Mastering Windows Server 2022 E-Book

Jordan Krause

• Herausgeber: Packt Publishing
• Kategorie: Wissenschaft und neue Technologien
• Sprache: Englisch

Seitenzahl: 1168

Veröffentlichungsjahr: 2023

Beschreibung

Written by a 10-time Microsoft MVP award winner with over 20 years of IT experience, Mastering Windows Server 2022 is a practical guide to deploying, securing, and optimizing your server infrastructure. Whether you’re new to server administration or an experienced professional sharpening your skills, this book is designed to be referenced on a regular basis instead of gathering dust on your shelf.

Updated for Windows Server 2022, this book covers versions, licensing models, and the latest features while guiding you through single-pane-of-glass administration with tools like Server Manager, PowerShell, and Windows Admin Center. While the primary focus is on Windows Server 2022 LTSC, we also explore SAC server releases, Containers, Nano Server, and OS release cadences.

You’ll gain hands-on expertise in remote access technologies, PKI and certificate management, virtualization with Hyper-V, and deploying a Remote Desktop Services farm. Plus, you’ll master Server Core, built-in redundancy, and troubleshooting techniques – all while reinforcing core infrastructure skills like Active Directory, DNS, DHCP, and Group Policy.

Leseprobe

Mastering Windows Server 2022

Fourth Edition

Comprehensive administration of your Windows Server environment

Jordan Krause

BIRMINGHAM—MUMBAI

Mastering Windows Server 2022

Fourth Edition

Copyright © 2023 Packt Publishing

All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, without the prior written permission of the publisher, except in the case of brief quotations embedded in critical articles or reviews.

Every effort has been made in the preparation of this book to ensure the accuracy of the information presented. However, the information contained in this book is sold without warranty, either express or implied. Neither the author, nor Packt Publishing or its dealers and distributors, will be held liable for any damages caused or alleged to have been caused directly or indirectly by this book.

Packt Publishing has endeavored to provide trademark information about all of the companies and products mentioned in this book by the appropriate use of capitals. However, Packt Publishing cannot guarantee the accuracy of this information.

Senior Publishing Product Manager: Aaron Tanna

Acquisition Editor – Peer Reviews: Gaurav Gavas

Project Editor: Rianna Rodrigues

Content Development Editor: Liam Draper

Copy Editor: Safis Editing

Technical Editor: Srishty Bhardwaj

Proofreader: Safis Editing

Indexer: Subalakshmi Govindhan

Presentation Designer: Ganesh Bhadwalkar

Developer Relations Marketing Executive: Meghal Patel

First published: October 2017

Second edition: June 2020

Third edition: September 2022

Fourth edition: May 2023

Production reference: 2300525

Published by Packt Publishing Ltd.

Livery Place

35 Livery Street

Birmingham

B3 2PB, UK.

ISBN 978-1-83763-450-7

www.packt.com

Contributors

About the author

Jordan Krause is an IT professional of more than 20 years and has received 10 Microsoft MVP awards for his work with Microsoft server and networking technologies. As one of the world's first experts on Microsoft DirectAccess, his authorship journey began with a book on remote access technology and has evolved into numerous writings on more extensive topics such as Windows Server, security, and Group Policy. Jordan lives in beautiful West Michigan (USA) and manages a team of IT engineers spread across the country

About the reviewer

Premnath Sambasivam is a server engineer with 10 years of experience in Windows, Azure, VMware, and SCCM administration. He is an MCSE Cloud Platform and Infrastructure professional and a Microsoft-certified Azure architect. He has developed and deployed Microsoft System Center Configuration Manager solutions to manage over 6,000 assets in his clients' environments and various VMware solutions. Premnath is a technology enthusiast who loves learning and exploring new technologies. He is currently a senior cloud engineer for one of the major retail brands in the USA. He has also reviewed Packt Publishing’s books like Mastering Windows Server 2019 and Mastering Windows Security and Hardening.

Join our community on Discord

Join our community’s Discord space for discussions with the author and other readers:

https://packt.link/SecNet

Contents

Preface

Who this book is for

What this book covers

To get the most out of this book

Get in touch

Making the Most Out of This Book – Get to Know Your Free Benefits

Unlock Your Book’s Exclusive Benefits

Getting Started with Windows Server 2022

The purpose of Windows Server

It’s getting cloudy out there

Public cloud

Private cloud

Windows Server versions and licensing

Standard versus Datacenter

Windows Server 2022 Essentials

Windows Server 2022 Datacenter: Azure Edition

Three different user interfaces

Desktop Experience

Server Core

Nano Server – now only for containers

Licensing models – what happened to SAC?

Long-Term Servicing Channel (LTSC)

Semi-Annual Channel (SAC) (now retiring)

License purchase and packs

Core Packs

At what point do I turn to Datacenter?

Client Access Licenses (CALs)

Overview of new and updated features

Hardware security

Network security

Protocol updates

DNS-over-HTTPS

Azure integrations

An Azure-specific version of the OS

Azure Stack HCI

Hotpatching

SMB over QUIC

Windows Admin Center

Storage

Containerization

The Windows 10 experience continued

Hyper-Converged Infrastructure

Microsoft Edge

Windows Defender Advanced Threat Protection

Integration with Linux

System Insights

Features deprecated in Server 2022

Semi-Annual Channel (SAC) releases

Windows Internet Name Service (WINS)

Internet Storage Name Service (iSNS) servers

Guarded fabric and Shielded VMs

Windows Deployment Services (WDS) partial deprecation

Navigating the interface

The updated Start menu

The Quick Admin Tasks menu

Using the Search function

Pinning programs to the taskbar

The power of right-clicking

Using the newer Settings screen

Two ways to do the same thing

Creating a new user through Control Panel

Creating a new user through the Settings menu

Task Manager

Task View

Summary

Questions

Installing and Managing Windows Server 2022

Technical requirements

Installing Windows Server 2022

Burning that ISO

Creating a bootable USB stick

Running the installer

Installing roles and features

Installing a role using the wizard

Installing a feature using PowerShell

Centralized management and monitoring

Server Manager

Remote Server Administration Tools (RSAT)

Does this mean RDP is dead?

