2.4.1 Implement auditing using Group Policy and AuditPol.exe
http://technet.microsoft.com/en-us/library/dd772623
Group policy auditing:
Computer Configuration\Policies\Windows Settings\Security settings\Local Policies\Audit policy
gpedit.msc local:
Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy
Note: The GP setting "Security Settings\Local Policies\Security
Options\Audit: Force audit policy subcategory settings" prevents the
application of category-level audit policy in favor of Advanced Auditing. This policy is enabled by default, so if you want to use the following auditing policies, you must disable this policy setting. http://technet.microsoft.com/en-us/library/jj852246.aspx
Success or Failure:
Audit account logon events -Audits when a computer validates credentials for an account for which it is authoritative.
Audit account management - audit's account management on a computer, including changing passwords
Audit directory service access - audits access AD objects
Audit logon events - audits actual logon/logoff of user accounts on the computer
Audit object access - audit non-AD objects such as files, folders, printers, etc.
Audit policy change - audit user rights assignments, auditing, account policies, trust policies
Audit privilege use - audits user rights usage
Audit process tracking - process-related events.
Audit system events - system access such as time change, startup/shutdown, extensible authentication components, loss of auditing events, security log size beyond threshold
Be selective on what to audit, as high levels can affect performance, cause too many security event entries, and quickly fills the log.
Object Access:
After enabling the appropriate policy, you can setup auditing on specific objects(such as a file), by going to the security tab of the object, advanced, Auding tab.
Advanced Auditing Policy:
First introduced in Vista and Windows 2008 via auditpol, advanced auditing became available to configure in GP in Windows 2008 R2. Advanced auditing configured in GP will only apply to 2008R2 and later, and Windows 7 and later clients. As of 2012, there are 56 settings.
Setup in GP:
Computer Configuration\Policies\Windows Settings\Security settings\Advanced Audit Policy Configuration
gpedit.msc locally:
Computer Configuration\Windows Settings\Security settings\Advanced Audit Policy Configuration
Categories-
Account Logon - credential validation, kerberos authentication, kerberos service ticket ops, other account logon events
Account Management - application group management, computer account management, distribution group management, other account management, security group management, user account mgmt.
Detailed Tracking - DPAPI activity(encryption/decryption into DPAPI), process creation, process termination, RPC events(inbound)
DS Access - detailed DS replication, DS access, DS Changes, DS replication
Logon/Logoff - account lockout, user/device claims, ipsec extended mode, ipsec main mode, ipsec quick mode, logoff, logon, network policy server(RADIUS, NAP), other logon/logoff, special logon
Object Access(may require appropriate SACL set on object) - application generated(Windows auditing API usage), certification services(ADCS), detailed file share, file share, file system(must match SACL), filtering platform connection(firewall/WFP), WFP packet drop, handle manipulation(open/close depends on SACL), kernel object access(based on SACL usage), other object access(task scheduler, COM+, etc), registry, removable storage, SAM, central access policy staging
Policy Change - policy change, authentication policy change, authorization policy change, WFP policy change(IPSEC, WFP), MPSSVC Rule-Level policy change(Microsoft Protection Service(MPSSVC.exe) also used by Firewall), other policy change events(TPM, cryptographic ops, etc)
Privilege Use - non-sensitive privilege use, sensitive privilege use
System - IPSec driver, other system events, security state change, security system extension, system integrity.
Global Object Access Auditing - see 2.4.2
Auditpol.exe
Note: auditing set with auditpol will not show up in the local gpedit/secpol settings and also do not save between reboots.
auditpol /list category
auditpol /list subcategory:*
auditpol /set /subcategory:"Account Lockout" /success:enable
auditpol /set /subcategory:"Account Lockout" /failure:enable
auditpol /get subcategory:"Account Lockout"
auditpol /set /subcategory:"Account Lockout" /success:disable
auditpol /set /user:contoso\ajolie /subcategory:"Logon" /success:enable
auditpol /get /user:contoso\ajolie /subcategory:"Logon"
auditpol /remove /user:contoso\ajolie
removes all user auditing, on all policies, for contoso\ajolie
auditpol /remove /allusers
auditpol /clear - clears all auditing policies
auditpol /backup /file:"c:\auditpol.csv"
auditpol /restore /file:"c:\auditpol.csv"
2.4.2 create
expression-based audit policies
2012 advanced policy:
Global Object Access Auditing - applies global SACL's for file system and/or registry. Must enable appropriate Object Access policy first(Advanced Audit Policy\System Audit Policies\Object Access) . You can also specify defined properties or attributes to audit on using expression-based auditing.
Note: If both a file or folder SACL and a global SACL are configured on a
computer, the effective SACL is derived from combining the file or
folder SACL and the global SACL. This means that an audit event is
generated if an activity matches either the file or folder SACL or the
global SACL.
You can choose what permissions a user should be audited for, and whether that affects success, fail, or both.
The conditions you can add are called expression-based audit policies. This is a new feature of Windows 8 and 2012. For instance, you could choose a principal of Everyone or Authenticated Users. Then add a condition User-Group-Member of each-Value- then "Add items" and select a group. For example, Accounting. Now, any user affected by this policy, who is a member of the group "Accounting" will be audited for whichever permission and type settings you configured.
These properties are set in AD using Dynamic Access Control(covered in 70-412).
Extra Note: You can set /resourcesacl through auditpol, but setting a condition can be cryptic. for instance, the user-group setting is set with the SID as in the following example. Also, File in /type:File is actually case-sensitive:
auditpol /resourcesacl /set /type:File /user:"NT AUTHORITY\Authenticated Users" /success /failure /access:FW /condition:"(Member of {SID(S-1-5-21-1477645170-1045419550-4197897434-12603)})"
auditpol /resourcesacl /type:File /view
2.4.3 create removable device audit policies
Auditing removable devices is now configured under the advanced auditing as seen in 2.4.1, Object Access/Audit Removable Storage.
auditpol /set /subcategory:"Removable Storage" /success:enable
Event 4663 is for success and event 4656 logs failed
Thursday, April 24, 2014
2. Configure file and print services 2.3 Configure file and disk encryption
Examples of encryption algorithms:
Symmetric: uses a single key to encrypt and decrypt data
Asymmetric key: uses mathematically-related keys. This allows one key to be public, so it could be published in a certificate.
Hash: one-way encryption
EFS encryption: used to encrypt files on NTFS volume.
Bitlocker drive encryption(BDE): encrypt an entire volume.
EFS encryption: http://technet.microsoft.com/en-us/library/cc749610%28v=WS.10%29.aspx
EFS creates a certificate for the user encrypting the files, thus allowing only that user to automatically decrypt the files upon use. An encryption certificate can be added to the file in order to share it with other users.
To encrypt a folder or file, click properties on the object, Advanced, then check Encrypt contents to secure data. When you encrypt a folder, you have the option to apply changes to this folder only, or to this folder, subfolders, and files.
To decrypt a folder or file, you just uncheck the Encrypt contents.
You cannot both compress and encrypt an NTFS file
encrypted files are decrypted when moved to a non-NTFS volume
files are automatically encrypted when put in a folder that has encryption enabled. However, moving one out does not automatically decrypt it
Files that are set to System or in the root directory cannot be encrypted
cipher.exe /e c:\home\flintstones
cipher.exe /d c:\home\flintstones
to allow another user to decrypt a file, right click properties on the encrypted file, advanced, click Add under "users who can access this file". Click the user to select their EFS certification
EFS and group policy:
Computer configuration\policies\windows settings\security settings\public key policies\encrypting file system
Choose Allow or Don't Allow EFS
Allow, Require, or Don't allow Elliptic Curve Cryptography
Check on uncheck:
Encrypt the contents of the user's Documents folder
Require a smart card for EFS
Create caching-capable user key from smart card
Display key backup notifications when user key s created or changed
Certificates tab allows you to set key size. You can also enable or disable EFS from creating it's own certificates when a certificate authority is not available.
2.3.1 Configure Bitlocker encryption
http://technet.microsoft.com/en-us/library/jj612864.aspxhttp://technet.microsoft.com/en-us/library/hh831713.aspx
http://technet.microsoft.com/en-us/library/hh831412.aspx
http://technet.microsoft.com/en-us/library/jj649829%28v=wps.620%29.aspx
http://download.microsoft.com/download/F/4/1/F41E0BFA-8F1B-44E3-91F0-8AF84908DCC7/Understand_and_Troubleshoot_BitLocker_in_Windows_Server_8_Beta.docx
Bitlocker requires Trusted Platform Module 1.2 or 2.0, or USB access to save a startup key to a removable device.
Hard disk must be partitioned with at least two drives:
OS/boot drive contains operating system and its support files. Must be NTFS.
System drive contains files needed to load Windows after firmware has readied the hardware. Bitlocker is not enabled on this drive.
Windows automatically creates the partitions required for Bitlocker.
Bitlocker uses AES-128 or AES-256
Startup modes:
TPM: Bitlocker encryption key stored on TPM
PIN: user must supply a numeric pre-boot PIN
Enhanced PIN: alphanumeric PIN
USB key: A startup key is stored on a USB
Network key: a key provided by a WDS server.
For drives that are not OS volumes, you can choose to use a password or a smart card or have it automatically unlock. If you choose password or smart card, you can save a recovery key
Installing bitlocker:
Add roles and Features
select Bitlocker Drive Encryption(Bitlocker)
Installing Bitlocker will also install the feature Enhanced Storage(EnhancedStorage) to support hard drives that support hardware encryption
Including the management tools will also install Bitlocker Drive Encryption Administration(RSAT-Feature-Tools-Bitlocker), Bitlocker Drive Encryption Tools(RSAT-Feature-Tools-Bitlocker-RemoteAdminTool), Bitlocker Recovery Password Viewer(RSAT-Feature-Tools-Bitlocker-BdeAducExt), AD DS & AD LDS Tools(Rsat-AD-Tools), AD DS Tools(RSAT-ADDS) and AD DS Snap-ins and command-line(RSAT-ADDS-Tools), the manage-bde command line tool, and the PS module Bitlocker
install-windowsfeature bitlocker -includemanagementools
You can check whether your computer has TPM installed by running the TPM management(tpm.msc) snap-in. (You can also get to this mmc via the Bitlocker option in control panel). The TPM must be initialized here before using Bitlocker.
Enable Bitlocker for a drive or removable drive that's not the OS volume:
go to control panel, Bitlocker Drive Encryption.
Click Turn on Bitlocker for the volume you want to encrypt
You can select a Password or Smart card to unlock the drive. You can also allow it to auto unlock. Next you will be prompted with options for backing up your recovery key: Save to USB, Save to file, print the key.
You will be prompted with whether you want to use:
"Encrypt used disk space only": This will encrypt as space is used
"Encrypt entire drive"
Once you have encrypted the volume, you have the option to go back and backup the recovery key again, change or remove password, add or remove a smart card, turn on auto-unlock, or disable bitlocker.
Note: You can also use a certificate as a protector on a data volume using manage-bde
Bitlocker to Go
Allows encryption of removable usb drives. Once the drive is plugged in, you can Turn on Bitlocker in the bitlocker control panel
For removable data drives, the recovery password and recovery key can be saved to a folder, saved to your Microsoft account online, or printed.
Bitlocker Recovery:
http://technet.microsoft.com/en-us/library/dn383583.aspx
Bitlocker allowed recovery options should be set in group policy (see 2.2.3)
1. Use a recovery password
2. A designated Data Recover Agent(DRA) can supply a certificate (configured by GP see 2.2.3)
3. An ADDS administrator can retrieve the recovery key from AD.
manage-bde - command line utility to manage bitlocker on a client.
A few parameters:
manage-bde -status to show bitlocker status
manage-bde -protectors -add c: -tpmandpin
manage-bde -on c: -password
-off, -lock, -unlock, -autounlock, -changepassword, -changepin, changekey
Powershell
http://technet.microsoft.com/en-us/library/jj649829.aspx
A few commands:
get-bitlockervolume
enable-bitlocker
disable-bitlocker
add-bitlockerkeyprotector
remove-bitlockerkeyprotector
lock-bitlocker
unlock-bitlocker
enable-bitlockerautolock
Extra Note: In an Enterpries, you may want to use the Microsoft Bitlocker Administration and Monitoring tool (MBAM),included with the Microsoft Desktop Optimization Pack(MDOP), for bitlocker administration. This can be used in standalone mode or integrated into SCCM.
2.3.2 configure the Network Unlock feature
http://technet.microsoft.com/en-us/library/jj574173.aspx
requirements:
Windows 8 or 2012 with UEFI DHCP drivers
Bitlocker Network Unlock feature installed on 2012
a 2012 WDS server
a DHCP server, separate from WDS
If you already have a WDS server in your environment, you can leverage it by installing the network unlock feature. Otherwise, whichever server you install Network Unlock on will install the WDS service. It doesn't have to be configured beyond the initial WDS configuration(to allow the wdsserver service to run)
Install the Network Unlock feature by going to Server Manager. Skip to Features and click on Bitlocker Network Unlock(bitlocker-networkunlock). If WDS is not installed, WDS(WDS), WDS Deployment(wds-deployment) and Transport(wds-transport) will be installed. If you check "include management tools", the WDS Tools(wds-adminpack) will also be installed.
install-windowsfeature bitlocker-networkunlock
The wdsserver service must be running.
If you have a CA, request a new certificate
Use the "Network Unlock on the Domain controller" template
Create the certificate
Export the public key certificate to create a .cer - Select DER encoded X.509 and do not export private key
Export the public key with private key to create a .pfx - Select Yes to export private key
Ot you can create a self-signed certificate and use certreq to create a new certificate. Import into certmgr, then export the .pfx
On the WDS server, go to certmgr.msc and right click certificates - Bitlocker Drive Encryption Network Unlock, and Import. Choose the PFX file.
Now you need to setup group policy to deploy the public key certificate to clients:
Computer Configuration\Policies\Windows Settings\Security Settings\Public Key Policies\Bitlocker Drive Encryption Network Unlock Certificate
Add Netwok Unlock Certificate. Import the .CER file.
It's recommended you require TPM + startup pin on client computers: See 2.3.3
You can use a subnet access list to specify that only clients from certain subnets can network unlock. On the WDS server, create a bde-network-unlock.ini file in the same folder as the network unlock provider dll (nkpprov.dll in c:\windows\system32)
Extra Note: Client certificates for network unlock are stored in HKLM\Software\Policies\Microsoft\SystemCertificates\FVE_NKP
Extra Note: The first NIC on a compatible client must be configured for DHCP to use with network unlock
2.3.3 configure Bitlocker policies
add a Data Recovery agent for recovery - A DRA is an account who is authorized to recover Bitlocker drives with a certificate.
Computer Configuration\Windows Settings\Security Settings\Public Key Policies\Bitlocker Drive Encryption
There are a number of other bitlocker policies that can be configured in
Computer Configuraton\Administrative Templates\Bitlocker Drive Encryption
Some good ones to know:
Bitlocker Drive Encryption:
Store Bitlocker recovery information in AD DS
Choose how users can recover Bitlocker-protected drives
Choose drive encryption method and cipher strength
Operating System Drives:
Allow network unlock at startup
Require additional authentication at startup
Allow Enhanced PINS for startup
Choose how Bitlocker-protected operating system drives can be recovered
Fixed Data Drives:
Configure use of passwords for fixed data drives
Choose how Bitlocker-protected fixed drives can be recovered
Removable Data Drives:
Control use of Bitlocker on removable drives
Configure use of passwords for removable data drives
Choose how Bitlocker-protected removable drives can be recovered.
2.3.4 configure the EFS recovery agent
EFS data recovery agent is configured through GP:
Computer\Policies\Windows Settings\Security Settings\Public Key Policies\Encrypting File System
2.3.5 manage EFS and Bitlocker certificates including backup and restore
certificates can be exported using certmgr.msc from Personal
Export with private key.
