This Day 1 preparation guide covers the Windows Server and Active Directory knowledge expected from an experienced System Administrator or System Engineer.

The focus is not on memorizing definitions. The questions progress from fundamentals to administration, authentication, Group Policy, DNS integration, replication, FSMO roles, security, troubleshooting, and real-world production scenarios.

Section 1 – Windows Server Fundamentals

1. What is Windows Server?

Windows Server is Microsoft’s server operating system designed to provide centralized infrastructure services such as:

Active Directory Domain Services
DNS
DHCP
File and Print Services
Hyper-V
Remote Desktop Services
IIS
Windows Deployment Services
Certificate Services
Failover Clustering
Group Policy
Security and identity management

In an enterprise environment, Windows Server is commonly used to provide centralized authentication, application services, file services, infrastructure services, and management.

2. What is the difference between Windows Server and Windows client OS?

Windows Server is designed for centralized, multi-user and enterprise workloads.

Important differences include:

Server roles and features
Active Directory services
Higher scalability
Enterprise networking capabilities
Server-oriented security and management
Remote administration
Failover and clustering capabilities
Infrastructure services such as DNS and DHCP

3. What are Server Roles and Features?

A role provides a major server capability.

Examples:

AD DS
DNS Server
DHCP Server
File and Storage Services
Hyper-V
Remote Desktop Services

A feature provides additional functionality that supports the operating system or installed roles.

Examples include:

.NET Framework
BitLocker
Failover Clustering
RSAT components

4. What is Server Manager?

Server Manager is Microsoft’s graphical management console used to:

Add/remove roles and features
Manage local and remote servers
View server events
Monitor services
Configure server roles
Access management tools

PowerShell can perform many of the same tasks remotely and is generally more efficient for automation.

5. How would you troubleshoot a Windows Server that is running slowly?

I would first determine whether the problem is related to CPU, memory, disk, network, or a specific application.

I would check:

Task Manager
Resource Monitor
Performance Monitor
Disk utilization
Available memory
CPU utilization
Network utilization
Running services/processes
Event Viewer
Application logs
Recent changes
Backup/AV/scanning activity

I would avoid restarting the server immediately unless there is a justified operational reason.

Section 2 – Active Directory Fundamentals

6. What is Active Directory Domain Services?

Active Directory Domain Services (AD DS) is Microsoft’s directory service for centrally managing identities, computers, groups, resources, authentication, authorization and policies in a Windows domain environment.

AD DS uses several important technologies, including:

LDAP
Kerberos
DNS
Group Policy
AD replication

7. What is a Domain?

A domain is a logical administrative and security boundary containing users, computers, groups and other directory objects.

For example:

corp.example.com

Objects within the domain can be centrally managed and authenticated.

8. What is a Domain Controller?

A Domain Controller is a Windows Server running the AD DS role.

It maintains a replica of the Active Directory database and provides services including:

Authentication
Authorization
LDAP directory access
Kerberos authentication
Group Policy processing
AD replication
Domain Controller discovery

9. What is the difference between a Domain Controller and a Member Server?

Domain Controller

Runs AD DS
Stores the AD database
Authenticates domain users
Participates in AD replication
Provides directory services

Member Server

Joined to the domain
Does not host AD DS
Uses domain authentication
Can host applications, file services, databases, etc.

10. What is an Active Directory object?

An object is an entity stored in Active Directory.

Examples:

User
Computer
Group
OU
Contact
Printer
Shared resource

Each object has attributes associated with it.

Section 3 – Forest, Tree, Domain and OU

11. What is an Active Directory forest?

A forest is the highest-level logical container in an AD environment.

A forest can contain:

One or more domains
One or more domain trees
A common schema
Configuration information
Global Catalog
Forest-wide trust relationships

12. What is an AD tree?

A tree is a collection of domains that share a contiguous DNS namespace.

For example:

example.com
    |
    +-- sales.example.com
    |
    +-- hr.example.com

13. What is an Organizational Unit?

An OU is a logical container within a domain.

