Windows 2008 IIS Common Issue on MP : Make sure you need to meet this settings on your windows 2008 server
ConfigMgr Learn it and work it
Showing posts with label Windows 2008. Show all posts
Showing posts with label Windows 2008. Show all posts
13 October 2010
21 June 2010
Below are the basic exceptional for any antivirus for Microsoft products…
Windows:
KB822158 Virus scanning recommendations for Enterprise computers that are running currently supported versions of Windows
Windows / Active Directory:
http://support.microsoft.com/kb/822158
http://support.microsoft.com/kb/837932
http://support.microsoft.com/kb/943556
Cluster:
http://support.microsoft.com/kb/250355
Forefront: Considerations when using antivirus software on FF Edge
Products
http://support.microsoft.com/kb/943620
http://technet.microsoft.com/en-us/library/cc707727.aspx
FRS:
http://support.microsoft.com/kb/815263
SQL:
http://support.microsoft.com/kb/309422
IIS:
http://support.microsoft.com/kb/821749
http://support.microsoft.com/kb/817442
DHCP:
http://support.microsoft.com/kb/927059
SCOM / MOM:
http://support.microsoft.com/kb/975931
Hyper-V:
http://support.microsoft.com/default.aspx/kb/961804
Exchange:
Exchange 2010: http://technet.microsoft.com/en-us/library/bb332342.aspx
Exchange 2007: http://technet.microsoft.com/en-us/library/bb332342(EXCHG.80).aspx
http://support.microsoft.com/kb/328841
http://support.microsoft.com/kb/823166
http://support.microsoft.com/kb/245822
http://technet.microsoft.com/en-us/library/bb332342(EXCHG.80).aspx
http://technet.microsoft.com/en-us/library/bb332342.aspx
SharePoint:
http://support.microsoft.com/kb/952167
http://support.microsoft.com/kb/320111
http://support.microsoft.com/kb/322941
SMS:
http://support.microsoft.com/kb/327453
ISA:
http://support.microsoft.com/kb/887311
WSUS:
http://support.microsoft.com/kb/900638
SBS:
http://support.microsoft.com/kb/885685
Med-V
Recommended Anti-Virus exclusions for MED-V client and workspace installations
System Center:
Recommendations for antivirus exclusions in MOM 2005 and Operations Manager 2007
08 April 2010
You want to stop unwanted things while loading or want to get control of boot load files??
Ohh.. my systems dead slow after joins here… they given me T61 with 1 GB.. Where my system taking more than 1 Gb almost every time I am working my Page file….
I checked this utility, which has the most comprehensive knowledge of auto-starting locations of any startup monitor, shows you what programs are configured to run during system bootup or login, and shows you the entries in the order Windows processes them. These programs include ones in your startup folder, Run, RunOnce, and other Registry keys. You can configure Autoruns to show other locations, including Explorer shell extensions, toolbars, browser helper objects, Winlogon notifications, auto-start services, and much more. Autoruns goes way beyond the MSConfig utility bundled with Windows Me and XP.
Autoruns' Hide Signed Microsoft Entries option helps you to zoom in on third-party auto-starting images that have been added to your system and it has support for looking at the auto-starting images configured for other accounts configured on a system. Also included in the download package is a command-line equivalent that can output in CSV format, Autorunsc.
You'll probably be surprised at how many executables are launched automatically!
Here is the link to download http://live.sysinternals.com/autoruns.exe
You want to stop unwanted things while loading or want to get control of boot load files??
Ohh.. my systems dead slow after joins here… they given me T61 with 1 GB.. Where my system taking more than 1 Gb almost every time I am working my Page file….
I checked this utility, which has the most comprehensive knowledge of auto-starting locations of any startup monitor, shows you what programs are configured to run during system bootup or login, and shows you the entries in the order Windows processes them. These programs include ones in your startup folder, Run, RunOnce, and other Registry keys. You can configure Autoruns to show other locations, including Explorer shell extensions, toolbars, browser helper objects, Winlogon notifications, auto-start services, and much more. Autoruns goes way beyond the MSConfig utility bundled with Windows Me and XP.
Autoruns' Hide Signed Microsoft Entries option helps you to zoom in on third-party auto-starting images that have been added to your system and it has support for looking at the auto-starting images configured for other accounts configured on a system. Also included in the download package is a command-line equivalent that can output in CSV format, Autorunsc.
You'll probably be surprised at how many executables are launched automatically!
