Activation

One of the first things that you do after installing the Windows Server operating system is activate it with a valid product key. You can do this through the desktop interface or through PowerShell.

In this section, I cover activating through the desktop interface. I cover activation through PowerShell in the later section on activation for Server Core.

1. Log into the server.

   Server Manager opens automatically.

2. In Server Manager, click Local Server in the navigation pane.

3. To start the activation process, click the Not Activated hyperlink next to Product ID.

   A dialog box launches automatically asking for the product key.

4. Enter your product key and click Next.

   You’re prompted to activate Windows.

5. Click Activate.

   You get a confirmation that Windows has been activated.

6. Click Close.

   You’re left on the Activation screen shown in Figure 4-1, where you see that your version of Windows is now activated.

Time zone

Setting the time zone is a common task in the server provisioning process. You may want to set the server to the time zone that you are in, or to the same time zone as a corporate office located elsewhere. This is common if your servers are in a co-location and you want them to be on the same time zone as your local systems.

1. In Server Manager, click Local Server in the left-hand menu.

2. Click the hyperlink next to Time Zone.

   This may already be set to the correct time zone for your area.

3. Click the Change Time Zone button.
4. Select your time zone from the drop-down list.
5. If you’re in an area that uses Daylight Saving Time, click the check box next to Automatically Adjust Clock for Daylight Saving Time. If you do not use Daylight Saving Time, leave the box unchecked.
6. Click OK to exit the Time Zone Settings dialog box, and then click OK again to exit the Date and Time dialog box.

Computer name and domain

Setting the computer name is a must in an enterprise environment. Most organizations have a naming convention that you need to follow, but the names the organization requires will certainly be easier to remember than the default randomly generated name. Joining to the domain is one of the simpler steps, but also one of the most important steps to enable centralized authentication management and configuration capabilities.

1. In Server Manager, click Local Server in the left-hand menu.

2. Click the hyperlink next to Computer Name.

   This will be the default name that starts with WIN- and will be followed by a random string of letters and numbers.

3. Click the Change button.

4. In the Computer Name field, enter the name that you want for your server, and then click OK.

   A dialog box appears telling you that you need to restart the server.

5. Click OK.

6. Click the Close button in the System Properties dialog box.

   You’re prompted to either Restart Now or Restart Later.

7. Click Restart Now if you want to reboot the server immediately. Click Restart Later if you want to finish other administrative tasks you may have first.

   If you click Restart Later, you’ll need to manually reboot the server when you’re ready.

8. To join a domain, perform Steps 1 through 3.
9. In the Computer Name/Domain Changes dialog box, click the Domain radio button, and enter the name of the domain you want to join.

10. Click OK.

    A dialog box appears telling you that you need to restart the server.

11. Click OK.
12. Click the Close button in the System Properties dialog box.

13. Click Restart Now or Restart Later.

    After the restart, the server will be joined to the domain.

Configure networking

Your server will use a dynamically assigned IP address by default. If this is not desirable, you’ll want to set a static IP address so that the server will continue to use the same address.

1. In Server Manager, click Local Server in the left-hand menu.
2. Next to Ethernet, click the hyperlink that says IPv4 Address Assigned by DHCP, IPv6 Enabled.
3. Right-click your network adapter (it should be called Ethernet), and click Properties.

4. Click Internet Protocol Version 4, and then click the Properties button.

   By default, the server is set to obtain an IP address automatically and obtain DNS server addresses automatically. If this is what is desired, then no changes are necessary.

5. If you need to make changes, select Use the Following IP Address.
6. Fill in the IP address, subnet mask, and default gateway.

7. Manually enter the addresses for the preferred DNS servers.

   See Figure 4-2 for an example.

8. Click OK to close the dialog box.
9. Click OK one more time to exit out of Ethernet Properties.

Activation

Windows Server Core gives you a few different options for activating your copy of Windows Server 2022. In this section, I cover activating via sconfig, as well as activating via PowerShell.

ACTIVATING FROM POWERSHELL

After you’ve logged into Windows Server Core, you’re presented with the sconfig utility. From there, you can activate your copy of Windows. To set the license and do the activation from the command line, you’ll need to select menu option 15, “Exit to command line (PowerShell)”. To activate, you have to set the key. You do this with the Windows Server License Manager script, slmgr.vbs.

The slmgr.vbs script allows you to work with your Windows Server product keys in different ways depending on the parameter that you use along with it. In the example in this book, I use both -ipk and -ato. The -ipk parameter is used when installing product keys, and the -ato parameter is used to specify online activation.

To install the product key that will be needed for your version of Windows Server 2022, use the following command with the parameter -ipk. Just replace <productkey> with your 25-character license key, including the dashes.

slmgr.vbs -ipk <productkey>

You get a dialog box that tells you the product key installed successfully. Click OK.

After the license key is installed, you use the same script with the -ato parameter to do an online activation of your copy of Windows. You do that with the following command:

slmgr.vbs -ato

If the activation was successful, you get a dialog box that says the product was activated successfully (see Figure 4-3).