.PFX - Give it a password
To restore, just import the PFX file to Personal and supply the password
Bitlocker certs can also be exported using certmgr.msc
They can also be stored in ADDS with the"Store Bitlocker recovery information in AD DS" GP option.
Symmetric: uses a single key to encrypt and decrypt data
Asymmetric key: uses mathematically-related keys. This allows one key to be public, so it could be published in a certificate.
Hash: one-way encryption
EFS encryption: used to encrypt files on NTFS volume.
Bitlocker drive encryption(BDE): encrypt an entire volume.
EFS encryption: http://technet.microsoft.com/en-us/library/cc749610%28v=WS.10%29.aspx
EFS creates a certificate for the user encrypting the files, thus allowing only that user to automatically decrypt the files upon use. An encryption certificate can be added to the file in order to share it with other users.
To encrypt a folder or file, click properties on the object, Advanced, then check Encrypt contents to secure data. When you encrypt a folder, you have the option to apply changes to this folder only, or to this folder, subfolders, and files.
To decrypt a folder or file, you just uncheck the Encrypt contents.
You cannot both compress and encrypt an NTFS file
encrypted files are decrypted when moved to a non-NTFS volume
files are automatically encrypted when put in a folder that has encryption enabled. However, moving one out does not automatically decrypt it
Files that are set to System or in the root directory cannot be encrypted
cipher.exe /e c:\home\flintstones
cipher.exe /d c:\home\flintstones
to allow another user to decrypt a file, right click properties on the encrypted file, advanced, click Add under "users who can access this file". Click the user to select their EFS certification
EFS and group policy:
Computer configuration\policies\windows settings\security settings\public key policies\encrypting file system
Choose Allow or Don't Allow EFS
Allow, Require, or Don't allow Elliptic Curve Cryptography
Check on uncheck:
Encrypt the contents of the user's Documents folder
Require a smart card for EFS
Create caching-capable user key from smart card
Display key backup notifications when user key s created or changed
Certificates tab allows you to set key size. You can also enable or disable EFS from creating it's own certificates when a certificate authority is not available.
2.3.1 Configure Bitlocker encryption
http://technet.microsoft.com/en-us/library/jj612864.aspxhttp://technet.microsoft.com/en-us/library/hh831713.aspx
http://technet.microsoft.com/en-us/library/hh831412.aspx
http://technet.microsoft.com/en-us/library/jj649829%28v=wps.620%29.aspx
http://download.microsoft.com/download/F/4/1/F41E0BFA-8F1B-44E3-91F0-8AF84908DCC7/Understand_and_Troubleshoot_BitLocker_in_Windows_Server_8_Beta.docx
Bitlocker requires Trusted Platform Module 1.2 or 2.0, or USB access to save a startup key to a removable device.
Hard disk must be partitioned with at least two drives:
OS/boot drive contains operating system and its support files. Must be NTFS.
System drive contains files needed to load Windows after firmware has readied the hardware. Bitlocker is not enabled on this drive.
Windows automatically creates the partitions required for Bitlocker.
Bitlocker uses AES-128 or AES-256
Startup modes:
TPM: Bitlocker encryption key stored on TPM
PIN: user must supply a numeric pre-boot PIN
Enhanced PIN: alphanumeric PIN
USB key: A startup key is stored on a USB
Network key: a key provided by a WDS server.
For drives that are not OS volumes, you can choose to use a password or a smart card or have it automatically unlock. If you choose password or smart card, you can save a recovery key
Installing bitlocker:
Add roles and Features
select Bitlocker Drive Encryption(Bitlocker)
Installing Bitlocker will also install the feature Enhanced Storage(EnhancedStorage) to support hard drives that support hardware encryption
Including the management tools will also install Bitlocker Drive Encryption Administration(RSAT-Feature-Tools-Bitlocker), Bitlocker Drive Encryption Tools(RSAT-Feature-Tools-Bitlocker-RemoteAdminTool), Bitlocker Recovery Password Viewer(RSAT-Feature-Tools-Bitlocker-BdeAducExt), AD DS & AD LDS Tools(Rsat-AD-Tools), AD DS Tools(RSAT-ADDS) and AD DS Snap-ins and command-line(RSAT-ADDS-Tools), the manage-bde command line tool, and the PS module Bitlocker
install-windowsfeature bitlocker -includemanagementools
You can check whether your computer has TPM installed by running the TPM management(tpm.msc) snap-in. (You can also get to this mmc via the Bitlocker option in control panel). The TPM must be initialized here before using Bitlocker.
Enable Bitlocker for a drive or removable drive that's not the OS volume:
go to control panel, Bitlocker Drive Encryption.
Click Turn on Bitlocker for the volume you want to encrypt
You can select a Password or Smart card to unlock the drive. You can also allow it to auto unlock. Next you will be prompted with options for backing up your recovery key: Save to USB, Save to file, print the key.
You will be prompted with whether you want to use:
"Encrypt used disk space only": This will encrypt as space is used
"Encrypt entire drive"
Once you have encrypted the volume, you have the option to go back and backup the recovery key again, change or remove password, add or remove a smart card, turn on auto-unlock, or disable bitlocker.
Note: You can also use a certificate as a protector on a data volume using manage-bde
Bitlocker to Go
Allows encryption of removable usb drives. Once the drive is plugged in, you can Turn on Bitlocker in the bitlocker control panel
For removable data drives, the recovery password and recovery key can be saved to a folder, saved to your Microsoft account online, or printed.
Bitlocker Recovery:
http://technet.microsoft.com/en-us/library/dn383583.aspx
Bitlocker allowed recovery options should be set in group policy (see 2.2.3)
1. Use a recovery password
2. A designated Data Recover Agent(DRA) can supply a certificate (configured by GP see 2.2.3)
3. An ADDS administrator can retrieve the recovery key from AD.
manage-bde - command line utility to manage bitlocker on a client.
A few parameters:
manage-bde -status to show bitlocker status
manage-bde -protectors -add c: -tpmandpin
manage-bde -on c: -password
-off, -lock, -unlock, -autounlock, -changepassword, -changepin, changekey
Powershell
http://technet.microsoft.com/en-us/library/jj649829.aspx
A few commands:
get-bitlockervolume
enable-bitlocker
disable-bitlocker
add-bitlockerkeyprotector
remove-bitlockerkeyprotector
lock-bitlocker
unlock-bitlocker
enable-bitlockerautolock
Extra Note: In an Enterpries, you may want to use the Microsoft Bitlocker Administration and Monitoring tool (MBAM),included with the Microsoft Desktop Optimization Pack(MDOP), for bitlocker administration. This can be used in standalone mode or integrated into SCCM.
2.3.2 configure the Network Unlock feature
http://technet.microsoft.com/en-us/library/jj574173.aspx
requirements:
Windows 8 or 2012 with UEFI DHCP drivers
Bitlocker Network Unlock feature installed on 2012
a 2012 WDS server
a DHCP server, separate from WDS
If you already have a WDS server in your environment, you can leverage it by installing the network unlock feature. Otherwise, whichever server you install Network Unlock on will install the WDS service. It doesn't have to be configured beyond the initial WDS configuration(to allow the wdsserver service to run)
Install the Network Unlock feature by going to Server Manager. Skip to Features and click on Bitlocker Network Unlock(bitlocker-networkunlock). If WDS is not installed, WDS(WDS), WDS Deployment(wds-deployment) and Transport(wds-transport) will be installed. If you check "include management tools", the WDS Tools(wds-adminpack) will also be installed.
install-windowsfeature bitlocker-networkunlock
The wdsserver service must be running.
If you have a CA, request a new certificate
Use the "Network Unlock on the Domain controller" template
Create the certificate
Export the public key certificate to create a .cer - Select DER encoded X.509 and do not export private key
Export the public key with private key to create a .pfx - Select Yes to export private key
Ot you can create a self-signed certificate and use certreq to create a new certificate. Import into certmgr, then export the .pfx
On the WDS server, go to certmgr.msc and right click certificates - Bitlocker Drive Encryption Network Unlock, and Import. Choose the PFX file.
Now you need to setup group policy to deploy the public key certificate to clients:
Computer Configuration\Policies\Windows Settings\Security Settings\Public Key Policies\Bitlocker Drive Encryption Network Unlock Certificate
Add Netwok Unlock Certificate. Import the .CER file.
It's recommended you require TPM + startup pin on client computers: See 2.3.3
You can use a subnet access list to specify that only clients from certain subnets can network unlock. On the WDS server, create a bde-network-unlock.ini file in the same folder as the network unlock provider dll (nkpprov.dll in c:\windows\system32)
Extra Note: Client certificates for network unlock are stored in HKLM\Software\Policies\Microsoft\SystemCertificates\FVE_NKP
Extra Note: The first NIC on a compatible client must be configured for DHCP to use with network unlock
2.3.3 configure Bitlocker policies
add a Data Recovery agent for recovery - A DRA is an account who is authorized to recover Bitlocker drives with a certificate.
Computer Configuration\Windows Settings\Security Settings\Public Key Policies\Bitlocker Drive Encryption
There are a number of other bitlocker policies that can be configured in
Computer Configuraton\Administrative Templates\Bitlocker Drive Encryption
Some good ones to know:
Bitlocker Drive Encryption:
Store Bitlocker recovery information in AD DS
Choose how users can recover Bitlocker-protected drives
Choose drive encryption method and cipher strength
Operating System Drives:
Allow network unlock at startup
Require additional authentication at startup
Allow Enhanced PINS for startup
Choose how Bitlocker-protected operating system drives can be recovered
Fixed Data Drives:
Configure use of passwords for fixed data drives
Choose how Bitlocker-protected fixed drives can be recovered
Removable Data Drives:
Control use of Bitlocker on removable drives
Configure use of passwords for removable data drives
Choose how Bitlocker-protected removable drives can be recovered.
2.3.4 configure the EFS recovery agent
EFS data recovery agent is configured through GP:
Computer\Policies\Windows Settings\Security Settings\Public Key Policies\Encrypting File System
2.3.5 manage EFS and Bitlocker certificates including backup and restore
certificates can be exported using certmgr.msc from Personal
Export with private key.
.PFX - Give it a password
To restore, just import the PFX file to Personal and supply the password
Bitlocker certs can also be exported using certmgr.msc
They can also be stored in ADDS with the"Store Bitlocker recovery information in AD DS" GP option.
2. Configure file and print services 2.2 Configure File Server Resource Manager (FSRM)
http://technet.microsoft.com/en-us/library/hh831746.aspx
http://technet.microsoft.com/en-us/library/cc770989%28v=ws.10%29.aspx
http://technet.microsoft.com/en-us/library/cc732431.aspx
http://technet.microsoft.com/en-us/library/jj900651.aspx
FSRM allows you to:
Quota Management-
Create quotes for a volume or folder tree, including notifications for thresholds
File Screening Management-
Create file filters to control what can be saved, including notifications for those trying to save blocked files
Storage Reports Management-
Generate or schedule storage reports for disk usage
Classification Management-
File classification - based on certain properties, apply policies such as restricting access, encrypting, expiration.
File Management Tasks-
Extra note: File classification is covered more in 70-412.
Extra note: In Windows Server 2012, the File Server Resource Manager command-line tools (dirquota.exe, filescrn.exe, and storrept.exe) are deprecated. They're still available but are meant to be replaced by the FSRM powershell cmdlets.
2.2.1 Install the FSRM role
Add Roles and Features in Server Manager, File Server Resource Manager(FS-Resource-Manager) found under File and ISCSI Services(File Services) and File and Storage Services(FileAndStorage-Services). Including the management tools will also install RSAT-FSRM-Mgmt with fsrm.msc and the PS module FileServerResourceManager
install-windowsfeature fs-resource-manager -includemanagementtools
FSRM server options:
right click the "File Resource Manager item" and select Configure Options:
Email notifications
set the SMTP server name/ip
specify default admin recipients
set the default "from" address
send a test e-mail
send-fsrmtestemail
Notification limits
set e-mail notification limits, event log notification limits, command notification limits, report notification limits
Storage reports
configure default canned report properties
Report locations
set folder locations for Incident, Scheduled, and Interactive(On-Demand) reports
File screen audit
Automatic classification
Access-Denied Assistance
Setup messages/e-mails for access-denied assistance when users are denied access to folders/files
get-fsrmadrsetting
set-fsrmadrsetting
Powershell for all of the above configuration settings:
get-fsrmsetting
set-fsrmsetting
2.2.2 configure quotas
Hard quota: stops users from saving anything that would go beyond the quota threshold
Soft Quota: used for notifications and monitoring. Will not stop files from being saved over the threshold.
Create a quota
Create a quota by clicking the Quotas tab under Quota Management, and right clicking the task area and "Create Quota".
Choose a folder in a path to create a quota on
Select "Create quota on path" will create a total quota on all existing and future subfolders and their nested subs. So if you put a 100 MB on a parent folder, you can only store 100 total MB in all folders below it.
You can choose to use a quota template, or create a custom quota.
If you create a custom quota, you are given the option of copying properties from an existing template, adding a description, setting your limit, choosing hard or soft quota, creating notification thresholds, and enable/disable quota after adding it. Click OK.
Once you hit Create, if you chose "custom quota", you are prompted with the option to save it as a template, unless the "Do not ask me to save as a template" option has been checked before.
Powershell:
Create a new basic 100MB quota:
new-fsrmquota -path "c:\quotaparent1" -size 100MB
Use a template:
new-fsrmquota -path "c:\quotaparent1" -template "100 MB Limit"
You can specify -disabled to create it disabled,-softlimit for soft quota, -description, and -threshold to add threshold notifcations(see below)
Create an auto apply quota
The next option only allows you to use a template. You cannot create a custom quota.
Selecting "Auto apply template and create quotas on existing and new subfolders" creates individual quotas for each subfolder that resides in the parent folder, but those quotas also include the total from the nested subs of each subfolder(as if you created an individual "Create quota on path" on each subfolder.) However, the parent folder is not affected; only it's subs and their nested subs.
Note that if you delete the auto-apply quota from the parent folder, the auto-applied quotas on the current subs will still exist.
Also note that you can place a quota on any nested subfolder whose parent(s) already have a quota applied. But it must be more restrictive than the parent, allowing you to place a quota deeper into the directory structure while maintaining the quotas of the parents. You cannot place a less restrictive quota, as the parent's quota is still enforced on all folders below it.
If you right click an applied quota you can edit it's settings. Even if you used a template to create the quota, you can customize the settings further. However, it will still be displayed under the Source templates expanded display.
Powershell:
new-fsrmautoquota -path "c:\quotaparent2" -template "100 MB Limit"
Since you can only choose template for auto quotas, the only other option to note here is -disabled
Quota Template
Creating a quota template is similar to the custom quota process outlined above.
Powershell:
Also similar to creating a quota
new-fsrmquotatemplate -name "Tiny" -size 10MB
-description, -softlimit, -threshold
get-fsrmquotatemplate -name "Tiny"
Display quotas:
You can view quota usage %'s in the Quotas menu, and filter by templates applied, applied quotas, auto apply quotas, as well as specific quota paths.
You can also use the Quota Usage storage report to view quotas that exceed a percentage.
Powershell
get-fsrmquota
get-fsrmquota -path "c:\quotaparent1"
get-fsrmautoquota
With an auto quota, you can still use get-fsrmquota to see all the auto-set quotas below the parent.
You can remove a quota with
remove-fsrmquota -path "c:\quotaparent1"
remove-fsrmautoquota -path "c:\quotaparent2"
Configuring notifications:
While creating or editing an applied quota, or creating/editing a template, you have the option to configure notifications
Adding or editing a notification gives you the following options:
The % of the threshold that triggers this notification
E-mail message:Send an e-mail to a specific address, and/or to the user who exceeded the threshold.
Event Log: Log this notification in the event log.
