AZ-802 · Domain 7 of 7

AZ-802 Domain 7: Monitor and troubleshoot Windows Server environments

Monitoring and fixing Windows Server: Performance Monitor, data collector sets, Windows Admin Center alerts, System Insights, event logs, Azure Monitor data collection rules and VM Insights, then troubleshooting connectivity, updates, time, storage, Arc extensions and Active Directory.

Exam weight
15–20%
Official functional groups
3
Estimated questions estimate
~9
Suggested study time estimate
10–13 hrs

About 12 min read Reviewed October 2026

Overview

Domain 7 is the operations layer of AZ-802. The monitoring group covers Performance Monitor, data collector sets, monitoring and alerts in Windows Admin Center, System Insights predictions, event log management, Azure Monitor data collection rules, alert rules and VM Insights. The Windows Server troubleshooting group covers connectivity, name resolution, Windows Update, the Windows Time service, performance, VM and Azure Arc extensions, disk encryption and storage.

The Active Directory troubleshooting group covers restoring deleted objects from the AD Recycle Bin, recovering the AD database in Directory Services Restore Mode, recovering SYSVOL, diagnosing replication, general on-premises AD faults, Kerberos and authentication errors, and secure channel or computer account trust failures. Questions in this domain usually start from a symptom and expect you to pick the tool or recovery method that resolves it without causing new damage.

How it's tested

Expect symptom-first scenarios: users cannot sign in, a server is slow, replication fails or an extension shows an error. You select the diagnostic tool, log, counter or recovery procedure that confirms the cause and restores service with the least risk and data loss.

  • Choose the recovery method

    An object, database or SYSVOL is damaged, and you pick Recycle Bin, authoritative or nonauthoritative restore, or SYSVOL recovery.

  • Collect the right data

    A server or fleet needs monitoring, and you choose data collector sets, System Insights, Windows Admin Center alerts or Azure Monitor rules.

  • Trace the failure

    Authentication, time or connectivity fails, and you use tools such as nltest, w32tm, repadmin or Test-NetConnection to isolate it.

Reasoning it through

An administrator deletes an OU containing 40 user accounts. The AD Recycle Bin was enabled last year. Restoring from backup in DSRM would require taking a domain controller offline and marking objects authoritative. Instead, Restore-ADObject on the deleted OU first, then on its child objects, brings back the accounts with all attributes and group memberships. Because the Recycle Bin is enabled, no downtime is needed and nothing else rolls back.

Functional groups 3

Official functional groups from the Microsoft outline, in outline order.

