What is the primary difference between the Server Manager in Windows Server 2012 and the previous versions?

Solutions Fast Track

Server Manager

Server Manager is likely to be a familiar tool to engineers who have worked with earlier versions of Windows.

Server Manager is a single solution that is used as a single source for managing identity and system information.

Server Manager is enabled by default when a Windows 2008 server is installed.

Server Core

Server Core brings a new way not only to manage roles but also to deploy a Windows Server.

Server Core is a minimal server installation option for Windows Server 2008 that contains a subset of executable files, as well as five server roles.

Microsoft defines Server Core as “a minimal server installation option for Windows Server 2008 that contains a subset of executable files, and five server roles.”

Active Directory Certificate Services

In PKI, a digital certificate is a tool used for binding a public key with a particular owner. A great comparison is a driver's license.

X.509 is the standard used to define what makes up a digital certificate.

The X.500 directory standard specifies a common root of a hierarchical tree although the “tree” is inverted: the root of the tree is depicted at the “top” level while the other branches—called “containers”—are below it.

Active Directory Domain Services

With the release of Windows Server 2008, an Active Directory domain controller can be deployed in several new ways.

Active Directory Domain Services (AD DS) stores information about users, computers, and other devices on the network.

AD DS has several new installation options in Windows Server 2008, including RODC and DNS.

Add Roles and Features

Server Manager is where you go to Add Roles and Features to your server. In upcoming chapters, we will be installing different roles and features. Most of these installs will be launched from Server Manager. The first few steps of all the installs will be the same. So, instead of repeating these steps multiple times, we will go through these steps now:

In the Server Manager Dashboard, select Add Roles and Features. This will launch the Add Roles and Features Wizard. First, you will be presented with the Before You Begin screen, as seen in Figure 1.3. This screen describes what can be done using the wizard. It also gives configuration suggestions to follow before you continue with the wizard. Click Next.

Next, you will see the Installation Type screen, as seen in Figure 1.4. You have two options. You can install roles or features on the system; or you can install VDI (Virtual Disk Infrastructure) services on the system. Select Role-based or feature-based installation, and click Next.

Next you will see the Server Selection screen, as seen in Figure 1.5. Here, you can choose to install to a server or to a VHD (virtual hard disk). If you choose a VHD, you have the option to install to a VHD attached to an online server, or to install to an offline VHD. Select Select a server from the server pool. Then choose the server you want to install onto, and click Next.

Server Manager cmdlets

The Server Manager cmdlets are there to help the administrator with any action the Server Manager would normally allow them to perform (see Table 11.17).

Table 11.17. Server Manager cmdlets

With the PowerShell Server Manager cmdlets, you can add, check, and remove roles, roles services, and features from servers in your environment. Before you can have access to these cmdlets, you have to import the Server Manager module via the import-module cmdlet. Follow these steps to import the Server Manager Module:

Startup PowerShell

Type import-module ServerManager

Once the cmdlet completes, you can check that you have access to the Server Manager cmdlets by typing get-help *windowsfeature*. Remember that the * are the wildcards and this will return all cmdlets with windowsfeature anywhere in them. A list of three cmdlets should then be listed for you as shown (see Figure 11.19), which will include Add-WindowsFeature, Get-WindowsFeature, and Remove-WindowsFeature.

These cmdlets are very straightforward in their use and purpose as can be determined by their names. Add-WindowsFeature is the one the administrator will be using to add the roles, role services, and features; Get-WindowsFeature is the one that will be used to get the information about them, and Remove-WindowsFeature to remove them directly. The syntax is just as straightforward. Assume that you wanted to install the telnet client on your server. Instead of starting up Server Manager and using the wizard, you can do it directly with PowerShell. The first thing you need is the name of the feature you want to install. Sometimes, you will not know the exact name that Server Manager uses and will need to look it up. This is done with the Get-WindowsFeature cmdlet. Typing Get-WindowsFeature at the prompt will return a list with all the potential features with a column showing their display name in Server Manager and a column showing their name. The Display name column will also have an [X] next to any feature already installed. This way if you need to, you can check to see if the feature you want is already installed. The name column is what will be needed for the cmdlet to run properly. In this case, the name of the telnet client is telnet-client. Looking at the Display name column, you will see that it is not installed by default (see Figure 11.20). With this name, you can now call the Add-WindowsFeature cmdlet by typing Add-WindowsFeature telnet-client and then hitting enter. You will then get the prompt back. Now, you try the Get-WindowsFeature cmdlet again. You can type it without an argument like you did the first time, or you can specify that you want to see the telnet client feature specifically by giving it the name and typing Get-WindowsFeature telnet-client. You will now be able to see that the telnet client has an [X] before it, showing that it has been installed (see Figure 11.21).

