Introduction |
|
xxi | |
Changes since Windows Server 2016 Inside Out |
|
xxi | |
Acknowledgments |
|
xxii | |
Errata, updates, and book support |
|
xxii | |
|
Chapter 1 Administration Tools |
|
|
1 | (30) |
|
|
1 | (1) |
|
Privileged Access Workstations |
|
|
2 | (2) |
|
|
4 | (7) |
|
Installing Windows Admin Center |
|
|
6 | (3) |
|
Windows Admin Center extensions |
|
|
9 | (1) |
|
|
10 | (1) |
|
Remote Server Administration Tools |
|
|
11 | (6) |
|
|
11 | (3) |
|
|
14 | (3) |
|
|
17 | (8) |
|
|
18 | (1) |
|
|
19 | (1) |
|
|
19 | (2) |
|
|
21 | (1) |
|
|
21 | (3) |
|
|
24 | (1) |
|
|
25 | (2) |
|
|
27 | (4) |
|
Chapter 2 Installation Options |
|
|
31 | (16) |
|
Windows Server 2019 editions |
|
|
31 | (2) |
|
Windows Server servicing branches |
|
|
33 | (2) |
|
Long Term Servicing Channel |
|
|
33 | (1) |
|
|
33 | (1) |
|
|
34 | (1) |
|
|
35 | (9) |
|
|
36 | (1) |
|
|
37 | (5) |
|
Server Core App Compatibility Features on Demand |
|
|
42 | (1) |
|
When to deploy Server Core |
|
|
43 | (1) |
|
Server with Desktop Experience |
|
|
44 | (1) |
|
|
45 | (2) |
|
Chapter 3 Deployment And Configuration |
|
|
47 | (62) |
|
Bare metal versus virtualized |
|
|
47 | (1) |
|
|
48 | (9) |
|
|
49 | (1) |
|
|
50 | (1) |
|
|
50 | (3) |
|
Adding drivers and updates to images |
|
|
53 | (1) |
|
Adding roles and features |
|
|
54 | (2) |
|
|
56 | (1) |
|
|
56 | (1) |
|
|
57 | (2) |
|
Windows Deployment Services |
|
|
59 | (9) |
|
|
60 | (2) |
|
|
62 | (1) |
|
|
62 | (5) |
|
Configuring transmissions |
|
|
67 | (1) |
|
Driver groups and packages |
|
|
68 | (1) |
|
|
68 | (11) |
|
Virtual machine templates |
|
|
68 | (1) |
|
|
69 | (2) |
|
|
71 | (4) |
|
|
75 | (1) |
|
|
76 | (3) |
|
Infrastructure configuration as code |
|
|
79 | (2) |
|
Desired State Configuration |
|
|
81 | (4) |
|
|
82 | (1) |
|
Local Configuration Manager |
|
|
83 | (1) |
|
|
83 | (1) |
|
|
84 | (1) |
|
|
84 | (1) |
|
|
85 | (11) |
|
|
85 | (4) |
|
|
89 | (5) |
|
|
94 | (1) |
|
Deploying Chef cookbooks and recipes |
|
|
95 | (1) |
|
|
96 | (7) |
|
|
96 | (3) |
|
Deploying Puppet agent to Windows Server |
|
|
99 | (2) |
|
Managing Windows Server configuration |
|
|
101 | (1) |
|
Puppet Windows Module Pack |
|
|
102 | (1) |
|
Package-management utilities |
|
|
103 | (6) |
|
|
104 | (1) |
|
|
105 | (4) |
|
Chapter 4 Active Directory |
|
|
109 | (50) |
|
Managing Active Directory |
|
|
109 | (9) |
|
Remote rather than local administration |
|
|
110 | (1) |
|
Active Directory Administrative Center |
|
|
110 | (3) |
|
Active Directory Users and Computers console |
|
|
113 | (1) |
|
Active Directory Sites and Services console |
|
|
114 | (3) |
|
Active Directory Domains and Trusts console |
|
|
117 | (1) |
|
|
118 | (7) |
|
|
118 | (2) |
|
|
120 | (1) |
|
|
121 | (1) |
|
Read only domain controllers |
|
|
121 | (3) |
|
Virtual domain controller cloning |
|
|
124 | (1) |
|
|
125 | (5) |
|
|
