Microsoft 70-744: Securing Windows Server 2016

Adopt the assume breach philosophy to design security as if a breach has occurred, and apply Windows operating system technologies to protect resources from internal and external threats.

Identify attack vectors across applications, OS, and cloud infrastructure, including unpatched vulnerabilities, memory exploits, SQL injection, malware, phishing, social engineering, and for-profit threats like ransomware.

Understand reconnaissance in the research and preparation stage, elevation of privilege, and data exfiltration, including spear phishing and stolen credentials.

Prioritize resources by identifying key assets such as Active Directory domain services, domain controllers, databases, email, file servers, web servers, and virtualization hosts, then allocate security efforts accordingly.

Enable auditing policies to capture security events in Windows event logs, monitor with Event Viewer, and archive logs to prevent overwriting evidence after breaches.

Explore the Sysinternals tools collection to understand security related utilities under the Microsoft umbrella, highlighting their role as security tools within Windows Server contexts.

Explore Sysinternals tools and security utilities, download the Sysinternals suite from Microsoft, extract it, and begin exploring its utilities in security-focused demonstrations.

AccessChk helps determine permissions for users or groups across files, directories, registry keys, and services. Use it to spot unauthorized privilege elevation and proactively verify that critical resources stay confidential.

Explore autostart with the auto runs utility, listing startup folder items, registry run/run once keys, and hiding signed Microsoft entries to spot malware and triggers.

View all active logon sessions and their running processes to detect breaches, assess authentication details like Kerberos, logging type network, and DNS domain, and investigate suspicious activity locally or remotely.

Process Explorer lets you view files opened by a process and when it was launched. It shows network activity, cpu and memory utilization, digital signatures, and helps monitor processes.

Monitor registry, file system, and process and thread activity in real time; capture and log data for later analysis, apply filters, and export evidence for Windows security.

Use sigcheck, a signature checker, to detect tampering when attackers replace known executables, view version and timestamp data, inspect digital signatures, and check files on VirusTotal for malware scans.

Learn to use Sysinternals Process Explorer and Process Monitor to monitor server activity, view log on sessions, and identify attacker activity and running processes.

Review chapter 01 of Microsoft 70-744: securing Windows Server 2016, outlining the key objectives and topics covered in the course material.

Apply the principle of least privilege by granting only the minimum permissions and using non-privileged accounts for daily tasks; use administrative credentials only when necessary.

Learn the difference between user rights and permissions, with two types. Privileges and log on rights govern access, illustrated by take ownership, backup, restore.

Configure account security options in Active Directory, including log on hours, log on workstations, smart cards, and sensitive privileged accounts, to reduce credential exposure and prevent misuse.

Demonstrates configuring user rights and account security options through group policy and Active Directory Administrative Center, covering rights assignment, domain controller precedence, and PowerShell bulk updates.

Explore windows complexity options from 2003 to 2016, including minimum password length, not containing the user logon name, and three of four character categories, enforced by the default domain policy.

Configure the default domain policy to enforce password history, age, length, and complexity. Define account lockout thresholds and durations to limit failed attempts and reset counts after 30 minutes.

Configure fine-grained password policies within the domain to apply rules to users and global security groups, stored as password settings objects in the password settings container in the system container.

Create a PSA in the password settings container, then link it to users directly or to groups indirectly, where direct links win and lower precedence numbers enforce stricter password rules.

Protected users group offers non-configurable protection for user accounts on domain controllers with PDC role from 2012, restricting Kerberos to des and rc4 and excluding computer or service accounts.

Delegate administrative control to groups to distribute authority and avoid single highly privileged administrator accounts, granting granular permissions across domains, containers, and organizational units.

Delegate control in Active Directory using the delegation wizard, focus on ACL permissions, security tab, and effective access to grant read and password reset rights to groups.

Discover how Local Administrator Password Solution (LAPS) centralizes, randomizes, and securely stores local admin passwords on domain-based machines, with access controlled via permissions and secure retrieval from Active Directory.

Understand laps requirements: Active Directory domain functional level Windows Server 2003 or higher, a schema extension, schema access, plus dot net 4.0 and PowerShell 2.0 on 32-bit and 64-bit systems.

