AZ-800: Windows Server Hybrid Administrator — PowerShell Prep

Read this first: AZ-800 alone does not earn the Windows Server Hybrid Administrator Associate certification. AZ-800 covers administering Windows Server in hybrid environments; its companion exam AZ-801 covers configuring advanced Windows Server services. You need both AZ-800 and AZ-801 to earn the associate certification. This track prepares you for the AZ-800 half — the PowerShell-heavy administration side.

Exam facts

AZ-800 is a role-based exam for Windows Server administrators who manage on-premises and hybrid environments. Expect scenario-based questions: a situation is described, and you pick the PowerShell command, the correct parameter, or the right order of steps. The exam tests what you would actually type at a prompt, not just what you recognize.

How to use this track. Each domain below states its exam weight, explains what the exam actually tests, lists the commands with their key parameters, gives runnable examples, and ends with an exercise. Work the exercises in order — Domain 1 (AD DS) is worth roughly a third of the exam, so it gets the most depth here.

Domain 1: Deploy and manage Active Directory Domain Services (30–35%)

This is the biggest domain on the exam — roughly one question in three — and the one where PowerShell fluency pays off most. The exam tests the full lifecycle: promoting domain controllers, managing FSMO roles, designing sites and replication, configuring trusts, administering users, groups, computers and organizational units, enforcing Group Policy, and connecting the on-premises directory to Entra ID. If you can only master one domain deeply, make it this one.

Two habits separate passing candidates from failing ones. First, know the difference between commands that read state and commands that change state — the exam loves asking which cmdlet actually fixes a problem versus which one merely reports it. Second, know the prerequisite chain: you cannot promote a domain controller before the AD DS role is installed, you cannot create a group Managed Service Account before the KDS root key exists, and you cannot enable the AD Recycle Bin after the fact without raising the forest functional level. The exam tests these orderings constantly.

Promoting domain controllers

Every AD deployment starts with promotion. Install-ADDSForest creates a new forest and promotes the first domain controller in it; Install-ADDSDomainController adds a replica controller to an existing domain; Install-ADDSDomain creates a child domain or a new domain tree. Before any of these, install the role with Install-WindowsFeature AD-Domain-Services -IncludeManagementTools, and run the Test- prerequisite cmdlets — the exam will ask what you check before promoting, and "run the prerequisite test" is a frequent correct answer.

# Promote the first DC in a brand-new forest
Install-WindowsFeature AD-Domain-Services -IncludeManagementTools
Install-ADDSForest -DomainName "corp.local" -DomainNetbiosName "CORP" `
  -SafeModeAdministratorPassword (Read-Host -AsSecureString "DSRM password") -InstallDns

# Add a replica DC to the existing domain
Install-ADDSDomainController -DomainName "corp.local" `
  -Credential (Get-Credential) -SiteName "Default-First-Site-Name" -InstallDns

# Verify: which DCs exist, and who holds the FSMO roles?
Get-ADDomainController -Filter * | Select-Object Name, Site, IsGlobalCatalog
Get-ADForest | Select-Object ForestMode, SchemaMaster, DomainNamingMaster
Get-ADDomain | Select-Object DomainMode, PDCEmulator, RIDMaster, InfrastructureMaster

FSMO roles: transfer versus seizure

Five Flexible Single Master Operations roles exist: Schema Master and Domain Naming Master (forest-wide), and PDC Emulator, RID Master, and Infrastructure Master (domain-wide). Moving a role gracefully while the old holder is online is a transfer. Taking a role by force because the old holder is dead or permanently offline is a seizure — and a seized role holder must never be brought back online, because two servers believing they hold the same role will corrupt the directory.