7.1 Monitor by using Windows Server tools and Azure servicesPerformance Monitor, data collector sets, Windows Admin Center, System Insights, event logs, data collection rules, alerts and VM Insights.
What it means
This group covers reading real-time counters in Performance Monitor, creating data collector sets for baselines and alerts, using Windows Admin Center to monitor servers and set alerts, enabling System Insights capacity forecasting, managing event logs and subscriptions, configuring Azure Monitor data collection rules, creating alert rules and using VM Insights to track Azure VM performance.
What to understand
Data collector sets record counters, traces and configuration to logs and can trigger performance counter alerts. Typical baseline counters include Processor % Processor Time, Memory Available MBytes, LogicalDisk Avg. Disk sec/Read and Network Interface Bytes Total/sec. System Insights runs local machine learning to forecast CPU, network, total storage and volume consumption. Event forwarding uses subscriptions with collector-initiated or source-initiated modes. Azure Monitor Agent sends data according to data collection rules associated with machines, including Arc-enabled servers. Alerts combine a signal, condition and action group. VM Insights adds performance charts and an optional dependency map.
How it shows up
Expect questions on choosing a monitoring tool, setting up event collection and configuring data collection rules for hybrid servers.
Common confusion
Configuring a workspace and expecting data to flow; Azure Monitor Agent collects only what an associated data collection rule defines.
7.2 Troubleshoot Windows Server issuesConnectivity, name resolution, updates, time, performance, extensions, disk encryption and storage.
What it means
This group covers diagnosing network connectivity and DNS resolution failures, Windows Update installation errors, Windows Time service drift, performance bottlenecks, failures of Azure VM extensions and Azure Arc extensions, BitLocker and Azure Disk Encryption problems, and storage issues such as degraded virtual disks or failing volumes.
What to understand
Test-NetConnection checks ports and routes, and Resolve-DnsName with ipconfig /flushdns isolates resolution problems. Windows Update errors appear in the Windows Update log produced by Get-WindowsUpdateLog and in CBS logs. The forest root PDC emulator should use an external time source while other machines follow the domain hierarchy; w32tm /query /status and /resync help. Arc extension status and logs live in the portal and under the agent folders on the server, and azcmagent check tests connectivity. BitLocker recovery mode can follow firmware or TPM changes. Get-PhysicalDisk and Get-VirtualDisk show storage health.
How it shows up
Expect a symptom with logs or command output, asking which command or step identifies or fixes the cause.
Common confusion
Pointing every domain member at an external NTP server; members should follow the domain hierarchy to avoid Kerberos skew.
7.3 Troubleshoot Active DirectoryRecycle Bin, DSRM recovery, SYSVOL, replication, on-premises AD, Kerberos and secure channel.
What it means
This group covers restoring deleted objects from the AD Recycle Bin, recovering the AD DS database by booting into Directory Services Restore Mode, recovering SYSVOL with authoritative or nonauthoritative DFSR sync, troubleshooting AD replication, general on-premises AD faults, Kerberos and authentication issues, and secure channel or computer account trust problems.
What to understand
The AD Recycle Bin, once enabled at forest level, preserves all attributes during the deleted object lifetime. Without it, an authoritative restore through DSRM and ntdsutil marks restored objects so they replicate outward. Nonauthoritative restore brings a DC back and lets partners update it. SYSVOL uses DFSR, and authoritative SYSVOL recovery sets msDFSR-Options on one DC. Repadmin /replsummary and /showrepl and dcdiag reveal replication faults. Kerberos fails with time skew over five minutes, missing SPNs or duplicate SPNs. Test-ComputerSecureChannel -Repair or nltest /sc_reset fixes a broken trust without rejoining.
How it shows up
Expect recovery and authentication scenarios that ask for the least disruptive fix in the correct order.
Common confusion
Rejoining a computer to the domain for a trust failure when Test-ComputerSecureChannel -Repair keeps its account and group memberships.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Data collector set

    Saved collection of counters, traces and configuration data.

    Remember
    Can raise performance counter alerts.
    Tested as
    Baseline questions.
    Trap
    Using only real-time graphs for trends.

  • System Insights

    Local predictive analytics for capacity forecasting.

    Remember
    Built-in CPU, network and storage forecasts.
    Tested as
    Capacity planning questions.
    Trap
    Thinking it needs Azure.

  • Event subscriptions

    Forward events from sources to a collector.

    Remember
    Collector-initiated or source-initiated.
    Tested as
    Central logging questions.
    Trap
    Forgetting WinRM and Event Log Readers rights.

  • Data collection rule

    Defines what Azure Monitor Agent collects and where it goes.

    Remember
    Associated with VMs and Arc servers.
    Tested as
    Hybrid monitoring questions.
    Trap
    Configuring the agent without a rule.

  • VM Insights

    Azure Monitor experience for VM performance and dependencies.

    Remember
    Uses Azure Monitor Agent and a DCR.
    Tested as
    Azure VM monitoring questions.
    Trap
    Expecting it for in-guest application logs.

  • Windows Time hierarchy

    Members sync to DCs, DCs to the forest root PDC emulator.

    Remember
    Kerberos tolerates five minutes skew by default.
    Tested as
    Time drift questions.
    Trap
    Setting manual NTP peers on every server.

  • azcmagent check

    Tests Arc agent connectivity to required endpoints.

