Windows Server 2016 has several new features as part of ads.
These features help you make your ads environment more secure and migrate to cloud based or hybrid environments.
Privileged Access Management.
Pam is based on Microsoft Identity Manager.
Pam allows you to separate the permissions required for certain administrative activities from the permissions
of the current ads environments.
Members with PAM users request permission to perform activities that require privileged access.
Instead of having that access granted on a permanent basis, granting those permissions can mean that
you should provide additional authentication steps, such as multifactor authentication.
When the user is gains access, the access is granted on a temporary basis through a shadow group in
a bastion forest.
The Bastion Forest is meant to be devoid of any access from hackers or any stolen credentials of privileged
users.
Because the user accounts do not have the required permissions on a permanent basis, there is a decrease
in the possibility of a security breach, such as unlawful access by a malicious hacker who has stolen
and administrators.
Password.
Additional reading for more information on Pam referred to privileged access management for Active Directory
Domain Services.
Azure ad join.
As your Active Directory join Azure AD Join supports connecting on premises domain joined devices to
Azure AD for improved cloud only and hybrid environments.
For corporate owned devices, users no longer need a personal Microsoft account.
Azure ad also supports connecting devices that normally cannot join an on premises domain such as mobile
devices.
Users can access the Windows Store with their on premises accounts and even with their personal devices.
Support also exists for mobile device management, MDM setting up shared devices and imaging corporate
owned devices.