Domain 1: Deploy and manage AD DS
- Install-ADDSForest promotes the first domain controller and creates a new forest and domain in one step (for example Install-ADDSForest -DomainName corp.contoso.com -InstallDns), while Install-ADDSDomainController adds a DC to an existing domain; Install-WindowsFeature AD-Domain-Services -IncludeManagementTools only stages the binaries and management tools, it does not promote anything.
- A domain controller deployed on an Azure VM should sit in its own AD DS site mapped to the VNet subnet, hold a static private IP address, and keep the NTDS database and SYSVOL on a data disk rather than the OS disk, so that site-aware clients and replication behave predictably across the hybrid boundary.
- A Read-Only Domain Controller holds a read-only replica of the directory and caches only the credentials allowed by its Password Replication Policy, which limits credential exposure at a branch site with weak physical security; combining an RODC with a Server Core installation removes the GUI and shrinks the patch and attack surface further.
- The five FSMO roles (Schema Master, Domain Naming Master, RID Master, PDC Emulator, Infrastructure Master) hold operations that must be performed by a single DC; transfer them gracefully with Move-ADDirectoryServerOperationMasterRole while the current holder is online, and seize only when the holder is permanently lost and will never return to the network.
- Uninstall-ADDSDomainController demotes a domain controller; the -ForceRemoval switch lets you demote a DC that cannot contact any replication partner, after which you must run metadata cleanup so the orphaned DC object, NTDS Settings and DNS records are removed from the directory.
- AD DS sites model physical locations and each site is defined by the IP subnets associated with it, so a branch client only prefers its local DC once the branch subnet object exists and is mapped to the branch site; without that mapping the client authenticates across the WAN to whatever DC the locator returns.
- Site links control intersite replication with a cost, an interval and a schedule, and the Knowledge Consistency Checker builds and repairs the connection objects that implement that topology automatically; enabling change notification on a site link makes intersite replication behave like intrasite replication and push changes immediately instead of waiting for the interval.
- Windows Server 2025 introduced the first new functional level since Windows Server 2016, mapping to DomainLevel 10 and ForestLevel 10 for unattended promotion; Microsoft never created a Windows Server 2019 or Windows Server 2022 functional level, so a forest built on those releases stays at the 2016 level.
- The 32k database page size is an optional Windows Server 2025 feature that replaces the original 8k Extensible Storage Engine page, raising multivalued attribute capacity to roughly 3,200 values; it is enabled forest-wide, requires the new functional level, and requires every DC in the forest to have a 32k-capable database, because an in-place upgraded DC keeps its existing 8k format.
- Trusts extend authentication between domains and forests: a forest trust between two forest root domains is transitive across every domain in both forests, an external trust is nontransitive and targets a single domain, and selective authentication makes trusted users prove the Allowed to Authenticate right on each resource server instead of granting them blanket access.
- Group-managed service accounts remove password management from services by rotating a machine-generated password automatically across every authorized host, and they require a KDS root key before New-ADServiceAccount will work; Windows Server 2025 adds the delegated Managed Service Account, which migrates an existing service account to fully randomized managed keys and disables the original account's password.
- Group Policy applies in the order Local, Site, Domain, OU, with the last writer winning, so an OU-linked GPO normally beats a domain-linked one; Enforced on a link makes its settings win regardless of that order and survive Block Inheritance, while security filtering and WMI filtering narrow which objects actually process the GPO.
- Group Policy preferences differ from policy settings in that they are applied but not enforced: the user or an administrator can change the resulting value, and unless you tick Remove this item when it is no longer applied the setting persists after the GPO stops applying, which is why preferences suit drive maps, shortcuts and registry seeding rather than security controls.
- Clients find domain controllers through the SRV records that the Netlogon service registers in the _msdcs zone, so a missing or stale SRV record breaks logon even when A records resolve; Windows Server 2025 also requires LDAP signing and sealing by default after a SASL bind for new deployments, and LDAPS needs a server authentication certificate installed on the DC itself, not AD FS.
Domain 2: Manage Windows Server instances and workloads in a hybrid environment
- Windows Admin Center is a browser-based console that manages servers, clusters and Hyper-V hosts; installing it in gateway (service) mode publishes it as a shared service that many administrators reach from their browsers, and a silent install looks like msiexec /i WindowsAdminCenter.msi /qn /L*v log.txt SME_PORT=6516 SSL_CERTIFICATE_OPTION=generate.
- Windows Admin Center is also available inside the Azure portal, where it manages Azure VMs and Azure Arc-enabled servers without a VPN or a public endpoint on the target; on Windows Server 2025 that portal experience is part of Windows Server Management enabled by Azure Arc, a benefit tied to Software Assurance or subscription licences.
