Standard

Datacentre

Essentials

Server license for each physical server is based on : Number of physical processors core, Number of virtual instances

Client Access Licenses (CAL) : Required for Standard & Datacenter Editions - One CAL for each user or device connected to the server A.

Retail - Purchased from store or internet. Require one-time activation using product key. Activated by online/over the phone

OEM - License tied to the computer Activated by manufacturer or system builder during installation.

Volume license - High number of licences at lower pricing.

Multiple Activation keys - Same key to activate multiple computers. Activated using Volume Activation Tool / Online / over the phone

Key management Service Server - automated activation within company network. No need connection to Microsoft for activation. Computers must contact KMS server within 180

Active Directory Based Activation - Automated activation in company using domain controller. Computers are activated upon joining the domain. Computers must contact a domain controller within 180 days to stay activated.

Cpu 1.4ghz

Memory 512MB / 2GB (Desktop Experience)

Available disk space 32GB

Use Key Management Service

Use Active Directory Based Activation.

Desktop Experience

Server Core installation

Nano Server

Full server installation

All server roles and features are supported

Include GUI support

Less resource intensive - Only essential components and services are installed - Less memory, diskspace & processor time.

Less downtime due to fewer patch and restarts.

Reduced attack surface due to lesser software installed.

No GUI

Can be managed locally using sconfig.cmd and PowerShell commands

Faster performance

More stable and secured

Uses less resources

Requires fewer updates and restarts

Optimised for cloud and virtualized environment

No Graphical User Interface

No local logon capability

Only support remote administration

Only supports 64-bit applications, tools, and agents.

A computer account will be created in the AD database

The computer can be managed by the domain administrators.

It adds primary function to server.

It provide service to clients Example of common Server Roles: Domain Controller, Dynamic Host Configuration Protocol (DHCP) Server, Domain Name System (DNS)

Existing servers meet hardware requirements

Software on server support in-place upgrade

Need to retain data and security permissions

Need to keep existing roles, features, and settings

OS must be Windows Server 2012 R2 or later

upgrade to same or newer editions

Same processor architecture eg 64 bits to 64-bits

Able to select product, roles, features and settings to be migrated

Existing server do not meet hardware requirement

Prevent existing issues from being carried forward to the new OS

Easier to troubleshoot installation failures.

Will not affect current server OS.

Enables network-based installations

Simplifies the deployment process

Supports deployment to computers with no operating system

Provides end-to-end operating system deployment

Can deploy updates, service packs, language packs or device drivers.

Windows PE

wim

vhd files

image-based deployment

AD DS – For authentication and access to the images

DHCP – assigns IP Address to the PC being deployed.

DNS – Provide name resolution

NTFS volume – Store the image

Establish or expand a private cloud environment.

Increase hardware utilization.

Improve business continuity.

Establish a centralized desktop strategy.

Increase efficiency in development and test activities.

Type I Virtualization (native or bare metal) - Hypervisor layer interacts directly with the computer’s physical hardware. No host operating system required. Each virtual machines have their own OS and accesses hardware through the hypervisor. Parent partition creates and manages the child partitions.

Type II Virtualization (Hosted) - Requires a “host” operating system. A virtual hardware environment is created for each VM with OS installed. The host OS shares access to the computer’s processor with the hypervisor. Does not provide the same performance as separate physical computers.

Windows Server 2016 (server role)

Microsoft Hyper-V Server 2016 (bare-metal)

Number of processors

Memory

Virtual network adapters

Virtual disks

Dynamically expanding - The disk starts with a small size and expands on demand. It can grow to the maximum size.

Fixed size - The size of the VHD file is fixed to the size when created. Faster than a dynamically expanding disk. Disk uses up the maximum defined space immediately.

Differencing - Disk is linked to another disk (Parent disk). Disks include only the differences from parent disk. Can save disk space. Suitable for multiple virtual machines with similar OS.

Physical (or pass through disk) - The virtual machine receives direct access to the physical disk for exclusive use. Provides the highest performance of all disk types. The drive is not available for other guest systems.

Private : VM to VM on the same host

Internal : VM to VM on the same host, VM to host

External : VM communicates via physical network adapter, Allows communication to external servers

Ensure open connections to heterogeneous products

Promote data portability

Enhance support for industry standards

Network Interoperability - Systems to use established networking protocols and services to communicate eg TCP/IP

Data Interoperability - Use natively supported file systems and file format such as TXT, PDF, and XML. Convert files to supported formats such as PDF, PNG

Applications Interoperability - Use standards such as Corba and XML.

Management Interoperability - Security: Use standard security protocols in areas such as authentication and encryption. Directory service: Provide a consistent way to locate, access, manage, and secure network resources by adopting protocols such as LDAP.

