Introducing Windows Server 2008 Mitch Tulluch with the Microsoft Windows Server Team Purchase select Microsoft Press books at a discount (available in the United States only) To learn more about this book, visit Microsoft howe. micrs /MSP re ks/141 x 9780735624214 Dace Publication Date: May 2007 FreSsAdditional Resources for IT Professionals Published and Forthcoming Titles from Microsoft Press > Wi Micro Windows? XP Windows Server Microsoft W Wicsot® Windows Server 2003 roesona) Resource Kit Third Edition Microsoft MVPs and Partners with Microsoft Windows Server Team 978:0-7356-2232.6 Microsoft Windows Server 2003 The Microsoft Windows Team with CChatie Russel and Sharon Crawford 978-0-7356-2167-1 Tulloch, Northrup, Honeycut, Russel and Wilson with the oeemeeeeiaee Microsoft Windows Vista Team Inside Microsoft SOL Server 2005: 978-0-7356-22858 The Storage Engine Kalen Bela Windows Vista 7386 05. Administrator's Pocket Consultant 978 0-7356-2105-3 Willam 8 Stanek Inside Microsoft SQL Server 2005: 978-0-7356-2296-8 T-SQL Programming tak Ben-Gan, Dejan Sarka, and Roger Wolter 978-0-7356-2197-8 ™ oy 7 » Exchange Server 2007 Microsoft xchange Server 2007 ‘Administrator's Companion Walter Glenn and Seatt Lowe 978:0-7356 2350-7 ‘Microsoft Exchange Server 2007 trator’s Pocket Consultant icros¢ findows Adoni ‘Adminstrator’ Companion ree oP Willem R Stanek Second ean Fitesone pocket Consutant ——SIB-0 7356 2540-4 Ge sl Staron rowfo eres and Jason Gerenc William R. Stanek > Seri Sesriem snore trot Windows Poweshl™ pieesonatt Winicres sereet 2002] are dean Coenen ee Se ‘Step pee aeons on Wier Sank Fria ine 978-0-7356-2895.8 Aumntsvotors Pocket Consutant ~~» SQL Server 2005 eden Seton ton, Microsoft SQLServer 2005 sre 0136-20975 iar tne drattraars Pocket Cova ; Sree ise N86 error Ment zo Windows 978-0-7356-2107-7 heed U i ~ Windows Client epee Selcraced peeing cue Windows Vista™ ‘Adminstrator Companion 978-0-7356-2231-9 Resource Kit Whalen, Goria, eal ‘Advanced VBScript for Microsoft Windows Administrators Don Jones and Jeflery 978-0-7356-2246-5, | a | a Microsoft Office Microsoft Windows Microsoft nteret SharePoin® Server Security Security and 2007 Administrators Resour Kit Acceleration (SA) ‘Companion Second Edition Administrator's Server 2 EifEngisn with te Sen ith and ian Companion Pocket Microsoft SharePoint Komar withthe Chorke Russel ond Consuftant Community Experts Mfcrosoft Security Sharon Crawford Bud Ratliff and Jason Seon Meo Sharon omrd Baler withthe Microsoft 978-0-7356-2174-9 ISA Server Team 978-0-7356-2188-6 microsoft.com/mspress«© Practical, portable ‘uide for fest answers ‘When you need them ‘© Focus on core oper- ations and support tasks «© Organized for quick, precise reference— to get the job done Available in 2008 from Microsoft Press Ieee Brey" essere Sreorse 750 Viotasdon eowcer Windows Seer 208 Sec neue leona ee 3008 Steonsesar Seomenee See our fll line of leaning resources at: microsoft.com/mspress and microsoft.com/learning ‘Companion’ © Comprehensive, ‘one volume guide to deployment and system ‘administration 1 Real-word insights, procedures trouble: Shooting tactic, and ‘workarounds «Fully searchable eBook on cD Inne Su emis ‘Motta er Senses ‘nes Gee Poly Gide, Sond aioe Scott Conant Internet Information Services ‘Sere 61973. «in-depth technical information and tools fom those who know the technology best «© Definitive reference for deployment and ‘operations Essential toolkit of resources, including ‘800k, on CD Intra nermaon Serves 978, ere Scripting Sotien1 Training Kit Two product in one offal exam prep guide + practice tests «Features lessons, exercises, and cose * Comprehensive sel test tral software, Book on CD Microsoft’PUBLISHED BY Microsoft Press A Division of Microsoft Corporation One Microsoft Way Redmond, Washington 98052-6399 Copyright © 2007 by Microsoft Corporation All rights reserved. No part of the contents of this book may be reproduced or transmitted in any form or by any means without the written permission of the publisher. Library of Congress Control Number: 2007924650 Printed and bound in the United States of America 123456789 QWr 210987 Distributed in Cenada by H.B, Fenn and Company Lid, ACP catalogee record for this ook is availabe from the British Libra Chapter 4 contains the “From the Experts: WMI Remote Connection” sidebar. Copyright © 2007 by Alain Lissoir. Microsot Press books are available through booksellers and distributors worldwide. For further infor- ‘mation about international editions, contact your local Microsoft Corporation office or contact Microsol Pres International directly at fax (425) 936-7329. Visit our Web site at wirw.nieresof com/mspress. Send comments to tinput@microsof com. Microsoft, Microsoft Press, Active Directory, ActiveX, Acro, BitLocker, ClearType, Direct3D, Excel, Intemet Explorer, Microsoft Dynamics, MSDN, MS-DOS, Outlook, PowerPoint, SharePoint, SQL Server, Terminal Services RemoteApp, Visual Basic, Visual Studio, Visual Web Developer, Win32, Windows, Windows CardSpace, Windows Live, Windows Media, Windows Mobile, Windows NT, Windows PowerShell, Windows Server, Windows Server System, Windows Vista, and WinFX are either registered trademarks of trademarks of Microsoft Corporation in the United States and/or other counties, Other product and company names mentioned herein may be the trademarks of theit ‘respective overs, The example companies, organizations, products, domain names, e-mail addresses, logos, people, places, and events depicted herein are Retitious, No association with any real company, organization, product, domain name, e-mail address, logo, person, place, or event is intended or should be inferred. This book expresses the author's views and opinions. The information contained in this book is provided “without any express, statutory, or implied warranties. Nether the authors, Microsoft Corporation, no its ‘esllers, oF distributors will be held liable for any damages caused or alleged to be caused either directly or indirectly by this book. ‘Acquisitions Editor: Martin DelRe Developmental Editor: Karen Szall Project Editor: Denise Bankaits Body Part No. X13-72717Table of Contents Preface 1 Introduction... What's Between the Sheets Acknowledgments... One Last Thing—Humor .... 2 Usage Scenarios. ..........s0ccsseceeeeeesceeseeeseeuesesesenes Providing an Identity and Access Infrastructure. .. Ensuring Security and Policy Enforcement . Easing Deployment Headaches. Making Servers Easier to Manage ... Supporting the Branch Office Providing Centralized Application Access Deploying Web Applications and Services ............ Ensuring High Availability... Ensuring Secure and Reliable Storage . Leveraging Virtualization Conclusion . . 3. Windows Server Virtualization. Why Enterprises Love Virtualiz Server Consolidation. Business Continuity. Testing and Development Application Compatibility Virtualization in the Datacenter What do you think of this book? We want to hear from you! Ce ned 10 10 1 2 .B B 14 14 15 16 16 . 8 18 19 19 19Table of Contents Virtualization Today. Monolithic Hypervisor Microkernelized Hypervisor . Understanding Virtualization in Windows Server 2008 Partition 1: Parent . Partition 2: Child with Enlightened Guest. Partition 3: Child with Legacy Guest Partition 4: Child with Guest Running Linux. . Features of Windows Server Virtualization : Managing Virtual Machines in Windows Server 2008. System Center Virtual Machine Manager 2007... SoftGrid Application Virtualization .. Conclusion. See -20 22 -22, 224 25 1126 227 - 28 2.28 -29 36 36 37 37 4 Managing Windows Server 2008.........e+-sessssseesesseesesse 39 Performing Initial Configuration Tasks ......... Using Server Manager... . Managing Server Roles ServerManagerCmd.exe. aa ol Other Management Tools . Group Policy . ‘Windows Management instrumentation .... ‘Windows PowerShell Microsoft System Center. Conclusion. ‘Additional Resources . - 56 39 42 ars = 50 53 56 -359 64 - 68 69 69 5 Managing Server Roles .........2..0000sessseeeeeeeeessseeeeees TL Understanding Roles, Role Services, and Features .. Available Roles and Role Services Available Features. .. “71 ele 283Table of Contents vil ‘Adding Roles and Features ....... 95 Using Initial Configuration Tasks, 7 Using Server Manager ........ + 104 From the Command Line = 105 Conclusion , - 108 Additional Reading = 108 6 Windows Server Core. : - 109 What Is 2 Windows Server Core Installation? = 109 Understanding Windows Server Core . -m ‘The Rationale for Windows Server Core . 15 Performing Intal Configuration of @ Windows Server Coe Serve 18 Performing Initial Configuration from the Command Line . 18 Managing a Windows Server Core Server .. - 30 Local Management from the Command Line. 130 Remote Management Using Terminal Services ... 137 Remote Management Using the Remote Server Ad 140 Remote Administration Using Group Policy .. : sevens MAL Remote Management Using WinRM/WinRS .......2....00ceeeseseree 142 Windows Server Core installation Tips and Tricks . 143 Conclusion ...... . M7 Additional Resources .... _ 47 7 Active Directory Enhancements . . 149 Understanding Identity and Access in Windows Server 2008 . 149 Understanding Identity and Access .........0ecseeevsesteseeteseseses 149 Identity and Access in Windows 2000 Server. +. 150 Identity and Access in Windows Server 2003 - 151 Identity and Access in Windows Server 2003 R2... - 152 Identity and Access in Windows Server 2008. - 153 Active Directory Domain Services ......... . 158 ‘AD DS Auditing Enhancements........ - 158 Read-Only Domain Controllers........6.cccccceecseerseeseeee 164 Restartable AD DS. 168 Granular Password and Account Lockout Poli 169Table of Contents Active Directory Lightweight Directory Services Active Directory Certificate Services : Certificate Web Enrollment improvements Network Device Enrollment Service Support. Online Certificate Status Protocol Support. Enterprise PKI and CAPI2 Diagnostics. (Other AD CS Enhancements . Active Directory Federation Services .... Active Directory Rights Management Services . Conclusion... Additional Resources 8 Terminal Services Enhancements .... Core Enhancements to Terminal Services. Remote Desktop Connection 6.0 Single Sign-On for Domain-joined Clients... Other Core Enhancements ... a Installing and Managing Terminal Services .. Terminal Services RemoteApp Using TS RemoteApp. Benefits of TS RemoteApp. ... Terminal Services Web Access Using TS Web Access we Benefits of TS Web Access......... Terminal Services Gateway .. Implementing TS Gateway. Benefits of TS Gateway. Terminal Services Licensing .. Other Terminal Services Enhancements Terminal Services WMI Provider. ... ‘Windows System Resource Manager. Terminal Services Session Broker Conclusion... Additional ResourcesTable of Contents ix 9 Clustering Enhancements . Failover Clustering Enhancements ... Goals of Clustering Improverents........ Understanding the New Quorum Model. Understanding Storage Enhancements Understanding Networking and Security Enhancements. Other Security Improvements. . Validating a Clustering Solution : Tips for Validating Clustering Solutions. Setting Up and Managing a Cluster. Creating a Highly Available File Server . Performing Other Cluster Management Tasks . Network Load Balancing Enhancements... Conclusion Additional Resources . 10 Network Access Protection . . The Need for Network Access Protection. . Understanding Network Access Protection . ‘What NAP Does. ; NAP Enforcement Methods. Understanding the NAP Architecture . ‘A Walkthrough of How NAP Works Implementing NAP. Choosing Enforcement Methods Phased Implementation . Configuring the Network Policy Server. Configuring NAP Clients Troubleshooting NAP Conclusion Additional Resources .Table of Contents 11 Internet Information Services 7.0....... Understanding IIS 7.0 Enhancements Security and Patching ‘Administration Tools. Configuration and Deployment Diagnostics. Extensibility ... ee ‘What's New in IIS 7.0 in Windows Server 2008 ..........++ ‘The Application Server Role .. Conclusion Additional Resources 12 Other Features and Enhancements Storage Improvements. ... File Server Role Windows Server Backup . Storage Explorer ... SMB 20... Multipath 1/0 iSCSI Initiator....... iSCSI Remote Boot .. ISNS Server........ Networking Improvements. Security Improvements Other Improvements Conclusion... Additional Resources . 13 Deploying Windows Server 2008 Getting Windows Server 2008 Installing Windows Server 2008. Manual Installation. . Unattended InstallationTable of Contents xi Using Windows Deployment Services. = 423 Multicast Deployment 424 TETP Windowing. .. 427 EFI 64 Network Boot Support... sescsssss sees - 430 Solution Accelerator for Windows Serve Deployment... eevee BL Understanding Volume Activation 2.0... = 432 Conclusion - 439 Additional Resources ..... 14 Additional Resources . Product Home Page .. Microsoft Windows Server TechCenter Microsoft Download Center ........ Microsoft Connect... Microsoft TechNet. Beta Central .......sceeee TechNet Events. ..........+ TechNet Virtual Labs. TechNet Community Resources TechNet Columns... 451 TechNet Magazine. ... - ASL TechNet Flash Newsletter. . - 451 MSON . - 451 Blogs ..... = 452 Blogs by MVPs . 453 Channel 9 - 454 Microsoft Press Books. 434 Conclusion .. = 455 INdeX... cece e cece e ee ee eee eee eteeeee eee eeeecee ABT ‘What do you think of this book? We want to hear from you! rOsoft is interested in hearing your feedback so we can continually improve our books and learning urces for you. To participate ina b eerChapter 1 Introduction Well, you've made it past the table of contents and have arrived at the Introduction, so I guess better start introducing this book to you and explaining what it’s about. Thisis the first book about Microsoft Windows Server 2008 published by Microsoft Press, and let me be straight with you right from the beginning. What? A book about Windows Server 2008 is being pub- lished when the product is only in Beta 3? Won't it have inaccuracies? (Sure.) Aren't features still subject to change? (Yup.) Doesn't that malee this a “throwaway” book? (Not on your life, you'll se.) And why would Microsoft Press publish a book about a product that's not even finished yet? ‘The short answer to that final question is that Microsoft Press has always done this sort of thing, Remember Introducing Windows Vista by William Stanek? Or Introducing Microsoft Windows Server 2003 by Jerry Honeycutt? Or Introducing Microsoft NET by David S. Platt? See? I told you. Why does Microsoft Press do this? To get you excited about what’s coming down the product pipeline from Microsoft. To help you become familiar with new products while theyre still in the development stage. And, of course, to get you ready to buy other books from them once the final version of the product is released. After all, you know what it's like. You have a business and have to make money-so do they. But isn'ta book that's based on a pre-release version (in this case, close to Beta 3) going to be full of inaccuracies and not reflect the final feature lineup in the RTM version of the product? Well, not realy, for several reasons, Fist, 've had the pleasure (sometimes the intense plea- sure) of interacting daily with dozens of individuals on the Windows Server 2008 product team at Microsoft during the course of writing this book. And they've been generous (some- times too generous) in supplying me with insights, specifications, pre-release documentation, and answers to my many, many questions—the answers to some of which Iwas actually able to understand (sometimes). I's been quite an experience interacting with the product team like this; they're proud of the features they're developing and they have good reason to be. And all this interaction with the product group should mean that alot of technical errors and inaccuracies will have