ExamFinch.com My Study

Study guide

7.7 Integration Services, Guest Components & Time Synchronization

Practice this exam

Administering Windows Server Hybrid Core Infrastructure AZ-800

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

About Exam AZ-800: Format, Scoring & the September 2026 Retirement

2 Chapter 1: Active Directory Domain Services Architecture & Deployment

1.1 Deploying & Managing Domain Controllers On-Premises 1.2 Domain Controllers in Azure IaaS & Virtualized DC Cloning 1.3 Read-Only Domain Controllers (RODCs) & Password Replication Policies 1.4 Flexible Single Master Operation (FSMO) Roles & Troubleshooting 1.5 Active Directory Sites, Subnets & Site Link Topology 1.6 AD DS Replication: Topology Generation, Convergence & Diagnostics 1.7 Forest and Domain Trust Relationships

3 Chapter 2: AD DS Security Principals, Service Accounts & Domain Join

2.1 Managing Users, Groups & Objects in Multi-Domain and Multi-Forest Environments 2.2 Service Account Types & Group Managed Service Accounts (gMSA) 2.3 Joining Windows Server to AD DS, Microsoft Entra Domain Services & Microsoft Entra ID 2.4 Creating & Managing Users, Groups and Organizational Units at Scale

4 Chapter 3: Hybrid Identity & Microsoft Entra Integration

3.1 Microsoft Entra Connect Sync Architecture, Installation & Filtering 3.2 SourceAnchor, Synchronization Rules & Microsoft Entra Connect Health 3.3 Microsoft Entra Cloud Sync & Disconnected Multi-Forest Topologies 3.4 Hybrid Authentication Methods & Staged Rollout 3.5 Microsoft Entra Domain Services 3.6 Integrating Microsoft Entra ID, AD DS & Entra Domain Services: Choosing an Architecture

5 Chapter 4: Group Policy in AD DS and Hybrid Environments

4.1 Group Policy Architecture & Processing Order (LSDOU) 4.2 Group Policy Filtering, Loopback Processing & Client-Side Extensions 4.3 Group Policy Preferences, Item-Level Targeting & Central Store 4.4 Group Policy in Microsoft Entra Domain Services & Fine-Grained Password Policies

6 Chapter 5: Remote Server Management in Hybrid Environments

5.1 Windows Admin Center (WAC) Deployment On-Premises and in Azure 5.2 PowerShell Remoting, WinRM & the Kerberos Double-Hop Problem 5.3 Just Enough Administration (JEA) for Constrained PowerShell Endpoints 5.4 OpenSSH on Windows Server & PowerShell Remoting over SSH 5.5 Secure RDP Access, Remote Desktop Gateway & Azure Bastion

7 Chapter 6: Hybrid Management with Azure Arc and Azure Services

6.1 Azure Arc-Enabled Servers Architecture & Onboarding 6.2 Azure Machine Configuration & VM Extensions on Arc Servers 6.3 Azure Update Manager: Assessment, Maintenance Configurations & Dynamic Scoping 6.4 Azure Automation for Hybrid Workloads: Runbooks & Hybrid Runbook Workers

8 Chapter 7: Hyper-V Virtualization & Virtual Machine Configuration

7.1 Hyper-V Type 1 Architecture, Installation & Hardware Prerequisites 7.2 VM Generations, Secure Boot, vTPM, Enhanced Session Mode & Direct VM Access 7.3 Compute, Dynamic Memory & Hardware Acceleration 7.4 VM Resource Controls, CPU Groups & Host Compute Partitioning 7.5 Hyper-V Virtual Hard Disks & Checkpoint Management 7.6 Hyper-V Virtual Switches, NIC Teaming & Switch Embedded Teaming (SET) 7.7 Integration Services, Guest Components & Time Synchronization

9 Chapter 8: Hyper-V High Availability, Security & Containers

8.1 Hyper-V Failover Clustering & Cluster Shared Volumes (CSV) 8.2 Hyper-V Replica & Azure Site Recovery (ASR) 8.3 Guarded Fabric & Shielded Virtual Machines 8.4 Windows Server Container Hosts, Isolation Models & Images 8.5 Managing Container Instances & Linux Containers with WSL 8.6 Windows Container Networking & AKS Enabled by Azure Arc 8.7 Managing Container Images, Tags & Azure Container Registry

10 Chapter 9: Azure IaaS Virtual Machine Administration

9.1 Azure VM Sizing, Series Selection & Managed Disk Tiers 9.2 Azure VM Host Caching, Disk Bursting, Ephemeral OS Disks & Disk Operations 9.3 Azure VM High Availability: Availability Sets, Zones & Proximity Placement Groups 9.4 Virtual Machine Scale Sets, Autoscale & Azure Dedicated Hosts 9.5 Azure VM Networking, NSGs & Connectivity