Here is the link to download http://live.sysinternals.com/autoruns.exe
WINDOWS 2008 R2 : MY FINDINGS
There are 17 possible roles and 42 different features that can be enabled on Windows Server 2008 R2 Enterprise Edition.
Hyper-V role is not available for Windows Server 2008 R2 Itanium, Windows Server 2008 R2 Web, or Windows Server 2008 R2 Foundation.
Another problem in Windows Server 2008 Hyper-V was the inability to dynamically change the storage on a running VM. Unlike in the physical world where you can easily add or remove Universal Serial Bus (USB), eSATA, or iSCSI drives without shutting down a server, the only way to add or remove VHDs from a VM was to shut the VM down
WINDOWS 2008 R2 : MY FINDINGS
There are 17 possible roles and 42 different features that can be enabled on Windows Server 2008 R2 Enterprise Edition.
Hyper-V role is not available for Windows Server 2008 R2 Itanium, Windows Server 2008 R2 Web, or Windows Server 2008 R2 Foundation.
Another problem in Windows Server 2008 Hyper-V was the inability to dynamically change the storage on a running VM. Unlike in the physical world where you can easily add or remove Universal Serial Bus (USB), eSATA, or iSCSI drives without shutting down a server, the only way to add or remove VHDs from a VM was to shut the VM down
23 March 2010
Group Policy Software Deployment: Targeting the right computers with WMI filters
Group policy was introduced with Windows 2000, and is an easy way of centralizing many Windows settings. In addition to centralizing event log and firewall settings, I personally like the ability to deploy MSI-based software applications with Group Policy, since it makes it extremely easy to deploy new software packages.
Even though Software Installation only works only with MSI-based packages, it does make deploying MSI-based software packages extremely easy.
We generally deploy software through Group Policy when three or more computers use it, since it's very easy to create a new package (if you already have a network share etc. setup, then you can literally do it in 2 minutes).
Before I list some of the useful WMI queries we use to target certain operating systems or computer types, there are a couple of things to note for those who are new to software deployment via group policy:
- Software packages are always installed right after a reboot, so they're mostly suitable for workstations.
- The network share which hosts the MSI files needs to give the computer accounts (e.g. DESKTOP1$) at least read access. Generally, giving EveryOne Read access works well unless you have a reason to restrict access to the software packages that you distribute.
Since OUs can contain a large amount of computers that might not all need that particular software package, you can use two techniques to narrow down which computers receive the software:
- Security Filtering
- WMI Filtering
With this method, you create a security group in Active Directory, place the computers that should get a particular software package into the group, and then specify this group in the Security Filtering list.
The screen shot below shows a group policy that will only be applied to members of the "Source Control Computers" group:
WMI Filtering
With this method, you can filter the computers which are affected by your policy, based on common properties of the Operating System. For example, some packages might distinguish between 32-bit and 64-bit, some packages might only work on Vista or later, whereas other packages apply only to servers. With WMI, you can target the right computers without having to mess with group memberships (though you will probably still need to do that). For example:
- 32-bit vs. 64-bit computers
- only workstations
- only computers running a certain OS
- only computers with a certain amount of RAM
- only computers of a certain brand
- 7-Zip 32-bit
- 7-Zip 64-bit
and then apply the respective WMI filter to them. But lets cut to the chase, here are a few WMI queries that you can cut & paste:
Operating System 32-bit
Select * from Win32_Processor where AddressWidth = '32'
Operating System 64-bit
Select * from Win32_Processor where AddressWidth = '64'
Workstation
Select * from WIN32_OperatingSystem where ProductType=1
Domain Controller
Select * from WIN32_OperatingSystem where ProductType=2
Server
Select * from WIN32_OperatingSystem where ProductType=3
Some filters require multiple WMI queries, which are just chained together.
Workstation 32-bit
Select * from WIN32_OperatingSystem where ProductType=1
Select * from Win32_Processor where AddressWidth = '32'
Workstation 64-bit
Select * from WIN32_OperatingSystem where ProductType=1
Select * from Win32_Processor where AddressWidth = '64'
Windows XP
Select * from WIN32_OperatingSystem where Version='5.1.2600' and ProductType=1
Windows Vista
Select * from WIN32_OperatingSystem where Version='6.0.6002' and ProductType=1
Windows 7
Select * from WIN32_OperatingSystem where Version='6.1.7600' and ProductType=1
Windows 2003
Select * from WIN32_OperatingSystem where Version='5.2.3790' and ProductType>1
Windows 2008
Select * from WIN32_OperatingSystem where Version='6.0.6002' and ProductType>1
Windows 2008 R2
Select * from WIN32_OperatingSystem where Version='6.1.7600' and ProductType>1
WIN32_OperatingSystem of course includes more information that can be useful for WMI queries, such as a descriptive name of the installed OS ("Name") as well as the service pack installed ("ServicePackMajorVersion").
