Interview prep · 🪟 Windows & Microsoft 365 Administrator
Windows & Microsoft 365 Administrator interview questionsand answers (30, by level).
The questions Indian employers actually ask for this role — fresher, mid-level and senior — with model answers written by engineers who sit on the other side of the table. Use with the role path and the 30-day lab plan.
Fresher / L1
Fundamentals they test on day one
1What is Active Directory and a domain controller?
AD is the directory service for users, computers and policies; a DC hosts the AD database and authenticates logons (Kerberos).
2Group Policy — what can it do?
Centrally enforce settings: password policy, drive maps, software, security hardening; applied by site/domain/OU order.
3What is DNS’s role in AD?
AD depends on DNS SRV records to locate DCs; broken DNS = broken logons. DCs usually run DNS.
4FSMO roles — name them.
Schema master, Domain naming master, RID master, PDC emulator, Infrastructure master.
5How do you reset a user password and unlock an account?
AD Users and Computers or PowerShell: Set-ADAccountPassword, Unlock-ADAccount; check lockout source with event 4740.
6NTFS vs share permissions?
Both apply; the most restrictive wins. Best practice: Full control on share, manage via NTFS.
7What is DHCP lease and reservation?
Lease: temporary IP assignment; reservation: fixed IP tied to a MAC.
8What is Microsoft 365 vs Office 365?
M365 bundles Office apps, Windows and EMS/Intune security; O365 is the productivity suite alone (naming mostly merged now).
9How do you check why a PC is slow?
Task Manager/Resource Monitor, startup apps, disk health, updates, malware scan, event logs, RAM.
10Safe mode and System Restore — when?
Boot troubleshooting with drivers/malware; restore reverts system files/registry without touching documents.
2–5 years / L2
What a working engineer must know
1Design OU structure and GPO strategy for 300 users.
OUs by location/department/device type, GPOs by function (security baseline, apps, user prefs), avoid deep nesting, use security filtering sparingly, document; test with gpresult/RSOP.
2Hybrid identity with Entra ID (Azure AD)?
Entra Connect sync (password hash sync or PTA), SSO, conditional access, MFA; plan for cloud-only groups and device join.
3How do you migrate file servers to SharePoint/OneDrive?
Inventory, clean up, permissions mapping, Migration Manager/SharePoint Migration Tool, pilot, sync clients, cutover with read-only period.
4Windows Server patching strategy?
WSUS/Intune/Configuration Manager rings, maintenance windows, cluster-aware updating for Hyper-V/SQL, test group, rollback plan.
5Explain Kerberos vs NTLM and why disable NTLM.
Kerberos uses tickets via KDC with mutual auth; NTLM is challenge-response, weaker, relay-prone; audit then restrict NTLM.
6How do you troubleshoot slow logons?
Event logs (Group Policy operational), gpresult, profile size, drive maps, DNS, slow DC response, printer mappings, WMI filters.
7Exchange Online mail flow problems — approach?
Message trace, MX/SPF/DKIM/DMARC checks, connectors, transport rules, quarantine, Defender policies; use our DNS tool.
8Intune: enrol and secure 200 laptops?
Autopilot profiles, compliance policies, configuration profiles (BitLocker, Defender), app deployment, conditional access requiring compliant devices.
9Backup and restore Active Directory?
System state backups on 2+ DCs, authoritative vs non-authoritative restore, AD Recycle Bin for objects, tested recovery plan.
10PowerShell: how do you bulk-create users from CSV?
Import-Csv | ForEach { New-ADUser … } with validation, logging, -WhatIf first; set passwords securely; add to groups.
Senior / L3
Design, judgement and leadership
1AD security hardening roadmap?
Tiered admin model, PAWs, LAPS, protected users, disable NTLM/legacy, Kerberos AES only, audit (Defender for Identity), remove stale objects, regular PingCastle/Purple Knight scans.
2Design Hyper-V or move to Proxmox for a Windows shop?
If Datacenter licences exist, Hyper-V with clustering/S2D; otherwise Proxmox + VirtIO drivers, AD/DNS unaffected; licensing per host cores either way. See our comparison page.
3M365 tenant security baseline?
MFA for all, conditional access, legacy auth blocked, Defender for Office, DLP/sensitivity labels, audit logging, Secure Score tracking, admin role separation.
4Forest/domain consolidation after an acquisition?
Trusts first, ADMT or Entra-based migration, SID history, mail coexistence, device re-join plan, phased by business unit.
5Print server/legacy app on Windows Server 2012 EOL — what now?
Isolate, ESU ended; migrate to 2022/2025 or containerise; replace print with Universal Print; see our EOL article.
6Licensing: Server Standard vs Datacenter; CALs?
Per-core licensing (16 min), Datacenter unlimited VMs, Standard 2 VMs; user/device CALs for access; RDS CALs separate.
7How do you run a 24×7 Windows estate with a small team?
Monitoring (Zabbix/SCOM), automation (PowerShell DSC/Intune), standard images, documented runbooks, managed-service partner for off-hours (like ours).
8DR for AD and file services?
Multiple DCs across sites, DFS-R/DFS-N or Azure Files sync, backups offsite, documented recovery order (DNS/AD first), test annually.
9Zero trust for a Windows environment?
Identity-centric: conditional access, device compliance, least privilege, segmentation, Defender for Endpoint, remove local admin.
10Describe an outage you managed and the permanent fix.
Use STAR; show diagnosis, communication, and systemic change (monitoring/process), not just the fix.
How to answer
Four habits that pass interviews
- Say the structure first“I’d check three things: …” — interviewers reward a method more than a lucky answer.
- Numbers and namesMention real tools, versions and figures from your lab; vague answers lose.
- Admit gaps cleanly“I haven’t run X in production; here is how I’d approach it” beats bluffing.
- Ask about the environmentScale, on-call, tooling — it shows you think like an operator.
Ready to be hired, or ready to hire?
Engineers: join our vetted network for projects and placements. Companies: we shortlist windows & microsoft 365 administrators within 48 hours.