Windows Server Labs

Windows Server 2025 · Azure Arc · AZ-801

Learn Windows Server by doing it, one lab at a time

Two hands-on tracks. In the first, you take an on-premises server and manage it from Azure. In the second, you watch an attack, build the control that stops it, and prove that it works.

Track 1 · 9 labs · about 8 hours

Hybrid management with Azure Arc

One Windows Server 2025 VM per person. Connect it to Azure Arc, unlock the Software Assurance benefits, and use Hotpatch, Azure Policy, Azure Monitor, Change Tracking, Defender for Cloud and Windows Admin Center in Azure. Every lab ends with customer talking points.

  1. Windows Admin Center
  2. Azure Arc onboarding and Azure benefits
  3. Hotpatching with Azure Arc
  4. Azure Policy and Machine Configuration
  5. Azure Monitor
  6. Change Tracking and Inventory
  7. Microsoft Defender for Cloud
  8. Windows management from Azure
  9. Security baseline with OSConfig

Start the hybrid track

Track 2 · 25 labs · AZ-801

Securing Windows Server

Four VMs, one domain, and an attacker. Each lab shows the attack first, then builds the control that stops it: passwords and lockout, Credential Guard, App Control, Protected Users, RODC, delegation, Sentinel, IPsec and BitLocker.

  1. Securing the Windows Server operating system 6 labs
  2. Securing hybrid Active Directory accounts 5 labs
  3. Least privilege and delegation 4 labs
  4. Watching your servers from Azure 4 labs
  5. Securing Windows Server networking 3 labs
  6. Securing Windows Server storage 3 labs

Build the lab and start

How every lab works

  1. The situation. A customer question or an attacker's move: why this lab matters.
  2. The concepts. Just enough theory, in plain words, with an analogy.
  3. Step by step. Build it on your own VM, with the exact commands.
  4. Prove it. A verification command or a portal view that shows it works.
  5. Takeaway. Talking points for the customer, or the one idea to remember.

What you need

Hybrid track

A Windows Server 2025 VM (your instructor provides one), an Azure subscription where you can create a resource group, and about two days.

Security track

A Hyper-V host for four Generation 2 VMs with Secure Boot and a virtual TPM, plus Azure and Microsoft 365 trials for the cloud chapters.