What should I review for my interview?
Which topics came up most in these interviews?
Microsoft Entra ID and hybrid identity appeared in 32 of 100 interviews. Windows Server administration appeared in 29 of 100 interviews. Review these alongside Active Directory itself.
- Can you explain hybrid synchronization, Conditional Access, MFA and SSO?
- Can you describe how you would troubleshoot Windows services, networking and certificates?
- Can you explain domains, forests, OUs and groups, then describe how you would investigate a logon problem or account lockout?
Which individual questions should I answer first?
The AD definition and managed objects question and the Entra Conditional Access setup question were the most asked. Each appeared in 4 of 100 interviews. FSMO roles came next.
For AD, can you say what it is and name the kinds of objects you manage? For Conditional Access, can you explain how you would set up policies to control access? For FSMO, can you name the roles and explain what they do? Check each part of the question, not just the opening definition.
Can I explain troubleshooting and recovery?
The recorded questions include replication failures and the difference between authoritative and non-authoritative restore. Use them to check these points:
- Which tools and commands would you use to investigate replication failures?
- Can you explain how the restore types differ?
- For a Group Policy problem, can you discuss processing order, OU placement and filtering?
Group Policy questions also cover ADMX templates and application restrictions. Can you explain those as well as how to create a GPO?
Can I explain authentication and security work?
Can you walk through Kerberos authentication, including its components and the steps leading to service access? Check whether you can also explain a pass-the-ticket attack, Kerberoasting and how to remediate Kerberoasting.
For AD CS, can you discuss its components, design, management and operational challenges? These recorded questions ask for more than a definition of the technology.
Should I check my PowerShell skills?
A code-writing task appeared in 1 of 100 interviews. Can you complete the recorded tasks?
- Find all disabled AD users who have not logged in within the past 90 days.
- Write a PowerShell script to check whether a specific Windows update is installed across a list of servers.
Who gets asked Active Directory and Windows Server
The 20 most asked Active Directory and Windows Server questions
Counted by interview, not by mention: a question asked twice in one conversation counts once.
What is Active Directory, and what kinds of objects can you manage in it?
Asked in 4 of 100 interviews · last asked Oct 8 · Concept · Junior
Show answer
Active Directory is Microsoft’s directory service for Windows domain networks. Active Directory Domain Services (AD DS) stores and manages objects such as users, computers, groups, printers, and organizational units (OUs). It checks user identities, helps control access to resources, and supports central management through Group Policy.
- Domain controllers run AD DS and store copies of the directory.
- Groups help administrators assign access permissions to many users at once.
- OUs organize objects and support delegated administration and Group Policy.
What the interviewer checks: The interviewer is checking whether you understand AD’s purpose, common objects, and role in central administration.
Other ways it was asked
- “What is Active Directory?”
- “What is Active Directory, and what are its main functions?”
- “Can you explain what Active Directory is and what kinds of objects you can manage in it?”
How would you set up Microsoft Entra Conditional Access policies to control access?
Asked in 4 of 100 interviews · last asked Oct 21 · Tooling · Mid-level
Show answer
I would create Conditional Access policies in Microsoft Entra to control who can access which resources and under what conditions. I would select users, resources, and conditions, then require MFA, a compliant device, or block access. I would test with report-only mode and the What If tool before enabling policies for a pilot group.
- Users need Entra ID P1 or an included entitlement; risk-based policies need P2.
- Exclude emergency access accounts from restrictive policies and monitor their use.
- Intune configuration policies apply settings; compliance policies assess devices; Conditional Access can require device compliance.
- Check sign-in logs for policy results and failures; use audit logs to track policy changes.
What the interviewer checks: The interviewer checks whether you can choose access controls, deploy them safely, and troubleshoot and audit access decisions.
Other ways it was asked
- “How do you configure conditional access policies in Entra?”
- “How do you use conditional access policies in Microsoft Entra, including troubleshooting and auditing them?”
- “How do you use Conditional Access policies in Microsoft Entra to control access?”
Can you explain the FSMO roles and what they do?
Asked in 3 of 100 interviews · last asked Aug 21 · Concept · Mid-level
Show answer
FSMO stands for Flexible Single Master Operations. These five Active Directory roles assign special tasks to one domain controller each to prevent conflicts. Schema Master and Domain Naming Master are forest-wide; RID Master, PDC Emulator, and Infrastructure Master are per-domain.
- Schema Master controls schema changes; Domain Naming Master controls adding or removing domains in the forest.
- RID Master gives domain controllers RID pools, used to create unique security identifiers for accounts and groups.
- PDC Emulator helps resolve password mismatches, handles account lockouts, and coordinates domain time.
- Infrastructure Master updates references to objects in other domains.
What the interviewer checks: The interviewer checks whether you know all five roles, their scope, and their main tasks.
Other ways it was asked
- “What are FSMO roles?”
- “What is an FSMO role in Active Directory?”
What is the difference between authoritative and non-authoritative restore?
Asked in 2 of 100 interviews · last asked Aug 21 · Concept · Mid-level
Show answer
A non-authoritative restore recovers a domain controller from backup, then receives newer Active Directory changes from other domain controllers. An authoritative restore marks selected restored objects as authoritative, so their restored state replicates to other domain controllers. Use non-authoritative restore for recovery; use authoritative restore to recover deleted or wrongly changed objects.
- Use non-authoritative restore for a failed domain controller when healthy replication partners exist.
- Use authoritative restore to recover an accidentally deleted organizational unit and its objects.
- An authoritative restore uses ntdsutil to increase restored objects’ version numbers so they win replication conflicts.
- If Active Directory Recycle Bin is enabled, it may offer simpler recovery for deleted objects.
What the interviewer checks: The interviewer checks whether you understand which data wins during replication after each restore type.
Other ways it was asked
- “Can you give an example of when to use an authoritative restore and when to use a non-authoritative restore?”
- “What is the difference between authoritative and non-authoritative Active Directory restores?”
How would you troubleshoot Active Directory replication failures, and which tools and commands would you use?
Asked in 2 of 100 interviews · last asked Aug 21 · Scenario · Mid-level
Show answer
I start with repadmin to find failed replication links and error codes, then check domain controller health with dcdiag. I check DNS, network access, time, authentication, and replication events. After fixing the cause, I retry replication and confirm that failures clear and successful replication times update.
- Use repadmin /replsummary for an overview and /showrepl for detailed inbound replication failures.
- Check DNS records and ensure domain controllers use DNS servers that resolve the AD domain.
- Check RPC connectivity, including dynamic RPC ports; check time differences that can break Kerberos authentication.
- Review Directory Service events and site links, schedules, and connection objects in Active Directory Sites and Services.
CodeReplace DC01 and example.com with your domain controller and domain. repadmin /replsummary repadmin /showrepl DC01 dcdiag /s:DC01 /test:replications /test:dns /v nslookup -type=SRV _ldap._tcp.dc._msdcs.example.com w32tm /monitor After fixing the cause, retry and check again: repadmin /syncall DC01 /Ade repadmin /showrepl DC01What the interviewer checks: The interviewer checks whether you can use replication errors to find the root cause and verify recovery.
Other ways it was asked
- “If Active Directory replication is failing, how would you troubleshoot and resolve the issue?”
- “How do you troubleshoot Active Directory domain controller replication issues?”
- “Which commands besides repadmin would you use to troubleshoot Active Directory replication?”
What is Group Policy in Windows?
Asked in 2 of 100 interviews · last asked Aug 9 · Concept · Junior
Show answer
Group Policy is a Windows feature for managing settings for users and computers. In Active Directory, administrators use Group Policy Objects (GPOs) to apply security rules, configure Windows, and deploy software. GPOs can be linked to sites, domains, and organizational units (OUs). Local Group Policy manages settings on a single computer.
- GPOs contain separate settings for computers and users.
- Policy normally applies in this order: local, site, domain, then OU.
- Inheritance and filtering control which settings apply.
What the interviewer checks: The interviewer checks whether you understand how Group Policy centrally manages Windows settings and where GPOs apply.
Other ways it was asked
- “Can you explain what Group Policy is?”
What is a pass-the-ticket attack in Kerberos?