# Graceful transfer: the old PDC emulator is still online
Move-ADDirectoryServerOperationMasterRole -Identity "DC02" `
  -OperationMasterRole PDCEmulator

# Seizure: the old holder is permanently offline — note -Force
Move-ADDirectoryServerOperationMasterRole -Identity "DC02" `
  -OperationMasterRole PDCEmulator, RIDMaster, InfrastructureMaster -Force

# Verify the move took effect
Get-ADDomain | Select-Object PDCEmulator, RIDMaster, InfrastructureMaster
Get-ADForest | Select-Object SchemaMaster, DomainNamingMaster

Sites, replication, and trusts

Multi-site AD is about controlling replication traffic: sites map to physical locations, site links set cost and interval, and subnets tell AD which site a client belongs to. Replication health is checked with Get-ADReplicationFailure and Get-ADReplicationPartnerMetadata — both are exam favorites because they distinguish "replication is broken" from "replication is slow." Trusts connect forests and domains: New-ADTrust creates them, with direction (one-way vs two-way) and selective authentication as the tested details.

# Diagnose replication health on a suspect DC
Get-ADReplicationFailure -Target "DC02" -Scope Server
Get-ADReplicationPartnerMetadata -Target "DC02" -PartnerType Both |
  Select-Object Server, LastReplicationSuccess, LastReplicationResult

# Create a two-way forest trust with selective authentication
New-ADTrust -Source "corp.local" -Target "partner.local" `
  -Direction Bidirectional -SelectiveAuthentication $true

# Check the trust you just made
Get-ADTrust -Filter * | Select-Object Source, Target, Direction, SelectiveAuthentication

Users, groups, computers, and OUs

Day-to-day AD administration is bulk work, and the exam tests bulk patterns: importing users from CSV, finding locked-out or expired accounts, and managing group membership. Know the group scopes cold — Domain Local groups hold members from any domain but are only usable in their own domain, Global groups hold members from their own domain and can be used anywhere in the forest, Universal groups hold members from anywhere and replicate forest-wide. Know the account-health queries: Search-ADAccount with -LockedOut, -AccountExpired, and -PasswordExpired is the fastest way to triage.

# Bulk-create users from CSV into a Sales OU
Import-Csv "users.csv" | ForEach-Object {
    New-ADUser -Name $_.Name -SamAccountName $_.SamAccountName `
      -UserPrincipalName "$($_.SamAccountName)@corp.local" `
      -Path "OU=Sales,DC=corp,DC=local" `
      -AccountPassword (ConvertTo-SecureString $_.Password -AsPlainText -Force) `
      -Enabled $true -ChangePasswordAtLogon $true
}

# Triage: find locked-out accounts, unlock them, verify
Search-ADAccount -LockedOut | Select-Object Name, SamAccountName, LastLogonDate
Search-ADAccount -LockedOut | Unlock-ADAccount
Get-ADUser -Filter 'LockedOut -eq $true' | Measure-Object

# Build an OU tree and a scoped group in one pass
New-ADOrganizationalUnit -Name "Sales" -Path "DC=corp,DC=local"
New-ADOrganizationalUnit -Name "Workstations" -Path "OU=Sales,DC=corp,DC=local"
New-ADGroup -Name "Sales-Users" -GroupScope Global -GroupCategory Security `
  -Path "OU=Sales,DC=corp,DC=local"
Get-ADUser -Filter * -SearchBase "OU=Sales,DC=corp,DC=local" |
  ForEach-Object { Add-ADGroupMember -Identity "Sales-Users" -Members $_ }

Group Policy

Group Policy is where AD administration becomes enforcement: create a GPO, link it to an OU, and verify the result. The exam tests the lifecycle — Get-GPO, New-GPO, New-GPLink, Backup-GPO, and the two verification tools: Get-GPOReport (what a GPO contains) and Get-GPResultantSetOfPolicy (what actually applies to a user or computer after all links, enforcement, and inheritance blocking). Invoke-GPUpdate forces a refresh instead of waiting for the default 90-minute interval — the exam asks this whenever a question says "the policy must apply immediately."

