Windows Small Business Server 2011 ®
Administrator’s Companion
Charlie Russel Sharon Crawford
Windows Small Business Server 2011 ®
Administrator’s Companion
Charlie Russel Sharon Crawford
Pub shed w th the author zat on of M crosoft Corporat on by O’Re y Med a, Inc 1005 Gravenste n H ghway North Sebastopo , Ca forn a 95472 Copyr ght © 2011 by Char e Russe and Sharon Crawford A r ghts reserved No part of the contents of th s book may be reproduced or transm tted n any form or by any means w thout the wr tten perm ss on of the pub sher ISBN 978-0-7356-4911-8 1 2 3 4 5 6 7 8 9 TG 6 5 4 3 2 1 Pr nted and bound n Canada M crosoft Press books are ava ab e through bookse ers and d str butors wor dw de If you need support re ated to th s book, ema M crosoft Press Book Support at
[email protected] P ease te us what you th nk of th s book at http://www. microsoft.com/learning/booksurvey M crosoft and the trademarks sted at http://www.microsoft.com/about/legal/en/ us/IntellectualProperty/Trademarks/EN-US.aspx are trademarks of the M crosoft group of compan es A other marks are property of the r respect ve owners The examp e compan es, organ zat ons, products, doma n names, ema addresses, ogos, peop e, p aces, and events dep cted here n are fict t ous No assoc at on w th any rea company, organ zat on, product, doma n name, ema address, ogo, person, p ace, or event s ntended or shou d be nferred Th s book expresses the author’s v ews and op n ons The nformat on conta ned n th s book s prov ded w thout any express, statutory, or mp ed warrant es Ne ther the authors, O’Re y Med a, Inc , M crosoft Corporat on, nor ts rese ers, or d str butors w be he d ab e for any damages caused or a eged to be caused e ther d rect y or nd rect y by th s book Acquisitions Editor: Ken Jones Developmental Editors: Laura Sackerman and Ken Jones Production Editor: Teresa E sey Proofreader: Nancy S xsm th Compositor: Ron B odeau Technical Reviewer: Andrew Edney Copyeditor: Roger LeB anc Indexer: Ange a Howard Cover Design: Tw st Creat ve • Seatt e Cover Composition: Karen Montgomery Illustrator: Robert Romano
For Dana Epp, always a mensch
Contents at a Glance Introduction
xxv
Part I
Preparation and Planning
Chapter 1
Introducing Windows Small Business Server 2011
1
Chapter 2
Understanding 64-Bit Windows
9
Chapter 3
Planning Your SBS Network
19
Chapter 4
Planning Fault Tolerance and Avoidance
45
Part II
Installation and Setup
Chapter 5
Installing Small Business Server 2011
67
Chapter 6
Configuring SBS in Hyper-V
81
Chapter 7
Migrating to Windows Small Business Server 2011 Standard 111
Chapter 8
Completing the Getting Started Tasks
Part III
Performing the Basic Tasks
Chapter 9
Managing Users and Groups
203
Chapter 10
Shares and Permissions
223
Chapter 11
Disk Management
243
Chapter 12
Storage Management
275
Chapter 13
Installing and Managing Printers
315
Chapter 14
Managing Computers on the Network
337
Chapter 15
Managing Software Updates
363
Chapter 16
Configuring Backup
383
181
Part IV
Performing Advanced Tasks
Chapter 17
Windows SBS Console vs. Server Manager
439
Chapter 18
Configuring and Managing Email
469
Chapter 19
Managing Local Connectivity
495
Chapter 20
Managing Remote Access
521
Chapter 21
Using Group Policy
547
Chapter 22
Managing Reports
579
Chapter 23
Customizing a SharePoint Site
597
Part V
Premium Edition Features
Chapter 24
Installing the Second Server
627
Chapter 25
Installing Microsoft SQL Server 2008 R2 Standard Edition for Small Business
657
Chapter 26
Adding a Terminal Server
673
Part VI
Maintenance and Troubleshooting
Chapter 27
Performance Monitoring
711
Chapter 28
Disaster Planning
733
Part VII
Appendices
Appendix A
Introduction to Networks
751
Appendix B
Automating Installation
757
Appendix C
Additional Resources
759
Index
761
Contents Introduction
xxv
Part I
Preparation and Planning
Chapter 1
Introducing Windows Small Business Server 2011
1
W ndows Sma Bus ness Server Ed t ons. . . . . . . . . . . . . . . . . . . . . . . . . . . .
1
What’s New and Improved . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2
Chapter 2
SBS Conso e
3
Remote Web Access
4
Insta at on and M grat on
4
Data Protect on
4
Exchange Server 2010 SP1
5
SharePo nt Foundat on Serv ces 2010
5
Sma Bus ness Server 2011 Prem um Add-on. . . . . . . . . . . . . . . . . . . . . . .
6
Hardware Requ rements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
6
Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
7
Understanding 64-Bit Windows
9
Why the Change? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
10
What Are the Advantages?. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
11
Memory
11
Performance
12
Secur ty. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . V rtua zat on What Are the Cha enges?. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
13 14 15
Dr vers
15
Hardware and Software Cons derat ons
15
What About C ents?. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
17
Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
18 ix
Chapter 3
Planning Your SBS Network
19
P ann ng the Network Infrastructure. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
19
Determ n ng Your Needs
21
Choos ng an Internet Connect on
22
Choos ng a Network Type
25
Choos ng Network Dev ces
28
Choos ng Server Hardware
34
Choos ng C ent Hardware and Software
36
Choos ng Nam ng Convent ons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Choos ng a Doma n Name for the Network
37
Nam ng Computers
39
P ann ng for Secur ty . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Chapter 4
40
Secur ng C ent Computers
41
Secur ng W re ess Networks
43
Secur ng Internet F rewa s
43
Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
44
Planning Fault Tolerance and Avoidance
45
Mean T me to Fa ure and Mean T me to Recover
46 47
Loca Power Supp y Fa ure
48
Vo tage Var at ons
50
Sags
52
Short-Term Power Outages
53
Long-Term Power Outages
53
D sk Arrays. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Contents
40
Ensur ng Phys ca Secur ty
Protect ng the Power Supp y. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
x
37
55
Hardware vs Software
55
RAID Leve s for Fau t To erance
55
Hot-Swap and Hot-Spare D sk Systems
61
Redundant Network ng. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
62
Other Spare Parts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
62
Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
63
Part II
Installation and Setup
Chapter 5
Installing Small Business Server 2011
67
P ann ng . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
67
Chapter 6
P ann ng Part t ons
67
P ann ng Locat on and Network ng
68
Prepar ng the Server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
69
Insta at on . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
70
Insta at on Process
70
Us ng the SBS Answer F e Generator
78
Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
79
Configuring SBS in Hyper-V
81
Hyper-V Overv ew. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
82
Emu at on vs Hyperv sor
83
Requ rements
84
Insta at on . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
86
Insta ng on M crosoft Hyper-V Server R2
87
Insta ng on Fu W ndows Server 2008 R2
89
In t a Configurat on . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
91
Configur ng Networks
91
Server Sett ngs
93
Creat ng a V rtua Mach ne. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
95
Creat ng a Bas c VM
96
Mach ne Sett ngs Work ng w th a V rtua Mach ne. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
101 105
Start ng, Stopp ng, Sav ng, Snapshott ng
105
C pboard
106
SBS n Hyper-V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
107
L cens ng
108
Configurat on
108
Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
109
Contents
xi
Chapter 7
Migrating to Windows Small Business Server 2011 Standard The M grat on Process. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
112
Prepar ng Your Server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
114
Before You Start
114
Back Up Your Ex st ng SBS Server
115
Insta Current Updates
115
Network Configurat on
116
Insta Router and F rewa
124
Configur ng Act ve D rectory
127
Best Pract ces Ana yzer
130
Opt m ze Exchange Ma boxes
133
Runn ng the M grat on Preparat on Too
134
Creat ng a M grat on Answer F e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Chapter 8
xii
Contents
111
139
Adm n strator Account
139
Us ng the SBS Answer F e Generator
142
Insta ng SBS 2011 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
145
M grat ng Sett ngs and Data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
146
Us ng the M grat on W zard
147
Re-Enab ng Fo der Red rect on
176
F na Thoughts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
178
Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
179
Completing the Getting Started Tasks
181
F n sh the Insta at on. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
182
Connect to the Internet. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
182
Customer Feedback Opt ons. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
184
Set Up Your Internet Address . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
185
Reg ster ng a New Doma n Name
185
Us ng an Ex st ng Doma n Name
188
Manag ng Your Doma n Name
192
Configure Ema
193
Add a Trusted Cert ficate
193
Protect Your Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
199
Add Users, Computers, and Dev ces . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
199
Network Essent a s Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
199
Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
200
Part III
Performing the Basic Tasks
Chapter 9
Managing Users and Groups
203
Understand ng Groups. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
203
Creat ng Groups. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
205
Sett ng Up a D str but on Group
205
Creat ng a Secur ty Group
206
Work ng w th Groups. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
208
Bu t-In Un versa Groups
209
Bu t-In Doma n Loca Groups
209
Bu t-In G oba Groups
212
Manag ng User Ro es. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
213
The Standard User Ro e
214
The Standard User w th Adm n strat on L nks
215
Network Adm n strator Ro e
215
Creat ng a New User Ro e
215
Add ng a New User Account. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
217
Add ng Mu t p e User Accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
220
G v ng Users Access to Computers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
221
Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
222
Contents
xiii
Chapter 10
Shares and Permissions Share Perm ss ons vs F e Perm ss ons. . . . . . . . . . . . . . . . . . . . . . . . . . . .
223
F e Perm ss ons
224 225
How Perm ss ons Work
227
Cons der ng Inher tance
228 229
Remov ng a Shared Fo der
233
Chang ng Share Perm ss ons
234
Spec a Shares. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ownersh p and How It Works Effect ve Perm ss ons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Factors Cons dered n Determ n ng Effect ve Perm ss ons
235 236 238 239
Defin ng User R ghts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
240
Manag ng Defau t User R ghts Ass gnments . . . . . . . . . . . . . . . . . . . . . .
241
Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
242
Disk Management
243
The Search for D saster Protect on. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
244
Choos ng the Storage So ut on for Your Network. . . . . . . . . . . . . . . . . .
248
Storage Connect on Techno og es
249
Manag ng D sks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
250
Part t ons and Vo umes
252
Add ng a Part t on or Vo ume
253
Extend ng or Shr nk ng a Vo ume
263
Add ng a M rror
267
Dr ve Fa ure n a M rrored Vo ume
268
Break ng a M rror
271
RAID-5 Vo umes
271
Mount ng a V rtua Hard D sk
272
Mount ng a Vo ume
273
Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Contents
225
What Perm ss ons Mean
Add ng a Shared Fo der. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
xiv
223
Share Perm ss ons NTFS Perm ss ons. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Chapter 11
223
274
Chapter 12
Storage Management D str buted F e System. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
275
DFS Term no ogy
276
Namespace Type
277
Namespace Server Requ rements
278
Namespace C ent Requ rements
278
DFS Rep cat on
279
F e Rep cat on Serv ce
279
Rep cat on Topo og es
280
Insta ng DFS Management
281
Creat ng or Open ng a Namespace Root
283
Add ng Namespace Servers
285
Add ng DFS Fo ders
285
Chang ng Advanced Sett ngs
287
Back ng Up and Restor ng the DFS Fo der Targets
289
Us ng DFS Rep cat on
290
Us ng F e Server Resource Manager. . . . . . . . . . . . . . . . . . . . . . . . . . . . .
296
Schedu ng Storage Reports
296
Us ng D rectory Quotas
300
Creat ng Quotas and Auto Quotas
301
V ew ng and Manag ng Quotas
302
Creat ng and Ed t ng Quota Temp ates
303
Screen ng F es
306
Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Chapter 13
275
Installing and Managing Printers
313
315
Understand ng Pr nt Servers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
315
Se ect ng Pr nters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
316
P ann ng Pr nter P acement. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
317
Nam ng Pr nters
318
Nam ng Pr nter Locat ons
318
Insta ng Pr nters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
319
Add ng and Shar ng a Network Pr nter
320
Shar ng Loca y Connected Pr nters
324 Contents
xv
Add ng C ent Dr vers for Shared Pr nters. . . . . . . . . . . . . . . . . . . . . . . . . Manag ng Pr nters from W ndows SBS
326
Manag ng Pr nters from the Command L ne
327
Sett ng Secur ty Opt ons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
328
Group Pr or t es and Pr nter Ava ab ty
329
Sett ng Up a Pr nter Poo . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
331
Configur ng Pr nt Spoo ng. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
332
Us ng the Fax Serv ce. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
333
Add ng a Fax Modem
333
Start ng and Configur ng the Fax Serv ce
334
Manag ng Fax Users and Adm n strators
336
Managing Computers on the Network Connect ng Computers to the Network. . . . . . . . . . . . . . . . . . . . . . . . . .
