Course Outline
Module 1: Windows Server Security for Government
This module provides an overview of securing an Active Directory environment by implementing least privilege principles and placing user accounts in the Protected Users group. It covers methods to limit authentication scope and address potentially insecure accounts. The module also discusses hardening the security configuration of a Windows Server operating system environment, using Windows Server Update Services for deploying updates, and securing Windows Server DNS to protect the network name resolution infrastructure.
Lessons
- Secure Windows Server User Accounts
- Hardening Windows Server Security Configuration
- Windows Server Update Management
- Securing Windows Server DNS
Lab: Configuring Security in Windows Server for Government
- Configuring Windows Defender Credential Guard
- Locating Problematic Accounts
- Implementing LAPS (Local Administrator Password Solution)
After completing this module, students will be able to:
- Diagnose and remediate potential security vulnerabilities in Windows Server resources.
- Harden the security configuration of the Windows Server operating system environment.
- Deploy operating system updates to computers on a network using Windows Server Update Services.
- Secure Windows Server DNS to help protect the network name resolution infrastructure.
- Implement DNS policies.
Module 2: Implementing Security Solutions in Hybrid Scenarios for Government
This module describes how to secure on-premises Windows Server resources and Azure IaaS workloads. It covers improving network security for Windows Server infrastructure as a service (IaaS) VMs, diagnosing network security issues, using Azure Security Center to onboard Windows Server computers, enabling Azure Update Management, deploying updates, reviewing update assessments, and managing updates for Azure VMs. The module also explains the use of Adaptive application controls and BitLocker disk encryption to protect Windows Server IaaS VMs, as well as monitoring changes in files, the registry, and application software.
Lessons
- Implement Network Security for Windows Server IaaS VMs
- Audit the Security of Windows Server IaaS Virtual Machines
- Manage Azure Updates
- Create and Implement Application Allowlists with Adaptive Application Control
- Configure BitLocker Disk Encryption for Windows IaaS Virtual Machines
- Implement Change Tracking and File Integrity Monitoring for Windows Server IaaS VMs
Lab: Using Azure Security Center in Hybrid Scenarios for Government
- Provisioning Azure VMs Running Windows Server
- Configuring Azure Security Center
- Onboarding On-Premises Windows Server into Azure Security Center
- Verifying the Hybrid Capabilities of Azure Security Center
- Configuring Windows Server Security in Azure VMs
After completing this module, students will be able to:
- Diagnose network security issues in Windows Server IaaS virtual machines.
- Onboard Windows Server computers to Azure Security Center.
- Deploy and manage updates for Azure VMs by enabling Azure Automation Update Management.
- Implement Adaptive application controls to protect Windows Server IaaS VMs.
- Configure Azure Disk Encryption for Windows IaaS VMs.
- Back up and recover encrypted data.
- Monitor Windows Server Azure IaaS VMs for changes in files and the registry.
Module 3: Implementing High Availability for Government
This module describes technologies and options to create a highly available Windows Server environment. It introduces Clustered Shared Volumes for shared storage access across multiple cluster nodes, failover clustering, stretch clusters, and cluster sets for implementing high availability of Windows Server workloads. The module also discusses high availability provisions for Hyper-V and Windows Server VMs, such as network load balancing, live migration, and storage migration. Additionally, it covers high availability options for shares hosted on Windows Server file servers and explains how to implement scaling for virtual machine scale sets and load-balanced VMs, as well as Azure Site Recovery.
Lessons
- Introduction to Cluster Shared Volumes
- Implement Windows Server Failover Clustering
- Implement High Availability of Windows Server VMs
- Implement Windows Server File Server High Availability
- Implement Scaling and High Availability with Windows Server VMs
Lab: Implementing Failover Clustering for Government
- Configuring iSCSI Storage
- Configuring a Failover Cluster
- Deploying and Configuring a Highly Available File Server
- Validating the Deployment of the Highly Available File Server
After completing this module, students will be able to:
- Implement highly available storage volumes using Clustered Shared Volumes.
- Implement highly available Windows Server workloads using failover clustering.
- Describe Hyper-V VMs load balancing.
- Implement Hyper-V VMs live migration and Hyper-V VMs storage migration.
- Describe Windows Server File Server high availability options.
- Implement scaling for virtual machine scale sets and load-balanced VMs.
- Implement Azure Site Recovery.
Module 4: Disaster Recovery in Windows Server for Government
This module introduces Hyper-V Replica as a business continuity and disaster recovery solution for a virtual environment. It discusses Hyper-V Replica scenarios, use cases, and prerequisites. The module also covers implementing Azure Site Recovery in on-premises scenarios to recover from disasters.