- Server Core omits the desktop shell and most graphical tools, which reduces disk and memory footprint and the number of components that need patching; you configure it locally with sconfig or PowerShell and administer it remotely with Windows Admin Center, Server Manager or RSAT from a management workstation.
- PowerShell remoting runs over WinRM on TCP 5985 for HTTP and TCP 5986 for HTTPS, using Enter-PSSession for an interactive session and Invoke-Command to fan out to many hosts; a stopped WinRM service, a missing listener or a blocked inbound Windows Remote Management rule are the usual causes of a failed connection.
- Kerberos is not available when the client and target are not in the same or a trusted domain, so for a workgroup or cross-forest target you add the host to the client's WinRM TrustedHosts list with Set-Item WSMan:\localhost\Client\TrustedHosts and supply explicit credentials.
- The double-hop problem occurs because a remote session receives a Kerberos ticket for the first server only and cannot forward the user's credentials to a second server; you solve it with CredSSP, which is easy but caches credentials on the intermediate host, or with resource-based Kerberos constrained delegation configured on the destination, which is the safer option.
- Just Enough Administration constrains a remoting endpoint to a defined set of cmdlets, functions and parameter values through a role capability file and a session configuration file registered with Register-PSSessionConfiguration; the session runs under a virtual or group-managed account, so an operator can perform a task without being a local administrator.
- The OpenSSH server component is installed by default on Windows Server 2025, with a one-step Remote SSH Access toggle in Server Manager that enables the sshd service, and membership of the OpenSSH Users group controls who may connect; on earlier releases OpenSSH Server is an optional feature you install first.
- Remote desktop access is controlled by the Remote Desktop Users group plus the Allow log on through Remote Desktop Services user right, listens on TCP 3389, and should keep Network Level Authentication on so the session is authenticated before a desktop is created.
- Azure Arc projects an on-premises or multicloud server into Azure as a first-class resource using the Azure Connected Machine agent (azcmagent), after which Azure Policy, tagging, RBAC, Microsoft Defender for Cloud, Azure Monitor and extensions all work against it; on Windows Server 2025 Azure Arc Setup ships as a Feature on Demand with a wizard and tray icon to complete onboarding.
- Once a machine is Arc-enabled you deploy Azure services to it through VM extensions exactly as you would on an Azure VM, for example New-AzConnectedMachineExtension -Name AMAAgent -ExtensionType AzureMonitorWindowsAgent -Publisher Microsoft.Azure.Monitor to install the Azure Monitor Agent on a non-Azure server.
- Azure Update Manager assesses and patches Azure VMs, Arc-enabled servers and Azure Local clusters from one pane with no dependency on Log Analytics or an Automation account; enable periodic assessment to check for updates every 24 hours, schedule installs inside a maintenance configuration, and note that it can deploy updates published to WSUS as well as Microsoft Update.
- Azure Automation runbooks automate operational tasks in PowerShell or Python on a schedule or in response to an alert, and a Hybrid Runbook Worker lets the same runbook execute against on-premises resources; authenticate the runbook with a managed identity rather than stored credentials.
Domain 3: Manage virtual machines
- Enhanced Session Mode connects to a VM through the VMBus rather than the network, so you get clipboard, local drive, printer and smart card redirection to a guest that has no working network configuration; it must be enabled in the host's Hyper-V Settings under both the server and the user policy, and the guest must support Remote Desktop.
- PowerShell Direct runs commands inside a guest over the VMBus with Enter-PSSession -VMName or Invoke-Command -VMName, so it works with no IP connectivity, no firewall rule and no WinRM listener, as long as the guest runs a supported Windows version and you supply valid guest credentials; SSH Direct provides the equivalent path to Linux guests.
- Enabling nested virtualization is an ordered sequence: shut the guest down, run Set-VMProcessor -VMName VM1 -ExposeVirtualizationExtensions $true on the host, enable MAC address spoofing on the guest's network adapter so the inner VMs can reach the network, then install Hyper-V inside the guest; Dynamic Memory is not supported on a VM that hosts nested VMs.
- Dynamic Memory lets Hyper-V move RAM between a configured minimum, startup and maximum using a percentage buffer, for example Set-VMMemory -VMName WEB1 -DynamicMemoryEnabled $true -MinimumBytes 512MB -MaximumBytes 4GB; the Minimum RAM value is the floor the host may shrink the VM to, and workloads that manage their own memory should be left on static memory.
- Integration services provide the guest-to-host channel for heartbeat, time synchronization, operating system shutdown, key-value exchange, VSS backup and Guest Services file copy; each one is toggled per VM with Enable-VMIntegrationService, and a stale integration component in the guest is a common cause of a feature silently not working.