Manufacturer (e.g. DELL)
Select * from WIN32_ComputerSystem where Manufacturer = 'DELL'
Installed Memory (e.g. more than 1Gb)
Select * from WIN32_ComputerSystem where TotalPhysicalMemory >= 1073741824
For more information, check out these resources on WMI:
WMI
Secrets of Windows Management Instrumentation
Scriptomatic (Vista/Win2k8/Win7: run as administrator!)
Group Policy Software Deployment: Targeting the right computers with WMI filters
Group policy was introduced with Windows 2000, and is an easy way of centralizing many Windows settings. In addition to centralizing event log and firewall settings, I personally like the ability to deploy MSI-based software applications with Group Policy, since it makes it extremely easy to deploy new software packages.
Even though Software Installation only works only with MSI-based packages, it does make deploying MSI-based software packages extremely easy.
We generally deploy software through Group Policy when three or more computers use it, since it's very easy to create a new package (if you already have a network share etc. setup, then you can literally do it in 2 minutes).
Before I list some of the useful WMI queries we use to target certain operating systems or computer types, there are a couple of things to note for those who are new to software deployment via group policy:
- Software packages are always installed right after a reboot, so they're mostly suitable for workstations.
- The network share which hosts the MSI files needs to give the computer accounts (e.g. DESKTOP1$) at least read access. Generally, giving EveryOne Read access works well unless you have a reason to restrict access to the software packages that you distribute.
Since OUs can contain a large amount of computers that might not all need that particular software package, you can use two techniques to narrow down which computers receive the software:
- Security Filtering
- WMI Filtering
With this method, you create a security group in Active Directory, place the computers that should get a particular software package into the group, and then specify this group in the Security Filtering list.
The screen shot below shows a group policy that will only be applied to members of the "Source Control Computers" group:
WMI Filtering
With this method, you can filter the computers which are affected by your policy, based on common properties of the Operating System. For example, some packages might distinguish between 32-bit and 64-bit, some packages might only work on Vista or later, whereas other packages apply only to servers. With WMI, you can target the right computers without having to mess with group memberships (though you will probably still need to do that). For example:
- 32-bit vs. 64-bit computers
- only workstations
- only computers running a certain OS
- only computers with a certain amount of RAM
- only computers of a certain brand
- 7-Zip 32-bit
- 7-Zip 64-bit
and then apply the respective WMI filter to them. But lets cut to the chase, here are a few WMI queries that you can cut & paste:
Operating System 32-bit
Select * from Win32_Processor where AddressWidth = '32'
Operating System 64-bit
Select * from Win32_Processor where AddressWidth = '64'
Workstation
Select * from WIN32_OperatingSystem where ProductType=1
Domain Controller
Select * from WIN32_OperatingSystem where ProductType=2
Server
Select * from WIN32_OperatingSystem where ProductType=3
Some filters require multiple WMI queries, which are just chained together.
Workstation 32-bit
Select * from WIN32_OperatingSystem where ProductType=1
Select * from Win32_Processor where AddressWidth = '32'
Workstation 64-bit
Select * from WIN32_OperatingSystem where ProductType=1
Select * from Win32_Processor where AddressWidth = '64'
Windows XP
Select * from WIN32_OperatingSystem where Version='5.1.2600' and ProductType=1
Windows Vista
Select * from WIN32_OperatingSystem where Version='6.0.6002' and ProductType=1
Windows 7
Select * from WIN32_OperatingSystem where Version='6.1.7600' and ProductType=1
Windows 2003
Select * from WIN32_OperatingSystem where Version='5.2.3790' and ProductType>1
Windows 2008
Select * from WIN32_OperatingSystem where Version='6.0.6002' and ProductType>1
Windows 2008 R2
Select * from WIN32_OperatingSystem where Version='6.1.7600' and ProductType>1
WIN32_OperatingSystem of course includes more information that can be useful for WMI queries, such as a descriptive name of the installed OS ("Name") as well as the service pack installed ("ServicePackMajorVersion").
Manufacturer (e.g. DELL)
Select * from WIN32_ComputerSystem where Manufacturer = 'DELL'
Installed Memory (e.g. more than 1Gb)
Select * from WIN32_ComputerSystem where TotalPhysicalMemory >= 1073741824
For more information, check out these resources on WMI:
WMI
Secrets of Windows Management Instrumentation
Scriptomatic (Vista/Win2k8/Win7: run as administrator!)
