ACTIVE DIRECTORY & GROUP POLICY MASTERCLASS

Stop Just Resetting Passwords. Learn How to Administer, Secure and Troubleshoot Active Directory & Group Policy Professionally.

A new employee joins your organization.

You create the user account.

But the employee still cannot access the Finance shared folder.

Another user has changed departments but still retains access to resources from their previous role.

A computer refuses to receive a security setting that should have been deployed through Group Policy.

An employee is repeatedly locked out.

A newly configured workstation cannot join the domain.

And management asks:

“Who currently has access to our sensitive resources—and why?”

These are not simply password-reset problems.

They involve:

Identity. Authentication. Authorization. Groups. Organizational Units. Permissions. Group Policy. Security. Troubleshooting. Governance.

The GavelBrains Active Directory & Group Policy Masterclass is designed to help IT Support professionals, System Administrators and aspiring infrastructure professionals move beyond basic account administration and develop practical capability in Active Directory Domain Services (AD DS) and Group Policy administration.

From “I Know Active Directory” to “I Can Explain How an AD Environment Works”

Many IT professionals learn how to:

create a user;

reset a password;

add someone to a group;

or join a computer to a domain.

Those are useful skills.

But professional Active Directory administration requires deeper questions:

Where should the object be located?

Which groups should the user belong to?

What permissions do those groups provide?

Which policies should apply?

How is authentication occurring?

Why did a Group Policy setting fail?

What happens when an employee changes role?

How do we prevent unnecessary administrative access?

How do we troubleshoot without making the environment less secure?

The Masterclass develops a structured administration model:

IDENTIFY → ORGANIZE → AUTHENTICATE → AUTHORIZE → APPLY POLICY → MONITOR → TROUBLESHOOT → REVIEW

Imagine This Scenario

Sarah joins the Finance department.

Her account is created.

She is added to the Finance security group.

She can access the required Finance resources.

Six months later, Sarah transfers to Operations.

The IT team adds her to the Operations groups.

But nobody removes her Finance access.

One year later, Sarah has accumulated:

Finance permissions.

Operations permissions.

Project permissions.

Shared-folder access.

Temporary group memberships.

This is access creep.

The problem did not occur because somebody deliberately gave Sarah excessive access.

It happened because access was continually added but not systematically reviewed or removed.

This is why professional Active Directory administration must consider the complete identity lifecycle:

JOINER → MOVER → LEAVER → REVIEW

MODULE 1 — Active Directory Domain Services Foundations

Build a strong understanding of what Active Directory Domain Services does within an enterprise environment.

Develop knowledge around:

✓ Directory services

✓ Domains

✓ Domain controllers

✓ Users

✓ Computers

✓ Groups

✓ Organizational Units

✓ Authentication

✓ Authorization

✓ Group Policy

✓ Administrative responsibilities

Instead of treating Active Directory as:

“The place where user accounts are created,”

you begin understanding it as an enterprise identity and access-management platform.

MODULE 2 — Domains, Forests & Trust Concepts

Active Directory environments have a logical structure.

Develop foundational understanding around:

✓ Domains

✓ Forests

✓ Domain controllers

✓ Directory hierarchy

✓ Trust concepts

✓ Naming

✓ Administrative boundaries

✓ Replication concepts

The objective is not to memorize architecture terminology.

It is to understand how the components relate.

MODULE 3 — Users & Computer Objects

Active Directory manages more than employees.

It can contain objects representing:

✓ Users

✓ Computers

✓ Groups

✓ Service-related identities

✓ Organizational structures

Learn to think about the lifecycle of those objects.

For a user:

Who requested the account?

Which department owns it?

What access should it receive?

When should it expire?

What happens when the person leaves?

For a computer:

Who owns it?

Where should it be located?

Which policies should apply?

Is it still active?

Good directory administration requires lifecycle thinking.

MODULE 4 — Organizational Units

Organizational Units help structure Active Directory objects for administration and policy application.

A poorly designed environment may place nearly everything in one location.

A more deliberate structure considers:

✓ Departments

✓ Locations

✓ Device types

✓ Administrative requirements

✓ Policy requirements

✓ Delegation

Scenario

Management says:

“Apply this security configuration to all Finance computers, but not to the test machines.”

