book

Mastering Windows Server 2022 - Fourth Edition

by Jordan Krause

May 2023

Intermediate to advanced

726 pages

22h 10m

English

Packt Publishing

Read now

Unlock full access

Who this book is forWhat this book coversTo get the most out of this bookGet in touchMaking the Most Out of This Book – Get to Know Your Free BenefitsUnlock Your Book’s Exclusive Benefits
The purpose of Windows ServerIt’s getting cloudy out therePublic cloudPrivate cloudWindows Server versions and licensingStandard versus DatacenterWindows Server 2022 EssentialsWindows Server 2022 Datacenter: Azure EditionThree different user interfacesDesktop ExperienceServer CoreNano Server – now only for containersLicensing models – what happened to SAC?Long-Term Servicing Channel (LTSC)Semi-Annual Channel (SAC) (now retiring)License purchase and packsCore PacksAt what point do I turn to Datacenter?Client Access Licenses (CALs)Overview of new and updated featuresHardware securityNetwork securityProtocol updatesDNS-over-HTTPSAzure integrationsAn Azure-specific version of the OSAzure Stack HCIHotpatchingSMB over QUICWindows Admin CenterStorageContainerizationThe Windows 10 experience continuedHyper-Converged InfrastructureMicrosoft EdgeWindows Defender Advanced Threat ProtectionIntegration with LinuxSystem InsightsFeatures deprecated in Server 2022Semi-Annual Channel (SAC) releasesWindows Internet Name Service (WINS)Internet Storage Name Service (iSNS) serversGuarded fabric and Shielded VMsWindows Deployment Services (WDS) partial deprecationNavigating the interfaceThe updated Start menuThe Quick Admin Tasks menuUsing the Search functionPinning programs to the taskbarThe power of right-clickingUsing the newer Settings screenTwo ways to do the same thingCreating a new user through Control PanelCreating a new user through the Settings menuTask ManagerTask ViewSummaryQuestions
Technical requirementsInstalling Windows Server 2022Burning that ISOCreating a bootable USB stickRunning the installerInstalling roles and featuresInstalling a role using the wizardInstalling a feature using PowerShellCentralized management and monitoringServer ManagerRemote Server Administration Tools (RSAT)Does this mean RDP is dead?Remote Desktop Connection ManagerWindows Admin Center (WAC)Installing Windows Admin CenterLaunching Windows Admin CenterAdding more servers to WACManaging a server with WACChanges are easy as pieAzure integrationsEnabling quick server rollouts with SysprepInstalling Windows Server 2022 onto a new serverConfiguring customizations and updates onto your new serverRunning Sysprep to prepare and shut down your master serverCreating your master image of the driveBuilding new servers using copies of the master imageIn-place upgrading to Windows Server 2022Download and run the installerSummaryQuestions
What is a domain controller?Active Directory Domain ServicesCreating your first domainPrep your domain controllerInstall the AD DS roleConfigure the domainTrees, forests, and…domains?Multiple domain controllers for redundancyActive Directory Users and ComputersUser accountsSecurity groupsPrestaging computer accountsActive Directory Domains and TrustsBuilding a trustNetwork connectivityConditional DNS forwardingConfiguring the trustTest it out!Active Directory Sites and ServicesActive Directory Administrative CenterDynamic Access ControlFine-Grained Password PolicyActive Directory Recycle BinRead-only domain controllersFSMO RolesViewing current FSMO role holdersRID, PDC, and Infrastructure masterSchema masterDomain naming masterView them all in one placeFSMO role visibility through PowerShellTransferring FSMO rolesTransferring FSMO roles via PowerShellDemote an old domain controllerDemoting while the old server is still onlineClean up AD Sites and ServicesDemoting when the old server is goneMove FSMO rolesDelete itClean up Sites and Services and DNSGroup PolicySummaryQuestions
The purpose of DNSTypes of DNS recordsHost record (A or AAAA)Alias record – CNAMEMail Exchanger (MX) recordMicrosoft 365 MX recordsTXT recordSPF recordEnforcement rule -allName Server (NS) recordPublic name server recordsipconfig /flushdnsSplit-brain DNSTypes of DNS zonesActive Directory Integrated ZonesForward Lookup ZonesReverse Lookup ZonesPrimary ZoneSecondary ZoneStub ZoneCreating a new zoneIP addressing with DHCPCreating a DHCP scopeAuthorize the DHCP serverScope OptionsDHCP reservationsDHCP failoverTwo DHCP serversHot standby modeLoad sharing modeConfiguring DHCP failoverIPAMSummaryQuestions