# Create a GPO, link it enforced to the Workstations OU, back it up
New-GPO -Name "Disable USB Storage" -Comment "Blocks removable storage on workstations"
New-GPLink -Name "Disable USB Storage" -Target "OU=Workstations,DC=corp,DC=local" -Enforced Yes
Backup-GPO -Name "Disable USB Storage" -Path "C:\GPOBackups"

# Verify what actually applies — and force it now, not in 90 minutes
Get-GPOReport -Name "Disable USB Storage" -ReportType Html -Path "C:\Reports\usb.html"
Get-GPResultantSetOfPolicy -Computer "WS042" -User "corp\jdoe" -ReportType Html -Path "C:\Reports\rsop.html"
Invoke-GPUpdate -Computer "WS042" -Force

Hybrid identity: Entra Connect

AZ-800's hybrid story starts with getting on-premises identities into Entra ID. Entra Connect (formerly Azure AD Connect) syncs users, groups, and devices; the exam tests the sync cycle and the verification steps, not the installer wizard. Start-ADSyncSyncCycle forces a sync, and you verify on the cloud side with Connect-MgGraph and Get-MgUser. Know the three authentication models cold: password hash synchronization (simplest, most common), pass-through authentication (passwords validated on-premises, no hash in the cloud), and federation (AD FS, most complex, chosen for specific compliance needs).

# Force a delta sync, check the scheduler, verify in the cloud
Start-ADSyncSyncCycle -PolicyType Delta
Get-ADSyncScheduler | Select-Object SyncCycleEnabled, NextSyncCyclePolicyType

Connect-MgGraph -Scopes "User.Read.All"
Get-MgUser -Filter "userPrincipalName eq 'jdoe@corp.local'" |
  Select-Object DisplayName, UserPrincipalName, OnPremisesSyncEnabled

Exercise: promote, seize, and verify

1. On a lab server, install the AD DS role and promote a replica DC into an existing domain. Verify with Get-ADDomainController -Filter *.
2. Simulate a dead PDC emulator: seize the PDC Emulator role to your new DC with -Force, then confirm with Get-ADDomain | Select-Object PDCEmulator.
3. Run Get-ADReplicationFailure against every DC and explain any non-zero result — is it a failure, or just a DC that has never replicated?
4. Create an OU tree, bulk-import five users from CSV, add them to a Global security group, and unlock any locked-out account you find with Search-ADAccount -LockedOut.
5. Create a GPO, link it to your new OU, back it up, and force the policy onto a test computer with Invoke-GPUpdate -Force. Confirm with Get-GPResultantSetOfPolicy.

Domain 2: Manage Windows Servers in a hybrid environment (10–15%)

This domain is the bridge between your on-premises servers and Azure. The exam tests three skills: managing servers remotely with PowerShell remoting, onboarding servers to Azure Arc so they can be governed like Azure resources, and using Windows Admin Center as the browser-based management plane. The weight is modest, but the questions are practical — they describe a server you cannot physically reach and ask how you manage it.

Remoting is the foundation everything else builds on. Enable-PSRemoting configures WinRM and the firewall rules on the target; Enter-PSSession gives you an interactive session; Invoke-Command runs commands on one or many remote computers without an interactive session. Know the trusted-hosts pattern: in a workgroup (no domain trust), the managing computer must list the target in WSMan:\localhost\Client\TrustedHosts, or remoting fails with an authentication error that looks like a permissions problem but is actually a trust problem.

# Set up remoting on a workgroup server, then manage it from your workstation
# (run on the target first)
Enable-PSRemoting -Force -SkipNetworkProfileCheck

# (run on your workstation — trust the workgroup target explicitly)
Set-Item WSMan:\localhost\Client\TrustedHosts -Value "SRV02" -Force
Test-WSMan -ComputerName "SRV02"

# Interactive session vs one-shot command — know when to use each
Enter-PSSession -ComputerName "SRV02" -Credential (Get-Credential)
Invoke-Command -ComputerName "SRV02","SRV03" -ScriptBlock {
    Get-Service -Name "Spooler","WinRM" | Select-Object Name, Status, StartType
}

# Install a role remotely without logging on to the server
Install-WindowsFeature -Name "Web-Server" -IncludeManagementTools -ComputerName "SRV02" -Restart

# Onboard an on-premises server to Azure Arc, then verify it
Connect-AzConnectedMachine -ResourceGroupName "rg-hybrid" `
  -Location "eastus" -SubscriptionId "00000000-0000-0000-0000-000000000000"
Get-AzConnectedMachine -ResourceGroupName "rg-hybrid" |
  Select-Object Name, Status, AgentVersion, Location

# Once onboarded, the server can take Azure Policy, Update Manager,
# and Monitor agent extensions — the whole point of Arc is that
# on-premises servers become governable like native Azure resources.