Asked in 2 of 100 interviews · last asked Jul 27 · Concept · Senior
Show answer
A pass-the-ticket attack uses a stolen Kerberos ticket to access services as another user, without knowing their password. An attacker can reuse a service ticket for its target service, or a ticket-granting ticket (TGT) to request service tickets. Access depends on the ticket’s validity and the user’s permissions.
- The attacker also needs the ticket’s associated session key, usually stolen with the ticket.
- A service ticket targets one service; a TGT can obtain tickets for multiple services.
- Golden Ticket and Silver Ticket attacks forge tickets rather than simply reuse stolen ones.
What the interviewer checks: The interviewer is checking whether you understand ticket reuse, ticket scope, and how it differs from ticket forgery.
Other ways it was asked
- “Can you give me examples of ticket-based attacks in Kerberos?”
Can you explain Kerberoasting and how to remediate it?
Asked in 2 of 100 interviews · last asked Sep 30 · Concept · Senior
Show answer
Kerberoasting is an attack where a domain user requests Kerberos service tickets and tries to crack them offline to recover service account passwords. The tickets are encrypted with keys derived from those passwords. Reduce the risk with group Managed Service Accounts (gMSAs), long random passwords, limited permissions, and AES instead of RC4 where supported.
- An ordinary domain account can request tickets for accounts with Service Principal Names (SPNs).
- Offline password guessing does not trigger account lockouts.
- gMSAs provide long, automatically rotated passwords; AES alone does not prevent Kerberoasting.
- Monitor unusual service ticket requests and rotate compromised passwords promptly.
What the interviewer checks: The interviewer checks whether you understand service ticket encryption, offline password attacks, and practical service account protection.
Other ways it was asked
- “What is Kerberoasting, and how does the attack work?”
Walk me through Kerberos authentication, including its components and the steps leading to service access.
Asked in 2 of 100 interviews · last asked Sep 30 · Concept · Senior
Show answer
The client asks the Key Distribution Center (KDC) for authentication. Its Authentication Service (AS) issues a ticket-granting ticket (TGT). The client presents the TGT to the Ticket-Granting Service (TGS) to get a service ticket. The target service validates that ticket and an authenticator before checking access permissions.
- Pre-authentication normally proves the client knows its secret; the password itself is not sent.
- A Service Principal Name (SPN) identifies the target service when requesting its ticket.
- Authenticators use session keys and timestamps to help prevent replay; client and server clocks must be closely synchronized.
- For mutual authentication, the service also proves its identity to the client.
What the interviewer checks: The interviewer checks whether you understand the components, ticket flow, and difference between authentication and access permissions.
Other ways it was asked
- “How does the Kerberos authentication process work, and what components are involved?”
- “Can you walk me through the full Kerberos flow from the first request to the final service access?”
How would you design and manage Microsoft AD CS, including its components and operational challenges?
Asked in 2 of 100 interviews · last asked Oct 20 · Tooling · Mid-level
Show answer
I would use an offline standalone root CA and online enterprise issuing CAs. I would configure certificate templates, enrollment permissions, autoenrollment, CRL publication, and optional OCSP. I would manage renewals, revocation, monitoring, backups, and recovery tests. The main challenges are protecting CA keys, preventing unsafe issuance, and avoiding certificate or revocation service outages.
- Keep the root CA offline; use enterprise issuing CAs for Active Directory integration and certificate templates.
- Restrict template permissions and separate administrative roles; weak settings can allow attackers to impersonate users.
- Keep revocation lists reachable and current; monitor certificate expiry, publication failures, and enrollment failures.
- Protect CA keys, consider hardware security modules, and test restoring CA databases, keys, and configuration.
What the interviewer checks: The interviewer checks whether you can design a secure PKI and keep certificate services reliable throughout their lifecycle.
Other ways it was asked
- “What tasks are involved in managing Microsoft Active Directory Certificate Services or another PKI platform?”
- “Describe a project where you designed or managed Microsoft ADCS. What components and challenges did you handle?”
How would you integrate CyberArk with Azure AD and Okta?
Asked in 2 of 100 interviews · last asked Oct 1 · Scenario · Senior
Show answer
I would integrate CyberArk PAM with Microsoft Entra ID, formerly Azure AD, or Okta using SAML SSO. I would create the application, configure CyberArk’s entity ID and reply URL, and import the identity provider’s metadata. Then I would map user identities, assign access, and test sign-in, MFA, and CyberArk permissions.
- Exact steps and support for multiple identity providers depend on the CyberArk product and version.
- SAML setup needs identity provider metadata, including its sign-in URL and signing certificate.
- The Azure tenant ID identifies the directory; it is not enough to configure SAML SSO.
- SSO handles authentication; CyberArk permissions control access to accounts and Safes.
What the interviewer checks: The interviewer checks whether you understand SAML trust, identity mapping, and the difference between sign-in and privileged access.
Other ways it was asked
- “What steps would you follow to integrate CyberArk with Azure AD?”
- “What is the main parameter required to integrate CyberArk with Azure AD?”
What is Microsoft Entra Privileged Identity Management, and how does it provide just-in-time administrative access?
Asked in 2 of 100 interviews · last asked Jun 26 · Concept · Mid-level
Show answer
Microsoft Entra Privileged Identity Management (PIM) manages privileged access to Microsoft Entra roles and Azure resources. It provides just-in-time access by letting eligible users activate an admin role for a limited time. Activation can require approval, multifactor authentication, and a reason. Access expires automatically, and PIM records role activity for review.
- Eligible users must activate a role before using its permissions.
- Activation requirements and time limits depend on the role's PIM settings.
- Temporary access reduces the risks of permanent admin rights.
- PIM supports Microsoft Entra roles and Azure resource roles.
What the interviewer checks: The interviewer is checking whether you understand eligible roles, temporary activation, and controls that protect privileged access.
Other ways it was asked
- “What is Privileged Identity Management (PIM) in Azure AD, and how is it used?”
- “What do you use in Azure to grant admin rights only when needed?”
How would you use Conditional Access and device compliance to restrict company resources to compliant devices?
Asked in 2 of 100 interviews · last asked Sep 30 · Scenario · Senior
Show answer
I would define device compliance policies in Microsoft Intune, such as requiring encryption and supported operating systems. Then I would create a Microsoft Entra Conditional Access policy for the relevant users and company resources, selecting “Require device to be marked as compliant.” Devices without a compliant status would be denied access.
- Mark devices with no assigned compliance policy as noncompliant in Intune.
- Test in report-only mode, then enable enforcement after checking sign-in logs.
- Exclude emergency access accounts from this policy, and protect and monitor them separately.
- Block legacy authentication and also require MFA; device compliance alone is not enough.
What the interviewer checks: The interviewer is checking whether you can connect Intune compliance status to access enforcement and deploy it safely.
Other ways it was asked
- “How would you ensure that only compliant devices get access to company resources?”
- “How would you use Conditional Access and device compliance together to enforce a Zero Trust posture for a remote workforce?”
How would you troubleshoot a user who cannot access a shared network folder?
Asked in 2 of 100 interviews · last asked Oct 19 · Scenario · Junior
Show answer
I would check the exact error and whether other users can access the folder. Then I would test network connectivity, name resolution, and the direct UNC path. I would verify the user’s account, group memberships, and effective share and NTFS permissions. Finally, I would check saved credentials, fix the cause, and test again as the user.
- Compare another user and another computer to narrow down the cause.
- Check that the share exists and SMB traffic can reach the server on TCP port 445.
- Both share and NTFS permissions must allow access; check inherited permissions and explicit denies.
- Use the direct UNC path to separate share access problems from mapped drive problems.
What the interviewer checks: The interviewer is checking whether you troubleshoot systematically and separate connection, sign-in, and permission problems.
Other ways it was asked
- “How would you troubleshoot a user’s inability to access a specific shared network folder?”
- “How would you follow a process to help a user who cannot access a shared folder?”
How do you patch a Windows server, from preparation through deployment?
Asked in 2 of 100 interviews · last asked Aug 20 · Tooling · Mid-level
Show answer
I check server health, update requirements, backups, and a recovery plan before scheduling a maintenance window. I test the updates on a representative nonproduction server first. I deploy approved updates through Windows Update or a central management tool, then reboot if required. Afterward, I confirm installation, check services and applications, and monitor for problems.
- Notify users and application owners about planned downtime.
- Confirm backups are recoverable; do not rely only on snapshots.