- Discrete Device Assignment dismounts a supported PCIe device from the host and assigns it to exactly one VM for near-native performance, which suits a single GPU-bound or NVMe-bound workload; the device is not shared, and a physical GPU can be configured for DDA or for partitioning, never both.
- GPU partitioning divides one physical GPU into hardware-backed fractions using SR-IOV so several VMs each get a dedicated slice with an enforced security boundary; Windows Server 2025 added live migration for GPU-P VMs on IOMMU DMA bit tracking capable processors, high availability for GPU-P on a cluster requires Windows Server 2025 Datacenter, and partitions are auto-assigned rather than hand-picked per VM.
- A production checkpoint uses VSS inside the guest to take an application-consistent, fully supported point-in-time copy and does not save the VM's running memory, whereas a standard checkpoint saves memory and device state and is a lab tool; production is the default, and deleting an intermediate checkpoint merges its differencing disk into the parent rather than losing data.
- Virtual hard disks come as fixed (space allocated up front, best predictability), dynamically expanding (grows on demand) and differencing (writes go to a child of a read-only parent); Resize-VHD changes capacity, Optimize-VHD reclaims space in a dynamic disk, and a VHD Set (.vhds) is the shared disk format for a guest failover cluster.
- A Hyper-V virtual switch is External (bound to a physical NIC and shared with the host), Internal (host plus VMs only) or Private (VMs only); per-adapter settings such as VLAN ID, MAC address spoofing, DHCP guard, router guard and bandwidth management are set on the VM network adapter, while Switch Embedded Teaming combines host NICs with the switch instead of using a separate NIC team.
- Hyper-V Replica asynchronously replicates a VM to a secondary host at 30 seconds, 5 minutes or 15 minutes using resilient change tracking; it authenticates with Kerberos over HTTP between domain-joined hosts or with a certificate over HTTPS when a host is not domain joined or the traffic must be encrypted, and you can keep up to 24 hourly recovery points with optional VSS application-consistent snapshots.
- Hyper-V Replica distinguishes three failovers: a test failover creates an isolated temporary copy without touching production, a planned failover shuts the primary down gracefully and replicates the remaining changes so nothing is lost, and an unplanned failover starts the replica without the primary and accepts data loss; extended replication chains the replica to a third host rather than replicating from the primary twice.
- High availability for Hyper-V VMs comes from clustering the hosts and placing the VMs on Cluster Shared Volumes so a node failure restarts them elsewhere, while Move-ClusterVirtualMachineRole -Name VM1 -Node Node2 -MigrationType Live moves a running VM for maintenance with no downtime; Windows Server 2025 dynamic processor compatibility raises the feature set available across mixed-generation cluster hosts.
- In Azure, availability sets spread VMs across fault and update domains inside one datacenter while availability zones spread them across physically separate datacenters in a region, scale sets add identical instances behind a load balancer, and just-in-time VM access in Microsoft Defender for Servers Plan 2 keeps deny-all inbound rules on RDP and SSH until an approved, time-limited request opens them; Azure Bastion is the alternative that removes the public IP entirely.
Domain 4: Implement and manage an on-premises and hybrid networking infrastructure
- An Active Directory-integrated zone stores its records in the directory instead of a text file, which gives it multi-master updates, replication with normal AD replication traffic, granular record permissions, and the option to accept secure dynamic updates only, so a rogue host cannot overwrite another machine's registration.
- A forwarder sends every query the server cannot answer to a named upstream resolver, a conditional forwarder does the same only for a specified domain suffix, and a stub zone instead keeps a live copy of the target zone's NS records so the local server can find that zone's authoritative servers itself.
- Record types map cleanly to tasks: A and AAAA resolve a host to IPv4 and IPv6, CNAME makes one name an alias of a canonical host so a move needs a single edit, PTR answers reverse lookups, SRV locates services such as domain controllers, and TXT carries SPF, DKIM, DMARC and domain verification strings.
- Reverse name resolution needs a matching in-addr.arpa (or ip6.arpa) reverse lookup zone to exist before PTR records can be created or registered, which is why nslookup on a name succeeds while nslookup on the address fails on a network that never built the reverse zone; create the forward zone with Add-DnsServerPrimaryZone and add a host record with Add-DnsServerResourceRecordA -ZoneName contoso.com -Name www -IPv4Address 10.0.0.50.
- Aging and scavenging removes stale dynamically registered records by comparing a record's timestamp against a no-refresh interval followed by a refresh interval; it must be enabled at both the server and the zone before anything is deleted, and static records are never scavenged because they carry no timestamp.
