Complete procedures with a way back.

Plan, promote, harden, validate, and back up a new two-controller Windows Server 2025 forest without exposing credentials or treating a VM snapshot as directory recovery.

Derive exact Kubernetes API permissions from observed calls, create a dedicated ServiceAccount with no ambient token, bind a narrow namespaced Role, mount a short-lived audience-bound token only where needed, and prove both allowed and denied behavior.