- Patch redundant servers in stages to keep services available.
- Check for failed or pending updates, review event logs, and record the results.
What the interviewer checks: The interviewer wants to see a safe, repeatable process that limits downtime and includes recovery and validation.
Other ways it was asked
- “What are the steps for patching Windows servers with Windows Update, from preparation through deployment?”
- “How do you patch a Windows operating system?”
Why are organizational units (OUs) used in Active Directory?
Asked once · last asked Sep 30 · Concept · Mid-level
Show answer
Organizational units (OUs) organize users, computers, and other objects within an Active Directory domain. They let administrators apply Group Policy to selected users and computers. They also let administrators delegate tasks, such as resetting passwords, without giving someone control of the whole domain.
- Group objects by department, location, or management needs.
- Link Group Policy Objects to OUs to manage user and computer settings.
- Delegate specific permissions over objects in an OU.
- OUs are not security groups and cannot be used to grant access to shared folders.
What the interviewer checks: The interviewer is checking whether you understand how OUs support organization, Group Policy, and delegated administration.
Can you explain the step-by-step process for unlocking an account in Active Directory?
Asked once · last asked May 6 · Tooling · Junior
Show answer
To unlock an account, first verify the user's identity and confirm the account is locked. Open Active Directory Users and Computers, find the user, and open Properties. On the Account tab, select “Unlock account,” then click Apply and OK. Ask the user to try signing in again.
- You need permission to unlock the account.
- Unlocking an account does not reset its password or enable a disabled account.
- If it locks again, check for saved old passwords, services, or scheduled tasks using wrong credentials.
What the interviewer checks: The interviewer is checking whether you can unlock an account safely and recognize why it might lock again.
What indicator in Active Directory shows that an account is locked out?
Asked once · last asked May 6 · Tooling · Junior
Show answer
The LOCKOUT flag in msDS-User-Account-Control-Computed indicates that an account is currently locked out. In PowerShell, you can check this with Get-ADUser by requesting the LockedOut property; True means locked out.
- The computed LOCKOUT flag has the value 0x10.
- A nonzero lockoutTime records a lockout, but does not always mean the account is still locked.
- Locked out and disabled are different account states.
What the interviewer checks: The interviewer is checking whether you can identify a current lockout rather than just a past lockout.
When you're managing Active Directory and user account issues, how do you approach handling a critical account lockout situation?
Asked once · last asked May 8 · Scenario · Mid-level
Show answer
I verify the user's identity and assess the impact before unlocking the account. I check domain controller security logs to find where the failed sign-ins are coming from. I fix the cause, such as saved old credentials, then unlock the account and confirm access. If I suspect an attack, I involve security and contain it first.
- Look for event 4740 on domain controllers; check the caller computer when listed.
- Check services, scheduled tasks, mobile devices, and saved credentials for old passwords.
- Reset the password if needed; unlocking alone does not fix repeated failed sign-ins.
- Monitor for another lockout, and do not weaken the lockout policy to restore access.
What the interviewer checks: The interviewer is checking whether you can restore access safely while finding and stopping the cause.
How do you manage Active Directory accounts, configure two-factor authentication, and manage Google account settings?
Asked once · last asked Jul 16 · Tooling · Mid-level
Show answer
I manage Active Directory users, groups, passwords, and account access with AD Users and Computers or PowerShell. I configure two-factor authentication through Microsoft Entra ID or a compatible provider for supported sign-ins. For Google Workspace, I use the Admin console to manage users, enforce two-step verification, and control security and sharing settings.
- Use groups to assign access, follow least privilege, and disable accounts when staff leave.
- Entra MFA does not automatically protect Windows sign-ins to on-premises Active Directory.
- Require two different factor types, such as a password and a security key.
- For personal Google accounts, manage security, recovery options, and connected apps in Google Account settings.
What the interviewer checks: The interviewer checks whether you can manage account access and understand where authentication and security policies are configured.
Active Directory basics and user management interview questions
Review domains, forests, OUs, groups and user accounts, plus domain membership, logon problems and account lockouts. 30 questions.
Which tools would you use to identify the source of an Active Directory account lockout?
Asked once · last asked Jul 16 · Tooling · Mid-level
Other ways it was asked
- “Which Windows event log would you check to troubleshoot Active Directory account lockouts?”
How would you migrate an Active Directory OU hierarchy as part of a tenant migration?
Asked once · last asked Aug 12 · Scenario · Senior
Other ways it was asked
- “How would you migrate an Active Directory OU hierarchy and Group Policy Objects from existing hybrid and on-premises systems as part of a tenant migration?”
What are Active Directory groups and forests, and how do they differ?
Asked once · last asked Aug 13 · Concept · Mid-level
How would you find all disabled Active Directory users who have not logged in within the past 90 days?
Asked once · last asked Aug 18 · Write code · Mid-level
If a client cannot join the domain, how would you troubleshoot it?
Asked once · last asked Aug 21 · Scenario · Mid-level
How can you determine whether a workstation is joined to an Active Directory domain?
Asked once · last asked Aug 24 · Scenario · Mid-level
How would you rejoin a workstation to an Active Directory domain?
Asked once · last asked Aug 24 · Scenario · Mid-level
A user cannot sign in, but Active Directory shows the account is unlocked. How would you troubleshoot the issue?
Asked once · last asked Aug 24 · Scenario · Mid-level
How would you troubleshoot a Windows laptop that takes a long time to log on for multiple users?
Asked once · last asked Aug 24 · Scenario · Mid-level
How would you join a new user's computer to an Active Directory domain?
Asked once · last asked Sep 2 · Tooling · Junior
Walk me through how you’d handle a ServiceNow ticket from a user on the 65th Floor who can’t log on to their computer at 08:00.
Asked once · last asked Sep 2 · Scenario · Mid-level
If AD and the computer account look fine, but the user can’t log on and says no domain controller is found, what’s the next step?
Asked once · last asked Sep 2 · Scenario · Mid-level
Show 12 more
What is the difference between security groups and distribution groups in Active Directory?
Asked once · last asked Sep 30 · Concept · Mid-level
In Active Directory, can you walk me through how you’d create a new user?
Asked once · last asked Oct 16 · Tooling · Mid-level
How would you configure a new laptop on a LAN and join it to a Windows domain, step by step?
Asked once · last asked Oct 19 · Tooling · Junior
What causes a Windows domain trust relationship error, and how would you resolve it?
Asked once · last asked Oct 19 · Scenario · Mid-level
What are Microsoft Azure and Active Directory, and what are they used for?
Asked once · last asked Mar 7 · Concept · Junior
What does SID stand for in Windows?
Asked once · last asked May 4 · Concept · Junior
What are the limitations of Active Directory?
Asked once · last asked Jul 16 · Concept · Mid-level
What else can Active Directory do besides manage users?
Asked once · last asked Aug 9 · Concept · Junior
What is Active Directory, and what is an Active Directory forest?
Asked once · last asked Aug 11 · Concept · Junior
What is the use of security groups in Active Directory?
Asked once · last asked Aug 18 · Concept · Junior
What is a Windows domain, and what is it used for?
Asked once · last asked Oct 19 · Concept · Junior
When troubleshooting a user's inability to access a shared folder, how would you check whether their account is locked and needs to be unlocked?
Asked once · last asked Oct 19 · Scenario · Junior
Active Directory DNS, replication and recovery interview questions
Questions cover domain controllers, FSMO roles, DNS, replication, time synchronization, backups, restores and domain controller migrations. 27 questions.
How would you configure monitoring on a Windows domain controller running DNS to log DNS queries and their results?
Asked once · last asked Aug 12 · Tooling · Mid-level
Other ways it was asked
- “How would you configure DNS query logging on a Windows domain controller for a private subnet?”
- “How would you configure DNS query logging on a Windows domain controller, and where would you find the logs?”
What can you tell me about DNS aging and scavenging?
Asked once · last asked Feb 24 · Concept · Mid-level
What is one benefit of integrating DNS with Active Directory?
Asked once · last asked Feb 24 · Concept · Mid-level
Can you explain how AD replication works?
Asked once · last asked Jul 16 · Concept · Mid-level
If a domain controller hosting FSMO roles crashes, how would you bring another domain controller in the same subnet into service?
