Active Directory
How office logins and user accounts are managed behind the scenes, plus server upgrades and cleanup.
- Tech basicsSecurity alert
Install October's Windows updates: an exploited flaw lets a booby-trapped file skip Windows' safety warning
Microsoft says attackers are already exploiting a Windows Shell flaw that bypasses Mark of the Web. Here is what that means, which updates fix it, and how to check your PCs.
- Field notes
Field note: auto-disabling inactive AD accounts, and why the first run was report-only
An audit wanted inactive accounts disabled automatically. The first dry run flagged 65 accounts, including a domain trust account and a pile of VPN accounts that were rarely used but very much needed.
- Field notes
Field note: a screen lock GPO with an exemption group, and the Kerberos ticket that has to come first
An audit required a 30-minute screen lock on every domain PC, except the dispatch consoles. Linking the GPO at the domain root with a deny for an exemption group worked, but only after the exempt machines picked up their new group membership.
- Field notes
Field note: the whole building's clock was 20 minutes off
Every PC in a building drifted because the domain controller handing out time was trusting its own failing hardware clock.
- Field notes
Field note: two Microsoft 365 accounts for one person, and two different fixes
Directory sync left a user with a duplicate account twice, in two different shapes. Here's how to tell which shape you have and how each one was fixed.
- Active DirectorySecurity alert
Two Windows flaws from September Patch Tuesday are being exploited
Microsoft confirmed attacks using two Windows privilege-escalation flaws fixed on September 8. If your September updates aren't installed yet, install them now.
- Field notes
Field note: the domain controller that couldn't take a new partner
The plan was simple, add a new domain controller and retire the old one. An old replication setting nobody had thought about in years stood in the way.
- Field notes
Field note: why one user kept getting locked out
A user's account kept locking, over and over, with nothing wrong on her end. The cause was a password spray, and how the directory checked those failed sign-ins.
- Field notes
Field note: "This username may be incorrect"
A user couldn't sign in to Microsoft 365 with her own email address. Years of account changes had left her sign-in name and email address pointing different directions.
- Active Directory
Separate admin accounts and the Protected Users group, for small shops
Why your everyday login shouldn't be a Domain Admin, how to split admin accounts without a big project, and how to use Protected Users without locking yourself out.
- Active Directory
Windows LAPS: a unique local admin password on every PC, built into Windows
Stop using the same local administrator password everywhere. Windows LAPS rotates it automatically and stores it in Active Directory, and it's already built into Windows.
- Useful scripts
Everyday Active Directory PowerShell commands (read-only)
Copy-and-paste PowerShell commands for the Active Directory questions that come up every week, from locked-out users to stale accounts and domain controller health. Nothing here changes anything.
- Active Directory
Replacing old domain controllers with Server 2025, step by step
Server 2016 support ends January 12, 2027. A safe step-by-step for moving a small domain to Server 2025 or 2022 domain controllers.