Windows System Administrator Interview Guide (3–5 Years Experience)

"Over the past 4 years, I have served as a Windows System Administrator managing enterprise Windows Server 2016/2019/2022 infrastructure, Active Directory domain services, GPO management, Hyper-V virtualization, WSUS patch deployment, Windows Admin Center operations, and automated server reporting via PowerShell."

• Server 2016: Introduced Windows Containers, Nano Server, Storage Spaces Direct (S2D), and Shielded VMs.
• Server 2019: Added Hybrid Cloud integration via Windows Admin Center, System Insights ML analytics, Storage Migration Service, and enhanced Defender ATP.
• Server 2022: Adds Secured-core server protection, TLS 1.3 enabled by default, DNS-over-HTTPS, SMB AES-256 encryption, and hybrid management via Azure Arc.

• Server Roles: Primary business services defining what the server *does* (e.g., Active Directory Domain Services, DNS Server, DHCP Server, Hyper-V, File & Storage Services).
• Server Features: Supporting software tools and utilities enhancing system capabilities (e.g., Failover Clustering, BitLocker, Telnet Client, PowerShell ISE).

1. UEFI/BIOS: Executes POST, reads NVRAM to load UEFI bootloader from EFI System Partition.
2. Bootmgr: Reads BCD database and loads `winload.efi`.
3. Winload: Loads kernel (`ntoskrnl.exe`), HAL, and Boot-Start drivers into memory.
4. Kernel Init: `ntoskrnl.exe` initializes subsystems and spawns `smss.exe` (Session Manager).
5. User Subsystem: `smss.exe` launches `winlogon.exe`, `lsass.exe`, and `services.exe`.

• MBR (Master Boot Record): Legacy partition style; supports max 2 TB drive capacity and max 4 primary partitions.
• GPT (GUID Partition Table): Modern UEFI-backed style; supports drives >2 TB (up to 9.4 ZB) and up to 128 primary partitions with built-in CRC redundancy checks.

• Share Permissions: Apply only when accessing files over the network (Read, Change, Full Control).
• NTFS Permissions: Apply both locally and over the network (Read, Write, Modify, Full Control).
• Conflict Resolution: When accessing files over a network share, Windows enforces the **Most Restrictive Permission** between Share vs NTFS permissions.

1. Run Disk Cleanup (`cleanmgr.exe`).
2. Purge Windows Update cache: `net stop wuauserv` & delete `C:\Windows\SoftwareDistribution`.
3. Purge WinSxS store using DISM: `DISM /Online /Cleanup-Image /StartComponentCleanup /ResetBase`.
4. Locate large log files using TreeSize or WinDirStat and review Pagefile/Hiberfil configurations.

• Schema Master (Forest): Controls structure modifications to the AD database schema.
• Domain Naming Master (Forest): Manages adding or removing domains in the forest.
• PDC Emulator (Domain): Primary time source, handles Kerberos password changes and lockouts instantly.
• RID Master (Domain): Allocates unique pools of Relative IDs to DCs for generating object SIDs.
• Infrastructure Master (Domain): Translates cross-domain object references and GUIDs.

1. Run `gpupdate /force` on client.
2. Generate HTML result report: `gpresult /h C:\gpreport.html`.
3. Inspect report for **Security Filtering** or **WMI Filter** blocks.
4. Check if target OU has "Block Inheritance" enabled.
5. Verify SYSVOL replication state across DCs using `repadmin /replsummary`.

• Replace Mode: Completely overrides user's normal GPO settings with policies linked to the computer's OU.
• Merge Mode: Combines user GPOs and computer GPOs; in case of conflict, computer GPO settings take precedence.

• Security Groups: Used to assign resource access permissions (file shares, printers, security rights) AND can be used as email distribution lists.
• Distribution Groups: Used exclusively for email broadcast lists; cannot be used to assign resource access permissions.

• Domain Local: Granted permissions to resources located inside the *same* local domain; can contain members from any trusted domain.
• Global: Organizes users sharing similar job roles from the *same* domain; can be granted access to resources across any trusted domain.
• Universal: Can contain members from any domain in the forest and can be granted permissions to resources across any domain in the forest (replicated in Global Catalog).

• LDAP: Lightweight Directory Access Protocol queries AD database objects. Plain LDAP uses **Port 389**; encrypted LDAPS uses **Port 636**.
• Kerberos: Default domain ticket-based authentication protocol operating on **Port 88** using mutual authentication via KDC service.

• NTLM: Legacy challenge-response protocol using MD4 password hashes; slower, lacks mutual authentication, vulnerable to relay and Pass-the-Hash attacks.
• Kerberos: Fast, ticket-based authentication using strong encryption, enforces mutual authentication, relies on trusted KDC and DNS.

