Windows Server Admin — Cheat Sheet

Tags: windows-server, active-directory, powershell, hyper-v, dns, gpo, networking

Level: intermediate

TL;DR: Core administration guide for Windows Server covering Active Directory, DNS, DHCP, Group Policy, PowerShell automation, Hyper-V, and storage management.

Key concepts

Active Directory Domain Services (AD DS) organizes network objects into trees, forests, domains, and organizational units (OUs).

Flexible Single Master Operation (FSMO) roles handle non-multimaster tasks across forests and domains.

Group Policy Objects (GPOs) enforce computer and user configurations deterministically across organizational units.

Group Policy Processing follows the LSDOU sequence: Local, Site, Domain, and Organizational Unit.

DNS handles domain controller location via SRV records and zone records for name resolution.

DHCP manages dynamic IP address allocation, reservations, scopes, and failover pairs.

Windows Server Core minimizes attack surface and memory overhead by omitting desktop GUI components.

Hyper-V provides enterprise virtualization with clustering, live migration, and nested virtualization support.

Storage Spaces Direct (S2D) pools internal storage drives across cluster nodes into software-defined storage.

PowerShell and PowerShell remoting (WinRM) serve as primary management mechanisms for automated administration.

Typical questions and ready answers

Q: How do you determine and seize or transfer FSMO roles?R: I use Get-ADForest and Get-ADDomain to locate roles, then execute Move-ADDirectoryServerOperationMasterRole to transfer gracefully or use the -Force switch to seize an offline master.

Q: What is the troubleshooting workflow when a GPO is not applying to a specific client?R: I run gpresult /r or generate an HTML report with gpresult /h report.html on the client to inspect security filtering, WMI filters, inheritance blocking, and loopback processing modes.

Q: How do domain members locate a Domain Controller in the network?R: The Netlogon service queries DNS for DC Locator SRV records (_ldap._tcp.dc._msdcs.<Domain>) matching the client's Active Directory site definition.

Q: How do you recover a deleted Active Directory object?R: I leverage the Active Directory Recycle Bin using Restore-ADObject via PowerShell, avoiding authoritative system state restore procedures.

Q: What distinguishes standard NTFS permissions from Share permissions?R: Share permissions control access over the network, whereas NTFS permissions apply both locally and across networks; the effective permission is always the most restrictive combination.

Pitfalls and common mistakes

Modifying Default Domain Policy or Default Domain Controllers Policy instead of creating targeted, separate GPOs.

Pointing a Domain Controller network interface to a public DNS resolver instead of an internal AD-integrated DNS server.

Neglecting Active Directory Sites and Subnets configuration, resulting in cross-WAN authentication delays and replication latency.

Assigning NTFS permissions directly to individual user accounts rather than following the AGDLP role-based access method.

Leaving Kerberos pre-authentication disabled or using weak encryption algorithms like DES and RC4.

Forgetting to configure DHCP authorization in Active Directory, preventing scopes from serving leases.

Incurring tombstone lifetime issues by leaving an unbooted DC disconnected for longer than the tombstone threshold.

Snippets and commands

# Force immediate Group Policy update and generate detailed status report
gpupdate /force
gpresult /h C:\temp\gp-report.html

# Query FSMO role holders across forest and domain
Get-ADForest | Select-Object -ExpandProperty SchemaMaster
Get-ADDomain | Select-Object InfrastructureMaster, PDCEmulator, RIDMaster

# Test and verify Active Directory replication health
repadmin /replsummary
repadmin /showrepl * /csv | Out-File -FilePath C:\temp\replication.csv

# Query DHCP scope statistics and active leases
Get-DhcpServerv4Scope
Get-DhcpServerv4Lease -ScopeId 192.168.1.0

# Create a new Organizational Unit and bulk-import users
New-ADOrganizationalUnit -Name "Engineering" -Path "DC=corp,DC=local"
Import-Csv users.csv | ForEach-Object {
    New-ADUser -Name $_.Name -SamAccountName $_.Username -UserPrincipalName "$($_.Username)@corp.local" -AccountPassword (ConvertTo-SecureString $_.Password -AsPlainText -Force) -Enabled $true
}

# WinRM configuration and remote execution
Enable-PSRemoting -Force
Invoke-Command -ComputerName "SRV-CORE-01" -ScriptBlock { Get-Service wuauserv | Restart-Service }

To review

[ ] AGDLP identity and permission role design pattern

[ ] Active Directory tombstone lifetime and metadata cleanup steps

[ ] DNS zone replication types and conditional forwarder routing

[ ] GPO WMI filtering syntax and security filtering rules

[ ] BitLocker Network Unlock implementation prerequisites

[ ] Windows Admin Center deployment models and gateway setup

[ ] Storage Spaces Direct quorum configurations and witness types

References

Microsoft Learn: Active Directory Domain Services Documentation

Microsoft Learn: Windows Server Administration and PowerShell Reference

Windows Server Security Best Practices and Threat Mitigation Guides