337 337 338
Estab sh ng Bas c Network Connect v ty
338
Us ng the Sma Bus ness Server Connect Computer W zard
342
Connect ng A ternate C ents
349
Connect ng to RWA Manag ng Computers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
351 352 354
V ew ng and Mod fy ng C ent Computer Sett ngs
356
Remote y Manag ng Computers
358
Remov ng Computers from the Network
361
Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Contents
336
Creat ng Computer Accounts
Us ng Remote Web Access
xvi
328
Determ n ng Pr nter Ava ab ty
Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Chapter 14
325
362
Chapter 15
Managing Software Updates Why Patch ng Is Important. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
364
The Patch ng Cyc e . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
365
Assess
366
Ident fy
367
Eva uate and P an
368
Dep oy
369
Repeat
370
Us ng SBS Software Updates. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Chapter 16
363
370
Configur ng Software Update Sett ngs
370
Dep oy ng Updates
376
Th rd-Party So ut ons. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
381
Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
381
Configuring Backup Configur ng the Backup Serv ce. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
383 383
W ndows Server Backup Us ng SBS W zards
385
W ndows Server Backup Us ng Nat ve Too s
391
Us ng the Backup Once W zard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
395
Recover ng Backups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
399
Recover ng Your Server
400
Recover ng Vo umes
400
Recover ng F es and Fo ders from the Loca Server
401
Recover ng F es and Fo ders from Another Server
403
Recover ng App cat ons and Data
404
Recover ng the Operat ng System
406
Restor ng a Backup Cata og
411
Us ng the Command L ne to Manage Backups. . . . . . . . . . . . . . . . . . . .
412
Us ng the W ndows Serverbackup PowerShe Snap- n
413
Us ng the Wbadm n Command
416
W ndows Storage Server 2008 R2 Essent a s . . . . . . . . . . . . . . . . . . . . . . Configur ng W ndows Storage Server 2008 R2 Essent a s for an SBS Network Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
422 423 435 Contents
xvii
Part IV
Performing Advanced Tasks
Chapter 17
Windows SBS Console vs. Server Manager Add ng (and Remov ng) Ro es and Features. . . . . . . . . . . . . . . . . . . . . . .
441
Add ng and Remov ng Ro es
441
Add ng and Remov ng Ro e Serv ces
450
Add ng and Remov ng Features
454
Add ng Features
455 458
Us ng Server Manager
461
D rect y Open ng Nat ve Conso es
464
Configuring and Managing Email Bas c Ema Configurat on . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Configur ng Internet Ma POP3 Ema . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
469 469 470 474 475
Sett ng POP3 Retr eva Frequency
477 478
Us ng Contacts
479
Add ng an Add t ona Ema Doma n Name
486
Chang ng the Max mum Message S ze
493
Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Managing Local Connectivity DHCP and DNS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
494
495 496
Manag ng DHCP
496
Manag ng DNS
503
W re ess Connect v ty. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Contents
467
Add ng a POP3 Account Advanced Ema Configurat on. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
xviii
457
Us ng the Advanced Mode of the W ndows SBS Conso e
Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Chapter 19
439
Ro es, Ro e Serv ces, and Features
Us ng the Nat ve Conso es. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Chapter 18
439
508
W ndows F rewa . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Chapter 20
Sett ng F rewa Po c es Us ng Group Po cy
512
F rewa Ru e Bas cs
513
F x ng Network Prob ems. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
519
Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
520
Managing Remote Access Remote Web Access. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
521 521
Configur ng the RWA Computer L st
523
Enab ng or D sab ng a User for RWA
530
RWA L nks L st
533
V rtua Pr vate Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Chapter 21
511
538
Enab ng VPNs
539
Configure VPN Perm ss ons
541
F x ng Network Prob ems. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
542
Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
546
Using Group Policy
547
Components of Group Po cy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
548
Group Po cy Objects. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
548
Manag ng Group Po c es. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
549
Order of Inher tance
551
Order of Imp ementat on
552
Creat ng a Group Po cy Object . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
553
De et ng a Group Po cy Object . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
554
Manag ng Group Po cy L nks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
555
Sett ng the Scope of the GPO
555
Enab ng and D sab ng GPO L nks
556
D sab ng a Branch of a GPO
557
Refresh ng Group Po cy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
557
Back ng Up a Group Po cy Object. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
559
Restor ng a Group Po cy Object . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
560
Contents
xix
Dep oy ng App cat ons w th Group Po cy. . . . . . . . . . . . . . . . . . . . . . . . Pub sh or Ass gn App cat ons
561
Creat ng a Software D str but on Po nt
562
Creat ng a GPO for Software Dep oyment
563
Configur ng the Group Po cy Software Insta at on Extens on
564
Group Po cy Preferences. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Chapter 22
571
Configur ng Common Opt ons
574
Us ng Group Po cy Preferences for Contro Pane
575
Us ng Group Po cy Resu ts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
576
Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
578
Managing Reports
579 580
Custom z ng the Deta ed Network Report
582
Creat ng a New Report
584
A erts for Serv ces
585 586
Performance Counter A ert
587
Event Log Error A erts
588
Creat ng Custom A erts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
588
Creat ng an A ert for a Stopped Serv ce
589
Custom A ert for Backup Fa ure
594
Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Customizing a SharePoint Site
595
597
Introduc ng SharePo nt Foundat on 2010. . . . . . . . . . . . . . . . . . . . . . . . .
597
Understand ng SharePo nt Items
598
Understand ng SharePo nt Ro es
599
Custom z ng Companyweb. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
606
Add ng a Workspace
606
Add ng RemoteApps L nks
613
Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Contents
579
Custom z ng the Summary Report
Configur ng A erts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
xx
568
Us ng Group Po cy Preferences for W ndows
Network Reports. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Chapter 23
560
624
Part V
Premium Edition Features
Chapter 24
Installing the Second Server
Chapter 25
M n mum System Requ rements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
627
Insta at on and In t a Configurat on. . . . . . . . . . . . . . . . . . . . . . . . . . . . .
629
Insta at on
630
In t a Configurat on
636
Custom z ng the Server
648
C os ng the In t a Configurat on Tasks W zard. . . . . . . . . . . . . . . . . . . . .
654
Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
655
Installing Microsoft SQL Server 2008 R2 Standard Edition for Small Business Insta at on Opt ons. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Chapter 26
627
657 657
Insta at on Restr ct ons
658
Insta ng SQL Server (Part One). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
658
P ann ng
659
Insta at on
662
Ma ntenance
663
Too s
663
Resources
663
Advanced
664
Opt ons
665
Insta ng SQL Server (Part Two). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
665
Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
671
Adding a Terminal Server New Remote Desktop Serv ces Features. . . . . . . . . . . . . . . . . . . . . . . . . .
673 673
RD Gateway
674
RemoteApps
674
RD Web Access
674
Contents
xxi
Concepts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Remote Access
675
Centra Management
676
L cens ng
677
Insta ng the Remote Desktop Serv ces Ro e. . . . . . . . . . . . . . . . . . . . . .
678
Configur ng RD L cens ng . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
688
Insta ng Remote Desktop L cens ng
688
Ass gn ng the L cens ng Server and L cens ng Mode
692
Configur ng RemoteApps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
694
RemoteApp Manager
695
Dep oy ng w th rdp and ms fi es
698
Add ng a RemoteApp to Remote Web Workp ace. . . . . . . . . . . . . . . . .
700
Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
708
Part VI
Maintenance and Troubleshooting
Chapter 27
Performance Monitoring Resource Mon tor Overv ew. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
712 716
Troub eshoot ng Troub esome App cat ons
716 717
Add ng Performance Counters
718
Chang ng the Performance Mon tor D sp ay
719
Sav ng the Performance Mon tor D sp ay
720
Us ng Re ab ty Mon tor. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . V ew ng Re ab ty Mon tor on a Remote Computer
720 721
Creat ng a Data Co ector Set. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
721
Manag ng Co ected Data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
727
Work ng w th Data Log F es
Contents
711
F ter ng Informat on from Resource Mon tor Us ng Performance Mon tor. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
xxii
675
729
V ew ng Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
730
Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
731
Chapter 28
Disaster Planning P ann ng for D saster. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
733
Ident fy ng the R sks
735
Ident fy ng the Resources
736
Deve op ng the Responses
736
Test ng the Responses
740
Iterat ng
741
Prepar ng for a D saster. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
742
Sett ng Up A Fau t-To erant System
742
Backups
743
Restor ng from Backup. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
743
V rtua zat on and D saster P ann ng. . . . . . . . . . . . . . . . . . . . . . . . . . . . .
747
No USB Support
747
Hardware Independence
748
Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Part VII
733
748
Appendices
Appendix A Introduction to Networks
751
Servers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
751
C ents. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
752
Med a Connect ng Servers and C ents. . . . . . . . . . . . . . . . . . . . . . . . . . .
752
Features of the W ndows Operat ng System . . . . . . . . . . . . . . . . . . . . . .
752
Doma ns and Workgroups. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
753
Do Workgroups Work?
753
Defin ng Doma ns
754
Doma n Components
755
Contents
xxiii
Appendix B Automating Installation
757
Appendix C Additional Resources
759
M crosoft Resources. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
759
Other Resources for SBS Users and Consu tants. . . . . . . . . . . . . . . . . . .
760
Index
761
What do you think of this book? We want to hear from you! M crosoft s nterested n hear ng your feedback so we can cont nua y mprove our books and earn ng resources for you. To part c pate n a br ef on ne survey, p ease v s t:
microsoft.com/learning/booksurvey
xxiv
Contents
Introduction I
f you run a sma bus ness, you don’t need us to te you that the h gh y compet t ve marketp ace, unpred ctab e econom c cyc es, t me pressures, and technoog ca demands are constant y exert ng pressure on your bottom ne
Your bus ness needs the same techno og es that arge compan es do You need the ab ty to share nformat on w th customers, partners, and emp oyees You have the same worr es about spam, ma ware, and secur ty And you have the same need to manage resources and emp oyee access to those resources The major d fference s you probab y don’t have the uxury of an n-house IT staff W ndows Sma Bus ness Server (SBS) 2011 a ows sma bus nesses to operate at the same techno ogy eve as much arger organ zat ons, but w thout the added costs of ma nta n ng a network adm n strat on department Windows Small Business Server 2011 Administrator’s Companion s a reference, ass stant, and coach for the busy network adm n strator, whether the adm n strator s on the scene or access ng the network from another ocat on
Conventions Even though W ndows Sma Bus ness Server 2011 has automated many, many of the tasks assoc ated w th configur ng and secur ng a network, th s book s requ red when you want to do someth ng s ght y out of the ord nary—or when you need add t ona understand ng of what a w zard s do ng Look for book e ements such as these Under the Hood Because w zards are so effic ent at what they do, t can be very d fficu t to know what’s go ng on n the background S debars t t ed “Under the Hood” descr be the techn ca operat ons be ng performed by the w zard These s debars a so nc ude methodo og ca nformat on to he p you understand W ndows Sma Bus ness Server Real World Everyone can benefit from the exper ences of others “Rea Wor d” s debars conta n e aborat on on a part cu ar theme or background based on the adventures of other users of W ndows Sma Bus ness Server
xxv
Note Notes include tips as well as alternative ways to perform a task or
information that needs to be highlighted.
Important Information marked Important shouldn’t be skipped. (That’s
why these elements are called Important.) Here you’ll find security notes, cautions, and warnings to keep you and your network out of trouble.
What’s in This Book Windows Small Business Server 2011 Administrator’s Companion s d v ded nto seven parts The first four parts rough y correspond to the deve opmenta phases of a W ndows Sma Bus ness Server network Part V dea s w th Prem um Add-on features, and Part VI covers ma ntenance and troub eshoot ng The ast part s made up of append ces w th he pfu nformat on Part I, Preparation and Planning P ann ng and preparat on are the sine qua non for any k nd of network It comes down to the o d say ng, “If you don’t have the t me to do t r ght, how w you find the t me to do t over?” Chapters 1 through 4 are a about do ng t r ght the first t me Part II, Installation and Setup Chapters 5 through 8 take you through the process of nsta ng W ndows Sma Bus ness Server and perform ng n t a configurat ons us ng the Gett ng Started Tasks Th s sect on nc udes he pfu chapters on configur ng W ndows SBS v rtua zat on and m grat ng from W ndows SBS 2003 Part III, Performing the Basic Tasks Chapters 9 through 16 cover the day-today tasks n runn ng a network configur ng d sks, sett ng up user accounts, arrang ng the shar ng of nformat on among users, add ng and remov ng computers and pr nters, manag ng software updates, and back ng up and restor ng data Part IV, Performing Advanced Tasks Chapters 17 through 23 prov de ns ght and nformat on about manag ng ema , connect v ty techno og es, and us ng Group Po cy In th s part, you’ a so find chapters about sett ng up and manag ng a SharePo nt s te Part V, Premium Edition Features Chapters 24 through 26 address features found the n W ndows SBS 2008 Prem um Add-on These chapters are about nsta ng a second server, nsta ng M crosoft SQL Server, and add ng term na servers to your network xxvi
Introduction
Part VI, Maintenance and Troubleshooting Chapter 27 covers the extens ve brary of mon tor ng too s ava ab e n W ndows Sma Bus ness Server, and Chapter 28 s a about how you save your bus ness, your network, and yourse f n the face of the many var et es of d saster that can affl ct networks Part VII, Appendices The fina part cons sts of append ces w th supp ementa nformat on Th s nc udes an ntroduct on to network ng, nstruct ons for automat ng nsta at on, and a st of resources for the users of W ndows SBS 2011
About the Companion Web Content The compan on content for th s book conta ns W ndows PowerShe scr pts for common adm nstrat ve tasks These fi es can be down oaded from the web at http://go.microsoft.com/FWLink/?Linkid=217073 Fu documentat on of the contents and structure of the compan on fi es can be found n the Readme txt fi e For nstruct ons on access ng the on ne ed t on of th s book, see "How to Access Your On ne Ed t on Hosted by Safar "
How to Access Your Online Edition Hosted by Safari The voucher bound n to the back of th s book g ves you access to an on ne ed t on of the book (You can a so down oad the on ne ed t on of the book to your own computer; see the next sect on ) To access your on ne ed t on, do the fo ow ng 1. Locate your voucher ns de the back cover, and scratch off the meta c fo
to revea your access code 2. Go to http://microsoftpress.oreilly.com/safarienabled 3. Enter your 24-character access code n the Coupon Code fie d under Step 1
(P ease note that the access code n th s mage s for ustrat on purposes on y ) Introduction
xxvii
4. C ck the CONFIRM COUPON button
A message w appear to et you know that the code was entered correct y If the code was not entered correct y, you w be prompted to re-enter the code
5. In th s step, you’ be asked whether you’re a new or ex st ng user of Safar
Books On ne Proceed e ther w th Step 5A or Step 5B
5A. If you a ready have a Safar account, c ck the EXISTING USER – SIGN IN
button under Step 2
5B. If you are a new user, c ck the NEW USER – FREE ACCOUNT button
under Step 2 ■
You’ be taken to the “Reg ster a New Account” page
■
Th s w requ re fi ng out a reg strat on form and accept ng an End User Agreement
■
When comp ete, c ck the CONTINUE button
6. On the Coupon Confirmat on page, c ck the My Safar button 7. On the My Safar page, ook at the Bookshe f area and c ck the t t e of the
book you want to access
xxviii
Introduction
How to Download the Online Edition to Your Computer In add t on to read ng the on ne ed t on of th s book, you can a so down oad t to your computer F rst, fo ow the steps n the preced ng sect on After Step 7, do the fo ow ng 1. On the page that appears after Step 7 n the prev ous sect on, c ck the
Extras tab 2. F nd “Down oad the comp ete PDF of th s book,” and c ck the book t t e
A new browser w ndow or tab w d a og box
open, fo owed by the F e Down oad
3. C ck Save 4. Choose Desktop and c ck Save 5. Locate the z p fi e on your desktop R ght-c ck the fi e, c ck Extract A , and
then fo ow the nstruct ons Introduction
xxix
Note If you have a problem with your voucher or access code, please contact
[email protected], or call 800-889-8969, where you’ll reach O’Reilly Media, the distributor of Microsoft Press books.
