Cheat Sheet

All key commands, ports and settings in one place. One click to copy.

Active Directory comparison tables

A quick comparison of similar concepts without repeating the full topic text.

FSMO roles

Who owns each unique operation and what fails when unavailable

Role	Scope	Purpose	When unavailable
Schema Master	Forest	Schema changes	Schema updates stop
Domain Naming Master	Forest	Add and remove domains	Forest structure cannot change
PDC Emulator	Domain	Time, passwords and GPO	Time and password changes may fail
RID Master	Domain	Allocate RID pools to DCs	New SIDs stop after pools run out
Infrastructure Master	Domain	Cross-domain references	Cross-domain references become stale

AD group scopes

Who can join and where permissions apply

Scope	Members	Where used	Example
Global	Accounts and global groups from its domain	Any trusted domain	G_Finance_Users
Domain Local	Accounts and groups from trusted domains	Resources in its local domain	DL_Finance_Modify
Universal	Accounts and groups across the forest	Any domain in its forest	U_All_IT

Kerberos vs NTLM

Identify the protocol and know what to troubleshoot

Feature	Kerberos	NTLM
Mechanism	Tickets: TGT then TGS	Challenge–Response
Requirements	Healthy DNS, time and SPN	Name or IP; often fallback
Mutual authentication	Yes	Incomplete
Events	4768 / 4769	NTLM Operational, 4624
Main risk	Kerberoasting / ticket theft	Relay / Pass-the-Hash

GPO processing order — LSDOU

The later policy normally wins

Order	Level	What applies	Important exception
1	Local	The computer's local policy	Overwritten first
2	Site	GPO linked to the AD Site	Depends on correct subnet mapping
3	Domain	Domain-wide policy	Block Inheritance may stop it
4	OU	Parent OU to child OU	Enforced overrides blocking

Users and Groups

Everyday commands for managing users in AD

Create a new user

New-ADUser -Name "Dana Levi" -SamAccountName dlevi -UserPrincipalName dlevi@corp.local -Path "OU=Users,DC=corp,DC=local" -AccountPassword (Read-Host -AsSecureString) -Enabled $true

Search for a user

Get-ADUser -Filter "Name -like '*levi*'" -Properties LastLogonDate,Enabled

Reset password

Set-ADAccountPassword -Identity dlevi -Reset -NewPassword (Read-Host -AsSecureString)

Lock / unlock account

Disable-ADAccount -Identity dlevi
Unlock-ADAccount -Identity dlevi

Add to group

Add-ADGroupMember -Identity "IT-Admins" -Members dlevi

All members of a group (including nested)

Get-ADGroupMember -Identity "Domain Admins" -Recursive

Health and security checks

Commands worth running once a month

Accounts with a password that never expires

Get-ADUser -Filter "PasswordNeverExpires -eq $true" -Properties PasswordNeverExpires | Select Name

Dormant accounts (90 days)

Search-ADAccount -AccountInactive -TimeSpan 90.00:00:00 -UsersOnly

Accounts with an SPN (Kerberoasting targets)

Get-ADUser -Filter "ServicePrincipalName -like '*'" -Properties ServicePrincipalName

Unconstrained Delegation — locate and neutralize

Get-ADComputer -Filter "TrustedForDelegation -eq $true" -Properties TrustedForDelegation

💡 Any result here is a high risk

Check replication between DCs

repadmin /replsummary
dcdiag /v

krbtgt password age

Get-ADUser krbtgt -Properties PasswordLastSet

💡 Recommended to change twice a year

Group Policy

Managing and diagnosing policies

Immediate policy refresh

gpupdate /force

Which policies apply to the user

gpresult /h C:\report.html /f

List of all GPOs

Get-GPO -All | Select DisplayName,ModificationTime

Backup all policies

Backup-GPO -All -Path "C:\GPOBackup"

Application order

💡 Local → Site → Domain → OU (LSDOU). The last one wins, unless Enforced is set.

DNS and DHCP

The infrastructure AD can't live without

Check the domain's DC records

nltest /dsgetdc:corp.local
nslookup -type=SRV _ldap._tcp.dc._msdcs.corp.local

Clear the DNS cache on a workstation

ipconfig /flushdns
ipconfig /registerdns

List of Scopes in DHCP

Get-DhcpServerv4Scope

Which DHCP servers are authorized in the domain

Get-DhcpServerInDC

💡 A server not on the list = suspected Rogue DHCP

Important ports

What needs to be open between a workstation and a DC

DNS

53 TCP/UDP

Kerberos

88 TCP/UDP

LDAP / LDAPS

389 TCP/UDP  |  636 TCP

Global Catalog

3268 / 3269 TCP

SMB (file shares, SYSVOL)

445 TCP

Kerberos Password Change

464 TCP/UDP

Event IDs for identifying events

What to look for in the DC's logs

Successful logon

💡 Pay attention to Logon Type: 3=network, 10=RDP

Failed logon

💡 Many in a row = password-guessing attempt

Kerberos ticket request (TGT)

Service ticket request (TGS)

💡 With RC4 encryption = suspected Kerberoasting

Change in sensitive group membership

4728 / 4732 / 4756

Account lockout

Security log cleared

💡 Almost always a bad sign

Recommended hardening settings

The settings that prevent most common attacks

Reset machine account creation by users

Set-ADDomain -Identity corp.local -Replace @{"ms-DS-MachineAccountQuota"="0"}

💡 Prevents RBCD attacks

Require LDAP signing

💡 GPO: Domain controller: LDAP server signing requirements → Require signing

Disable NTLMv1 and LM

💡 GPO: Network security: LAN Manager authentication level → Send NTLMv2 response only. Refuse LM & NTLM

Enable LAPS

Get-LapsADPassword -Identity PC-01 -AsPlainText

💡 A different local admin password on every computer

Protected Users + Credential Guard

💡 For admin accounts: prevents credentials from being kept in memory

Tier Model

💡 A domain admin never logs into an end-user workstation