After this training day you can deploy domain controllers, maintain users, groups, OUs and group managed service accounts, and restore deleted objects. You enforce password policies through Group Policy and harden AD DS with least privilege, delegated tasks, the Protected Users group, Credential Guard and by blocking NTLM in favour of Kerberos. The course suits system administrators who know Windows Server and want to tidy up and secure their Active Directory or prepare for the Applied Skills assessment.
What you’ll take away.
- Deploy and manage domain controllers and migrate them to new servers
- Create and maintain users, groups, OUs and group managed service accounts
- Enforce password policies through Group Policy and fine-grained password policies
- Secure AD DS on least-privilege principles and phase out legacy protocols such as NTLM
Your training in detail
- Who is it for?
- System administrators who run and secure Active Directory in their organisation.
- Prerequisites
- Experience with Windows Server and core networking technologies, PowerShell basics and some familiarity with AD DS concepts.
- Format & planning
- Standard length: 1 training day. A different length can be arranged for companies.
Agenda: from understanding to application
Our independently developed agenda proposal. Focus areas, lab environment and scope are agreed before booking.
Domain controller topology, deployment and migration
Users, groups, OUs and gMSAs, plus bulk tasks
Replication, AD Recycle Bin and authoritative and non-authoritative restore
Group Policy Objects and fine-grained password policies
Security: least privilege, delegation, Protected Users and Credential Guard
Restricting NTLM, finding inactive accounts and non-expiring passwords
In the guided project you build a domain, create an OU structure with accounts, enforce password policies through GPOs and harden privileged accounts.
Exams, licences & credentials
The course prepares you for the “Microsoft Applied Skills: Administer Active Directory Domain Services” assessment, a hands-on lab on Microsoft Learn. The assessment and any fees are included only if the offer confirms it. The credential is issued by Microsoft. This is not an official Microsoft course unless the offer states otherwise.
Vendor references & review date
Sources checked on 2026-11-10. These sources describe the technology or external exam requirements. They do not imply a partnership with NextNowa.
Your learning content
These objectives describe the training topic. The specific syllabus, dates and trainer are agreed before booking; the written offer is binding.
Frequently asked questions
How does this course differ from AZ-802?
AZ-802 covers Windows Server across the board, from Hyper-V to storage. AZ-1008 spends one day on AD DS alone, with a strong focus on hardening.
Is this about Microsoft Entra ID?
No. The subject is on-premises Active Directory Domain Services with domain controllers and Group Policy. Cloud identities in Entra ID are not part of the course.
Does AZ-1008 Administer Active Directory Domain Services: managing and securing AD DS include a certificate?
The course prepares you for the “Microsoft Applied Skills: Administer Active Directory Domain Services” assessment, a hands-on lab on Microsoft Learn. The assessment and any fees are included only if the offer confirms it. The credential is issued by Microsoft. This is not an official Microsoft course unless the offer states otherwise.