08 February 2010
ADST and AD Daily health Checks
Active Directory Snapshot Tool (ADST)
ADST tools is the one like MBSA it checks everything about AD healthchecks.
Below are the complete tools for AD health checks
| Test |
| Frequency | |
| AD Convergence | Daily |
| DCDiag – General | Daily |
| FRS Convergence | Daily |
| Performance Info | Daily |
| Replication Status | Daily |
| Account Policies | Weekly |
| Backup Status | Weekly |
| Database Info | Weekly |
| DCDiag – DNS | Weekly |
| DNSLint | Weekly |
| DNS Information | Weekly |
| Event Logs | Weekly |
| Exchange DSAccess | Weekly |
| GPOTool | Weekly |
| IP Information | Weekly |
| Large Groups | Weekly |
| OS Information | Weekly |
| Replication Configuration | Weekly |
| Site Configuration | Weekly |
| Subnet Information | Weekly |
| SYSVOL Information | Weekly |
| Time Configuration | Weekly |
| WINS 1B and 1C | Weekly |
| AD Object Count | Monthly |
| Forest / Domain Information | Monthly |
| Machine Account Info | Monthly |
| Orphaned GPTs | Monthly |
| Partition ACLs | Monthly |
| Security Updates | Monthly |
| Unlinked GPOs | Monthly |
| User Account Info | Monthly |
| Account Lockouts | As needed |
| ADST Dependencies | As needed |
-------------------
Thanks,
Pablo Picasso - "Computers are useless. They can only give you answers."
ADST and AD Daily health Checks
Active Directory Snapshot Tool (ADST)
ADST tools is the one like MBSA it checks everything about AD healthchecks.
Below are the complete tools for AD health checks
| Test |
| Frequency | |
| AD Convergence | Daily |
| DCDiag – General | Daily |
| FRS Convergence | Daily |
| Performance Info | Daily |
| Replication Status | Daily |
| Account Policies | Weekly |
| Backup Status | Weekly |
| Database Info | Weekly |
| DCDiag – DNS | Weekly |
| DNSLint | Weekly |
| DNS Information | Weekly |
| Event Logs | Weekly |
| Exchange DSAccess | Weekly |
| GPOTool | Weekly |
| IP Information | Weekly |
| Large Groups | Weekly |
| OS Information | Weekly |
| Replication Configuration | Weekly |
| Site Configuration | Weekly |
| Subnet Information | Weekly |
| SYSVOL Information | Weekly |
| Time Configuration | Weekly |
| WINS 1B and 1C | Weekly |
| AD Object Count | Monthly |
| Forest / Domain Information | Monthly |
| Machine Account Info | Monthly |
| Orphaned GPTs | Monthly |
| Partition ACLs | Monthly |
| Security Updates | Monthly |
| Unlinked GPOs | Monthly |
| User Account Info | Monthly |
| Account Lockouts | As needed |
| ADST Dependencies | As needed |
-------------------
Thanks,
Pablo Picasso - "Computers are useless. They can only give you answers."
09 January 2010
Windows 2008 Core Server Commands in MY LAB I Used
============================================================================================================================================
****************To rename the server Name
Default installations of Windows Server 2008 give the server a name like WIN-94CX1930EF21 or some other obscure pattern that doesn't fit into most computer infrastructures. You can change the computer name using the netdom command. Netdom (which isn't a new tool) is an easy way to change the computer name after Windows Server 2008 is installed on Core Editions. You can also use it on the full installation versions.
It's pretty straightforward to use the netdom command. For example, let's go from the default name WIN-94CX1930EF21 to a computer name of SERVER13. This is the command you would enter:
netdom renamecomputer WIN-94CX1930EF21 /Newname SERVER13
============================================================================================================================================
****************To Add the IP address
In Windows Server 2008 Core installation, the only way to setup IP Address eithe Static or DHCP is from the command line. The following procedure helps setting the IP Address from the command Line using "netsh". This procedure works in Windows Server 2008 (No core installation as well), Windows Server 2003, Windows XP, Windows Vista.
