IN THIS CHAPTER
As feature rich as SBS 2008 is in its own right, the addition of further servers to the network is a necessity for many environments. These additional servers can take on many roles and can be running a multitude of operating systems. The decision to add a server to a network needs to be made with careful consideration of what its purpose is—if this purpose requires a separate server or can be added to an existing server; the ability to manage and maintain this server on an ongoing basis; how the server will be backed up and how it will be recovered in the event of failure. This chapter specifically addresses the addition of Windows Server 2008-based servers to the SBS 2008 network, where these servers can fulfill several common scenarios likely to be encountered.
NOTE
For the purpose of clarity, this chapter may refer to a server other than the SBS 2008 server as the “second server;” however, in reality, there is no reason why an additional server cannot be the third, fourth, or fifth server on the network—it all depends on the specific requirements of your network environment as to how many servers you have. Any reference to the term “second server,” therefore, can also be read as “additional server.”
Prior to the implementation of any server on a network, the role it is going to serve on the network needs to be determined. In addition, there is the question of how the server is going to be licensed, which can be almost as time-consuming as the installation of the operating system!
This section provides an overview of some of the licensing models available from Microsoft for SBS based networks together with a summary of the most common roles the second server might fulfill on the network.
Any discussion on adding servers to a network needs to include some coverage of licensing. A server on the network needs to have a valid operating system license if it’s going to legally exist, although this license can be supplied under any one of several license options from Microsoft, and not all licenses necessarily need to be the same. Although complete coverage of Microsoft’s licensing programs is beyond the scope of this book, the following list identifies the most relevant license programs for the typical SBS 2008 network:
OEM
Retail
Microsoft Open License Program (MOLP)
Microsoft Open Value Licensing (MOVL)
Determining the correct licensing program for your environment can be as simple, or as complex, as you want it to be. There are factors that need to be considered when making a choice and certainly no “one size fits all” solution exists.
OEM licenses are typically the lowest-cost license to purchase but come with limitations in terms of being able to reassign the license to another piece of hardware (unless you purchase Software Assurance for the license within 90 days of the original license purchase). The OEM license can only be purchased with new system components (the complexity starts when you start to consider what constitutes a “system component”) and requires an OEM license sticker be attached to the associated hardware. If you lose the OEM license sticker then you have effectively lost the license and therefore the right to use the software.
Retail licenses (also known as Full Package Product (FPP) or boxed product) can be purchased independently of any hardware and typically constitute a very low proportion of SBS license sales. There is no license sticker; however, you do get a certificate that must be stored as evidence of your right to use the software. The software license can be reassigned to another system in the event of hardware failure or retirement. If you lose the license certificate, you have effectively lost the license and therefore the right to use the software.
MOLP and MOVL license agreements are electronically tracked licenses—there is no sticker or piece of paper to keep. The key differences between these license agreements are the following:
MOLP license agreements are effective for two years; MOVL license agreements are effective for three years. (This does not mean the licenses themselves expire.)
MOLP license agreements require the license cost to be paid in full with the license purchase; MOVL license agreements are typically paid in three annual installments (but can be completely paid up-front if the client desires).
MOVL license agreements include Software Assurance; MOLP licenses can be purchased with or without Software Assurance.
From Microsoft’s perspective, MOLP or MOVL licenses are the best choice because they provide Microsoft with the maximum visibility of who their end users are—the licenses are electronically tracked through the Microsoft licensing portal at https://eopen.microsoft.com. From a business’s perspective, these licenses are easy to manage and track as there is no physical license that needs to be stored and no OEM sticker that needs to be applied to a computer.
This summary should not be used to make any final decision about which licensing program is right for your environment. Information on which license program is best should be sought from your trusted Microsoft partner or by visiting the Microsoft License Advisor page at http://www.microsoft.com/licensing/mlahome.mspx. Information on all Microsoft volume license programs can be found at http://www.microsoft.com/licensing/default.mspx.
NOTE
An overview of SBS 2008 licensing can be found at http://www.microsoft.com/windowsserver/essential/sbs/
prodinfo/licensing-overview.mspx.
The Premium Edition of SBS 2008 includes a second Windows Server 2008 Standard server license. This is a full Windows Server 2008 Standard license governed by the rights of the license agreement under which the server license is supplied (OEM, retail, MOLP, MOVL).
Apart from obtaining a second server license by purchasing SBS 2008 Premium, you can also purchase separate Windows Server 2008 licenses under any of Microsoft’s licensing programs. There is no functional difference between the second server license provided with SBS 2008 Premium or a separately purchased server license.
The role given to the second server on the network really depends on the particular needs of the business environment into which the server is being deployed. Factors that can affect the server role include the number of sites across which the network operates, business applications in use, the number of users on the network, requirement for availability of some network resources, and the hardware onto which the server operating system is installed.
Some of the scenarios call for the server to be dedicated to the task to which it is being assigned, where others allow the server to be multi-functional. This ties in with the new Windows Server 2008 concepts of server roles and server features.
NOTE
Windows Server 2008 configuration is very much focused around roles and features. Roles define the primary function, purpose, or use of the server, such as Active Directory Domain Controller, Terminal Services server, web server, virtualization (Hyper-V) server, print server, or firewall. Features are more often supportive or additive functions to the roles, but can be standalone too, and include being a backup server, Telnet client or server, Group Policy management server, SMTP server, or WINS server. Visit http://technet2.microsoft.com/windowsserver2008/
en/servermanager/default.mspx to learn more about Windows Server 2008 roles.