125 | (1) |
|
|
125 | (1) |
|
|
126 | (1) |
|
Account and resource forests |
|
|
127 | (1) |
|
|
127 | (1) |
|
Flexible Single Master Operations roles |
|
|
128 | (2) |
|
|
130 | (8) |
|
|
130 | (2) |
|
|
132 | (1) |
|
|
133 | (1) |
|
|
134 | (2) |
|
|
136 | (2) |
|
|
138 | (8) |
|
|
139 | (2) |
|
|
141 | (2) |
|
|
143 | (2) |
|
|
145 | (1) |
|
|
146 | (6) |
|
Active Directory Recycle Bin |
|
|
147 | (2) |
|
|
149 | (2) |
|
Active Directory snapshots |
|
|
151 | (1) |
|
Managing AD DS with PowerShell |
|
|
152 | (7) |
|
|
152 | (4) |
|
|
156 | (1) |
|
|
157 | (2) |
|
Chapter 5 Dns, Dhcr And Ipam |
|
|
159 | (32) |
|
|
159 | (18) |
|
|
159 | (3) |
|
|
162 | (1) |
|
Forwarders and conditional forwarders |
|
|
163 | (1) |
|
|
164 | (1) |
|
|
164 | (1) |
|
Peer Name Resolution Protocol |
|
|
165 | (1) |
|
|
166 | (1) |
|
Zone aging and scavenging |
|
|
167 | (1) |
|
|
168 | (1) |
|
|
169 | (1) |
|
|
170 | (4) |
|
|
174 | (1) |
|
Managing DNS with PowerShell |
|
|
174 | (3) |
|
|
177 | (8) |
|
|
177 | (1) |
|
|
178 | (1) |
|
|
178 | (1) |
|
|
179 | (1) |
|
|
179 | (1) |
|
|
180 | (1) |
|
|
180 | (1) |
|
|
180 | (1) |
|
|
181 | (1) |
|
|
182 | (3) |
|
|
185 | (6) |
|
|
185 | (1) |
|
Configure server discovery |
|
|
185 | (1) |
|
|
186 | (2) |
|
Managing IPAM with PowerShell |
|
|
188 | (3) |
|
|
191 | (1) |
|
|
191 | (1) |
|
|
192 | (1) |
|
|
193 | (1) |
|
Guest integration services |
|
|
193 | (1) |
|
|
194 | (1) |
|
|
195 | (1) |
|
Discrete Device Assignment |
|
|
196 | (1) |
|
|
197 | (1) |
|
Nested virtualization dynamic memory |
|
|
197 | (1) |
|
Nested virtualization networking |
|
|
197 | (1) |
|
|
198 | (1) |
|
|
198 | (1) |
|
|
199 | (3) |
|
|
199 | (1) |
|
Dynamically expanding disks |
|
|
199 | (1) |
|
|
200 | (1) |
|
Modifying virtual hard disks |
|
|
200 | (1) |
|
|
201 | (1) |
|
|
202 | (1) |
|
Virtual Fibre Channel adapters |
|
|
203 | (1) |
|
|
204 | (1) |
|
Hyper-V storage optimization |
|
|
204 | (1) |
|
|
204 | (1) |
|
|
204 | (1) |
|
|
205 | (1) |
|
|
205 | (1) |
|
|
205 | (1) |
|
|
206 | (1) |
|
Virtual machine network adapters |
|
|
206 | (1) |
|
Optimizing network performance |
|
|
206 | (2) |
|
|
207 | (1) |
|
|
207 | (1) |
|
Dynamic virtual machine queue |
|
|
207 | (1) |
|
Virtual machine NIC teaming |
|
|
208 | (1) |
|
Virtual machine MAC addresses |
|
|
208 | (1) |
|
|
209 | (1) |
|
|
209 | (3) |
|
Configuring Hyper-V replica servers |
|
|
210 | (1) |
|
|
210 | (1) |
|
|
211 | (1) |
|
|
211 | (1) |
|
Hyper-V failover clusters |
|
|
212 | (5) |
|
Hyper-V host cluster storage |
|
|
212 | (1) |
|
|
213 | (1) |
|
|
214 | (1) |
|
|
215 | (1) |
|
|
215 | (1) |
|
Active Directory detached clusters |
|
|
216 | (1) |
|
Preferred owner and failover settings |
|
|
216 | (1) |
|
|
217 | (2) |
|
Hyper-V guest cluster storage |
|
|
218 | (1) |
|
|
218 | (1) |
|
|
219 | (1) |
|
|
219 | (2) |
|
|
221 | (1) |
|
Exporting, importing, and copying VMs |
