ee eBook Collection
Installing and Configuring Windows Server 2012 Entire eBook
This is a Protected PDF document. Please enter your user name and password to unlock the text.
✔ Remember my user name and password.
If you are experiencing problems unlocking this document or you have questions regarding Protectedpdf files please contact a Technical Support representative:
In the United States: 1-877-832-4867 In Canada: 1-800-859-3682
Outside the U.S. and Canada: 1-602-387-2222 Email: technicalsupport@apollogrp.edu.
1000-0001-BB2D-00111F70
Installing and Confi guring Windows Server® 2012 Exam 70-410
Craig Zacker
Microsoft® Offi cial Academic Course
www.wiley.com/college/microsoft or
call the MOAC Toll-Free Number: 1+(888) 764-7001 (U.S. & Canada only)
Credits
VP & PUBLISHER Don Fowley
EXECUTIVE EDITOR John Kane
DIRECTOR OF SALES Mitchell Beaton
EXECUTIVE MARKETING MANAGER Chris Ruel
MICROSOFT PRODUCT MANAGER Gene R. Longo of Microsoft Learning
TECHNICAL EDITORS Jeff T. Parker
Kenneth Hess
EDITORIAL PROGRAM ASSISTANT Jennifer Lartz
ASSISTANT MARKETING MANAGER Debbie Martin
SENIOR PRODUCTION MANAGER Janis Soo
ASSOCIATE PRODUCTION MANAGER Joel Balbin
CREATIVE DIRECTOR Harry Nolan
COVER DESIGNER Georgina Smith
SENIOR PRODUCT DESIGNER Thomas Kulesa
CONTENT EDITOR Wendy Ashenberg
PRODUCTION EDITOR Eugenia Lee
TECHNOLOGY AND MEDIA Tom Kulesa/Wendy Ashenberg
This book was set in Garamond by Aptara, Inc. and printed and bound by Bind-Rite Robbinsville. The covers were
printed by Bind-Rite Robbinsville.
Copyright © 2013 by John Wiley & Sons, Inc. All rights reserved. No part of this publication may be reproduced,
stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying,
recording, scanning or otherwise, except as permitted under Sections 107 or 108 of the 1976 United States
Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of
the appropriate per-copy fee to the Copyright Clearance Center, Inc. 222 Rosewood Drive, Danvers, MA 01923,
(978) 750-8400, fax (978) 646-8600. Requests to the Publisher for permission should be addressed to the
Permissions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030-5774, (201) 748-6011,
fax (201) 748-6008. To order books or for customer service, please call 1-800-CALL WILEY (225-5945).
Microsoft, Active Directory, AppLocker, Bing, BitLocker, DreamSpark, Hyper-V, Internet Explorer, SQL Server,
Visual Studio, Win32, Windows Azure, Windows, Windows PowerShell, Windows Server, and Windows Vista are
either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries.
Other product and company names mentioned herein may be the trademarks of their respective owners.
The example companies, organizations, products, domain names, e-mail addresses, logos, people, places, and events
depicted herein are fi ctitious. No association with any real company, organization, product, domain name, e-mail
address, logo, person, place, or event is intended or should be inferred.
The book expresses the author’s views and opinions. The information contained in this book is provided without
any express, statutory, or implied warranties. Neither the authors, John Wiley & Sons, Inc., Microsoft Corporation,
nor their resellers or distributors will be held liable for any damages caused or alleged to be caused either directly or
indirectly by this book.
ISBN 978-1-118-51107-7
Printed in the United States of America
10 9 8 7 6 5 4 3 2 1
www.wiley.com/college/microsoft or
call the MOAC Toll-Free Number: 1+(888) 764-7001 (U.S. & Canada only) | iii
Wiley’s publishing vision for the Microsoft Official Academic Course series is to provide students and instructors with the skills and knowledge they need to use Microsoft technology effectively in all aspects of their personal and professional lives. Quality instruction is required to help both educators and students get the most from Microsoft’s software tools and to become more productive. Thus, our mission is to make our instructional programs trusted educational companions for life.
To accomplish this mission, Wiley and Microsoft have partnered to develop the highest- quality educational programs for information workers, IT professionals, and developers. Materials created by this partnership carry the brand name “Microsoft Official Academic Course,” assuring instructors and students alike that the content of these textbooks is fully endorsed by Microsoft and that they provide the highest-quality information and instruction on Microsoft products. The Microsoft Official Academic Course textbooks are “Official” in still one more way—they are the officially sanctioned courseware for Microsoft IT Academy members.
The Microsoft Official Academic Course series focuses on workforce development. These programs are aimed at those students seeking to enter the workforce, change jobs, or embark on new careers as information workers, IT professionals, and developers. Microsoft Official Academic Course programs address their needs by emphasizing authentic workplace scenarios with an abundance of projects, exercises, cases, and assessments.
The Microsoft Official Academic Courses are mapped to Microsoft’s extensive research and job-task analysis, the same research and analysis used to create the Microsoft Certified Solutions Associate (MCSA) exam. The textbooks focus on real skills for real jobs. As students work through the projects and exercises in the textbooks and labs, they enhance their level of knowledge and their ability to apply the latest Microsoft technology to everyday tasks. These students also gain resume-building credentials that can assist them in finding a job, keeping their current job, or furthering their education.
The concept of life-long learning is today an utmost necessity. Job roles, and even whole job categories, are changing so quickly that none of us can stay competitive and productive without continuously updating our skills and capabilities. The Microsoft Official Academic Course offerings, and their focus on Microsoft certification exam preparation, provide a means for people to acquire and effectively update their skills and knowledge. Wiley supports students in this endeavor through the development and distribution of these courses as Microsoft’s official academic publisher.
Today educational publishing requires attention to providing quality print and robust electronic content. By integrating Microsoft Official Academic Course products, MOAC Labs Online, and Microsoft certifications, we are better able to deliver efficient learning solutions for students and teachers alike.
Joseph Heider
General Manager and Senior Vice President
Foreword from the Publisher
www.wiley.com/college/microsoft or
call the MOAC Toll-Free Number: 1+(888) 764-7001 (U.S. & Canada only) | v
Welcome to the Microsoft Official Academic Course (MOAC) program for becoming a Microsoft Certified Solutions Associate for Windows Server 2012. MOAC represents the collaboration between Microsoft Learning and John Wiley & Sons, Inc. Microsoft and Wiley teamed up to produce a series of textbooks that deliver compelling and innovative teaching solutions to instructors and superior learning experiences for students. Infused and informed by in-depth knowledge from the creators of Windows Server 2012, and crafted by a publisher known worldwide for the pedagogical quality of its products, these textbooks maximize skills transfer in minimum time. Students are challenged to reach their potential by using their new technical skills as highly productive members of the workforce.
Because this knowledgebase comes directly from Microsoft, the architect of Windows Server 2012 and creator of the Microsoft Certified Solutions Associate exams, you are sure to receive the topical coverage that is most relevant to students’ personal and professional success. Microsoft’s direct participation not only assures you that MOAC textbook content is accurate and current, it also means that students will receive the best instruction possible to enable their success on certification exams and in the workplace.
■ The Microsoft Offi cial Academic Course Program
The Microsoft Official Academic Course series is a complete program for instructors and institutions to prepare and deliver great courses on Microsoft software technologies. With MOAC, we recognize that because of the rapid pace of change in the technology and curriculum developed by Microsoft, there is an ongoing set of needs beyond classroom instruction tools for an instructor to be ready to teach the course. The MOAC program endeavors to provide solutions for all these needs in a systematic manner in order to ensure a successful and rewarding course experience for both instructor and student, including technical and curriculum training for instructor readiness with new software releases; the software itself for student use at home for building hands-on skills, assessment, and validation of skill development; and a great set of tools for delivering instruction in the classroom and lab. All are important to the smooth delivery of an interesting course on Microsoft software, and all are provided with the MOAC program. We think about the model below as a gauge for ensuring that we completely support you in your goal of teaching a great course. As you evaluate your instructional materials options, you may wish to use the model for comparison purposes with available products.
Preface
www.wiley.com/college/microsoft or
call the MOAC Toll-Free Number: 1+(888) 764-7001 (U.S. & Canada only) | vii
■ Textbook Organization
This textbook is organized in nineteen lessons, with each lesson corresponding to a particular exam objective for the 70-410 Installing and Configuring Windows Server 2012 exam. This MOAC textbook covers all the learning objectives for the 70-410 certification exam, which is the first exam needed in order to obtain a Microsoft Certified Solutions Associate (MCSA) certification. The exam objectives are highlighted throughout the textbook.
■ Pedagogical Features
Many pedagogical features have been developed specifically for Microsoft Official Academic Course programs.
Presenting the extensive procedural information and technical concepts woven throughout the textbook raises challenges for the student and instructor alike. The Illustrated Book Tour that follows provides a guide to the rich features contributing to Microsoft Official Academic Course program’s pedagogical plan. Following is a list of key features in each lesson designed to prepare students for success on the certification exams and in the workplace:
• Each lesson begins with an overview of the skills covered in the lesson. More than a standard list of learning objectives, the overview correlates skills to the certification exam objective.
• Illustrations: Screen images provide visual feedback as students work through the exercises. The images reinforce key concepts, provide visual clues about the steps, and allow students to check their progress.
• Key Terms: Important technical vocabulary is listed at the beginning of the lesson. When these terms are used later in the lesson, they appear in bold italic type and are defined.
• Engaging point-of-use reader aids, located throughout the lessons, tell students why this topic is relevant (The Bottom Line), provide students with helpful hints (Take Note), or show cross-references to where content is covered in greater detail (X Ref ). Reader aids also provide additional relevant or background information that adds value to the lesson.
• Certification Ready features throughout the text signal students where a specific certification objective is covered. They provide students with a chance to check their understanding of that particular exam objective and, if necessary, review the section of the lesson where it is covered. In addition, some Certification Ready sidebars will provide more general information that will assist with your exam preparation.
• Using Windows PowerShell: Windows PowerShell is a Windows command-line shell that can be utilized with many Windows Server 2012 functions. The Using Windows PowerShell sidebar provides Windows PowerShell-based alternatives to graphical user interface (GUI) functions or procedures. These sidebars begin with a brief description of what the Windows PowerShell commands can do, and they contain any parameters needed to perform the task at hand. When needed, explanations are provided for the functions of individual parameters.
Illustrated Book Tour
www.wiley.com/college/microsoft or
call the MOAC Toll-Free Number: 1+(888) 764-7001 (U.S. & Canada only)
viii | Illustrated Book Tour
• Knowledge Assessments provide lesson-ending activities that test students’ comprehension and retention of the material taught, presented using some of the question types that they’ll see on the certification exam.
• An important supplement to this textbook is the accompanying lab work. Labs are available via a Lab Manual and also by MOAC Labs Online. MOAC Labs Online provides students with the ability to work on the actual software simply by connecting through their Internet Explorer web browser. Either way, the labs use real-world scenarios to help students learn workplace skills associated with installing and configuring Windows Server 2012.
www.wiley.com/college/microsoft or
call the MOAC Toll-Free Number: 1+(888) 764-7001 (U.S. & Canada only)
Illustrated Book Tour | ix
■ Lesson Features
Exam Objective
Key Terms
Certification Ready Alert
Configuring File and Share Access | 129
or create new ones, based on your users’ needs. Scheduling shadow copies to occur
too frequently can degrade server performance and cause copies to be aged out too
quickly, whereas scheduling them to occur too infrequently can cause users to lose
work because the most recent copy is too old.