Command: Run a specific command or script
Report: Generate a report(See 2.2.4)
Powershell:
First you must create an Action object using new-fsrmaction. Then you create a threshold object using new-fsrmquotathreshold. Note that actions and thresholds are not saved independently, so you must use them other ways, such as storing in variables or creating inline when applying to quotas or quota templates. Example of inline:
set-fsrmquota -path "c:\quotaparent1" -threshold (new-fsrmquotathreshold -percentage 85 -action (new-fsrmaction -type emaill -mailto:"admin@contoso.com" -subject "Threshold" -body "Too much stuff"))
Other Quota cmdlets:
set-fsrmautoquota
set-fsrmquotatemplate
update-fsrmquota
update-fsrmautoquota
(update is used to scan a path in order to resync usage reports for the path)
reset-fsrmquota
(update a quota with a template)
2.2.3 configure file screens
Using File Screening Management node in FSRM mmc:
File Groups:
Right click, create file group. Give the group a name then add file extensions or file name patterns that can be included or excluded for this group
Powershell:
new-fsrmfilegroup -name "Various" -includepattern @("*.mp3","*.exe","*.vbs")
Other parameters: -description, -excludepattern
get-fsrmfilegroup -name "Various"
set-fsrmfilegroup -name "Various" -includepattern @("*.exe","*.vbs")
remove-fsrmfilegroup -name "Various"
File Screens:
Right click, create File screen. Enter a path for the screen. Choose a template, or custom file screen properties. Defining custom properties allows the following options:
Settings tab:
Copy settings from a template
Choose:
Active Screening: Do not allow users to save unauthorized files
Passive Screening: Allow users to save. This is for monitoring those unauthorized files.
Select the file groups to block
E-mail message:
Choose "Send e-mail to administrators" and/or "Send e-mail to user"
Event Log
Create a log entry for the event log.
Command
Run a command or script
Report
Generate reports
Powershell:
new-fsrmfilescreen -path "c:\home" -includegroup "Various" -active
new-fsrmfilescreen -path "c:\screenme" -template "Block Image Files"
-description to add a description
-notification adds a notification created using new-fsrmaction
set-fsrmfilescreen -path "c:\home" -includegroup @("Various","E-mail files")
get-fsrmfilescreen
remove-fsrmfilescreen
File screen exceptions
An exception can be applied to a subfolder whose parent has a file screen applied and it needs to be overridden for this sub.
Powershell:
new-fsrmfilescreenexception
get-fsrmfilescreenexception
set-fsrmfilescreenexception
remove-fsrmfilescreenexception
File screening templates
Creating file screen templates is similar to creating a custom property file screen as listed above
new-fsrmfilescreentemplate -name "Various files" -includegroup "Various" -active
get-fsrmfilescreentemplate
set-fsrmfilescreentemplate
remove-fsrmfilescreentemplate
Other File screen cmdlets:
reset-fsrmfilescreen - reset a file screen to the default settings of a specified template
2.2.4 configure reports
To create, and schedule a report, right click the Storage Reports area and select "Schedule a new report task". This task will be saved for reuse
To create a report and run it now, right click and select Generate Reports now. This task will not be saved.
Settings tab:
If you are scheduling a task, you must give it a name. If you're just generating one, the name will be chosen for you as "Interactive Report Task" with the date/time.
Choose reports to include, and choose their parameters
Available canned reports:
Duplicate files - finds files with same size and modified date
File Screening Audit - Use to monitor screening policies. You can configure min number of days in past events occured, as well as pick specific users
File by File Group: List files that match file groups, in order to find those that take up lots of space.
File by Owner: Pick all owners or selected owners. You can include a file matching pattern as well
Files by Property: Used by classification to find files by property value
Folders by property: Used by classification
Large files: You can set the min file size, as well as a file name pattern to match.
Least recently accessed files: Choose min days since last accessed, as well as a file name pattern
Most recently accessed files: Choose max days since last accessed, as well as a file name pattern
Quota usage: Set minimum % quota usage. This checks all quotas.
Select the format(s) you want to save the report as: DHTML, HTML, XML, CSV, Text
Scope tab:
Select the file data groups to include(these are not the same as the File Screen file groups. If you don't select any of them, the report(s) will default to all files):
Application Files
Backup and Archival Files
Group Files
User Files
Choose the volume(s)/folders to check. Note that the reports will recursively check all subfolders below the one you choose.
Delivery tab:
Allows you to enter e-mail addresses to send the report to.
Schedule tab(only available if you chose Schedule a new report taks):
Choose a time, and the days to run the report on. You can choose to limit the max time the report will be able to run(in hours).
If you chose "Generate reports now", once you click OK you are given the option to Generate reports in the background to view later, or to generate now and view after they finish.
Reports are saved in the location set in the FSRM server options. Default is "c:\storagereports"
new-fsrmstoragereport -name "large" -interactive -namespace @("c:\home","c:\storage") -reporttype "LargeFiles" -largefileminimum 50MB -reportformat @("csv","text")
scheduledreport:
Use new-fsrmscheduledtask to create a schedule object.
new-fsrmstoragereport -name "Large Files" -namespace @("c:\home","c:\storage") -reporttype "LargeFiles" -largefileminimum 50MB -reportformat @("csv","text") -schedule (new-fsrmscheduled task -time (get-date "1:30am") -weekly "Monday)
get-fsrmstoragereport
unless you specify -name, in addition to schedule reports, this will show currently queued/running interactive and incident reports. The interactive and schedule properties tell you which it is.
set-fsrmstoragereport -name "Large Files" -namespace "c:\home"
remove-fsrmstoragereport -name "Large Files"
other commands:
start-fsrmstoragereport, stop-fsrmstoragereport, wait-fsrmstoragereport
Extra note: one more option available in Storage Reports: Add or Remove Reports for a report task just allows you to see all the report tasks and quickly configure the reports they use, instead of editing each report task individually.
2.2.5 (R2) Configure file management tasks
Right-click "File Management Tasks" under FSRM menu and select "Create File Management Task"
General tab: name the task. Check or uncheck Enable
Scope: Choose type of data to include and the folders to include.
Action: Choose a type of task.. If custom, you will need to provide a path to an executable and command line arguments, as well as working directory. Choose the account to run the task as.
Notification: Add an FSRM notification.
Report: Add an FSRM report to generate
Condition: Include conditions for the task
Schedule: Schedule when the task will run.
This task will be added to Task scheduler under Task Scheduler Library->Microsoft->Windows->File Server Resource Manager
http://technet.microsoft.com/en-us/library/cc770989%28v=ws.10%29.aspx
http://technet.microsoft.com/en-us/library/cc732431.aspx
http://technet.microsoft.com/en-us/library/jj900651.aspx
FSRM allows you to:
Quota Management-
Create quotes for a volume or folder tree, including notifications for thresholds
File Screening Management-
Create file filters to control what can be saved, including notifications for those trying to save blocked files
Storage Reports Management-
Generate or schedule storage reports for disk usage
Classification Management-
File classification - based on certain properties, apply policies such as restricting access, encrypting, expiration.
File Management Tasks-
Extra note: File classification is covered more in 70-412.
Extra note: In Windows Server 2012, the File Server Resource Manager command-line tools (dirquota.exe, filescrn.exe, and storrept.exe) are deprecated. They're still available but are meant to be replaced by the FSRM powershell cmdlets.
2.2.1 Install the FSRM role
Add Roles and Features in Server Manager, File Server Resource Manager(FS-Resource-Manager) found under File and ISCSI Services(File Services) and File and Storage Services(FileAndStorage-Services). Including the management tools will also install RSAT-FSRM-Mgmt with fsrm.msc and the PS module FileServerResourceManager
install-windowsfeature fs-resource-manager -includemanagementtools
FSRM server options:
right click the "File Resource Manager item" and select Configure Options:
Email notifications
set the SMTP server name/ip
specify default admin recipients
set the default "from" address
send a test e-mail
send-fsrmtestemail
Notification limits
set e-mail notification limits, event log notification limits, command notification limits, report notification limits
Storage reports
configure default canned report properties
Report locations
set folder locations for Incident, Scheduled, and Interactive(On-Demand) reports
File screen audit
Automatic classification
Access-Denied Assistance
Setup messages/e-mails for access-denied assistance when users are denied access to folders/files
get-fsrmadrsetting
set-fsrmadrsetting
Powershell for all of the above configuration settings:
get-fsrmsetting
set-fsrmsetting
2.2.2 configure quotas
Hard quota: stops users from saving anything that would go beyond the quota threshold
Soft Quota: used for notifications and monitoring. Will not stop files from being saved over the threshold.
Create a quota
Create a quota by clicking the Quotas tab under Quota Management, and right clicking the task area and "Create Quota".
Choose a folder in a path to create a quota on
Select "Create quota on path" will create a total quota on all existing and future subfolders and their nested subs. So if you put a 100 MB on a parent folder, you can only store 100 total MB in all folders below it.
You can choose to use a quota template, or create a custom quota.
If you create a custom quota, you are given the option of copying properties from an existing template, adding a description, setting your limit, choosing hard or soft quota, creating notification thresholds, and enable/disable quota after adding it. Click OK.
Once you hit Create, if you chose "custom quota", you are prompted with the option to save it as a template, unless the "Do not ask me to save as a template" option has been checked before.
Powershell:
Create a new basic 100MB quota:
new-fsrmquota -path "c:\quotaparent1" -size 100MB
Use a template:
new-fsrmquota -path "c:\quotaparent1" -template "100 MB Limit"
You can specify -disabled to create it disabled,-softlimit for soft quota, -description, and -threshold to add threshold notifcations(see below)
Create an auto apply quota
The next option only allows you to use a template. You cannot create a custom quota.
Selecting "Auto apply template and create quotas on existing and new subfolders" creates individual quotas for each subfolder that resides in the parent folder, but those quotas also include the total from the nested subs of each subfolder(as if you created an individual "Create quota on path" on each subfolder.) However, the parent folder is not affected; only it's subs and their nested subs.
Note that if you delete the auto-apply quota from the parent folder, the auto-applied quotas on the current subs will still exist.
Also note that you can place a quota on any nested subfolder whose parent(s) already have a quota applied. But it must be more restrictive than the parent, allowing you to place a quota deeper into the directory structure while maintaining the quotas of the parents. You cannot place a less restrictive quota, as the parent's quota is still enforced on all folders below it.
If you right click an applied quota you can edit it's settings. Even if you used a template to create the quota, you can customize the settings further. However, it will still be displayed under the Source templates expanded display.
Powershell:
new-fsrmautoquota -path "c:\quotaparent2" -template "100 MB Limit"
Since you can only choose template for auto quotas, the only other option to note here is -disabled
Quota Template
Creating a quota template is similar to the custom quota process outlined above.
Powershell:
Also similar to creating a quota
new-fsrmquotatemplate -name "Tiny" -size 10MB
-description, -softlimit, -threshold
get-fsrmquotatemplate -name "Tiny"
Display quotas:
You can view quota usage %'s in the Quotas menu, and filter by templates applied, applied quotas, auto apply quotas, as well as specific quota paths.
You can also use the Quota Usage storage report to view quotas that exceed a percentage.
Powershell
get-fsrmquota
get-fsrmquota -path "c:\quotaparent1"
get-fsrmautoquota
With an auto quota, you can still use get-fsrmquota to see all the auto-set quotas below the parent.
You can remove a quota with
remove-fsrmquota -path "c:\quotaparent1"
remove-fsrmautoquota -path "c:\quotaparent2"
Configuring notifications:
While creating or editing an applied quota, or creating/editing a template, you have the option to configure notifications
Adding or editing a notification gives you the following options:
The % of the threshold that triggers this notification
E-mail message:Send an e-mail to a specific address, and/or to the user who exceeded the threshold.
Event Log: Log this notification in the event log.
Command: Run a specific command or script
Report: Generate a report(See 2.2.4)
Powershell:
First you must create an Action object using new-fsrmaction. Then you create a threshold object using new-fsrmquotathreshold. Note that actions and thresholds are not saved independently, so you must use them other ways, such as storing in variables or creating inline when applying to quotas or quota templates. Example of inline:
set-fsrmquota -path "c:\quotaparent1" -threshold (new-fsrmquotathreshold -percentage 85 -action (new-fsrmaction -type emaill -mailto:"admin@contoso.com" -subject "Threshold" -body "Too much stuff"))
Other Quota cmdlets:
set-fsrmautoquota
set-fsrmquotatemplate
update-fsrmquota
update-fsrmautoquota
(update is used to scan a path in order to resync usage reports for the path)
reset-fsrmquota
(update a quota with a template)
2.2.3 configure file screens
Using File Screening Management node in FSRM mmc:
File Groups:
Right click, create file group. Give the group a name then add file extensions or file name patterns that can be included or excluded for this group
Powershell:
new-fsrmfilegroup -name "Various" -includepattern @("*.mp3","*.exe","*.vbs")
Other parameters: -description, -excludepattern
get-fsrmfilegroup -name "Various"
set-fsrmfilegroup -name "Various" -includepattern @("*.exe","*.vbs")
remove-fsrmfilegroup -name "Various"
File Screens:
Right click, create File screen. Enter a path for the screen. Choose a template, or custom file screen properties. Defining custom properties allows the following options:
Settings tab:
Copy settings from a template
Choose:
Active Screening: Do not allow users to save unauthorized files
Passive Screening: Allow users to save. This is for monitoring those unauthorized files.
Select the file groups to block
E-mail message:
Choose "Send e-mail to administrators" and/or "Send e-mail to user"
Event Log
Create a log entry for the event log.
Command
Run a command or script
Report
Generate reports
Powershell:
new-fsrmfilescreen -path "c:\home" -includegroup "Various" -active
new-fsrmfilescreen -path "c:\screenme" -template "Block Image Files"
-description to add a description
-notification adds a notification created using new-fsrmaction
set-fsrmfilescreen -path "c:\home" -includegroup @("Various","E-mail files")
get-fsrmfilescreen
remove-fsrmfilescreen
File screen exceptions
An exception can be applied to a subfolder whose parent has a file screen applied and it needs to be overridden for this sub.
Powershell:
new-fsrmfilescreenexception
get-fsrmfilescreenexception
set-fsrmfilescreenexception
remove-fsrmfilescreenexception
File screening templates
Creating file screen templates is similar to creating a custom property file screen as listed above
new-fsrmfilescreentemplate -name "Various files" -includegroup "Various" -active
get-fsrmfilescreentemplate
set-fsrmfilescreentemplate
remove-fsrmfilescreentemplate
Other File screen cmdlets:
reset-fsrmfilescreen - reset a file screen to the default settings of a specified template
2.2.4 configure reports
To create, and schedule a report, right click the Storage Reports area and select "Schedule a new report task". This task will be saved for reuse
To create a report and run it now, right click and select Generate Reports now. This task will not be saved.
Settings tab:
If you are scheduling a task, you must give it a name. If you're just generating one, the name will be chosen for you as "Interactive Report Task" with the date/time.
Choose reports to include, and choose their parameters
Available canned reports:
Duplicate files - finds files with same size and modified date
File Screening Audit - Use to monitor screening policies. You can configure min number of days in past events occured, as well as pick specific users
File by File Group: List files that match file groups, in order to find those that take up lots of space.
File by Owner: Pick all owners or selected owners. You can include a file matching pattern as well
Files by Property: Used by classification to find files by property value
Folders by property: Used by classification
Large files: You can set the min file size, as well as a file name pattern to match.
Least recently accessed files: Choose min days since last accessed, as well as a file name pattern
Most recently accessed files: Choose max days since last accessed, as well as a file name pattern
Quota usage: Set minimum % quota usage. This checks all quotas.
Select the format(s) you want to save the report as: DHTML, HTML, XML, CSV, Text
Scope tab:
Select the file data groups to include(these are not the same as the File Screen file groups. If you don't select any of them, the report(s) will default to all files):
Application Files
Backup and Archival Files
Group Files
User Files
Choose the volume(s)/folders to check. Note that the reports will recursively check all subfolders below the one you choose.
Delivery tab:
Allows you to enter e-mail addresses to send the report to.
Schedule tab(only available if you chose Schedule a new report taks):
Choose a time, and the days to run the report on. You can choose to limit the max time the report will be able to run(in hours).