Configure and manage local administrator passwords with active directory and LAPS, move computer accounts into an OU, enable password permissions, install GPO templates, and enforce password complexity and rotation.

Deploy the local administrator password solution (laps), configure a gpo to manage local admin passwords, and retrieve randomized passwords via the laps ui or powershell.

Assign computer accounts to enhance security through security groups, control policy application and resource access; default 30-day password resets require rejoin to the domain, or disable accounts to stop sign-ins.

Learn to diagnose and repair broken trust relationships by resetting secure channel passwords for computer accounts, using the graphical user interface or PowerShell to reestablish domain trust.

Explore built-in service accounts in Windows Server 2016, how to assign them via the service logon tab, and compare local system, local service, and network service with a better option.

Configure group managed service accounts in Windows Server 2016 by creating a gmsa in Active Directory, adding servers as members, installing the AD PowerShell module, and ensuring automatic password management.

Verify system requirements and enable credential guard via policy. Configure virtualization based security in the GPO, choosing secure boot and enabling credential guard with or without UAF lock.

Verify credential guard is active after policy updates by using the system information utility to confirm virtualization based security is enabled, or query Win32_device_guard via PowerShell and WMI across devices.

Assess credential guard weaknesses and limits, including memory-attack protection for derived domain credentials, while not covering local or Microsoft accounts, on premise Active Directory domain services credentials, or pass-the-hash threats.

Identify Active Directory accounts with non-expiring passwords and no recent sign-ins using AD tools or Get-ADUser, then disable and re-enable as needed.

Locate problem accounts in your domain with the Active Directory Administrative Center or PowerShell. Use global search to add criteria for password expiration and last logon to identify security risks.

Explore privileged access workstations to add an extra layer of security that protects user credentials and prevents escalation of privilege by attackers.

Implement privileged access workstations to keep administrative tasks separate from daily use, using two accounts (non-privileged and privileged) to minimize compromise and prevent credential harvesting and lateral movement.

Learn how a jump server uses a remote desktop to perform administrative tasks via an intermediary, and why pairing it with a privileged access workstation reduces malware risk.

Secure domain controllers by applying latest Windows updates, using server core, enabling TPM and BitLocker, and enforcing strict firewall and access controls to prevent credential theft.

Apply least privilege by configuring user rights and password policies, manage computer and service accounts with group managed service accounts, and protect credentials with credential guard and privileged access workstations.

Review chapter 02 of Microsoft 70-744 to reinforce security practices for Windows Server 2016 in this course.

Explore the fundamentals of just enough administration and deploy it to grant users or administrators the necessary rights and privileges in a more granular, controlled fashion.

Explore how JTA endpoints provide role-based access control on Windows Server 2016 and Windows 10 via PowerShell remoting, restricting users to predefined cmdlets, parameters, and values.

Configure a session configuration file for the JTA implementation, detailing path, session type, role definitions, and remote signed PowerShell with run as virtual account and transcript logging.

Create a PowerShell session configuration file, set it to restricted remote server, enable run as virtual account, and link the DNS ops roll capabilities to the DNS ops group.

The session configuration file references roll capability files that whitelist commands, located in a Roll capabilities subfolder of a PowerShell module found along the PowerShell path.

Demonstrates building a role capability file in Windows Server 2016 using the PowerShell integrated scripting editor, defining visible commands, functions, and parameters for DNS administration.

Register and configure a PowerShell endpoint, connect using enter-session syntax with computer name and configuration name, and assign user capabilities via a session configuration linking security groups and role files.

Connect to a JEA endpoint with the session configuration and configuration name; specify the computer parameter for the local machine to limit the session to roll capability files.

Learn how to deploy JEA endpoints across large networks by using desired state configuration to centrally apply and maintain session configurations on multiple computers.

Implement an administrative forest to host privileged accounts and workstations, hardened for security, linked to the production forest by a one-way trust with selective authentication and smart-card logons.

Ties the security of an object to the security of the controlling subject, and shows that security dependencies are transitive, so a compromised workstation can expose domain controllers.

Leverage MIM 2016 on-premises to automate user and group lifecycles, enable self-service password resets and account unlocks, manage certificates, self-service attribute management, and password synchronization across directories.

