Networking with Windows Server 2008 R2

Active Directory: Improving and Automating Identity and Access

2011-04-28T00:33:00.000-07:00

Active Directory: Improving and Automating Identity and Access

    1. Using Windows PowerShell with Active Directory 66
      2. Selecting Functional Levels in Windows Server 2008 R2 78
      3. Active Directory Recycle Bin: Recovering Deleted Objects 82
      4. Offline Domain Join: Securing and Facilitating Deployment 86
      5. Service Accounts 87
      6. Best Practices Analyzer 88

For the Windows Server 2008 release, Microsoft consolidated and renamed its various
identity and access services to create the following five roles:
    1. Active Directory Certificate Services (AD CS)
    2. Active Directory Domain Services (AD DS)
    3. Active Directory Federation Services (AD FS)
    4. Active Directory Lightweight Directory Services (AD LDS)
    5. Active Directory Rights Management Services (AD RMS)
For Windows Server 2008 R2, these five roles remain in place and the visible Active
Directory infrastructure is functionally the same. You can still install the roles the same
way, by using Server Manager or Windows Optional Component Setup (Ocsetup.exe)
from the command line, although the Add Roles Wizard now requires you to install the
Microsoft .NET Framework 3.5.1 feature with Active Directory Domain Services, Active
Directory Lightweight Directory Services, and Active Directory Rights Management
Services roles. This requirement is to support the new Active Directory Web Services
module.
Note For more information on Active Directory Web Services, see the section “Introducing
Active Directory Web Services,” later in this chapter.

Once you have installed the Active Directory roles you need, you will find that all of the
familiar Active Directory objects and attributes are still the same, and all of your familiar
tools are still there. However, although the Active Directory roles in Windows Server 2008 R2
appear to be the same as those in Windows Server 2008, there are some substantial innovations
beneath the surface, particularly in the area of Active Directory administration.
The R2 release includes a new set of tools for managing Active Directory from Windows
PowerShell, a new graphical management utility that is based on those same Windows
PowerShell
cmdlets, and a long-requested mechanism for restoring Active Directory objects
that administrators have inadvertently deleted. There is also a new facility for joining workstations
to an AD DS domain when they do not have access to a domain controller, and an
Active Directory implementation of the Best Practices Analyzer (BPA) technology that should
be familiar to administrators of Microsoft Exchange Server.
These are all improvements that administrators can avoid entirely, if they so desire. You can
skip right over this chapter if you want to and continue to work with Active Directory the way
you always have on your new Windows Server 2008 R2 servers, and everything will function
just as it always has. However, if you choose to persevere and examine these new features,
you might find yourself approaching your Active Directory management tasks in a completely
new and better way. You might even learn to love the command prompt.

Using Windows PowerShell with Active Directory:

      As in many other areas of its operating system, Windows Server 2008 R2 leverages Windows
PowerShell as a major new management tool for Active Directory. Windows Server 2008
R2 includes no fewer than 85 new cmdlets for AD DS and AD LDS, which are designed to
replace the existing (non–Windows PowerShell) command prompt tools, such as Dsget.exe, Dsmod.
exe, and Dsadd.exe. For administrators not comfortable working from the command
prompt, Windows Server 2008 R2 also includes Active Directory Administrative Center
(ADAC), a new management console that provides a graphical interface to the functionality of
the Windows PowerShell cmdlets.

Using Active Directory Module for Windows PowerShell:

      You have already read about the enhanced capabilities of Windows PowerShell 2.0 in Chapter
1, “What’s New in Windows Server 2008 R2,” and you have seen some of what Windows
PowerShell can do with Hyper-V and Remote Desktop Services in Chapter 3, “Hyper-V: Scaling
and Migrating Virtual Machines,” and Chapter 4, “Remote Desktop Services and VDI: Centralizing
Desktop and Application Management.” Another major innovation in Windows Server
2008 R2 is the ability to use Windows PowerShell cmdlets to manage the AD DS and AD LDS
roles.
Using Windows PowerShell with Active Directory
Windows Server 2008 R2 implements the cmdlets for Active Directory management as a
Windows PowerShell module called ActiveDirectory. A Windows PowerShell 2.0 module is a
self-contained unit consisting of cmdlets, scripts, or other code that you must import into a
Windows PowerShell session before you can access its features.

Importing the Active Directory Module:

      When you add the AD DS or AD LDS role on a computer running Windows Server 2008 R2,
the system installs the Active Directory Module for Windows PowerShell and creates a shortcut
with the same name in the Administrative Tools program group. This shortcut launches
the Windows PowerShell environment and uses the Import-Module cmdlet to load the Active
Directory module. You can also import the module manually from a standard Windows
PowerShell
prompt by using the following command:
Import-Module ActiveDirectory
Once you have imported the module, the Active Directory cmdlets it contains become
available, but only within that Windows PowerShell session. If you open up another Windows
PowerShell window (without importing the module), the Active Directory cmdlets are not
available in that session.

Using the Active Directory Module Cmdlets:

      Active Directory Module for Windows PowerShell contains 90 cmdlets not found in a standard
Windows PowerShell session. Most (but not all) of the cmdlets in the module include the
initials AD as part of their names, so you can list them using the following command:
Get-Command *-AD*
The Active Directory cmdlets, which you can use individually or combine using the standard
PowerShell piping techniques, provide almost universal administrative access to AD DS
and AD LDS resources. For example, to create new AD DS objects, you can use any of the
following cmdlets:
1. New-ADUser
2. New-ADComputer
3. New-ADGroup
4. New-ADOrganizationalUnit
5. New-ADObject
Each of these cmdlets supports parameters representing the possible attributes of the new
object. For example, the New-ADUser cmdlet has 60 possible parameters, as shown in Figure
5-1, generated by the Get-Help New-ADUser command.

        Figure 5-1 Command-line parameters for the New-ADUser cmdlet.

These parameters not only enable you to create a new object, but you can also specify
values for many of the object’s attributes using a single command, such as in the following
example:
New-ADUser –Name “Mark Lee” -SamAccountName “MarkLee” -GivenName “Mark”
-Surname “Lee” -DisplayName “Mark Lee” -Path ‘CN=Users,DC=example,DC=local’
-OfficePhone “717-555-1212” -Title “Account Manager”
-EmailAddress “mlee@example.com” -ChangePasswordAtLogon $true
Consider how many different processes you would have to perform and how many screens
you would have to access to create the user object for Mark Lee and set all the attributes
defined in this example using the Active Directory Users and Computers console. For custom
attributes, and those not specifically covered by a cmdlet’s parameters, you can use the
–OtherAttributes parameter, and to create objects not explicitly supported by a cmdlet, you
can use New-ADObject, and specify the type of object you want to create.
Of course, for any serious Windows PowerShell user, command-line parameters are only
one way to specify attribute values when creating a new object with the New-ADUser cmdlet.
Another possible method is to use an existing object as a template. When you specify the
name of the object you want to use as a template on the New-ADUser command line, using
the –instance parameter, the system copies all of the attribute values from the template to
the new object, except for those overridden by other parameters on the command line.
Yet another method, suitable for creating multiple Active Directory objects using a single
command, is to create a comma-separated value (CSV) file containing a list of the objects you
want to create and their attribute values. You can then use the Import-CSV cmdlet to pipe the
contents of the CSV file to the New-ADObject cmdlet, and the system will create each object
listed in the file in turn.
In addition to cmdlets for creating Active Directory objects, there are also cmdlets for
manipulating them, such as the following examples:
   1. Set-ADObject Modifies the properties of an Active Directory object
   2. Get-ADObject Gets or performs a search to retrieve one or more Active Directory
objects
   3. Move-ADObject Moves an Active Directory object or container from one container
to another or from one domain to another
   4. Restore-ADObject Restores a deleted Active Directory object
   5. Rename-ADObject Renames an Active Directory object
   6. Remove-ADObject Removes an Active Directory object
A comprehensive treatise on managing Active Directory using the capabilities provided by
the Active Directory Module for Windows PowerShell could easily fill this book. The preceding
are some extremely basic examples of how, with a little study and a little practice, you
can learn to enhance and streamline the processes by which you perform your regular Active
Directory management tasks, using the tools provided in Windows Server 2008 R2.