Your OU structure may significantly affect how easily that requirement can be implemented.

This is why OU design should reflect administrative and policy needs—not merely organizational aesthetics.

MODULE 5 — Active Directory Groups

Groups help administrators manage access more efficiently.

Instead of assigning permissions individually to:

50 employees,

you can use appropriate group structures.

Develop practical understanding around:

✓ Security groups

✓ Distribution concepts

✓ Group scope concepts

✓ Membership

✓ Role-based grouping

✓ Permission assignment

✓ Nested groups

✓ Group ownership

✓ Group review

The principle is:

MANAGE ACCESS THROUGH STRUCTURE — NOT RANDOM INDIVIDUAL PERMISSIONS.

MODULE 6 — Authentication vs Authorization

These concepts are frequently confused.

AUTHENTICATION

Answers:

“Can you prove who you are?”

AUTHORIZATION

Answers:

“Now that we know who you are, what are you allowed to access?”

Scenario

A user successfully signs into the domain.

But they cannot open a departmental folder.

The authentication process may have succeeded.

The problem could now involve:

group membership;

permissions;

resource availability;

policy;

or authorization.

Understanding this distinction improves troubleshooting.

MODULE 7 — File & Folder Permissions

Permissions are one of the areas where poor administration can create both security problems and support tickets.

Develop understanding around:

✓ Access permissions

✓ Groups and permissions

✓ Inheritance

✓ Effective access

✓ Least privilege

✓ Shared folders

✓ Access troubleshooting

Scenario

A user says:

“Access Denied.”

Do you simply add them directly to the folder?

A better process asks:

Should the user actually have access?

Which group normally provides it?

Is the user in that group?

Are permissions inherited?

Is there an explicit restriction?

Would adding the user directly create an unmanaged exception?

Troubleshooting should not undermine access governance.

MODULE 8 — Group Policy Foundations

Group Policy helps organizations manage Windows configurations consistently.

Develop practical understanding around:

✓ Group Policy Objects

✓ User configuration

✓ Computer configuration

✓ Policy settings

✓ Linking

✓ Scope

✓ Processing

✓ Administrative templates

✓ Security configuration

Instead of configuring hundreds of computers manually, Group Policy can help standardize settings across appropriate populations.

MODULE 9 — GPO Processing & Inheritance

Creating a GPO does not automatically mean every object receives it.

You need to understand:

✓ Where the GPO is linked

✓ Which objects are in scope

✓ OU structure

✓ Processing order

✓ Inheritance concepts

✓ Filtering concepts

✓ Effective policy

Scenario

You create a security GPO.

It applies successfully to:

90 computers.

But:

10 computers do not receive it.

What do you do?

Recreate the GPO?

Manually configure the ten computers?

Before doing either, investigate.

Are the computers in the expected OU?

Is the GPO linked correctly?

Are they within scope?

Is another policy affecting the result?

Is policy processing occurring?

Professional troubleshooting begins with evidence.

MODULE 10 — Troubleshooting Group Policy

One of the most valuable administration skills is understanding why a policy did not apply.

Use a structured approach:

EXPECTED POLICY → OBJECT LOCATION → LINK → SCOPE → PROCESSING → EFFECTIVE RESULT → EVIDENCE

Ask:

What setting should apply?

To which user or computer?

Where is the object located?

Which GPO contains the setting?

Where is it linked?

Is the object actually in scope?

What does effective policy show?

This is more reliable than repeatedly forcing policy updates and hoping the problem disappears.

MODULE 11 — Passwords & Account Lockouts

Password resets are common IT Support tasks.

But repeated lockouts require investigation.

Possible causes might include:

✓ Old credentials on another device

✓ Cached credentials

✓ Mapped resources

✓ Scheduled tasks

✓ Services

✓ Mobile applications

✓ User error

✓ Suspicious authentication activity

Scenario

A user calls:

“My account keeps locking every 20 minutes.”

Resetting the password repeatedly may only treat the symptom.

A professional administrator tries to identify:

WHAT IS CONTINUING TO SUBMIT THE INVALID CREDENTIALS?

This is the difference between:

RESETTING THE ACCOUNT

and

TROUBLESHOOTING THE ROOT CAUSE.

MODULE 12 — Domain Join Troubleshooting

A workstation cannot join the domain.