For networks where there is more than a single location, the additional server can be installed as a domain controller (DC) for a remote site. The domain controller role allows the server to authenticate user login requests, check permissions to network objects, facilitate user password changes, and so on. Having an additional domain controller at a site where users are remote to the main SBS 2008 server can improve WAN performance, and it enables users logging into the network to successfully authenticate in the event of a WAN link failure between the sites.
Windows Server 2008 includes the ability for a domain controller to be deployed in a read-only configuration, also called a Read-Only Domain Controller (RODC). The RODC is just like a global catalog server in Active Directory, which can be deployed at a remote site to enable users at this site a better network authentication response time, as well as act as a resource against which users can look up objects in Active Directory. The key difference, however, is as the name implies—the domain controller is read only. Although changes cannot be written to it, it can forward change requests to a non-read-only domain controller. The RODC also maintains a read-only copy of the SYSVOL share.
The RODC is an ideal solution for several reasons, including the following:
Environments where the remote site is connected to the main network by a slow WAN link
Environments where the domain controller is not as physically secure as it could be if located at the main site
Situations where a required application needs to run on a domain controller and the staff maintaining this application need to be restricted from making any changes to the Active Directory configuration
You can read more about planning and deploying RODCs at http://go.microsoft.com/fwlink/?LinkID=122172.
Windows Server 2008 Terminal Services enables users to run Windows-based programs, or a full Windows desktop, which can access LAN-connected resources, from a multitude of devices and locations.
Many readers are familiar with Microsoft Terminal Services technology and how it can be used to benefit an organization’s operations. Windows Server 2008 builds on the functionality available in Windows Server 2003 Terminal Services, giving both users and administrators greater functionality, performance and security.
Terminal Services is a Windows Server role and is best implemented as the sole task of a Windows server.
More detailed and in-depth information regarding Microsoft’s Windows Server 2008 Terminal Services technology can be found at http://go.microsoft.com/fwlink/?LinkId=48555.
Another function for the second server is to support a line of business (LOB) application or database. In the case of SBS 2008 Premium, where a license for Microsoft SQL 2008 Standard is included, this can be installed onto the second server in order to host a business database, thereby freeing up the SBS 2008 server to look after the network.
The process for setting up the second server to host the LOB is dependent on the particular requirements of the database or application itself, and the application vendor should be consulted for their system requirements before committing to a hardware purchase.
Virtualization is one of the hottest topics around for multiple reasons, including the fact that it offers the following: better overall utilization from your server hardware investment; lower power consumption, less physical space consumed, and less heat emissions due to fewer physical servers; easier management of multiple servers; simplified backup and disaster recovery; and more efficiency in building and using development and test environments.
Windows Server 2008 now includes out-of-the-box virtualization support through the use of Microsoft’s new Hyper-V product. Hyper-V provides the ability to install, host, and manage multiple operating system instances on a single server chassis in a virtualized environment.
For some years, there has been a myth circulated about SBS-based networks and domain controllers—the myth is that there can only be a single domain controller on the network, which is the SBS server itself.
This is simply not true.
Although SBS-based networks do have some specific limitations by design, this does not include limiting the number of domain controllers on the network. In fact, there is nothing to prevent you from having dozens of domain controllers on the network if this is something you really want to achieve (within licensing limitations, of course).
The actual limitations of an SBS network include the following:
You cannot have more than one SBS server in the same domain.
The SBS domain cannot establish trusts with other domains.
Parent and/or child domains are not supported.
The SBS domain must be the root domain of the Active Directory forest.
The SBS server must own all the domain and forest Flexible Single Master Operations (FSMO) roles.
So with this in mind, rest assured that your second (and third, fourth, and so on) server can indeed be a domain controller on an SBS 2008 network.
Although Windows Server 2008 has a simpler setup process than previous Windows Server operating systems, this does not negate the need for proper planning before inserting the setup DVD into the server and hitting the power button.
Understanding the role the server is going to play on the network is the beginning of the planning process. Other areas to consider include network connectivity and performance (both LAN and WAN based), power quality and reliability, and the physical environment in which the server will be operating. From this you can determine the correct hardware and software licenses to purchase. Only then are you ready to start setting up your server.
Taking care to get the basics right at the start of the server deployment process means you have a much better result when the server goes into production.
Let’s assume you have successfully installed Windows Server 2008 onto the server hardware and are ready to add this server to the SBS 2008 domain.
NOTE
Microsoft provides comprehensive installation information, including troubleshooting assistance, in the Windows Server 2008 Technical Library on TechNet. Point your browser to http://technet2.microsoft.com/windowsserver2008 and select the link for “Installing and Upgrading to Windows Server 2008.”
The latest release notes for Windows Server 2008 are available at http://go.microsoft.com/fwlink/?LinkID=99299.
Once you have completed the operating system installation, you should be presented with a screen similar to Figure 14.1.
Change the server time zone to match the time zone of the SBS 2008 server (assuming it has been correctly set) by following these steps:
1. Select the Set Time Zone link.
2. Click the Change Time Zone button.
3. Select the appropriate time zone from the drop-down box and click the OK button.
4. Ensure the date and time are also correct and, if necessary, change by selecting the Change Date and Time button.
5. Click OK to return to the Initial Configuration Tasks screen.
A server should always have a static IP address on the network. This address can either be manually entered into the network configuration settings for the network card or can be assigned to the server as a DHCP reservation from the SBS 2008 server. Both methods are generally acceptable; however, it is generally best practice to manually set the IP details for the server to avoid potential connectivity problems if the DHCP service becomes unavailable for an extended period of time.
