Rules to Better Windows Servers - 10 Rules

We all know it’s important to keep our servers updated. Unfortunately though, by default, Windows will automatically download and install all new Windows Updates on your servers. This will mean the servers will occasionally restart to install updates when you don’t want them too. You will also get annoying popups trying to get you to restart the computer.

Note: This rule is applied to both client PCs and servers.

It is also one more reason developers don’t like to join a company domain on their personal laptops!

Note: Server patching is also achievable via SCCM and you get more control over restarting windows like this. WSUS can also be used in conjunction with group policies to handle restart times better.

The best ensure you are still downloading updates but not installing them automatically is to use Group Policy.

1. Create an Organization Unit (OU) in Active Directory, and put all your Production Servers in the OU

2. Create a new Group Policy object and link it to the Production Server OU

3. Edit the new Group Policy object and drill down to
   Computer Configuration | Policies | Windows Components | Windows Update
4. Edit
   Configure Automatic Update Properties item and enable it
5. Set Configure Automatic Updating option to 3 – Auto download and notify for install

After the new Group Policy propagates, you will notice the update setting is now locked on the servers in the Production Server OU.

From now on your servers will be updated without unplanned reboots!

Check out "auto-update" rules for PCs and Servers.

After a new Service Pack is released for a product (for example, Exchange 2010 Service Pack 1), users and management can get very excited about new features that the Service Pack will bring that will help them out, or fix problems that they had been having with the product.

Microsoft generally test their Service Packs very well, but things can go wrong.

As a general rule, we wait 4 weeks before installing a new Service Pack, and tell everyone to hold their horses.

Figure 1 - Even though managers and users might be pressing you to install a Service Pack - tell them to hold their horses!

After the 4 week period has expired perform the following tasks before installing the Service Pack:

• Do an search for any trending problem when updating to the new Service Pack
• Check for any known issues in the Microsoft KB with the Service Pack
• Read installation documentation
• Backup your system, or if you are using Hyper-V, take a snapshot
• Reboot before you are about to install a Service Pack

Following this rule should prevent disaster in the event that a Service Pack is troublesome.

Downtime occurs when you have a single server setup.

TODO: This is 2008 R2 – update to 2016 Note: 2008 R2 was not as reliable as later versions. So it would be better to use failover cluster in Server 2012 R2 or 2016 for a more reliable infrastructure configuration.

Use NLB to allow load balancing and failover. On each of your Windows Servers, you will host your website.

You need to follow these steps to get it up and running:

1. On all nodes of the NBL cluster, the Network Load Balancing Feature needs to be installed.

   

   Figure: Install the NLB Feature
2. Open the Network Load Balancing Manager from Administrative Tools

   

   Figure: Under the Cluster menu item, click New
3. Enter the first node in the cluster in ‘Host’ and press ‘Connect’

   

   Figure: Select the interface for the node
4. Enter a Priority as 1 (this is just a host identifier)

   

   Figure: In 'Priority' enter '1'

5. 

   Figure: Enter a virtual IP address for the cluster. eg. 192.168.1.12
6. Choose the IP address of your cluster from the dropdown list Set a Full Internet Name eg. spcluster.sydney.ssw.com.au. Ensure the Multicast Cluster operation mode is selected.

   

   Figure: Set the 3 cluster parameters
7. You want sticky sessions so you don’t mistakenly bounce between servers (and lose your state)

   

   Figure: Leave the Port Rule as default. This will provide sticky session

   

   Figure: Success. The cluster configuration will show a green icon
8. Right click the name of the cluster eg. spcluster.sydney.ssw.com.au Click Add Host To Cluster

   

   Figure: Add the 2nd web server with a priority of 2
9. Open a command prompt and type in wlbs query to verify the cluster:

   

   Figure: Type in wlbs query to verify the cluster
10. Ping both nodes and the virtual IP address externally to verify they are all working

If you are dealing with a single server, there is no way to achieve 100% uptime, when updating or restarting a server.

So set your website up correctly with at least 2 front ends, and 1 backend (the SQL Server).

Figure: Good Example – When one server goes down, the website remains up Then, use a Network Load Balancer (we recommend Microsoft’s build in NLB) which allows you to spread website load to multiple servers, but even more helpful when you need to do Windows Updates or make changes to web servers in your environment.

Follow the below steps on your test server first, get the application tested passed, then move on to production.

