The following links provide in-depth information on how key Active Directory components work.

• AD Data Store
• Windows Server 2003 Active Directory Branch Office Guide
• Bridgehead Server Selection (Windows 2008 R2)
• AD Replication Model
• Certificate Revocation & Status Checking
• Core Group Policy
• DNS
• How DNS Support for AD works
• Windows 2000 DNS
• DFS
• Fine-Grained Password Policy
• Foreign Security Principals & AD
• FRS
• FSMOs
• Kerberos 5
• Kerberos for the Busy Admin
• Windows 2000 Kerberos Authentication
• Managed Service Accounts
• TCPIP

The following are extremely useful resources for Windows Server 2012 Active Directory Features.

Windows 2012 Features

• TechED: What’s New in Active Directory in Windows Server 2012 (Dean Wells’ presentation at TechEd)
• How many Windows Server 2012 domain controllers do I need initially and where should I put them?
• PowerShell version 3 commandlets including Active Directory Replication and Topology:Introduction & Advanced Topics

Group Managed Service Accounts (gMSA)

• Getting Started with Group Managed Service Accounts
• Group Managed Service Accounts Overview
• Windows Server 2012: Group Managed Service Accounts

RID Protection

• TechNet Article: Managing RID Issuance
• ASKDS Blog Article: Managing RID Issuance in Windows Server 2012

DC Cloning & SafeGuarding

• Virtual Domain Controller Cloning in Windows Server 2012
• Microsoft Article: Introduction to Active Directory Domain Services (AD DS) Virtualization (Level 100)
• Microsoft Virtual Machine Generation ID Whitepaper document
• Virtualize your Windows Server 2012 domain controllers
• Things to consider when you host Active Directory domain controllers in virtual hosting environments
• Virtualized Domain Controller Deployment and Configuration
• ms-DS-Generation-Id Attribute
• Virtual Domain Controller Cloning in Windows Server 2012
• Safely Cloning an Active Directory Domain Controller with Windows Server 2012 – Step-by-Step
• Virtualized Domain Controller Deployment and Configuration
• New-ADDCCloneConfigFile

Dynamic Access Control (DAC)

• Introduction to Windows Server 2012 Dynamic Access Control
• Understand and Troubleshoot Dynamic Access Control in Windows Server 2012 (Word doc download)
• Getting started with Central Access Policies – Reducing security group complexity and achieving data access compliance using Dynamic Access Control
• MSDN Article on Dynamic Access Control (DAC)
• DAC Scenario

Kerberos FAST

• RFC6113   A Generalized Framework for Kerberos Pre-Authentication
• What’s New in Kerberos Authentication
• Access Control and Authorization Overview– covers domain requirements for Kerberos armoring and group policy settings.

Kerberos Constrained Delegation Enhancements

• Kerberos Constrained Delegation Overview
• How Windows Server 2012 Eases the Pain of Kerberos Constrained Delegation

o   Part 1

o   Part 2

• [MS-SFU]: Kerberos Protocol Extensions: Service for User and Constrained Delegation Protocol Specification

Kerberos Proxy

• Kerberos Authentication Overview
• Enriched Remote Access experience in Windows Server 2012
• Delegation of Authentication
• [MS-KKDCP]: Kerberos Key Distribution Center (KDC) Proxy Protocol

The following are extremely useful resources for understanding the Active Directory Group Policy.

Group Policy

• Core Group Policy Technical Reference
• How Core Group Policy Works

o   Core Group Policy Architecture

o   Core Group Policy Physical Structure

o   Core Group Policy Processes and Interactions

o   Network Ports Used by Group Policy

o   Related Information

• What is Core Group Policy

o   Change and Configuration Management

o   Core Group Policy Infrastructure

o   Core Group Policy Scenarios

o   Core Group Policy Dependencies

o   Related Information

• Core Group Policy Tools and Settings

o   Group Policy Tools

o   Group Policy Settings

o   Group Policy WMI Classes

o   Related Information

• Group Policy Components
• Group Policy Preferences Overview Whitepaper (download)
• (Vista) – TroubleshootingGroup Policy Using Event Logs
• Interpreting Userenv log files
• Designing a Group Policy Infrastructure

o   Overview of Group Policy

o   Planning Your Group Policy Design

o   Designing Your Group Policy Model

o   Deploying Group Policy

o   Maintaining Group Policy

o   Additional Resources for Group Policy Infrastructure

• Group Policy Management ConsolE Technical Reference

o   What Is Group Policy Management Console?

o   How Group Policy Management Console Works

o   Group Policy Management Console Tools and Settings

• Group Policy Object Editor

o   What Is Group Policy Object Editor?

o   How Group Policy Object Editor Works

o   Group Policy Object Editor Tools and Settings

• Group Policy Loopback processing

o   Part 1: Circle Back to Loopback

o   Part 2: Back to the Loopback: Troubleshooting Group Policy loopback processing

The following are extremely useful resources for the Active Directory Read Only Domain Controller (RODC).