Group Policy ObjectsGroup Policy background refresh cycleBuilding a GPOAdding Trusted SitesMapping network drivesInstalling registry keysPrevent shut down of systemDisable removable USB drivesScoping a GPOLinksGpresultContinuing with the linkGroup Policy processing orderLocal PolicySite-level policiesDomain-level policiesOU-level policiesSecurity FilteringWMI FilteringItem-level targetingDelegationComputer settings and user settingsComputer ConfigurationUser ConfigurationLinking GPOs accordinglyGroup Policy loopback processingPolicy versus preferencePoliciesPreferencesDefault Domain PolicyAdministrative TemplatesImplementing ADMX/ADML filesThe Central StoreEnable the Central StorePopulate the Central StoreSummaryQuestions
Common certificate typesUser certificatesComputer certificatesSSL certificatesSingle-name certificatesMulti-domain or subject alternative name certificatesWildcard certificatesPlanning your PKIRole servicesEnterprise versus standaloneRoot versus subordinate (issuing)Naming your CA serverCan I install the CA role onto a domain controller?Creating a new certificate templateIssuing your new certificatesPublishing the templateRequesting a certificate from MMCRequesting a certificate from the web interfaceCreating an auto-enrollment policyObtaining a public authority SSL certificatePublic/private key pairCreating a certificate signing requestSubmitting the certificate requestDownloading and installing your certificateRe-keying certificatesExporting and importing certificatesExporting from MMCExporting from IISImporting into a second serverOpenSSL for Linux webserversGenerate a CSRAcquire the certificateInstall the certificateSummaryQuestions
Introduction to IPv6Your networking toolboxpingtracertpathpingTest-ConnectionTelnetTest-NetConnectionPacket tracing with WiresharkTCPViewnetstatBuilding a routing tableMulti-homed serversOnly one default gatewayBuilding a routeAdding a route with Command PromptDeleting a routeAdding a route with PowerShellNIC TeamingSoftware-defined networkingHyper-V Network VirtualizationPrivate cloudsHybrid cloudsHow does it work?System Center Virtual Machine ManagerNetwork ControllerGeneric Routing EncapsulationMicrosoft Azure Virtual NetworkRAS Gateways/SDN GatewaysVirtual network encryptionBridging the gap to AzureA VPN gatewayAzure ExpressRouteThird-party optionsAzure Network AdapterSummaryQuestions
Regular ol’ VPNRouting and Remote Access Service (RRAS)Configuring VPN inside RRASSecuring your VPNAlways On VPNTypes of AOVPN tunnelsUser tunnelsDevice tunnelsDevice tunnel requirementsAOVPN client requirementsDomain-joinedRolling out the settingsAOVPN server componentsRemote Access serverCertification Authority (CA)Network Policy Server (NPS)DirectAccessThe truth about DirectAccess and IPv6Prerequisites for DirectAccessDomain-joinedSupported client operating systemsDirectAccess servers – one or two NICs?To NAT or not to NAT?Network Location ServerCertificates used with DirectAccessDo not use the Getting Started Wizard (GSW)!Remote Access Management ConsoleConfigurationDashboardOperations StatusRemote Client StatusReportingTasksDA, VPN, or AOVPN? Which is best?Domain-joined or not?Auto or manual launchSoftware versus built-inPassword and login issues with traditional VPNsPort-restricted firewallsManual disconnectNative load-balancing capabilitiesDistribution of client configurationsWeb Application ProxyWAP as AD FS ProxyRequirements for WAPLatest improvements to WAPPre-authentication for HTTP BasicHTTP to HTTPS redirectionWildcard domain publishingClient IP addresses forwarded to applicationsPublishing Remote Desktop Gateway appsImproved administrative consoleSummaryQuestions
Microsoft Defender AntivirusInstalling Microsoft Defender AntivirusExploring the user interfaceDisabling Microsoft Defender AntivirusWhat is ATP anyway?Windows Defender ATP Exploit GuardWindows Defender Firewall – no laughing matterThree Windows Firewall administrative consolesWindows Defender Firewall (Control Panel)Firewall & network protection (Windows Security Settings)Windows Defender Firewall with Advanced Security (WFAS)Three different firewall profilesBuilding a new inbound firewall ruleCreating a rule to allow pings (ICMP)Managing WFAS with Group PolicyEncryption technologiesBitLocker and the virtual TPMShielded VMsEncrypted virtual networksEncrypting File SystemIPsecConfiguring IPsecAzure AD Password ProtectionFine-grained password policyAdvanced Threat Analytics – end of supportWhat is (was) ATA?Microsoft Defender for IdentityGeneral security best practicesGetting rid of perpetual administratorsUsing distinct accounts for administrative accessUsing a different computer to accomplish administrative tasksNever browse the internet from serversRole-Based Access Control (RBAC)Just Enough Administration (JEA)Adjust RDP away from 3389Disable external RDP… NOWDisable insecure encryption protocolsWindows RegistryIIS CryptoSummaryQuestions