What could be wrong?

Possible areas to investigate include:

✓ Network connectivity

✓ IP configuration

✓ DNS

✓ Domain reachability

✓ Credentials

✓ Time synchronization concepts

✓ Computer account state

✓ Permissions

Scenario

The computer has internet access.

But it cannot locate the Active Directory domain.

Internet access does not prove that domain-related DNS and network configuration are correct.

A structured administrator works through dependencies rather than assuming:

“The network is working.”

MODULE 13 — Joiner-Mover-Leaver Administration

Identity lifecycle is one of the most important operational processes in Active Directory.

JOINER

Create the identity.

Assign appropriate groups.

Apply relevant policy.

Provide only required access.

MOVER

Update department/role information.

Add new access.

Remove unnecessary old access.

Review privileged permissions.

LEAVER

Disable or remove access according to organizational procedure.

Address group memberships.

Sessions and dependent systems may also require attention.

Document completion.

REVIEW

Periodically verify that access remains appropriate.

This connects Active Directory administration to security governance.

MODULE 14 — Active Directory Security Fundamentals

Active Directory is a high-value security system.

If directory administration is poorly controlled, attackers may gain significant access across the environment.

Develop awareness around:

✓ Least privilege

✓ Administrative accounts

✓ Privileged groups

✓ Shared accounts

✓ Password security

✓ Service identities

✓ Account lifecycle

✓ Dormant accounts

✓ Excessive permissions

✓ Change documentation

✓ Monitoring and escalation

Security Scenario

An administrator discovers that a normal user account has been added to a highly privileged group.

Do not simply remove it and forget the issue.

Ask:

Who added it?

When?

Why?

Was the change authorized?

What activity occurred while the privilege existed?

Could the account be compromised?

Does the issue require security escalation?

Security-aware administration goes beyond configuration correction.

MODULE 15 — Active Directory Backup, Recovery & Resilience Concepts

Identity infrastructure is business-critical.

Develop foundational awareness around:

✓ Domain-controller resilience

✓ Backup concepts

✓ Recovery considerations

✓ Documentation

✓ Dependencies

✓ Disaster recovery

✓ Administrative access during disruption

The objective is to recognize that Active Directory itself must be included in business-continuity and disaster-recovery thinking.

PRACTICAL ACTIVE DIRECTORY LABS

This Masterclass is designed to encourage hands-on practice in an isolated and authorized lab.

Potential labs include:

✓ Build a test domain

✓ Create Organizational Units

✓ Create test users

✓ Create security groups

✓ Manage group membership

✓ Join test computers to the domain

✓ Configure test shared resources

✓ Apply permissions

✓ Create Group Policy Objects

✓ Link policies

✓ Test user vs computer policy

✓ Troubleshoot policy application

✓ Simulate account lockouts

✓ Practise Joiner-Mover-Leaver workflows

✓ Document administrative evidence

The purpose is not simply:

“I created a domain.”

The purpose is to understand:

WHY IT WAS DESIGNED THAT WAY.

Build an Active Directory Portfolio

If you are developing your career, document your lab professionally.

Potential portfolio projects include:

Active Directory Lab Architecture

Document:

domain structure;

OUs;

users;

groups;

computers;

policy design.

Joiner-Mover-Leaver Project

Show:

account creation;

role-based group assignment;

department transfer;

access removal;

offboarding.

Group Policy Project

Document:

business requirement;

GPO design;

scope;

implementation;

validation;

troubleshooting.

Shared Folder Access Project

Demonstrate:

group-based access;

permissions;

inheritance;

least privilege;

validation.

Troubleshooting Case Study

For example:

GPO not applying

or

User repeatedly locked out.

Document:

PROBLEM → EVIDENCE → HYPOTHESIS → TEST → RESOLUTION → VALIDATION → LESSONS LEARNED.

Always label home-lab projects honestly.

90-Day Active Directory Development Plan

DAYS 1–30 — BUILD FOUNDATIONS

Focus on:

✓ AD DS concepts

✓ Domains

✓ Domain controllers

✓ Users

✓ Computers

✓ Groups

✓ OUs

✓ Authentication

Build your initial lab.