Time zone

Much like activation in Windows Server Core, you can set the time zone via sconfig or PowerShell. In this section, I cover both methods. The great thing about PowerShell version is that it will work on Windows Server with Desktop Experience as well.

Computer name and domain

Setting the name and adding a server to a Windows domain are some of the most common activities that system administrators do with new servers. With Windows Server Core, there are two methods that you should know to complete this task: sconfig (the configuration utility in Windows Server Core) and PowerShell.

Configure networking

Before you can set the IP address for the adapter with PowerShell, you need to find out what the index of your interface is. You can do this by typing the following:

Get-NetAdapter

The output lists all network adapters. In this case, you want the one that says Ethernet. After you have the index number, you can set the IP address and the DNS servers. On my server, the index is 4.

Use the following command to set the static IP address. InterfaceIndex is the index number for my network card, IPAddress is the IP address I want to assign, PrefixLength is the subnet mask that I want to use, and DefaultGateway is the gateway address for the local network (see Figure 4-4).

New-NetIPAddress -InterfaceIndex 4 -IPAddress 192.168.1.50 -PrefixLength 24 -DefaultGateway 192.168.1.1

I haven't discussed PowerShell much at this point, and this is a more complex bit of PowerShell. The New-NetIPAddress is a cmdlet that allows you to work with IP addresses on Windows Server systems. The parameters that come afterward, like -InterfaceIndex, help to identify the object you want to work with (the network adapter, in this case) or to make changes to the settings, like the -IPAddress parameter where you specify the IP address you want to set on the network adapter.

To set the DNS Server after that, the command uses the same index number for my network card. ServerAddresses is used to identify the DNS servers that the system should use (see Figure 4-5). If you have more than one, you can separate them with a comma.

Set-DNSClientServerAddress -InterfaceIndex 4 -ServerAddresses 8.8.8.8, 8.8.4.4

Automatic updates

Most organization use automatic updates. The following directions walk you through setting up your server to reach out to Microsoft’s update servers (the default behavior).

Many organizations have patching solutions that handle the scheduling of updates, and could still be considered an automatic update because the tool will schedule the deployment of approved patches.

1. Click the Start menu and type gpedit.msc.
2. Navigate to the Windows Update section by clicking on Computer Configuration, then Administrative Templates, then Windows Components, and finally Windows Update.
3. Double-click Configure Automatic Updates.

4. Select Enabled.

   You’re given configuration options.

   Under Configure Automatic Updating, you can see that it’s set to Auto Download and Notify to Install. This is the default setting.

5. Click the drop-down box and select the setting that works best for your environment.

   In my case, I’ve chosen Auto Download and Schedule the Install. See Figure 4-6 for an example.

6. Click OK to save the change.

Downloading and installing updates

You hear about the next big security vulnerability on the news media, and vendors release patches to the vulnerability very quickly after that. When a security vulnerability impacts your Windows Server systems, you may want to start a manual update — that way, your systems are protected outside of your normal patching windows. If your organization uses a patching solution, the patch may be pushed from that system, but there are always a few systems that don’t take the patch for whatever reason. You may have to manually update when that occurs.

1. With Server Manager open, click Local Server in the left-hand menu.

2. Click the hyperlink next to Last Checked for Updates.

   This may say Never if it hasn’t been run yet.

3. Click the Check for Updates button.

   The server will check to see if there are any updates available.

Automatic updates

There are two ways you can enable automatic updates on Server Core: using the sconfig utility and using PowerShell.

SETTING UPDATES TO AUTOMATIC VIA PowerShell

To set updates to automatic via PowerShell, you need to navigate to C:Windowssystem32 and stop the Windows Update service. It may already be stopped. Then you can use the script program to execute scregedit.wsf. Adding the switch /AU 4 enables automatic updates, /AU 1 would disable automatic updates. The following example enables Windows updates:

1. Stop the Windows Update Server service.

   net stop wuauserv

2. Set automatic updates to 4 which is enabled.

   cscript scregedit.wsf /AU 4

3. Start the Windows Updates Server service.

   net start wuauserv

If you would like to see an example of what this looks like and what the responses should be, please see Figure 4-7.

Downloading and installing updates

To force Server Core to then detect and install any available updates, simply type the following command and press Enter.

wuauclt /detectnow

Adding roles and features

Roles and features are added in Windows Server 2022 with Desktop Experience through Server Manager.

1. Open Server Manager.
2. Choose Manage⇒  Add Roles and Features.
3. On the Before You Begin page, click Next.
4. On the Select Installation Type page, click Next.
5. On the Select Destination Server page, click Next.

6. Check the check box next to the role that you want to install and click Next.

   For this demonstration, I’ve chosen File Server under File and Storage Services (see Figure 4-8).

   

7. On the next screen, select any features you may want to install and then click Next.
8. If you want the server to restart automatically if needed for the role you installed, you can select the Restart the Destination Server Automatically if Required check box. If a restart is not needed, or you don’t want it to restart, leave the check box unchecked.
9. Click Install to install the roles and/or features you selected.