If you chose "Generate reports now", once you click OK you are given the option to Generate reports in the background to view later, or to generate now and view after they finish.
Reports are saved in the location set in the FSRM server options. Default is "c:\storagereports"
new-fsrmstoragereport -name "large" -interactive -namespace @("c:\home","c:\storage") -reporttype "LargeFiles" -largefileminimum 50MB -reportformat @("csv","text")
scheduledreport:
Use new-fsrmscheduledtask to create a schedule object.
new-fsrmstoragereport -name "Large Files" -namespace @("c:\home","c:\storage") -reporttype "LargeFiles" -largefileminimum 50MB -reportformat @("csv","text") -schedule (new-fsrmscheduled task -time (get-date "1:30am") -weekly "Monday)
get-fsrmstoragereport
unless you specify -name, in addition to schedule reports, this will show currently queued/running interactive and incident reports. The interactive and schedule properties tell you which it is.
set-fsrmstoragereport -name "Large Files" -namespace "c:\home"
remove-fsrmstoragereport -name "Large Files"
other commands:
start-fsrmstoragereport, stop-fsrmstoragereport, wait-fsrmstoragereport
Extra note: one more option available in Storage Reports: Add or Remove Reports for a report task just allows you to see all the report tasks and quickly configure the reports they use, instead of editing each report task individually.
2.2.5 (R2) Configure file management tasks
Right-click "File Management Tasks" under FSRM menu and select "Create File Management Task"
General tab: name the task. Check or uncheck Enable
Scope: Choose type of data to include and the folders to include.
Action: Choose a type of task.. If custom, you will need to provide a path to an executable and command line arguments, as well as working directory. Choose the account to run the task as.
Notification: Add an FSRM notification.
Report: Add an FSRM report to generate
Condition: Include conditions for the task
Schedule: Schedule when the task will run.
This task will be added to Task scheduler under Task Scheduler Library->Microsoft->Windows->File Server Resource Manager
2. Configure file and print services 2.1 Configure Distributed File System (DFS)
DFS groups shared folders into a single logical structure across one or more servers.
2.1.1 Install and configure DFS namespaces
http://technet.microsoft.com/en-us/library/cc732863%28v=ws.10%29.aspx
http://technet.microsoft.com/fr-fr/library/ee404780%28v=ws.10%29.aspx
In Add Roles and Features, DFS Namespaces(FS-DFS-namespace) is found under File and Storage Services(FileandStorage-Services),File and iSCSI Services(File-services). The File Server(FS-FileServer) role feature should also be installed for share management. Including management tools installs the feature DFS Management Tools(RSAT-DFS-Mgmt-Con) and the PS module DFSN
Powershell:
install-windowsfeature fs-dfs-namespace -incluemanagementtools
Go to Server Manager Tools/DFS Management, or run dfsmgmt.msc from the command line.
Configuring DFS Namespaces:
Domain-based namespace: DFS configuration is stored in AD
Stand-alone namespaces: DFS configuration is stored on one server.
Windows 2008 mode supports up to 50k folders and access-based enumeration.
To use Windows 2008 mode with domain-based namespace, your AD forest must use windows 2003 mode or higher, the domain has to be 2008 or higher, and all namespace servers must be 2008 or higher.
The other option is using Windows 2000 Server mode which only supports 5k folders.
Create a new namespace and folder link:
Choose the namespace server that will host the namespace, click Next.
Enter the name for the namespace. This will appear after the \\server or \\domain
This will create a share on the namespace server if it does not exist, located under a folder called DFSRoots, so you can click edit settings to edit permissions for this DFS share. Else, hit Next.
Set Domain-based(2008 if applicable) or stand-alone namespace
Once you've created a new namespace, you can configure a new folder link for it. This link will be placed inside the namespace directory that you just created.
Double click the namespace, then New Folder.
Give the folder link a name, and choose the target folder(s) to which this link will pick.
Click ok. If you chose multiple target folders, and replication is enabled, you are given the option to set up a replication group.
Configuration:
Tabs for a namespace share:
Namespace: Lists namespace folder links
Namespace servers: Lists namespace servers for this namespace share. You can set share permissions or override referral targeting for this specific root share.
Delegation: Show delegation permissions for managing this namespace share
Search:
Properties of a namespace share:
You can change the referral cache duration for clients, and also select a method for ordering targets outside a client site: Lowest cost, Random Order, or Exclude other-site targets
You can also check to have clients fall back to preferred targets if their original target is available again.
Under advanced you can configure the DC polling for this share: Consistency vs scalability.
Consistency always polls the PDC emulator for namespace changes
Scalability will always poll the closest DC
You can also enable Access-based enumeration for this namespace under Advanced tab.
Tabs for a namespace folder link:
Folder targerts = targets for the folder link
Replication = shows replication status when there are multiple target folders and replication is enabled
Properties of a namespace folder link:
You can set client referral cache duration, and you can override the referral settings from the root namespace: Exclude targets outside the client's site or Clients fall back to preferred targets.
Under advanced you can set the view permissions for this folder link.
Properties of a folder link target:
Enable or disable referrals to this target, setup share permissions directly without having to go to the server
Under advanced, you can override referral ordering for this target.
Powershell configuration
http://blogs.technet.com/b/filecab/archive/2012/10/19/introducing-dfs-namespaces-windows-powershell-cmdlets.aspx
get-command -module dfsn
To create a new DFS root, you must setup a share first:
mkdir c:\dfsroot\public
new-smbshare -name public -path c:\dfsroot\public
There are lots of settings for a new-dfsnroot, but you only need path, targetpath, and type
path=domain or server namespace path, targetpath is first server share target path, type is standalone, domainv1 for 2003 or domainv2 for 2008
new-dfsnroot -path "\\contoso.com\public" -targetpath "\\server2\public" -type domainv2
get-dfsnroot will show your new namespace root
set-dfsnroot to set or change the other settings
get-dfsnroottarget -path "\\contoso.com\public" will show your first target. You can add other targets for this root namespace with
new-dfsnroottarget
set-dfsnroottarget configure settings on the root target
To put a folder link in the new namespace root, you also must make a new share:
mkdir c:\testshare
new-smbshare -name testshare -path c:\testshare
new-dfsnfolder -path "\\contoso.com\public\testshare" -targetpath "\\server2\testshare"
get-dfsnfolder to show the new folder link
get-dfsnfoldertarget -path "\\contoso.com\public\testshare" shows the first folder link target
Now we can add folder link targets to an existing folder link. I added a share on server1 already.
new-dfsnfoldertarget -path "\\contoso.com\public\testshare" -targetpath "\\server1\testshare"
get-dfsnfoldertarget -path "\\contoso.com\public\testshare" now shows both targets
set-dfsnfoldertarget to set configuration on the target
Of course, now you would want to setup replication for the two folder targets
Remove any of the above with:
remove-dfsnroot, remove-dfsnroottarget, remove-dfsnfolder, remove-dfsnfoldertarget
The rest of the PS commands:
set-dfsnserverconfiguration, move-dfsnfolder, get-dfsnaccess, grant-dfsnaccess, remove-dfsnaccess, revok-dfsnaccess
Extra note: a new namespace root created in PS will not show up in the DFS management gui until you "Add namespaces to display"
Extra note: It's important to note that the folder targets of a folder link will enforce their own share/NTFS permissions when a user is transparently forwarded to the share, and these permissions are not replicated. Therefore, if you have multiple target folders, you must manually keep the share and target folder NTFS permissions consistent or your users could suffer permission problems when redirected. However, any files and folders inside the target folders should replicate their own NTFS permissions to all target folders in the replication group.
2.1.2 configure DFS Replication Targets
For 2008/2008R2/2012, the following limits apply:
10 terabytes is the max size of all replicated files on a server
11 million replicated files max on a volume
64 gigabytes is the max size of one replicated file
There is no longer a limit to the number of replication groups, replicated folders, connections, or replication group members for 2012 R2
In Add Roles and Features, DFS Replication(FS-DFS-replication) is found under File and Storage Services(FileandStorage-Services),File and iSCSI Services(File-services).
Once installed, you can setup replication groups for multiple target folders on a single folder link. Or you can setup replication groups for folders that aren't even involved with DFS namespaces.
To setup a replication group for a DFS namespace folder link, right click the folder link and select "Replicate folder"
You can change the name of the replication group name and folder name
Next you can verify the folder targets
Select the server for the folder target that you want use as the source of the initial replication of it's contents to the others.
Select a topology. Hub and spoke for 3+ members, Full, or set your own custom one later.
Set your bandwith usage for replication, and replication schedules.
To setup a replication group for other folders, right click the "Replication" menu item and select "New Replication group".
Choose whether this is a multipurpose replication or if it will be used for data collection(hub and spoke)
Type a name for the group.
Choose servers that will participate in this group. They must have FS-DFS-Replication feature installed.
Select a topology. Hub and spoke for 3+ members, Full, or set your own custom one later.
Set your bandwith usage for replication, and replication schedules.
Select the server for the folder target that you want use as the source of the initial replication of it's contents to the others.
Choose the folder on the primary server to replicate
Enable and select folders for the other servers to replicate to. You can choose to set them to read-only.
Replication General settings:
Right clicking the Replication menu item allows you to
Create a new replication group
Add replication groups to display
Delegate management
Disable topology verification
Replication group settings:
right clicking a replication group allows you to:
Add a new member
Choose new folders to replicate for this group
Add a new connection
Change the topology.
Create a diagnostic report for this group
Verify the topology
Delegate management for this group
Edit the group replication schedule
Remove the replication group from displaying in the left menu.
Replication group tabs:
Memberships:
Shows all the replicated folders.
If you right click a member and properties, you can set Staging settings.
Connections:
Shows member server connections and status
Right clicking and properties allows you to enable/disable replication for this connection,
enable/disable RDC, or edit the replication schedule
You can also force a replication by right clicking and replicate now
Replicated folders:
Also shows the folders being replicated. This will show namespace info if it's a folder link
Delegation:
shows permissions for managing this group.
Extra note: 2012R2 introduces new PS cmdlets for DFS Replication. See http://technet.microsoft.com/en-us/library/dn296591.aspx
Extra note: also for 2012R2, DFS limits will increase: 100 terabytes max of replicated files on one server, 70 million max replicated files on a volume, 250 gigs is max file size that will replicate
2.1.3 configure Replication Scheduling
Right click the replication group and choose "Edit replication group schedule".
You can specify bandwith requirements per 1 hour by clicking on the graph, or you can click Details and manually input specific times. The minimum time period you can set is 15 minutes.
2.1.4 configure Remote Differential Compression settings
You can disable or enable RDC compression on a specific connection in a replication group by right clicking the connection on the Connections tab and selecting properties, then checking the "Use remote differential compressions (RDC)".
2.1.5 configure staging
Right click the replicated folders in the Memberships tab.
Choose properties and click the Staging tab.
You can choose the path for the staging for this specific server/folder
Choose the Quota in MB. The default is 4096.
Under the advanced tab, you can also set the Conflict and Deleted quota for this folder. The path is relative to your staging path.
2.1.6 configure fault tolerance
Once again I'm not sure what MS is looking for here that isn't covered above. This whole section is about DFS so what could this mean?
I'll just use this space to mention that there are other command line utilities associated with DFS:
Set up replication groups on the source server. Since the GUI wizard requires to select 2 or more servers in a replication group, we can do this using cmdlets:
new-dfsreplicationgroup -groupname "repgroup" | new-dfsreplicatedfolder -foldername "reptest"
add-dfsrmember -groupname "repgroup" -computername "server1"
set-dfsrmembership -groupname "repgroup" -foldername "reptest" -contentpath "c:\reptest" -computername "Server1" -primarymember $True
In Dfs-Replication Event Log, look for event id 4112 for successful initialization
Verify that replications on the same volume are in a status of 4 (Normal):
Get-WmiObject -Namespace "root\Microsoft\Windows\DFSR" -Class msft_dfsrreplicatedfolderinfo | format-table replicatedfoldername, state -auto
Use export-dfsrclone command:
export-dfsrclone -volume "C:" -Path "C:\dfsrclone"
volume is the volume on which replicated folders are that you want to export the DFS rep DB for. Path is where the clone backup will be stored.
Once run, export-dfsrclone will give you a couple of examples to copy the clone DB as well as the contents of the replicated folder(s) for use on the destination server. You should have config.xml and dfsr.db.clone files in the clone export directory.
Use get-dfsrclonestate command to check the export progress. Results: Ready - status before and after cloning. Started DB export, Started DB import, Processing DB export, Processing DB import, Resetting - rollback of export/import, Shutdown - due to requested backup or restore, Shutting Down.
You can also check the DFS Replication event viewer for Event ID 2406(initialize export), then 2402 for successful export.
On the destination server: Install fs-dfs-replication -includemanagementtools (for the cmdlets), copy replicated files to their folders on the new server, and copy clone DB to a staging directory. Check to see if replication is installed on the destination volume
get-childitem -path "c:\system volume information\dfsr" -hidden
If replication is enabled, there are other tasks to remove it or verify if there are replicated folders(see technet link)
Otherwise, import the clone DB:
import-dfsrclone -volume "c:" -path "c:\cloneimport"
After import, finish adding destination server to the group, setup the connection, and destination folder membership:
add-dfsrmember -groupname "repgroup" -computername "server2"
add-dfsrconnection -groupname "repgroup" -sourcecomputername "server1" -destinationcomputername "server2"
set-dfsrmembership -groupname "repgroup" -foldername "reptest" -contentpath "c:\reptest" -computername "server2"
2.1.1 Install and configure DFS namespaces
http://technet.microsoft.com/en-us/library/cc732863%28v=ws.10%29.aspx
http://technet.microsoft.com/fr-fr/library/ee404780%28v=ws.10%29.aspx
In Add Roles and Features, DFS Namespaces(FS-DFS-namespace) is found under File and Storage Services(FileandStorage-Services),File and iSCSI Services(File-services). The File Server(FS-FileServer) role feature should also be installed for share management. Including management tools installs the feature DFS Management Tools(RSAT-DFS-Mgmt-Con) and the PS module DFSN
Powershell:
install-windowsfeature fs-dfs-namespace -incluemanagementtools
Go to Server Manager Tools/DFS Management, or run dfsmgmt.msc from the command line.
Configuring DFS Namespaces:
Domain-based namespace: DFS configuration is stored in AD
Stand-alone namespaces: DFS configuration is stored on one server.
Windows 2008 mode supports up to 50k folders and access-based enumeration.
To use Windows 2008 mode with domain-based namespace, your AD forest must use windows 2003 mode or higher, the domain has to be 2008 or higher, and all namespace servers must be 2008 or higher.
The other option is using Windows 2000 Server mode which only supports 5k folders.
Create a new namespace and folder link:
Choose the namespace server that will host the namespace, click Next.
Enter the name for the namespace. This will appear after the \\server or \\domain
This will create a share on the namespace server if it does not exist, located under a folder called DFSRoots, so you can click edit settings to edit permissions for this DFS share. Else, hit Next.
Set Domain-based(2008 if applicable) or stand-alone namespace
Once you've created a new namespace, you can configure a new folder link for it. This link will be placed inside the namespace directory that you just created.
Double click the namespace, then New Folder.
Give the folder link a name, and choose the target folder(s) to which this link will pick.
Click ok. If you chose multiple target folders, and replication is enabled, you are given the option to set up a replication group.
Configuration:
Tabs for a namespace share:
Namespace: Lists namespace folder links
Namespace servers: Lists namespace servers for this namespace share. You can set share permissions or override referral targeting for this specific root share.
Delegation: Show delegation permissions for managing this namespace share
Search:
Properties of a namespace share:
You can change the referral cache duration for clients, and also select a method for ordering targets outside a client site: Lowest cost, Random Order, or Exclude other-site targets
You can also check to have clients fall back to preferred targets if their original target is available again.
Under advanced you can configure the DC polling for this share: Consistency vs scalability.
