ENT Windows Server 2025

Knowledge Content

• Overview of Windows Server 2025
• The role of Windows Server in enterprise environments
• Standard and Datacenter Editions
• Desktop Experience and Server Core
• Server Roles, Role Services, and Features
• Enterprise Windows Server infrastructure architecture
• Virtualization fundamentals
• VMware Workstation Pro architecture
• Naming conventions and IP address planning
• Enterprise lab topology

Key Hands-on Labs

• Build the VMware Workstation Pro lab environment.
• Configure Custom VMnet networks.
• Create Windows Server and Windows Client virtual machines.
• Allocate CPU, memory, VMDK storage, and virtual network adapters.
• Configure VMware snapshots, clones, and lab-recovery procedures.
• Design and document the initial enterprise topology.

Knowledge Content

• Hardware and virtual-machine requirements
• Windows Server 2025 installation
• Initial server configuration
• Server Manager, MMC, and RSAT
• Roles, Features, and Services
• Server Build Standards
• Golden Images and Sysprep
• Post-deployment validation
• Remote administration of Server Core fundamentals

Key Hands-on Labs

• Install Windows Server 2025 Desktop Experience.
• Configure hostname, IP address, time zone, DNS, and updates.
• Install and manage Roles, Features, and Services.
• Develop a Server Build Standard.
• Create a Golden Image using Sysprep.
• Deploy new servers using VMware Full Clones.
• Perform Server Acceptance Validation.

Knowledge Content

• Local users and groups
• Password and Account Lockout Policies
• Local Security Policy
• User Rights Assignment
• NTFS permissions
• Share permissions
• Ownership and inheritance
• Effective Access
• Permission auditing

Key Hands-on Labs

• Create and manage local users and groups.
• Configure Password and Account Lockout Policies.
• Design a departmental folder structure.
• Configure NTFS and Share permissions.
• Assign permissions through security groups.
• Validate ownership, inheritance, and Effective Access.
• Troubleshoot Access Denied and permission conflicts.

Knowledge Content

• MBR and GPT
• Partitions and volumes
• NTFS and ReFS
• Mount points
• Storage Spaces
• Thin and Fixed Provisioning
• Data Deduplication
• BitLocker
• iSCSI Target and Initiator
• Multipath I/O – MPIO

Key Hands-on Labs

• Manage disks, partitions, and volumes.
• Format volumes using NTFS and ReFS.
• Extend storage capacity.
• Deploy Mirror and Parity Storage Spaces.
• Deploy iSCSI Target and Initiator services.
• Configure multiple storage paths and MPIO.
• Simulate disk and storage-path failures.
• Encrypt data volumes using BitLocker.

Knowledge Content

• IPv4 and IPv6
• Subnets, gateways, and DNS clients
• Routing tables
• NIC Teaming
• VLAN and network-segmentation fundamentals
• VMware Custom VMnet networks
• Windows Server routing
• Network Address Translation – NAT
• Windows Defender Firewall
• Network Quality of Service – QoS
• Packet analysis and troubleshooting

Key Hands-on Labs

• Configure IPv4 and IPv6.
• Analyze and modify routing tables.
• Configure NIC Teaming and adapter failover.
• Simulate VLAN segmentation using VMware Custom VMnets.
• Build a Windows Server router.
• Configure routing and NAT.
• Configure Windows Defender Firewall.
• Analyze traffic using Wireshark and pktmon.
• Troubleshoot IP, routing, DNS client, MTU, VMnet, and firewall issues.

Knowledge Content

• SMB File Services
• Shared folders
• NTFS and Share permission integration
• Access-Based Enumeration
• File Server Resource Manager – FSRM
• Quotas and File Screening
• File classification
• File Management Tasks
• Shadow Copies
• Work Folders
• File-access auditing

Key Hands-on Labs

• Deploy FILE01.
• Build departmental data structures.
• Configure SMB shares and Access-Based Enumeration.
• Implement Hard and Soft Quotas.
• Configure File Screening.
• Automate data classification, movement, and expiration.
• Configure Shadow Copies and Previous Versions.
• Deploy Work Folders.
• Audit file-access activities.
• Troubleshoot File Services and permissions.

Knowledge Content

• Windows Admin Center architecture
• Windows Admin Center Gateway
• Server Manager and RSAT
• Windows Remote Management – WinRM
• WS-Management
• PowerShell Remoting
• OpenSSH
• HTTPS remote management
• Kerberos delegation and Double-Hop
• Just Enough Administration fundamentals

Key Hands-on Labs

• Install Windows Admin Center on MGMT01.
• Centrally manage multiple Windows Servers.
• Manage networking, storage, certificates, events, and updates.
• Configure WinRM and PowerShell Remoting.
• Configure PowerShell Remoting over HTTPS.
• Deploy OpenSSH Server.
• Examine and test a basic JEA endpoint.
• Troubleshoot WinRM, SPNs, firewall rules, certificates, and Double-Hop.