Acknowledgments As most peop e know, the creat on of a book s a co aborat ve process The nksta ned wretches who do the actua wr t ng are on y part of a arge and mu t ta ented team F rst, thanks to the numerous peop e at M crosoft who were of great ass stance Kev n Beares he ped us many t mes n ways from sma to very arge Thanks to Sean Dan e s of the SBS product group for more th ngs than we can remember Sean was the first ca whenever we needed someth ng beyond the ord nary Thanks to Jonas Svensson for be ng respons ve and effect ve when we needed bu ds and resources And much grat tude to the ent re SBS Product Group for g v ng us a great product and for pu ng out a the stops to get us what we needed They rea y went above and beyond Thanks to Greg Starks of Hew ett-Packard for h s support of the SMB commun ty, and n part cu ar h s support of our HP server when we needed t Of course, the peop e at M crosoft Press are the ones that rea y made the book poss b e In part cu ar sen or ed tor Ken Jones, project ed tor Laura Sackerman, and techn ca ed tor Andrew Edney, as we as Teresa E sey (product on ed tor), Sum ta Mukherj (vendor coord nator), Ron B odeau (compos tor), Rob Romano ( ustrator), and the rest of the product on team We owe a true debt to Roger LeB anc, who ed ted th s book w th a know ng and carefu hand It’s a much better book because of h s efforts Add t ona and s ncere thanks to R chard S ddaway for h s b og post on W ndows Server Backup and the PowerShe Snap- n for t And to Sean Wa br dge, SharePo nt MVP, whose he p n sort ng through the changes n how SharePo nt Foundat on 2010 behaved w th Web Parts was nd spensab e
xxx
Introduction
Errata We have made every effort to ensure the accuracy of th s book and ts companon content If you do find an error, p ease report t on our M crosoft Press s te at ore y com 1. Go to http://microsoftpress.oreilly.com 2. In the Search box, enter the book’s ISBN or t t e 3. Se ect your book from the search resu ts 4. On your book’s cata og page, under the cover mage, you w
see a st of
nks 5. C ck V ew/Subm t Errata
You w find add t ona nformat on and serv ces for your book on ts cata og page If you need add t ona support, p ease ema M crosoft Press Book Support at ms nput@m crosoft com P ease note that product support for M crosoft software s not offered through the addresses above
We Want to Hear from You At M crosoft Press, your sat sfact on s our top pr or ty and your feedback our most va uab e asset P ease te us what you th nk of th s book at http://www.microsoft.com/learning/booksurvey The survey s short, and we read every one of your comments and deas Thanks n advance for your nput!
Stay in Touch Let us keep the conversat on go ng! We are on Tw tter http://twitter.com/Microsoft
Introduction
xxxi
Part I
Preparation and Planning CHAPTER 1
Introduc ng W ndows Sma Bus ness Server 2011 1
CHAPTER 2
Understand ng 64-B t W ndows 9
CHAPTER 3
P ann ng Your SBS Network 19
CHAPTER 4
P ann ng Fau t To erance and Avo dance 45
CHAPTER 1
Introducing Windows Small Business Server 2011 T
here’s an oft-repeated story that the head of the U S Patent Office n 1899 dec ared that the office shou d be c osed because “Everyth ng that can be nvented has been nvented ” A as for the egend, Char es H Due never sa d anyth ng of the k nd Due was, n fact, a great be ever n the creat v ty of nventors He a so knew that evo ut onary change was every b t as va uab e as revo ut onary change In our t me, the evo ut on of M crosoft W ndows Sma Bus ness Server from ts ncept on to the atest vers on n 2011 has been an order y progress on of mprovements both arge and sma —and the tota d stance covered s mmense
Windows Small Business Server Editions W ndows Sma Bus ness Server s ava ab e n two ed t ons Standard and Essent a s The Standard ed t on s the vers on covered n th s book It’s the dea so ut on for sma bus nesses w th up to 75 users Note Windows Small Business Server Essentials is a new, first-server solution for
small businesses (up to 25 users) that can seamlessly integrate into online services such as Microsoft Office 365, cloud backup solutions, and cloud management solutions. It is expected to be released in the first half of 2011.
A so ava ab e s the W ndows Sma Bus ness Server Prem um Add-on, wh ch nc udes a second W ndows Server 2008 R2 cense and M crosoft SQL Server 2008 R2 techno og es
1
What’s New and Improved Probab y the best new “feature” n W ndows SBS 2011 s that t’s bu t on W ndows Server 2008 R2 You get a the advantages of W ndows Server 2011—h gh eve s of secur ty and contro over your network, soph st cated report and management too s, and enhanced access to ema , the Internet, and bus ness app cat ons—a n a s ng e, ntegrated, ow-ma ntenance package In add t on to great hardware and sca ng features and eas er v rtua zat on, you’ a so have ■
A stra ghtforward nterface des gned for sma bus nesses
■
An eas er nsta at on and m grat on process
■
Remote Access for s mp e access a most anywhere
■
A hea th-mon tor ng nfrastructure that ana yzes both server and c ent we -be ng
64-Bit Architecture
T
he major shift for Windows SBS Server from 2003 to 2008 was from 32-bit architecture to 64-bit. The 64-bit architecture continues in SBS 2011. When
Microsoft Exchange Server 2007 was released in a 64-bit version only, the shift was inevitable. It’s also a desirable shift. The 32-bit version of Windows was rapidly coming up against its own limitations. A 32-bit operating system is limited to 4 gigabytes (GB) of RAM (random access
memory). A 64-bit operating system can have up to 32 GB of RAM. That, in and of itself, is a significant difference. But the real difference is in the area of address space. Vastly increased amounts of address space help minimize the time spent swapping processes in and out of memory by storing more of those processes in RAM rather than on the hard disk. This, in turn, can increase overall program performance. A 32-bit computer works very well for most programs, however. For example, spreadsheet programs, web browsers, and word-processing programs will run at about the same speed on either a 32-bit or 64-bit computer. However, when you’re running a server and hosting multiple clients, a mail server, and shared applications and files, a 64-bit computer is much preferred. For more on how 64-bit architecture works, see Chapter 2, “Understanding 64-Bit Windows.”
2 CHAPTER 1
Introducing Windows Small Business Server 2011
SBS Console When you nsta W ndows SBS 2011, you’ mmed ate y not ce that the nterface nc udes SBS Conso e (shown n F gure 1-1), a centra organ zat ona po nt from wh ch you can perform many adm n strat ve tasks assoc ated w th W ndows SBS
Figure 1-1 The W ndows SBS Standard Conso e
Note A shortcut to the console is automatically placed on the server desktop.
From Users And Groups at the top of the conso e w ndow, you can add users and groups as we as configure these objects S m ar y, c ck Network to add or remove computers, manage dev ces such as pr nters, and configure your Internet connect on and other network ng features Other areas of the conso e connect you to the too s for shared fo ders, backup, report generat on, and secur ty Chapter 17, “W ndows SBS Conso e vs Server Manager,” prov des more nformat on on the use of SBS Conso e
What’s New and Improved
CHAPTER 1
3
Remote Web Access Former y known as Remote Web Workp ace (RWW), the new Remote Web Access (RWA) has many p uses, a few of wh ch are ■
The ab ty to remote y access shared fo ders
■
Secure, anywhere access to your fi es and documents through any common web browser
■
The ab ty to connect to the PCs n your network and even run app cat ons from v rtua y any ocat on
■
A new nterface that adm n strators can reorgan ze w thout programm ng know edge
■
Fu Out ook Web Access (OWA) support
Chapter 20, “Manag ng Remote Access,” covers the new features and uses of Remote Web Access
Installation and Migration Whether you’re upgrad ng or nsta ng a new server, SBS 2011 Standard makes t s mp e In add t on to the fam ar W ndows nterface, you’ a so get ■
A much s mp fied setup procedure w th comp ete gu dance for configur ng the server, and the Internet and doma n configurat on for each connected PC
■
The ab ty to et users connect the r own PC—w thout requ r ng an adm n strator
■
Enhanced source server va dat on too s for better preparat on for m grat on
■
Automat c adm n strat on of your Internet doma n name
Insta at on deta s are n Chapter 5, “Insta ng Sma Bus ness Server 2011 ” The procedures for m grat on are n Chapter 7, “M grat ng to W ndows Sma Bus ness Server 2011 Standard ”
Data Protection Everyone agrees that the eas est way to protect your data s to back t up at frequent nterva s SBS 2011 makes th s chore a good dea eas er by conduct ng automat c, da y backups of every computer and server on the network Restorat on of nd v dua fi es, fo ders, or an ent re computer s fa r y eas y done us ng uncomp cated d saster recovery too s The fu story on sett ng up and us ng backup s found n Chapter 16, “Configur ng Backup ”
4 CHAPTER 1
Introducing Windows Small Business Server 2011
Exchange Server 2010 SP1 SBS 2011 Standard features the powerfu new M crosoft Exchange Server 2010 SP1 W th th s upgrade from Exchange Server 2007, you’ have ■
The enhanced Out ook Web Access (OWA), wh ch m rrors M crosoft Office Out ook more c ose y than ever
■
The mproved Exchange Management Conso e for a s ng e p ace to manage a your ema tasks
■
Automat c detect on and repa r of corrupted ma boxes and databases
■
New features that he p users organ ze the r nboxes effic ent y
■
The ab ty to set retent on po c es and tags through a stra ghtforward nterface, and dep oyment opt ons for ro es and features
■
New arch v ng opt ons, such as defin ng when ema data exp res, dep oyment ru es, and how to prov s on persona arch ves to a d fferent database
■
New transport secur ty ru es to protect sens t ve bus ness nformat on
“Configur ng and Manag ng Ema ,” Chapter 18, covers Exchange Server 2010 SP1 and a aspects of ema
SharePoint Foundation Services 2010 SBS 2011 Standard features M crosoft SharePo nt Foundat on Serv ces 2010—the newest vers on of M crosoft W ndows SharePo nt Serv ces—w th features and capab t es that he p you co aborate secure y on ne—from any ocat on You’ have ■
An mproved Remote Web Access (forma y Remote Web Workp ace) that a ows you to share nterna documents, harmon ze ca endars, manage ssues, and part c pate n d scuss ons—no matter where you are
■
The ab ty to conso date ntranet s tes nto a s ng e on-prem ses ocat on
■
Qu ck methods for produc ng secure and s mp e so ut ons for your spec fic needs
■
Bu t- n mon tor ng, a erts, and adm n strat ve too s for SharePo nt
Us ng SharePo nt s covered n Chapter 23, “Custom z ng a SharePo nt S te ”
What’s New and Improved
CHAPTER 1
5
Small Business Server 2011 Premium Add-on When you have m ted IT resources but st need to run a arge number of app cat ons, the W ndows Sma Bus ness Server 2011 Prem um Add-on can save the day The Prem um Addon conta ns ■
An add t ona cense for W ndows Server 2008 R2 Standard, wh ch a ows you to dep oy another server on your W ndows SBS 2011 network
■
M crosoft SQL Server 2008 R2 for Sma Bus ness, wh ch nc udes a range of features that can he p organ zat ons make the most of the r nformat on w th better too s for deve opment, manageab ty, bus ness nte gence, and data warehous ng SQL Server 2008 R2 for Sma Bus ness has the same capab t es as SQL Server 2008 R2 Standard; however, t s ava ab e to use on y n the SBS 2011 env ronment
An add t ona server adds great flex b ty to a Sma Bus ness Server network, nc ud ng the potent a for a second doma n contro er An add t ona server can be used for mu t p e bus ness app cat ons, remote desktop serv ces, or v rtua zat on
Hardware Requirements The hardware requ rements for W ndows SBS Server are deta ed n Tab es 1-1 and 1-2 Actua requ rements can vary based on your system configurat on and the app cat ons and features you need to use Processor performance s dependent on not on y the c ock frequency of the processor, but a so the number of cores and the s ze of the processor cache As a ways, d sk space requ rements for the system part t on are approx mate Add t ona ava ab e hard-d sk space m ght be requ red f you are nsta ng over a network Table 1-1 Hardware requ rements for W ndows Sma Bus ness Server 2011 Standard
Hardware
Minimum Requirement
Processor
Quad core 2 GHz 64-b t (x64) or faster; 1 socket (4 sockets max mum)
Phys ca memory (RAM)
8 GB m n mum 10 GB recommended m n mum (32 GB max mum)
Storage capac ty
120 GB
DVD ROM dr ve
DVD ROM dr ve
Network adapter
One 10/100 Ethernet adapter
Mon tor and v deo adapter
Super VGA (SVGA) mon tor and v deo adapter w th 1024 x 768 or h gher reso ut on
6 CHAPTER 1
Introducing Windows Small Business Server 2011
Hardware
Minimum Requirement
Network dev ces
A router or firewa dev ce that supports IPv4 NAT
Internet connect on
W ndows SBS 2011 Standard requ res that you connect the server to the Internet
These m n mums are defin te y m n ma —part cu ar y the m n mum 8 GB of phys ca memory Even on a sma network, 10 GB s the east amount of RAM you’ need f your users are to be reasonab y content Table 1-2 Hardware requ rements for Prem um Add On server cense
Component
Requirement
Processor
M n mum S ng e processor w th 1 4 GHz (x64 processor) or 1 3 GHz (Dua Core)
Memory
M n mum 512 MB RAM Max mum 32 GB
D sk Space Requ rements
M n mum 32 GB or greater
D sp ay
Super VGA (800 × 600) or h gher reso ut on mon tor
Other
DVD Dr ve, Keyboard, and M crosoft Mouse (or compat b e po nt ng dev ce), and Internet access (fees may app y)
Summary In th s chapter we covered some—far from a —of the h gh po nts n W ndows Sma Bus ness Server 2011 In the next chapter, you start the process of deve op ng and ma nta n ng a h ghperform ng network
Summary
CHAPTER 1
7
CHAPTER 2
Understanding 64-Bit Windows I
f you’ve been runn ng M crosoft W ndows Sma Bus ness Server (SBS) 2008, you’ve a ready made the change to 64-b t W ndows when you m grated to SBS 2008 But for a ot of fo ks st runn ng SBS 2003, the move to W ndows Sma Bus ness Server 2011 Standard (SBS 2011) s a eap nto a who e new wor d of 64-b t comput ng SBS 2011 s a comp ete arch tectura change from SBS 2003— t s bu t on the 64-b t vers on of W ndows Server 2008 R2 Th s s a rad ca change for those who have been usng on y 32-b t W ndows Gone are the memory constra nts nherent n 32-b t W ndows, and w th them some of the m tat ons nherent n SBS In th s chapter, we’ cover some under y ng reasons for the change to 64-b t, how t affects what you can (and can’t) do w th SBS 2011, and how th s change w a so affect the c ents on your SBS network
Real World Overcoming the Fear Factor
W
e’ve been running 64-bit Windows—first as Windows XP Professional x64 Edition and now with Windows 7 and Windows Server 2008
R2—since early in 2005, and we have to admit, it was a bit of a struggle early on. Drivers were the biggest issue because all drivers had to be rewritten for 64-bit. But careful selection of hardware solved that issue, and we were up and running. What we quickly figured out was that pretty much all our programs worked— just as we expected them to. They were just as fast (in some cases, a bit faster), and the few things that didn’t work were predictable and expected. But even more important was that Windows XP Professional x64 Edition looked, felt, and behaved just like our familiar 32-bit Windows XP Professional. Oh, there were a few differences, but they were trivial compared to the similarities. Windows XP x64 just felt “right.” And now with Windows 7, the differences between 32-bit and 64-bit are difficult to even find.
