AZ-800 - Microsoft Server Hybrid Core Inf.

Overview

Main system - Microsoft 365 - Sits on top of Azure

image.png

Microsoft Cloud

Cloud Sync - SSO logs users in via on-prem D.C, and Entra ID via cloud (syncs out but not in)


Powershell


Verb-Noun Structure
Verb-N... Tab for intellisense
Stop-Service <inputObject>  Parameters are required

Example: 

Get-Eventlog -LogName System -Newest 5 | Format-List Out-File c:\log.txt

Remote Access via Powershell

winrm quickconfig brings the service on
Get-Process -ComputerName SVR
Stop-Process
Get-Service -ComputerName SVR
Invoke-Command -ComputerName SVR -ScriptBlock {get-eventlog -LogName Security -Newest 5}
Enter_PSSession -ComputerName SVR
Exit
Get-Process -ComputerName SVR,DC (runs on both)

CredSSP

Scenario:

  1. Logged into ServerA, remote powershell to ServerB
  2. ServerB powershell command attempts to access ServerC
  3. Access is denied because credentials not passed from ServerB to ServerC

Credential Security Support Provider (CredSSP)

 

Integrated Scripting Environment (ISE)

Get-Variable
$Number1 = 5 Stores the value in a new variable
$Number outputs 5
$Name = "SVR" Can now use -ComputerName $Name
ISE

opens integrated scripting environment

(click show script pane)
$name = Read-Host "Which computer would you like to connect to?"
$log = Read-Host "Which log would you like to see?"
$amount = Read-Host "How many of the newest entries would you like to see?"
Get-Eventlog -ComputerName $name -LogName $log -Newest $amount

Domains, Trees, Forests

Domains, Trees & Forests

image.png

Trusts

Setup via Active Directory Domains and Trusts

Configure DNS to ensure they can communicate (conditional forwarders)

image.png

KCC

Separation of sites frees up bandwidth.

KCC Creates new rings within each site and appoints one D.C. as a Bridge Head (every 180 minutes) (can be altered) (Inter-Site Replication)

Site Links

Configured and Managed via AD DS > Sites

image.png

Domain Controller AD Partitions

Active Directory Partitions

image.png

Global Catalog Server

Configured in Active Directory Sites and Services > Services > DC > NTDS Settings > Properties > Tick "Global Catalog"

Read-Only Domain Controller (RODC)

Read Only Domain Controller (RODC)

Scenario

image.png

 

How to setup: (would normally be done via RDP or install locally and ship it to the location)

Flexible Single Master Operations (FSMO)

Flexible Single Master Operations (FSMO)

image.png

AD DS Users, OUs, & Groups

Users and OUs

Organisational Units - a means of separating users and devices/objects based on location, site, role, job, department

Example 1

Example 2

Groups

Group Scopes

Microsoft Strategy

firefox_xlh5XXZiOF.png

Universal Groups

*For larger organisations multiple globval groups can be linked to a single universal group, which is replicated across all domains

firefox_3CAA3dFk5H.png

Universal Group Membership Caching Feature

image.png

Scenario: users are finding it take a long time to log in - the global catalog server might be located in a different site to where the user and the domain controller are located

Solutions

Hybrid Identity Authentication & Entra Connect

Hybrid identity model & directory synchronisation is the most common for enterprise users

Managed Authentication

Password Hash Synchronisation (PHS) (Recommended)

Entra ID handles authentication using a locally hashed password

image.png

image.png

Pass-Through Authentication (PTA)

Entra ID sends the credentials to an on-prem software agent to be authenticated by AD DS 

image.png

image.png

Federated Authentication

Federated Authentication - Entra ID redirects the client's authentication request to another identity provider

image.png

image.png

Group Policy

Group Policy

Policies are filtered down:

image.png

 

Hyper-V