1. Open the Network Load Balancing Manager
2. Right click on the machine you want to update | Select Control Host | Click Drain Stop

   

   Figure: The 2 green icons indicate both servers are live with users - Do a drain stop on the server you want to make changes too
3. To view the current connections on the server, open a command prompt and enter netstat -an. You will be able to see the connections list dropping as users are sent to the other server

   

   Figure: Run "netstat -an" to view the current connections on the server
4. Allow the NLB to finish sending the connections to the remaining servers. The server you have drain stopped, will turn red when all the users have been moved to the other server

   

   Figure: When the server turns red, the connections have been dropped and you're ready to update
5. Optional – if you are using Hyper-V, take a snapshot of the server you are about to make changes on
6. Restart

   

   Figure: Now that the server isn't being hit with users, perform your updates. Click "Restart Now"7. Optional – Do a smoke test (open the site and check its working)
7. Optional – Run any automated tests (for example Telerik Tests)
8. When the server ready, add it back into the load balancer. Right click on the machine | Select Control Host | Click Start
9. The server icon will return to green, and users will start being sent to the server again

   

   Figure: The server will now accept connections again11. Follow the same process for the other server (or multiple)

Congratulations you've just updated your servers with 100% uptime.

It is important install your printers automatically to all clients that logon to the domain.

This can be achieved via Group Policy. This can be set up easily in a Microsoft Windows 2008 Server R2:

• From Server Manager add the Print Services role

  

  Figure: Install the Print Services role* When the role has installed, open Print Management from Administrative Tools
• Install all your printers by right clicking on Printers and clicking Add Printer

  

  Figure: Add all of your printers to the server* Right click on Drivers and choose Add Drivers. From here you will be able to install the x86 and x64 drivers for your printers so all workstations in your organization get the printer drives automatically

  

  Figure: Add the additional drivers for both x86 and x64* Click on Printers in the menu to get a list of your installed printers
• Right click on the first printer you want to install via group policy and click on Deploy with Group Policy

  

  Figure: Deploying your printer with Group Policy* Next, you need to choose a Group Policy Object (GPO) to add the printers too. You may wish to create a new GPO specifically for the printers, which you can do through the Group Policy Management tool in Administrative Tools

  

  Figure: Select the Group Policy Object (GPO) to add the printers to* Repeat the last 2 steps for each printer you want to add automatically using Group Policy
• Reboot your workstations and the new printers will be added upon login

For PCs that are not in the domain, the printers won’t be automatically installed.

So you should add a DNS alias which maps \printer to your print server.

A “Too slow” is not enough info.

Request an image of the “Resource Monitor”

Then after you decide there is justification:

• Do a typical action – take a new image or baseline.
• Give the additional resources e.g. Ram and processors...
• Do the typical action again – take another image of the “Resource Monitor”
• If there is some improvement, reply “done” (otherwise reply “not done”)

Note: An ideal email subject prefix for more resources would be e.g. “Performance issue – “Machine name”

Windows Server has a built-in solution for auditing who accessed your files in a file share or non-shared files in your file system, but it is turned off by default.

"Advanced Audit Policy Configuration" is a Group Policy setting in Windows that enables several audit options for your files, e.g.:

1. Object Access - Audit who opened, closed or modified files and folders in your system
2. Logon/Logoff - Audit who's logged on and off the server

To get to this setting, you need to:

1. Open your domain's or server's Group Policy (or Local Group Policy)
2. Computer Configuration | Windows Settings | Security Settings | Advanced Audit Policy Configuration
3. Choose the setting that applies to you e.g. Object Access
4. Edit the subcategory | Check "Success" and "Failure" as best practices

After that, your server will start logging audit events in the Event Viewer. To filter relevant events, do the following:

1. Open Window's Event Viewer | Windows Logs | Security

2. Click "Filter Current Log..." | IDs 4663, 4660, 5145:

   1. 4663 (An attempt was made to access an object) - Event ID when a user accesses a file system file
   2. 4660 (An object was deleted) - Event ID when a user deletes a file system file
   3. 5145 (A network share object was checked to see whether the client can be granted desired access.) - Event ID when a network user accesses a file share file
3. The relevant logs will start popping up:

4. Click on each entry for a detailed explanation on which file was opened, which IP address was used and which user initiated the action

This kind of audit tool is an important part of any SysAdmin or Security Engineer to better see what is going on in your Windows environment.

Windows has a built-in storage solution called Storage Spaces that allows you to group 3 or more storage drives to create a bigger pool; however, that technology, whilst useful, has some better third-party contenders like Drive Bender, which does the same thing better and faster.

With Drive Bender, you also have software RAID, disk grouping, and file duplication that you find in Storage Spaces, but with a better interface and faster transfer rates.

Drive Bender Pros

1. Nice UI with lots of functionality
2. Regular updates
3. Heaps of configuration options
4. Friendly (and fast!) customer support (Bonus: They are located in Sydney, Australia, just like SSW! 😃)
5. Easy add and remove of drives to the pool
6. Check your disk health automatically
7. Get notifications on pool status

Drive Bender Cons

1. Storage Spaces is "free" (built-in in Windows Server), Drive Bender is $54.95 for 3 machines (still cheap, forever)

Have a look at Drive Bender website for more info!

When using service accounts, you should have a specific AD account for each major service.