Microsoft Windows Server Administrator

AD DS is the identity backbone of most Windows environments. You deploy domain controllers, plan domains and forests, and learn the directory database and the roles that domain controllers hold.

• Directory structure: domains, trees and forests
• Promoting and demoting domain controllers
• Operations master roles and where they live
• Read-only domain controllers
• The global catalog
• Planning a domain design

You build A small forest with two domain controllers, with operations master roles placed on purpose.

Directories that span locations need a topology. You configure sites and subnets, manage replication between domain controllers, and set up trusts across domains and forests.

• Sites, subnets and site links
• Replication topology and the KCC
• Checking and forcing replication
• Domain and forest trusts
• Authentication across trust boundaries
• Multi-site and multi-forest planning

You build A two-site forest with working replication and a trust to a second forest.

Users, groups and computers define who can do what, and Group Policy applies the rules at scale. You manage accounts and groups, delegate administration, and write and troubleshoot Group Policy.

• Users, computers and group scopes
• Organizational units and delegation
• Group Policy objects, links and inheritance
• Security filtering and WMI filtering
• Group Policy preferences and administrative templates
• Troubleshooting with gpresult and Resultant Set of Policy

You build An OU structure with delegated administration and a tested set of Group Policy objects.

Nothing in a domain works without name resolution. You deploy and manage DNS zones and records, secure them, and connect on-premises DNS with Azure DNS and private zones for hybrid environments.

• DNS zones, records and dynamic updates
• Forwarders, conditional forwarders and root hints
• DNS security: DNSSEC and secure updates
• Azure DNS and private DNS zones
• Resolving names between on premises and Azure
• Troubleshooting with nslookup and logs

You build A DNS setup that resolves names in both directions between a domain and an Azure network.

Addresses must be handed out and tracked. You configure DHCP scopes and options, plan for failover, and manage IP address space across an organization.

• DHCP scopes, options and reservations
• DHCP failover and split scopes
• DHCP in routed networks
• IP address management in Windows Server
• Authorizing servers and avoiding rogue DHCP
• Troubleshooting lease problems

You build A DHCP deployment with failover and a documented address plan.

Virtualization turns hardware into flexible capacity. You configure Hyper-V hosts and virtual switches, create and manage guests, use checkpoints, and plan how workloads move between hosts.

• Installing and configuring Hyper-V
• Virtual switches and networking
• Virtual hard disks and storage
• Generation 1 and generation 2 machines
• Checkpoints and their limits
• Live migration and replica

You build A Hyper-V host running guests on a virtual switch, with a checkpoint recovered.

Many servers now run in Azure. You deploy and configure Windows Server VMs there, size and secure them, and manage them with the same practices you apply on premises.

• Choosing VM sizes and disks
• Deploying Windows Server VMs
• Networking and access to Azure VMs
• Extensions and configuration management
• Backup and recovery for Azure VMs
• Azure Hybrid Benefit and cost basics

You build A Windows Server VM in Azure, joined to a domain and managed like its on-premises peers.

Servers outside Azure still need cloud-scale management. You connect them with Azure Arc, patch them with Azure Update Manager, and automate routine work with Azure Automation.

• Onboarding servers to Azure Arc
• Policy and inventory for Arc-enabled servers
• Patching with Azure Update Manager
• Maintenance windows and update schedules
• Azure Automation runbooks
• Managing servers through Windows Admin Center in Azure

You build A mixed fleet managed through Arc, with scheduled patching and one automation runbook.

File data needs access control, reach and resilience. You configure Windows file shares and permissions, organize namespaces with DFS, and extend shares to the cloud with Azure Files.

• SMB shares, NTFS and share permissions
• File Server Resource Manager quotas and screens
• DFS Namespaces and Replication
• Azure Files and identity-based access
• Azure File Sync for hybrid shares
• Troubleshooting access

You build A file service with permissioned shares, a DFS namespace and an Azure Files share.

Disks fail and servers get stolen. You pool disks with Storage Spaces, replicate volumes with Storage Replica, and protect data at rest with BitLocker.

• Disks, volumes and file systems
• Storage Spaces and resiliency types
• Storage Replica: server to server and cluster
• Deduplication and tiering
• BitLocker deployment and recovery
• Planning capacity and recovery

You build A storage pool with a replicated volume, and a BitLocker recovery carried out.

Servers and domain controllers are prime targets. You apply security baselines, configure exploit protection and Credential Guard, add Defender for Servers, and tighten how domain controllers are exposed and administered.

• Security baselines for Windows Server
• Exploit protection and Defender settings
• Credential Guard and protecting credentials
• Defender for Servers through Azure
• Domain controller hardening and tiered administration
• Auditing and detecting abuse

You build A hardening baseline applied to a server and a domain controller, with the checks that verify it.

When something breaks, method matters. You monitor with Performance Monitor and Azure Monitor, troubleshoot servers, networks and storage, and recover Active Directory, including Kerberos and replication failures.

• Performance Monitor and data collector sets
• Event logs and event forwarding
• Azure Monitor and the agent for servers
• Network and storage troubleshooting
• Kerberos failures and time skew
• Active Directory backup and recovery
• Replication troubleshooting

You build A monitoring setup for a server group, and a recorded recovery of a deleted Active Directory object.

Stand up and run one environment end to end. You build the directory, name resolution and virtual infrastructure, connect it to Azure, secure it and set up monitoring, then practice a recovery.

• Designing the environment
• Building identity, DNS and DHCP
• Adding virtualization, storage and file services
• Connecting to Azure and securing it
• Monitoring and rehearsing recovery

You build A working hybrid Windows Server environment with documentation, monitoring and a recovery drill.