Users have single login name and password that can be used across Windows, Linux and UNIX

Can enforce consistent security policies such as password length and complexity across Windows, Linux and UNIX

Unix system implementation of the Server Message Block (SMB)/Common Internet File System (CIFS) protocol

Support file and printer sharing between Microsoft Windows, Mac OS , and other Unix OS.

Can integrate Linux/Unix with Windows Server domain

Available on most Unix-based operating systems

A Samba-enabled Unix/Linux machine can masquerade as a Windows server in a Microsoft network

Share folders and printers across file systems

Assist clients with Network Neighborhood browsing

Authenticate clients onto a Windows domain

Provide or assist with WINS name resolution

a customizable information store

a single point from which users can locate resources and services in the network.

Microsoft’s implementation of directory service

Centralized control of network resources

Centralized and decentralized resource management

Stores objects securely in a logical structure

Optimizes network traffic

Is a container

Used to group objects within a domain

Organize Objects

Assigning GPOs to configure object settings.

Delegate administrative permissions

Provides a structure for the management of user accounts, computers accounts and groups.

It is an authentication and authorization boundary. Used to limit the scope of access to resources in the domain.

Requires at least one domain controller to hold a copy of the domain’s AD database. The database is synchronized with other Domain Controller through the process known as replication.

Ist domain in the forest

Contains 2 unique groups schema admin & Enterprise Admin

A domain tree is a hierarchy of domains

Each tree share a contiguous namespace to its parent domain

Eg Asia domain name ends with its parent domain name, mydomain.local

Global catalog to enable searching

A collection of one or more trees

Created with the first domain.

Can grow to include child domains or new domain trees.

A forest Shares: Common schema of the AD database.

Defines the objects that can be stored in AD DS

Defines the properties associated with the objects

Can only be updated by the Schema Admin Group.

A server that host the AD DS database (Ntds.dit) and SYSVOL

Performs authentication using Kerberos authentication service and Key Distribution Center (KDC) services

For availability: At least two domain controllers in a domain

For security: Implement RODC and BitLocker

A computer running Windows Server OS

Administrative privileges for creating a domain

TCP/IP is installed and configured to use DNS

An authoritative DNS server that supports SRV resource records

Use Server Manager

Use Windows PowerShell

Install from media

A domain controller that supports only incoming replication traffic.

Use for authentication purpose only & cannot be used to create, modify, or delete Active Directory objects.

For use in locations with no or minimal physical security & No need to update the Active Directory database.

Administrator

Guest

Rename the Administrator account

Set a strong password

Administrator passwords known to only a few people

Do not use the Administrator account for daily non-administrative tasks

Active Directory Users and Computer

Active Directory Administrative Centre

Active Directory Domain and Trusts.

Local accounts

Domain accounts

Built-in group used to provide administrative privileges

Are granted with privileges eg rights and permission to perform delegated tasks

Eg Domain users, Administrators, Server Operator

Groups for which membership is controlled by the operating system (membership is automatically assigned)

Used by the OS to provide access to resources based on the type of authentication or connection

Eg Authenticated user, Interactive, Everyone

A Right authorizes a user to perform certain actions on a computer

User rights are assigned through local policies or Active Directory group policies.

It defines the type of access that is granted to an object or object attribute.

It modifies the Access Control List (ACL) of the object.

Assign NTFS & share permission for files and folders

Assign AD permission for Active Directory objects.

Tools which enable user to issue command-line command against a remote computer

Commands used by WRMS: WinRM is executed on the remote server to listen and respond to WinRS requests.

WinRS is executed on the local computer, enable administrator to execute command-line commands against the remote server.

Install a full suite of tools of a Windows Server with all of the roles and features installed.

Enables administrators to remotely manage roles and features of a server from a computer that is running Windows 7 and above.

Supported on Professional or Enterprise editions of the Windows client operating system.

Different versions of RSAT required for different Windows client’s OS.

Advantages: Enable remote management of multiple servers from a workstation.

Reduce licensing costs by eliminating the need to install Windows Server on the computer used for managing servers.

Disadvantages: The client computer must be running the specific OS version

Can only be used to manage remote servers’ not local computer.

Default implementation of Remote Desktop Services (RDS)

Allows two administrators to remotely logged on to a server concurrently

Uses RDP protocol to deliver bitmap from remote servers

Only the Administrator account is able to remote in. For additional user, add user to the Remote Desktop User group.