11 Chapter 10: Hybrid DNS Infrastructure & Name Resolution

10.1 Active Directory-Integrated DNS Architecture, Dynamic Updates & Zone Types 10.2 DNS Records, Aging & Scavenging and the GlobalNames Zone 10.3 DNS Forwarding, Conditional Forwarding & Azure DNS Zone Integration 10.4 Hybrid Name Resolution with Azure DNS Private Resolver 10.5 Windows Server DNS Policies & DNSSEC

12 Chapter 11: IP Addressing, DHCP & IPAM Management

11.1 DHCP Server Role, the DORA Lifecycle & Active Directory Authorization 11.2 DHCP Scopes, Option Hierarchy, Reservations & Relay Agents 11.3 DHCP High Availability & Failover Configurations 11.4 IP Address Management (IPAM) Deployment & Auditing 11.5 Resolving IP Address Issues in Hybrid Environments

13 Chapter 12: Hybrid Network Connectivity, Remote Access & Private Access

12.1 Remote Access Role, VPN Protocols & Site-to-Site VPN to Azure 12.2 Network Policy and Access Services (NPAS), RADIUS & Policy Processing 12.3 Azure Network Adapter & Azure Extended Network 12.4 Web Application Proxy & Microsoft Entra Application Proxy 12.5 Microsoft Entra Private Access & Global Secure Access 12.6 Azure Relay & Hybrid Connections

14 Chapter 13: File Services, DFS, SMB & Azure File Sync

13.1 Windows Server File Share Access, NTFS Permissions & Access-Based Enumeration 13.2 File Server Resource Manager: Quotas, File Screens & Storage Reports 13.3 DFS Namespaces (DFS-N) & DFS Replication (DFS-R) 13.4 BranchCache: Distributed Cache and Hosted Cache Modes 13.5 Modern SMB Protocols, SMB Multichannel & SMB over QUIC 13.6 Azure File Shares, Tiers & Hybrid Permissions 13.7 Azure File Sync, Cloud Tiering & Monitoring 13.8 Migrating DFS Namespaces & DFS Replication to Azure File Sync

15 Chapter 14: Windows Server Storage Infrastructure & High Availability

14.1 Disk Partitioning, Volumes & Enterprise File Systems (NTFS vs ReFS) 14.2 Data Deduplication Architecture, Usage Types & Management 14.3 Storage Spaces & Storage Spaces Direct (S2D) 14.4 Storage Replica & Storage Quality of Service 14.5 iSCSI Target Server, IQNs, CHAP Authentication & Multipath I/O

7.7 Integration Services, Guest Components & Time Synchronization

Key Takeaways Explain This Topic AI

Hyper-V exposes six integration services per VM: Guest Service Interface, Heartbeat, Key-Value Pair Exchange, Shutdown, Time Synchronization, and VSS.

Guest Service Interface is the only integration service disabled by default; Copy-VMFile fails until it is enabled with Enable-VMIntegrationService .

Disable Time Synchronization on virtualized domain controllers so the AD DS time hierarchy governs, and point the forest-root PDC Emulator at an external NTP source.

Windows Server 2016 and later hosts still resynchronize a guest clock at VM start and after a checkpoint restore, even when Time Synchronization is disabled.

Windows Server 2012 and later guests have built-in integration services that are serviced through Windows Update; current Windows Server 2025 hosts do not provide the legacy integration-services setup disk.

Last updated: August 2026

Integration Services, Guest Components & Time Synchronization

Every Hyper-V guest runs a set of integration services (also called integration components , or ICs) — paravirtualized drivers and service endpoints that let the guest cooperate with the host over the VMBus instead of pretending to be physical hardware. Microsoft calls these out as their own objective ("Configure integration services"), and exam items lean on two facts candidates routinely miss: Guest Services is off by default , and Time Synchronization is the one you deliberately turn off on domain controllers .

1. The Six Integration Services

Each service is independently toggleable per virtual machine. The names below are the exact strings the PowerShell cmdlets accept.

Service ( -Name value) What it does Default Fails how, if disabled

Guest Service Interface Enables host-to-guest file copy over VMBus ( Copy-VMFile ) Disabled Copy-VMFile fails even though the VM is healthy and running

Heartbeat Guest periodically reports "I am alive" to the host Enabled Get-VM shows no heartbeat; clustering cannot detect a hung guest

Key-Value Pair Exchange Two-way registry-based data channel (KVP); how the host learns the guest's IP addresses, OS build and FQDN Enabled Get-VMNetworkAdapter shows blank IPAddresses ; WAC/Hyper-V Manager cannot show guest OS details

Shutdown Host can gracefully shut the guest down ( Stop-VM without -TurnOff ) Enabled Stop-VM can only hard power off, risking dirty shutdowns

Time Synchronization Host pushes its clock into the guest Enabled Guest clock drifts unless another time source (domain hierarchy or NTP) governs it

