Windows Server & Active Directory

Our help desk resets passwords and unlocks accounts all day long. When we take over a small or mid-sized domain, the most common over-privilege I find is the help desk (or the office manager who does it on the side) sitting in Domain Admins just so they can do that. AD has had granular delegation since Windows 2000, and it takes a few minutes to set up. Further down is a related trick I use from the RMM a lot: getting a machine, and scripts running as SYSTEM on it, to pick up a new group membership without rebooting someone's PC in the middle of their day. Delegating resets and unlocks You'll need Domain Admin once to set it up, users organised into OUs so you can scope…

The VPN, the remote access portal, the copier that does scan-to-email, the wiki, the helpdesk system. Anything that looks people up in AD needs an account to bind with, and in a lot of environments we inherit, that account belongs to an actual person. Usually whoever set it up. It works fine until they change their password at the 90-day prompt, mistype it on their phone and lock themselves out, or leave. Then everybody's logins to that system break at once. It's messy in quieter ways too. The logs show that person "logging in" thousands of times a day, and because those accounts are often admins, the appliance ends up holding admin credentials. What we do instead is bor…

Time problems never show up as "the clock is wrong". They show up as a user who randomly can't authenticate, Group Policy that stops applying, or me trying to line up firewall logs against server logs and finding them minutes apart. Kerberos tolerates five minutes of clock skew by default, and past that things get weird fast. The design is simple once you see it. The DC holding the PDC emulator role in the forest root domain syncs to a reliable external NTP source. Every other DC syncs from the PDC emulator, or another DC higher up the hierarchy. Member servers and workstations sync from a DC in their domain, and that part happens on its own for domain-joined machines. S…

A lot of the AD calls we get start the same way. Someone at the front desk says a user "only sometimes" can't get into an app, or a new hire's drive mappings never show up. When we dig in, it's rarely anything exotic. It's replication that quietly stopped weeks ago, a DC nobody noticed was heading for tombstone, or SYSVOL that never finished moving to DFSR. I run this same check on every domain we take on, and again any time something is flaky. You'll want a DC or a management box with RSAT (AD DS tools), an account in Domain Admins (or delegated rights to read replication metadata), and an elevated prompt or PowerShell window. Start with dcdiag across the whole enterpr…