Windows & Active Directory Administration
Build a working mental model of Windows — processes, the registry, users and permissions — then how Active Directory lets one team manage thousands of machines and identities. A core-technology foundation for IT operations, system administration, Cloud, DevOps and Security roles alike. Recommended prior knowledge: Cyber Foundations.
What you will be able to do
- Explain how a Windows machine is built — processes, services, the registry, the file system and the local security model — and inspect it from the command line and PowerShell.
- Reason about identity and access: local vs domain accounts, groups and SIDs, NTFS and share permissions, and how logon and authentication work in Active Directory.
- Understand how an organization manages Windows at scale — domains, OUs, Group Policy — and troubleshoot and audit a Windows system methodically from its logs.
Units
- 01
Windows Foundations
What a Windows system actually is: processes and how programs run, services that run in the background, the registry as the system's configuration database, the file system layout, and the local security model that decides who can do what.
BeginnerAvailableWhy you are learning this
Every later unit — and every role that ever administers, secures or troubleshoots a Windows machine — assumes you can picture what is running, where configuration lives, and how the system decides what is allowed. This unit builds that picture from nothing.
- 02
Working with Windows: Command Line & PowerShell
How administrators actually drive Windows: navigating from the command line, the difference between the classic shell and PowerShell, why PowerShell works with objects rather than plain text, and using cmdlets to inspect a system reliably and repeatably.
BeginnerAvailableWhy you are learning this
Clicking through windows does not scale and cannot be automated. The command line and PowerShell are how real administration, troubleshooting and automation get done — and how everything you inspect later in this path is actually retrieved.
- 03
Users, Groups & Local Security
How Windows identifies and authorizes people: local accounts and groups, the SID as the real identity behind a name, privileges and rights, User Account Control (UAC), and the principle of least privilege applied on a single machine.
BeginnerAvailableWhy you are learning this
Almost every 'can this person do that?' question — and almost every privilege-escalation risk — comes down to accounts, groups, SIDs and privileges. This is the local identity model that Active Directory later scales to the whole organization.
Unit contents3
- 04
Files, NTFS Permissions & Shares
How Windows controls access to data: NTFS permissions and access control lists, how permissions inherit down a folder tree, the difference between share permissions and NTFS permissions, and how to work out a user's effective access.
BeginnerAvailableWhy you are learning this
Shared files are where organizations keep their work — and where 'why can they read that?' and data-exposure incidents happen. Reading an ACL and computing effective permissions is a daily administration and security skill.
Unit contents4
- 05
Active Directory Fundamentals
What a directory service is and why organizations use one: the domain, tree and forest, organizational units (OUs) for structure, the objects AD stores (users, groups, computers), and the central role DNS plays in making it all findable.
BeginnerAvailableWhy you are learning this
Active Directory is the backbone of identity in most organizations — one place that answers 'who are you and what may you access' for thousands of users and machines. Understanding its structure is the foundation of enterprise administration and security.
- 06
Authentication & Access in Active Directory
How a domain proves who you are and lets you reach resources: interactive vs network logon, the idea behind Kerberos tickets and where NTLM still appears, single sign-on, and how trusts extend access between domains.
BeginnerAvailableWhy you are learning this
Authentication is where access begins and where many attacks live. A conceptual grasp of Kerberos, NTLM, logon types and trusts is what lets you reason about single sign-on, access failures, and the credential-based attacks that later security paths study in depth.
Unit contents4
- 07
Group Policy & Managing at Scale
How one team configures thousands of machines consistently: what a Group Policy Object (GPO) is, how policies are scoped to sites, domains and OUs, the order in which they apply and win, and why central management beats touching every machine.
BeginnerAvailableWhy you are learning this
Group Policy is how enterprise Windows is actually configured and secured at scale. Understanding GPO scope and precedence explains both 'why did this setting apply?' in administration and 'why is this hardening not taking effect?' in security.
Unit contents3
- 08
Operations: Logging, Auditing & Troubleshooting
How to see what a Windows system is doing and fix it when it breaks: the Windows event logs and the key channels, what auditing records and why, and a repeatable method for troubleshooting a Windows or AD problem from its evidence.
BeginnerAvailableWhy you are learning this
When something breaks or looks wrong on Windows, the event logs are the ground truth. Reading them and troubleshooting methodically is the daily core of Windows operations — and the exact evidence that SOC, detection, endpoint and DFIR roles later build on.
Recommended next
SOC Analyst L1
Learn how modern SOC analysts monitor, investigate, triage and respond to security events — by doing the work, not by memorising definitions.
Scripting & Automation
Build a working mental model of how programs think — data, logic, functions, files — and use it to automate repetitive work reliably. A core-technology foundation for Cloud, DevOps, Data, Programming, AI and Security roles alike. Concepts are language-agnostic, shown mainly in Python. Recommended prior knowledge: Cyber Foundations.
Endpoint Security
Defending endpoints end to end — architecture and attack surface, telemetry and EDR, process-lineage investigation, containment decisions, and hardening. Where telemetry, detection, forensics and response meet the real host. Recommended prior knowledge: Cyber Foundations, SOC or Detection Engineering.