The Remove-WindowsFeature cmdlet is the cmdlet you will be using to remove modules, as the name implies. Following the previous example, let us say you now want to remove the telnet client. Since you already know the name of the feature you want to remove, you do not need to look it up, but if you do not know the name, you could just look it up with Get-WindowsFeature as described earlier. The next step is to issue the cmdlet by typing Remove-WindowsFeature telnet-client and hit enter. PowerShell will process the cmdlet and then return a summary describing if the removal was successful, if a restart is needed, and a reminder of what feature was removed (see Figure 11.22).

So, the question is, when would you use these features? Imagine you are the lucky administrator tasked with building up a Web server farm consisting of 15 new servers which all require IIS to be installed. Instead of trudging your way through each server one at a time and utilizing the Server Manager GUI to perform the installs, you would instead be able to create and utilize a repeatable PowerShell cmdlet or a sequence of cmdlets. Even if you decided to log on to each server and execute the cmdlets instead of utilizing the GUI, you would save a hefty amount of time in performing the installations. Now, add to this the equation the fact that you can use PowerShell's new remoting features or even just write it once and have it available on the network, and you can see the reason why you would use it.

Installation Requirements for ACL Manager

Before installing ACLM, verify that the intended server meets all software and hardware requirements listed in the following. CiscoWorks2000 and Cisco Resource Manager Essentials (RME) are both prerequisites for the installation of ACLM. The software runs on either Windows NT 4.0 and Windows2000, or Solaris 2.6 and 2.7 operating systems.

When running ACLM server on a Solaris operating system, the following requirements apply:

System Sun UltraSPARC 60

Processor 400MHz or faster

Memory 512MB RAM with 1GB swap space

Disk 9GB

When running ACLM server on a Windows operating system, the following requirements apply:

System Pentium-compatible

Processor 500Mhz or faster

Memory 512MB RAM with 1GB swap space

Disk 9GB

Because the ACLM user interface is run from a browser on an authorized client machine, certain software and hardware requirements are needed on the client as well. ACLM will function on several different client platforms and operating systems as follows:

IBM PC-Compatible Windows 95, Windows 98,Windows NT 4.0, and Windows2000

Sun Microsystems Solaris versions 2.5.1, 2.6, or 2.7

IBM RS/6000 Any version of AIX supporting the required browsers listed next

HP-UX Workstation Any version of HP-UX supporting the required browsers listed next

All client systems connecting to ACLM must also have either an Internet Explorer 5.0 or 5.1 browser or the Netscape Communicator 4.6 or 4.7 Internet Web browser.

Installing the .NET framework

Open the Server Manager and click the Features option in the left-hand pane (see Figure 11.1). This displays the Features control panel in the right-hand pane.

Click Add Features to open the list of available features for Windows 2008 (see Figure 11.2).

Clicking the .NET Framework 3.5.1. Features checkbox displays a message telling you there are several dependent features also required, which you can select here. Click Add Required Role Services to continue (see Figure 11.3).

You now see the Add Features Wizard. Click Next (see Figure 11.4).

The next window, Introduction to Web Server (IIS), provides general information on the Windows Web Server. Click Next (see Figure 11.5).

The Web Server Role Services window provides the option to include additional roles. Since this was initiated by the .NET framework install, all required dependencies are already selected. So there is no reason to add anything at this time. Click Next (see Figure 11.6).

The final screen you see prior to the installation starting is the validation screen, which explains how the install process will work and what to expect in terms of restarts, etc. Click Install to begin (see Figure 11.7).

The install process begins, installing the Web Server (IIS) feature, the .NET Framework feature, and the Windows Process Activation Service (see Figure 11.8).

Once the install is complete, an Installation Results window is displayed. Click Close and then close out of the Server Manager console as well (see Figure 11.9).

Longhorr's Server Manager

Installation using Longhorn's Server Manager provides a single interface that allows administrators to install and uninstall server roles and features. It also provides quick status on the state of installed roles and provides entry points to role management tools. To install IIS 7.0 on Longhorn Server, just as in Vista, you must have administrator rights to the system. In this example we will install the same features as the last procedure for Vista but using Longhorn Server's Server Manager:

Click the Start button and go to Administrative Tools | Server Manager, as shown in Figure 2.7.

While in Server Manager, select Roles in the left window pane. Afterward the Roles view is displayed, similar to Figure 2.8. As you see, we have no roles installed on our server.

Now let's add the Web Server role for Longhorn Server. As shown in Figure 2.9, select Add Roles.

Now you should see the Add Roles Wizard in Figure 2.10. Click Next.

The Select Server Roles screen appears as shown in Figure 2.11. Choose Web Server (IIS).

After you select Web Server (IIS), a popup screen like the one shown in Figure 2.12 will inform you that this role cannot be installed unless the Windows Process Activation Service is also installed. If you need to know why these features are required, simply click the Why are these features required link at the bottom of the dialog box. Now click Add Required Features. Once that's done, click Next back on the Select Server Roles screen.