License Server Assignment and Activation

2011-04-25T13:27:00.000-07:00

Licensing:

     The Remote Desktop Services role and its role services are included as part of the standard
Windows Server license and do not require any additional licenses. The RD Session Host
license is also covered by the Windows Server license with the same considerations as any
other Hyper-V host.
Each user or device that directly or indirectly accesses a computer running Windows
Server to interact with a remote graphical user interface (using the Windows Server 2008 R2
RDS functionality or other technology) must have a Windows Server 2008 RDS Client Access
License (CAL) in addition to the Windows Server CAL. RDS functionality is considered those
features or services that are enabled with the RDS role and/or role service(s) in Windows
Server 2008 R2. This includes, but is not limited to, RD Gateway, RemoteApp, RD Web Access,
and RD Connection Broker.
RDS CALs are available as Per User or Per Device CALs. RD Session Host servers are configured
for Per Device or Per User mode, and require an appropriate RDS CAL for access.
Licensing
Each Per Device RDS CAL allows one device to connect to the RDS resources, regardless
of how many users use the device. Conversely, a Per User RDS CAL allows a single user access
to the RDS resources from as many devices as he or she happens to have. Companies should
carefully consider their users and the type of devices and access they need to RDS resources
before purchasing CALs and deciding what mode RD Session Host servers will use.
Windows Server 2008 R2 RDS CALs and Windows Server 2008 TS CALs are equivalent and
can be used interchangeably. However, RDS CALs can only be managed from Windows Server
2008 SP2 Terminal Server License servers or Windows Server 2008 R2 RD License servers. The
RD Licensing Manager, shown in Figure 4-13, adds important new capabilities, including the
ability to automatically migrate licenses and dynamically activate or deactivate license servers.

Figure 4-13 The RD Licensing Manager

License Server Assignment and Activation

   Windows Server 2008 R2 changes how RDS Session Hosts locate and connect to license servers.
In Windows Server 2008, Terminal Servers used a discovery mechanism to find and connect
to a license server. This created problems if the license server was unavailable, or if the
discovery process encountered problems, and it became the source of a significant number of
support calls. In Windows Server 2008 R2, this is changed so that RD Session Hosts explicitly
specify the RD License servers they will connect to, as shown in Figure 4-14, and when a specific
license server is unavailable, licenses are automatically migrated.

and VDI: Centralizing Desktop
and Application Management
Figure 4-14 The RD Licensing Server is specified in the RD Session Host Configuration console.
When an RD Session Host is initially installed, it has a 120-day grace period before a
license server needs to be specified. If no license server is specified and available at the end
of that grace period, the RD Session Host will stop accepting connections. This grace period
cannot be reset and is not an “evaluation” or “temporary” license.

Virtual Desktop Licensing:

    Complete and correct licensing of a Microsoft VDI environment requires licensing of both the
Windows client operating system running in a centralized location and the infrastructure and
management components that enable an end-to-end VDI environment.
Virtual Enterprise Centralized Desktop (VECD) is the license for Windows as a guest operating
system in the data center. VECD is available for client devices that are covered by Software
Assurance (VECD for SA), and those that are not, including devices such as thin clients. VECD
or VECD for SA is required for any VDI environment running Windows as the guest operating
system.
Most VDI environments also include management components such as System Center
Virtual Machine Manager (SCVMM) or System Center Operations Manager to manage the
environment. For licensing the infrastructure and management components of a Microsoft
VDI environment, there are essentially two options: You can license the infrastructure components
(RD Session Host, RD Virtualization Host, RD Connection Broker, etc.) with RDS CALs
and license the management components separately; or, if you’re a Volume License customer,
you have a pair of new options—the Microsoft Virtual Desktop Infrastructure Standard Suite
and the Microsoft Virtual Desktop Infrastructure Premium Suite. These two suites combine
the products for an optimum VDI experience in a value package.

   1. Microsoft Virtual Desktop Infrastructure Standard Suite (VDI Standard
Suite) Includes the core products and CALs required to enable and manage VDI,
including:
• Remote Desktop Services (RDS) The RDS component of the VDI Suite is
licensed solely for use in a VDI context; it does not provide a license to use sessionbased
RDS resources.
• Microsoft Desktop Optimization Pack (MDOP) This is a collection of technologies
that enable desktop virtualization and management, including App-V.
• System Center Virtual Machine Manager (SCVMM) Client Management
License This provides centralized management of the Microsoft® Hyper-V™-
based virtualization components of the VDI host.
• System Center Configuration Manager Standard Server Management
License This provides centralized configuration management of the (physical) VDI
hosts of the VDI Suite.
• System Center Operations Manager Standard Server Management
License This provides centralized monitoring and performance management of
the physical VDI host of the VDI Suite.
n Microsoft Virtual Desktop Infrastructure Premium Suite (VDI Premium
Suite) Includes all the components of the VDI Standard Suite, plus the following:
• App-V for RDS This provides application-level virtualization for RDS sessions.
• RDS The RDS license is not use restricted to the VDI scenario only, but can also be
used for session-based desktop and applications scenarios.
Note T he System Center components of the VDI Suites are only licensed for use in a VDI
scenario, and can’t be used for general management of virtualization hosts with mixed
workloads.

Remote Desktop Administration and Management

2011-04-23T09:23:00.000-07:00

Remote Desktop Administration and Management:

    The RemoteApp and Desktop Connection Web application gives IT administrators a single
place to manage and assign resources for their users. Changes made here are directly
reflected in the RemoteApp and Desktop Connection Control Panel for Windows 7 users,
and in the applications and virtual desktops that users connecting from earlier versions of
Windows
see when they log in to the RD Web Access server, as shown in Figure 4-2
.
50 CHAPTER 4 Remote Desktop Services
and VDI: Centralizing Desktop
and Application Management
Figure 4-2 The RemoteApp and Desktop Connection page from a Windows XP SP3 computer.
The Windows 7 computer of the same user directly integrates these same links into the
user’s Start menu, as shown in Figure 4-3.

Figure 4-3 RemoteApp and Desktop Connections are directly integrated into the Windows 7 Start menu.
Whenever an administrator makes changes to the available programs or virtual desktops,
both the RD Web Access page and the user’s Start menu are dynamically updated without
further intervention.
(Re)introducing Remote Desktop Services and VDI CHAPTER 4 51

Windows PowerShell Module:

     Windows Server 2008 R2 includes a new Windows PowerShell module, the RemoteDesktopServices
module, that includes both cmdlets and a full RDS Provider, as shown in Figure 4-4.