The process for setting a static address for the server is very similar to that used for Windows Server 2003 and Windows 2000 Server, as follows:
TIP
Although IPv6 is the default protocol for Windows Server 2008, if you do not have plans to use this in your network, it should be disabled from the protocol stack. This can be easily done by unchecking the Internet Protocol Version 6 item when viewing the properties of the network connection after item 2. IPv6 is covered in more detail in Chapter 19, “IPv6 Overview.”
1. From the Initial Configuration Tasks screen, select the Configure networking link. This opens the Network Connections screen.
2. Right-click the network adapter for the server and select Properties from the drop-down menu.
3. Select Internet Protocol Version 4 (TCP/IPv4) and then click Properties.
4. Enter the appropriate IP address, subnet mask, and gateway addresses.
5. The DNS server address entered should be the address of the SBS 2008 server; for this example, it is 192.168.16.2 (see Figure 14.2).
6. Click the OK and Close buttons to save your changes.
Best Practice—IP Addressing for the SBS Network
Ask 10 people for their best IP addressing methodology, and chances are you’ll get 10 different answers. For the typical SBS 2008 network, you won’t need to get too fancy. First, you need to consider the environment into which the servers are going to be installed—what equipment exists, and therefore what static addresses have already been allocated?
In most cases, the following guidelines have served well for the typical SBS network:
Give the servers on the network a low IP host address; for example, 192.168.16.2, 192.168.16.3, up to 192.168.16.10.
Assign printers and other resource devices an address starting from 192.168.16.20.
Assign client computers addresses between 192.168.16.50 and 192.168.16.150. This gives more than enough addresses for an SBS network. These addresses should be assigned by the DHCP Server service on the SBS 2008 server.
Assign routers, firewalls, and wireless access devices a high IP address. The main Internet router can be 192.168.16.254 and then move backwards for other access devices.
Where a static address is being assigned to a device, try to set the IP address on the device itself and configure a reservation on the DHCP server so conflicts will be avoided.
These are, of course, only guidelines, but have proven to work well for keeping servers, network resources, client machines, and access devices in separate address ranges with ample headroom for growth.
Remember to document the static IP addresses and the devices/servers to which they are assigned.
It is also a good idea to change the server name at this stage, to match the name it will have on the domain. Changing the server name is a very simple process, but it requires a restart of the server:
1. In the Initial Configuration Tasks screen, select the Provide computer name and domain link.
2. The System Properties dialog box is displayed. Click the Change button.
3. Enter the server name in the top text box; spaces and special characters are not permitted for the name, so use letters and numbers only. If you enter an invalid name, you receive the warning shown in Figure 14.3.
4. Click the OK button to save the new server name. You are prompted to restart the server for the changes to apply.
5. Click OK and then Close, and restart the server.
TIP
Another way to change the server name is to use the netdom command prompt utility. The syntax for this is as follows:
netdom renamecomputer %computername% /newname:<NewComputerName>
where <NewComputerName> is the new name for the server. If you append the /Reboot switch, the server is also automatically restarted after 30 seconds. Note that the command prompt needs to be set to “run as administrator.”
Now that your server has the correct time zone, IP address, and name, it can be added to the SBS 2008 domain.
In SBS 2003, the process for adding a server to the network was relatively similar to adding client computers to the domain—a server computer account was created, and the server was then added to the domain using the Connect Computer Wizard. With SBS 2008, you no longer use this wizard for servers.
If you try to add the server to the domain using the http://connect site, you receive the error message shown in Figure 14.4.
Complete the following steps to correctly join your server to the SBS 2008 domain:
1. From the Server Manager screen, click the Change System Properties link.
2. In the System Properties dialog box, select the Change button.
3. In the Computer Name/Domain Changes dialog box, select the radio button next to Domain and enter the domain name into the text box; then click OK.
4. Enter the domain administrator username and password into the Windows Security dialog box and click OK.
5. When the server has been added to the domain, you receive a welcome to the domain notification. Click OK.
6. You are prompted that the server needs to be restarted to complete the process. Click OK.
7. Click the Close button and then the Restart Now button to restart the server.
After the server has restarted and you login, make sure you change from the local server account to the domain account. The initial login screen will look like the one shown in Figure 14.5.
Click the Switch User button to see the screen shown in Figure 14.6.
Select Other User to see the screen shown in Figure 14.7.
You see that you are being prompted to log into the domain. Enter the administrator username and password and click the login arrow, or press the Enter key to complete the login process.
The Server Manager console is displayed with the Full Computer Name showing that the server has been successfully joined to the domain (see Figure 14.8).
You can also verify that the server has been successfully added to the domain by referring to the Network tab on the SBS Console (see Figure 14.9).
Figure 14.8 shows the main screen from which server roles and features are installed.
CAUTION
When a server is added to the SBS 2008 domain, it initially appears under the Client Computers section of the SBS management console. This is because the server object is placed in the SBSComputers OU by default. Leaving the server in this OU means the group policies applicable to PCs on the network are applied to it, rather than the server group policies.
Move the server into the SBSServers OU by performing the following: Open Active Directory Users & Computers (or clicking Start, Run, typing dsa.msc and clicking OK); browse to MyBusinessComputersSBSComputers; locate and right-click the server object and select Move; expand the presented domain tree to MyBusinessComputers OU and select the SBSServers OU. Then click the OK button. Close Active Directory Users & Computers.
Refresh the Computers tab in the SBS Management Console to see the server object has moved into the Servers section.
One of the roles the second server can fill is that of an additional domain controller for either the main office or a remote office. To configure the second server as an additional domain controller, follow these steps:
1. From the Server Manager console shown in Figure 14.8, scroll down to view the Roles Summary section.
2. Click the Add Roles link.
3. Click Next at the Before You Begin page after you have read the initial text (you can skip this page in the future by selecting the Skip This Page by Default checkbox). This text simply introduces the Add Roles Wizard and reminds you to ensure the domain administrator account has a strong password (which is enforced by default by SBS 2008); network settings have been configured and the server has been updated from Windows Update.