- Round robin rotates the order of multiple equal records for the same name to spread load crudely, while netmask ordering overrides it to return the record closest to the client's subnet first; neither is health aware, so neither removes a failed host from rotation.
- DNS policies add three objects: a client subnet describes where a query came from, a zone scope holds a separate set of records inside one zone, and a recursion scope holds a distinct recursion and forwarder configuration; query resolution policies then map criteria such as client subnet, FQDN, query type, transport or time of day to a scope, which is how split-brain DNS, geo-location traffic management and blackholing a malicious subnet are implemented.
- Query resolution policies exist at server or zone level with a unique processing order, and a server-level policy may only DENY or IGNORE, never ALLOW; recursion policies can be created at server level only, and zone transfer policies likewise restrict themselves to DENY or IGNORE.
- DNSSEC signs a zone so resolvers can validate that an answer came from the authoritative zone and was not altered, adding RRSIG signatures, DNSKEY keys, DS delegation records and NSEC3 records for authenticated denial of existence; a validating server needs a trust anchor, which on a domain controller is stored in the forest directory partition, and the Name Resolution Policy Table is what forces Windows clients to require validation for a namespace.
- Hybrid name resolution has two directions: on-premises servers reach Azure private zones through a conditional forwarder that points at an Azure DNS Private Resolver inbound endpoint or a DNS forwarder VM, while Azure resources reach on-premises zones through a Private Resolver outbound endpoint with a forwarding ruleset; inside a VNet the platform resolver always answers at 168.63.129.16.
- DHCP hands out configuration from a scope with a lease duration, exclusion ranges and options, a reservation pins one address to a client's MAC address, and option values applied at reservation level beat scope level, which beats server level; a DHCP server must also be authorized in Active Directory before it will service a domain network.
- DHCP failover is a relationship between exactly two servers and covers DHCPv4 scopes only: hot standby designates an active and a standby server and holds back a reserve percentage of addresses (5 percent by default) for the standby, while load balance mode splits requests by a hash of the client MAC address at a default 50:50 ratio; both rely on the Maximum Client Lead Time, both use TCP port 647, both need the servers' clocks within one minute, and scope changes must be replicated to the partner by hand.
Domain 5: Manage storage and file services
- Azure file share performance is decided at the storage account: premium shares live in a FileStorage account, which is also the only place NFS 4.1 shares can exist, while standard shares sit in a general-purpose v2 account with transaction optimized, hot and cool access tiers, and the protocol of an existing share cannot be switched afterwards; protect the contents with soft delete, which retains a deleted share for a configurable 1 to 365 days before it is purged, and with share snapshots, which are incremental so each one stores only the blocks that changed.
- Identity-based authentication over SMB uses exactly one identity source per storage account, chosen from on-premises AD DS, Microsoft Entra Domain Services or Microsoft Entra Kerberos; share-level access is granted through Azure RBAC roles against the Microsoft Entra identity while directory and file permissions are enforced by ordinary Windows ACLs, which is what lets you retire the storage account key, and a private endpoint gives the share a private IP inside the VNet.
- Azure File Sync centralizes file shares in Azure Files while keeping a local Windows Server cache: you create a Storage Sync Service, register each server with Register-AzStorageSyncServer after installing the agent, then build a sync group containing one cloud endpoint (the Azure file share) and one server endpoint per registered server path.
- Cloud tiering keeps the full namespace on the server but replaces the content of cool files with a reparse point that has the offline and FILE_ATTRIBUTE_RECALL_ON_DATA_ACCESS attributes set and a size on disk of zero, so an application that opens the file triggers a transparent recall; the volume free space policy tiers until a chosen percentage of the volume is free and the date policy tiers anything untouched for a set number of days.
- Effective access over the network is the intersection of the share permission and the NTFS permission, so a share granting Change to a group whose NTFS rights are Read still yields Read; New-SmbShare -Name Data -Path D:\Data -ChangeAccess corp\SalesRW creates the share and its share-level right in one call, and access-based enumeration hides folders a user has no rights to read.
- SMB over QUIC tunnels SMB inside a TLS 1.3 session over UDP port 443 instead of TCP 445, which makes an edge file server reachable over the internet without a VPN; it needs a server authentication certificate mapped with New-SmbServerCertificateMapping, it is available on any edition of Windows Server 2025 (previously only Windows Server 2022 Datacenter: Azure Edition), and a KDC proxy is the recommended addition so clients use Kerberos rather than NTLM.
- Windows Server 2025 hardened SMB by default: signing is now required for all outbound connections rather than only for SYSVOL and NETLOGON, the authentication rate limiter delays each failed NTLM attempt to blunt brute force, the client can block NTLM on outbound connections entirely, and signing and encryption support can be audited before you enforce it on third-party clients.