Figure 4-4 The RemoteDesktopServices module for Windows PowerShell includes both cmdlets and a
provider.
For those new to Windows PowerShell, a brief explanation of providers is in order. In
Windows PowerShell, providers are a way to view and navigate information in a hierarchical
way as if the providers were drives on the computer. In fact, the FileSystem is implemented as
a provider. This means that when you type dir c:\ at the Windows PowerShell prompt, what
you’re actually doing is asking Windows PowerShell to give you the children of the C drive
of the FileSystem provider. (The dir command is an alias for Get-ChildItem.) Windows PowerShell
implements the Windows Registry as a provider as well, so you issue the command
dir HKLM:\System\CurrentControlSet to see what the HKeyLocalMachine registry
hive has in the System\CurrentControlSet container.
With the RemoteDesktopServices provider, the “drive” is RDS:. Beneath that top level we
have RDSConfiguration, GatewayServer, LicenseServer, RDSFarms, ConnectionBroker, and
RemoteApp containers. With the RDS Windows PowerShell module, you can configure and
manage all RDS role services and components using Windows PowerShell. For example, you
can do the following:
52 CHAPTER 4 Remote Desktop Services
and VDI: Centralizing Desktop
and Application Management
1. View and edit configuration settings of Remote Desktop Server
2. Publish RemoteApp applications
3. Configure License Server
4. Create and configure a Remote Desktop server farm
5. Configure and assign virtual Internet Protocol (IP) addresses to either sessions or applications
6. Create and manage RDV (VDI) pools
7. Create and manage Gateway Resource Access and Client Access policies
For example, with Windows PowerShell, you can quickly get a list of the personal virtual
desktop assigned to a particular user:
PSH> import-module RemoteDesktopServices
PSH> $cred = Get-Credential
PSH> Get-VirtualDesktop –user example\charlie –credential $cred
Name AssignedTo Host
---- ---------- ----
xmpl-vdi-92.example.local EXAMPLE\Charlie HOST-9.example.local
Because the RDS team implemented their Windows PowerShell support primarily as a provider,
it’s easy to navigate and investigate the functionality available, and also easy to get help
on how to do tasks. So, for example, if you want to know what the parameters are for creating
a new RemoteApp using Windows PowerShell, you just ask Windows PowerShell to tell you,
as shown in Figure 4-5.
You can also use Windows PowerShell to quickly get or set the value of various RDS settings,
as shown in Figure 4-6.
(Re)introducing Remote Desktop Services and VDI CHAPTER 4 53

Figure 4-5 Using the Get-Help command with the –path parameter to get specific help on creating
RemoteApps.

Figure 4-6 Getting the ConnectionBrokerSettings.
To change the session settings to disable new connections, the command would be as
follows:
RDS:\RDSConfiguration> Set-Item –path .\SessionSettings\AllowConnections 0
54 CHAPTER 4 Remote Desktop Services
and VDI: Centralizing Desktop
and Application Management

Windows 7 and RDS (Better Together)

   Users running Windows 7 will have an enhanced user experience when using Remote Desktop.
Not only will they have more direct access to applications and desktops through the
RemoteApp and Desktop Connection (RAD) link in the Control Panel, but the overall experience
is more natural and integrated. RemoteApps are directly integrated into the Start menu,
Taskbar, and system tray, so that many users will be unable to tell whether a program is running
locally or remotely.

Improved User Experience

     The improved user experience with Remote Desktop Services and Windows 7 clients includes
the following features:
   1. Multimedia redirection This feature provides high-quality multimedia by redirecting
multimedia files and streams so that audio and video content is sent in its original
format from the server to the client and rendered using the client’s local media playback
capabilities.
   2. True multimonitor support Remote Desktop Services enables support for up
to 10 monitors in almost any size, resolution, or layout with RemoteApp and remote
desktops. Applications will behave just like they do when running locally in multimonitor
configurations.
    3. Audio input and recording VDI supports any microphone connected to a user’s
local machine and enables audio recording support for RemoteApp and Remote Desktop.
This is useful for Voice over Internet Protocol (VoIP) scenarios and also enables
speech recognition.
    4. Windows Aero support VDI provides users with the ability to use the Windows
Aero user interface for client desktops, ensuring that remote desktop sessions look and
feel like local desktop sessions.
     5. DirectX redirection Improvements in DirectX 9, 10, and 11 application rendering,
and support for the new DirectX 10.1 application programming interfaces (APIs)
that allow DirectX (2D& 3D) graphics to be redirected to the local client to harness the
power of the graphical processing unit (GPU) on the user’s local device, remove the
need for a GPU on the server.
    6. Improved audio/video synchronization Remote Desktop Protocol (RDP)
improvements in Windows Server 2008 R2 are designed to provide closer synchronization
of audio and video in most scenarios.
    7. Language bar redirection Users can control the language setting of RemoteApp
programs using the local language bar.
    8. Task Scheduler Improvements keep scheduled applications from interacting with
users running RemoteApps, avoiding confusion.
Enabling VDI CHAPTER 4 55

RA D Control Panel

     The RAD Control Panel applet, part of Windows 7, provides a simple way to configure
RemoteApp and VDI directly into the user’s Start menu. Plus, once the initial connection is
made, applications and desktops are automatically updated as the administrator configures
the available applications and desktops, simplifying management and deployment.

Configuring RemoteApp and Desktop Connection

      To change the settings for RAD, use the Remote Desktop Connection Manager console, as
shown in Figure 4-7.

Figure 4-7 The Remote Desktop Connection Manager console.
The Remote Desktop Connection Manager connects to an RD Connection Broker, and
allows you to configure the RD Virtualization Host servers and the personal and pooled
virtual desktops they provide, along with designating the RemoteApp sources that will be
available to the RD Connection Broker.

Enabling VDI

   Windows Server 2008 R2 adds support for both personal and pooled virtual desktops.
Enabling that VDI support requires setting up and configuring an RD Virtualization Host, an
RD Session Host, an RD Connection Broker, and an RD Web Access server, although these
and VDI: Centralizing Desktop
and Application Management
different roles can be combined as appropriate for your environment. The basic steps to
enabling VDI are as follows:
   1. Enable the RD Virtualization Host role service of the Remote Desktop Services role.
This will also enable the Hyper-V role.
Note E nabling the Hyper-V role requires hardware that supports hardware virtualization.
This might require an updated BIOS. The BIOS must be configured to support both
hardware virtualization and hardware Data Execution Protection.
2. Enable an RD Session Host. This is required both for VDI and to provide RemoteApp
programs.
3. Enable an RD Connection Broker and an RD Web Access server.
4. Export the Secure Sockets Layer (SSL) certificate for the RD Web Access computer. This
will be imported onto the virtual machines (VMs).
5. Create the VMs that will be used, configuring them as appropriate. These will be used
either as part of a VDI pool or as personal VMs.
     • Add the SSL machine certificate from the RD Web Access computer to them.
     • Enable Remote Access.
     • Allow Remote RPC for RDS in the registry.
     • Enable Remote Service Management in Windows Firewall.
     • Add RDP protocol permissions to the VMs.
     • Configure the VMs for rollback if they’re part of a VDI pool.
6. Add the RD Web Access computer to the TS Web Access Computers local group on the
RD Connection Broker.
7. Add the RD Connection Broker computer as a source for the RD Web Access computer,
as shown in Figure 4-8.

