1. Planning
   1. INSTALLATION
      1. dism.exe
         1. convert GUI to CORE or vice versa
            1. Convert Server Core back to Server GUI
            2. Dism /online /enable-feature /featurename:Server-Gui-Mgmt /featurename:Server-Gui-Shell /featurename:ServerCore-FullServer Y
         2. Import-Module DISM Disable-WindowsOptionalFeature -online -Featurename Servercore-Fullserver y
      2. Add-WindowsFeature
      3. Install-WindowsFeature
   2. Windows Server 2012 R2 Datacenter
      1. Can upgrade from: 2012 Datacenter 2008 R2 Enterprise SP1 2012 Standard
   3. Windows Server 2012 R2
      1. can remove DHCP offline VHD
      2. WMF 4.0 built-in
   4. Windows Server 2012
      1. No Work Folders
   5. Windows Server 2008 Core
      1. Can NOT migrate to 2012 R2
   6. Windows Server 2008 R2 Core
      1. Can Migrate to 2012 R2
   7. Windows 8 Enterprise
   8. Windows 8.1 Pro
      1. RSAT
      2. Can remove DHCP offline
   9. Windows Server 2008 R2
      1. To remote manage (higher server) needs WMF 3.0 & .Net Framework 4.0 or plus
   10. Windows 7
   11. Windows Server 2003 Datacenter SP1
       1. Can migrate to 2012 R2
   12. Windows Server 2003 R2 Datacenter
       1. Can migrate to 2012 R2
2. AD
   1. Domain services
   2. Delegate Control
      1. Delegation control wizard
      2. Subnet
         1. AD Sites and Services
   3. User Accounts
      1. Attributes
      2. Multiple users
         1. CSV file and use PowerShell
      3. disable
         1. dsmod user CANONICAL NAME -disable yes
   4. Computers
      1. Offline Domain Join
         1. 1. Open an elevated command prompt on Server 2. djoin.exe /provision /domain /machine /savefile 3. Copy the provisioning data file to the Client Computer 4. Open an elevated command prompt on Client 5. djoin.exe /requestobj /loadfile /windowspath /localos 6. reboot client computer
   5. Logical Components
      1. schema
         1. schema master
         2. objects that are accessible
         3. attributes
            1. classes
         4. SIDs
      2. partition
      3. domain
         1. DNS
      4. domain tree
         1. share space
      5. forest
      6. site
         1. logging into the right site
      7. OU
         1. folder
         2. delegate authority
         3. deploy group policy
   6. physical Components
      1. Domain Controller
         1. oprerational master
         2. unique name
      2. data store
      3. global catalog servers
      4. RODC
3. GPO
   1. Software Restriction Policy
      1. Application
   2. Windows 7 Upgrade
      1. Specify Setting for optional component installation and component repair
   3. Group Policy Management Editor
      1. Computer Configuration
         1. Windows Settings
            1. Security Settings
            2. Local Policies
            3. User Rights Assignment
            4. Deny Logon Locally
   4. User Account RIGHTS
      1. access network resources
         1. locally
            1. Local Security Policy
            2. Assign the "Access this computer from the network" GPO
   5. Links
      1. To Implement corporate Policies
         1. parent GPO Link has Precedence over child GPO Link
         2. Child Object not being applied
            1. remove enforcement from the parent GPO link
      2. force a collection of settings
      3. linked to OUs domains sites
   6. Resultant Set of Policy (RSoP)
      1. from remote computers
      2. GPMC
         1. gathers information
   7. Starter GPO
      1. Remote Event Log MAnagement
         1. NP-In
         2. RPC
         3. RPC-EPMAP
         4. WMI-in
   8. Dynamic Access Control (DAC) policy
      1. set attributes for access
      2. Enforce Settings on accessing Resources
   9. Restore
      1. dcgpofix /target:both
         1. restore Defaults
            1. Domain Policy GPO
            2. Domain Controllers GPO
   10. ADMX files
       1. Administrative Templates
       2. created manually
          1. Stored in C:\windows\PolicyDefinitions
          2. create a central store root folder within PolicyDefinitions Folder
          3. Create the EN-US subfolder in the PolicyDefinitions Folder
       3. registry.pol file
