- Greetings everyone, my name is Jeff Woolsey,
and it's a pleasure to be here to cover this topic today.
Windows Server Best Practices You'll Want
to Implement Today.
I've got a lot of content, so let's get started.
Now, first you may be wondering why I chose this topic.
Well, let me show you a common question
that I receive in email.
This email always starts like this from a customer.
Jeff, my organization urgently needs to know
about the next release of Windows Server.
Okay, great, how can I help?
We need to know about your Windows Server investments.
Okay, what version of Windows Server are you using?
We just upgraded to Windows Server 2012 R2.
Okay, well, I can only sum up my response in one way.
Look, I understand that different organizations
move at different paces.
But let's put this in context, please.
Windows Server 2012 R2 was released in summer of 2013.
If you've just upgraded to 2012 R2,
there's seven years of innovation waiting for you to deploy
in Windows Server 2016 and 2019.
There are huge advancements across the board in security,
application modernization, performance, scale,
hybrid capabilities, and so much more.
You should be taking advantage of that now
to help your organization.
I also know that a large percentage of you
have software assurance, so, in these cases,
you already own the software.
You're just not deploying it, for whatever reason.
So, with that in mind,
let's dive into these Windows Server best practices
that you'll want to implement today.
Let's start off, right off the bat,
with a high-level recommendation.
You really should be using Windows Server 2016
as your minimum OS, and, ideally, Windows Server 2019.
I could spend the entire session
talking about what's new in 2016 and 2019,
but I'm gonna quickly focus on four areas.
Let's start with security.
There's a whole bunch of new features,
like Just Enough Administration,
just-in-time administration, Credential Guard,
Remote Credential Guard.
By the way, these two security features mitigate
pass the hash attacks.
Device Guard, Windows Defender,
Windows Defender Control Flow Guard,
PowerShell logging for digital forensics.
These are just a few of the features in 2016 and 2019.
Then, of course, there's application modernization.
Containers, full stop.
If you're trying to modernize your applications,
whether using .NET, whether using Java,
whether you wanna bring your old applications forward,
containers are a great way to do that.
You only get that in 2016 and later.
Of course, Windows Server 2019
also includes the storage migration service
to modernize your file servers,
and we'll talk about more of that.
Also, rolling cluster upgrades, improvements to IAS 10,
like support for HTTP/2 protocols, and so much more.
And, of course, there's hybrid.
Windows Server 2016 ADFS added three new options
for sign-on without passwords, and configuration
for Azure, MFA with ADFS has never been simpler.
2019 ADFS has major new enhancements
to protected log-ons, like smart log-ons support
for remote PowerShell.
And there's much more.
Of course, there's management.
With Windows Admin Center, it just works out of the box
with Windows Server 2016 and later, period.
Windows Server 2012 R2 and earlier require that you
install Windows Management Framework 5.1 to be installed,
and some applications haven't been tested
and validated with WMF 5.1.
And, of course, there's a new PowerShell module,
IS administration, for managing IS.
Folks, I've highlighted just a few areas,
and, based on what organizations are trying
to do these days, such as improve security,
modernize their apps, adopt hybrid cloud,
and ease management?
Well, these are all right here,
and they've been available for years now.
Now, one thing that I'm seeing is more new hires
in the IT ranks.
And these folks are being asked to take over services
that may be new to them.
One of those are domain controllers.
For folks new to domain controllers, let's quickly discuss.
I cannot state this more clearly.
DCs are critical infrastructure.
Here's why.
DCs authenticate, store user account information,
and authorize all users and computers in a Windows domain.
Folks, DCs are the keys to your kingdom.
The bad guys really wanna get their hands on your DC.
DCs are used for signing and enforcing security policies
for all computers, and installing or updating software.
And finally, a common overlooked fact is
that DCs provide Windows Time Service,
also known as Win 32 Time which synchronizes the date
and time for all computers running in AD domain.
Now, remember those security and hybrid things
I mentioned a few moments ago?
Well, if you want maximum protection for your DCs,
both on-prem and as you connect them for hybrid cloud,
well, if your domain controllers aren't running
at least Windows Server 2016, you should be.
And I recommend going right to 2019.
So, here are just a few of the new enhancements,
in case you're wondering.
Certificate services.
in 2016, it now increases support for TPM key attestation.
You can use Smart Card KSP for key attestation and devices
that are not joined to the domain,
can use ENDES enrollment to get certificates
that can be attested for keys being in a TPM.
There's Privileged Access Management, or PAM.
This is a solution that's helped organizations
restrict privileged access
within an existing AD environment.
PAM adds protections for privileged groups
that control access across a range
of domain-joined computers, and applications
on those computers.
It also adds more monitoring, more visibility,
and more fine-grain controls.
And those are just a couple of the many, many improvements
across the board.
Now, I wanna point out some significant changes
to the Windows Time Service.