8. Click OK twice to close the Schedule and Settings dialog boxes.
9. Click Enable. The system enables the Shadow Copies feature for the selected volume and creates the fi rst copy in the designated storage area.
CLOSE Windows Explorer.
After you complete this procedure, users can restore previous versions of fi les on the selected volumes from the Previous Versions tab on any fi le or folder’s Properties sheet.
NTFS quotas enable you to set a storage limit for users of a particular volume. Depending on how you confi gure the quota, users exceeding the limit can be denied disk space or just receive a warning. The space consumed by individuals users is measured by the size of the fi les they own or create.
NTFS quotas are relatively limited in that you can set only a single limit for all users of a volume. The feature is also limited in the actions it can take in response to a user exceeding the limit. The quotas in File Server Resource Manager, by contrast, are much more flexible in the nature of the limits you can set and the responses of the program, which can send e-mail notifications, execute commands, and generate reports, as well as log events.
To confi gure NTFS quotas for a volume, use the following procedure.
CONFIGURE NTFS QUOTAS
GET READY. Log on to Windows Server 2012, using an account with domain administrative privileges.
1. Click the Windows Explorer icon in the taskbar. The Windows Explorer window appears.
2. In the Folders list, expand the Computer container, right-click a volume and, from the context menu, select Properties. The Properties sheet for the volume appears.
3. Click the Quota tab to display the interface shown in Figure 4-31.
4. Select the Enable quota management check box to activate the rest of the controls.
5. If you want to prevent users from consuming more than their quota of disk space, select the Deny disk space to users exceeding quota limit check box.
6. Select the Limit disk space to radio button and specify amounts for the quota limit and the warning level.
■ Configuring NTFS Quotas
THE BOTTOM LINE
Managing disk space is a constant concern for server administrators. One way to prevent users from monopolizing large amount of storage is to implement quotas. Windows Server 2012 supports two types of storage quotas. The more elaborate of the two is implemented as part of File Server Resource Manager. The second, simpler option is NTFS quotas.
CERTIFICATION READY Configure NTFS quotas. Objective 2.1
Easy-to-Read Tables
Bottom Line Reader Aid
Why should the administrators of an enterprise network want users to store their fi les on shared server drives, rather than their local workstation drives? The answers to this question typically include the following:
• To enable users to collaborate on projects by sharing files
• To back up document files more easily
• To protect company information by controlling access to documents
• To reduce the number of shares needed on the network
• To prevent the need to share access to workstations
• To monitor users’ storage habits and regulate their disk-space consumption
• To insulate users from the sharing and permission assignment processes
Without these problems, fi le sharing would simply be a matter of creating a share on each user’s workstation and granting everyone full access to it. Because of these problems, however, this practice would lead to chaos in the form of lost fi les, corrupted workstations, and endless help calls from confused users.
■ Designing a File-Sharing Strategy
THE BOTTOM LINE
Decide where users should store their files and who should be permitted to access them.
7 0 - 4 1 0 E X A M O B J E C T I V E
Objective 2.2 – Confi gure print and document services. This objective may include but is not limited to: Confi gure the Easy Print print driver; confi gure Enterprise Print Management; confi gure drivers; confi gure printer pooling; confi gure print priorities; confi gure printer permissions.
LESSON HEADING EXAM OBJECTIVE
Deploying a Print Server
Understanding the Windows Print Architecture
Sharing a Printer
Managing Printer Drivers Configure drivers
Using Remote Access Easy Print Configure the Easy Print print driver
Configuring Printer Security Configure printer permissions
Managing Documents
Managing Printers Configure print priorities Configure printer pooling
Using the Print and Document Services Role
Using the Print Management Console Configure Enterprise Print Management
Configuring Print and Document Services
5LESSON
K E Y T E R M S
Enhanced Metafile (EMF)
print device
print server
printer
printer control language (PCL)
printer driver
printer pool
Remote Desktop Easy
Print
spooler
XML Paper Specification
(XPS)
Table 5-1
Basic Printer Permissions PERMISSION CAPABILITIES
ADVANCED PERMISSIONS
DEFAULT ASSIGNMENTS
Print • Connect to a printer
• Print documents
• Pause, resume, restart, and cancel the user’s own documents
• Print
• Read Permissions
Assigned to the Everyone special identity
Manage this printer
• Cancel all documents
• Share a printer
• Change printer properties
• Delete a printer
• Change printer permissions
• Print
• Manage Printers
• Read Permissions
• Change Permissions
• Take Ownership
Assigned to the Administrators group
Manage documents
• Pause, resume, restart, and cancel all users’ documents
• Control job settings for all documents
• Manage Documents
• Read Permissions
• Change Permissions
• Take Ownership
Assigned to the Creator Owner special identity
www.wiley.com/college/microsoft or
call the MOAC Toll-Free Number: 1+(888) 764-7001 (U.S. & Canada only)
www.wiley.com/college/microsoft or
call the MOAC Toll-Free Number: 1+(888) 764-7001 (U.S. & Canada only)
More Information Reader Aid
Take Note Reader Aid
Warning Reader Aid
Screen Images
Configuring File and Share Access | 99
developing a consistent directory structure and duplicating it on all the servers is a good idea so that if users have to access a server in another department, they can fi nd their way around.
A well-designed sharing strategy provides each user with three resources:
• A private storage space, such as a home folder, to which the user has exclusive access
• A public storage space, where users can store files that they want colleagues to be able to access
• Access to a shared workspace for communal and collaborative documents
One way to implement this strategy would be to create one share called Home, with a private folder for each user on it, and a second share called Public, again with a folder for each user. Depending on your network’s hardware confi guration, you could create both shares on a separate server for each department or workgroup, split the shares and folder among multiple servers in each department, or even create one big fi le server containing all the shares for the entire company.
MORE INFORMATION
Even if you split the Home and Public shares among multiple servers, you can still make them appear as a single
unified directory tree by using the Windows Server 2012 Distributed File System (DFS). See Objective 2.1,
“Configure Distributed File System (DFS),” in Exam 70-411, “Administering Windows Server 2012.”
✚
Controlling Access
On most enterprise networks, the principle of “least privileges” should apply. This principle states that users should have only the privileges they need to perform their required tasks, and no more.
A user’s private storage space should be exactly that—private and inaccessible, if not invisible, to other users. This is where each user can store his or her private fi les without exposing them to other users. Therefore, each user should have full privileges to his or her private storage with the ability to create, delete, read, write, and modify fi les. Other users should have no privileges to that space at all.
The easiest way to create private folders with the appropriate permissions for each user is to create a home folder through each Active Directory user object.
TAKE NOTE*
Each user should also have full privileges to his or her public folder. This is where users can share fi les informally. For example, when Ralph asks Alice for a copy of her budget spreadsheet, Alice can simply copy the fi le from her private folder to her public folder. Then, Ralph can copy the fi le from Alice’s public folder to his own private folder, and access it from there. Thus, public and private folders vary in that other users should be able to list the contents of all public folders and read the fi les stored there, but not be able to modify or delete fi les in any folder but their own. Users should also be able to navigate throughout the Public folder tree, so that they can read any user’s fi les and copy them to their own folders.
Although users should have full privileges to their personal folders, you should not leave their storage practices unmonitored or unregulated. Later in this lesson, you learn how to set NTFS quotas limiting users’ storage space.
TAKE NOTE*
Configuring File and Share Access | 99
developing a consistent directory structure and duplicating it on all the servers is a good idea so that if users have to access a server in another department, they can fi nd their way around.
A well-designed sharing strategy provides each user with three resources:
• A private storage space, such as a home folder, to which the user has exclusive access
• A public storage space, where users can store files that they want colleagues to be able to access
• Access to a shared workspace for communal and collaborative documents
One way to implement this strategy would be to create one share called Home, with a private folder for each user on it, and a second share called Public, again with a folder for each user. Depending on your network’s hardware confi guration, you could create both shares on a separate server for each department or workgroup, split the shares and folder among multiple servers in each department, or even create one big fi le server containing all the shares for the entire company.
MORE INFORMATION
Even if you split the Home and Public shares among multiple servers, you can still make them appear as a single
unified directory tree by using the Windows Server 2012 Distributed File System (DFS). See Objective 2.1,
“Configure Distributed File System (DFS),” in Exam 70-411, “Administering Windows Server 2012.”
✚
Controlling Access
On most enterprise networks, the principle of “least privileges” should apply. This principle states that users should have only the privileges they need to perform their required tasks, and no more.
A user’s private storage space should be exactly that—private and inaccessible, if not invisible, to other users. This is where each user can store his or her private fi les without exposing them to other users. Therefore, each user should have full privileges to his or her private storage with the ability to create, delete, read, write, and modify fi les. Other users should have no privileges to that space at all.
The easiest way to create private folders with the appropriate permissions for each user is to create a home folder through each Active Directory user object.
TAKE NOTE*
Each user should also have full privileges to his or her public folder. This is where users can share fi les informally. For example, when Ralph asks Alice for a copy of her budget spreadsheet, Alice can simply copy the fi le from her private folder to her public folder. Then, Ralph can copy the fi le from Alice’s public folder to his own private folder, and access it from there. Thus, public and private folders vary in that other users should be able to list the contents of all public folders and read the fi les stored there, but not be able to modify or delete fi les in any folder but their own. Users should also be able to navigate throughout the Public folder tree, so that they can read any user’s fi les and copy them to their own folders.
Although users should have full privileges to their personal folders, you should not leave their storage practices unmonitored or unregulated. Later in this lesson, you learn how to set NTFS quotas limiting users’ storage space.
TAKE NOTE*
Configuring Local Storage | 87
Windows versions prior to 2008 use the correct terminology in the Disk Management snap-in. The menus enable you to create partitions on basic disks and volumes on dynamic disks. Windows Server 2012 uses the term volume for both disk types, and enables you to create any of the available volume types, whether the disk is basic or dynamic. If the volume type you select is not supported on a basic disk, the wizard converts it to a dynamic disk as part of the volume creation process.
Despite the menus that refer to basic partitions as volumes, the traditional rules for basic disks remain in effect. The New Simple Volume menu option on a basic disk creates up to three primary partitions. When you create a fourth volume, the wizard actually creates an extended partition and a logical drive of the size you specify. If any space remains on the disk, you can create additional logical drives in the extended partition.
To create a new simple volume on a basic or dynamic disk using the Disk Management snap-in, use the following procedure.
CREATE A NEW SIMPLE VOLUME
GET READY. Log on to Windows Server 2012, using an account with Administrator privileges.
1. In the Server Manager window, click Tools > Computer Management.
2. In the Computer Management console, click Disk Management.
3. In the Graphical View of the Disk Management snap-in, right-click an unallocated
disk area on which you want to create a volume. From the context menu, select
New Simple Volume. The New Simple Volume Wizard appears.
4. Click Next to dismiss the Welcome page. The Specify Volume Size page appears, as
shown in Figure 3-25.
Creating a Simple Volume
Technically speaking, you create partitions on basic disks and volumes on dynamic disks. This is not just an arbitrary change in nomenclature. Converting a basic disk to a dynamic disk actually creates one big partition, occupying all space on the disk. The volumes you create on the dynamic disk are logical divisions within that single partition.