Knowledge Content

• Cmdlets, Help System, and Modules
• Objects and pipelines
• Variables, conditions, and loops
• Functions and parameters
• File and service administration
• Bulk administration
• PowerShell Remoting
• Error handling
• Logging and reporting
• Scheduled automation

Key Hands-on Labs

• Manage services, processes, files, and storage.
• Create local users in bulk from CSV data.
• Collect server, storage, and network information.
• Develop a Server Inventory Script.
• Add error handling and operational logging.
• Export Server Health Reports to CSV and HTML.
• Automate baseline server configuration.
• Schedule administrative scripts.

Knowledge Content

• Event Viewer
• Windows Event Logs
• Resource Monitor
• Performance Monitor
• Performance Counters
• Data Collector Sets
• Task Scheduler
• Performance baselines
• Capacity planning
• System maintenance

Key Hands-on Labs

• Analyze Application, System, and Security logs.
• Create Custom Event Views.
• Build server-performance baselines.
• Create Data Collector Sets.
• Simulate CPU, memory, disk, and network bottlenecks.
• Analyze and optimize server performance.
• Develop a Server Maintenance Plan.
• Prepare a Performance Analysis Report.

Knowledge Content

• Microsoft Security Baselines
• Microsoft Defender Antivirus
• Windows Defender Firewall
• BitLocker
• Advanced Audit Policy
• AppLocker
• TPM and Secure Boot
• Privileged-access fundamentals
• Patch-management fundamentals
• Server hardening

Key Hands-on Labs

• Perform an initial Security Assessment.
• Back up the server configuration before hardening.
• Apply an approved Microsoft Security Baseline.
• Configure Microsoft Defender Antivirus and Firewall.
• Deploy Advanced Audit Policy.
• Implement application control using AppLocker.
• Verify virtual TPM, Secure Boot, and BitLocker where supported.
• Validate business services after hardening.
• Compare the security posture before and after implementation.

Knowledge Content

• Windows Server Backup
• File and volume backup
• System State backup
• Bare-Metal Recovery
• Windows Recovery Environment
• RPO and RTO fundamentals
• Structured troubleshooting
• Fault isolation
• Root Cause Analysis
• Incident documentation

Key Hands-on Labs

• Back up files, volumes, and System State.
• Configure a backup schedule.
• Restore deleted or modified data.
• Perform Bare-Metal Recovery in VMware Workstation Pro.
• Simulate startup and service failures.
• Simulate storage and network failures.
• Perform fault isolation and Root Cause Analysis.
• Prepare Incident and Recovery Reports.

Capstone Scope

Learners integrate Modules 1–11 to:

• Analyze standalone server requirements.
• Design networking, storage, and permissions.
• Install and standardize Windows Server 2025.
• Deploy File Server and FSRM services.
• Administer servers through Windows Admin Center.
• Automate administration using PowerShell.
• Perform security hardening.
• Configure monitoring, backup, and recovery.
• Complete a blind troubleshooting challenge.
• Perform Root Cause Analysis.
• Complete the As-Built Documentation.
• Present and formally hand over the Local Server Project.

Knowledge Content

• Forests, trees, and domains
• Domain Controllers
• Schema and Global Catalog
• Active Directory database and SYSVOL
• Forest and Domain Functional Levels
• Windows Server 2025 Functional Level
• DNS namespaces
• Active Directory–integrated DNS
• Secure Dynamic Updates
• Forwarders and Conditional Forwarders
• Delegation, Aging, and Scavenging
• DNS Policies and Split-Brain DNS
• DNS security and troubleshooting

Key Hands-on Labs

• Design the forest, domain, and DNS namespace.
• Deploy DC01.
• Validate NTDS.dit, SYSVOL, DNS, and Global Catalog.
• Join servers and clients to the domain.
• Create Forward and Reverse Lookup Zones.
• Configure Secure Dynamic Updates.
• Configure Forwarders, Delegation, Aging, and Scavenging.
• Implement DNS Policies and Split-Brain DNS.
• Verify Schema and Functional Levels.
• Troubleshoot DNS and domain-logon failures.