1. Inspect Windows Security Log on DC for **Event ID 4625** (Failed Logon) and review status error codes.
2. Verify if account is disabled or locked out (`Event ID 4740`).
3. Check system time synchronization between client and DC (Kerberos fails if time skew >5 mins).
4. Test workstation secure channel trust relationship using PowerShell: `Test-ComputerSecureChannel`.

• Forward Lookup Zone: Maps domain hostnames to IP addresses (e.g., `server.domain.com` → `10.0.0.50`).
• Reverse Lookup Zone: Maps IP addresses to domain hostnames (e.g., `10.0.0.50` → `server.domain.com`) using Pointer (PTR) records.

• A Record: Maps hostname to IPv4 address.
• AAAA Record: Maps hostname to IPv6 address.
• CNAME: Alias mapping one domain name to another domain name.
• MX Record: Points to destination mail exchange servers.
• PTR Record: Maps IP address to hostname for reverse lookups.
• TXT Record: Holds text data (used for SPF, DKIM, DMARC domain verification).

1. Discover: Client broadcasts request on LAN (UDP Port 67).
2. Offer: DHCP server offers available IP address parameters (UDP Port 68).
3. Request: Client requests offered IP address.
4. Acknowledge: Server acknowledges lease assignment to client.

• Hot Standby: Primary server processes 100% of IP leases; secondary server steps in automatically if primary fails.
• Load Balance: Both DHCP servers process client IP requests simultaneously based on a configured percentage split (default 50/50).

1. Check local hosts file (`C:\Windows\System32\drivers\etc\hosts`).
2. Flush DNS cache: `ipconfig /flushdns`.
3. Use `nslookup` or PowerShell `Resolve-DnsName` to test resolution against specific DNS servers.
4. Clear DNS Server cache via DNS Manager (`dnsmgmt.msc`) or `dnscmd /clearcache`.
5. Restart DNS Server service (`net stop dns && net start dns`).

1. Check physical NIC link light and verify IP configuration via `ipconfig /all` (check for APIPA `169.254.x.x`).
2. Ping local loopback (`127.0.0.1`), local IP, Default Gateway, and remote public IP (`8.8.8.8`).
3. Test DNS resolution: `nslookup google.com`.
4. Trace network hops: `tracert destination`.
5. Test specific port connectivity using PowerShell: `Test-NetConnection -ComputerName "Server" -Port 445`.

• Generation 1: Supports legacy 32/64-bit OS, emulates legacy BIOS, IDE controllers, and synthetic drivers.
• Generation 2: Modern 64-bit OS support, UEFI boot, Secure Boot, PXE boot over standard NIC, SCSI virtual controllers, and faster boot performance.

• External: Binds to a physical host NIC, allowing VMs to communicate with each other, the host OS, and the physical external network.
• Internal: Allows communication between VMs and the host OS only (no physical network access).
• Private: Allows communication *only* between VMs connected to the same switch (no host OS or physical network access).

• Password Hash Sync (PHS): Syncs re-hashed user password hashes from on-prem AD to Entra ID; simplest, most resilient cloud identity mode.
• Pass-Through Auth (PTA): On-premises agent validates cloud user login attempts against local DCs in real time over outbound HTTPS connection.

1. Inspect Entra ID Sign-in logs for specific status error codes.
2. Verify Entra Connect Sync status in `miisclient.exe` on-prem.
3. Check if user account is locked out or password expired in on-premises AD.
4. Test web access via browser Incognito mode to clear local credential token cache.

• Full: Backs up all selected data; resets archive bit.
• Incremental: Backs up only data changed since the last backup (fastest backup, slowest restore).
• Differential: Backs up all data changed since the last *Full* backup (larger sizes, faster restore).
• 3-2-1 Rule: Maintain **3** total data copies, across **2** different media types, with **1** copy off-site or air-gapped.

• RTO (Recovery Time Objective): The maximum acceptable duration of system downtime to restore operations post-outage.
• RPO (Recovery Point Objective): The maximum acceptable age of unrecovered data/backups lost during an outage.

• RAID 0: Striping (high performance, zero fault tolerance).
• RAID 1: Mirroring (requires 2 disks, 1-disk fault tolerance).
• RAID 5: Striping with distributed parity (requires min 3 disks, 1-disk fault tolerance).
• RAID 6: Striping with double parity (requires min 4 disks, 2-disk fault tolerance).
• RAID 10: Mirrored sets striped together (requires min 4 disks, high speed & fault tolerance).

• Antivirus: Signature-based pre-execution protection blocking known malware files.
• EDR (Endpoint Detection and Response): Continuous behavioral telemetry logging process execution chains, script execution, and memory behavior to detect zero-days and support remote host isolation.

