Plain English: Active Directory Domain Services is a centrally managed directory of people, computers, groups, policies, and trust relationships. It answers questions such as “Who is Alice?”, “Which computer is BBO-LABCTL?”, “Is this password valid?”, and “Which groups give this user access?”

Analogy: AD is not “a server with users on it.” Think of it as a government registry distributed across several city halls. The directory is the authoritative record. A Domain Controller is one office that carries a synchronized copy and can process most changes.

What you must be able to explain

Authentication asks: “Who are you?” Authorization asks: “Now that I know who you are, what may you do?” AD participates in both, but they are different problems.

Analogy: Authentication is showing your employee badge to the guard. Authorization is whether that badge opens the server room.

Security principals

Users, computers and security groups can be assigned permissions because Windows gives them security identifiers (SIDs). A SID is the durable security identity; the friendly name is a label administrators can change.

whoami /user
whoami /groups

The final portion of many domain-account SIDs is the RID, allocated from RID pools by DCs. This is why the RID Master FSMO role matters.

Kerberos vs NTLM

Modern AD primarily uses Kerberos for domain authentication. Kerberos uses tickets and relies heavily on DNS and synchronized time. NTLM is older and still appears in compatibility scenarios. When Kerberos breaks, DNS, SPNs and time are high-value suspects.

Directly granting file permissions to individual people works in a tiny lab but becomes difficult to audit. Enterprise environments prefer role-based group nesting.

Analogy: Do not hand every employee a unique handwritten key permission. Put employees into job-role clubs; give the club access to the door.

Group scopes

Core commands

Get-ADUser -Identity alice
Get-ADGroup -Identity "Production-Users"
Get-ADGroupMember -Identity "Production-Users"
Get-ADPrincipalGroupMembership -Identity alice
Add-ADGroupMember -Identity "Production-Users" -Members alice

AD is mostly multi-master: multiple writable DCs can accept many directory changes. Five operations are intentionally single-master at a given moment. Those are the FSMO roles.

The five FSMO roles

netdom query fsmo
Get-ADForest | Select SchemaMaster,DomainNamingMaster
Get-ADDomain | Select PDCEmulator,RIDMaster,InfrastructureMaster

Global Catalog

A GC stores a full copy of objects in its own domain plus a partial attribute set for objects in other forest domains. It supports forest-wide searches and some logon scenarios.

Get-ADDomainController -Filter * | Select HostName,Site,IsGlobalCatalog,IPv4Address

AD does not merely use DNS to turn names into IP addresses. It publishes service records so clients can discover LDAP, Kerberos, Global Catalog and DC services.

Analogy: Ordinary DNS is a street map. AD-integrated DNS is the street map plus a directory saying “passport office here, court here, police station here.”

Key zones and records

bbo.test holds normal host/service records. _msdcs.bbo.test contains AD/DC locator data. SRV records begin with service/protocol labels such as _ldap._tcp.

Get-DnsServerZone
Resolve-DnsName BBO-SRV01.bbo.test
Resolve-DnsName -Type SRV _ldap._tcp.dc._msdcs.bbo.test
nltest /dsgetdc:bbo.test

Client DNS rule

Domain members and DC candidates should use internal AD DNS servers. Pointing a domain client only at 8.8.8.8 may resolve Microsoft.com while making bbo.test invisible.

PowerShell is a shell, scripting language and automation environment. The biggest mental shift is that PowerShell usually passes objects, not lines of text.

Analogy: Command Prompt often gives you printed labels on boxes. PowerShell gives you the actual boxes, with properties you can inspect and actions you can perform.

Get-Service
Get-Service | Get-Member

Get-Member reveals the object's type, properties and methods. That is one of the fastest ways to stop guessing.

Competent PowerShell use is not memorizing every cmdlet. It is knowing how to discover the command and inspect its syntax safely.

Get-Command *ADUser*
Get-Command -Verb Get
Get-Help Get-ADUser
Get-Help Get-ADUser -Examples
Get-Help Get-ADUser -Full

Verb-Noun: PowerShell cmdlets usually follow approved verbs such as Get, Set, New, Remove, Add, Test, Invoke and Export.