- DFS Namespaces present one logical path such as \\corp.contoso.com\Public over shares that physically live on several servers, created with New-DfsnRoot -Path \\corp.contoso.com\Public -Type DomainV2 -TargetPath \\FS1\Public, and DFS Replication keeps the folder targets in step; a replication member that has not replicated within MaxOfflineTimeInDays (60 by default) is disabled and must be re-added rather than simply reconnected.
- File Server Resource Manager enforces storage policy: quotas apply a hard limit or a soft (report-only) limit with notification thresholds, file screens block or audit file types by group, classification rules tag files by content or property, and file management tasks act on those classifications on a schedule, for example expiring or moving stale data.
- Storage Spaces pools physical disks into virtual disks with simple, mirror or parity resiliency, and Storage Spaces Direct extends that across cluster nodes into software-defined shared storage with the fastest devices acting as cache; Windows Server 2025 adds thin provisioned S2D volumes that draw from the pool only as data is written and can be converted from fixed.
- Storage Replica performs block-level volume replication, synchronous for zero data loss within a low-latency site pair and asynchronous across longer distances, and Windows Server 2025 adds compression and an enhanced log to cut bandwidth and improve block replication performance; Data Deduplication is the separate feature that reclaims capacity by storing identical chunks once.
- ReFS targets large datasets and resiliency with integrity streams, block cloning and, on Windows Server 2025, native deduplication and compression, while NTFS remains the general-purpose file system with the broadest feature support including EFS, hard quotas and full BitLocker tooling; pick per volume against what the workload actually needs.
- Storage QoS measures everything in normalized IOPS, where any request of 8 KB or smaller counts as one and a 256 KB request counts as 32, and it requires VMs hosted on a Scale-Out File Server or on Cluster Shared Volumes; an Aggregated policy shares its MinimumIops and MaximumIops across every VHD assigned to it, whereas a Dedicated policy applies the same floor and ceiling to each VHD separately.
- An iSCSI Target Server presents block storage over the network to initiators identified by IQN, which is how you build shared storage for a cluster without a SAN, and BitLocker encrypts whole volumes with the key protected by the TPM, a startup key or a recovery password; store recovery passwords in Active Directory by Group Policy so a locked volume can be recovered with manage-bde rather than rebuilt.
Domain 6: Secure Windows Server infrastructure
- Exploit Protection is the successor to EMET and applies mitigations such as DEP, mandatory and bottom-up ASLR, Control Flow Guard and SEHOP either system wide or targeted at an individual process, which is how you harden a fragile legacy application; tune the settings on one server, export them to an XML file, and deploy that file to the rest through Group Policy.
- App Control for Business, previously called Windows Defender Application Control, inverts the default so code runs only when policy allows it, enforced by code integrity in the kernel and extended to scripts, MSI installers and batch files, with interactive PowerShell dropped into Constrained Language Mode; a policy in audit mode logs what it would have blocked without blocking it, which is the mandatory step before you switch it to enforced.
- App Control rules can trust a code signing certificate, a file's publisher or hash, a path, the Intelligent Security Graph reputation service, or the managed installer that deployed the software, so you can authorize a whole software distribution channel instead of enumerating every binary; when a legitimate file is blocked, the fix is to add a publisher or hash rule to a supplemental policy and redeploy rather than to turn enforcement off.
- App Control policies apply to the whole device and affect every user on it, while AppLocker rules can be scoped to specific users and groups and depend on the Application Identity service being started; Microsoft's guidance is to enforce App Control at the most restrictive level the organization can accept and use AppLocker only to add per-user rules on shared machines.
- Credential Guard uses virtualization-based security to run the LSA secrets in a Hyper-V-backed trustlet so derived credentials such as NTLM hashes and Kerberos ticket-granting tickets cannot be read from the running operating system, which defeats pass-the-hash and pass-the-ticket; it is enabled by default on Windows Server 2025 machines that meet the requirements, and a UEFI lock stops a local administrator from quietly turning it off.
- Microsoft Defender SmartScreen checks downloaded files and visited sites against Microsoft reputation data and warns or blocks on unrecognized or malicious content; on a server it is configured through Group Policy or the Defender settings and complements, rather than replaces, antivirus and application control.
- OSConfig is the Windows Server 2025 way to apply and hold a security posture: it delivers scenario documents covering the role-aware Windows Server security baseline, Microsoft Defender Antivirus, LAPS, secured-core and App Control, and its drift control feature re-corrects any setting that moves away from the desired state; where a baseline must go to older servers, the Security Compliance Toolkit still ships the equivalents as GPO backups with Policy Analyzer and LGPO, and either way you scope the baseline so settings for absent roles are not applied.