Asked once · last asked Jul 16 · Scenario · Senior
What is the difference between a conditional forwarder and a stub zone?
Asked once · last asked Jul 16 · Concept · Mid-level
What is a bridgehead server in Active Directory?
Asked once · last asked Jul 16 · Concept · Mid-level
How does Active Directory select a domain controller to become a bridgehead server?
Asked once · last asked Jul 16 · Concept · Senior
Other ways it was asked
- “If an Active Directory bridgehead server is inaccessible, how is another domain controller in the same site selected as the replacement?”
How do you keep multiple Windows domain controllers synchronized?
Asked once · last asked Aug 12 · Concept · Mid-level
Which FSMO role has a special role in handling password changes and authentication in Active Directory, and how does it work?
Asked once · last asked Aug 18 · Concept · Mid-level
Other ways it was asked
- “Which FSMO role is responsible for user password changes and authentication in Active Directory?”
How would you troubleshoot a domain controller demotion that fails because the server also hosts a Certificate Authority?
Asked once · last asked Aug 18 · Scenario · Senior
What high-level steps would you take to migrate domain controllers from Windows Server 2012 to Windows Server 2025?
Asked once · last asked Aug 18 · Scenario · Senior
Show 12 more
What is USN rollback in Active Directory?
Asked once · last asked Aug 21 · Concept · Senior
What are lingering objects in Active Directory?
Asked once · last asked Aug 21 · Concept · Senior
When would you seize an FSMO role?
Asked once · last asked Aug 21 · Scenario · Senior
What is the PDC Emulator in FSMO roles?
Asked once · last asked Aug 21 · Concept · Mid-level
Why is DNS critical for Active Directory?
Asked once · last asked Aug 21 · Concept · Mid-level
How would you repair broken synchronization between domain controllers?
Asked once · last asked Aug 21 · Scenario · Senior
Why is time synchronization important in Active Directory?
Asked once · last asked Aug 21 · Concept · Mid-level
When you suspect DNS is the root cause of the issue, how do you validate name resolution and domain controller discovery?
Asked once · last asked Aug 24 · Scenario · Mid-level
After a domain migration, some machines still hit old domain controllers. What's a common cause?
Asked once · last asked Sep 1 · Scenario · Mid-level
What is the role of Windows Server in an Active Directory environment?
Asked once · last asked May 12 · Concept · Junior
What are the different roles in Active Directory?
Asked once · last asked Aug 9 · Concept · Junior
What is the Windows `w32tm` command used for?
Asked once · last asked Aug 21 · Tooling · Junior
Group Policy interview questions
Check your understanding of GPO creation, processing order, OU placement, filtering, ADMX templates, application restrictions and policy troubleshooting. 13 questions.
If Event Viewer shows a group policy processing delay, how do you identify a slow or problematic GPO extension?
Asked once · last asked Aug 24 · Scenario · Mid-level
Other ways it was asked
- “When troubleshooting slow Group Policy processing, what should you check first in Event Viewer, and what clues can help identify a slow extension?”
How do you configure a Group Policy Object?
Asked once · last asked May 12 · Tooling · Mid-level
How can Active Directory Group Policy restrict which programs users are allowed to run?
Asked once · last asked Jun 16 · Tooling · Mid-level
What is the difference between security filtering and WMI filtering?
Asked once · last asked Jul 16 · Concept · Mid-level
What are ADMX templates, and how do you use them to manage Windows policies?
Asked once · last asked Aug 3 · Concept · Junior
Other ways it was asked
- “What is ADMX, and what is it used for?”
- “How would you use ADMX templates to manage Windows policy settings?”
If a Group Policy Object (GPO) is not being applied on a computer, what could be the reason, and how would you troubleshoot it?
Asked once · last asked Aug 18 · Scenario · Mid-level
How are Group Policy settings applied when a computer and a user are in different organizational units?
Asked once · last asked Sep 30 · Concept · Mid-level
Other ways it was asked
- “How are conflicts between Group Policy settings on a computer's and a user's organizational units resolved?”
How might a user attempt to bypass Group Policy restrictions, and how would you defend against those attempts?
Asked once · last asked Sep 30 · Scenario · Senior
How can you check which Group Policy settings are applied to a Windows computer?
Asked once · last asked Oct 19 · Tooling · Mid-level
What is the `gpupdate` command used for?
Asked once · last asked Aug 21 · Tooling · Junior
What is the `gpresult` command used for?
Asked once · last asked Aug 21 · Tooling · Junior
What are Group Policy Objects, and how are they used to manage Windows devices?
Asked once · last asked Sep 8 · Concept · Junior
Active Directory security and authentication interview questions
Security questions cover Kerberos, NTLM, AD CS, server hardening, credential attacks, privilege escalation, auditing, forensics and incident response. 49 questions.
What might an attacker with access to Active Directory and a domain controller do to encrypt an organization's infrastructure?
Asked once · last asked Sep 21 · Scenario · Mid-level
Other ways it was asked
- “What could an attacker do with access to an Active Directory domain controller?”
- “What tools might an attacker use to encrypt an organization's infrastructure after gaining access to Active Directory?”
What weakness in NTLM can make an NTLM relay attack possible?
Asked once · last asked Jun 5 · Concept · Senior
Other ways it was asked
- “What conditions determine whether an NTLM relay attack succeeds?”
- “How can an NTLM relay attack lead to privilege escalation?”
In an authorized security assessment, how might you gain initial access to a Windows domain machine and then identify ways to escalate privileges?
Asked once · last asked Jan 29 · Scenario · Senior
What additional steps or details would make an incident response playbook more effective for handling a ransomware attack on Windows-based file servers?
Asked once · last asked Feb 21 · Scenario · Mid-level
How do you manage security incident-response controls in Microsoft Defender tenant settings?
Asked once · last asked Apr 10 · Tooling · Senior
What is the difference between Kerberos and NTLM authentication?
Asked once · last asked May 8 · Concept · Mid-level
What is the difference between silver tickets and golden tickets?
Asked once · last asked May 8 · Concept · Senior
What are certificate exploitation attacks in an Active Directory environment?
Asked once · last asked May 8 · Concept · Senior
If systems cannot be patched or upgraded to NTLMv2, how would you mitigate the security risk?
Asked once · last asked May 8 · Scenario · Senior
How would you secure a Windows server against attacks?
Asked once · last asked May 12 · Scenario · Mid-level
What are Windows ShellBags, and how can they help in a forensic investigation?
Asked once · last asked May 13 · Concept · Mid-level
What areas of the registry would you look at for persistence?
Asked once · last asked May 13 · Scenario · Mid-level
Show 33 more
How would you use Windows event logs to identify remote sessions?
Asked once · last asked May 13 · Scenario · Mid-level
Why does CyberArk Vault run on Windows rather than Linux, and how is the Vault secured?
Asked once · last asked May 19 · Concept · Senior
Other ways it was asked
- “Why does CyberArk Vault use Windows rather than Linux, given that Linux is stable and may offer greater security? How is the Vault secure if it does not use Linux?”
Describe a methodology you use for hunting for persistence mechanisms like WMI event consumers.
Asked once · last asked May 26 · Scenario · Senior
How can an attacker use a captured NTLM hash to gain access to a higher-privileged system?
Asked once · last asked Jun 5 · Scenario · Senior
Which logs, fields, or event criteria should you monitor to detect an NTLM relay attack?
Asked once · last asked Jun 5 · Scenario · Senior
Where in Windows can you view failed logon events, and which utility and log category would you use?
Asked once · last asked Jun 5 · Tooling · Mid-level
Once inside an environment, what does Scattered Spider typically target in Active Directory?
Asked once · last asked Jun 5 · Concept · Senior
Which Active Directory file might Scattered Spider target to obtain credential data?
Asked once · last asked Jun 5 · Concept · Senior
Given a Windows machine and Microsoft Outlook as the initial access vector, how would you map an end-to-end attack and detection chain from initial access through exfiltration?
Asked once · last asked Jun 9 · Scenario · Senior
Should a Pass-the-Hash detection target credential dumping, lateral movement, or both?
Asked once · last asked Jun 9 · Concept · Senior
What are utilities such as mshta.exe, PowerShell, and Command Prompt commonly called when attackers abuse them?
Asked once · last asked Jul 27 · Concept · Mid-level
Why is LSASS important to Windows security?
