🎯 AD Administration Course · Module 8 of 8
AD Security, Monitoring, Backup & Recovery
AZ-800 Exam Alignment
AZ-800
Secure, monitor, back up, and recover Active Directory: Configure fine-grained password policies, implement the Protected Users security group, configure audit policies, enable the AD Recycle Bin, perform System State backups, and recover from AD failures.
- Know how Fine-Grained Password Policies (PSOs) work and how to apply them to users or groups
- Understand the Protected Users security group — what protections it provides and what it does NOT protect
- Know key security event IDs: 4720 (account created), 4740 (account locked out), 4726 (account deleted), 4732 (member added to group)
- Know the difference between authoritative and non-authoritative restore — when each is used
Exam Tip: AZ-800 tests the AD Recycle Bin heavily — know it must be enabled BEFORE objects are deleted to protect them, it requires Windows Server 2008 R2+ forest functional level, and deleted objects are recoverable for 180 days (tombstone lifetime). Also know that authoritative restore is required when you need a restored object to replicate outward and override existing copies on other DCs.
Security is the final and most important dimension of Active Directory administration. A compromised AD means every system, user, and resource in the organisation is potentially exposed. This module covers the key security controls, monitoring tools, and backup/recovery procedures that protect your AD DS environment against both accidental loss and intentional attack.
🔒 Fine-Grained Password Policies (PSOs)
The default domain password policy applies to all accounts in the domain. Fine-Grained Password Policies (Password Settings Objects — PSOs) allow you to apply different password requirements to specific users or groups — for example, a stricter policy for IT admins.
| Setting | Description | Example Values |
|---|---|---|
| Minimum Password Length | Minimum number of characters required | 14 characters for admins, 10 for standard users |
| Password Complexity | Requires uppercase, lowercase, number, and symbol | Enabled for all PSOs |
| Password History | Number of previous passwords that cannot be reused | 24 passwords remembered |
| Maximum Password Age | How long a password can be used before expiry | 90 days for standard, 30 days for privileged |
| Minimum Password Age | Minimum time before a password can be changed again | 1 day (prevents rapid cycling to get back to old password) |
| Account Lockout Threshold | Failed attempts before account is locked | 5 attempts |
| Account Lockout Duration | How long the account stays locked (0 = until admin unlocks) | 30 minutes |
| Precedence | When multiple PSOs apply to a user, the one with the lowest precedence number wins | 1 = highest priority |
💡 PSO Application Rules
- PSOs can be applied directly to users or Global security groups — not to OUs or Universal groups
- If a PSO is applied to a user directly AND via a group, the direct PSO assignment wins regardless of precedence
- If multiple PSOs apply via group memberships, the one with the lowest precedence number wins
- If no PSO applies, the domain password policy applies
- PSOs are configured in Active Directory Administrative Center (ADAC) — not ADUC or GPMC
🔐 Protected Users Security Group
The Protected Users security group (available at Windows Server 2012 R2+ domain functional level) provides enhanced security for privileged accounts by restricting authentication protocols and credential caching.
| What Protected Users PREVENTS | Why This Matters |
|---|---|
| Kerberos RC4 encryption (NTLM hash-based) | Forces AES-only Kerberos — eliminates pass-the-hash attacks using Kerberos |
| NTLM authentication entirely | Eliminates NTLM-based pass-the-hash and relay attacks for group members |
| Credential caching (CredSSP, Digest, WDigest) | Prevents credentials from being stored in memory — reduces credential theft risk |
| Kerberos delegation (constrained or unconstrained) | Prevents service impersonation attacks using delegated credentials |
| Kerberos TGT lifetime beyond 4 hours | Reduces the window for stolen ticket reuse |
⚠️ Protected Users: Test Before You Apply
Adding an account to Protected Users will break NTLM authentication for that account entirely. Applications that use NTLM (older applications, some services) will fail. Service accounts that use delegation will stop working. Always test in a non-production environment before adding privileged accounts, and never add service accounts without testing. Also note: this group protects against credential theft — it does NOT prevent phishing or social engineering.