Knowledge Content

• Organizational Units
• Domain users, groups, and computers
• Group types and scopes
• AGDLP and AGUDLP
• Delegation of Control
• Managed Service Accounts
• Group Managed Service Accounts – gMSAs
• Delegated Managed Service Accounts – dMSAs
• Identity lifecycle management

Key Hands-on Labs

• Design the OU structure based on the enterprise organization.
• Create domain users and computers from CSV data.
• Implement AGDLP and AGUDLP.
• Migrate FILE01 permissions to domain security groups.
• Configure Delegation of Control.
• Deploy gMSAs.
• Migrate a traditional service account to a dMSA.
• Troubleshoot service logon and SPN issues.

Knowledge Content

• Kerberos and NTLM
• Kerberos tickets
• Service Principal Names
• Fine-Grained Password Policies
• Protected Users
• Kerberos Constrained Delegation
• Resource-Based Constrained Delegation
• Authentication Policies and Silos
• LDAP Signing
• LDAP Channel Binding
• LDAPS and TLS
• Authentication auditing

Key Hands-on Labs

• Analyze domain authentication.
• Examine Kerberos tickets.
• Configure and troubleshoot SPNs.
• Implement Fine-Grained Password Policies.
• Configure Protected Users.
• Implement constrained and resource-based delegation.
• Configure Authentication Policies and Silos.
• Deploy LDAP Signing and Channel Binding.
• Prepare and complete trusted LDAPS after PKI deployment.
• Audit NTLM usage and authentication failures.

Knowledge Content

• Group Policy architecture
• GPO processing
• Scope, inheritance, and enforcement
• Administrative Templates
• Central Store
• Group Policy Preferences
• Security Policies
• Scripts and software deployment
• Security and WMI Filtering
• Loopback Processing
• GPO backup, restore, and migration
• Group Policy troubleshooting

Key Hands-on Labs

• Develop a GPO linking strategy.
• Deploy desktop and security policies.
• Build the Group Policy Central Store.
• Configure Group Policy Preferences.
• Deploy logon, startup, and PowerShell scripts.
• Deploy MSI applications.
• Configure Security and WMI Filtering.
• Deploy Windows Defender Firewall rules through GPO.
• Deploy Windows LAPS through GPO.
• Back up, restore, and recover GPOs.
• Analyze slow logon and GPO processing.

Knowledge Content

• DHCP architecture
• Scopes, Superscopes, and reservations
• DHCP options and policies
• Vendor Classes and User Classes
• DHCP Relay
• DHCP Failover
• DNS integration
• IP Address Management – IPAM
• DHCP security

Key Hands-on Labs

• Deploy DHCP01 and DHCP02.
• Create scopes, reservations, exclusions, and options.
• Integrate DHCP with Secure Dynamic DNS.
• Configure DHCP Policies.
• Deploy the DHCP Relay Agent.
• Configure DHCP Failover.
• Deploy IPAM01.
• Centrally manage DNS, DHCP, and IP address spaces.
• Detect IP conflicts and Rogue DHCP services.
• Back up, restore, and troubleshoot DHCP.

Knowledge Content

• Active Directory Sites and Subnets
• Site Links
• Intrasite and intersite replication
• Additional Domain Controllers
• Read-Only Domain Controllers
• Global Catalog placement
• FSMO roles
• Domain and Forest Trusts
• Secure channels
• Windows Time Service

Key Hands-on Labs

• Deploy DC02.
• Create Sites, Subnets, and Site Links.
• Configure replication schedules and costs.
• Deploy BR-DC01 as an RODC.
• Configure Password Replication Policy.
• Monitor and troubleshoot replication.
• Perform FSMO role transfer.
• Perform an isolated FSMO seizure exercise.
• Deploy a second forest and configure a Forest Trust.
• Configure the enterprise time hierarchy.
• Troubleshoot trusts, secure channels, and time skew.

Knowledge Content

• Active Directory Recycle Bin
• NTDS.dit and SYSVOL
• Directory Services Restore Mode
• Active Directory snapshots
• Replication metadata
• Metadata Cleanup
• System State backup
• Authoritative Restore
• Non-Authoritative Restore
• SYSVOL recovery
• Forest Recovery

Key Hands-on Labs

• Enable Active Directory Recycle Bin.
• Back up a Domain Controller.
• Restore deleted Active Directory objects.
• Create and examine an Active Directory snapshot.
• Perform Domain Controller Metadata Cleanup.
• Perform Non-Authoritative Restore.
• Perform Authoritative Restore.
• Recover SYSVOL.
• Recover a Domain Controller from System State.
• Perform an isolated Forest-Recovery Scenario.
• Develop an Active Directory Recovery Runbook.

