Microsoft Windows Server Administrator Associate (AZ-802) — Questions 76–116

Enabling SMB encryption globally forces all connections to use encryption. Older clients or non-Windows systems that do not support SMB 3.0 or higher will fail to negotiate a connection, resulting in access errors. This transition requires careful planning, often involving auditing first or using per-share encryption instead of global settings to maintain backward compatibility while securing sensitive data transfers across the network infrastructure.

By default, RODCs do not store user passwords. To allow a user to log on when the WAN link is unavailable, their credentials must be cached locally. This is achieved by adding the user or their group to the 'Allowed RODC Password Replication Group' or modifying the RODC's Password Replication Policy.

Windows Server DHCP failover provides two distinct modes to ensure that IP address leasing remains operational if one server fails. Choosing the correct mode depends on whether the administrator wants both servers to actively lease addresses simultaneously or have one server remain idle until a failure event occurs within the network environment.

A soft quota monitors capacity usage and generates administrative notifications when thresholds are reached without blocking users from writing new files. This contrasts with hard quotas, which actively deny write operations once the specified storage limit is breached, making soft quotas ideal for warning purposes.

Test-NetConnection is a versatile 'Swiss Army knife' for network troubleshooting in Windows. It replaces older tools like ping and telnet by allowing administrators to check basic connectivity and verify if specific service ports are open and responding, providing detailed information about the network path and success of the connection.

Repadmin.exe is the primary command-line tool for monitoring and troubleshooting Active Directory replication. It provides deep visibility into the replication topology, last successful replication times, and specific error codes that occur when domain controllers fail to synchronize their databases, which is critical for maintaining forest-wide consistency.

The New-NetRoute cmdlet is the standard PowerShell method to add routes to the Windows routing table. By specifying the -DestinationPrefix and the -NextHop, you instruct the OS on how to route traffic to the storage network. Using the -PolicyStore command ensures that the route is persistent across system reboots, which is critical for storage connectivity stability.

A failed revocation check indicates that the client or server cannot verify if the certificate has been prematurely invalidated by the issuing CA. This check is crucial for security because it ensures that compromised certificates are not being used. Connectivity failures here usually stem from the inability to reach the Certificate Revocation List (CRL) distribution point, often due to network blocking or incorrect DNS resolution for the URL defined in the certificate.

Deploying a Read-Only Domain Controller is the recommended strategy for branch offices where physical security cannot be guaranteed. This approach ensures that only a subset of user credentials is cached locally based on the Password Replication Policy, significantly reducing the impact of a physical server theft while still providing local authentication services for users at the site.

Implementing VM Insights requires both the Azure Connected Machine agent for identity and the Azure Monitor agent (AMA) for data collection. By installing the Connected Machine agent, you project the server into Azure. Once projected, the AMA extension can be deployed via Azure Policy or manually to collect telemetry, performance metrics, and logs, providing unified monitoring across the hybrid infrastructure.

Monitoring strategies have evolved from the legacy Log Analytics agent to the Azure Monitor Agent (AMA). AMA provides a more secure, cost-effective, and simplified way to collect data using Data Collection Rules (DCRs). This transition is critical for administrators to ensure long-term support and leverage granular control over data collection from both Azure and on-premises Windows Server instances.

The Azure Connected Machine agent relies on the 'himds' (Hybrid Instance Metadata Service) to function. If this service is stopped, the server loses its heartbeat to the Azure control plane, causing it to appear as offline. Checking this service status is the most direct way to identify if the agent software has crashed or been disabled, which is the most common cause of communication gaps.

WSUS supports two modes for downstream servers: Replica and Autonomous. In Replica mode, the downstream server mirrors the update approvals, settings, and classes of the upstream server. This centralizes management and ensures that only updates vetted and approved by the central administrator are distributed across the entire organization's branch offices or departments.

Active Directory uses site link costs to determine the most efficient path for replication. When 'Bridge all site links' is enabled (the default), Active Directory can calculate a transitive path between sites that are not directly connected. The total cost is the sum of the costs of the individual links that make up the path.

Selecting the right resiliency type involves balancing performance, capacity, and fault tolerance. For a four-drive system, mirroring and parity are the primary options. Mirroring is generally preferred for performance-sensitive workloads because it avoids the computational overhead of parity calculations, leading to faster write operations at the cost of reduced usable storage capacity compared to parity.

SMB Direct requires network adapters that support Remote Direct Memory Access (RDMA). RDMA allows the network adapter to transfer data with minimal CPU intervention and extremely low latency. This is a key technology for high-performance workloads like Storage Spaces Direct and SQL Server over SMB.

The Delegation of Control Wizard in Active Directory Users and Computers (ADUC) is designed for granting specific, limited permissions to users or groups over specific portions of the directory. This follows the principle of least privilege by allowing tasks to be offloaded to non-administrators without granting full Domain Admin rights.

Azure Stack HCI relies heavily on the network for storage traffic between nodes. To achieve the performance required for hyperconverged workloads, the network must support advanced features that offload processing and prevent congestion. RDMA and SET are the cornerstones of a modern, high-performance software-defined data center network on the Microsoft platform.

Performance Monitor (perfmon) allows for more than just live viewing; it includes Data Collector Sets (DCS) for structured data gathering. DCS can be scheduled with specific start and stop times, and configured to collect specific counters, enabling administrators to gather consistent baseline data without manual intervention during off-peak hours.

Modern Windows Server administration emphasizes automation through PowerShell. To promote a server to a domain controller, the ADDSDeployment module provides specific cmdlets that replace the legacy dcpromo utility. These cmdlets handle the configuration of the database, logs, SYSVOL paths, and the necessary directory partition replicates from existing domain controllers in the environment.

