AZ-802 · Domain 6 of 7

AZ-802 Domain 6: Secure Windows Server infrastructure

Hardening Windows Server and Active Directory: exploit protection, App Control for Business, Credential Guard, SmartScreen, OSConfig baselines, Windows LAPS, Defender for Servers and firewall rules, plus password policies, Entra Password Protection, Protected Users and domain controller hardening.

Exam weight
10–15%
Official functional groups
2
Estimated questions estimate
~6
Suggested study time estimate
8–10 hrs

About 11 min read Reviewed October 2026

Overview

Domain 6 is split into securing the operating system and securing AD DS. The operating system group covers exploit protection, Application Control for Windows, Credential Guard, Microsoft Defender SmartScreen, security settings delivered by Group Policy, security baselines managed with OSConfig, Windows Local Administrator Password Solution, Microsoft Defender for Servers, and Windows Firewall including connection security rules.

The AD DS group covers password policies, Microsoft Entra Password Protection for on-premises domains, the Protected Users group, hardening domain controllers and restricting who can sign in to them, security options for user accounts and built-in administrative groups, delegation of administration, and authentication protocols such as NTLM and Kerberos. Many objectives share one theme: shrink privilege and credential exposure so a single compromised account cannot spread through the domain.

How it's tested

Security questions usually state a threat or audit finding, such as shared local admin passwords, pass-the-hash risk or untrusted executables, and ask which control addresses it with the least disruption. Several answers may improve security, so look for the one that targets the exact threat and meets the stated prerequisites.

  • Map the threat to a control

    An attack technique is described, and you choose LAPS, Credential Guard, Protected Users, App Control or exploit protection.

  • Scope the password rule

    Different users need different password requirements, and you choose fine-grained password policies or Entra Password Protection.

  • Restrict the admin path

    Administrators sign in too widely, and you apply tiering, logon rights, delegation or group membership limits.

Reasoning it through

An audit finds that every member server shares the same local Administrator password, set years ago. Changing it manually would be slow and would drift again. Windows LAPS, built into current Windows Server versions, rotates a unique password per server and stores it encrypted in AD DS or Microsoft Entra ID. You update the schema with Update-LapsADSchema, grant the computers permission to write their passwords, and enable LAPS through Group Policy.

Functional groups 2

Official functional groups from the Microsoft outline, in outline order.

6.1 Secure Windows Server operating systemExploit protection, App Control, Credential Guard, SmartScreen, Group Policy security, OSConfig, LAPS, Defender for Servers and firewall.
What it means
This group covers configuring exploit protection mitigations, Application Control for Windows policies, Credential Guard, Microsoft Defender SmartScreen, operating system security through Group Policy, managing the Windows Server security baseline with OSConfig, implementing Windows LAPS, onboarding and managing Defender for Servers, and configuring Windows Firewall profiles, rules and connection security rules.
What to understand
Exploit protection applies system and per-app mitigations such as DEP and ASLR and can be exported as XML. App Control for Business, formerly Windows Defender Application Control, allows only approved code and should start in audit mode. Credential Guard uses virtualization-based security to isolate NTLM hashes and Kerberos tickets and is enabled by default on qualifying Windows Server 2025 domain members. OSConfig applies and monitors the Windows Server 2025 security baseline with drift control through PowerShell. Windows LAPS backs up local admin passwords to AD DS or Entra ID. Defender for Servers reaches on-premises servers through Azure Arc. Connection security rules use IPsec to authenticate or encrypt traffic between hosts.
How it shows up
Expect questions that ask which feature stops a named technique and what must be in place before enabling it.
Common confusion
Expecting Credential Guard on domain controllers to protect AD DS secrets; it provides no added protection for the directory database there.
6.2 Secure AD DSPassword policies, Entra Password Protection, Protected Users, DC hardening, account and group security, delegation and authentication.
What it means
This group covers default domain and fine-grained password policies, deploying Microsoft Entra Password Protection agents to block weak passwords, using the Protected Users group, hardening and restricting access to domain controllers, account security options such as Account is sensitive and cannot be delegated, securing built-in groups like Domain Admins and Backup Operators, delegating administration with the Delegation of Control Wizard, and controlling NTLM and Kerberos.
What to understand
The default domain policy sets one password policy for the domain; fine-grained password policies apply to users or global security groups through Password Settings Objects with precedence. Entra Password Protection uses a proxy service and a DC agent to enforce global and custom banned password lists, starting in audit mode. Protected Users members cannot use NTLM, DES or RC4, cannot be delegated, and get four-hour TGTs. Restrict DC logon to Tier 0 admins, keep privileged groups nearly empty, and delegate OU tasks instead of granting Domain Admins. NTLM can be audited then restricted through Group Policy.
How it shows up
Expect questions on assigning stricter passwords to admins, protecting privileged accounts and delegating limited rights to help desk staff.
Common confusion
Adding service accounts to Protected Users; they lose NTLM and delegation, which often breaks the service.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Windows LAPS

    Rotates unique local admin passwords and stores them in AD DS or Entra ID.

