Microsoft AZ-800 - Administering Windows Server Hybrid Core Infrastructure

In Windows Server deployments that use Hyper-V with Sw itch Embedded Teaming (SET) and SMB Direct (RDMA), Microsoft’s guidance in Administering Windows Server Hybrid Core Infrastructure is to validate the end-to-end Data Center Bridging (DCB) and RDMA prerequisites with Validate-DCB . The DCB validation covers the exact Windows Server settings RDMA depends on: Priority-based Flow Control (PFC), Enhanced Transmission Selection (ETS), QoS policies for SMB (priority tagging), and RDMA enablement on the relevant physical adapters. The study materials emphasize that while tools such as Server Manager , Failover Cluster Manager , or basic adapter inventory (e.g., Get-NetAdapter ) can show device status or general configuration, they do not verify the complete, lossless fabric requirements for RDMA over Converged Ethernet used with Hyper-V/SET.

The prescribed approach is to run Validate-DCB against the host NICs participating in the SET team to confirm:

RDMA is enabled on the interfaces used for SMB Direct.

PFC is enabled for the SMB priority.

ETS bandwidth reservations are correctly applied.

QoS policies align across adapters so SMB traffic is lossless.

The cmdlet produces pass/fail diagnostics and remediation guidance, providing a single authoritative validation for “RDMA and all required Windows Server settings” on each s erver. Accordingly, the correct choice for verifying the configuration in this scenario is Validate-DCB .

The Administering Windows Server Hybrid Core Infrastructure materials state the placement and provisioning requirements for IP Address Management (IPAM). Specifically:

“The IPAM server must be installed on a domain member computer . You cannot install the IPAM server feature on a domain controller .”

“IPAM manages and discovers domain controllers, DHCP servers, and DNS servers in the domain. Servers in a workgroup are not supported as managed servers.”

“When you choose Group Policy–based provisioning , IPAM creates and links GPOs that configure the required settings on managed DC/DHCP/DNS servers so that IPAM can perform inventory, event collection, and address space management.”

Applying these rules:

Server2 is a domain-joined Windows Server Core member with no conflicting roles, satisfying the guidance to avoid installing IPAM on a DC and aligning with the recommendation to place IPAM on a dedicated member server. DC1 is a domain controller (and DNS), so it must not host IPAM. Server1 (DHCP) could host IPAM but best practice is to use a dedicated server. Server3 is in a workgroup, so it cannot host IPAM or be managed by it.

For GPO-based provisioning and server discovery, the managed servers that must be provisioned are the infrastructure role holders: DC1 (AD DS/DNS) and Server1 (DHCP). These are exactly the servers IPAM discovers and manages via the created GPOs.

To ensure that all computers in the domain use DNSSEC to resolve names in the adatum.com zone, you’ll need to configure both the DNS servers a nd the client computers. Here’s how you can do it:

Step 1: Sign the adatum.com Zone First, you need to sign the adatum.com DNS zone. This can be done using the DNS Manager or PowerShell. Here’s a PowerShell example:

Add-DnsServerSigningKey -ZoneName " adatu m.com " -CryptoAlgorithm RsaSha256

Set-DnsServerDnsSecZoneSetting -ZoneName " adatum.com " -DenialOfExistence NSEC3 -NSEC3Parameters 1,0,10, " "

This will add a signing key and configure DNSSEC for the zone with NSEC3 parameters.

Step 2: Configure DNS Servers E nsure that your DNS servers are configured to support DNSSEC. This includes setting up trust anchors for the zones that you want to validate and configuring the DNS servers to provide DNSSEC validation for DNS queries.

Step 3: Configure DNS Clients For DNS SEC validation to occur on the client side, the client computers must be configured to trust the DNS server’s validation process. This typically involves configuring the client’s DNS settings to point to a DNS server that supports DNSSEC.

Step 4: Validate Configuration You can validate that DNSSEC is working correctly by using tools like nslookup or dig to query DNS records and check for the presence of DNSSEC signatures in the responses.

Note: The exact steps may vary depending on your environment and the version of Windows Server you are using. Ensure that you have the appropriate administrative rights to make these changes and that you test the configuration in a controlled environment before deploying it domain-wide12.

By following these steps, you shoul d be able to ensure that all computers in your domain use DNSSEC to resolve names in the adatum.com zone.

TASK 7

👉 Objective:

Attach the VHDX file c:\vhds\Disk1.vhdx to VM1 so it can dynamically expand when VM1 is running.

Step-by-Step Guide

✅ Step 1: Verify the VHDX File Type

Dynamic expansion means the virtual disk type should be dynamic (not fixed).

Let’s verify the disk type of Disk1.vhdx:

powershell

Copy

Get-VHD -Path " c:\vhds\Disk1.vhdx "

In the output, ensur e that VhdType shows Dynamic.

If it’s not dynamic, convert it:

powershell

Copy

Convert-VHD -Path " c:\vhds\Disk1.vhdx " -DestinationPath " c:\vhds\Disk1_dynamic.vhdx " -VHDType Dynamic

✅ Step 2: Attach the VHDX to VM1

Use PowerShell to add the disk to VM1:

p owershell

Copy

Add-VMHardDiskDrive -VMName " VM1 " -Path " c:\vhds\Disk1.vhdx "

✅ Or do it via Hyper-V Manager:

Open Hyper-V Manager.