Remote Desktop Connection Manager

Windows Admin Center (WAC)

Installing Windows Admin Center

Launching Windows Admin Center

Adding more servers to WAC

Managing a server with WAC

Changes are easy as pie

Azure integrations

Enabling quick server rollouts with Sysprep

Installing Windows Server 2022 onto a new server

Configuring customizations and updates onto your new server

Running Sysprep to prepare and shut down your master server

Creating your master image of the drive

Building new servers using copies of the master image

In-place upgrading to Windows Server 2022

Download and run the installer

Summary

Questions

Active Directory

What is a domain controller?

Active Directory Domain Services

Creating your first domain

Prep your domain controller

Install the AD DS role

Configure the domain

Trees, forests, and…domains?

Multiple domain controllers for redundancy

Active Directory Users and Computers

User accounts

Security groups

Prestaging computer accounts

Active Directory Domains and Trusts

Building a trust

Network connectivity

Conditional DNS forwarding

Configuring the trust

Test it out!

Active Directory Sites and Services

Active Directory Administrative Center

Dynamic Access Control

Fine-Grained Password Policy

Active Directory Recycle Bin

Read-only domain controllers

FSMO Roles

Viewing current FSMO role holders

RID, PDC, and Infrastructure master

Schema master

Domain naming master

View them all in one place

FSMO role visibility through PowerShell

Transferring FSMO roles

Transferring FSMO roles via PowerShell

Demote an old domain controller

Demoting while the old server is still online

Clean up AD Sites and Services

Demoting when the old server is gone

Move FSMO roles

Delete it

Clean up Sites and Services and DNS

Group Policy

Summary

Questions

DNS and DHCP

The purpose of DNS

Types of DNS records

Host record (A or AAAA)

Alias record – CNAME

Mail Exchanger (MX) record

Microsoft 365 MX records

TXT record

SPF record

Enforcement rule -all

Name Server (NS) record

Public name server records

ipconfig /flushdns

Split-brain DNS

Types of DNS zones

Active Directory Integrated Zones

Forward Lookup Zones

Reverse Lookup Zones

Primary Zone

Secondary Zone

Stub Zone

Creating a new zone

IP addressing with DHCP

Creating a DHCP scope

Authorize the DHCP server

Scope Options

DHCP reservations

DHCP failover

Two DHCP servers

Hot standby mode

Load sharing mode

Configuring DHCP failover

IPAM

Summary

Questions

Group Policy

Group Policy Objects

Group Policy background refresh cycle

Building a GPO

Adding Trusted Sites

Mapping network drives

Installing registry keys

Prevent shut down of system

Disable removable USB drives

Scoping a GPO

Links

Gpresult

Continuing with the link

Group Policy processing order

Local Policy

Site-level policies

Domain-level policies

OU-level policies

Security Filtering

WMI Filtering

Item-level targeting

Delegation

Computer settings and user settings

Computer Configuration

User Configuration

Linking GPOs accordingly

Group Policy loopback processing

Policy versus preference

Policies

Preferences

Default Domain Policy

Administrative Templates

Implementing ADMX/ADML files

The Central Store

Enable the Central Store

Populate the Central Store

Summary

Questions

Certificates

Common certificate types

User certificates

Computer certificates

SSL certificates

Single-name certificates

Multi-domain or subject alternative name certificates

Wildcard certificates

Planning your PKI

Role services

Enterprise versus standalone

Root versus subordinate (issuing)

Naming your CA server

Can I install the CA role onto a domain controller?

Creating a new certificate template

Issuing your new certificates

Publishing the template

Requesting a certificate from MMC

Requesting a certificate from the web interface

Creating an auto-enrollment policy

Obtaining a public authority SSL certificate

Public/private key pair

Creating a certificate signing request

Submitting the certificate request

Downloading and installing your certificate

Re-keying certificates

Exporting and importing certificates

Exporting from MMC

Exporting from IIS

Importing into a second server

OpenSSL for Linux webservers

Generate a CSR

Acquire the certificate

Install the certificate

Summary

Questions

Networking with Windows Server 2022

Introduction to IPv6

Your networking toolbox

ping

tracert

pathping

Test-Connection

Telnet

Test-NetConnection

Packet tracing with Wireshark

TCPView

netstat

Building a routing table

Multi-homed servers

Only one default gateway

Building a route

Adding a route with Command Prompt

Deleting a route

Adding a route with PowerShell

NIC Teaming

Software-defined networking

Hyper-V Network Virtualization

Private clouds

Hybrid clouds

How does it work?

System Center Virtual Machine Manager

Network Controller

Generic Routing Encapsulation

Microsoft Azure Virtual Network

RAS Gateways/SDN Gateways

Virtual network encryption

Bridging the gap to Azure

A VPN gateway

Azure ExpressRoute

Third-party options

Azure Network Adapter

Summary

Questions

Remote Access

Regular ol’ VPN

Routing and Remote Access Service (RRAS)

Configuring VPN inside RRAS

Securing your VPN

Always On VPN

Types of AOVPN tunnels

User tunnels

Device tunnels

Device tunnel requirements

AOVPN client requirements

Domain-joined

Rolling out the settings

AOVPN server components

Remote Access server

Certification Authority (CA)

Network Policy Server (NPS)

DirectAccess

The truth about DirectAccess and IPv6

Prerequisites for DirectAccess

Domain-joined

Supported client operating systems

DirectAccess servers – one or two NICs?

To NAT or not to NAT?

Network Location Server

Certificates used with DirectAccess

Do not use the Getting Started Wizard (GSW)!

Remote Access Management Console

Configuration

Dashboard

Operations Status

Remote Client Status

Reporting

Tasks

DA, VPN, or AOVPN? Which is best?

Domain-joined or not?

Auto or manual launch

Software versus built-in

Password and login issues with traditional VPNs

Port-restricted firewalls

Manual disconnect

Native load-balancing capabilities

Distribution of client configurations

Web Application Proxy

WAP as AD FS Proxy

Requirements for WAP

Latest improvements to WAP

Pre-authentication for HTTP Basic

HTTP to HTTPS redirection

Wildcard domain publishing

Client IP addresses forwarded to applications

Publishing Remote Desktop Gateway apps

Improved administrative console

Summary

Questions

Hardening and Security

Microsoft Defender Antivirus

Installing Microsoft Defender Antivirus

Exploring the user interface

Disabling Microsoft Defender Antivirus

What is ATP anyway?