|
|
221 | (1) |
|
VM Network Health Detection |
|
|
222 | (1) |
|
|
222 | (1) |
|
Domain controller cloning |
|
|
223 | (1) |
|
Shielded virtual machines |
|
|
223 | (1) |
|
Managing Hyper-V using PowerShell |
|
|
224 | (5) |
|
|
229 | (44) |
|
Storage spaces and storage pools |
|
|
229 | (18) |
|
|
230 | (4) |
|
|
234 | (1) |
|
|
235 | (2) |
|
Thin provisioning and trim |
|
|
237 | (2) |
|
|
239 | (1) |
|
|
240 | (7) |
|
|
247 | (4) |
|
|
248 | (1) |
|
|
249 | (2) |
|
|
251 | (1) |
|
|
252 | (4) |
|
|
256 | (2) |
|
|
258 | (1) |
|
|
259 | (1) |
|
|
260 | (3) |
|
Storage Quality of Service |
|
|
263 | (1) |
|
|
264 | (2) |
|
Storage-related PowerShell cmdlets |
|
|
266 | (7) |
|
|
266 | (1) |
|
|
266 | (1) |
|
|
267 | (1) |
|
|
267 | (1) |
|
|
268 | (3) |
|
|
271 | (2) |
|
|
273 | (36) |
|
Shared folder permissions |
|
|
274 | (6) |
|
|
275 | (1) |
|
|
276 | (1) |
|
|
277 | (3) |
|
File Server Resource Manager |
|
|
280 | (13) |
|
|
280 | (2) |
|
|
282 | (4) |
|
|
286 | (2) |
|
|
288 | (2) |
|
|
290 | (2) |
|
|
292 | (1) |
|
|
293 | (6) |
|
|
293 | (3) |
|
|
296 | (3) |
|
|
299 | (3) |
|
|
302 | (7) |
|
|
302 | (1) |
|
File Server Resource Manager cmdlets |
|
|
303 | (2) |
|
|
305 | (1) |
|
|
306 | (3) |
|
Chapter 9 Internet Information Services |
|
|
309 | (28) |
|
|
309 | (17) |
|
|
310 | (3) |
|
|
313 | (1) |
|
|
314 | (1) |
|
|
314 | (1) |
|
Configuring TLS certificates |
|
|
315 | (3) |
|
|
318 | (1) |
|
Modifying custom error response |
|
|
319 | (1) |
|
Adding or disabling the default document |
|
|
320 | (1) |
|
|
321 | (1) |
|
IP address and domain name filtering |
|
|
322 | (1) |
|
|
323 | (1) |
|
|
324 | (2) |
|
|
326 | (3) |
|
Creating application pools |
|
|
327 | (1) |
|
Configuring application pool recycling settings |
|
|
328 | (1) |
|
|
329 | (3) |
|
|
330 | (1) |
|
Delegating administrative permissions |
|
|
331 | (1) |
|
|
332 | (2) |
|
Managing IIS using PowerShell |
|
|
334 | (3) |
|
|
337 | (32) |
|
|
337 | (2) |
|
|
339 | (1) |
|
|
339 | (1) |
|
|
340 | (1) |
|
Managing containers with Docker |
|
|
340 | (7) |
|
|
341 | (1) |
|
|
342 | (2) |
|
Retrieving container OS image |
|
|
344 | (1) |
|
Container registries and images |
|
|
345 | (2) |
|
|
347 | (9) |
|
|
347 | (3) |
|
Modifying a running container |
|
|
350 | (1) |
|
Creating a new image from a container |
|
|
351 | (1) |
|
|
351 | (2) |
|
Managing container images |
|
|
353 | (2) |
|
Service accounts for Windows containers |
|
|
355 | (1) |
|
|
356 | (1) |
|
|
357 | (6) |
|
|
359 | (1) |
|
|
360 | (2) |
|
|
362 | (1) |
|
|
362 | (1) |
|
Linux containers on Windows |
|
|
363 | (1) |
|
|
364 | (5) |
|
|
365 | (1) |
|
|
365 | (4) |
|
Chapter 11 Clustering And High Availability |
|
|
369 | (22) |
|
|
369 | (16) |
|
|
370 | (2) |
|
Cluster storage and cluster shared volumes |
|
|
372 | (1) |
|
|
372 | (1) |
|
|
373 | (1) |
|
|
373 | (1) |
|