Figure 3-25
The Specify Volume Size page
When you use
DiskPart.exe, a command-line
utility included with Windows
Server 2012, to manage basic
disks, you can create four primary
partitions, or three primary
partitions and one extended
partition. The DiskPart.exe utility
contains a superset of the
commands supported by the Disk
Management snap-in. In other
words, DiskPart can do everything
Disk Management can do, and
more. However, while the Disk
Management Snap-in prevents
you from unintentionally
performing actions that might
result in data loss, DiskPart has
no safeties, and thus does not
prohibit you from performing such
actions. For this reason, Microsoft
recommends that only advanced
users use DiskPart and that they
use it with due caution.
WARNING
x | Illustrated Book Tour
www.wiley.com/college/microsoft or
call the MOAC Toll-Free Number: 1+(888) 764-7001 (U.S. & Canada only)
www.wiley.com/college/microsoft or
call the MOAC Toll-Free Number: 1+(888) 764-7001 (U.S. & Canada only)
Illustrated Book Tour | xi
Step-by-step Exercises
Informative Diagrams
X Ref Reader Aid
Configuring File and Share Access | 129
or create new ones, based on your users’ needs. Scheduling shadow copies to occur
too frequently can degrade server performance and cause copies to be aged out too
quickly, whereas scheduling them to occur too infrequently can cause users to lose
work because the most recent copy is too old.
8. Click OK twice to close the Schedule and Settings dialog boxes.
9. Click Enable. The system enables the Shadow Copies feature for the selected volume and creates the fi rst copy in the designated storage area.
CLOSE Windows Explorer.
After you complete this procedure, users can restore previous versions of fi les on the selected volumes from the Previous Versions tab on any fi le or folder’s Properties sheet.
NTFS quotas enable you to set a storage limit for users of a particular volume. Depending on how you confi gure the quota, users exceeding the limit can be denied disk space or just receive a warning. The space consumed by individuals users is measured by the size of the fi les they own or create.
NTFS quotas are relatively limited in that you can set only a single limit for all users of a volume. The feature is also limited in the actions it can take in response to a user exceeding the limit. The quotas in File Server Resource Manager, by contrast, are much more flexible in the nature of the limits you can set and the responses of the program, which can send e-mail notifications, execute commands, and generate reports, as well as log events.
To confi gure NTFS quotas for a volume, use the following procedure.
CONFIGURE NTFS QUOTAS
GET READY. Log on to Windows Server 2012, using an account with domain administrative privileges.
1. Click the Windows Explorer icon in the taskbar. The Windows Explorer window appears.
2. In the Folders list, expand the Computer container, right-click a volume and, from the context menu, select Properties. The Properties sheet for the volume appears.
3. Click the Quota tab to display the interface shown in Figure 4-31.
4. Select the Enable quota management check box to activate the rest of the controls.
5. If you want to prevent users from consuming more than their quota of disk space, select the Deny disk space to users exceeding quota limit check box.
6. Select the Limit disk space to radio button and specify amounts for the quota limit and the warning level.
■ Configuring NTFS Quotas
THE BOTTOM LINE
Managing disk space is a constant concern for server administrators. One way to prevent users from monopolizing large amount of storage is to implement quotas. Windows Server 2012 supports two types of storage quotas. The more elaborate of the two is implemented as part of File Server Resource Manager. The second, simpler option is NTFS quotas.
CERTIFICATION READY Configure NTFS quotas. Objective 2.1
Configuring File and Share Access | 113
The next step is to assign each user the Allow Full Control permission to his or her own subfolder, as shown in Figure 4-17. This enables each user to create, modify, and delete fi les in his or her own folder, without compromising the security of other users’ folders. Because the user folders are at the bottom of the hierarchy, no subfolders inherit the Full Control permissions.
Figure 4-16
Granting Allow permissions to the xfer folder
Figure 4-17
Granting Full Control to individual user folders
100 | Lesson 4
Administrators typically use NTFS permissions to assign these privileges on a Windows Server 2012 fi le server. You have no compelling reason to use the FAT (File Allocation Table) fi le system in Windows Server 2012. NTFS provides not only the most granular user access control, but also other advanced storage features, including fi le encryption and compression. The new ReFS fi le system introduced in Windows Server 2012 lacks features such as encryption and compression, but it still supports the NTFS permission system.
To simplify the administration process, you should always assign permissions to security groups rather than to individuals. Assigning permissions to groups enables you to add new users or move them to other job assignments without modifying the permissions themselves. On a large Active Directory Domain Services (AD DS) network, you might also consider the standard practice of assigning the NTFS permissions to a domain local group, placing the user objects to receive the permissions in a global (or universal) group, and making the global group a member of a domain local group.
Except in special cases, explicitly denying NTFS permissions to users or groups usually is not necessary. Some administrators prefer to use this capability, however. When various administrators use different permission assignment techniques on the same network, it can become extremely diffi cult to track down the sources of certain effective permissions. Another way to simplify the administration process on an enterprise network is to establish specifi c permission assignment policies, so that everyone performs tasks the same way.
XREF For more information on NTFS permission assignments, see “Assigning Permissions,” later in this lesson.
Mapping Drives
After you create the folders for each user and assign permissions to the folders, you need to make sure that users can access their folders.
One way of doing this is to use the Folder Redirection settings in Group Policy to map each user’s Documents folder to his or her home folder on the network share. This process is invisible to users, enabling them to work with their fi les without even knowing they are stored on a network drive.
Another way to provide users with easy and consistent access to their fi les is to map drive letters to each user’s directories with logon scripts, so they can always fi nd their fi les in the same place, using Windows Explorer. For example, you might consider mapping drive F: to a user’s private home folder and drive G: to the user’s Public folder. A third drive letter might point to the root of the Public share, so that the user can access other people’s public folders.
Many users do not understand the fundamental concepts of network drive sharing and fi le management. Often, they just know that they store their fi les on the F: drive and are unaware that another user’s F: drive might point to a different folder. However, consistent drive letter assignments on every workstation can simplify support for users experiencing problems storing or retrieving their fi les.
■ Creating Folder Shares
THE BOTTOM LINE
Sharing folders makes them accessible to network users.
www.wiley.com/college/microsoft or
call the MOAC Toll-Free Number: 1+(888) 764-7001 (U.S. & Canada only)
www.wiley.com/college/microsoft or
call the MOAC Toll-Free Number: 1+(888) 764-7001 (U.S. & Canada only)
xii | Illustrated Book Tour
Skill Summary
Knowledge Assessment
Business Case Scenarios
130 | Lesson 4
7. Select the Log event check boxes to control whether users exceeding the specifi ed limits should trigger log entries.
8. Click OK to create the quota and close the Properties sheet.
CLOSE Windows Explorer.
Figure 4-31
The Quota tab of a volume’s Properties sheet
S K I L L S U MMA RY
IN THIS LESSON, YOU LEARNED:
• Creating folder shares makes the data stored on a file server’s disks accessible to network users.
• Windows Server 2012 has several sets of permissions that operate independently of each other, including NTFS permissions, share permissions, registry permissions, and Active Directory permissions.
• NTFS permissions enable you to control access to files and folders by specifying the tasks individual users can perform on them. Share permissions provide rudimentary access control for all files on a network share. Network users must have the proper share and NTFS permissions to access file server shares.
• Access-based enumeration (ABE) applies filters to shared folders based on an individual user’s permissions to the files and subfolders in the share. Users who cannot access a particular shared resource cannot see that resource on the network.
• Offline Files is a Windows feature that enables client systems to maintain local copies of files they access from server shares.
• Volume Shadow Copies is a Windows Server 2012 feature that enables you to maintain previous versions of files on a server, so that if users accidentally delete or overwrite a file, Configuring File and Share Access | 131
they can access a copy. You can implement Shadow Copies only for an entire volume; you cannot select specific shares, folders, or files.
• NTFS quotas enable you to set a storage limit for users of a particular volume. Depending on how you configure the quota, users exceeding the limit can be denied disk space or just receive a warning.
■ Knowledge Assessment
Multiple Choice
Select one or more correct answers for each of the following questions.
1. Which of the following is the best description of a security principal? a. the person granting permissions to network users b. the network resource receiving permissions c. a collection of individual special permissions d. an object that assigns permissions
2. Which of the following statements about effective access is not true? a. Inherited permissions take precedence over explicit permissions. b. Deny permissions always override Allow permissions. c. When a security principal receives Allow permissions from multiple groups, the per-
missions are combined to form the effective access permissions. d. Effective access includes both permissions inherited from parents and permissions
derived from group memberships.
3. Which of the following statements is not true in reference to resource ownership? a. One of the purposes for file and folder ownership is to calculate disk quotas. b. Every file and folder on an NTFS driver has an owner. c. It is possible for any user possessing the Take Ownership special permission to assume
the ownership of a file or folder. d. It is possible to lock out a file or folder by assigning a combination of permissions
that permits access to no one at all, including the owner of the file or folder.
4. Which of the following statements about permissions are true? a. ACLs are composed of ACEs. b. Basic permissions are composed of advanced permissions. c. All permissions are stored as part of the protected resource. d. All of the above.
5. What is the maximum number of shadow copies that a Windows Server 2012 system can maintain for each volume?
a. 8 b. 16 c. 64 d. 128
6. Which of the following terms describes the process of granting users access to file server shares by reading their permissions?
a. authentication b. authorization c. enumeration d. assignment
Configuring File and Share Access | 133
Build a List
1. Order the steps to create a folder share. a. Select a File share profile option: SMB Share-Quick, SMB Share-Advanced, SMB
Share-Applications, NFS Share-Quick, and NFS Share-Advanced. b. Click Shares in the submenu and, from the Tasks menu, select New Share. c. Select the Server, path, and share name. d. Log on to Windows Server 2012 with administrative privileges. e. Configure share settings: Enable access-based enumeration, Allow caching of share,
Enable BranchCache on the file share, and Encrypt data access. f. Open Server Manager and click the File and Storage Services icon. g. Specify permissions to control access and click Next to confirm and create.
2. Order the steps to set share permissions. a. In Server Manager, click the File and Storage Services icon. In the submenu, click
Shares. b. Log on to Windows Server 2012 with administrative privileges. c. Select the type of permissions to assign (Allow or Deny). d. Click Permissions and Customize Permissions. e. Click Add, and then select a principal (for example, user, computer, service account,
or group). f. Click the Share tab. g. From the Shares tile, right-click a share and, from the context menu, select
Properties.
3. Order the steps to assign basic NTFS permissions. a. Log on to Windows Server 2012 with administrative privileges. b. From the Shares tile, right-click a share and, from the context menu, select
Properties. c. Select the type of permissions to assign (Allow or Deny). d. In Server Manager, click the File and Storage Services icon. In the submenu,
click Shares. e. In the Advanced Security Settings dialog box, the Permissions tab shows the
Permissions List. Click Add to add a Permission Entry. f. Select a principal (for example, user, computer, service account, or group). g. Click Permissions, and then click Customize Permissions. h. From the Applies To drop-down list, specify the subfolders and files that should
inherit permissions you’re assigning.
■ Business Case Scenarios
Scenario 4-1: Assigning Permissions
While you are working the help desk for a corporate network, a user named Leo calls to request access to the files for Trinity, a new classified project. The Trinity files are stored in a shared folder on a Windows Server 2012 workgroup file server, which is locked in a secured underground data storage facility in New Mexico. After verifying that he has the appropriate security clearance for the project, you create a new group on the file server called TRINITY_ USERS and add Leo’s user account to that group. Then, you add the TRINITY_USER group to the access control list for the Trinity folder on the file server, and assign the group the following NTFS permissions:
• Allow Modify • Allow Read & Execute
www.wiley.com/college/microsoft or
call the MOAC Toll-Free Number: 1+(888) 764-7001 (U.S. & Canada only)
| xiii www.wiley.com/college/microsoft or
call the MOAC Toll-Free Number: 1+(888) 764-7001 (U.S. & Canada only)
This book uses particular fonts, symbols, and heading conventions to highlight important information or to call your attention to special steps. For more information about the features in each lesson, refer to the Illustrated Book Tour section.