To setup Static IP Address:
From the command prompt:
1. Type
C:\Users\Administrator> netsh interface ipv4 show interfaces
Idx Met MTU State Name
- – — —- ——-
1 50 4294967295 connected Loopback Pseudo-Interface 1
10 20 1500 connected Local Area Connection
This should show the Network Connections. We are looking for the name here. On mine, I have one LAN interface and is named as "Local Area Connection"
2. To set a static IP Address type the following command
C:\Users\Administrator>netsh interface ipv4 set address name="Local Area Connect
ion" source=static address=192.168.0.5 mask=255.255.255.0 gateway=192.168.0.1
The syntax is
netsh interface ipv4 set address name="<ID>" source=static address=<StaticIP> mask=<SubnetMask> gateway=<DefaultGateway>
Where:
ID is the name of the LAN Connection
StaticIP is the static IP address that you are setting
SubnetMask is the subnet mask for the IP address
DefaultGateway is the default gateway
===========================================================================================================================================
****************TO set the DNS Servers :---
set the DNS Servers one at a time with the followind command. For each DNS server, increase the index number.
C:\Users\Administrator>netsh interface ipv4 add dnsserver name="Local Area Connection" address=192.168.0.1 index=1
C:\Users\Administrator>netsh interface ipv4 add dnsserver name="Local Area Conne
ction" address=192.168.0.10 index=2
The syntax is
netsh interface ipv4 add dnsserver name="<ID>" address=<DNSIP>index=1
Where:
ID is the name of the Network Connection
DNSIP is the IP address of your DNS server
This should do. To confirm, do an "ipconfig"
Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Broadcom 440x 10/100 Integrated Controller
Physical Address. . . . . . . . . : 00-1D-09-D4-2C-8F
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 192.168.0.5(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.0.1
DNS Servers . . . . . . . . . . . : 192.168.0.1
192.168.0.10
127.0.0.1
NetBIOS over Tcpip. . . . . . . . : Enabled
============================================================================================================================================
****************TO ADD INTO DOMAIN.. cALLED MYDC.COM WITH THE COMPUTER NAME DHCPSRV
netdom join dhcpsrv /domain:mydc /userd:administrator /passwordd:*
or else you can use the below
netdom join dhcpsrv /domain:mydc
============================================================================================================================================
-------------------
Thanks,
Mike Ditka - "If God had wanted man to play soccer, he wouldn't have given us arms."
Windows 2008 Core Server Commands in MY LAB I Used
============================================================================================================================================
****************To rename the server Name
Default installations of Windows Server 2008 give the server a name like WIN-94CX1930EF21 or some other obscure pattern that doesn't fit into most computer infrastructures. You can change the computer name using the netdom command. Netdom (which isn't a new tool) is an easy way to change the computer name after Windows Server 2008 is installed on Core Editions. You can also use it on the full installation versions.
It's pretty straightforward to use the netdom command. For example, let's go from the default name WIN-94CX1930EF21 to a computer name of SERVER13. This is the command you would enter:
netdom renamecomputer WIN-94CX1930EF21 /Newname SERVER13
============================================================================================================================================
****************To Add the IP address
In Windows Server 2008 Core installation, the only way to setup IP Address eithe Static or DHCP is from the command line. The following procedure helps setting the IP Address from the command Line using "netsh". This procedure works in Windows Server 2008 (No core installation as well), Windows Server 2003, Windows XP, Windows Vista.
To setup Static IP Address:
From the command prompt:
1. Type
C:\Users\Administrator> netsh interface ipv4 show interfaces
Idx Met MTU State Name
- – — —- ——-
1 50 4294967295 connected Loopback Pseudo-Interface 1
10 20 1500 connected Local Area Connection
This should show the Network Connections. We are looking for the name here. On mine, I have one LAN interface and is named as "Local Area Connection"
2. To set a static IP Address type the following command
C:\Users\Administrator>netsh interface ipv4 set address name="Local Area Connect
ion" source=static address=192.168.0.5 mask=255.255.255.0 gateway=192.168.0.1
The syntax is
netsh interface ipv4 set address name="<ID>" source=static address=<StaticIP> mask=<SubnetMask> gateway=<DefaultGateway>
Where:
ID is the name of the LAN Connection
StaticIP is the static IP address that you are setting
SubnetMask is the subnet mask for the IP address
DefaultGateway is the default gateway
===========================================================================================================================================
****************TO set the DNS Servers :---
set the DNS Servers one at a time with the followind command. For each DNS server, increase the index number.
