Lesson 1 — Windows Server Intro & Roles

Main Dashboard Areas

• Dashboard — Health summary: events, services, performance alerts, and BPA results across all managed servers
• Local Server — Computer name, domain, IP addresses, Windows Update, Windows Firewall, Remote Desktop status, and product ID. Most initial-config tasks happen here.
• All Servers — Add remote servers for centralized management. Requires WinRM and appropriate firewall rules.
• Roles nodes — Each installed role (AD DS, DNS, DHCP, IIS, etc.) gets its own node with role-specific status and links to management tools.
• Features — Manage optional Windows features (RSAT tools, Telnet client, .NET frameworks, BitLocker, etc.)

1. Open Server Manager → click Manage → Add Roles and Features
2. Before you begin — Read prerequisites; click Next
3. Installation type — Select Role-based or feature-based installation (most common). The other option is Remote Desktop Services scenario-based installation.
4. Server selection — Choose the target server from the server pool (local or remote)
5. Server Roles — Check the box for the role(s) you want. The wizard automatically offers to add required role services and features.
6. Features — Additional optional features independent of specific roles (e.g., RSAT tools, Windows Server Backup)
7. Role-specific pages — Some roles (IIS, AD DS, RDS) show extra configuration screens
8. Confirmation — Review selections. Optionally check Restart the destination server automatically if required
9. Click Install. Progress bar appears; most roles install in under 2 minutes.

Step 1: Set Hostname

In Server Manager → Local Server → click the Computer Name link, or via PowerShell:

Rename-Computer -NewName "SRV-DC01" -Restart

Step 2: Configure Static IP Address

# Find the interface index
Get-NetAdapter

# Set static IP, subnet mask, gateway, and DNS
New-NetIPAddress -InterfaceIndex 5 -IPAddress 192.168.1.10 -PrefixLength 24 -DefaultGateway 192.168.1.1
Set-DnsClientServerAddress -InterfaceIndex 5 -ServerAddresses ("192.168.1.10","8.8.8.8")

# Verify
Get-NetIPAddress -AddressFamily IPv4 | Select-Object InterfaceAlias, IPAddress, PrefixLength

Step 3: Configure Windows Update

# Check pending updates (requires PSWindowsUpdate module or WSUS)
# Via Settings: Start → Settings → Update & Security → Windows Update
# PowerShell (requires NuGet + PSWindowsUpdate module):
Install-PackageProvider -Name NuGet -Force
Install-Module -Name PSWindowsUpdate -Force
Get-WindowsUpdate
Install-WindowsUpdate -AcceptAll -AutoReboot

Step 4: Configure Windows Firewall

# Check firewall status on all profiles
Get-NetFirewallProfile | Select-Object Name, Enabled

# Enable firewall on all profiles (should already be on)
Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True

Step 5: Enable Remote Desktop

# Enable RDP
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" -Value 0

# Create firewall rule to allow RDP inbound
Enable-NetFirewallRule -DisplayGroup "Remote Desktop"

# Allow RDP through firewall (if rule missing)
New-NetFirewallRule -DisplayName "Allow RDP" -Direction Inbound -Protocol TCP -LocalPort 3389 -Action Allow

Step 6: Set Time Zone

Set-TimeZone -Name "Eastern Standard Time"
# List all available time zones:
Get-TimeZone -ListAvailable | Where-Object {$_.Id -like "*Pacific*"}

Once RDP is enabled, connect from any Windows machine using mstsc.exe:

# Launch Remote Desktop Connection (from Run dialog or Start)
mstsc.exe

# Connect directly to a specific server
mstsc /v:192.168.1.10

# Connect with specific resolution
mstsc /v:SRV-DC01.lab.local /w:1920 /h:1080

# Full-screen mode
mstsc /v:SRV-DC01 /f

Windows Admin Center (WAC) is a browser-based, zero-additional-cost management tool introduced with Server 2019. It replaces many MMC snap-ins with a modern web interface.