9
On the Windows Server side, the driver issues are pretty much long gone. It would be hard today to buy any server-class computer that doesn’t support 64-bit Windows. SBS 2011 will work on virtually any server you buy today, with the obvious exception of one based on Intel’s Itanium processor. Those servers are 64-bit, but they have a completely different architecture and are entirely focused on the enterprise side of the server market.
Why the Change? The first quest on most users ask about the move to 64-b t for W ndows Sma Bus ness Server s “Why?” A s mp e answer s because M crosoft Exchange s ava ab e on y on 64-b t W ndows Server, and now M crosoft no onger supports 32-b t vers ons for any server operat ng system But the rea answer s a b t more comp ex W ndows Sma Bus ness Server 2003, wh ch s 32-b t on y, runs adequate y on current, 64-b t-capab e server hardware Our ma n server here s a Hew ett Packard (HP) ML350G5 It s fu y 64-b t-capab e, but t can a so run 32-b t W ndows Server, a ow ng us to nsta W ndows Sma Bus ness Server 2003 R2 on t w thout ssue But f we d d that, we’d ose access to most of the 16 g gabytes (GB) of RAM we’ve nsta ed on the server because W ndows Sma Bus ness Server 2003 supports on y 4 GB of RAM W th 64-b t W ndows Sma Bus ness Server 2011 Standard, we can see and use a 16 GB of RAM, and SBS 2011 w actua y support 32 GB of RAM The m tat ons on RAM are espec a y mportant w th SBS because we run so much on a s ng e server Even add ng a second server to offload some of the burden st eaves many SBS 2003 servers memory constra ned The move to 64-b t removes those constra nts and a ows us to use more powerfu servers Tab es 2-1 and 2-2 compare the memory m ts of 32-b t and 64-b t W ndows Server Table 2-1 Genera memory m ts
General Memory Limits
SBS 2003 (32-bit)
64-Bit Windows Server 2008 R2
Tota V rtua Address Space
4 GB
16 terabytes
V rtua Address Space per 32-b t process
2 GB (3 GB f system s booted w th /3GB sw tch, wh ch s not recommended)
4 GB f comp ed w th / LARGEADDRESSAWARE (2 GB otherw se)
V rtua Address Space per 64-b t process
Not app cab e
8 terabytes
Paged Poo
47 MB
128 GB
10 CHAPTER 2
Understanding 64-Bit Windows
General Memory Limits
SBS 2003 (32-bit)
64-Bit Windows Server 2008 R2
Non-Paged Poo
256 MB
128 GB
System PTE
660 MB to 900 MB
128 GB
Table 2-2 Memory m ts for SBS vers ons
Physical Memory and CPU Limits
SBS 2003 (32-bit)
SBS 2008 and SBS 2011 Standard (64-bit)
Phys ca Memory
4 GB
32 GB
Number of CPU Sockets
2
4
Number of CPU Cores
8
48
Note Microsoft counts CPUs according to the number of physical CPU sockets that are
present—not according to the number of cores. With current processors that support 12 cores on a single CPU, Windows Small Business Server 2011 Standard supports 48 cores.
Another cons derat on s that W ndows Server 2008 was the fina vers on of W ndows Server that supported 32-b t The m tat ons of the 32-b t arch tecture and memory mode made the move to 64-b t compe ng, and beg nn ng w th W ndows Server 2008 R2 (the under y ng operat ng system for SBS 2011), there s no onger a 32-b t vers on of W ndows Server
What Are the Advantages? Why the b g push to 64-b t by M crosoft for ts server operat ng systems? Is t just the memory m tat ons of 32-b t, or are there other compe ng reasons? In our op n on, there are four compe ng reasons to use 64-b t for servers memory, performance, secur ty, and v rtua zat on
Memory The 32-b t vers ons of W ndows Server use a flat memory address ng scheme, m t ng them to a 232 address space Th s means a v rtua memory address space of on y 4 GB, wh ch s d v ded nto 2 GB of v rtua memory address space for the operat ng system and 2 GB of v rtua memory address space for app cat ons By contrast, 64-b t vers ons of W ndows Server support 16 terabytes of v rtua memory address space, d v ded equa y between that reserved for the operat ng system and that ava ab e to app cat ons
What Are the Advantages?
CHAPTER 2
11
The actua RAM supported by var ous vers ons of W ndows Server s re ated to, but somewhat d fferent from, the actua memory address space Enterpr se and Datacenter ed t ons of 32-b t W ndows Server use a techn que ca ed Physical Address Extension (PAE) to support arger RAM configurat ons PAE uses a memory address w ndow w th n the 4 GB of the 32-b t address space to swap n segments of memory ocated at addresses beyond 4 GB Th s s ess effic ent than a flat memory address mode , obv ous y, but t s the on y so ut on to supportng RAM configurat ons of more than 4 GB w th 32-b t W ndows The 64-b t vers ons of W ndows Server support d fferent amounts of RAM, but the d fferent at on s a market ng d fference, not a techno ogy d fference The 64-b t vers ons of W ndows Server 2008 R2 Standard (and W ndows Sma Bus ness Server 2011 Standard that runs on Standard) support 32 GB of RAM, wh e the Enterpr se and Datacenter vers ons support 2 terabytes of RAM But a of them have the same 16 terabytes of v rtua memory address space
Performance The performance and effic ency of 64-b t W ndows a so benefits from an mproved overa I/O effic ency and throughput W th support for greater phys ca memory and memory address space, caches can be substant a y arger than n 32-b t W ndows, enab ng SBS 2011 to fu y use the mproved I/O hardware ava ab e, such as PCI Express and PCI-X 266, to mprove overa I/O performance The arger address space a ows more I/O to be n progress s mu taneous y Even 32-b t app cat ons can benefit from th s mprovement, espec a y those that need to use the /3GB sw tch When us ng the /3GB sw tch, W ndows s forced nto a constra ned address space, m t ng the amount of non-paged poo ava ab e Th s can cause non-paged poo to be exhausted when there are severa I/O requests outstand ng
Under the Hood Registers
P
rocessors have many ways to store information that applications will need, but each storage location has a cost associated with retrieving that information.
The fastest and lowest cost locations are local registers on the processor. These are fast, local slots where applications (and the operating system) can store values that will be needed shortly. Data stored in registers is available for reuse at full processor speeds and is faster than even cached data in an on-chip cache. All 32-bit x86
processors have a mere eight general-purpose registers, making them significantly register-poor compared to Reduced Instruction Set Computing (RISC) processors. Worse, because the x87 floating-point architecture is stack-oriented, floating-point arithmetic instructions require at least one of the operands to be on top of the stack. This requirement leads to further inefficiencies and relatively poor floatingpoint performance.
12 CHAPTER 2
Understanding 64-Bit Windows
The x64 architecture addresses this issue by doubling the number and size of the registers available. Although 32-bit x86 processors are limited to eight 32-bit general-purpose registers, eight floating-point registers, and eight Streaming Single Instruction-Stream, Multiple Data-Stream (SIMD) Extensions (SSE) or SSE2 registers, the 64-bit x64 architecture has sixteen 64-bit wide general-purpose registers and sixteen 128-bit wide SSE/SSE2 registers.
Another mprovement n 64-b t W ndows Server s a faster I/O subsystem There are a coup e of reasons for th s F rst, the operat ng system s no onger constra ned by the mted address space ava ab e to t n 32-b t W ndows Th s m tat on can become espec a y mportant for server funct ons that create and re ease many connect ons, such as an act ve web server In 32-b t W ndows, th s can ead to fragmentat on of the address space used by W ndows and the eventua s ow ng down of the server, or an nab ty of the server to accept add t ona connect ons W th 64-b t W ndows, th s address space s far arger, a ow ng the web server to funct on at fu speed Another way that the I/O subsystem benefits from 64-b t W ndows s that t has a w der data path, a ow ng faster d sk reads and wr tes and faster memory access D sk- ntens ve operat ons are s gn ficant y faster n 64-b t W ndows
Security A 64-b t-capab e processors nc ude support for the hardware data execut on protect on (DEP) b t DEP contro s wh ch areas of memory can be used to execute code, protect ng aga nst buffer overflows Th s protect on he ps to prevent the k nds of attacks that ed to the Code Red and the SQL S ammer worms, though good cod ng pract ces are equa y mportant
Under the Hood Buffer Overflows
W
hen an application buffer is stuffed with more data than it is designed to handle, the buffer spills the extra data into unexpected areas of memory,
putting data where it wasn’t supposed to be. This creates a buffer overflow. Buffer overflow is a generic term for exploits that load executable code into areas that are supposed to contain only data, and then jump program execution into that code by overloading heaps, stacks, and other memory pools. For example, if your email client is designed to handle attachments with a maximum of 255-character file names and you receive a message that has a file name with 256 characters, a buffer overflow can occur. When this happens, memory space adjacent to that file name buffer gets overwritten and malicious code can be executed with
Security
CHAPTER 2
13
the privileges associated with the original program. The infamous MSBlaster worm was this type of exploit. The hardware DEP in x64 processors protects against this type of exploit. This buffer overflow protection is combined with Microsoft’s PatchGuard technology, which prevents non-Microsoft-originated programs from patching the Windows kernel. This technology, available only on 64-bit Windows, prevents kernel-mode drivers from extending or replacing kernel services, including system service dispatch tables, the interrupt descriptor table (IDT), and the global descriptor table (GDT). Third-party software is also prevented from allocating kernel stacks or patching any part of the kernel.
In some ways, however, an even more mportant secur ty feature of SBS 2011 (and a vers ons of W ndows Server 2008 R2) s the requ rement that every dr ver be s gned to assure the authent c ty of the dr ver prov der Th s won’t prevent a bad y wr tten dr ver from caus ng prob ems, but t w ensure that when you down oad and nsta a dr ver, you know that t rea y s wr tten by the company that c a ms to have wr tten t Th s he ps to protect aga nst an mportant and d fficu t-to-detect secur ty oopho e that cou d a ow an unscrupu ous v rus or root-k t author to prov de an m tat on of a common y used dr ver that conta ned code that ets the author bypass W ndows secur ty Security Alert Always know the source of any driver you install on any comput-
er in your network. If you need a driver for an HP component, go directly to the HP site or to the Windows Update site to obtain the driver. Do not download from some third-party site. Signed drivers can help ensure that you’re getting what you think you’re getting, but they aren’t required for the 32-bit computers on your network.
