The short version
Use this sheet for a last pass, not as your only source. It follows the seven domains of the Microsoft skills outline read on October 22, 2026, and pairs concepts that people mix up with simple decision rules. Microsoft says related topics may also appear, so it does not cover everything on the exam. Confirm details against Microsoft Learn before you rely on them.
Exam facts at a glance
| Item | Fact |
|---|---|
| Exam | AZ-802: Administering Windows Server |
| Passing score | 700 on a 1-1,000 scale (scaled, not 70%) |
| Time | 120 minutes, per the credential page |
| Questions | Not published for AZ-802 |
| Language | English |
| Delivery | Proctored, scheduled through Pearson VUE |
| Retake | 24 hours, then 14 days; five attempts in 12 months |
| Credential validity | One year; free renewal assessment |
| Domains | AD DS 20-25%, storage 15-20%, monitor and troubleshoot 15-20%, hybrid, VMs, networking and security 10-15% each |
Domain 1: Deploy and manage AD DS (20-25%)
Term pairs
- Transfer vs seize (operations master roles): transfer when the current holder is online and healthy. Seize only when it is gone for good, and never bring it back online afterward.
- Forest-wide vs domain-wide roles: schema master and domain naming master exist once per forest. PDC emulator, RID master and infrastructure master exist once per domain.
- Writable DC vs RODC: an RODC holds a read-only copy and caches only the passwords your password replication policy allows.
- sMSA vs gMSA: a standalone managed service account serves one server; a group managed service account can serve several and needs a KDS root key.
- Group Policy settings vs preferences: settings are enforced and removed when out of scope; preferences are applied once and users may change them.
Decision rules
- Trust direction runs opposite to access: the trusted side’s users reach the trusting side’s resources.
- A client picks a DC by its site, and site membership comes from subnets. Wrong subnet data means wrong DC.
- Need to limit which accounts sign in at a branch? Think RODC plus password replication policy.
Traps: reversing trust direction; treating a forest trust as access to every domain automatically (permissions still apply); forgetting staged RODC accounts exist for delegated installs.
Domain 2: Hybrid management (10-15%)
- JEA role capability vs session configuration: the role capability file says what a role may do; the session configuration says who gets which role.
- Double hop: credentials do not pass from your session to a second remote server by default. Know that delegation options exist, and that JEA can run as a virtual or managed account instead.
- Arc agent vs Azure side: the connected machine agent runs on the server and connects outbound; extensions, policy and Update Manager work from Azure.
- Update Manager vs Automation runbooks: patch assessment and scheduling versus scripted tasks.
Rule: if the scenario says “no inbound firewall ports” and “servers outside Azure”, think Arc with outbound-only connectivity.
Domain 3: Virtual machines (10-15%)
- PowerShell Direct vs remoting: Direct goes from the Hyper-V host to a guest on that host without guest networking; remoting needs network access.
- Standard vs production checkpoints: production checkpoints use guest backup technology and are the safer default for production workloads. Avoid checkpoints on domain controllers unless you understand the rollback effect.
- Hyper-V Replica vs failover clustering: Replica copies VMs to another host or site asynchronously for disaster recovery; clustering gives high availability within a site.
- Availability set vs availability zone (Azure): sets spread VMs across racks in one datacenter; zones span separate datacenters.
- JIT access vs Bastion: just-in-time opens management ports briefly; Bastion gives browser-based access without a public IP on the VM.
Trap: setting a static IP inside an Azure VM guest. Configure the address on the Azure network interface.
Domain 4: Networking (10-15%)
- Conditional forwarder vs stub zone: a forwarder sends queries for one namespace to named servers; a stub zone stores name server records for it. When the scenario wants the simplest forwarding, think conditional forwarder.
- DNS policy: use it for split-brain answers, geo-based or time-based responses.
- DNSSEC: it signs zones so clients can validate answers; it does not encrypt.
- DHCP failover modes: load balance shares scopes between two servers; hot standby has an active and a standby server.
- AD-integrated zones: replication scope decides which DCs hold the zone.
Domain 5: Storage and file services (15-20%)
| Layout | Think |
|---|---|
| Simple | No resiliency |
| Two-way mirror | Minimum two disks |
| Three-way mirror | Minimum five disks |
| Parity | Minimum three disks |
| Dual parity | Minimum seven disks |
- File screen vs quota: a screen blocks file types; a quota limits space.
- DFS Namespaces vs DFS Replication: namespaces give one path; replication copies content.
- Storage Replica vs Hyper-V Replica: the first replicates volumes, the second replicates VMs.
- Azure File Sync parts: storage sync service, registered server, sync group, cloud endpoint, server endpoint. Deploy in that logic: create the cloud side first, then register the server.
- BitLocker recovery: know where recovery keys can be stored (AD DS, Entra ID or a file) before you need them.
Domain 6: Secure the infrastructure (10-15%)
- Credential Guard isolates secrets using virtualization-based security; Application Control limits which code runs; exploit protection applies mitigations per process.
- Windows LAPS rotates local administrator passwords and stores them in AD or Entra ID.
- Protected Users blocks weaker authentication methods and delegation for those accounts.
- Entra Password Protection blocks weak passwords at the domain controller.
Rule: audit first, then enforce, when a setting could break an old application.
Domain 7: Monitor and troubleshoot (15-20%)
- AD Recycle Bin: restores deleted objects; it must be enabled first, and it cannot be turned off.
- Authoritative vs non-authoritative restore: non-authoritative lets replication overwrite; authoritative marks restored objects as the winner. Both start in Directory Services Restore Mode.
- Secure channel broken: repair it on the member computer instead of rejoining the domain when you can.
- Kerberos failures: check time skew, duplicate service principal names and DNS before anything exotic.
- Replication: repadmin shows partner status; dcdiag tests DC health.
- System Insights: a “no data” style status is not the same as healthy.
- Azure Monitor: data collection rules say what to collect; alerts act on it; VM Insights adds performance views.
Common traps across domains
- Choosing the drastic fix (rebuild) when a targeted one exists.
- Ignoring the constraint: no downtime, least privilege, no internet.
- Mixing Azure-side and server-side tasks.
- Missing a prerequisite such as a functional level.
Last-day checklist
- Reread the weakest domain’s notes, not all of them.
- Review the confusable pairs above aloud.
- Redo the lab tasks you missed in practice sets.
- Confirm your ID, appointment time and check-in rules; see the exam day guide.
- Sleep. The exam is 120 minutes of reading carefully.
More guides for AZ-802
- AZ-802 Study Plan: 4-Week and 8-Week
- AZ-802 Sample Questions With Answers
- Is AZ-802 Hard? An Honest Difficulty Check
- AZ-802 Prerequisites: What to Know First
- AZ-802 Renewal and Retakes Explained
- Is AZ-802 Worth It? An Honest Look
- AZ-104 vs AZ-802: Which First?
Next step
For the full picture, see the domains explained page and the exam format page. The exam overview links the rest. To test yourself, try the AZ-802 practice tests, and use Microsoft’s study guide as the authority.