Explore just-in-time administration and privileged access management, and understand how Microsoft's implementation extends the just-in-time and just enough administration concepts with time-based access.

Privileged access management enables just-in-time administration by granting temporary rights to a security group, with requests logged and privileges revoked after use, supporting least privilege.

Outline the key components of privileged access management in Windows Server 2016, including the administrative forest (bastion), pam client, mem service and portal, and pam component and monitoring services.

Create an administrative (bastion) forest for privilege access management, establish a trust with the production forest using the pam tool, then install mehm 2016 on a second joined server.

Test dns name resolution between production and bastion forests, configure conditional forwarders to enable cross-forest resolution, and create a one-way trust with the new pam trust command.

Create shadow principals in administrative forest to mirror production forest accounts and groups. The PAM server grants temporary membership with the original group's SID, enabling access without changing production resources.

Install the MIM web portal within a SharePoint environment and enable privileged access management administration. Create a new SQL database for the MIM portal and PAM REST API.

Setup enables users to request privileged access via Windows PowerShell or the web portal, while admins create PAM roles that configure privilege options, time-to-live, MFA, and approval requirements.

Review chapter 03 of the Microsoft 70-744 course to reinforce essential security practices for securing Windows Server 2016.

Understand how malware harms computer systems by identifying common types—virus, worm, trojan horse, ransomware, and spyware—and their payloads, such as remote access, keylogging, and identity theft, to empower effective protection.

Mitigate malware by keeping systems and applications patched and running updated anti-malware with automatic updates. Enforce safe user behavior with proxies and email filtering to reduce infections.

Windows Defender provides anti-spyware and anti-virus protection on servers, with scheduled scans, quick, full, or custom scans, severity-based responses (notify, delete, quarantine), and definitions updated via Windows Update.

Examine software restriction policies, a legacy app control method in Windows Server 2016, and compare enforcement types—hash, certificate, path, and zone, noting certificate precedence.

AppLocker replaces software restriction policies with group policy controls for executables, scripts, Windows Installer files, and universal apps. It supports enforce or audit modes, easier whitelisting, and group-specific application policies.

Explore AppLocker rules that control whether apps run via publisher, path, hash, and certificate criteria; least precedence applies, while publisher rules offer the most flexibility using signing information.

Explore Device Guard, a suite of security features built into Windows 10 and Windows Server 2016, and learn how to use it to enhance protection.

Explore how Device Guard blends hardware and software hardening to run only trusted applications on Windows 10. It combines virtual secure mode, configurable code integrity, and secure boot.

Enable virtualization based security and device guard by configuring EFI, secure boot, and TPM; install Hyper-V, turn on credential guard, and verify virtual secure mode via event viewer.

Prepare a malware-scan reference computer, create a code integrity policy in elevated PowerShell, convert to binary, sign with internal CIA or public CA, and test with local policy.

Enable control flow guard, or cfg, a security feature that prevents memory corruption by restricting where code can execute; it requires compiler and OS support and runs on Windows 10+.

Learn patch management with Windows Server Update Services (WSUS) on Windows Server 2016, including how to add the WSUS roll for effective updates.

Explore how Windows Server Update Services centralize patch management, approve and deploy essential updates, test compatibility, and monitor and troubleshoot updates across computer groups.

Learn server requirements for Windows Server 2016, including .NET Framework 4.6+ installation via Server Manager, 70 gigs of disk space, wiod or sql server options, and update filtering by language.

Configure clients to communicate with the internet update server via group policy. Link a GPO to an Active Directory container to control Windows Update restarts, notifications, and computer group settings.

Manage WSUS with graphical admin console: configure product categories, download and approve updates for all or specific groups, monitor status, synchronize with Microsoft Update, and use PowerShell for administration.

Demonstrates installing and configuring WSUS as a central patch management server, synchronizing with Microsoft Update, and managing updates, products, languages, groups, and automatic approvals.

Review chapter 04 content to reinforce essential security concepts for Windows Server 2016. Prepare for the Microsoft 70-744 exam with focused review for securing Windows Server 2016.

Explore the basic auditing features of Windows Server 2016 and learn why auditing is essential for securing the overall infrastructure.

Record user and operating system activities in security logs, distinguishing success audits from failure audits to monitor security and reveal trends in log ons and account creation.