Windows Defender ATP Exploit Guard

Windows Defender Firewall – no laughing matter

Three Windows Firewall administrative consoles

Windows Defender Firewall (Control Panel)

Firewall & network protection (Windows Security Settings)

Windows Defender Firewall with Advanced Security (WFAS)

Three different firewall profiles

Building a new inbound firewall rule

Creating a rule to allow pings (ICMP)

Managing WFAS with Group Policy

Encryption technologies

BitLocker and the virtual TPM

Shielded VMs

Encrypted virtual networks

Encrypting File System

IPsec

Configuring IPsec

Azure AD Password Protection

Fine-grained password policy

Advanced Threat Analytics – end of support

What is (was) ATA?

Microsoft Defender for Identity

General security best practices

Getting rid of perpetual administrators

Using distinct accounts for administrative access

Using a different computer to accomplish administrative tasks

Never browse the internet from servers

Role-Based Access Control (RBAC)

Just Enough Administration (JEA)

Adjust RDP away from 3389

Disable external RDP… NOW

Disable insecure encryption protocols

Windows Registry

IIS Crypto

Summary

Questions

Server Core

Why use Server Core?

No more switching back and forth

Interfacing with Server Core

PowerShell

Using cmdlets to manage IP addresses

Setting the server hostname

Joining your domain

Remote PowerShell

Server Manager

Remote Server Administration Tools

Accidentally closing Command Prompt

Windows Admin Center to manage Server Core

The Sconfig utility

Roles available in Server Core

Building a Server Core domain controller

Install the AD DS role

Promote this server to a domain controller

Verify that it worked

What happened to Nano Server?

Summary

Questions

PowerShell

Why move to PowerShell?

Cmdlets

PowerShell is the backbone

Scripting

Server Core

Working within PowerShell

Launching PowerShell

Default execution policy

Restricted

AllSigned

RemoteSigned

Unrestricted

Bypass mode

Using the Tab key

Useful cmdlets for daily tasks

Query user or quser

IP addressing cmdlets

Using Get-Help

Formatting the output

Format-Table

Format-List

Visual customizations

Importing a module

Using a pipeline

Export to CSV

Pipes can invoke action

PowerShell Integrated Scripting Environment

PS1 files

Working with PowerShell ISE

Remotely managing a server

Preparing the remote server

The WinRM service

Enable-PSRemoting

Allowing machines from other domains or workgroups

Connecting to the remote server

Using -ComputerName

Using Enter-PSSession

Desired State Configuration

Windows Terminal

Summary

Questions

Redundancy in Windows Server 2022

Network Load Balancing (NLB)

Not the same as round-robin DNS

What roles can use NLB?

Virtual and dedicated IP addresses

NLB modes

Unicast

Multicast

Multicast IGMP

Configuring a load-balanced website

Enabling NLB

Enabling MAC address spoofing on VMs

Configuring NLB

Configuring IIS and DNS

Testing it out

Flushing the ARP cache

Failover clustering

Clustering Hyper-V hosts

Virtual machine load balancing

Clustering for file servers

Scale-out file server

Clustering tiers

Application-layer clustering

Host-layer clustering

A combination of both

How does failover work?

Setting up a failover cluster

Building the servers

Installing the feature

Running Failover Cluster Manager

Running cluster validation

Running the Create Cluster wizard

Clustering improvements in Windows Server 2022

AutoSites

Clustering Affinity

Improvements to BitLocker protected cluster storage

Slightly older improvements (but still cool)

True two-node clusters with USB witnesses

Higher security for clusters

Multi-site clustering

Cross-domain or workgroup clustering

Cluster operating system rolling upgrades

Storage Replica (SR)

Configuring Storage Replica

Initializing disks as GPT

Testing preparedness for Storage Replica

Configuring Storage Replica

Shifting the primary server to FS02

Storage Spaces Direct (S2D)

New in Server 2022 and 2019

Summary

Questions

Containers

Understanding application containers

Sharing resources

Isolation

Scalability

What’s new in Server 2022?

Smaller image size for Server Core

Virtualized time zones

Initial IPv6 support

HostProcess containers

Enhanced management through Windows Admin Center

A new base image option

Container base images

Nano Server

Server Core

Windows Server

Windows Server containers versus Hyper-V containers

Windows Server containers

HostProcess containers

Hyper-V containers

Docker and Kubernetes

Linux containers

Docker Hub

Docker Trusted Registry

Kubernetes

Working with containers

Installing the role and feature

Installing Docker for Windows

Docker commands

docker version

docker info

docker --help

docker images

docker search

docker pull

docker run

docker ps -a

Downloading a container image

Running a container

Where is Azure in all this?

Azure Container Registry

Azure Kubernetes Service (AKS)

Azure Kubernetes Service for Azure Stack HCI

Summary

Questions

Hyper-V

Designing and implementing your Hyper-V Server

Installing the Hyper-V role

Nested virtualization

AMD processors are now supported

Virtual switches

External virtual switch

Internal virtual switch

Private virtual switch

Creating a new virtual switch

Receive Segment Coalescing (RSC)

Implementing a new virtual server

Starting and connecting to the VM

Installing the operating system

Managing a virtual server

Hyper-V Manager

The Settings menu

Checkpoints

Configuring auto stop and start

Expanding a virtual disk

Hyper-V console, Remote Desktop Protocol (RDP), or PowerShell

Windows Admin Center (WAC)

Shielded VMs

Encrypting VHDs

Infrastructure requirements for shielded VMs

Guarded hosts

Host Guardian Service (HGS)

Host attestations

TPM-trusted attestations

Host key attestations

Admin-trusted attestation – deprecated in 2019

The future of shielded VMs

Integrating with Linux

ReFS deduplication

ReFS

Data deduplication

Why is this important to Hyper-V?

Hyper-V Server…2019?

Summary

Questions

Remote Desktop Services

Wherefore art thou, role?