Consistency always polls the PDC emulator for namespace changes
Scalability will always poll the closest DC
You can also enable Access-based enumeration for this namespace under Advanced tab.
Tabs for a namespace folder link:
Folder targerts = targets for the folder link
Replication = shows replication status when there are multiple target folders and replication is enabled
Properties of a namespace folder link:
You can set client referral cache duration, and you can override the referral settings from the root namespace: Exclude targets outside the client's site or Clients fall back to preferred targets.
Under advanced you can set the view permissions for this folder link.
Properties of a folder link target:
Enable or disable referrals to this target, setup share permissions directly without having to go to the server
Under advanced, you can override referral ordering for this target.
Powershell configuration
http://blogs.technet.com/b/filecab/archive/2012/10/19/introducing-dfs-namespaces-windows-powershell-cmdlets.aspx
get-command -module dfsn
To create a new DFS root, you must setup a share first:
mkdir c:\dfsroot\public
new-smbshare -name public -path c:\dfsroot\public
There are lots of settings for a new-dfsnroot, but you only need path, targetpath, and type
path=domain or server namespace path, targetpath is first server share target path, type is standalone, domainv1 for 2003 or domainv2 for 2008
new-dfsnroot -path "\\contoso.com\public" -targetpath "\\server2\public" -type domainv2
get-dfsnroot will show your new namespace root
set-dfsnroot to set or change the other settings
get-dfsnroottarget -path "\\contoso.com\public" will show your first target. You can add other targets for this root namespace with
new-dfsnroottarget
set-dfsnroottarget configure settings on the root target
To put a folder link in the new namespace root, you also must make a new share:
mkdir c:\testshare
new-smbshare -name testshare -path c:\testshare
new-dfsnfolder -path "\\contoso.com\public\testshare" -targetpath "\\server2\testshare"
get-dfsnfolder to show the new folder link
get-dfsnfoldertarget -path "\\contoso.com\public\testshare" shows the first folder link target
Now we can add folder link targets to an existing folder link. I added a share on server1 already.
new-dfsnfoldertarget -path "\\contoso.com\public\testshare" -targetpath "\\server1\testshare"
get-dfsnfoldertarget -path "\\contoso.com\public\testshare" now shows both targets
set-dfsnfoldertarget to set configuration on the target
Of course, now you would want to setup replication for the two folder targets
Remove any of the above with:
remove-dfsnroot, remove-dfsnroottarget, remove-dfsnfolder, remove-dfsnfoldertarget
The rest of the PS commands:
set-dfsnserverconfiguration, move-dfsnfolder, get-dfsnaccess, grant-dfsnaccess, remove-dfsnaccess, revok-dfsnaccess
Extra note: a new namespace root created in PS will not show up in the DFS management gui until you "Add namespaces to display"
Extra note: It's important to note that the folder targets of a folder link will enforce their own share/NTFS permissions when a user is transparently forwarded to the share, and these permissions are not replicated. Therefore, if you have multiple target folders, you must manually keep the share and target folder NTFS permissions consistent or your users could suffer permission problems when redirected. However, any files and folders inside the target folders should replicate their own NTFS permissions to all target folders in the replication group.
2.1.2 configure DFS Replication Targets
For 2008/2008R2/2012, the following limits apply:
10 terabytes is the max size of all replicated files on a server
11 million replicated files max on a volume
64 gigabytes is the max size of one replicated file
There is no longer a limit to the number of replication groups, replicated folders, connections, or replication group members for 2012 R2
In Add Roles and Features, DFS Replication(FS-DFS-replication) is found under File and Storage Services(FileandStorage-Services),File and iSCSI Services(File-services).
Once installed, you can setup replication groups for multiple target folders on a single folder link. Or you can setup replication groups for folders that aren't even involved with DFS namespaces.
To setup a replication group for a DFS namespace folder link, right click the folder link and select "Replicate folder"
You can change the name of the replication group name and folder name
Next you can verify the folder targets
Select the server for the folder target that you want use as the source of the initial replication of it's contents to the others.
Select a topology. Hub and spoke for 3+ members, Full, or set your own custom one later.
Set your bandwith usage for replication, and replication schedules.
To setup a replication group for other folders, right click the "Replication" menu item and select "New Replication group".
Choose whether this is a multipurpose replication or if it will be used for data collection(hub and spoke)
Type a name for the group.
Choose servers that will participate in this group. They must have FS-DFS-Replication feature installed.
Select a topology. Hub and spoke for 3+ members, Full, or set your own custom one later.
Set your bandwith usage for replication, and replication schedules.
Select the server for the folder target that you want use as the source of the initial replication of it's contents to the others.
Choose the folder on the primary server to replicate
Enable and select folders for the other servers to replicate to. You can choose to set them to read-only.
Replication General settings:
Right clicking the Replication menu item allows you to
Create a new replication group
Add replication groups to display
Delegate management
Disable topology verification
Replication group settings:
right clicking a replication group allows you to:
Add a new member
Choose new folders to replicate for this group
Add a new connection
Change the topology.
Create a diagnostic report for this group
Verify the topology
Delegate management for this group
Edit the group replication schedule
Remove the replication group from displaying in the left menu.
Replication group tabs:
Memberships:
Shows all the replicated folders.
If you right click a member and properties, you can set Staging settings.
Connections:
Shows member server connections and status
Right clicking and properties allows you to enable/disable replication for this connection,
enable/disable RDC, or edit the replication schedule
You can also force a replication by right clicking and replicate now
Replicated folders:
Also shows the folders being replicated. This will show namespace info if it's a folder link
Delegation:
shows permissions for managing this group.
Extra note: 2012R2 introduces new PS cmdlets for DFS Replication. See http://technet.microsoft.com/en-us/library/dn296591.aspx
Extra note: also for 2012R2, DFS limits will increase: 100 terabytes max of replicated files on one server, 70 million max replicated files on a volume, 250 gigs is max file size that will replicate
2.1.3 configure Replication Scheduling
Right click the replication group and choose "Edit replication group schedule".
You can specify bandwith requirements per 1 hour by clicking on the graph, or you can click Details and manually input specific times. The minimum time period you can set is 15 minutes.
2.1.4 configure Remote Differential Compression settings
You can disable or enable RDC compression on a specific connection in a replication group by right clicking the connection on the Connections tab and selecting properties, then checking the "Use remote differential compressions (RDC)".
2.1.5 configure staging
Right click the replicated folders in the Memberships tab.
Choose properties and click the Staging tab.
You can choose the path for the staging for this specific server/folder
Choose the Quota in MB. The default is 4096.
Under the advanced tab, you can also set the Conflict and Deleted quota for this folder. The path is relative to your staging path.
2.1.6 configure fault tolerance
Once again I'm not sure what MS is looking for here that isn't covered above. This whole section is about DFS so what could this mean?
I'll just use this space to mention that there are other command line utilities associated with DFS:
|
|||||||||||
| 2.1.7 (R2) Clone a DFS database; recover DFS database; optimize DFS replication | |||||||||||
Exporting a DFS replication database can be used to setup an offline or otherwise unavailable/low-bandwith server for an initial replication. Or it can be used for failure recovery of a DFS replication DB. |
|||||||||||
new-dfsreplicationgroup -groupname "repgroup" | new-dfsreplicatedfolder -foldername "reptest"
add-dfsrmember -groupname "repgroup" -computername "server1"
set-dfsrmembership -groupname "repgroup" -foldername "reptest" -contentpath "c:\reptest" -computername "Server1" -primarymember $True
In Dfs-Replication Event Log, look for event id 4112 for successful initialization
Verify that replications on the same volume are in a status of 4 (Normal):
Get-WmiObject -Namespace "root\Microsoft\Windows\DFSR" -Class msft_dfsrreplicatedfolderinfo | format-table replicatedfoldername, state -auto
Use export-dfsrclone command:
export-dfsrclone -volume "C:" -Path "C:\dfsrclone"
volume is the volume on which replicated folders are that you want to export the DFS rep DB for. Path is where the clone backup will be stored.
Once run, export-dfsrclone will give you a couple of examples to copy the clone DB as well as the contents of the replicated folder(s) for use on the destination server. You should have config.xml and dfsr.db.clone files in the clone export directory.
Use get-dfsrclonestate command to check the export progress. Results: Ready - status before and after cloning. Started DB export, Started DB import, Processing DB export, Processing DB import, Resetting - rollback of export/import, Shutdown - due to requested backup or restore, Shutting Down.
You can also check the DFS Replication event viewer for Event ID 2406(initialize export), then 2402 for successful export.
On the destination server: Install fs-dfs-replication -includemanagementtools (for the cmdlets), copy replicated files to their folders on the new server, and copy clone DB to a staging directory. Check to see if replication is installed on the destination volume
get-childitem -path "c:\system volume information\dfsr" -hidden
If replication is enabled, there are other tasks to remove it or verify if there are replicated folders(see technet link)
Otherwise, import the clone DB:
import-dfsrclone -volume "c:" -path "c:\cloneimport"
After import, finish adding destination server to the group, setup the connection, and destination folder membership:
add-dfsrmember -groupname "repgroup" -computername "server2"
add-dfsrconnection -groupname "repgroup" -sourcecomputername "server1" -destinationcomputername "server2"
set-dfsrmembership -groupname "repgroup" -foldername "reptest" -contentpath "c:\reptest" -computername "server2"
1. Deploy, manage, and maintain servers 1.3 Monitor servers
1.3.1 Configure Data Collector Sets (DCS)
A DCS organizes performance counts, event traces, and system configuration data into one single object and allows Reports to be created for the DCS(found in Reports menu under Performance in the left pane)
In Performance Manager, left pane, expand DCS. Right click user defined folder and choose New Data Collector Set. Create from Template or Create manually. Choose a template if using templates. Save and close. Right click and Start the DCS.
Creating manually alllows you to select Performance counter data collector, Event Trace data collector, Config Data collectors, and performance counter alerts.
Performance counter DC allows collection of various performance related counters
Event Trace DC allows you to collect certain debug type data from specific events
Config DC's allow monitoring of registry keys.
Performance Alerts monitor thresholds for performance counters.
In the properties for the parent DCS, a few things you can configure: you can configure a root directory, a schedule for the DCS to run, permissions, stop conditions, run a task when the DCS stops,
For each task in the DCS, there are also properties specific to the type of task. Except for the performance alert, the other types allow you to define a file to store the collected data in.
Once you run a DCS, you can look at the results in the Report tab menu.
1.3.2 configure alerts
Performance alerts are notifications or tasks that are executed when a performance threshold is reached. Create a new DCS, choose Create manually, select performance counter alert. Add a performance counter to select which counter. choose Above or Below the limit value.
Now in the properties, we can set the interval under Alerts, or add/change/remove counters. Under "Alert Action", you can set the thresholds to log in the Application event log, or to start another DCS. Under Alert Task, you can set to run a task when alert is triggered.
1.3.3 monitor real-time performance
Task Manager: from Run/command prompt use taskmgr, or right click taskbar and Task Manager, or ctrl-alt-delete choose Task Manager
Processes lists the processes,Type,Status, Publisher, PID, Process Name, Command Line, CPU, Memory. Columns are selected by right clicking a column and checking/unchecking the ones you want to include.
Apps, Background, Windows processes. You can expand to see process tree. Right click to End task, Change memory resource value format, Create dump file, go to this process in the details tab, open file location to show the location, search online(via Bing) to find out more information, properties tab.
Performance tab shows CPU, Memory, and Ethernet stats.
CPU you can right click the right pane and select Change graph to -> To switch between overall usage and logical processors. It shows Utilization, Speed, Sockets/logical processors, VM capable, LM1 cache, processes, threads, handles, and up time.
Memory shows In Use, Available, Commited, Cached, Paged pool, and Non-paged pool, Slots used, Hardware reserved, Max memory possible
Ethernet shows Send/Receive, Adapter name, domain name, connect type, ipv4 & ipv6 address. Right click and view network details for more information for all nic's on the system.
Users tab shows logged in users, their id, session id, client name, status, cpu, and memory. right click colum to select which coluns to display. You can expand each user to show their processes.
Details tab shows even more selectable columns for processes. I won't list them all here.
Services tab shows Name, PID, Description, Status, and Group for services. You can start, stop, restart services here. Or you can open up the services MMC for more detailed service configuration.
Resource Monitor
A more detailed tool that shows usages of resources by processes, services, files, etc.
Access it through server manager via tools/resource monitor. Also in control panel/administrative tools. From command line you can use either resmon or perfmon /res . Or launch from within performance monitor by right clicking Monitoring Tools and selecting Resource Monitor.
Overview allows you to see CPU, Disk, Network, and Memory stats for processes. You can select individual processes to see filtered information for the process or processes in each category. If you right click the columns you can select/unselect various columns in each category.
CPU tab gives you same information as on overview but also adds Services, Associated Handles, and
Associated Modules. However, you must select a process or multiple processes to see their associated handles and associated modules. This will also filter the services that may be associated with the process(es) that have been selected. As in overview, the columns are also customizable.
Memory tab shows same thing as memory under overview, but also includes a bar graph of overall physical memory usage.
Disk The disk tab shows processes with disk activity as they access the disk in real time.
It also shows the same overall disk activity information as the overview page. There is also a section for logical disk storage. As the other tabs, you can customize columns viewing. You can further see current TCP connections per process and Listening ports per process. This is filterable by selecting a process or multiple process. Columns are customizable.
Network tab, like Disk tab, first shows you the processes that are accessing the network in real-time. Then it has a tab Network Activity that shows overall utilization like on the Overview tab.
Performance Monitor
http://technet.microsoft.com/en-us/library/cc749249.aspx
Performance Manager is in Server Manager/tools. Also found in control panel/administrative tools as well as command line "perfmon". Perfmon can be used to monitor performance in a graph format, via counters of various performance. You can view real-time data but also historical data in a Line, Histogram bar, or Report format.You can also define Data Collector Sets here(1.3.1) and associated Reports here. You can also shortcut to the "Action Center/Reliability Monitor" by right clicking "Monitoring Tools" and selecting "View system reliability", or the Resource Monitor by selecting "Resource Monitor"
To configure Perf mon, right click "performance monitor" and select properties. (You can also do some of this on the Perf mon toolbar) From here, you have the following tabs:
General: customize the graph view with "display elements". Change Report and histogram data to Min, Current, Default, Max, or Avg. Set sample frequency and how much will be graphed before redrawing. Sample automatically is the same as pausing the graph in the Toolbar.
Source allows you to set a source for historical perfomance data. You can choose Log files, or a data base. Or you can go back to real-time data with "Current Activity"
Data shows which counters are currently active and allows customization.
Graph allows you to configure the graph views.
Appearance is for further display customization, including colors, fonts, borders, and seperator.
The performance monitor toolbar includes options also found in the properties:
View current activity. View log data will take you to properties/source to select a data source. The next icon allows you to choose which graph you want. the + icon adds counters. X icon deletes counters. The "highlighter" icon highlights whichever counter is currently selected in the value bar.
The next icon copies properties as an activex control that can be embedded into an IE compatible web page. The clipboard icon pastes a counter list from the clipboard. You can pause real-time update, and also manually refresh with the next icon.
1.3.4 monitor virtual machines (VMs)
Hyper-V resource monitoring
activated and viewed using powershell
Enable-VMResourceMetering
Disable-VMResourceMetering
Reset-VMResourceMetering
Measure-VM
As outlined in 3.1.3 of 70-410, you can setup resource pools to monitor resources across multiple computers using:
new-vmresourcepool
measure-vmresourcepool
then when you enable-vmresourcemetering, you can use the -resourcepoolname switch
enable-vmresourcemetering -resourcepoolname serverpool
1.3.5 monitor events
Event Viewer
Run from Start/Administrative tools, or in Server Manager under Tools, or run eventvwr.msc
Multiple logs available:
Custom Views:
Create custom views using specific logs/sources, event levels, categories and keywords, logging period, and user/computers. Administrative Events is a default log that logs Critical, Error, Warning levels from all administrative event logs. There may be other default logs depending on server roles installed
Windows Logs:
Application - events from applications and programs
Security - events dealing with logins and resource/object access. Must enable auditing to log these events
Setup: application setup logs
System: System events such as boot and services
Forwarded events: can store events from remote computers using event subscription. Not compatible pre-windows 7 or 2008.
