AdvanTech Training Academy

Training Modules

🌐 DNS & Cloudflare

ⓘ Click a module to read the material first, then take the quiz. Score 80%+ to unlock the next module.

🖥️ Hybrid AD & M365

New User Provisioning & Offboarding

ⓘ Modules unlock sequentially. Complete each module at 80%+ to progress.

🔷 UniFi Network

Controller Operations & Device Management

ⓘ Modules unlock sequentially. Complete each module at 80%+ to progress.

🎯 Halo Foundations

HaloPSA Onboarding & Orientation

ⓘ Modules unlock sequentially. Complete each module at 80%+ to progress.

🎫 Halo Service Desk

Tickets, Workflows & Field Service

ⓘ Modules unlock sequentially. Complete each module at 80%+ to progress.

⚙️ Halo Admin

Configuration & Platform Administration

ⓘ Modules unlock sequentially. Complete each module at 80%+ to progress.

☎️ AdvanTechUC VoIP

Practice Lab & VoIP Configuration Standard

ⓘ Practice lab now live — written lessons and certification quiz coming soon.

Academy v2 Modules

Loading Academy v2 modules...

Labs & Simulations

Hands-On Practice

🔷

UniFi Network Lab

Simulated UniFi Network Controller — drag & drop topology, configure VLANs, SSIDs, and firewall rules through guided scenarios.

3 Scenarios +950 XP Total UniFi Cert

→

Certifications

Industry Certification Tracks

Explore all certifications

Browse industry certs across 11 vendors — cost, format, DoD 8140 status, exam weights, and study resources. Tracks with a built-in course open directly.

In-house study tracks

A+

CompTIA A+ Certification Track

Two exams to certify — Core 1 (220-1201) and Core 2 (220-1202). Full lessons, hands-on labs, a practice bank, and timed exams.

2 Exams +1000 XP A+ Cert Badge

→

N+

CompTIA Network+ Certification Track

One exam to certify — N10-009. Full lessons, hands-on labs, a practice bank, and a timed 90-question exam.

1 Exam +1500 XP Net+ Cert Badge

→

ⓘ Earn each badge by passing its exam. Your certifications and XP save to your profile automatically.

Quick Reference Card

DNS Record Types

AIPv4 mapping

AAAAIPv6 mapping

CNAMEAlias to hostname

MXMail server + priority

TXTSPF / DKIM / DMARC

NSNameserver delegation

PTRReverse DNS

CAACA authorization

Cloudflare Error Codes

521Origin refused

522TCP timeout

524Origin too slow

525SSL handshake failed

526Invalid SSL cert

1000Prohibited IP in A record

SSL Modes

FlexibleCF to origin unencrypted

FullHTTPS any cert OK

Full StrictValid cert required

Always HTTPSForce HTTPS at edge

dig Commands

dig example.com AQuery A record

dig +traceFull resolution chain

dig @1.1.1.1Query CF resolver

dig -x 1.2.3.4Reverse DNS

ipconfig /flushdnsFlush Windows cache

🖥️ Key Concepts

UPNUser Principal Name — login ID (user@domain.com)

OUOrganizational Unit — container for users & GPOs

ADUCActive Directory Users & Computers (dsa.msc)

SIDSecurity Identifier — unique, permanent account ID

GPOGroup Policy Object — applied at OU level

Security GroupControls access to resources (files, printers)

Distribution GroupEmail list only — no resource permissions

✅ Create User Checklist

1Navigate to correct OU in ADUC

2Right-click OU → New → User

3Set UPN with routable suffix (@domain.com)

4Set temp password + "must change at next logon"

5Copy existing user for group memberships

6Fill department, title, phone (syncs to M365)

7Leave disabled if start date is future

8Enable account on start day

⚠️ Common Mistakes

.local UPN suffixNon-routable — breaks M365 sync

Wrong OUWrong GPO applies — user in bad policy scope

No group copyMissing access on day one

Forgot to enableUser cannot log in on first day

Simple passwordSecurity risk — use complex temp password

📋 Naming Convention

FormatFirst initial + last name (jsmith)

UPNjsmith@company.com

Display NameJohn Smith

UPN SuffixesManaged in AD Domains & Trusts

Disable vs DeleteAlways disable — never immediate delete

🔄 Sync Basics

AAD ConnectTool that syncs on-prem AD → Entra ID

Delta SyncIncremental — only changed objects

Full SyncRe-reads all objects — use sparingly

Default cycleEvery 30 minutes automatically

Sync serverCommands run on AAD Connect server only

Source of truthOn-prem AD — changes made there, not M365

💻 PowerShell Commands

Import-Module ADSyncLoad the sync module first

Start-ADSyncSyncCycle -PolicyType DeltaManual delta sync

Start-ADSyncSyncCycle -PolicyType InitialFull sync (rarely needed)