been avoided for many descriptions of features in this book. In addition, the product team has generously given their time (occasionally after repeated, badgering e-mails on my part) to review my chapters in draft and to make comments and sug. gestions (sometimes lot of suggestions). This, too, should result in alot of technical galls being weeded out. To understand what it means for these individuals to have given their time like this to poring over my chapter drafts, you've got to understand something about the stress of developing a product like Windows Server 2008 and getting it out the door as bug-Introducing Windows Server 2008 free as possible and into customers’ hands while working under heavy time constraints, After all, the market won't stand stil if product like Windows Server 2008 is delayed. There are competitors—we won't mention their names here, but they're out there and you know about them, ‘Another reason this book has a high degree of technical accuracy (especially fora prerelease title) is because a lot of its actually written by the product team themselves! You'll find scat- tered throughout most of the chapters almost a hundred sidebars (95 at last count) whose titles are prefixed “From the Experts.” These sidebars are a unique feature of this book (and. especially for a pre-release book), and they provide valuable “under the hood!” insights con- cerning how different Windows Server 2008 features work, recommendations and best prac- tices for deploying and configuring features, and tips on troubleshooting features. These sidebars range from a couple of paragraphs to several pages in length, and most of them were written by members of the Windows Server 2008 product team at Microsoft. A few were writ ten by members of other teams at Microsoft, while a couple were contributed by contractors and vendors who work closely with Microsoft. And more than anything else, the depth of expertise provided by these sidebars makes this book a “keeper” instead of a “throwaway,” as ‘most preselease books usually are, Tl get you alist ofall the names ofthese sidebar writers in a minute to acknowledge them, but ‘maybe I better show you what a sidebar actually looks like if you've never seen one before (or if you've seen them in other titles but didn’t know what they were called). Here's an example ofa sidebar: From the Experts: Important Disclaimer! ‘The contents ofthis book are based on a pre-release version of Windows Server 2008 and are subject to change. The new features and enhancements described in the chapters that follow might get pulled at the last minute, modified (especially the GUI), tweaked, twisted, altered, adjusted, amended~press Shift#F7 im Microsoft Office Word for more. Nothing written here is written in stone, and the product group (and myself) have tried not to promise anything or describe features that might not make it into RTM. So while ‘we've made our best effort to ensure this book is a technically accurate description of Windows Server 2008 atthe Beta 3 milestone (and hopefully well beyond), we disclaim and deny and renounce and repudiate and whatever (Shift+F7 again) any and all respon- sibility for anything in this book that is no longer accurate once the final release of Win- dows Server 2008 occurs. Thanks for understanding, Mitch Tulloch with the Windows Server Team at Microsoft ‘That's what a sidebar looks like. Sure hope you've read itChapter 1 Introduction 3 ‘And having a disclaimer like that shouldn’t be a problem, right? For example, ifthe UL changes for some feature between now and RTM, that shouldn't decrease the technical value ofthis book much, should it? After ll, you're IT pros, so you're pretty smart and can figure out 4 Ul, right? And ifa feature has to be dropped at the last minute or changed to make it meet some emerging standard, interoperate better with products from other vendors, or simply to ensure the highest possible stability ofthe final product, you'l understand, won't you? I mean, you're IT pros, so you know all about how the software development process works, right? ‘Thanks for cutting us some slack on this. I'm sure you won't be disappointed by what you find between these covers. And whatever flaws or errors o gaps you do happen to find, feel free to fill them in yourself with extra reading and hands-on experimenting with the product. You have the power-you'e IT pros, You rock. You rule. What's Between the Sheets | guess I should have said “what's between the covers,” but sheets are pages, right? Lame attempt at humor there, but | guess you want to know what I'm going to be covering in this, book. Well, I could start talking about the “three pillars of Windows Server 2008,” which are (Warning! The Marketing Police insist on Init Caps here!) More Control, Increased Protection, and Greater Flexibility. But if started talking like that you'd probably clap your hands tightly over your ears and start shouting, “Augh! Marketing Muff! Shut it off Shut it off” and run away screaming madly to the server room. now that’s not being fair to those who work in marketing (poor souls), but we all need to pick on somebody sometimes, don’t we? And since you are an IT pro (the target audience of this book), what you want is technical *meat,” not marketing “luff"and that’s exactly what ‘we (myself together with the product team at Microsoft) have tried to bring you. So instead of talking about “pillars,” we're going to focus on “features” and “enhancements” (changes to fea- tures found on previous Windows Server platforms) so that you can derive the utmost benefit from reading this book. Windows Server 2008 has a lot of new features and a ton of enhancements to existing ones. Unfortunately, in a book this size (there’sno point writing a 1500-page book about pre-release software) this means some features have to get more prominence than others. So some fea- tures and enhancements have their own separate chapters, while others get unceremoniously lumped together for coverage. Don't read more into this than is intended, however, as some features simply interest me more than others and some are closer to being finished at the time of writing this than others. Features closer to being finished generally have more internal doc- ‘umentation (the raw source material for much ofthis book) available and that documentation {s usually in nearfinished condition.4 Introducing Windows Server 2008 “Anyway, for personal reasons or otherwise, the following new features and enhancements have been chosen by me (and me alone) to be showcased within their own separate chapters: The Windows server core installation option of Windows Server 2008 New and improved server management tools Identity and Access (IDA) enhancements to Active Directory (Clustering enhancements Terminal Services enhancements Network Access Protection (NAP) Internet Information Services 70 & Deployment tools ‘These features all got their own chapters, while most everything else has been lumped. together into Chapter 12, “Other Features and Enhancements"not because they're any less important, but simply for reasons of my personal interest in things, limited time and resources, and convenience. Talso talk briefly in Chapter 2, “Usage Scenarios” about why you will (the Marketing Police insisted on my using italics there) want to deploy Windows Server 2008 in your enterprise Thus, Chapter 2 will briefly talk about various scenarios where the new features and enhance- ‘ments found in Windows Server 2008 can bring your enterprise tangible benefits. So there's abit of marketing content in that chapter, but i's important for reasons of planning and design. Otherwise, the rest of the book is pure geek stuf Acknowledgments Anyway, before l jump in and start describing all the new features and enhancements found in Windows Server 2008, I'd first like to say “Hats off” to all those working inside Microsoft and others who contributed their valuable time and expertise. Their efforts in writing sidebars for this book, reviewing chapters in their draft form, answering questions, and providing me with access to internal documentation and specifications made this book the quality technical resource that I'm sure you'l find it to be. In fact, let me acknowledge them by name now. I'll omit their titles, as these can be found in the credits at the end of each sidebar. I know the compositor (the person who transforms my manuscript into pages) will probably hate this, but I'm going to put everyone's name on a separate line to call them out and recognize them better for their invaluable contribution to this book. Here goes: ‘Aaron J, Smith Ahmed Bisht Ajay Kumar Alain LissoirChapter 1 Alex Baleanquall Amit Date Amith Krishnan ‘Andrew Mason ‘Aruna Somendra Asad Yaqoob ‘Aurash Behbahani Avi Ben-Menahem Bill Staples Brett Hill (Chandra Nukala Chris Edson (Chuck Timon Claudia Lake Craig Liebendorfer Dan Harman David Lowe Dino Chiesa Donovan Follette Eduardo Melo Elden Christensen Emily Langworthy Eric Deily Eric Fitzgerald Eric Holle Eric Woersching, George Menzel Harini Muralidharan Harish Kumar Poongan Shanmugam Isaac Roybal Jason Olson Jeff Woolsey Jeffrey Snover Jez Sadler Joel Sloss Introduction6 Introducing Windows Server 2008 John Morello Kadirvel C. Vanniarajan Kalpesh Patel Kapil ain Kevin London Kevin Rhodes Kevin Sullivan Kurt Friedrich Lu Zhao Mahesh Lotlikar Manish Kalra Marcelo Mas Mike Schutz Mike Wilenzick ‘Moon Majumdar Nick Pierson, Nils Dussart Nisha Vietor Nitin T Bhat (Oded Shekel Paul Mayfield Peter Waxman Piyush Lumba Rahul Prasad Rajiv Arunkundram Reagan Templin Samim Erdogan Samir Jain, Santosh Chandwani Satyajit Nath, Scott Dickens Scott Turnbull Siddhartha Sen Somesh Goel Soo Kuan TeoChapter 1 Introduction 7 Sriram Sampath Suryanarayana Shastri Suzanne Morgan Tad Brockway ‘Thom Robbins Tim Elhaij Tobin Titus Tolga Acar Tom Kelnar Tony Ureche Tres Hill UIFB, Simon-Weidner Vilay Gaijala Wai0 Hui Ward Ralston Yogesh Mehta Zardosht Kasheff Thope I haven't missed anyone in the above list of reviewers, sidebar contributors, and other experts, If have, I'm really sorry—e-mail me and I'll see that you get a free copy of my book! And since we're acknowledging people here, et me also give credit to the editorial staf at Microsoft Press who helped bring this project to fruition. Thank you, Martin DelRe, Karen Szall, and Denise Bankaitis for your advice, patience, and prodding to help me get this book ‘completed on time for TechEd ‘07, And thank you, Roger LeBlanc, for your skill and restraint in copyediting my writing and weeding out dangling participles, nested colons, and other {grammatical horrors while maintaining my natural voice and rambling style of writing, Thank you to Waypoint Press for their editorial and production services. And thanks especially to Ingrid, my wife and business partner, who contributed many hours of research gathering and ‘organizing material for this book and helped in many other ways every step of the way. She deserves to have her name on a separate page all by herself, but the compositor would probably choke if tried this, so I'l just give her a whole line to herself, like this: Thank you, Ingrid! One Last Thing—Humor You've probably noticed by now that this chapter is written with a fairly light tone. Afterall, I'ma geek, so my wife usually doesn’t find the jokes I tell to be funny, right? (I'm being ironicIntroducing Windows Server 2008 actually and using “my wife” asa literary device here, but please don’t tell her in case she’s offended by this usage.) (More irony.) OK, so maybe I'm not the most slapstick kind of guy. And why add humor, anyway, to 2 serious book about a serious product developed by a serious company like Microsoft? Well, apart from the fact that Microsoft can poke fun at itself sometimes (search the Internet for the “Microsoft IPod” video and you'll see what I mean), the main reason I've tried to use humor is to better engage you, the reader. Yes, you're an IT pro, a geek, and you read manuals all day long and get your kick out of finding errors in them. Well I am too-my father used to tell me a story about how, when I was in high school, he came down to see me in my room one evening and found me “reading a calculus textbook and chuckling in a superior way” about something I was reading, I can’t remember that particular incident, but I do recall getting a laugh over some of the textbooks I had to read in university. Such is the curse of being a geck. ‘And, hopefully, that describes you as well—because if you're the totally wound.up and straight- laced type, you're probably in the wrong business if you're an IT pro. Software doesn't always do what i’s supposed to do, and it’s usually best just to laugh about it and find a workaround instead of taking it out on the vendor. Anyway, 'm telling you all this just so that you're aware that I'll be adding the occasional joke or giving lighthearted treatment to some of the features and enhancements discussed in this book. In fact, at one point I even thought of trying to add a Dilbert cartoon at the start of each, chapter to set the stage for what I wanted to tell you concerning each feature. Unfortunately, eventually abandoned this plan for three reasons: ‘Reason #1: had to write this book in a hurry so that it could be published in time for TechEd while still being based on builds as near to Beta 3 as possible. So, unfortunately, there was no time to wade through the red tape that Microsoft Legal would probably have required to make this happen. ‘= Reason #2: My project manager didn't have the kind of budget to pay the level of royalties that United Feature Syndicate, Inc., would probably have demanded for doing this kind of thing, Reason #3: Scott Adams probably uses a MacChapter 2 Usage Scenarios In this chapter Providing an Identity and Access Infrastructure.......cssseeeeseereeeeerse dO Ensuring Security and Policy Enforcement Easing Deployment Headaches. Making Servers Easier to Manage. Supporting the Branch Office Providing Centralized Application Access. Deploying Web Applications and Se Ensuring High Availability . Ensuring Secure and Reliable Storage Leveraging Virtualization. Conclusion ......... Before we jump into the technical stuff, le’s pause and make a business case for deploying Microsoft Windows Server 2008 in your organization. Sure, there's a marketing element in doing this, and as a techie you'd rather get to the real stuf right away. However, reality for ‘most IT pros means preparing RFPs for bosses, presenting slide decks showing ROI from planned implementations of products, and generally trying to work within the constraints of ‘a meager budget created by pointy-headed executives who can’t seem to understand how cool technology is and why they need it for their business So let's look briefly at how Windows Server 2008 can benefit your enterprise. I'm assuming you already know a few basic things about the new features and enhancements of the plat- form (otherwise, you wouldn't be going to TechEd ‘07 and similar events where this book is being distributed), but you might also want to give this chapter a reread once you've finished. the rest of the book. This will give you a better idea of what Windows Server 2008 is and what it’s capable of. Anyway, let's ask the sixty-fourdollar questions: Who needs Windows Server 2008? And why do Ineed it? ‘Oh yeah, I forgot: -amarketing jargonaon>10 Introducing Windows Server 2008, Providing an Identity and Access Infrastructure {Av the core of any mid- or large-sized organization are controls—controls concerning who is allowed to access your organization's information resources, how you verify someone's identity, what they're allowed to do, how you enforce controls, and how you keep records for auditing and for increasing efficiency. ‘An umbrella name forall this is