OUs are commonly used to:

Organize users/computers
Delegate administration
Apply Group Policy
Separate administrative responsibilities

Example:

Company
 |
 +-- Users
 |
 +-- Servers
 |
 +-- Workstations
 |
 +-- IT
 |
 +-- Finance

14. Why should we use OUs instead of putting everything in the default containers?

OUs provide better administrative control.

They allow us to:

Apply different GPOs
Delegate permissions
Organize objects
Separate server and workstation policies
Build a logical administrative structure

Section 4 – Active Directory Database

15. What is NTDS.dit?

NTDS.dit is the primary Active Directory database file.

It contains directory information such as:

Users
Groups
Computers
Organizational information
Security principals
Other AD objects and attributes

A typical location is:

C:\Windows\NTDS\NTDS.dit

16. What is SYSVOL?

SYSVOL is a shared directory on Domain Controllers that stores important domain-wide files, including:

Group Policy templates
Logon scripts
Other files required for domain-wide policy distribution

SYSVOL replication is therefore important for consistent Group Policy operation across Domain Controllers.

17. What are NETLOGON and SYSVOL shares?

A Domain Controller normally exposes:

\\DC01\SYSVOL
\\DC01\NETLOGON

SYSVOL contains Group Policy-related data.

NETLOGON is commonly used for domain logon scripts and related domain resources.

Section 5 – Authentication

18. What authentication protocol does Active Directory primarily use?

Active Directory primarily uses Kerberos for domain authentication.

LDAP is primarily associated with directory access, while Kerberos handles authentication.

19. Explain what happens when a domain user logs in.

A simplified process is:

User enters credentials
        ↓
Client locates a Domain Controller through DNS
        ↓
Kerberos authentication
        ↓
Domain Controller validates credentials
        ↓
Kerberos tickets are issued
        ↓
Security token is created
        ↓
Group memberships are evaluated
        ↓
Computer/User Group Policy is processed
        ↓
User session starts

The exact authentication flow can vary depending on the circumstances.

20. Why is time synchronization important for Kerberos?

Kerberos uses time-based authentication mechanisms.

If the client and Domain Controller clocks differ beyond the permitted tolerance, authentication can fail.

Therefore, incorrect time synchronization can cause:

Kerberos failures
Domain authentication problems
Replication-related problems
Other security/authentication issues

The PDC Emulator plays an important role in the domain time hierarchy.

Section 6 – DNS and Active Directory

21. Why is DNS critical for Active Directory?

DNS is fundamental to AD because clients use DNS to locate Domain Controllers and services.

AD uses DNS records, including SRV records, to locate services such as:

LDAP
Kerberos
Domain Controllers
Global Catalog services

For example:

_ldap._tcp.dc._msdcs.example.com

Incorrect DNS configuration can result in:

Domain join failures
Slow logons
GPO failures
DC discovery problems
Authentication problems
Replication problems

22. What DNS server should a domain-joined Windows client normally use?

In an AD environment, domain clients should normally use the organization’s internal AD-integrated DNS infrastructure rather than relying directly on public DNS servers.

The internal DNS servers can resolve AD-specific records that public DNS servers cannot provide.

23. How would you troubleshoot DNS problems on a domain computer?

Useful commands include:

ipconfig /all
nslookup
ipconfig /flushdns

For AD service discovery:

nslookup -type=SRV _ldap._tcp.dc._msdcs.example.com

I would check:

DNS server addresses
DNS suffix
Forward lookup zones
_msdcs records
SRV records
Network connectivity
DNS server health
Dynamic registration
Firewall configuration

Section 7 – Domain Controller Discovery

24. How can you find which Domain Controller a client is using?

Useful commands include:

echo %LOGONSERVER%

and:

nltest /dsgetdc:example.com

These can help determine Domain Controller discovery and logon-related information.

25. What is the Global Catalog?

The Global Catalog is a partially replicated, searchable representation of objects across the forest.