Conventions and Features Used in This Book
CONVENTION MEANING
This feature provides a brief summary of the material
to be covered in the section that follows.
This feature signals the point in the text where a
specific certification objective is covered. It provides
you with a chance to check your understanding of that
particular MCSA objective and, if necessary, review the
section of the lesson where it is covered. In addition,
some Certification Ready sidebars will provide more
general information that will assist with your exam
preparation.
Reader aids appear in shaded boxes found in your text.
Take Note and More Information provide helpful hints
related to particular tasks or topics.
The Using Windows PowerShell sidebar provides
Windows PowerShell-based alternatives to graphical
user interface (GUI) functions or procedures.
Warning points out instances when error or misuse
could cause damage to the computer or network.
These X Ref notes provide pointers to information
discussed elsewhere in the textbook or describe
interesting features of Windows Server that are not
directly addressed in the current topic or exercise.
A shared printer can be used by Key terms appear in bold italic.
many individuals on a network.
cd\windows\system32 Commands that are to be typed are shown in a
special font.
Any button on the screen you are supposed to click on
or select will appear in blue.
CERTIFICATION READY
THE BOTTOM LINE
TAKE NOTE*
USING WINDOWS POWERSHELL
XREF
WARNING
✚ MORE INFORMATION
Click Install Now.
www.wiley.com/college/microsoft or
call the MOAC Toll-Free Number: 1+(888) 764-7001 (U.S. & Canada only) | xv
The Microsoft Official Academic Course programs are accompanied by a rich array of resources that incorporate the extensive textbook visuals to form a pedagogically cohesive package. These resources provide all the materials instructors need to deploy and deliver their courses. Resource information available at www.wiley.com/college/microsoft includes:
• DreamSpark Premium is designed to provide the easiest and most inexpensive developer tools, products, and technologies available to faculty and students in labs, classrooms, and on student PCs. A free 3-year membership is available to qualified MOAC adopters.
Note: Windows Server 2012 can be downloaded from DreamSpark Premium for use in this course.
• The Instructor’s Guide contains solutions to all the textbook exercises as well as chapter summaries and lecture notes. The Instructor’s Guide and Syllabi for various term lengths are available from the Instructor’s Book Companion site.
• The Test Bank contains hundreds of questions organized by lesson in multiple-choice, best answer, build list, and essay formats and is available to download from the Instructor’s Book Companion site. A complete answer key is provided.
• PowerPoint Presentations. A complete set of PowerPoint presentations is available on the Instructor’s Book Companion site to enhance classroom presentations. Tailored to the text’s topical coverage, these presentations are designed to convey key Windows Server 2012 concepts addressed in the text.
• Available Textbook Figures. All figures from the text are on the Instructor’s Book Companion site. By using these visuals in class discussions, you can help focus students’ attention on key elements of Windows Server and help them understand how to use it effectively in the workplace.
• MOAC Labs Online. MOAC Labs Online is a cloud-based environment that enables students to conduct exercises using real Microsoft products. These are not simulations but instead are live virtual machines where faculty and students can perform any activities they would on a local machine. MOAC Labs Online relieves the need for local setup, configuration, and most troubleshooting tasks. This represents an opportunity to lower costs, eliminate the hassle of lab setup, and support and improve student access and portability. Contact your Wiley rep about including MOAC Labs Online with your course offering.
• Lab Answer Keys. Answer keys for review questions found in the lab manuals and MOAC Labs Online are available on the Instructor’s Book Companion site.
• Lab Worksheets. The review questions found in the lab manuals and MOAC Labs Online are gathered in Microsoft Word documents for students to use. These are available on the Instructor’s Book Companion site.
• Sharing with Fellow Faculty Members. When it comes to improving the classroom experience, there is no better source of ideas and inspiration than your colleagues teaching the same material. The Wiley Faculty Network connects teachers with technology, facilitates the exchange of best practices, and helps to enhance instructional efficiency and effectiveness. Wiley Faculty Network activities include technology training and tutorials, virtual seminars, peer-to-peer exchanges of experiences and ideas, personal consulting, and sharing of resources. For details visit www.WhereFacultyConnect.com.
Instructor Support Program
www.wiley.com/college/microsoft or
call the MOAC Toll-Free Number: 1+(888) 764-7001 (U.S. & Canada only)
■ Important Web Addresses and Phone Numbers
To locate the Wiley Global Education Rep in your area, go to http://www.wiley.com/college and click on the “Who’s My Rep? ” link at the top of the page, or call the MOAC Toll Free Number: 1 + (888) 764-7001 (U.S. & Canada only).
To learn more about becoming a Microsoft Certified Solutions Associate and exam availability, visit Microsoft’s Training & Certification website.
DreamSpark Premium is designed to provide the easiest and most inexpensive way for universities to make the latest Microsoft developer tools, products, and technologies available in labs, classrooms, and on student PCs. DreamSpark Premium is an annual membership program for departments teaching Science, Technology, Engineering, and Mathematics (STEM) courses. The membership provides a complete solution to keep academic labs, faculty, and students on the leading edge of technology.
Software available through the DreamSpark Premium program is provided at no charge to adopting departments through the Wiley and Microsoft publishing partnership.
Contact your Wiley rep for details.
For more information about the DreamSpark Premium program, go to Microsoft’s DreamSpark website.
Note: Windows Server 2012 can be downloaded from DreamSpark Premium for use in this course.
DREAMSPARK PREMIUM—FREE 3-YEAR MEMBERSHIP AVAILABLE TO QUALIFIED ADOPTERS!
xvi | Instructor Support Program
www.wiley.com/college/microsoft or
call the MOAC Toll-Free Number: 1+(888) 764-7001 (U.S. & Canada only)
Book Companion Website (www.wiley.com/college/microsoft)
The students’ book companion site for the MOAC series includes any resources, exercise files, and web links that will be used in conjunction with this course.
Wiley E-Text: Powered by VitalSource
Wiley E-Texts: Powered by VitalSource are innovative, electronic versions of printed textbooks. Students can buy Wiley E-Texts for around 40% off the U.S. price of the printed text and get the added value of permanence and portability. Wiley E-Texts provide students with numerous additional benefits that are not available with other e-text solutions.
Wiley E-Texts are NOT subscriptions; students download the Wiley E-Text to their computer desktops. Students own the content they buy to keep for as long as they want. Once a Wiley E-Text is downloaded to the computer desktop, students have instant access to all of the content without being online. Students can also print the sections they prefer to read in hard copy. Students also have access to fully integrated resources within their Wiley E-Text. From highlighting their e-text to taking and sharing notes, students can easily personalize their Wiley E-Text as they are reading or following along in class.
Microsoft Windows Server Software
Windows Server 2012 software is available through a DreamSpark student membership. DreamSpark is a Microsoft Program that provides students with free access to Microsoft software for learning, teaching, and research purposes. Students can download full versions of Windows Server 2012 and other types of software at no cost by visiting Microsoft’s DreamSpark website.
■ Microsoft Certifi cation
Microsoft Certification has many benefits and enables you to keep your skills relevant, applicable, and competitive. In addition, Microsoft Certification is an industry standard that is recognized worldwide—which helps open doors to potential job opportunities. After you earn your Microsoft Certification, you have access to a number of benefits, which can be found on the Microsoft Certified Professional member site.
Microsoft Learning has reinvented the Microsoft Certification Program by building cloud- related skills validation into the industry’s most recognized certification program. Microsoft Certified Solutions Expert (MCSE) and Microsoft Certified Solutions Developer (MCSD) are Microsoft’s flagship certifications for professionals who want to lead their IT organization’s journey to the cloud. These certifications recognize IT professionals with broad and deep skill sets across Microsoft solutions. The Microsoft Certified Solutions Associate (MCSA) is the certification for aspiring IT professionals and is also the prerequisite certification necessary to
Student Support Program
| xvii
www.wiley.com/college/microsoft or
call the MOAC Toll-Free Number: 1+(888) 764-7001 (U.S. & Canada only)
earn an MCSE. These new certifications integrate cloud-related and on-premise skills validation in order to support organizations and recognize individuals who have the skills required to be productive using Microsoft technologies.
On-premise or in the cloud, Microsoft training and certification empowers technology professionals to expand their skills and gain knowledge directly from the source. Securing these essential skills will allow you to grow your career and make yourself indispensable as the industry shifts to the cloud. Cloud computing ultimately enables IT to focus on more mission-critical activities, raising the bar of required expertise for IT professionals and developers. These reinvented certifications test on a deeper set of skills that map to real-world business context. Rather than testing only on a feature of a technology, Microsoft Certifications now validate more advanced skills and a deeper understanding of the platform.
Microsoft Certified Solutions Associate (MCSA)
The Microsoft Certified Solutions Associate (MCSA) certification is for students preparing to get their first jobs in Microsoft technology. Whether in the cloud or on-premise, this certification validates the core platform skills needed in an IT environment. The MCSA certifications are a requirement to achieve Microsoft’s flagship Microsoft Certified Solutions Expert (MCSE) and Microsoft Certified Solutions Developer (MCSD) certifications.
The MCSA Windows Server 2012 certification shows that you have the primary set of Windows Server skills that are relevant across multiple solution areas in a business environment. The MCSA Windows Server 2012 certification is a prerequisite for earning the MCSE Server Infrastructure certification, the MCSE Desktop Infrastructure certification, or the MCSE Private Cloud certification.
Exam 70-410, Installing and Configuring Windows Server 2012, is part one of a series of three exams that validate the skills and knowledge necessary to implement a core Windows Server 2012 Infrastructure into an existing enterprise environment. This exam will validate the initial implementation and configuration of the Windows Server 2012 core services, such as Active Directory and the networking services. This exam along with the remaining two exams will collectively validate the skills and knowledge necessary for implementing, managing, maintaining, and provisioning services and infrastructure in a Windows Server 2012 environment.
If you are a student new to IT who may not yet be ready for MCSA, the Microsoft Technology Associate (MTA) certification is an optional starting point that may be available through your school.
You can learn more about the MCSA certification at the Microsoft Training & Certification website.
Preparing to Take an Exam
Unless you are a very experienced user, you will need to use test preparation materials to prepare to complete the test correctly and within the time allowed. The Microsoft Official Academic Course series is designed to prepare you with a strong knowledge of all exam topics, and with some additional review and practice on your own, you should feel confident in your ability to pass the appropriate exam.
After you decide which exam to take, review the list of objectives for the exam. You can easily identify tasks that are included in the objective list by locating the exam objective overview at
xviii | Student Support Program
www.wiley.com/college/microsoft or
call the MOAC Toll-Free Number: 1+(888) 764-7001 (U.S. & Canada only)
Student Support Program | xix
the start of each lesson and the Certification Ready sidebars in the margin of the lessons in this book.
To register for the 70-410 exam, visit Microsoft Training & Certifications Registration webpage for directions on how to register with Prometric, the company that delivers the MCSA exams. Keep in mind these important items about the testing procedure:
• What to expect. Microsoft Certification testing labs typically have multiple workstations, which may or may not be occupied by other candidates. Test center administrators strive to provide a quiet and comfortable environment for all test takers.
• Plan to arrive early. It is recommended that you arrive at the test center at least 30 minutes before the test is scheduled to begin.