Identity and Access Management, or IDA. Organizations need an IDA solution that provides services for managing information about users and computers, ‘making information resources available and controlling access to them, simplifying access using single sign-on, ensuring sensitive business information is adequately protected, and safeguarding your information resources as you communicate and exchange information with customers and business partners. Why is Windows Server 2008 an ideal platform for building your IDA solution? Because it both leverages the basic functionality of Active Directory found in previous Windows Server platforms and inchides new features and enhancements to Active Directory in Windows Server 2008. For example, you can now use Active Directory Domain Services (AD DS) audit- ing to maintain a detailed record of changes made to directory objects that records both the new value of an attribute that was changed and its original value. You can leverage the new support for Online Certificate Status Protocol in Active Directory Certificate Services (AD CS) to streamline the process of managing and distributing revocation status information across your enterprise. You can use several enhancements in Active Directory Rights Management Services (AD RMS) together with RMS-enabled applications to help you safeguard your com- pany’s digital information from unauthorized use more eastly than was possible using RMS on previous Windows Server platforms. And you can use the integrated Active Directory Federation Services (AD FS) role to leverage the industry-supported Web Services (WS) protocols to securely exchange information with business partners and provide a single sign- ‘on (SSO) authentication experience for users and applications over the life of an online Want to find out more about these enhancements? Turn to Chapter 7, “Active Directory Enhancements,” to learn about all this and more, And with Windows Vista on the client side, you have added benefits such as an integrated RMS client, improved smart card ‘support, and better integration with SSO and other Active Directory enhancements in Windows Server 2008. Ensuring Security and Policy Enforcement Do users and computers connecting to your network comply with your company's security policy requirements? Is there any way to enforce that this is indeed the case? Yes, there is. In addition to standard policy enforcement mechanisms such as Group Policy and Active Directory authentication, Windows Server 2008 also includes the new Network Access Protection (NAP) platform. NAP provides a platform that helps ensure that client computersChapter2 Usage Scenarios 11 trying to connect to your network meet administrator-defined requirements for system health aslaid outin your security policy. For example, NAP can ensure that computers connecting to your network to access resources on it have all critical security updates, antivirus software, the latest signature files, a functioning host-based firewall that’s properly configured, and so on. And if NAP determines that 2 client computer doesn’t meet all these health requirements, it ‘can quarantine the computer on an isolated network until remediation can be performed or it can deny access entirely to the network, By using the power of NAP, you can enforce compli- ance with your network health requirements and mitigate the risk of having improperly configured client computers that might have been exposed to worms and other malware. Want to find out more about NAP? Turn to Chapter 10, “Implementing Network Access Protection,” where I have a comprehensive description of the platform and how it’s implemented using Windows Server 2008 together with Windows Vista, ‘And if you really want to enhance the security of your servers, try deploying the Windows server core installation option of Windows Server 2008 instead of the full installation option. ‘The Windows server core installation option has significantly smaller attack surface because all nonessential components and functionality have been removed. Want to learn about this installation option? Turn to Chapter 6, “Windows Server Core,” for a detailed walkthrough of its capabilities and tasks related to its management. ig Deployment Headaches Do you currently use third-party, image-based deployment tools to deploy your Windows servers? I'm not surprised—until Microsoft released the Windows Automated Installation Kit (Windows AIK), you were pretty much limited to either deploying Windows using third-party imaging tools or using Sysprep and answer files. The Windows AIK deploys Windows Vista based on Vista's new componentized, modular architecture and Windows image (.wim) file-based installation media format. Windows Vista and the Windows AIK has changed everything, and now Microsoft has finally come on strong in the deployment tools arena. And with the release of the Microsoft Solution Accelerator for Business Desktop Deployment (BDD) 2007 customers now have a best practice set of comprehensive guidance and tools from Microsoft that they can use to easily deploy Windows Vista and the 2007 Office system across an enterprise. So deploying Windows clients is a snap now, but what about deploying Windows servers? ‘Windows Server 2008 includes huge improvements in this area with its new Windows Deployment Services role, an updated and redesigned version of the Remote Installation Services (RIS) feature found in Windows Server 2003 and Windows 2000 Server. Windows Deployment Services enables enterprises to rapidly deploy Windows operating systems using network-based installation, a process that doesnt require you to be physically present at each. target computer or to install directly from DVD media.2 Introducing Windows Server 2008 And if you liked BDD 2007, you'll like the similar set of guidance and tools that Microsoft is currently developing for deploying Windows Server 2008 machines. This new set of tools and best practices will be called the Solution Accelerator for Windows Server Deployment and it will integrate the capabilites of Windows AIK, ImageX, Windows Deployment Services, and other deployment tools to provide a point-and-click, drag-and-drop deployment experience similar to what you've experienced with BDD 2007 if you've had a chance to play with it already. Deploying systems is « headache sometimes, but managing licensing and activation of these ‘machines can bring on a migraine. Instead of taking two pills and going to bed, however, you'll find that the enhancements made to Volume Activation 2.0 in Windows Server 2008 take the pain away. This improved feature will also help you sleep at night, knowing that your ‘machines are in compliance with licensing requirements, Want to read more about all these improvements? Crack open Chapter 13, “Deploying ‘Windows Server 2008,” and youl find everything you need to get you started in this area g Servers Easier to Manage Tusually don’t gt excited about tools—they're designed to get the job done and nothing ‘more. Sure, some people might buy a new compound miter saw, show itto all their neighbors, and go “Ook, ab.” Not me—maybe it's because I'm a geek and I get excited about quad-core processors instead! Sil, you've gotta love tools when they make life easier, and Windows Server 2008 includes a slate of new and improved tools for managing Windows Server 2008 machines throughout your enterprise. ‘There's Server Manager, an integrated MMC console that provides a single source for ‘managing your server's roles and features and for monitoring your server's status. Server ‘Manager even comes in a commanc:-line version called Server ManagerCmd.exe, which you can use to quickly add role services and features or perform “what if” scenarios such as, “What components would get installed if I added the Web Server role on my system?” Then there's Windows PowerShell, a commantline shell and scripting language that includes ‘more than 130 cmdlets, plus an intuitive scripting language specifically designed for IT pros like you. As of the Beta 3 release of Windows Server 2008, PowerShell is now included as an optional component you can install. PowerShell is a powerful tool for performing administra- tion tasks on Windows Server 2008, such as managing services, processes, and storage. And PowerShell can also be used to manage aspects of certain server roles such as Internet Information Services (IIS) 70, Terminal Services, and Active Directory Domain Services. ‘Then there's the Windows Remote Shell (WinRS) and Windows Remote Management (WinRM) components first included in Windows Vista; enhancements to Windows ‘Management Instrumentation (WMD), also introduced in Windows Vista; improvernents inChapter2 Usage Scenarios 13 how Group Policy works, including both changes in Windows Vista and in Windows Server 2008; and more. Where can you learn more about these different tools? Try Chapter 4, “Managing Windows Server 2008” for a start. Then turn to Chapter 6 and to Chapter 11, “Internet Information Services 7.0,” for more examples of seeing these tools at work. Managing your Windows serv- cers has never been easier than using what the Windows Server 2008 platform provides for you to do this, Supporting the Branch Office Iewould be nice fall your servers were set up in a single location so that you could keep an eye on them, wouldn't it? Unfortunately, today’s enterprise often consists of a corporate head- quarters and a bunch of remote branch offices, sometimes scattered all around the globe. What's worse, you might be the main IT person stuck there at headquarters, while people who don’t know a router from a switch have hands-on physical access to your servers, which just happen to be located out there in remote sites instead of being safe under your watchful eye. What can you do to maintain control? “My precioussss! gollum..” ‘Windows Server 2008 has several technologies that help you keep control and be Lord of the Servers in your enterprise. Read-Only Domain Controllers (RODCs) are a new type of domain controller that hosts a read-only replica of your Active Directory database. If you combine RODCs with the BitLocker Drive Encryption feature first introduced in Windows Vista, you no longer have to worry about thieves (or silly employees) walking off with one of your domain controllers and all your goodies. Restartable Active Directory Domain Services lets you stop Active Directory services on your domain controllers so that updates can be applied or offline defragmentation of the database can be performed, and it can do this without requiring you to reboot your machine, This is a big improvement that not only reduces down- time, but makes your domain controllers easier to manage, which is a plus when they're located ata remote site. Other improvements~such as delegation improvements, the new SMB 2.0 protocol, and the enhanced DFSR introduced in Windows Server 2003 R2-help make Windows Server 2008 an ideal platform for domain controllers that need to be located. at branch offices, ‘Want to find out more about these improvements? Chapter 7 covers RODC and Restartable AD DS, while various other improvements can be found in Chapter 12, “Other Features and Enhancements.” Providing Centralized Application Access Mobile users can be a pain to support. Although virtual private network (VPN) technologies have made remote access simpler, giving remote users full access to your internal network from over the Internet is often not the best solution. With the improvements to Terminal“ Deploying Web Applica’ Introducing Windows Server 2008 Services in Windows Server 2008, however, users (both remote and on the network) can securely access business applications running on your Terminal Servers and have the same kind of experience as if these applications were installed locally on their machines Terminal Services Gateway (TS Gateway) lets remote users securely punch through your perimeter firewall and access Terminal Servers running on your corpnet. Terminal Services RemoteApp enables remoting of individual application windows instead of the whole desktop so that an application that is actually running on a Terminal Server looks and feels to the user as if it were running on her own desktop. And Terminal Services Web Access makes applica tion deployment a snap—the user visits a Web site, clicks on a link or icon, and launches an application on a Terminal Server located somewhere in a galaxy fa, far away. Interested in learning more about these new features and enhancements to Terminal Services in Windows Server 2008? Flip to Chapter 8, “Terminal Services Enhancements,” and you'll find a ton of information on the subject. ns and Services Does your organization rely on providing Web applications and Web services to customers? Is the Web a way of life for your business? The new features and enhancements found in Internet Information Services 7.0 are going to excite you if that’s the case. Hosting companies will benefit from xcopy deployment, which copies both a site's content and its configuration to the Web server in one single action. The new modular architecture of US 7.0 will make a difference in datacenters because it enables you to deploy Web servers that have a low footprint and minimal attack surface. Enterprises that build B2B and B2C solutions that rely on the NET Framework 3,0 can use the Application Server role of Windows Server 2008 to leverage industry-standard Web Services (WS) protocols for building these solutions on top of IIS 7.0. And Windows System Resource Manager and other components can help you make efficient use of your hardware resources and ensure a consistent end-user experience. Want to learn more about IIS 7.0 and the Application Server role? Turn to Chapter 11 for a whirlwind tour of these topics. Ensuring High Availability 1 get miffed when I try to buy a book online from some bookstore and have to wait more than five seconds for the check-out page to appear, or ifthe site temporarily seems to go down. ‘What's wrong with these guys? Don't they understand high availability? What, are they running their entire store on a single box? Don't they know single point of failure?Chapter2 Usage Scenarios 15 ‘Whatever applications are critical to the operation of your business, you need to use some form of clustering to make sure they never go down or become inaccessible to customers. ‘Windows Server 2008 includes two enhancements in the area of high availability. First, server clusters (now called failover clusters) have been significantly improved to make them simple to set up and configure, easier to manage, more secure, and more stable. Improvements have been made in the way the cluster communicates with storage, which can increase perfor- ‘mance for both storage area network (SAN) and direct attached storage (DAS). Failover clusters also offer new configuration options that can eliminate the quorum resource from being a single point of failure. Network Load Balancing (NLB) has also been improved in Windows Server 2008 to include support for IPV6 and the NDIS 6.0 specification. And the WMI provider has been enhanced. with new functionality to make NLB solutions more manageable. Has this piqued your interest? Check out Chapter ‘out more. “Clustering Enhancements,” and find Ensuring Secure and Reliable Storage used to think file servers were boring until I earned about the new storage features and enhancements in Windows Server 2008. Not any more. The Share And Storage Management snap-in provided by the File Server role makes managing volumes and shares easier than ever before with its two new wizards. The Provision Storage Wizard provides an integrated storage provisioning experience for performing tasks like creating a new LUN, specifying the LUN type, unmasking a LUN, and creating and formatting a volume. The wizard also supports multiple protocols—including Fibre Channel, SCSI, and SAS—and it requires only a VDS 1.1 hardware provider. The Provision A Shared Folder Wizard provides an integrated file-share provisioning experience that lets you easily configure permissions, quotas, fle screens, and other settings for SMB shares, and it supports NFS shares also, Then there's Storage Explorer, a new MMC snap-in that provides a tree-structured view of detailed information concerning all the components of your Fibre Channel or iSCSI SAN, including Fabrics, Platforms, Storage Devices, and LUNs. And it provides integrated support for Microsoft Multipath 10 (MPIO), which enables software and hardware vendors to develop ‘multipathing solutions that work effectively with solutions built using Windows Server 2008 and vendor-supplied storage hardware devices. And the builtin iSCSI Initiator lets you contig. ‘ure target iSCSI storage device, plug your server and storage device into a Gigabit Ethernet switch, andpresto!