4. Select the checkbox for Active Directory Domain Services; then click Next to see the screen shown in Figure 14.10.
5. Read the text shown, as seen in Figure 14.10. Note that you will be required to install DNS Server onto the domain controller as part of the process. You can also click on links under Additional Information to review further information related to the task being undertaken.
6. Click the Next button and note the informational messages presented, which advise that the server might need to be restarted after the wizard has run (although it won’t) and that you still need to run the dcpromo utility to make the server a fully functional domain controller, as shown in Figure 14.11. Click the Install button to continue.
7. Once the installation process has completed, you will find the server is not yet a domain controller—it has only had the role binaries added to it (see Figure 14.12). You need to run the dcpromo utility to perform the actual promotion of the server to be a domain controller. This can be done from a command prompt or from the final informational screen that appears after running the Server Roles Wizard.
8. Clicking on the link to run the dcpromo wizard closes the informational screen and starts the Active Directory Domain Services Installation Wizard (see Figure 14.13).
9. For the typical SBS 2008 network, the Advanced Mode Installation checkbox should not be selected. Further information about advanced mode installation can be found by selecting the Advanced Mode Installation link below the checkbox.
10. The next screen provides a warning related to the security of communication with Windows Server 2008 domain controllers. You should take a few moments to read this if you have any operating systems older than Vista SP1 present on the network, as well as operating systems that act as SMB clients (including Linux distributions). Further information regarding this can be read at http://go.microsoft.com/fwlink/?LinkId=104751. Click the Next button to continue.
11. Select the default setting of adding a domain controller to an existing domain. Click Next.
12. You will be presented with a dialog box confirming the forest credentials to use for the domain controller promotion process. Click Next.
13. Because SBS networks allow only a single domain per forest, the next dialog box has no options other than to go back, continue, or cancel. It simply shows you the domain for this domain controller. Click Next.
14. Similarly for the Select a Site dialog box, you are simply shown the Default-First-Site-Name site with no additional options. Click Next to continue the promotion process.
15. You can now specify additional domain controller options, specifically if this will be a read-only domain controller (RODC) (see Figure 14.14). Refer to the earlier section in this chapter, “Additional Domain Controller for Branch Office,” for more information on RODCs.
16. If, as part of your planning, you have determined this domain controller needs to be an RODC, select the checkbox for the RODC option. Click Next to continue.
17. If you select the option to have this server set up as an RODC, you will be asked to specify a user or group to whom you can delegate server management. This user or group (it should be a security group to which you add users) will have local administrative rights over the server in the event the server is unable to contact a writable Windows Server 2008 domain controller.
Note that this group will therefore be able to login locally on the server and, if they want, demote the server from being a domain controller. Leaving this text box blank means that only domain administrators will have rights to manage this server. This would be the typical selection for an SBS 2008-based network. Click Next to continue.
18. You are next prompted to specify the location for the Active Directory database, log files, and sysvol. Accept the defaults for most SBS-based networks, which will be the same locations these files are found on the SBS 2008 server itself. Click Next.
19. Enter the Directory Services Restore Mode (DSRM) password. This is the password you enter if starting the server in DSRM, which is available by pressing the F8 key as the server first boots. This mode is typically used to restore a backup of Active Directory in the event of database corruption. This password does not need to be the same as the domain administrator account password but should be guarded as closely as that password and will need to meet the password policy that is in effect on the SBS 2008 server. Click Next after entering the password twice and noting it down for future reference.
20. Read the summary provided in the next box to ensure you have entered the correct information. You can also export the settings to an answer file, which can be useful for documentation purposes. Passwords are not exported to this file, though, so don’t discard the passwords noted earlier. Click Next, and the domain controller wizard will start the DC setup process including, if necessary, the installation of DNS.
21. When the promotion process has completed, you are presented with a dialog box indicating that Active Directory Domain Services is now installed on the computer. Simply click the Finish button and then Restart Now to restart the server as a domain controller.
In instances where the second domain controller is to be located at a remote site, the IP address of the server needs to be changed to one in the subnet for this site.
These deployments would typically use a VPN connection between the sites managed by either the hardware routers for each site or some software-based firewall/VPN solution. See Figure 14.15 for an example network.
Assuming the VPN connection is operational, the change to the second server is simply changing the IP address and gateway address. The DNS server address on the server should stay set to the SBS 2008 server address.
The IP address change is best performed as the last step before shutting down and relocating the server. This is to allow the server to start correctly, being able to communicate with the SBS 2008 server as services start.
If this server is going to be a DHCP server to the client machines on the remote network, it should provide its address as their DNS server (see the following section).
The SBS 2008 server will be providing DHCP services to the main office; however, this is not suitable for remote sites. The additional domain controller can be configured to provide DHCP-assigned addresses to the client computers at the remote site by installing the DHCP Server role and creating the appropriate DHCP scope.
Before installing the DHCP Server role, you need to know the DHCP scope details that will be configured as part of the service setup process. Using the example network shown previously, Table 14.1 provides the information needed for the installation wizard.
Note that the WINS service is not installed by default on the SBS 2008 server and is not required for most networks today.
TIP
Ensure the router at the site is not providing DHCP services. Many routers have the DHCP server service running by default, which could assign inappropriate IP addresses and DNS addresses to the client machines. Having incorrect DNS server addresses can create network performance problems, particularly with regard to resolving internal network resources.