Enabling
Figure 4-8 Configure RD Web Access to use an RD Connection Broker as a source.
8. Configure the VDI Pool and assign any Personal Virtual Desktops on the RD Connection
Broker as shown in Figure 4-9.

Figure 4-9 Adding virtual machines to a Virtual Desktop Pool.
58 CHAPTER 4 Remote Desktop Services
and VDI: Centralizing Desktop
and Application Management
   9. Add applications to the RemoteApp server and make them available as RemoteApps.
10. Log on to the client computer as an administrator and import the machine SSL certificate
from the RD Web Access server.
   11. Log on to the client computer and set up the RemoteApp and Desktop Connection.
Yes, this is fairly complicated, but most of these steps are performed one time only, or can
be easily automated.
Integrating Remote and Local Applications with

RemoteApp

   RemoteApp for Windows Server 2008 R2 gives you the ability to provide your users with an
integrated and transparent mixture of local and remote applications. For applications that
behave best when run locally, or that are used when not connected to the network, you can
install the applications locally, while providing access to other applications using RemoteApp
where appropriate. Applications running remotely can even control the file extensions on the
client computer, providing a transparent experience for the user.
To configure remote applications to take over the local file extensions, you need to create
a Windows Installer (.msi) package for them and install the package locally (or use Group
Policy to deploy the resulting .msi package), following these steps:
1. Open RemoteApp Manager and connect to the RD Session Host that hosts the application
you want to deploy.
2. Click Add RemoteApp Program to open the RemoteApp Wizard. Click Next and select
the program or programs you want to add, as shown in Figure 4-10.

Figure 4-10 Adding a program with the RemoteApp Wizard.
Working Over the Web: Web Access CHAPTER 4 59
3. Click Next and then click Finish to return to the RemoteApp Manager.
4. Select the program in the list of RemoteApp programs and click Create Windows
Installer Package in the Actions pane.
5. Click Next to open the Specify Package Settings page. Make any changes here that are
appropriate for your environment.
6. Click Next to open the Configure Distribution Package page shown in Figure 4-11.

Figure 4-11 The Configure Distribution Package page of the RemoteApp Wizard.
7. Select the Associate Client Extensions For This Program With The RemoteApp Program
check box. Also select the Desktop check box if you want the user to have a shortcut to
this application on his or her desktop.
8. Click Next and then click Finish to create the .msi package, which can be installed on
users’ computers.

Working Over the Web: Web Access

       Windows Server 2008 R2 provides access to RemoteApp programs and desktops using the RD
Web Access role for all versions of Windows that support at least RDP version 6.0 or later. This
includes Windows Vista SP1 and Windows XP SP3.
Users can connect to the resources of your RDS environment, including virtual desktops,
from supported clients using direct RemoteApp and Desktop Connection, or over the Web
using the Remote Desktop Gateway. This enables users to have consistent access to corporate
resources without having to use a virtual private network (VPN) connection. Figure 4-12
shows the typical RD Web Access connection through an RD Gateway.
and VDI: Centralizing Desktop
and Application Management

Figure 4-12 The RD Web Access connection through an RD Gateway.
RD Web Access can be configured to provide virtual desktops as well as RemoteApps, and
also provides a gateway to allow users to connect to their own workstation if corporate policy
allows it.

Server Manager

2011-04-22T08:59:00.000-07:00

Server Manager

    The primary graphical interface for server management in Windows Server 2008 R2 is the
Server Manager console, shown in Figure 2-6.
Figure 2-6 The Server Manager console.
20 CHAPTER 2 Installation and Configuration:
Adding R2 to Your World
The Server Manager console includes integrated management consoles for the roles and
features that are enabled on the server. New in Windows Server 2008 R2 is the ability to
run the Server Manager remotely without having to open a Remote Desktop session to the
remote server.
Also new in the R2 version of Server Manager are Best Practice Analyzers (BPAs) that are
directly integrated into the Server Manager for those roles that have them.
Adding Roles, Role Services, and Features
Adding a role, role service, or feature in Windows Server 2008 R2 can be done from Server
Manager, from the Initial Configuration Tasks Wizard, or from Windows PowerShell. The
Server Manager and Initial Configuration Tasks Wizard experience is essentially the same as it
was in Windows Server 2008, but the option to use Windows PowerShell is new.
To use Server Manager to add a role or feature, select Server Manager () in
the tree pane and then, from the Action menu, select Add Roles (or Add Features). To add
a role service for an already installed role, highlight that role in the tree pane and, from the
Action menu, select Add Role Service. The Add Role Wizard, Add Role Services Wizard, or
Add Feature Wizard will open. All three wizards are essentially the same. The Add Role Wizard
is shown in Figure 2-7.
Figure 2-7 The Add Role Wizard, with the File Services role selected.
A new alternative that makes it easier to script and automate the configuration of servers is
Windows PowerShell. Windows Server 2008 R2 has a new ServerManager module that can be
used to add or remove roles, role services, or features. Figure 2-8 shows a Windows Power-
Shell session that sets the execution policy to only require signing for scripts that originate
Windows Server Core CHAPTER 2 21
remotely, then imports the ServerManager module, and finally adds the File Services role,
along with the File Server role service.
Figure 2-8 Adding the File Services role using Windows PowerShell.

Windows Server Core

     The option to choose a minimal environment for running specific server roles was a very new
installation option in Windows Server 2008, and that option has been enhanced in Windows
Server 2008 R2 with the addition of Active Directory Certificate Services as a role, and the
inclusion of Windows PowerShell as a supported feature.
Server Core is an installation option, not a separate edition of Windows Server 2008 R2.
You can install Server Core regardless of which edition you are installing—it’s really just a
decision about interface and functionality.

Configuring Server Core

     Configuring and managing a Server Core installation is a bit different than a full installation
of Windows Server 2008 R2. The initial configuration is especially different because the
Initial Configuration Tasks Wizard isn’t available. Once the server is configured, however, you
can use standard remote management tools to manage the roles and features on the server,
including using Server Manager.
The following steps outline how to perform a basic Server Core configuration to give the
server a fixed Internet Protocol (IP) address and join it to the domain. These instructions
assume you’ve completed the basic installation and set the default administrator password,
and you are now staring at the blank Cmd.exe prompt shown earlier in Figure 2-1. Use the
commands shown in Figure 2-9 to configure the network adapter for a fixed IP address of
192.168.51.4 with a Domain Name System (DNS) server at 192.168.51.2.
22 CHAPTER 2 Installation and Configuration:
Adding R2 to Your World
Figure 2-9 Setting a fixed IP address.
Now, join the server to the example.local domain using the following command:
Netdom join %computername% /domain:example.local /userd:example\Charlie /passwordd:*
Restart the server using shutdown –r and log back in with a domain administrator
account to confirm that the domain join went as expected. Once you’re back at the inspiring
Server Core command line, you need to rename the computer something a bit more memorable
than the random name given it during the initial install. The command to do this is
Netdom again:
Netdom renamecomputer %computername% /newname:
Answer Yes at the prompt, and then restart the computer after the rename and log back in
with a domain administrator account.
Now, configure the firewall for remote administration and enable remote management
through the firewall, using the commands shown in Figure 2-10.
Figure 2-10 Enabling remote management.
Windows Server Core CHAPTER 2 23
Finally, use the new Server Configuration utility, Sconfig.exe, to configure the rest of the
settings, as shown in Figure 2-11.
Figure 2-11 Sconfig.exe makes configuring some options much easier.
Sconfig.exe is new in Windows Server 2008 R2 and allows you to configure most of the
settings you need to get up and running with Server Core. This includes enabling remote
Server Manager, remote management consoles, and Windows PowerShell, which are critical
steps to getting your Server Core installation ready to use.