• Bring your identification. To take your exam, you must bring the identification (ID) that was specified when you registered for the exam. If you are unclear about which forms of ID are required, contact the exam sponsor identified in your registration information. Although requirements vary, you typically must show two valid forms of ID, one with a photo, both with your signature.
• Leave personal items at home. The only item allowed into the testing area is your identification, so leave any backpacks, laptops, briefcases, and other personal items at home. If you have items that cannot be left behind (such as purses), the testing center might have small lockers available for use.
• Nondisclosure agreement. At the testing center, Microsoft requires that you accept the terms of a nondisclosure agreement (NDA) and complete a brief demographic survey before taking your certification exam.
www.wiley.com/college/microsoft or
call the MOAC Toll-Free Number: 1+(888) 764-7001 (U.S. & Canada only) | xxi
Craig Zacker is an instructor, writer, editor, and networker whose computing experience began in the days of teletypes and paper tape. After making the move from minicomputers to PCs, he worked as a network administrator and PC support technician while operating a freelance desktop publishing business. After earning a Master’s Degree in English and American Literature from New York University, Craig worked extensively on the integration of Microsoft Windows operating systems into existing internetworks, supported fleets of Windows workstations, and was employed as a technical writer, content provider, and webmaster for the online services group of a large software company. Since devoting himself to writing and editing full-time, Craig has authored or contributed to dozens of books on operating systems, networking topics, and PC hardware. He has also published articles with top industry publications, developed online training courses for the various firms, and authored the following Microsoft Official Academic Course (MOAC), Academic Learning Series (ALS), and Self-Paced Training Kit titles:
MOAC: Windows Server 2008, Enterprise Administrator (Exam 70-647)
MOAC: Windows 7 Configuration (Exam 70-680)
MOAC: Windows Server Administrator (Exam 70-646)
MOAC: Configuring Windows Server 2008 Application Services (Exam 70-643)
MOAC: Configuring Microsoft Windows Vista (Exam 70-620)
MOAC: Implementing & Administering Security in a Windows Server 2003 Network (Exam 70-299)
MOAC: Managing & Maintaining a Microsoft Windows Server 2003 Environment (Exam 70-290)
ALS: Network+ Certification, Second, Third, and Fourth Editions
ALS: Planning & Maintaining a Windows Server 2003 Network Infrastructure (Exam 70-293)
ALS: Microsoft Windows 2000 Network Infrastructure Administration, Second Edition (2002)
MCSE Self-Paced Training Kit (Exam 70-293): Planning & Maintaining a Microsoft Windows Server 2003 Network Infrastructure (2003)
MCSA/MCSE Self-Paced Training Kit: Microsoft Windows 2000 Network Infrastructure Administration, Exam 70-216, Second Edition (2002)
MC SA Training Kit: Managing a Windows 2000 Network Environment (2002)
Network+ Certification Training Kit, First and Second Editions (2001)
Network+ Certification Readiness Review (2001)
About the Author
www.wiley.com/college/microsoft or
call the MOAC Toll-Free Number: 1+(888) 764-7001 (U.S. & Canada only)
Acknowledgments
We thank the MOAC faculty and instructors who have assisted us in building the Microsoft Official Academic Course courseware. These elite educators have acted as our sounding board on key pedagogical and design decisions leading to the development of the MOAC courseware for future Information Technology workers. They have provided invaluable advice in the service of quality instructional materials, and we truly appreciate their dedication to technology education.
Brian Bridson, Baker College of Flint
David Chaulk, Baker College Online
Ron Handlon, Remington College—Tampa Campus
Katherine James, Seneca College of Applied Arts & Technology
Wen Liu, ITT Educational Services
Zeshan Sattar, Pearson in Practice
Jared Spencer, Westwood College Online
David Vallerga, MTI College
Bonny Willy, Ivy Tech State College
We also thank Microsoft Learning’s Lutz Ziob, Don Field, Tim Sneath, Moorthy Uppaluri, Keith Loeber, Rob Linsky, Anne Hamilton, Shelby Grieve, Christine Yoshida, Gene Longo, Mike Mulcare, Paul Schmitt, Martin DelRe, Colin Klein, Julia Stasio, and Josh Barnhill for their encouragement and support in making the Microsoft Official Academic Course programs the finest academic materials for mastering the newest Microsoft technologies for both students and instructors.
xxii | Acknowledgments
www.wiley.com/college/microsoft or
call the MOAC Toll-Free Number: 1+(888) 764-7001 (U.S. & Canada only) | xxiii
1 Installing Servers 1
2 Configuring Servers 32
3 Configuring Local Storage 59
4 Configuring File and Share Access 97
5 Configuring Print and Document Services 135
6 Configuring Servers for Remote Management 169
7 Creating and Configuring Virtual Machine Settings 197
8 Creating and Configuring Virtual Machine Storage 225
9 Creating and Configuring Virtual Networks 248
10 Configuring IPv4 and IPv6 Addressing 267
11 Deploying and Configuring the DHCP Service 298
12 Deploying and Configuring the DNS Service 333
13 Installing Domain Controllers 370
14 Creating and Managing Active Directory Users and Computers 405
15 Creating and Managing Active Directory Groups and Organizational Units 430
16 Creating Group Policy Objects 460
17 Configuring Security Policies 489
18 Configuring Application Restriction Policies 522
19 Configuring Windows Firewall 550
Appendix A 574
Index 575
Brief Contents
www.wiley.com/college/microsoft or
call the MOAC Toll-Free Number: 1+(888) 764-7001 (U.S. & Canada only) | xxv
Lesson 1: Installing Servers 1
Selecting a Windows Server 2012 Edition 2 Supporting Server Roles 3 Supporting Server Virtualization 6 Server Licensing 6
Installing Windows Server 2012 7 System Requirements 7 Performing a Clean Installation 8 Installing Third-Party Drivers 13 Working with Installation Partitions 14
Choosing Installation Options 14 Using Server Core 15
Server Core Defaults 16 Server Core Capabilities 16
Using the Minimal Server Interface 17 Using Features on Demand 19
Upgrading Servers 20 Upgrade Paths 20 Preparing to Upgrade 21 Performing an Upgrade Installation 21
Migrating Roles 23 Installing Windows Server Migration
Tools 24 Using Migration Guides 27
Skill Summary 28
Knowledge Assessment 28
Business Case Scenarios 31
Lesson 2: Configuring Servers 32
Completing Post-Installation Tasks 32 Using GUI Tools 33 Using Command-Line Tools 37 Converting Between GUI and Server
Core 37 Configuring NIC Teaming 39
Contents
Using Roles, Features, and Services 43
Using Server Manager 46 Adding Roles and Features 47 Deploying Roles to VHDs 51 Configuring Services 53
Delegating Server Administration 54
Skill Summary 55
Knowledge Assessment 55
Business Case Scenarios 58
Lesson 3: Configuring Local Storage 59
Planning Server Storage 60 Determining the Number of Servers Needed 60 Estimating Storage Requirements 61 Selecting a Storage Technology 62
Selecting a Physical Disk Technology 62 Using External Drive Arrays 63
Planning for Storage Fault Tolerance 65 Using Disk Mirroring 65 Using RAID 66
Using Storage Spaces 67
Understanding Windows Disk Settings 68 Selecting a Partition Style 69 Understanding Disk Types 70 Understanding Volume Types 71 Choosing a Volume Size 72 Understanding File Systems 72
Working with Disks 72 Adding a New Physical Disk 74 Creating and Mounting VHDs 76 Creating a Storage Pool 78 Creating Virtual Disks 82 Creating a Simple Volume 87 Creating a Striped, Spanned, Mirrored, or
RAID-5 Volume 90 Extending and Shrinking Volumes and Disks 92
www.wiley.com/college/microsoft or
call the MOAC Toll-Free Number: 1+(888) 764-7001 (U.S. & Canada only)
Skill Summary 93
Knowledge Assessment 94
Business Case Scenario 96
Lesson 4: Configuring File and Share Access 97
Designing a File-Sharing Strategy 98 Arranging Shares 98 Controlling Access 99 Mapping Drives 100
Creating Folder Shares 100
Assigning Permissions 108 Understanding the Windows Permission
Architecture 109 Understanding Basic and Advanced
Permissions 110 Allowing and Denying Permissions 111 Inheriting Permissions 112 Understanding Effective Access 114 Setting Share Permissions 115 Understanding NTFS Authorization 119 Assigning Basic NTFS Permissions 120 Assigning Advanced NTFS Permissions 123 Understanding Resource Ownership 126 Combining Share and NTFS Permissions 126
Configuring Volume Shadow Copies 127
Configuring NTFS Quotas 129
Skill Summary 130
Knowledge Assessment 131
Business Case Scenarios 133
Lesson 5: Configuring Print and Document Services 135
Deploying a Print Server 136 Understanding the Windows Print Architecture 136
Understanding Windows Printing 136 Windows Printing Flexibility 137
Sharing a Printer 141 Managing Printer Drivers 144 Using Remote Access Easy Print 145 Configuring Printer Security 146
Managing Documents 148 Managing Printers 150
Setting Printer Priorities 150 Scheduling Printer Access 151 Creating a Printer Pool 152
Using the Print and Document Services Role 153 Using the Print Management
Console 156 Adding Print Servers 156 Viewing Printers 158 Managing Printers and Print Servers 161 Deploying Printers with Group Policy 162
Skill Summary 164
Knowledge Assessment 165
Business Case Scenarios 168
Lesson 6: Configuring Servers for Remote Management 169
Using Server Manager for Remote Management 170 Adding Servers 171
Adding Workgroup Servers 174 Calibrating Server Manager Performance 174 Managing Windows Server 2012 Servers 175
Configuring WinRM 175 Configuring Windows Firewall 176
Managing Down-Level Servers 180 Creating Server Groups 183
Using Remote Server Administration Tools 184
Using Windows PowerShell Web Access 186 Installing Windows PowerShell Web Access 186 Configuring the Windows PowerShell Web Access
Gateway 188 Configuring a Test Installation 188 Customizing a Gateway Installation 189
Creating Authorization Rules 190
Working with Remote Servers 191
Skill Summary 192
Knowledge Assessment 193
Business Case Scenarios 196
xxvi | Contents
www.wiley.com/college/microsoft or
call the MOAC Toll-Free Number: 1+(888) 764-7001 (U.S. & Canada only)
Contents | xxvii
Lesson 7: Creating and Configuring Virtual Machine Settings 197
Virtualizing Servers 198 Virtualization Architectures 198 Hyper-V Implementations 199
Hyper-V Licensing 200 Hyper-V Hardware Limitations 200 Hyper-V Server 200
Installing Hyper-V 201
Using Hyper-V Manager 205 Creating a Virtual Machine 207 Installing an Operating System 213 Configuring Guest Integration Services 215 Allocating Memory 217
Using Dynamic Memory 218 Configuring Smart Paging 219
Configuring Resource Metering 220
Skill Summary 221
Knowledge Assessment 221
Business Case Scenarios 224
Lesson 8: Creating and Configuring Virtual Machine Storage 225
Working with Virtual Disks 226 Understanding Virtual Disk Formats 227 Creating Virtual Disks 227
Creating a Virtual Disk with a VM 227 Creating a New Virtual Disk 228 Adding Virtual Disks to Virtual Machines 232 Creating Differencing Disks 232