Virtualization One of the most mportant features that s ava ab e on y on 64-b t W ndows s Hyper-V Hyper-V s hyperv sor-based nat ve v rtua zat on that uses the hardware v rtua zat on capab t es of the atest Inte and AMD processors to prov de a robust, fast, and resourceconserv ng v rtua env ronment Because Hyper-V s bu t n to W ndows Server 2008 R2, t runs more effic ent y and nat ve y A server runn ng the Hyper-V ro e has mu t p e partitions, each runn ng nat ve y on the under y ng hardware The first part t on s known as the parent (somet mes ca ed host) part t on, and t acts as the hardware and operat ng system contro part t on for a the other part t ons where v rtua zed operat ng systems (v rtua mach nes) run
14 CHAPTER 2
Understanding 64-Bit Windows
The other part t ons are child (somet mes ca ed guest) part t ons, each w th ts own operatng system, runn ng d rect y on the hyperv sor ayer W ndows Sma Bus ness Server 2011 Standard can run as a ch d part t on, but t can’t be used for the parent part t on We’ cover v rtua zat on and SBS 2011 n more deta n Chapter 6, “Configur ng SBS n Hyper-V ”
What Are the Challenges? So s mov ng to 64-b t a good and wonderfu ? Or do spec a cha enges need to be cons dered and dea t w th to make the trans t on eas er? Not surpr s ng y, the trans t on to 64-b t s not w thout some spec a concerns, nc ud ng dr ver, hardware, and software cons derat ons
Drivers Every dr ver for W ndows Sma Bus ness Server 2011 Standard must be 64-b t and must be a s gned dr ver Th s means that before you buy a server you need to ver fy that the manufacturer fu y supports 64-b t W ndows Server 2008 R2 If your env ronment nc udes other hardware, such as pr nters, wh ch are d rect y contro ed by SBS, you need to make sure that there are dr vers ava ab e for that hardware We’ cover how to configure SBS to support both 64-b t and 32-b t c ents for your pr nters n Chapter 13, “Insta ng and Manag ng Pr nters ” But f you’re buy ng one or more pr nters for your SBS network, ver fy that they have dr vers for 64-b t W ndows Server 2008 R2 ava ab e And f you’ve got egacy hardware or pr nters you need to ma nta n, ver fy that there are 64-b t dr vers ava ab e If not, cons der your opt ons for e ther rep ac ng them or prov d ng an add t ona 32-b t W ndows computer that can prov de access to the egacy hardware
Hardware and Software Considerations There are some genera hardware cons derat ons you shou d take nto account when mov ng to W ndows Sma Bus ness Server 2011, as we as some software cons derat ons that are spec fic to 64-b t W ndows One cons derat on you don’t have to worry about s whether you’re runn ng AMD or Inte processors There s fu b nary compat b ty between AMD’s AMD64 and Inte ’s EM64T, a ow ng W ndows Sma Bus ness Server 2011 to use the same b nary whether the under y ng processor s an AMD processor or an Inte processor
Server-Grade Hardware As we ment oned ear er, you need to make sure that any hardware you use w th your SBS 2011 network has the proper s gned dr vers ava ab e that support 64-b t W ndows Server 2008 R2 But t’s more than just dr vers Avo d choos ng ower consumer-grade hardware, espec a y pr nters Because you’re shar ng that pr nter across your ent re network, hav ng a better pr nter makes sound financ a sense and a so makes t eas er to support Many consumer-grade pr nters have no actua nte gence bu t n to the pr nter; nstead, they are ent re y dependent on the operat ng system to work Server-grade (a so referred to
What Are the Challenges?
CHAPTER 2
15
as bus ness-grade) pr nters support a fu pr nter contro anguage n the pr nter tse f, usua y e ther PCL or PostScr pt Hav ng a server-grade pr nter removes many of the compat b ty ssues assoc ated w th pr nter dr vers because even f there sn’t a perfect match for your pr nter, there w be one that s c ose Note All-in-one printer/fax/scanner devices present a particular challenge in 64-bit
Windows—very few of them have drivers that support all of their functionality. If you absolutely have to have this kind of device, you’ll probably have better luck connecting it to a centrally located personal computer.
32-Bit Software Compatibility SBS 2011 uses the W ndows On W ndows 64-b t (WOW64) subsystem to support 32-b t app cat ons runn ng on 64-b t W ndows The WOW64 subsystem prov des a h gh-performance, 32-b t W ndows env ronment that supports ex st ng 32-b t W ndows app cat ons Because of the under y ng hardware compat b ty of the x64 arch tecture, 32-b t app cat ons are ab e to run at fu speed n the WOW64 subsystem Because of the arger ava ab e memory address space and the greater effic enc es of the x64 processor arch tecture, many app cat ons actua y run faster n WOW64 than they do n 32-b t W ndows WOW64 so ates 32-b t app cat ons from 64-b t app cat ons, but t prov des for nteroperab ty and data exchange across the boundary through the Common Object Mode (COM) and remote procedure ca (RPC) and through transparent cut and paste WOW64 runs 32-b t app cat ons seam ess y wh e prevent ng fi e and reg stry co s ons between 32-b t and 64-b t vers ons of an app cat on An mportant WOW64 m tat on s that 32-b t app cat ons cannot oad 64-b t DLLs, and 64-b t app cat ons cannot oad 32-b t DLLs Th s means that 32-b t Act veX contro s, for examp e, cannot be run n the 64-b t vers on of Internet Exp orer, and th s s why 32-b t and 64-b t vers ons of Internet Exp orer are both nc uded w th a 64-b t vers ons of W ndows The 32-b t vers on s the defau t Another m tat on s that 32-b t DLLs that prov de context-sens t ve menu extens ons to W ndows Exp orer don’t work They must be rewr tten to run nat ve y n 64-b t
Legacy Software in 64-Bit Windows Runn ng egacy software n 64-b t W ndows ra ses some spec a concerns The vast major ty of 32-b t software w work w thout ssue n the WOW64 subsystem The on y rea except ons to th s are app cat ons that have spec a zed dr vers, such as ant v rus software, d sk defragmentat on ut t es, and so on These genera y use spec a fi e system dr vers Check w th your software vendor—many prov de updated vers ons that work we w th 64-b t W ndows
16 CHAPTER 2
Understanding 64-Bit Windows
What won’t work are 16-b t or MS-DOS app cat ons There s no support at a n any 64-b t vers on of M crosoft W ndows for 16-b t app cat ons Nor s there any support for pure DOS app cat ons (Th s does not mean that app cat ons wr tten to run from the command ne won’t work Just not o der MS-DOS app cat ons such as DOS Ed t, or one of our favor tes, Vern Buerg’s L st ) So, what’s the best way to hand e an app cat on that doesn’t run n 64-b t W ndows? We find v rtua zat on to be a great so ut on Create a v rtua mach ne (VM) that runs a 32-b t vers on of W ndows, and use that VM to run your ncompat b e app cat on If you’re runn ng SBS 2011 v rtua zed a ready, creat ng a sma VM for th s s no prob em If you’re runn ng SBS 2011 Standard Ed t on on a phys ca host, however, you have to run the VM on another host because SBS 2011 doesn’t support enab ng the Hyper-V ro e If you have the W ndows Sma Bus ness Server 2011 Prem um Add-On, you a ready have a perfect p ace to enab e Hyper-V See Chapter 6 for more deta s on sett ng up and configur ng v rtua mach nes us ng Hyper-V
What About Clients? SBS 2011 prov des fu support for 64-b t W ndows c ents That sa d, the need for 64-b t at the c ent eve s st far ess compe ng than t s for servers 32-b t W ndows s qu te adequate for the vast major ty of desktop and aptop computers used n bus ness today The except ons to th s are deve opment workstat ons, draw ng and computer-a ded des gn (CAD) workstat ons, or other spec a zed workstat ons used for memory- ntens ve app cat ons that need to address greater than 4 GB of RAM The 64-b t bus ness vers ons of W ndows 7, W ndows V sta, and W ndows XP support up to 128 GB of RAM and two phys ca processors If you have spec a zed needs for very arge RAM workstat ons, 64-b t s defin te y the way to go But most users w find 32-b t W ndows suffic ent, though th s s defin te y chang ng as the ava ab ty of desktop computers w th 8 GB and even 12 GB of RAM become more common Tab e 2-3 shows the support matr x for processors and RAM n W ndows Note Although you can run Windows XP Professional x64 Edition (XP x64) as a client op-
erating system in an SBS 2011 network, it is not a fully supported scenario. Certain wizards, including the Connectcomputer Wizard, will not work in XP x64.
What About Clients?
CHAPTER 2
17
Table 2-3 32 b t vs. 64 b t W ndows c ents
Maximum RAM
# of CPU Sockets
Windows Edition
32-bit
64-bit
32-bit
64-bit
XP Profess ona
4 GB
128 GB
2
2
XP Tab et PC Ed t on
4 GB
not app cab e
2
not app cab e
XP Med a Center Ed t on (not supported n SBS network)
4 GB
not app cab e
1
not app cab e
W ndows V sta Bus ness
4 GB
128 GB
2
2
W ndows V sta Enterpr se (ava ab e on y w th Software Assurance)
4 GB
128 GB
2
2
W ndows V sta U t mate
4 GB
128 GB
2
2
W ndows V sta Home Bas c (not supported n SBS network)
4GB
8 GB
1
1
W ndows V sta Home Prem um (not supported n SBS network)
4 GB
16 GB
1
1
W ndows 7 Profess ona
4 GB
128 GB
2
2
W ndows 7 Enterpr se (ava ab e on y w th Software Assurance)
4 GB
128 GB
2
2
W ndows 7 U t mate
4 GB
128 GB
2
2
W ndows 7 Home Prem um (not supported n SBS network)
4 GB
16 GB
1
1
Summary In th s chapter, we covered how 64-b t comput ng s d fferent from the fam ar 32-b t approach, as we as how t’s rea y the same We h gh ghted some key reasons why W ndows Sma Bus ness Server 2011 Standard s ava ab e on y as a 64-b t so ut on The next chapter covers how to des gn and prepare a network pr or to nsta ng W ndows Sma Bus ness Server We a so cover nam ng convent ons, how to p an for adequate network secur ty, and how to ca cu ate the number and type of censes you’ need
18 CHAPTER 2
Understanding 64-Bit Windows
CHAPTER 3
Planning Your SBS Network B
efore you actua y start nsta ng W ndows Sma Bus ness Server 2011 Standard, you shou d spend some t me and thought p ann ng what your network w ook ke T me spent now, before you actua y start nsta ng anyth ng, w save you t me, energy, and comp cat ons ater By des gn ng your network nfrastructure, nam ng convent ons, and network secur ty before you actua y mp ement them, you’ save cost y reconfigurat on ater
Planning the Network Infrastructure The first tasks n des gn ng a network for your company are ■
Eva uat ng the comput ng needs of the organ zat on
■
Choos ng an Internet connect on method and oca network type
■
Se ect ng network dev ces
■
Choos ng server hardware
■
Choos ng c ent hardware and software
Under The Hood Network Operating Systems
O
n an ordinary PC, the role of the operating system is to manage the file system; handle the running of applications; manage the computer’s
memory; and control the input and output to attached devices such as cameras, printers, and scanners. A network operating system expands that role,
managing the following: ■
Centralized security
■
Remote access
■
Remote file systems
■
Running shared applications
■
Input and output to shared network devices
■
CPU scheduling of networked processes
19
When multiple computers are connected in a workgroup, as shown in Figure 3-1, the result is called a peer-to-peer network: a network without a central server and with no network operating system. W ndows XP Profess ona
W ndows 7 U t mate
Loca Pr nter
W ndows 7 64 b t Profess ona
W ndows 7 Home Prem um
W ndows V sta Bus ness
Loca Scanner
W ndows XP Profess ona
Figure 3-1 A peer to peer network, wh ch has no centra server or management
Adding one or more servers running Windows Server 2008 R2 or a Windows Small Business Server 2011 Standard, as shown in Figure 3-2, is a client/server-based network—one or more servers and multiple clients, all sharing a single security policy. The servers provide both the resources and the security policy for the network, and the clients are the computers that use the resources managed by the server. W ndows XP Profess ona
Network Pr nter
W ndows Sma Bus ness Server 2011 Standard W ndows 7 Enterpr se (ema , f es, database) Network Scanner
W ndows 7 U t mate (64 b t)
W ndows 7 Enterpr se
W ndows V sta W ndows 7 Bus ness Enterpr se (64 b t)
Figure 3-2 A c ent/server network, wh ch has a centra management and resource server
20 CHAPTER 3
Planning Your SBS Network
Servers Use Network Operating Systems Because SBS 2011 has to supply services to as many as 75 users, and you’re depending on it to run your business, a high-powered, robust operating system and highly reliable hardware are essential. When your users rely on a server to get their work done and keep your business running, you certainly don’t want frequent failures— you don’t even want to reboot! In addition to supplying print, file, or other services, the network operating system has to provide network security. Different businesses and organizations have varying security needs, but all must have some level of data protection. Therefore, the system must offer a range of configurable security levels, from the relatively nonintrusive to the very stringent.