It is used for:

Forest-wide searches
User logon-related operations in certain scenarios
Universal group membership
Directory searches

A Global Catalog server contains a partial attribute set for objects from domains in the forest.

Section 8 – FSMO Roles

26. What are the five FSMO roles?

There are five Flexible Single Master Operations roles.

Forest-wide

Schema Master
Domain Naming Master

Domain-wide

RID Master
PDC Emulator
Infrastructure Master

27. What does the Schema Master do?

The Schema Master controls modifications to the Active Directory schema.

Schema changes affect the structure and attributes available in AD.

28. What does the Domain Naming Master do?

It controls additions and removals of domains and certain application partitions within the forest.

29. What does the RID Master do?

The RID Master helps Domain Controllers allocate Relative ID pools.

These RIDs are used as part of creating unique security identifiers for security principals.

30. What does the PDC Emulator do?

The PDC Emulator has several important responsibilities, including:

Domain time hierarchy
Password-change handling considerations
Account lockout-related processing
Compatibility functions
Certain Group Policy-related operations

It is one of the most operationally important FSMO roles.

31. What does the Infrastructure Master do?

The Infrastructure Master is responsible for certain cross-domain object reference updates.

Its importance depends on the particular AD architecture, including Global Catalog placement.

32. How do you check FSMO role holders?

Use:

netdom query fsmo

PowerShell can also provide forest and domain information:

Get-ADForest
Get-ADDomain

Section 9 – Active Directory Replication

33. Is Active Directory single-master or multi-master?

AD uses multi-master replication for most directory changes.

This means multiple Domain Controllers can accept changes and replicate those changes to other Domain Controllers.

FSMO roles exist because certain operations require a designated single master.

34. What is AD replication?

AD replication is the process through which directory changes are distributed between Domain Controllers.

Replication allows Domain Controllers to maintain consistent directory information.

35. What are AD Sites?

AD Sites represent the physical/network topology of the organization.

They help Active Directory understand:

Network locations
Subnets
Domain Controllers
Replication topology

Proper site configuration can improve authentication and replication efficiency.

36. What are Site Links?

Site Links define logical replication paths between AD Sites.

They can influence:

Replication topology
Replication cost
Replication scheduling

37. How do you troubleshoot AD replication?

Start with:

repadmin /replsummary

Then:

repadmin /showrepl

And:

dcdiag

Then investigate:

DNS
Network connectivity
RPC communication
Firewall
AD Sites/Subnets
Replication partners
Event Viewer
SYSVOL/NETLOGON health

38. A user created on DC01 is not visible on DC02. What do you check?

I would first determine whether this is an actual replication problem.

I would check:

repadmin /replsummary
repadmin /showrepl

Then verify:

DC01 and DC02 connectivity
DNS resolution
Replication status
Site configuration
RPC connectivity
Event Viewer
AD replication errors

I would not immediately force replication without identifying the underlying problem.

Section 10 – Group Policy

39. What is Group Policy?

Group Policy provides centralized configuration and management of users and computers in an Active Directory environment.

It can configure:

Security settings
Password policies
Windows Firewall
Software
Scripts
Drive mappings
Administrative restrictions
Windows Update settings
Desktop configuration

40. What is a GPO?

A Group Policy Object is a collection of policy settings that can be linked to:

Site
Domain
OU

A GPO contains both computer and user configuration settings.

41. What is the normal GPO processing order?

The standard order is:

Local
  ↓
Site
  ↓
Domain
  ↓
OU

This is commonly remembered as:

L-S-D-O-U

Nested OU processing can result in additional processing as the computer/user is located deeper in the OU hierarchy.

42. What is Group Policy inheritance?

GPOs linked at higher levels can be inherited by objects lower in the AD hierarchy unless inheritance or other policy behavior changes the result.

43. What is Block Inheritance?

Block Inheritance prevents normal inherited GPOs from higher levels from applying to a container.

However, an Enforced GPO can override this behavior.

