Configuring Windows Server Hybrid Advanced Services (AZ-801)

Explore the Microsoft Defender suite, including Defender for Endpoint, Defender for Identity, and Defender for Cloud, then enable Windows Defender Exploit Guard and enforce hardware-focused exploit protection via group policy.

Configure Windows Defender Application Control (WDAC) to enforce an explicit allow list for drivers and software, requiring careful planning, testing, and suitable hardware.

Protect servers with Microsoft Defender for Endpoint, a centralized cross-platform threat management integrated in Windows Security. Enable Credential Guard via GPO using virtualization based security and hardware prerequisites.

Enable SmartScreen to alert users and admins to potential threats, with centralized management via Group Policy or Intune and exclusions for false positives.

Explore group policy security settings in Windows Server 2022, and onboard on-premises and hybrid cloud devices to Defender for Endpoint and Defender for Cloud via Azure Arc for centralized security.

Explore securing Windows with group policies using Defender for Endpoint, access the security portal, monitor device inventory and alerts, and automate vulnerability and software updates for hybrid server environments.

Configure password policies for Windows Server and Azure AD to resist brute force, dictionary, and password spray attacks. Implement fine-grained policies and MFA to safeguard accounts, beyond traditional group policy.

Enable Azure AD password protection to block weak passwords and variants. Enable hybrid deployments by applying global and custom banned lists, and protect privileged accounts with the protected users group.

Secure domain controllers by using RODCs with password replication groups to limit cached hashes, enforce admin role separation, and deploy guarded and shielded VMs; for small branches, consider RODCs.

Configure authentication policy silos in Active Directory to enclose privileged accounts on specific systems. Explore password options, fine-grained policies, Azure AD protection, and hybrid deployment with policy definitions and agents.

Configure authentication policy silos and password protection in a hybrid Windows Server environment, including Azure AD password protection proxy registration and Kerberos armoring via group policy.

enforce domain controller security through group policy objects, restricted groups, and firewall rules, then harden high privilege accounts with local administrator password solution, protected users, and admin sd holder.

Explore built-in active directory administrative groups such as enterprise admins and domain admins, their impact on domain controllers and local administrators on member servers, and delegation and protected users protections.

Configure built-in Active Directory administrative groups, enforce domain controller access with firewall and network access groups, and deploy LAPS to manage local admin passwords via GPO, schema extensions, and tooling.

Explore active directory delegation for least-privilege administration and credential delegation, including the Kerberos second-hop problem and constrained delegation for secure remote PowerShell scenarios.

Deploy Microsoft Defender for Identity sensors on domain controllers and connect to the cloud service. Use AI-powered analytics to detect anomalous identity activity and investigate alerts in the MDI portal.

Demonstrates credential delegation for PowerShell remoting using CredSSP, configuring client and server settings and policy to forward fresh credentials, and ends with a brief look at Microsoft Defender for Identity.

Microsoft Sentinel is a cloud-native siem and security orchestration platform that ingests data from Azure, AWS, and on-prem sources, enabling detection, threat hunting with Cousteau, and playbooks.

Deploy Microsoft Sentinel and onboard Windows servers to a log analytics workspace. Configure data connectors, including Defender for Cloud and Azure AD, and explore analytics rules, notebooks, and hunting queries.

Onboard Windows machines to a log analytics workspace using the log analytics agent or Azure Arc extension, with workspace ID and keys. Learn multi-homing, off-cloud onboarding, and Arc policy guidance.

Discover how Microsoft Defender for Cloud secures hybrid environments with secure score, threat alerts, and policy-driven compliance across Azure, other clouds, and on-premises.

Identify server security issues with Azure Security Center and Defender for Cloud, using secure score, MFA recommendations, vulnerability assessment, log analytics integration, and automated remediation options.

Configure Windows Defender Firewall rules for inbound and outbound traffic, implement domain isolation with IPsec transport mode to encrypt and authenticate LAN traffic, and manage rules via group policy.

Demonstrates configuring Windows Defender Firewall with advanced security via a domain-scoped GPO to enable an ICMPv4 echo-request rule for a 10.0.0.0/24 subnet on Windows Server 2022.

Configure and apply IPsec connection security rules via group policy for two domain servers, enforce mutual authentication with Kerberos/NTLM, and monitor security associations.

BitLocker drive encryption provides at-rest, full-volume protection for OS, fixed, and removable drives, using TPM-backed startup integrity and recovery keys to safeguard data.

Configure BitLocker drive encryption via group policy, enable recovery data storage in Active Directory, and manage TPM, startup PIN, and recovery options for OS and data drives.

Learn to configure BitLocker drive encryption on Windows Server, enable TPM-based or password-protected startup, back up recovery keys to file or AD, and perform recovery with manage-bde force recovery.

Learn how Azure disk encryption applies BitLocker to OS and data disks, compare storage service encryption with Azure disk encryption, and manage keys via Azure Key Vault and encryption sets.