Failover and preference settings |
|
|
374 | (1) |
|
|
375 | (1) |
|
|
376 | (1) |
|
Virtual machine failover clustering |
|
|
377 | (2) |
|
|
379 | (2) |
|
|
381 | (1) |
|
|
382 | (1) |
|
Managing failover clustering with PowerShell |
|
|
383 | (2) |
|
|
385 | (6) |
|
Network Load Balancing prerequisites |
|
|
386 | (1) |
|
NLB cluster operation modes |
|
|
386 | (1) |
|
|
387 | (1) |
|
|
388 | (1) |
|
|
388 | (1) |
|
Managing NLB with PowerShell |
|
|
389 | (2) |
|
Chapter 12 Active Directory Certificate Services |
|
|
391 | (46) |
|
|
391 | (15) |
|
|
393 | (10) |
|
|
403 | (3) |
|
Certificate revocation lists |
|
|
406 | (6) |
|
|
406 | (1) |
|
Authority Information Access |
|
|
407 | (1) |
|
|
408 | (2) |
|
Publishing CRLs and delta CRLs |
|
|
410 | (2) |
|
Certificate Services role services |
|
|
412 | (1) |
|
|
413 | (7) |
|
|
414 | (6) |
|
Adding and editing templates |
|
|
420 | (1) |
|
Certificate autoenrollment and renewal |
|
|
420 | (2) |
|
|
422 | (15) |
|
Handling certificate requests |
|
|
424 | (1) |
|
|
425 | (2) |
|
Key archiving and recovery |
|
|
427 | (5) |
|
|
432 | (1) |
|
Managing Certificate Services using PowerShell |
|
|
433 | (2) |
|
Managing Certificate Services using Certutil.exe and Certreq.exe |
|
|
435 | (2) |
|
Chapter 13 Active Directory Federation Services |
|
|
437 | (18) |
|
|
437 | (1) |
|
Claims, claim rules, and attribute stores |
|
|
438 | (1) |
|
|
439 | (1) |
|
|
439 | (1) |
|
|
439 | (1) |
|
|
440 | (1) |
|
Configuring certificate relationship |
|
|
441 | (1) |
|
|
442 | (1) |
|
|
443 | (2) |
|
Relying party trust claim rules |
|
|
443 | (1) |
|
Claims provider trust claim rules |
|
|
444 | (1) |
|
Configure Web Application Proxy |
|
|
445 | (2) |
|
|
447 | (2) |
|
Multifactor authentication |
|
|
449 | (1) |
|
Managing AD FS with PowerShell |
|
|
450 | (3) |
|
Managing Web Application Proxy with PowerShell |
|
|
453 | (2) |
|
Chapter 14 Dynamic Access Control And Active Directory Rights Management Services |
|
|
455 | (20) |
|
|
455 | (1) |
|
Configuring Group Policy to support DAC |
|
|
456 | (1) |
|
Configuring User and Device Claims |
|
|
456 | (1) |
|
Configuring Resource Properties |
|
|
457 | (2) |
|
|
459 | (2) |
|
|
461 | (2) |
|
|
463 | (1) |
|
|
463 | (1) |
|
|
464 | (1) |
|
AD RMS certificates and licenses |
|
|
465 | (1) |
|
|
466 | (3) |
|
AD RMS Administrators and Super Users |
|
|
469 | (1) |
|
Trusted User and Publishing Domains |
|
|
470 | (1) |
|
|
471 | (2) |
|
Apply AD RMS templates automatically |
|
|
471 | (2) |
|
Managing AD RMS with Windows PowerShell |
|
|
473 | (2) |
|
Dynamic Access Control cmdlets |
|
|
474 | (1) |
|
Chapter 15 Routing And Remote Access |
|
|
475 | (24) |
|
|
475 | (4) |
|
RD Gateway connection and resource policies |
|
|
476 | (1) |
|
Configuring server settings |
|
|
477 | (1) |
|
Configuring clients to use RD Gateway |
|
|
477 | (2) |
|
|