📍 AD Security Audit Events
Event Viewer › Windows Logs › Security
📄 Event Viewer
📄 Windows Logs
📄 Application
📄 System
🔐 Security
Recent Security Events (filtered)
| Event ID | Description | Level |
|---|---|---|
| 4720 | A user account was created: jsmith | Audit Success |
| 4740 | A user account was locked out: jdoe | Audit Success |
| 4732 | A member was added to a security-enabled local group | Audit Success |
| 4625 | An account failed to log on | Audit Failure |
| Event ID | Description | Where Logged |
|---|---|---|
| 4720 | A user account was created | DC where object was created |
| 4722 | A user account was enabled | DC |
| 4723 | An attempt was made to change an account’s password | DC |
| 4724 | An attempt was made to reset an account’s password | DC |
| 4725 | A user account was disabled | DC |
| 4726 | A user account was deleted | DC |
| 4728 | A member was added to a security-enabled global group | DC |
| 4732 | A member was added to a security-enabled local group | DC |
| 4740 | A user account was locked out | PDC Emulator |
| 4625 | An account failed to log on | Machine where logon was attempted |
PowerShell — Fine-Grained Passwords, Recycle Bin, Backup & Recovery
# Create a Fine-Grained Password Policy (PSO) New-ADFineGrainedPasswordPolicy -Name 'TC-AdminPSO' -Precedence 1 -MinPasswordLength 16 -ComplexityEnabled $true -PasswordHistoryCount 24 -MaxPasswordAge '30.00:00:00' -LockoutThreshold 3 # Apply the PSO to an admin group Add-ADFineGrainedPasswordPolicySubject -Identity 'TC-AdminPSO' -Subjects 'TC-IT-Admins' # Enable the AD Recycle Bin (irreversible) Enable-ADOptionalFeature -Identity 'Recycle Bin Feature' -Scope ForestOrConfigurationSet -Target 'techcareers.local' -Confirm:$false # Restore a deleted user from the Recycle Bin Get-ADObject -Filter {displayName -eq 'John Smith'} -IncludeDeletedObjects | Restore-ADObject # Backup AD (System State) - run on each DC wbadmin start systemstatebackup -backuptarget:E: -quiet # Add admin account to Protected Users group Add-ADGroupMember -Identity 'Protected Users' -Members 'jsmith'
📋 AD Recycle Bin vs Authoritative Restore
| Feature | AD Recycle Bin | Authoritative Restore |
|---|---|---|
| Prerequisites | Must be enabled BEFORE deletion. Requires WS2008R2+ FFL. | System State backup taken before the deletion/corruption. |
| Recovery scope | Recovers individual objects with all attributes and links intact (including group memberships) | Recovers the entire AD database to the backup point — loses all changes made after backup |
| Replication effect | Restored object replicates normally as a new change | Authoritative objects are given a higher USN and replicate outward, overriding copies on other DCs |
| When to use | Recovering accidentally deleted users, groups, OUs, computers — when Recycle Bin was enabled | AD database corruption, mass deletion when Recycle Bin was NOT enabled, or recovering tombstoned objects |
| Non-authoritative restore | N/A | Recovers the DC’s own database to a point in time and lets normal replication update it — used when a DC’s database is corrupted but other DCs are current |
💡 Best Practices
- Enable the AD Recycle Bin immediately after forest creation — it is irreversible to enable and saves costly restores when objects are deleted accidentally
- Create PSOs for privileged accounts (Domain Admins, service accounts) with higher complexity, shorter maximum age, and stricter lockout than standard users
- Add all privileged admin accounts to the Protected Users security group — never add service accounts without testing first
- Back up System State on at least one DC per site daily using
wbadminor Windows Server Backup — AD backups must be less than 60 days old (tombstone lifetime) - Enable advanced audit policies (Account Management, DS Access, Logon/Logoff) and forward security logs to a SIEM for alerting on Event IDs 4720, 4726, 4732, 4740
- Implement the tiered administration model — Tier 0 (DCs, AD), Tier 1 (servers), Tier 2 (workstations) — to prevent credential theft from cascading up to AD
🎓 Interview Q&A
Q: What is the difference between authoritative and non-authoritative AD restore?