Exercise: manage a server you cannot touch

1. Enable remoting on a lab server, add it to TrustedHosts from your workstation, and confirm with Test-WSMan.
2. Use Invoke-Command to install a Windows feature on two servers at once and collect the results.
3. Onboard one server to Azure Arc and verify its status with Get-AzConnectedMachine. List one Azure capability (Policy, Update Manager, or Monitor) that the onboarded server can now use.

Domain 3: Manage VMs and containers (15–20%)

This domain splits into three parts: Hyper-V virtual machines on Windows Server, Windows containers, and Azure VMs running Windows Server. The exam treats Hyper-V as the core — VM lifecycle, virtual switches, virtual disks, and checkpoints — and containers as the conceptual complement: process isolation versus Hyper-V isolation, and when each is appropriate. Azure VMs appear as the hybrid extension: the same Windows Server workload, managed with Az cmdlets instead of Hyper-V cmdlets.

Virtual switches are the most-tested Hyper-V concept after basic VM creation. An External switch binds to a physical NIC and gives VMs access to the physical network; an Internal switch lets VMs talk to the host and each other but not the outside network; a Private switch lets VMs talk only to each other. If a question says a VM cannot reach the internet but can reach other VMs on the same host, the switch type is the first thing to check.

# Build a VM end to end: switch, VM, disk, checkpoint
New-VMSwitch -Name "External" -NetAdapterName "Ethernet" -AllowManagementOS $true
New-VM -Name "WEB01" -MemoryStartupBytes 4GB -Generation 2 `
  -NewVHDPath "C:\VMs\WEB01.vhdx" -NewVHDSizeBytes 60GB -SwitchName "External"
Start-VM -Name "WEB01"
Get-VM -Name "WEB01" | Select-Object Name, State, CPUUsage, MemoryAssigned

# Checkpoint BEFORE patching — production checkpoints are the safe default
Checkpoint-VM -Name "WEB01" -SnapshotName "BeforePatch"
# ...patch the VM...
# If the patch breaks it: Restore-VMSnapshot -Name "BeforePatch" -VMName "WEB01" -Confirm:$false

# Containers: host prep, then the isolation choice that the exam tests
Install-WindowsFeature -Name "Containers" -IncludeManagementTools
# Process isolation: shares the host kernel, fastest, least isolation
# Hyper-V isolation: each container gets a lightweight VM, strongest isolation
# Exam rule of thumb: untrusted or multi-tenant workloads get Hyper-V isolation;
# trusted first-party workloads on the same host get process isolation.

# The same workload in Azure, managed with Az cmdlets
Connect-AzAccount
Get-AzVM -ResourceGroupName "rg-servers" | Select-Object Name, Location, PowerState
Start-AzVM -ResourceGroupName "rg-servers" -Name "WEB01"

Exercise: build and protect a VM

1. Create an External virtual switch, then a Generation 2 VM with a 60 GB dynamic VHDX attached to it.
2. Start the VM, confirm its state with Get-VM, and take a production checkpoint named "BeforePatch."
3. Explain in one sentence when you would choose Hyper-V isolation over process isolation for a container workload.

Domain 4: Manage hybrid networking (15–20%)

Hybrid networking is DNS, DHCP, and IP address management — the services every other domain silently depends on. The exam tests creation and configuration, not just lookup: building zones and records, designing scopes with exclusions and reservations, and choosing between forwarders, conditional forwarders, and root hints. It also tests the client side — Resolve-DnsName, Get-DnsClientServerAddress, Get-NetIPAddress, and Get-NetRoute are how you verify every networking change you make.