DAYS 31–60 — BUILD ADMINISTRATION SKILLS

Focus on:

✓ Permissions

✓ Group Policy

✓ GPO processing

✓ Domain joins

✓ Passwords and lockouts

✓ Joiner-Mover-Leaver administration

Create structured lab exercises.

DAYS 61–90 — BUILD PROFESSIONAL READINESS

Focus on:

✓ Troubleshooting

✓ Security fundamentals

✓ Portfolio case studies

✓ Administrative documentation

✓ Interview questions

✓ Scenario practice

✓ Remaining skills gaps

The objective is to move from:

“I know how to create an AD user.”

to:

“I understand how identities, groups, permissions, OUs and policies work together—and I can troubleshoot and document them.”

Imagine the Interview Difference

The interviewer asks:

“A user can log in but cannot access the Finance shared folder. How would you troubleshoot it?”

Weak answer:

“I would reset their password.”

Stronger answer:

“Since the user can authenticate successfully, I'd first clarify whether the issue is isolated to the Finance resource and whether access previously worked. I'd confirm the user is supposed to have access, then review the group membership or access path that normally grants permission. I'd check the resource permissions and inheritance rather than immediately adding the user directly. I'd compare with a working user where appropriate, identify whether the issue is authorization or resource-related, make the least disruptive approved correction, validate access with the user and document the change.”

That answer demonstrates:

IDENTITY + AUTHORIZATION + TROUBLESHOOTING + SECURITY + DOCUMENTATION.

Who Is This Masterclass For?

The Active Directory & Group Policy Masterclass is designed for:

• IT Support professionals
• Help Desk technicians
• Desktop Support professionals
• Junior System Administrators
• System Administrators
• Windows Administrators
• Microsoft 365 professionals
• Infrastructure professionals
• IAM professionals
• Cybersecurity professionals
• IT consultants
• Career changers with IT foundations
• Professionals preparing for IT Support/System Administration interviews

Career Areas This Training Can Support

Depending on your wider experience and employer requirements, this knowledge can strengthen preparation for roles such as:

IT Support Technician

Service Desk Analyst

Desktop Support Technician

Junior System Administrator

Windows Administrator

Infrastructure Support Analyst

Systems Support Engineer

Identity Support Administrator

IT Operations Support

What Makes This Masterclass Different?

The objective is not:

“Memorize where buttons are located in Active Directory Users and Computers.”

The Masterclass connects:

USER → GROUP → OU → POLICY → PERMISSION → RESOURCE → SECURITY → EVIDENCE.

You learn to ask:

Who is the identity?

What role do they perform?

Which access do they require?

Which group should provide it?

Where should the object be located?

Which policy should apply?

What evidence shows the policy actually applied?

What happens when the employee changes role?

What happens when they leave?

That is professional Active Directory administration.

THE COMPLETE GAVELBRAINS LEARNING EXPERIENCE

Active Directory & Group Policy Masterclass

Including:

✓ Active Directory Domain Services foundations

✓ Domains, forests and trust concepts

✓ Users and computers

✓ Organizational Units

✓ Groups and group strategy

✓ Authentication vs authorization

✓ File and folder permissions

✓ Group Policy foundations

✓ GPO processing and inheritance

✓ Group Policy troubleshooting

✓ Password and account-lockout troubleshooting

✓ Domain-join troubleshooting

✓ Joiner-Mover-Leaver administration

✓ Active Directory security fundamentals

✓ Backup and recovery concepts

✓ Practical Active Directory labs

✓ Scenario-based troubleshooting

✓ Portfolio-development guidance

✓ Implementation worksheets

✓ 90-Day Active Directory Development Plan

Product Price: ₦40,000

Move beyond basic password resets and account creation.

Learn how to organize identities, control access, apply policy, troubleshoot problems and administer Windows domain environments more professionally.

IDENTIFY → ORGANIZE → AUTHENTICATE → AUTHORIZE → APPLY POLICY → TROUBLESHOOT → REVIEW → DOCUMENT

GavelBrains Academy

Practical Skills. Professional Careers.

Manage Identity. Apply Policy. Build System Administration Skills.

This Masterclass is an educational and professional-development resource. It does not guarantee employment, certification, promotion or salary outcomes. Active Directory environments differ between organizations. Perform labs only in systems you own or are explicitly authorized to administer, and follow organizational security, backup and change-management requirements before making production changes.