Learn to build a Windows server failover cluster for high availability, using shared storage, quorum and cluster shared volumes, plan with a witness, and deploy via PowerShell.

Configure a stretch failover cluster across sites or into Azure using storage replica for synchronous or asynchronous replication, enabling high availability, disaster recovery, and cluster shared volumes.

Explore quorum options for Windows Server hybrid, including node majority with or without a witness, no witness, and disk or cloud file share witnesses to prevent ties.

Configure failover clustering networking with multiple NICs and NIC teaming for isolation, high availability, and performance, including Storage Spaces Direct, DMA, SMB Direct, SMB Multichannel, and QoS.

Configure a new failover cluster with a static IP, add nodes, enable cloud witness quorum, and deploy storage spaces direct with virtual disks and cluster shared volumes.

Configure failover cluster roles, including scale out file server and Hyper-V replica, and understand cluster sets with a management cluster and member clusters for scalable resilience.

Learn scale-out file server configurations for highly available file shares, featuring automatic client rebalancing and two deployment types: general use and application data with related witness options.

Explore azure load balancer concepts, including regional and global deployment, and how floating IP enables the front end private IP to move with the availability group listener during failover.

Explore failover cluster VM load balancing and its auto balancer levels, using memory and CPU metrics to balance cluster nodes and enable high availability.

Explore configuring failover cluster load balancing for a hybrid Windows Server environment, including setting up an Always-on availability group listener, internal load balancer, and SQL Server connectivity.

Learn how cluster aware updating in Windows Server failover clustering enables zero-downtime patching through maintenance mode, node draining, and rolling upgrades, using PowerShell and GUI tools.

Demonstrates manual cluster OS rolling upgrade to Windows Server 2022, preserving the lowest cluster functional level while upgrading nodes one by one and coordinating workload failover.

Discover how to manage failover clusters with PowerShell and Windows Admin Center, including suspending nodes, moving cluster groups, and performing live migrations and updates.

Discover storage spaces direct, a software defined extension for hyperconverged clusters. Build 2–16 identical server nodes with cache, erasure coding, and mirroring options.

Configure storage spaces direct with high-bandwidth ethernet and RDMA, create and manage storage pools, virtual disks, and cluster shared volumes using PowerShell, Failover Cluster Manager, and Windows Admin Center.

Learn how the Azure Recovery Services vault enables hybrid cloud backup and replication for Azure workloads, on-premises servers, and other clouds, plus installing the Mars agent.

Learn to back up and recover on-premises windows server 2022 using the mars agent with azure recovery services vault, including vault registration, encryption, and scheduling backups.

Learn to deploy the Mars agent, on-board Windows and VMware servers, configure storage pools, and set up protection groups for hybrid backups and cloud recovery with Azure backup server.

Configure the Azure Recovery Services Vault for Windows Server backups, enabling soft delete, encryption, and geo redundant storage, then create backup policies with daily to yearly retention.

Learn to configure Azure VM backup with the Recovery Services Vault, manage incremental snapshots, and perform instant restore for Windows Server environments, including consistency levels and cross-region options.

Practice recovering a Windows Server VM in Azure by choosing in-place or trial restores, using Azure Site Recovery, and restoring disks to a new VM via an ARM template.

Explore Azure VM recovery options, including full VM restore to an alternate network, in-place storage swap, and file-level recovery from backups, with ARM template deployment.

Configure recovery services vaults, match regions with Azure VMs, and enable geo redundant storage. Explore restore options, including cross-region restore, VM and file recovery, and create new or replace VMs.

Protect on-premises and Azure Site Recovery workloads in a hybrid environment. Configure networking, replication, and failover using Recovery Services vault and secure port 443 traffic without a VPN.

Configures a site recovery plan to orchestrate multi-tier failover with Azure Automation runbooks, enabling script-driven checks, replication, test failovers, and snapshot-based failover decisions for Azure VMs.

Learn how the ASI replication policy in the recovery services vault sets snapshot frequency and retention for cost considerations in application-consistent VM recovery.

Explore configuring Azure Site Recovery for hybrid Windows Server environments, covering replication policies, recovery plans, and failover steps for Azure to Azure, Hyper-V, and VMware scenarios.

Hyper-V replica enables disaster recovery by performing asynchronous replication from the primary vm to a standby replica, with planned failover, optional offline media for initial replication, and configurable recovery options.

Configure Hyper-V replica and VM replication to perform planned and unplanned failovers, with test failover to a secondary VM, and extend replication to a tertiary host for disaster recovery.

Learn Hyper-V failover concepts, including planned and unplanned failovers, test failover, replication setup, recovery points, and reverse replication for disaster recovery on Windows Server 2022.

Explore hybrid cloud data transfer with Storage Migration Service, migrating file shares and server identity from on premises to Azure, including cut-over using an orchestrator and Windows Admin Center.

Demonstrates migrating file shares from FS1 to FS2 using Storage Migration Service in Windows Admin Center. Walks through inventory, transfer, and cut over with Docs and Scripts shares.