44. What is an Enforced GPO?

An enforced GPO has special inheritance behavior and can prevent lower-level policies from overriding its settings in normal circumstances.

45. What is Security Filtering?

Security filtering controls which users or computers have permission to apply a GPO.

Incorrect security filtering can cause a GPO to appear linked correctly but not actually apply to the intended objects.

46. What is WMI filtering?

WMI filtering allows a GPO to apply only when a specified WMI query evaluates as true.

It can be used to target machines based on characteristics such as:

Operating system
Version
Hardware
Other system properties

Section 11 – Troubleshooting Group Policy

47. A GPO is not applying. What do you check?

I would check the issue systematically:

Correct OU?
     ↓
GPO linked?
     ↓
GPO enabled?
     ↓
Security filtering?
     ↓
WMI filtering?
     ↓
Inheritance?
     ↓
Network/DNS?
     ↓
SYSVOL?
     ↓
Client-side processing?

Useful commands:

gpupdate /force
gpresult /r

Detailed report:

gpresult /h C:\Temp\gpresult.html

I would also inspect Group Policy-related Event Viewer logs.

48. What is the difference between Computer Configuration and User Configuration?

Computer Configuration

Applies to the computer.

Examples:

Security policies
Firewall
Startup scripts
Computer-level software settings

User Configuration

Applies to the user.

Examples:

User logon scripts
Desktop settings
Drive mappings
User restrictions

49. What is loopback processing?

Group Policy loopback processing allows user configuration policies to be determined based on the computer being used.

It is particularly useful in environments such as:

RDS
Shared computers
Kiosk systems
Terminal servers

Common modes include:

Merge
Replace

Section 12 – AD Users and Groups

50. What is a Security Group?

A security group can be used to assign permissions to resources.

Example:

Users
  ↓
GG-Finance
  ↓
Finance-Share-RW
  ↓
Folder permissions

51. What is a Distribution Group?

A Distribution Group is primarily designed for email distribution rather than resource permission assignment.

52. What is the difference between Global, Domain Local and Universal groups?

Global Group

Typically used to collect users/accounts from its own domain based on common role or function.

Domain Local Group

Typically used to assign permissions to resources within its domain.

Universal Group

Can contain members across domains and is useful in multi-domain environments.

53. What is AGDLP?

AGDLP stands for:

Accounts
   ↓
Global Groups
   ↓
Domain Local Groups
   ↓
Permissions

Example:

User
 ↓
GG-Accounts
 ↓
DL-Accounts-Share-RW
 ↓
File Server Permission

This separates identity management from resource permissions and makes administration more scalable.

Section 13 – Domain Trusts

54. What is an Active Directory trust?

A trust establishes an authentication relationship between domains or forests.

Trusts can allow identities from one security boundary to authenticate to resources in another, subject to appropriate permissions.

55. What types of trusts should you know?

Important trust concepts include:

One-way trust
Two-way trust
Transitive trust
Non-transitive trust
Forest trust
External trust

The actual behavior depends on the trust type and configuration.

Section 14 – Computer Accounts and Secure Channel

56. What is a computer account?

When a Windows computer joins an AD domain, a corresponding computer object is created in Active Directory.

The computer uses this identity when establishing its secure relationship with the domain.

57. What does “The trust relationship between this workstation and the primary domain failed” mean?

It generally indicates a problem with the secure channel between the workstation and the domain.

Possible causes include:

Computer account problems
Secure channel/password mismatch
Restored/duplicated machines
Other domain relationship issues

Test the secure channel with:

Test-ComputerSecureChannel -Verbose

If appropriate:

Test-ComputerSecureChannel -Repair -Verbose

The repair method should be selected based on the actual cause.

