What Changes in a Domain¶
Later rounds add Active Directory. One Server 2022 machine becomes a domain controller (DC), and the other machines join its domain as member servers or workstations. Everything you've learned still applies. What changes is where accounts live, where policy comes from, and a set of extra settings that only make sense once machines trust each other.
These pages follow the CIS Microsoft Windows Server 2022 Benchmark v5.1.0, the domain version of the standalone benchmark. It has two profiles, Domain Controller and Member Server, and each page below says which one a setting belongs to. Items marked STIG WN22-DC-… come from the domain-controller section of the Server 2022 STIG.
Two kinds of machine¶
| Domain controller | Member server or workstation | |
|---|---|---|
| Accounts | Domain accounts in Active Directory. There are no local accounts on a DC; the SAM is replaced by the directory. | Local accounts still exist, but people should log in with domain accounts |
| Administrators group | Is the "Administrators" for every DC in the domain | Contains Domain Admins automatically, plus any local admins |
| Policy | Default Domain Policy (accounts) and Default Domain Controllers Policy (the DC itself) | Domain GPOs first, then local policy fills in whatever the domain didn't set |
| Tools | dsa.msc, gpmc.msc, ntdsutil, the ActiveDirectory PowerShell module |
Same tools as before, plus gpresult to see which domain policy landed |
The README says which machine is the DC and which are members. On a member, systeminfo | findstr Domain shows the domain name; on a DC, Get-ADDomainController answers.
Where policy comes from now¶
On a standalone machine you set password policy in secpol.msc. In a domain, password, lockout, and Kerberos policy for domain accounts come from the Default Domain Policy GPO, and secpol.msc on a member only governs its local accounts. The domain wins where both are set. So:
| Setting group | Standalone | Domain |
|---|---|---|
| Password and lockout policy | secpol.msc on each machine |
gpmc.msc → Default Domain Policy (applies to every domain account) |
| Audit policy, user rights, security options for the DC | gpmc.msc → Default Domain Controllers Policy |
|
| The same for members | secpol.msc / gpedit.msc |
A domain GPO linked to the members' OU, or local policy if there is none |
After changing a GPO, run gpupdate /force on the affected machine and confirm with gpresult /r (shows which GPOs applied) or gpresult /h report.html for the full picture. A setting that "didn't take" is almost always a GPO higher in the list setting it the other way.
The pages¶
| Page | Covers |
|---|---|
| Domain Accounts and Groups | Users and privileged groups in the directory, the local accounts left on members |
| Domain Policies | Default Domain Policy: password, lockout, Kerberos |
| Domain Controller Hardening | User rights, security options, and services specific to a DC |
| Member Servers in a Domain | Settings that change on a server once it's joined, including LAPS |
| Group Policy and SYSVOL | Making policy processing trustworthy and keeping GPOs and SYSVOL from being edited by users |
| Domain Auditing | Kerberos, account management, and directory-change auditing on the DC |
| Directory Permissions | ACLs on the domain, OUs, and AD's own files |
What you already know still applies¶
A DC is still a Server 2022 machine. Firewall, SMB, Defender, updates, unwanted programs, event log size, and the rest of the site apply to it unchanged, with the DC values from the pages above where they differ. Do the standalone work first, then the domain pages.
Before you start¶
Snapshot both machines. A bad GPO can lock every account in the domain out, and the only clean way back is the snapshot.