   11. Security Templates
       1. apply server configuration to other servers
   12. NOTES
       1. downloads GPO after boot
       2. in SYSVOL
       3. first Computer Boots
       4. second when User Logs on
       5. refreshes 90min
4. Security
   1. Application control policy
      1. AppLocker
         1. Rule Collections
            1. Window Installer Files
            2. .msi
            3. Packaged App Installers
            4. .appx
            5. Scripts
            6. .VBS
            7. .ps1
            8. DLLS
            9. .ocx
            10. Executable Files
            11. .com
            12. add rules up from parent
         2. Rule
            1. execution of application on clients computers
            2. Publisher Condition and Path Condition
         3. under security settings - Application Control policies
      2. Augmented to support Win 8 packaged apps
      3. Applied using Applocker Group Policy settings
      4. Introduced Windows Server 2008 R2
   2. Updates and Fixes
      1. Network Access Protection (NAP)
   3. Firewall
      1. Rules
         1. Inbound
            1. traffic coming into the device
         2. Outbound
            1. traffic leaving the device
         3. Security Connection Rules
            1. Tunnel
            2. Authenticate connections between 2 gateway computers
            3. Isolation
            4. separate inbound & outbound connections based on credentials
            5. Authentication Exemption
            6. do not require authentication
            7. Custom
            8. allow to add IP address & leave other endpoinbt open (authentication req)
         4. Ports
            1. SMTP = 25
            2. HTTPS = 443
            3. POP3 = 110
            4. RDP = 3389
            5. Telnet = 23
      2. DMZ
         1. Authentication Exemption
            1. Exempting from Authentication in and out of firewall
            2. improve performance
            3. protects internal network
         2. Not to expose DNS
         3. Store in AD
   4. Software Restriction
      1. Policy for Internal Applications
         1. Rule Types Order
            1. 1. Hash 2. Certificate 3. Path 4. Internet Zone 5. Default
      2. Software Restriction policy
         1. Used to identify software running on a local computer
         2. Introcuced prior to Windows Server 2008 R2
         3. Deployed using Domain-wide group policy
   5. NTFS
      1. Configure NTFS Permissions
      2. Permissions
         1. Full Control
            1. Delete
            2. Change Permissions
            3. Create Files and Write Data
            4. Take Ownership
            5. Traverse Folder/Execute File
         2. Modify
            1. Delete
            2. Create Files and Write Data
            3. Traverse Folder/Execute File
         3. Write
            1. Create Files and Write Data
         4. Read
         5. Read/Execute
            1. Traverse Folder/Execute File
   6. Share permissions
   7. UAC
      1. accept updates without UAC prompts
         1. UAC: Detect applications and prompt for elevation
      2. TrustedHost list for NTLM authentication
         1. So processes can run like remote workgroup server
      3. policy settings
         1. Access Token
            1. Two generated for an administrative user signing onto a computer
            2. Generated when a standard user signs on to a computer
         2. Consent Prompt
            1. presented when a user performs a task that requires admin privileges
         3. Credential Prompt
            1. Displays when a standard user attempts to perform an admin function
         4. Admin approval Mode
            1. Required to elevate the security context from standard to admin
   8. Auditing
      1. collection of settings
         1. success and or failure settings
      2. enabled
         1. Audtipol.exe
         2. secedit.msc
      3. Documentation
         1. what when where
      4. Triggers
      5. Policy
         1. account logon events
         2. account management
         3. directory services
            1. record access events taking place on AD objects
         4. logon events