Components of an RDS environment

Remote Desktop Session Host

Remote Desktop Connection Broker

Remote Desktop License Manager

Remote Desktop Web Access

Remote Desktop Gateway

Publishing RDS sessions

Creating an RDS environment

Your first RDS collection

Add RD Gateway and RD Licensing

Collection configuration

Connecting to it

Editing deployment and collection properties

Deployment Properties

Collection Properties

Adding RDSH servers to your collection

Drain-stop an RDSH for maintenance

Installing applications on an RDSH

No users logged in

Install mode

RDS licensing

User CALs

Device CALs

Specify the RD License server

RD Licensing Manager

RDS user profiles

Local profiles

Roaming profiles

User Profile Disks (UPDs)

FSLogix

RemoteApp

RDS maintenance considerations

Install mode

Server Manager errors related to RDS

Logging directly in to RDSH servers

SSL certificate replacements

Cloning RDSH servers

Sidder

GPOs and RDS

Summary

Questions

Troubleshooting

Backup and restore

Schedule regular backups

Restoring from Windows

Restoring from the installer disk

Task Manager

Resource Monitor

Performance Monitor

Sysinternals tools

Descriptions of popular tools

TcpView

Disk2vhd

Autologon

Autoruns

Diskmon

LogonSessions

PsExec

PsKill

PsShutdown

Process Monitor (Procmon)

AccessEnum

Windows Firewall with Advanced Security

System Insights

Remote toolsets

Event Logs

Filtering event logs

Exporting Windows event logs with PowerShell

Common Event IDs

MMC and MSC shortcuts

Summary

Questions

Appendix: Answers to the End-of-Chapter Questions

Chapter 1: Getting Started with Windows Server 2022

Chapter 2: Installing and Managing Windows Server 2022

Chapter 3: Active Directory

Chapter 4: DNS and DHCP

Chapter 5: Group Policy

Chapter 6: Certificates

Chapter 7: Networking with Windows Server 2022

Chapter 8: Remote Access

Chapter 9: Hardening and Security

Chapter 10: Server Core

Chapter 11: PowerShell

Chapter 12: Redundancy in Windows Server 2022

Chapter 13: Containers

Chapter 14: Hyper-V

Chapter 15: Remote Desktop Services

Chapter 16: Troubleshooting

Other Books You May Enjoy

Index

Landmarks

Cover

Index

Preface

The world of servers has always been an interesting place. For more than 20 years, Microsoft has been separated from the pack and has distinguished itself as the leader of serving power in corporate datacenters across the globe. Indeed, there is not much for competition in the server operating system space. During my career I have had the privilege of working within the walls of many hundreds of different networks and environments, and without a single exception they have all been in some way powered by Windows Server. You may think I have blinders on; a lifer in Microsoft technology would naturally seek out work within Microsoft environments, right? But rest assured, I’m no stranger to the sudo command. I fully recognize the uses and benefits that Linux servers offer in certain circumstances, especially in web hosting. Containers bring to light another engaging topic in the Microsoft vs Linux conversation, but as you will find within the pages of this book, we are now seeing ways that these two technologies interact and coexist like they never have before, rather than try to outdo one another.

As many businesses and IT administrators shift attention to cloud resources, the Microsoft trend continues. There are many options for hosting compute resources in the cloud, and serving up data from those resources. Over the last few years, Microsoft has been taking significant steps to outpace competition and build unique ways to tie on-premise datacenters together with Azure. Technology like Azure Stack HCI, the ability to essentially host your own instance of Azure inside datacenter walls, is one of these entities that provides an incredibly unique spin on cloud technology.

Why would I dare to talk about cloud technology in a book that is clearly pointed at administering Windows Servers? Because knowledge of local Windows Server administration is still completely relevant in a cloudy world. When companies started moving resources into the cloud, I heard a lot of speakers and presentations state things like “Moving to the cloud won’t negate the need for IT staff, your people will just need different skillsets.” These speakers were clearly implying that IT would still be necessary, but they would now be administering cloud-based resources rather than on-premise infrastructure. Cloud transitions are happening every day, but what has proven surprising to some is that this transition is much less about replacing one set of skills with another, but rather maintaining all existing skillsets and tacking on new learning to handle the existence of cloud platforms.

Whether you are running Azure, AWS, or any of the other cloud hosting platforms, it is very likely that within your cloud tenant you have virtual machines that are still running some version of the Windows Server operating system. Windows Server is not magically different simply because it is now running on a VM inside Azure instead of running on a VM inside Hyper-V. It is still Windows Server, and it still needs to be administered, maintained, and troubleshot in the same ways that you have always done with your servers.

Maintaining a skillset to administer Windows Server and its roles is still essential to our IT departments, which loops us back to answering my question about Azure. Even in an infrastructure fully transitioned into the cloud, it is still very likely that you need to maintain the ability to administer Windows Server, which I believe surprised a lot of IT resource coordinators, following cloud migration projects.

A lot of fresh IT engineers are coming into the workforce prepared with some knowledge of SaaS resource administration, like Microsoft 365 and SharePoint, and this is wonderful! One of my primary motivations in writing this book is to provide a resource for new and growing admins to be successful in their careers. You may have learned through school or certification exams how to begin working in these new cloud platforms, but perhaps lack the foundational knowledge of the Microsoft technology that underpins a lot of Azure, Windows Servers. So many of the roles that exist inside Windows Server are foreign to engineers, but this is critical information to know as you continue your IT career journey and grow into more advanced positions. To pinpoint just one example, I often ask questions during interviews about DNS. It is entirely surprising to me how often answers to these questions come up short. DNS has been one of the staple roles in any Windows Server environment for as far back as I can remember, but until you have worked with it and gone through some of the learning hardships firsthand, it seems this is a common area that is somehow missed during standard IT learning.

I use DNS as an example because it’s true, but also because it is very meme-worthy. “It’s always DNS”. You may have heard some of your tenured administrators say these words, but until you experience it for yourself, may not quite appreciate their significance. The answer to so many questions lie within this one little role, incorrect configuration of DNS can cause multitudes of problems. I found the following graphic on the internet and take no credit for it, but also find it completely true, and hilarious.

Technical books are supposed to be a little mundane, that is why they are called technical books. It’s the nature of the industry, I suppose. I tried to resist this stereotype wherever possible, you may even find a dad joke or two scattered throughout these pages. I genuinely hope that you find this book to be a helpful resource, and that information learned here can be directly applied to your work in Information Technology.