Section 15 – User Account Troubleshooting

58. A user cannot log in to the domain. How do you troubleshoot it?

I would first determine whether the issue affects:

One user
One computer
Multiple users
One site
The entire domain

Then check:

Network connectivity
DNS
Domain Controller discovery
User account status
Password/lockout status
Computer trust relationship
Time synchronization
Kerberos/authentication
Group Policy
Event Viewer

Useful commands include:

ipconfig /all
nslookup
nltest /dsgetdc:domain.com
nltest /sc_verify:domain.com

59. What would you check if a user account is locked out?

I would:

Confirm the account is actually locked.
Identify the source of the lockout.
Check recent authentication attempts.
Investigate stored credentials.
Check mapped drives.
Check scheduled tasks/services using old credentials.
Check mobile devices or applications.
Check other machines where the user may be logged in.

The goal is not merely to unlock the account but to identify what is repeatedly causing the lockout.

Section 16 – Password and Account Policies

60. Where are domain password policies normally configured?

Traditional domain-wide password policies are normally configured through Group Policy associated with the domain.

Policies can include:

Minimum password length
Password complexity
Password history
Maximum password age
Minimum password age
Account lockout settings

61. What is Fine-Grained Password Policy?

Fine-Grained Password Policies allow different password and account lockout requirements to be applied to different users or groups within the same domain.

They are useful when different groups require different security requirements.

Section 17 – File Server Permissions

62. What is the difference between Share permissions and NTFS permissions?

Share permissions

Apply when accessing a resource through a network share.

Example:

\\Server01\Finance

NTFS permissions

Apply to the file system itself.

They apply both locally and through network access.

When accessing a file through a share, effective access is determined by the combination of applicable share and NTFS permissions.

63. A user can access a folder locally but not through the network. Why?

I would investigate:

Share permissions
NTFS permissions
User/group membership
SMB connectivity
DNS
Firewall
Authentication
Network path

This is different from simply checking the NTFS ACL.

Section 18 – Windows Services and Event Viewer

64. How do you troubleshoot a Windows service that isn’t starting?

I would check:

Service status
Startup type
Service account
Dependencies
Event Viewer
Application logs
Recent configuration changes
Required ports
File/folder permissions
Disk space

Useful PowerShell:

Get-Service

65. What is Event Viewer used for?

Event Viewer provides logs that help troubleshoot:

System problems
Application failures
Security events
Service failures
Authentication problems
Driver issues
Group Policy problems

Important logs include:

Application
Security
System

and specialized application/service logs.

Section 19 – Windows Server Backup and Recovery

66. What is Windows Server Backup?

Windows Server Backup is Microsoft’s built-in backup capability for Windows Server.

Depending on configuration, it can back up:

Files
Volumes
System State
Bare-metal recovery components

In enterprise environments, third-party backup platforms may also be used.

67. What is System State backup?

System State contains important operating system and directory-related components.

For a Domain Controller, System State backup is particularly important because it includes data required for recovering AD-related services.

68. What is authoritative and non-authoritative AD restore?

Non-authoritative restore

Restores the Domain Controller and allows normal replication to bring the restored directory data up to date.

Authoritative restore

Marks selected directory data as authoritative so that the restored information is replicated to other Domain Controllers.

Authoritative recovery should be performed carefully and only when the recovery scenario requires it.

Section 20 – Domain Controller Failure

69. What happens if one Domain Controller fails?

The impact depends on the environment.

If other healthy Domain Controllers are available, users may continue authenticating.

However, you should check:

FSMO roles
DNS
Global Catalog availability
Replication
SYSVOL/NETLOGON
Services hosted exclusively on the failed DC
Applications pointing directly to that DC

The correct response is to assess the role of the failed DC before deciding whether to repair, restore, replace or remove it.

70. Can you simply shut down and remove a Domain Controller?

No.

A Domain Controller should normally be properly demoted.

If a DC has permanently failed, forced removal/metadata cleanup may be required depending on the situation.