Why use Server Core?No more switching back and forthInterfacing with Server CorePowerShellUsing cmdlets to manage IP addressesSetting the server hostnameJoining your domainRemote PowerShellServer ManagerRemote Server Administration ToolsAccidentally closing Command PromptWindows Admin Center to manage Server CoreThe Sconfig utilityRoles available in Server CoreBuilding a Server Core domain controllerInstall the AD DS rolePromote this server to a domain controllerVerify that it workedWhat happened to Nano Server?SummaryQuestions
Why move to PowerShell?CmdletsPowerShell is the backboneScriptingServer CoreWorking within PowerShellLaunching PowerShellDefault execution policyRestrictedAllSignedRemoteSignedUnrestrictedBypass modeUsing the Tab keyUseful cmdlets for daily tasksQuery user or quserIP addressing cmdletsUsing Get-HelpFormatting the outputFormat-TableFormat-ListVisual customizationsImporting a moduleUsing a pipelineExport to CSVPipes can invoke actionPowerShell Integrated Scripting EnvironmentPS1 filesWorking with PowerShell ISERemotely managing a serverPreparing the remote serverThe WinRM serviceEnable-PSRemotingAllowing machines from other domains or workgroupsConnecting to the remote serverUsing -ComputerNameUsing Enter-PSSessionDesired State ConfigurationWindows TerminalSummaryQuestions
Network Load Balancing (NLB)Not the same as round-robin DNSWhat roles can use NLB?Virtual and dedicated IP addressesNLB modesUnicastMulticastMulticast IGMPConfiguring a load-balanced websiteEnabling NLBEnabling MAC address spoofing on VMsConfiguring NLBConfiguring IIS and DNSTesting it outFlushing the ARP cacheFailover clusteringClustering Hyper-V hostsVirtual machine load balancingClustering for file serversScale-out file serverClustering tiersApplication-layer clusteringHost-layer clusteringA combination of bothHow does failover work?Setting up a failover clusterBuilding the serversInstalling the featureRunning Failover Cluster ManagerRunning cluster validationRunning the Create Cluster wizardClustering improvements in Windows Server 2022AutoSitesClustering AffinityImprovements to BitLocker protected cluster storageSlightly older improvements (but still cool)True two-node clusters with USB witnessesHigher security for clustersMulti-site clusteringCross-domain or workgroup clusteringCluster operating system rolling upgradesStorage Replica (SR)Configuring Storage ReplicaInitializing disks as GPTTesting preparedness for Storage ReplicaConfiguring Storage ReplicaShifting the primary server to FS02Storage Spaces Direct (S2D)New in Server 2022 and 2019SummaryQuestions
Understanding application containersSharing resourcesIsolationScalabilityWhat’s new in Server 2022?Smaller image size for Server CoreVirtualized time zonesInitial IPv6 supportHostProcess containersEnhanced management through Windows Admin CenterA new base image optionContainer base imagesNano ServerServer CoreWindows ServerWindows Server containers versus Hyper-V containersWindows Server containersHostProcess containersHyper-V containersDocker and KubernetesLinux containersDocker HubDocker Trusted RegistryKubernetesWorking with containersInstalling the role and featureInstalling Docker for WindowsDocker commandsdocker versiondocker infodocker --helpdocker imagesdocker searchdocker pulldocker rundocker ps -aDownloading a container imageRunning a containerWhere is Azure in all this?Azure Container RegistryAzure Kubernetes Service (AKS)Azure Kubernetes Service for Azure Stack HCISummaryQuestions