Once you have determined the DHCP scope information for the remote site, install the DHCP role onto the domain controller, as follows:
1. Open the Server Manager console.
2. Click on the Roles branch on the left side of the console.
3. Click on the Add Roles link on the right side of the console to start the Add Roles Wizard.
4. If the Before You Begin page appears, click Next to move to the Select Server Roles screen.
5. Select the DHCP Server role by clicking the checkbox next to its name and clicking Next.
6. Read the introduction screen; then click Next.
7. The Network Connection Bindings screen enables you to confirm the network connection to which the DHCP service will be bound. Where the server has only one network card, there will only be a single connection shown. Click Next.
8. Enter the IP address of the DNS server the clients use to resolve network resources (see Figure 14.16). This should be the IP address of the domain controller at the remote site. Click Next.
9. If you are not using the WINS service on your network, leave the WINS Server Settings option at its default of not required; otherwise, enter the IP address of the WINS server on your network and then click Next.
10. Click the Add button and enter the information prepared earlier regarding the DHCP scope as per Table 14.1 (see Figure 14.17). When the information has been entered, click the OK button and then click Next.
11. If you are not using IPv6, select the Disable DHCPv6 option for the DHCPv6 Stateless Mode option; then click Next.
12. Authorize the DHCP Server service on the domain using the credentials supplied, which will be the domain administrator account with which you are currently logged in. If you do not authorize the DHCP Server, the DHCP Server service will not be able to start. Click Next.
NOTE
The Windows Server 2008 DHCP Server service is integrated with Active Directory in order to ensure it starts only if authorized to do so. As the DHCP Server service starts, it sends a DHCPInform message, which requests information about the root Active Directory from other DHCP Servers on the network. A DHCPAck message is then sent back to this server by other DHCP Servers on the domain, informing the DHCP Server where to locate the Active Directory root domain.
The DHCP Server then queries the Active Directory to ensure that its address is listed as an authorized DHCP Server; if its address is found in the list, the DHCP Server service will start. If it does not find its address in the list, the service will shut down.
In an Active Directory domain, all DHCP Servers must be either domain controllers or member servers before they can be authorized to provide DHCP Server services to the computers on the network.
In the case where the DHCP Server is also a domain controller, it simply refers to its copy of the list of authorized DHCP Servers.
13. Confirm the DHCP Server service setup summary and, if correct, click the Install button to start the installation process.
14. On completion of the installation process, the wizard presents a completion dialog box. Simply click the Close button to exit the wizard.
If the DHCP Server service has installed and started successfully, the server is ready to assign IP addresses to the computers on the network. Any existing computers with addresses assigned by the router (if previously providing addresses) should have their IP address released and then renewed in order to be assigned an address by the Windows Server.
By default, Active Directory replication is set to occur once per hour between domain controllers. This schedule should be adequate for most implementations but can most certainly be changed to be either more or less frequent.
To change the replication of AD information, open the Active Directory Sites and Services branch under Roles in the Server Manager console, from either domain controller (unless the second server is an RODC, in which case you can only do this from the SBS 2008 server). Continue to expand the console and select the NTDS Settings node under the secondary domain controller to see something similar to Figure 14.18.
Right-click the RODC Connection (FRS) in the middle pane and select Properties (see Figure 14.19).
Select the View Schedule button to view the replication schedule (see Figure 14.20).
The dialog box indicates the days of the week, together with every half-hour increment throughout each day.
By default, the entire week is selected; however, you can change this to select only particular days and times by dragging the mouse over a rectangle of days and times you want to change. Alternatively, you can select individual times.
Change the replication schedule for the selected time(s) by choosing from the radio buttons on the right side of the dialog box: none, once per hour, twice per hour, or four times per hour.
CAUTION
Take into account the speed of the connection between your sites where the domain controllers are located. Replicating too often, during busier business hours, over a slow link could cause performance problems for other tasks relying on the link.
Click the OK button twice to save your changes.
You can also perform a manual replication of the Active Directory from the RODC, as follows:
1. Open the Active Directory Sites and Services branch under Roles in the Server Manager console of the RODC.
2. Right-click on NTDS Settings on the left side under the SBS 2008 server.
3. Left-click on the Replicate configuration from the selected DC menu item to initiate a replication process.
This process is useful when you may have turned off replication between the sites during the work day but want to perform an update (for example, due to a user password being reset or group membership changes) without waiting for the next scheduled synchronization.
As noted earlier, if you are intending the second server to be a Terminal Services server for network users, this should be selected as the only role for the server.
Terminal Services (TS) is different from Remote Desktop on the SBS 2008 server. Remote Desktop is limited to two concurrent connections, whereas TS allows virtually any number depending on licensing and hardware specifications. Typically, though, it allows up to around 40 users per server. TS licensing does not need to be installed for Remote Desktop connections.
Perform the following steps to install Terminal Services onto the second server:
1. Open the Server Manager console and click on the Roles branch on the left.
2. Click the Add Roles link on the righthand side.
3. Click Next at the Before You Begin screen.
4. Select the checkbox next to Terminal Services in the Select Server Roles screen; then click Next.
5. Click Next on the Introduction to Terminal Services screen.
6. Select Terminal Server from the list of Role Services; then click Next.
7. Read the information provided about applications on the server—if you have already installed applications for use by users, they need to be removed prior to completing the installation of the Terminal Services role. If you have already installed, for example, Microsoft Office, you need to cancel the wizard, remove Office, and then re-run the role installation wizard. Click Next.
8. Select whether or not you want to require Network Level Authentication; then click Next.
9. If you have not yet determined your TS Licensing mode, select the Configure Later option; then click Next. (See the following section for more information on Terminal Services licensing.)