Improperly removing a DC can leave:

Stale AD objects
DNS records
Replication references
Site information
Other metadata

Section 21 – AD Health Checks

71. What tools do you use to check Domain Controller health?

Important tools include:

dcdiag
repadmin /replsummary
repadmin /showrepl

Other useful checks include:

Event Viewer
DNS Manager
Active Directory Sites and Services
Active Directory Users and Computers
PowerShell
Performance Monitor

72. What would you check during a regular AD health check?

I would review:

Domain Controller health

CPU/memory/disk
Services
Event logs
DNS
SYSVOL
NETLOGON

Replication

Replication failures
Replication latency
Partner health

Security

Privileged accounts
Group membership
Account lockouts
Password policy
Authentication failures

Section 22 – Senior-Level Troubleshooting Scenarios

73. Users report that domain login takes several minutes. How would you troubleshoot?

I would first establish the scope.

If only one user is affected, I would investigate the workstation/user profile.

If many users are affected, I would investigate infrastructure.

My sequence would include:

DNS
 ↓
DC discovery
 ↓
Network latency
 ↓
Authentication
 ↓
GPO processing
 ↓
Logon scripts
 ↓
Mapped drives
 ↓
Profile
 ↓
Event logs

I would use gpresult, Event Viewer, DNS tests and DC discovery tools to narrow the issue.

74. All users in one branch office cannot authenticate, but headquarters users are working.

I would compare the affected site with the working site.

I would investigate:

WAN connectivity
Local DNS
AD Site/Subnet configuration
Domain Controller availability
Firewall
Routing
DC discovery
Replication
Authentication traffic

This scenario requires both networking and Active Directory troubleshooting.

75. One Domain Controller is showing replication errors.

I would not immediately demote the DC.

I would first collect evidence:

repadmin /replsummary
repadmin /showrepl
dcdiag

Then investigate:

DNS
Network connectivity
RPC
Firewall
Time synchronization
AD Sites
Event logs
SYSVOL
Replication topology

76. A GPO is linked correctly but isn’t applying.

I would check:

gpresult /r

and:

gpresult /h C:\Temp\gpresult.html

Then investigate:

Correct OU
Security filtering
WMI filtering
GPO status
Inheritance
Enforced policies
Client/DC connectivity
SYSVOL
Group Policy event logs

77. Users can access the internet but cannot access an internal server.

Internet access alone doesn’t prove that internal services are healthy.

I would check:

Internal DNS
      ↓
Server name resolution
      ↓
Network route
      ↓
Firewall
      ↓
Required port
      ↓
Authentication
      ↓
Application/service
      ↓
Permissions

For a file server, I would additionally investigate SMB and both share/NTFS permissions.

78. A computer suddenly cannot authenticate with the domain.

I would check:

Network
DNS
Time
DC discovery
Secure channel
Computer account
Event logs

Useful tests:

nltest /dsgetdc:domain.com
nltest /sc_verify:domain.com

and:

Test-ComputerSecureChannel -Verbose

Section 23 – PowerShell You Should Know

For a System Administrator interview, be comfortable with basic AD PowerShell commands.

Find a user

Get-ADUser username

Get detailed user information

Get-ADUser username -Properties *

Find computers

Get-ADComputer -Filter *

Find groups

Get-ADGroup -Filter *

Find Domain Controllers

Get-ADDomainController -Filter *

Domain information

Get-ADDomain

Forest information

Get-ADForest

Check secure channel

Test-ComputerSecureChannel -Verbose

Section 24 – Essential Commands to Memorize

These commands should become familiar before the interview.

ipconfig /all
ipconfig /flushdns
nslookup
ping
tracert

gpupdate /force
gpresult /r
gpresult /h C:\Temp\gpresult.html

nltest /dsgetdc:domain.com
nltest /sc_verify:domain.com

dcdiag
repadmin /replsummary
repadmin /showrepl

netdom query fsmo

PowerShell:

Get-ADUser
Get-ADComputer
Get-ADGroup
Get-ADDomain
Get-ADForest
Get-ADDomainController
Get-Service
Test-ComputerSecureChannel

Section 25 – Rapid-Fire Interview Questions

These should be answered without needing to think for a long time.