Asked once · last asked Jul 27 · Concept · Mid-level
Other ways it was asked
- “What built-in Windows protections can safeguard LSASS or LSA, and how do they help?”
What is a pass-the-hash attack, and how does it exploit NTLM?
Asked once · last asked Jul 27 · Concept · Senior
What is a golden ticket attack?
Asked once · last asked Jul 27 · Concept · Senior
What built-in Windows tools or features can attackers use for lateral movement?
Asked once · last asked Jul 27 · Concept · Senior
How would you implement CIS best practices in a Windows Server environment and assess their impact on security or system performance?
Asked once · last asked Aug 11 · Behavioral · Mid-level
Other ways it was asked
- “Could you walk me through a specific example of how you implemented CIS best practices in a Windows server environment and the impact it had on security or system performance?”
How would you identify and prioritize hardening changes for different Windows Server roles?
Asked once · last asked Aug 11 · Scenario · Senior
Can you walk me through how you would design and manage a secure Active Directory environment for an organization of about 500 users? Please highlight considerations like group policy enforcement and delegation.
Asked once · last asked Aug 11 · Design · Senior
What commands or PowerShell pipelines would you use to identify users who logged in over the weekend and performed Active Directory activities?
Asked once · last asked Aug 18 · Scenario · Senior
How do Windows Pro and Windows Home differ from a security perspective?
Asked once · last asked Aug 20 · Concept · Junior
How does authentication work in Active Directory?
Asked once · last asked Aug 21 · Concept · Mid-level
What is the difference between LDAP and LDAPS?
Asked once · last asked Aug 21 · Concept · Mid-level
What might it indicate if an administrator performs suspicious actions on a domain controller in an Active Directory environment?
Asked once · last asked Sep 21 · Scenario · Junior
Other ways it was asked
- “What evidence would you look for when investigating suspicious administrator activity on an Active Directory domain controller?”
How does relaying NTLM authentication to LDAP differ from relaying it to SMB?
Asked once · last asked Sep 30 · Concept · Senior
Which Windows privilege-escalation vulnerabilities or misconfigurations might automated scanners miss but a penetration tester could identify manually?
Asked once · last asked Sep 30 · Scenario · Senior
How can an unquoted Windows service path be exploited for privilege escalation?
Asked once · last asked Sep 30 · Scenario · Mid-level
How can Kerberos be secured?
Asked once · last asked Oct 8 · Concept · Mid-level
How would you secure Kerberos in a hybrid Linux-Windows environment using Active Directory?
Asked once · last asked Oct 8 · Scenario · Senior
When a client requests an infrastructure or Active Directory audit, how do you conduct it?
Asked once · last asked Oct 15 · Scenario · Mid-level
Which AD CS certificate template settings and CA permissions prevent unauthorized alternate subject enrollment?
Asked once · last asked Oct 20 · Scenario · Senior
Other ways it was asked
- “Which Microsoft ADCS certificate template and CA configuration changes would prevent unauthorized alternate subject enrollment?”
- “Which exact template fields and CA ACL entries did you change to stop alternate subject enrollment?”
What is registry analysis?
Asked once · last asked Mar 26 · Concept · Junior
Can a CyberArk Vault server be domain-joined?
Asked once · last asked May 6 · Concept · Mid-level
What are the two types of tickets used in Kerberos?
Asked once · last asked Jul 27 · Concept · Junior
Microsoft Entra ID and hybrid identity interview questions
Review hybrid synchronization, Conditional Access, MFA, SSO, federation, application permissions, identity governance, privileged access and identity integrations. 47 questions.
How would you implement Zero Trust using Azure AD MFA and Conditional Access, from planning through deployment?
Asked once · last asked Aug 12 · Scenario · Senior
What does the migration process look like when moving a domain-joined machine to an Entra-only environment?
Asked once · last asked Oct 16 · Scenario · Mid-level
How would you identify applications that connect to SharePoint without multifactor authentication?
Asked once · last asked Apr 3 · Scenario · Mid-level
If you joined as a security architect or analyst and found about 30 global administrators, how would you assess whether that is too many and recommend an appropriate number?
Asked once · last asked Apr 23 · Scenario · Senior
Other ways it was asked
- “If you joined as a security architect or analyst and found about 30 global administrators, what would you recommend? Is that too many, and what should the recommended number be?”
Beyond just-in-time access, what additional controls would you recommend to reduce risk from global administrator accounts, and how would you implement them?
Asked once · last asked Apr 23 · Scenario · Senior
When you onboard an application in Microsoft Entra ID for SSO, how does the authentication flow work when users access it?
Asked once · last asked Apr 27 · Concept · Mid-level
When configuring an application with AD groups, what is attribute mapping, and why is it necessary?
Asked once · last asked Apr 27 · Concept · Mid-level
After a user receives an Azure RBAC role through Entra ID and just-in-time escalation, how would credential checkout work to access a SQL database?
Asked once · last asked May 8 · Scenario · Senior
How would you integrate Active Directory or Entra ID with SailPoint, including prerequisites and required components?
Asked once · last asked Jun 4 · Scenario · Mid-level
Other ways it was asked
- “What are the prerequisites for configuring an Active Directory connector with SailPoint IdentityNow or IdentityIQ?”
- “How would you integrate Azure AD or Active Directory with SailPoint?”
- “What steps would you follow to set up a SailPoint connector for Active Directory or Azure AD?”
How would you configure third-party identity federation with Microsoft Entra ID or Okta?
Asked once · last asked Jun 12 · Tooling · Senior
Other ways it was asked
- “How have you configured third-party identity federation with Azure/Entra ID or Okta?”
In Azure or Entra ID, what would you create to block a user from signing in to a specific application?
Asked once · last asked Jun 26 · Scenario · Mid-level
What command or feature do you use in Azure to close or revoke a user's sessions?
Asked once · last asked Jun 26 · Tooling · Mid-level
Show 31 more
How would you use a SAML connector to integrate SailPoint with Microsoft Entra ID?
Asked once · last asked Jul 27 · Design · Senior
Other ways it was asked
- “What role does SAML play in integrating an identity provider with Microsoft Entra ID?”
How would you configure Microsoft 365 MFA policies to exclude specific users and SMTP-based service accounts while keeping MFA enabled for the rest of the organization?
Asked once · last asked Aug 18 · Scenario · Senior
What components are used to connect on-premises Active Directory to Azure Active Directory?
Asked once · last asked Aug 20 · Concept · Mid-level
Other ways it was asked
- “How would you integrate an on-premises Active Directory environment with Azure Active Directory?”
How would you troubleshoot synchronization between on-premises Active Directory and Entra ID, and which logs would you check?
Asked once · last asked Aug 20 · Scenario · Mid-level
Other ways it was asked
- “How would you troubleshoot a synchronization issue between on-premises Active Directory and Azure Active Directory?”
- “Which logs do you check when troubleshooting Azure Active Directory synchronization issues?”
Which command would you use to check whether a Windows device is Azure AD joined?
Asked once · last asked Aug 20 · Tooling · Mid-level
How do you create an application in Microsoft Entra ID, and how would you troubleshoot access issues for an existing app?
Asked once · last asked Sep 8 · Tooling · Mid-level
How do sign-in logs and conditional access policies work together to diagnose sign-in issues?
Asked once · last asked Sep 8 · Scenario · Mid-level
How would you test conditional access policies before rolling them out to a broad audience?
Asked once · last asked Sep 9 · Scenario · Senior
If you inherited a Microsoft Entra environment from an MSP, what would you review first to determine whether identity and access management was being managed securely and properly?
Asked once · last asked Sep 9 · Scenario · Senior
How would you use Microsoft Entra ID for authentication and authorization across MCP servers and the full AI request flow?
Asked once · last asked Sep 21 · Design · Senior
What would you check when Microsoft 365 or Google Workspace sign-in fails despite valid accounts and credentials?
Asked once · last asked Sep 22 · Scenario · Junior
Other ways it was asked
- “After confirming the Microsoft 365 or Google Workspace account was active and the username and password were correct, what did you do next to help the user log in?”
- “What additional troubleshooting steps or tools would you use when a user cannot sign in to Microsoft 365 or Google Workspace after their account and credentials have been verified?”
When would you choose Amazon Cognito over Azure Active Directory?