Application and Services Logs:
Logs specific to some applications and services.
Subscriptions:
see 1.3.6
Common Event fields(properties of an event):
Source: software/component that logged the event
Event ID: A specific event code
Level: Event severity (Information, Warning, Error, Critical, Success Audit, Failure Audit)
User, Computer:
Logged date/time
Task Category
Keywords
Opcode
Filtering events:
Right click log, select filter current log. This is similar to setting up a custom log. You can configure the same fields except the By log is set to the log you are filtering.
Attaching a task to an event:
You can choose to attach a task to a log or a specific event
Right click the log and select attach a task. Any event logged in this log will trigger the task
Right click a specific event and choose attach a task to this event. The task will only trigger on this event.
Under action, choose "Start a program".
Extra Note: With "attaching a task to an event", you may see the actions Send an e-mail (deprecated) and Display a message (deprecated). MS plans to remove these and seems to be encouraging people to do these functions via powershell. In my version they are still selectable but I didn't bother to test them out.
1.3.6 configure event subscriptions
Event Viewer subscriptions
Setup forwarding computers and a collecting computer. The forwarders send events to the collector, who places the events in the Forwarded events log.
Note: You may need to run the winrm quickconfig command to setup remote monitoring. You may also need to add the collector computer to the administrators group of the forwarding computers if you setup Machine account in user account.
Subscription types:
Collector initiated: collector contacts source(forwarder) computers and provides subscription
Source initiated: source(forwarder) computers contact collector and receive subscription. Must be configured through policy or local config on the source computers.
You can filter the events to be subscribed too. You can also click Advanced and setup bandwidth management for the event sub as well as HTTP or HTTPS.
1.3.7 configure network monitoring
various tools for monitoring a network connection: ping, nslookup, tracert, arp, ipconfig, netstat.
Packet sniffers(protocol analyzers): I personally use Wireshark but MS offers one called Microsoft Network Monitor. This GUI based tool also has a command line tool called nmcap. You can also capture network traces using netsh trace.
1.3.8 (R2) Schedule performance monitoring
Data Collector Sets can be scheduled in properties. Click on Schedule tab for the DCS, and Add Schedule. Set the range of dates that this DCS will be run, or just set a beginning date with no expiration. Set the Start/Launch time. Choose which days of the week this DCS will run on.
A DCS organizes performance counts, event traces, and system configuration data into one single object and allows Reports to be created for the DCS(found in Reports menu under Performance in the left pane)
In Performance Manager, left pane, expand DCS. Right click user defined folder and choose New Data Collector Set. Create from Template or Create manually. Choose a template if using templates. Save and close. Right click and Start the DCS.
Creating manually alllows you to select Performance counter data collector, Event Trace data collector, Config Data collectors, and performance counter alerts.
Performance counter DC allows collection of various performance related counters
Event Trace DC allows you to collect certain debug type data from specific events
Config DC's allow monitoring of registry keys.
Performance Alerts monitor thresholds for performance counters.
In the properties for the parent DCS, a few things you can configure: you can configure a root directory, a schedule for the DCS to run, permissions, stop conditions, run a task when the DCS stops,
For each task in the DCS, there are also properties specific to the type of task. Except for the performance alert, the other types allow you to define a file to store the collected data in.
Once you run a DCS, you can look at the results in the Report tab menu.
1.3.2 configure alerts
Performance alerts are notifications or tasks that are executed when a performance threshold is reached. Create a new DCS, choose Create manually, select performance counter alert. Add a performance counter to select which counter. choose Above or Below the limit value.
Now in the properties, we can set the interval under Alerts, or add/change/remove counters. Under "Alert Action", you can set the thresholds to log in the Application event log, or to start another DCS. Under Alert Task, you can set to run a task when alert is triggered.
1.3.3 monitor real-time performance
Task Manager: from Run/command prompt use taskmgr, or right click taskbar and Task Manager, or ctrl-alt-delete choose Task Manager
Processes lists the processes,Type,Status, Publisher, PID, Process Name, Command Line, CPU, Memory. Columns are selected by right clicking a column and checking/unchecking the ones you want to include.
Apps, Background, Windows processes. You can expand to see process tree. Right click to End task, Change memory resource value format, Create dump file, go to this process in the details tab, open file location to show the location, search online(via Bing) to find out more information, properties tab.
Performance tab shows CPU, Memory, and Ethernet stats.
CPU you can right click the right pane and select Change graph to -> To switch between overall usage and logical processors. It shows Utilization, Speed, Sockets/logical processors, VM capable, LM1 cache, processes, threads, handles, and up time.
Memory shows In Use, Available, Commited, Cached, Paged pool, and Non-paged pool, Slots used, Hardware reserved, Max memory possible
Ethernet shows Send/Receive, Adapter name, domain name, connect type, ipv4 & ipv6 address. Right click and view network details for more information for all nic's on the system.
Users tab shows logged in users, their id, session id, client name, status, cpu, and memory. right click colum to select which coluns to display. You can expand each user to show their processes.
Details tab shows even more selectable columns for processes. I won't list them all here.
Services tab shows Name, PID, Description, Status, and Group for services. You can start, stop, restart services here. Or you can open up the services MMC for more detailed service configuration.
Resource Monitor
A more detailed tool that shows usages of resources by processes, services, files, etc.
Access it through server manager via tools/resource monitor. Also in control panel/administrative tools. From command line you can use either resmon or perfmon /res . Or launch from within performance monitor by right clicking Monitoring Tools and selecting Resource Monitor.
Overview allows you to see CPU, Disk, Network, and Memory stats for processes. You can select individual processes to see filtered information for the process or processes in each category. If you right click the columns you can select/unselect various columns in each category.
CPU tab gives you same information as on overview but also adds Services, Associated Handles, and
Associated Modules. However, you must select a process or multiple processes to see their associated handles and associated modules. This will also filter the services that may be associated with the process(es) that have been selected. As in overview, the columns are also customizable.
Memory tab shows same thing as memory under overview, but also includes a bar graph of overall physical memory usage.
Disk The disk tab shows processes with disk activity as they access the disk in real time.
It also shows the same overall disk activity information as the overview page. There is also a section for logical disk storage. As the other tabs, you can customize columns viewing. You can further see current TCP connections per process and Listening ports per process. This is filterable by selecting a process or multiple process. Columns are customizable.
Network tab, like Disk tab, first shows you the processes that are accessing the network in real-time. Then it has a tab Network Activity that shows overall utilization like on the Overview tab.
Performance Monitor
http://technet.microsoft.com/en-us/library/cc749249.aspx
Performance Manager is in Server Manager/tools. Also found in control panel/administrative tools as well as command line "perfmon". Perfmon can be used to monitor performance in a graph format, via counters of various performance. You can view real-time data but also historical data in a Line, Histogram bar, or Report format.You can also define Data Collector Sets here(1.3.1) and associated Reports here. You can also shortcut to the "Action Center/Reliability Monitor" by right clicking "Monitoring Tools" and selecting "View system reliability", or the Resource Monitor by selecting "Resource Monitor"
To configure Perf mon, right click "performance monitor" and select properties. (You can also do some of this on the Perf mon toolbar) From here, you have the following tabs:
General: customize the graph view with "display elements". Change Report and histogram data to Min, Current, Default, Max, or Avg. Set sample frequency and how much will be graphed before redrawing. Sample automatically is the same as pausing the graph in the Toolbar.
Source allows you to set a source for historical perfomance data. You can choose Log files, or a data base. Or you can go back to real-time data with "Current Activity"
Data shows which counters are currently active and allows customization.
Graph allows you to configure the graph views.
Appearance is for further display customization, including colors, fonts, borders, and seperator.
The performance monitor toolbar includes options also found in the properties:
View current activity. View log data will take you to properties/source to select a data source. The next icon allows you to choose which graph you want. the + icon adds counters. X icon deletes counters. The "highlighter" icon highlights whichever counter is currently selected in the value bar.
The next icon copies properties as an activex control that can be embedded into an IE compatible web page. The clipboard icon pastes a counter list from the clipboard. You can pause real-time update, and also manually refresh with the next icon.
1.3.4 monitor virtual machines (VMs)
Hyper-V resource monitoring
activated and viewed using powershell
Enable-VMResourceMetering
Disable-VMResourceMetering
Reset-VMResourceMetering
Measure-VM
As outlined in 3.1.3 of 70-410, you can setup resource pools to monitor resources across multiple computers using:
new-vmresourcepool
measure-vmresourcepool
then when you enable-vmresourcemetering, you can use the -resourcepoolname switch
enable-vmresourcemetering -resourcepoolname serverpool
1.3.5 monitor events
Event Viewer
Run from Start/Administrative tools, or in Server Manager under Tools, or run eventvwr.msc
Multiple logs available:
Custom Views:
Create custom views using specific logs/sources, event levels, categories and keywords, logging period, and user/computers. Administrative Events is a default log that logs Critical, Error, Warning levels from all administrative event logs. There may be other default logs depending on server roles installed
Windows Logs:
Application - events from applications and programs
Security - events dealing with logins and resource/object access. Must enable auditing to log these events
Setup: application setup logs
System: System events such as boot and services
Forwarded events: can store events from remote computers using event subscription. Not compatible pre-windows 7 or 2008.
Application and Services Logs:
Logs specific to some applications and services.
Subscriptions:
see 1.3.6
Common Event fields(properties of an event):
Source: software/component that logged the event
Event ID: A specific event code
Level: Event severity (Information, Warning, Error, Critical, Success Audit, Failure Audit)
User, Computer:
Logged date/time
Task Category
Keywords
Opcode
Filtering events:
Right click log, select filter current log. This is similar to setting up a custom log. You can configure the same fields except the By log is set to the log you are filtering.
Attaching a task to an event:
You can choose to attach a task to a log or a specific event
Right click the log and select attach a task. Any event logged in this log will trigger the task
Right click a specific event and choose attach a task to this event. The task will only trigger on this event.
Under action, choose "Start a program".
Extra Note: With "attaching a task to an event", you may see the actions Send an e-mail (deprecated) and Display a message (deprecated). MS plans to remove these and seems to be encouraging people to do these functions via powershell. In my version they are still selectable but I didn't bother to test them out.
1.3.6 configure event subscriptions
Event Viewer subscriptions
Setup forwarding computers and a collecting computer. The forwarders send events to the collector, who places the events in the Forwarded events log.
Note: You may need to run the winrm quickconfig command to setup remote monitoring. You may also need to add the collector computer to the administrators group of the forwarding computers if you setup Machine account in user account.
Subscription types:
Collector initiated: collector contacts source(forwarder) computers and provides subscription
Source initiated: source(forwarder) computers contact collector and receive subscription. Must be configured through policy or local config on the source computers.
You can filter the events to be subscribed too. You can also click Advanced and setup bandwidth management for the event sub as well as HTTP or HTTPS.
1.3.7 configure network monitoring
various tools for monitoring a network connection: ping, nslookup, tracert, arp, ipconfig, netstat.
Packet sniffers(protocol analyzers): I personally use Wireshark but MS offers one called Microsoft Network Monitor. This GUI based tool also has a command line tool called nmcap. You can also capture network traces using netsh trace.
1.3.8 (R2) Schedule performance monitoring
Data Collector Sets can be scheduled in properties. Click on Schedule tab for the DCS, and Add Schedule. Set the range of dates that this DCS will be run, or just set a beginning date with no expiration. Set the Start/Launch time. Choose which days of the week this DCS will run on.
1. Deploy, manage, and maintain servers 1.2 Implement patch management
Multiple WSUS servers installed in either of two modes:
Autonomous mode: upstream WSUS servers share updates with downstream servers, but updates must be approved at each WSUS server
Replica mode: upstream WSUS servers share updates with downstream servers, and all updates can be approved at an upstream server for replication downstream.
Server-side targeting:
You manually move computers into their WSUS group.
Client-side targeting:
Via GP, local GP, or registry, you can specify a WSUS group for the client computer to place itself in.
1.2.1 Install and configure the Windows Server Update Services (WSUS) role
Server Manager, Add roles and features
Select Windows Server Update Services.
WSUS requires RSAT tools and IIS to be installed
Check WSUS Services.
Check either WID Database if you will not be using a dedicated SQL server, or Database if you will. WID is a "Windows Internal Database"
Select a path to store updates.
Powershell install:
install-windowsfeature updateservices -includemanagementtools
This will also install, if not installed already, IIS Web server (Web-Server) and associated role features, .Net Framework 4.5(NET-Framework-45-ASPNET), RSAT, RSAT-Role-Tools and associated UpdateServices-RSAT feature for WSUS cmdlets/console. It also installs Windows Process Activation Service(WAS and WAS-Config-APIs)
Also Note that this will install the WID database(UpdateServices-WidDB & Windows-Internal-Database) by default. If you need to use a SQL server, install the feature updateservices-DB.
Post-install initial configuration:
Run the WSUS tool from Server Manager tools.
It will verify the path where you want to store updates
Choose Upstream Server: either MS Update or another WSUS server. use SSL is recommended. This is where you can set the upstream mode.
Specify a proxy server if needed.
The configuration will attempt to download WSUS information from MS update to configure further
Choose the update languages
Choose products for which you want updates from the upstream
Choose the type of updates, drivers, etc you want to download from the upstream.
Set sync Schedule. Manual or automatic
Finished: You can manually force an upstream sync now and/or launch the WSUS console.
Server Options:
Update Source and Proxy Server, Products and Classifications, Update Files and Languages, Synchronization Schedule, Microsoft Update Improvement Program:
You set these up in the intial configuration above. They can be changed here.
Update Files(And Languages): Languages was done in inital config. But Update Files lets you
choose to either store files locally or not. if not, computers install from MS Update.
Store locally options:
Download update files only when updates are approved: Deselect to download all updates
regardless of approval
Download express installation files: faster download and install
Download files from MS update: If WSUS uses upstream server, this option makes
the WSUS server download updates from MS update instead.
Automatic Approvals: Setup automatic approval rules for classifications and computer groups.
Computers: This is where you choose how updates are assigned to computers:
Use the update services console: server-side targeting
Use Group Policy or registry settings: client-side targeting
Server Cleanup Wizard: cleans up WSUS server for old computers, updates, and files
Reporting Rollup: Here you can configure whether downstream servers should send their
update/computer statuses sent upstream for central management in replica mode.
E-mail notifications
Personalization: Configure reporting rollup display, validation errors, to-do list display
WSUS configuration wizard: reruns the initial configuration.
Viewing status reports on computers and other wsus reports:
You must have Microsoft Viewer 2008 installed. Download from MS if not installed.
Microsoft Viewer 2008 requires .net 2.0 You can install 3.5(includes .net 2 and 3)(Net-Framework-Features) using server manager, add roles and features, feature install.
Approving Updates:
You can activate updates while viewing computer reports, or in the Updates menu.
Powershell:
Pipe get-wsusupdate into approve-wsusupdates
Powershell WSUS configuration:
http://technet.microsoft.com/library/hh826166
http://blogs.technet.com/b/heyscriptingguy/archive/2013/05/27/use-the-updateservices-module-to-manage-wsus.aspx
WSUS troubleshooting:
Server logs:
Application event log
c:\Program Files\Update Services\Logfiles\change.log
c:\program files\update services\logfiles\softwaredistribution.log
Client troubleshooting:
logs:
c:\windows\windowsupdate.log
c:\windows\softwaredistribution\reportingevents.log
reset updates due to corrupted update or other reason:
(wuauserv is the windows update service)
net stop wuauserv
delete everything in c:\windows\softwaredistribution
net start wuauserv
wuauclt /detectnow
This will query the WSUS server and check for updates
wuauclt /detectnow /resetauthorization
This expires a locally stored cookie with WSUS information, therefore it contacts the wsus server for fresh info and check for unpdates. Used when certain changes are made. For instance, if you change client-side targeting you may need to gpupdate /force on the client and then wuauclt /detectnow /resetauthorization
Extra note: I learned the hard way that you should run a Server Cleanup fairly often on WSUS server, depending on how much data you are storing. Besides the console server option, you can also do this in powershell with the invoke-wsusservercleanup cmdlet.