-you've now got high-speed block storage over IP. And there's SCSI Boot, which lets you install Windows Server 2008 directly to an iSCSI volume on a SAN. The enhanced Windows Server Backup uses the same block-level, image-based (.vhd) backup technology that is used by the CompletePC Backup And Recovery feature of Windows Vista, How's all that for your lowly, much-maligned file server? Find out more about storage improvements and lots more in Chapter 1216 —_ Introducing Windows Server 2008 Leveraging Virtualization Last but not least (infact, so not least that well be covering this topic n our very next chapter), there's Windows Server Virtualization, which will change (once it’s released after ‘Windows Server 2008 is released) the entire architecture of Windows servers in fundamental ways. And even though Windows Server Virtualization is still in an early stage of development at the time of writing this book, IT pros like you already know the power virtualization tech- nologies have to affect today's enterprises through server consolidation, business continuity ‘management, development and testing environments, application compatibility, and datacenter workload decoupling. I won't go into more details about Windows Server Virtualization here—turn to Chapter 3, “Windows Server Virtualization,” and get a preview. Conclusion ‘marketing jargomorr> ‘Whew, that’s relief That's not the hat I usually wear, because I'ma geek and nota hawker of wares and potions. I'm glad that’s over with because now we can get to the technical stuff that we IT pros love to talk about. But, in point of fact, I respect the marketing professionals for what they have to do. I they don't get the news out there about Windows Server 2008, who's going to buy it? And if people don’t buy it, how can Microsoft stay in business? And if Microsoft goes out of business, how can I write about their products, make money, and feed iy family? ‘Anyway, now that ll that's out of the way, lets dig into the technical stuff and get down and geeky.Chapter 3 Windows Server Virtualization In this chapter Why Enterprises Love Virtualization. .........esscseesesessssesensessers Virtualization Today . Understanding Virtualization in Windows Server 2008 Features of Windows Server Virtualization. Managing Virtual Machines in Windows Server 2008 System Center Virtual Machine Manager 2007 Now that we've examined some possible usage scenarios for Microsoft Windows Server 2008, its time to start digging deep into the features of the platform. But there are a lot of new features and enhancements in Windows Server 2008-why begin with virtualization? (Customer facing answer? Need. ‘Technical answer for us IT pros? Architecture. Why Enterprises Love Virtualization Virtualization has been around in computing since the mainframe days of the late ‘60s ‘Those of us who are old enough to remember punch cards (carrying boxes of them around ‘was a great way of getting exercise) might remember the IBM 360 mainframe system and the CP/CMS time-sharing operating system, which simulated the effect of each user having a full, standalone IBM mainframe at their fingertips. Each user's “virtual machine” was fully inde- pendent of those belonging to other users, so ifyou ran an application that crashed “your” machine, other users weren’t affected. PCs changed this paradigm in the '80s, and eventually gave users’ physical machines that today are far more powerful than the mainframes of the ’60s and ‘70s, But as desktop PCs began to proliferate, so did servers in the back rooms of most businesses, Soon you'd have two domain controllers, 2 mail server running Microsoft Exchange, a couple of file servers, a database server, a Web server for your intranet, and so on. Larger companies might have 718 Introducing Windows Server 2008 dozens or even hundreds of servers, some running multiple roles such as AD, DNS, DHCP, ‘Managing all these separate boxes can be a headache, and restoring them from backup after a disaster can involve costly downtime for your business. But even worse from a business stand- point is that many of them are underutilized. How does virtualization for x86/x64 platforms solve these issues? Server Consolidation Ina production environment, having a server that averages only 5 percent CPU utilization doesn't make sense. A typical example would be a DHCP server in an enterprise environment that leases adciresses to several thousand clients. One solution to such underutilization is to consolidate several roles on one box. For example, instead of just using the box as a DHCP server, you could also use it as @ DNS server, file server, and print server. The problem is that as more roles are installed on a box, the uncertainty in their peak usage requirements increases, making it difficult to ensure that the machine doesn’t become a bottleneck. In addli- tion, the attack surface of the machine increases because more ports have to be open so that it can listen for client requests forall these services, Patching also becomes more complicated when updates for one of the running service need to be appliedif the update causes a sec- ondary issue, several essential network services could go down instead of one. Using virtualization, however, you can consolidate multiple server roles as separate virtual ‘machines running on a single physical machine. This approach lets you reduce “server sprawi" and maximize the utilization of your current hardware, and each role can run in its own isolated virtual environment for greater security and easier management. And by consol- idating multiple (possibly dozens of) virtual machines onto enterprise-class server hardware that has faultolerant RAID hardware and hot-swappable components, you can reduce down- time and make the most efficient use of your hardware. The process of migrating server roles from separate physical boxes onto virtual machines is known as server consolidation, and this 1s probably the number one driver behind the growing popularity of virtualization in enterprise environments, After all, budgets are limited nowadays! Business Continuity Being able to ensure business continuity in the event ofa disaster is another big driver toward virtualization, Restoring a critical server role from tape backup when one of your boxes starts, emitting smoke can be a long and painful process, especially when your CFO is standing over you wringing his hands waiting for you to finish. Having hot-spare servers waiting in the closet {s, of course, a great solution, but it costs money, both in terms of the extra hardware and the licensing costs.Chapter 3 Windows Server Virtualization 19 That's another reason why virtualization is so compelling, Because guest operating systems, ‘which run inside virtual machines (VMs), are generally independent of the hardware on ‘which the host operating system runs, you can easily restore a backed-up virtual server to a system that has different hardware than the original system that died. And using virtual ‘machines, you can reduce both scheduled and unscheduled downtime by simplifying the restore process to ensure the availabilty of essential services for your network. Tes' g and Development IT pros like us are always in learn mode because of the steady flow (or flood) of new technologies arriving on our doorstep. I remember when I had to set up a test network to evaluate Exchange 5.5. had eight boxes sitting on a bench just so I could try out the various features of the new messaging platform. These included an Exchange 5.0 server, an Exchange 4.0 server, and an MS Mail 3.0 server so that I could test migration from these platforms. Plus I had several different clients running on different boxes. The heat alone from these systems could have kept me warm during a Winnipeg winter. Testing new platforms is 2 lot easier today because of virtualization. I can run a half dozen virtual machines easily on a single low-end server, and I can even set up a routed network without having to learn 1OS by enabling IP routing on a virtual Microsoft Windows XP ‘machine with two virtual NICs. Architects can benefit from virtualization by being able to cre- ate virtual test networks on a single server that mimic closely the complexity of large enter- prise environments. Developers benefit too by being able to test their applications in isolated environments, where they can roll back their virtual machines when needed instead of having to install everything from scratch, The whole IT life cycle becomes easier to manage because virtualization reduces the time it takes to move new software from a development. environment to test and then production. Application Compatibility ‘Another popular use of virtualization today is to ensure application compatibility. Suppose you upgrade the version of Windows you have running on your desktop and find that a crit: cal LOB application won't run properly on the new version. You can try several ways to resolve this problem. You can run the program in application compatibility mode, using the Application Compatibility Toolkit to shim the application so that it works on the new plat- form, Or you can contact the vendor for an updated version of the application. Another alter- native, however, is virtualization: install Microsoft Virtual PC 2007 on each desktop computer where the user needs to use the problem application, install the old version of Windows as a guest OS, and then run the application from there. Virtualization in the Datacenter Virtualization also has a special place in the datacenter, asit lets you decouple workloads from hardware to make the best use of your resources. You can rapidly provision workloads as they20 Introducing Windows Server 2008 are needed so that your solutions can both scale up and scale out easily. Virtualization also simplifies automating complex solutions, though current virtualization products are limited, {in this regard. But that’s where Windows Server 2008 comes in. Virtualization Today Virtualization today on Windows platforms basically takes one of two forms: Type 2 or Hybrid. A typical example of Type 2 virtualization is the Java virtual machine, while another example is the common language runtime (CLR) of the NET Framework. In both examples, you start with the host operating system-that is, the operating system installed directly onto the physical hardware. On top of the host OS runs a Virtual Machine Monitor (VMM), whose role is to create and manage virtual machines, dole out resources to these machines, and keep these machines isolated from each other. In other words, the VMM is the virtualization layer in this scenario, Then on top of the VMM you have the guests that are running, which in this case are Java or NET applications. Figure 3-1 shows this arrangement, and because the guests have to access the hardware by going through both the VMM and the host OS, performance is generally not at its best in this scenario. Figure 3-1 Architecture of Type 2 VMM More familiar probably to most IT pros is the Hybrid form of virtualization shown in Figure 3-2. Here both the host OS and the VMM essentially run directly on the hardware (though with different levels of access to different hardware components), whereas the guest (OSs run on top of the virtualization layer. Well, that's not exactly what's happening here. A ‘more accurate depiction of things is that the VMM in this configuration still must go through the host OS to access hardware. However, the host OS and VMM are both running in kernel, mode and so they are essentially playing tug o' war with the CPU. The host gets CPU cycles ‘when itneeds them in the host context and then passes cycles back to the VMM and the MM services then provide cycles to the guest OSs. And so it goes, back and forth. The reason why the Hybrid model is faster is that the VMM is running in kernel mode as opposed to the ‘Type 2 model where the VMM generally runs in User mode. ‘Anyway, the Hybrid VMM approach is used today in two popular virtualization solutions from Microsoft, namely Microsoft Virtual PC 2007 and Microsoft Virtual Server 2005 R2.CChapter3. Windows Server Virtualization 22 ‘The performance of Hybrid VMM is better than that of Type 2 VMM, but it’ still not as good as having separate physical machines. Figure 3-2 Architecture of Hybrid VMM Note Another way of distinguishing between Type 2 and Hybrid VMMs is that Type 2 \VMMs are process virtual machines because they isolate pracesses (services or applications) as separate guests on the physical system, while Hybrid VMMs are system virtual machines because they isolate entire operating systems, such as Windows or Linux, as separate quests. A third ype of virtualization technology available today is Type 1 VMM, or hypervisor technology. A hypervisor isa layer of software that sits just above the hardware and beneath, ‘one or more operating systems. Its primary purpose is to provide isolated execution environ- ‘ments, called partitions, within which virtual machines containing guest OSs can run. Each partition is provided with its own set of hardware resources~such as memory, CPU cycles, and devices—and the hypervisor is responsible for controlling and arbitrating access to the underlying hardware Figure 33 shows simple form of Type 1 VMM in which the VMM (the hypervisor) is running directly on the bare metal (the underlying hardware) and several guest OSs are running on top of the VMM. Figure 3-3 Architecture of Type 1 VMM Going forward, hypervisor-based virtualization has the greatest performance potential, and in a moment we'll see how this will be implemented in Windows Server 2008. But first let's Compare two variations of Type | VMM: monolithic and microkernelized.22 Introducing Windows Server 2008 Monolithic Hypervisor In the monolithic model, the hypervisor has its own drivers for accessing the hardware beneath it (See Figure 3-4.) Guest OSs run in VMs on top of the hypervisor, and when a guest needs to access hardware it does so through the hypervisor and its driver model. Typically, one of these guest OSs is the administrator or console OS within which you run the tools that provision, manage, and monitor all guest OSs running on the system. Figure 3-4 Monolithic hypervisor ‘The monolithic hypervisor model provides excellent performance, but it can have weaknesses {in the areas of security and stability. This is because this model inherently has a greater attack surface and much greater potential for security concerns due to the fact that drivers (and even sometimes third-party code) runs in this very sensitive area. For example, if malware were downloaded onto the system, it could instal a keystroke logger masquerading as a device river in the hypervisor. If this happened, every guest OS running on the system would be compromised, which obviously