Asked once · last asked Sep 23 · Concept · Senior
What should an Azure AD authentication detection look for, and why?
Asked once · last asked Oct 6 · Concept · Mid-level
How will you implement automatic retrieval of the Microsoft 365 profile, including department, email, and user information, when a user opens the app?
Asked once · last asked Oct 8 · Tooling · Mid-level
How would you integrate Office 365, managed through Microsoft Entra ID, with an enterprise application that uses its own authentication mechanism?
Asked once · last asked Oct 8 · Design · Senior
A user receives Microsoft approval prompts they did not request several nights a week. What would you check, and in what order?
Asked once · last asked Oct 8 · Scenario · Mid-level
When a user receives repeated unrequested Microsoft approval prompts, why is resetting their password alone insufficient?
Asked once · last asked Oct 8 · Scenario · Mid-level
How would you secure privileged access in Azure AD, now Microsoft Entra ID?
Asked once · last asked Oct 15 · Scenario · Senior
How would you decide whether a given access control belongs in an Okta policy or an Entra Conditional Access policy?
Asked once · last asked Oct 15 · Scenario · Senior
How would you prevent or detect someone editing an account directly in Active Directory when Okta owns it?
Asked once · last asked Oct 15 · Scenario · Senior
How would you approach a scenario where an account is disabled in Okta but still active in Active Directory, and nobody knows how long it has been that way?
Asked once · last asked Oct 15 · Scenario · Senior
How does Active Directory differ from Microsoft Entra ID?
Asked once · last asked Oct 16 · Concept · Mid-level
What role does Microsoft Entra ID play in an endpoint management environment?
Asked once · last asked Oct 20 · Concept · Mid-level
How would you integrate an application with Microsoft Entra using SAML or OIDC, including configuration and troubleshooting?
Asked once · last asked Oct 21 · Tooling · Senior
Other ways it was asked
- “Walk me through an application integration with Microsoft Entra using SAML or OIDC. What did you configure, and what did you troubleshoot?”
What is the difference between delegated and application permissions, and how should an app authenticate when reading user data from Microsoft Graph?
Asked once · last asked Oct 21 · Concept · Mid-level
For just-in-time administrative access to Microsoft Entra roles, when would you choose CyberArk over Microsoft Entra Privileged Identity Management (PIM), and why?
Asked once · last asked Oct 21 · Concept · Senior
How would you implement identity and access management strategies in Azure using Entra ID, RBAC, or managed identities?
Asked once · last asked Oct 23 · Tooling · Senior
Other ways it was asked
- “How have you implemented identity and access management strategies in Azure, particularly around Entra ID, RBAC, or managed identities?”
What is Microsoft Entra ID?
Asked once · last asked Apr 3 · Concept · Junior
What is the difference between Azure and Entra?
Asked once · last asked Aug 18 · Concept · Junior
How would you use Event Viewer to troubleshoot Azure Active Directory synchronization issues?
Asked once · last asked Aug 20 · Tooling · Mid-level
What is Conditional Access in Entra ID?
Asked once · last asked Sep 30 · Concept · Mid-level
Windows Server administration and troubleshooting interview questions
These questions cover networking, file services, services and processes, PowerShell, monitoring, IIS, certificates, virtualization, server upgrades and failover clustering. 46 questions.
Explain the upgrade process from Windows Server 2016 to 2019 and how Failover Clustering works in a production environment.
Asked once · last asked Aug 15 · Scenario · Senior
Other ways it was asked
- “Explain the upgrade process from Windows Server 2016 to 2019, how Failover Clustering works in production, and how to handle backup and recovery.”
- “How do you handle a Windows Server cluster upgrade from 2016 to 2019 and manage the failover backup process?”
How would you migrate multiple virtual machines from VMware to a Windows Server 2022 Hyper-V host?
Asked once · last asked Aug 18 · Scenario · Mid-level
What happens when a Windows machine starts up and obtains an IP address through DHCP?
Asked once · last asked Sep 30 · Concept · Mid-level
Other ways it was asked
- “After a Windows machine obtains an IP address through DHCP, what other steps typically occur during startup?”
How do you conduct weekly node audits, review Splunk logs or dashboards, and capture weekly reviews of a Windows environment?
Asked once · last asked Apr 15 · Scenario · Senior
Other ways it was asked
- “During weekly reviews of a Windows environment and Splunk logs or dashboards, what would you look for?”
What are the advantages of NTFS over FAT?
Asked once · last asked May 4 · Concept · Junior
How would you set up a Windows file share, and what administration tasks can you perform in SharePoint or Microsoft 365?
Asked once · last asked May 12 · Tooling · Junior
How do you install an SSL/TLS certificate on a Windows server?
Asked once · last asked May 13 · Tooling · Mid-level
Other ways it was asked
- “How do you install SSL on Windows servers?”
How is a PFX file used when installing an SSL certificate on a Windows server?
Asked once · last asked May 13 · Concept · Mid-level
What command syntax would you use to create a service in Windows?
Asked once · last asked May 13 · Tooling · Junior
How would you independently supervise production workloads across Linux and Windows Server, including monitoring server performance and services?
Asked once · last asked Jun 2 · Scenario · Senior
In Windows, what command shows which process is listening on a specific port, and what options would you use to show the process and port?
Asked once · last asked Jun 26 · Tooling · Mid-level
Where do you find the Windows logs for the Network Policy Server (NPS) service?
Asked once · last asked Jun 26 · Tooling · Mid-level
Show 33 more
Why do we use FSLogix instead of local profiles?
Asked once · last asked Aug 10 · Concept · Mid-level
What are the prerequisites for Windows Failover Clustering, including Active Directory and computer-object requirements?
Asked once · last asked Aug 11 · Concept · Mid-level
Other ways it was asked
- “What are the prerequisites for building a new failover cluster?”
- “Besides network connectivity, what Active Directory and computer-object requirements must be met to build a failover cluster?”
What permissions does a service account need on the cluster nodes, and what is the Cluster Name Object in Active Directory?
Asked once · last asked Aug 11 · Concept · Mid-level
Which PowerShell commands would you use to restart a service on 100 servers?
Asked once · last asked Aug 11 · Tooling · Mid-level
If you cannot log in to a Windows machine, how can you check its Event Viewer logs?
Asked once · last asked Aug 13 · Scenario · Mid-level
Explain the steps to upgrade Windows Server 2016 to 2019.
Asked once · last asked Aug 15 · Tooling · Mid-level
Explain the role of Windows Server Failover Clustering and how you handle backups and failover in a production environment.
Asked once · last asked Aug 15 · Scenario · Senior
A Windows Server can reach devices in its own subnet but not another VLAN. How do you troubleshoot that?
Asked once · last asked Aug 18 · Scenario · Mid-level
Can you explain how you host an application in IIS?
Asked once · last asked Aug 19 · Tooling · Mid-level
A Windows server is at 100% CPU utilization. How would you troubleshoot it?
Asked once · last asked Aug 21 · Scenario · Mid-level
How can Wireshark help troubleshoot Windows and database issues, including Remote Desktop Protocol (RDP) connectivity?
Asked once · last asked Sep 2 · Tooling · Mid-level
If DFS replication is interrupted and two servers have different changes to the same file, how is the conflict handled?
Asked once · last asked Sep 30 · Scenario · Senior
A customer reports that a Windows Server can't communicate with another system on the network. What commands or tools would you use to troubleshoot, and what would each help you determine?
Asked once · last asked Oct 16 · Scenario · Mid-level
What is Distributed File System (DFS), and what is it used for?
Asked once · last asked Sep 30 · Concept · Mid-level
Other ways it was asked
- “What problem does Distributed File System (DFS) solve?”
What protocol is used to access a Windows file share?
Asked once · last asked Jan 29 · Concept · Junior
How would you start a Windows service from the command line?
Asked once · last asked May 13 · Tooling · Junior
What command would you use to list all running processes in Windows?
Asked once · last asked May 13 · Tooling · Junior
Can you name three Windows registry hives?
Asked once · last asked May 13 · Concept · Junior
Other ways it was asked
- “What are the three main Windows registry hives?”
How do you flush the DNS cache in Windows?
Asked once · last asked Jun 26 · Tooling · Junior
How do you kill a process from the Windows command line?
