Microsoft AZ-802 - Administering Windows Server

Both Kerberos V5-based authentication methods, whether configured as Computer (Kerberos V5) or the less common User (Kerberos V5) variant, fundamentally require that both endpoints of the connection be joined to, and trusted by, the same Active Directory domain, since Kerberos authentication depends entirely on that domain trust relationship to issue and validate tickets. Because the two workgroup servers in this scenario are not joined to the domain at all, neither Kerberos-based method can successfully authenticate a connection security rule between them and the five domain member servers, and NTLMv2, while it can work across a domain trust in some configurations, still generally depends on a domain or trusted account context that a plain workgroup server does not participate in for this kind of IPsec connection security scenario. Computer certificate authentication, by contrast, does not depend on Active Directory domain membership at all; it only requires that both computers, regardless of whether they are domain-joined or standalone workgroup members, trust a common certification authority and each hold an appropriate certificate issued by that authority. This makes computer certificate authentication the correct and supported method for securing an IPsec connection security rule between domain-joined member servers and workgroup servers, which is exactly the mixed-membership scenario described.

Deploying 100 Azure virtual machines and ensuring every one of them is consistently joined to the on-premises AD DS domain, with minimal manual repetition, calls for an infrastructure-as-code approach. An ARM template (or the equivalent Bicep definition) can declare each VM alongside a domain-join VM extension resource (commonly the JsonADDomainExtension), which automatically performs the domain join as part of the VM ' s deployment, applied identically and repeatably across all 100 machines in a single deployment operation. Microsoft Entra Connect (or Entra Connect Sync) is a directory synchronization service that keeps the on-premises AD DS forest and the Microsoft Entra tenant ' s identities aligned; it has no capability to domain-join new virtual machines and is unrelated to this task. A Group Policy Object applies configuration and security settings to computers that are already members of the domain — a GPO cannot cause a computer to join a domain in the first place, since domain membership must exist before Group Policy can apply to that computer. An Azure management group is purely an organizational container used to apply Azure Policy and RBAC across multiple subscriptions and has no relationship to Windows domain join operations. An ARM template is therefore the correct tool.

Domain Controllers: GPO1. Domain Servers: GPO1.

All the computers involved -- the domain controllers and the domain member servers -- are already members of the same AD DS domain, so Kerberos V5 authentication, which every domain member can use natively via its existing domain trust relationship without deploying any additional certificate infrastructure, satisfies the requirement to authenticate connections using computer accounts while minimizing administrative effort; GPO3 and GPO4, which rely on X.509 certificates, would require standing up and managing a certificate authority and issuing certificates to every computer, adding unnecessary administrative overhead when Kerberos already works. Between the Kerberos-based GPOs, selecting the " Require " variant (GPO1) rather than the " Request " variant (GPO2) for both the Domain Controllers and Domain Servers OUs ensures that only authenticated domain computer accounts -- and no unauthenticated hosts that fail or skip IPsec negotiation -- are actually able to establish connections, which is exactly what " only authenticated computer accounts can connect " demands; " Request " would still allow an unauthenticated fallback connection in the clear if negotiation failed, which does not satisfy the requirement. Therefore, GPO1 should be applied to both OUs.

App1 is being blocked because Windows Defender Firewall with Advanced Security denies unsolicited inbound connections by default. To let remote users reach App1 on TCP port 52310 while keeping the solution scoped to only this application on Server1, an administrator creates a new inbound rule restricted to that specific port (or program path). Allowing all inbound connections for the profile would open every port on Server1 and violate the requirement to scope access narrowly, an outbound rule has no bearing on inbound client requests since App1 is being accessed rather than initiating connections, and a connection security (isolation) rule only governs authentication requirements between peers rather than which ports or programs are permitted to receive traffic. A scoped inbound port or program rule is therefore the only option that opens exactly the access App1 needs. The rule can be created through the Windows Defender Firewall with Advanced Security console, PowerShell ' s New-NetFirewallRule cmdlet, or Group Policy if Server1 is domain-joined, and scoping it to the specific port (or the App1 executable path) ensures no other service on Server1 gains unintended inbound reachability.

Because a domain-wide Group Policy Object already enforces Credential Guard with UEFI lock across all domain members, that policy setting is authoritative and will simply reapply the enabled, UEFI-locked Credential Guard configuration to Server1 the moment Group Policy next refreshes, entirely regardless of whatever one-time local change was just made to disable it. For the currently disabled state on Server1 to actually persist rather than being silently overwritten at the next policy refresh, the governing Group Policy Object itself has to be updated so that its Turn On Virtualization Based Security setting is no longer configured to enforce Credential Guard for the organizational unit or scope that Server1 falls under; only changing the policy that controls this setting stops Group Policy from re-asserting Credential Guard on Server1. Running the Device Guard and Credential Guard hardware readiness tool only assesses hardware compatibility and makes no configuration changes at all, and running dism with the /Disable-Feature and /FeatureName:IsolatedUserMode parameters only changes local machine state, which, exactly like the earlier local disable action, would simply be reverted the next time the domain-wide Group Policy setting reapplies to Server1.

Cluster role to create on Cluster2: Hyper-V Replica Broker. Replication target name to specify: The name of the Hyper-V Replica Broker.

