Azure AZ-801 cheat sheet

Windows Defender Firewall profiles: Domain, Private, Public; a network interface uses the most restrictive profile that matches, and rules are per-profile unless 'All' is selected.

Windows LAPS stores managed local administrator passwords in AD (Windows Server 2019 schema with LAPS extension) or in Entra ID; the password is encrypted with DPAPI-NG and readable only by authorized principals.

Credential Guard uses virtualization-based security (VBS) to isolate LSA secrets in a Hyper-V-protected process; it requires UEFI, Secure Boot, VT-x/AMD-V, and cannot coexist with unattended device drivers that need direct LSASS access.

Tier model: Tier 0 = identity (DCs, AD FS, Entra Connect), Tier 1 = servers/apps, Tier 2 = user workstations; domain admins log on only to Tier 0 assets via privileged access workstations.

BitLocker on servers: TPM-only protects OS volume; add TPM+PIN or startup key for pre-boot authentication; Network Unlock supplies a key over DHCP for headless servers in the datacenter.

SMB hardening: SMB signing (required by default on DCs), SMB encryption (AES-128-GCM/CCM on SMB 3.x), disable SMB 1.0, and set LanmanServer RequireSecuritySignature via GPO.

Just Enough Administration: a JEA session configuration (.pssc) defines role capabilities (.psrc) with visible cmdlets and constrained language mode; transcripts record all sessions.

Protected Users group: members cannot use NTLM, Digest, or CredSSP, get no unconstrained Kerberos delegation, and have a non-configurable 4-hour TGT lifetime.

Server hardening baseline: Microsoft Security Compliance Toolkit (GPO baselines) plus Policy Analyzer to compare effective settings against the baseline.

Failover cluster validation must pass before cluster creation; quorum options: Node Majority, Node and Disk Majority, Node and File Share Majority, No Majority (Disk Only).

Cluster quorum witness types: disk witness (shared storage), file share witness (SMB share), cloud witness (Azure Storage account, requires internet and an account key).

A cluster resource's Possible Owners, Preferred Owners, and Failover/Failback settings determine placement; resource dependencies enforce start order (e.g., IP address before network name).

Cluster Shared Volumes (CSV) let multiple nodes access the same NTFS volume simultaneously; CSV is required for Hyper-V live migration and Scale-Out File Server.

Hyper-V live migration prerequisites: same or compatible processor family (or processor compatibility mode), shared storage or SMB 3.0, identical virtual switch names, and constrained or unconstrained delegation/CredSSP.

Storage Spaces Direct requires at least 2 nodes (4 recommended), RDMA-capable NICs for best performance, and a supported SAS/SATA/NVMe configuration validated with Test-Cluster.

Network Load Balancing (NLB) suits stateless TCP/UDP services; it does not support stateful sessions unless affinity is set, and cannot be combined with Failover Clustering on the same NIC.

Cluster-Aware Updating (CAU) orchestrates patching with self-updating mode (cluster updates itself) or remote-updating mode (admin console pushes updates).

Scale-Out File Server uses SMB 3.0 transparent failover with continuously available shares; it is intended for application data (Hyper-V, SQL), not user home folders.

Windows Server Backup: full server, volume, system state, and bare-metal recovery; backups to a dedicated volume are removed from the backup target list, and only one scheduled backup policy is supported.

WBAdmin system state includes registry, COM+ class registration, SYSVOL, Active Directory (on DCs), cluster quorum, and IIS metabase; it does not include user data.

Azure Backup for Windows Server uses the MARS agent for file/folder and system state, and MABS/DPM for application-consistent workload backup; recovery services vault stores the data.

Azure Site Recovery replicates Hyper-V VMs, VMware VMs, and physical servers to Azure or a secondary site; recovery plans group machines and define ordered startup and scripts.

Hyper-V Replica replicates VMs asynchronously to a Replica server (or Azure) with configurable recovery points (e.g., every 5 minutes, plus hourly); failover can be planned, unplanned, or test.

AD DS recovery: authoritative restore uses ntdsutil 'authoritative restore' after a nonauthoritative restore; a DSRM restart (Directory Services Restore Mode) is required to restore SYSVOL and NTDS.dit.

Azure Site Recovery Recovery Point Objective depends on replication frequency; Recovery Time Objective depends on recovery plan automation and the target region readiness.

Backup of clustered roles: use cluster-aware backup (VSS) or back up CSV volumes; a quorum loss recovery requires forcing quorum with the /forcequorum switch of the cluster command.

Test restores should verify boot, application consistency, and DNS/AD registration; a bare-metal recovery needs matching or compatible hardware and the Windows installation media plus the WB backup.

Storage Migration Service orchestrates inventory, transfer, and cutover: the orchestrator runs on a Windows Server 2019+ host, and the transfer uses SMB and can preserve ACLs, shares, and ownership.

Storage Migration Service cutover changes the source computer name and IP to the destination; it can be reversed within the configured cutover window.

Active Directory migration: ADMT (Active Directory Migration Tool) migrates users, groups, and computers with SID history; requires a trust and proper DNS resolution between forests.

AD FS/Entra Connect migration: move to a new server by joining it to the same farm/staging mode, then promote; Entra Connect supports staging mode and swing migration.

Windows Server upgrade paths: in-place upgrade supports the two prior versions for the same edition family; otherwise use a clean install with the User State Migration Tool (USMT) or Storage Migration Service.

Workload migration to Azure: Azure Migrate discovers on-premises servers and assesses readiness; Azure Site Recovery or Azure Migrate: Server Migration performs the actual replication.

DHCP migration: export with 'Export-DhcpServer' and import with 'Import-DhcpServer' (or netsh dhcp server export/import); scope options and reservations are preserved.

DNS migration: export zones with 'dnscmd /zoneexport' or copy zone files; AD-integrated zones replicate via AD and require the zone to be created as AD-integrated on the target.

Print server migration: Print Management console 'Migrate Printers' exports printer settings and drivers to a .printerExport file and imports on the destination server.

Performance Monitor data collector sets can log to .blg (binary), .csv, or .tsv; counter logs, trace logs, and configuration data are the three data collector types.

Key counters: Processor% Processor Time, Memory\Available MBytes, Memory\Pages/sec, PhysicalDisk\Avg. Disk sec/Read (healthy < 10 ms), Network Interface\Bytes Total/sec.

Event Viewer logs: System, Application, Security, Setup, and ForwardedEvents; subscription via WS-Man/WEF with source-initiated or collector-initiated subscriptions.

Windows Event Forwarding requires WinRM (5985/5986) and the collector's 'Windows Event Collector' service; the collector machine account must be in the source's Event Log Readers group.

Server Manager performance alerts and the Best Practices Analyzer (BPA) scan roles for configuration issues; BPA results are per-role and can be exported.

Sysinternals: Process Explorer (handle/DLL view), Process Monitor (file/registry/network trace), PsExec (remote execution), TCPView (socket state).

Storage troubleshooting: 'Get-PhysicalDisk', 'Get-VirtualDisk', 'Get-StorageJob'; event ID 153 (disk I/O retried) and 129 (reset) indicate storage path issues.

Boot troubleshooting: Last Known Good Configuration, Startup Repair, Safe Mode, and WinRE; 'bcdedit' edits boot entries and 'bootrec /rebuildbcd' repairs the boot store.

Network troubleshooting: 'Test-NetConnection' (port test), 'Get-NetAdapter', 'netsh int ip reset', 'ipconfig /flushdns', and 'Resolve-DnsName' for DNS verification.