What are good and bad Active Directory snapshots

Explains why hypervisor snapshots of domain controllers can't replace proper AD backups: restores risk lingering objects, replication inconsistency, and USN rollback during forest recovery.

Active Directory fails in two flavors—DC outages and logical corruption of directory data—but recovery plans often address only the first; the post explains why logical corruption is harder to heal.

The AD Replication Status Tool returns: a GUI for monitoring replication between domain controllers, after a brief Microsoft removal; the post recounts its history and favor among admins.

Syncing Domain Admins into Entra ID lets attackers pivot from compromised on-prem AD to the cloud, and back via password writeback. CIS and Microsoft advise keeping privileged admin accounts cloud-only.

Unkaputtbar brings VM-style snapshots to bare-metal Kali via BTRFS and snapper: automatic snapshots on apt operations and boot, booting into snapshots from GRUB, plus diff, browse, and restore.

A domain controller should do one thing: control the domain. Why ADDS belongs on a DC and which roles, tools, and apps to keep off it to shrink the attack surface.