When Hyper-V Replica is used with a clustered Hyper-V host as either the primary or the replica site, that cluster requires a Hyper-V Replica Broker role, because the broker abstracts away which specific physical node currently owns a given replicated virtual machine, keeping replication working correctly even as VMs live-migrate or fail over between nodes within the cluster. Before enabling replication, an administrator must create this Hyper-V Replica Broker role on Cluster2 and configure its replication settings, including the authentication method, the storage location for replica virtual machine files, and which primary servers are allowed to replicate to it. When subsequently configuring replication for the virtual machines on Cluster1, the destination (replica server) must be specified using the Hyper-V Replica Broker ' s own client access point name -- not the name of an individual physical node in Cluster2 -- because the broker, not any single node, is what tracks current VM ownership as virtual machines move between Cluster2 ' s nodes. Specifying an individual node name instead would break replication and failover as soon as a VM ' s ownership moved to a different node in Cluster2.

Add-DhcpServerv4Reservation is the DHCP Server PowerShell module cmdlet that creates a single IPv4 client reservation on a specified DHCP server, and it accepts pipeline input, so importing PrinterReservations.csv with Import-Csv and piping the resulting objects directly into Add-DhcpServerv4Reservation lets the cmdlet consume each row ' s ScopeId, IPAddress, and ClientId (MAC address) values to create all 20 reservations in a single pipelined command, which is the minimum-effort approach since it avoids writing any loop or per-row logic. Set-DhcpServerv4Reservation is used only to modify properties of a reservation that already exists, such as its description or client type, not to create new reservations, so piping CSV rows into it would fail outright since none of the reservations exist yet. Add-DhcpServerv4ExclusionRange creates an exclusion range that prevents the DHCP server from ever leasing addresses in that range to any client, which is the opposite of a reservation (which still requires the address to be leasable specifically to one identified client) and would actually break the ability to service these printers via DHCP. The fourth option ' s ForEach-Object with Add-DhcpServerv4Filter is scoped to the MAC address allow/deny filtering feature, an unrelated security control for permitting or blocking specific hardware addresses from obtaining any lease at all, not a mechanism for creating per-client static IP reservations from a CSV of address assignments.

When a network topology change occurs after a Point-to-Site VPN client is already connected -- such as enabling gateway transit through virtual network peering after Client1 ' s original connection was established -- the Windows VPN client configuration package must be downloaded again from the virtual network gateway and reinstalled on the client for it to learn the new routes to the newly reachable peered network. Downloading and reinstalling the VPN client configuration on Client1 refreshes the routing information embedded in that package so that it now includes routes into Vnet2, which is exactly the documented remediation Microsoft describes for this scenario. Because the peering and gateway transit settings on Vnet1 and Vnet2 were already configured correctly before this solution was applied, refreshing Client1 ' s configuration package is sufficient on its own to restore connectivity, without needing any additional changes to BGP, gateway SKU, or network security group rules. This solution therefore meets the goal of ensuring Client1 can communicate with Vnet2.

The BitLocker recovery key for volume C: the Server1 computer object. The BitLocker recovery key for volume E: the Server2 computer object.

When BitLocker recovery information is backed up to Active Directory Domain Services, it is written as a child object underneath the computer object of whichever machine was actually running when the key protector was created; it is never written under a user object, an organizational unit object, or the domain root itself. Because Admin1 turned on BitLocker for volume C directly on Server1, that recovery password is stored as a child object of Server1 ' s own computer object, and Admin1 subsequently moving Server1 into OU1 only changes Server1 ' s location within the directory tree, not which computer object actually holds its recovery data. Because Admin2 turned on BitLocker for removable volume E while it was physically attached to Server2, its recovery password was written under Server2 ' s computer object at that time. Simply moving the removable drive over to Server1 afterward and unlocking it there does not trigger a new backup to Active Directory, since a new recovery-information object is only created when a key protector is actually added to a volume, not merely when an already-encrypted volume is unlocked elsewhere. The recovery key for volume E therefore remains associated with Server2 ' s computer object even after the drive itself has been physically relocated to Server1.

In the subscription, create: a Log Analytics workspace. On Server1, install: the Azure Monitor agent.

Azure Monitor collects and analyzes telemetry through Log Analytics workspaces, which are the destination data store for the logs and performance counters that monitored machines send. Because Server1 is on-premises but has internet connectivity, it does not need to be Arc-onboarded merely to send monitoring telemetry via Azure Monitor Agent (AMA) using Microsoft Entra-based or token authentication; the essential subscription-side resource that must exist first is the Log Analytics workspace that will store the collected data and against which data collection rules and queries are defined. On the server side, the Azure Monitor agent is the current, supported agent for collecting events, performance counters, and logs from Windows and Linux machines, whether they are Azure VMs, on-premises servers, or Arc-enabled servers, and forwarding that data to the configured Log Analytics workspace through an associated data collection rule. The distractor options do not fit this scenario: an Azure Files storage account and Azure SQL Database/Blob Storage accounts are unrelated data stores that Azure Monitor does not use as its telemetry destination; the Analytics gateway is a Power BI on-premises data gateway component, not a monitoring agent; and the Device Health Attestation server role is a Windows feature for validating device boot-time security state, unrelated to Azure Monitor telemetry collection. Creating the workspace and installing the Azure Monitor agent together is what is needed to monitor Server1.