Deploy and manage identity infrastructure

Learn about the fundamentals of Active Directory Domain Services (AD DS) in Windows Server, including forests, domains, sites, domain controllers, organizational units (OUs), users, and groups.

This module covers how to deploy and manage AD DS domain controllers and FSMO roles. You learn how to deploy domain controllers in on-premises environments using Server Manager and the AD DS Configuration Wizard, maintain domain controller availability through backup and recovery procedures, manage the global catalog role and its placement across sites, understand and manage the five FSMO roles (schema master, domain-naming master, RID master, infrastructure master, and PDC emulator), transfer FSMO roles between domain controllers and seize roles in emergency scenarios, and manage and extend the AD DS schema.

Learn to implement Group Policy Objects (GPOs) in Active Directory Domain Services (AD DS).

This module covers advanced Active Directory Domain Services (AD DS) administration tasks. You learn how to create and manage trust relationships including external, forest, and realm trusts, implement Enhanced Security Administrative Environment (ESAE) forests to protect privileged accounts using the clean-source principle, monitor and troubleshoot AD DS replication using Performance Monitor, Repadmin.exe, and Dcdiag.exe, and create custom AD DS application partitions using NtdsUtil.exe.

This module covers how to implement hybrid identity by integrating on-premises AD DS with Microsoft Entra ID. You learn how to select from Microsoft Entra integration models including extending AD DS to Azure, directory synchronization, password hash sync, and federation with AD FS, plan and prepare on-premises AD DS for synchronization with Microsoft Entra Connect, configure seamless single sign-on (SSO) and pass-through authentication, enable Microsoft Entra ID login for Azure VMs, and implement Microsoft Entra Domain Services for Kerberos authentication, LDAP, and Group Policy in the cloud without deploying domain controllers.

This module covers how to implement Active Directory Domain Services (AD DS) domain controllers on Azure virtual machines. You learn how to choose between deploying a standalone Azure forest or extending an on-premises environment into Azure, configure cross-premises connectivity using site-to-site VPN or ExpressRoute, and plan for AD DS sites, trust relationships, read-only domain controllers (RODCs), FSMO role placement, and global catalog servers. You also walk through the steps to install a replica domain controller and create a new AD DS forest in Azure.