The pipeline operator | sends output objects from one command to the next command.

Analogy: Imagine an assembly line. Get-Service places service objects on the belt. Where-Object removes objects you do not want. Sort-Object arranges them. Select-Object packages only the fields you care about.

Get-Service |
  Where-Object Status -eq 'Running' |
  Sort-Object DisplayName |
  Select-Object Name,DisplayName,Status

The multiline format is one statement. A pipe at the end of a line naturally indicates continuation in modern PowerShell; backticks can also continue lines, but trailing whitespace after a backtick is a common source of mistakes.

Core transformations

Get-Process | Select-Object Name,CPU,WorkingSet64
Get-Service | Where-Object Status -eq 'Stopped'
Get-Process | Sort-Object CPU -Descending
Get-ChildItem C:\Windows | Measure-Object -Property Length -Sum
Get-EventLog -LogName System -Newest 20

Where-Object decides which objects survive. Select-Object decides which properties are displayed/emitted.

$server = 'BBO-SRV01'
$services = Get-Service
$ports = 53,88,389,445
$config = @{
    Domain = 'bbo.test'
    DnsServer = '192.168.219.10'
}

Variables hold references to values/objects. Inspect them with Get-Variable or their type with:

$services.GetType()
$server.GetType()

SecureString

Read-Host -AsSecureString prevents casual plaintext display, but a SecureString is not magic irreversible secrecy. Code in the same security context can often convert it. Use it to reduce accidental exposure, not as a password vault.

Escaping uses the PowerShell backtick. Backticks also continue a physical line, but they are fragile if whitespace follows them.

Microsoft Entra ID is Microsoft's cloud identity and access directory. It is not simply “Active Directory in Azure,” and it does not use the same architecture/protocol assumptions as AD DS.

Analogy: AD DS is the badge office inside your private corporate campus. Entra ID is the identity authority used at cloud buildings all over the world. Hybrid identity lets one employee identity participate in both environments.

Tenant, directory and subscription are related but distinct concepts. Your Entra tenant is the identity directory; Azure subscriptions are billing/resource containers that trust a tenant for identities.

Entra users can be cloud-only or synchronized from on-prem AD. Groups can be assigned or dynamic depending on licensing/capability.

Roles are not groups

Entra administrative roles grant control-plane privileges such as User Administrator or Conditional Access Administrator. Security groups primarily organize principals and authorize resources/app assignments.

Analogy: A security group is a club membership. An admin role is a set of master-office duties.

These three states solve different problems.

You encountered this directly when BBO-LABCTL was accidentally Entra joined during OOBE. To make it a hybrid-management workstation, we disconnected that state, returned it to standalone, pointed DNS to AD, and prepared it for bbo.test domain join.

dsregcmd /status

Key fields include AzureAdJoined, DomainJoined, tenant/device details and SSO state.

Cloud identity security is not just a password. Entra supports MFA, authentication methods, Self-Service Password Reset and passwordless methods such as FIDO2/passkeys and Windows Hello for Business depending on scenario.

Analogy: Password = something you know. Security key/phone/biometric = additional evidence or a stronger key. Conditional Access decides when stronger evidence is required.

Operational distinction

Authentication-method registration, authentication success and authorization to a resource are separate stages. Sign-in logs help show what happened.

Conditional Access evaluates signals and applies grant/session controls. A policy can consider user/group, target resource, device platform, location, risk and device state.

Analogy: The badge is valid, but the building guard also checks whether you are at the right door, using an approved laptop, and whether a second factor is required.

Microsoft Intune is a cloud endpoint-management service. It manages devices, applications, configuration, compliance and security posture.

Analogy: Entra gives the employee/device a cloud identity badge. Intune is the fleet-management department that decides how the company laptop must be configured, what software it receives and whether it meets safety inspection.

Portal “Succeeded” is not enough. Always verify the effect on the Windows endpoint.