Knowledge Content

• Advanced SMB
• SMB Signing and Encryption
• SMB Compression and Multichannel
• DFS Namespace
• DFS Replication
• Branch File Services
• User and device claims
• Resource Properties
• Central Access Rules
• Central Access Policies
• Information governance

Key Hands-on Labs

• Complete the domain integration of FILE01.
• Harden SMB services.
• Deploy FILE02.
• Build a Domain-Based DFS Namespace.
• Configure Folder Targets.
• Deploy DFS Replication.
• Extend File Services to the Branch Office.
• Configure claims and Resource Properties.
• Deploy Central Access Policies.
• Configure Access-Denied Assistance.
• Troubleshoot DFS, SMB, permissions, and data access.

Knowledge Content

• Enterprise PKI architecture
• Offline Root CA
• Enterprise Subordinate CA
• Certificate Templates
• Auto-Enrollment
• AIA and CRL Distribution Points
• CRL and OCSP
• Key archival and recovery
• Certificate lifecycle
• PKI security, backup, and recovery

Key Hands-on Labs

• Design a two-tier PKI.
• Deploy the offline Root CA ROOTCA01.
• Deploy the Enterprise Subordinate CA CA01.
• Configure AIA and CRL Distribution Points.
• Create Certificate Templates.
• Deploy Auto-Enrollment.
• Issue certificates to users, computers, servers, and Domain Controllers.
• Complete trusted LDAPS deployment.
• Deploy an Online Responder for OCSP.
• Configure key archival and recovery.
• Back up, restore, and harden the enterprise CA.

Knowledge Content

• IIS architecture
• Websites and Application Pools
• HTTP and HTTPS
• Authentication and authorization
• FTP and FTPS
• URL Rewrite and Reverse Proxy
• IIS Web Farms
• Network Load Balancing
• Claims-based authentication
• Active Directory Federation Services
• Relying Party Trusts
• Web Application Proxy
• Application publishing

Key Hands-on Labs

• Deploy WEB01.
• Configure website DNS records.
• Issue HTTPS certificates from CA01.
• Configure IIS websites, Application Pools, bindings, and authentication.
• Deploy FTP and FTPS.
• Deploy WEB02 and build an IIS Web Farm.
• Configure Shared Configuration.
• Deploy a Reverse Proxy.
• Configure Network Load Balancing.
• Deploy ADFS01.
• Configure a Relying Party Trust and Claims Rules.
• Deploy WAP01.
• Publish applications using Pass-through Authentication.
• Publish applications using AD FS Pre-Authentication.
• Troubleshoot IIS, proxy, claims, DNS, and certificate issues.

Knowledge Content

• Routing and Remote Access Service – RRAS
• Routing and NAT
• Remote-Access VPN
• Site-to-Site VPN
• SSTP, IKEv2, and L2TP/IPsec
• Network Policy Server – NPS
• RADIUS
• Certificate-based authentication
• Always On VPN fundamentals
• VPN security

Key Hands-on Labs

• Deploy VPN01.
• Configure RRAS routing and NAT.
• Deploy a Remote-Access VPN.
• Deploy a Site-to-Site VPN to the Branch Office.
• Configure NPS as a RADIUS Server.
• Create Connection Request and Network Policies.
• Integrate VPN services with NPS.
• Deploy certificate-based VPN authentication.
• Configure RADIUS Accounting.
• Examine Always On VPN architecture.
• Troubleshoot VPN tunnels, RADIUS, routing, NPS, and certificates.

Knowledge Content

• RDS architecture
• RD Session Host
• RD Connection Broker
• RD Web Access
• RD Gateway
• RemoteApp
• RDS Collections
• User Profiles
• RDS Farms
• Session load balancing
• High availability fundamentals
• RDS security

Key Hands-on Labs

• Deploy an RDS Session-Based environment.
• Configure RD Session Host and Connection Broker.
• Deploy RD Web Access and RemoteApp.
• Configure RD Gateway.
• Issue and assign certificates to RDS roles.
• Create and manage RDS Collections.
• Configure centralized user profiles.
• Build a multi-Session Host RDS Farm.
• Configure Session Load Balancing.
• Simulate a Session Host failure.
• Harden and troubleshoot RDS.

Knowledge Content

• Answer files
• Windows Deployment Services
• PXE deployment
• Boot and Install Images
• Drivers and Custom Images
• Server Migration
• Storage Migration Service
• Windows Server Update Services
• Update Deployment Rings
• Patch compliance
• KMS
• Active Directory–Based Activation

Key Hands-on Labs

• Create an unattended installation Answer File.
• Deploy WDS.
• Configure PXE deployment on VMware Workstation Pro.
• Manage Boot Images, Install Images, and drivers.
• Capture and deploy a Custom Image.
• Migrate a File Server.
• Migrate DNS or DHCP services.
• Deploy WSUS.
• Configure WSUS clients through Group Policy.
• Build Pilot and Production Update Rings.
• Simulate an update failure and rollback.
• Examine KMS and Active Directory–Based Activation.
• Perform activation only where valid volume-license keys are available.
• Prepare Migration and Patch Compliance Reports.