Managing Server Core

     Once Windows PowerShell is installed, and you have remote management and Remote
Desktop enabled, you are in a position to manage the server comfortably using familiar
tools. You’ll need to use Windows PowerShell or the Dism.exe command-line utility to add
or remove roles, role services, and features because you can’t use the remote management
tools or Server Manager to add roles remotely. You can manage a server running Server Core

installation in the following ways:

    1. Locally and remotely using a command prompt By using the Windows
command-
line tools at a command prompt, you can manage servers running a Server
Core installation.
   2. Remotely using Terminal Server By using another computer running Windows,
you can use the Terminal Server client to connect to a server running a Server Core
installation and manage it remotely. The shell in the Terminal Server session will be the
command prompt.
24 CHAPTER 2 Installation and Configuration:
Adding R2 to Your World
   3. Remotely using Windows Remote Shell By using another computer running
Windows
Vista, Windows 7, Windows Server 2008, or Windows Server 2008 R2, you
can use Windows Remote Shell to run command-line tools and scripts on a server running
a Server Core installation.
4. Locally or remotely using Windows PowerShell By using Windows PowerShell
locally on a computer running a Server Core installation of Windows Server 2008 R2
or remotely from a computer running Windows Server 2008 R2, you can connect to a
server running a Server Core installation in the same way that you would connect to
any computer running Windows.
5. Remotely using a Microsoft Management Console (MMC) snap-in By using
an MMC snap-in from a computer running Windows Vista, Windows 7, Windows
Server 2008, or Windows Server 2008 R2, you can connect to a server running Server
Core installation in the same way that you would connect to any computer running
Windows.
6.Remotely using Server Manager By using Server Manager from a computer
running Windows Server 2008 R2 you can connect to a server running a Server Core
installation of Windows Server 2008 R2 and manage it.
Figure 2-12 shows Server Manager connecting to a Server Core computer.

Installation and Configuration: Adding R2 to Your World

2011-04-20T06:29:00.000-07:00

Installation and Configuration:Adding R2 to Your World
1.System Requirements and Scalability 11
2.Installation 14
3.Configuration 16
4.Windows Server Core 21
Windows Server 2008 R2 uses the same basic installation and configuration methods
as Windows Server 2008. The installer, originally introduced in Microsoft Windows
Vista, is an image-based install that is noticeably quicker than earlier versions of
Windows
Server. Configuration continues the role-based model introduced in Windows
Server 2008, now with a new ServerManager module for Windows PowerShell as an
option for adding and removing roles and features. This new capability is also available
on Server Core installations, a change from Windows Server 2008 where Windows
PowerShell
was not supported on Server Core.
Additionally, for Server Core, the command-line utility used to add and remove roles
has changed. In Windows Server 2008, the utility is Ocsetup.exe, but in Windows Server
2008 R2, it is Dism.exe.

Windows Server Core

      If you’re coming to Windows Server 2008 R2 from Microsoft Windows Server
2003, a brief explanation of Server Core is probably in order here. With the
release of Windows Server 2008, Microsoft added a new installation option
called Server Core. This installs a version of Windows Server that has a limited
subset of available roles and functionality, and no graphical interface, as shown
in Figure 2-1.

Installation and Configuration:

Adding R2 to Your World
Figure 2-1 The console interface of Windows Server 2008 R2 Enterprise Core.
Server Core is not a separate edition of Windows Server 2008 R2, it is an installation
option that has a reduced footprint and reduced overhead, but still provides all
the underlying server functionality of the roles that are available on it. You can’t go
out and buy a copy of Windows Server Core. Instead, you buy whatever version of
Windows Server you need for your network, and when you install Windows Server,
you choose a Server Core installation, as shown in Figure 2-2.
Management of server roles can be done from the command line, or from remote
management tools running on other computers in the network.
So, why choose Server Core? After all, most Windows Server administrators are a
good deal more comfortable with the familiar Windows graphical interface than
they are with the command line, and even an experienced administrator can find
the single Cmd.exe window shown in Figure 2-1 a bit daunting. The two reasons we
find most compelling are the reduction in resource usage—a Server Core installation
is physically smaller and uses less RA M—and the improved security footprint—
because there are fewer services and features installed, there is a smaller attack
surface. This also has the added benefit of requiring fewer security-related updates
and potentially fewer server restarts.

   Figure 2-2 Server Core is an installation option, not a separate product

System Requirements and Scalability

     The system requirements for Windows Server 2008 R2 are essentially the same as for Windows
Server 2008, with one very important exception: There is no 32-bit version of Windows
Server 2008 R2. There are only 64-bit versions. The minimum system requirements.

Minimum System Requirements for Windows Server 2008 R2
Component Requirement
Processor
Minimum: 1.4 GHz x64 processor
Note: An Intel Itanium 2 processor is required for Windows Server 2008 for
Itanium-Based Systems
Memory
Minimum: 512 MB RAM (384 MB for Server Core installation)
Maximum: 8 GB (Foundation) or 32 GB (Standard) or 2 TB (Enterprise,
Datacenter, and Itanium-Based Systems)
Disk Space
Requirements
Minimum: 32 GB or greater (3.5 GB for Server Core installation)
Foundation: 10 GB or greater
Note: Computers with more than 16 GB of RAM will require more disk
space for paging and dump files
Display Super VGA (800 × 600) or higher resolution monitor
Other Keyboard and Microsoft Mouse or compatible pointing device.

Installation and Configuration:

Adding R2 to Your World
Processors and Memory
The Windows Server 2008 R2 editions support the same number of physical processors and
RAM as Windows Server 2008 did, up to 64 processor sockets, and up to 2 terabytes (TB)
of RAM, for Windows Server 2008 R2 Datacenter and Itanium versions. Table 2-2 shows the
breakdown by edition.
Windows Server 2008 R2 Memory and Processors by Edition
edition ma ximum # of CPUs ma ximum RAM
Web 4 32 GB
Standard 4 32 GB
Enterprise 8 2 TB
Datacenter 64 2 TB
Itanium 64 2 TB
Foundation 1 8 GB
Microsoft counts processor sockets, not logical processors, for most licensing purposes
and for the consideration of maximum number supported. The exception to this is the
Hyper-
V role of Windows Server 2008 R2, which supports a maximum of 64 logical processors
for a single physical server.