479 | (8) |
|
IKEv2 Always On VPN protocol |
|
|
479 | (2) |
|
|
481 | (1) |
|
|
481 | (1) |
|
|
481 | (1) |
|
|
482 | (1) |
|
|
482 | (1) |
|
|
483 | (1) |
|
Granting access to a VPN server |
|
|
483 | (4) |
|
|
487 | (1) |
|
Network Address Translation (NAT) |
|
|
487 | (2) |
|
|
489 | (7) |
|
|
490 | (1) |
|
|
490 | (2) |
|
|
492 | (1) |
|
|
493 | (3) |
|
Managing Remote Access using PowerShell |
|
|
496 | (3) |
|
Chapter 16 Remote Desktop Services |
|
|
499 | (20) |
|
|
499 | (3) |
|
Remote Desktop Connection Broker |
|
|
502 | (1) |
|
|
502 | (1) |
|
Remote Desktop Session Host |
|
|
503 | (6) |
|
Session collection settings |
|
|
504 | (2) |
|
Personal session desktops |
|
|
506 | (1) |
|
|
506 | (1) |
|
Group Policy configuration |
|
|
507 | (2) |
|
Remote Desktop Virtualization Host |
|
|
509 | (4) |
|
Virtual machine preparation |
|
|
510 | (1) |
|
Virtual desktop collections |
|
|
511 | (1) |
|
|
512 | (1) |
|
Personal virtual desktops |
|
|
512 | (1) |
|
|
512 | (1) |
|
Remote Desktop Web Access |
|
|
513 | (1) |
|
|
513 | (2) |
|
|
514 | (1) |
|
Activating a License Server |
|
|
515 | (1) |
|
Managing Remote Desktop Services using PowerShell |
|
|
515 | (4) |
|
Chapter 17 Azure Laas And Hybrid Services |
|
|
519 | (56) |
|
|
519 | (19) |
|
|
520 | (4) |
|
|
524 | (8) |
|
|
532 | (6) |
|
|
538 | (26) |
|
Azure Active Directory Connect |
|
|
540 | (1) |
|
Azure AD Connect server requirements |
|
|
541 | (3) |
|
Installing Azure AD Connect |
|
|
544 | (7) |
|
Using UPN suffixes and non-routable domains |
|
|
551 | (3) |
|
Monitor Azure AD Connect Health |
|
|
554 | (1) |
|
|
555 | (2) |
|
|
557 | (3) |
|
Implement and manage Azure AD self-service password reset |
|
|
560 | (2) |
|
Azure AD Password Protection |
|
|
562 | (1) |
|
|
563 | (1) |
|
Azure hybrid cloud services |
|
|
564 | (11) |
|
Connect Windows Admin Center |
|
|
565 | (2) |
|
Creating Azure laaS VMs from Windows Admin Center |
|
|
567 | (2) |
|
|
569 | (3) |
|
|
572 | (1) |
|
|
572 | (1) |
|
|
573 | (2) |
|
Chapter 18 Windows Subsystem For Linux |
|
|
575 | (6) |
|
|
575 | (1) |
|
|
576 | (3) |
|
|
579 | (2) |
|
Chapter 19 Hardening Windows Server And Active Directory |
|
|
581 | (54) |
|
Hardening Active Directory |
|
|
582 | (14) |
|
Hardening domain controllers |
|
|
582 | (1) |
|
|
583 | (1) |
|
Role-Based Access Control |
|
|
584 | (1) |
|
|
585 | (1) |
|
|
586 | (2) |
|
|
588 | (1) |
|
Authentication policies silos |
|
|
589 | (2) |
|
|
591 | (1) |
|
Block server operators from scheduling tasks |
|
|
592 | (1) |
|
Enable Local Security Authority protection |
|
|
592 | (1) |
|
|
593 | (1) |
|
Enhanced Security Administrative Environment forest |
|
|
594 | (2) |
|
|
596 | (32) |
|
|
596 | (4) |
|
|
600 | (3) |
|
Just Enough Administration |
|
|
603 | (6) |
|
Privileged Access Management |
|
|
609 | (4) |
|
Local Administrator Password Solution |
|
|
613 | (2) |
|