Leverage azure file sync to back up multi-site on-prem file shares to azure files, synchronize servers via sync groups, and enable tiered storage and recall from the cloud.

Explore configuring Azure File Sync to migrate on-premises file shares to the cloud, creating a storage sync service, sync groups, and server endpoints, with cloud tiering and health monitoring.

Explore how Azure Migrate provides a unified toolset to assess, replicate, and migrate Windows and Linux workloads from on-premises or other clouds, including p2v and VMware/Hyper-V migrations.

Learn to migrate physical workloads to Azure using Azure Migrate, with as-is on-premises and performance-based assessments, a replication appliance, and monitoring via Azure Monitor, Log Analytics, and Defender for servers.

Migrate an on-premises Hyper-V workload to Azure using the Azure Migrate appliance, covering discovery, assessment, and the migration workflow with replication and Azure Site Recovery.

Explore migrating IIS websites, Hyper-V virtual machines, and RDS hosts using out-of-box tools like MZ deploy and Hyper-V live migration, targeting Windows Server 2022 environments.

Explore using Windows Server Migration Tools for DHCP and print server migrations, compare PowerShell and Smic deploy on legacy servers, and migrate printers via the Print Management console.

Explore Windows server migration tools through manual print management and DHCP export/import, and PowerShell-driven migrations using RMS Deploy to export and import roles like DHCP and IIS websites.

Learn how Windows Server hybrid administrators migrate IIS web apps to Azure App Service using the App Service Migration Assistant, assess compatibility, generate ARM templates, and monitor the deployed app.

Explore migrating IIS workloads to containers with Docker, building images, pushing to Azure Container Registry, and deploying to Azure container instances or AKS, with app service options.

Explore Azure Migrate for web app migration, using the App Service Migration Assistant and containerization to move ASP.NET and PHP apps from IIS to Azure App Service.

Learn to migrate AD DS objects with the Active Directory Migration Tool, covering user, group, computer, and service accounts, plus scenarios like mergers, forest consolidation, and domain renaming.

Upgrade your domain to Windows Server 2022 introducing two member servers, preparing forest with ad prep tool, promoting to domain controllers, transferring FSMO roles, and raising functional levels to 2016.

Explore migrating user accounts across forests with the Active Directory migration tool (DMT), including forest trusts, DNS forwarding, password export, and conflict handling via wizards and automation.

Learn to use performance monitor to baseline Windows Server performance across CPU, memory, disk IO, and network IO, and collect remote data for hybrid cloud readiness with Azure.

Explore System Insights as an ML-powered evolution of performance monitoring, surfacing predictive analytics and capacity forecasts in Windows Admin Center, PowerShell, and Azure Log Analytics for hybrid clouds.

Explore practical server monitoring with system insights and Windows performance tools, building and analyzing data collector sets, event logs, and Azure Monitor metrics to forecast capacity and manage alerts.

Deploy log analytics agents across Azure, Azure Arc-enabled, and on-premises Windows servers to report to a log analytics workspace, and enable multi-homed configurations with performance counter collection and Cousteau queries.

Onboard Windows and non-Azure VMs to a log analytics workspace, install the agent, then configure alerts and action groups via log search and the cousteau query language.

Learn how to monitor Azure virtual machines using the Windows Diagnostics extension and Log Analytics, onboard VM Insights, and analyze performance with interactive workbooks and Cousteau queries.

Learn to diagnose hybrid network routing issues using PowerShell diagnostics like Test-NetConnection, Azure Network Watcher tools, and on-prem DHCP and DNS troubleshooting with packet capture.

Master diagnosing hybrid network connectivity issues with Network Watcher tools, including IP flow verify, SSG diagnostics, and next-hop analysis, alongside on-premises dhcp, dns, and vpn troubleshooting using windows admin center.

Identify provisioning and allocation failures in Azure deployments, validate Bicep and ARM templates, and ensure region and VM size compatibility; enable boot diagnostics and the serial console for troubleshooting.

Configure Azure disk encryption with AD and Key Vault, align GPO and firewall rules for hybrid Windows Server deployments, and optimize storage with managed disks.

Explore troubleshooting techniques for VM connection issues in Azure, including deployments, error details, activity logs, resource health, boot diagnostics, serial console, and network watcher connectivity tests.

Enable the Active Directory recycle bin to recover deleted objects like OUs and users, extend retention with msDSDeletedObjectLifetime up to 365 days, one-way and requires enterprise admins privilege.

Diagnose and fix Active Directory replication across domain controllers and forests using AD sites and services, repadmin, DC diag, KCC; troubleshoot hybrid authentication with Azure AD Connect and ID Fix.

Master troubleshooting for on-premises Active Directory using PowerShell and graphical tools, including the recycle bin feature, tombstone lifetime, and restoring deleted objects with authoritative restore.

Master core Windows Server hybrid administration across on-premises and hybrid environments, including high availability, disaster recovery, migration, and monitoring, applicable to any cloud, and ready for the ASA 801 exam.