Clients Use Workstation Operating Systems Like other computers, client computers on a network need an operating system. However, a client operating system doesn’t need to manage the resources for other computers or manage security for the network. Rebooting a workstation can be an annoyance for the user but doesn’t usually disrupt anyone else’s work. On a Windows Small Business Server network, clients can run Microsoft Windows XP Professional (including Windows XP Tablet PC Edition and Windows XP Professional x64 Edition) and business editions of Windows Vista or Windows 7. However, for best performance and security, Windows Vista SP1 or Windows 7 should be deployed on clients.
Determining Your Needs Before des gn ng a network, dec de wh ch features of SBS 2011 your bus ness needs; do ng so he ps ensure that the network des gn s d ctated by bus ness needs rather than by fancy techno ogy Key needs to cons der nc ude ■
Centra zed user account management
■
Centra zed update management
■
Web and ema access for emp oyees
■
F e shar ng and centra zed fi e storage
■
Database storage us ng M crosoft SQL Server
■
Pr nter shar ng
■
Centra zed backup
■
Centra zed fax server
Planning the Network Infrastructure
CHAPTER 3
21
■
Remote access to the nterna network v a the Internet, nc ud ng remote access d rect y to the user’s desktop from the web
■
Management of remote computers
■
Co aborat on and document management (SharePo nt Foundat on 2010)
You a so must dec de how mportant the fo ow ng factors are, as we as what resources are ava ab e to support your cho ces ■
Performance
■
Re ab ty
■
Secur ty
Planning Get a thorough idea of what kind of work will be done on the network,
when and where it will be done, and by whom. For example, your organization might need to do payroll every other Friday, during which time the file server and printers are under a heavy load.
Choosing an Internet Connection To choose an Internet connect on method, you must ba ance an organ zat on’s bandw dth needs and budget aga nst the ava ab e Internet connect on methods The fo ow ng sect ons d scuss how to do th s, as we as how to choose an Internet serv ce prov der (ISP)
Determining Bandwidth Needs F rst, determ ne the base ne eve of bandw dth you requ re You can then ba ance th s aga nst the organ zat on’s budget and performance goa s A ow for 100 k ob ts per second (Kbps) of down oad bandw dth and 50 Kbps of up oad bandw dth for each s mu taneous user of ema and the web If remote access s mportant, a ow for a m n mum of 100 Kbps of up oad bandw dth for each s mu taneous remote access user Tab e 3-1 sts var ous Internet connect on speeds and the number of users supported for each speed, assum ng that users w be brows ng the web and us ng ema Th s tab e does not nc ude requ rements for remote connect ons Important Running an Internet-accessible web server on your network requires at
least 50 Kbps or more of upload bandwidth per simultaneous visitor, depending on the size of images or files. This can quickly swamp your Internet connection, which is one reason most small businesses pay for web hosting.
22 CHAPTER 3
Planning Your SBS Network
Table 3-1 Bandw dth requ rements for web brows ng and ema
Download/Upload Speed
Number of Users
256/128 Kbps
1–5
512/256 Kbps
1–5
1024/512 Kbps
5–10
3072/768 Kbps
10–20
5120/1024 Kbps
15–30
Note These bandwidth numbers are not intended to be definitive—they are a minimum
planning baseline. Each organization and its users have different usage patterns and needs, and you should evaluate your needs accordingly. Be prepared to add more bandwidth if necessary. Your users will never complain that the Internet connection is too fast, but they will definitely complain if it’s too slow!
Under The Hood Bits and Bytes
N
etwork speeds are measured in either kilobits per second (Kbps) or megabits per second (Mbps), whereas download speed and hard disks are rated
in kilobytes per second (KBps) or megabytes per second (MBps). For example, a 640-Kbps DSL connection might download files at 60 KBps from a fast website, but a 1.5-Mbps cable Internet connection might download at 180 KBps from the same site. (Some of the bandwidth is used up by transmission overhead and inefficiencies.) When you compare network speeds, make sure you’re using the same units of measurement.
Types of Internet Connections To choose an Internet connect on method, you need to know wh ch methods are ava ab e as we as the r performance character st cs Tab e 3-2 sts the most common connect on methods and the r speeds
Planning the Network Infrastructure
CHAPTER 3
23
Table 3-2 nternet connect on types
Type of Connection
Download Speed
Upload Speed
Notes
D a -up
28 8–53 Kbps
28 8–40 Kbps
Ana og te ephone ne Somet mes referred to as P a n O d Te ephone Serv ce (POTS)
ISDN (Integrated Serv ces D g ta Network)
64–128 Kbps 64–128 Kbps (one channe or (one channe or two) two)
Must be w th n 50,000 feet of a te ephone company centra office (CO) Connect on s d a -up (not pers stent)
ADSL (Asynchronous D g ta Subscr ber L ne)
256 Kbps– 8 Mbps
128 Kbps– 1 Mbps
Must be w th n 18,000 feet of a CO
IDSL (DSL over ISDN)
128–144 Kbps
128–144 Kbps
Works at greater d stances from a CO than other DSL var ants
SDSL (Synchronous 128 Kbps– DSL) 2 3 Mbps
128 Kbps– 2 3 Mbps
Must be w th n 20,000 feet of a CO
Cab e
128 Kbps– 15 Mbps
128 Kbps– 1 Mbps
Must have access to broadband cab e serv ce; speed can fluctuate depend ng on the number of users on a g ven cab e oop
M crowave w re ess 256 Kbps– 10+ Mbps
256 Kbps– 10+ Mbps
Must be n ne of s ght to the ISP’s antenna; max mum d stance 10 m es
Frame re ay/T1
56 Kbps– 1 54 Mbps
56 Kbps– 1 54 Mbps
Good ava ab ty; very re ab e; cons stent throughput; expens ve
802 11b (W F )
Up to 11 Mbps
Up to 11 Mbps
Speed decreases w th ncreas ng d stance from access po nt
802 11g or 802 11a Up to 54 Mbps Up to 54 Mbps
Speed decreases w th ncreas ng d stance from access po nt
802 11n
Up to 540 Mbps
Up to 540 Mbps
Speed decreases w th ncreas ng d stance from access po nt
Geosynchronous sate te
150 Kbps– 3 Mbps
33 6 Kbps– 128 Kbps
Requ res ne of s ght to sate te (southern sky n North Amer ca) Unsu tab e for rea -t me mu t med a because of h gh atency
Ethernet
10 to 1000 Mbps
10 to 1000 Mbps L m ted ava ab ty Backbone connect on m ght be DSL or T1, m t ng actua bandw dth
24 CHAPTER 3
Planning Your SBS Network
Choosing ISPs After determ n ng the preferred connect on type and bandw dth, t’s t me to actua y find ISPs Two webs tes to check are http://www.cnet.com/internet-access and http://www .dslreports.com. In add t on to speed and cost, ook for the fo ow ng features ■
Static IP address To host any k nd of Internet-access b e serv ce such as ema , M crosoft Out ook Anywhere, remote access, or webs tes, you need a stat c IP address or an ISP that supports the Dynam c DNS serv ce, or you need to manage your externa DNS w th a DNS serv ce that supports dynam c updates, such as http://www.zoneedit.com SBS 2011 nc udes support for tzo com dynam c DNS f you use the bu t- n w zards to reg ster or transfer your doma n name
■
Terms of service and ports Many ISPs have terms of serv ce (TOS) on consumergrade accounts that proh b t host ng ema servers, or they have a po cy that b ocks spec fic ports such as port 25 You need to ask before you buy
■
Transfer limitations If the ISP has a month y data transfer m t, make sure the m t sn’t ower than your ant c pated usage—charges for go ng beyond the m t can be s gn ficant
■
Web hosting If you want the ISP to host the organ zat on’s Internet webs te, ook for v rtua host ng (so that your organ zat on can use ts own doma n name) w th enough d sk space on the ISP’s web servers
■
Backup Internet connection If your bus ness s dependent on a ways be ng connected to the Internet, choose a secondary Internet connect on w th suffic ent bandw dth to a ow you to ma nta n m n ma serv ce n case the pr mary Internet connect on fa s Th s second Internet connect on shou d use a d fferent ISP and a d fferent connect on techno ogy You can use a dua WAN router to use both connect ons s mu taneous y
Choosing a Network Type The next step n des gn ng a network s to choose a network type (See Tab e 3-3 ) Start by ook ng at where your computers are phys ca y ocated If you can eas y run cab e between a computers, the cho ces are s mp e G gab t Ethernet (G gE) or Fast Ethernet (100BaseT) Choose G gE f your w r ng supports t; otherw se, st ck to Fast Ethernet If you’re nsta ng new cab ng, h re a profess ona cab ng expert Spend ng money on good w r ng now can save you a lot of prob ems n the future If the computers are w de y scattered or mob e, cons der nc ud ng some w re ess access points (APs) These are network dev ces that perm t w re ess c ents access to a w red network Even Fast Ethernet s v rtua y as fast as the rea -wor d speeds of the fastest current w re ess standard (802 11n), wh e be ng far more re ab e, more secure, and cheaper as we For these reasons, use w re ess networks to supp ement w red networks, not to rep ace them
Planning the Network Infrastructure
CHAPTER 3
25
More Info For more information about wireless access points, see the section “Choos-
ing a Wireless Standard: 802.11a/b/g/n” later in this chapter.
Security Alert All wireless technologies have the potential to introduce security
risks. When using wireless networking, always use appropriate security measures, such as Wireless Protected Access (WPA), 802.11i (WPA2), or 802.1x. For more information, see the section “Planning for Security” later in this chapter.
Table 3-3 Common network types
Speed (Real World)
Cabling
Maximum Distance
Other Hardware Requirements
94 Mbps
Cat 5, Cat 5e, Cat 6
328 feet from hub or sw tch
Fast Ethernet hub or sw tch
1000 Mbps
327 Mbps
Cat 5e or Cat 6
328 feet from hub or sw tch
G gab t hub or sw tch
802 11b (W F )
11 Mbps
4 5 Mbps
W re ess
1800 feet (60–150 feet typ ca ndoors)
802 11b or 802 11g access po nt (AP), 32 users per AP
802 11a
54 Mbps
19 Mbps
W re ess
1650 feet (50–100 feet typ ca ndoors)
802 11a AP, 64 users per AP
802 11g
54 Mbps
13 Mbps
W re ess
1800 feet (60–150 feet typ ca ndoors)
802 11g AP, 32 users per AP
802 11n
540 Mbps
130 Mbps
W re ess
7200 feet (100–500 feet typ ca ndoors)
802 11n AP, 32 users per AP
Technology
Speed
Fast Ethernet
100 Mbps
G gab t Ethernet
Note Wireless speeds vary greatly depending on the distance from the access point, and
the number and type of walls, floors, and other interference between the access point and the client device.
26 CHAPTER 3
Planning Your SBS Network
Best Practices Avoid the consumer-focused HomePNA and HomePlug network types.
They’re more expensive, slower, less secure, and less reliable than Ethernet or a properly configured 802.11a/b/g/n wireless network.
Choosing the Right Network Cable Choos ng the r ght cab e for a w red Fast Ethernet (100 Mbps) network s easy—Cat 5 cab e However, there are except ons to th s ru e that perta n to ex st ng nsta at ons and new construct on Cab es n an ex st ng network m ght not be usab e 10-megab t Ethernet equ pment m ght be usab e for sma networks unt t can be rep aced, but expect to rep ace t soon—you’ find t s ow Coax a (th nnet) Ethernet and Cat 3 Unsh e ded Tw sted Pa r (UTP) cab es are unre ab e and s ow and shou d be rep aced New construct on shou d run severa strands of Cat 5e or, dea y, Cat 6 A though Cat 5 cab e can be used w th G gab t Ethernet, t s marg na at best Cat 5e and Cat 6 cab es are more re ab e and prov de headroom for poss b e 10-G gab t Ethernet standards Cab es shou d converge at a reasonab y c ean, centra y ocated w r ng c oset w th adequate power, vent at on, and secur ty for a servers and network dev ces (Be sure to eave room for future growth ) Sh e ded Cat 5, Cat 5e, and Cat 6 cab es are ava ab e for s tuat ons that potent a y nvo ve h gh eve s of e ectromagnet c nterference (such as antennas) You shou d use p enum-grade cab e any t me w r ng s p aced n a drop ce ng (Before runn ng cab e n a drop ce ng, ta k to the bu d ng manager )
Choosing a Wireless Standard: 802.11a/b/g/n Current y, you can choose from four w re ess standards 802 11b, 802 11a, 802 11g, and 802 11n Here’s what you need to know about each (a so refer to Tab e 3-3) ■
802.11b 802 11b was the first w de y dep oyed standard, though the speed was m ted (11 Mbps theoret ca ; 5 Mbps or even ess n the rea wor d) 802 11b supports a max mum of 32 users per AP, and a max mum of 3 s mu taneous channe s n use n the same ocat on Channels separate w re ess networks, w th each channe prov d ng 11 Mbps of bandw dth You shou d not buy new equ pment that supports on y 802 11b, and f you current y have 802 11b equ pment, you shou d upgrade t to 802 11n There are ser ous secur ty cons derat ons w th o der w re ess hardware that prec ude t from be ng dep oyed n a bus ness env ronment
Planning the Network Infrastructure
CHAPTER 3
27
■
802.11g 802 11g s faster than 802 11b (54 Mbps theoret ca ; 13 Mbps rea -wor d) and backward-compat b e w th 802 11b 802 11g supports a max mum of 32 users per AP, and a max mum of 3 s mu taneous channe s n use n the same ocat on
■
802.11a 802 11a s faster than 802 11g (54 Mbps theoret ca ; 19 Mbps rea -wor d) and s more to erant of m crowave nterference and network congest on because t uses the 5 GHz frequency band 802 11a supports a max mum of 64 users per AP, and a max mum of 8 channe s n use s mu taneous y n the same ocat on 802 11a s not compat b e w th e ther 802 11b or 802 11g If you dec de to use 802 11a network dev ces, st ck w th dev ces from the same vendor and cons der a tr -mode 802 11a/b/g dev ce that w a ow other dev ces, such as aptops w th bu t- n 802 11b/g connect v ty, to work on the w re ess network (Th s strategy a so perm ts the h ghest network dens ty, w th 11 channe s ava ab e s mu taneous y for w re ess networks )
■
802.11n 802 11n s faster than 802 11g (up to 540 Mbps theoret ca ; 100–130 Mbps rea -wor d) and backward-compat b e w th 802 11g and 802 11b Most 802 11n equ pment s n the same frequency band (2 4 GHz) as 802 11b/g, but the standard supports dua -band equ pment that can a so use the 5-GHz range of 802 11a Th s dua -band equ pment prov des the greatest flex b ty and compat b ty and s espec a y good at avo d ng nterference from other equ pment Choos ng dua -band equ pment from a s ng e OEM s the safest cho ce for compat b ty at the h ghest speeds If you’re buyng new w re ess equ pment, we strong y recommend 802 11n and prefer dua -band 802 11n where poss b e
Choosing Network Devices After se ect ng a network type and Internet connect on method, create a network d agram to v sua y show wh ch network dev ces are needed Then se ect the necessary dev ces for the network, such as sw tches, w re ess access po nts, firewa s, and network adapters Best Practices Choose a single brand of network hardware if possible. This ensures
greater hardware compatibility, simplifies administration, and makes obtaining vendor support easier.