Configuring Pass-Through Disks 235 Modifying Virtual Disks 235 Creating Snapshots 239
Connecting to a SAN 240 Understanding SAN Technologies 242 Using Fibre Channel 242 Connecting Virtual Machines to a SAN 242
Skill Summary 244
Knowledge Assessment 245
Business Case Scenarios 247
Lesson 9: Creating and Configuring Virtual Networks 248
Using Virtual Networking 249 Creating Virtual Switches 249
Creating the Default Virtual Switch 249 Creating a New Virtual Switch 252 Configuring MAC Addresses 254
Creating Virtual Network Adapters 256 Using Synthetic Adaptors and Emulated
Adapters 258 Configuring Hardware Acceleration Settings 259 Configuring Advanced Network Adapter
Features 260 Creating Virtual Network Configurations 262
Extending a Production Network into Virtual Space 262
Creating an Isolated Network 262
Skill Summary 263
Knowledge Assessment 263
Business Case Scenarios 266
Lesson 10: Configuring IPv4 and IPv6 Addressing 267
Understanding IPv4 Addressing 268 IPv4 Classful Addressing 268
Subnetting Example 1 270 Classless Inter-Domain Routing 270
Subnetting Example 2 271 Public and Private IPv4 Addressing 272 Using Network Address Translation 273 Using a Proxy Server 273 IPv4 Subnetting 274 Supernetting 275 Assigning IPv4 Addresses 276
Manual IPv4 Address Configuration 276 Dynamic Host Configuration Protocol 278 Automatic Private IP Addressing (APIPA) 278
Understanding IPv6 Addressing 278 Introducing IPv6 279
Contracting IPv6 Addresses 279 Expressing IPv6 Network Addresses 279
IPv6 Address Types 279 Global Unicast Addresses 280 Link-Local Unicast Addresses 283
www.wiley.com/college/microsoft or
call the MOAC Toll-Free Number: 1+(888) 764-7001 (U.S. & Canada only)
xxviii | Contents
Unique Local Unicast Addresses 284 Special Addresses 284 Multicast Addresses 285 Anycast Addresses 286
Assigning IPv6 Addresses 286 Manual IPv6 Address Allocation 286 Stateless IPv6 Address Autoconfiguration 287 Dynamic Host Configuration Protocol v6 287
Planning an IP Transition 288 Using a Dual IP Stack 288 Tunneling 289
Configuring Tunnels Manually 289 Configuring Tunnels Automatically 290
Skill Summary 293
Knowledge Assessment 294
Business Case Scenarios 296
Lesson 11: Deploying and Configuring the DHCP Service 298
Understanding DHCP 299 DHCP Packets 300 DHCP Options 302
The Magic Cookie 302 The Option Format 302 The DHCP Message Type Option 303 The Pad Option 303 The Option Overload Option 303 The Vendor-Specific Information Option 303 The End Option 304 Other Configuration Options 304
DHCP Communications 305 DHCP Lease Negotiation 306 DHCP Lease Renewal 307
Designing a DHCP Infrastructure 308 Using a Distributed DHCP Infrastructure 309 Using a Centralized DHCP Infrastructure 309 Using a Hybrid DHCP Infrastructure 311 Regulating DHCP Network Traffic 311
Deploying a DHCP Server 312 Creating a Scope 313 Configuring DHCP Options 318 Creating a Reservation 319 Using PXE 320
Using PXE with WDS 321 Configuring a Custom DHCP Option 321
Deploying a DHCP Relay Agent 323
Skill Summary 328
Knowledge Assessment 329
Business Case Scenarios 332
Lesson 12: Deploying and Configuring the DNS Service 333
Understanding the DNS Architecture 334 Creating a DNS Standard 334 Understanding DNS Naming 336 Understanding The DNS Domain Hierarchy 337
Top-Level Domains 337 Second-Level Domains 339 Subdomains 339
Using DNS Messaging 340 Understanding DNS Communications 340 Comprehending DNS Server Caching 343
Negative Caching 344 Cache Data Persistence 344
Understanding DNS Referrals and Queries 345 Using DNS Forwarders 346 Understanding Reverse Name Resolution 347
Designing a DNS Deployment 348 Resolving Internet Names 349 Hosting Internet Domains 350 Hosting Active Directory Domains 350 Integrating DHCP and DNS 351 Separating DNS Services 351
Creating Internet Domains 352
Creating Internal Domains 353 Creating Subdomains 354 Combining Internal and External Domains 354 Creating Host Names 355
Deploying a DNS Server 356 Creating Zones 356
Using Active Directory-Integrated Zones 358 Creating an Active Directory Zone 358
Creating Resource Records 361 Configuring DNS Server Settings 364
Configuring Active Directory DNS Replication 364 Configuring Root Hints 365
Skill Summary 365
Knowledge Assessment 366
Business Case Scenarios 369
www.wiley.com/college/microsoft or
call the MOAC Toll-Free Number: 1+(888) 764-7001 (U.S. & Canada only)
Contents | xxix
Lesson 13: Installing Domain Controllers 370
Introducing Active Directory 371 Understanding Active Directory Functions 371 Understanding Active Directory Architecture 372
Understanding Objects and Attributes 372 Understanding Domains 373 Zooming In: Organizational Units 373 Zooming In: Groups 374 Zooming Out: Domain Trees 374 Zooming Out: Forests 375 Introducing the Global Catalog 376 Understanding Functional Levels 376
Understanding Active Directory Communications 377 Introducing LDAP 377 Understanding Replication 377 Using Read-Only Domain Controllers 378 Expanding Outward: Sites 379
Deploying Active Directory Domain Services 380 Installing the Active Directory Domain Services Role 380 Creating a New Forest 383 Adding a Domain Controller to an Existing Domain 387 Creating a New Child Domain in a Forest 389 Installing AD DS on Server Core 392 Using Install from Media (IFM) 393 Upgrading Active Directory Domain Services 395 Removing a Domain Controller 396 Configuring the Global Catalog 398 Troubleshooting DNS SRV Registration Failure 399
Skill Summary 400
Knowledge Assessment 401
Business Case Scenarios 404
Lesson 14: Creating and Managing Active Directory Users and Computers 405
Creating User Objects 406 Understanding User Creation Tools 407 Creating Single Users 408
Using Dsadd.exe 411 Using Windows PowerShell 412
Creating User Templates 413
Creating Multiple Users 415 Using Batch Files 415 Using CSVDE.exe 415 Using LDIFDE.exe 416 Using Windows PowerShell 417
Creating Computer Objects 417 Creating Computer Objects Using Active Directory
Users and Computers 418 Creating Computer Objects with Active Directory
Administrative Center 419 Creating Computer Objects Using Dsadd.exe 419
Managing Active Directory Objects 420 Managing Multiple Users 421 Joining Computers to a Domain 422
Joining a Domain Using Netdom.exe 423 Creating Computer Objects While Joining 423 Joining a Domain While Offline 424
Managing Disabled Accounts 425
Skill Summary 425
Knowledge Assessment 426
Business Case Scenarios 428
Lesson 15: Creating and Managing Active Directory Groups and Organizational Units 430
Designing an Internal Domain Structure 431 Understanding Inheritance 431 Using Organizational Units 432 Using Group Objects 433
Working with Organizational Units 433 Creating OUs 434 Using OUs to Delegate Active Directory
Management Tasks 435
Working with Groups 439 Understanding Group Types 440 Understanding Group Scopes 440
Domain Local Groups 440 Global Groups 441 Universal Groups 441
Working with Default Groups 441 Nesting Groups 445 Using Special Identities 446 Creating Groups 448
Creating Groups from the Command Line 449
www.wiley.com/college/microsoft or
call the MOAC Toll-Free Number: 1+(888) 764-7001 (U.S. & Canada only)
xxx | Contents
Managing Group Memberships 450 Managing Group Membership Using Group Policy 451 Managing Group Objects with Dsmod.exe 452
Converting Groups 453 Deleting a Group 454
Skill Summary 454
Knowledge Assessment 455
Business Case Scenarios 458
Lesson 16: Creating Group Policy Objects 460
Introducing Group Policy 461 Understanding Group Policy Objects 462
Local GPOs 462 Domain GPOs 463 Starter GPOs 463
Viewing the Group Policy Container 463 Viewing Group Policy Templates 465 Configuring a Central Store 466
Using the Group Policy Management Console 467 Creating and Linking Nonlocal GPOs 468 Using Security Filtering 471 Understanding Group Policy Processing 472
Processing Multiple GPOs 474 Applying GPO Settings 474 Configuring Exceptions to GPO Processing 475
Managing Starter GPOs 477 Configuring Group Policy Settings 478
Policy Explanations 479 Understanding Policy States 480 Searching Policies 481
Creating Multiple Local GPOs 481
Skill Summary 485
Knowledge Assessment 485
Business Case Scenarios 488
Lesson 17: Configuring Security Policies 489
Configuring Security Policies Using Group Policy 490 Defining Local Policies 491
Planning and Configuring an Audit Policy 491 Assigning User Rights 497
Configuring Security Options 498 Customizing Event Log Policies 500 Understanding Restricted Groups 501 Using Security Templates 502
Using the Security Templates Console 502 Planning a Security Template Strategy 503 Creating Security Templates 503 Working with Security Template Settings 504 Importing Security Templates into GPOs 504
Maintaining and Optimizing Group Policy 505 Manually Refreshing Group Policy 506 Optimizing Group Policy Processing 506
Configuring Local Users and Groups 507 Using the User Accounts Control Panel 507
Creating a New Local User Account 507 Using the Local Users and Groups Snap-In 510
Creating a Local Group 511
Configuring User Account Control 512 Performing Administrative Tasks 512 Using Secure Desktop 513 Configuring User Account Control Settings 514
Skill Summary 516
Knowledge Assessment 517
Business Case Scenarios 521
Lesson 18: Configuring Application Restricted Policies 522
Installing Software with Group Policy 523 Repackaging Software 524 Deploying Software Using Group Policy 524
Assigning an Application to a User or Computer 525 Publishing an Application 525 Customizing Software Installation Packages 530
Configuring Software Restriction Policies 533 Enforcing Restrictions 534 Configuring Software Restriction Rules 535
Hash Rules 536 Certificate Rules 536 Path Rules 536 Network Zone Rules 537 Using Multiple Rules 537
Configuring Software Restriction Properties 537 Enforcement 537 Designated File Types 538 Trusted Publishers 539
Software Restriction Best Practices 539
www.wiley.com/college/microsoft or
call the MOAC Toll-Free Number: 1+(888) 764-7001 (U.S. & Canada only)
Contents | xxxi
Using AppLocker 540 Understanding Rule Types 540 Creating Default Rules 542 Creating Rules Automatically 543 Creating Rules Manually 544
Skill Summary 545
Knowledge Assessment 546
Business Case Scenarios 549
Lesson 19: Configuring Windows Firewall 550
Building a Firewall 551 Understanding Windows Firewall Settings 551 Working with Windows Firewall 552
Using the Windows Firewall Control Panel 555 Customizing Settings 556 Allowing Applications 557
Using the Windows Firewall with Advanced Security Console 558 Configuring Profile Settings 559 Creating Rules 560 Importing and Exporting Rules 565 Creating Rules Using Group Policy 566 Using Filters 567 Creating Connection Security Rules 567
Skill Summary 570
Knowledge Assessment 570
Business Case Scenarios 573
Appendix A 574
Index 575
Installing Servers
1
7 0 - 4 1 0 E X A M O B J E C T I V E
Objective 1.1 – Install servers. This objective may include but is not limited to: Plan for a server installation; plan for server roles; plan for a server upgrade; install Server Core; optimize resource utilization by using Features on Demand; migrate roles from previous versions of Windows Server.