- Windows LAPS gives every machine a unique local administrator password that rotates automatically and is stored in Active Directory or Microsoft Entra ID, eliminating a shared local admin credential; Windows Server 2025 adds automatic managed account creation, readable passphrase complexity options, image rollback detection through the msLAPS-CurrentPasswordVersion attribute, and a post-authentication action that can terminate the processes still running as the managed account.
- Microsoft Defender for Servers is the Defender for Cloud plan that brings endpoint detection and response, vulnerability assessment and threat intelligence to Windows Server, including Azure Arc-enabled machines, and Plan 2 is the tier that adds just-in-time VM access and file integrity monitoring.
- Windows Defender Firewall applies a separate rule set per profile (domain, private, public), and the secure posture is inbound blocked by default with explicit allow rules deployed by Group Policy; connection security rules are the separate IPsec layer that authenticates and optionally encrypts traffic between two hosts, which is how server and domain isolation is built.
- A domain has exactly one password and account lockout policy applied from a GPO linked at the domain level, and the only supported way to give a different policy to a subset of accounts is a fine-grained password policy object created in the Password Settings Container and linked to users or groups, with a precedence value breaking ties when several apply; View resultant password settings shows which one actually wins for a user.
- Microsoft Entra Password Protection extends the global and custom banned password lists to on-premises AD DS without any domain controller touching the internet: a proxy service on a domain-joined member server forwards policy downloads, a DC agent password filter DLL evaluates each password change, and the downloaded policy is cached in a folder under SYSVOL so it replicates; audit mode logs what it would have rejected while enforce mode blocks the change.
- Adding an account to the Protected Users group applies nonconfigurable protections that cannot be relaxed: NTLM authentication fails, Kerberos will not use DES or RC4, the account cannot be delegated by constrained or unconstrained delegation, no cached verifier is created so offline sign-in stops working, and the ticket-granting ticket is fixed at a nonrenewable 240 minutes; never add computer or service accounts, and note that Windows Server 2025 KDCs no longer issue RC4 ticket-granting tickets at all.
- Harden domain controllers by running Server Core, denying them internet access, restricting interactive and network logon rights to Tier 0 administrators working from privileged access workstations, and delegating everyday tasks per OU with the Delegation of Control wizard instead of adding people to Domain Admins; mark Tier 0 accounts Account is sensitive and cannot be delegated, and prefer resource-based constrained delegation over unconstrained delegation, which caches a forwardable TGT on the front-end server.
Domain 7: Monitor and troubleshoot Windows Server environments
- Performance Monitor reads counters live, but sustained evidence comes from a Data Collector Set that logs selected counters to a .blg file on a schedule; a set can be built from a template with logman import -n MyCollector -xml C:\template.xml, and a capture that ends earlier than expected has usually hit a configured stop condition such as a maximum file size or an overall duration limit, and the built-in System Diagnostics Data Collector Set report is the fastest first pass on an unfamiliar server because it puts counters, configuration data and a basic diagnosis into one generated report.
- Choose counters that match the symptom: LogicalDisk Avg. Disk sec/Read, sec/Write and sec/Transfer measure storage latency and sustained values above roughly 20 to 25 milliseconds point at the disk subsystem, Current Disk Queue Length shows backlog, Memory Pages/sec shows hard paging, and on a Hyper-V host the Hyper-V Hypervisor Logical Processor and Virtual Processor sets are more trustworthy than CPU figures reported inside a guest.
- Windows Admin Center surfaces live CPU, memory, network and disk charts per server and per VM, can raise alerts on those signals, and lights up Azure Monitor integration when the server is connected to Azure; resource metering is the separate Hyper-V mechanism you must switch on with Enable-VMResourceMetering before Measure-VM will report chargeback data.
- System Insights is preinstalled on Windows Server and provides four predictive capabilities that are enabled by default: CPU capacity forecasting, networking capacity forecasting, total storage consumption forecasting and volume consumption forecasting; it analyses data entirely on the local machine and publishes each prediction to the event log, which is how you aggregate forecasts across many servers.
- Event data lives in Windows Logs and in Applications and Services Logs, where per-feature channels such as Microsoft\Windows\Hyper-V-* carry the detail; wevtutil epl System C:\Logs\System.evtx exports a log for offline analysis, and Windows Event Forwarding centralizes logs to a collector using subscriptions managed with wecutil, in either a collector-initiated or a source-initiated arrangement.
- The modern Azure collection path is a Log Analytics workspace, then a data collection rule that names the event logs and performance counters to gather, then the Azure Monitor Agent installed as an extension and associated with that rule; the same three steps apply to an Azure Arc-enabled server, so a machine that reports no data is usually missing the DCR association or has an extension stuck in a failed provisioning state.
