Plan Server installations and upgrades
Key differences between Microsoft Windows Server 2008 and Microsoft Windows Server 2008 R2.
- 2008 R2 doesn’t support x86 processor architecture whereas 2008 supports x86, x64 and IA64.
- 2008 R2 has a foundation edition.
- Terminal Services has been renamed Remote Desktop Services in 2008 R2.
- 2008 R2 has the Active Directory recycle bin funtionality.
- 2008 R2 Hyper-V has dynamic memory functionality.
- 2008 R2 has Managed Service Accounts functionality, Applocker, Direct Access, Branch Cache, IIS 7.5 and AD CS functionality for 2008 R2 core.
- 32GB RAM, 4 sockets, one virtualisation licence
- 250 incoming RAS or Remote Desktop gateway connections and base AD CS features i.e. no CA templates.
- Predominantly used to deploy domain controllers, WINS, DNS, DHCP, file and print servers, certificate services and application / web servers.
- 2TB RAM, 8 sockets, 4 virtualisation licenses
- Failover clustering, AD FS functionality and fully featured AD CS incl CA templates. Hot add CPU and hot add memory.
- Predominantly used to deploy failover cluster to support MS SQL or MS Exchange or where federated services are requied.
- 2TB RAM, 64 sockets, unlimited virtualisation licenses.
- Hot replace CPU and hot replace memory this uses dynamic hardware partitioning, see here
- predominantly used to deploy Hyper-V hosts.
- 32GB RAM, 4 sockets, web server and DNS server roles.
- predominantly used to deploy web and application servers.
Core edition benefits
- Reduced updates because application has no GUI, so no updates for IE, media player etc.
- Lower hardware requirements due to no GUI interface.
- Reduced attack surface because fewer binaries are installed.
Scripting in Core
- PowerShell support in Windows Server 2008 R2 core.
- Windows Scripting host support, Visual Basic scripting support, registry editor GUI and notepad.
Installing roles and features in Core
- oclist to generate list of installed and or available roles and features
- ocsetup to install roles and features
- In 2008 R2 both have been deprecated by servermanagercmd and servermanagercmd has been deprecated by PowerShell module ServerManager and the commands Get-WindowsFeature, Add-WindowsFeature and Remove-WindowsFeature.
Core role deployments
- Domain controllers, lightweight directory services (AD LDS), DHCP, DNS, WINS, Windows Media services, file and print and Hyper-V.
- CLI or RSAT
- CLI tools – netsh (networking command shell), netdom (rename computer, join computer to domain etc.), oclist and ocsetup as described above, slmgr.vbs (licensing and activation) and winrs (remote management configuration)
- Core editions cannot be upgraded to full installations
- Windows Server 2003 cannot be upgraded to Windows Server 2008 R2 Core
- No upgrade path for x86 to x64
- Upgrade to equivalent edition if processor architecture is the same i.e. x86 or x64 (remember no x86 version of Windows Server 2008 R2 available)
- Windows Server 2008 core to Windows Server 2008 R2 core as long as processor architecture is the same
- Windows Server 2003 must be SP1 and have 30GB of free space
- When upgrading the Windows installer will produce a compatibility report
- Upgrade from Windows Server 2003 to Windows Server 2008 can be rolled back as long as no successful logons have occurred.
- To ensure you can rollback
- Perform ASR backup of Windows Server 2003 (ASR via wizard creates a full backup too)
- Perform system state backup incl files and folders
- If you need to restore Windows Server 2003, restore Windows Server 2003 ASR, restore system state and full backup, reinstall any applications
- P2V and then upgrade, test applications etc. (NOTE: doesn’t test hardware compatibility)
Bitlocker is full disk encryption which uses either Trusted Platform Model 1.2 (TPM) or a USB flash drive. Windows Server 2008 R2 and Windows 7 (Enterprise and Ultimate) create a 1.5GB partition at the front of the disk for the boot files when BitLocker is enabled; this partition is unencrypted. For Vista and Windows Server 2008 use the BitLocker drive preparation tool.
The TPM uses a symmetric key to encrypt the data for encryption speed; the symmetric key within the TPM is encrypted with a asymmetric key. BitLocker keys can also be stored within AD DS and USB flash drives (NOTE: I think you need a password if you’re using a USB flash drive)
- MAK – Multi Activation Key
- One key per edition which can be activated multiple times.
- MAK proxies are used to activate client with no direct internet access; MAK proxy is part of VAMT which uses a cil xml based file; the cil file is generated from within VAMT.
- MAK keys are good for up to 25 desktop clients and 5 servers; above this use KMS keys.
- VAMT requires TCP 1688 be open between the VAMT application and client in order to collect licensing information.
- VAMT can be used to store and distribute MAK keys.
- KMS – Key Management Service
- Requires 5 server or 25 vista or windows 7 client before successful activation can take place; this threshold is physical machines too, virtual machine do not count until the threshold has been reached.
- KMS key must be installed on Server 2008/R2 and can exist on 6 servers i.e. you can have 6 KMS servers; may be distributed around the enterprise.
- clients contact the KMS server every 180 days; if the client doesn’t it is given a futher grace period.
- KMS requires a DNS SRV records _vlmcs._tcp.domain.name.
- TCP 1688 must be open between the KMS host and clients.