Who this book is for

Anyone interested in Windows Server 2022 or in learning more in general about a Microsoft-centric datacenter will benefit from this book. An important deciding factor when choosing which content was appropriate for such a volume was making sure that anyone who had a baseline in working with computers could pick this up and start making use of it within their own networks. If you are already proficient in Microsoft infrastructure technologies and have worked with prior versions of Windows Server, then there are some focused topics on the aspects and parts that are brand new and only available in Server 2022. On the other hand, if you are currently in a desktop support role, or if you are coming fresh into the IT workforce, care was taken in the pages of this book to ensure that you will receive a rounded understanding, not only of what is brand new in Server 2022, but also what core capabilities it includes as carryovers from previous versions of the operating system, and that are still crucial to be aware of when working in a Microsoft-driven datacenter.

What this book covers

Chapter 1, Getting Started with Windows Server 2022, gives us an introduction to the latest Server operating system and an overview of the new technologies and capabilities that it can provide. We will also spend a little bit of time exploring the updated interface for those who may not be comfortable with it yet.

Chapter 2, Installing and Managing Windows Server 2022, dives right into the very first thing we will have to do when working with Server 2022: install it! While this seems like a simple task, there are a number of versioning and licensing variables that need to be understood before you proceed with your own installation. From there, we will start to expand upon Microsoft’s centralized management mentality, exploring how we can now manage and interact with our servers without ever having to log into them.

Chapter 3, Active Directory, leads us into the most core and essential role that exists in a Windows Server environment. AD is the central repository for many different types of data inside most corporate infrastructures, and without understanding the tools that exist to interface with this directory you will not be able to do much work with those fancy new servers.

Chapter 4, DNS and DHCP, segues into two other important roles that exist in almost every network. DNS and DHCP are both necessary technologies and concepts to understand for any IT administrator, and both happen to be roles that can be serviced from Windows Server 2022. We’ll dig into both.

Chapter 5, Group Policy, showcases a fantastic policy engine that can be used inside any Active Directory environment to create a centralized management location for your users and workstations. Whether you are interested in setting up password policies, configuring lockdowns on your systems, automatically mapping network drives, or even distributing software, Group Policy is a powerful tool that is often underutilized.

Chapter 6, Certificates, jumps into one of the pieces of Windows Server that has existed for many years, and yet most server administrators that I meet are unfamiliar with it. We’ll take a closer look at certificates as they become more and more commonly required for new technologies that we roll out. By the end of this chapter, you should be able to spin up your own PKI and start issuing certificates for free!

Chapter 7, Networking with Windows Server 2022, begins with an introduction to that big, scary IPv6, and continues from there into building a toolbox of items that are baked into Windows Server 2022 and can be used in your daily networking tasks. We will also discuss the parts and pieces that make up Software-Defined Networking.

Chapter 8, Remote Access, takes a look at the different remote access technologies that are built into Windows Server 2022. Follow along as we explore the capabilities provided by VPN, DirectAccess, Web Application Proxy, and Always On VPN.

Chapter 9, Hardening and Security, gives some insight into security and encryption functions that are built into Windows Server 2022. Security is the primary focus of CIOs everywhere, so we’ll explore what protection mechanisms are available to us out of the box.

Chapter 10, Server Core, throws us into the shrinking world of headless servers. Server Core has flown under the radar for many years but is critical to understand as we bring our infrastructures into a more security-conscious mindset. We’ll make sure you have the information necessary to make your environment more secure and more efficient, all while lowering the amount of space and resources that are consumed by those servers.

Chapter 11, PowerShell, gets us into the newer, bluer (or black or yellow or purple, or whatever color you desire!) command-line interface so that we can become comfortable using it and also learn why it is so much more powerful than Command Prompt. PowerShell is quickly becoming an indispensable tool for administering servers, especially in cases where you are adopting a centralized management and administration mindset. We will also take a look at the latest Microsoft command-line interface, Windows Terminal.

Chapter 12, Redundancy in Windows Server 2022, looks at some platforms in Server 2022 that provide powerful data and computing redundancy. Follow along as we discuss Network Load Balancing, Failover Clustering, Storage Spaces Direct, and build our own instance of Storage Replica.

Chapter 13, Containers, incorporates the terms open source and Linux into a Microsoft book! Application containers are quickly becoming the new standard for hosting modern, scalable applications. Learn how to start enhancing your DevOps story using tools such as Windows Server containers, Hyper-V containers, Docker, and Kubernetes.

Chapter 14, Hyper-V, covers a topic that every server administrator should be very familiar with. Organizations have been moving their servers over to virtual machines en masse for many years. We’ll use this chapter to make sure you understand how that hypervisor works and give you the resources required to build and manage one if and when you have the need.

Chapter 15, Remote Desktop Services, showcases an enormous functionality set built into Windows Server 2022, indeed the administration of RDS servers is a skillset unto its own. Providing users with virtual desktop sessions on a farm (collection) of Windows Servers can literally change your entire ideology about how users access their information.

Chapter 16, Troubleshooting, provides information about tools and software included with Windows Server that can be used to troubleshoot common problems. Server 2022 seems to be Microsoft’s most stable and reliable server operating system to date, yet as you all know nothing is perfect, and issues are bound to present themselves. Here we discover tools like Resource Manager, Performance Monitor, and System Insights that help to keep our servers tuned and running well.

To get the most out of this book

Each technology that we discuss within the pages of this book is included in, or relates directly to, Windows Server 2022. If you can get your hands on a piece of server hardware and the Server 2022 installer files, you will be equipped to follow along and try these things out for yourself. We will talk about and reference some enterprise-class technologies that come with stiffer infrastructure requirements to make them work fully, and so you may have to put the actual testing of those items on hold until you are working in a more comprehensive test lab or environment, but the concepts are all still included in this book.

We will also discuss some items that are not included in Server 2022 itself, but that are used to extend its capabilities and features. Some of these items help tie us into an Azure cloud environment, and some are provided by third parties, such as using Docker and Kubernetes on your Server 2022 to interact with application containers. Ultimately, you do not need to use these tools to manage your new Windows Server 2022 environment, but they do facilitate some pretty cool things that I think you will want to explore.

