Complete procedures with a way back.

Import the official Windows Server 2025 baseline into a new GPO, review differences, scope a safe pilot, prove RSoP and events, test recovery, and roll out by rings.

Build a secure two-server Microsoft DNS service for Active Directory with replicated forward/reverse zones, controlled recursion, authenticated updates, staged scavenging, concrete failover tests, and supported recovery evidence.

Plan, promote, harden, validate, and back up a new two-controller Windows Server 2025 forest without exposing credentials or treating a VM snapshot as directory recovery.