Nobody wants to read domain controller logs for a month by hand. Invoke-ADPinCensus turns on the instruments, collects across the window, and hands back one dependency report with the rows pre-populated and the dispositions left to you. What it does, what it deliberately does not, and how to run it.
Turn on the instruments, run them for thirty days, and end Stage 0 with a dependency inventory that has zero unknowns: NTLM and LDAP auditing, the Kerberos consumer census, the account sweep, and the planted test that proves your silence is real.
Every failed AD migration starts with a dependency list built from memory. The domain controllers have been keeping their own inventory for years. Stage 0 is learning to read it: what can pin a domain, the instrument for each class, and the gate that ends the guessing.
A 140-seat company with healthy hybrid AD, Intune, and Exchange Online can retire its last domain controller. The whole path in seven pausable stages, what it costs at Business Premium, and who should not attempt it.