Second Level Address Translation

Windows Server 2008 R2 adds support for the enhanced memory management
capabilities of the newest Intel and AMD processors. AMD calls this
Rapid Virtualization Indexing (RVI) and Intel calls it Enhanced Page Tables. In both
cases, it allows the Hyper-V hypervisor to manage memory, especially of largememory
virtual machines (VMs), more effectively and with less overhead in the
parent partition. Second Level Address Translation (SLAT ) works by providing two
levels of address translation. The additional page table is used to translate guest
“physical” addresses to system physical addresses. Guest operating systems can
now be allowed to directly manage their own page tables, without the need for the
hypervisor to intercept those calls, reducing the overhead required for the Hyper-V
parent to maintain shadow page tables in software.
System Requirements and Scalability
Power Consumption

     Power consumption, and the carbon footprint it generates, is an ever increasing concern for
most information technology (IT) managers these days. The cost of the power itself, along
with the resulting cost of cooling to remove the excess heat generated, adds significantly to
the overall cost of running a datacenter. Modern server processors have helped improve this
by using less actual power per CPU, but this has been offset to some extent by the increasing
need for more RAM and more CPUs. Windows Server 2008 R2 helps manage the overall
power consumption of datacenters in several ways, including the following:
    1. Server consolidation Windows Server 2008 R2 supports more logical processors
per physical Hyper-V host, giving you the ability to consolidate more workloads onto
fewer physical servers.
   2. Core parking Windows Server 2008 R2 is able to take advantage of the ability of
modern processors to dynamically enable and disable processor cores. When Windows
Server recognizes that processors are being underutilized, it turns off or parks processor
cores that aren’t needed, reducing power consumption. When processor demand
increases, Windows Server 2008 R2 reenables cores as necessary to maintain system
performance.
   3. Group Policy management of P-states Windows Server 2008 R2 utilizes Group
Policy to change the Advanced Configuration and Power Interface (ACPI) power-performance
states (P-states) of the processors to manage the speed and power consumption
of the processors.
4. Storage consolidation Windows Server 2008 R2 is able to better utilize storage
area networks (SANs), including booting directly from an SAN, allowing you to centralize
and consolidate storage more effectively.
Clustering
Windows Server 2008 R2 adds a new Cluster Shared Volume (CSV) feature to failover clustering
to enable live migration of VMs. CSV volumes enable multiple nodes in the same failover
cluster to concurrently access the same logical unit number (LUN). By storing the VHD files for
a virtual machine on the CSV, migration of a VM happens without interruption of service. Also
new in failover clustering is improved connectivity fault tolerance, and an enhanced cluster
validation tool. More on clustering is discussed in Chapter 3, “Hyper-V: Scaling and Migrating
Virtual Machines,” when we talk about Hyper-V.

Scalability

     A key design goal was to provide higher performance for Windows Server 2008 R2 on similar
hardware. Windows Server 2008 R2 features that improve performance and scalability for
applications and services include the following:
14 CHAPTER 2 Installation and Configuration:
Adding R2 to Your World
   1. Support for larger workloads by adding more servers to a workload (scaling out)
   2. Support for larger workloads by utilizing or increasing system resources (scaling up)
Increased Workload Support by Scaling Out
The Network Load Balancing (NLB) feature in Windows Server 2008 R2 allows you to combine
two or more computers into a cluster. You can use NLB to distribute workloads across the
cluster nodes to support a larger number of simultaneous users. NLB feature improvements in
Windows Server 2008 R2 include the following:
    3. Improved support for applications and services that require persistent connections
using the new IP Stickiness feature in NLB clusters
    4. Improved health monitoring and awareness for applications and services running on
NLB clusters
Installation
Installation of Windows Server 2008 R2 uses the same general steps as Windows Server 2008,
with the exception that you won’t be prompted for a license key during the installation,
as you are with some distributions of Windows Server 2008. We do not cover the detailed
step-by-step of Windows Server installation here—that’s adequately covered in many places,
including http://technet.microsoft.com/en-us/library/dd540768(WS.10).aspx.
We focus in this section on the various upgrade scenarios and what is and isn’t supported.
The general rule is that upgrades of the same architecture, language, edition, and platform
from Windows Server 2003 SP2, Windows Server 2003 R2, and Windows Server 2008 are
supported. Upgrades from beta builds of Windows Server 2008 R2 are not supported, and
upgrades from versions of Windows Server prior to Windows Server 2003 SP2 are not supported.
If you are running a 32-bit version of Windows Server, even if the underlying hardware is
64-bit, there is no upgrade available.
The specific supported upgrade scenarios are shown in Table 2-3.
Tab le 2-3 Supported Upgrade Scenarios for Windows Server 2008 R2
source Version
supported Tar get Version of Windows
Server 2008 R2
FROM Windows Server 2003 (SP2, R2)
Datacenter Datacenter
Enterprise Enterprise, Datacenter
Standard Standard, Enterprise
Installation CHAPTER 2 15
From Windows Server 2008
Datacenter Datacenter
Datacenter Core Datacenter Core
Enterprise Enterprise, Datacenter
Enterprise Core Enterprise Core, Datacenter Core
Foundation (SP2 only) Standard
Standard Standard, Enterprise
Standard Core Standard Core, Enterprise Core
Web Standard, Web
Web Core Standard Core, Web Core
There are a couple of omissions in the upgrade paths that are worth pointing out. There is
no upgrade path for Itanium versions of Windows Server—the expectation is that a full, clean
install will be performed. There is also no way to upgrade to Windows Server 2008 R2 Foundation.
If you have Windows Server 2008 Foundation, which shipped at the SP2 level, you can
upgrade to Windows Server 2008 R2 Standard only.
Also, Microsoft does support upgrades from both the Release Candidate (RC) and Interim
Development Server (IDS) builds of Windows Server 2008.
Even where it is technically possible and supported to upgrade, in our experience it’s
always worth considering a clean installation. This is especially true if the server being
upgraded has already gone through one or more upgrades to get to its current level.
Schema Updates
Joining a computer running Windows Server 2008 R2 to an existing Active Directory domain
doesn’t require an update to the Active Directory schema. However, before you can make a
computer running Windows Server 2008 R2 a domain controller, you do need to prepare the
forest and the domain that will have an R2 domain controller. To prepare the forest, follow
these steps:
1. Log on to the domain controller that holds the Schema Master flexible single master
operations (FSMO) role with an account that is a member of the Schema Admins
group.
2. Copy the contents of the \Support\Adprep folder on the Windows Server 2008 R2 DVD
to a local folder.
3. Open a command prompt as administrator and change to the directory where you
copied the files.
4. Run the following command:
Adprep /forestprep
16 CHAPTER 2 Installation and Configuration:
Adding R2 to Your World
5. Allow the changes to replicate before preparing the domain.
If you’re installing Windows Server 2008 R2 into an existing forest, but a new domain, you
don’t need to do anything else, but if you’re installing into an existing domain, you’ll need to
prepare that domain using the following steps:
1. Log on to the domain controller that holds the Infrastructure Master FSMO role with
an account that is a member of the Domain Admins group.
2. Copy the contents of the \Support\Adprep folder on the Windows Server 2008 R2 DVD
to a local folder.
3. Open a command prompt as administrator and change to the directory where you
copied the files.
4. Run the following command:
Adprep /domainprep /gpprep
5. Allow the changes to replicate before installing the new Windows Server 2008 R2
domain controller.
More Info See http://technet.microsoft.com/en-us/library/cc731728(WS.10).aspx for
more information on Adprep.exe.
Installation Process
The installer for Windows Server 2008 R2 is the same installer that was introduced with
Windows
Vista. Before you start the installation on x64 systems, however, you need to verify
that you have digitally signed drivers for any hardware that will be used on the server. Starting
with Windows Server 2008, all drivers for x64 versions of Windows Server must be digitally
signed or they will not load during the boot process. This can cause the server to fail to boot,
or to have hardware unavailable, so it’s a good idea to make sure you have all the drivers you
need before you start.
Windows Server 2008 R2 doesn’t require a license key to install, but you will need to
provide one within 60 days to continue to use the software. As you can see in Figure 2-2, you
must choose the edition of R2 you want to install. This choice must match the license key you
use to activate the software or activation will fail.
Configuration
The final step of the Windows Server 2008 R2 installation is setting the password on the
Administrator account, as shown in Figure 2-3.
Configuration CHAPTER 2 17
Figure 2-3 Setting the initial Administrator password.
The default password policy for Windows Server 2008 R2 is to require a minimum of six
characters, with at least three of the four categories of characters: lowercase, uppercase, numbers,
and nonalphanumeric characters. Passwords expire in 42 days, by default. Once a server
is joined to a domain, the policies of the domain will apply for domain accounts, but the local
security policy will still apply for local accounts, as shown in Figure 2-4.
Once the password is set, you’ll see the Initial Configuration Tasks Wizard, as shown in
Figure 2-5. This wizard is also known as the Out of Box Experience (OOBE) and is similar to the
one from Windows Server 2008, with the addition of the Activate Windows option. The OOBE
is a useful wizard for the initial configuration of a server, providing easy access on a single
page to most of the tasks you need to get your server up and running.
18 CHAPTER 2 Installation and Configuration:
Adding R2 to Your World
Figure 2-4 The Local Security Policy controls password policies for local accounts.
Figure 2-5 The Initial Configuration Tasks Wizard, or OOBE.
Configuration CHAPTER 2 19
Role-Based Configuration
If you’re familiar with Windows Server 2008, you’ll already have a good start on the rolebased
configuration that is used in Windows Server 2008 R2, but if you’re new to Windows
Server 2008, then a quick overview should help. Windows Server 2008 and Windows Server
2008 R2 both use role-based configuration. All the features and roles that are available to the
server are physically installed on the server’s hard drive, as part of the image-based install.
You don’t ever have to worry about finding the right DVD for your server if there’s an update
or you need to add a new feature or role because all the necessary files are already on the
hard drive.
When you want to enable specific functionality on the server, you add the role, role service,
or feature that includes that functionality. This is an important change that ensures that each
role gets only the services and features enabled that are required by the role and no others,
limiting the overall attack surface of the server. Enabling the role also configures the Windows
Firewall for that role, enabling the role or feature to work without opening up unnecessary
ports that could create an unintended security risk.
There are 17 possible roles and 42 different features that can be enabled on Windows
Server 2008 R2 Enterprise Edition.

