Sara Perrott - Windows Server 2022 & Powershell All-in-One For Dummies

Resource Monitor: If you just want a quick look at how your system is doing, Resource Monitor is great for that. It has a simple summary screen that gives you information on your CPU, disk, network, and memory usage. This tool focuses on resource utilization and could help troubleshoot issues like low disk space, an overutilized disk, or insufficient network bandwidth. FIGURE 1-3:The Tools menu in Server Manager.

System Configuration: I use System Configuration when I’m having boot issues. The Boot tab gives me several helpful options, including whether I want to use safe boot, if I want to create a boot log, and if I want to use a very basic video setting.

System Information: When you need to know what your hardware specs are or what some of your settings are, this should be your go-to utility. It can even tell you what version of BIOS you’re running and what mode it’s running in.

Windows Memory Diagnostic: This is the same memory diagnostic that I cover in Book 1, Chapter 2. You’re simply launching it from the menu rather than typing in the name of the program.

Windows PowerShell: PowerShell is always handy. You can query settings and export to a text file if need be.

The majority of your configuration tasks will be done in the Local Server section in Server Manager. When you click Local Server, you’re presented with a Properties page that displays current server information, shown in Figure 1-4. The great thing about this page is that every setting is a clickable hyperlink. If you click it, you’re taken to where you can configure that individual setting. Pretty cool, right? When you have a freshly built server, it simplifies the configuration process because you can change the hostname and IP address from here, as well as update the server, add it to a domain, even activate the operating system.

FIGURE 1-4:The Server Manager’s Local Server properties screen.

I mention earlier that, by default, all Windows Server 2022 systems have the File and Storage Services role installed. This gives you an easy-to-access menu to work with your server’s storage. When you click File and Storage Services in the navigation menu, you’re presented with several options; select Disks. This is where you can bring new disks online, initialize the disks, and create volumes, shown in Figure 1-5.

FIGURE 1-5:Working with disks in the File and Storage Services area of Server Manager.

As I mention earlier, a role is something that we want the server to do. By installing roles, you make servers useful. Maybe you’re building out an Active Directory infrastructure, or maybe you’re creating a robust virtualization platform. Regardless of what you’re trying to accomplish, you’ll most likely start by installing a role.

Let’s take a look at the roles that are part of Windows Server 2022.

Active Directory Certificate Services (AD CS) is a role that allows you to create a public key infrastructure (PKI) in your organization that will allow you to issue your own internal certificates. This may include certificates for your domain controllers so they can support Lightweight Directory Access Protocol (LDAP) over Secure Sockets Layer (SSL), or certificates for internal web servers, or even code-signing certificates for scripts that will run on your organization’s systems. You can install certificate authorities (CAs) and provide additional services like Online Certificate Status Protocol (OCSP), which provides lookups for certificate revocation information, and Network Device Enrollment Service (NDES), which allows network devices to enroll for certificates without domain credentials.

AD CS has a lot of moving pieces. If you’re interested in learning more about AD CS, including how to install and configure it, check out Book 5, Chapter 6.

Active Directory Domain Services (AD DS) gives you the ability to store information about users and other network objects in a directory service. You can organize these objects in a hierarchical structure with forests, domains, and organizational units (OUs).

Active Directory contains a global catalog, which contains information about every single object in the directory, and is required for successful logon to the domain. With Active Directory, it’s simple to search for and locate specific objects if you know a little information about them.

If you’re interested in AD DS, you can learn more about installing and configuring AD DS in Book 2, Chapter 5.

Active Directory Federation Services (AD FS) can provide single sign-on capabilities to organizations that are utilizing AD DS. It allows those with an Active Directory account to use that account on applications that are outside the boundaries of their Active Directory (for example, a web application hosted by a business partner), or applications that don’t rely on Active Directory accounts for authentication at all. By creating a federation (the sharing of identity information), the user can be authenticated via his company’s Active Directory and can then be authenticated to the business partner’s web application with a claim. The business partner simply has to configure their web application to trust the incoming claims.

Active Directory Lightweight Directory Services (AD LDS) is a Lightweight Directory Access Protocol (LDAP)–based directory service similar to AD DS. It’s designed to be used with directory-enabled applications, and it’s especially handy for an organization that may want to establish a directory of customer accounts, but keep that directory separate from the organization’s AD DS infrastructure.

It can be used as an identity provider with AD FS for both authentication and the generation of claims to web applications that are configured to understand federation.

Active Directory Rights Management Services (AD RMS) allows businesses to create and enforce policies to protect their data. The rules are created on the AD RMS server but continue to protect documents even if they leave the premises. For example, you can set the policy to allow documents to only be accessible for a brief amount of time, after which the recipient can no longer open them. You can take away the ability to print the document or copy text out of it with copy/paste.

AD RMS is not perfect. It won’t prevent someone from taking a screenshot of the data in a sensitive document (there aren’t many rights management products that can prevent this activity). Plus, the applications on the client side must support RMS. The functionality exists in the Microsoft Office suite of applications, SharePoint, and Exchange Server. You can also make Internet Explorer compatible with an add-on.

The Device Health Attestation role was added in Windows Server 2016. It gives administrators a way to verify that a device is healthy as it boots. It can measure several different settings and is configured with whichever settings the system administrator or network administrator wants to track. This role is often used for systems to validate that they’re safe before they’re allowed to connect through remote access services like DirectAccess or other virtual private network (VPN) services.