• Download: microsoft.com/en-us/windows-server/windows-admin-center
• Install on: Windows 10/11 PC (gateway mode) or Windows Server (for remote management of other servers)
• Port: HTTPS on port 443 (or custom port you choose during setup)
• Capabilities: Server management, Hyper-V VM management, storage, networking, certificates, events, PowerShell console, Azure hybrid integration, extensions marketplace

# Install WAC silently (run on the gateway server)
# Download MSI from Microsoft, then:
msiexec /i WindowsAdminCenter.msi /qn /L*v log.txt SME_PORT=443 SSL_CERTIFICATE_OPTION=generate

# After install, access via browser:
# https://servername or https://localhost (if installed locally)

Server Core is a minimal Windows Server installation with no GUI (no Explorer, no desktop, no Server Manager GUI). Management is done entirely through PowerShell, command-line tools, or remotely via WAC/MMC.

• Benefits: ~60% smaller attack surface, less memory usage (~1GB RAM vs ~2GB GUI), fewer updates required, smaller disk footprint
• Drawback: All administration must be done via CLI or remote tools
• Switch between GUI and Core: Install or remove the Server-Gui-Shell feature

# On Server Core — initial config with sconfig.cmd (menu-driven)
sconfig

# Or via PowerShell directly on Server Core:
# Set hostname
Rename-Computer -NewName "SRV-CORE01" -Restart

# Set IP
New-NetIPAddress -InterfaceIndex 3 -IPAddress 192.168.1.20 -PrefixLength 24 -DefaultGateway 192.168.1.1

# Enable PowerShell remoting (so you can manage it from another PC)
Enable-PSRemoting -Force

# Install a role on Server Core (same cmdlets, no GUI wizard):
Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools

MMC is the framework that hosts most Windows administrative tools as "snap-ins". Type any of these in the Run dialog (Win+R):

Event Viewer (eventvwr.msc) is the primary tool for reviewing what happened on a server. Understanding the log structure is essential for troubleshooting.

Windows Logs

Custom Views

Custom Views let you create filtered log views across multiple logs:

# PowerShell — query Event Viewer logs
# Get last 10 failed logon attempts
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 10 |
  Select-Object TimeCreated, Message | Format-List

# Get all critical and error events from System log in last 24 hours
$start = (Get-Date).AddHours(-24)
Get-WinEvent -FilterHashtable @{LogName='System'; Level=1,2; StartTime=$start} |
  Select-Object TimeCreated, LevelDisplayName, Message | Format-Table -Wrap

Task Scheduler (taskschd.msc) runs programs, scripts, or commands at specified times or in response to events.

Creating a Basic Task via GUI

1. Open Task Scheduler → Action → Create Basic Task
2. Name and description → Next
3. Trigger: Daily / Weekly / Monthly / One time / At startup / At logon / On event
4. Action: Start a program (specify program path and arguments)
5. Finish → task appears in Task Scheduler Library

PowerShell Task Scheduling

# Create a scheduled task to run a backup script daily at 2 AM
$action = New-ScheduledTaskAction -Execute "PowerShell.exe" `
  -Argument "-NonInteractive -WindowStyle Hidden -File C:\Scripts\backup.ps1"

$trigger = New-ScheduledTaskTrigger -Daily -At "2:00AM"

$settings = New-ScheduledTaskSettingsSet -RunOnlyIfNetworkAvailable `
  -WakeToRun -StartWhenAvailable

$principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount -RunLevel Highest

Register-ScheduledTask -TaskName "Daily Backup" -Action $action `
  -Trigger $trigger -Settings $settings -Principal $principal -Description "Nightly backup job"

# Manage tasks
Get-ScheduledTask | Where-Object {$_.State -eq "Ready"} | Select-Object TaskName, LastRunTime
Start-ScheduledTask -TaskName "Daily Backup"
Disable-ScheduledTask -TaskName "Daily Backup"
Unregister-ScheduledTask -TaskName "Daily Backup" -Confirm:$false