How do you identify stale objects and automate cleanup?
What’s your process for auditing AD changes (GPOs, users, groups)?
How do you detect unauthorized DC promotion in the environment?
Which logs and tools do you monitor regularly for AD health?
How would you plan for an in-place upgrade of domain controllers?