DNS

Zone types are the first decision and the most-tested DNS concept. A primary zone is read-write and holds the authoritative copy; a secondary zone is a read-only copy transferred from a primary; a stub zone holds only the NS records needed to find authoritative servers for another zone. Forwarders send queries the local server cannot answer to a designated upstream server; conditional forwarders send queries only for specific domains to specific servers — the hybrid scenario where corp.local queries go to the on-premises DC and everything else goes to Azure DNS.

# Build a forward zone, add records, verify from a client
Add-DnsServerPrimaryZone -Name "corp.local" -ZoneFile "corp.local.dns" `
  -ReplicationScope "Forest" -DynamicUpdate "Secure"
Add-DnsServerResourceRecordA -ZoneName "corp.local" -Name "web01" -IPv4Address "10.0.1.25"
Add-DnsServerResourceRecordA -ZoneName "corp.local" -Name "dc01" -IPv4Address "10.0.1.10"

# Verify: from the server, and from a client pointed at it
Get-DnsServerZone | Select-Object ZoneName, ZoneType, IsDsIntegrated
Resolve-DnsName -Name "web01.corp.local" -Server "10.0.1.10" -Type A
Resolve-DnsName -Name "web01.corp.local"   # uses the client's configured DNS

DHCP

DHCP is scope design: the range, the exclusions (addresses never leased), the reservations (addresses always leased to one MAC), and the options (003 router, 006 DNS servers, 015 DNS suffix). Failover is the exam's favorite DHCP topic, and it has two modes you must not confuse: hot standby, where one server is active and the other only takes over on failure, and load balance, where both servers actively lease addresses according to a percentage split.

# Build a scope: range, exclusion for static servers, reservation for the printer
Add-DhcpServerv4Scope -Name "Branch-LAN" -StartRange "10.0.1.50" `
  -EndRange "10.0.1.250" -SubnetMask "255.255.255.0" -State Active
Add-DhcpServerv4ExclusionRange -ScopeId "10.0.1.0" `
  -StartRange "10.0.1.50" -EndRange "10.0.1.60"
Add-DhcpServerv4Reservation -ScopeId "10.0.1.0" -IPAddress "10.0.1.61" `
  -ClientId "AA-BB-CC-DD-EE-FF" -Name "Branch-Printer"
Set-DhcpServerv4OptionValue -ScopeId "10.0.1.0" -OptionId 3 -Value "10.0.1.1"
Set-DhcpServerv4OptionValue -ScopeId "10.0.1.0" -OptionId 6 -Value "10.0.1.10","10.0.1.11"

# Failover: hot standby (one active, one idle) vs load balance (both leasing)
Add-DhcpServerv4Failover -Name "DHCP-FO" -PartnerServer "dhcp02.corp.local" `
  -ServerRole Active -SharedSecret (ConvertTo-SecureString "secret" -AsPlainText -Force)
Get-DhcpServerv4Scope | Select-Object ScopeId, Name, State, LeaseDuration

Exercise: build the network services

1. Create a primary forward zone and a reverse lookup zone. Add A and PTR records for two servers, then verify with Resolve-DnsName from a client.
2. Build a DHCP scope with an exclusion range and one reservation. Lease an address to a test client and confirm the reservation is honored.
3. Configure a DHCP failover relationship and state which mode you chose and why.

Domain 5: Manage storage and file services (15–20%)

Storage on AZ-800 is software-defined: Storage Spaces pools virtual disks from physical disks, volumes format those disks, and file services (SMB shares, DFS Namespaces, DFS Replication) present them to users. Failover clustering ties it together — shared storage and clustered roles that survive a node failure. The exam tests the provisioning chain in order: physical disks to pool to virtual disk to volume to share, and it tests what breaks when you skip a step.