Learn about the types of events in security auditing, including account logon events, account management, directory service access, object access, policy changes, privilege use, and system events.

Enable object access auditing and modify the ACL to track delete permission on a targeted folder, while avoiding global auditing to limit event volume.

Explore advanced auditing and its subcategories to narrow event focus, reduce unnecessary logs, and audit PowerShell execution with Windows PowerShell for auditing.

Explore advanced auditing in Windows server 2016, focusing on directory service access, replication of objects and attributes, and changes, and learn to fine tune audit policies for success and failure.

Fine tune auditing with advanced subcategories, such as account management, directory service access, and Kerberos service ticket operations, to minimize unnecessary events and focus on credential validation and privilege use.

Learn to use Windows Event Viewer to forward security logs from domain controllers to a central monitoring system, configure event subscriptions, and filter events for centralized auditing.

Configure event forwarding in Windows Server 2016 to centralize security auditing by forwarding remote events to a collector, using a subscription and event log readers group.

Audit security logs with Windows PowerShell by querying the security log, filtering for failed audits, and using remoting to access local or remote systems.

Explore PowerShell transaction logging, bundling commands to ensure success or roll back with undo. Use start transaction, complete transaction, and undo transaction, with event commands and require tx parameter true.

Enable script block logging to trace PowerShell script execution, logging all blocks in the Windows PowerShell operational log via a group policy setting.

Deploying and configuring advanced thread analytics; topic c ATA Microsoft 70-744 securing Windows Server 2016.

Learn how UEBA analyzes Windows logs and domain controller traffic to detect attacks, generate alerts, and identify deviations from normal user and device behavior.

Identify and detect attacker activity across kill chain phases—reconnaissance, compromised credentials, lateral movement, privilege escalation, and domain dominance—by analyzing domain controller traffic, event logs, Kerberos traffic, TGTs, and honey tokens.

An on premise standalone product uses the 88 Center to collect and analyze domain controller data for threats, with gateways, a database, and a console for alerts.

Port mirroring replicates domain controller traffic to the gateway, enabling monitoring of authentication traffic and credential-related packets across switches or virtual networks.

Deploy and configure the Operations Management Suite to manage Windows Server 2016 environments. Explore practical steps for deployment and configuration of the Operations Management Suite.

Explore the operations management suite as a hybrid security monitoring solution that gathers cloud and data center data for threat detection and log analytics with easy setup.

Deploy OMS in a simple hybrid setup by creating a Microsoft account, using the OMS portal, optionally linking an Azure subscription, and deploying agents across Windows, Linux, and virtual machines.

Configure auditing and advanced threat analytics in Windows Server 2016 to monitor security events via event logs and PowerShell logging, boosting protection against network attacks.

Review chapter 05 of the Microsoft 70-744 course on securing Windows Server 2016 to reinforce the chapter's content.

Secure virtualization infrastructures by addressing security risks from virtual machines stored on host systems in environments that span on premise and cloud based solutions.

Explore guarded fabric, a hyper-v virtualization infrastructure delivering granular delegated access to guest virtual machines, and learn the separation of fabric and workload administrator roles for compliance.

Attestation and encryption manage key transport to unlock shielded VMs for workload administrators, with the guarded host obtaining decryption keys from the HDD cluster after attestation approval.

Choose an attestation method based on hardware and security needs, using admin trusted for lower-end servers or TPM 2.0 with EFI 3.1 and Secure Boot for protection and integrity policies.

Initialize host guardian service to establish a one-way external trust between hgs forest and production forest, using netdom or PowerShell, verify dns resolution, and generate signing and encryption digital certificate.

Configure the Hyper-V host as a trusted client, install host guardian client roles, and use PowerShell to set the hgs client configuration with the attestation server URL.

Install the security and compliance manager to enforce consistent security across domain and non-domain systems, covering prerequisites, licensing, updates, and automatic baselines import.

Configure and deploy security baselines using the security compliance manager by importing baselines, merging 2012 and 2016, exporting to a GPO, and applying via group policy management console.

Explore Nano Server, a new installation option in Windows Server 2016 that differs from server core mode.

