# System Administrator Interview Questions: Active Directory, DNS and DHCP

> Prepare for Windows sysadmin interviews with answer outlines on Active Directory, FSMO roles, replication, DNS and DHCP, plus the dcdiag and PowerShell commands interviewers expect you to know.

Source: https://www.epifive.com/blog/sysadmin-interview-questions-ad-dns-dhcp · Published 2026-10-25 · EpiFive

## Key takeaways

- Three FSMO roles are per domain (PDC emulator, RID master, infrastructure master) and two are per forest (schema master, domain naming master).
- Active Directory depends on DNS for domain controller location, so check DNS first when sign-in or replication fails.
- dcdiag tests domain controller health, and repadmin /replsummary summarizes which domain controllers are failing inbound or outbound replication.
- A DHCP server in a domain must be authorized in Active Directory with Add-DhcpServerInDC before it will lease addresses.
- Answer with a diagnostic path, not just a definition, by saying what you would check, in what order, and why.

Windows sysadmin interviews keep returning to three services that depend on each other: Active Directory Domain Services for identity, DNS for finding things, and DHCP for addressing. A strong answer defines the term in one sentence, says how it fails, and names the command you would run to check. This guide gives you answer outlines, the operations master roles, replication basics, and the commands to practise before the interview.

## Who this is for

This guide is for candidates applying for junior to mid-level system administrator or infrastructure roles in Windows environments, and for help desk staff moving up. By the end you will have crisp definitions, a troubleshooting order for directory and name-resolution problems, and a lab plan to practise the commands. For entry-level support interviews, start with [help desk interview questions for beginners](https://www.epifive.com/blog/help-desk-interview-questions-beginners).

## How to structure any answer

Use definition, mechanism, failure mode, then check. For example, for DNS: it maps names to IP addresses; Active Directory uses it to locate domain controllers; if records are missing, clients cannot sign in to the domain; you check with `nslookup` and `dcdiag /test:DNS`. Four sentences, and the interviewer can then pick where to go deeper.

## Active Directory questions

### What is Active Directory Domain Services?

AD DS is a directory service that stores information about objects on the network, such as user and computer accounts, shared resources and printers, and makes it available to authorized users and administrators. Microsoft lists four supporting pieces: the schema (the rules that define the classes of objects and attributes), the global catalog (information about every object in the directory, searchable regardless of which domain holds it), a query and index mechanism, and a replication service that distributes directory data. Security is integrated through sign-in authentication and access control.

### How does replication work?

All domain controllers in a domain participate in replication and hold a complete copy of the directory information for their domain. Any change is replicated to all domain controllers in the domain. Because AD DS supports multimaster replication, any domain controller can accept a change, which leads to the next question.

### What are the FSMO roles and why do they exist?

Some changes are impractical to perform in a multimaster fashion, so certain domain controllers hold operations master roles that accept those changes. There are five:

| Role | Scope | What it does |
| --- | --- | --- |
| PDC emulator | Domain | Processes password updates and receives preferential replication of password changes |
| RID master | Domain | Maintains the global RID pool and allocates RID pools to domain controllers so every security principal gets a unique identifier |
| Infrastructure master | Domain | Maintains a list of security principals from other domains that are members of groups in its domain |
| Schema master | Forest | Governs schema changes |
| Domain naming master | Forest | Adds and removes domains and other directory partitions from the forest |

Details that interviewers like to hear:

- The first domain controller created in a forest holds all five roles, and the first in each new domain holds the three domain-level roles. Microsoft notes that this can cause high CPU on that first domain controller, so roles are often transferred.
- Read-only domain controllers cannot hold operations master roles.
- If a domain controller fails a logon because of a bad password, it forwards the request to the PDC emulator before rejecting it, since the PDC emulator has the latest password changes.
- Microsoft says not to place the infrastructure master on a global catalog server, except where all domain controllers are global catalog servers or the forest has a single domain, in which case the placement does not matter.
- Place role holders where the network is reliable, and designate standby role holders that are direct replication partners.

