Recipes: "I need to do X"
Reverse navigation: not by topic but by the task on your desk. Command, explanation and a link to the theory.
I have a problem — search by symptomAdd a user to a group
JuniorRights in AD are granted through groups, not to individual users. The most common helpdesk action.
Open the recipeReset a password and force a change at next logon
JuniorHelpdesk standard: a temporary password the user must change immediately.
Open the recipeBulk-reset passwords from a CSV list
MidAfter an incident or for a whole department, doing it by hand is impossible.
Open the recipeFind every locked account and unlock it
JuniorMonday morning brings a lockout wave. One list beats hunting one by one.
Open the recipeFind computers that have not logged on for 90 days
JuniorStale computer accounts are needless attack surface and inventory noise.
Open the recipeJoin a computer to the domain into a specific OU
JuniorWithout an OU the computer lands in Computers and misses the department GPOs.
Open the recipeFix "the trust relationship with the domain failed"
JuniorNo need to leave and rejoin — one command refreshes the machine account password.
Open the recipeCheck which GPOs actually applied
Junior"I made a GPO and it does nothing" is solved by this report 90% of the time.
Open the recipeBack up and restore a GPO
JuniorBack up before any policy change. Restoring takes seconds; rebuilding without a backup takes a day.
Open the recipeVerify the domain SRV records are healthy
JuniorWithout SRV records clients cannot find a DC: no logon, no GPO, no domain join.
Open the recipeCheck replication health between DCs
MidStalled replication means a password change never reaches another site, GPOs go stale, and eventually a DC dies.
Open the recipeFind what keeps locking a user's account
JuniorUnlocking without finding the source means the same ticket in an hour.
Open the recipeExport a list of all privileged accounts
MidMost organizations discover forgotten admin accounts the first time they run this.
Open the recipeFind accounts with an SPN (Kerberoasting targets)
MidEvery user account with an SPN is a password an attacker can crack offline.
Open the recipeSee who holds the FSMO roles
MidA standing interview question and the first step in any odd domain failure.
Open the recipeOffboard a leaver correctly
JuniorDeleting immediately breaks file and mailbox access. Correct: disable, kill sessions, move to a hold OU.
Open the recipeGet a user's true last logon time
JuniorLastLogonDate replicates and is approximate; lastLogon does not replicate, so query every DC.
Open the recipeReset the krbtgt password after a suspected Golden Ticket
Midkrbtgt is the key that signs every Kerberos ticket. Stolen, it lets an attacker forge anyone.
Open the recipeBulk-create users from a CSV file
MidOnboarding a whole department at once. The file needs Name,SamAccountName,OU columns.
Open the recipeRecursive report: who really is in Domain Admins
JuniorNested groups hide members. -Recursive reveals those who got in through a group inside a group.
Open the recipeList all computers by operating system
JuniorThe first question in any upgrade project or after a new CVE: how many old machines remain, and where.
Open the recipeMove computers to a different OU
JuniorGPO applies by OU. A host left in the default Computers container never receives your policy.
Open the recipeFind orphaned GPOs that are not linked anywhere
MidAn unlinked GPO does nothing but confuses troubleshooting and clutters the domain.
Open the recipeForce immediate replication between domain controllers
MidAn urgent change (password reset, account disable) must reach every DC now, not in 15 minutes.
Open the recipeSpot a spike of failed logons (4625) on a DC
JuniorGrouping 4625 by account and source separates a forgotten password from an intrusion attempt.
Open the recipeWeekly account lockout report
JuniorThe same three users every week means a recurring technical cause (phone, service), not carelessness.
Open the recipe