For folks in the financial industry, you're probably aware
that there were some regulatory changes
in the past few years, tightening the requirements
for time sync, due to high speed stock trading.
Well, prior to Windows Server 2016, the primary goal
of the time service was to provide necessary accuracy
to satisfy Kerberos.
However, with new regulations for time sync,
Windows Server 2016 added high-precision time,
providing you the ability to implement time sync
as low as one millisecond accuracy in your domain.
In Windows Server 2019, we went a full step further,
and added support for the Precision Time Protocol, or PTP,
for folks that need to go sub-millisecond,
and we added UTP-compliant leap second support.
So, at this point, I hope I've convinced you
to migrate your DCs to at least Windows Server 2016.
Now, let's discuss what this looks like at a high level,
and then step-by-step.
If you've never migrated a domain controller,
here's the process.
Number one, leave your existing server domain controller
as is.
Number two,
set up your new Windows Server domain controller.
Number three,
synchronize the Windows Server domain controller
with the old one.
Number four, promote the new domain controller.
Number five, demote the old domain controller.
So, that's it.
Five steps, that's the high level.
Now we're actually gonna do this step-by-step.
In this example, we're gonna migrate
a Windows Server 2012 R2 two domain controller
to a new Windows Server 2016 domain controller.
The process is the same for Windows Server 2019.
All right, let's go.
First, here we have a fresh installation
of Windows Server 2016.
The first step is to join the new Windows Server 2016 server
to the existing Windows Server 2012 R2 domain.
Restart when prompted.
Next, you sign into the Windows Server 2016
with a domain admin account.
In Server Manager, under Add Roles and Features,
install Active Directory Domain Services
on the new Windows Server 2016.
This will automatically run AD prep
on the existing Windows Server 2012 R2 forest and domain.
Next, in Server Manager,
on the new Windows Server 2016 system,
click the yellow triangle, and, from the dropdown,
click "Promote the server to a domain controller".
Now, we're gonna go through a short wizard,
and add this new DC
to the existing Windows Server 2012 R2 domain.
On the deployment configuration screen,
click "Add a domain controller to an existing domain",
and click next.
On the Domain Controller Option screen,
enter the DSRM password and click next.
For the remainder of the screens, you just click next.
On the Prerequisite Check screen, click install,
and once the restart is done, sign back in.
Now, on the Windows Server 2012 R2 server, the old server,
in Server Manager, click on the Tools menu,
and select Active Directory Module for Windows PowerShell.
So, now we're gonna move
the Flexible Single Master Operations role, or FSMO roles.
If you've never heard this before, hey, no worries.
Let me briefly explain what these are.
Active directory contains five roles,
called Flexible Single Master Operations roles.
These roles are required
for the domain controllers to function correctly.
During the first DC installation,
the FSMO roles are installed automatically.
There are two forest-wide roles,
Schema Master and Domain Naming Master.
There are three domain-wide roles,
PDC, RID Pool Manager, and Infrastructure Manager.
So, now we're gonna move the FSMO roles
from the old Windows Server 2012 R2 DC
to the new Windows Server 2016 DC.
In the PowerShell window,
use the Move-ADDirectoryServerOperationMasterRole
to move the FSMO roles.
You can type the name of each operation master role,
or use numbers to specify the roles.
The numbers make it a lot easier.
The default is yes, or Y, to move them all.
Hit enter five times and you're all set.
So, now, let's just verify that all five roles
have been moved to the new Windows Server 2016 DC.
Let's start with the three domain-wide roles,
PDC, RID Pool Manager, and Infrastructure Master.
On the server 2016 DC, in Server Manager, click Tools,
and select Active Directory Module for Windows PowerShell.
Use the PowerShell command Get-ADDomain.
Notice the three highlighted domain-wide roles
have been moved to the new DC, awesome.
Now, let's verify the two forest-wide roles,
Schema Master and Domain Naming Master,
have been moved to the new Windows Server 2016 DC.
On the Windows Server 2016 DC, in Server Manager,
click Tools,
and select Active Directory for Windows Module PowerShell.
Use the PowerShell command Get-ADForest cmdlets
to view the FSMO role holders.
Notice the Domain Naming Master and Schema Master
are referencing the new DC.
We have now verified that the new Windows Server 2016 DC
is in charge, awesome.
The next step is to move to demote
and remove the old Windows Server 2012 R2 DC.
To do this, use Server Manager, Windows Admin Center,
or use the ADDSDeployment PowerShell module
to remove the active directory roles.
Important: when removing the ADDS roles,
do not use the DISM.exe,
or the Windows PowerShell DISM module.
After promotion to a domain controller, it's not supported.
It'll prevent the server from booting normally.
This is because DISM is a native servicing tool
that has no inherent knowledge of ADDS
or its configuration, so, don't do it.
Once the server is demoted and removed,
you can raise the forest functional
and domain functional levels to Windows Server 2016.