isn't good. Even worse, once you've been “hyperjacked” there’s no way the operating systems running above can tell because the hypervisor is invisible to the OSs above and can be lied to by the hypervisor! The other problem is stablity—if a driver were updated in the hypervisor and the new driver had a bug init, the whole system would be affected, including all its virtual machines. Driver stability is thus a critical issue for this model, and introducing any third-party code has the potential to cause problems. And given the evolving nature of server hardware, the frequent need for new and updated drivers increases the chances of something bad happening, You can think of the monolithic model as a“fat hypervisor” model because ofall the drivers the hypervisor needs to support. Microkernelized Hypervisor Now contrast the monolithic approach just mentioned with the microkernelized model (See Figure 3-5.) Here you have a truly “thin” hypervisor that has no drivers running within it. Yes, that's right-the hypervisor has no drivers at ll. Instead, drivers are run in each partitionChapter3. Windows Server Virtualization 23. so that each guest OS running within a virtual machine can access the hardware through the hypervisor. This arrangement makes each virtual machine a completely separate partition for greater security and reliability. Figure 3-5 Microkernelized hypervisor In the microkernelized model, which is used in Windows Server virtualization in Windows Server 2008, one VM is the parent partition while the others are child partitions. A partition is the basic unit of isolation supported by the hypervisor. A partition is made up of a physical address space together with one or more virtual processors, and you can assign specific hardware resources—such as CPU cycles, memory and devices—to the partition, The parent partition isthe partition that creates and manages the child partitions, and it contains a virtual- ization stack that is used to control these child partitions. The parent partition is generally also the root partition because iis the partition that is created first and owns all resources not owned by the hypervisor. And being the default owner ofall hardware resources means the root partition (that is, the parent) is also in charge of power management, plug and play, ‘managing hardware failure events, and even loading and booting the hypervisor. Within the parent partition isthe virtualization stack, a collection of software components that work in conjunction with and sit on top of the hypervisor and that work together to sup- port the virtual machines running on the system. The virtualization stack talks with the hypervisor and performs any virtualization functions not directory supplied by the hypervi- sor. Most of these functions are centered around the creation and management of child partitions and the resources (CPU, memory, and devices) they need. ‘The virualization stack also exposes a management interface, which in Windows Server 2008 isa WMI provider whose APIs will be made publicly known. This means that not only will the tools for managing virtual machines running on Windows Server 2008 use these APIs, but third-party system management vendors will also be able to code new tools for managing, configuring, and monitoring VMs running on Windows Server 2008. The advantage of the microkernelized approach used by Windows Server virtualization over the monolithic approach is that the drivers needed between the parent partition and the physical server don't require any changes to the driver model. In other words, existing drivers Just work. Microsoft chose this route because requiring new drivers would have been a24 Q) Introducing Windows Server 2008 showstopper: And as for the guest OSs, Microsoft will provide the necessary facilites so that these OSs just work either through emulation or through new synthetic devices. (On the other hand, one could argue that the microkernelized approach does suffer a slight performance hit compared with the monolithic model. However, security is paramount now- days, so sacrificing a percentage point or two of performance for a reduced attack surface and greater stability is a no-brainer in most enterprises. Tip What’ the difference between a virtual machine and a partition? Think of a virtual machine as comprising a parition together with its state Understanding Virtualization in Windows Server 2008 Before I get you too excited, however, you need to know that what I'm going to describe now {is not yet present in Windows Server 2008 Beta 3, the platform that this book covers. I's coming soon, however. Within 180 days of the release of Windows Server 2008, you should be able to download and install the bits for Windows Server virtualization that will make possible everything that I've talked about in the previous section and am going to describe rnow. In fact, if you're in a hotel after a long day at TechEd and you're reading this book for relaxation (that is, you're atypical geek), you can probably already download tools for your current prerelease build of Windows Server 2008 that might let you test some of these Win- dows Server virtualization technologies by creating and managing virtual machines on your latest Windows Server 2008 build 1 said might let you test these new technologies. Why? First, Windows Server virtualization is an x64 Editions technology only and can't be installed on x86 builds of Windows Server 2008. Second, it requires hardware processors with hardware-assisted virtualization support, which currently includes AMD-V and Intel VT processors only. These extensions are needed because the hypervisor runs out of context (effectively in ring 1), which means that the code and data forthe hypervisor are not mapped into the address space of the guest. Asa result, the hypervisor has to rely on the processor to support various intercepts, which are provided by these extensions. And finally, for security reasons it requires processor support for hardware- enabled Data Execution Prevention (DEP), which Intel describes as XD (eXecute Disable) and AMD describes as NX (No eXecute). So if you have suitable hardware and lots of memory, you should be able to start testing Windows Server virtualization as it becomes available in prere- lease form for Windows Server 2008. Let's dig deeper into the architecture of Windows Server virtualization running on ‘Windows Server 2008, Remember, what we're looking at won't be available until after ‘Windows Server 2008 RTMs-~today in Beta 3, there is no hypervisor in Windows Server 2008, and the operating system basically runs on top of the metal the same way Windows Server 2003 does. So we're temporarily time-shifting into the future here, and assuming that whenChapter3. Windows Server Virtualization 25 we try and add the Windows Virtualization role to our current Windows Server 2008 build that it actually does something! Figure 3-6 shows the big picture of what the architecture of Windows Server 2008 looks like with the virtualization bits installed. maT — 2 ee Figure 3-6 Detailed architecture of Windows Server virtualization Partition 1: Parent Let’s unpack this diagram one piece ata time. First, note that we've got one parent partition (at the left) together with three child partitions, all running on top of the Windows hypervi- sor. In the parent partition, running in kernel mode, there must be a guest OS, which must bbe Windows Server 2008 but can be either a full installation of Windows Server 2008 or a Windows server core installation, Being able to run a Windows server core installation in the parent partition is significant because it means we can minimize the footprint and attack surface of our system when we use it as a platform for hosting virtual machines. Running within the guest OS is the Virtualization Service Provider (VSP), a “server” component that runs within the parent partition (or any other partition that owns hardware). The VSP talks to the device drivers and acts as a kind of multiplexer, offering hardware ser- vices to whoever requests them (for example, in response to 1/O requests). The VSP can pass consuch requests either directly toa physical device through a driver running, in kernel or user ‘mode, or to a native service such as the file system to handle. ‘The VSP plays a key role in how device virtualization works, Previous Microsoft virtualization solutions such as Virtual PC and Virtual Server use emulation to enable guest OSs to access hardware. Virtual PC, for example, emulates a 1997-era motherboard, video card, network26 Introducing Windows Server 2008 card, and storage for its guest 05s, This is done for compatibility reasons to allow the greatest possible number of different guest OSs to run within VMs on Virtual PC. (Something like over 1,000 different operating systems and versions can run as guests on Virtual PC.) Device emu- lation is great for compatibility purposes, but generally speaking it’s lousy for performance. SPs avoid the emulation problem, however, as we'll see in a moment, Inthe user-mode portion of the parent partition are the Virtual Machine Service (VM Service), which provides facilities to manage virtual machines and their worker processes; a Virtual Machine Worker Process, which is a process within the virtualization stack that represents and services a specific virtual machine running on the system (there is one VM Worker Process for each VM running on the system); and a WMI Provider that provides a set of interfaces for managing virtualization on the system. As mentioned previously, these WMI Providers will be publicly documented on MSDN, so you'll be able to automate virtualization, tasks using scripts if you know how. Together, these various components make up the user- ‘mode portion of the virtualization stack. Finally, at the bottom of the kernel portion of the parent partition is the VMBus, which represents a system for sending requests and data between virtual machines running on the system. Partition 2: Child with Enlightened Guest ‘The second partition from the left in Figure 3.6 shows an “enlightened” guest OS running within a child partition, An enlightened guest is an operating system that is aware that itis rrunning on top of the hypervisor. As a result, the guest uses an optimized virtual machine interface. A guest that is fully enlightened has no need of an emulator, one that is partially enlightened might need emulation for some types of hardware devices. Windows Server 2008 {isan example of fully enlightened guest and is shown in partition 2 in the figure. (Windows Vista is another possible example of a fully enlightened guest.) The Windows Server 2003 guest OS shown in this partition, however, is only a partially enlightened, or “driver enlightened,” guest OS.) By contrast, a legacy guest is an operating system that was written to run on a specific type of physical machine and therefore has no knowledge or understanding that itis running within a virtualized environment. To run within a VM hosted by Windows Server virtualization, aleg- acy guest requires substantial infrastructure, including a system BIOS and a wide variety of emulated devices. This infrastructure is not provided by the hypervisor but by an external ‘monitor that well discuss shortly. Running in kernel mode within the enlightened guest OS is the Virtualization Service Client (VSC), a “client” component that runs within a child partition and consumes services. The key thing here is that there is one VSP/VSC pair for each device type. For example, say aChapter 3 Windows Server Virtualization 27 user-mode application running in partition 2 (the child partition second from the left) wants to write something to a hard drive, which is server hardware. The process works like this: 1. The application calls the appropriate file system driver running in kernel mode in the child partition. 2. The file system driver notifies the VSC that it needs access to hardware, 3. The VSC passes the request over the VMBus to the corresponding VSP in partition I (the parent partition) using shared memory and hypervisor IPC messages. (You can think of the VMBusas a protocol with a supporting library for transferring data between different partitions through a ring buffer. I that’s too confusing, think of it asa pipe. Also, while the diagram makes it look as though traffic goes through all the child partitions, this is not really the case—the VMBus is actually a point-to-point inter-partition bus.) 4. The VSP then writes to the hard drive through the storage stack and the appropriate port driver, Microsoft plans on providing VSP/VSC pairs for storage, networking, video, and input devices for Windows Server virtualization, Third-party IHVs will likely provide additional VSP/VSC pairs to support additional hardware. Speaking of writing things to disk, let's pause a moment before we go on and explain how pass-through disk access works in Windows Server virtualization. Pass-through disk access represents an entire physical disk asa virtual disk within the guest. The data and commands are thus “passed through” to the physical disk via the partition’s native storage stack without any intervening processing by the virtual storage stack. This process contrasts with a virtual disk, where the virtual storage stack relies on its parser component to make the underlying storage (which could be a vhd or an .iso image) look like a physical disk to the guest. Pass- through disk access is totally independent of the underlying physical connection involved. For example, the disk might be direct-attached storage (IDE disk, USB flash disk, FireWire disk) or it might be on a storage area network (SAN). Now let's resume our discussion concerning the architecture of Windows Server virtualization and describe the third and fourth partitions shown in Figure 3-6 above. Partition 3: Child with Legacy Guest In the third partition from the left is a legacy guest OS such as MS-DOS. Yes, there are stil a few places (such as banks) that run DOS for certain purposes. Hopefully, they've thrown out all their 286 PCs though. The thing to understand here is that basically this child partition ‘works like Virtual Server. In other words, it uses emulation to provide DOS with a simulated hardware environment that it can understand. Asa result, there is no VSC component here running in kernel mode.28 Introducing Windows Server 2008 Partition 4: Child with Guest Running Linux Finally, in the fourth partition on the right is Linux running as a guest OS in a child partition. Microsoft recognizes the importance of interoperability in today’s enterprises. More specifi cally, Microsoft knows that their customers want to be able to run any OS on top of the hyper- visor that Windows Server virtualization provides, and therefore it can’t relegate Linux (or any ‘other 0S) to second-class status by forcing itto have to run on emulated hardware. That's why Microsoft has decided to partner with XenSource to build VSCs for Linux, which will enable Linux to run as an enlightened guest within a child partition on Windows Server 2008. knew those FOSS guys would finally see the light one day. Features of Windows Server Virtualization Now that we understand something about how virtualization works (or will work) on Windows Server 2008, let's look at what it can actually do. Here's a quick summary: © Creates and manage child partitions for both 32-bit (x86) and 64-bit (x64) operating systems. Creates VMs that can use SMP to access 2, 4, or even 8 cores Creates VMs that use up to 1 TB of physical memory. Windows Server virtualization can do this because it’s built on 64-bit from the ground up. That means 64-bit HV, 64-bit virtualization stack, and so on. ‘© Supports direct pass-through disk access for VMs to provide enhanced read/write performance. Storage