Select VM1 and go to Settings.

In the left pane, select SCSI Controller (recommended for hot-add).

Click Add Hard Drive.

Browse and select c:\vhds\Disk1.vhdx.

Click Apply and OK.

✅ Step 3: Verify Hot-Add Support (Optional)

If VM1 is running Windows Server 2012 or later and uses a SCSI Controller, the VHDX can be added without shutting down the VM.

✅ Step 4: Verify the Di sk in the VM

Inside VM1, open Disk Management (diskmgmt.msc).

The newly attached disk should appear as unallocated.

Initialize it, create a volume, and format if needed.

Summary

VHDX file type: Must be dynamic for expanding.

Hot-adding supported if attached via SCSI Controller and OS supports it.

Now Disk1.vhdx is attached to VM1 and can expand dynamically.

TASK 2

👉 Objective: Configure DC3 to replicate with DC1 and DC2 only between 8:00 PM and 6:00 AM.

Step-by-Step Guide: Replication Scheduling for DC3

✅ Step 1: Promote DC3 to a Domain Controller (if not already done)

Use Server Manager or P owerShell to install the Active Directory Domain Services role and promote the server as a domain controller.

Example PowerShell command to install the AD DS role:

powershell

Copy

Install-WindowsFeature AD-Domain-Services

To promote:

powershell

Copy

Install-ADDSDomainController -DomainName " contoso.com "

✅ Step 2: Open Active Directory Sites and Services

Log in to DC3 or another DC with administrative tools.

Open Active Directory Sites and Services (dssite.msc).

✅ Step 3: Locate the Site

In the lef t pane, expand the Sites container and find the site that contains DC3.

Expand the site to find Servers.

Under Servers, select DC3.

✅ Step 4: Configure Replication Connection Objects

Expand DC3 and click on NTDS Settings.

In the right pane, you’ll see co nnection objects to other domain controllers (these represent replication partners).

✅ Step 5: Adjust the Replication Schedule for Each Connection

For each connection object to DC1 and DC2:

Right-click the connection object and select Properties.

Click t he Change Schedule button.

✅ Step 6: Set the Replication Schedule

In the schedule window, you’ll see a grid of hours.

Clear all hours except the time window of 8 PM to 6 AM (in 1-hour blocks).

Select 8 PM to 6 AM (10 hours total) for all days.

Click OK to save.

✅ Step 7: Verify and Document

Ensure that both connection objects (to DC1 and DC2) have the updated schedule.

Document your configuration as part of your environment’s change control.

One possible solution to configure SRV1 as a DNS server that can resolve names from the contoso.com domain by using DC1 and all other names by using the root hint servers is to use conditional forwarding. Conditional forwarding allows a DNS server to forward queries for a specific domain name to another DNS server, while using the normal forwarding or root hint servers for other queries. Here are the steps to configure conditional forwarding on SRV1:

On SRV 1, open DNS Manager from the Administrative Tools menu or by typing dnsmgmt.msc in the Run box.

In the left pane, right-click on Conditional Forwarders and select New Conditional Forwarder.

In the New Conditional Forwarder dialog box, enter contoso.com as the DNS Domain name.

In the IP addresses of the master servers box, enter the IP address of DC1, which is the DNS server for the contoso.com domain. You can also click on Resolve to verify the name resolution of DC1.

Optionally, you can check the box Store this conditional forwarder in Active Directory, and replicate it as follows if you want to store and replicate the conditional forwarder in AD DS. You can also select the replication scope from the drop-down list.

Click OK to create the conditional forwar der.

Now, SRV1 will forward any queries for the contoso.com domain to DC1, and use the root hint servers for any other queries. You can test the name resolution by using the nslookup command on SRV1 or another computer that uses SRV1 as its DNS server. For example, you can run the following commands:

nslookup www.contoso.com

nslookup www.microsoft.com

The first command should return the IP address of www.contoso.com from DC1, and the second command should return the IP address of www.microsoft.com from a root hint server.

Server1 - Set-Item

Server4 - Enable-PSRemoting

In the AZ-800 “Administering Windows Server Hybrid Core Infrastructure” objectives for Active Directory, server promotion is governed by forest/domain administrative roles. The materials state that promoting a member server to a domain controller in a given domain requires membership in either the Enterprise Admins group or the Domain Admins group of the target domain. The Configuration and Domain naming contexts that DCPromo touches (NTDS settings, SYSVOL/DFS-R readiness, DC computer account, and associated service SPNs) are protected so that “Enterprise Admins have full rights forest-wide, and Domain Admins have full rights within their respective domain.”

In this case, the requirement is to promote Server1 to a domain controller in canada.contoso.com. From the identities table:

Contoso\Admin1 is a member of Enterprise Admins (forest-wide authority).

Canada\Admin3 is a member of Canada\Domain Admins (authority within canada.contoso.com).

Contoso\Admin2 is Domain Admins (contoso.com) only, which does not grant administrative authority in the canada.contoso.com child domain.

Therefore, the users who can currently perform the required task for Server1 are Admin1 and Admin3.