- Data collection rules are also the cost control, because filtering and transforming at the rule keeps unwanted rows out of the workspace entirely; once data lands you query it with Kusto Query Language, for example Perf | where ObjectName == 'Processor' and CounterName == '% Processor Time' | summarize avg(CounterValue) by Computer.
- Azure Monitor alert rules fire on a metric threshold or a log query result and route through action groups to email, SMS, webhooks, an Automation runbook or a Function; for Azure VMs the host metrics such as CPU and disk I/O are collected automatically at no cost, while guest metrics, the dependency map and process-level detail require the agent-based monitoring you enable per machine.
- Connectivity and name resolution are separate failure domains and should be tested separately: Test-NetConnection proves routing and a listening port, while ipconfig /flushdns, Resolve-DnsName and nslookup pointed at a specific server prove which resolver answered and with what; a client that resolves internal names but not Azure private endpoints is usually missing the conditional forwarder rather than suffering a network fault.
- Windows Update problems are diagnosed from the assessment data in Azure Update Manager or the WSUS targeting group, and on the server itself with Get-WindowsUpdateLog, which converts the ETW traces into a readable WindowsUpdate.log; clearing the SoftwareDistribution folder with the update services stopped forces a clean re-scan when the client's cached metadata is corrupt.
- Time drift breaks Kerberos, because a ticket whose timestamp is outside the permitted clock skew (5 minutes by default) is rejected: the PDC emulator of the forest root domain is the authoritative source for the hierarchy, and w32tm /query /status, w32tm /query /source and w32tm /resync are the tools that show where a member is really getting its time.
- The Active Directory Recycle Bin must be enabled by an Enterprise Admin at a Windows Server 2008 R2 or higher forest functional level and cannot be turned off afterwards; it preserves a deleted object's attributes and group memberships for the msDS-deletedObjectLifetime period, which defaults to the forest tombstoneLifetime of 180 days, and objects are returned with Restore-ADObject or the Deleted Objects container, always restoring a parent before its children.
- Directory Services Restore Mode is the offline boot option used to restore the AD database from a system state backup, and you need the DSRM password to get in; a nonauthoritative restore lets normal replication bring the DC back up to date, an authoritative restore marks specific objects so they win replication, and the first recovered DC also needs an authoritative SYSVOL synchronization, done for DFSR by setting msDFSR-Options to 1 on that DC's SYSVOL Subscription object.
- Replication and trust faults have their own toolset: repadmin /replsummary and repadmin /showrepl expose failing partners while repadmin /syncall forces a pass, dcdiag tests DC health broadly, a machine that has lost its secure channel is repaired with Test-ComputerSecureChannel -Repair or Reset-ComputerMachinePassword, and a duplicate service principal name found by setspn -X is a classic cause of Kerberos failing for one service while everything else works.
AZ-802 exam tips
- Study to the weighting. Deploy and manage AD DS is the single largest area at 20 to 25 percent, and storage and file services plus monitoring and troubleshooting add another 30 to 40 percent between them. If time is short, drill FSMO roles, sites and replication, Group Policy, Azure Files and Azure File Sync, and the workspace plus data collection rule plus Azure Monitor Agent model before anything else.
- Notice what the AZ-802 skills outline leaves out. Windows containers, Azure Site Recovery, Azure Migrate and Storage Migration Service are not listed, and failover clustering appears only indirectly through implementing high availability for Hyper-V VMs, Storage Spaces Direct and Storage Replica. Hyper-V Replica is the one replication technology the outline names on the compute side, so study it properly and do not spend days on migration tooling.
- Windows Server 2025 changed several defaults that exam scenarios lean on: Credential Guard is on by default on capable machines, SMB signing is required for all outbound connections, the OpenSSH server is installed by default, SMB over QUIC works on every edition, and there is a Windows Server 2025 functional level with no 2019 or 2022 equivalent. When an answer hinges on a default, check which OS version the scenario states.
- Most of this exam is a tool-selection problem in disguise, so read the constraint, not the goal. No GUI means PowerShell or Windows Admin Center. No network in the guest means PowerShell Direct or Enhanced Session Mode. On-premises but governed from Azure means Azure Arc. Patching across Azure and on-premises means Azure Update Manager. Non-domain-joined target means TrustedHosts or certificate-based authentication.
- Know cmdlets with their distinguishing parameters, because command-completion items turn on the parameter rather than the verb: Install-ADDSForest -InstallDns, Move-ADDirectoryServerOperationMasterRole, Add-DnsServerConditionalForwarderZone -MasterServers, Add-DnsServerQueryResolutionPolicy -ZoneScope, New-SmbShare -ChangeAccess, New-SmbServerCertificateMapping, Set-VMProcessor -ExposeVirtualizationExtensions, New-StorageQosPolicy -PolicyType, Restore-ADObject.