### A domain controller seems unhealthy. What do you run?

Start with `dcdiag`. Microsoft describes it as a tool that analyses the state of domain controllers and reports problems, and it must run elevated. Its connectivity tests verify that the domain controller can be located in DNS, answers ICMP pings, allows LDAP binding, and allows binding to the AD RPC interface. Useful forms:

```text
dcdiag
dcdiag /s:DC01 /v
dcdiag /test:DNS /DnsAll
dcdiag /e /q
```

`/s` targets a named server, `/v` is verbose, `/e` tests all servers in the enterprise and `/q` prints only errors. The default tests include Advertising, Services, SysVolCheck, KnowsOfRoleHolders, RidManager, Replications and NetLogons, and the DNS test must be requested explicitly. Mention one caveat from the documentation: blocking ICMP internally prevents dcdiag from working as intended.

### How do you check replication?

Use `repadmin`. Microsoft describes it as the tool for diagnosing replication problems between domain controllers, and says its primary use is monitoring so you can find issues such as offline servers or an unavailable link.

```text
repadmin /replsummary
repadmin /showrepl
repadmin /syncall
```

`/replsummary` identifies domain controllers that are failing inbound or outbound replication and summarizes the result, `/showrepl` shows the status of the last inbound replication attempt for each partition, and `/syncall` synchronizes a domain controller with all its partners. Microsoft warns that incorrect use can harm the replication topology and that a wildcard target can increase network traffic.

### What is the global catalog?

It holds information about every object in the forest in a searchable form, so users and applications can find directory information regardless of which domain contains the data.

## DNS questions

### Why does Active Directory need DNS?

DNS is the default name resolution service in Windows networks and the domain controller location mechanism for authentication, updates and searches. When a user signs in, the DNS client queries a DNS server to find a domain controller, then contacts it to begin authentication. Domain controllers also use DNS to find each other. When you create a new forest and domain, DNS is installed with Active Directory.

### What DNS features should you know?

Microsoft's list includes Active Directory integration (secure updates and replication of DNS data), dynamic updates, DNSSEC, forwarding and conditional forwarding, caching, logging, DNS policies and anycast.

### A user cannot sign in to the domain from one machine. Walk me through it.

1. Confirm the machine's DNS setting points at a domain DNS server, not a public resolver.
2. Run `ipconfig /all` to see the configured DNS servers.
3. Run `nslookup contoso.com` and confirm that the name resolves to domain controller addresses.
4. Run `ipconfig /flushdns` if stale or negative cache entries could be the cause.
5. Run `ipconfig /registerdns` if the machine's own records may be missing; Microsoft documents it as manually initiating dynamic registration of DNS names and addresses.
6. On the domain controller, run `dcdiag /test:DNS` to test basic DNS health, forwarders, delegations, dynamic updates and record registration.

Saying "check DNS first" and showing why is exactly what the interviewer wants to hear.

### What do the dcdiag DNS switches check?

`/DnsBasic` covers network connectivity, DNS client configuration, service availability and zone existence. `/DnsForwarders` adds forwarders, `/DnsDelegation` adds delegations, `/DnsDynamicUpdate` checks whether dynamic update is enabled in the AD zone, `/DnsRecordRegistration` checks that A, CNAME and SRV records are registered, and `/DnsAll` runs everything except the external-name test. On large estates `/e` can be slow because offline servers cause long time-outs.

## DHCP questions

### What does DHCP do?

It automatically provides an IP host with an address and related configuration such as subnet mask and default gateway, defined in RFCs 2131 and 2132. The server keeps a pool of addresses, exclusions, reservations tied to MAC addresses, and a lease duration. Clients also receive options such as router, DNS servers and DNS domain name. DHCP relay agents forward initial DHCP messages so that you do not need a server on every subnet.

### How do you set up a DHCP server in a domain?

Microsoft's quickstart gives this order, which you should be able to recite. The addresses below are placeholders, so substitute your own:

```powershell
Install-WindowsFeature DHCP -IncludeManagementTools
Add-DhcpServerInDC -DnsName DHCP1.corp.contoso.com -IPAddress 10.0.0.3
Get-DhcpServerInDC
Add-DhcpServerv4Scope -Name "Contoso network" -StartRange 10.10.10.100 -EndRange 10.10.10.200 -SubnetMask 255.255.255.0
Set-DhcpServerv4OptionValue -ScopeId 10.10.10.0 -OptionId 6 -Value "10.10.10.10"
```

The prerequisites are a static IPv4 address on the server and a planned address range. The authorization step matters: unauthorized DHCP servers in a domain do not lease addresses to clients, which is a security feature that stops rogue servers from handing out wrong addresses.

