How to Use This Guide
This topic collects interview questions commonly asked for Windows Server and Active Directory administrator roles, ranging from fundamentals like FSMO roles to scenario-based troubleshooting. Rather than memorizing definitions verbatim, focus on being able to explain the 'why' behind each answer and connect it to a real troubleshooting scenario, since interviewers frequently follow up a definition question with 'how would you diagnose that in practice?'
Cricket analogy: Memorizing a definition without understanding the 'why' is like knowing the LBW law's wording but not being able to apply it in a live umpiring decision — interviewers test the applied judgment, not the textbook line.
Fundamentals: FSMO Roles, DNS, and Trusts
A very common opener is 'what are the five FSMO roles and why do they exist?' — Schema Master and Domain Naming Master are forest-wide (one per forest), while RID Master, PDC Emulator, and Infrastructure Master are domain-wide (one per domain), and they exist because certain AD operations, like extending the schema or allocating RID pools, cannot be safely multi-mastered without risking conflicts. A related favorite is explaining the difference between a one-way and two-way trust, and between a transitive and non-transitive trust, since these determine whether authentication requests can flow automatically between domains or forests versus requiring an explicit, manually configured relationship.
Cricket analogy: FSMO roles being single-master is like only one match referee being authorized to make the final call on a code-of-conduct breach — even with multiple umpires on the field, that specific authority isn't distributed to avoid conflicting rulings.
Sample Questions and Model Answers
Question: 'A user reports they can log into some workstations but not others in the same domain — what would you check?' Model answer: start with the basics — is the account locked or expired (Get-ADUser -Properties LockedOut, AccountExpirationDate), then check whether the failure is time-related (Kerberos requires clock skew under 5 minutes by default), whether the failing workstations can reach a domain controller (nltest /dsgetdc), and whether it's a specific logon type restriction from Group Policy (like 'Deny log on locally' applied via a security filtered GPO to certain OUs).
Cricket analogy: Systematically ruling out causes — account, time sync, connectivity, policy — is like a bowling review process checking no-ball, front-foot landing, and release point in sequence rather than guessing at the fault immediately.
# Quick triage script for a user login issue mentioned in interview scenarios
Get-ADUser -Identity jdoe -Properties LockedOut, AccountExpirationDate, PasswordExpired, Enabled
# Check domain controller reachability from an affected workstation
nltest /dsgetdc:corp.contoso.com
# Check current time skew against the PDC emulator (Kerberos tolerance is 5 minutes by default)
w32tm /stripchart /computer:pdc01.corp.contoso.com /samples:1
# Review effective GPOs and any 'Deny log on locally' restrictions applied to the workstation's OU
gpresult /r /scope:computerScenario and Behavioral Questions
Interviewers often pair technical scenarios with a behavioral angle: 'walk me through the last time you had to recover from a production AD incident' expects you to narrate a structured response — detection, containment, root cause, remediation, and prevention — rather than just describing what broke, because that structure demonstrates operational maturity beyond raw technical knowledge. A strong answer names specific tools used at each phase (e.g., 'I checked repadmin /replsummary first,' 'I used the AD Recycle Bin because it was a single deleted OU, not full corruption') to show the candidate actually did the work rather than reciting theory.
Cricket analogy: Narrating detection-containment-remediation is like a team's post-match review following a structured format — what went wrong in the field, how we contained the damage, what we'll change at training — rather than just listing the runs conceded.
When asked a 'define X' question, add one sentence on when you'd actually use it or check it in production — e.g., 'FSMO role holders can be checked with netdom query fsmo, and I'd check this first if schema extension or new-account creation suddenly failed domain-wide.' This turns a textbook answer into evidence of hands-on experience.
- Prepare to explain not just definitions but the operational 'why' and how you'd diagnose the scenario in practice.
- Know the five FSMO roles, which are forest-wide vs domain-wide, and why each cannot be safely multi-mastered.
- Be ready to explain trust types: one-way vs two-way, transitive vs non-transitive, and how they affect authentication flow.
- Practice structured troubleshooting narration: account status, time sync, connectivity, then Group Policy restrictions.
- Behavioral incident questions expect a detection-containment-root cause-remediation-prevention structure, not just a description of the failure.
- Naming specific tools (repadmin, dcdiag, nltest, gpresult) in your answers demonstrates hands-on experience over memorized theory.
- Cross-reference this topic with the Quick Reference sheet for exact command syntax you may be asked to write on a whiteboard.
Practice what you learned
1. Which two FSMO roles are forest-wide rather than domain-wide?
2. What is the default Kerberos clock skew tolerance between a client and domain controller?
3. In a strong behavioral answer about a past incident, which structure demonstrates operational maturity?
4. What command would you use to check which server holds a specific FSMO role?
5. A non-transitive trust between two domains means what?
Was this page helpful?
You May Also Like
Windows Server & AD Quick Reference
A condensed cheat sheet of essential Windows Server and Active Directory commands, ports, and defaults for day-to-day administration.
Monitoring and Event Logs
Learn how Windows Event Logs, Event Viewer, and key security event IDs help administrators detect AD problems and security incidents.
Backup and Disaster Recovery for AD
Understand how to protect Active Directory with system state backups, the AD Recycle Bin, and a tested forest recovery plan.
Related Reading
Related Study Notes in Microsoft Technologies
Browse all study notesWindows 10 / UWP Development Study Notes
.NET · 30 topics
Microsoft TechnologiesWindows Batch Scripting Study Notes
Batch · 30 topics
Microsoft TechnologiesMFC (Microsoft Foundation Classes) Study Notes
C++ · 30 topics
Microsoft TechnologiesSilverlight Study Notes
.NET · 30 topics
Microsoft TechnologiesXAML Study Notes
.NET · 30 topics
Microsoft TechnologiesWPF (Windows Presentation Foundation) Study Notes
.NET · 30 topics