Docs

Appearance

Active Directory Operations Guide ​

Overview ​

Active Directory (AD) is the on-premises identity backbone. It runs on Windows Server domain controllers in the PROD Azure environment and syncs to Entra ID via Entra Connect.

Kevin and Greg are the T1 Domain Admins — they own AD operations. This guide is for Rory (and any future IT engineer) to understand AD well enough to investigate issues, run read-only diagnostics, and handle basic operations when Kevin and Greg are unavailable.

For cloud identity operations (Entra ID, groups, PIM, Conditional Access) see Entra Identity Operations.

Domain Information ​

PropertyValue
Domain nameciriusgroup.internal
NetBIOS nameCIRIUSGROUP
Forest rootciriusgroup.internal
Functional levelWindows Server 2016 (or higher — verify current)
Domain controllersSee DC list below

Domain Controllers ​

ServerRoleLocationNotes
Primary DCPDC Emulator, RID Master, Schema Master, Domain Naming MasterAzure PROD — vnet-identityWritable DC — primary operations
RODCRead-Only Domain ControllerAzure PROD — vnet-rodcDMZ-facing; read-only; no cached domain admin passwords
DR DC (CGIRDPAZP01)Replica DCAWS Prod accountDR environment; syncs from primary

Exact server names and IPs are in the network topology docs. Access via Twingate + RDP.

FSMO Roles ​

The five FSMO (Flexible Single Master Operations) roles control specific domain functions. Knowing where they live helps diagnose AD issues.

RoleHolderWhat It Does
Schema MasterPrimary DCControls schema modifications (adding new AD attributes)
Domain Naming MasterPrimary DCControls adding/removing domains from the forest
PDC EmulatorPrimary DCTime sync source, password changes, account lockout processing
RID MasterPrimary DCIssues blocks of relative IDs for new objects
Infrastructure MasterPrimary DCUpdates cross-domain group membership references

To verify FSMO role holders:

powershell
# Run from any domain-joined machine with AD tools
netdom query fsmo
# Or:
Get-ADDomain | Select PDCEmulator, RIDMaster, InfrastructureMaster
Get-ADForest | Select SchemaMaster, DomainNamingMaster

If the PDC Emulator goes down, time sync for all domain members will drift and Kerberos authentication will fail within 5 minutes (Kerberos tolerance is 5 minutes). Ensure the DR DC can be promoted to PDC Emulator if needed.

Checking AD Health ​

Replication Status ​

powershell
# Check replication status between all DCs
repadmin /replsummary

# Force immediate replication
repadmin /syncall /AdeP

# Check for replication errors
repadmin /showrepl

A healthy output shows No Errors for all partitions. Replication errors that persist more than 1 hour need investigation — stale AD data can cause authentication failures.

DC Diagnostics ​

powershell
# Run full DC health check (takes 5-10 minutes)
dcdiag /test:all

# Check specific tests
dcdiag /test:replications
dcdiag /test:netlogons
dcdiag /test:dns

dcdiag passes should all show passed. FAILED or WARNING results indicate problems.

AD Services Status ​

On the DC directly:

powershell
# Check critical AD services
Get-Service -Name "ADWS", "DFSR", "DNS", "Kerberos", "LanmanServer", "Netlogon" | Format-Table Name, Status

All should be Running. NetLogon and ADWS (Active Directory Web Services) being stopped will break authentication and LDAP queries respectively.

Group Policy (GPO) ​

GPOs apply settings to computers and users in Organizational Units (OUs).

Viewing GPOs ​

Group Policy Management Console (GPMC) — on the DC or any machine with RSAT tools:

gpmc.msc

Navigate: Forest → Domains → ciriusgroup.internal → Group Policy Objects

Key GPOs in use:

GPOApplies ToPurpose
Default Domain PolicyAll domain objectsBase password policy, account lockout
Security BaselineServers OUWindows security hardening (aligned to CIS)
Audit PolicyAll serversEventID 4688, 4624, 4648, 4698, 7045, 1102 enablement
Kill Chain LoggingAll serversPowerShell script block logging (4104), LSASS auditing

Do not modify GPOs without Kevin or Greg's involvement. A bad GPO can lock out all machines in an OU.

Checking Which GPO Applies to a Machine ​

powershell
# On the target machine
gpresult /r /scope:computer

# Get full GPO report as HTML
gpresult /h "C:\Temp\gpo-report.html"

This shows which GPOs are applied and in what order (last writer wins for conflicting settings).

