Table Of ContentRand Morimoto, Ph.D., MCITP
Michael Noel, MVP, MCITP
Omar Droubi, MCSE
Ross Mistry, MVP, MCITP
Chris Amaris, MCSE, CISSP
Technical Edit by Guy Yardeni
ptg
Windows Server
®
2008 R2
U N L E A S H E D
800 East 96th Street,Indianapolis,Indiana 46240 USA
From the Library of Robert Ryan
Windows Server® 2008 R2 Unleashed Editor-in-Chief
Copyright © 2010 by Pearson Education,Inc. Karen Gettman
All rights reserved. No part of this book shall be reproduced,stored in a retrieval
Executive Editor
system,or transmitted by any means,electronic,mechanical,photocopying,recording,
Neil Rowe
or otherwise,without written permission from the publisher. No patent liability is
assumed with respect to the use of the information contained herein. Although every Development
precaution has been taken in the preparation of this book,the publisher and author Editor
assume no responsibility for errors or omissions. Nor is any liability assumed for
Mark Renfrow
damages resulting from the use of the information contained herein.
ISBN-13: 978-0-672-33092-6 Managing Editor
ISBN-10: 0-672-33092-X Kristy Hart
The Library of Congress Cataloging-in-Publication Data is on file.
Project Editor
Printed in the United States of America
Betsy Harris
First Printing January 2010
Copy Editor
Trademarks
Karen Annett
All terms mentioned in this book that are known to be trademarks or service marks
have been appropriately capitalized. Sams Publishing cannot attest to the accuracy of Indexer
this information. Use of a term in this book should not be regarded as affecting the WordWise Publishing
validity of any trademark or service mark. Services
Warning and Disclaimer
Proofreaders
Every effort has been made to make this book as complete and as accurate as possi-
Water Crest
ble,but no warranty or fitness is implied. The information provided is on an “as is”
Publishing
basis. The authors and the publisher shall have neither liability nor responsibility to any
person or entity with respect to any loss or damages arising from the information Williams Woods
contained in this book or from the use of it. Publishing
Bulk Sales Technical Editor
Sams Publishing offers excellent discounts on this book when ordered in quantity for ptg
Guy Yardeni
bulk purchases or special sales. For more information,please contact
U.S. Corporate and Government Sales Publishing
1-800-382-3419 Coordinator
[email protected] Cindy Teeters
For sales outside of the U.S.,please contact
Book Designer
International Sales
Gary Adair
[email protected]
Compositor
Jake McFarland
Contributing
Writers
Alex Lewis,CISSP,
MVP
Colin Spence,MCP,
MCTS
Jeff Guillet,MVP,
MCITP,CISSP
Jon Skoog,MCSE,
CISSP
Stefan Garaygay,
MCSE
Tyson Kopczynski,
CISSP,GSEC,GCIH,
MCTS
From the Library of Robert Ryan
Contents at a Glance
Introduction...................................................................................1
Part I Windows Server 2008 R2 Overview
1 Windows Server 2008 R2 Technology Primer........................................5
2 Planning, Prototyping, Migrating, and Deploying Windows Server
2008 R2 Best Practices.....................................................................49
3 Installing Windows Server 2008 R2 and Server Core.............................83
Part II Windows Server 2008 R2 Active Directory
4 Active Directory Domain Services Primer..........................................113
5 Designing a Windows Server 2008 R2 Active Directory.......................149
6 Designing Organizational Unit and Group Structure...........................175
7 Active Directory Infrastructure........................................................195 ptg
8 Creating Federated Forests and Lightweight Directories.......................227
9 Integrating Active Directory in a UNIX Environment.........................245
Part III Networking Services
10 Domain Name System and IPv6......................................................259
11 DHCP/WINS/Domain Controllers...................................................325
12 Internet Information Services.........................................................377
Part IV Security
13 Server-Level Security.....................................................................419
14 Transport-Level Security................................................................441
15 Security Policies, Network Policy Server, and Network Access
Protection...................................................................................459
Part V Migrating to Windows Server 2008 R2
16 Migrating from Windows Server 2003/2008 to Windows
Server 2008 R2.............................................................................483
17 Compatibility Testing....................................................................525
From the Library of Robert Ryan
Part VI Windows Server 2008 R2 Administration and Management
18 Windows Server 2008 R2 Administration..........................................549
19 Windows Server 2008 R2 Group Policies and Policy Management.........585
20 Windows Server 2008 R2 Management and Maintenance Practices.......639
21 Automating Tasks Using PowerShell Scripting ...................................699
22 Documenting a Windows Server 2008 R2 Environment......................763
23 Integrating System Center Operations Manager 2007 R2 with
Windows Server 2008 R2...............................................................793
Part VII Remote and Mobile Technologies
24 Server-to-Client Remote Access and DirectAccess...............................849
25 Remote Desktop Services...............................................................921
Part VIII Desktop Administration
26 Windows Server 2008 R2 Administration Tools for Desktops................987
27 Group Policy Management for Network Clients...............................1023
ptg
Part IX Fault-Tolerance Technologies
28 File System Management and Fault Tolerance..................................1097
29 System-Level Fault Tolerance (Clustering/Network Load Balancing).....1173
30 Backing Up the Windows Server 2008 R2 Environment.....................1227
31 Recovering from a Disaster...........................................................1267
Part X Optimizing,Tuning,Debugging,and Problem Solving
