Field notesAUWENSearch
Explore Systems
← tools

Windows Server & Active Directory

Understand identity, access, DNS, and policy before changing a domain.

3 lessons published · Updated 2026-09-14

Before you begin

Begin with the PowerShell command desk. Use a disposable Windows Server lab and an ordinary account. AD queries require the ActiveDirectory RSAT module, a reachable lab domain controller, and permission to read the objects. Local inventory works without a domain.

Working toward: Operate a small domain with delegated administration, tested recovery, and documented policies.

Read each explanation, run the example in your own lab, and attempt the exercise before opening its answer. Published lessons are ready to study; unfinished roadmap topics remain planned.

Validation: Based on upstream documentation. Platform-specific labs require the learner’s matching environment and are not execution-tested here.

1. Identify the machine and account

A domain stores shared identities and policies. A local account belongs to one computer; a domain account is managed through the directory. Authentication establishes who you are; authorization decides what you may do. Collect evidence before assuming a login failure is a password problem.

whoami
whoami /groups
Get-CimInstance Win32_ComputerSystem | Select-Object Name, Domain, PartOfDomain
Get-Service Netlogon

What to expect

Your current identity, group memberships, and whether the machine belongs to a domain. Netlogon status varies by machine role.

Your turn

Explain why a successful login does not guarantee access to a shared folder.

Show answer and reasoning
The identity may authenticate successfully but lack share or NTFS permissions. Group membership and explicit denies can affect access. Inspect both permission layers.

Watch for: Do not use a domain administrator account for routine browsing or every diagnostic command.

Link to this lesson

2. Read the directory

AD stores objects with attributes, including users, groups and computers. An organisational unit helps scope administration and policy; it is not the same thing as a security group. These queries read the lab domain and the signed-in user.

Import-Module ActiveDirectory
Get-ADDomain | Select-Object DNSRoot, NetBIOSName
Get-ADUser -Identity $env:USERNAME -Properties Enabled | Select-Object Name, SamAccountName, Enabled

What to expect

The lab domain and a matching user object. A local account or different logon name may not match; replace the identity with a known lab user.

Your turn

Which would you use to grant access to a shared folder: an OU or a security group?

Show answer and reasoning
Use a security group in the access-control list. An OU is a directory container used for organisation, delegation, and Group Policy scope.

Watch for: A failed query may mean missing RSAT, connectivity, identity mismatch or insufficient rights. Do not “fix” it by granting broad privileges.

Link to this lesson

3. Separate DNS, time and policy

Domain services depend on name resolution and time. Group Policy results describe settings that applied, rather than settings you merely intended to configure. Start with read-only observations and record the exact error and timestamp.

Get-DnsClientServerAddress
w32tm /query /status
gpresult /r

What to expect

Configured DNS servers, time synchronization details, and available policy results. Computer-level policy details may require an elevated lab session.

Your turn

A client uses a public DNS resolver and cannot locate its private domain. What should you investigate?

Show answer and reasoning
Check that the client uses the intended domain-aware DNS service and can resolve the lab domain’s service records. Verify network reachability before changing the configuration.

Watch for: Do not replace domain DNS with a public resolver as a blanket troubleshooting step.

Link to this lesson

Path to advanced

In-progress stages identify the lessons already published. All other listed topics remain planned. Each addition needs teaching, a reproducible lab, failure cases, and a checkpoint before the capstone.

  1. Build a domain

    Install an isolated lab, configure DNS and time, join a client, and document the dependency chain.

    PLANNED

  2. Delegate access

    Create test users, groups and organisational units; scope Group Policy and use least privilege.

    PLANNED

  3. Operate and recover

    Diagnose replication, rotate credentials, patch deliberately, and test supported directory recovery.

    PLANNED

References

Original AUWEN lessons, with upstream documentation for further study and version checks.

All learning paths and update notes →