AZ-802 · Domain 1 of 7

AZ-802 Domain 1: Deploy and manage AD DS

The heaviest AZ-802 skill area: deploying writable and read-only domain controllers on-premises and in Azure, FSMO roles, trusts, sites and replication, users, groups and service accounts, and Group Policy.

Exam weight
20–25%
Official functional groups
4
Estimated questions estimate
~11
Suggested study time estimate
14–18 hrs

About 14 min read Reviewed October 2026

Overview

Domain 1 covers Active Directory Domain Services from the first domain controller to day-to-day policy. Microsoft lists four functional groups. The first covers deploying and managing domain controllers locally and in Azure, Read-Only Domain Controllers and their password replication policy, and FSMO role management. The second covers trusts, AD DS sites and replication across multi-site, multi-domain and multi-forest designs. The third covers users, groups and service accounts, including principals that span domains or forests. The fourth covers Group Policy and Group Policy preferences.

AZ-802 became the only exam for Microsoft Certified: Windows Server Administrator Associate after Microsoft retired AZ-800 and AZ-801 on September 30, 2026. The exam was released as a beta in mid-2026. At 20–25%, AD DS carries more weight than any other skill area, and Domain 6 and Domain 7 return to it for hardening and recovery.

How it's tested

Questions here usually describe an organization with several offices, domains or forests and a requirement such as faster logons at a branch, access for a partner forest, or fewer accounts with static passwords. You pick the directory object, role placement, trust type or policy setting that satisfies the requirement with the least administrative effort.

  • Place the domain controller

    A branch, an Azure region or an insecure site is described, and you choose between a writable domain controller, an RODC or no local controller.

  • Choose the trust

    Two domains or forests must share resources, and you select direction, transitivity, scope and authentication level for the trust.

  • Fix policy precedence

    A setting does not apply as expected, and you work through LSDOU order, enforcement, inheritance blocking, security filtering and loopback mode.

Reasoning it through

A retail branch has poor physical security and a slow WAN link, and staff complain about slow sign-ins. A writable domain controller would hold every password hash, which is risky if the server is stolen. An RODC with a password replication policy that caches only branch users and branch computers speeds up logons while limiting exposure. Placing the RODC in its own AD DS site with a subnet object keeps clients authenticating locally.

Functional groups 4

Official functional groups from the Microsoft outline, in outline order.