    Remember
    Built into current Windows Server; legacy LAPS is deprecated.
    Tested as
    Lateral movement questions.
    Trap
    Installing the legacy MSI on new servers.

  • Credential Guard

    Isolates credentials with virtualization-based security.

    Remember
    Default on qualifying Windows Server 2025 members.
    Tested as
    Pass-the-hash questions.
    Trap
    Relying on it to protect domain controllers.

  • App Control for Business

    Allows only trusted code to run.

    Remember
    Deploy in audit mode first.
    Tested as
    Untrusted software questions.
    Trap
    Confusing it with AppLocker scope and strength.

  • Exploit protection

    Process mitigations such as DEP, ASLR and CFG.

    Remember
    Configure system-wide or per app and export XML.
    Tested as
    Memory exploit questions.
    Trap
    Expecting it to block unsigned apps.

  • OSConfig

    Security configuration stack for Windows Server 2025 baselines.

    Remember
    Detects and corrects drift.
    Tested as
    Baseline questions.
    Trap
    Thinking it only applies to Azure VMs.

  • Defender for Servers

    Defender for Cloud plan for server protection.

    Remember
    Arc onboarding for non-Azure machines; Plan 2 adds JIT and FIM.
    Tested as
    Threat protection questions.
    Trap
    Choosing Plan 1 when JIT is needed.

  • Fine-grained password policy

    Password Settings Object applied to users or global groups.

    Remember
    Lowest precedence value wins.
    Tested as
    Different password rules questions.
    Trap
    Linking it to an OU.

  • Entra Password Protection for AD DS

    Banned password lists enforced on domain controllers.

    Remember
    Proxy plus DC agent, audit then enforce.
    Tested as
    Weak password questions.
    Trap
    Expecting it to need DCs with internet access.

  • Protected Users

    Security group that hardens member credential handling.

    Remember
    No NTLM, delegation, DES or RC4; 4-hour TGT.
    Tested as
    Privileged account questions.
    Trap
    Adding computers or service accounts.

  • Account is sensitive and cannot be delegated

    Flag that blocks delegation of an account's credentials.

    Remember
    Use for admin accounts.
    Tested as
    Delegation risk questions.
    Trap
    Setting it on service accounts that need delegation.

  • Delegation of Control

    Grants specific AD permissions on an OU.

    Remember
    Avoids membership in privileged groups.
    Tested as
    Help desk questions.
    Trap
    Using Account Operators for password resets.

  • Connection security rules

    IPsec rules in Windows Firewall to authenticate or encrypt traffic.

    Remember
    Separate from allow and block rules.
    Tested as
    Server isolation questions.
    Trap
    Expecting a firewall rule alone to encrypt.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Credential protections

ConceptMeaningKey differenceCommon trap
Windows LAPS Unique rotated local admin passwords Stops shared local password reuse Expecting it to protect domain accounts
Credential Guard Isolates cached credentials with VBS Blocks hash and ticket theft from LSASS Expecting it on domain controllers
Protected Users Restricts how member credentials are used Removes NTLM and delegation Adding service accounts

Password controls

ConceptMeaningKey differenceCommon trap
Default domain password policy Single policy for the domain Applies to all domain users Linking more policies to OUs
Fine-grained password policy PSO for users or global groups Precedence resolves conflicts Applying it to OUs
Entra Password Protection Banned password lists on DCs Blocks weak or company terms Expecting it to set length or age

Application control options

ConceptMeaningKey differenceCommon trap
App Control for Business Kernel-enforced code integrity policy Strongest application control Skipping audit mode
AppLocker User-mode allow and deny rules Easier per-user targeting Treating it as a security boundary

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. PSO on an OU

    What candidates pick
    Link a fine-grained password policy to the Admins OU.
    Why it looks right
    Group Policy is linked to OUs.
    Why it's wrong
    Password Settings Objects apply only to users and global security groups, not OUs.

    Clue to watch for Different password rules for one department.

  2. Credential Guard for DCs

    What candidates pick
    Enable Credential Guard on domain controllers to protect NTDS.dit.
    Why it looks right
    It protects credentials.
    Why it's wrong
    Credential Guard protects locally cached secrets and gives no added protection to the AD database on DCs.

