AZ-800: Administering Windows Server Hybrid Core Infrastructure

Deploying on-premises domain controllers starts with analyzing your forest and domain topology. This analysis determines where to place domain controllers so clients in different locations can authenticate quickly. The Active Directory Domain Services (AD DS) role can be installed using Server Manager or PowerShell, giving administrators flexibility based on their automation preferences. Both tools support the full process, including promoting a server to a domain controller and specifying which domain or forest it will join.

Group Policy Objects (GPOs) are the main tool for managing settings for users and computers in an Active Directory environment. You create and manage them using the Group Policy Management Console (GPMC). The process starts by defining the policy's goal, linking the GPO to the correct organizational units (OUs), and then configuring the specific settings inside it, such as security rules or software installation instructions.

A trust relationship connects two domains or forests so that users in one can be authenticated and access resources in the other. The direction of the trust controls who can access what. A two-way trust allows users in both connected domains to access each other’s resources. A one-way trust is directional: a one-way outgoing trust lets users in your local on-premises domain access resources in the remote domain, while a one-way incoming trust lets remote users access local resources. Choosing the correct direction is the first step in securing cross-domain authentication.

Provisioning and configuring Active Directory Domain Services (AD DS) users and groups involves creating accounts for users, services, and computers. These accounts are placed into logical containers called Organizational Units (OUs), which help apply group policies and delegate administrative tasks to specific parts of the directory. The main tools for this work are the graphical Active Directory Users and Computers or Active Directory Administrative Center, and PowerShell for automation. Administrators choose group scopes—global, domain local, or universal—and nest groups inside one another to simplify assigning access permissions. This structure of OUs and groups is key for enforcing role-based access in both on-premises AD DS and hybrid setups with Microsoft Entra ID.

Organizations that keep user accounts in an on-premises Active Directory Domain Services (AD DS) forest use Microsoft Entra Connect to synchronize those identities to the cloud-based Microsoft Entra ID. This tool copies user accounts and group memberships, enabling users to sign into cloud services with the same username and password they use on-premises. The synchronization is one-way by default, flowing from on-premises AD DS to Microsoft Entra ID, which creates a unified identity across both environments.

Windows Admin Center (WAC) provides a centralized, secure administration and monitoring solution for hybrid Windows Server environments. Configuring the WAC gateway on a local server enables the management of both on-premises and cloud-based servers through a unified web interface. This centralized design acts as a management hub, allowing traffic to flow securely between local administrator browsers and hybrid server endpoints. The WAC gateway bridges the gap between on-premises and Azure resources seamlessly.

To manage on-premises Windows Servers from Azure, you install the Azure Connected Machine Agent and register each server with Azure Arc. First, ensure the operating system is compatible and that you have a Log Analytics workspace ready in Azure to receive the agent's data. You also need the right Azure permissions to manage the workspace. The agent communicates with Azure over TCP port 443, and you can choose how it connects. The simplest way is direct internet access. You can also route traffic through a Log Analytics Gateway or use a more secure hybrid network like VPN or ExpressRoute.

To use Windows Server as a host for containers, you must first install the necessary Windows features. This installation process is completed using PowerShell. The Containers feature provides the base components needed to run containers. If you need stronger isolation between workloads, you can also install the Hyper-V feature, which runs each container inside a lightweight virtual machine.

Enhanced Session Mode in Hyper-V improves how administrators interact with virtual machines by enabling advanced connection features. This mode allows for seamless clipboard sharing, drive redirection, and high-resolution display capabilities during active remote sessions. Without this mode, administrators are limited to basic console interactions, making daily administrative tasks more time-consuming.

Azure Managed Disks simplify storage management by handling the backend storage accounts for Azure Virtual Machines (VMs). You only specify the required disk size and performance tier, and Azure automatically provisions and manages the underlying resources. This abstraction prevents single storage account limits from impacting multiple virtual disks, improving overall resiliency.

You can integrate DNS with Active Directory Domain Services (AD DS) by creating AD-integrated zones. These zones store DNS data inside the Active Directory database. This integration provides security by using AD DS permissions, ensures records are automatically copied whenever AD replicates, and increases fault tolerance because the DNS data exists on multiple domain controllers.

IP Address Management (IPAM) is a framework in Windows Server that lets you manage IP addresses, DHCP, and DNS services from one central place. To start using this framework, you deploy IPAM servers on Windows Server. During setup, you configure authentication, role-based access, and server discovery. Server discovery allows the IPAM server to automatically find and manage DHCP and DNS servers across your network domain.

The Remote Access role in Windows Server provides the foundation for connecting remote users and branch offices to the corporate network. This role includes several technologies such as DirectAccess, VPN, and Routing and Remote Access Services (RRAS). DirectAccess always-on connectivity for domain-joined clients, meaning remote users are automatically connected without manual action. Site-to-site VPNs connect entire offices, while VPN connectivity supports individual remote clients. The Remote Access role is managed through the Remote Access Management Console and Windows PowerShell, and it requires careful planning for network adapters, IP addressing, and security certificates.

Azure File Shares provide cloud-based file storage that you can access like a network drive. You create a share inside an Azure storage account, which is the top-level container for your storage resources. When you create a share, you choose its size and performance tier, such as the Premium tier for high-speed workloads or the Standard tier for general use. Once created, you can access the share from anywhere using the Server Message Block (SMB) or Network File System (NFS) protocol, and you manage it through the Azure portal, PowerShell, or Azure CLI by performing tasks like resizing the share or changing its performance tier.

Before a new physical disk can be used, you must initialize it with a partition style. The two main styles are Master Boot Record (MBR) and GUID Partition Table (GPT). You must choose GPT for drives larger than two terabytes or if you need more than four primary partitions. GPT also works natively with modern UEFI boot systems, while MBR is kept for older legacy BIOS systems.

Setting up file share access in Windows Server involves controlling who can see and use shared folders and what they can do with the files inside. Administrators create shared folders on the server and then decide which users or groups get access and what level of access they receive—read-only, read-write, or full control. This access control ties into Windows authentication, so the server verifies identity before allowing any file operations. The combination of share permissions and NTFS permissions on the underlying folders gives administrators fine-grained control over data security.