Network · Network & Infrastructure
Directory services and domain identity
On-premises directory services, including directory health, account changes and configured security auditing.
Features and benefits
| Feature | Practical benefit |
|---|---|
| Central account and device directory | Shared identity records support consistent onboarding, changes and offboarding across domain-connected systems. |
| Domain authentication | Directory-backed sign-in provides a common authentication foundation for compatible devices and applications. |
| Groups and delegated administration | Group-based access and scoped administration make it easier to assign appropriate rights and remove them when responsibilities change. |
| Policy-based configuration | Linked configuration policies can apply agreed security and operating settings to the intended users and devices. |
| Directory replication | When multiple controllers are deployed, replication shares directory changes and supports service continuity. |
| Configured account and privilege auditing | Selected security events support investigation and validation of identity changes when audit policy and collection are configured. |
Directory services and domain identity
Connect central identity, effective access and directory health to the account lifecycle.
Requirements → deployment → operation → validation
Document library
Requirements and security baseline
Directory services and domain identity Requirements and security baseline
Baseline alignment. Directory and domain-controller baselines, validation results and approved exceptions. CIS IGs · DISA STIGs
- Domains, domain controllers, identity owners and service dependencies
- Privileged roles, account lifecycle and policy requirements
- Replication, recovery, auditing and retention requirements
Deployment and control mapping
Directory services and domain identity Deployment and control mapping
- Scope and ownership: On-premises directory services, including directory health, account changes and configured security auditing.
- Approved rollout and acceptance: Approved role or account configuration and baseline policy; replication, authentication and effective-access acceptance
- Applicable requirements mapped to configuration, validation evidence and approved exceptions
Client and user guide
Directory services and domain identity Client and user guide
- Approved account requests and sign-in support
- Access changes, offboarding and reporting unexpected privileges
- Password and authentication responsibilities under local policy
Technician training outline
Directory services and domain identity Technician training outline
- Directory health, replication and account administration
- Group membership, policy application and privileged changes
- Audit-event collection, recovery preparation and validation
RDA technician workflow
Directory services and domain identity RDA technician workflow
- Identify and assess the requirement; plan the scope, accountable owner and required approvals
- Implement and verify: Test an approved account or privilege change, verify its effective access and confirm receipt of the required audit event.
- Document the configuration and result; hand off operation, review exceptions and plan lifecycle changes
Portal and access training
Directory services and domain identity Portal and access training
- Separate administrative identities and least-privilege delegation
- Protected directory management and emergency access
- Privileged-group review and administrator offboarding
Training module template
Directory services and domain identity Training module template
- Learning objectives and prerequisites: directory health, replication and account administration
- Authorized practical exercise: Test an approved account or privilege change, verify its effective access and confirm receipt of the required audit event.
- Knowledge check, observed result and instructor or responsible-owner sign-off
Basic installation and acceptance
Directory services and domain identity Basic installation and acceptance
- Supported server, domain and network prerequisites
- Approved role or account configuration and baseline policy
- Replication, authentication and effective-access acceptance
Advanced deployment and changes
Directory services and domain identity Advanced deployment and changes
- Delegation and controlled group or policy changes
- Additional domain controllers or recovery arrangements in scope
- Advanced audit policy and required object-level auditing
Technical configuration and integrations
Directory services and domain identity Technical configuration and integrations
- Domain topology, controllers, authentication and replication dependencies
- Group-based access, delegated administration and effective configuration policies
- Audit policy, required object-level auditing, collector health and recovery records
Operational audit and checklist
Directory services and domain identity Operational audit and checklist
- Coverage and operating checks: replication or authentication failures and unhealthy controllers
- Evidence sample: configured account, authentication and group-change security events; approved access changes and centralized event receipt where configured
- Review date and owner; pass or fail, exceptions, corrective action and retest evidence
Tabletop exercises
Directory services and domain identity Tabletop exercises
- A controller is unavailable during an authentication incident
- An unauthorized privileged group change is detected
- An account is disabled but a required access path remains active
Response playbook
Directory services and domain identity Response playbook
- Assess identity impact, privileged scope and evidence
- Authorize account containment, repair or recovery
- Validate authentication, effective access and directory health
Operational runbooks
Directory services and domain identity Operational runbooks
- Create, change or disable an account through approved workflow
- Investigate a directory health or replication failure
- Validate group access and collect required audit events
Evaluation and lifecycle review
Directory services and domain identity Evaluation and lifecycle review
Selection and fit. Compare viable options against the business need, security requirements, existing systems and full operating cost. Record the reasons for the selection, the tradeoffs accepted and the conditions that would prompt a different choice.
Keeping the choice current. Follow supplier notices between scheduled reviews and reassess before renewal or a material change. Check ownership changes, renamed or retired products, subscription and licensing terms, pricing, capabilities and support commitments. Record the effect on security, data handling, integrations and service continuity. Assign an owner to approve adjustments or plan a transition, including data export and removal of access.
- Supported platform lifecycle and recovery readiness
- Account governance, effective access and audit coverage
- Directory dependencies, maintenance effort and operating cost