LESSON HEADING EXAM OBJECTIVE
Selecting a Windows Server 2012 Edition Plan for a server installation
Supporting Server Roles Plan for server roles
Supporting Server Virtualization
Server Licensing
Installing Windows Server 2012
System Requirements
Performing a Clean Installation
Installing Third-Party Drivers
Working with Installation Partitions
Choosing Installation Options
Using Server Core Install Server Core
Using the Minimal Server Interface
Using Features on Demand Optimize resource utilization by using Features on Demand
Upgrading Servers Plan for a server upgrade
Upgrade Paths
Preparing to Upgrade
Performing an Upgrade Installation
Migrating Roles Migrate roles from previous versions of Windows Server
Installing Windows Server Migration Tools
Using Migration Guides
1LESSON
2 | Lesson 1
K E Y T E R M S
cmdlets
physical operating system
environment (POSE)
Server Core
virtual operating system environment
(VOSE)
Windows PowerShell
WinSxS
When planning a server deployment, you should choose the operating system edition based on multiple factors, including the following:
• The roles you intend the servers to perform
• The virtualization strategy you intent to implement
• The licensing strategy you plan to use
Compared with Windows Server 2008, Microsoft has simplified the process of selecting a Windows Server 2012 edition by reducing the available products. As with Windows Server 2008 R2, Windows Server 2012 requires a 64-bit processor architecture. All 32-bit versions have been eliminated, and for the first time since the Windows NT Server 4.0 release, no build will be released supporting Itanium processors. This leaves Windows Server 2012 with the following core editions:
• Windows Server 2012 Datacenter: This edition is designed for large and powerful servers with up to 64 processors and fault-tolerance features such as hot add processor support. As a result, this edition is available only through the Microsoft volume-licensing program and from original equipment manufacturers (OEMs), bundled with a server.
• Windows Server 2012 Standard: This edition includes the full set of Windows Server 2012 features, varying from the Datacenter edition only by the number of virtual machine instances permitted by the license.
• Windows Server 2012 Essentials: This edition includes nearly all the features in the Standard and Datacenter editions, except for Server Core, Hyper-V, and Active Directory Federation Services. This edition is limited to one physical or virtual server instance and a maximum of 25 users.
• Windows Server 2012 Foundation: This reduced version of the operating system is designed for small businesses that require only basic server features such as file and print services and application support. This edition includes no virtualization rights and is limited to 15 users.
These various editions are priced commensurate with their capabilities. Obviously, your goal is to purchase the most inexpensive edition that provides all your needs. The following sections examine the primary differences between the Windows Server 2012 editions.
■ Selecting a Windows Server 2012 Edition
THE BOTTOM LINE
Microsoft releases all its operating systems in multiple editions, which provides consumers with various price points and feature sets.
CERTIFICATION READY Plan for a server installation. Objective 1.1
Installing Servers | 3
Computers running the Windows Server 2012 operating system can perform a wide variety of tasks, using both the software included with the product and third-party applications. The activities Windows Server 2012 performs for network clients are known as roles. After you install the Windows Server 2012 operating system, you can use Server Manager or Windows PowerShell to assign one or more roles to that computer.
The roles included with Windows Server 2012 fall into three basic categories:
• Directory services store, organize, and supply information about a network and its resources.
• Infrastructure services provide support services for network clients.
• Application services provide communications services, operating environments, or programming interfaces for specific applications.
Table 1-1 lists the roles that Microsoft supplies with Windows Server 2012.
Supporting Server Roles
Windows Server 2012 includes predefined combinations of services called roles that implement common server functions.
CERTIFICATION READY Plan for server roles. Objective 1.1
DIRECTORY SERVICES INFRASTRUCTURE SERVICES APPLICATION SERVICES
Active Directory Certificate Services implements certification authorities (CAs) and other services that facilitate the creation and man- agement of the public key certificates used by the identity and access con- trol elements of the Windows Server 2012 security infrastructure.
DHCP (Dynamic Host Configuration Protocol) Server provides network clients with dynami- cally assigned IP addresses and other TCP/IP configuration settings, such as subnet masks, default gateway addresses, and Domain Name System (DNS) server addresses.
Application Server provides an inte- grated environment for deploying and running server-based business applica- tions designed within (or expressly for) the organization, such as those requir- ing the services provided by Internet Information Services (IIS), Microsoft .NET Framework 2.0 and 3.0, COM1, ASP .NET, Message Queuing, or Windows Communication Foundation (WCF).
Active Directory Domain Services (AD DS) configure the server to func- tion as an Active Directory domain controller, which stores and manages a distributed database of network resourc- es and application-specific information.
DNS Server provides name-to- address and address-to-name resolu- tion services for AD DS and Internet clients. The Windows Server 2012 DNS server implementation also supports dynamic DNS and DHCP integration.
Fax Server enables you to manage fax devices and clients to send and receive faxes over the network.
Active Directory Federation Services create a single sign-on environment by implementing trust relationships that enable users on one network to access applications on other networks without providing a secondary set of logon credentials.
Hyper-V provides a hypervisor-based environment in which administrators can create virtual machines, each of which provides an isolated instance of the operating system environment.
File and Storage Services install tools and services that enhance Windows Server 2012’s basic ability to provide network clients with access to files stored on server drives, including Distributed File System (DFS), DFS Replication, Storage Manager for Storage Area Networks (SANs), fast file searching, and file ser- vices for UNIX clients.
Table 1-1
Windows Server 2012 Server Roles
(continued)
4 | Lesson 1
Some Windows Server 2012 editions include all these roles, whereas others include only some of them. Selecting the appropriate edition of Windows Server has always been a matter of anticipating the roles that the computer must perform. At one time, this was a relatively sim- ple process. You planned your server deployments by deciding which ones would be domain controllers, which ones would be web servers, and so forth. After you made these decisions, you were done, because server roles were largely static.
With the increased focus on virtualization in Windows Server 2012, however, more adminis- trators must consider not only what roles servers must perform at the time of the deployment, but also what roles they will perform in the future.
By using virtualized servers, you can modify your network’s server strategy at will to accommodate changing workloads and business requirements, or to adapt to unforeseen
DIRECTORY SERVICES INFRASTRUCTURE SERVICES APPLICATION SERVICES
Table 1-1
(continued)
Active Directory Lightweight Directory Services (AD LDS) imple- ment a Lightweight Directory Access Protocol (LDAP) directory service that provides support for directory-enabled applications without incurring the extensive overhead of AD DS.
Network Policy and Access Services (NPAS) implement services such as Network Policy Server (NPS), Health Registration Authority (HRA), and Host Credential Authorization Protocol (HCAP), which enforce secu- rity policies for network users.
Print and Document Services provides clients with access to printers attached to the server or to the net- work, as well as centralized network printer and print server management, and printer deployment using Group Policy. Document services enable you to route images from network- attached scanners to users.
Active Directory Rights Management Services (AD RMS) make up a client/server system that uses certificates and licensing to implement persistent usage policies, which can control access to informa- tion, no matter where a user moves it.
Remote Access provides remote users with access to network resources by using DirectAccess and VPNs, as well as LAN and NAT routing services.
Remote Desktop Services enable clients on the network or on the Internet to access server-based appli- cations remotely or the entire Windows desktop by using server resources.
Volume Activation Services auto- mate the management of Microsoft host keys and Key Management System (KMS) hosts.
Web Server (IIS) installs Internet Information Services (IIS) 7.5, which enables the organization to publish websites and web-based applications for use by intranet, extranet, and/or Internet clients.
Windows Deployment Services (WDS) enable you to install Windows operating systems remotely on com- puters throughout the enterprise.
Windows Server Update Services (WSUS) automate the process of dis- seminating operating-system updates to Windows computers throughout the enterprise.
Installing Servers | 5
circumstances. Therefore, the process of anticipating the roles servers will perform must account for the potential expansion of your business, as well as possible emergency needs.
Table 1-2 lists the roles included with the various Windows Server 2012 editions.
ROLE DATACENTER STANDARD FOUNDATION ESSENTIALS
Active Directory Certificate Services
Yes Yes Limited to CA creation
Limited to CA creation
Active Directory Domain Services
Yes Yes Forest and domain root only
No
Active Directory Federation Services
Yes Yes No No
Active Directory Lightweight Directory Services
Yes Yes Yes No
Active Directory Rights Management Services
Yes Yes Yes No
Application Server Yes Yes Yes Yes
DHCP Server Yes Yes Yes Yes
DNS Server Yes Yes Yes Yes
Fax Server Yes Yes Yes Yes
File and Storage Services
Yes Yes Yes (DFS limited)
Yes (DFS limited)
Hyper-V Yes Yes No No
Network Policy and Access Services
Yes Yes Yes (Limited connections)
Print and Document Services
Yes Yes Yes Yes
Remote Access Yes Yes Yes No
Remote Desktop Services
Yes Yes Yes (Limited connections)
Yes (Limited connections)
Volume Activation Services
Yes Yes Yes No
Web Server (IIS) Yes Yes Yes Yes
Windows Deployment Services
Yes Yes Yes Yes
Windows Server Update Services
Yes Yes Yes Yes
Table 1-2
Roles Included in Windows Server 2012 Editions
6 | Lesson 1
Supporting Server Virtualization
The Windows Server 2012 Datacenter and Standard editions both include support for Hyper-V, but they vary in the number of virtual machines permitted by their licenses.
Server Licensing
Microsoft provides several different sales channels for Windows Server 2012 licenses, and not all editions are available through all the channels. Licensing Windows Server 2012 includes purchasing licenses for both servers and clients, and each one has many options.
Each running instance of the Windows Server 2012 operating system is classified as being in a physical operating system environment (POSE) or a virtual operating system environ- ment (VOSE). A POSE is a physical computer with its own hardware, and a VOSE is a vir- tual machine running on a Hyper-V server with virtualized hardware. When you purchase a Windows Server 2012 license, you can perform a POSE installation of the operating system, as always. After installing the Hyper-V role, you can then create virtual machines (VMs) and perform VOSE installations on them. The number of VOSE installations permitted by your license depends on the edition you purchased, as shown in Table 1-3.
If you are already involved in a licensing agreement with Microsoft, you should be aware of the server editions available to you through that agreement. If you are not, you should inves- tigate the licensing options available to you before you select a server edition.
Table 1-4 lists the sales channels through which you can purchase each Windows Server 2012 edition.
Table 1-3
Physical and Virtual Instances Supported by Windows Server 2012 Editions
EDITION POSE INSTANCES VOSE INSTANCES
Datacenter 1 Unlimited
Standard 1 2
Foundation 1 0
Essentials 1 (POSE or VOSE) 1 (POSE or VOSE)
Table 1-4
Windows Server Sales Channel Availability, by Edition
ORIGINAL VOLUME EQUIPMENT RETAIL LICENSING MANUFACTURER
Datacenter No Yes Yes
Standard Yes Yes Yes
Foundation No No Yes
Essentials Yes Yes Yes
TAKE NOTE* The limitations specified in Table 1-3 are those of the license, not the soft- ware. For example, you can create more than four VMs on a copy of Windows Server 2012 Enterprise, but you must purchase additional licenses to do so.
Installing Servers | 7
The licensing structure for Windows Server 2012 is considerably simpler than it has been in previous versions of the operating system. The licenses you need to purchase for a given server installation are affected by the following criteria:
• Processors—Both the Datacenter and the Standard edition come with a license that supports up to two physical processors. To run either one on a computer with more than two processors, you must purchase additional licenses.