Sync Service Managermiisclient.exe — verify sync results

Revoke-AzureADUserAllRefreshTokenKill active sessions

🔗 Match Types

Soft MatchLinks by UPN or SMTP address

Hard MatchLinks by ImmutableID / ms-DS-ConsistencyGuid

Cloud-onlyAccount created directly in Entra ID

Synced accountMastered in AD — edit in AD only

OU FilterOnly OUs in scope sync to cloud

🔍 Troubleshooting Sync

User not in M365 after 30+ minCheck Sync Service Manager for errors

.local UPN suffixAdd routable suffix in AD Domains & Trusts

Wrong OUOU may be excluded from sync filter

Disabled AD → M365Blocks sign-in but does NOT revoke tokens

M365 edit revertsSynced accounts — make changes in AD only

📋 License Tiers

Business BasicWeb/mobile only — no desktop Office apps

Business StandardDesktop apps + Exchange + Teams + SharePoint

Business PremiumStandard + Intune + Defender + AAD P1

Shared MailboxFree under 50GB — no license needed

Mailbox provisioningUp to 30 min after license assigned

Data retention30 days after license removed before deletion

🏢 AdvanTech License Process

WhereTeams → Service Delivery → Escalations channel

FormLicense Request Microsoft Form

Field 1Company Name

Field 2Contact — person who approved the request

Add format+1 Microsoft 365 Business Standard

Remove format-1 Microsoft 365 Business Standard

Applied byDispatcher via Pax8 → syncs to tenant

📧 Mailbox Types

User MailboxPersonal — requires license, has login

Shared MailboxRole-based, no login, free under 50GB

Primary SMTPMain From address — set in AD for synced users

AliasAdditional addresses on same mailbox

Litigation HoldPreserves all content for legal purposes

🌐 Admin Portals

M365 Adminadmin.microsoft.com — users & licenses

Exchange Adminadmin.exchange.microsoft.com — mailboxes

Entra IDentra.microsoft.com — identity & CA

SharePoint Adminadmin.sharepoint.com — sites & policies

🔒 MFA Essentials

Enrollment URLaka.ms/mfasetup

Recommended methodMicrosoft Authenticator app

Security DefaultsFree baseline — enforces MFA for all users

Conditional AccessAAD P1 (Business Premium) — policy-based MFA

Per-user MFAMFA on every sign-in, no exceptions

Push fatigueAttacker sends repeated pushes — report immediately

MFA resetVerify identity first — then reset in M365 admin

🔐 AdvanTech Password Standards

Share passwords viaHudu Secure Send only

Never share viaEmail, Teams, verbally without follow-up

Store in HuduSystem/shared credentials only — not user passwords

MFA backup codesHudu OK for shared admin accounts only

Temp passwordsComplex + force change at next logon

ReuseNever reuse across systems or clients

Rotate shared pwOn employee or client offboarding

📋 Password Reset Log Requirements

Date & timeWhen reset was performed

Identity verificationHow requester was verified

Secure SendConfirm used (if applicable)

Hudu updateOnly if system credential — not personal

🚨 Compromise Response

Unexpected MFA pushSomeone has their password — act immediately

Step 1Reset password

Step 2Reset MFA methods

Step 3Revoke all active sessions

Step 4Escalate to Security team immediately

📁 Permission Levels

OwnerFull control — manage site, permissions, content

MemberAdd, edit, delete content

VisitorRead-only access

Least privilegeAlways grant minimum required level

Check PermissionsSite Settings → look up user's effective access

🔗 SharePoint & Teams Relationship

Every TeamAuto-creates a SharePoint site behind it

M365 GroupShared membership — Teams + SP + Planner + mailbox

Add to TeamGrants SharePoint access automatically

Group vs DirectGroup-based access preferred — easier to manage

SP Admin Centeradmin.sharepoint.com — tenant-wide settings

⚠️ Inheritance & Gotchas

InheritanceLibraries inherit from parent site by default

Broken inheritanceLibrary has own permissions — easy to miss

Can see site, not folderBroken inheritance on that library

Can't edit as MemberLibrary may have Visitor-only broken inheritance

External sharingScope tightly + set expiration date

🚪 Offboarding Steps

Remove from sitesClean up all SharePoint permissions

Remove from groupsM365 Groups and Security Groups

Transfer ownershipSites where they are sole Owner → active user

No active ownerSite becomes unmanageable — do this first

☁️ OneDrive Basics

OneDrivePersonal cloud storage per user

vs SharePointPersonal desk drawer vs shared filing cabinet

Storage included1 TB per user (Business Standard/Premium)

