S2. Identity and directory services

Outcome: you can build and run an Active Directory environment and apply policy at scale.

Skills: AD DS deployment, sites and replication, multi-domain concepts, users, groups, OUs, delegation, Group Policy, Linux users, groups and PAM basics.

Labs

1. Promote DC1 to a new forest. Add DC2 in the branch site with its own AD site and subnet.
2. Create an OU structure, security groups and 20 users with a PowerShell script.
3. Write GPOs for password policy, drive mappings and software restrictions. Test with gpresult.
4. Join CL1 and SRV1 to the domain. Delegate password reset rights to a helpdesk group.
5. Break replication on purpose and repair it with repadmin and dcdiag.
6. Linux lane: manage users and groups, configure sudo rules, explore PAM files, join LNX1 to the domain with realmd and sssd.

Prove it: the OU and GPO design document, the user creation script, and a recorded repair of the replication failure.

Certs: AZ-802 (AD DS is the largest domain, 20-25%), AZ-104 (identity concepts), Linux+ (user management), LPIC-1 (administrative tasks).