is ofien a bottleneck for physical machines, and with virtual disks itcan be even more ofa bottleneck. Windows Server virtualization overcomes this issue. ‘Supports hov-add access to any form of storage. This means you can create virtual storage workloads and manage them dynamically. ‘© Supports dynamic addition of virtual NICs and can take advantage of underlying virtual LAN (VLAN) security ‘Includes tools for migrating Virtual Server workloads to Windows Server virtualization, This means your current investment in Virtual Server won't go down the drain. ‘Supports Windows Server 2008 Core as the parent OS for increased security I said this, earlier, but it bears repeating here because it's important, = Supports NAT and network quarantine for VMs, role-based security, Group Policy, utilization counters, non Microsoft guests, virtual machine snapshots using Volume Shadow Copy Service (VSS), resource control using Windows System Resource Manager (WSRM), clustering, and a whole bunch of other things.Chapter 3 Windows Server Virtualization 29 To put this all in perspective, take a look at Table 3-1, which provides a comparison between. Virtual Server 2005 R2 and Windows Server virtualization, Table 3-1 Comparison of Virtual Server 2005 R2 and Windows Server Virtualization Features Feature Virtual Server 2005 R2_ Windows Server Virtualization 32-bit VMs Yes Yes WMS No Yer ‘SMP VMs No Up to 8 core virtual machines Hot-add memory No Yes Hot-add processors No Yes Hot-add storage No Yes Hot-add networking No Yes Max memory per VM 366M > 32GB ‘Cluster support Yer Yes Scripting support Using COM Using WMI Max number of VMs oa No limit—depends only on hardware Management tool Web UI MMC snap-in Live migration support No Yes Works with System Center Yes Yes Virtual Machine Manager Note Virtual Server 2005 R2 Service Pack 1 will support intel VT and AMD-V technologies, as well as VSS. Managing Virtual Machines in Windows Server 2008 ‘At the time of this writing, the MMC snap in for managing virtual machines that is provided with Windows Server virtualization is still evolving, but I wanted to give you a quick preview here. Figure 3-7 shows the Windows Virtualization Management console for a near-Beta 3 build of Windows Server 2008, The console tree on the left displays the name of the server, while the Details pane in the middle shows a number of virtual machines, most of them in an Off state and two in a Saved state. The Actions pane on the right lets you manage virtualization settings, import virtual machines, connect to a virtual machine, and perform other tasks.Introducing Windows Server 2008 Figure 3-7. Windows Virtualization Management console So that's a very brief preview of what's in store for virtualization in Windows Server 2008 in terms of managing virtual machines. Fortunately we also have some experts on the product team at Microsoft who provide us with some more information concerning this feature and especially the planning issues surrounding implementing Windows Server virtualization in your environment. Fist, here's one of our experts talking about using Windows Server virtualization in conjunction with the Windows server core installation option of Windows Server 2008: \dows Server Virtualization and a Windows n From the Experts: Server Core Installat ‘The Windows server core installation option of Windows Server 2008 and Windows Server virtualization are two new features of Windows Server 2008 that go hand in hand. ‘The Windows server core installation option isa new minimal GUI shel/-Iess installation option for Window Server 2008 Standard, Enterprise and Datacenter Editions that reduces the management and maintenance required by an administrator. The Windows server core installation option provides key advantages over a full installation of Windows Server 2008 and is the perfect complement to Windows Server virtualization. Here are a couple of reasons why. im Reduced attack surface A Windows server core installation provides a greatly reduced attack surface because itis tailored to provide only what aole requires. ByChapter 3 Windows Server Virtualization 31 providing a minimal parent partition, this reduces the need to patch the parent partition. In the past with one workload running per server, ifyou needed to reboot the server for a patch, it wasn’t ideal, but generally one workload was affected. With Windows Server virtualization, you're not just running a single workload. You could be running dozens (even hundreds) of workloads in their ‘own virtual machine, Ifthe virtualization server requires a reboot for a patch (and you don't have a high availability solution in place), the result could be significant downtime. lm Reduced resource consumption With the parent partition requiring only a fraction of the memory resources for a Windows server core installation as opposed to a full installation of Windows Server 2008, you can use that memory to run more virtual machines, In short, it is highly recommended that you use Windows Server virtualization in conjunction with a Windows server core installation. “Jeffrey Woolsey Lead Program Manager, Windows Virtualization Next, let's hear another of our experts on the virtualization team at Microsoft share about how to identify what should be virtualized in your environment and what maybe shouldn't From the Experts: Virtualization Sizing Itis very important to understand how to roll out virtualization in your organization and ‘what makes the most sense for your environment and business conditions, So often, some enthusiastic users and organizations start ether attempting to virtualize every- thing or start with their most complex middleware environments, There are no right or ‘wrong first candidates for virtualization but you need to ensure that you have fully thought about the impact of using virtualization in your environment and for the work- Toads in question ‘As you think about what to virtualize and how to go about picking the right workloads, the order of deployment, and what hardware capabilities you need, find a model ora set of models that help you conceptualize the end solution. The System Center family of products provides you a set of tools that help simplify some of these issues, and other solutions from vendors like HP provide you tools to help size the deployment environment once you have figured out the candidates and the rollout process.32 Introducing Windows Server 2008 L ‘The next few paragraphs help identify some of the best practices in sizing your virtualization environment. Think of the following as a set of steps that will help you {identify what workloads to virtualize and what the deployment schedule should look like. Assessment As with any project, the first step isto fully know about where you are today and what capabilities you already have in your environment. The last thing you want to do is to sit and re-create the wheel and invest in things you already have in your environment. As you think about assessment, think about assessing all the components you have in your infrastructure, the types of workloads, and interdependencies of the various workloads. Also evaluate all the management assets you already have in your infrastructure and identify the functions that these are performing, such as monitoring, deployment, data protection, security, and so ‘on. These are the easier items to assess, but the more critical one to assess will be the overall process discipline that exists in your organization and how you deal with change in today's world, While this is a hard factor to quantify, this is critical in evaluating what capacity you have to deploy virtualization. To help you make this assessment from a holistic perspective, there are tools available such as, Microsoft's Infrastructure Optimization Model or Gartner's IT Maturity Model that, you can choose to use. There is one thing a customer once told me that I will never forget-"If someone tells you they have a solution for your problems when you have not identified or told them what your problems are, most likely they are giving you something you already have in a different package-that is, if you are lucky.” Solution Target Once you have identified and assessed your current environment, find out where you can use virtualization today. All server virtualization solutions today provide these usage scenarios: Production Server Consolidation, which encompasses all forms of consolidation of systems in existing or new environments, @ Test and Development Environments, which addresses the use of virtualization for optimizing the test and dev cycles and not only enables you to leverage the cost saving from hardware needs but also enables easy creation and modification of the environments Business Continuance, where your primary motivator isto leverage the fact that virtualization transforms your IT infrastructure to files (in Microsofts, case a VD file) to enable new and interesting continuance and disaster recovery solutions.Chapter 3 Windows Server Virtualization 33 Dynamic Datacenter, which is a new set of capabilities unleashed by virtualization to now enable you to not only create and manage yout environment more efficiently, but provide a new level of capability to be able to dynamically modify the characteristics of the environments for workloads based on usage. The dynamic resource manipulation enables you to take the consolidation benefits and translate it to now making your IT a more agile environment. © Branch Office, which while not being 2 core solution, is one usage scenario ‘where virtualization helps change how IT systems are deployed, monitored, and managed and helps extend the capabilites ofthe branch environment to bring in legacy and new application environments under one common Infrastructure umbrella ‘As you are trying to decide which solution area or areas to target for your virtualization solution, do keep in mind the level of complexity of the solutions and the need for increasing levels of management tools and process discipline. Test and dev environments are the easiest to virtualize and usually can manage to take some downtime in case of hiccups-hence this isa natural start for everyone. Server ‘Consolidation is another area that you can start using virtualization in today. The initial cost savings here are in the hardware consolidation benefits-but the true value of consolidation is seen only when you have figured out how to use a unified ‘management infrastructure, Business continance and branch scenarios need you to have a management infrastructure in place to help orchestrate these solutions and again to see the true value ~ you will need to have a certain level of processes outlined. Dynamic datacenter is a complex solution for most customers to fully deploy and this usually applies to a certain subset ofthe org’s infrastructure-select the workloads that need this type of solution more carefully as adding the SLAs to ‘maintain such a solution should mean that the workload is really critical to the organization. Consolidation Candidates Most users today are deploying virtualization to help consolidate workloads and bring in legacy systems into a unified management ‘umbrella, In this light, it becomes important to identify which workloads are the most logical ones to consolidate today and what makes sense in the future. There are some workloads that sound attractive for virtualization, but might not be ideal at any stretch because of certain I/O characteristics or purely because they are so big and critical that they easily scale up to or beyond the capabilities of the hard: ‘ware being thrown at them. Operations Manager or Virtual Machine Manager has a report thatis generated called the virtualization candidates report that helps scan your entire IT org and tell you exactly what workloads are ideal for virtualization ‘based on a number of thresholds such as CPU utilization, 1/O intensity, network usage, size of the workload, and so on. Based on this report and knowing the34 Introducing Windows Server 2008 interdependencies identified during the assessment phase, you can make intelligent decisions on what workloads to virtualization and when, 4. Infrastructure Planning Thisis where the rubber meets the road so to speak. Once you have identified the candidates to virtualize, you need a place to host the virtu- alized workloads. Tools from companies such as HP (HP Virtualization Sizing Guide) help you identify the type of servers you will need in your environment to host the virtualization solution that you have identified in the previous step. There is one fundamental rule to consider as you are selecting the infrastructure for vir ‘tualization-the two biggest limiting factors for virtualization are memory and /O throughput-so always ensure that you select a x64 platform for your hardware to censure alarge memory access, and always try to get the best disk subsystem either into the system for DAS or good SAN devices. 5. Placement Thisis not so much an area that is going to affect the sizing of your environment, but has the potential to impact your sizing decisions in the long run, Here we are referring to the act of taking one of the virtualization candidates and. actually deploying it to one of the selected virtualization host systems, The know- edge of interdependencies of the various workloads affects some of how this place. ‘ment occurs but from a high level, this is more about optimizing the placement for afew selected variables, Virtual Machine Manager has an intelligent placement tool that helps you optimize either to a load balancing algorithm or to a maximizing uti lization algorithm. You can alternatively also tweak individual parameters to help optimize your environment based on your business weights of the different param: ters Asyou size your virtualization environment, also keep in mind the overall manageability, factor and how you can scale your management apps to help cover the new environment, Now that you have seen how to size your virtualization environments, keep two things in mind-virtualization isa great technology that can help in multiple levels and scenar- ios buts still not the panacea forall problems so do take the time to identify your true problems and also remember that you need to look at deploying and managing virtual- ized environments over a long period of time and hence the need to think about virtualization as a 3-year solution at least. Virtualization is primarily a consolidation technology that abstracts resources and aids aggregation of workloads, so think carefully about how this affects your environment and what steps you need to have in place to avoid disasters and plan for them early. Rajiv Arunlundram Senior Product Manager, Server VirtualizationChapter 3 Windows Server Virtualization 35 Finally, an important planning item for any software deployment is licensing, Here’s one of our experts explaining the current licensing plan for Windows virtualization: From the Exper Virtualization Licensing One of the most talked about and often most confused areas for virtualization is icens- ing, Some of this is primarily caused due to the lack of one industry standard way of dealing with licensing and the other cause is that virtualization isa disruptive technol- ogy in how companies operate and hence not clear to customers on what the various policies mean in this new world. Microsofi’s licensing goals ae to provide customers and partners cost-effective, flexible, and simplified licensing for our products that will be applicable across all server virtual: ization products, regardless of vendor. To this effec, several changes were put in place in late 2005 to help accelerate virtualization deployments across vendors: mt Windows server licensing was changed from installation-based licensing to