1. Install and configure #
Start on the right foot.
Checklist #
- Supported Windows Server version, Server Core by default, minimal roles.
- Consistent naming (
SRV-ROLE-NN), static IP, internal DNS, time synced on the PDC emulator. - Configuration described as code: PowerShell scripts, DSC, or Ansible for Windows, versioned in Git.
- Remote administration (Windows Admin Center, PowerShell Remoting) from a dedicated admin workstation.
2. Identity and access #
Protecting Active Directory protects everything else.
The tier model #
- At least two domain controllers, backed up (system state) and monitored (
dcdiag,repadmin). - Named admin accounts separate from mailbox accounts, “Domain Admins” almost empty, MFA for privileged access.
- Windows LAPS on all servers and PCs, gMSAs for services, AD Recycle Bin enabled.
- Rights granted to groups (AGDLP), delegation on OUs rather than domain admin rights.
- Quarterly review: inactive accounts, privileged group members, PingCastle score.
3. Operate #
Day to day.
Updates, security, backup #
| Area | Practice | Check |
|---|---|---|
| Updates | monthly rings after Patch Tuesday | Get-HotFix, WSUS or Azure Update Manager report |
| Security | Microsoft baseline, SMBv1 absent, BitLocker, Defender up to date | Get-MpComputerStatus, manage-bde -status |
| GPOs | one GPO per topic, pilot OU, GPO backups | gpresult /h, Backup-GPO -All |
| Storage | mirror for live data, alerts at 80% | Get-Volume, Get-VirtualDisk |
| Backup | 3-2-1 with an immutable copy, monthly restore test | wbadmin get versions |
| Logs | larger sizes, advanced audit, centralization | Get-WinEvent, SIEM |
| Monitoring | CPU, memory, disk, services, certificates, AD replication | Prometheus windows_exporter, Zabbix, Azure Monitor, Dynatrace |
Good practice: Document each server (role, owner, dependencies, restart and restore procedure) and each change. A written, tested procedure beats one person’s expertise.
Commands to know #
| Action | Command |
|---|---|
| Quick server check | Get-ComputerInfo -Property OsName, OsUptime, CsTotalPhysicalMemory |
| Stopped automatic services | Get-Service | Where-Object { $_.StartType -eq 'Automatic' -and $_.Status -ne 'Running' } |
| Disk space | Get-Volume | Where-Object DriveLetter |
| AD health | dcdiag /e /q ; repadmin /replsummary |
| Inactive accounts | Search-ADAccount -AccountInactive -TimeSpan 90.00:00:00 |
| Certificates expiring soon | Get-ChildItem Cert:\LocalMachine\My | Where-Object NotAfter -lt (Get-Date).AddDays(30) |
| Recent errors | Get-WinEvent -FilterHashtable @{LogName='System'; Level=2; StartTime=(Get-Date).AddDays(-1)} |
My progress
Sign in to track your progress and take notes. Sign in
💬 Questions about this lesson
No questions yet: be the first to ask for help or share your configuration.
Recommended Articles
Group Policy (GPO): configuring the estate from Active Directory
Design and troubleshoot Group Policy: computer and user configuration, OU linking, LSDOU order, i...
Active Directory Domain Services and DNS
Understand and deploy Active Directory: forest, domains, organizational units, domain controllers...
Backup, Hyper-V and Windows troubleshooting
Back up and restore with Windows Server Backup (including system state and Active Directory), vir...
Windows updates and security: WSUS, Defender, BitLocker, LAPS and hardening
Maintain and secure a Windows estate: update strategy (Windows Update, WSUS, Azure Update Manager...
PowerShell for Windows administrators
Master PowerShell to administer Windows: cmdlets and help, object pipeline, filters and formats, ...
Windows and Windows Server: versions, editions and architecture
Discover the Windows ecosystem for administrators: Windows 11 and Windows Server 2025, editions a...
Windows storage: disks, volumes, Storage Spaces and RAID
Manage storage on Windows: GPT and MBR, partitions and volumes with PowerShell, NTFS and ReFS, St...
Windows networking: IP, DNS, DHCP, firewall and remote access
Configure and troubleshoot Windows networking with PowerShell, deploy a DHCP server, master Windo...
Users, groups, NTFS permissions and SMB shares
Manage local accounts and groups, understand UAC, apply NTFS permissions with inheritance, create...