28 CHAPTER 3
Planning Your SBS Network
Diagramming the Network Creat ng a d agram of the network can qu ck y show wh ch dev ces you need and where they shou d be ocated, as shown n F gure 3-3
nternet DSL Router
F rewa
Sw tch
802 11n W re ess Access Po nt (WPA2)
W ndows Sma Bus ness Server 2011 Standard (ema , f es, database) Figure 3-3 A network w th the W ndows Sma Bus ness Server computer connected d rect y to the
nternet
Use the fo ow ng st as a gu de when creat ng the network d agram ■
Internet connection The Internet connect on usua y comes n the form of a te ephone or coax a cab e that connects to a DSL or cab e router It s trad t ona y represented by a c oud at the top of the draw ng and a ne that connects to the router or firewa
■
DSL or cable modem The Internet usua y enters the organ zat on n the form of a te ephone or cab e ne that p ugs nto a DSL or cab e modem
Planning the Network Infrastructure
CHAPTER 3
29
■
Firewall The DSL or cab e modem s then p ugged nto the firewa , wh ch shou d be a router or firewa Some modems are comb ned w th bu t- n routers that have bas c firewa capab t es Consumer routers or DSL modems are not suffic ent protect on for a bus ness network
■
Perimeter network Th s s an opt ona area of the network between the DSL or cab e modem and the firewa , where ow-secur ty dev ces such as w re ess access po nts can be p aced
■
Internal network The nterna network nc udes the SBS computer, the c ent computers, and any network-connected dev ces, such as pr nters
Planning Wireless access points should be on the internal network and use 802.11i
(WPA2) encryption. You can also place access points in the perimeter network when you want to provide Internet access to the general public (such as in a coffee shop, conference room, or lobby).
Choosing a Network Switch Ethernet networks use the star network topo ogy (a so known as hub and spoke), wh ch means that a network dev ces must be p ugged nto a centra hub or sw tch Choos ng the r ght sw tch requ res eva uat ng the fo ow ng factors ■
Switch or hub Don’t buy a hub un ess you have a spec a zed need and understand why you’re do ng t Get a sw tch nstead Sw tches are nexpens ve, prov de add t ona performance, and fac tate m x ng 10 Mbps, 100 Mbps, and 1 Gbps dev ces on the same network segment
■
Number of ports Make sure that the sw tch prov des more than enough ports for a computers, access po nts, network pr nters, and Network Attached Storage (NAS) dev ces on the network, a ong w th spare ports for expans on or to use n the event of a port fa ure
■
Speed Fast Ethernet (100/10 Mbps) sw tches offer bas c performance for sma bus nesses, but G gE (1000/100/10 Mbps) sw tches are hard y d fferent n pr ce and prov de extra bandw dth for mproved performance of fi e servers and h gh-qua ty stream ng v deo where the network cab ng w support t
■
Management Managed sw tches prov de the ab ty to v ew the status of attached dev ces from a remote connect on, wh ch can be usefu for off-s te techn c ans In genera , save the cash and st ck w th an unmanaged sw tch un ess the cost d fference s s ght or the organ zat on uses an off-s te consu tant who wants the ab ty to remote y adm n ster sw tches
30 CHAPTER 3
Planning Your SBS Network
Choosing Wireless Access Points As you earned ear er n the chapter, w re ess access po nts perm t c ents to w re ess y connect to a w red network Access po nts are often ntegrated nto routers, but they are a so ava ab e as stand-a one dev ces that must be p ugged nto a sw tch ke any other network dev ce Avo d w re ess “gateway” or router products for connect ng to your nterna network— they w comp cate your network management and TCP/IP configurat on They’re fine for externa y connected w re ess access po nts Some w re ess routers can be reconfigured to be s mp e access po nts Note Business-grade access points are more expensive than consumer-oriented access
points; however, they are usually more reliable and full-featured.
When choos ng an access po nt, cons der the fo ow ng features ■
Routers w th bu t- n access po nts are often no more expens ve than stand-a one access po nts and are usefu when creat ng a per meter network But be sure they can be used as a pure access po nt—many can funct on on y as a router, wh ch w comp cate your network setup
■
Access po nts shou d support 802 11 (WPA2) WEP s s mp y not acceptab e for any w re ess dev ce connected to your nterna network, and even WPA shou d not be cons dered suffic ent protect on for an nterna y connected access po nt
■
Access po nts shou d support 802 1x (RADIUS) authent cat on f you want to prov de the h ghest eve of secur ty and ease-of-use to a w re ess network SECURITY ALERT Two “features” that some suggest to improve wireless security are
disabling of SSID broadcasts and Media Access Control (MAC) address filtering. Don’t bother. They are a significant and ongoing administrative burden, and a hacker with a port scanner can easily defeat them anyway.
■
Some access po nts have two or more antennas that can be adjusted for better coverage; others support externa antennas that can be mounted on a wa for better p acement
■
Stand-a one w re ess br dges (often referred to as wireless Ethernet bridges) and some access po nts prov de the ab ty to w re ess y br dge (connect) two w red networks that can’t be connected v a cab es There are a number of d fferent types of br dgng modes, nc ud ng Po nt-to-Po nt and AP C ent Po nt-to-Po nt uses two w re ess br dges to nk two w red networks AP C ent uses an AP on the ma n network (to wh ch w re ess c ents can connect) and a w re ess br dge n AP C ent mode on the remote network segment, act ng as a w re ess c ent
Planning the Network Infrastructure
CHAPTER 3
31
C ents on the other s de of a w re ess br dge w exper ence s ower performance to the ma n network segment because of the shared w re ess nk, so use w re ess br dges w th d scret on, and a ways use br dges and APs made by the same manufacturer ■
Don’t nc ude “turbo” or other h gh-speed modes offered by some manufacturers n your buy ng cr ter a They prov de tt e performance ga n, f any, n the rea wor d and can have a de eter ous effect on compat b ty
Real World Placing Access Points for the Best Coverage
W
ireless access points have a limited range, especially in the environment of a typical office. The indoor range of 802.11b, 802.11g, and tri-mode 802.11a
access points is usually around 60–100 feet at the highest connection speed, and 25–75 feet for first-generation, single-mode 802.11a access points. That said, 2.4-GHz cordless phones, microwave ovens, and Bluetooth devices can cause serious interference with 802.11b and 802.11g networks (but not with 802.11a networks) when they are turned on. Fluorescent lights, metal walls, computer equipment, furniture, and standing too close to the access point can also reduce the range of wireless networks. Unfortunately, there is no reliable way to quantify these variables—trial and error is the best way to position access points. With 802.11n, and especially dual-band 802.11n, the effective distance is at least double that of 802.11g, but this still requires full 802.11n deployment and optimal conditions. In our initial tests of 802.11n, it does appear to provide a more stable and reliable signal at a significantly greater distance than our previous 802.11a/g equipment. There are some useful guidelines when selecting access point locations: ■
Place the access point and wireless network card antennas as high as possible to get them above objects that might attenuate the signal.
■
If you place access points in the plenum (the space inside a drop ceiling or raised floor), make sure you obtain access points or enclosures certified for plenum installation.
■
Place the access point in the center of the desired coverage area to provide the best coverage while also reducing the publicly exposed “surface area” of the network.
■
Only use the minimum signal strength (power) required to provide coverage for your office. Most WAPs have multiple levels of signal strength but ship with a default of “maximum.”
■
Use multiple access points as necessary to cover multiple floors or large offices, or to service a large number of clients simultaneously. Twenty clients per 802.11g AP
32 CHAPTER 3
Planning Your SBS Network
is a reasonable maximum, with an average of no more than two to four simultaneously active users per AP yielding the best network performance. ■
Use wireless bridges to place another Ethernet network segment (or another wireless access point) in a location unreachable by cables. Wired clients on this segment communicate with other wired devices on this segment at the speed of the wired network (1000/100/10 Mbps); however, communication with the main network segment takes place at the speed of the wireless network (10–100 Mbps real-world bandwidth).
■
When selecting channels for access points, sniff (search by using a wireless client) for the presence of other networks and then choose an unused channel, preferably one that is four or more channels separated from other channels in use. For example, channels 1, 6, and 11 can be used simultaneously without interference.
Choosing a Firewall Device or Router SBS 2011 s des gned to connect d rect y to a firewa and does not prov de any d rect protect on for the rest of the SBS network Th s s a major change from ear er vers ons of SBS that acted as the gateway between the Internet and the nterna network when SBS was dep oyed w th two network cards (NICs) W ndows Sma Bus ness Server 2011 Standard nc udes the new W ndows F rewa that s part of W ndows Server 2008 R2 to protect the server, but t shou d be protected by an add t ona , separate firewa that w a so act to protect the computers on the nterna network You shou d ook for the fo ow ng features on your network firewa dev ce ■
Packet filtering F rewa s shou d support nbound packet fi ter ng and Statefu Packet Inspect on (SPI)
■
Protection from specific attacks F rewa s shou d support protect on from the den a -of-serv ce (DoS) attacks and other common attacks such as P ng of Death, SYN F ood, LAND Attack, and IP Spoofing
■
Network Address Translation (NAT) NAT s the backbone of most firewa dev ces, prov d ng bas c secur ty and Internet connect v ty to nterna c ents
■
IPv6 Support As IPv6 becomes more pervas ve, and as our poo of ava ab e IPv4 addresses approaches exhaust on, the need to d rect y support IPv6 for our Internet connect on becomes more compe ng Choos ng a firewa dev ce that fu y supports IPv6 now w save money and t me ater
■
VPN pass-through To perm t proper y authent cated Internet users to estab sh VPN connect ons w th a W ndows Sma Bus ness Server computer beh nd a firewa , the firewa must support VPN pass-through of the des red VPN protoco (PPTP, L2TP, and/or IPSec)
Planning the Network Infrastructure
CHAPTER 3
33
■
VPN tunnels Some firewa dev ces prov de d rect support for estab sh ng VPN connect ons If you do choose to use a firewa dev ce to estab sh VPN connect ons w th c ents and servers n remote offices, make sure the firewa supports the necessary number of s mu taneous VPN tunne s
■
UPnP support W ndows Sma Bus ness Server can automat ca y configure firewa s that support Un versa P ug and P ay (UPnP) to work w th W ndows Sma Bus ness Server serv ces such as Exchange Server and remote access (by open ng the necessary ports on the firewa ) UPnP support can be found n most consumer firewa dev ces as we as n some bus ness firewa s Note Enabling UPnP on a dedicated firewall device makes configuring the device to
work with Windows Small Business Server easy, but it does have security implications. We suggest using UPnP to do the initial setup of the firewall device, if the device supports it, but then disabling UPnP completely. ■
Dual-WAN support Some firewa s come w th support for two WAN connect ons to ncrease speed and re ab ty, wh ch s a great so ut on for networks ook ng for a re ab e Internet connect on Other firewa s prov de a ser a port so that an externa d a up modem can be used as a backup connect on, but th s connect on s much s ower
■
RADIUS support RADIUS support on your firewa w enab e add t ona funct ona ty and secur ty, nc ud ng eas y ntegrat ng Two Factor Authent cat on (TFA) nto your remote access configurat on
■
Content filtering Most firewa s make b ock ng certa n webs tes poss b e, such as webs tes conta n ng spec fied keywords Many bus nesses use th s feature to reduce the emp oyees’ ab ty to v s t object onab e webs tes, a though most content fi ters are arge y neffect ve
■
Built-in wireless access point F rewa s w th bu t- n access po nts and sw tched, G gE, w red ports comb ne severa funct ons and can be a cost-effect ve so ut on However, the r pr mary funct on s to protect the network, and that shou d be the first and most mportant eva uat on cr ter on
Choosing Server Hardware If you have a server that can meet the capac ty needs of the network or can be upgraded to do so wh e a ow ng for future growth, by a means use th s server But rea st ca y, because there s no n-p ace upgrade to W ndows Sma Bus ness Server 2011 Standard, you shou d p an on buy ng a new server as part of your m grat on p an More Info See Chapter 7, “Migrating to Windows Small Business Server 2011 Standard,”
for more information about migrating to SBS 2011 from an existing SBS domain.
34 CHAPTER 3
Planning Your SBS Network
When eva uat ng server hardware, see Tab e 3-4, wh ch sts the effect ve m n mum configurat ons necessary for adequate performance at d fferent oad eve s More Info The sidebar “Determining Server Load” later in this chapter provides more
information about configuration and performance.