instance-based licensing for server products 1 Microsoft changed licensing to allow customers to run up to 1 physical and 4 virtual instances with a single license of Windows Server 2003 Enterprise Edition, on the licensed device; and 1 physical and unlimited virtual instances with Windows Server 2003 Datacenter Edition on the licensed device. With the release of SQL Server 2005 SP2, Microsoft announced expanded virtualization use rights to allow unlimited virtual instances on servers that are fully licensed for SQL. Server 2005 Enterprise Edition. With al these changes, you can now easily acquire and license Windows Server and other technologies in a much more efficient process. Virtualization also adds another level of complexity for licensing with the ability to easily move the images or instances around between machines. This is where licensing from the old era makes it tricky. The simple way to remember and ensure that you are fully licensed is to look at the host sys temsas the primary license holders with the instances being the deployment front. So if ‘you want to move a workload to a system that has Windows Server Enterprise Edition running and already has 4 instances running, you will need an additional license; ifit is lower than 4, you will not need an additional license to make the move happen. Do note that the licensing policies for these apply across virtualization products in the same manner across all server virtualization platforms. Rajiv Arunkundram Senior Product Manager, Server VirtualizationIntroducing Windows Server 2008 System Center Virtual Machine Manager 2007 The Virtualization Management Console snap-in that is included with Windows Server virtu- alization is limited in several ways, and it's mainly intended for managing virtual machines on a few servers ata time. Large enterprises want infrastructure solutions, however, and not just point tools. System Center Virtual Machine Manager fills this gap and will enable you to cen- tralize management of a large enterprise's entire virtual machine infrastructure, rapidly provi- sion new virtual machines as needed, and efficiently manage physical server utilization. Plus it’s fully integrated with the Microsoft System Center family of products, so you can leverage your existing skill sets as you migrate your network infrastructure to Windows Server 2008. ‘System Center Virtual Machine Manager runs as a standalone server application, and itcan be used to manage a virtualized datacenter that contains hundreds or even thousands of virtual ‘machines in an Active Directory environment. System Center Virtual Machine Manager will be able to manage virtual machines running on both Microsoft Virtual Server 2005 R2 and Windows 2008 Server with Windows Server virtualization installed. You can even deploy ‘System Center Virtual Machine Manager in a fiber-channel SAN environment for performing tasks such as the following ‘Deploying VMs from your SAN library to a host ‘Transferring VMs from a host to your library Migrating VMs from one host to another host ‘The administrator console for System Center Virtual Machine Manager is built upon Windows PowerShell, and you can use it to add and manage host machines, create and ‘manage virtual machines, monitor tasks, and even migrate physical machines to virtual ones (Something called P2V), System Center Virtual Machine Manager also includes a self-service Web portal that enables users to independently create and manage their own virtual machines. The way this works is that the administrator predetermines who can create virtual machines, which hosts these ‘machines can run on, and which actions users can perform on their virtual machines. At the time of this writing, System Center Virtual Machine Manager is in Beta 1 and supports ‘managing only virtual machines hosted on Virtual Server 2005 R2. SoftGrid Application Virtualization Finally, another upcoming virtualization technology you should know about is SoftGrid Application Virtualization, which Microsoft took ownership of when it acquired Softrcity in July 2006, SoftGrid provides a different kind of virtualization than we've been discussing here-instead of virtualizing an entire operating system, it virtualizes only an application. This functionality makes SoftGrid a more fine grained virtualization technology than WindowsChapter 3 Windows Server Virtualization 37 Server virtualization. Also, it’s designed not for the server end but for deploying applications to desktops easily and updating them as necessary. Essentially, what SoftGrid can do using its streaming delivery mechanism is to transform any ‘Windows program into a dynamic service that then follows users wherever they might go. ‘These services can then be integrated into Microsoft's management infrastructure so that they can be configured and managed using standard policy-based methods. At this point, SoftGrid isn't directly associated with Windows 2008 Server or Windows Server virtualization, but i's anew Microsoft technology you should be aware of as the virtualization landscape continues to evolve, Conclusion It would have been nice to have looked in greater depth at how Windows Server virtualization in Windows Server 2008 works. Unfortunately, atthe time of this writing the bits aren't there yet. Still, you have to admit that this is one of the hottest features of Windows Server 2008, both from the perspective of the day-to-day needs of IT professionals and as a prime selling point for Windows Server 2008. I've tried to give you a taste of how this new technology will ‘work and a glimpse of what it looks like, but I hope you're not satisfied with that-I'm not. 1 can't wait til allthis comes together, and the plain truth of the matter is that in only a few years virtualization will be inexpensive and ubiquitous. So get ready for it now. Bring back the mainframe! Additional Reading Ifyou want to find out more about the underlying processor enhancements from Intel and ‘AMD that will support and be required by Windows Server virtualization, check out the following sources: See http://www. intel.com/technology/virtualization/index. him for information concern- ing Intel VT technology See hitp://www.amd.com/us-en/Processors/Productinformation/ 0,,30_118_8826_14287,00,html for information about AMD-V technology For information on how Microsoft and XenSource are collaborating to support running Linux on Windows Server 2008, read the following article on Microsoft PressPass: http://www. microsoft com/ presspass/press/2006 /jul06/07-I7MSXenSourcePR.mspx, The starting point for finding out more about current (and future) Microsoft virtualization products is http://www-microsoft.com/windowsserversystem/virtualserver/default mspx on Microsoft.com.Introducing Windows Server 2008 For more information about System Center Virtual Machine Manager and how you can join the beta program for this product, see http://www.microsoft.com/ windowsserversystem/ virtwalization/default mspx on the Microsoft Web site. From there, you can jump to pages describing Virtual Server 2005 R2, Virtual PC 2007, System Center Virtual Machine Manager, and most likely Windows Server virtualization on Windows Server 2008 in the near future as well If you're interested in finding out more about SoftGrid Application Virtualization, see http://www sofricity.com/index.asp, although the Softricity Web site will probably be folded soon into Microsoft.com. Finally, be sure to turn to Chapter 14, “Additional Resources,” if you want to find more resources about Windows Server virtualization in Windows Server 2008, In that chapter, you'll find links to webcasts, whitepapers, blogs, newsgroups, and other sources of information on this feature and other Microsoft virtualization technologies.Chapter 4 Managing Windows Server 2008 In this chapter Performing In Using Server Manager. ‘Other Management Tools. Conclusion .. Additional Resource: Configuration Tasks........cccsecsseessteeseeeeeseee ee 33D Iwas kidding, ofcourse, when I said we should bring back the mainframe, Afterall, emember how much fun it was managing those machines? Siting at a green screen all day long, drop ping armfuls of punch cards into the hopper...what fun! Atleast running an IBM System/360 could be more fun than operating a PDP-11, When I was a university student years ago (decades actually), I worked one summer for the physics department, where there was a PDP in the sub-sub-basement where the Cyclotron was located. | remember sitting there alone one night around 3 am. while an experiment was running, watching the lights blink on the PDP and flipping a switch from time to time to read a paper tape. And that was my intro- duction to the tools used for managing state-of heart computers in those days-specifically, lights, switches, and paper tape. ‘Computers have come a long way since then. Besides being a lot more powerful, they're also allot easier to manage. So before we examine other new and exciting features of Microsoft, Windows Server 2008, let's look at the new and enhanced tools you can use to manage the platform. These tools range from user interface (UI) tools for configuring and managing servers to a new command-line tool for installing roles and features, tools for remote adminis- tration, Windows Management Instrumentation (WMI) enhancements for improved scripted. management, Group Policy enhancements, and more. Performing Initial Configuration Tasks The first thing you'll notice when you install Windows Server 2008 isthe Initial Configuration Tasks screen (shown in Figure 41), 3940 Introducing Windows Server 2008 Boner, ae oe es ® Bete Boe ™ 7 Uf trast Figure 4-1. The Initial Configuration Tasks screen Remember fora moment how you perform your initial configuration of a machine running ‘Windows Server 2003 Service Pack | of later, where you do this in three stages: 1. During Setup, when you specify your administrator password, network settings, domain membership, and so on 2. Immediately after Setup, when a screen appears asking if you want to download the latest updates from Windows Update and turn on Automatic Updates before the server can receive inbound traffic 3. After you've allowed inbound traffic to your server, when you can use Manage Your Server to install roles on your server to make ita print server, file server, domain controller, and so on Windows Server 2008, however, consolidates these various server configuration tasks by consolidating during- and postSetup tasks together and presenting them to you in a single screen called Initial Configuration Tasks (ICT). Using the ICT you can Specify key information, including the administrator password, time zone, network settings, and server name, You can also join your server to a domain, For example, clicking the Provide Computer Name And Domain link opens System Properties with the Computer Named tab selected.Chapter 4 Managing Windows Server 200841 Search Windows Update for available software updates, and enable one or more of the following: Automatic Updates, Windows Error Reporting (WER), and participation in the Customer Experience Improvement Program. © Configure Windows Firewall on your machine, and enable Remote Desktop so that the server can be remotely managed using Terminal Services. Add roles and features to your server—for example, to make it a DNS server or domain controller, In addition to providing a user interface where you can perform these tasks, ICT also displays status information for each task. For example, if task has already been performed, the link for the task changes color from blue to purple just like an ordinary hyperlink. And if WER has been turned on, the message “Windows Error Reporting on” is displayed next to the corre- sponding task item, ‘Once you've performed the initial configuration of your server, you can click the Print, Exnail (Or Save This Information link at the bottom. This opens Internet Explorer and displays a results page showing the settings you've configured. ‘This results page can be found at Sosystemdrive%\users\\AppData\ Roaming\Microsoft\Windows\ ServerManager\InitialConfigurationTasks html, and itcan be saved or e-mailed for reporting purposes.a Introducing Windows Server 2008 A few more notes concerning Initial Configuration Tasks Performing some tasks requires that you log off orreboot your machine. For example, by default when you install Windows Server 2008, the builtin Administrator account is enabled and has no password. Ifyou use ICT to change the name of this account or specify a password, you must log off and then on again for this change to take effect. If Windows Server 2008 detects that itis deployed on a restricted network (that is, quarantined by NAP) when you first log on, the Update This Server section of the ICT displays a new link named Restore Network Access. Clicking this link allows you to review current network access restrictions and restore full network access for your server, and until you do this your server is in quarantine and has only limited network access, The reason that the other two items in this section (Enable Windows Update And Feedback and Download And Install Updates) are not displayed in this situation is that ‘machines in quarantine cannot access Windows Update directly and must receive their updates from a remediation server. For more information about this, see Chapter 10, “Network Access Protection.” OEMs can customize the ICT screen so that it displays an additional section at the bottom that can include an OEM logo, a description, and task links that can launch EXEs, DLLs, and scripts provided by the OFM. Note that OEM task links cannot display status information, however. The ICT is not displayed if you upgrade to Windows Server 2008 from a previous version of Windows Server. The ICT is also not displayed if the following Group Policy setting is configured: Computer Configuration\Administrative Templates\ System\Server Manager\Do Not Open Initial Configuration Tasks Windows At Logon Using Server Manager OK, you've installed your server, performed the initial configuration tasks, and maybe installed a role or two—such as file server and DHCP server—on your machine as well. Now what? Once you close ICT, another new tool automatically opens-namely, Server Manager (shown in Figure 4-2). [like to think of Server Manager as “Computer Management on steroids,” asit can do everything compmgmt.msc can do plus a whole lot more. (Look at the console tree on the left in this figure and you'll see why I said this.)Chapter 4 Managing Windows Server 200843, RINNE ERE ale 2n pone ania Figure 4-2 Main page of Server Manager ‘The goal of Server Manager is to provide a straightforward way of installing roles and features ‘on your server so that it can function within your business networking environment, As tool, Server Manager is primarily targeted toward the IT generalist who works at medium-sized organizations. IT specialists who work at large enterprises might want to use additional tools to configure their newly installed servers, however—for example, by performing some initial configuration tasks during unattended setup by using Windows Deployment Services (WDS) together with unattend xml answer files. See Chapter 13, “Deploying Windows Server 2008,” for more information on using WDS to deploy Windows Server 2008. Server Manager also enables you to modify any of the settings you specified previously using the Initial Configuration Tasks screen. For example, in Figure 4-2 you can see that you can enable Remote Desktop by clicking the Configure Remote Desktop link found on the right side of the Server Summary tile. In fact, Server Manager lets you configure additional advanced settings that are not exposed in the ICT screen, such as enabling or disabling the Internet Explorer Enhanced Security Configuration (IE