Windows Server Administration
Installing and Configuring Windows Server 2019/2022
This lesson covers the deployment and initial environment preparation of modern Windows Server operating systems within enterprise infrastructure. Mastery of these fundamentals is essential for establishing a secure, scalable foundation for subsequent role-based service deployments. Administrators reach for these configuration techniques whenever provisioning new virtual or physical instances to ensure standardized operational performance.
Base OS Installation and Deployment
The installation process for Windows Server is the primary mechanism for establishing the security boundary of your infrastructure. Choosing the Desktop Experience versus Server Core is a critical architectural decision; Core is preferred for production to reduce the attack surface and minimize patch cycles by removing the graphical shell. When deploying, the installer interacts with the underlying hardware abstraction layer to configure the partition table—typically GPT for UEFI systems—to support modern secure boot features. By automating this via unattended answer files, you ensure consistency across your fleet. During the initial setup, the operating system registers itself with the boot manager and establishes the initial Windows registry hive, which acts as the configuration backbone for all subsequent kernel and service operations. Properly setting up the disk structure during this phase prevents future performance bottlenecks and simplifies long-term maintenance of the system partition and data volumes.
# Example of initiating a disk wipe and partition creation using diskpart
# This cleans the primary disk and prepares a GPT partition for Server installation
select disk 0
clean
convert gpt
create partition primary
format fs=ntfs quick label="System"
assign letter=CInitial Network Configuration
Once the operating system is installed, the network configuration acts as the identity pillar for the server within the TCP/IP stack. Configuring a static IP address ensures that service discovery and DNS resolution remain stable, which is critical for directory services and resource access. When you assign an address via the configuration interfaces, the system updates the local network stack and the WMI management providers, which propagate these settings to the kernel-level drivers. It is vital to separate your management traffic from client-facing traffic where possible to protect against network-level congestion or interference. By disabling DHCP for server roles, you eliminate reliance on broadcast discovery which can be a point of failure in complex routed environments. Understanding how the stack handles ARP requests and default gateways allows you to troubleshoot connectivity issues efficiently without resorting to trial-and-error configuration changes that jeopardize server uptime.
# Setting a static IP, Subnet, and Gateway using PowerShell
$NIC = Get-NetAdapter -Name "Ethernet"
New-NetIPAddress -InterfaceAlias $NIC.Name -IPAddress "192.168.1.10" -PrefixLength 24 -DefaultGateway "192.168.1.1"
# Setting the primary DNS server for directory lookup
Set-DnsClientServerAddress -InterfaceAlias $NIC.Name -ServerAddresses "192.168.1.5"Identity and Hostname Management
Assigning a unique, descriptive hostname and joining a domain are the final steps in defining the server's identity within the enterprise ecosystem. Hostnames must adhere to strict naming conventions to facilitate automated management scripts and asset tracking. When joining a domain, the server establishes a secure channel via the Kerberos protocol, creating a machine account in the directory service. This account enables the server to participate in group policy processing and secure resource authorization. The process involves generating a computer password that the server manages automatically, ensuring that security tokens remain refreshed. By abstracting the identity away from the specific physical hardware, you gain the ability to migrate services across your environment while maintaining consistent access control lists. Proper identity management prevents unauthorized access and ensures that the server respects organizational boundaries defined by the forest and domain architecture.
# Renaming the computer and joining the domain
Rename-Computer -NewName "SRV-PROD-01" -Restart
# Adding the server to the corporate domain with provided credentials
Add-Computer -DomainName "corp.internal" -Credential (Get-Credential)Enabling and Managing Server Roles
Windows Server roles transform a generic OS into a functional utility, such as a web server, file server, or domain controller. When you install a role, you are essentially deploying binaries and services that extend the capability of the kernel to handle specific network requests. The underlying mechanism utilizes the role-based management architecture, which registers new WMI classes and Performance Monitor counters, allowing for granular oversight of the service's health. For instance, enabling the Web Server role triggers the installation of the Internet Information Services engine, which hooks into the HTTP.sys driver to efficiently route traffic to designated sites. By only installing the roles necessary for the server's function, you adhere to the principle of least privilege, significantly reducing the security risk profile. Administrators must monitor these role-specific services to ensure that dependencies are met and that resource allocation remains balanced for peak efficiency.