Remote Desktop Connection

Remote Desktop

using the mstsc.exe

Simple volume

Spanned volume

Striped volume (RAID-0)

Mirrored volume (RAID-1)

RAID-5 volume

File Classification

File Management

File screening management

Quota management

Storage reports

Used to limit disk space usage

provide notifications when thresholds are reached

Send email notifications

Log an event in Event Viewer

Run a command or script

Generate storage reports

Folders by Property

Duplicate Files

Large Files

File Screening Audit

Files by File Group, Owner, or Property

File Explorer

PowerShell

Net Share command

Server manager File and Storage Services

Default share to provide everyone with Read and Write permission

Disabled by default

Enabled via Network and sharing Center Advanced sharing settings

Located in user’s home directory under libraries folder

Hidden share created by Windows OS to allow system administrators to have remote access to every disk volume on a network-connected system.

Cannot be deleted but may be disabled.

Require administrative privileges to access.

Simplified data migration : Can be used to copy data across servers

Increased availability of file server data: When a server is down,DFS refers client computers to the next available server.

Security Integration: Uses existing NTFS and share permission of folders.

Load Balancing: A logical name can be mapped to shares on multiple file servers. Access across content will be distributed across servers.

Storage consists disks connected directly to the storage controllers in the host.

Common interface protocol used are SATA and SCSI

Easy to configure

Inexpensive

Slower

Disk attached to single server

Advantages

An IP-based, dedicated, high-performance file sharing and storage device.

Uses OS that is optimized for file I/O

Support file sharing protocol eg Network File System & Server Message Block

Slow access

Easy to configure

Not Enterprise level solution

Provide centralized storage

Relatively inexpensive

A high-speed, dedicated network of servers and shared storage devices.

Common SAN deployments are:

Fibre Channel (FC) SAN

IP SAN

Fastest Access Time

Easily expandable

Centralized storage

High level of redundancy

More expensive

Used to connect data storage to servers and between data centres.

A high-speed network technology

Runs on optical fibre cables / copper cabling

can support up to 128 Gb/s

Uses FC switches to form a switched fabric.

Supports access to remote, SCSI-based storage devices

Can run over a pre-existing switching and IP infrastructure

iSCSI initiator : A client using software ( driver) or hardware (iSCSI Host Bus Adapter) to send data to an external iSCSI-based storage array

iSCSI target - Storage array with iSCSI port - Provide LUN access

IP network

Created by concatenating physical disks storage space.

Can span multiple drives and can be expanded or reduced as needed.

Support RAID

Used to create Virtual disks

Controls the way files are named and how they are placed for storage and retrieval

Has different characteristics such as structure, logic, security and size limitation.

Common File Systems

Linux/Unix OS : eg ext2 ,ext3, XFS, JFS and ReiserFS.

Windows Server OS : eg Fat32, NTFS and ReFS

NTFS (New Technology File System) - Preferred file system for Windows Server - Support Large volume - Provide File and folder securitySupport features: File compression

ReFS (Resilient File System) - Only supported on Windows 8, Windows Server 2012 and above - Unlimited file and directory sizes - Increased resiliency—no need for errorchecking tools - Does not support file compression, EFS, or quotas

Storage technology that combines multiple disk drives into one logical unit.

Data is distributed across the drives based on the RAID levels used

Used to provide performance and/or disk fault tolerance

Common RAID levels are 0,1,3,5,6,1+0

Provide better performance

RAID functionality not limited to OS.

Define the type of access granted to a user, group, or computer for an object

Can be applied to objects such as files, folders and printers

Can be assigned to users and groups in the network or on a local computer

An ACL is a data structure containing entries that specify individual user or group rights to specific objects such as file or folder.

Each entries are known as access control entries (ACEs)

Read

Write

Read & Execute

Modify

Full Control

NTFS permissions are cumulative

Permissions are inherited

File permissions override folder permissions

Deny overrides all permissions

Creators of files and folders are their owners

Read

Change

Full Control (Includes all Read and Change permissions+ change NTFS file and folder permissions

Grant permissions to groups instead of users.

Use Deny permissions only when necessary.

Never deny the Everyone group access to an object

Grant permissions to an object that is as high in the folder structure as possible

Use NTFS permissions instead of shared permissions for fine-grained access.

permissions: (R) Read, (W) Write & (X) Execute

assigned to 3 type of owners : eg RWX R _ X R _ _ ( User ) (Group) (Others)

chmod change file permissions

chown change file owner

chgrp change file group

umask user file creation mode mask

Symbolic mode eg chmod u+wx filename

Absolute mode eg chmod 755 filename

A collection of settings used to define what a system will look like and how it will behave for a group of users or computers

Supported on all Windows client running Windows 2000 and later.

Minimize administration as settings can be applied to a large number of users and computers

Provide a consistent method to enforce standards in the work environment.

Group Policy Management Console

Group Policy Management Editor

PowerShell

Default domain policy

Default domain controller policy

Computer Configuration : at system startup

User Configuration : at logon

Every 90 minutes (+ 30 min variable) / Security settings refresh at least every 16 hours

Applied manually by using: The Gpupdate command - The Windows PowerShell cmdlet

Local

Site

Domain

OU