C:\Users\Administrator>netsh interface ipv4 add dnsserver name="Local Area Connection" address=192.168.0.1 index=1
C:\Users\Administrator>netsh interface ipv4 add dnsserver name="Local Area Conne
ction" address=192.168.0.10 index=2
The syntax is
netsh interface ipv4 add dnsserver name="<ID>" address=<DNSIP>index=1
Where:
ID is the name of the Network Connection
DNSIP is the IP address of your DNS server
This should do. To confirm, do an "ipconfig"
Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Broadcom 440x 10/100 Integrated Controller
Physical Address. . . . . . . . . : 00-1D-09-D4-2C-8F
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 192.168.0.5(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.0.1
DNS Servers . . . . . . . . . . . : 192.168.0.1
192.168.0.10
127.0.0.1
NetBIOS over Tcpip. . . . . . . . : Enabled
============================================================================================================================================
****************TO ADD INTO DOMAIN.. cALLED MYDC.COM WITH THE COMPUTER NAME DHCPSRV
netdom join dhcpsrv /domain:mydc /userd:administrator /passwordd:*
or else you can use the below
netdom join dhcpsrv /domain:mydc
============================================================================================================================================
-------------------
Thanks,
Mike Ditka - "If God had wanted man to play soccer, he wouldn't have given us arms."
02 January 2010
windows 2003 slipstreeming
Windows Server 2003 Service Pack 2 Released!
-------------------
Thanks,
Mike Ditka - "If God had wanted man to play soccer, he wouldn't have given us arms."
Microsoft has just released Windows Server 2003 SP2, currently available for all architectures (x86, x64, & Itanium) in English and German.
Download Links:
Windows Server 2003 SP2 for x86
Integrating the Service Pack
You can slipstream SP2 into your Windows Server 2003 CD by copying the contents of your CD to a folder on your hard-drive, and issuing the following command:
WindowsServer2003-KB914961-SP2-x86-ENU.exe /integrate:C:\W2k3\
In the example above, this is the x86 installer being used and the Windows Server 2003 CD has been copied to C:\W2k3\
After the process completes, download Microsoft Corporation.img and use it as the bootsector for your CD.
If you're using Nero, it'll look something like this:
Choose CD-ROM (Boot) from the New Compilation's Boot page.
Under Source of boot image data choose "Image file" and Browse to the Microsoft Corporation.img.
Select Enable expert settings (for advanced users only) and set the following: Kind of emulation - No Emulation
Number of loaded sectors - 4
Load segment of sectors - 07C0
-------------------
Thanks,
Mike Ditka - "If God had wanted man to play soccer, he wouldn't have given us arms."
windows 2003 slipstreeming
Windows Server 2003 Service Pack 2 Released!
-------------------
Thanks,
Mike Ditka - "If God had wanted man to play soccer, he wouldn't have given us arms."
Microsoft has just released Windows Server 2003 SP2, currently available for all architectures (x86, x64, & Itanium) in English and German.
Download Links:
Windows Server 2003 SP2 for x86
Integrating the Service Pack
You can slipstream SP2 into your Windows Server 2003 CD by copying the contents of your CD to a folder on your hard-drive, and issuing the following command:
WindowsServer2003-KB914961-SP2-x86-ENU.exe /integrate:C:\W2k3\
In the example above, this is the x86 installer being used and the Windows Server 2003 CD has been copied to C:\W2k3\
After the process completes, download Microsoft Corporation.img and use it as the bootsector for your CD.
If you're using Nero, it'll look something like this:
Choose CD-ROM (Boot) from the New Compilation's Boot page.
Under Source of boot image data choose "Image file" and Browse to the Microsoft Corporation.img.
Select Enable expert settings (for advanced users only) and set the following: Kind of emulation - No Emulation
Number of loaded sectors - 4
Load segment of sectors - 07C0
-------------------
Thanks,
Mike Ditka - "If God had wanted man to play soccer, he wouldn't have given us arms."
26 December 2009
Administering Windows Server 2008 Server Core Machines
Administering Windows Server 2008 Server Core Machines
Now that your machine has been more or less configured and is ready to be deployed, it's time to discuss how you go about preparing the server for installation in different scenarios. As you know from earlier in this book, Windows Server 2008 offers groups of services, and the associated software, wrapped in "roles" that correspond to the likely environments in which you will deploy a machine. On a full installation of Windows Server 2008, these roles are installed using the Server Manager MMC console. On a Server Core machine, that is obviously not possible, as the graphical shell largely doesn't exist.
There is a command-line utility called oclist that allows you to view available roles to install on a machine with Windows Server 2008 Server Core. Once you have run oclist and identified any given role name, you can use that name in conjunction with the ocsetup utility to install or uninstall that server role or optional feature.