10. Select the user group(s) allowed to access the Terminal Services server; then click Next.
11. Review the installation selections presented; then click the Install button to install Terminal Services onto the server.
12. Upon completion of the installation process, you must restart the server. When the server has restarted, and you have logged into the server, the setup wizard finalizes the Terminal Services installation process.
In order to use Terminal Services (TS) on your network, you need to have a TS licensing server set up and configured. The licensing server is used to install, issue, and manage device and user Terminal Services licenses.
Running in Grace Mode
If you’re not ready to set up your TS licenses when your server is being deployed, don’t panic. Microsoft understands that when given the choice between rolling out a new server or setting up a licensing service, the server is the much more exciting choice.
With this in mind, the terminal server will operate properly without TS licensing set up for a grace period of 120 days. You can monitor the number of grace period days you have left when logging into the server with a local administrator account—a message will appear in the lower-right corner of the screen to advise the number of days you have remaining before the grace period expires. After this time, if no TS licensing server has been set up, the TS server will not accept any further connections to it.
Prior to the grace period expiring, you need to have set up the TS licensing service (ideally on the SBS 2008 server), purchased the appropriate number of licenses, and entered the license details into the TS License Manager console (see link in Figure 14.21).
The grace period ends when either the number of grace period days is exceeded or a permanent TS CAL is issued by the TS licensing server to a client connecting to the TS server.
Since the introduction of Windows Server 2003, the ability to have licenses based on users or devices accessing the TS server has been available. Typically, one type of license is used for the server—a license is issued for each named user that logs in, or for each client device that is used to access the TS server. This is called “Per User” and “Per Device” licensing mode, respectively.
When Per Device licensing is used, and a client device connects to the TS for the first time, a temporary license is issued to the device by the TS licensing server. Where this is a Windows-based device, an entry is made into the registry for this license—this is in addition to the temporary license information stored on the TS licensing server. If this device should connect to the TS a second time, the temporary license is converted to a permanent TS Per Device license.
The registry key for the license is HKEY_LOCAL_MACHINESOFTWAREMicrosoftMSLicensingStoreLICENSExxx, where “xxx” is a number starting from 000 and incrementing by 1, depending on the number of TS servers this device has connected to.
Per User CALs are handled somewhat differently than Per Device CALs. The Per User CAL gives a single user the right to connect to a domain-joined TS from an unlimited number of devices. Note that the user should only access the server from one device at a time in order to remain licensing compliant. Another point to note is Per User CALs are not enforced by TS licensing, so client connections can be made with the server regardless of the number of Per User licenses entered into the licensing management console. This means your organization needs to ensure it has purchased sufficient licenses in order to avoid violation of the license agreement accepted when the server was installed.
Identifying the right license for your environment can be as complex or as simple as you make it. For most SBS environments, user-based licenses are the best option to choose because they give users the flexibility to access the TS from any computer on the LAN, a thin client device, from a notebook computer, a Windows Mobile device, or a computer at the user’s home (for example).
Device-based licenses are ideal for environments where there are typically more users than devices accessing the server—for example, a factory where there are multiple shifts of workers sharing computers. If there were three shifts of 30 workers and only 30 computers, and users do not need to access the TS from outside the workplace, it makes good economic sense to use Per Device licenses such that only 30 need to be purchased instead of 90 user CALs.
Keep in mind the TS Licensing mode is either Device or User; you should not try to use both types of licenses on the same server.
More detailed information about Terminal Services licensing can be found on the Microsoft TechNet web site at http://go.microsoft.com/fwlink/?LinkID=85873
TS licensing is a server role service that is best installed onto the SBS 2008 server. This role should be deployed after the TS server itself has been set up and installed on the network and is running in the licensing grace period.
By default, the Terminal Services role is installed onto the SBS 2008 server, so adding the TS Licensing role service is done from within the Terminal Services branch of the Server Manager console.
Install TS licensing by following these steps after you have determined the type of TS CALs you are going to use:
1. Open the Windows Server 2008 Server Manager tool by clicking Start, Administrative Tools, Server Manager or clicking Start and typing ServerManager.msc and hitting Enter.
2. In the left pane, click Roles and then select Terminal Services.
3. In the right pane, scroll down to the Role Services section and click the Add Role Services link.
4. Select the TS Licensing checkbox; then click Next.
5. Accept the default setting for TS Licensing Discovery Scope; then click Next.
6. Click Install to complete the installation.
7. Click Close when the installation process has completed.
Now that TS licensing is installed, scroll to the bottom of the Terminal Services management console to Advanced Tools and select TS Licensing Manager (see Figure 14.21).
Prior to using the TS Licensing console, the license server must be activated with the Microsoft Clearing House, which installs a digital certificate onto the server that validates the server ownership and identity. Once this certificate is installed, the server will accept the installation of TS licenses.
Terminal Services RemoteApp (TS RemoteApp) is a part of the Terminal Services role that enables you to make applications, or a complete desktop, hosted by the TS easily deployed across a network.
TS RemoteApp enables you to create .RDP files that can be supplied pre-configured to users, which they simply double-click to access the application or desktop. You also can distribute a .MSI file using group policy, which installs a link onto the desktop of the user’s computer, and into the Start menu if desired, such that it looks like a locally installed application!
This process can reduce complexity and confusion for users in instances where they lose track of where they are actually running an application—on their local desktop or on a remote server. Programs accessed through TS RemoteApp can look and operate like a locally running application; they can be minimized and allow cut and paste between other applications, and their windows can be resized.
This can be especially useful when deploying a new version of an application, and you want to perform testing parallel to an existing program installed on the users’ computers, or a different terminal server.