Enabling remote administration

Remote Management is enabled by default and allows for remote administration through PowerShell. Remote Desktop is a separate setting that allows you to connect to the server and work with it directly.

When a server has Desktop Experience, administrators often prefer to work with the server over Remote Desktop. This is disabled by default; you enable it to use it. If the firewall on the server is enabled and does not have Remote Desktop enabled, you won’t be able to connect to it. You need to enable the Remote Desktop – User Mode (TCP-In) rule listed in the Inbound Rules of your server’s firewall.

1. With Server Manager open, click Local Server in the left-hand menu.
2. Click the hyperlink next to Remote Desktop that says Disabled.

3. In the dialog box that appears, select Allow Remote Connections to This Computer.

   A dialog box appears telling you that a firewall exception will be made for Remote Desktop.

4. Click OK.
5. If you want to set remote access for specific people or groups, click the Select Users button.
6. Click Add, choose your person or group, and click OK.
7. Click OK again on Remote Desktop Users to close out of it.
8. Click OK one more time on the System Properties screen to enable Remote Desktop.

Configure Windows Firewall

Assuming that you’re going to use the Windows Firewall on your server, you need to know how to enable applications through the firewall. By allowing inbound traffic, you enable the server to do the job you plan on using it for.

1. From Server Manager, select Local Server on the left-hand side.

2. Click the Private: On link next to Microsoft Defender Firewall.

   The Firewall & Network Protection app opens.

3. Click Allow an App through Firewall.
4. Select File and Print Sharing and enable it for the Private profile by selecting the check box under Private (see Figure 4-9).
5. Click OK to save your changes.

Adding roles and features

To get really good working with Server Core, half of the battle you face is learning how to find the things you want. In Server with Desktop Experience, you have the GUI to guide you. Not so with Server Core.

Let’s look at the example I used with the Desktop Experience server. You want to install the File Server role. Before you can install the role, you need to find out what to call it. By using Get-WindowsFeature, you can find the names of the roles and features you’re interested in. If you have an idea of what the name is, you can do a wildcard search. In the following example, I’ve used *file* to indicate that I want the Get-WindowsFeature cmdlet to return results that have the word file in them.

Get-WindowsFeature *file*

When you type the preceding command, you get three results of items that have file in their names. You can see File Server under Display Name. For the installation command, you need the name under the Name column. In this case, it's FS-FileServer. Now you’re ready to install it! Use the following command to install the File Server (see Figure 4-10):

Install-WindowsFeature FS-FileServer

You see a progress bar as the feature is installed. After it’s installed, if you run the first command again, you see that all three results are now installed. File and iSCSI Services was installed because File Server relies on it.

Enabling remote administration

Remote Management is enabled by default in Windows Server 2022. If it was disabled in your environment, you can enable it by running the Configure-SMRemoting command. This allows you remotely administer your server with Server Manager.

Configure-SMRemoting -Enable

To be able to administer the server remotely with PowerShell, you need two additional commands. Enable-PSRemoting configures PowerShell to receive remote commands that are sent to your system. Winrm quickconfig will analyze and automatically configure the WinRM service for you. This is very helpful when you just want it to work and don't need to customize it. The command starts the WinRM service if it isn’t already started, and ensures that WinRM is set to automatically start. It also configures listeners for HTTP and HTTPS, and ensures that the Windows firewall is allowing HTTP and HTTPS traffic inbound.

The Enable-PSRemoting command will not give you any output if it succeeds. You’ll simply be presented with the PowerShell prompt again.

Enable-PSRemoting -force

Running winrm quickconfig is a little different. After it runs its analysis, it tells you what needs to be changed and asks for a yes or no as to whether it can make the necessary changes. Select Y and press Enter. If everything looked good during the analysis, you'll be told that WinRM is already running and is already set up for Remote Management instead of the yes/no question.

winrm quickconfig

Configure Windows Firewall

Working with the Microsoft Defender Firewall on Server Core is pretty simple. You need to find the name of the rule you want to work with first. You can do that with the Get-NetFirewallRule command (see Figure 4-11). Using the Format-table command at the end makes the output more easily readable. Try the command without it — you'll see what I mean!

Get-NetFirewallRule *remote* | Format-table

The preceding command looks for any rules that have remote in the name. You can see each rule and whether it's enabled.

Let’s enable the Remote Firewall Management rules. These would allow you to administer this server’s firewall from another system. The rules you’re interested in are RemoteFwAdmin-In-TCP and RemoteFWAdmin-RPCSS-In-TCP.

Here are the commands you'll use to enable these (see Figure 4-12):

Set-NetFirewallRule –Name "RemoteFwAdmin-In-TCP" –Enabled True
Set-NetFirewallRule –Name "RemoteFwAdmin-RPCSS-In-TCP" –Enabled True

If the commands complete successfully, you’ll get no response. You’ll be returned to the PowerShell prompt. If you run your search again, you’ll see that these rules are now enabled.