Provisioned whenLicense assigned + user signs in first time

New computerSign into sync client — files download automatically

Files On-DemandCloud placeholders — download only when opened

🔵 Sync Status Icons

Blue cloudSyncing to personal OneDrive

Green checkmarkFile available locally

Grey iconPaused or signed out

Red XSync error — check icon for details

Sync paused causesBattery saver, offline, over quota, file error

📂 Known Folder Move (KFM)

What it doesBacks up Desktop, Documents, Pictures to cloud

Verify KFMRight-click OD icon → Settings → Sync and Backup

Recycle Bin93-day recovery window for deleted files

Version HistoryUp to 500 versions per file — restore anytime

Bad characters# % & * : < > ? / \ | — cause sync failure

Path lengthMax 260 characters — long paths fail to sync

🚪 Offboarding Steps

Before deletingAssign manager as secondary OneDrive owner

Retention window30 days after deletion before permanent loss

Don't rely on windowHandle OneDrive proactively during offboarding

Where to assignM365 Admin Center → user account → OneDrive

🚪 First Questions to Ask

Who is requesting?Must be manager or authorized owner — verify

Disable or convert?Key decision — drives entire workflow

Who needs access?If shared mailbox — who gets delegation

Document approvalLog who authorized the request in the ticket

✅ Offboarding Order of Operations

1Disable AD account → move to Disabled OU

2Trigger manual delta sync immediately

3Revoke all active M365 sessions

4Set auto-reply on mailbox

5Convert mailbox to shared (if applicable)

6Remove license (shared mailboxes free under 50GB)

7Delegate shared mailbox access

8Assign manager as OneDrive secondary owner

9Remove from SharePoint sites & M365 Groups

10Transfer SharePoint site ownership if sole owner

11Rotate shared system passwords they had access to

📬 Shared Mailbox Delegation

Full AccessRead & manage — cannot send as mailbox

Send AsEmail appears from shared mailbox address

Send on BehalfShows "User X on behalf of mailbox"

PreferredFull Access + Send As for most cases

AutomappingOutlook auto-adds shared mailbox — up to 60 min

License after convertRemove immediately — shared mailbox <50GB is free

📋 Ticket Documentation Required

Who approvedManager name on record

Actions & timestampsEach step logged with date/time

Mailbox outcomeDisabled or converted — documented

Delegation granted toNamed users who received access

License removedConfirmed

Sessions revokedConfirmed

Retain disabled account30–90 days before permanent deletion

🔷 Adoption Basics

AdoptionConnects a factory-state device to the controller

Easiest methodUniFi Mobile App — same network, tap to adopt

Same-VLANShould show Pending Adoption automatically

Required portsTCP 8080 + UDP 10001 between device & host

Stuck adoptingFactory reset is the standard last resort

🖥️ set-inform Command

AdvanTech productionset-inform http://unifi.advantechservices.com:8080/inform

Port 8080Inform protocol — device check-in

Port 8443HTTPS management UI — not for set-inform

Cross-VLANRequires Layer 3 routing to allow TCP 8080

🌍 Remote Adoption

Host has public IPConfirm no upstream firewall blocks TCP 8080

Host behind gatewayPort forward TCP 8080 to host's internal IP

VPN connectionAlready same logical network — confirm 8080 open

ZTPZero-Touch Provisioning — no manual commands needed

🌐 The Five Standard VLANs

CORPVLAN 1 — 10.10.1.0/24 — native/untagged

PRODUCTIONVLAN 10 — 10.10.10.0/24

IOTVLAN 20 — 10.10.20.0/24

ANNEXVLAN 30 — 10.10.30.0/24

GUESTVLAN 50 — 10.10.50.0/24 — isolated

🔢 Addressing & Naming

ConventionThird octet = VLAN ID (10.10.[VLAN].0)

Default subnet/24 — 254 usable, ~249 DHCP leases

High-density/22 only when segment needs 250+ devices

SwitchesBy role — CORE-SWITCH, PRODUCTION-SWITCH

APs[Site]-AP-[Zone], e.g. Byron-AP-Lobby

SSIDsSite prefix + suffix, e.g. BBC-IOT, BBC-GUEST

🔥 Firewall Baseline

IoT → CORP/ProductionBlocked

Guest → all internalBlocked; client isolation ON

CORP → internal VLANsAllowed (management access)

Verify withPing test — GUEST → CORP should fail

ExceptionsNarrow, documented port forwards only

🧭 7-Phase Deployment Flow

1Physical Install & Cabling

2Adoption

3WAN & Failover

4VLANs

5WiFi/SSIDs

6Security/Firewall

7Validation & Docs — done = works AND documented

🗄️ Standard Rack Order

1UXG-Pro — gateway, top of rack

2USW-48-POE — core switch

3USW-24-POE — access switches

4Patch panel(s) — bottom

UPS requiredGateway + core switch, always

⚡ PoE Power Budgeting

U7 Pro AP draw~13–20W (802.3at)