### What is the difference between an exclusion and a reservation?

An exclusion is a range of addresses the server will not hand out, such as space for static devices, and you add one with `Add-DhcpServerv4ExclusionRange`. A reservation always gives one specific address to one specific MAC address, and you add one with `Add-DhcpServerv4Reservation`.

### What is DHCP failover?

Two DHCP servers share a single scope, which gives redundancy and load balancing. Policies, audit logging and integration with dynamic DNS and IPAM are other features worth naming.

### Clients get an unexpected address. What do you check?

Run `ipconfig /all` on a client to see the address, the DHCP server it came from and the options. Then confirm the scope is active, check leases and exclusions on the server, and check whether a second, rogue DHCP server is answering. `ipconfig /release` and `/renew` let you re-test the lease on the client.

## Lab plan

Build a two-machine lab: one Windows Server domain controller with DNS, and one client. Then:

1. Create a domain, a few users and an organizational unit.
2. Install and authorize DHCP, create a scope and a reservation, and renew the client lease.
3. Break DNS on the client and diagnose it with `nslookup` and `ipconfig`.
4. Run `dcdiag` and `repadmin /replsummary` and read each result.
5. Look up the owner of each FSMO role.

If you plan to host the lab in the cloud, see [building an Azure home lab on the free account](https://www.epifive.com/blog/azure-home-lab-free-account-limits) for the limits and cost controls. For Azure-focused interviews, continue with [Azure cloud engineer interview questions on networking and identity](https://www.epifive.com/blog/azure-engineer-interview-networking-identity).

## Checklist

- You can list the five FSMO roles, scope and purpose from memory.
- You can explain why AD depends on DNS and how you would diagnose a sign-in failure as a DNS problem.
- You can run and interpret dcdiag and repadmin /replsummary.
- You can install, authorize and configure DHCP in PowerShell.
- You describe each answer as definition, mechanism, failure and check.

## References

- Active Directory Domain Services overview: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/get-started/virtual-dc/active-directory-domain-services-overview
- Planning operations master role placement: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/planning-operations-master-role-placement
- dcdiag: https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/dcdiag
- Repadmin (archived reference): https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc770963(v=ws.11)
- What is DHCP Server in Windows Server: https://learn.microsoft.com/en-us/windows-server/networking/technologies/dhcp/dhcp-top
- Install and configure DHCP Server on Windows Server: https://learn.microsoft.com/en-us/windows-server/networking/technologies/dhcp/quickstart-install-configure-dhcp-server
- DNS in Windows and Windows Server: https://learn.microsoft.com/en-us/windows-server/networking/dns/dns-top
- ipconfig: https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/ipconfig

## Frequently asked questions

### What are the five FSMO roles in Active Directory?

Three roles exist in each domain: PDC emulator, RID master and infrastructure master. Two exist in each forest: schema master and domain naming master. They exist because some changes, such as schema modifications, are impractical to perform in a multimaster fashion.

### Why does Active Directory depend on DNS?

Clients use DNS to locate domain controllers, and domain controllers use DNS to locate each other. If a client cannot resolve the service records for its domain, it cannot find a domain controller to authenticate against, which is why many sign-in failures are really DNS failures.

### Why must a DHCP server be authorized in Active Directory?

Authorization is a security feature that stops unauthorized DHCP servers from handing out incorrect addresses. Unauthorized DHCP servers in an Active Directory domain do not lease addresses to clients, so a new server must be added to the authorized list before it works.

### Which tools check domain controller health?

dcdiag runs a suite of tests against domain controllers, covering DNS registration, connectivity, replication, services and SYSVOL. repadmin reports replication status; repadmin /replsummary and /showrepl are the usual starting points.