32 Optimizing Windows Server 2008 R2 for Branch Office
Communications........................................................................1305
33 Logging and Debugging...............................................................1345
34 Capacity Analysis and Performance Optimization............................1391
Part XI Integrated Windows Application Services
35 Windows SharePoint Services........................................................1433
36 Windows Media Services..............................................................1483
37 Deploying and Using Windows Virtualization.................................1515
Index........................................................................................1553
From the Library of Robert Ryan
Table of Contents
Introduction 1
Part I Windows Server 2008 R2 Overview
1 Windows Server 2008 R2 Technology Primer 5
Windows Server 2008 R2 Defined.......................................................5
When Is the Right Time to Migrate?..................................................10
Versions of Windows Server 2008 R2.................................................12
What’s New and What’s the Same About Windows Server 2008 R2?.......16
Changes in Active Directory............................................................20
Windows Server 2008 R2 Benefits for Administration...........................22
Improvements in Security in Windows Server 2008 R2.........................26
Improvements in Mobile Computing in Windows Server 2008 R2..........28
Improvements in Windows Server 2008 R2 for Better Branch Office ptg
Support......................................................................................30
Improvements for Thin Client Remote Desktop Services.......................33
Improvements in Clustering and Storage Area Network Support.............37
Addition of Migration Tools.............................................................38
Improvements in Server Roles in Windows Server 2008 R2....................40
Identifying Which Windows Server 2008 R2 Service to Install or
Migrate to First............................................................................43
Summary......................................................................................46
Best Practices.................................................................................47
2 Planning,Prototyping,Migrating,and Deploying Windows Server
2008 R2 Best Practices 49
Determining the Scope of Your Project..............................................50
Identifying the Business Goals and Objectives to Implement Windows
Server 2008 R2.............................................................................50
Identifying the Technical Goals and Objectives to Implement Windows
Server 2008 R2.............................................................................53
The Discovery Phase: Understanding the Existing Environment.............59
The Design Phase: Documenting the Vision and the Plan.....................63
The Migration Planning Phase: Documenting the Process for
Migration...................................................................................67
The Prototype Phase: Creating and Testing the Plan.............................73
From the Library of Robert Ryan
vi Windows Server 2008 R2 Unleashed
The Pilot Phase: Validating the Plan to a Limited Number of Users.........75
The Migration/Implementation Phase: Conducting the Migration
or Installation..............................................................................78
Summary......................................................................................79
Best Practices.................................................................................80
3 Installing Windows Server 2008 R2 and Server Core 83
Preplanning and Preparing a Server Installation..................................83
Installing a Clean Version of Windows Server 2008 R2 Operating
System.......................................................................................89
Upgrading to Windows Server 2008 R2..............................................98
Understanding Server Core Installation............................................103
Managing and Configuring a Server Core Installation.........................105
Performing an Unattended Windows Server 2008 R2 Installation.........111
Summary....................................................................................111
Best Practices...............................................................................112
Part II Windows Server 2008 R2 Active Directory
ptg
4 Active Directory Domain Services Primer 113
Examining the Evolution of Directory Services..................................114
Understanding the Development of AD DS.......................................115
Examining AD DS’s Structure..........................................................116
Outlining AD DS’s Components......................................................119
Understanding Domain Trusts........................................................124
Defining Organizational Units........................................................126
Outlining the Role of Groups in an AD DS Environment....................127
Explaining AD DS Replication........................................................129
Outlining the Role of DNS in AD DS................................................131
Outlining AD DS Security..............................................................133
Outlining AD DS Changes in Windows Server 2008 R2.......................134
Summary....................................................................................146
Best Practices...............................................................................146
5 Designing a Windows Server 2008 R2 Active Directory 149
Understanding AD DS Domain Design.............................................149
Choosing a Domain Namespace......................................................151
Examining Domain Design Features................................................153
Choosing a Domain Structure.........................................................154
Understanding the Single Domain Model.........................................155