         5. object access
         6. policy change
         7. priviledge
            1. record user acces and actions on a system
         8. process tracking
         9. sytem events
      6. SACL
         1. system access control list
         2. Who will be audited
         3. Auditing inheritance apply
   9. Security Templates
      1. Configure permissions for startup modes using system services
      2. Define access control permissions for NTFS
      3. define the users allowed to be members of groups using RESTRICTED GROUPS
      4. Merge Predefined security templates to an Existing GPO
         1. 1. Open GRoup Policy Management 2. Open the target GPO to edit 3. Open the security template 4. Navigate to Security Settings to import a template 5. Confirm merge
5. Hyper-V Manager
   1. VMs
      1. Create and Configure Virtual Machine Settings
      2. Backup
         1. Checkpoint (earlier version called Snapshots)
            1. Managing VM Checkpoints
            2. revert the virtual machine to a previous state
            3. Checkpoint name
            4. Revert = Rollback
      3. Generation 1
         1. x86 Architecture
         2. RemoteFX Enabled
         3. Backward Compatible
         4. Subtopic 4
         5. Server 2008
         6. Server 2008 R2
      4. Generation 2
         1. Secure Boot
         2. Boot from SCSI
         3. PXE boot
         4. Windows 8.1 64-bit
         5. Supports 4 SCSI controllers
         6. Each Controller can support up to 64 = 256 Storage devices MAX
      5. Hyper-V Resource Metering
         1. Measure-VM
            1. Average CPU
            2. max disk space per VM
            3. IO net traffic per virtual adapter
      6. Memory
         1. Found under Settings
         2. Dynamic Memory (RAM) max-min
         3. Smart paging
            1. location of temp memory
            2. used when no physical mem is avail
            3. Booting VMs need more mem
            4. Smart Paging File Location
      7. Create a VM from ISO
         1. 1. select Create a virtual hard disk 2. Install OS from Boot CD/DVD 3. Select
      8. Join Domain
         1. offline domain join (faster)
      9. guest integration services
         1. fastest comm for guest & server
         2. Pass local resources into the OS
         3. 2012 Server R2 onwards
      10. Virtual Machine Connection Tool
          1. execute an enhanced session mode connection
             1. redirecting local resources to VM (display,USB, printers etc)
             2. in Hyper-V Settings
   2. Install Hyper-V Remotely
      1. Open a PowerShell Session
         1. Get-WindowsFeature
            1. Get-Help Install-WindowsFeature
            2. Install-WindowsFeature -Name <Feaure_name> -computername <computer_name> -restart
   3. Networking
      1. Switches
         1. Configure Hyper-V Virtual Switches
         2. Internal Switch
            1. Virtual Host Plugs in
         3. External Switch
            1. Connects to a physical Switch
            2. Access to a physical network
         4. Private Switch
      2. NIC
         1. NIC Teaming
            1. Set-VMNetworkAdapter
            2. under Advanced Features
            3. ADV
            4. Enhance Throughput and Availability
            5. Run from VM
            6. lbfoadmin.exe
            7. Process
            8. 1. Open Server Manager 2. Access NIC Teaming for the Server 3. Select both NICs, right-click and select Add to New Team 4. Enter the Team Name
      3. Virtual Switch Manager
         1. Configure range of MAC addresses
            1. assigned to VMs
         2. Under Global Network Settings
      4. Network Isolation
         1. Port Access Control Lists (ACLs)
      5. network performance
         1. Virtual Receive-side scaling (vRSS)
            1. avoid bottlenecks network traffic to VMs
         2. IP REwrite
            1. increase Throughput
6. Storage
   1. Volume
      1. list volume
         1. display volume label, number, letter, file system, size and status
   2. Share
      1. net share TeamLeaders=e:\TeamLeaders
      2. Quotas
         1. Hard
            1. Enforce Quotas
         2. Soft