1. Apply CIS Server Hardening GPOs.
2. Disable legacy protocols (SMBv1, NetBIOS, LLMNR).
3. Enable BitLocker encryption and UAC at maximum level.
4. Configure Windows Defender Firewall default block rules.
5. Disable unnecessary server roles and default services.
6. Enforce LAPS for local administrator account management.

Import-Csv "C:\NewUsers.csv" | ForEach-Object {
    New-ADUser -Name $_.Name -GivenName $_.FirstName -Surname $_.LastName `
               -UserPrincipalName $_.UPN -Path $_.OU -AccountPassword (ConvertTo-SecureString $_.Password -AsPlainText -Force) `
               -Enabled $true -ChangePasswordAtLogon $true
}

$Services = Get-Service | Where-Object {$_.StartType -eq 'Automatic' -and $_.Status -ne 'Running'}
$Disks = Get-CimInstance Win32_LogicalDisk | Where-Object {$_.DriveType -eq 3 -and ($_.FreeSpace/$_.Size) -lt 0.15}
$Events = Get-WinEvent -FilterHashtable @{LogName='System'; Level=1,2; StartTime=(Get-Date).AddHours(-24)}
# Format results into HTML string and send via Send-MailMessage

• Server Uptime % (Target >99.9%).
• Patch Compliance Rate % (Target >95% within 14 days of Patch Tuesday).
• Mean Time to Resolve (MTTR) for infrastructure tickets.
• Backup Success Rate % (Target 100%).
• Active Directory Replication Health & DNS Resolution Speed.

1. Audit Active Directory environment, FSMO roles, and Domain Controller health (`dcdiag`).
2. Review backup restoration status and test DR recovery workflows.
3. Audit WSUS patch compliance and critical vulnerability exposure across servers.
4. Inspect Active Directory Domain Administrator group memberships and check Windows LAPS adoption.
5. Review system documentation, topology diagrams, and existing operational SOPs.

1. Test Authentication Scope: Verify if users can log in using cached credentials on existing workstations. Test logging in with a test domain account from multiple subnets.
2. Check DC & DNS Health: Verify physical/virtual DC power status. Ping DC static IPs and test DNS resolution for domain SRV records (`_msdcs.domain.com`).
3. Check Kerberos & Time Synchronization: Run `w32tm /query /status` on client devices to check time skew against PDC Emulator (Kerberos fails if skew >5 mins).
4. Verify AD Services: Connect to DCs and verify `NTDS`, `KDC`, `DNS`, and `Netlogon` services are running.
5. Check Network Firewalls: Verify RPC and Kerberos ports (`88`, `389`, `135`, `49152-65535`) are unblocked across network subnets.

1. Verify Secondary DC Failover: Confirm secondary DC handles domain authentication and DNS queries seamlessly.
2. Attempt Hardware/Host Recovery: Inspect physical host power, repair file system errors in WinRE if needed, and boot DC into Directory Services Restore Mode (DSRM) to run `ntdsutil` database integrity checks.
3. Seize FSMO Roles (If Unrecoverable): If the failed DC held FSMO roles and cannot be recovered, open PowerShell on the surviving DC and execute `Seize-ADDirectoryServerRole` to forcibly claim FSMO roles.
4. Metadata Cleanup: Clean up dead DC records from Active Directory using `ntdsutil` or `dsa.msc` (deleting computer object) and remove stale DNS records.
5. Re-promote / Rebuild: Provision a clean Windows Server installation and promote it as a fresh secondary DC.

1. Unlink/Disable GPO: Open Group Policy Management Console (`gpmc.msc`), identify newly linked GPO, right-click and uncheck **Link Enabled** or delete the link from the targeted OU.
2. Force Immediate Refresh: Execute an emergency forced policy refresh command (`gpupdate /force`) across domain hosts via PowerShell `Invoke-Command` or MECM/Intune.
3. Identify Misconfiguration: Review GPO change history. Identify syntax errors in User Configuration policies (e.g., Software Restriction Policies or AppLocker misconfigurations).
4. Enforce Governance: Require all future GPO edits to undergo development in a dedicated Staging OU, undergo peer review, and receive formal CAB approval before production linking.

1. Immediate Workaround: Open `dhcpmgmt.msc` → Reclaim inactive IP leases by clearing expired active leases or shortening scope Lease Duration (e.g., reduce from 8 days to 8 hours for wireless subnets).
2. Expand Scope Pool: Expand the active scope IP range if unallocated IPs exist in the subnet prefix.
3. Add Superscope / Subnet: If the subnet is exhausted, configure a **Superscope** in DHCP Manager to add a secondary IP network block to the physical segment.
4. Configure DHCP Failover: Set up a secondary DHCP server in Load Balance mode to ensure continuous IP availability.