Common mistakeFree ports ≠ free PoE budget

SymptomAP randomly drops = check PoE utilization first

🔌 Cabling Standard

TerminationCat6, TIA/EIA-568B, both ends, every run

LabelingBoth ends — source → destination naming

AP drop labelAP zone name, matches controller device name

Certify linksCable certifier — never trust link-light alone

✅ Pre-Adoption Checklist

TopologyStar from core — no daisy-chaining past it

Trunk uplinksWired now, tagging configured later (M17)

Before Phase 2Racked, PoE confirmed, UPS'd, certified, labeled

Don't forgetPhotograph the finished rack for M20 docs

🌐 WAN Setup

Standard configDual WAN — primary ISP + secondary/cellular

WAN1Primary — highest bandwidth, lowest latency

WAN2Secondary — backup ISP or cellular

AddressingMatch ISP handoff exactly — DHCP, Static, or PPPoE

🔁 Failover Mode

AdvanTech defaultFailover Only — WAN2 idle until WAN1 fails

Why not load-balanceBackup circuit shouldn't carry live traffic

Health checksMultiple public IP targets (1.1.1.1, 8.8.8.8)

Common mistakeHealth check pointed at an internal IP

🧪 Verifying Failover

Before closing phasePhysically disconnect WAN1 and confirm cutover

Also confirmFail-back behavior on WAN1 reconnect

Golden ruleUntested failover is an assumption, not a fact

🔀 Creating the VLANs

CORPVLAN 1, 10.10.1.0/24 — native, untagged

OthersVLAN 10/20/30/50 — tagged

DHCP scope/24 default; /22 only at 250+ devices

🔌 Access vs Trunk

AccessSingle VLAN, untagged — end devices

TrunkMultiple VLANs, tagged — uplinks & APs

Why APs need trunkOne AP broadcasts 4 SSIDs on 4 VLANs

🏷️ Port Profiles

All-VLANs-TrunkSwitch & AP uplinks

CORP-AccessStaff workstations

Production-AccessProduction floor equipment

IoT-AccessHVAC, sensors, IoT devices

✅ Verifying Config

TestDevice gets DHCP lease in expected subnet

At end of Phase 4VLANs route freely — isolation is Phase 6

Common mistakeStale port profile from a previous device

📶 SSID → VLAN Mapping

BBCCORP (VLAN 1) — WPA2-Personal

BBC-PRODUCTIONVLAN 10 — WPA2-Personal

BBC-IOTVLAN 20 — WPA2-Personal

BBC-GUESTVLAN 50 — Open + client isolation

AnnexUsually no dedicated SSID

🔐 WPA2 vs WPA3

WPA2Universal compatibility, 4-way handshake

WPA3SAE handshake, stronger, less compatible

IoT SSIDDeliberately WPA2 — chipset compatibility

Transition modeMixed WPA2/WPA3 — middle ground option

🚪 Guest & Client Isolation

Guest securityOpen — no password, by design

Real boundaryVLAN isolation + firewall, not encryption

Client isolationGuests can't see/reach each other

🔥 Isolation Matrix

IoT → CORP/ProductionBlocked

Guest → all internalBlocked

CORP → internalAllowed (management)

PrincipleDeny by default between segments

📋 Writing Rules in UniFi

Rule orderTop to bottom — first match wins

Common mistakeBroad allow above a specific block rule

LAN InInter-VLAN traffic — isolation rules live here

LAN LocalTraffic to the gateway/controller itself

🎯 Documented Exceptions

PatternNarrow port forward — one IP, exact ports

ExampleHVAC at 10.10.20.100, ports 80 & 7226

RuleNo undocumented exceptions, ever

🧪 Verifying Isolation

Guest → CORP pingShould FAIL

IoT → CORP/Production pingShould FAIL

CORP → other VLANs pingShould succeed

All VLANs → internetShould succeed

✅ Full Validation Pass

Phase 2Every device Connected, none pending

Phase 3Failover physically tested

Phase 4Test device gets correct DHCP lease per VLAN

Phase 5All 4 SSIDs verified on correct VLANs

Phase 6Ping tests confirm isolation as expected

📋 Documentation Standard

VLAN schemeEvery ID, subnet, purpose — site-specific values

Device inventoryController name, location, IP for every device

SSIDsMapping + security type recorded

ExceptionsEvery port forward — reason + who requested

PhotosRack layout + cable labeling from Phase 1

🏁 Closeout Standard

RuleDone = works AND documented — both required

Where docs liveHudu, per Module 9 password/doc standards

Risk of skippingNext tech starts from zero, 6 months later

My Progress

Module Scores

★ Bookmarked Questions

AdvanTech Training Academy

Create Account

📢 Announcements

AdvanTech Training Academy

AdvanTech AI Coach