            1. Send Threshold Notifications
      3. Shared Folders
         1. Configure Shared Folders
         2. Ends with a $ is a hidden share
         3. Default Read-Only Access
   3. VHD
      1. Virtual Hard Disk Wizard (edit Existing)
         1. Convert
         2. Expand
         3. Compact
         4. Shrink
      2. Create & Modify VHDs and VHDx
      3. Offline
         1. Adding a Role to an Offline VHD
            1. 1. Configure a role-based installation 2. Locate a VHD 3. Locate a Server to mount VHD 4. Add the VHD File
      4. Disk Formats
         1. VHD
            1. 2TB
         2. VHDX
            1. 64TB
            2. Not Supported earlier than Win Server 2012
      5. Disk Type
         1. Fixed Size
         2. Dynamically expanding
         3. Differencing
            1. dependent on a parent drive
      6. pass-through disk
   4. SAN
      1. Fibre Channel Storage Area Network
      2. vSAN
      3. Virtual SAN Manager
   5. Virtual Fibre Channel Adapter
   6. DFS
      1. Distributed File System
         1. access-based enumeration (abe)
            1. view of files and folders
            2. dfsutil property abe enable \\server\path\share
   7. Work Folders
      1. Needs Windows Server 2012 R2
      2. NTFS
      3. Installation
         1. 1. Launch the Add Roles and Features Wizard 2. Select Role-based or feature-based deployment 3. Select the destination server 4. Select the Work Folders role service and OK
   8. DISKs
      1. Basic
         1. Configure
         2. Convert to Dynamic Disk
         3. Format Partition
         4. MBR
      2. Dynamic
         1. Configure
         2. Can convert back to Basic
         3. GPT Format
            1. partitions > 2TB need to convert to GPT
   9. Disk Pool (storage pool)
      1. Configure Disk Pools
         1. Create Virtual Disk after Pool
      2. collection of heterogeneous disks
      3. Select the physical disks for the storage pool
      4. Hot Spare (redundency)
      5. Virtual Disks
         1. Storage Layout
            1. Simple
            2. Striped for max capacity and increased throughput
            3. Mirror
            4. Parity
         2. Provision type
            1. Thin
            2. Volume uses space from Storage Pool as needed
            3. Fixed
            4. Volume uses space from Storage Pool = volume size
         3. New Volumes
            1. 1. Select Server & Disk 2. Size 3. Drive Letter 4. Select File System & Volume Label
   10. Failover Clustering
       1. Install & configure Failover Clustering
       2. fault tolerance in assuring network service availability
       3. iSCSI initiator
          1. access servers
          2. installed iSCSI target services on two servers to simulate a shared storage that can be used by members of a server cluster
          3. nodes of the server cluster acts as iSCSI initiators which are clients that connect to a shared volume
       4. Add-WindowsFeature -Name Failover-Clustering -IncludeAllSubFeature –IncludeManagementTools
       5. Set DNS name and point to A or AAAA record host
       6. Failover Cluster Manager
          1. Validate Configuration
          2. Create Cluster
       7. added functionality to a failover cluster by creating a storage pool
       8. in-place Upgrade each node
          1. 1. Remove one of the Servers from the cluster and upgrade to 2012 R2 2. Create a new Cluster 3. Run the Copy Cluster Roles wizard 4. Disband the old cluster 5. upgrade all remaining servers to 2012 R2
       9. Migrate Clustered Roles
          1. 1. Connect to the new Cluster 2. Run the Copy Cluster Roles Wizard 3. Take the Roles on the old Cluster Offline 4. Bring the Roles on the new Closter Online
   11. Offline Files
       1. Configure Offline Files
       2. Sync of Files and Folders
       3. Files not cached policy enabled in GPO
       4. 1. Configure Sync Options Using GPO 2. Go to OU -> Create GPO & Link 3. Name GPO 4. Edit -> Go to Computer Configuration-> Policies-> Administrative Templates-> Network-> select Offline Files 5. Options : Configure Background Sync -> Enable 6. Options : Enable Transparent Caching -> Enable
