Start at the beginning: turn a standalone Windows Server into a working domain. You'll install the AD DS role, promote the server to a domain controller, confirm the promotion actually succeeded, join a member server to the domain, and move FSMO roles between DCs.
The objects you'll touch every day. You'll create user accounts in Active Directory Users and Computers, put a group-based access model in place instead of assigning permissions one user at a time, and design an OU structure you can safely delegate to other admins.
Group Policy is where most AD questions actually land. You'll build a GPO that maps a network drive, then use gpresult, the tool every admin reaches for, to prove which settings applied, which didn't, and why.
Lock down the accounts you've been creating. You'll configure the domain password policy that every user in the domain has to live with (length, complexity, history, and age requirements) and verify the settings actually take effect when a user changes their password.