1.1 Deploy and manage AD DS domain controllersDomain controllers on-premises and in Azure, RODCs, account security on RODCs and FSMO roles.
What it means
This group covers promoting and demoting domain controllers on physical or virtual hosts, running domain controllers as Azure virtual machines, deploying Read-Only Domain Controllers, managing which credentials an RODC may cache, and transferring, seizing and troubleshooting the five Flexible Single-Master Operations roles.
What to understand
Domain controllers are promoted with Install-ADDSDomainController or Server Manager after adding the AD DS role. In Azure, give the VM a static private IP, point the VNet DNS at the domain controllers, place NTDS and SYSVOL on a data disk with caching set to None, and spread controllers across availability zones. An RODC holds no writable copy and caches secrets only for accounts in its Allowed RODC Password Replication Group or policy. Schema master and domain naming master are forest-wide; PDC emulator, RID master and infrastructure master are per domain. Transfer a role when its holder is online and seize it only when the holder will never return.
How it shows up
Expect questions on where to place FSMO roles, which RODC settings limit credential exposure and how to deploy a domain controller in Azure correctly.
Common confusion
Seizing a FSMO role from a holder that is only temporarily offline; the old holder must never be brought back online afterward.
1.2 Configure and manage multi-site, multi-domain, and multi-forest environmentsTrusts, AD DS sites, site links and replication.
What it means
This group covers creating and validating domain and forest trusts, defining AD DS sites, subnets and site links, and managing replication between domain controllers inside a site and across sites, including schedules, costs and bridgehead servers.
What to understand
Forest trusts are transitive between two forests and need Kerberos and DNS name resolution between them, often via conditional forwarders. External trusts link single domains and are not transitive. Shortcut trusts speed authentication inside a forest, and realm trusts connect to Kerberos realms outside Windows. Selective authentication limits which users may authenticate across a trust. Sites map IP subnets to locations so clients find nearby controllers. The Knowledge Consistency Checker builds the replication topology, site link cost steers traffic, and intersite replication follows a schedule while intrasite replication triggers on change notification.
How it shows up
Expect a partner forest or branch office scenario that asks for the trust type, the site design or the reason replication is slow.
Common confusion
Thinking forest trusts are transitive to a third forest; trust transitivity stops at the two forests that share the trust.
1.3 Create and manage AD DS security principalsUsers, groups, cross-domain principals and service accounts.
What it means
This group covers creating and managing user and group accounts, choosing group scope and type, granting access to principals from other domains or forests, and selecting between standalone managed service accounts, group managed service accounts and delegated managed service accounts for services and scheduled tasks.
What to understand
Group scope decides membership and use: global groups hold accounts from their own domain, domain local groups grant permissions on local resources, and universal groups span the forest and replicate to the global catalog. The AGDLP pattern places accounts in global groups, global groups in domain local groups, and permissions on domain local groups. A gMSA lets a service run on several servers with an automatically rotated password, which needs a KDS root key in the forest. A standalone MSA is limited to one computer. Windows Server 2025 adds delegated MSAs that replace a legacy service account.
How it shows up
Expect a request to grant cross-forest access with minimal groups or to remove static passwords from a service used by several servers.
Common confusion
Choosing a standalone managed service account for a service that runs across a server farm; only a gMSA works on several hosts.
1.4 Manage Windows Server by using domain-based Group PoliciesGroup Policy objects, processing order and Group Policy preferences.
What it means
This group covers creating, linking and scoping Group Policy objects, controlling processing with inheritance, enforcement, security filtering, WMI filters and loopback processing, and using Group Policy preferences for drive maps, registry values, local groups, scheduled tasks and other settings that users may change.
What to understand
Policies apply in order local, site, domain, then OU, so later links win unless an earlier link is enforced. Block inheritance stops parent links except enforced ones. Security filtering needs Read and Apply permissions, and Authenticated Users or Domain Computers still needs Read for the GPO to process. Loopback in replace or merge mode applies user settings from the computer's location. Preferences differ from policies: they write settings that users can change and can use item-level targeting. A central store in SYSVOL keeps ADMX templates consistent.
How it shows up
Expect questions where a setting fails to apply, a kiosk needs user settings tied to the computer, or a mapped drive must target only some users.
Common confusion
Assuming preferences are enforced like policies; a preference can be changed by the user unless reapplied or set to apply once.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • FSMO roles

    Five single-master roles: schema, domain naming, PDC emulator, RID and infrastructure.

    Remember
    Two are forest-wide and three are per domain.
    Tested as
    Role placement and failure questions.
    Trap
    Seizing when a transfer would work.

  • PDC emulator

    Domain role for time source, password change priority and lockout processing.

    Remember
    The forest root PDC emulator should sync with an external time source.
    Tested as
    Time and lockout questions.
    Trap
    Configuring every DC as an external NTP client.

  • Read-Only Domain Controller

    Domain controller with a read-only database and filtered credential caching.

    Remember
    Uses a password replication policy.
    Tested as
    Branch office security questions.
    Trap
    Expecting writes to go to the RODC.

  • Domain controller in Azure

    AD DS on an Azure VM in a hybrid design.

    Remember
    Static IP, data disk with no caching, and VNet DNS pointing at controllers.
    Tested as
    Hybrid identity questions.
    Trap
    Putting NTDS on the OS disk with read/write cache.

  • Forest trust

    Transitive trust between two forest root domains.

    Remember
    Needs name resolution in both directions.
    Tested as
    Merger and partner questions.
    Trap
    Assuming it extends to other forests.

  • Selective authentication

    Trust option requiring Allowed to Authenticate on target computers.

