AZ-802 Administering Windows Server

Note: This lab pre-provisions Azure resources at start — allow up to 12 minutes for the environment to become ready before beginning the exercises.

Take the AD DS fundamentals from lesson 1 and turn them into a working production-shaped domain on Azure IaaS. In this hands-on lab you will connect to two Azure-hosted Windows Server 2022 VMs, install Active Directory Domain Services, and promote a new forest — corp.meridian-mfg.com — with two domain controllers spread across availability zones. You will validate DC health with dcdiag, wire the virtual network's DNS to the new domain controllers, verify multi-DC replication with repadmin, confirm FSMO role placement, and lay down the OU structure Meridian Manufacturing will build on in every later lab in this course. By the end of this lab you will be able to stand up a production-shaped Azure-hosted AD DS forest end to end and prove that it is healthy.

Note: This lab pre-provisions Azure resources at start — allow up to 15 minutes for the environment to become ready before beginning the exercises. Four empty Windows Server VMs and two peered VNets get you ready to promote and configure Active Directory Domain Services yourself.

Take everything Lesson 3 taught you about Sites, replication, forest trusts, and FSMO placement and put it to work on a live two-forest environment. You will bootstrap the Meridian and Delvara AD DS forests from a shared PowerShell script, configure Active Directory Sites and Subnets to reflect the Azure region, add DNS conditional forwarders that make cross-forest resolution work, establish a bidirectional forest trust between Meridian Manufacturing and the newly acquired Delvara Robotics forest, promote a Read-Only Domain Controller with a scoped Password Replication Policy, and transfer FSMO roles between domain controllers so your operations master placement matches the design. By the end you will be able to build and validate the multi-site, multi-forest AD DS environment Meridian needs to operate as one company.

Note: This lab pre-provisions Azure resources at start — allow up to 15 minutes for the environment to become ready before beginning the exercises. Two empty Windows Server VMs get you ready to promote AD DS and build out the identity + policy layer yourself.

Turn a promoted AD DS forest into a working identity platform. In this hands-on lab you will bootstrap the Meridian forest, design and build an organizational-unit tree that reflects Meridian's business structure, create users at scale from a CSV file, apply the AGDLP model to a shared folder permission scenario, establish the Key Distribution Services root key and deploy a group Managed Service Account for a service that used to run under a domain user, deploy a Group Policy Object with Security Filtering scoped to a specific group, and configure a Group Policy Preference with item-level targeting. By the end of this lab you will be able to operate the identity + policy layer of an on-premises or Azure-hosted AD DS forest to Meridian's day-two standards.

Note: This lab pre-provisions Azure resources at start — allow up to 15 minutes for the environment to become ready before beginning the exercises. Two empty Windows Server VMs let you install Windows Admin Center, connect it to a member server, and configure a Just-Enough-Administration endpoint yourself.

Build the modern hybrid-management surface Meridian is standardizing on. In this hands-on lab you will install Windows Admin Center on a management VM, connect a second Windows Server as a managed target, use WAC's browser UI to inspect services and event logs on the target, configure a Just-Enough-Administration endpoint that lets an on-call operator restart the print spooler without holding admin credentials, and configure Azure Update Manager to assess and schedule patches for the Azure VMs. By the end of this lab you will be able to stand up the tooling that replaces Meridian's legacy per-server RDP-plus-MMC workflow.

Note: This lab pre-provisions Azure resources at start — allow up to 15 minutes for the environment to become ready before beginning the exercises. Two empty Windows Server VMs let you work through data-disk sizing, VM resize, auto-shutdown, and Windows container basics.

Practice the day-two workload operations you'll actually do on Meridian's Azure fleet. In this hands-on lab you will attach a Premium SSD data disk to a Windows Server VM with the correct host-caching setting for a database workload, resize a VM to a different SKU, configure auto-shutdown to save Meridian's dev-tier cloud spend, install the Windows container runtime, pull a Server Core base image, build a small container image from a Dockerfile, and run it end-to-end. By the end you will be able to reason about disk + VM lifecycle patterns for production and dev workloads and evaluate whether a container is a better fit than a VM.

Note: This lab pre-provisions Azure resources at start — allow up to 15 minutes for the environment to become ready before beginning the exercises. Two empty Windows Server VMs let you install DNS + DHCP roles, configure a Windows Firewall rule set, and stand up IPsec Connection Security yourself.

Practice Meridian's networking-services stack hands-on. In this hands-on lab you will install the Windows DNS Server role and create a primary zone with A + CNAME records, add a conditional forwarder to route queries for a partner domain, install the DHCP role and configure a scope with reservations, set up DHCP failover between two DHCP servers in load-balance mode, configure Windows Defender Firewall inbound rules and profiles, and stand up an IPsec Connection Security Rule between two Windows Servers. By the end of this lab you will be able to build the network-services layer of a Windows Server deployment from the role installs up.

Note: This lab pre-provisions Azure resources at start — allow up to 15 minutes for the environment to become ready before beginning the exercises. Two empty Windows Server VMs let you build a file server, attach data disks, and work through the storage stack yourself.

Build the Windows Server file services layer from role installs up. In this hands-on lab you will install the File Server role and create an SMB share with correct share + NTFS permissions, deploy File Server Resource Manager to enforce user quotas and screen unwanted file types, enable Data Deduplication and measure the space savings, create a Storage Spaces pool from attached data disks and carve out a mirrored virtual disk, and set up a DFS Namespace pointing at redundant folder targets on two servers. By the end of this lab you will be able to stand up Meridian's file-services stack including redundancy and space efficiency.

Note: This lab pre-provisions Azure resources at start — allow up to 15 minutes for the environment to become ready before beginning the exercises. Two empty Windows Server VMs let you bootstrap a small Meridian forest, deploy LAPS, and work through the security stack yourself.

Deploy Meridian's Windows Server security baseline hands-on. In this hands-on lab you will bootstrap a small Meridian forest, deploy Windows LAPS to manage the local Administrator password on a member server, retrieve and rotate a LAPS password, verify the Credential Guard configuration state on a Windows Server VM, build and deploy a Windows Defender Application Control policy in Audit mode and review the CodeIntegrity events, and configure Restricted Groups + Advanced Audit Policy to lock down administrative access on the domain controller. By the end of this lab you will be able to apply Meridian's Windows Server security baseline to production workloads.

Note: This lab pre-provisions Azure resources at start — allow up to 15 minutes for the environment to become ready before beginning the exercises. Two empty Windows Server VMs let you bootstrap a Meridian forest and work through monitoring and AD troubleshooting hands-on.

Practice the ops workflows Meridian's team runs every week. In this hands-on lab you will bootstrap a small Meridian forest, create a Windows Performance Monitor Data Collector Set capturing CPU/memory/disk with an alert threshold, onboard the file server to Azure Monitor via Azure Monitor Agent and a Data Collection Rule, enable Active Directory Recycle Bin and demonstrate a full deleted-object restore, deliberately break the secure channel between a member server and the domain, and repair it with Test-ComputerSecureChannel -Repair. By the end of this lab you will be able to instrument, monitor, and repair Meridian's Windows Server estate.