System Administrator Interview Questions: Active Directory, DNS and DHCP

Windows sysadmin interviews keep returning to three services that depend on each other: Active Directory Domain Services for identity, DNS for finding things, and DHCP for addressing. A strong answer defines the term in one sentence, says how it fails, and names the command you would run to check. This guide gives you answer outlines, the operations master roles, replication basics, and the commands to practise before the interview.

Who this is for

This guide is for candidates applying for junior to mid-level system administrator or infrastructure roles in Windows environments, and for help desk staff moving up. By the end you will have crisp definitions, a troubleshooting order for directory and name-resolution problems, and a lab plan to practise the commands. For entry-level support interviews, start with help desk interview questions for beginners.

How to structure any answer

Use definition, mechanism, failure mode, then check. For example, for DNS: it maps names to IP addresses; Active Directory uses it to locate domain controllers; if records are missing, clients cannot sign in to the domain; you check with nslookup and dcdiag /test:DNS. Four sentences, and the interviewer can then pick where to go deeper.

Active Directory questions

What is Active Directory Domain Services?

AD DS is a directory service that stores information about objects on the network, such as user and computer accounts, shared resources and printers, and makes it available to authorized users and administrators. Microsoft lists four supporting pieces: the schema (the rules that define the classes of objects and attributes), the global catalog (information about every object in the directory, searchable regardless of which domain holds it), a query and index mechanism, and a replication service that distributes directory data. Security is integrated through sign-in authentication and access control.

How does replication work?

All domain controllers in a domain participate in replication and hold a complete copy of the directory information for their domain. Any change is replicated to all domain controllers in the domain. Because AD DS supports multimaster replication, any domain controller can accept a change, which leads to the next question.

What are the FSMO roles and why do they exist?

Some changes are impractical to perform in a multimaster fashion, so certain domain controllers hold operations master roles that accept those changes. There are five:

Details that interviewers like to hear:

• The first domain controller created in a forest holds all five roles, and the first in each new domain holds the three domain-level roles. Microsoft notes that this can cause high CPU on that first domain controller, so roles are often transferred.
• Read-only domain controllers cannot hold operations master roles.
• If a domain controller fails a logon because of a bad password, it forwards the request to the PDC emulator before rejecting it, since the PDC emulator has the latest password changes.
• Microsoft says not to place the infrastructure master on a global catalog server, except where all domain controllers are global catalog servers or the forest has a single domain, in which case the placement does not matter.
• Place role holders where the network is reliable, and designate standby role holders that are direct replication partners.

A domain controller seems unhealthy. What do you run?

Start with dcdiag. Microsoft describes it as a tool that analyses the state of domain controllers and reports problems, and it must run elevated. Its connectivity tests verify that the domain controller can be located in DNS, answers ICMP pings, allows LDAP binding, and allows binding to the AD RPC interface. Useful forms:

dcdiag
dcdiag /s:DC01 /v
dcdiag /test:DNS /DnsAll
dcdiag /e /q

/s targets a named server, /v is verbose, /e tests all servers in the enterprise and /q prints only errors. The default tests include Advertising, Services, SysVolCheck, KnowsOfRoleHolders, RidManager, Replications and NetLogons, and the DNS test must be requested explicitly. Mention one caveat from the documentation: blocking ICMP internally prevents dcdiag from working as intended.

How do you check replication?

Use repadmin. Microsoft describes it as the tool for diagnosing replication problems between domain controllers, and says its primary use is monitoring so you can find issues such as offline servers or an unavailable link.

repadmin /replsummary
repadmin /showrepl
repadmin /syncall

/replsummary identifies domain controllers that are failing inbound or outbound replication and summarizes the result, /showrepl shows the status of the last inbound replication attempt for each partition, and /syncall synchronizes a domain controller with all its partners. Microsoft warns that incorrect use can harm the replication topology and that a wildcard target can increase network traffic.

What is the global catalog?

It holds information about every object in the forest in a searchable form, so users and applications can find directory information regardless of which domain contains the data.

DNS questions

Why does Active Directory need DNS?

DNS is the default name resolution service in Windows networks and the domain controller location mechanism for authentication, updates and searches. When a user signs in, the DNS client queries a DNS server to find a domain controller, then contacts it to begin authentication. Domain controllers also use DNS to find each other. When you create a new forest and domain, DNS is installed with Active Directory.

What DNS features should you know?

Microsoft's list includes Active Directory integration (secure updates and replication of DNS data), dynamic updates, DNSSEC, forwarding and conditional forwarding, caching, logging, DNS policies and anycast.

A user cannot sign in to the domain from one machine. Walk me through it.

