Free to read · Three levels

Active Directory Domain Services: identity, policy, and reliable operations

A complete AD DS theory course covering forests, protocols, policy, delegation, replication, security, recovery, and evidence-based troubleshooting.

18 lessonsEnglish + ArabicContent reviewed
Start learning

In this course

Eighteen substantial bilingual lessons distinguish AD DS from Microsoft Entra ID and from a general Windows Server overview. Original offline Python models, non-runnable planning records, mistakes, and worked exercises explain relationships without acting on an actual directory.

The reference baseline is Microsoft Windows Server 2025 AD DS documentation reviewed on 2026-10-26. Controller OS, schema, functional levels, client/application support, and current security guidance are treated as separate requirements. Python 3.12 local-model verification does not certify any Windows, DNS, LDAP, Kerberos, policy, replication, or restore behavior.

What you will learn

  • Separate logical boundaries, identities, permissions, and physical topology.
  • Explain GPO, AD/SYSVOL replication, trusts, and supported evidence interpretation.
  • Review privileged paths, protocol protections, and recovery readiness without unsafe shortcuts.
  • Build a bounded troubleshooting and change record with explicit unknowns and validation limits.

Your learning path

Three levels

Basic

Understand AD DS identity, logical structure, naming, discovery, protocols, and resource relationships.

  1. AD DS and identity boundaries
  2. Domains, forests, and functional levels
  3. OUs, objects, and directory names
  4. DNS and domain-controller discovery
  5. LDAP, Kerberos, and sign-in flow
  6. Accounts, groups, and resource access
Explore this level

Intermediate

Reason about policy, delegation, replication, sites, SYSVOL, and cross-boundary access.

  1. Group Policy scope and processing
  2. Delegation and administrative boundaries
  3. Replication, partitions, and operation masters
  4. Sites, subnets, and replication topology
  5. SYSVOL, DFSR, and policy consistency
  6. Trusts and cross-domain access
Explore this level

Advanced

Review privileged security, hardening, recovery, monitoring, controlled change, and diagnosis.

  1. Privileged access, tiering, and control-plane security
  2. Directory hardening and service identities
  3. Backup and forest recovery
  4. Monitoring and evidence correlation
  5. Controlled changes and functional-level planning
  6. Systematic directory troubleshooting
Explore this level

Who this is for

  • Learners who understand basic networking and want a rigorous AD DS identity model.
  • Administrators and support learners reviewing directory design and troubleshooting before authorized lab practice.

Before you start

  • Basic IP/DNS, authentication/authorization concepts, and familiarity with users, groups, and operating systems.
  • Python 3.12 for local models; no domain, Windows host, credentials, network service, or administrative tooling is required.

Related technical solutions

Separate controller discovery from authentication failureCompare the failing client’s actual evidence categories before changing an account, assuming a password problem, or treating public DNS success as domain discovery.Diagnose a GPO that is not observedSeparate policy eligibility from retrieval and client processing before changing link order, filters, inheritance, or permissions.Separate directory replication from SYSVOL evidenceName the affected partition and direction, preserve the two policy components, and avoid treating a stale snapshot as authority to force synchronization or restore a controller.