What's inside
AZ-802 doesn't test whether you can click through a wizard. It tests whether you can choose the right role, setting, cmdlet or Azure service for a Windows Server task, on-premises or hybrid.
This independent study guide for the Microsoft Certified: Windows Server Administrator Associate exam, which replaced AZ-800 and AZ-801, distils what AZ-802 really expects you to understand into the comparisons, configuration choices and traps that Windows Server decisions turn on, with short PowerShell examples throughout.
Organised by technology
Fifteen chapters, each readable on its own and together covering all seven AZ-802 skill areas:
- Active Directory Domain Services: domain controllers on-premises and in Azure, functional levels, RODCs and the Password Replication Policy, FSMO roles; sites, site links and replication; trusts and selective authentication; users, groups and managed service accounts; Group Policy processing, filtering and preferences.
- Hybrid management: Windows Admin Center on-premises and in the Azure portal, PowerShell remoting, the second hop, JEA, SSH and RDP; Azure Arc-enabled servers, Azure Machine Configuration, VM extensions, Azure Update Manager and hotpatch, Azure Automation runbooks.
- Virtual machines: Hyper-V generations, memory, nested virtualisation, GPU partitioning, checkpoints, virtual switches and SET, live migration and Hyper-V Replica; Windows Server VMs in Azure, managed disks, scale sets, availability zones, JIT access and Azure Bastion.
- Networking: AD-integrated DNS, scavenging, conditional forwarders, DNS policies and DNSSEC, hybrid resolution with Azure DNS Private Resolver; DHCP scopes, reservations and failover.
- Storage and file services: Azure Files and identity-based access, Azure File Sync and cloud tiering; share permissions, FSRM, DFS Namespaces and Replication, SMB over QUIC and SMB hardening; Storage Spaces Direct, Storage Replica, Data Deduplication, ReFS, iSCSI and BitLocker.
- Security: App Control for Business, Credential Guard, OSConfig baselines, Windows LAPS, Defender for Servers and Windows Firewall; fine-grained password policies, Entra Password Protection, Protected Users, AdminSDHolder, delegation and Kerberos hardening.
- Monitoring and troubleshooting: Performance Monitor, System Insights, event forwarding, Azure Monitor Agent and data collection rules; connectivity, Windows Update, time, Arc agent and BitLocker issues; AD Recycle Bin, DSRM and authoritative restore, SYSVOL recovery, replication and Kerberos troubleshooting.
Inside
- Comparison tables for every close call, such as which service account, which trust, which DHCP failover mode or which recovery method fits a requirement.
- 150 Common trap callouts that name the answers that look right but aren't, and explain what's right instead.
- 13 diagrams, from FSMO role placement and trust types to hybrid DNS, Azure File Sync and AD recovery.
- Key takeaways at the end of every chapter for fast revision.
- A glossary of more than 650 terms, each linked to Microsoft Learn, with a free online version for print readers.
Up to date
Windows Server keeps changing. This edition reflects Microsoft's documentation as of October 2026, with Windows Server 2025 as the current release: the new functional level, delegated managed service accounts, SMB over QUIC on every edition, hotpatch for Arc-enabled servers, Credential Guard on by default and the current names Microsoft Entra ID and App Control for Business.
Understanding, not memorising
This book contains no exam questions. It explains the knowledge the exam expects, so you can answer questions you have never seen and apply the same judgement on real servers.
Written by Tony Rough, a cloud architect with more than twenty years in IT infrastructure who holds the Azure Solutions Architect Expert, Azure Administrator and Azure Security Engineer certifications.
Part of the Ultra Transcenders series from Distilled Press. An independent publication, not affiliated with, sponsored by or endorsed by Microsoft Corporation.