Lessons
- Implement Hyper-V Replica
- Protect On-Premises Infrastructure from Disasters with Azure Site Recovery
Lab: Implementing Hyper-V Replica and Windows Server Backup for Government
- Implementing Hyper-V Replica
- Implementing Backup and Restore with Windows Server Backup
After completing this module, students will be able to:
- Describe Hyper-V Replica, prerequisites for its use, and its high-level architecture and components.
- Describe Hyper-V Replica use cases and security considerations.
- Configure Hyper-V Replica settings, health monitoring, and failover options.
- Describe extended replication.
- Replicate, failover, and failback virtual machines and physical servers with Azure Site Recovery.
Module 5: Implementing Recovery Services in Hybrid Scenarios for Government
This module covers tools and technologies for implementing disaster recovery in hybrid scenarios. It begins with Azure Backup as a service to protect files and folders, highlights how to implement Recovery Vaults and Azure Backup Policies, and describes recovering Windows IaaS virtual machines, performing backup and restore of on-premises workloads, and managing Azure VM backups. The module also covers providing disaster recovery for Azure infrastructure by managing and orchestrating replication, failover, and failback of Azure virtual machines with Azure Site Recovery.
Lessons
- Implement Hybrid Backup and Recovery with Windows Server IaaS
- Protect Your Azure Infrastructure with Azure Site Recovery
- Protect Your Virtual Machines Using Azure Backup
Lab: Implementing Azure-Based Recovery Services for Government
- Implementing the Lab Environment
- Creating and Configuring an Azure Site Recovery Vault
- Implementing Hyper-V VM Protection Using Azure Site Recovery Vault
- Implementing Azure Backup
After completing this module, students will be able to:
- Recover Windows Server IaaS virtual machines using Azure Backup.
- Use Azure Backup to protect data for on-premises servers and virtualized workloads.
- Implement Recovery Vaults and Azure Backup policies.
- Protect Azure VMs with Azure Site Recovery.
- Run a disaster recovery drill to validate protection.
- Failover and failback Azure virtual machines.
Module 6: Upgrade and Migrate in Windows Server for Government
This module discusses approaches to migrating and updating Windows Server workloads running in earlier versions of Windows Server. It covers strategies for moving domain controllers to Windows Server 2022, using the Active Directory Migration Tool (ADMT) to consolidate domains within a forest or migrate domains to a new AD DS forest, and using Storage Migration Service to migrate files and file shares from existing file servers to new servers running Windows Server 2022. The module also covers installing and using the Windows Server Migration Tools cmdlets to migrate commonly used server roles from earlier versions of Windows Server.
Lessons
- Active Directory Domain Services Migration
- Migrate File Server Workloads Using Storage Migration Service
- Migrate Windows Server Roles
Lab: Migrating Windows Server Workloads to IaaS VMs for Government
- Deploying AD DS Domain Controllers in Azure
- Migrating File Server Shares Using Storage Migration Service
After completing this module, students will be able to:
- Compare upgrading an AD DS forest and migrating to a new AD DS forest.
- Describe the Active Directory Migration Tool (ADMT).
- Identify requirements and considerations for using Storage Migration Service.
- Describe how to migrate a server with storage migration.
- Use the Windows Server Migration Tools to migrate specific Windows Server roles.
Module 7: Implementing Migration in Hybrid Scenarios for Government
This module discusses approaches to migrating workloads running in Windows Server to an infrastructure as a service (IaaS) virtual machine. It introduces using Azure Migrate to assess and migrate on-premises Windows Server instances to Microsoft Azure, covers how to migrate a workload running in Windows Server to an IaaS virtual machine (VM) and to Windows Server 2022 using Windows Server migration tools or the Storage Migration Service, and describes how to use the Azure Migrate App Containerization tool to containerize and migrate ASP.NET applications to Azure App Service.
Lessons
- Migrate On-Premises Windows Server Instances to Azure IaaS Virtual Machines
- Upgrade and Migrate Windows Server IaaS Virtual Machines
- Containerize and Migrate ASP.NET Applications to Azure App Service
Lab: Migrating On-Premises VMs Servers to IaaS VMs for Government
- Implementing Assessment and Discovery of Hyper-V VMs Using Azure Migrate
- Implementing Migration of Hyper-V Workloads Using Azure Migrate
After completing this module, students will be able to:
- Plan a migration strategy and choose the appropriate migration tools.
- Perform server assessment and discovery using Azure Migrate.
- Migrate Windows Server workloads to Azure VM workloads using Azure Migrate.
- Explain how to migrate workloads using Windows Server Migration tools.
- Migrate file servers using the Storage Migration Service.
- Discover and containerize ASP.NET applications running on Windows.
- Migrate a containerized application to Azure App Service.