In terms of securing your DCs against attack,
we have docs written explicitly on how to do this,
and I've included the link for you.
In addition, I wanna point to a three-part series
on the most common AD mistakes, highly recommended.
Finally, I wanna make sure that you've seen
this recent security bulletin,
and urge you to address this immediately.
This is an important issue,
and you should patch your DCs immediately.
I've included a link to the patch, and the documentation,
please follow the instructions, it's all there.
Now, let's get to file servers.
Windows file servers are ubiquitous, and because they are,
their importance is often overlooked.
File servers are critical infrastructure.
File servers store your organizational data,
both structured and unstructured.
File servers often contain sensitive data, that can,
and should, be protected with encryption,
file classification, and auditing enabled if appropriate.
FSRM, or File Server Resource Manager,
can automatically classify files,
perform tasks based on these classifications,
set quotas on folders,
and create reports monitoring storage usage.
If you haven't looked into FSRM, you should.
Now, remember those security and hybrid things
I mentioned earlier?
You want maximum protection for your file servers,
both on premises, and as you connect them for hybrid cloud.
So, if your file server isn't already running
at least Windows Server 2016, you should be,
and, again, I'm going to recommend going right to 2019.
Now, here are just a few improvements in Windows Server 2016
and later.
Security, pre-authentication integrity
provides improved protection from man-in-the-middle attacks.
Tampering with SMB connections, and authentication messages.
Performance, with directory caching.
Windows clients can now cache much larger directories,
approximately 500,000 entries.
Windows clients will attempt directory queries
with one megabyte buffers to reduce round trips,
and improve performance.
And this is just a few.
In addition to these enhancements,
let's talk about how you can get more bang for your buck,
with deduplication.
Now, data deduplication, often called dedupe for short,
is a feature that can help reduce the impact
of redundant data on storage costs.
When enabled, day-to-day duplication optimizes free space
on a volume by examining the data on the volume,
by looking for duplicated portions on the volume,
and optimizes redundancies
without compromising data fidelity or integrity.
Now, you may be thinking, wait a minute, hey,
doesn't Windows Server 2012, 2012 R2, have dedupe?
Yes, but with several important considerations.
Volumes must be carefully sized to ensure
that data dupe could keep up with the churn on the volume.
The average maximum size of a dedupe volume,
for a high-churn workload, was one to two terabytes.
That's not very big these days.
The absolute maximum recommended size was 10 terabytes,
and here's why.
In Windows Server 2012 R2,
the data deduplication job pipeline uses a single thread
in I/O queue for each volume.
So, no matter how many cores, the dedupe job isn't scaling
to take advantage of them.
In Windows Server 2016 and later,
the dedupe job job pipeline was redesigned to scale
and run multiple threads in parallel
using multiple I/O queues for each volume.
Performance and scalability is greatly improved
with more cores.
And, as a result, dedupe now supports volumes
up to 64 terabytes, and files up to a terabyte,
among other enhancements.
These improvements are huge.
And in case you're wondering what you can expect
for storage savings with dedupe,
here are a few different scenarios,
such as user documents, deployment shares,
virtualization libraries, and general file shares.
You can see varying levels of savings,
but these numbers are huge across the board.
Again, dedupe optimizes redundancies
without compromising data fidelity or integrity.
Now, you may be thinking, hey, Jeff, this is great,
but how do I move all my old file servers
to Windows Server 2016 or 2019?
Well, you do it
with the Windows Server 2019 Storage Migration Service.
The Storage Migration Service is a feature built
into Windows Server 2019, and will help you migrate
your old file servers from as far back
as Windows Server 2003, yes, I said 2003,
to Windows Server 2016, 2019.
The UI is a wizard-based workflow in Windows Admin Center,
and, honestly, it's a thing of beauty.
Now, if you'd like to see a step-by-step
of upgrading file servers,
check out the storage migration video from my pal, Ned Pyle.
Since we've been talking about migration,
I wanna make you aware of brand new migration assessment
we're working on for Windows Server.
You've told us you want help getting an inventory
of your on-prem environment,
assess your risk moving forward, and help with mitigations.
This assessment is based on your request for this tool.
If you wanna know more, check out this session online
at aka.ms/AppAssessment, and join the private preview.
Finally, if you're not using Windows Admin Center,
you should begin immediately.
You can download it, install it,
and be managing your Windows Servers
in just a couple of minutes, it's that easy.
We deliver new versions of Admin Center twice a year,
and we're constantly adding new tools and features.
Admin Center is available at no cost,
and you can download it at aka.ms/WACDownload.
I'm out of time, so I'm gonna pass this to Prasidh
to cover Windows Admin Center in detail.
Finally, there are links to learn more about Windows Server,
Azure, and more.
I hope you enjoyed this session,
and now to Prasidh for Windows Admin Center.
Thank you very much.