|
615 | (3) |
|
Windows Firewall with Advanced Security |
|
|
618 | (10) |
|
|
628 | (7) |
|
|
631 | (4) |
|
Chapter 20 Security Systems And Services |
|
|
635 | (18) |
|
Security Compliance Toolkit |
|
|
636 | (2) |
|
|
636 | (2) |
|
Local Group Policy Object tool |
|
|
638 | (1) |
|
|
638 | (2) |
|
|
640 | (2) |
|
Windows Defender Application Control |
|
|
642 | (2) |
|
Virtualization-based security |
|
|
644 | (1) |
|
|
645 | (2) |
|
|
647 | (3) |
|
|
650 | (1) |
|
Windows Defender SmartScreen |
|
|
651 | (2) |
|
Chapter 21 Maintenance And Monitoring |
|
|
653 | (32) |
|
|
653 | (2) |
|
|
655 | (1) |
|
|
655 | (4) |
|
|
655 | (1) |
|
|
656 | (1) |
|
|
657 | (1) |
|
|
658 | (1) |
|
|
659 | (2) |
|
|
659 | (1) |
|
|
660 | (1) |
|
|
661 | (1) |
|
|
662 | (4) |
|
|
664 | (1) |
|
|
664 | (1) |
|
Role- and application-specific backups |
|
|
665 | (1) |
|
|
665 | (1) |
|
Restore to an alternative location |
|
|
666 | (1) |
|
|
666 | (4) |
|
|
667 | (2) |
|
Backing up data to Azure Backup Agent |
|
|
669 | (1) |
|
Restore from Azure Backup |
|
|
669 | (1) |
|
|
670 | (2) |
|
Windows Server Update Services |
|
|
672 | (7) |
|
Products, security classifications, and languages |
|
|
672 | (1) |
|
Autonomous and replica modes |
|
|
673 | (1) |
|
|
673 | (1) |
|
|
674 | (1) |
|
|
675 | (1) |
|
|
675 | (2) |
|
|
677 | (1) |
|
|
677 | (2) |
|
|
679 | (4) |
|
Monitoring and maintenance related PowerShell cmdlets |
|
|
683 | (1) |
|
WSUS related PowerShell cmdlets |
|
|
684 | (1) |
|
Chapter 22 Upgrade And Migration |
|
|
685 | (38) |
|
Supported upgrade and migration paths |
|
|
685 | (8) |
|
Upgrading roles and features |
|
|
687 | (1) |
|
Converting evaluation version to licensed version |
|
|
688 | (1) |
|
|
689 | (1) |
|
Windows Server Migration Tools |
|
|
689 | (4) |
|
|
693 | (6) |
|
|
695 | (1) |
|
Migrating to a new forest |
|
|
696 | (3) |
|
Active Directory Certificate Services |
|
|
699 | (5) |
|
|
700 | (2) |
|
|
702 | (1) |
|
Verification and post migration tasks |
|
|
703 | (1) |
|
|
704 | (1) |
|
|
705 | (4) |
|
Preparing to migrate DHCP |
|
|
706 | (2) |
|
|
708 | (1) |
|
Verification and post migration tasks |
|
|
709 | (1) |
|
|
709 | (14) |
|
Migrate file servers using Storage Migration Service |
|
|
710 | (8) |
|
Migrate file and storage servers using WSMT |
|
|
718 | (5) |
|
Chapter 23 Troubleshooting |
|
|
723 | (38) |
|
Troubleshooting methodology |
|
|
723 | (6) |
|
|
724 | (1) |
|
|
725 | (1) |
|
|
726 | (1) |
|
Ranking hypothetical solutions |
|
|
727 | (1) |
|
|
728 | (1) |
|
|
729 | (4) |
|
|
733 | (28) |
|
|
734 | (1) |
|
|
735 | (1) |
|
|
736 | (1) |
|
|
737 | (1) |
|
|
738 | (1) |
|
|
739 | (1) |
|
|
740 | (1) |
|
|
741 | (3) |
|
|
744 | (1) |
|
|
745 | (1) |
|
|
746 | (1) |
|
Active Directory Explorer |
|
|
746 | (3) |
|
Insight for Active Directory |
|
|
749 | (1) |
|
|
750 | (1) |
|
|
751 | (10) |
Index |
|
761 | |