79. What protocol does Kerberos use?

Kerberos is an authentication protocol used by AD for domain authentication.

80. What protocol is commonly used for directory queries?

LDAP.

81. What is the default Kerberos port?

TCP/UDP 88.

82. What is LDAP’s standard port?

TCP 389.

83. What is LDAPS?

LDAP secured using TLS/SSL, commonly associated with TCP 636.

84. What is DNS’s standard port?

TCP/UDP 53.

85. What is SMB’s standard port?

TCP 445.

86. What is an SRV record?

A DNS record used to identify the location of services such as LDAP and Kerberos.

87. What is the purpose of a Global Catalog?

It provides a searchable partial representation of objects across the forest and supports several forest-wide directory operations.

88. How many FSMO roles exist?

Five.

89. How many FSMO roles are forest-wide?

Two.

90. How many are domain-wide?

Three.

91. What command checks FSMO role holders?

netdom query fsmo

92. What command summarizes replication failures?

repadmin /replsummary

93. What command shows replication details?

repadmin /showrepl

94. What command checks Domain Controller health?

dcdiag

95. What command generates a detailed Group Policy report?

gpresult /h report.html

96. What command forces Group Policy processing?

gpupdate /force

97. What does AGDLP mean?

Accounts → Global Groups → Domain Local Groups → Permissions.

98. What is SYSVOL used for?

It stores Group Policy-related files and other domain-wide data such as logon scripts.

99. Why is DNS important to AD?

It allows clients and Domain Controllers to locate AD services and Domain Controllers.

100. What is the most important principle when troubleshooting AD?

Determine the scope and establish the root cause before making changes.

Final Interview Scenarios – Practice Without Looking at the Answers

Before considering Day 1 complete, try answering these yourself.

Scenario A

A user cannot log in to the domain, but another user can log in to the same computer.

What would you check?

Scenario B

No users in one branch can log in, but headquarters is working.

What would you check first?

Scenario C

A GPO works for 95 computers but not five computers.

How would you isolate the problem?

Scenario D

A newly created AD user isn’t visible on another Domain Controller.

How would you troubleshoot it?

Scenario E

A Domain Controller has been offline for several days.

What would you check before bringing it back into production?

Scenario F

A user’s account keeps locking out every 10 minutes.

How would you find the source?

Scenario G

Users complain that Windows logon suddenly takes five minutes.

How would you determine whether the problem is DNS, AD, GPO, network or the workstation?

Scenario H

A file server is reachable by IP address but not by hostname.

What does that immediately make you investigate?

Scenario I

The PDC Emulator is unavailable.

What functions could be affected and what would you investigate?

Scenario J

One Domain Controller reports replication failures with all partners.

What infrastructure components would you investigate before attempting repairs?

Day 1 Final Revision Checklist

Before moving to Day 2, you should be comfortable explaining:

The Interview Mindset

For a senior System Administrator interview, avoid answering every question with a definition.

Instead, use this structure:

What is it? → Why is it important? → How have you used it? → How would you troubleshoot it?

For example, instead of saying:

“DNS resolves names to IP addresses.”

A stronger interview answer is:

“DNS is critical to Active Directory because clients use it not only for name resolution but also to locate Domain Controllers and AD services through records such as SRV records. If DNS is incorrectly configured, we can see domain join, authentication, Group Policy and replication problems. So when troubleshooting an AD issue, DNS is one of the first infrastructure components I verify.”

That style demonstrates production experience rather than memorized theory.

Day 1 objective

By the end of this preparation, you should be able to take an unfamiliar Windows/AD problem and explain your troubleshooting approach logically:

Identify the scope
       ↓
Check recent changes
       ↓
Check network & DNS
       ↓
Check authentication/DC discovery
       ↓
Check AD/GPO/replication
       ↓
Check logs
       ↓
Identify root cause
       ↓
Apply controlled fix
       ↓
Verify
       ↓
Document

That troubleshooting methodology is more important for your upcoming interviews than memorizing another 100 isolated definitions.