TIP
TS RemoteApp requires the client computers to be running RDC 6.1, which is included in Windows Server 2008, Windows Vista with SP1, and Windows XP with SP3.
Let’s assume you have a new application installed on the TS, called WordPad, which you want to make available to users without their needing to access a full desktop on the server. Perform the following steps to make this application available through TS RemoteApp:
1. Open the Server Manager console on the TS server.
2. Expand the Roles branch on the left side; then expand the Terminal Services role and click on the TS RemoteApp Manager link, as shown in Figure 14.22.
3. Click the Add RemoteApp Programs in the top-right corner of the Server Manager console.
4. Click the Next button to show the list of registered applications on the server. If the actual application you want to add is not listed, click the Browse button; otherwise, select the checkbox next to the application you want to make available (see Figure 14.23).
5. If you click the Properties button, you are able to verify the path to the application executable, the alias of the program, whether or not the user can pass command-line arguments to the application (including any particular command-line arguments you want to enforce), and also change the icon, as shown in Figure 14.24.
6. Click Next and then Finish to complete the RemoteApp Wizard.
The application will now appear under the RemoteApp Programs section in the Server Manager console, as shown in Figure 14.25.
You are now able to create either a .RDP file or a .MSI file, or both, which can be deployed to client computers on the network.
To create a .RDP file, perform the following steps:
1. Select the RemoteApp program, as shown in Figure 14.25, and then select the Create .rdp File link in the righthand side of the Server Manager console.
2. Click the Next button to specify the location for the .RDP to be placed. By default, this location is C:Program FilesPackaged Programs. Click Next and then Finish to create the file.
NOTE
This dialog box also enables you to make additional changes, including the server or server farm name, TCP port, whether server authentication is required together with TS Gateway, and whether or not the file will be signed by a digital certificate.
Refer to http://go.microsoft.com/fwlink/?LinkId=85872 for more information on TS Gateway.
3. When the wizard completes, the folder with the .RDP file is opened in Windows Explorer. You can now copy this file to a client computer and use it to access the TS RemoteApp application.
Similarly, you can create the .MSI file, which has the added advantage of creating shortcuts to the application in the user’s Start menu, as well as on the desktop, if desired:
1. Select the RemoteApp program, as shown previously in Figure 14.25, and then select the Create Windows Installer Package link in the righthand side of the Server Manager console.
2. Click the Next button to specify the location for the .MSI to be placed. By default, this location is C:Program FilesPackaged Programs. Click Next.
3. Select where you want the shortcut icons to appear on the client computer. By default, the Start menu is selected where the icon will appear in a group called Remote Programs. You can also select to have filename extensions on the client computer associated with this RemoteApp program. Click Next and then Finish to create the .MSI file.
NOTE
Client-side extension redirection enables you to associate files locally accessed on the client computer with the RemoteApp program being published to the computers.
So, for example, if you were publishing WordPad, which uses files with the filename extension .RTF, any file on the client that is opened and has this filename extension will be opened on the TS instead of on the client machine itself.
The users are not prompted to accept the TS taking over the file extensions for this program.
4. Once the wizard completes, the folder with the .MSI file will be opened in Windows Explorer. This can now be deployed to the computers on the network
If you decide to make changes to the .RDP or .MSI file, you can simply re-run the wizard and recreate the file.
A functional backup and recovery plan is essential for any network. This section discusses the process for installing the Windows Server Backup feature, running manual backups, and configuring scheduled backups for the server. Further information related to backups can be found in Chapter 18, “Backup and Disaster Recovery.”
Windows Server 2008 employs new technology for performing and managing backups. Gone is the old NTBackup utility! Windows Server 2008’s backup feature is a powerful tool that performs fast image-based volume backups, which can be used for the simple and rapid recovery of files, folders, and even the complete server.
Windows Server 2008’s backup feature is not installed by default. To install backup, which also requires the PowerShell feature, perform the following steps:
1. Open the Server Manager console.
2. Select the Features branch on the left side.
3. On the right side of the console, click the Add Features link.
4. From the Features list, select the checkbox next to Windows PowerShell.
5. Click the + next to Windows Server Backup Features item and select the Windows Server Backup and Command-Line Tools options.
6. Click the Next button and then the Install button.
7. When the installation process has completed, click the Close button.
To access the backup interface, expand the Storage branch in the Server Manager console and select Windows Server Backup. (If you have previously selected Windows Server Backup before installing the feature, you need to close and reopen the Server Manager console to view the backup interface.)
It’s a good idea to take a backup of your server prior to making any significant changes to its configuration. Windows Server Backup makes this backup process extremely simple.
Assuming there is a backup disk shared from the SBServer called “backups,” a manual backup can be run using the following process:
1. Open the Server Manager console and expand the Storage branch.
2. Select the Windows Server Backup branch.
3. On the right side of the console, click the Backup Once link, which will open the Backup Once Wizard.
4. If this is the first time a backup has been run, the Different Options radio button will be selected. If a backup has been previously scheduled, you will have the option to use the same settings as the scheduled backup job. Click the Next button.
5. Select the Full Server option to back up all server volumes; then click Next.
6. Select to backup to a Remote shared folder; then click Next.
7. Type the UNC path to the backup disk (in this example, \SBServerackups); then click Next.
8. Select the VSS backup option appropriate for your environment—the text below the options provides more information, and the help link at the bottom of the dialog box provides further detail. If you are not using any other backup product on the server, select the lower option, VSS full backup, and then click Next.
9. Click the Backup button to start the backup process.
A backup status box will appear to show the backup progress. You can either watch the backup proceed or click the Close button to let the backup continue in the background.