From the Library of Robert Ryan
Contents vii
Understanding the Multiple Domain Model......................................157
Understanding the Multiple Trees in a Single Forest Model..................160
Understanding the Federated Forests Design Model............................162
Understanding the Empty-Root Domain Model.................................165
Understanding the Placeholder Domain Model.................................167
Understanding the Special-Purpose Domain Design Model..................169
Renaming an AD DS Domain.........................................................170
Summary....................................................................................173
Best Practices...............................................................................173
6 Designing Organizational Unit and Group Structure 175
Defining Organizational Units in AD DS..........................................176
Defining AD Groups.....................................................................178
Examining OU and Group Design...................................................182
Starting an OU Design...................................................................182
Using OUs to Delegate Administration.............................................184
Group Policies and OU Design........................................................186
Understanding Group Design.........................................................186
Exploring Sample Design Models....................................................188 ptg
Summary....................................................................................193
Best Practices...............................................................................193
7 Active Directory Infrastructure 195
Understanding AD DS Replication in Depth......................................195
Understanding Active Directory Sites...............................................200
Planning Replication Topology.......................................................207
Outlining Windows Server 2008 R2 IPv6 Support...............................213
Detailing Real-World Replication Designs.........................................216
Deploying Read-Only Domain Controllers (RODCs)...........................220
Summary....................................................................................224
Best Practices...............................................................................225
8 Creating Federated Forests and Lightweight Directories 227
Keeping a Distributed Environment in Sync......................................227
Active Directory Federation Services................................................232
Synchronizing Directory Information with Forefront Identity
Manager (FIM)...........................................................................236
Harnessing the Power and Potential of FIM.......................................240
Summary....................................................................................243
Best Practices...............................................................................243
From the Library of Robert Ryan
viii Windows Server 2008 R2 Unleashed
9 Integrating Active Directory in a UNIX Environment 245
Understanding and Using Windows Server 2008 R2 UNIX Integration
Components..............................................................................245
Reviewing the Subsystem for UNIX-Based Applications (SUA)..............252
Understanding the Identity Management for UNIX Components.........253
Administrative Improvements with Windows Server 2008 R2..............256
Summary....................................................................................258
Best Practices...............................................................................258
Part III Networking Services
10 Domain Name System and IPv6 259
Understanding the Need for DNS....................................................260
Getting Started with DNS on Windows Server 2008 R2.......................263
Resource Records..........................................................................266
Understanding DNS Zones.............................................................270
Performing Zone Transfers.............................................................274
Understanding DNS Queries...........................................................276
Other DNS Components................................................................278 ptg
Understanding the Evolution of Microsoft DNS.................................285
DNS in Windows Server 2008 R2.....................................................286
DNS in an Active Directory Domain Services Environment..................288
Troubleshooting DNS....................................................................292
IPv6 Introduction.........................................................................297
How to Configure IPv6 on Windows Server 2008 R2..........................311
Secure DNS with DNSSEC..............................................................316
Summary....................................................................................323
Best Practices...............................................................................323
11 DHCP/WINS/Domain Controllers 325
Understanding the Key Components of an Enterprise Network............326
Exploring the Dynamic Host Configuration Protocol (DHCP)..............328
Exploring DHCP Changes in Windows Server 2008 R2........................336
Enhancing DHCP Reliability...........................................................345
Implementing Redundant DHCP Services.........................................350
Exploring Advanced DHCP Concepts...............................................358
Securing DHCP............................................................................359
Reviewing the Windows Internet Naming Service (WINS)...................361
Installing and Configuring WINS....................................................364
Planning, Migrating, and Maintaining WINS....................................368
Exploring Global Catalog Domain Controller Placement.....................370