    Clue to watch for The target is the domain controller itself.

  3. Everyone into Protected Users

    What candidates pick
    Add all accounts, including services, to Protected Users.
    Why it looks right
    More protection seems better.
    Why it's wrong
    Members lose NTLM and delegation, which breaks many services and applications.

    Clue to watch for Accounts used by applications or scheduled tasks.

  4. Legacy LAPS on Windows Server 2025

    What candidates pick
    Download and deploy the legacy LAPS MSI.
    Why it looks right
    It is the familiar tool.
    Why it's wrong
    Windows LAPS is built in and supports encryption and Entra ID backup; legacy LAPS is deprecated.

    Clue to watch for Current Windows Server versions.

  5. Account Operators for help desk

    What candidates pick
    Add help desk staff to Account Operators.
    Why it looks right
    The group resets passwords.
    Why it's wrong
    Built-in operator groups carry broad rights; delegating password reset on specific OUs is least privilege.

    Clue to watch for Reset passwords only for one OU.

  6. Firewall rule for encryption

    What candidates pick
    Create an inbound allow rule to encrypt server traffic.
    Why it looks right
    Firewall rules control traffic.
    Why it's wrong
    Allow rules do not encrypt; connection security rules apply IPsec authentication and encryption.

    Clue to watch for Traffic must be authenticated or encrypted between servers.

Answer framework

Use these steps when a security question names a threat and offers several controls.

  1. Name the threat precisely: credential theft, shared local passwords, weak passwords, untrusted code, memory exploits or excessive privilege, since each one maps to a different control on the exam.
  2. Map it to the narrowest control, such as LAPS, Credential Guard, Protected Users, App Control or exploit protection.
  3. Check prerequisites and scope, including schema updates, VBS support, Arc onboarding or the users and groups the setting applies to.
  4. Deploy in audit mode where available, review the impact on services and users, then switch to enforcement deliberately.
  5. Reduce privilege around the control with delegation, restricted DC logon and near-empty built-in administrative groups, so the control is not undermined by an over-privileged account.

Practice question

Members of the Finance group must use passwords of at least 16 characters, while all other users keep the existing 12-character domain policy. Finance users are in several OUs. You need to meet the requirement with minimal effort. What should you do?

Want more like this? The AZ-802 practice test has questions for every domain.

Checklist

0 of 13

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Treat this domain as a list of threats and matching controls. Create a two-column table and fill it as you study: threat on the left, control, prerequisite and side effect on the right. In the lab, deploy Windows LAPS and read a password with Get-LapsADPassword. Enable Credential Guard on a member server and confirm it with msinfo32. Apply the OSConfig baseline on a Windows Server 2025 VM and change a setting to watch drift correction. Build an App Control policy in audit mode and review the code integrity events.

For AD DS, create two Password Settings Objects with different precedence and check which wins with Get-ADUserResultantPasswordPolicy. Add a test admin to Protected Users and try an NTLM connection to see it fail. Use the Delegation of Control Wizard to grant password reset on one OU. If you have Azure access, install the Entra Password Protection proxy and DC agent in audit mode and review the event log entries for weak passwords.

FAQ

What percentage of AZ-802 is Domain 6, Secure Windows Server infrastructure?

Secure Windows Server infrastructure is weighted at 10–15%, roughly five to eight questions. It has two functional groups: securing the operating system and securing AD DS.

Is AppLocker still on the exam?

The current outline names Application Control for Windows rather than AppLocker. Know how they differ, but focus on App Control for Business policies, audit mode and enforcement.

Does Windows LAPS need a schema update?

For AD DS backup, yes. Run Update-LapsADSchema once, then grant computers permission to update their password attributes with Set-LapsADComputerSelfPermission. Entra ID backup does not need the schema change.

What is OSConfig?

OSConfig is the security configuration stack in Windows Server 2025. It applies Microsoft security baselines through PowerShell or Azure Arc and can detect and correct drift from those settings.

Does Entra Password Protection require domain controllers to reach the internet?

No. Only the proxy service needs outbound access to Microsoft Entra ID. DC agents get policy through the proxy and never connect directly.

Which Defender for Servers plan includes just-in-time VM access?

Defender for Servers Plan 2 includes JIT VM access and file integrity monitoring. Plan 1 focuses on Defender for Endpoint integration.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 6 knowledge

Check whether you can match threats to controls such as Windows LAPS, Credential Guard, Protected Users and fine-grained password policies with AZ-802 practice questions.

Take the AZ-802 practice test Check your AZ-802 readiness

Keep going