AZ-800 Administering Windows Server Hybrid Exam Prep

Discover read-only domain controllers (Rodke) that host a read-only Active Directory database, cache credentials, and enable unidirectional replication for secure branch-office authentication and DNS.

Discover flexible single master operation roles (Fizmo) that govern domain changes, including schema master, domain naming master, read master, infrastructure master, and pdc emulator, with forest-wide or domain-wide scope.

Learn to identify the FSMO operations master roles using PowerShell and administrative snap-ins, and transfer gracefully or seize the roles on a new domain controller when needed.

Understand active directory partitions and naming contexts—configuration, schema, domain, and application—and manage them with NTDSUtil, monitor replication with repadmin and dcdiag, and track performance with Performance Monitor.

Apply and manage group policies across Active Directory domains and OUs, understanding application from site to domain to OU and how multiple GPOs interact through priority, inheritance, blocking, and enforcement.

Explain how a group policy object stores metadata in the container and settings in the template, with versioned GPO files, and replicates across domain controllers using DRA and DFS.

Explore Active Directory security principles, focusing on user and service accounts, creating users with Active Directory administration tools and group managed service accounts.

Group users to simplify access control and policy application in Active Directory. Compare security and distribution groups and their scopes: local, domain local, global, and universal, to assign permissions.

Explore Azure Active Directory, a cloud-based, multi-tenant directory service that integrates with web-based applications, supports on-premise hybrid setups, and offers conditional access, single sign-on, and MFA.

Explore how Azure AD Connect syncs on-premises users and groups to Azure AD for Office 365 access, and compare password hash sync, pass-through, and federation authentication with authentication agents.

Show how to install Azure AD Connect to sync on-premises users to Azure AD, set required permissions, prepare UPNs, and use ID Fix for attribute fixes.

Enable Azure AD Connect Cloud Sync, a lightweight provisioning agent that lets multiple on-premises directories sync to a single Azure AD tenant, alongside the traditional AD Connect tool.

Implement and configure Azure AD DS by meeting prerequisites like Azure AD premium and password hash sync, selecting dns domain, provisioning a vnet and resource group, and creating admin group.

Explore self-managed Azure Ads, infrastructure as a service that runs cloud domain controllers with on-prem features, including joining domains and creating forests.

Identify highly sensitive admin groups, enforce minimum membership with restricted groups, and configure Group Policy and user access control to prompt for elevation.

Learn how to delegate administrative tasks at the organizational unit level using security groups, assign specific permissions, and delegate control in the OU interface.

Administer hybrid environments by enforcing security-first planning across on-premises and cloud networks, implementing least privilege, just enough access, and just-in-time access, and using jump servers to protect administrators.

Explore just enough administration (JEA) with PowerShell remoting to limit admin tasks via RBAC, enabling credential checks, allowed commands, and blocking everything else on a jump server.

Secure administrative work with a dedicated privileged access workstation and a hardened jump server, leveraging Windows Defender application control and credential guard for strong protection.

Use Windows Admin Center, a single web console, to manage on-premises and Azure resources via Server Manager, failover and hyper-converged clusters, and Windows 10 client module, enabling hybrid administration.

Explore remote server administration tools (RSAT) for managing Active Directory and network services from a remote machine, including ADSI Edit, DNS, DHCP, and diagnostic utilities.

Explore PowerShell as a script-based admin tool, learn the verb-noun command structure, perform local and remote tasks, manage sessions, and address remoting security.

Explore Just Enough Administration (JEA), a PowerShell-based, UI-free rbac-driven security model. Configure role capabilities and session endpoints with virtual accounts to limit commands and avoid storing credentials.

Explore infrastructure as a service for Azure virtual machines in hybrid environments, and learn to manage them with Azure portal, PowerShell, Azure CLI, and Run Command across on-prem and cloud.

Azure Bastion provides private RDP/SSH access to VMs through the portal, functioning as a jump server; deploy a subnet named 'Azure Bastion Subnet' with /27 and connect without public IPs.

Enable just in time access to secure machines by granting access only during admin sessions. Leverage RBAC, NSG, and Azure Firewall to enforce access, while maintaining activity logs for compliance.

Unify governance and policy management across on-premises and cloud resources with Azure Arc. Centrally manage Windows, Linux, SQL, and Kubernetes environments through extensions, onboarding, and policy remediation.