# Installing the Web Server (IIS) role and management tools
Install-WindowsFeature -Name Web-Server -IncludeManagementTools
# Verifying the service status after installation
Get-Service -Name W3SVCSecurity Hardening and Remote Management
Security hardening is the process of stripping away unnecessary services, protocols, and administrative entry points to build a resilient defense-in-depth model. Configuring the local firewall to permit only essential traffic ensures that the surface area available to potential attackers is minimized. Remote management, typically handled via secure WinRM channels, allows administrators to perform maintenance without needing direct physical access, which is crucial in virtualized data centers. By enforcing signing and encryption on remote management traffic, you ensure that administrative commands cannot be intercepted or modified in transit. You should also audit the security logs regularly to detect failed login attempts or unauthorized modifications to critical system configurations. A hardened server is not a static object but a dynamic entity that requires continuous monitoring and automated remediation to maintain its security posture against evolving environmental threats and potential internal misconfigurations.
# Configuring Windows Firewall to only allow remote management traffic
Set-NetFirewallRule -DisplayGroup "Windows Remote Management" -Enabled True
# Enabling PSRemoting to allow secure remote administration
Enable-PSRemoting -ForceKey points
- Server Core is recommended for production environments to minimize attack surface and resource usage.
- GPT partitioning is the modern standard for UEFI-based Windows Server installations.
- Static IP assignment is mandatory for server roles to maintain service discovery and DNS consistency.
- Joining a domain establishes a Kerberos-based secure channel for centralized identity management.
- Hostnames should follow a standardized naming convention to aid in automated asset management.
- Role installation adds specific binaries and kernel-level drivers to support designated service functions.
- The principle of least privilege dictates that only necessary server roles should be installed on a single host.
- Hardening through firewall rules and encrypted remote management is vital for secure enterprise administration.
Common mistakes
- Mistake: Installing the Desktop Experience version on servers requiring high security and minimal attack surface. Why it's wrong: Desktop Experience adds unnecessary GUI components that increase the attack surface and resource usage. Fix: Install Server Core for production infrastructure roles.
- Mistake: Neglecting to set a static IP address before promoting a server to a Domain Controller. Why it's wrong: Domain Controllers require reliable, non-changing network identification to ensure DNS availability. Fix: Always configure static IPv4/IPv6 settings during the initial network setup phase.
- Mistake: Failing to configure appropriate disk partitioning (separate volumes for OS, logs, and databases). Why it's wrong: Placing logs on the system drive risks filling the OS partition, potentially crashing the server. Fix: Allocate separate VHDs or physical drives for system files, data, and logs.
- Mistake: Using the default Admin credentials for initial setup without renaming the account. Why it's wrong: 'Administrator' is a well-known target for brute-force attacks. Fix: Create unique administrative accounts, disable the default Administrator account, and use Privileged Access Workstations.
- Mistake: Installing roles and features without verifying the prerequisite Windows Updates. Why it's wrong: Incompatible or missing patches can cause post-installation instability or security vulnerabilities. Fix: Run all critical updates and perform a reboot before executing the 'Add Roles and Features' wizard.
Interview questions
What are the primary differences between Windows Server Core and the Desktop Experience installation options?
Windows Server Core is a minimal installation option that lacks the graphical user interface, reducing the attack surface, disk footprint, and resource consumption. It is ideal for security-hardened infrastructure roles like DNS or Domain Controllers. Conversely, the Desktop Experience includes the full GUI, which is preferred for management convenience in environments where ease of access to tools like Server Manager is required. Administrators should choose Core whenever possible to minimize patching requirements and reboots.
How do you perform an offline image servicing task on a Windows Server installation?
To perform offline servicing, you use the Deployment Image Servicing and Management (DISM) tool. You mount the WIM file using 'dism /mount-image /imagefile:install.wim /index:1 /mountdir:c:\mount' and then apply packages or drivers using 'dism /image:c:\mount /add-package /packagepath:update.msu'. This is critical because it allows you to update images before deployment, ensuring that new servers are compliant and patched immediately upon installation, saving significant time during the provisioning process in enterprise environments.
Compare the use of Group Policy Objects versus Desired State Configuration (DSC) for server configuration management.
Group Policy Objects are the traditional, centralized way to manage domain-joined Windows Server settings, offering an easy-to-use GUI for enforcing registry changes, security policies, and software deployment. DSC is a newer, declarative platform based on PowerShell that focuses on 'what' the state of a server should be rather than 'how' to achieve it. While GPO is superior for standard desktop and user management, DSC provides better idempotency and consistency for high-performance server clusters where automated, programmatic configuration drift correction is strictly required.
Explain the process of configuring NIC Teaming in Windows Server 2019/2022.