A non-authoritative restore restores a DC’s AD database from a System State backup to a previous point in time. After the DC reboots, it synchronises with other DCs via normal replication — other DCs’ more recent data overwrites the restored data. This is used when a DC’s database is corrupted but other DCs in the domain are healthy and current. An authoritative restore goes further — after restoring from backup, you mark specific objects or the entire database as authoritative by incrementing their USN values to be higher than any other copy in the domain. When the DC replicates, the authoritative objects replicate OUTWARD and overwrite copies on other DCs. Authoritative restore is used when you need to recover accidentally deleted objects AND the AD Recycle Bin was NOT enabled.
Q: What are the key limitations of the AD Recycle Bin?
The AD Recycle Bin has several important limitations: (1) It must be enabled before objects are deleted — it cannot recover objects deleted before it was turned on; (2) Enabling it requires Windows Server 2008 R2 or higher forest functional level and is an irreversible operation; (3) Deleted objects are only retained for the tombstone lifetime (default 180 days) — after that they are garbage-collected and cannot be recovered; (4) Some attributes that are cleared when an object is deleted are NOT restored (e.g. profile path, home folder) — these must be set again after recovery; (5) The Recycle Bin is managed via Active Directory Administrative Center (ADAC) or PowerShell — not ADUC.
Q: What does AdminSDHolder do in Active Directory?
AdminSDHolder is a special AD object that acts as a security template for privileged group members. Every 60 minutes, the SDProp process (running on the PDC Emulator) compares the ACLs of all members of privileged groups (Domain Admins, Enterprise Admins, Administrators, etc.) to the AdminSDHolder object’s ACL, and overwrites any differences. This prevents privilege escalation through ACL modification on admin accounts — even if someone modifies the ACL on a Domain Admin’s user account, SDProp will reset it within 60 minutes. Administrators must modify AdminSDHolder’s ACL itself if they want permanent changes to how admin accounts are secured. AdminSDHolder also sets
adminCount=1 on protected accounts, which persists even after removal from privileged groups.🎯 AZ-800 Mock Test
Module 8 — AD Security, Monitoring, Backup & Recovery
5 questions · Scenario-based · Pass mark: 70%
Question 1 of 5
IT admins need a stricter password policy (16 characters minimum, 30-day max age) than standard users (10 characters, 90-day max age) without affecting the entire domain. What is the correct solution?
ACreate a separate GPO linked to the IT OU with the stricter password policy settings
BMove all IT admin accounts to a separate domain with a different domain password policy
CCreate a Fine-Grained Password Policy (PSO) with Precedence 1 and apply it to the IT admins Global security group
DApply the stricter settings in the Default Domain Policy and use WMI filters to exclude standard users
Question 2 of 5
An administrator accidentally deleted 200 user accounts in the HR OU. The AD Recycle Bin was enabled 2 months ago. What is the fastest recovery method?
AUse Get-ADObject -IncludeDeletedObjects and pipe to Restore-ADObject to restore all deleted HR users with attributes and group memberships intact
BPerform an authoritative restore of the domain from the most recent System State backup
CRestore from backup using non-authoritative restore and force replication
DManually recreate all 200 accounts using exported CSV data from the previous HR report
Question 3 of 5
You want to monitor when a user account is added to the Domain Admins group. Which event ID should you filter for in the Security event log on domain controllers?
A4720 — A user account was created
B4740 — A user account was locked out
C4726 — A user account was deleted
D4728 — A member was added to a security-enabled global group
Question 4 of 5
A DC’s AD database has been corrupted. The other two DCs in the domain are healthy and have current data. What restore method should you use?
AAuthoritative restore — to ensure the corrupted DC’s old data overwrites the other DCs
BNon-authoritative restore — restore from backup and let the other DCs replicate current data to the recovered DC
CRebuild the DC from scratch and join it to the domain as a new DC
DRestore using the AD Recycle Bin to recover the corrupted database
Question 5 of 5
A Domain Admin account has been added to the Protected Users security group. Shortly after, an application that previously worked stops authenticating. What is the most likely cause?
AProtected Users resets the account password, forcing re-authentication
BProtected Users disables the account until the next group policy refresh
CThe application uses NTLM authentication, which is blocked for all members of the Protected Users group
DProtected Users requires two-factor authentication for all application access
🔒
This module is locked — Complete Module 7 and pass its mock test to unlock this module.
🏆
Course Complete!
You’ve completed all 8 modules of the Active Directory Administration course. You are now prepared for the AZ-800 exam and equipped to administer real-world AD DS environments.