1. Immediate Cleanup: Run Disk Cleanup (`cleanmgr`), purge Windows temp files, and clear old IIS/application log files under `C:\inetpub\logs`.
2. Locate Large Files: Run TreeSize or PowerShell script to scan the volume and identify top large directories or runaway log files.
3. Shadow Copy / VSS Purge: Inspect VSS shadow copy storage limits (`vssadmin list shadowstorage`) and resize allocated space if shadow copies consume excess storage.
4. Expand Virtual Disk: If running on a VM, extend the virtual disk (VHDX/VMDK) in Hyper-V/VMware console, then extend the volume live inside Disk Management (`diskmgmt.msc`).
5. Configure Storage Sense: Deploy Storage Sense policies via GPO to automatically purge temporary files routinely.

1. Inspect Error Logs: Open Event Viewer → Check Application Log for Event ID 1000/1002 to identify failing DLL dependencies or service crash details.
2. Service Dependencies Check: Check `services.msc` to ensure all parent dependent services are running.
3. Uninstall Recent Update: Open CMD as Admin → Execute `wusa /uninstall /kb:KB1234567 /quiet /norestart` or roll back patch via WSUS/MECM deployment console.
4. Test Application: Restart server and verify application service starts successfully.
5. Vendor & Patch Management Escalation: Log issue with software vendor, hide/defer specific KB update in WSUS, and test update patch in staging environment prior to re-deployment.

1. Check Sync Server Status: Log onto Entra Connect server and verify the `Microsoft Azure AD Sync` service is running.
2. Inspect Synchronization Service Manager: Launch `miisclient.exe` → Review **Operations** tab for failed sync cycles and export error strings (e.g., `credentials-expired` or `stopped-server-down`).
3. Verify Connector Account: Confirm the AD DS service account credentials are valid and not locked out.
4. Test Password Writeback: Check if Password Hash Sync (PHS) or Password Writeback feature is flagged with errors in Event Viewer under `Azure AD Connect` log.
5. Manual Sync Trigger: Execute manual delta synchronization via PowerShell: `Start-ADSyncSyncCycle -PolicyType Delta`.

1. Check Hypervisor Host Metrics: Review host resource utilization in Hyper-V / vCenter. Check if physical host CPU/RAM is overcommitted.
2. Check Storage Latency: Inspect disk I/O metrics on SAN/S2D volume. Disk queue length >2 or latency >20ms indicates storage bottleneck.
3. Check Guest OS Metrics: Log into VM → Open Resource Monitor (`resmon`) and Performance Monitor (`perfmon`).
4. Isolate Component:
   • High `Processor Queue Length` → CPU starvation (assign more virtual vCPUs).
   • High `Page Faults/sec` & Dynamic Memory maxed out → Memory exhaustion (increase RAM limit).
   • High `Avg. Disk sec/Transfer` → Storage I/O bottleneck (move VHDX to SSD storage pool).

1. Tooling & Preparation: Utilize **Windows Storage Migration Service** in Windows Admin Center or Microsoft `Robocopy`.
2. Initial Seed Copy: Run initial Robocopy pass during business hours to seed raw data: `robocopy \\OldServer\Share \\NewServer\Share /MIR /COPYALL /MT:16 /LOG:C:\CopyLog.txt`.
3. User Communication: Send change notice informing users of scheduled cutover maintenance window.
4. Delta Copy & Cutover: During maintenance window, set old shares to Read-Only, execute final Robocopy delta sync pass (`/MIR` to catch changes), and update DNS CNAME / DFS Namespace paths to point seamlessly to the new server IP.
5. Validation: Confirm file share accessibility, verify NTFS permissions match original source, and commission old server after 30-day soak period.

1. Immediate Host Isolation: Disconnect physical network cable from file server or execute network isolation via EDR console immediately.
2. Identify Patient Zero: Open `fsmgmt.msc` on file server → Inspect **Open Files** and **Sessions** to identify the specific user workstation account executing rapid file encryption across shares. Isolate that user's desktop immediately.
3. Revoke Credentials: Disable the compromised user account in Active Directory and reset session tokens.
4. Eradication & Recovery: Wipe infected endpoint. Restore encrypted file server shares from uninfected VSS Shadow Copies (`Previous Versions`) or immutable off-site backups.
5. Post-Mortem: Deploy File Server Resource Manager (FSRM) anti-ransomware file blocking rules (blocking `.locked`, `.crypto` extensions) and strengthen EDR behavioral blocking.