All Runbooks

Stale DNS records, ghost objects in Sites and Services, metadata that refuses to leave. Here's the full cleanup — every command in the right order.

Transfer FSMO roles, sync replication, run demotion, verify DNS — every step in the right order with the right commands.

Four root causes, none obvious from the portal error messages. Check sync status, policy scope, grace period, and device enrollment state.

Even a clean demotion leaves traces. This guide cleans up the metadata, DNS records, and Sites and Services entries that demotion misses.

GPO silently failing with no error and no alert. This runbook walks through every diagnostic step — scope, security filtering, WMI filters, loopback, and event log codes.

DNS failures break logins, GPO, and Kerberos silently. Here's a structured approach to finding and fixing the root cause fast.

Decoding the most common replication errors — 1864, 8606, 1722, 8524, 1753 — with the exact fix for each.

The trust relationship broke — but you don't need to wipe the machine. Here's how to reset the secure channel in under 5 minutes.

Silent sync failures, AttributeValueMustBeUnique, soft match errors, and connector space issues — all decoded with the exact fix for each.

A crashing print spooler almost always traces to a corrupt driver. Here's how to find the bad driver and remove it without taking down the server.

Autopilot setups fail when steps are done out of sequence. This runbook covers device registration, profiles, ESP configuration, and the correct deployment order.

Pre-provisioning fails with red screens and cryptic error codes. This runbook decodes 0x800705B4, 0x80180018, 0x80070774, and every other common failure.

An app shows Failed in Intune with a useless error code. This runbook covers detection rules, install context, CDN blocks, supersedence loops, and 5 more root causes.

CA in a hybrid environment has more moving parts than cloud-only. This runbook builds a safe, working policy set from scratch — emergency account first, report-only mode always.

The correct transfer sequence, pre-flight health checks, NTP reconfiguration after PDC move, and how to seize roles when the holder is dead.

Shares, DFS namespaces, GPO drive maps, and open sessions — handled in the right order so nothing breaks when you pull the plug.

A badly configured AD site causes slow logins and clients hitting the wrong DC. Here's the complete setup from site creation to client verification.

Full hybrid migration — directory sync, mailbox batches, MX cutover timing, SPF/DKIM/DMARC, and the post-migration cleanup most guides skip.

Events 4768, 4771, and 4776 fire constantly but nobody explains what the failure codes actually mean. Every common Kerberos pre-auth failure decoded with the exact fix for each.

Client stuck at 0%, all clients stopped checking in, or the WSUS console grinding to a halt. Covers client-side reset, WSUS database maintenance, and recurring cleanup scripts.

Full Access granted but the mailbox won't open. Send As works in the portal but shows the real sender. Every shared mailbox permission failure mode decoded with PowerShell verification commands.

EDR profile creation, the Intune-MDE connector, onboarding verification, and fixes for every common failure — including the Server 2016 legacy sensor trap and third-party AV conflicts.

NDES service account setup, Certificate Connector installation, trusted root profile, and SCEP profile configuration — plus the error codes that appear when any layer breaks.

Pre-flight AD health checks, static IP and DNS configuration, PowerShell promotion, SYSVOL verification, DNS SRV record registration, replication confirmation, and post-promotion NTP fix.

Password Replication Policy planning, pre-staging the RODC computer account, PowerShell promotion, PRP verification, and delegated administration for sites with no dedicated IT staff.