Endpoint management has a lifecycle: provision/enroll → configure → protect → support → update → retire/wipe.

Enrollment questions

• Who owns the device?
• What is its Entra join state?
• How is MDM enrollment initiated?
• Which user is primary/assigned?
• What license and enrollment restrictions apply?

Hybrid-joined Windows devices can be automatically enrolled into Intune through supported MDM auto-enrollment configuration, often using Group Policy plus Entra/Intune prerequisites.

Before blaming Intune, prove the device identity state.

dsregcmd /status

For the planned hybrid state, you ultimately want both:

DomainJoined : YES
AzureAdJoined : YES

Also verify the signed-in user, tenant details and SSO sections. If the device is only Entra joined or only AD joined, the enrollment path may differ.

Most Intune configuration is useless until it is assigned to the correct user/device group.

Analogy: Creating a company policy document does nothing until you specify which departments must follow it.

Assignment thinking

• User-targeted vs device-targeted
• Include vs exclude groups
• Test/pilot rings before broad rollout
• Filters where appropriate
• Avoid mixing overlapping policies without understanding precedence/conflict

Configuration profiles push Windows settings from Intune. Settings Catalog exposes a large set of policy-backed settings.

Safe first lab

1. Create a clearly visible, low-risk setting profile.
2. Assign only to the BBO-LABCTL pilot group.
3. Sync the device.
4. Verify the setting locally.
5. Check per-setting/device status in Intune.

Troubleshooting: If a policy is assigned but not effective, check device check-in, targeting, conflicts, applicability, CSP/MDM diagnostic logs and whether another management layer such as GPO is controlling the same setting.

A configuration policy tries to set something. A compliance policy generally evaluates whether the device meets a rule and marks it compliant/noncompliant.

Analogy: Configuration is the mechanic adjusting tire pressure. Compliance is the vehicle inspection checking whether tire pressure meets the standard.

Lab

Define one testable compliance requirement, observe BBO-LABCTL's state, intentionally violate it if safe, observe noncompliance, remediate, and verify return to compliant.

Azure DevOps (ADO) combines work tracking, source control, pipelines, artifacts and collaboration around delivery.

Analogy: Think of a factory: Boards is the work-order system, Repos is the controlled blueprint cabinet, Pipelines is the automated assembly line, Artifacts is the parts/package warehouse, and permissions determine who can enter each area.

For IT Operations, ADO is useful for change tracking, automation scripts, infrastructure code, runbooks and repeatable deployments—not only software development.

An ADO organization contains projects. Projects contain repos, boards, pipelines and teams. Access levels and permissions are related but distinct.

Analogy: Access level is which building package your badge pays for; permissions are which rooms you may enter.

Boards tracks work and state. Common hierarchy varies by process template, but Agile often uses Epic → Feature → User Story → Task/Bug.

BBO example

Use Area Paths for ownership/functional areas and Iteration Paths for timeboxes/sprints.

Queries answer questions across work items: open incidents, items assigned to you, blocked tasks, overdue work, work by area, etc.

Dashboards surface charts, queries and status widgets for a team.

Useful IT Ops queries

• Open P1/P2 incidents
• Changes awaiting validation
• Automation bugs
• Work assigned to current iteration
• Items tagged AD / Intune / Entra

Git tracks versions of files through commits. A repository is not simply a shared folder.

Analogy: A commit is a labeled photograph of the project state plus the history linking it to previous photographs. A branch is a movable pointer to one line of development.

Core workflow

git clone ...
git status
git switch -c feature/bbo-health-check
git add .
git commit -m "Add initial AD health check"
git push -u origin feature/bbo-health-check

Understand working tree, staging area, commit, local branch, remote branch and pull/push before memorizing commands.

Azure Repos hosts Git repositories with Azure DevOps permissions/policies.

Simple BBO structure

• main = accepted/working administrative scripts and documentation
• feature branches = changes under development
• pull requests = review/merge gate

A small lab does not need an elaborate GitFlow model. Prefer a simple branch/PR discipline you can explain.