As I have done with my own test lab used throughout the pages of this book, if you have one server or high-powered computer available and download the Windows Server 2022 installer to use on top of it, you can easily enable yourself the ability to create many virtual machines and different instances of Server 2022. In this case, you may want to skip ahead to certain sections of Chapter 2 and Chapter 14, so that you are equipped to install a host operating system and configure Hyper-V upon it, then loop back to the beginning of the book so you have the same platform available as I did when building out these pages and the servers I used to populate them.

Download the color images

We also provide a PDF file that has color images of the screenshots/diagrams used in this book. You can download it here: https://packt.link/4zrrF.

Conventions used

There are a number of text conventions used throughout this book.

CodeInText: Indicates code words in text, database table names, folder names, filenames, file extensions, pathnames, dummy URLs, user input, and Twitter handles. For example: “Inside DNS, I am going to create an alias record that redirects intranet to web1.”

Any command-line input or output is written as follows:

Uninstall-WindowsFeature -Name Windows-Defender

Bold: Indicates a new term, an important word, or words that you see on the screen. For instance, words in menus or dialog boxes appear in the text like this. For example: “Select System info from the Administration panel.”

Warnings or important notes appear like this.

Tips and tricks appear like this.

Get in touch

Feedback from our readers is always welcome.

General feedback: Email [email protected] and mention the book’s title in the subject of your message. If you have questions about any aspect of this book, please email us at [email protected].

Errata: Although we have taken every care to ensure the accuracy of our content, mistakes do happen. If you have found a mistake in this book, we would be grateful if you reported this to us. Please visit http://www.packtpub.com/submit-errata, click Submit Errata, and fill in the form.

Piracy: If you come across any illegal copies of our works in any form on the internet, we would be grateful if you would provide us with the location address or website name. Please contact us at [email protected] with a link to the material.

If you are interested in becoming an author: If there is a topic that you have expertise in and you are interested in either writing or contributing to a book, please visit http://authors.packtpub.com.

Share your thoughts

Once you’ve read Mastering Windows Server 2022, Fourth Edition, we’d love to hear your thoughts! Please click here to go straight to the Amazon review page for this book and share your feedback.

Your review is important to us and the tech community and will help us make sure we’re delivering excellent quality content.

Making the Most Out of This Book – Get to Know Your Free Benefits

Unlock exclusive free benefits that come with your purchase, thoughtfully crafted to supercharge your learning journey and help you learn without limits.

https://www.packtpub.com/unlock/9781837634507

Note: Have your purchase invoice ready before you begin.

Figure 0.1: Next-Gen Reader, AI Assistant (Beta), and Free PDF access

Enhanced reading experience with our Next-gen Reader:

Multi-device progress sync: Learn from any device with seamless progress sync.

Highlighting and Notetaking: Turn your reading into lasting knowledge.

Bookmarking: Revisit your most important learnings anytime.

Dark mode: Focus with minimal eye strain by switching to dark or sepia modes.

Learn smarter using our AI assistant (Beta):

Summarize it: Summarize key sections or an entire chapter.

AI code explainers: In Packt Reader, click the “Explain” button above each code block for AI-powered code explanations.

Note: AI Assistant is part of next-gen Packt Reader and is still in beta.

Learn anytime, anywhere:

: Access your content offline with DRM-free PDF and ePub versions—compatible with your favorite e-readers.

Unlock Your Book’s Exclusive Benefits

Your copy of this book comes with the following exclusive benefits:

Next-gen Packt Reader

AI assistant (beta)

DRM-free PDF/ePub downloads

Use the following guide to unlock them if you haven’t already. The process takes just a few minutes and needs to be done only once.

How to unlock these benefits in three easy steps

Step 1

Have your purchase invoice for this book ready, as you’ll need it in Step 3. If you received a physical invoice, scan it on your phone and have it ready as either a PDF, JPG, or PNG.

For more help on finding your invoice, visit https://packt.link/unlock_help.

Note: Bought this book directly from Packt? You don’t need an invoice. After completing Step 2, you can jump straight to your exclusive content.

Step 2

Scan the following QR code or visit https://www.packtpub.com/unlock/9781837634507:

Step 3

Sign in to your Packt account or create a new one for free. Once you’re logged in, upload your invoice. It can be in PDF, PNG, or JPG format and must be no larger than 10 MB. Follow the rest of the instructions on the screen to complete the process.

Need help?

If you get stuck and need help, visit https://www.packtpub.com/unlock-benefits/help for a detailed FAQ on how to find your invoices and more. The following QR code will take you to the help page directly:

Note: If you are still facing issues, reach out to [email protected].

1

Getting Started with Windows Server 2022

Many years ago, Microsoft adjusted its operating system release ideology so that the latest Windows Server operating system maintained a similar graphical structure, and very similar release date, to whatever the latest and greatest Windows client operating system was going to have. This has been the trend for some time now, with Server 2008 R2 closely reflecting Windows 7, Server 2012 feeling a lot like Windows 8, and many of the same usability features that came with the Windows 8.1 update also included with Server 2012 R2. This, of course, carried over to Server 2016 as well—giving it the same look and feel as if you were logged into a Windows 10 workstation.

As of the Server 2016 release, we were all familiar and comfortable with the Windows 10 interface, and it felt quite natural to jump right into Server 2016 and start giving it a test drive. Windows Server 2019 diverted from this standard path a little bit, by having a look and feel that was very similar to its predecessor, Server 2016. Why did Server 2019 not come with a fancy new graphical interface to match the new version of a Windows client Operating System (OS)? Because Microsoft changed the game with Windows 10. Now, instead of releasing new versions of Windows (11, 12, 13, and so on), we were, for the time being, simply sticking with Windows 10 and giving it sub-version numbers, indicative of the dates when each operating system version was released. For example, Windows 10 version 1703 was released around March 2017. Windows 10 version 1709 was released in September 2017.

Then came 1803 and 1809—although 1809 was delayed a little and didn’t release until somewhere closer to November, which wasn’t the original plan. Follow that up with 1903 and 1909, and you start to see a pattern emerge. Then we moved into the year 2020, and suddenly our spring release of Windows 10 was called 2004. Hmm… 2004 sounds fine when you pronounce it twenty-oh-four, indicating the year 2020 and the month of April, but when seeing 2004 on paper, most folks started calling it two-thousand-four, which sounds quite old and outdated, don’t you think? I can’t say for sure, but perhaps this is part of the reason that the next release version of Windows 10 went by the name 20H2. This nomenclature seems to have stuck around, and we are continuing the trend with bi-annual client OS releases that reflect this pattern. All in all, you can see that Microsoft’s current plan is to continue releasing a new feature release version of the Windows operating system every 6 months or so.