Server Manager

The primary graphical interface for server management in Windows Server 2008 R2 is the
Server Manager console, shown in Figure 2-6.
Figure 2-6 The Server Manager console.
20 CHAPTER 2 Installation and Configuration:
Adding R2 to Your World
The Server Manager console includes integrated management consoles for the roles and
features that are enabled on the server. New in Windows Server 2008 R2 is the ability to
run the Server Manager remotely without having to open a Remote Desktop session to the
remote server.
Also new in the R2 version of Server Manager are Best Practice Analyzers (BPAs) that are
directly integrated into the Server Manager for those roles that have them.

Better Together with Windows 7

2011-04-18T08:09:00.000-07:00

Better Together with Windows 7
Many of the enhancements of Windows Server 2008 R2 are independent of the client operating
system being used, but others, such as DirectAccess, only work with Windows 7 clients.
Others, as is the case with the new RDS features, work better with a Windows 7 client, but are
still important improvements even if you’re running Windows Vista or Windows XP.
Some of the things that make Windows 7 and Windows Server 2008 R2 work better together
(and the technologies that enable them) are the following:
1.Simplified remote connectivity for remote users (DirectAccess)
2.Secure remote connectivity, even from public computers (Remote Workplace plus RD
     Gateway and RD Session Host)
3.Improved branch office performance and security (BranchCache and read-only Distributed
     File System Replication [DFS-R])
4. More efficient power management where the hardware supports it (Group Policy)
5. Virtualized desktops (VDI)
6. Improved removable drive security (BitLocker To Go)

Top Reasons to Upgrade

   Windows Server 2008 R2 is not a free update to Windows Server 2008 unless you have Software
Assurance (SA). So should you upgrade? And why?
6 CHAPTER 1 What’s New in Windows Server R2
Well, the short answer is yes, you should upgrade. The why is what this book is all about in
many ways, but here are our top 10 reasons to upgrade:

1. Powerful hardware and scaling features Windows Server 2008 R2 supports
      up to 256 logical processors. R2 also supports SLAT, which enables R2 to take advantage
      of the Enhanced Page Tables feature found in the latest AMD CPUs as well as the
      similar Nested Page Tables feature found in Intel’s latest processors. The combination
      enables R2 servers to run with much improved memory management.
2. Improved Hyper-V Hyper-V in Windows Server 2008 R2 can now access up to 64
      logical CPUs on host computers—twice Hyper-V’s initial number of supported CPUs.
      Live migration enables a highly fault-tolerant virtualization infrastructure, and dynamic
      addition and removal of disks simplifies backup scenarios and overall management of
      virtualized resources.
3. Reduced power consumption Windows Server 2008 R2 supports Core Parking,
      which dynamically turns off unused processor cores when they aren’t needed, reducing
      power consumption.
4. Reduced desktop costs Windows Server 2008 R2 enables VDI technology, which
      extends the functionality of RDS to provide full desktop virtualization or application
      virtualization of key applications.
5. Improved server management Windows Server 2008 R2 includes a new version
      of Windows PowerShell, which is now available on Server Core as well. Server Manager
      can now also be used remotely.
6. Improved branch office performance and security Windows Server 2008 R2
      includes BranchCache and read-only DFS-R, which extends the branch office scenarios
      introduced in Windows Server 2008.
7. Improved Web server Windows Server 2008 R2 includes IIS 7.5 as well as a new
      FTP server. IIS 7.5 includes a new Windows PowerShell provider for IIS management.
8. Windows PowerShell v2 Windows Server 2008 R2 includes an improved and
       more powerful version of Windows PowerShell that has cmdlet support for remote
       management. Windows PowerShell is now available on Server Core in Windows Server
       2008 R2.
   9. Improved Remote Desktop Services The new RDS features provide an improved
       and more seamless user experience, especially when the client is running Windows 7.
10.Improved mobile user experience Mobile users running Windows 7 have seamless
       and continuous access to corporate resources through DirectAccess. And RD Web
       Access, shown in Figure 1-1, provides users running at least Windows XP SP3 with full
       access to published applications or desktops.