Read Only Domain Controller

• Read-Only Domain Controller Planning and Deployment Guide

o   Understanding Planning and Deployment for Read-Only Domain Controllers

o   RODC Branch Office Guide

o   Appendix A: RODC Technical Reference Topics

o   Appendix B: RODC-Related Events

o   Appendix C: Acronyms Used in This Guide

• RODC Administration

o   Installing Remote Server Administration Tools

o   Administering the Password Replication Policy

• Read-only Domain Controllers Step-by-Step Guide

o   Who Should Use This Guide?

o   What Is an RODC?

o   RODC Placement Considerations for Windows Server 2003 Domains

o   Prerequisites for Deploying an RODC

o   Known Issues for Deploying an RODC

o   Steps for Deploying an RODC

o   Steps for Administering an RODC

o   RODC Frequently Asked Questions

o   Appendix A: Client Operations

o   Appendix B: How the Authentication Process Works with RODCs

o   Appendix C: Application Compatibility with RODCs

o   Appendix D: Steps to Add an Attribute to the RODC Filtered Attribute Set

• RODC Frequently Asked Questions
• Adding Attributes to the RODC Filtered Attribute Set
• Description of the Windows Server 2008 read-only domain controller compatibility pack for Windows
• Adding Attributes to the RODC Filtered Attribute Set
• Using the confidentiality bit in 203 SP1
• RODC DNS Client Update Mechanism
• The RODC requests the updateusing aspecial operation calledreplicateSIngleObject:
• BitLocker implementation for RODC.

The following are extremely useful resources for Windows Server 2008 Active Directory Features.

Server 2008 AD Features

• Changes in Functionality from Windows Server 2003 with SP1 to Windows Server 2008
• AD DS Fine–Grained Password and Account Lockout Policy Step–by–Step Guide
• Fine-Grained Password Policy and “Urgent Replication”
• What’s New in AD DS: Active Directory Best Practices Analyzer
• AD DS Auditing Step–by–Step Guide
• Managed Service Accounts
• Managed Service Accounts: Understanding, Implementing, Best Practices, and Troubleshooting
• Changes in Functionality from Windows Server 2003 with SP1 to Windows Server 2008 (doc download)
• What’s New in Active Directory Domain Services in Win2008
• What’s New in Active Directory Domain Services in Win2008 R2
• Changes in Functionality from Windows Server 2008 to Windows Server 2008 R2
• Getting the Effective Audit Policy in Windows 7 and 2008 R2
• What’s New in AD DS: Active Directory Module for Windows PowerShell

• The AD Recycle Bin: Understanding, Implementing, Best Practices, and Troubleshooting

The following are extremely useful resources for understanding the Active Directory Replication.

Replication

• How Active Directory Replication Topology Works

o   Active Directory KCC Architecture and Processes

o   Replication Topology Physical Structure

o   Performance Limits for Replication Topology Generation

o   Goals of Replication Topology

o   Topology-Related Objects in Active Directory

o   Replication Transports

o   Replication Between Sites

o   KCC and Topology Generation

o   Network Ports Used by Replication Topology

o   Related Information

• Active Directory Replication Model

o   What Is the Active Directory Replication Model?

o   How the Active Directory Replication Model Works

o   Active Directory Replication Tools and Settings

• Active Directory Replication Topology

o   What Is Active Directory Replication Topology?

o   How Active Directory Replication Topology Works

o   Active Directory Replication Tools and Settings

• AD Branch Office Guide (download)
• Microsoft Active Directory Topology Diagrammer
• The Role of the Inter–Site Topology Generator in Active Directory Replication
• How to view and set LDAP policy in Active Directory by using Ntdsutil.exe
• How to configure the Windows Time service against a large time offset
• BridgeHead Server Selection
• Active Directory Load BalancingTool (ADLB)
• Configuring Change Notification on a MANUALLY created Replication partner

The following are extremely useful resources for understanding the Active Directory DNS & Name Resolution.

DNS & Name Resolution

• How DNS Works – (a bit lengthy)

o   DNS Architecture

o   DNS Protocol

o   DNS Physical Structure

o   DNS Processes and Interactions

o   Network Ports Used By DNS

o   Related Information

• DNS Technical Reference

o   What Is DNS?

o   How DNS Works

o   DNS Tools and Settings

• How DNS Support for Active Directory Works

o   DNS Support for Active Directory Architecture

o   DNS Physical Structure in Support of Active Directory

o   DNS Support for Active Directory Processes and Interactions

o   Network Ports Used by DNS in Support of Active Directory

o   Related Information

• Windows 2000 DNS

o   Introduction

o   DNS Fundamentals

o   New Features of the Windows 2000 DNS

o   Designing a DNS Namespace for the Active Directory

o   Summary

o   Glossary

• DNS Support for Active Directory

o   What Is DNS Support for Active Directory?

o   How DNS Support for Active Directory Works

o   DNS Support for Active Directory Tools and Settings

• GlobalNames Zone Deployment(document download)
• Description of the netmask ordering feature and the round robin feature in Windows Server 2003 DNS
• How to reconfigure an _msdcs subdomainto a forest–wide DNS application directory partitionwhen you upgrade from Windows 2000 to Windows Server 2003
• Event ID 4515 is logged in the DNS Server log in Windows Server 2003
• Tools / concepts to be familiar with: NSLOOKUP, DNSCMD (all), DNSLINT, etc