However, expecting IT departments to lift and shift all of their servers just for the purposes of moving to an OS that is 6 months newer is crazy; sometimes it takes longer than that just to plan a migration.

Anyway, I’m getting ahead of myself a little, as we will discuss the versioning of Windows Server later in this chapter, in our Windows Server versions and licensing section. The point here is that Windows Server 2019 looks and feels like the latest version of the Windows client operating system that was released at about the same time—that OS being Windows 10 1809.

So what about Windows Server 2022? Since the release of Server 2019, Microsoft has unveiled Windows 11! It certainly comes with a new and updated look and feel, being different in many ways from Windows 10. Since Windows 11 was released right around the same time as Windows Server 2022, wouldn’t it make sense for Server 2022 will be super futuristic and look just like Windows 11? While that might make a lot of sense, it is not at all what happened.

Figure 1.1: The Server 2022 lock screen

Does that look familiar to anybody? You’re right, it looks exactly the same as Server 2019, or Windows 10. This is because Server 2022 is based on Windows 10 code, NOT Windows 11. For the time being, I am going to consider that a smart move. Windows 11 seems to be playing well in the consumer market, but in my experience so far it is working through some struggles within a business environment. The safe play for this new release of the Server operating system was to base it on reliable, tried, and true coding that we know works well with the roles and applications that companies are going to need to install on it. That being said, Server 2022 does certainly come with some enhancements and benefits.

Before we get started talking about the features of Windows Server, it is important to establish a baseline for usability and familiarity with the operating system itself before diving deeper into the technologies running under the hood.

Let’s spend a few minutes exploring the new graphical interface and options that are available for finding your way around this latest release of Windows Server, with a view to covering the following topics in this chapter:

The purpose of Windows ServerIt’s getting cloudy out thereWindows Server versions and licensingOverview of new and updated featuresFeatures deprecated in Server 2022Navigating the interfaceUsing the newer Settings screenTask ManagerTask View

The purpose of Windows Server

What is a server? Is that a silly question? I don’t think so. It’s a good question to ponder, especially now that the definition of servers and server workloads is changing on a regular basis. The answer to this question for Windows clients is simpler. A Windows client machine is a requester, consumer, and contributor of data.

From where is this data being pushed and pulled? What enables the mechanisms and applications running on the client operating systems to interface with this data? What secures these users and their data? The answers to these questions reveal the purpose of servers in general. Servers house, protect, and serve up data to be consumed by clients.

Everything revolves around data in business today. Our email, documents, databases, customer lists—everything that we need to do business—is data. That data is critical to us. Servers are what we use to build the fabric upon which we trust our data to reside.

We traditionally think about servers using a client-server interface mentality. A user opens a program on their client computer, this program reaches out to a server in order to retrieve something, and the server responds as needed. This idea can be correctly applied to just about every transaction you may have with a server. When your domain-joined computer needs to authenticate you as a user, it reaches out to Active Directory on the server to validate your credentials and get an authentication token. When you need to contact a resource by name, your computer asks a DNS server how to get there. If you need to open a file, you ask the file server to send it your way.

Servers are designed to be the brains of our operation, and often by doing so transparently. In recent years, large strides have been taken to ensure resources are always available and accessible in ways that don’t require training or a large effort on the part of our employees. It used to be true that the general user population knew the name of your server and how to contact it because that was generally required for them to be able to get the information they needed.

If their mapped drives disappeared, it wasn’t uncommon that everyone would know how to throw \\server\share into File Explorer to get there via plan B.

It also used to be the case that your average business only ran one single server, enabling this to be true. Today our server landscape is vastly different, with even small businesses running a virtualization host that typically contains a dozen or more virtual servers, and much effort is made so that your workforce doesn’t know or care anything about that server infrastructure; they simply expect it to work 100% of the time.

In most organizations, many different servers are needed to provide your workforce with the capabilities they require. Each service inside Windows Server is provided as, or as part of, a role. When you talk about needing new servers or configuring a new server for any particular task, what you are really referring to is the individual role or roles that are going to be configured on that server to get the work done. A server without any roles installed is useless, though depending on the chassis can make an excellent paperweight. A 3U SAN device could weigh upward of 100 pounds and keep your desk orderly even in the middle of a hurricane!

If you think of roles as the meat and potatoes of a server, then the next bit we will discuss is sort of like adding salt and pepper. Beyond the overhead roles you will install and configure on your servers, Windows also contains many features that can be installed, which sometimes stand alone but, more often, complement specific roles in the operating system. Features may complement and add functionality to the base operating system, such as is the case with Telnet Client. Or a feature may be added to a server in order to enhance an existing role, such as adding the Network Load Balancing feature to an already equipped remote access or IIS server. The combination of roles and features inside Windows Server is what equips that piece of metal to do work.

This book will, quite obviously, focus on a Microsoft-centric infrastructure. In these environments, the Windows Server operating system is king and is prevalent across all facets of technology. There are alternatives to Windows Server and different products that can provide some of the same functions to an organization, but it is quite rare to find a business environment anywhere that is running without some semblance of a Microsoft infrastructure.

Windows Server contains an incredible amount of technology, all wrapped up in one small installation disk. With Windows Server 2022, Microsoft has got us thinking out of the box about what it means to be a server in the first place, and it comes with some exciting new capabilities, which we will spend some time covering in these pages. Things such as PowerShell, Windows Admin Center (WAC), software-defined storage, and software-defined networking are changing the way that we manage and size our computing environments; these are exciting times to be or to become a server administrator!

It’s getting cloudy out there

There’s a new term out there; you may have even heard of it... the cloud. I say this tongue in cheek of course, and if smiley faces were appropriate within published works, I would insert one here. While the word “cloud” has certainly turned into a buzzword that is often misused and spoken of inappropriately, the idea of cloud infrastructure is an incredibly powerful one.

A cloud fabric is one that revolves around virtual resources—virtual machines (VMs), virtual disks, and even virtual networks. Being plugged into the cloud typically enables things like the ability to spin up new servers on a whim, or even the ability for particular services themselves to increase or decrease their needed resources automatically, based on utilization.

