Complete procedures with a way back.

Combine group-based share and NTFS permissions, SMB 3.1.1 encryption/signing, Kerberos, ABE, FSRM hard quotas, and a verified metadata-preserving restore.

Build a Generation 2 Hyper-V VM behind a reviewed external switch, enforce ProductionOnly checkpoint lifecycle, and prove independent application-consistent restore.

Build a secure two-server Microsoft DNS service for Active Directory with replicated forward/reverse zones, controlled recursion, authenticated updates, staged scavenging, concrete failover tests, and supported recovery evidence.

Plan, promote, harden, validate, and back up a new two-controller Windows Server 2025 forest without exposing credentials or treating a VM snapshot as directory recovery.

Build an authorized two-server DHCPv4 service with reviewed IPAM, inactive-first scope creation, internal DNS options, shared secure updates, reservations, load-balanced failover, relay and maintenance tests, and isolated recovery.