NIC Teaming, or Load Balancing and Failover (LBFO), allows multiple physical network adapters to be grouped into a single logical team to provide increased bandwidth and fault tolerance. You configure this via Server Manager or PowerShell using 'New-NetLbfoTeam -Name Team1 -TeamMembers NIC1, NIC2'. The choice of teaming mode, such as Switch Independent or LACP, depends on the physical switch capabilities. Implementing this is essential for high-availability roles like Hyper-V hosts to ensure network traffic continuity during a cable or adapter failure.
How does the Storage Migration Service simplify the transition to a new Windows Server 2022 environment?
The Storage Migration Service is an orchestration tool that automates the inventory, transfer, and cutover of data from legacy servers to modern Windows Server instances or Azure. It manages the migration of files, shares, and security configurations, including the automated updating of server names and IP addresses after the data transfer. This is vital for enterprises as it eliminates the manual, error-prone tasks of recreating file permissions and shared folder structures during large-scale data center infrastructure migrations.
Detail the implementation of Storage Spaces Direct (S2D) and why it is the preferred choice for hyper-converged infrastructure.
Storage Spaces Direct creates software-defined storage by pooling local drives across a cluster of servers into a virtual storage pool. You enable this using 'Enable-ClusterS2D'. It is the foundation for hyper-converged infrastructure because it leverages commodity hardware to provide high-performance, fault-tolerant storage without requiring an expensive external Storage Area Network. It supports advanced features like Resilient File System (ReFS) and block-level mirroring or parity, providing the performance required for mission-critical SQL workloads and virtual machine hosting in modern data centers.
Check yourself
1. Which installation option is recommended to minimize the attack surface of a Windows Server 2022 domain controller?
- A.Server with Desktop Experience
- B.Server Core
- C.Nano Server
- D.Azure Stack HCI
Show answer
B. Server Core
Server Core provides the minimal set of binaries required for the OS, reducing the attack surface. 'Desktop Experience' adds unnecessary GUI overhead; 'Nano Server' is deprecated for standard DC roles; 'Azure Stack HCI' is for hyper-converged infrastructure, not standard server roles.
2. When deploying Windows Server 2022, why is it critical to configure the Preferred DNS server to point to the server's own IP address if it is the first domain controller?
- A.To allow the server to cache internet traffic locally
- B.To ensure the AD DS role can properly register SRV records
- C.To bypass the need for a secondary DNS server
- D.To enable automatic Windows update downloads
Show answer
B. To ensure the AD DS role can properly register SRV records
Domain controllers require local DNS availability to host the AD integrated zones and register service (SRV) records necessary for clients to find the DC. The other options are incorrect because they describe irrelevant or incorrect functions of DNS for a domain controller.
3. If you need to install a server role on a machine running Server Core, what is the most efficient administrative approach?
- A.Mount an ISO image and run the Setup.exe GUI
- B.Use PowerShell with the Install-WindowsFeature cmdlet
- C.Use the Remote Desktop connection to map the GUI drive
- D.Perform an in-place upgrade to the Desktop Experience version
Show answer
B. Use PowerShell with the Install-WindowsFeature cmdlet
PowerShell cmdlets are the standard and most efficient way to manage Server Core features. Mounting an ISO for a GUI setup is impossible on Core, RDP does not add a GUI if none exists, and in-place upgrades are not recommended for role installation.
4. You have a Windows Server 2019 instance that needs to support a large SQL Server database. Which disk configuration strategy is best for long-term stability?
- A.Place the OS, Logs, and Data files on a single 2TB partition
- B.Place the OS on the C: drive and the Data/Logs on separate dedicated volumes
- C.Place the OS and Logs on the C: drive for faster access
- D.Use a single large striped volume for all files
Show answer
B. Place the OS on the C: drive and the Data/Logs on separate dedicated volumes
Separating OS, data, and logs prevents log-filling issues from impacting the system partition and allows for independent IOPS optimization. The other options introduce high risks of system failure due to disk space exhaustion or performance bottlenecks.
5. What is the primary purpose of using 'Features on Demand' in Windows Server 2022?
- A.To allow installing features without a Windows Server media source
- B.To reduce the size of the operating system footprint by removing binary files for unused features
- C.To automatically update features whenever a new patch is released
- D.To enable the use of graphical interfaces on Server Core installations
Show answer
B. To reduce the size of the operating system footprint by removing binary files for unused features
Features on Demand removes the binary files of unused roles from the WinSxS folder to save disk space and enhance security. The other options describe either standard updates, incorrect assumptions about 'on-demand' functionality, or invalid scenarios for Server Core.