Module 8: Server and Performance Monitoring in Windows Server for Government
This module introduces a range of tools to monitor the operating system and applications on a Windows Server computer, as well as how to configure a system to optimize efficiency and troubleshoot problems. It covers using Event Viewer to observe events, interpreting data in the event log, auditing and diagnosing a Windows Server environment for regulatory compliance, user activity, and troubleshooting, and troubleshooting AD DS service failures or degraded performance, including recovery of deleted objects and the AD DS database, and hybrid authentication issues.
Lessons
- Monitor Windows Server Performance
- Manage and Monitor Windows Server Event Logs
- Implement Windows Server Auditing and Diagnostics
- Troubleshoot Active Directory
Lab: Monitoring and Troubleshooting Windows Server for Government
- Establishing a Performance Baseline
- Identifying the Source of a Performance Problem
- Viewing and Configuring Centralized Event Logs
After completing this module, students will be able to:
- Explain the fundamentals of server performance tuning.
- Use built-in tools in Windows Server to monitor server performance.
- Use Server Manager and Windows Admin Center to review event logs.
- Implement custom views.
- Configure an event subscription.
- Audit Windows Server events.
- Configure Windows Server to record diagnostic information.
- Recover the AD DS database and objects in AD DS.
- Troubleshoot AD DS replication.
- Troubleshoot hybrid authentication issues.
Module 9: Implementing Operational Monitoring in Hybrid Scenarios for Government
This module covers using monitoring and troubleshooting tools, processes, and best practices to streamline app performance and availability of Windows Server IaaS VMs and hybrid instances. It describes how to implement Azure Monitor for IaaS VMs in Azure, use dependency maps, enable diagnostics to get data about a VM, view VM metrics in Azure Metrics Explorer, create a metric alert to monitor VM performance, and use Azure Monitor VM Insights to monitor VM performance. The module also covers troubleshooting on-premises and hybrid network connectivity, diagnosing common issues with DHCP, name resolution, IP configuration, and routing, as well as resolving issues with VM startup, extensions, performance, storage, and encryption.
Lessons
- Monitor Windows Server IaaS Virtual Machines and Hybrid Instances
- Monitor the Health of Your Azure Virtual Machines Using Azure Metrics Explorer and Metric Alerts
- Monitor Performance of Virtual Machines Using Azure Monitor VM Insights
- Troubleshoot On-Premises and Hybrid Networking
- Troubleshoot Windows Server Virtual Machines in Azure
Lab: Monitoring and Troubleshooting of IaaS VMs Running Windows Server for Government
- Enabling Azure Monitor for Virtual Machines
- Setting Up a VM with Boot Diagnostics
- Setting Up a Log Analytics Workspace and Azure Monitor VM Insights
After completing this module, students will be able to:
- Implement Azure Monitor for IaaS VMs in Azure and on-premises environments.
- View VM metrics in Azure Metrics Explorer.
- Use monitoring data to diagnose problems.
- Evaluate Azure Monitor Logs and configure Azure Monitor VM Insights.
- Configure a Log Analytics workspace.
- Troubleshoot on-premises connectivity and hybrid network connectivity.
- Troubleshoot AD DS service failures or degraded performance.
- Recover deleted security objects and the AD DS database.
- Troubleshoot hybrid authentication issues.
Requirements
Before attending this course, participants must have:
- Experience managing the Windows Server operating system and related workloads in on-premises environments, including Active Directory Domain Services (AD DS), DNS, Distributed File System (DFS), Hyper-V, and File and Storage Services.
- Familiarity with common Windows Server management tools, as implied by the first prerequisite.
- Basic knowledge of core Microsoft compute, storage, networking, and virtualization technologies, also implied by the first prerequisite.
- Experience and understanding of essential networking technologies such as IP addressing, name resolution, and Dynamic Host Configuration Protocol (DHCP).
- Experience with and an understanding of Microsoft Hyper-V and fundamental server virtualization concepts.
- Awareness of basic security best practices.
- Basic understanding of security-related technologies, including firewalls, encryption, multi-factor authentication, and Security Information and Event Management (SIEM)/Security Orchestration, Automation, and Response (SOAR).
- Basic knowledge of on-premises resiliency Windows Server-based compute and storage technologies, such as Failover Clustering and Storage Spaces.
- Basic experience implementing and managing Infrastructure as a Service (IaaS) services in Microsoft Azure.
- Basic understanding of Azure Active Directory.
- Hands-on experience with Windows client operating systems, such as Windows 10 or Windows 11.
- Basic proficiency with Windows PowerShell.
Participants should also have an understanding of the following concepts as they relate to Windows Server technologies:
- High availability and disaster recovery strategies for government environments.
- Automation techniques for efficient management.
- Monitoring practices to ensure system health and performance.
- Troubleshooting methods to resolve issues effectively.