1. Confirm the machine's DNS setting points at a domain DNS server, not a public resolver.
2. Run ipconfig /all to see the configured DNS servers.
3. Run nslookup contoso.com and confirm that the name resolves to domain controller addresses.
4. Run ipconfig /flushdns if stale or negative cache entries could be the cause.
5. Run ipconfig /registerdns if the machine's own records may be missing; Microsoft documents it as manually initiating dynamic registration of DNS names and addresses.
6. On the domain controller, run dcdiag /test:DNS to test basic DNS health, forwarders, delegations, dynamic updates and record registration.

Saying "check DNS first" and showing why is exactly what the interviewer wants to hear.

What do the dcdiag DNS switches check?

/DnsBasic covers network connectivity, DNS client configuration, service availability and zone existence. /DnsForwarders adds forwarders, /DnsDelegation adds delegations, /DnsDynamicUpdate checks whether dynamic update is enabled in the AD zone, /DnsRecordRegistration checks that A, CNAME and SRV records are registered, and /DnsAll runs everything except the external-name test. On large estates /e can be slow because offline servers cause long time-outs.

DHCP questions

What does DHCP do?

It automatically provides an IP host with an address and related configuration such as subnet mask and default gateway, defined in RFCs 2131 and 2132. The server keeps a pool of addresses, exclusions, reservations tied to MAC addresses, and a lease duration. Clients also receive options such as router, DNS servers and DNS domain name. DHCP relay agents forward initial DHCP messages so that you do not need a server on every subnet.

How do you set up a DHCP server in a domain?

Microsoft's quickstart gives this order, which you should be able to recite. The addresses below are placeholders, so substitute your own:

Install-WindowsFeature DHCP -IncludeManagementTools
Add-DhcpServerInDC -DnsName DHCP1.corp.contoso.com -IPAddress 10.0.0.3
Get-DhcpServerInDC
Add-DhcpServerv4Scope -Name "Contoso network" -StartRange 10.10.10.100 -EndRange 10.10.10.200 -SubnetMask 255.255.255.0
Set-DhcpServerv4OptionValue -ScopeId 10.10.10.0 -OptionId 6 -Value "10.10.10.10"

The prerequisites are a static IPv4 address on the server and a planned address range. The authorization step matters: unauthorized DHCP servers in a domain do not lease addresses to clients, which is a security feature that stops rogue servers from handing out wrong addresses.

What is the difference between an exclusion and a reservation?

An exclusion is a range of addresses the server will not hand out, such as space for static devices, and you add one with Add-DhcpServerv4ExclusionRange. A reservation always gives one specific address to one specific MAC address, and you add one with Add-DhcpServerv4Reservation.

What is DHCP failover?

Two DHCP servers share a single scope, which gives redundancy and load balancing. Policies, audit logging and integration with dynamic DNS and IPAM are other features worth naming.

Clients get an unexpected address. What do you check?

Run ipconfig /all on a client to see the address, the DHCP server it came from and the options. Then confirm the scope is active, check leases and exclusions on the server, and check whether a second, rogue DHCP server is answering. ipconfig /release and /renew let you re-test the lease on the client.

Lab plan

Build a two-machine lab: one Windows Server domain controller with DNS, and one client. Then:

1. Create a domain, a few users and an organizational unit.
2. Install and authorize DHCP, create a scope and a reservation, and renew the client lease.
3. Break DNS on the client and diagnose it with nslookup and ipconfig.
4. Run dcdiag and repadmin /replsummary and read each result.
5. Look up the owner of each FSMO role.

If you plan to host the lab in the cloud, see building an Azure home lab on the free account for the limits and cost controls. For Azure-focused interviews, continue with Azure cloud engineer interview questions on networking and identity.

Checklist

• You can list the five FSMO roles, scope and purpose from memory.
• You can explain why AD depends on DNS and how you would diagnose a sign-in failure as a DNS problem.
• You can run and interpret dcdiag and repadmin /replsummary.
• You can install, authorize and configure DHCP in PowerShell.
• You describe each answer as definition, mechanism, failure and check.

References

• Active Directory Domain Services overview: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/get-started/virtual-dc/active-directory-domain-services-overview
• Planning operations master role placement: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/planning-operations-master-role-placement
• dcdiag: https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/dcdiag
• Repadmin (archived reference): https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc770963(v=ws.11)
• What is DHCP Server in Windows Server: https://learn.microsoft.com/en-us/windows-server/networking/technologies/dhcp/dhcp-top
• Install and configure DHCP Server on Windows Server: https://learn.microsoft.com/en-us/windows-server/networking/technologies/dhcp/quickstart-install-configure-dhcp-server
• DNS in Windows and Windows Server: https://learn.microsoft.com/en-us/windows-server/networking/dns/dns-top
• ipconfig: https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/ipconfig