This course develops the skills needed to deploy, administer, secure, and maintain identity services in a Windows Server environment. It covers Active Directory Domain Services (AD DS), domain controllers, DNS dependencies, Group Policy Objects (GPOs), certificate services, federation, and directory recovery.
Participants explore identity administration across multiple domains and locations, including replication, trust relationships, account protection, and service availability. The course also introduces rights management and directory synchronization for hybrid identity environments.
Duration 5 Days – 35 hrs.
Objectives
- Deploy and configure AD DS domain controllers.
- Manage users, groups, computers, and organizational units.
- Configure DNS components that support domain discovery and authentication.
- Administer domains, forests, trusts, sites, and replication.
- Implement GPOs to manage user and computer settings.
- Strengthen domain controller, account, and service account security.
- Deploy Active Directory Certificate Services (AD CS) and manage certificates.
- Configure Active Directory Federation Services (AD FS).
- Explain Active Directory Rights Management Services (AD RMS) and content protection.
- Plan directory synchronization between AD DS and Microsoft Entra ID.
- Monitor identity services, troubleshoot failures, and perform AD DS backup and recovery.
Target Audience
- Windows Server administrators.
- System administrators.
- IT infrastructure engineers.
- Active Directory administrators.
- IT support professionals responsible for Windows domain environments.
- Identity administrators expanding their knowledge of Windows Server identity services.
Prerequisites
- Practical experience administering Windows Server.
- Basic knowledge of Active Directory concepts and domain environments.
- Understanding of IP addressing, DNS, and DHCP.
- Familiarity with Windows client operating systems.
- Basic knowledge of server virtualization.
- Familiarity with security principles, permissions, and access control.
- Basic experience using Windows PowerShell.
Course Outline
Day 1: AD DS Deployment and Administration
Module 1: Installing and Configuring Domain Controllers
- AD DS architecture and core components.
- Forests, domains, directory partitions, and domain controllers.
- Deployment requirements and installation options.
- DNS zones, service records, and domain controller discovery.
- Global catalog and operations master roles.
- Read-only domain controller deployment considerations.
Module 2: Managing AD DS Objects
- User, group, and computer account administration.
- Organizational unit design and management.
- Group types, scopes, and nesting.
- Delegation of administrative permissions.
- Routine administration with graphical tools and PowerShell.
Module 3: Managing Advanced AD DS Infrastructure
- Multiple-domain and multiple-forest environments.
- Domain and forest functional levels.
- Trust relationships and authentication paths.
- User principal names and directory naming considerations.
Day 2: Sites, Replication, and Group Policy
Module 4: Configuring AD DS Sites and Replication
- Sites, subnets, and site links.
- Intrasite and intersite replication.
- Replication topology and global catalog placement.
- Replication monitoring and troubleshooting.
- DNS dependencies in distributed environments.
Module 5: Implementing and Administering Group Policy
- Group Policy architecture and processing.
- Creating, linking, and managing GPOs.
- Inheritance, enforcement, and processing order.
- Security filtering and Windows Management Instrumentation filtering.
- GPO backup, restoration, and troubleshooting.
Module 6: Managing User and Computer Settings
- Administrative templates and the Central Store.
- Group Policy preferences.
- Folder Redirection.
- Software deployment and policy-based scripts.
- Loopback processing and policy results.
Day 3: AD DS Security and Certificate Services
Module 7: Securing Active Directory Domain Services
- Domain controller protection and administrative delegation.
- Account policies and fine-grained password policies.
- Privileged group membership and least privilege.
- Authentication auditing.
- Managed and group managed service accounts.
- Security considerations for branch office environments.
Module 8: Deploying and Managing AD CS
- Public key infrastructure concepts.
- Enterprise and standalone certification authorities.
- Root and subordinate certification authority design.
- AD CS installation and configuration.
- Certification authority administration and maintenance.
- Certificate authority backup and recovery considerations.
Day 4: Certificates, Federation, and Rights Management
Module 9: Deploying and Managing Certificates
- Certificate templates and enrollment permissions.
- Manual enrollment and autoenrollment.
- Certificate renewal, revocation, and validation.
- Certificate revocation lists and distribution points.
- Key archival and recovery.
- Certificate-based authentication and smart card concepts.
Module 10: Implementing and Administering AD FS
- Claims-based authentication and federation concepts.
- AD FS infrastructure requirements.
- Federation service deployment and configuration.
- Claims provider and relying party trusts.
- Claims rules and application integration.
- Web Application Proxy concepts.
- Federation troubleshooting.
Module 11: Introducing AD RMS
- Rights management architecture and use cases.
- Infrastructure and deployment requirements.
- Rights policy templates.
- Content protection and client access.
- Administration and maintenance considerations.
Day 5: Hybrid Identity, Monitoring, and Recovery
Module 12: Implementing Directory Synchronization
- On-premises and cloud identity relationships.
- Microsoft Entra ID integration concepts.
- Directory readiness, identity matching, and synchronization scope.
- Microsoft Entra Connect Sync concepts.
- Synchronized identity administration.
- Synchronization monitoring and troubleshooting.
Module 13: Monitoring, Maintaining, and Recovering AD DS
- Domain controller health and directory service monitoring.
- Event logs and diagnostic tools.
- Authentication, DNS, and replication troubleshooting.
- Active Directory database maintenance.
- System state backups and recovery planning.
- Authoritative and nonauthoritative restoration.
- Active Directory Recycle Bin and deleted-object recovery.
- Domain controller and forest recovery considerations.
Integrated Capstone: Enterprise Identity Configuration and Recovery
- Extend a prepared AD DS environment for a branch office.
- Configure organizational units, delegated permissions, and GPOs.
- Apply account protection and certificate enrollment settings.
- Resolve a DNS, replication, or policy configuration issue.
- Recover a deleted directory object.
- Document the resulting configuration and recovery procedures.

