Explanation:
1. Obtain and install a new certificate. 2. Copy the certificate thumbprint. 3. Run Windows Admin Center Setup and select Change.
When the certificate backing a Windows Admin Center gateway installation expires, the fix is to supply the gateway with a new certificate through its own Setup program rather than through IIS, because a standalone gateway installation binds its HTTPS listener itself (via the installer) rather than being hosted inside IIS; the IIS Manager certificate-binding option is a distractor that does not apply to this deployment model. The correct sequence starts by obtaining a new certificate from the CA and installing it into the local machine certificate store on Server1, exactly as would have been done for the original certificate. Once the new certificate is in the store, its thumbprint must be copied, because the Windows Admin Center Setup program asks for the certificate by thumbprint when reconfiguring the gateway. The final step is to re-run Windows Admin Center Setup and choose the Change option, which lets you supply the new certificate thumbprint and rebinds the gateway ' s HTTPS listener to it, without uninstalling the product. Repair only reinstalls existing files and settings and does not prompt for a new certificate, and Remove would uninstall Windows Admin Center entirely, losing its configuration, so neither is appropriate. Following obtain-and-install, copy- thumbprint, then Setup-Change replaces the certificate with minimal disruption.

Explanation:
The Failover TCP/IP settings (the IPv4/IPv6 address, subnet, and gateway a replicated VM should assume after failover) are a network-adapter property that only applies to the Replica copy of the virtual machine, so they are configured on VM1 as it exists on the Replica server, Server2 - this is the only place the option is exposed in Hyper-V Manager. A virtual switch, on the other hand, must be present and correctly mapped on both the primary host and the Replica host so that the VM ' s virtual network adapter can connect to a switch whether it is running on Server1 (normal operation) or has failed over to run on Server2, which is why virtual switch configuration needs to be addressed for VM1 on both servers rather than only on the one where failover TCP/IP settings apply. Configuring the Failover TCP/IP settings on Server2 before running the failover test ensures VM1 comes online there with a working static address rather than retaining Server1 ' s original address on an unreachable subnet.

Establishing a WinRM/PowerShell remoting session to Server2 requires membership in a group that actually has effect on Server2 specifically -- either Server2 ' s own local Administrators group or its own local Remote Management Users group. User3 (Server2\Administrators) and User4 (Server2\Remote Management Users) are both explicitly members of local groups scoped directly to Server2, so both directly qualify. User1 ' s membership in Contoso\Administrators -- the domain ' s built-in, domain-scoped Administrators group -- does not automatically translate into local administrator rights on an ordinary member server like Server2; only the Domain Admins (and Enterprise Admins) global groups receive that special, hardcoded automatic local- Administrators nesting at domain-join time, and the domain ' s own built-in " Administrators " group ' s automatic reach is effectively confined to domain controllers, which share a single AD database rather than maintaining separate local SAM databases the way member servers do. Similarly, User2 ' s membership in a domain group named " Contoso\Remote Management Users " has no automatic effect on Server2 ' s own local Remote Management Users group -- there is no such automatic domain-to-local nesting for that group, and no Group Policy Restricted Groups configuration binding the two is described. Consequently, only User3 and User4 -- the users whose group memberships are scoped directly to Server2 itself -- can establish a PowerShell remoting session from Server1 to Server2; User1 and User2 ' s domain-scoped group memberships confer no rights on Server2.

A hand-built mesh of manually created connection objects across a hub site and 20 branch sites produces an enormous number of direct replication links, which is both unnecessary for a topology this size and a common root cause of NTDS Replication event ID 2094 (a DC has not replicated with a partner for an extended period, often because a manual link is stale or unreachable in the way the KCC expects) and DCDIAG replication error 8461 (a domain controller cannot reach or has an inconsistent view of a designated replication partner).
The Knowledge Consistency Checker (KCC) is designed to automatically generate and continuously optimize a minimal, efficient spanning topology across every site link in the forest, adapting to changes and failures without administrator involvement, but the KCC will not remove or override connection objects that were created manually, so as long as the manual mesh remains in place it keeps forcing replication down inefficient, error-prone paths. Deleting the manual connection objects hands topology generation back to the KCC, which will rebuild an efficient set of connections automatically, resolving the stale/unreachable-partner warnings and errors while requiring no ongoing administrative effort, unlike recreating more manual connections or adjusting the Enterprise Domain Controllers group membership (irrelevant to topology) or recreating site links (which govern cost/schedule between sites, not the per-DC connection objects that are actually causing the errors).

The exhibit shows that east.contoso.com already runs domain controllers on Windows Server 2019, and the Active Directory schema version introduced by Windows Server 2019 is schema version 88, which is identical to the schema version used by Windows Server 2022. Because introducing a new Windows Server
2022 domain controller into a domain whose schema already supports that operating system version requires no forest preparation (adprep /forestprep) and no domain preparation (adprep /domainprep), promoting the new domain controller does not require Enterprise Admins or Schema Admins membership at all. Promoting an additional domain controller into a domain whose schema is already compatible with the OS being installed only requires membership in that specific domain ' s Domain Admins group, which for east.contoso.
com is EAST\Domain Admins. Adding Admin1 to CONTOSO\Enterprise Admins or CONTOSO\Schema Admins would grant forest-wide administrative rights far beyond what is needed for this single-domain promotion task, violating least privilege, so the correct and minimally sufficient group membership is EAST\Domain Admins only.