Day Two Operations: Hardening Three Windows Domain Controllers (and Finding a Clock That Answered to Nobody)

Mon, 28 Sep 2026 14:57:03 +0200

In the last post three HP boxes became a Windows Server 2025 domain: AD, DNS, DHCP failover, Group Policy, BitLocker, Storage Spaces. That was day one: everything installed, everything green, everything “works”.

This post is about day two, the part where you stop admiring the green checkmarks and start asking uncomfortable questions. What time is it, according to whom? Which services are running that nobody asked for? What happens if a server simply doesn’t boot tomorrow? Spoiler: one of those questions had a very funny answer.

Enough YAML for Now: Three Servers, Windows Server 2025, and a Crash Course on the Dark Side

Wed, 23 Sep 2026 21:06:04 +0200

Confession time. After the Nextcloud migration battle log, a double-digit number of playbook runs, one nftables ruleset that cheerfully flushed K3s’ own tables, and more YAML than any human should read in a single week, I had officially had it up to here with Nextcloud, Ansible and anything containing the word “migration”.

So I did what any reasonable Linux nerd does when burned out on Linux: I went over to the other side. Three servers, three fresh installs of Windows Server 2025, and a few evenings of Active Directory, DNS, DHCP, Group Policy, Storage Spaces and BitLocker. No YAML. Just a lot of Get- and Set-.

Domain Controller – apt-upgrade.me – Homelab, Linux & DevSecOps

Day Two Operations: Hardening Three Windows Domain Controllers (and Finding a Clock That Answered to Nobody)

Enough YAML for Now: Three Servers, Windows Server 2025, and a Crash Course on the Dark Side