- For ordered-step items, order by prerequisite rather than by narrative. The destination is created before the rule that feeds it (workspace before data collection rule), the zone or scope exists before the record or policy that references it, the VM is shut down before a setting that cannot change at runtime, and a parent object is restored before its children.
- When two answers both work, pick the one with less standing privilege and less attack surface: Server Core over Desktop Experience, JEA over local administrator, a gMSA or dMSA over a user account with a fixed password, identity-based authentication over a storage account key, resource-based constrained delegation over unconstrained delegation, and an enforced policy over an audit-mode one once testing is done.
Study guide FAQ
How does AZ-802 relate to AZ-800 and AZ-801?
AZ-800 and AZ-801 retire on September 30, 2026 at 5:00 PM Central Standard Time, which is stated in the warning banner on their Microsoft Learn exam pages. AZ-802 is the current path: it is a single exam that carries no retirement date and counts toward the same Microsoft Certified: Windows Server Hybrid Administrator Associate certification. If you have not already passed the AZ-800 and AZ-801 pair, take AZ-802. If you have passed one of the pair, either finish the other before the retirement date or plan for AZ-802 instead. The certification page lists all three exams during the transition, so check it before you book.
What is actually different about AZ-802 compared with the AZ-800 and AZ-801 pair?
It is one exam with seven skill areas instead of two exams with five each, and AD DS carries the heaviest weighting at 20 to 25 percent. Several AZ-800 and AZ-801 topics are not named in the AZ-802 skills outline at all, including Windows containers, Azure Site Recovery, Azure Migrate and Storage Migration Service. Newer material is named explicitly instead: GPU partitioning, SMB over QUIC, OSConfig, Application Control for Windows, Microsoft Entra Password Protection for AD DS, just-in-time VM access and Azure Bastion, Azure Update Manager, and remote SSH.
How much Azure knowledge does AZ-802 need?
A substantial amount, because the role is defined as hybrid. Expect Azure Arc-enabled servers and VM extensions, Azure Monitor with data collection rules and the Azure Monitor Agent, Azure Update Manager, Azure Automation runbooks, Azure Files and Azure File Sync, Microsoft Defender for Servers, just-in-time VM access and Azure Bastion, Azure DNS Private Resolver, and Azure VM capacity, availability sets and zones. That sits alongside heavyweight on-premises content: AD DS, DNS and DHCP, Hyper-V, Storage Spaces Direct, DFS and FSRM.
Is the exam on Windows Server 2025, or on older releases?
The skills outline does not pin a version, and Microsoft notes that most questions cover features that are generally available. Windows Server 2025 is the current release and it changed behaviour that several outline topics depend on, including the new domain and forest functional level, the 32k database page size, delegated Managed Service Accounts, Credential Guard on by default, SMB signing required for outbound connections, OSConfig baselines, GPU partitioning with live migration, and SMB over QUIC on every edition. Learn the current behaviour, but read each scenario for the OS version it states, because a Windows Server 2019 or 2022 scenario can have a different correct answer.
How should I use CertGrid's AZ-802 practice questions, and can a practice score tell me I will pass?
The bank holds 694 drawable questions spanning the seven skill areas with detailed explanations, so it works best as a way to rehearse the concepts and commands and to find the areas you avoid. A practice percentage is not a predicted exam score. CertGrid does not publish a readiness score for AZ-802, and no third-party number can tell you how a scaled 700-point Microsoft exam will grade you. Judge your timing on hands-on experience and on whether you can explain every bullet in the published skills outline, not on a practice percentage.
Official exam sources
The domain names and weightings on this page follow the published exam blueprint. Each source below records what it confirmed and when it was read, so the split can be checked rather than taken on trust.
- Microsoft Learn - Exam AZ-802 study guideBlueprint revised June 22, 2026 · link and content verified 18 September 20267 skills areas: Deploy and manage AD DS (20-25%); Manage Windows Server instances and workloads in a hybrid environment (10-15%); Manage virtual machines (10-15%); Implement and manage an on-premises and hybrid networking infrastructure (10-15%); Manage storage and file services (15-20%); Secure Windows Server infrastructure (10-15%); Monitor and troubleshoot Windows Server environments (15-20%). Pass mark 700.
- Microsoft Learn - Windows Server Hybrid Administrator Associatelink and content verified 18 September 2026AZ-802 is a current path to the certification; AZ-800 and AZ-801 retire 30 September 2026.