Think of a simple e-commerce website where a consumer can go to order goods. Perhaps 75% of the year, the company can operate this website on a single web server with limited resources, resulting in a fairly low cost of service. But, the other 25% of the year, maybe around the holiday seasons, utilization ramps way up, requiring much more computing power. Prior to the cloud mentality, this would mean that the company would need to size its environment to fit the maximum requirements all the time, in case it was ever needed. They would be paying for more servers and much more computing power than was needed for the majority of the year. With a cloud fabric, which gives the website the ability to increase or decrease the number of servers it has at its disposal as needed, the total cost of such a website or service can be drastically decreased. This is a major driving factor of the cloud in business today.

Public cloud

Most of the time, when your neighbor Suzzi Knowitall talks to you about the cloud, she is simply talking about the internet. Well, more accurately, she is talking about some service that she uses, which she connects to by using the internet. For example, Office 365, Google Drive, OneDrive, and Dropbox—these are all public cloud resources, as they store your data in the cloud. In reality, your data is just sitting on servers that you access via the internet, but you can’t see those servers and you don’t have to administer and maintain those servers, which is why it feels like magic and is then referred to as the cloud.

To IT departments, the term cloud more often means one of the big three cloud hosting providers. Since this is a Microsoft-driven book, and since I truly feel this way anyway, Microsoft Azure is top-notch in this category. Azure itself is another topic for another book (or many other books) but is a centralized cloud computing architecture that can host your data, your services, or even your entire network of servers.

Moving your datacenter to Azure enables you to stop worrying or caring about server hardware, replacing hard drives, and much more. Rather than purchasing servers, unboxing them, racking them, installing Windows on them, and then setting up the roles you want configured, you simply click a few buttons to spin up new virtual servers that can be resized at any time for growth. You then pay ongoing op-ex costs for these servers—monthly or annual fees for running systems in the cloud—rather than the big cap-ex costs for server hardware in the first place.

Other cloud providers with similar capabilities are numerous, but the big three are Azure, Amazon (AWS), and Google. As far as enterprise is concerned, Azure simply takes the cake and eats it too. I’m not sure that the others will ever be able to catch up with all of the changes and updates that Microsoft constantly makes to the Azure infrastructure.

Private cloud

While most people working in the IT sector these days have a pretty good understanding of what it means to be part of a cloud service, and many are indeed doing so today, a term that is being pushed into enterprises everywhere and is still many times misunderstood is private cloud. At first, I took this to be a silly marketing ploy, a gross misuse of the term “cloud” to try and appeal to those hooked by buzzwords. Boy, was I wrong. In the early days of private clouds, the technology wasn’t quite ready to stand up to what was being advertised.

Today, however, that story has changed. It is now entirely possible to take the same fabric that is running up in the true, public cloud and install it right inside your datacenter. This enables you to provide your company with cloud benefits such as the ability to spin resources up and down, run everything virtualized, and implement all of the neat tips and tricks of cloud environments, with all of the serving power and data storage remaining locally owned and secured by you. Trusting cloud storage companies to keep data safe and secure is absolutely one of the biggest blockers to implementation on the true public cloud, but by installing your own private cloud, you get the best of both worlds, specifically stretchable compute environments with the security of knowing you still control and own all of your data.

This is not a book about clouds, public or private. I mention this to give a baseline for some of the items we will discuss in later chapters, and also to get your mouth watering a little bit to dig in and do a little reading yourself on cloud technology. You will find that Windows Server 2022 interacts in many ways with the cloud and will notice that so many of the underlying systems available in Server 2022 are similar to, if not the same as, those becoming available in Microsoft Azure.

In these pages, we will not focus on the capabilities of Azure, but rather a more traditional sense of Windows Server as would be utilized on-premises. With the big push toward cloud technologies, it’s easy to get caught with blinders on and think that everything and everyone is quickly running to the cloud for all of their technology needs, but it simply isn’t true. Most companies will have the need for many on-premise servers for many years to come; in fact, many may never put full trust in the cloud and will forever maintain their own datacenters. These datacenters will have local servers, which will require server administrators to manage them. That’s where you come in.

Windows Server versions and licensing

Anyone who has worked with the design or installation of Windows Server in recent years is probably wondering which direction we are taking in this book. You see, there are different capability editions, different technical versions, plus different licensing models of Windows Server. Let’s take a few minutes to cover those differences so that you can have a well-rounded knowledge of the different options, and so that we can define which portions we plan to discuss over the course of this book.

Standard versus Datacenter

When installing the Windows Server 2022 operating system onto a piece of hardware, as you will experience in Chapter 2, Installing and Managing Windows Server 2022, you will have two different choices of server capability.

The first is Server 2022 Standard, which is the default option and one that includes most of your traditional Windows Server roles. While I cannot give you firm details on pricing because that could potentially be different for every company, depending on your agreements with Microsoft, Standard is the cheaper option and is most commonly used for installations of Windows Server 2022.

Datacenter, on the other hand, is the luxury model. There are some roles and features within Windows Server 2022 that only work with the Datacenter version of the operating system, and they are not available in Standard. If ever you are looking for a new piece of Microsoft technology to serve a purpose in your environment, make sure to check the requirements to find out whether you will have to build a Datacenter server. Keep in mind that Datacenter can cost significantly more money than Standard, so you generally only use it in places where it is actually required. For example, if you are interested in hosting a Storage Spaces Direct (S2D) environment, you will be required to run the Server 2022 Datacenter edition.

One of the biggest differences between Standard and Datacenter that even small businesses may need to consider is the number of VMs that they can legally host. Out-of-the-box Server 2022 Standard can only run two VMs on it at any given time, which is a pretty limiting factor if you are looking to build out a Hyper-V server. Datacenter allows you to run unlimited numbers of VMs, which makes it a no-brainer when building your virtualization host servers. For running Hyper-V, the Datacenter edition is often the way to go.

There is more information on this topic that makes the previous paragraph complicated. Both Server 2022 Standard and Server 2022 Datacenter have the technical ability to run many VMs. Whether or not you are allowed to do so comes down to licensing. We will discuss more on this topic when we discuss Windows Server licensing structures later in this chapter.