Asked once · last asked Jun 26 · Tooling · Junior
How do you run a command remotely from PowerShell?
Asked once · last asked Jun 26 · Tooling · Mid-level
What is mshta.exe used for in Windows?
Asked once · last asked Jul 27 · Concept · Junior
What is a terminal server, and how is it used?
Asked once · last asked Aug 9 · Concept · Junior
How would you extend a disk on a Windows virtual machine?
Asked once · last asked Aug 13 · Tooling · Mid-level
When using RDP, which host or system does the user connect to?
Asked once · last asked Aug 20 · Concept · Junior
How would you troubleshoot an application problem on a failed Windows server?
Asked once · last asked Aug 21 · Scenario · Mid-level
Which command would you use to check the date and time on Windows Server?
Asked once · last asked Aug 21 · Tooling · Junior
Other ways it was asked
- “Which command would you use to query the Windows Time service status?”
What is DFSR?
Asked once · last asked Aug 21 · Concept · Junior
Which command would you use to check the IP address on Windows Server?
Asked once · last asked Aug 21 · Tooling · Junior
If you cannot log in to a user's computer, how would you access it to check network connectivity?
Asked once · last asked Sep 2 · Scenario · Mid-level
What roles can Windows and Linux systems serve in infrastructure, and which tasks is each suited to supporting?
Asked once · last asked Sep 3 · Concept · Mid-level
Other ways it was asked
- “What roles did Windows and Linux systems serve in your infrastructure, and which tasks did each support?”
What are Windows 365 virtual machines called?
Asked once · last asked Oct 16 · Concept · Junior
What is the maximum length of a Windows computer name?
Asked once · last asked Oct 19 · Concept · Junior
SCCM, Intune and Windows patching interview questions
Check how you would handle endpoint provisioning, operating system deployment, device compliance, management tools, patch rollouts, deployment logs and update recovery. 40 questions.
What prechecks and postchecks do you perform when patching a server?
Asked once · last asked Aug 20 · Tooling · Mid-level
Other ways it was asked
- “What postchecks do you perform after patching a server?”
How would you enroll a device in Microsoft Intune?
Asked once · last asked Aug 24 · Tooling · Mid-level
Why would you deploy SCCM agents on Windows 365 virtual machines?
Asked once · last asked Oct 16 · Concept · Mid-level
How do you set up a new machine in an Intune-managed environment?
Asked once · last asked Oct 16 · Tooling · Mid-level
How are boundary groups managed in Microsoft Configuration Manager, and who is typically responsible for them?
Asked once · last asked Oct 16 · Concept · Mid-level
In SCCM, what is the difference between a package and an application model, and which would you use to deploy an application?
Asked once · last asked Mar 26 · Concept · Mid-level
How would you compare Intune and SCCM for application deployment, and when would you choose each?
Asked once · last asked Mar 26 · Concept · Senior
Other ways it was asked
- “If an organization uses both Intune and SCCM, how would you decide whether to discontinue one deployment system or keep both?”
From a Windows compliance perspective, what are you actually validating?
Asked once · last asked Apr 15 · Concept · Mid-level
If an application fails to install from Company Portal or Software Center, what would you do first, and what steps would you take to find out why?
Asked once · last asked Apr 21 · Scenario · Mid-level
How would you troubleshoot a failed SCCM software deployment, including generic error codes?
Asked once · last asked Jul 20 · Scenario · Mid-level
Other ways it was asked
- “Explain your process for troubleshooting a failed software deployment in SCCM.”
- “When SCCM logs show a generic failure code during a software deployment, what would you investigate next?”
- “If SCCM logs do not reveal the cause of a failed software deployment, how would you diagnose it further?”
Describe a complex SCCM issue you diagnosed and resolved, including how you used deployment logs.
Asked once · last asked Jul 20 · Behavioral · Mid-level
Other ways it was asked
- “Tell me about a time you had to troubleshoot a complex SCCM issue.”
- “How did you diagnose and resolve a complex SCCM issue using deployment logs?”
Describe a time you had to deploy a critical patch across your endpoints.
Asked once · last asked Jul 20 · Behavioral · Mid-level
Show 27 more
How would you manage endpoint patching at enterprise scale, and how might the approach evolve?
Asked once · last asked Jul 21 · Scenario · Senior
How would you plan a transition from SCCM to Intune for endpoint patch management?
Asked once · last asked Jul 21 · Scenario · Senior
What is the biggest difference between Intune and Workspace ONE?
Asked once · last asked Aug 3 · Concept · Mid-level
How would you use the Microsoft Graph API or REST APIs with PowerShell to automate Intune tasks?
Asked once · last asked Aug 3 · Tooling · Senior
How would you make sure that 95% of 1,000 Windows devices are patched in two weeks and 99% in four weeks?
Asked once · last asked Aug 3 · Scenario · Senior
What steps would you follow in SCCM to create and deploy a software package?
Asked once · last asked Aug 11 · Tooling · Mid-level
How would you write a PowerShell script to check whether a specific Windows update (KB) is installed across a list of servers?
Asked once · last asked Aug 18 · Write code · Mid-level
How would you use SCCM to deploy an RMM agent during off-hours while controlling when devices reboot?
Asked once · last asked Aug 18 · Tooling · Senior
Can you explain the SCCM patching process and how you would patch a domain controller?
Asked once · last asked Aug 19 · Tooling · Mid-level
Other ways it was asked
- “Can you explain both the SCCM patching process and patching on the DC server in detail?”
How would you deploy Windows Server updates using software update groups, whether you create the groups yourself or receive them from another team?
Asked once · last asked Aug 20 · Tooling · Mid-level
Other ways it was asked
- “For Windows Server patching, do you create software update groups yourself or receive them from another team, and how do you deploy the updates?”
A Windows Server crashes during an update. What would you do to restore service and troubleshoot the issue?
Asked once · last asked Aug 20 · Scenario · Mid-level
If a Windows Server patch causes a crash, how would you decide whether to roll back, and what change approval or communication steps would you follow?
Asked once · last asked Aug 20 · Scenario · Mid-level
How do you deploy an operating system image using SCCM?
Asked once · last asked Aug 20 · Tooling · Mid-level
Other ways it was asked
- “How do you use an SCCM task sequence to deploy an operating system image and feature updates?”
Which logs do you check when troubleshooting Microsoft Intune issues?
Asked once · last asked Aug 20 · Tooling · Mid-level
How do you handle application deployments and patching, and what tools or approach do you use?
Asked once · last asked Sep 8 · Tooling · Mid-level
Describe a real-world problem you solved using Microsoft Intune and how you addressed it.
Asked once · last asked Sep 9 · Tooling · Mid-level
Before the POC rollout, how would you deal with the IT team saying they are familiar with Intune and do not want to introduce any other operating system into the environment?
Asked once · last asked Sep 24 · Scenario · Senior
What is the difference between an Intune configuration profile and a compliance policy?
Asked once · last asked Sep 30 · Concept · Mid-level
How do you configure patch management in Microsoft Intune?
Asked once · last asked Oct 16 · Tooling · Mid-level
Where are Microsoft Endpoint Configuration Manager task sequence logs located?
Asked once · last asked Oct 20 · Tooling · Mid-level
How can task sequence settings be configured based on options selected by an end user during deployment?
Asked once · last asked Oct 20 · Tooling · Mid-level
How would you set up app deployment through Intune?
Asked once · last asked Oct 21 · Tooling · Mid-level
How do you download Windows updates for deployment to servers?
Asked once · last asked Aug 20 · Tooling · Mid-level
How does SCCM integrate with Microsoft Intune?
Asked once · last asked Aug 20 · Concept · Mid-level
What is Windows Autopilot?
Asked once · last asked Aug 24 · Concept · Junior
How would you provision hybrid workstations?
Asked once · last asked Aug 27 · Scenario · Mid-level
What suggestions would you make to allow Intune to discover new devices?
Asked once · last asked Oct 20 · Scenario · Mid-level
Application packaging and deployment interview questions
Packaging questions cover packaging and repackaging, MSI and MSIX, silent installations, custom actions, driver deployment, validation and application delivery. 25 questions.
What is the difference between application packaging and application repackaging?
Asked once · last asked Apr 21 · Concept · Junior
Other ways it was asked
- “What is the primary difference between application packaging and repackaging?”