    Remember
    Use before investigating extension errors.
    Tested as
    Arc troubleshooting questions.
    Trap
    Reinstalling the agent first.

  • AD Recycle Bin

    Forest feature that keeps deleted objects with all attributes.

    Remember
    Cannot be disabled once enabled.
    Tested as
    Deleted object questions.
    Trap
    Using DSRM restore when the Recycle Bin is on.

  • Authoritative restore

    Restore in DSRM and mark objects with ntdsutil to win replication.

    Remember
    Needed when no Recycle Bin exists.
    Tested as
    Recovery questions.
    Trap
    Doing a nonauthoritative restore and expecting objects to return.

  • Authoritative SYSVOL recovery

    Rebuilds DFSR SYSVOL from one trusted DC.

    Remember
    Set msDFSR-Options and disable replication on others first.
    Tested as
    SYSVOL corruption questions.
    Trap
    Copying files manually between DCs.

  • repadmin and dcdiag

    Command-line tools for replication and DC health.

    Remember
    Use /replsummary and /showrepl first.
    Tested as
    Replication questions.
    Trap
    Forcing replication without reading errors.

  • Secure channel repair

    Resets the computer account password trust with the domain.

    Remember
    Test-ComputerSecureChannel -Repair.
    Tested as
    Trust relationship questions.
    Trap
    Rejoining the domain as the first step.

  • Kerberos troubleshooting

    Diagnosing ticket failures from time, SPN or encryption issues.

    Remember
    Use klist and setspn -X.
    Tested as
    Authentication questions.
    Trap
    Ignoring duplicate SPNs.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

AD object recovery options

ConceptMeaningKey differenceCommon trap
AD Recycle Bin Online restore with all attributes No downtime, needs prior enablement Assuming it is on by default
Authoritative restore DSRM restore with ntdsutil marking Overrides newer replicas for chosen objects Marking the whole database unnecessarily
Nonauthoritative restore DSRM restore updated by partners Rebuilds a failed DC Expecting deleted objects to return

Monitoring tools

ConceptMeaningKey differenceCommon trap
Performance Monitor and data collector sets Local counters and logs Detailed per-server baselines Using them for fleet alerting
Windows Admin Center Browser-based health and alerts Quick per-server view Expecting long-term analytics
Azure Monitor with DCRs Central collection for Azure and Arc servers Fleet-wide alerts and queries Skipping the data collection rule
System Insights On-box forecasting Predicts capacity trends Treating it as real-time alerting

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. DSRM for a deleted user

    What candidates pick
    Boot a DC into DSRM and perform an authoritative restore.
    Why it looks right
    It is the classic recovery method.
    Why it's wrong
    With the Recycle Bin enabled, Restore-ADObject restores the object online with attributes and no downtime.

    Clue to watch for The Recycle Bin is enabled in the forest.

  2. Nonauthoritative restore brings objects back

    What candidates pick
    Restore the DC from backup without marking objects.
    Why it looks right
    It restores the database.
    Why it's wrong
    Partners replicate the deletion back; the object must be marked authoritative to survive.

    Clue to watch for Objects were deleted and replication has already happened.

  3. Rejoin to fix trust

    What candidates pick
    Remove and rejoin the computer to the domain.
    Why it looks right
    It resets everything.
    Why it's wrong
    Rejoining recreates the account and loses group memberships; Test-ComputerSecureChannel -Repair fixes the password trust in place.

    Clue to watch for Trust relationship between workstation and domain failed.

  4. Workspace without rule

    What candidates pick
    Install Azure Monitor Agent and wait for data in Log Analytics.
    Why it looks right
    Older agents sent data once linked.
    Why it's wrong
    Azure Monitor Agent sends nothing until a data collection rule is associated with the machine.

    Clue to watch for Agent installed but no performance data appears.

  5. Restart for Kerberos errors

    What candidates pick
    Restart the application server to clear Kerberos failures.
    Why it looks right
    Restarts often fix errors.
    Why it's wrong
    Persistent Kerberos errors usually come from time skew or SPN problems, which restarts do not fix.