    Remember
    Narrows access across a trust.
    Tested as
    Partner access questions.
    Trap
    Forgetting to grant the permission on servers.

  • AD DS sites and site links

    Objects mapping subnets to locations and linking them for replication.

    Remember
    Cost and schedule control intersite traffic.
    Tested as
    Branch logon and replication questions.
    Trap
    Leaving a subnet unassigned to any site.

  • Group managed service account

    Service identity with automatic password rotation across several hosts.

    Remember
    Requires a KDS root key.
    Tested as
    Service account questions.
    Trap
    Using a user account with a never-expires password.

  • AGDLP

    Accounts into global groups, into domain local groups, which get permissions.

    Remember
    Universal groups bridge domains in a forest.
    Tested as
    Access design questions.
    Trap
    Granting permissions directly to users.

  • Group Policy processing order

    Local, site, domain, OU, with the last applied link winning.

    Remember
    Enforced links override block inheritance.
    Tested as
    Policy conflict questions.
    Trap
    Thinking the domain GPO beats an OU GPO by default.

  • Loopback processing

    Applies user settings based on the computer object location.

    Remember
    Replace or merge mode.
    Tested as
    Kiosk and RDS questions.
    Trap
    Linking user settings to a computer OU without loopback.

  • Group Policy preferences

    Configurable, changeable settings with item-level targeting.

    Remember
    Not enforced like policy settings.
    Tested as
    Drive map and registry questions.
    Trap
    Expecting preferences to tattoo and lock settings.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Trust types

ConceptMeaningKey differenceCommon trap
Forest trust Links two forest roots Transitive within both forests Assuming transitivity to a third forest
External trust Links one domain to a domain in another forest Non-transitive, NTLM or Kerberos Using it when the whole forest needs access
Shortcut trust Links two domains in the same forest Shortens the authentication path Using it across forests
Realm trust Links to a non-Windows Kerberos realm Interoperability with MIT Kerberos Picking it for a Windows partner

Service account options

ConceptMeaningKey differenceCommon trap
Standalone MSA Managed account bound to one computer Automatic password, single host Deploying it to a cluster
Group MSA Managed account usable by many hosts Needs KDS root key and allowed host list Forgetting PrincipalsAllowedToRetrieveManagedPassword
Delegated MSA Windows Server 2025 account that replaces a legacy service account Migrates an existing account Treating it as a gMSA alias

RODC vs writable domain controller

ConceptMeaningKey differenceCommon trap
Writable DC Full read-write AD DS copy Stores all secrets Placing it in an insecure branch
RODC Read-only copy with filtered secrets Forwards writes to a writable DC Expecting local password changes to replicate outward

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Seize too early

    What candidates pick
    Seize the RID master role as soon as its holder reboots.
    Why it looks right
    It restores the role fast.
    Why it's wrong
    Seizing is for permanent loss; the old holder must never return, so a transfer or wait is correct when it will recover.

    Clue to watch for The holder is down for maintenance or patching.

  2. Writable DC at the branch

    What candidates pick
    Deploy a full domain controller to the insecure branch.
    Why it looks right
    It gives the best local performance.
    Why it's wrong
    It stores every credential hash on hardware that may be stolen; an RODC with a filtered policy reduces exposure.

    Clue to watch for Physical security is poor or staff lack IT skills.

  3. External trust for a forest merger

    What candidates pick
    Create an external trust between the two root domains.
    Why it looks right
    It looks simpler to set up.
    Why it's wrong
    External trusts are non-transitive, so child domains are not covered; a forest trust covers all domains in both forests.

    Clue to watch for Every domain in both forests must share access.

  4. Domain GPO wins

    What candidates pick
    Expect the domain-linked GPO to override the OU-linked GPO.
    Why it looks right
    Domain sounds higher in the hierarchy.
    Why it's wrong
    Later links win, and OU links apply after domain links unless the domain link is enforced.

    Clue to watch for Two conflicting settings, one linked at the domain and one at an OU.