Plan for nano server by understanding its differences from server core and its advantages, including a smaller footprint, no local sign-in, 64-bit app support, faster setup, and fewer post-install updates.

Understand Nano Server roles as a DNS server, Hyper-V host, and storage host for scale-out file servers, plus web and application hosting for containers and virtual guests.

Prepare Nano Server installation from Nano Server folder on Windows Server 2016 media and deploy via VHD for native boot or Hyper-V, or via WIM file on a physical computer.

Copy the nano server image generator, import its PowerShell module, and create a VHD or WIM with New-NanoServerImage using base/target paths and optional packages like containers and DNS.

Review the core topics of securing Windows Server 2016 covered in chapter 06. Reinforce essential concepts from the Microsoft 70-744 course.

Plan and implement the encrypting file system to protect files and folders on NTFS partitions, ensuring only authorized users can access them.

Learn how the encrypting file system (efs) uses symmetric and public key encryption to protect data confidentiality, integrity, and secure session key exchange in SSL.

Recover encrypted files using the private key paired with the public key in the data recovery fields, and configure data recovery agents and key archival with an internal certificate authority.

Plan and implement BitLocker, the encryption technology available in Windows Server 2016 and client operating systems, to protect data and secure endpoints.

BitLocker provides volume-level encryption, protecting all files by encrypting the entire drive or only the used portions, with TPM-based boot integrity and optional startup authentication with PIN or USB key.

Configure and manage bitlocker using control panel, group policy, and the bitlocker drive encryption configuration tool to enforce encryption for removable drives, passwords, and network unlock in Active Directory.

Walks through deploying BitLocker on Windows Server 2016 and Windows 10, using Server Manager and Group Policy Management Console to enable drive encryption and configure startup options.

Learn how BitLocker protects failover cluster volumes in Windows Server 2016, using protectors for cluster shared volumes and enabling BitLocker via PowerShell or the Manage BT utility.

Enable BitLocker on csv volumes by installing the feature, ensuring ntfs drives with letters, and configure password and account or group protectors before adding volumes to the cluster.

Windows Server 2016 supports BitLocker network unlock, enabling automatic decryption key access for remote startup, requiring EFI firmware, TPM, no legacy mode, and PKI with AD CS.

Learn how to recover BitLocker protected drives by using the 48-digit recovery key, recovery passwords stored in Active Directory, and policy settings for BitLocker recovery information.

Explore Microsoft BitLocker Administration and Monitoring (MBAM), a comprehensive enterprise tool for managing BitLocker deployment, reporting, monitoring, and role-based administration with self-service password resets and full CC integration.

Configure data protection with the Encrypting File System (EFS) and Lochore, combining file- and full-volume encryption to safeguard data using TPM chips on mobile, desktop, and server systems.

Review chapter 07 from the Microsoft 70-744 course on securing Windows Server 2016 to reinforce key concepts.

Explore storage management and capacity management to ensure critical data on network servers remains available and compliant with regulatory requirements, while prioritizing files, preventing misuse, and addressing rapid space growth.

Explore storage management with File Server Resource Manager, focusing on quota management, file screening, and storage reports—the three primary components—with a brief introduction to automatic file management.

Install and configure file server resource manager on Windows Server 2016, setting quotas, file screens, storage reports, classification and file management tasks, and enable email notifications.

Install and configure the file server resource manager (fsrm) on Windows Server 2016 to manage quotas, file screening, reports, and email notifications, using Server Manager or PowerShell.

Set up and manage quotas with File Server Resource Manager, applying hard or soft limits on volumes or folders, and configure email alerts, event log entries, and storage reports.

Control server storage with file screening by monitoring extensions and blocking certain types with an active file screen. Use built-in file groups and templates to standardize allowed and denied extensions.

Define a namespace for file screens using file groups with include and exclude patterns, and customize default groups or create new ones to manage whole collections of files.

Demonstrate using file server resource manager to implement file screening and enforce allowed or blocked file types. Learn to configure file groups, templates, and exceptions, plus notifications and audit reporting.

Set up and schedule report tasks to automate reporting on specified volumes and folders, choose reports and parameters, and select file formats, with optional manual generation for immediate access.

Generate and schedule storage reports with Windows file server resource manager to visualize capacity, utilization, and file-type distribution, enabling data-driven storage decisions.