Resiliency types are the key Storage Spaces concept. Simple stripes data with no redundancy — one disk failure loses data. Mirror keeps two or three copies — survives one or two disk failures. Parity stores parity information — survives one disk failure (single parity) or two (dual parity) with better capacity efficiency than mirroring. Storage Spaces Direct (S2D) extends this across cluster nodes with local disks, and it requires a validated cluster first — which is why Test-Cluster appears on this exam at all.

# Full chain: pool -> mirrored virtual disk -> NTFS volume -> SMB share
New-StoragePool -FriendlyName "Pool01" `
  -StorageSubsystemFriendlyName "Windows Storage*" `
  -PhysicalDisks (Get-PhysicalDisk -CanPool $true)
New-VirtualDisk -FriendlyName "VD01" -StoragePoolFriendlyName "Pool01" `
  -ResiliencySettingName "Mirror" -Size 500GB -ProvisioningType Fixed
New-Volume -FriendlyName "Data" -FileSystem NTFS -DriveLetter "E" `
  -StoragePoolFriendlyName "Pool01"

New-SmbShare -Name "Data" -Path "E:\" -FullAccess "CORP\Domain Admins" `
  -ChangeAccess "CORP\Sales-Users" -ReadAccess "CORP\Everyone"
Grant-SmbShareAccess -Name "Data" -AccountName "CORP\Sales-Managers" -AccessRight Change
Get-SmbShare -Name "Data" | Select-Object Name, Path, Description

# DFS: one namespace path, replicated content behind it
New-DfsnRoot -Path "\\corp.local\Shared" -TargetPath "\\fs01\Shared" -Type DomainV2
New-DfsReplicationGroup -GroupName "Docs" -DomainName "corp.local"
New-DfsReplicatedFolder -GroupName "Docs" -FolderName "Policies"
Add-DfsrMember -GroupName "Docs" -ComputerName "fs01","fs02"
Add-DfsrConnection -GroupName "Docs" -SourceComputerName "fs01" -DestinationComputerName "fs02"

# Clustering: validate BEFORE you create — the exam tests this order
Test-Cluster -Node "node01","node02" -ReportName "C:\Reports\cluster.html"
New-Cluster -Name "CL01" -Node "node01","node02" -StaticAddress "10.0.1.100"
Get-Cluster -Name "CL01" | Select-Object Name, State
Get-ClusterResource -Cluster "CL01" | Select-Object Name, State, OwnerGroup

Exercise: provision storage end to end

1. Build a Storage Spaces pool from available disks, create a mirrored virtual disk, format it as an NTFS volume, and share it with tiered permissions (Full for admins, Change for one group, Read for everyone).
2. Create a domain-based DFS namespace and a replication group with two members. Verify replication with Get-DfsrState or the DFS Replication event log.
3. Run Test-Cluster against two lab nodes, fix any warnings, then create the cluster and confirm its resources with Get-ClusterResource.

Study plan

Work the domains in exam-weight order, not page order: AD DS first (it is a third of the exam), then networking and storage, then VMs and containers, then hybrid servers. Budget roughly four weeks: week one for AD DS deployment, FSMO, and replication; week two for users, groups, GPO, and hybrid identity; week three for DNS, DHCP, and storage; week four for Hyper-V, containers, Arc, and full practice labs. Every exercise above is designed to run on two or three lab VMs — nested virtualization for Hyper-V practice, and a trial Azure subscription for the Arc and Az portions.

Prerequisites assumed by this track: you can already write basic PowerShell (variables, pipelines, ForEach-Object, Where-Object), you have administered a Windows Server before, and you understand TCP/IP basics (subnets, DNS, DHCP). If any of those are shaky, start with the site's beginner lessons before tackling the domain exercises here.

Commands quick reference

Every cmdlet covered in this track, grouped by domain. Commands linked to a page have a full reference on this site; unlinked commands are exam material presented here with examples above.

Next steps: work the five domain exercises in order, then move to AZ-104 for Azure administration or SC-300 for identity — both share material with this track (Graph cmdlets, hybrid identity, and Azure governance). When you can complete every exercise above without notes, you are ready to book AZ-800 — and remember to plan AZ-801 next for the full associate certification.