Some sample output from oclist
Note that the DHCPServerCore role is listed as not installed. Let's say that we wanted our Server Core machine deployed as a headless, GUI-less, stripped-down DHCP server for our enterprise. To prepare the machine, we need to install the DHCP Server role. Using the name we obtained from the oclist command output, we can start the role installation process with the ocsetup command, as follows:
ocsetup DHCPServerCore
The system will trundle for a while, and the process should complete without errors. To verify that the role installation process is complete, run oclist again and then check to see whether the DHCPServerCore role is listed as "installed."
To uninstall a role, use the following command (in our case, should we want to uninstall the DHCP Server role):
ocsetup DHCPServerCore /uninstall
Installing Active Directory Domain Services on Server Core
One role that you would likely want to install on a Server Core machine is the domain controller role. Installation of this role on a Server Core machine is a bit different, because installing the role using ocsetup has a large dependency on the graphical shell—meaning that using that method of setup can result in a very unstable Server Core machine that thinks it's a domain controller in some ways, but in other ways it doesn't.
The only supported way to install the domain controller role on a Server Core machine is to use the dcpromo utility in unattended mode. Using unattended mode requires setting up a simple text file with some parameters that will allow dcpromo to proceed without needing to prompt the user for any information, and ultimately you will be able to successfully promote a Server Core member server to a domain controller.
You need, at a minimum, the following nine parameters in a file called unattend.txt (or anything you want, as long as you remember the name):
[DCInstall] ReplicaOrNewDomain=Domain NewDomain=Forest NewDomainDNSName=hasselltech.local AutoConfigDNS=Yes DNSDelegation=Yes DNSDelegationUserName=username DNSDelegationPassword=password RebootOnSuccess=NoAndNoPromptEither SafeModeAdminPassword=breakincaseofemergency
|
Then, to run the utility, just issue the following command:
dcpromo /unattend:unattend.txt
Windows Remote Shell
Included with Windows Vista and full installations of Windows Server 2008 is the Windows Remote Shell, or WinRS. You'll also find WinRS on installations of Windows Server 2003 R2. WinRS consists of a listener portion that runs on the Server Core machine itself, and the client software on other machines. The client software sends commands addressed to specific machines to the listener port on that machine, and the WinRS software on the Server Core machine receives the command, executes, and transmits the output back to the originating client machine.
First, you'll need to activate the WinRS listener on the Server Core machine. Use the following command:
WinRM quickconfig
Setting up the Windows Remote Shell listener on the Server Core machine
Once the listener is configured, you can simply go to any Windows Vista or Windows Server 2008 (full edition) machine, and funnel your Server Core-destined commands through winrs. For example, to see the results of the oclist command, issue the following at a command line on a Vista machine:
winrs -r:WS08-CORE-1 "oclist"
Controlling Server Core Via Group Policy
Many administrators find setting up Server Core machines with a consistent configuration can be achieved most easily through the use of a targeted Group Policy attack. You can create a group policy object (GPO) that only applies to Server Core machines by limiting the application of the GPO's attributes via WMI to only machines operating with the Server Core SKU, or by creating an organizational unit (OU) within Active Directory Domain Services, placing only Server Core machines within that OU, and then linking the GPO to the newly created OU. I prefer the WMI method, as it doesn't force you to construct your AD hierarchy based on operating systems, although both methods ultimately work equally as well in terms of the desired effect.
To use the WMI method, filter the OperatingSystemSKU property under the Win32_OperatingSystem class. The applicable values are as follow: 12 represents the Datacenter Server Core edition, 13 represents the Standard Server Core edition, and 14 represents the Enterprise Server Core edition.
-------------------
Thanks,
Paddy
Administering Windows Server 2008 Server Core Machines
Administering Windows Server 2008 Server Core Machines
Now that your machine has been more or less configured and is ready to be deployed, it's time to discuss how you go about preparing the server for installation in different scenarios. As you know from earlier in this book, Windows Server 2008 offers groups of services, and the associated software, wrapped in "roles" that correspond to the likely environments in which you will deploy a machine. On a full installation of Windows Server 2008, these roles are installed using the Server Manager MMC console. On a Server Core machine, that is obviously not possible, as the graphical shell largely doesn't exist.
There is a command-line utility called oclist that allows you to view available roles to install on a machine with Windows Server 2008 Server Core. Once you have run oclist and identified any given role name, you can use that name in conjunction with the ocsetup utility to install or uninstall that server role or optional feature.