ESC) or running the Security Configuration Wizard (SCW) on your machine.4 Introducing Windows Server 2008 Managing Server Roles Let’s dig a bit deeper into Server Manager. Near the bottom of Figure 4-2, you can see that we've already installed two roles on our server using the ICT screen. Well learn more about the various roles, role services, and features you can install on Windows Server 2008 later in Chapter 5, “Managing Server Roles.” For now, let's see what we can do with these two roles that have already been installed. Clicking the Go To Manage Roles link changes the focus from the root node (Server Manager) to the Roles node beneath it. (See Figure 4-3.) This page displays a lst of roles installed on the server and the status of each of these roles, including any tole services that were installed together with them, (Role services will be explained later in Chapter 5.) r 3 | 1 | i | i | +] == 1 (eae ie Va i enter 1 = a | a a = Giseses. J | i ol toes eres i eee, | aes Fos ita em 1d ae = Eocoee ld Figure 4-3 Roles page of Server Manager The status of this page is updated in realtime at periodic intervals, and if you look carefully at these figures youl see a link at the bottom of each page that says “Configure refresh.” Ifyou click this link, you can specify how often Server Manager refreshes the currently displayed page. By default, the refresh interval is two minutes.Chapter 4 Managing Windows Server 200845 Selecting the node for the File Server role in the console tee (or clicking the Go To File Server link on the Roles page) displays more information about how this role is configured on the ‘machine (as shown in Figure 44), Using this page, you can manage the following aspects of your file server: ‘View events relevant to this role (by double-clicking on an event to display its details) ‘View system services for this role, and stop, start, pause, or resume these services. View role services installed for this role, and add or remove role services. Get help on how to perform role-related tasks. (2 eR ERIRIENETI En =e - =) | sie 4 . Figure 4-4 Main page for File Server role Note the check mark in the green circle beside File Server Resource Manager (FSRM) under Role Services. This means that FSRM, an optional component or “role service” for the FileIntroducing Windows Server 2008 Server role, has been installed on this server. You probably remember FSRM from Windows Server 2003 R2-it's a terrific tol for managing file servers and can be used to configure vol- ume and folder quotas, file screens, and reporting, But in Windows Server 2003 R2, you had to launch FSRM as a separate administrative tool-not so in Windows Server 2008. What's cool about Server Manager is that itis implemented as a managed, user-mode MMC 3.0 snap- {in that can host other MMC snap-ins and dynamically show or hide them inline based on whether a particular role or feature has been installed on the server. ‘What this means here is that we can expand our File Server node, and underneath it you'll find two other snap-ins—namely, File Server Resource Manager (which we chose to install as an additional role service when we installed the File Server role on our machine) and Shared Folders (which is installed by default whenever you add the file server role toa machine.) And underneath the FSRM node, you'll find the same subnodes you should already be familiar with in FSRM on Windows Server 2003 R2. (See Figure 4-5.) And anything you can do with FSRM in R2, you do pretty much the same way in Windows Server 2008. For example, to configure an SMTP server for sending notification e-mails when quotas are exceeded, right- click on the File Server Resource Manager node and select Properties. (In addition to hosting the FSRM snap-in within Server Manager, adding the FSRM role service also adds the FSRM console to Administrative Tools.) EERIE ee Figure 4-5 File Server role showing hosted snap-ins for File Server Resource Manager and Shared FoldersChapter 4 Managing Windows Server 200847 Here are a few more important things to know about Server Manager. First, Server Manager is designed to be a single, all-in-one tool for managing your server. In that light, it replaces both ‘Manage Your Server (for adding roles) and the Add/Remove Windows Components portion of Add Or Remove Programs found on previous versions of Windows Server. Infact, if you go to Control Panel and open Programs And Features (which replaced Add Or Remove Programs in Windows Vista), you'll see a link called Turn Windows Features On And Off. Ifyou click that link, Server Manager opens and you can use the Roles or Features node to add or remove roles, role services, and features. (See Chapter 5 for how this is done.) Also, when Server Manager is used to installa role such as File Server on your server, it makes sure that this role is secure by default. That is, the only components that are installed and ports that are opened are those that are absolutely necessary for that role to function.) In Windows Server 2003 Service Pack 1 or later, you needed to run the Security Configuration Wizard (SCW) to ensure a server role was installed securely. Windows Server 2008 still includes the ‘SCW, but the tool is intended for use by IT specialists working in large enterprises. For ‘medium-sized organizations, however, IT generalists can use Server Manager to install roles securely, and it's much easier to do than using SCW. In addition, while Server Manager can be used for installing new roles using smart defaults, SCW is mainly designed as a post- deployment tool for creating security policies that can then be applied to multiple servers to harden them by reducing their attack surface. (You can also compare policies created by SCW against the current state ofa server for auditing reasons to ensure compliance with your cor- porate security policy.) Finally, while Server Manager can only be used to add the default Windows roles (or out-of band roles made available later, as mentioned in the extensibility discussion a bit later), SCW can also be used for securing nondefault roles such as Exchange Server and SQL Server. But the main takeaway for this chapter concerning Server Manager vs. ‘SCW is that when you run Server Manager to install a new role on your server, you don't need to run SCW afterward to lock down the role, as Server Manager ensures the role is already secure by default, Server Manager relies upon something called Component Based Servicing (CBS) to discover ‘what roles and services ae installed on a machine and to install additional roles or services or remove them. For those of you who might be interested in how this works, there's a sidebar in the next section that discusses it in more detail. Server Manager is also designed to be exten- sible, This means when new features become available (such as Windows Server Virtualiza- tion, which we talked about in Chapter 3, "Windows Server Virtualization”), you'll be able to use Server Manager to download these roles from Microsoft and install them on your server. Server Manager is designed to manage one server only (the local server) and cannot be used to manage multiple servers at once. If you need a tool to manage multiple servers simmulta- neously, use Microsoft System Center. You can find out more about System Center products and their capabilities at http://www microsoft.com/systemcenter/,and it will be well worth your time to do so. In addition, the status information displayed by Server Manager is limited to48 Introducing Windows Server 2008 event information and whether role services are running. So if you need more detailed information concerning the status of your servers, again be sure to check out System Center, the next generation of the SMS and MOM platforms. Unlike using Computer Management, you can't use Server Manager to remotely connect to another server and manage it. For example, if you right-click on the root node in Server Man- ager, the context menu that is displayed does not display a Connect To A Different Computer ‘option. However, thisis not really significant limitation of the tool because most admins will simply enable Remote Desktop on their servers and use Terminal Services to remotely manage them. For example, you can create a Remote Desktop Connection on a Windows Vista com- ‘puter, use it to connect to the console session on a Windows Server 2008 machine, and then rrun Server Manager within the remote console session. And speaking of Computer ‘Management, guess what happens if you click Star, right-lick on Computer, and select ‘Manage? In previous versions of Windows, doing this opened Computer Management—what tool do you think opens if you do this in Windows Server 2008? Finally, a few more quick points you can make note of: Server Manager cannot be used to manage servers running previous versions of the ‘Windows Server operating system. Server Manager cannot be installed on Windows Vista or previous versions of Microsoft Windows. Server Manager is not available on a Windows server core installation of Windows Server 2008 because the supporting components (.NET Framework 2.0 and MMC 3.0) are not available on that platform, You can configure the refresh interval for Server Manager and also whether the tool is automatically opened at logon by configuring the following Group Policy settings Computer Configuration\ Administrative Templates\ System\Server Manager\Do Not Open Server Manager Automatically At Logon (Computer Configuration\ Administrative Templates\ System\ Server Manager\, Configure The Refresh Interval For Server ManagerChapter 4 Managing Windows Server 200849, From the Experts: The Security Configuration Wizard in Windows Server 2008 ‘The Security Configuration Wizard (SCW) reduces the attack surface of Windows Servers by asking the user a series of questions designed to identify the functional requirements ofa server. Functionality not required by the roles the server s performing is then disabled, In addition to being a fundamental security best practice, SCW reduces the number of systems that need to be immediately patched when a vulnerability is exposed. Specifically, SCW: Disables unneeded services. Creates required firewall rules, Removes unneeded firewall rules Allows further address or security restrictions for firewall rules. Reduces protocol exposure to server message block (SMB), LanMan, and Lightweight Directory Access Protocol (LDAP), SCW guides you through the process of creating, editing, applying, or rolling back a security policy based on the selected roles of the server. The security policies that are created with SCW are XML files that, when applied, configure services, Windows Firewall rules, specific registry values, and audit policy. Those security policies can be applied to an individual machine or can be transformed into a group policy object and then linked to an Organizational Unit in Active Directory. With Windows Server 2008 some important improvements have been made to SCW: On Windows Server 2003, SCW was an optional component that had to be ‘manually installed by administrators, SCW is now a default component of Windows Server 2008 which means Administrators won't have to perform extra steps to install or deploy the tool to leverage it Windows Server 2008 will introduce a lot of new and exciting fumetionality in Windows Firewall. To support that functionality, SCW has been improved to store, process, and apply firewall rules with the same degree of precision that the Windows Firewall does. This was an important requirement since on Windows Server 2008 the Windows Firewall will be on by default The SCW leverages a large XML database that consists of every service, firewall rule and administration option from every feature or component available on Windows Server 2008. This database has been totally reviewed and updated for ‘Windows Server 2008. Existing roles have been updated, new roles have been added to the database, and all firewall rules have been updated to support the new Windows Firewall,Introducing Windows Server 2008 mt SCW now validates all XML files in its database files using a set of XSD files that contains the SCW XML schema. This will help administrators or developers extend the SCW database by creating new SCW roles base on their own requirements or applications. Those XSD files are available under the SCW directory. All SCW reports have been updated to reflect the changes made to the SCW ‘schema regarding support for the new Window Firewall. Those reports include the Configuration Database report, the Security Policy report and the Analysis report, that will compare the current configuration of Windows Server 2008 against an SCW security policy. SCW provides an end to end solution to reduce the attack surface of Windows Server 2008 machines by providing a possible configuration of default components, roles, features, and any third-party applications that provide an SCW role. SCW is not responsible for installing or removing any roles, features, or third-party applications from Windows Server 2008. Instead, Administrators should use Server Manager if they need to instal roles and features, or use the setup provided with any third party application. The installation of roles and features via Server Manager is made based on security best practices While SCW complements well Server Manager, its main value is in the configuration of, the core operating system and third-party applications that provide an SCW role. SCW should be used every time the configuration of a default component on Windows Server 2008 needs to be modified or when a third-party application is added or removed. In some specific scenarios, like for remote administration, running SCW after using Server Manager might provide some added value to some specificroles or features, Using SCW after modifying a role or feature through Server Manager is not a requirement, however. -Nils Dussart Program Manager for the Security Configuration Wizard (SCW), Windows Core Operating System Division ServerManagerCmd.exe In addition to the Server Manager user interface, there is also a command-line version of Server Manager called ServerManagerCmd.exe that was first introduced in the IDS_2 build of ‘Windows Server 2008 (that is, the February CTP build). This command-line tool, which is, found in the Yowindir%\system32 folder, can be used to perform the following tasks: ‘§ Display a list of roles and features already installed on a machine. Display alist of role services and features that would be installed if you chose to install a given role. Add a role or feature to your server using the default settings of that role or feature.Chapter 4 Managing Windows Server 200851 Add several roles/features at once by providing an XML answer file listing the roles/ features to be installed, ‘Remote roles or features from your server. What ServerManagerCmd.exe can’t do includes the following: Install a role or feature, and change its default settings. Reconfigure a role or feature already installed on the machine. Connect to a remote machine, and manage roles/features on that machine. Manage roles/features on machines running a Windows server core installation of Windows Server 2008. Manage non-OOB roles/features~such as Exchange Server or SQL Server. Let's take a look at the servermanagercmd -query command, which displays the list of roles and features currently available on the computer, along with their command-line names (values that should be used to install or remove the role or feature from the command line). ‘When you run this command, something called discovery runs to determine the different roles and features already installed. gr After discovery completes (which may take a short period of time), the command generates output displaying installed roles/features in green and marked with “X".