Knowledge Content

• High-availability architecture
• Single Points of Failure
• RPO and RTO
• Windows Server Failover Clustering
• Cluster Nodes and networks
• Shared iSCSI storage
• Multipath I/O
• Cluster Validation
• Quorum and Witness
• Clustered roles
• Highly Available File Services
• Cluster-Aware Updating
• Planned and unplanned failover
• Storage Spaces Direct and Storage Replica fundamentals

Key Hands-on Labs

• Deploy CLNODE01 and CLNODE02 on VMware Workstation Pro.
• Design Management, Client Access, Cluster, and Storage networks.
• Connect the nodes to shared iSCSI storage on STOR01.
• Configure redundant storage paths and MPIO.
• Perform Cluster Validation.
• Resolve validation warnings and errors.
• Build a two-node Windows Failover Cluster.
• Configure quorum and File Share Witness.
• Deploy Highly Available File Services.
• Configure clustered roles and resource dependencies.
• Integrate Cluster-Aware Updating with WSUS.
• Perform planned failover.
• Simulate node, network, witness, service, and storage-path failures.
• Perform unplanned failover and recovery.
• Validate service availability, RPO, and RTO.
• Prepare a High-Availability Test Report.

This module uses Windows Failover Clustering inside Windows Server virtual machines running on VMware Workstation Pro. It does not require Hyper-V and does not include vSphere technologies such as vMotion or VMware HA.

Knowledge Content

• Windows LAPS
• Credential Guard
• AppLocker and WDAC fundamentals
• Domain Controller hardening
• Privileged access
• Administrative Tiering
• Enterprise Access Model
• Just Enough Administration
• PowerShell automation
• Configuration compliance
• Windows Event Forwarding
• Centralized monitoring
• Structured troubleshooting
• Root Cause Analysis
• Incident and Problem Management

Key Hands-on Labs

• Complete the enterprise Windows LAPS deployment.
• Harden Domain Controllers.
• Configure Credential Guard where supported.
• Design the Administrative Tiering and Enterprise Access Model.
• Deploy a Privileged Access Workstation.
• Configure Just Enough Administration.
• Automate AD, DNS, DHCP, File Services, IIS, and Failover Cluster administration.
• Perform configuration-compliance checks.
• Deploy MON01 as the Windows Event Collector.
• Configure Windows Event Forwarding.
• Collect logs from Domain Controllers, DNS, DHCP, IIS, VPN, RDS, PKI, File Servers, and Cluster Nodes.
• Build an Enterprise Service Health Dashboard.
• Complete blind and multi-service troubleshooting challenges.
• Prepare Root Cause Analysis and Problem Reports.
• Conduct a Post-Incident Review.

Learners complete the project independently before the final review session.

Capstone Scope

• Analyze enterprise business and technical requirements.
• Design the VMware Workstation Pro lab infrastructure.
• Design the forest, domain, OUs, Sites, and Subnets.
• Deploy Domain Controllers and enterprise DNS.
• Deploy DHCP, DHCP Failover, and IPAM.
• Manage identities, Group Policy, delegation, and Windows LAPS.
• Deploy File Services, DFS, FSRM, and Dynamic Access Control.
• Deploy the two-tier enterprise PKI.
• Deploy IIS, AD FS, Reverse Proxy, and Web Application Proxy.
• Deploy VPN, NPS, and RADIUS.
• Deploy Remote Desktop Services.
• Deploy WDS, WSUS, and deployment automation.
• Design volume-activation architecture.
• Deploy Windows Failover Clustering and Highly Available File Services.
• Administer the environment through Windows Admin Center.
• Automate administration using PowerShell.
• Perform enterprise security hardening.
• Build centralized monitoring, backup, and disaster-recovery solutions.
• Resolve intentionally injected multi-service incidents.
• Perform Root Cause Analysis.
• Complete Design and As-Built Documentation.
• Present and defend the proposed solution.
• Complete final system validation and acceptance.

Final Review Activities

• Architecture and solution presentation
• Technical review of all core enterprise services
• Security, monitoring, backup, and recovery validation
• Live blind troubleshooting challenge
• Fault isolation and Root Cause explanation
• Design and As-Built Documentation review
• Technical defense
• Project assessment and formal acceptance