Forcing a GPO Update ​

If you change a GPO and want it applied immediately instead of waiting for the 90-minute refresh cycle:

powershell
# On the target machine (or via remote)
gpupdate /force
Invoke-GPUpdate -Computer "COMPUTERNAME" -Force   # remote

Organizational Units (OU) Structure ​

OUs control which GPOs apply and how objects are organized. The rough structure:

ciriusgroup.internal
├── Computers
│   ├── Servers          ← Production servers, DCs
│   ├── Workstations     ← Staff laptops and desktops
│   └── DR              ← DR machines (CGIRDPAZP01, BIZARCAZP01)
├── Users
│   ├── Staff            ← Regular user accounts
│   ├── ServiceAccounts  ← svc-* accounts
│   └── Disabled         ← Offboarded accounts awaiting deletion
└── Groups
    ├── Security         ← Security groups used for access control
    └── Distribution     ← Distribution groups (mail-enabled)

When creating a new object, it must be placed in the correct OU or the wrong GPOs apply.

Common AD Operations ​

Find a User Account ​

powershell
Get-ADUser -Identity "username" -Properties *
Get-ADUser -Filter {EmailAddress -eq "user@ciriusgroup.com"} -Properties *

Check Account Lockout ​

powershell
# Check if an account is locked
Get-ADUser -Identity "username" -Properties LockedOut, BadLogonCount, BadPasswordTime

# Unlock an account
Unlock-ADAccount -Identity "username"

When an account is locked out, the PDC Emulator processes the unlock and replicates to all DCs. If unlocking doesn't stick, check if there's a process (mapped drive, service) repeatedly authenticating with the old password.

Reset a Password ​

powershell
# Reset password (prompts for new password)
Set-ADAccountPassword -Identity "username" -Reset

# Force password change at next login
Set-ADUser -Identity "username" -ChangePasswordAtLogon $true

Check Group Membership ​

powershell
# What groups is a user in?
Get-ADPrincipalGroupMembership -Identity "username" | Select Name

# Who is in a specific group?
Get-ADGroupMember -Identity "GroupName" | Select Name, SamAccountName

Find Stale Computer Accounts ​

powershell
# Computers that haven't logged on in 90+ days
$cutoff = (Get-Date).AddDays(-90)
Get-ADComputer -Filter {LastLogonDate -lt $cutoff} -Properties LastLogonDate |
  Select Name, LastLogonDate | Sort-Object LastLogonDate

Entra Connect Sync ​

Entra Connect runs on the primary DC (or a dedicated sync server) and syncs on-prem AD to Entra ID every 30 minutes.

powershell
# Check sync status
Import-Module ADSync
Get-ADSyncScheduler

# Trigger immediate sync
Start-ADSyncSyncCycle -PolicyType Delta

# Check for sync errors
Get-ADSyncConnectorRunStatus

If sync fails: check the Application Event Log on the Entra Connect server for ADSync errors. The most common fix is restarting the Microsoft Azure AD Sync service.

Troubleshooting ​

Authentication Failures (Users Can't Log In) ​

  1. Check if the account is locked: Get-ADUser -Identity "user" -Properties LockedOut
  2. Check domain replication — if a DC has stale data, some users may not authenticate: repadmin /replsummary
  3. Check the PDC Emulator is reachable — Kerberos routes password changes and lockouts there
  4. Check time sync — Kerberos fails if client clock is >5 minutes from DC: w32tm /query /status on the client

Kerberos Errors (Event 4769, Event 14) ​

Usually a time skew or DNS issue. Verify:

  • Time sync to PDC Emulator is working
  • DNS resolves DC names correctly (nslookup ciriusgroup.internal)
  • SPN (Service Principal Name) registrations are correct for the failing service: setspn -L <service-account>

GPO Not Applying ​

  1. Run gpresult /r on the target machine — is the GPO in the applied list?
  2. Check WMI filter if the GPO uses one — the filter may not be matching
  3. Check the OU — is the machine in the correct OU?
  4. Force update: gpupdate /force
  5. Check SYSVOL replication if GPO applied on some DCs but not others: repadmin /replsummary

When Kevin / Greg Are Unavailable ​

For operations that only Domain Admins can perform (schema changes, OU creation, DC promotion):

  1. Use the AD break-glass account (AD Break-Glass — Primary DC in Keeper) for emergency read-only investigation
  2. For write operations: the AD break-glass account has Domain Admin rights — use only for genuine emergencies and document per Break-Glass Procedure
  3. For anything that can wait: contact Kevin or Greg directly (mobile numbers in Keeper → Emergency Contacts)

Document History ​

DateChangeAuthor
May 2026Initial draft — domain info, FSMO roles, health checks, GPO, OU structure, common operations, Entra Connect, troubleshooting, break-glass access.Rory

Internal use only — Cirius Group