       5. GPO Setup ->User Configuration-> Policies-> Administrative Templates-> Network-> select Offline Files.
       6. Folder Redirection
          1. 1. Create a Folder Redirection Security Group 2. Create a File Share for the redirected folder 3. Create a GPO for Folder Redirection 4. Configure Folder Redirection with Offline Files 5. Enable the Folder Redirection GPO
   12. Volume Shadow Copy Service (VSS)
       1. Configure Volume Shadow Copy Service
   13. NTFS Quotas
       1. Configure NTFS Quotas
7. Networking
   1. DHCP
      1. Server
         1. DHCP Relay agent
            1. Fwd client request to another subnet
            2. DHCP/Bootstrap Protocol (BOOTP)
         2. Configure to issue IP addresses
            1. 1. Install DHCP service 2. Create DHCP scope 3. Activate Scope 4. Authorize the DHCP Server
         3. Authorize in AD
            1. Add-DhcpServerInDC
         4. may have 1 or more scopes
      2. Reservations
         1. allocation of addresses
            1. ie. printers
            2. servers
            3. network devices
      3. Scope Options
         1. Default Gateway Addresses
         2. DNS Server
         3. 1st and Last IP addresses
         4. Lease Duration
            1. Low lease for wireless
         5. Activate the scope
      4. Backup
         1. Reservation
         2. Leases
         3. Scopes
      5. Binds IP Addresses to MAC addresses
      6. database
      7. PXE boot can be defined if using WDS
   2. Remote Desktop Services
   3. DNS
      1. DNS MAnager
         1. Resource Records
            1. Mail Exchanger (MX)
            2. identify mail servers
            3. Canonical name (CNAME)
            4. multiple names are needed for a single host record
            5. Service Location (SRV)
            6. used to locate domain controllers
            7. Created automatically from AD DS
            8. have a priority
            9. Host (A)
            10. not for a DHCP Client
      2. nslookup
      3. Powershell
         1. New-NetIPAddress
         2. Set-DnsClientServerAddress
      4. 404 errors
         1. Flush DNS client resolver Cache
            1. ipconfig /flushdns
         2. Restart each user's computer
      5. Allows computers to establish a connection to a name associated to an IP address
      6. Process
         1. 1. Goes to a root server 2. delegate authority ie. a .com server 3. authorative delegate to second level dns server 4. provides an IP address 5. Client will cache the information
      7. Primary Zone
         1. read and write replicate to a secondary zone
         2. read/write copy
      8. Zone transfer Process
         1. Secondary
            1. read only
            2. Checks with master every x min
         2. Stub
            1. Copy to find Primary (redirection)
         3. notify
            1. Push info if received info straight away
            2. keeps servers up-to-date
      9. Dynamic Updates
         1. Best security is not to have it
         2. Inserts records into the DNS
         3. NS (name server) and SOA records already created
      10. KMS Activation Infrastructure
          1. Manually create the _vlmcs._TCP SRV record and point it to KMS host
      11. Active Directory
          1. AD integrated DNS
             1. encrypted
             2. mulitmaster topology
             3. Branch offices RO copy
             4. All DNS servers jost the same info
          2. Non-AD integrated DNS
             1. zone transfers are not secured
             2. DNS data is stored locally
             3. Uses Cache only option
          3. AD needs DNS
             1. AD replicates data automatically
             2. Store in AD for security
             3. multimaster
      12. root hints
          1. provides a list of IP addresses of DNS servers that are considered to be authoritative at the root level of the DNS hierarchy
          2. (also known as root name server).
      13. cache.dns
          1. checks its own cache first
          2. Populated to root hints
          3. list of root servers
      14. NOTES
          1. Finds Authoratative servers
          2. delegate authority
          3. levels
             1. root-level
             2. first-level
             3. .org , .com, .eu
             4. second-level
             5. .microsoft, google
             6. third-level
             7. mail.microsoft
          4. resource records
             1. information and IP address associated
             2. registration records of DHCP clients
          5. DNS recursion
             1. look up itself
          6. SOA
             1. Start of Authority
             2. version number (increments)
             3. primary server
             4. email
             5. refresh time
             6. in each zone
          7. Forwarders
             1. if no answer, indtead of root hints try this server
             2. capitalize on cache
             3. add manually
             4. ISP may use this
          8. reverse lookups
             1. IP to name
             2. used for security
             3. verification usage