Summary....................................................................................374
Best Practices...............................................................................374
From the Library of Robert Ryan
Contents ix
12 Internet Information Services 377
Understanding Internet Information Services (IIS) 7.5........................377
Planning and Designing Internet Information Services 7.5..................382
Installing and Upgrading IIS 7.5......................................................383
Installing and Configuring Websites................................................389
Installing and Configuring FTP Services...........................................397
Securing Internet Information Services 7.5........................................407
Summary....................................................................................416
Best Practices...............................................................................417
Part IV Security
13 Server-Level Security 419
Defining Windows Server 2008 R2 Security.......................................419
Deploying Physical Security...........................................................420
Using the Integrated Windows Firewall with Advanced Security...........424
Hardening Server Security..............................................................427
Examining File-Level Security.........................................................429
Additional Security Mechanisms.....................................................433 ptg
Using Windows Server Update Services............................................434
Summary....................................................................................440
Best Practices...............................................................................440
14 Transport-Level Security 441
Introduction to Transport-Level Security in Windows Server 2008 R2....442
Deploying a Public Key Infrastructure with Windows Server 2008 R2....443
Understanding Active Directory Certificate Services (AD CS) in
Windows Server 2008 R2.............................................................444
Active Directory Rights Management Services...................................451
Using IPSec Encryption with Windows Server 2008 R2.......................454
Summary....................................................................................456
Best Practices...............................................................................456
15 Security Policies,Network Policy Server,and Network Access Protection 459
Understanding Network Access Protection (NAP) in
Windows Server 2008 R2.............................................................459
Deploying a Windows Server 2008 R2 Network Policy Server...............462
Enforcing Policy Settings with a Network Policy Server.......................465
Deploying and Enforcing a Virtual Private Network (VPN)
Using an RRAS Server..................................................................473
Summary....................................................................................480
Best Practices...............................................................................481
From the Library of Robert Ryan
x Windows Server 2008 R2 Unleashed
Part V Migrating to Windows Server 2008 R2
16 Migrating from Windows Server 2003/2008 to Windows
Server 2008 R2 483
Beginning the Migration Process.....................................................484
Big Bang Migration.......................................................................487
Phased Migration.........................................................................491
Multiple Domain Consolidation Migration.......................................505
Summary....................................................................................522
Best Practices...............................................................................523
17 Compatibility Testing 525
The Importance of Compatibility Testing.........................................526
Preparing for Compatibility Testing.................................................527
Researching Products and Applications............................................534
Verifying Compatibility with Vendors..............................................537
Microsoft Assessment and Planning (MAP) Toolkit.............................542
Lab-Testing Existing Applications....................................................543
Documenting the Results of the Compatibility Testing.......................546 ptg
Determining Whether a Prototype Phase Is Required..........................546
Summary....................................................................................547
Best Practices...............................................................................548
Part VI Windows Server 2008 R2 Administration and Management
18 Windows Server 2008 R2 Administration 549
Defining the Administrative Model.................................................550
Examining Active Directory Site Administration................................551
Configuring Sites..........................................................................554
Examining Windows Server 2008 R2 Active Directory Groups..............562
Creating Groups...........................................................................564
Managing Users with Local Security and Group Policies......................568
Managing Printers with the Print Management Console .....................576
Summary....................................................................................582
Best Practices...............................................................................583
19 Windows Server 2008 R2 Group Policies and Policy Management 585
Group Policy Overview..................................................................585
Group Policy Processing—How Does It Work?...................................586
Local Group Policies.....................................................................588
Security Templates........................................................................590
Elements of Group Policy..............................................................591
From the Library of Robert Ryan
