Windows Server & AD Interview Questions

This topic collects interview questions commonly asked for Windows Server and Active Directory administrator roles, ranging from fundamentals like FSMO roles to scenario-based troubleshooting. Rather than memorizing definitions verbatim, focus on being able to explain the 'why' behind each answer and connect it to a real troubleshooting scenario, since interviewers frequently follow up a definition question with 'how would you diagnose that in practice?'

A very common opener is 'what are the five FSMO roles and why do they exist?' — Schema Master and Domain Naming Master are forest-wide (one per forest), while RID Master, PDC Emulator, and Infrastructure Master are domain-wide (one per domain), and they exist because certain AD operations, like extending the schema or allocating RID pools, cannot be safely multi-mastered without risking conflicts. A related favorite is explaining the difference between a one-way and two-way trust, and between a transitive and non-transitive trust, since these determine whether authentication requests can flow automatically between domains or forests versus requiring an explicit, manually configured relationship.

Question: 'A user reports they can log into some workstations but not others in the same domain — what would you check?' Model answer: start with the basics — is the account locked or expired (Get-ADUser -Properties LockedOut, AccountExpirationDate), then check whether the failure is time-related (Kerberos requires clock skew under 5 minutes by default), whether the failing workstations can reach a domain controller (nltest /dsgetdc), and whether it's a specific logon type restriction from Group Policy (like 'Deny log on locally' applied via a security filtered GPO to certain OUs).

Interviewers often pair technical scenarios with a behavioral angle: 'walk me through the last time you had to recover from a production AD incident' expects you to narrate a structured response — detection, containment, root cause, remediation, and prevention — rather than just describing what broke, because that structure demonstrates operational maturity beyond raw technical knowledge. A strong answer names specific tools used at each phase (e.g., 'I checked repadmin /replsummary first,' 'I used the AD Recycle Bin because it was a single deleted OU, not full corruption') to show the candidate actually did the work rather than reciting theory.