Administer Windows Server (AZ-802) interview questions

FSMO roles are five special jobs held by specific domain controllers: Schema Master and Domain Naming Master per forest; RID Master, PDC Emulator and Infrastructure Master per domain. If the PDC Emulator is down, time sync and password-change replication suffer and some lockouts behave oddly; you can transfer or, if it is dead, seize the role to another DC.

What they are checking: Knowing the roles and the impact of losing one.

Likely follow-up: When do you transfer a role and when do you seize it?

Whether the branch has its own subnet mapped to a site in AD Sites and Services, so clients use a local DC instead of one over the WAN. Then DNS settings on the clients, replication health with repadmin /replsummary, and Group Policy processing time.

What they are checking: Understanding of sites, DNS and replication.

Likely follow-up: What does repadmin tell you?

Check the GPO is linked to the right OU and the computers are in it, security filtering and WMI filters, and that the setting is in the right half (computer vs user). On the machine run gpresult /r or /h and gpupdate /force, and look at the Group Policy event log.

What they are checking: A clear order of checks and the right tools.

Likely follow-up: What is loopback processing?

Clients find domain controllers through SRV records in DNS. If a client points to a public DNS server instead of the DC, it cannot find the domain, so logons, Group Policy and joins fail. Most "AD problems" are really DNS problems.

What they are checking: That you link AD health to DNS first.

Likely follow-up: Which SRV record does a client look up to find a DC?

Install Microsoft Entra Connect (or Cloud Sync) on a member server, choose password hash sync, filter which OUs sync, and fix UPN suffixes so users sign in with their email address. Then monitor sync health and plan for its high availability.

What they are checking: A realistic hybrid identity plan.

Likely follow-up: What problems do non-routable UPN suffixes cause?

A checkpoint is a point-in-time state stored with the VM on the same storage. It is useful before a change but grows over time and is lost if the storage fails. A backup is a separate copy elsewhere. Never use checkpoints as backups, and delete them after the change.

What they are checking: Not confusing checkpoints with backups.

Likely follow-up: Why can old checkpoints hurt performance?

Give them separate admin accounts, use tiering so domain admin accounts only log on to DCs, deploy LAPS for unique local admin passwords, and use Protected Users and privileged access workstations. Audit membership of privileged groups.

What they are checking: Awareness of credential theft risks and tiering.

Likely follow-up: What does LAPS solve?

Short term: find large or duplicate files with File Server Resource Manager reports and clean up. Medium term: extend the volume, turn on Data Deduplication, or tier cold data to Azure with Azure File Sync. Set quotas to stop it happening again.

What they are checking: Short-term fix and long-term prevention.

Likely follow-up: How does Azure File Sync cloud tiering work?

Take regular system-state backups with Windows Server Backup or your backup tool, keep at least two DCs per domain, and enable the AD Recycle Bin. Know the difference between non-authoritative and authoritative restore.

What they are checking: Restore knowledge, not only backup.

Likely follow-up: When would you need an authoritative restore?

Event Viewer: System log for Event ID 1074 (planned shutdown with the process and user), 6008 (unexpected shutdown) and 41 (kernel power). Check Windows Update history and any crash dumps.

What they are checking: Knowing exactly where to look.

Likely follow-up: What does a bugcheck code tell you?