Michael Reinders

Microsoft Sysinternals Active Directory Explorer is a tool for quickly inspecting Active Directory attributes, tracing unexpected directory changes, reviewing permissions, and comparing the directory at two points in time.   Without a baseline comparison, you can’t easily determine what changed.  What is Active Directory Explorer?  Active Directory Explorer is an investigation and comparison tool, not the…

One question I still hear regularly from IT pros planning a new rollout is whether it’s acceptable to install a certificate authority (CA) on a domain controller.  The short answer is yes. Microsoft fully supports installing Active Directory Certificate Services on a domain controller, and the setup process doesn’t prevent you from doing so. However,…

In this article, I look at how to choose between a Windows Active Directory (AD) domain or workgroup. A Windows workgroup distributes identity and administration across individual computers, while an Active Directory domain centralizes them. That means the real choice is not how the PCs are grouped, but whether your organization can safely continue managing…

Service accounts rarely attract much attention until a password change, server migration, or security issue breaks a workload. That’s why it’s worth choosing the right identity from the get-go because your decision affects not only security, but also the ongoing management of the service. Service Account vs User Account If you’re deciding which identity to…

Excel checkboxes turn a worksheet from a static grid into an interactive tool. Instead of typing Yes, No, Done, or Pending, I can click a box to mark an item as complete, approved, reviewed, or selected. In current Microsoft 365 versions of Excel, checkboxes are easier to use because I can insert them directly into…

Office metadata should be treated as operational risk, not trivia. In Microsoft Word, Excel, and PowerPoint files, metadata is the information stored with the file that describes the document rather than appearing as normal content. It can include the author, company, creation date, last modified by value, revision count, keywords, comments, custom properties, template names, and file-management…

This guide focuses on when admins should use Windows troubleshooting tools like Event Viewer, Reliability Monitor, System File Checker, SFC/DISM, Windows Update logs, and core network commands. Most Windows troubleshooting failures happen because administrators start with repair commands instead of evidence. Running SFC, DISM, or a Windows Update reset before identifying the failing subsystem wastes…

AD site topology is the way Active Directory (AD) models your physical network using sites, subnets, and site links. It helps clients find nearby domain controllers and helps replication follow efficient network paths. But the most common Active Directory performance problems are caused by bad site topology, not AD itself. In many environments, administrators spend…

Active Directory DNS is used to locate domain controllers and critical services (LDAP, Kerberos, and the Global Catalog) via SRV and host records. If DNS is missing or misconfigured, common outcomes include failed logons, Group Policy errors, and domain controller replication issues. This article explains how and why Active Directory depends on DNS, with practical…

In Active Directory (AD), a domain is the main administrative boundary, a tree is a DNS-based grouping of related domains, and a forest is the top-level security boundary that can contain one or more trees and domains. Here’s the quick breakdown: AD domains vs forests vs trees: at-a-glance decision guide Domains in Active Directory A…

In this guide, you’ll learn how to migrate a DNS server in a Windows Server environment, covering both Active Directory–integrated and standard zones. We’ll look at prep, validation, and troubleshooting steps to keep name resolution (and Active Directory) stable throughout the cutover. Migrating a DNS server in a Windows environment can be tricky, especially for…

When a user account becomes locked, account lockout event id 4740 is logged on your domain controllers. It is the primary signal administrators rely on to begin troubleshooting. While the event itself is straightforward, interpreting it correctly and using it effectively to identify the true source of a lockout is not always obvious. What is…