Windows Server — Complete Admin Guide

# Users
Get-ADUser -Identity jsmith -Properties *
Get-ADUser -Filter {Enabled -eq $true} | Select Name, SamAccountName, LastLogonDate
New-ADUser -Name "Jane Smith" -SamAccountName jsmith -UserPrincipalName [email protected] `
  -AccountPassword (ConvertTo-SecureString "P@ssw0rd1!" -AsPlainText -Force) -Enabled $true
Set-ADUser -Identity jsmith -Title "IT Admin" -Department "IT"
Disable-ADAccount -Identity jsmith
Enable-ADAccount -Identity jsmith

# Computers
Get-ADComputer -Filter * | Select Name, IPv4Address, OperatingSystem, LastLogonDate
Get-ADComputer -Identity PC001 -Properties *

# Groups
Get-ADGroup -Identity "Domain Admins"
Get-ADGroupMember -Identity "Domain Admins" -Recursive
Add-ADGroupMember -Identity "IT Admins" -Members jsmith, bday
Remove-ADGroupMember -Identity "IT Admins" -Members jsmith -Confirm:$false

# Locked-out and password searches
Search-ADAccount -LockedOut | Select Name, SamAccountName, LockedOut
Unlock-ADAccount -Identity jsmith
Search-ADAccount -PasswordExpired | Select Name, SamAccountName
Search-ADAccount -AccountDisabled | Select Name, SamAccountName

# OU management
Get-ADOrganizationalUnit -Filter * | Select Name, DistinguishedName
New-ADOrganizationalUnit -Name "Workstations" -Path "DC=corp,DC=local"
Move-ADObject -Identity "CN=PC001,CN=Computers,DC=corp,DC=local" `
  -TargetPath "OU=Workstations,DC=corp,DC=local"

# GPO management
Get-GPO -All                                          # List all GPOs in domain
Get-GPO -Name "Default Domain Policy"
New-GPO -Name "Workstation Security Baseline"
New-GPLink -Name "Workstation Security Baseline" -Target "OU=Workstations,DC=corp,DC=local"
Get-GPInheritance -Target "OU=Workstations,DC=corp,DC=local"

# Resultant Set of Policy — what actually applies to a user/computer
gpresult /H C:\Temp\gp-report.html /F             # HTML report for current user/computer
gpresult /Scope Computer /V                        # Verbose computer policy results
gpupdate /force                                    # Force immediate policy refresh

# Roles and features
Get-WindowsFeature | Where Installed                      # List installed features
Get-WindowsFeature AD-Domain-Services                     # Check specific feature
Install-WindowsFeature AD-Domain-Services -IncludeManagementTools
Install-WindowsFeature DHCP, DNS -IncludeManagementTools
Uninstall-WindowsFeature Telnet-Client

# Disk and volume management
Get-Disk                                                  # Physical disks
Initialize-Disk -Number 1 -PartitionStyle GPT
New-Partition -DiskNumber 1 -UseMaximumSize -AssignDriveLetter
Format-Volume -DriveLetter D -FileSystem NTFS -NewFileSystemLabel "Data"
Get-Volume                                                # All volumes and free space

# SMB shares
Get-SmbShare                                              # List all shares
New-SmbShare -Name "Data" -Path "D:\Data" -FullAccess "corp\IT Admins" -ReadAccess "corp\Domain Users"
Set-SmbShare -Name "Data" -Description "Department Data Share"
Remove-SmbShare -Name "Data" -Force

# Domain controller
Get-ADDomainController -Discover                          # Find a DC
Get-ADDomainController -Filter *                          # List all DCs
Test-ComputerSecureChannel                                # Check secure channel to domain
Test-ComputerSecureChannel -Repair -Credential corp\admin # Repair broken secure channel

# Domain controller diagnostics (run on or targeting a DC)
dcdiag                                    # Full DC health check
dcdiag /test:replications                 # AD replication test only
dcdiag /test:netlogons                    # Netlogon service test

# AD replication
repadmin /showrepl                        # Show replication status for all partners
repadmin /replsummary                     # Summarized replication health
repadmin /syncall /AdeP                   # Force sync all partitions

# NETLOGON log — authentication events, secure channel issues
# Path: %SystemRoot%\debug\netlogon.log (and netlogon.bak)

# DC discovery and DNS
nltest /dsgetdc:corp.local                # Find a DC for the domain
nltest /dclist:corp.local                 # List all DCs
nslookup _ldap._tcp.corp.local            # Verify SRV records exist

# Event log queries
Get-EventLog -LogName System -Newest 50
Get-WinEvent -FilterHashtable @{LogName='System'; Level=2} -MaxEvents 50  # Errors only

# Disable SMBv1 (WannaCry/EternalBlue vector — must disable)
Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force
Get-SmbServerConfiguration | Select EnableSMB1Protocol  # Verify

# Enable SMB signing (prevents relay attacks)
Set-SmbServerConfiguration -RequireSecuritySignature $true -Force

# LSA protection — prevents non-PPL processes from reading LSASS memory
New-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" `
  -Name RunAsPPL -Value 1 -PropertyType DWORD -Force

# Restrict anonymous enumeration
Set-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" `
  -Name RestrictAnonymous -Value 1

# Disable legacy protocols
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol  # On desktop OS

# Enable Windows Firewall on all profiles
Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True

# Windows Server Backup — install feature first
Install-WindowsFeature Windows-Server-Backup

# Backup system state (includes AD, registry, boot files)
wbadmin start systemstatebackup -backuptarget:\\fileserver\backup -quiet

# List backups
wbadmin get versions

# Restore system state
wbadmin start systemstaterecovery -version:MM/DD/YYYY-HH:MM -quiet

# Authoritative restore of deleted AD objects (from DSRM mode)
# 1. Boot to DSRM, 2. Restore system state, 3. Run:
ntdsutil "activate instance ntds" "authoritative restore" "restore subtree OU=Deleted,DC=corp,DC=local" quit quit

# AD Recycle Bin — restore without DSRM (must be enabled first)
Enable-ADOptionalFeature -Identity "Recycle Bin Feature" -Scope ForestOrConfigurationSet -Target "corp.local"
Get-ADObject -Filter {isDeleted -eq $true} -IncludeDeletedObjects | Select Name, Deleted, WhenChanged
Restore-ADObject -Identity "<objectGUID>"