Web

2011-04-18T07:26:00.000-07:00

Web

Windows Server 2008 R2 includes Internet Information Services (IIS) 7.5, an improved and
updated version of the IIS 7 that was included in Windows Server 2008. Windows Server 2008
R2 also includes a new Windows PowerShell provider for IIS to facilitate the automation of
management tasks. This Windows PowerShell provider is available on Server Core installations
of Windows Server 2008 R2 as well as full installations. IIS 7.5 also includes a new File Transfer
Protocol (FTP) server that supports Internet Protocol version 6 (IPv6), Secure Sockets Layer
(SSL), and Unicode characters.
Server Core can now include the Microsoft .NET Framework, giving administrators the
ability to manage IIS from Windows PowerShell or IIS Manager. As with many other areas of
R2, IIS 7.5 includes a Best Practices Analyzer (BPA) to simplify troubleshooting and configuration
of IIS. For full details on the new version of IIS, see Chapter 7, “IIS 7.5: Improving the Web
Application Platform.”
Top Reasons to Upgrade CHAPTER 1 5

Networking and Access
One of the most exciting new features in Windows Server 2008 R2 is DirectAccess, a new way
to securely connect remote clients to the corporate network. The most common method has
been virtual private networks (VPNs), which often require third-party client software running
on the client, and can be time-consuming to configure and troubleshoot. With Windows
Server 2008 R2 and DirectAccess, if the client is running Windows 7, the remote user has
seamless, always-on remote access to corporate resources that does not compromise the
secure aspects of remote connectivity.
DirectAccess works with the Network Access Protection (NAP) of Windows Server 2008 R2
to ensure that client computers meet your system health requirements, such as having security
updates and antimalware definitions installed, before allowing a DirectAccess connection.
Clients that are connected via DirectAccess can be remotely managed by internal IT staff,
allowing you to ensure that they are kept current with critical updates. DirectAccess is covered
in Chapter 8, “DirectAccess and Network Policy Server.”
Better Together with Windows 7
Many of the enhancements of Windows Server 2008 R2 are independent of the client operating
system being used, but others, such as DirectAccess, only work with Windows 7 clients.
Others, as is the case with the new RDS features, work better with a Windows 7 client, but are
still important improvements even if you’re running Windows Vista or Windows XP.
Some of the things that make Windows 7 and Windows Server 2008 R2 work better together
(and the technologies that enable them) are the following:
n Simplified remote connectivity for remote users (DirectAccess)
n Secure remote connectivity, even from public computers (Remote Workplace plus RD
Gateway and RD Session Host)
n Improved branch office performance and security (BranchCache and read-only Distributed
File System Replication [DFS-R])
n More efficient power management where the hardware supports it (Group Policy)
n Virtualized desktops (VDI)
n Improved removable drive security (BitLocker To Go)

Management

2011-04-17T06:30:00.001-07:00

There are substantial improvements in the way Windows Server 2008 R2 can be managed,
both graphically and from the command line. A new version of Windows PowerShell
provides enhanced remote capabilities and is now available as an installation option for
Windows Server
Core. Graphical management is also improved, with Server Manager now
fully supported remotely, and many of the management consoles are better integrated into
Server Manager, enabling remote management. The improvements in Windows PowerShell
are covered
throughout the book, and we cover the specifics of setting up remote Server
Manager,
installing Windows PowerShell in Server Core, and many of the changes to rolebased
administration in Chapter 2, “Installation and Configuration: Adding R2 to Your World.”
Windows Server 2008 R2 includes a new Active Directory (AD) schema that enables an AD
Recycle Bin, a new set of Active Directory Windows PowerShell cmdlets, and improvements in
daily AD administration.
Improvements in storage management and file server management are part of Windows
Server 2008 R2. The new Windows File Classification Infrastructure (FCI) provides insight into
your data by automating classification processes so that you can manage your data more
effectively and economically. BranchCache improves bandwidth utilization of wide area

What’s New in Windows Server R2

2011-04-17T06:19:00.000-07:00

Hi to all here i write some networking basics of Windows Server 2008. Thanks to Microsoft team.

What Is R2?
Windows Server 2008 R2, or simply “R2” for short, is the second release of Windows
Server 2008. It isn’t a completely new release, but rather adds additional features and
refinements to the existing release.

Release Cadence
Beginning with Windows Server 2003, Microsoft moved to a server release cycle that
was designed to have a major release every three to five years (Windows Server 2003,
Windows Server 2008), with a minor release at the approximate midpoint of the major
release cycle (Windows Server 2003 R2, Windows Server 2008 R2). This change allowed
Microsoft to move away from including new functionality in service packs (SPs), while
providing customers with a more stable and predictable server environment.
An R2 release is more than an SP, but less than a full major release. Windows Server
2008 R2 includes Windows Server 2008 SP2, but it also adds many new features and
functionality that were not part of Windows Server 2008.

Licensing and Packaging Changes
There are some minor licensing changes included in Windows Server 2008 R2, and one
completely new edition since the original release of Windows Server 2008. The new edition is
Windows Server 2008 R2 Foundation, an original equipment manufacturer (OEM)–only edition
that is an entry-level small-business solution limited to a maximum of 15 users, which has
several other restrictions as well.

The licensing of Windows Server 2008 R2 is very similar to that of Windows Server 2008,
and you can use Windows Server 2008 Client Access Licenses (CALs) for Windows Server 2008
R2 without having to upgrade your license. There is, however, one important difference that
is introduced with Windows Server 2008 R2—there is no requirement to upgrade to Windows
Server 2008 CALs when you install Windows Server 2008 R2 on a physical server that is only
used with the Hyper-V role.
Another difference between Windows Server 2008 and Windows Server 2008 R2 licensing
is caused by the name change from Terminal Services (TS) in Windows Server 2008 to Remote
Desktop Services (RDS) in Windows Server 2008 R2. This is more than just a name change,
and we cover the new features and functionality in depth in Chapter 4, “Remote Desktop Services
and VDI: Centralizing Desktop and Application Management.” However, for the licensing,
it really is just a name change—Windows Server 2008 R2 RDS CALs and Windows Server
2008 TS CALs can both be used for the full functionality of Windows Server 2008 R2 RDS.
There are also new license suite options in Windows Server 2008 R2, with the introduction
of the new Virtual Desktop Infrastructure (VDI) Standard and Virtual Desktop Infrastructure
Premium suites. We cover these new suite licenses in Chapter 4 when we talk about the new
VDI functionality that R2 makes possible.

The Focus for R2
It would be presumptuous of us to talk about the “vision” that Microsoft had for Windows
Server 2008 R2, but we can certainly see a pattern in where the major improvements are:
1. Virtualization
2. Management
3. Scalability
4. Web

5. Networking and access
6. “Better Together” with Windows 7

We take a look at each of these areas throughout this book, but let’s start with a quick
high-level look at what has changed in each area.

Virtualization
Direct support for server virtualization, in the form of the Hyper-V hypervisor, was one of the
most important and highly anticipated improvements in Windows Server 2008. With the release
of Windows Server 2008 R2, Microsoft extends Hyper-V virtualization to include support
for client desktop virtualization, and adds important new capabilities for dynamic disk allocation,
live migration, and improved scalability and redundancy. We cover the improvements in
Hyper-V server virtualization capabilities in Chapter 3, “Hyper-V: Scaling and Migrating Virtual
Machines.”
Virtualization, however, isn’t limited to machine virtualization, but also includes presentation
virtualization (RDS), application virtualization (App-V), and client desktop virtualization
(VDI).
Windows Server 2008 R2 adds improvements in RDS that provide a more seamless integration
with Windows 7 clients, including full support for Windows Aero and multiple monitors.
Application virtualization support in R2 is improved, and the addition of the Remote Desktop
Virtualization Host (RD Virtualization Host) role service enables full desktop virtualization. We
cover VDI and RDS in greater detail in Chapter 4.