             4. PTR
          9. Cache lookups
             1. shown in advances view of DNS manager
   4. IPv6
      1. Link-Lcal Unicat Address
         1. FE80::/8
         2. Local connectivity
         3. auto address config
         4. router discovery
         5. neighbour discovery
            1. AnyCast
      2. Unique Local Unicast Address
         1. FC00::/7
         2. local comms
         3. assign DA clients
         4. Not desireable to configure a long time
      3. Global Unicast Address
         1. 2000::/3
         2. publicaly routable addresses
      4. IPsec built in
      5. 128bit
      6. avoidance of Broadcast
      7. AAAA records DNS
      8. No NAT
      9. Multicast
      10. Router
          1. Stateless
             1. client assigns itself and IP address
          2. Statefull
             1. Binds Addresses
      11. Technologies
          1. ISATAP
             1. Tunneling Protocol
             2. transmit IPv6 packets between dual-stack nodes on top of an IPv4 network
             3. using Group Policy
             4. Can Implement Using DirectAccess
          2. 6to4
             1. Public Tunneling
             2. Remote hosts
             3. Site-to-site connections
             4. Not NAT
             5. Starts with 2002
             6. Uses Relay Routers to forward IPv6 Through IPv4 environment
          3. Teredo
             1. Tunneling 6to4
             2. Supports NAT
             3. Client
             4. Server
             5. direct traffic
             6. configuration point
             7. Ipv4 & IPv6 address
             8. Encapsulated in a UDP packet
          4. NAT64
             1. Acts as a network device between IPv4 and IPv6 network
   5. DirectAccess
      1. IPv6
         1. ISATAP
   6. IP Address Management (IPAM)
      1. Best deployed on a member server in each site
      2. Can Not be installed in AD DC
8. Server Manager
   1. Feature on Demand
      1. data Deduplication
         1. locate and remove duplication of data without issues
         2. File and Storage Services
      2. IIS Web Server
      3. Install-WindowsFeature –Name AD-Domain-Services -IncludeManagementTools
   2. Remote Server Manage
      1. 2008 R2
         1. Install .NET Framework 4 or newer
            1. Install Windows Management Framework (WMF) 3.0
            2. Install hotfix KB2682001
      2. Server Core
         1. Configure-SMRemoting.exe -enable
         2. Not able to connect unless WinRM
9. PowerShell
   1. Desired State Configuration (DSC)
      1. Need Windows Management Framwork (WMF) 4.0
      2. Install or remove server roles and features Manage registry settings Manage files and directories Start, stop, and manage processes and services Manage local groups and user accounts Install and manage packages such as .msi and .exe Manage environment variables Run Windows PowerShell scripts Fix a configuration that has drifted away from the desired state Discover the actual configuration state on a given node
      3. setup a central configuration pull server
         1. Stores computer configurations
         2. Can be checked for updates of the pull server
         3. Not on a Core Server
            1. Need to convert the server to a "Server with a GUI" installation
            2. Install-WindowsFeature DSC-Service
10. Cloud Services
    1. windows Azure
       1. VMs
          1. Server Applications
             1. AD
       2. Services
          1. Infrastructure as a Service (IaaS)
11. Printing
    1. Policy
       1. Use Remote Desktop Easy Print Print Driver First
          1. local machine
          2. no need to install prin drivers
       2. deploy by gpo
    2. Drivers
       1. Install
          1. Add-PrinterDriver -Name "Some printer"
       2. Version 4
          1. discover drivers over the network
          2. no architure dependent
          3. delivered from WSUS
       3. Type 3
          1. Backwards comaptible
       4. Class drivers
    3. NOTES
       1. Branch
       2. adrvertise in listing of printers
       3. Printing Priority
          1. higher has precedence
       4. driver isolation
          1. troubleshooting
          2. protecting from crashing
          3. enabled by default
    4. Print Pooling
    5. Distributed Scan Server
    6. Services
       1. Role
12. Domain Controller
    1. replication traffic
    2. install from media (IFM)
       1. NTDSUTIL.EXE
          1. Create Full NoDefrag %s
             1. Creates an IFM store w/o Defrag
             2. space is limited and as fast as possible
    3. NTDS.DIT
       1. database
    4. Global Catalog Server
       1. if unavailable - Configure universal group membership caching at sites
          1. eliminates the need to contact DC for authentication
    5. Deploy a domain controller (Slow Connection)
       1. 1. Create an IFM installation Run Ntdsutil.exe on main domain controller 2. Install a server in the branch office and install AD DS role 3. Promote the server to a Controller 4. Configure the server to perform an install from Media (IFM) (using previous created media)