Some sample output from oclist
Note that the DHCPServerCore role is listed as not installed. Let's say that we wanted our Server Core machine deployed as a headless, GUI-less, stripped-down DHCP server for our enterprise. To prepare the machine, we need to install the DHCP Server role. Using the name we obtained from the oclist command output, we can start the role installation process with the ocsetup command, as follows:
ocsetup DHCPServerCore
The system will trundle for a while, and the process should complete without errors. To verify that the role installation process is complete, run oclist again and then check to see whether the DHCPServerCore role is listed as "installed."
To uninstall a role, use the following command (in our case, should we want to uninstall the DHCP Server role):
ocsetup DHCPServerCore /uninstall
Installing Active Directory Domain Services on Server Core
One role that you would likely want to install on a Server Core machine is the domain controller role. Installation of this role on a Server Core machine is a bit different, because installing the role using ocsetup has a large dependency on the graphical shell—meaning that using that method of setup can result in a very unstable Server Core machine that thinks it's a domain controller in some ways, but in other ways it doesn't.
The only supported way to install the domain controller role on a Server Core machine is to use the dcpromo utility in unattended mode. Using unattended mode requires setting up a simple text file with some parameters that will allow dcpromo to proceed without needing to prompt the user for any information, and ultimately you will be able to successfully promote a Server Core member server to a domain controller.
You need, at a minimum, the following nine parameters in a file called unattend.txt (or anything you want, as long as you remember the name):
[DCInstall] ReplicaOrNewDomain=Domain NewDomain=Forest NewDomainDNSName=hasselltech.local AutoConfigDNS=Yes DNSDelegation=Yes DNSDelegationUserName=username DNSDelegationPassword=password RebootOnSuccess=NoAndNoPromptEither SafeModeAdminPassword=breakincaseofemergency
|
Then, to run the utility, just issue the following command:
dcpromo /unattend:unattend.txt
Windows Remote Shell
Included with Windows Vista and full installations of Windows Server 2008 is the Windows Remote Shell, or WinRS. You'll also find WinRS on installations of Windows Server 2003 R2. WinRS consists of a listener portion that runs on the Server Core machine itself, and the client software on other machines. The client software sends commands addressed to specific machines to the listener port on that machine, and the WinRS software on the Server Core machine receives the command, executes, and transmits the output back to the originating client machine.
First, you'll need to activate the WinRS listener on the Server Core machine. Use the following command:
WinRM quickconfig
Setting up the Windows Remote Shell listener on the Server Core machine
Once the listener is configured, you can simply go to any Windows Vista or Windows Server 2008 (full edition) machine, and funnel your Server Core-destined commands through winrs. For example, to see the results of the oclist command, issue the following at a command line on a Vista machine:
winrs -r:WS08-CORE-1 "oclist"
Controlling Server Core Via Group Policy
Many administrators find setting up Server Core machines with a consistent configuration can be achieved most easily through the use of a targeted Group Policy attack. You can create a group policy object (GPO) that only applies to Server Core machines by limiting the application of the GPO's attributes via WMI to only machines operating with the Server Core SKU, or by creating an organizational unit (OU) within Active Directory Domain Services, placing only Server Core machines within that OU, and then linking the GPO to the newly created OU. I prefer the WMI method, as it doesn't force you to construct your AD hierarchy based on operating systems, although both methods ultimately work equally as well in terms of the desired effect.
To use the WMI method, filter the OperatingSystemSKU property under the Win32_OperatingSystem class. The applicable values are as follow: 12 represents the Datacenter Server Core edition, 13 represents the Standard Server Core edition, and 14 represents the Enterprise Server Core edition.
-------------------
Thanks,
Paddy
Available roles and features on Windows Server 2008 Server Core machines
-------------------
Thanks,
Paddy
Available roles and features on Windows Server 2008 Server Core machines
-------------------
Thanks,
Paddy
Here are some other things you don't get with Windows Server 2008 Server Core:
Here are some other things you don't get with Windows Server 2008 Server Core:
-
No .NET Framework, or even the common language runtime (CLR)
-
No Microsoft Management Console, and no related snap-ins
-
The vast majority of Control Panel applets are not present
-
No Run box, and no Start menu to go with it
-------------------
Thanks,
Paddy
Here are some other things you don't get with Windows Server 2008 Server Core:
Here are some other things you don't get with Windows Server 2008 Server Core:
-
No .NET Framework, or even the common language runtime (CLR)
-
No Microsoft Management Console, and no related snap-ins
-
The vast majority of Control Panel applets are not present
-
No Run box, and no Start menu to go with it
-------------------
Thanks,
Paddy
Subscribe to:
Posts (Atom)