Error 1256 indicates that the remote system is unavailable, which usually points to a network connectivity issue or a failure of the source domain controller (DC2). Troubleshooting should focus on physical connectivity, firewall rules, or the operational status of DC2 to ensure it can communicate with DC1 over the network.

Windows Event Forwarding supports two main subscription models: source-initiated and collector-initiated. Choosing the correct model depends on network topology and management requirements. Collector-initiated subscriptions are useful when the administrator wants the central server to control the polling interval and manage the list of source computers explicitly within the subscription configuration itself.

Windows provides several tools for performance monitoring, but they vary in granularity. Resource Monitor is specifically designed to bridge the gap between Task Manager and Performance Monitor by providing detailed, real-time information about hardware resource usage at the process and file level, which is critical for identifying I/O contention.

Securing a server involves both positive and negative enforcement. By creating a specific inbound rule for the trusted application, you permit necessary traffic, while a default deny policy ensures that no other unsolicited traffic reaches the server. This combination effectively implements the principle of least privilege, reducing the attack surface by ensuring that only authorized communication flows are allowed through the firewall boundaries.

The Azure Arc resource bridge is a virtual appliance that simplifies the management of virtualized environments. It provides a unified way to manage virtual machines, scale resources, and integrate hybrid infrastructure with Azure management services like RBAC and policy. By abstracting the underlying virtualization, it enables a consistent cloud-like experience for managing on-premises virtualized workloads, improving administrative efficiency and oversight.

To manage disk space effectively while capturing performance metrics, the 'Stop condition' settings within the Data Collector Set properties allow you to define size limits. Configuring the 'Maximum size' to 500 MB and selecting the 'Overwrite' option ensures the log file rotates, maintaining only the most recent data. This is critical in production environments to prevent system volume exhaustion from unbounded performance log growth.

In iSCSI configurations, security is maintained by specifying which clients (initiators) are allowed to connect to a specific target. The -InitiatorId parameter restricts access to the target so that only the device with the matching iSCSI Qualified Name (IQN) can discover and connect to the storage resources.

Data Deduplication in Windows Server is designed for specific workloads where data redundancy is common. General-purpose file shares and Virtual Desktop Infrastructure (VDI) libraries are the primary targets for this technology. Understanding supported workloads prevents performance issues and ensures that the deduplication engine can effectively reduce storage footprints without impacting application stability or data integrity.

To maximize security for hybrid connectivity, you must minimize the attack surface by using a private endpoint, enforcing modern authentication, and restricting outbound access. Private Link ensures traffic never traverses the public internet, Managed Identities prevent static credential leakage, and limiting outbound access via a proxy or firewall ensures that the agent only communicates with known, required Azure service endpoints, reducing the risk of data exfiltration.

Receive Side Scaling (RSS) is a technology that allows the network stack to distribute incoming network traffic processing across multiple CPU cores. By offloading this task, the server can handle higher network throughput without overloading a single core, which is critical for high-traffic servers. This reduces CPU bottlenecks and ensures that the server can scale its networking capabilities to meet increasing demand efficiently.

Windows Admin Center security is managed through two main layers: gateway access and tool access. Gateway access is controlled via local groups or Active Directory groups on the WAC server. For more granular control over specific server tasks, WAC integrates with Just Enough Administration (JEA) to limit the cmdlets and actions available to the user.

Analyzing performance counter output requires understanding both the metric and the duration of the sample. In this case, the CPU usage is consistently high over a ten-second period. While this might indicate a bottleneck, an administrator must determine if this is a transient spike or a sustained trend that requires further investigation into specific processes.

To view the contents of a past Active Directory database, you first use ntdsutil to mount the snapshot or recovered database file. Then, you use dsamain to expose that database as an LDAP directory service on a custom port. Once dsamain is running, standard tools like Active Directory Users and Computers can connect to that specific port.

A Site-to-Site VPN is the standard solution for connecting on-premises infrastructure to Azure over the internet using an IPsec/IKE tunnel. It provides a secure, encrypted path for traffic, ensuring that data moving between the local data center and the cloud remains protected. This is the most common deployment scenario for hybrid connectivity where a dedicated line like ExpressRoute is not financially feasible.

The Relative Identifier (RID) Master is responsible for allocating pools of RIDs to all domain controllers in a domain. When a DC exhausts its local pool and the RID Master is unavailable, it cannot create new security principals. In cases of permanent or long-term failure, the role must be seized to a healthy DC to restore functionality.

Resource metering is a powerful tool for monitoring VM resource consumption over time. It allows administrators to gather data on CPU, memory, disk, and network usage, which is essential for internal chargeback models or infrastructure scaling. Knowing how to enable and query this data via PowerShell is a key administrative task.

SMB Signing is a security mechanism in the SMB protocol that allows for the digital signing of SMB packets. This prevents the modification of data in transit and protects against man-in-the-middle attacks. Enforcing this feature ensures that both the client and the server can verify the origin and integrity of every packet exchanged during a session.

Reducing the attack surface is a proactive security strategy that involves disabling unnecessary features and services. By removing unused software, restricting network exposure, and managing administrative privileges, you limit the vectors available for a potential intruder to gain a foothold. This process is essential for maintaining the integrity of the server and ensuring that only required code runs, thereby reducing the risk of exploitation and unauthorized system access.

Azure Files supports several authentication methods for accessing file shares. For organizations with an existing on-premises footprint, integrating Azure Files with AD DS allows for a seamless user experience using standard Kerberos authentication. This allows the use of existing NTFS permissions (ACLs) to control access to files and folders within the cloud-hosted share.

Fine-Grained Password Policies (FGPP) allow administrators to apply different password and account lockout settings to different sets of users or groups within a single domain. This eliminates the need for multiple domains just to enforce varying security requirements, which was a significant limitation in older versions of Windows Server.