What is the mechanism of MSI (Windows Installer)?
Asked once · last asked Mar 26 · Concept · Junior
Once you receive application source files, how do you validate them, and what do you include on your validation checklist?
Asked once · last asked Mar 26 · Tooling · Mid-level
Besides the version, registry entries, and services, what else would you validate when testing an application package?
Asked once · last asked Mar 26 · Tooling · Mid-level
If an MSI installs in UI mode but does not start when run silently, for example with /qn, what would you do to troubleshoot it?
Asked once · last asked Mar 26 · Scenario · Mid-level
How do you create a response file for a silent application installation?
Asked once · last asked Mar 26 · Tooling · Mid-level
An MSI extracted from setup.exe cannot be installed on its own and reports that setup.exe is required. How would you troubleshoot this?
Asked once · last asked Mar 26 · Scenario · Mid-level
What are custom actions in an MSI, and when would you use them?
Asked once · last asked Mar 26 · Concept · Mid-level
How would you implement a deferred custom action in an MSI?
Asked once · last asked Mar 26 · Tooling · Senior
When deploying multiple drivers, when would you repackage them rather than handle them with an MSI custom action?
Asked once · last asked Mar 26 · Scenario · Senior
Other ways it was asked
- “When deploying an MSI and 10 drivers, would you package the drivers in the MSI or handle them with PowerShell?”
- “When deploying multiple drivers, what factors would determine whether you repackage them?”
What are the limitations of application repackaging, and can very large packages be repackaged?
Asked once · last asked Mar 26 · Concept · Senior
How would you check the package source and verify the source files?
Asked once · last asked Apr 21 · Tooling · Mid-level
Show 13 more
How do you repackage an application?
Asked once · last asked Apr 21 · Tooling · Mid-level
If there is no previous version of an application, what approach would you take to package it?
Asked once · last asked Apr 21 · Scenario · Mid-level
In an Intune environment with different Windows 11 builds, such as the current, N−1, and N−2 updates, how would you test a package and target its deployment to a specific build?
Asked once · last asked Apr 21 · Scenario · Senior
How would you package and deploy application updates across Windows and Linux?
Asked once · last asked Aug 20 · Tooling · Mid-level
Other ways it was asked
- “What types of application updates have you deployed, and how do you package and deploy them?”
How do you package applications for deployment through Microsoft Intune?
Asked once · last asked Sep 8 · Tooling · Mid-level
When validating an application package, would you install it in UI mode?
Asked once · last asked Mar 26 · Tooling · Junior
What challenges would you consider when deploying 10 drivers?
Asked once · last asked Mar 26 · Scenario · Mid-level
What is an application package, and how does application packaging work?
Asked once · last asked Apr 21 · Concept · Junior
How are application packages created?
Asked once · last asked Apr 21 · Tooling · Mid-level
What makes one application deployment format better than another?
Asked once · last asked Apr 21 · Concept · Mid-level
Can application packaging also include deployment?
Asked once · last asked Apr 21 · Concept · Junior
What methodology do you follow when packaging an application?
Asked once · last asked Apr 21 · Tooling · Mid-level
What is MSIX?
Asked once · last asked Apr 21 · Concept · Junior
Microsoft 365, Exchange and SharePoint interview questions
Review Outlook support, email administration, SharePoint, OneDrive, tenant migrations, collaboration integrations, compliance and planning for productivity tools. 20 questions.
How would you integrate an enterprise financial system with Office 365?
Asked once · last asked Oct 8 · Design · Senior
Other ways it was asked
- “How would you integrate an enterprise financial system with Office 365 so that actions in one system are correctly performed in the other?”
- “What challenges can arise when integrating an enterprise financial system with Office 365 so that actions are correctly performed in both systems, and how would you address them?”
How would you plan an end-to-end migration of users from multiple Microsoft 365 tenants into a new tenant in India?
Asked once · last asked Aug 12 · Design · Senior
Other ways it was asked
- “How would you plan an end-to-end migration of on-premises-only, hybrid, and cloud-only users into a single new Microsoft 365 tenant?”
How would you recover an email that was deleted from the Deleted Items folder in Outlook?
Asked once · last asked Aug 24 · Tooling · Mid-level
Other ways it was asked
- “How would you recover a deleted email in Outlook?”
What is the difference between online and offline mode in Microsoft Outlook?
Asked once · last asked Aug 24 · Concept · Mid-level
Other ways it was asked
- “What is the key difference between online and offline mode in Microsoft Outlook?”
If the university currently uses Microsoft 365 for their productivity suite, how would that factor into your implementation plan for Gemini and Google Workspace?
Asked once · last asked Sep 24 · Scenario · Senior
Other ways it was asked
- “If a university is set on continuing to use Microsoft 365 (Word, Outlook, Calendar, etc.), how would that change or factor into your implementation plan for Gemini and Google Workspace adoption?”
Tell me about a challenging SharePoint project and how you overcame its main challenge.
Asked once · last asked May 7 · Behavioral · Mid-level
If I were a senior, nontechnical law firm partner, how would you explain what SharePoint is to me?
Asked once · last asked May 8 · Tooling · Mid-level
How would you create custom alerts in SharePoint if the built-in alert feature is unavailable?
Asked once · last asked Jul 17 · Tooling · Mid-level
What tools and steps would you use to identify and resolve the root cause of an issue in Azure or Microsoft 365?
Asked once · last asked Aug 11 · Scenario · Mid-level
How can Microsoft 365 logs be integrated into an Azure Machine Learning anomaly-detection model, and what types of anomalies can it detect?
Asked once · last asked Aug 11 · Concept · Senior
Can you dive a bit deeper into how you'd configure Microsoft Defender specifically for email threats and how it ties into overall Microsoft 365 security?
Asked once · last asked Aug 11 · Tooling · Mid-level
What techniques do you use to ensure compliance with regulations within the Microsoft 365 environment?
Asked once · last asked Aug 11 · Tooling · Mid-level
Show 8 more
If HR requests access to an email between two employees, what steps should you take as an Exchange administrator?
Asked once · last asked Aug 12 · Scenario · Mid-level
If a team member requests access to project documents in OneDrive, what process would you follow?
Asked once · last asked Aug 12 · Scenario · Mid-level
What four key steps would you include in an Exchange-to-Microsoft 365 migration?
Asked once · last asked Aug 18 · Scenario · Mid-level
Other ways it was asked
- “What are the four core steps in an Exchange-to-Microsoft 365 migration?”
Would a fully patched Microsoft Outlook block or detect a Google Sheets attachment?
Asked once · last asked Jun 9 · Scenario · Mid-level
What is Microsoft Outlook used for?
Asked once · last asked Jun 16 · Concept · Junior
Can you explain how you would manage and secure email communication in an organization using Microsoft 365?
Asked once · last asked Aug 11 · Tooling · Mid-level
What is the mailbox storage limit with a Microsoft 365 E5 license?
Asked once · last asked Aug 18 · Concept · Junior
Other ways it was asked
- “For E5, what is the email storage limit?”
What is the difference between PST and OST?
Asked once · last asked Oct 19 · Concept · Junior
Related interview questions
- System Administrator interview questions
- IT Support and Help Desk interview questions
- Cybersecurity interview questions
- Network Engineer interview questions
- AWS interview questions
- Azure interview questions
- Docker interview questions
- Kubernetes interview questions
- Terraform interview questions
- CI/CD interview questions
- Linux interview questions
How this list is made
Every question here was asked by a real interviewer in a real job interview that a candidate ran MeetAssist in. After the call, the interviewer's questions are pulled from the transcript. Practice sessions, tests, exams and anything that was not a job interview are dropped.
Questions are rewritten so they make sense on their own: names of people, employers and clients are removed, and speech-to-text mistakes are fixed. Small talk, logistics and questions about one candidate's own résumé are left out. Rephrasings of the same question are merged, and the count is the number of different interviews it came up in.
The interviews come from candidates who use MeetAssist, so they lean towards software, data and AI roles: the shares describe these interviews, not every Active Directory and Windows Server interview. Answers to the most asked questions are written and checked by an editor; a "common mistake" is shown only when reviews of real answers in these interviews show it, with the count.
100 interviews, 49 candidates, Jan 2026 to Oct 2026. Updated every month with new interviews.
Or add the Chrome extension