Management Tools and Automation
- Comparing Server Manager, RSAT and Windows Admin Center; managing Server Core with SConfig
- PowerShell remoting, Just Enough Administration (JEA) and the pre-installed OpenSSH Server
- Automating routine tasks with PowerShell and scheduled tasks, CIM cmdlets instead of WMIC
- Connecting servers with Azure Arc: Windows Admin Center in the Azure portal, Best Practices Assessment
Operating Active Directory Domain Services
- Checking the health of domain controllers: dcdiag, repadmin, event logs
- Transferring and seizing FSMO roles, cleanly demoting domain controllers
- Maintaining the AD database with ntdsutil; 32k database pages and the Windows Server 2025 functional level
- Recovering deleted objects with the AD Recycle Bin
- Service accounts: group managed service accounts (gMSA) and delegated managed service accounts (dMSA)
- Password and lockout policies, fine-grained password policies, Windows LAPS with passphrases and automatic account management
Managing Group Policy
- Backing up, restoring and copying Group Policy Objects, and importing them with migration tables
- Maintaining the central store for administrative templates (ADMX)
- Inheritance, filtering and loopback processing; analysing errors with gpresult and event logs
- Security baselines: OSConfig for Windows Server 2025 and the Microsoft Security Compliance Toolkit
File Services in Operation
- File Server Resource Manager (FSRM): quotas, file screening, storage reports, classification
- Monitoring DFS namespaces and DFS Replication and troubleshooting errors
- SMB security: signing required by default, encryption, blocking NTLM, auditing clients without signing
- Shadow Copies for shared folders
Managing Updates
- Operating Windows Server Update Services (WSUS): approvals, computer groups, cleanup; WSUS is no longer being developed further
- Azure Update Manager for Arc-connected servers
- Hotpatch for Windows Server 2025 via Azure Arc: baseline and hotpatch months, prerequisites
- Planning maintenance windows and restarts
Monitoring and Analysing Performance
- Event logs, custom views and event forwarding
- Performance Monitor, data collector sets and performance baselines
- Resource Monitor, Task Manager and performance data in Windows Admin Center
- Overview of monitoring with Azure Monitor for Arc-connected servers
Backup and Recovery
- Windows Server Backup: volumes, system state and bare-metal recovery
- Backing up domain controllers, non-authoritative and authoritative restore
- Restoring files and folders, testing recovery regularly
Hardening Servers
- Protecting privileged accounts: tiered administration model, the “Protected Users” group, authentication policies
- Credential Guard (enabled by default on suitable hardware) and LSA protection
- Monitoring and reducing NTLM usage, phasing out RC4 in Kerberos, LDAP signing and channel binding
- Advanced audit policies, Windows Firewall and Microsoft Defender Antivirus on servers