Now you will see the Web Server (IIS) screen shown in Figure 2.13, providing an introduction to the Web Server. Click Next.

You will be allowed to select the features you want enabled in IIS 7.0, as shown in Figure 2.14. Since we are just taking the defaults, we won't be adding or deleting any features, so we can now click Next. Remember that with IIS 7.0, only the modules from the features you choose load, so the more you add, the larger the footprint becomes.

After selecting the features you require, the installation wizard provides you a breakdown of the roles, services, and features you are about to install, as shown in Figure 2.15. If you are sure of what you want to install, click Install. If not, click Previous and select the features you want.

You will now see the Installation Progress screen, similar to the one shown in Figure 2.16.

When the installation is complete, you will see the Installation Results shown in Figure 2.17. After viewing the installation results, click Close.

Now you should see Server Manager, showing that you have one role installed, that being Web Server (IIS), as shown in Figure 2.18.

To verify that the installation was a success, just as in Vista, you can test using http://localhost. You should see the same screen as previously shown in Figure 2.6.

Just as in previous versions of IIS, we can install the server via the user interface, whether through Vista's Programs and Features or Longhorn Server's Server Manager. These methods are probably the easiest forms of installation. Now we will examine installing IIS 7.0 via the command line using PKGMGR.EXE.

Protecting the Messages

As an IMAP server manager, protecting the existence of the server's mail messages is a high priority. A frequent and reliable backup process is a key to disaster recovery, but it may not be the total reliability solution. Loss of even half a day's mail messages could represent a large productivity cost to a corporate enterprise. A high-availability file system may be a requirement.

Most people think of RAID 5 for high availability. RAID 5 provides data security with a low resource overhead. However, in some cases, it will exert a performance penalty when writing to files. An e-mail system performs a lot of write operations. If performance is an issue, you should consider an alternate high-availability scheme. Sometimes a simple disk mirror method such as RAID 1 (or 1 plus 0) can provide the best compromise between performance and availability.

Even if you have your mail system on a regular backup rotation, the next question is: can you easily restore those files? You will certainly want to use backup software that conveniently does file-level restores. In some cases, however, restoring the data may not be the only task. An indexed mailbox (like that supported in Cyrus IMAP) requires that you reconstruct it if you add (or delete) files outside the operation of the mail server. Otherwise, the indexes will be out of sync with the data and some messages may not be visible.

Web (Including WSUS) and BITS Application Servers

For both new and existing Web and BITS application servers, all you need to do is install the BranchCache feature. In general, we recommend that you install the services first before you enable BranchCache on the servers. You can use PowerShell or Server Manager to do this.

The PowerShell lines to install and enable BranchCache are as follows:

Install-WindowsFeature BranchCache

Restart-Computer

If you use the Server Manager, perform the following steps:

In Server Manager, click Manage, and then click Add Roles and Features. The Add Roles and Features wizard opens. Click Next.

On the Select Installation Type page, select Role-based or feature-based installation and then click Next.

On the Select destination server page, make sure that the correct server is selected and then click Next.

On the Select server roles page, click Next.

On the Select features page, click BranchCache and then click Next (Figure 12.2).

On the Confirm installation selections page, click Install. On the Installation progress page, you can see the BranchCache feature installation progress. Click Close when the installation is finished.

You can confirm that the BranchCache service is running by checking for it in the services.msc. It should be enabled and its startup type set as Automatic.

Installing Server Core Roles

We can't use Server Manager because it has .NET Framework dependencies, and we can't use the command servermanagercmd.exe either for the same reason. If we want to install roles or features on Server Core, we need the command ocsetup.exe. ocsetup is often used to perform scripted installations of Windows components, and substitutes the Sysocmgr.exe tool that we know from previous Windows versions. ocsetup has one disadvantage when compared with Server Manager. Server Manager carefully checks dependencies when installing roles or features, while ocsetup doesn't. This means you have to install or de-install all the roles and features in the correct order. ocsetup installs the following file types.

Microsoft System Installer (MSI) files (Windows Installer service, msiexec.exe)

Component-Based Servicing (CBS) components (Package Manager)

MSI or CBS packages that have an associated custom installer .exe file

The full command-line options for ocsetup are ocsetup.exe [/?] [/h] [/help] component [/log:file] [/norestart] [/passive] [/quiet] [/unattendfile:file] [/uninstall] [/x: parameter]. For the full explanation of the flags see Table 7.4.

Table 7.4. Command-Line Options for ocsetup.exe

Installing AD CS Using Server Manager

To install AD CS using Server Manager, read the scenario below and follow the steps:

Scenario

After a long meeting to review the overall plan for Public Key Infrastructure at EndtoEdge.com, the first part of the implementation phase was defined. The core requirements for this initial phase are:

The Certificate Authority must be able to issue certificates for domain-joined computer as well as non-domain-joined computers.