  5. Preference treated as policy

    What candidates pick
    Use a Group Policy preference to lock a setting users must not change.
    Why it looks right
    Preferences cover many settings.
    Why it's wrong
    Preferences set values but do not prevent users changing them; an administrative template policy enforces the setting.

    Clue to watch for The requirement says users must be prevented from changing it.

  6. Single-host managed account

    What candidates pick
    Create an sMSA for a web farm application pool.
    Why it looks right
    It removes manual password changes.
    Why it's wrong
    An sMSA is tied to one computer; only a gMSA can be retrieved by many hosts.

    Clue to watch for The service runs on three or more load-balanced servers.

Answer framework

Use this sequence when an AD DS question asks where to place, trust, group or configure something.

  1. Identify the scope: one domain, several domains in one forest, or separate forests, because that decides trust type and group scope.
  2. Check physical and network constraints such as branch security, WAN speed and Azure placement before choosing a writable controller or RODC.
  3. Map each location to a site with subnets and site links so authentication and replication follow the intended path.
  4. Pick identities that remove static passwords and follow AGDLP, using a gMSA wherever a service runs on several servers.
  5. Apply settings through Group Policy, then confirm the result with LSDOU order, enforcement, filtering and Resultant Set of Policy before finishing.

Practice question

Contoso runs a web application on four load-balanced Windows Server 2025 servers in one domain. The application pool uses a domain user account whose password never expires. Security requires automatic password rotation with no service downtime. What should you implement first?

Want more like this? The AZ-802 practice test has questions for every domain.

Checklist

0 of 12

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Build a small lab first: two domain controllers in one domain, a child domain or second forest, and a member server. Promote controllers with PowerShell so the cmdlets become familiar, then transfer each FSMO role and read the output of netdom query fsmo. Add a second site with a subnet and site link, change the cost, and watch repadmin /showrepl and repadmin /replsummary to see how replication reacts.

Next, create a forest trust with selective authentication and test access from the other forest. Practice AGDLP by granting a cross-forest group access to a share. Create a KDS root key and a gMSA, install it on two servers and run a service under it. Finish with Group Policy: link conflicting GPOs at the domain and OU, then use Group Policy Results to predict and confirm the winner. Try loopback merge mode and a drive-map preference targeted to one group. If you have an Azure subscription, deploy a domain controller VM using the placement rules from this page.

FAQ

How much of AZ-802 is Domain 1, Deploy and manage AD DS?

Microsoft weights Deploy and manage AD DS at 20–25% of the exam, the largest share of the seven skill areas. That is roughly 10 to 13 questions on a typical form, though Microsoft does not publish a fixed count.

Is AZ-802 replacing AZ-800 and AZ-801?

Yes. Microsoft retired AZ-800 and AZ-801 on September 30, 2026, and AZ-802 is now the exam for Microsoft Certified: Windows Server Administrator Associate. Existing Windows Server Hybrid Administrator Associate holders keep their credential.

Do I need to know Microsoft Entra ID for this domain?

Only lightly. Domain 1 is about on-premises AD DS and domain controllers running in Azure. Entra appears more in hybrid management and in Domain 6, where Entra Password Protection for AD DS is listed.

Which FSMO roles matter most for troubleshooting?

The PDC emulator, because it handles time, account lockout and urgent password changes, and the RID master, because a failure stops new objects once a domain controller uses up its RID pool.

Are Group Policy preferences on the exam?

Yes. Microsoft lists Implement Group Policy preferences as its own objective. Know drive maps, registry items, local users and groups, item-level targeting and the difference between preferences and enforced policy settings.

Is AZ-802 still in beta?

Microsoft launched AZ-802 as a beta in mid-2026. The study guide now links a practice assessment, which Microsoft usually provides after beta, but we could not confirm a general availability date. Check the exam page before booking.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 1 knowledge

Check your grasp of domain controllers, FSMO roles, trusts, sites, service accounts and Group Policy with AZ-802 practice questions before moving to hybrid management.

Take the AZ-802 practice test Check your AZ-802 readiness

Keep going