Explore deeper into classification and file management tasks, uncovering automated capabilities on a Windows Server file server.

Automate file tagging with metadata by applying classification properties through predefined rules that scan location, filenames, and content. These properties enable automatic actions and permissions via dynamic access control.

Set up classification properties and rules to automate file classification on a predefined schedule, scanning content or location, and determine automatic classifications with testing on sample files.

Explore configuring file classifications with file server resource manager, creating classification properties and rules, and automating confidential data tagging through content and folder classifiers.

Learn how file management tasks in classification management automate actions on files using classification properties, including moving, archiving, deleting, renaming, and encryption, and how dynamic access control amplifies their usefulness.

Discover how dynamic access control enhances Windows file security by combining NTFS and shared folder permissions with central access policy permissions and claims-based authentication sourced from Active Directory.

Dynamic access control in Windows Server 2016 centralizes file access policies on domain controllers, applying them across file servers with Active Directory attributes and device claims for auditing and remediation.

Identify the foundational technologies for dynamic access control, including tcp/ip, remote procedure call, server message block, ldap, dns, kerberos v5, lsa, and net logon service.

Understand identity as a security principle in Active Directory, defined by SIDs and GUIDs, with ACLs and ACEs granting permissions; Kerberos issues tickets and access tokens for resource access.

Explore user claims and device claims for dynamic access control, leveraging default and custom Active Directory attributes, ensuring values for critical attributes via scriptable account creation and value validation.

Define central access policies in Active Directory and push them out to enforce dynamic access control. Use conditional expressions with groups, claims, and resource policies driven by compliance needs.

Explore policy components, including applicability and data conditions like resource.department equals research and resource.city equals Chicago. Understand how access conditions (aces) grant permissions and how dynamic access control works.

Set up a file server on Windows Server 2012+ with File Server Resource Manager and a 2012 domain controller. Enable claims and Kerberos armoring to enable dynamic access control.

Demonstrates implementing dynamic access control in Windows Server 2016 by creating department claims and resource properties, building central access rules, and deploying a central access policy via group policy.

Explore file server resource manager for advanced quota and file management, with classification and dynamic access control via central access policies and access remediation to secure resources on trusted devices.

Review chapter 08 of Microsoft 70-744: Securing Windows Server 2016 to reinforce essential concepts and prepare for exam readiness.

Compare host-based and hardware firewalls, from Windows firewall to perimeter devices, and describe how application layer gateways, circuit level gateways, packet filtering, and stateful multi-layer inspection enhance security.

Explore well-known ports and services, such as 80, 443, 53, 25, 22, 110, 143, and 5060/5061, noting that tcp/udp use ports to identify upper-layer protocols; memorization aids testing.

Learn the host-based Windows firewall that protects Windows Server 2016 by filtering inbound and outbound traffic, with control panel setup, IPsec integration, and automatic block notifications via netsh and PowerShell.

Explore how Windows classifies networks into domain, private, and public profiles, how each profile's firewall rules differ, and how domain profile can auto-activate via DNS.

Configure Windows Firewall with advanced security to manage inbound and outbound rules, predefined rules, logging, and IPsec connection security. Centralize administration via Group Policy and remote management with PowerShell.

Explore configuring the Windows Firewall in Windows Server 2016 using control panel and advanced settings, including inbound rules, program-based permissions, and logging, plus remote management via PowerShell and group policy.

Explore the data center firewall in Windows Server 2016, a stateful, multi-tenant, OS-agnostic solution derived from Azure, protecting virtual environments.

Automate configuration, monitoring, and troubleshooting of physical and virtual network infrastructure in your data center with the network controller on Windows Server, using southbound and northbound APIs for comprehensive management.

Explore the datacenter firewall in Windows Server 2016, a built-in, OS-agnostic, network layer stateful multitenant firewall for Hyper-V that enforces tenant policies and moves with VMs across subnets and networks.

Define network security groups to segment a Hyper-V environment into virtual subnets, create a perimeter network, and apply inbound and outbound ACL rules at the virtual machine level.

Examine data center firewall scenarios in software-defined networks across public, private, and multitenant clouds, and design three-segment networks: front-end, back-end, and security, with firewall rules to regulate internet access.