    Clue to watch for Event IDs mention KRB_AP_ERR_SKEW or duplicate SPNs.

  6. Manual SYSVOL copy

    What candidates pick
    Copy SYSVOL files from a healthy DC to the broken one.
    Why it looks right
    It looks quick.
    Why it's wrong
    DFSR will overwrite or conflict with manual copies; perform an authoritative or nonauthoritative DFSR SYSVOL sync.

    Clue to watch for SYSVOL is corrupted or out of sync on several DCs.

Answer framework

Use these steps for symptom-driven AZ-802 monitoring and troubleshooting questions.

  1. Describe the symptom precisely and note what changed recently, such as updates, deletions, hardware or network modifications, because most incidents follow a change that someone can name.
  2. Pick the layer to test first: network, name resolution, time, authentication, replication, storage or the agent and extension.
  3. Run the targeted tool, such as Test-NetConnection, Resolve-DnsName, w32tm, klist, repadmin, dcdiag or azcmagent check.
  4. Choose the least disruptive fix: Recycle Bin before DSRM, secure channel repair before rejoin, resync before rebuild.
  5. Add monitoring so the issue is caught earlier next time, using data collector sets, alerts or data collection rules that notify the right team.

Practice question

Users at a branch intermittently fail to sign in and Event Viewer shows KRB_AP_ERR_SKEW errors. The branch domain controller syncs time with a public NTP server configured by a former administrator. What should you do?

Want more like this? The AZ-802 practice test has questions for every domain.

Checklist

0 of 14

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Study this domain last, after the configuration domains, because each troubleshooting objective assumes you know how the feature should work. Build a symptom list from the outline, such as no performance data in Azure Monitor, time skew, deleted OU, broken SYSVOL or trust relationship failed, and practice each in a lab. Break things on purpose: change a member server's time source, delete an OU with the Recycle Bin enabled, unlink a data collection rule, or stop the Netlogon service.

For monitoring, create a data collector set that records disk and memory counters for a day, enable System Insights, and set up an event subscription from two servers. In Azure, associate a data collection rule with an Arc-enabled server and create an alert with an action group. For AD recovery, take a system state backup, then rehearse an authoritative restore of one OU with ntdsutil in DSRM. Write down the command order for each recovery, because exam options often differ only in sequence.

FAQ

How much of AZ-802 does Domain 7, monitoring and troubleshooting, account for?

Monitor and troubleshoot Windows Server environments is weighted at 15–20%, about eight to ten questions. It has three functional groups covering monitoring, Windows Server troubleshooting and Active Directory troubleshooting.

Is the Log Analytics agent still tested?

The current outline names data collection rules and VM Insights, which use Azure Monitor Agent. The legacy Log Analytics agent is retired, so expect Azure Monitor Agent answers.

When should I use DSRM instead of the AD Recycle Bin?

Use DSRM when the Recycle Bin was not enabled before the deletion, when the deleted object lifetime has passed, or when the AD database itself is corrupt and must be restored from backup.

What tools should I know for AD replication problems?

Know repadmin /replsummary, /showrepl and /syncall, dcdiag, and the Directory Service and DFS Replication event logs. Also check DNS, because many replication errors start with name resolution.

How do I fix a broken trust relationship without rejoining?

Sign in locally and run Test-ComputerSecureChannel -Repair with domain credentials, or use nltest /sc_reset or Reset-ComputerMachinePassword. The computer account and its group memberships stay intact.

What is System Insights used for?

System Insights analyzes local performance data with machine learning to forecast CPU, network and storage use. It helps plan capacity before resources run out and can be managed in Windows Admin Center.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 7 knowledge

Test your troubleshooting judgment, from AD Recycle Bin restores and Kerberos time skew to Azure Monitor data collection rules, with AZ-802 practice questions.

Take the AZ-802 practice test Check your AZ-802 readiness

Keep going