Designing and implementing your Hyper-V ServerInstalling the Hyper-V roleNested virtualizationAMD processors are now supportedVirtual switchesExternal virtual switchInternal virtual switchPrivate virtual switchCreating a new virtual switchReceive Segment Coalescing (RSC)Implementing a new virtual serverStarting and connecting to the VMInstalling the operating systemManaging a virtual serverHyper-V ManagerThe Settings menuCheckpointsConfiguring auto stop and startExpanding a virtual diskHyper-V console, Remote Desktop Protocol (RDP), or PowerShellWindows Admin Center (WAC)Shielded VMsEncrypting VHDsInfrastructure requirements for shielded VMsGuarded hostsHost Guardian Service (HGS)Host attestationsTPM-trusted attestationsHost key attestationsAdmin-trusted attestation – deprecated in 2019The future of shielded VMsIntegrating with LinuxReFS deduplicationReFSData deduplicationWhy is this important to Hyper-V?Hyper-V Server…2019?SummaryQuestions
Wherefore art thou, role?Components of an RDS environmentRemote Desktop Session HostRemote Desktop Connection BrokerRemote Desktop License ManagerRemote Desktop Web AccessRemote Desktop GatewayPublishing RDS sessionsCreating an RDS environmentYour first RDS collectionAdd RD Gateway and RD LicensingCollection configurationConnecting to itEditing deployment and collection propertiesDeployment PropertiesCollection PropertiesAdding RDSH servers to your collectionDrain-stop an RDSH for maintenanceInstalling applications on an RDSHNo users logged inInstall modeRDS licensingUser CALsDevice CALsSpecify the RD License serverRD Licensing ManagerRDS user profilesLocal profilesRoaming profilesUser Profile Disks (UPDs)FSLogixRemoteAppRDS maintenance considerationsInstall modeServer Manager errors related to RDSLogging directly in to RDSH serversSSL certificate replacementsCloning RDSH serversSidderGPOs and RDSSummaryQuestions
Backup and restoreSchedule regular backupsRestoring from WindowsRestoring from the installer diskTask ManagerResource MonitorPerformance MonitorSysinternals toolsDescriptions of popular toolsTcpViewDisk2vhdAutologonAutorunsDiskmonLogonSessionsPsExecPsKillPsShutdownProcess Monitor (Procmon)AccessEnumWindows Firewall with Advanced SecuritySystem InsightsRemote toolsetsEvent LogsFiltering event logsExporting Windows event logs with PowerShellCommon Event IDsMMC and MSC shortcutsSummaryQuestions
Chapter 1: Getting Started with Windows Server 2022Chapter 2: Installing and Managing Windows Server 2022Chapter 3: Active DirectoryChapter 4: DNS and DHCPChapter 5: Group PolicyChapter 6: CertificatesChapter 7: Networking with Windows Server 2022Chapter 8: Remote AccessChapter 9: Hardening and SecurityChapter 10: Server CoreChapter 11: PowerShellChapter 12: Redundancy in Windows Server 2022Chapter 13: ContainersChapter 14: Hyper-VChapter 15: Remote Desktop ServicesChapter 16: Troubleshooting

Content preview from Mastering Windows Server 2022 - Fourth Edition

6 Certificates

“Ugh, we need to use certificates to make this work.”

Real-life quote from any admin after discovering their latest software purchase requires the use of certificates

If the quote above, or perhaps a variant more colorful than stated above, sounds familiar, don’t scrap that new project just yet! For some reason, the use of certificates seems like a daunting task to many of us, even those who have worked in IT for many years. I think this is probably because there are many different options available on a certificate server, but there is not a lot of common sense or user-friendliness built into the management console for dealing with certificates. This, combined with a general lack of requirements for certificates on servers ...