• Virtual instances—The Standard edition license supports one physical instance and as many as two virtual operating system instances on a Hyper-V installation. If you want to create more than two virtual machines running Windows Server 2012 Standard, you must purchase additional licenses at the rate of two virtual instances per license. The Datacenter edition supports an unlimited number of virtual instances. The Essentials license enables you to install the operating system on one physical computer or one vir- tual machine, but not both. The Foundation license includes no virtual instances.
• Clients—The Foundation license supports up to 15 users and the Essentials edition up to 25 users. For the Standard and Datacenter editions, you must purchase client access licenses (CALs).
If a computer is brand new and has no operating system installed on it, it cannot start until you supply a boot disk, such as a Windows Server 2012 installation disk. During installation, you select the disk partition on which you want to install the operating system, and the Setup program copies the operating system files there.
■ Installing Windows Server 2012
THE BOTTOM LINE
A clean installation is the simplest way to deploy Windows Server 2012 on a bare metal computer—that is, a computer with no operating system installed—or a computer with a partition that you are willing to reformat (losing all the data on the partition in the process).
System Requirements
Choosing the correct hardware for a server requires an understanding of the tasks it will perform.
As of this writing, the minimum system requirements for all editions of Windows Server 2012 are as follows:
• 1.4 GHz 64-bit processor
• 512 MB RAM
• 32 GB disk space
• DVD or USB flash drive
• Super VGA (800x600) or higher resolution monitor
Having 32 GB of available disk space should be considered an absolute minimum. The sys- tem partition needs extra space if you install the system over a network or your computer has more than 16 GB of RAM installed. The additional disk space is required for paging, hiber- nation, and dump files. In practice, you are unlikely to come across a computer with
8 | Lesson 1
32 GB RAM and only 32 GB disk space. If you do, free more disk space or invest in addi- tional storage hardware.
Not until you have decided how you will deploy your applications and what roles an applica- tion server will perform should you begin selecting the hardware that goes into the computer. Suppose that your organization decides to deploy an application suite such as Microsoft Office on all company workstations. If you decide to install the applications on each indi- vidual workstation, each computer must have sufficient memory and processor speed to run them efficiently. The application servers on the network then has to perform only relatively simple roles, such as file and print services, which do not require enormous amounts of server resources.
By contrast, if you decide to deploy the applications using Remote Desktop Services, you can use workstations with a minimal hardware configuration, because the servers take most of the burden. In this case, you need a more powerful application server in terms of processor and memory, or perhaps even several servers sharing the client load.
Server roles can also dictate requirements for specific subsystems within the server computers, as in the following examples:
• Servers hosting complex applications might require more memory and faster processors.
• File servers can benefit from disk arrays and hard drives with higher speeds and larger caches, or even a high performance drive interface, such as SCSI (Small Computer System Interface, pronounced “scuzzy”).
• Web servers receiving large amounts of traffic might need higher-end network adapters or multiple adapters to connect to different subnets.
• Streaming media servers require sufficient hardware in all subsystems, because any per- formance bottleneck in the server can interrupt the client’s media experience.
Enterprises with extensive server requirements might want to consider specialized server hard- ware, such as a storage area network, network attached storage, or a server cluster.
As part of Microsoft’s increased emphasis on virtualization and cloud computing in its server products, the company has increased the maximum hardware configurations significantly for Windows Server 2012. Table 1-5 lists these maximums.
Table 1-5
Maximum Hardware Configurations in Windows Server Versions
WINDOWS SERVER 2012 WINDOWS SERVER 2008 R2
Logical Processors 640 256
RAM 4 terabytes 2 terabytes
Failover cluster nodes 63 16
Performing a Clean Installation
A clean installation can be the basis for a new server, or the initial phase of a server migration.
To perform a clean installation of Windows Server 2012, use the following procedure.
TAKE NOTE* The Traditional Chinese version of Windows Server 2012 (ZH-TN) does not install correctly on a computer with only 512 MB of RAM—either a physical computer or a virtual machine. In practice, the next readily available physical RAM size is 1 GB.
Installing Servers | 9
PERFORM A CLEAN INSTALLATION
GET READY. Prepare the computer for the Windows Server 2012 installation by making sure that all its external peripheral devices are connected and powered on.
1. Turn on the computer and insert the Windows Server 2012 installation disk into
the DVD drive.
2. Press any key to boot from the DVD (if necessary). A progress indicator screen
appears as Windows is loading fi les.
MORE INFORMATION
The device that a PC uses to boot is specified in its system (or BIOS) settings. In some cases, you might have to
modify these settings to enable the computer to boot from the Windows Server 2012 DVD. If you are not familiar
with the operation of a particular computer, watch the screen carefully as the system starts and look for an instruc-
tion specifying what key to press to access the system settings.
✚
The computer loads the Windows graphical interface and the Windows Setup page
appears, as shown in Figure 1-1.
3. By using the drop-down lists provided, select the appropriate language to install,
time and currency format, and keyboard or input method, and then click Next. The
Windows Setup page appears, as shown in Figure 1-2.
4. Click Install Now. The Windows Setup Wizard appears, displaying the Select the
operating system you want to install page, as shown in Figure 1-3.
5. Select the operating system edition and installation option you want to install and
click Next. The License Terms page appears.
Figure 1-1
The Windows Setup page
10 | Lesson 1
6. Select the I accept the license terms check box and click Next. The Which type of installation do you want? page appears, as shown in Figure 1-4.
Figure 1-2
The Window Setup page
Figure 1-3
The Select the operating system you want to install page
Installing Servers | 11
Figure 1-4
The Which type of installation do you want? page
Figure 1-5
The Where do you want to install Windows? page
7. Because you are performing a clean installation and not an upgrade, click the
Custom: Install Windows Only (advanced) option. The Where do you want to install Windows? page appears, as shown in Figure 1-5.
12 | Lesson 1
8. From the list provided, select the partition on which you want to install Windows
Server 2012, or select an area of unallocated disk space where the Setup program
can create a new partition. Then click Next. The Installing Windows page appears.
9. After several minutes, during which the Setup program installs Windows Server
2012, the computer restarts and the Settings page appears, as shown in Figure 1-6.
Figure 1-6
The Settings page
10. In the Password and Reenter Password text boxes, type the password to be asso-
ciated with the Administrator account and press Enter. The system fi nalizes the installation and the Windows sign-on screen appears, as shown in Figure 1-7.
Figure 1-7
The Windows sign-on screen
Installing Servers | 13
INSTALL A THIRD-PARTY DISK DRIVER
GET READY. If during a Windows Server 2012 installation no disk partitions or unallocated space appear on the Where do you want to install Windows? page, you must install the appro- priate driver for your disk controller using the following procedure before the installation can continue.
1. On the Where do you want to install Windows? page, click the Load Driver button.
A Load Driver message box appears, as shown in Figure 1-8.
During the Windows Server 2012 installation procedure, the Setup program enables you to select the partition or area of unallocated disk space where you want to install the operating system. The Where do you want to install Windows? page lists the partitions on all the com- puter’s disk drives that the Setup program can detect with its default drivers. In most cases, all the computer’s drives should appear in the list; if they do not, it is probably because Windows does not include a driver for the computer’s drive controller.
If the computer’s hard drives are connected to a third-party controller, rather than the one integrated into most motherboards, the list of partitions might appear empty, and you have to supply a driver for the Setup program to see the drives. Check the controller manufacturer’s website for a driver supporting Windows Server 2012, or another recent version of Windows Server.
To install the driver, use the following procedure.
In some cases, it might be necessary to install a driver supplied by a hardware manufac- turer before the disks in the computer appear in the setup program.
Installing Third-Party Drivers
Figure 1-8
The Load Driver message box
2. Insert the storage medium containing the driver into the computer. You can supply
drivers on a CD, DVD, fl oppy disk, or USB fl ash drive.
3. Click OK if the driver is in the root directory of the storage medium, or Browse if
you need to locate the driver in the directory structure of the disk. A list of the
drivers found on the disk appears on the Select the driver to install page.
4. Select one of the drivers in the list and click Next.
5. When the driver loads, the partitions and unallocated space on the associated disks
appear in the list on the Where do you want to install Windows? page.
6. Select the partition or area of unallocated space where you want to install Win-
dows Server 2012 and then continue with the rest of the installation procedure, as
covered earlier in this lesson.
14 | Lesson 1
Clicking the Drive options (advanced) button on the page causes four additional buttons to appear, as shown in Figure 1-9. These buttons have the following functions:
• Delete removes an existing partition from a disk, permanently erasing all its data. You might want to delete partitions to consolidate unallocated disk space, enabling you to create a new, larger partition.
• Extend enables you to make an existing partition larger, as long as unallocated space is available immediately following the selected partition on the disk.
• Format enables you to format an existing partition on a disk, thereby erasing all its data. You do not need to format any new partitions you create for the install, but you might want to format an existing partition to eliminate unwanted files before installing Windows Server 2012 on it.
• New creates a new partition of a user-specified size in the selected area of unallocated space.
In addition to installing disk drivers, the Where do you want to install Windows? page enables you to create, manage, and delete the partitions on your disks.
Working with Installation Partitions
Figure 1-9
Additional buttons on the Where do you want to install Windows? page
■ Choosing Installation Options
THE BOTTOM LINE
Many enterprise networks today use servers dedicated to a particular role. When a server is performing a single role, does it really make sense to have so many other processes running on the server that contribute little to that role?
Installing Servers | 15
• Reduced disk space: Server Core requires less disk space for the installed operating sys- tem elements, as well as less swap space, which maximizes the utilization of the server’s storage resources.
• Reduced patch frequency: Windows Server 2012’s graphical elements are among the most frequently patched features, so running Server Core reduces the number of patches that you must apply. Fewer patches also mean fewer server restarts and less downtime.
• Reduced attack surface: The less software there is running on the computer, the fewer entrances are available for attackers to exploit. Server Core reduces the potential open- ings presented by the operating system, increasing its overall security.
Many IT administrators today are so accustomed to graphical user interfaces (GUIs) that they are unaware that there was ever any other way to operate a computer. When the first version of Windows NT Server appeared in 1993, many complained about wasting server resources on graphical displays and other elements that they deemed unnecessary. Up until that time, server displays were usually minimal, character-based, monochrome affairs. In fact, many servers had no display hardware at all, relying instead on text-based remote administration tools, such as Telnet.
Using Server Core
Windows Server 2012 includes an installation option that addresses those old complaints about wasting server resources on graphical displays.
When you select the Windows Server Core installation option, you get a stripped-down ver- sion of the operating system. There is no Start menu, no desktop Explorer shell, no Microsoft Management Console, and virtually no graphical applications. All you see when you start the computer is a single window with a command prompt, as shown in Figure 1-10.
The advantages of running servers using Server Core are several:
• Hardware resource conservation: Server Core eliminates some of the most memory- and processor-intensive elements of the Windows Server 2012 operating system, thus devoting more of the system hardware to running essential services.
CERTIFICATION READY Install server core. Objective 1.1
TAKE NOTE* Server Core is not a separate product or edition. It is an instal- lation option included with the Windows Server 2012 Standard, Enterprise, and Datacenter editions.
Figure 1-10
The default Server Core interface
16 | Lesson 1
When Microsoft first introduced the Server Core installation option in Windows Server 2008, the idea was intriguing, but few administrators took advantage of it. The main reason for this was that most server administrators were not sufficiently conversant with the command-line interface to manage a Windows server without a GUI.