Extra note: It looks like 2012 is lacking a lot of cmdlets necessary for most powershell configurations, but the previous links list the ones you can use if you need some quick and dirty command line configs. If you're trying to do a post-install initial configuration, your best bet is to use the console installed on GUI 2012 or windows 8. When I first wrote these notes,I had thought they would add more by R2 but that does not seem to be the case.
1.2.2 configure group policies for updates
Configuring client computers to access the WSUS server:This can be done through GP or local GP edit(gpedit.msc) or registry. This must be done regardless of whether you use server-side targeting or client-side targeting.
local GP(gpedit.msc)
Local Computer Policy -> Computer Configuration ->Administrative Templates -> Windows Components -> Windows Update
GP
Computer Configuration ->Policies -> Administrative Templates -> Windows Components -> Windows Update
Registry
http://technet.microsoft.com/en-us/library/dd939844%28v=ws.10%29.aspx
First you must enable Automatic Updates. This is done using the Configure Automatic Updates setting in GP and local GP. You can also enable AU by using the control panel/Windows Updates.
Next you have to assign the WSUS server on a client.This is done in GP and local GP using the "Specify intranet Microsoft update service location" setting. Check the Enabled and enter your WSUS server in both intranet update service field and intranet statistics server field. You should preface the url with http or https. (Note that using SSL requires more complex setup on the server). It's important to note that WSUS 4 on 2012 defaults to port 8530 for http and 8531 for https. So you must also specify the port. Depending on your network setup, you can use server name or FQDN. Example:
http://wsusserver.contoso.com:8530
Other GP settings:
"Do not display 'Install Upates and Shutdown' option in Shutdown Windows dialog'"
"Do not adjust default option to 'Install Updates and Shut Down' in Shut Down Windows dialog'"
"Enable Windows Update Power Management to automatically wake up the system to install
scheduled updates"
"Automatic Updates detection frequency"
"Allow non-administrators to receive update notifications"
"Turn on Software Notifications"
"Allow Automatic Updates immediate installation"
"Turn on recommended updates via Automatic updates"
"No auto-restart with logged on users for scheduled automatic updates"
"Re-prompt for restart with scheduled installations"
"Delay Restart for scheduled installations"
"Reschedule Automatic Updates scheduled installations"
"Enable client-side targeting": see 1.2.3
"Allowed signed updates from an intranet MS update service location"
Extra note: Before WSUS 4, WSUS would default to port 80 unless there was a web site already on port 80. Then it would use 8530. In 2012, WSUS 4 just installs to 8530 regardless.
1.2.3 configure client-side targeting
Set the "Enable client-side targeting" to the WSUS group you want this group policy to apply to. Any computers affected by the GP will place themselves in that WSUS group.
You can also configure using the registry:
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate
TargetGroup should be set to the group you want
\AU key value UseWUServer needs to be set to 1
1.2.4 configure WSUS synchronization
I already covered a lot of this in 1.2.1
Use Synchronization menu to see current synchronizations.
Select products and classifications to synchronize
Classifications:
Critical Updates, Definition Updates, Drivers, Feature Packs, Security Updates, Service Packs, Tools, Update Rollups, Updates
Configure Update files
Setup manual or automatic synchronization on Synchronization Schedule option
Powershell:
Disable a product:
get-wsusproduct -titleincludes "SQL Server" | set-wsusproduct -disable
To enable, run set-wsusproduct without -disable switch
Same with classification except get-wsusclassification does not include -titleincludes parameter, so you must pipe through where-object
Enable Drivers classification:
get-wsusclassification | where -filterscript {$_.classification.title -eq "Drivers" | set-wsusclassification
set-wsusserversynchronization only allows configuration of upstream servers/MS update. No options for scheduling.
Set server to sync from MS Update:
set-wsusserversynchronization -syncfrommu
Configure an upstream server to synch from on port 1337 using SSL:
set-wsusserversynchronization -useservername UpWsus -portnumber 1337 -UseSSL
Configure an upstream server by piping in
1.2.5 configure WSUS groups
All computers will always show all computers. New computers are also assigned to Unassigned Computers, unless configured via client-side targeting.
Right click All Computers and Add a new computer group.
Server side targeting requires you to manually move computers from unassigned computers by right clicking and "Change Membership"
Powershell:
There doesn't seem to be a powershell cmdlet to configure groups.
Add a computer to a group:
get-wsuscomputer -nameincludes "WDSserver" | add-wsuscomputer -targetgroupname "Windows 2012"
Extra note: Another errata in MOAC 70-411 book. They give example Add-Wsuscomputer -computer PC1 to add Pc1 to a targetgroup. Add-wsuscomputer requires an input object piped from get-wsuscomputer. A string won't work.
1.2.6 (R2) Manage patch management in mixed environments
I still have not worked out what this R2 added objective is asking for.
Autonomous mode: upstream WSUS servers share updates with downstream servers, but updates must be approved at each WSUS server
Replica mode: upstream WSUS servers share updates with downstream servers, and all updates can be approved at an upstream server for replication downstream.
Server-side targeting:
You manually move computers into their WSUS group.
Client-side targeting:
Via GP, local GP, or registry, you can specify a WSUS group for the client computer to place itself in.
1.2.1 Install and configure the Windows Server Update Services (WSUS) role
Server Manager, Add roles and features
Select Windows Server Update Services.
WSUS requires RSAT tools and IIS to be installed
Check WSUS Services.
Check either WID Database if you will not be using a dedicated SQL server, or Database if you will. WID is a "Windows Internal Database"
Select a path to store updates.
Powershell install:
install-windowsfeature updateservices -includemanagementtools
This will also install, if not installed already, IIS Web server (Web-Server) and associated role features, .Net Framework 4.5(NET-Framework-45-ASPNET), RSAT, RSAT-Role-Tools and associated UpdateServices-RSAT feature for WSUS cmdlets/console. It also installs Windows Process Activation Service(WAS and WAS-Config-APIs)
Also Note that this will install the WID database(UpdateServices-WidDB & Windows-Internal-Database) by default. If you need to use a SQL server, install the feature updateservices-DB.
Post-install initial configuration:
Run the WSUS tool from Server Manager tools.
It will verify the path where you want to store updates
Choose Upstream Server: either MS Update or another WSUS server. use SSL is recommended. This is where you can set the upstream mode.
Specify a proxy server if needed.
The configuration will attempt to download WSUS information from MS update to configure further
Choose the update languages
Choose products for which you want updates from the upstream
Choose the type of updates, drivers, etc you want to download from the upstream.
Set sync Schedule. Manual or automatic
Finished: You can manually force an upstream sync now and/or launch the WSUS console.
Server Options:
Update Source and Proxy Server, Products and Classifications, Update Files and Languages, Synchronization Schedule, Microsoft Update Improvement Program:
You set these up in the intial configuration above. They can be changed here.
Update Files(And Languages): Languages was done in inital config. But Update Files lets you
choose to either store files locally or not. if not, computers install from MS Update.
Store locally options:
Download update files only when updates are approved: Deselect to download all updates
regardless of approval
Download express installation files: faster download and install
Download files from MS update: If WSUS uses upstream server, this option makes
the WSUS server download updates from MS update instead.
Automatic Approvals: Setup automatic approval rules for classifications and computer groups.
Computers: This is where you choose how updates are assigned to computers:
Use the update services console: server-side targeting
Use Group Policy or registry settings: client-side targeting
Server Cleanup Wizard: cleans up WSUS server for old computers, updates, and files
Reporting Rollup: Here you can configure whether downstream servers should send their
update/computer statuses sent upstream for central management in replica mode.
E-mail notifications
Personalization: Configure reporting rollup display, validation errors, to-do list display
WSUS configuration wizard: reruns the initial configuration.
Viewing status reports on computers and other wsus reports:
You must have Microsoft Viewer 2008 installed. Download from MS if not installed.
Microsoft Viewer 2008 requires .net 2.0 You can install 3.5(includes .net 2 and 3)(Net-Framework-Features) using server manager, add roles and features, feature install.
Approving Updates:
You can activate updates while viewing computer reports, or in the Updates menu.
Powershell:
Pipe get-wsusupdate into approve-wsusupdates
Powershell WSUS configuration:
http://technet.microsoft.com/library/hh826166
http://blogs.technet.com/b/heyscriptingguy/archive/2013/05/27/use-the-updateservices-module-to-manage-wsus.aspx
WSUS troubleshooting:
Server logs:
Application event log
c:\Program Files\Update Services\Logfiles\change.log
c:\program files\update services\logfiles\softwaredistribution.log
Client troubleshooting:
logs:
c:\windows\windowsupdate.log
c:\windows\softwaredistribution\reportingevents.log
reset updates due to corrupted update or other reason:
(wuauserv is the windows update service)
net stop wuauserv
delete everything in c:\windows\softwaredistribution
net start wuauserv
wuauclt /detectnow
This will query the WSUS server and check for updates
wuauclt /detectnow /resetauthorization
This expires a locally stored cookie with WSUS information, therefore it contacts the wsus server for fresh info and check for unpdates. Used when certain changes are made. For instance, if you change client-side targeting you may need to gpupdate /force on the client and then wuauclt /detectnow /resetauthorization
Extra note: I learned the hard way that you should run a Server Cleanup fairly often on WSUS server, depending on how much data you are storing. Besides the console server option, you can also do this in powershell with the invoke-wsusservercleanup cmdlet.
Extra note: It looks like 2012 is lacking a lot of cmdlets necessary for most powershell configurations, but the previous links list the ones you can use if you need some quick and dirty command line configs. If you're trying to do a post-install initial configuration, your best bet is to use the console installed on GUI 2012 or windows 8. When I first wrote these notes,I had thought they would add more by R2 but that does not seem to be the case.
1.2.2 configure group policies for updates
Configuring client computers to access the WSUS server:This can be done through GP or local GP edit(gpedit.msc) or registry. This must be done regardless of whether you use server-side targeting or client-side targeting.
local GP(gpedit.msc)
Local Computer Policy -> Computer Configuration ->Administrative Templates -> Windows Components -> Windows Update
GP
Computer Configuration ->Policies -> Administrative Templates -> Windows Components -> Windows Update
Registry
http://technet.microsoft.com/en-us/library/dd939844%28v=ws.10%29.aspx
First you must enable Automatic Updates. This is done using the Configure Automatic Updates setting in GP and local GP. You can also enable AU by using the control panel/Windows Updates.
Next you have to assign the WSUS server on a client.This is done in GP and local GP using the "Specify intranet Microsoft update service location" setting. Check the Enabled and enter your WSUS server in both intranet update service field and intranet statistics server field. You should preface the url with http or https. (Note that using SSL requires more complex setup on the server). It's important to note that WSUS 4 on 2012 defaults to port 8530 for http and 8531 for https. So you must also specify the port. Depending on your network setup, you can use server name or FQDN. Example:
http://wsusserver.contoso.com:8530
Other GP settings:
"Do not display 'Install Upates and Shutdown' option in Shutdown Windows dialog'"
"Do not adjust default option to 'Install Updates and Shut Down' in Shut Down Windows dialog'"
"Enable Windows Update Power Management to automatically wake up the system to install
scheduled updates"
"Automatic Updates detection frequency"
"Allow non-administrators to receive update notifications"
"Turn on Software Notifications"
"Allow Automatic Updates immediate installation"
"Turn on recommended updates via Automatic updates"
"No auto-restart with logged on users for scheduled automatic updates"
"Re-prompt for restart with scheduled installations"
"Delay Restart for scheduled installations"
"Reschedule Automatic Updates scheduled installations"
"Enable client-side targeting": see 1.2.3
"Allowed signed updates from an intranet MS update service location"
Extra note: Before WSUS 4, WSUS would default to port 80 unless there was a web site already on port 80. Then it would use 8530. In 2012, WSUS 4 just installs to 8530 regardless.
1.2.3 configure client-side targeting
Set the "Enable client-side targeting" to the WSUS group you want this group policy to apply to. Any computers affected by the GP will place themselves in that WSUS group.
You can also configure using the registry:
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate
TargetGroup should be set to the group you want
\AU key value UseWUServer needs to be set to 1
1.2.4 configure WSUS synchronization
I already covered a lot of this in 1.2.1
Use Synchronization menu to see current synchronizations.
Select products and classifications to synchronize
Classifications:
Critical Updates, Definition Updates, Drivers, Feature Packs, Security Updates, Service Packs, Tools, Update Rollups, Updates
Configure Update files
Setup manual or automatic synchronization on Synchronization Schedule option
Powershell:
Disable a product:
get-wsusproduct -titleincludes "SQL Server" | set-wsusproduct -disable
To enable, run set-wsusproduct without -disable switch
Same with classification except get-wsusclassification does not include -titleincludes parameter, so you must pipe through where-object
Enable Drivers classification:
get-wsusclassification | where -filterscript {$_.classification.title -eq "Drivers" | set-wsusclassification
set-wsusserversynchronization only allows configuration of upstream servers/MS update. No options for scheduling.
Set server to sync from MS Update:
set-wsusserversynchronization -syncfrommu
Configure an upstream server to synch from on port 1337 using SSL:
set-wsusserversynchronization -useservername UpWsus -portnumber 1337 -UseSSL
Configure an upstream server by piping in
1.2.5 configure WSUS groups
All computers will always show all computers. New computers are also assigned to Unassigned Computers, unless configured via client-side targeting.
Right click All Computers and Add a new computer group.
Server side targeting requires you to manually move computers from unassigned computers by right clicking and "Change Membership"
Powershell:
There doesn't seem to be a powershell cmdlet to configure groups.
Add a computer to a group:
get-wsuscomputer -nameincludes "WDSserver" | add-wsuscomputer -targetgroupname "Windows 2012"
Extra note: Another errata in MOAC 70-411 book. They give example Add-Wsuscomputer -computer PC1 to add Pc1 to a targetgroup. Add-wsuscomputer requires an input object piped from get-wsuscomputer. A string won't work.
1.2.6 (R2) Manage patch management in mixed environments
I still have not worked out what this R2 added objective is asking for.
1. Deploy, manage, and maintain server 1.1 Deploy and manage server images
http://technet.microsoft.com/en-us/library/hh831764.aspx
http://technet.microsoft.com/en-us/library/jj648426.aspx
Image file contains OS system files, updates & drivers, installed apps, configuration changes
Prerequisites: Installed: ADDS, DHCP, DNS, NTFS volume, Local Admin
1.1.1 Install the Windows Deployment Services (WDS) role
Windows Deployment Services (WDS) Roles:
Deployment Server (WDS-Deployment) - Image repository(on NTFS), PXE Server, TFTP(uses
UDP) to transport files
Transport Server (WDS-Transport) - subset role that's required by Deployment Server. However, this
can be installed by itself for advanced custom setups.
WDS Tools (WDS-AdminPack)
Install from Server Manager: select server, select WDS, Include Tools, Select Role Services: Deployment Services and Transport Server should be checked
Powershell:
install-windowsfeature -name wds -includemanagementtools
Initial Configuration:
Server Manager -> Tools -> Windows Deployment Services (wdsmgmt.msc)
Expand or double click Servers. The current server will shows as status "Not Configured"
Right-click "Configure server"
Prerequisites are shown. Click Next.
Select "Integrated with Active Directory"
Remote Install Folder will store the boot images, install images, PXE boot files, and WDS Tools.You will be warned if you place this folder on the system volume.
If you are running DHCP on the same server as WDS you will see the Proxy DHCP settings. "Do not listen on DHCP ports" should be checked. This stops WDS from listening on port 67. The next option "Configure DHCP options for proxy" will set option 60 on a MS DHCP server. Non-MS servers should be configured manually.