The Certificate Authority must be able to issue certificates to domain members that are not connected to the domain at certain point in time.

Client computers that are not part of the domain should be able to request a certificate using a friendly Web interface.

In this phase, the plan is to have only one Certificate Authority that should be integrated with Active Directory.

The certificates generated by this CA should expire every 5 years.

Note

This scenario assumes that you already have an account member of the IIS_IUSRS group that will be used as service account for the Certificate Enrollment Web Services (CES). For this scenario, the account name is CESService. This account must have privilege to logon locally on the computer that you are installing this role service.

Implementation steps—follow the steps below to install AD CS Role and prepare the environment to meet the above requirements:

On the Server Manager, click Dashboard in the left pane and click Add Roles and features.

On the Before you begin page, click Next.

On the Select installation type page, ensure that Role-based or feature-based installation option is selected and click Next.

On the Select destination server page, select the target server and click Next.

On the Select server roles page, select Active Directory Certificate Services role. On the Add Roles and Features Wizard dialog box, click Add Features button and click Next.

On the Select features page, leave the default selection and click Next.

On the Active Directory Certificate Services page, click Next.

On the Select role services page, make sure that all options that are part of the scenario requirement are selected as shown below and then click Next.

Note

Upon selecting each one of those options, the Add Roles and Features Wizard dialog box is expected to appear multiple times. Make sure to click Add Feature button always when requested.

On the Web Server Role (IIS) page, click Next.

Note

If you already have IIS installed on this server, this page will not appear.

On the Select role services page, leave the default selection and click Next.

On the Confirm installation selections, leave the default selection and click Install.

On the Installation progress page, you have the option to wait until the installation is finished or you can click Close and leave the installation happening in the background. For this particular example, we will wait until the installation is successfully completed to click Close.

In the Server Manager, click the orange alert sign under the notification flag as shown in Figure 3.27.

Click Configure Active Directory Certificate Services on the destination server option.

On the AD CS Configuration wizard, Credentials page, review the installation requirements, make sure you are compliant with all requirements, and then click Next.

On the Role Services page, select Certificate Authority and Certificate Authority Web Enrollment as shown in Figure 3.28 and click Next.

Note

Although for this scenario we need all role services installed, you will need to install those two roles services first since they are prerequisites for the others.

On the Setup Type page, select Enterprise CA in order to accommodate the design requirements for this scenario and then click Next.

On the CA Type page, select Root CA since this is the first CA in this organization and then click Next.

On the Private Key page, select Create a new private key and click Next.

Note

Use the option Use existing private key when reinstalling a certificate authority.

On the Cryptography for CA page, select the cryptographer provider, the key length, and the hash algorithm that will be used as shown in Figure 3.29. For this particular scenario, leave the default selection and click Next.

Note

Use the option Allow administrator interaction when the private key is accessed by the CA if you want to prevent unapproved use of the CA and its private key. This will require that the administrator enters a password before every cryptographic operation.

On the CA Name page, ensure that the information is correct and click Next.

On the Validity Period page, leave the default selection as per scenario requirements and click Next.

On the CA Database page, leave the default options and click Next.

On the Confirmation page, review all selections as shown in Figure 3.30 and, assuming that they are all correct, click Configure.

On the Progress page, wait until the installation, and once it is finished, the Results page should appear with the confirmation that both role services were installed as shown in Figure 3.31 and then click Close.

In the Server Manager, click the notification flag and click Add Roles and Features as shown in Figure 3.32.

On the Installation progress page, click Configure Active Directory Certificate Services on the destination server.

On the AD CS Configuration wizard, on the Credentials page, click Next.

On the Role Services page, select the options required for this scenario as shown in Figure 3.33 and then click Next.

On the CA for CES page, leave the default selection (CA Name) and click Next.

On the Authentication Type for CES page, ensure that Windows integrated authentication is selected and click Next.

On the Service Account for CES page, ensure that Specify service account (recommended) option is selected and click Select button. The Window Security dialog box will appear for you to type the credentials of the CES Service account and click OK. The Service Account for CES page will appear as shown in Figure 3.34. Once you confirm that the account is correctly configured there, click Next.

On the Authentication Type for CEP page, ensure that Windows integrated authentication is selected and click Next.

On the Server Certificate page, select Choose an existing certificate for SSL encryption (recommended) and highlight the certificate suggested as shown in Figure 3.35 and then click Next.

On the Confirmation page, review the selections and click Configure.

On the Progress page, wait until all role services are installed. Once this process is finished, the Results page will appear as shown in Figure 3.36. Confirm that all roles services were installed and click Close, and then click Close again in the Installation progress page.

At this point, the role is installed and ready to be used.