Active Directory and Hybrid Identity Administration on Windows Server

In many organisations Active Directory has grown for years without a clear design. Organisational units no longer reflect the business, group nesting is hard to follow, Group Policy objects conflict, service accounts have permanent administrator rights and old domain controllers remain in service. When the organisation adopts Microsoft 365 or other cloud services, this directory is synchronised to Microsoft Entra ID, and its weaknesses become cloud weaknesses. Attackers know this, and privileged credentials in Active Directory are a common route to a full network compromise.

This programme covers Active Directory from structure to security to the cloud. It moves through five stages: designing and deploying the directory, managing identities, groups and delegation, controlling configuration through Group Policy, connecting on-premises identity to Microsoft Entra ID, and securing, monitoring and recovering the environment. Participants learn why each practice matters as well as how to carry it out.

Built on recognised practice. The programme references current Microsoft documentation for Active Directory Domain Services on Windows Server 2025 and 2022, Microsoft Entra Connect Sync and Microsoft Entra Cloud Sync, the Microsoft enterprise access model for privileged access, Windows LAPS, and hardening guidance such as the CIS Benchmarks. Attack techniques are discussed with reference to the MITRE ATT&CK knowledge base.

What this changes in practice. How to structure organisational units and delegate administration; which synchronisation option and authentication method to choose for hybrid identity; how to separate and protect privileged accounts; how to replace shared service account passwords with managed accounts; which changes to automate with PowerShell; and how to prepare for the recovery of a compromised forest.

How it is delivered. Twenty hours across five sessions, built around one running case: an organisation with an ageing single-forest directory that is moving to Microsoft 365. Participants work in a lab environment to restructure the directory, apply policies, configure synchronisation, harden privileged access and script common tasks with PowerShell. AI assistants are used modestly to draft and review scripts, with attention to checking their output.

In-house option. For organisations, the programme can be tailored to your own directory design, Windows Server versions, cloud services and security policies, and can include a structured review of your current environment as part of the exercises.

Who Should Attend

System administrators: Windows server and directory administrators

Infrastructure engineers responsible for identity, servers and Microsoft 365 integration

Security staff: security analysts and engineers who protect identity infrastructure

IT support leads: senior helpdesk and desktop support staff moving into directory administration

IT team leaders who plan directory upgrades and cloud migration

Objectives

Explain the logical and physical structure of Active Directory, including forests, domains, sites, replication and functional levels

Deploy and maintain domain controllers and manage FSMO roles on current Windows Server versions

Design an organisational unit structure that supports delegation and Group Policy

Manage users, groups and service accounts, including group managed and delegated managed service accounts

Create, link, filter and troubleshoot Group Policy objects

Compare Microsoft Entra Connect Sync and Microsoft Entra Cloud Sync and select an appropriate authentication method

Configure and monitor directory synchronisation between Active Directory and Microsoft Entra ID

Apply privileged access controls such as tiered administration, Protected Users and Windows LAPS

Automate routine administration with PowerShell and review AI-generated scripts before use

Monitor, back up and recover Active Directory, including planning for recovery after a compromise

Course Outline

Directory Foundations: Structure, Domain Controllers and Replication

The role of Active Directory Domain Services in identity and access management
Forests, domains, trusts and functional levels, including Windows Server 2025
Deploying domain controllers, read-only domain controllers and FSMO roles
Sites, subnets and replication topology
DNS integration and common name resolution problems
Upgrading and retiring legacy domain controllers

Managing Identities: Users, Groups, Delegation and Service Accounts

Organisational unit design for administration and policy
User life cycle: joiners, movers and leavers
Group types, scopes and nesting strategies
Delegation of administration with least privilege
Service accounts: risks, group managed and delegated managed service accounts
Bulk administration and reporting with PowerShell

Controlling Configuration: Group Policy in Practice

Group Policy processing, precedence, inheritance and filtering
Security baselines and password and account lockout policies
Fine-grained password policies
Software, drive and printer settings and user environment control
Troubleshooting with resultant set of policy and event logs
Group Policy and cloud-based device management side by side

Hybrid Identity: Connecting Active Directory to Microsoft Entra ID

Hybrid identity concepts and preparing the directory for synchronisation
Microsoft Entra Connect Sync and Microsoft Entra Cloud Sync: choosing and migrating
Password hash synchronisation, pass-through authentication and federation
Single sign-on for domain-joined users and hybrid joined devices
Monitoring synchronisation health and resolving common errors
Conditional access and multifactor authentication for hybrid users

Securing, Monitoring and Recovering the Directory

Common attack paths: credential theft, Kerberos attacks and privilege escalation
Tiered administration, privileged access workstations and the enterprise access model
Protected Users, Windows LAPS and removal of legacy protocols
Auditing, security monitoring and alerting on directory changes
Backup, authoritative restore and forest recovery planning
Using AI assistants for scripting and log analysis: benefits, limits and review
Action plan: strengthening your Active Directory environment

Competencies

Active Directory design and deployment

Domain controller and replication management

Identity, group and delegation management

Service account security

Group Policy configuration and troubleshooting

Hybrid identity synchronisation with Microsoft Entra ID

Privileged access protection

PowerShell automation for directory administration

Directory monitoring, backup and recovery

Live Online

Access Elite Academy’s complete training portfolio live online. Organizations, distributed teams and professionals can join scheduled interactive sessions or request any program to be delivered online, subject to scheduling and delivery requirements. Elite Academy’s Live Online Training provides access to our complete portfolio of professional programs without linking availability to a physical destination. Organizations, multi-location teams and individual professionals can join scheduled instructor-led sessions or request any program from the Elite Academy portfolio for live online delivery, subject to scheduling and delivery requirements. The format preserves real-time interaction, expert guidance and practical learning while removing the need to travel. Browse the current Live Online schedule below or request your preferred program and dates.