Set your PXE settings: Do not respond to any clients, Respond to only known clients, Respond to all clients (suboption: Require admin approval for unknown computers under Pending Devices)
You can now check "Add images to server now" if you would like to add images now. Finish.
WDSutil:
Wdsutil /initialize-server /reminst "c:\wdsfolder"
use /server switch for remote WDS server.
use /authorize to authorize in dhcp if needed
(you can also authorize at a later time with wdsutil /set-server /authorize:yes)
After-install configuration:
Configuring the WDS properties:
right click the server and select properties
General
PXE response - covered above in the initialization
ADDS: naming format for unknown clients. Set location to create new computer accounts
Boot: setup pxe options for known and unknown clients and locations for boot images
Clients: Configure unattended install answer file for various client architectures. Configure after-install domain joining. Enable client logging.
DHCP: covered above in the initialization
Multicast: configurations for mass image installing
Advanced: DC and GC prefererence, DHCP authorization
Network: WDS port specification. Network Profile option no longer valid in 2012.
TFTP: TFTP options.
Extra Note: You can unintialize a server using wdsutil and the /unintialize-server switch
Extra Note: New cmdlets for configuring WDS introduced in "Windows Powershell 4.0, Windows Server 2012 R2 Preview". I started these notes pre-R2 so I only be using WDSUtil for command line configuration examples.
1.1.2 configure and manage boot, install, and discover images
Images use Windows Imaging Format (WIM)
Right click Boot Images and Add Image File. You're looking for boot.wim on the OS install CD.
To add an install image, you right click install image and "Add Install Image". There is a default install image on every OS install CD called install.wim which will do a standard install. Otherwise you can add a custom image here as well.
Image Groups: An image group is made up of images that shares security options and file resources.
Resource WIM file(res.rwm) will contain the file resources for all of the images in a group.
Right clicking a boot image gives you the option to create a capture image or discover image off of that boot image.
Capture image: This image is used to grab an image off the client pc and capture it as a new install image. Images must be sysprep'd before capture. use /generalize and /oobe switches
Discover image: used to boot on a computer that does not support pxe. You can put it on a bootable medium(ie. CDROM) and boot off that. To convert the discover WIM to ISO, use the Windows Assessment and Deployment Kit's oscdimg.exe utility.
Image priority: lowest value is shown first in menu on the client.
Image permissions: can be set in the properties of each image or image group to control who has access to install the image
Unattended Install:
Unattended installs use answer files in XML format that can be created using Windows System Image Manager, part of the WADK. To deploy a server with unattended install you must have an answer file for the boot image and the install image. For the boot image, go to server properties/client tab and check "Enable unattended installation". Then browse to your answer file for the appropriate architecture. Next, go to your images and right click properties and check the "Allow image to install in unattended mode and browse to your answer file for this image under Select file.
WDSUtil:
wdsutil /add-image /imagefile:"c:\wds\boot\boot.wim" /imagetype:boot
wdsutil /add-image /imagefile:"c:\wds\install\install.wim" /imagetype:install
other parameters:
/Imagegroup
/SingleImage: single image from WIM
/Name: Sets image display name
/Description: Sets description
/unattendfile: path for answer file
1.1.3 update images with patches, hotfixes, and drivers
The main thing to know is how to use the DISM tool. As of windows 2008 R2, you can use the WDS console to add drivers to boot images(useful for adding new network driver due to new hardware), and also they added a feature called dynamic driver provisioning(see 1.1.5). Let's start with DISM.
First thing about DISM is to mount the image:
First you want to get the index of the image you want to work with:
dism /get-wiminfo /wimfile:E:\WDSimages\install\windows7install.wim
If you would like to see specific info about this image, just add /index:
dism /get-wiminfo /wimfile:E:\WDSimages\install\windows7install.wim /index:1
Now we need to mount it:
dism /mount-wim /wimfile:E:\WDSimages\install\windows7install.wim /index:1 /mountdir:E:\WDSimages\currentimage
This will expand the image into E:\wdsimages\currentimage.
To add packages, patches, hotfixes, etc that are in .cab or .msu format, use:
dism /image:E:\WDSimages\currentimage /add-package /packagepath:E:\WDSupdates\packages\newpackage.cab
Instead of /add-package use /remove-package to remove from the image
To add drivers to a mounted WIM:
dism /image:e:\wdsimages\currentimage /add-driver /driver:e:\wdsupdates\drivers\newdriver.inf
you can add a lot of drivers at once with the /recurse switch.
dism /image:e:\wdsimages\currentimage /add-driver /driver:e:\wdsupdates\drivers /recurse
use /remove-driver to remove drivers
Now you must unmount the image and either commit or discard changes:
dism /unmount-image /mountdir:e:\wdsimages\currentimage /commit
dism /unmount-image /mountdir:e:\wdsimages\currentimage /discard
About the Dynamic Driver Provisioning in WDS console(2008 R2+):
See the R2 objective 1.1.5.
Extra Note: you can also install drivers using an unattended install answer file.
1.1.4 install features for offline images
You can also install features into WIM images using the DISM utility.
Mount your dism image as explained in 1.1.3
List the features available on this image:
dism /image:e:\wdsimages\currentimage /get-features
Enable a feature:
dism /image:e:\wdsimages\currentimage /enable-feature /featurename:SMTP-SERVER
Disable a feature:
dism /image:e:\wdsimages\currentimage /disable-feature /featurename:SMTP-SERVER
Now you must unmount and /commit your mounted image as shown in 1.1.3
1.1.5 (R2) Configure driver groups and packages
Drivers are installed as the image is installed, not injected directly into the image. Keep in mind that you can also configure dynamic driver provisioning with wdsutil.
http://technet.microsoft.com/en-us/library/dd348456.aspx
Add driver packages by right clicking Drivers under the WDS server, and selecting "Add driver packages". You can select a package from an inf file, or select all packages in a folder. Click next to select drivers you want to add. Next you an select an existing group to add to, create a new driver group to add the package to, or leave it unassigned. If you added it to a group, you can edit the filters for the group.
Right click the "Drivers" sub-menu and select "Add Driver Group". You can configure a filter that takes into account the hardware of the client. Some example filter types: Manufacturer, Model, Bios Vendor, Bios Version, Chassis Type, UUID, and Device Group. Next, you can configure a filter by install image using the filter types: OS Version, OS Edition, OS Language, or Image ID.
(Example, OS Version requires Majorversion.Minorversion.Buildnumber.ServicePackNumber. Image ID requires GUID of image)
Finally, you can configure whether driver packages will only be installed if they match client hardware, or if all driver packages in the group will be installed.
Other options when right clicking Drivers: Enable/Disable Driver Packages, Delete Driver Packages. Let's you search for drivers to disable/enable or delete.
Other options when right clicking a driver group:
Disable, Duplicate - Clone the group to a new one, Modify Filters, Add driver packages to
the group, Delete, Rename
Properties - let's you enabled/disable group, set whether drivers only get installed if hardware
exists on client, and edit filters on the Filters tab.
Clicking on All Packages will show you all driver packages. Right click on a driver package allows:
Add or Remove package to group, Disable, Delete, Rename
Properties - Rename, enable/disable, view package info like location and architecture;
Drivers tab lists drivers in package; Files tab lists all files in package;
Group Membership tab to update groups for package.
http://technet.microsoft.com/en-us/library/jj648426.aspx
Image file contains OS system files, updates & drivers, installed apps, configuration changes
Prerequisites: Installed: ADDS, DHCP, DNS, NTFS volume, Local Admin
1.1.1 Install the Windows Deployment Services (WDS) role
Windows Deployment Services (WDS) Roles:
Deployment Server (WDS-Deployment) - Image repository(on NTFS), PXE Server, TFTP(uses
UDP) to transport files
Transport Server (WDS-Transport) - subset role that's required by Deployment Server. However, this
can be installed by itself for advanced custom setups.
WDS Tools (WDS-AdminPack)
Install from Server Manager: select server, select WDS, Include Tools, Select Role Services: Deployment Services and Transport Server should be checked
Powershell:
install-windowsfeature -name wds -includemanagementtools
Initial Configuration:
Server Manager -> Tools -> Windows Deployment Services (wdsmgmt.msc)
Expand or double click Servers. The current server will shows as status "Not Configured"
Right-click "Configure server"
Prerequisites are shown. Click Next.
Select "Integrated with Active Directory"
Remote Install Folder will store the boot images, install images, PXE boot files, and WDS Tools.You will be warned if you place this folder on the system volume.
If you are running DHCP on the same server as WDS you will see the Proxy DHCP settings. "Do not listen on DHCP ports" should be checked. This stops WDS from listening on port 67. The next option "Configure DHCP options for proxy" will set option 60 on a MS DHCP server. Non-MS servers should be configured manually.
Set your PXE settings: Do not respond to any clients, Respond to only known clients, Respond to all clients (suboption: Require admin approval for unknown computers under Pending Devices)
You can now check "Add images to server now" if you would like to add images now. Finish.
WDSutil:
Wdsutil /initialize-server /reminst "c:\wdsfolder"
use /server switch for remote WDS server.
use /authorize to authorize in dhcp if needed
(you can also authorize at a later time with wdsutil /set-server /authorize:yes)
After-install configuration:
Configuring the WDS properties:
right click the server and select properties
General
PXE response - covered above in the initialization
ADDS: naming format for unknown clients. Set location to create new computer accounts
Boot: setup pxe options for known and unknown clients and locations for boot images
Clients: Configure unattended install answer file for various client architectures. Configure after-install domain joining. Enable client logging.
DHCP: covered above in the initialization
Multicast: configurations for mass image installing
Advanced: DC and GC prefererence, DHCP authorization
Network: WDS port specification. Network Profile option no longer valid in 2012.
TFTP: TFTP options.
Extra Note: You can unintialize a server using wdsutil and the /unintialize-server switch
Extra Note: New cmdlets for configuring WDS introduced in "Windows Powershell 4.0, Windows Server 2012 R2 Preview". I started these notes pre-R2 so I only be using WDSUtil for command line configuration examples.
1.1.2 configure and manage boot, install, and discover images
Images use Windows Imaging Format (WIM)
Right click Boot Images and Add Image File. You're looking for boot.wim on the OS install CD.
To add an install image, you right click install image and "Add Install Image". There is a default install image on every OS install CD called install.wim which will do a standard install. Otherwise you can add a custom image here as well.
Image Groups: An image group is made up of images that shares security options and file resources.
Resource WIM file(res.rwm) will contain the file resources for all of the images in a group.
Right clicking a boot image gives you the option to create a capture image or discover image off of that boot image.
Capture image: This image is used to grab an image off the client pc and capture it as a new install image. Images must be sysprep'd before capture. use /generalize and /oobe switches
Discover image: used to boot on a computer that does not support pxe. You can put it on a bootable medium(ie. CDROM) and boot off that. To convert the discover WIM to ISO, use the Windows Assessment and Deployment Kit's oscdimg.exe utility.
Image priority: lowest value is shown first in menu on the client.
Image permissions: can be set in the properties of each image or image group to control who has access to install the image
Unattended Install:
Unattended installs use answer files in XML format that can be created using Windows System Image Manager, part of the WADK. To deploy a server with unattended install you must have an answer file for the boot image and the install image. For the boot image, go to server properties/client tab and check "Enable unattended installation". Then browse to your answer file for the appropriate architecture. Next, go to your images and right click properties and check the "Allow image to install in unattended mode and browse to your answer file for this image under Select file.
WDSUtil:
wdsutil /add-image /imagefile:"c:\wds\boot\boot.wim" /imagetype:boot
wdsutil /add-image /imagefile:"c:\wds\install\install.wim" /imagetype:install
other parameters:
/Imagegroup
/SingleImage: single image from WIM
/Name: Sets image display name
/Description: Sets description
/unattendfile: path for answer file
1.1.3 update images with patches, hotfixes, and drivers
The main thing to know is how to use the DISM tool. As of windows 2008 R2, you can use the WDS console to add drivers to boot images(useful for adding new network driver due to new hardware), and also they added a feature called dynamic driver provisioning(see 1.1.5). Let's start with DISM.
First thing about DISM is to mount the image:
First you want to get the index of the image you want to work with:
dism /get-wiminfo /wimfile:E:\WDSimages\install\windows7install.wim
If you would like to see specific info about this image, just add /index:
dism /get-wiminfo /wimfile:E:\WDSimages\install\windows7install.wim /index:1
Now we need to mount it:
dism /mount-wim /wimfile:E:\WDSimages\install\windows7install.wim /index:1 /mountdir:E:\WDSimages\currentimage
This will expand the image into E:\wdsimages\currentimage.
To add packages, patches, hotfixes, etc that are in .cab or .msu format, use:
dism /image:E:\WDSimages\currentimage /add-package /packagepath:E:\WDSupdates\packages\newpackage.cab
Instead of /add-package use /remove-package to remove from the image
To add drivers to a mounted WIM:
dism /image:e:\wdsimages\currentimage /add-driver /driver:e:\wdsupdates\drivers\newdriver.inf
you can add a lot of drivers at once with the /recurse switch.
dism /image:e:\wdsimages\currentimage /add-driver /driver:e:\wdsupdates\drivers /recurse
use /remove-driver to remove drivers
Now you must unmount the image and either commit or discard changes:
dism /unmount-image /mountdir:e:\wdsimages\currentimage /commit
dism /unmount-image /mountdir:e:\wdsimages\currentimage /discard
About the Dynamic Driver Provisioning in WDS console(2008 R2+):
See the R2 objective 1.1.5.
Extra Note: you can also install drivers using an unattended install answer file.
1.1.4 install features for offline images
You can also install features into WIM images using the DISM utility.
Mount your dism image as explained in 1.1.3
List the features available on this image:
dism /image:e:\wdsimages\currentimage /get-features
Enable a feature:
dism /image:e:\wdsimages\currentimage /enable-feature /featurename:SMTP-SERVER
Disable a feature:
dism /image:e:\wdsimages\currentimage /disable-feature /featurename:SMTP-SERVER
Now you must unmount and /commit your mounted image as shown in 1.1.3
1.1.5 (R2) Configure driver groups and packages
Drivers are installed as the image is installed, not injected directly into the image. Keep in mind that you can also configure dynamic driver provisioning with wdsutil.
http://technet.microsoft.com/en-us/library/dd348456.aspx
Add driver packages by right clicking Drivers under the WDS server, and selecting "Add driver packages". You can select a package from an inf file, or select all packages in a folder. Click next to select drivers you want to add. Next you an select an existing group to add to, create a new driver group to add the package to, or leave it unassigned. If you added it to a group, you can edit the filters for the group.
Right click the "Drivers" sub-menu and select "Add Driver Group". You can configure a filter that takes into account the hardware of the client. Some example filter types: Manufacturer, Model, Bios Vendor, Bios Version, Chassis Type, UUID, and Device Group. Next, you can configure a filter by install image using the filter types: OS Version, OS Edition, OS Language, or Image ID.
(Example, OS Version requires Majorversion.Minorversion.Buildnumber.ServicePackNumber. Image ID requires GUID of image)
Finally, you can configure whether driver packages will only be installed if they match client hardware, or if all driver packages in the group will be installed.
Other options when right clicking Drivers: Enable/Disable Driver Packages, Delete Driver Packages. Let's you search for drivers to disable/enable or delete.
Other options when right clicking a driver group:
Disable, Duplicate - Clone the group to a new one, Modify Filters, Add driver packages to
the group, Delete, Rename
Properties - let's you enabled/disable group, set whether drivers only get installed if hardware
exists on client, and edit filters on the Filters tab.
Clicking on All Packages will show you all driver packages. Right click on a driver package allows:
Add or Remove package to group, Disable, Delete, Rename
Properties - Rename, enable/disable, view package info like location and architecture;
Drivers tab lists drivers in package; Files tab lists all files in package;
Group Membership tab to update groups for package.
Subscribe to:
Posts (Atom)