VSS (listed as Backup (volume checkpoint) ) Host-initiated Volume Shadow Copy Service freeze for application-consistent backups and production checkpoints Enabled Production checkpoints silently fall back to crash-consistent, or fail if fallback is turned off +-----------------------------------------------------------------------------------------+

  • | INTEGRATION SERVICES OVER THE VMBus |
  • | |
  • | [ROOT PARTITION / HOST] [CHILD PARTITION / GUEST] |
  • | +---------------------------------+ +----------------------------+ |
  • | | Virtual Machine Management Svc | | Hyper-V Guest Shutdown Svc | |
  • | | (vmms.exe) + VM Worker Process | | Hyper-V Heartbeat Svc | |
  • | | | <== VMBus ==> | Hyper-V Data Exchange Svc | |
  • | | Virtualization Service | (no emulated | Hyper-V Time Sync Svc | |
  • | | Providers (VSPs) | hardware) | Hyper-V Volume Shadow Copy | |
  • | | | | Hyper-V Guest Svc Interface| |
  • | +---------------------------------+ +----------------------------+ |
  • | (Virtualization Service |
  • | Clients / VSCs) |
  • +-----------------------------------------------------------------------------------------+

2. Managing Integration Services with PowerShell # Inspect every integration service and its live health on one VM

  • Get-VMIntegrationService -VMName "VM-APP-01" |
  • Format-Table Name, Enabled, PrimaryStatusDescription, SecondaryStatusDescription
  • # Enable Guest Services so Copy-VMFile works (disabled by default)
  • Enable-VMIntegrationService -VMName "VM-APP-01" -Name "Guest Service Interface"
  • # Copy a file from host to guest with no network path required
  • Copy-VMFile -VMName "VM-APP-01" `
  • SourcePath "C:\Payload\agent.msi" `
  • DestinationPath "C:\Temp\agent.msi" `
  • CreateFullPath -FileSource Host
  • # Disable host time push on a virtualized domain controller
  • Disable-VMIntegrationService -VMName "DC-01" -Name "Time Synchronization"
  • # Enable the same service across an entire fleet
  • Get-VM | Enable-VMIntegrationService -Name "Guest Service Interface"

Read the PrimaryStatusDescription column, not just Enabled . Enabled = True with a status of "Protocol version mismatch" or "The virtual machine is not running" means the service is switched on but is not actually functioning — a mismatch almost always means the guest's integration components are older than the host's.

3. Time Synchronization and the Domain Controller Trap

The Hyper-V time provider is a stratum-adjacent authority : it feeds the host's clock straight into the guest. That is exactly what you want on a member server and exactly what you do not want on a domain controller, because AD DS runs its own time hierarchy and Kerberos rejects tickets whose timestamps skew beyond the (default) five-minute tolerance.

The standard design is:

The PDC Emulator in the forest root domain is the authoritative time source for the whole forest and should sync to an external NTP source , not to its Hyper-V host.

Guest domain controllers should have Time Synchronization cleared so the AD time hierarchy — not the hypervisor — governs their clocks.

Everything else (member servers, workstations) inherits time from the domain hierarchy via W32Time.

Important

Even with Time Synchronization disabled, Windows Server 2016 and later hosts still resynchronize a guest's clock at VM start and after a checkpoint is restored . This is why reverting a domain controller to a checkpoint can produce time-skew symptoms alongside the safe-restore and non-authoritative resynchronization behavior covered in section 7.5 — and it is another reason checkpoints are not a backup strategy for DCs.

4. Keeping Integration Components Current

Guest generation How ICs are delivered

Windows Server 2012 and later guests Integration services are built in ; keep them current with important Windows updates. Current Hyper-V hosts do not ship an integration-services setup disk

Windows Server 2008 and 2008 R2 guests Install all critical Windows updates in the guest. The setup-disk workflow belongs to Hyper-V hosts older than Windows Server 2016, not to a current Windows Server 2025 host

Modern Linux guests Linux Integration Services (LIS) are built into the upstream kernel; only older RHEL/CentOS builds need the separate LIS download

FreeBSD guests BIS (BSD Integration Services) shipped in-kernel from FreeBSD 10 onward

A version mismatch is not cosmetic. On a current host, first verify the guest service is running, install important updates inside the Windows guest, restart it, and recheck both IntegrationServicesVersion and the affected service status. Out-of-date ICs can cause degraded network throughput, missing KVP data, and production checkpoints that will not take.

5. Fast Reference: Symptom → Integration Service

  • Symptom reported in a scenario Integration service to check
  • Copy-VMFile returns "the operation failed" on a running VM Guest Service Interface (disabled by default)
  • Hyper-V Manager shows blank IP address / OS name for a guest Key-Value Pair Exchange
  • Stop-VM only powers off instead of shutting down cleanly Shutdown
  • Backup product produces crash-consistent images of a SQL guest VSS
  • Cluster does not fail over a hung but powered-on VM Heartbeat
  • Domain controller's clock is being dragged off the AD hierarchy Time Synchronization (disable it)