The backup process creates a VHD file on the backup device as part of the initial backup job setup and will alert you if there is insufficient space available, so there is no need for you to monitor the backup job simply to ensure it completes before running out of space.
Your server protection plan needs to include a regular backup process to ensure you can recover the server in the event of a disaster, whether this is a loss of files or data, disk failure, fire or flood, or some other fault that renders the server unusable on the network.
This then begs the question: “How often should I perform a backup?” The general rule of thumb is the server should be backed up a minimum of once per day; however, if you are in an environment where many transactions are being performed on a daily basis, more frequent backups should be considered, particularly for the data.
Windows Server 2008 backup enables you to schedule frequent backups of your server’s data volume through the day with minimal performance impact on the network users; these backups are both very fast and take up only a small amount of storage space on the backup device. Due to backup’s ability to take snapshots of only the data that has changed since the last backup, each incremental backup will be as small as the amount of data that has changed.
This shows the importance of getting your server disk layout correct from the very beginning, where the data is ideally held on a separate volume and can therefore be backed up and recovered separately to the operating system and server-based applications.
Let’s assume you have a volume E: on which all user data is stored, and you want to create a scheduled backup of this data to the backup disk for the server. Perform the following steps:
CAUTION
Windows Server 2008 backup requires a separate, dedicated disk for running scheduled backups. This disk can be an external USB or FireWire disk. You cannot use a share from another server—the backup disk needs to be local to the server itself.
1. Open the Server Manager console and expand the Storage branch.
2. Select the Windows Server Backup branch.
3. On the right side of the console, click the Backup Schedule link, which will open the Backup Schedule Wizard.
4. Click the Next button on the Getting Started screen.
5. Select the Custom option to back up selected server volumes; then click Next.
6. Ensure the data disk is selected and deselect any other volumes you do not want to include in this backup schedule. Note that you cannot exclude the operating system itself from these backups. Click Next.
7. Specify the time(s) of day you want to perform a backup. By default, 9 p.m. is selected for a once-per-day backup. However, you can select the More Than Once a Day option and specify any number of backup times as are appropriate by selecting the time in the left column and then clicking the Add button. Click Next to continue.
8. If this is the first time you have scheduled a backup, you will not see any disks listed as available. Click the Show All Available Disks button to list the disks the server sees as available for accepting backups (see Figure 14.26).
9. Select the disk to which you want to back up by clicking in the checkbox next to it; then click OK (see Figure 14.27).
10. The disk you have chosen to be available for backups will now show in the list. Select it by clicking in the checkbox next to the disk; then click Next.
CAUTION
The first time you select a disk to accept Windows Server 2008 backups, you will receive a warning that advises that the disk will being formatted prior to being used as a backup disk. If there is anything of importance on the disk, you should remove it prior to continuing. In addition, the disk will no longer appear in Windows Explorer because it will be dedicated for backups only.
11. Note the Windows Server Backup label that will be applied to this disk by the backup process. The disk label is a combination of the server name, date and time of the backup wizard being run, and the disk ID. This label should be noted on the disk itself to allow for easy identification in the event it is needed for server/data recovery. Click Next.
12. Confirm the backup schedule summary information provided by the wizard and, if it looks correct, click Finish to save the backup schedule, or click Previous to go back and make the appropriate changes.
CAUTION
As soon as you click the Finish button, the backup disk will be formatted and prepared for use. So, if you have yet to copy off any data from this disk, now is the time to do so. Once you click the Finish button, it’s too late.
13. You will be presented with a summary screen, which advises when the first scheduled backup will take place. Click the Close button to return to the Server Manager console.
You can use the same Backup Schedule link on the right of the Windows Server Backup console to make modifications to the backup schedule, or set up additional backup schedules.
You can also see the backup process scheduled from within the Task Scheduler utility, which is available under Administrative Tools. Expand the Task Scheduler Library, Microsoft, Windows and select Backup, as shown in Figure 14.28.
Many businesses today find they need to have more than just a single server installed on the network to fulfill the business’s requirements. The actual process of setting up a server and connecting it to a network can be a simple enough task; however, performing this task in such a way as to ensure a reliable, robust, manageable, and expandable network takes more than sheer good luck. Careful planning and preparation needs to be undertaken to assess the actual role of the server on the network both now and into the future. This needs to be combined with an understanding of the most appropriate licenses and hardware to purchase together with the development of a sound backup and recovery strategy.
Licensing—Determine the best license purchasing program for your organization by consulting with your trusted Microsoft partner or use the tools and resources provided by Microsoft. Settling for what appears to be the cheapest option can cause problems when you need additional flexibility.
Hardware—Ensure you purchase quality hardware that is appropriate to the task for which the server is being set up and ensure all hardware components are certified for use with Windows Server 2008 (www.windowsservercatalog.com).
Environment—Consider the environment into which the server is going to be deployed, paying particular attention to the WAN connection speed to other sites, physical security, and quality of power available to the server. Endeavor to provide the best of these as possible for the server.
IP Addressing—Ensure you plan and document your IP addressing scheme for the network and configure IP address reservations for devices and hosts that have static addresses configured on them.
AD Replication Schedule—When configuring your AD replication schedule, remember to consider the speed of the link between sites and the impact the replication traffic might have on the users’ ability to perform their normal work tasks.
TS Licensing—Determine the correct TS licensing for your environment (user or device) and configure the server for this licensing model before making it available for users to log into.
Tracking TS User CALs—Use the tools provided with the operating system for reporting on TS User CAL usage or consider creating a simple spreadsheet to track license usage to ensure you remain compliant.
Backups—Ensure you have a tested and proven backup process in place before deploying a server into a production environment. Make sure you regularly test your backups and store your backup media offsite.