CyberPatriot Resources · Resource 03
Windows Server & Active Directory
Use Microsoft Learn to understand Windows Server roles, Active Directory Domain Services, privileged identities, DNS, Group Policy, shares, auditing, and secure administration.
In competition work, documentation should help you understand what a component does and what depends on it before you make a change. The scenario still determines what must remain enabled, authorized, and functional.
Resource Goal
Server resource rule
Understand the dependency before changing the server
A server role, domain account, DNS setting, share, or GPO can affect many other systems. Use documentation to identify purpose and scope, then make only mission-compatible, evidence-backed changes.
Official Microsoft references
Start with the documentation maintained by Microsoft
These references are useful for learning architecture, role dependencies, identity security, DNS, and evidence sources.
Active Directory Domain Services overview
Microsoft's overview of AD DS, directory objects, domains, forests, and how directory services organize identity information.
Open Microsoft Learn →
Install Active Directory Domain Services
Official Server Manager and PowerShell guidance for installing AD DS on supported Windows Server releases.
Open Microsoft Learn →
Best practices for securing Active Directory
Microsoft guidance on privilege, attack-surface reduction, monitoring, secure administration, and recovery planning.
Open Microsoft Learn →
Reducing the Active Directory attack surface
A focused Microsoft reference for least privilege, privileged accounts, secure administrative hosts, and reducing exposure.
Open Microsoft Learn →
Monitoring Active Directory for signs of compromise
Useful background for audit policy, event monitoring, and understanding evidence in an AD environment.
Open Microsoft Learn →
DNS and Active Directory Domain Services
Explains why DNS is fundamental to domain-controller discovery and communication inside Active Directory.
Open Microsoft Learn →
What to study
Focus on the concepts that affect competition decisions
Roles & Features
Users & Groups
Active Directory Structure
Group Policy
DNS & Name Resolution
Shares & Permissions
Competition use
Use the documentation to answer the question behind the finding
When a privileged account looks suspicious
Confirm whether the account is approved by the scenario.
Check direct and indirect privileged-group membership.
Determine whether the identity is a service or automation account.
Preserve relevant account-change evidence.
Make the narrowest justified change and verify required administration still works.
When a server role looks unnecessary
Identify what role or feature is installed.
Determine whether the scenario or another required service depends on it.
Check current service state and recent evidence.
Do not remove the role simply because it is unfamiliar.
If a change is justified, verify the mission function afterward.
When domain authentication fails
Check basic network reachability.
Check DNS configuration and name resolution.
Confirm domain-controller services are healthy.
Review authentication and system logs.
Avoid unrelated account or policy changes until the dependency chain is understood.
When share access is wrong
Identify the required share and approved users.
Review share permissions.
Review NTFS permissions.
Check group membership that affects effective access.
Test the expected user path after any change.
Quick reference map
Know where to look when you need evidence
Identity
Services
Policy
Network
Evidence
Event IDs
Useful Windows Server evidence references
Event IDs are clues, not conclusions. Interpret them with the account, system, timestamp, scenario, and surrounding events.
4624
Successful logon
4625
Failed logon
4672
Special privileges assigned to a new logon
4720
User account created
4722
User account enabled
4725
User account disabled
4728
Member added to a global security group
4732
Member added to a local security group
5140
Network share accessed
7045
Service installed
Weak habit vs better habit
Use documentation to improve judgment, not replace it
Weak habit
Remove unfamiliar domain accounts immediately.
Better habit
Classify the identity, review scenario authorization, privilege, dependencies, and evidence before changing it.
Weak habit
Disable server roles that are not obviously needed.
Better habit
Identify the role's mission purpose and dependencies before changing the server.
Weak habit
Fix domain logon problems by resetting accounts first.
Better habit
Check network and DNS dependencies before assuming the account itself is the problem.
Weak habit
Use Domain Admin for convenience.
Better habit
Apply least privilege and protect highly privileged accounts from unnecessary everyday use.
Weak habit
Change a GPO because one machine has the wrong setting.
Better habit
Confirm whether the issue is local or domain-wide and understand the GPO's scope before editing it.
Weak habit
Only check share permissions when access is wrong.
Better habit
Review both share and NTFS permissions plus group membership to understand effective access.
Windows Server resource checklist
Build a reference habit that protects mission dependencies
Use Microsoft Learn as the primary Windows Server and AD reference.
Understand the role of AD DS before changing directory objects.
Treat Domain Admins, Enterprise Admins, and Administrators as highly sensitive groups.
Use least privilege for routine administration.
Preserve required server roles and services.
Check DNS when domain services or authentication behave unexpectedly.
Review both share and NTFS permissions.
Treat broad Group Policy changes as high impact.
Use Event Viewer and audit evidence to support conclusions.
Protect service accounts and understand their dependencies.
Verify required domain functionality after meaningful changes.
Use documentation to learn concepts, not to justify a change that conflicts with the competition scenario.