Explore IP security (IPsec), a suite of technologies that provides enhanced security on Windows networks within the context of securing Windows Server 2016.

Explore how IPsec builds an open, nonproprietary IP stack for secure, confidential communication over untrusted networks via tunneling, data encapsulation, encryption, and digital signatures with negotiated security associations.

Explore IPsec usage scenarios for authenticating and encrypting host-to-host traffic, using tunnel mode for site-to-site VPNs and ensuring integrity, non repudiation, and confidentiality at the network layer.

Explore tools for configuring an IP stack, including the Windows firewall with advanced security snap-in, the IP security policy snap-in, and group policies with automation via command-line utilities and PowerShell.

Examine the rule types in the wizard, including isolation, authentication exemption, server-to-server rules, and tunnel mode. Learn how health policies and health certificates authenticate IPsec connections.

Learn how IPsec secures Windows server communications by configuring tunnel mode and transport mode between endpoints, typically routers or firewalls, with encapsulation and ESP headers.

Identify users and computers through Kerberos v5 or computer certificates, negotiate encryption and signing algorithms, and configure IP set authentication with Active Directory certificate services and auto enrollment.

Configure encryption settings in the Windows firewall with advanced security, selecting secure authentication signing algorithms and aes encryption while avoiding legacy options like md5 and des to ensure compatibility.

Monitor connections with Windows Firewall with advanced security console to view connection security rules, main mode and quick mode, and IPsec sessions, including key exchange, security associations, and encrypted protocols.

Demonstrates implementing IPsec in Windows Server 2016, configuring connection security rules, Kerberos authentication, optional pre-shared keys, and group policy deployment to enforce encryption for DNS traffic on port 53.

Securely manage dns services by implementing least-privilege delegation, JTA endpoints, and PowerShell-based administration. Configure logging, scavenging, backups, and zone types to protect against denial of service and stale records.

Optimize DNS name resolution with advanced DNS zone options, including DNS round robin and net mask ordering, for effective load balancing. Explore forwarding and stub zones.

Enable advanced DNS security on Windows Server 2016 by configuring cache locking to prevent TTL poisoning, enabling socket pool port randomisation, and implementing DANE with DNSSEC.

Implement dnssec by configuring a trust anchor, signing zones with the psec wizard, and enforcing validation via the nrpt and group policy.

Demonstrates signing a DNS zone with DNSSEC, configuring a key master and signing keys, enabling automatic rollover, distributing trust anchors, and enforcing DNSSEC validation via the name resolution policy table.

Microsoft 70-744 introduces DNS policies that control how the server handles queries based on IP and factors. Use policies to block queries, redirect to healthiest endpoint, and enable split DNS.

Implement DNS policies by using AD DNS server client subnets and zone scopes to route queries to the correct servers, manage resource records, and enable sinkhole security.

Protect against DNS amplification by enabling the RRL feature on Windows DNS, leveraging the three-way handshake to validate clients, detecting malicious queries, and throttling responses via set-dns-server options.

Demonstrates configuring dns policies to tailor name resolution by client location, create subnets and zone scopes, add records, and enable rrl for load balancing.

Explore monitoring network traffic in the context of the Microsoft 70-744 course on securing Windows Server 2016.

Explore how SMB 3.1.1 secures Windows 10 and Server 2016 by encrypting SMB traffic, enforcing pre-authentication integrity, and negotiating ciphers with SHA-512 and AES-GCM.

Explain SMB encryption requirements and compatibility, highlighting backward compatibility by communicating at the lowest common SMB version, e.g., SMB 3.1.1 for modern systems and older versions for legacy ones.

Use Windows PowerShell to enable encrypted SMB shares, either per share or the entire server; set encrypt data to true, noting encrypted existing shares require SMB 3.0 x clients.

Secure the network infrastructure with Windows Firewall with Advanced Security, datacenter firewall and network controller, IPsec encryption, DNS security policies, and SMB 3.1.1 protections using PowerShell and Microsoft Message Analyzer.

Conclude this course on securing Windows Server 2016 by consolidating server hardening, virtualization and network security, intrusion detection and prevention systems, and workload-specific protections to prepare for the 70-744 exam.