Table 3-4 M n mum server conf gurat ons for d fferent oad eve s
Component
Light Load
Medium Load
Heavy Load
CPU
Quad core Inte or AMD Quad core or greater processor Xeon or Opteron processor
Dua Xeon or Opteron processors, w th at east four cores each
Memory
10–12 GB
12–16 GB
12–32 GB
Storage
Two or more hard dr ves n hardware m rror (RAID-1) w th 200 GB ava ab e for W ndows Sma Bus ness Server 2011 Standard
Four-dr ve, hardwarebased RAID us ng SATA or SAS dr ves
Four-dr ve (or more), hardware-based SCSI or SAS RAID
LAN Network Adapter
100/10 Mbps PCI card
1000/100/10 Mbps PCI card
1000/100/10 Mbps PCI-x or PCIe card
Backup
Two or more externa USB hard dr ves
Two or more externa eSATA or USB hard dr ves
Two or more externa eSATA or USB hard dr ves
More Info See Chapter 11, “Disk Management,” for more information on RAID. See
Chapter 12, “Storage Management,” for more information about choosing the appropriate storage solution. See Chapter 16, “Configuring Backup,” for more information about creating a backup strategy and choosing backup devices.
Under The Hood Determining Server Load
T
he appropriate hardware for an SBS 2011 server depends on the load you place it under. Think of load as equal to the number of requests per unit of time mul-
tiplied by the difficulty of fulfilling each request.
Planning the Network Infrastructure
CHAPTER 3
35
The easiest way to determine load is to sample the performance of the existing server over a range of conditions. Of course, this is tricky when you’re constructing a new network or restructuring an existing network. Consider the following factors: ■
The usage pattern over time (number of requests per unit of time) A server that handles an average load can easily become swamped at key times, such as at the beginning and end of a workday, when many users simultaneously log on or log off; during lunch, when users might browse the Internet for personal use; or around deadlines, when many users make heavy use of file, email, or database services.
■
The kinds of user requests (the complexity of each request) This determines which server subsystems are stressed most heavily. Database serving stresses storage, memory, and possibly CPU; file serving stresses mostly storage and I/O; remote access stresses memory and I/O primarily; Exchange Server stresses storage, memory, and to some extent CPU.
Choosing Client Hardware and Software When se ect ng c ent computers for use on a network, choose systems that are fast enough to perform adequate y when runn ng W ndows7 Profess ona (See Tab e 3-5 for recommended configurat ons ) Other operat ng systems—such as W ndows XP, Mac OS X, and L nux—can be made to work on an SBS 2011 network; however, they won’t prov de fu support for many features of SBS Table 3-5 Recommended c ent computer conf gurat ons
Component
Minimum Configuration
Better Configuration
Operat ng System
W ndows XP Profess ona SP3
W ndows 7 Profess ona or Enterpr se
CPU
Pent um 4, 2 0 GHz or faster
Dua -core processor, 2 0 GHz or faster
RAM
256 MB
2 GB
Hard dr ve
30 GB
100 GB
Network Adapter
Fast Ethernet or 802 11g
G gE, 802 11n
D sp ay
15- nch mon tor runn ng at 800 x 600 reso ut on
17- nch mon tor runn ng at 1024 x 768 reso ut on
36 CHAPTER 3
Planning Your SBS Network
Under The Hood Remote Desktop Services (RDS)
C
omputers too slow to adequately run a Windows XP operating system can be put to use as Remote Desktop or Virtual Desktop Infrastructure (VDI) clients. In
this configuration, users connect to a separate Windows Server 2008 R2 computer running the RD Session Host or RD Virtualization Host role. This server can provide a full desktop replacement (VDI) or a full desktop session (RD Session Host), or it can be used to supplement the power of the client by running key applications as RemoteApps and displaying them on the client. This second server cannot be the same physical computer as the Windows Small Business Server computer unless virtualization is used to run multiple virtual machines (VMs) on a single physical computer. With either RDS or VDI, all processing is done on the server, and the display is sent back to the client computer, which can run any supported RDS client operating system. This approach can make more efficient use of resources and make central management easier. The new RemoteApps simplifies deploying resource-intensive applications to users without having to upgrade everyone’s computer, while the use of VDI allows full-featured Windows 7 desktops to be deployed to less powerful clients. For more information on Remote Desktop Services and VDI, see Chapter 26, “Adding a Terminal Server.”
Choosing Naming Conventions Creat ng nam ng convent ons makes choos ng names for computers, shared fo ders, and users eas er and ends cons stency to the network Th s cons stency resu ts n a more user-fr end y network More Info For help with naming users, see Chapter 9, “Managing Users and Groups.”
For help with naming shared folders, see Chapter 10, “Shares and Permissions.”
Choosing a Domain Name for the Network The doma n name s the most mportant and po t ca y sens t ve name on the network, and t s one you can’t change w thout start ng a over and comp ete y rebu d ng your network Do not make th s dec s on w thout consu t ng everyone who has a stake n the resu t By gett ng others nvo ved n the process, you’ have a much greater chance of acceptance
Choosing Naming Conventions
CHAPTER 3
37
Some quest ons to ask when choos ng a doma n name nc ude ■
Is the name easy to remember, and does t make sense for the company? Th s cou d be the company name n ts most common form or an abbrev at on
■
Is the name 15 characters or shorter? Use on y etters, numbers, the underscore, and a hyphen n the name to ensure DNS and NetBIOS compat b ty
■
Is the name ava ab e? If the name s a ready n use as an Internet doma n name for another company, you’ have to e ther choose a d fferent name or have a d fferent nterna and externa doma n name
■
If you a ready have an Internet webs te, use the same name, w thout the extens on, for your nterna doma n name For examp e, f the company uses www.example.com for ts Internet webs te, use example for the doma n name The W ndows Sma Bus ness Server 2011 Standard Insta at on W zard w automat ca y add a oca extens on to the name you choose
■
As soon as you choose a doma n name, reg ster t (preferab y w th com, net, or org) on the Internet so that another company can’t purchase t
Important Changing your internal domain name is impossible without a complete
re-installation, so picking a name that will last is critical.
Real World Internal Domain Name vs. Internet Domain Name
T
here are two domain names you need to worry about when setting up your network: the Internet domain name that the outside world sees for your company
and email, and the internal domain name that Windows Small Business Server uses.
They are usually related but not identical. The public, Internet domain name needs to be globally unique, officially registered with a Domain Naming Service, and clearly identifiable as your company. The internal, Windows name can be anything at all, though it usually is the same as the external, public one, but with a different top-level domain. So if your company is Example Widgets and your public Internet domain name is example.com, your internal Windows domain name could be something like example.local. This makes it easy to keep track of, and it gives you complete control over managing the internal DNS of your Windows Small Business Server network while allowing you to have a reliable third party manage your public DNS records.
38 CHAPTER 3
Planning Your SBS Network
Although it is technically possible to change your public name, it’s neither easy nor painless, and it’s virtually impossible to change your internal name without having to completely rebuild your network from scratch. So it’s worth spending time up front to make sure you’re choosing a name that is appropriate and has the support of all parties. Another possibility is to choose a completely generic name for your internal domain that has nothing whatsoever to do with your company name. This works great if you change your public name because nothing has to change on your network. But it’s not an approach we like. We’ve always preferred naming based on the company name—it’s just easier for everyone to understand and remember.
Naming Computers It’s easy for you to keep a map of what the d fferent c ents and servers are ca ed and where they are on the network, but f you make fe hard on users, you pay n the ong run So namng a the computers after Shakespearean characters or Norse gods m ght make sense to you, but t sn’t go ng to he p users figure out that Puck s the W ndows Sma Bus ness Server computer and Od n s the desktop used for payro On the other hand, us ng Srv1 for the SBS server te s everyone mmed ate y wh ch computer t s When nam ng computers, use a cons stent convent on and sens b e names, such as the fo ow ng ■
SRV1 or SBSSRV for the W ndows Sma Bus ness Server 2011 Standard computer
■
FrontDesk for the recept on st’s computer
In th s book, we’ be us ng a somewhat more comp cated nam ng convent on that dent fies the phys ca host computer, the ro e of the computer, and the IP address of the computer Thus our SBS server s hp160-SBS2011, s gn fy ng that t’s runn ng on the Hew ett-Packard DL 160 G6 server, and that t’s runn ng W ndows Sma Bus ness Server 2011 Standard There are severa v rtua mach nes runn ng on that HP server, so t gets a fa r workout Our nam ng convent on s more comp cated than most sma bus nesses need, but t serves our needs where we are cont nua y bu d ng and rebu d ng test env ronments for wr tng projects U t mate y, t doesn’t matter what you name your computers, as ong as everyone understands the convent on and can find the resources they need
Choosing Naming Conventions
CHAPTER 3
39
Planning for Security It s far eas er to mp ement effect ve secur ty measures to protect your SBS network f you p an for secur ty before you actua y start nsta ng software In the fo ow ng sect ons, we’ cover some of the most common attack vectors and the pre m nary steps you can take n th s p ann ng stage to prepare your defenses ■
Careless or disgruntled employees and former employees Interna users and former users are the b ggest r sk factors to data oss and data theft on most computer networks Whether from az ness, d sregard of secur ty po c es, or outr ght ma ce, the nterna user s often the most dangerous on your network To he p reduce r sks re ated to th s, refer to the “Ensur ng Phys ca Secur ty” sect on of th s chapter as we as to Chapter 8, “Comp et ng the Gett ng Started Tasks ”
■
Internet hackers A computers and dev ces attached d rect y to the Internet are subject to random attacks by hackers Accord ng to the Cooperat ve Assoc at on for Internet Data Ana ys s (CAIDA), dur ng a random three-week t me per od n 2001 more than 12,000 DoS attacks occurred 1200–2400 were aga nst home computers and the rest were aga nst bus nesses If your organ zat on has a h gh profi e, t m ght a so be subject to targeted attack by hackers who don’t ke your organ zat on or who are engag ng n corporate esp onage For more nformat on about secur ng a network aga nst Internet hackers, see the “Secur ng Internet F rewa s” sect on of th s chapter
■
Wireless hackers and theft of service W re ess access po nts are exposed to the genera pub c ook ng for free Internet access and to mob e hackers To reduce th s r sk, refer to the “Secur ng W re ess Networks” sect on n th s chapter
■
Viruses and worms Networks are subject to v rus exposure from ema attachments, nfected documents, and worms such as CodeRed and B aster that automat ca y attack vu nerab e servers and c ents Refer to the “Secur ng C ent Computers” sect on of th s chapter for more nformat on
Ensuring Physical Security A though secur ty s not someth ng that can be ach eved n abso ute terms, t shou d be a c ear y defined goa The most secure operat ng system and network n the wor d s defenseess aga nst someone w th phys ca access to a computer Eva uate your phys ca env ronment to dec de what add t ona secur ty measures you shou d take, nc ud ng the fo ow ng ■
P ace servers n a ocked server room And contro who has keys!
■
Use case ocks on your servers, and don’t eave the keys n them
■
P ace network hubs, routers, and sw tches n a ocked cab e room or w r ng c oset
■
Insta case ocks on c ent systems or pub c y access b e systems
40 CHAPTER 3
Planning Your SBS Network
■
Use aptop ocks when us ng aptops n pub c
■
Use B tLocker to encrypt the data on aptops that conta n sens t ve data
Securing Client Computers Even a h gh y secure network can be qu ck y comprom sed by a poor y secured c ent computer—for examp e, a aptop runn ng an o der vers on of W ndows w th sens t ve data stored on the hard dr ve To max m ze the secur ty of c ent computers, use the fo ow ng gu de nes (refer to Chapter 8, “Comp et ng the Gett ng Started Tasks,” and Chapter 14, “Manag ng Computers on the Network,” for more secur ty procedures) ■
Use a secure operating system Use W ndows V sta or W ndows 7 on a c ent computers, w th a strong preference for W ndows 7 on aptops
■
Use NTFS, file permissions, BitLocker, and EFS Use NTFS for a hard dr ves, and app y appropr ate fi e perm ss ons so that on y va d users can read sens t ve data Encrypt sens t ve fi es on aptop computers us ng the Encrypt ng F e System (EFS), and encrypt at east the system dr ve on aptops us ng B tLocker (B tLocker s ava ab e on y on Enterpr se and U t mate vers ons of W ndows V sta and W ndows 7 )
■
Keep clients updated Use the Automat c Updates feature of W ndows to keep systems updated automat ca y Idea y, use the W ndows Software Update Serv ce (WSUS), ntegrated nto SBS 2011, to centra y contro wh ch updates are nsta ed, as descr bed n Chapter 15, “Manag ng Software Updates ”
■
Enable password policies Password Po c es s a feature of SBS 2011 that requ res user passwords to meet certa n comp ex ty, ength, and un queness requ rements, ensur ng that users choose passwords that aren’t tr v a to crack Note Remembering passwords has become an increasingly difficult prospect, leading
to the resurgence of the yellow-sticky-note method of recalling them. It’s important to discourage this practice, and encourage the use of distinctive but easy-to-remember passphrases. See the Under The Hood sidebar “Beyond Passwords—Two-Factor Authentication” for an alternative to annoyingly complex passwords. ■
Install antivirus software Ant v rus software shou d be nsta ed on the SBS 2011 computer as we as on a c ents The best way to do th s s to purchase a sma bus ness ant v rus package that supports both c ents and the server There are good th rd-party so ut ons spec fica y des gned for the SBS market from severa vendors
■
Install antispyware software Ant spyware software shou d be nsta ed on a c ent computers on the network and configured for rea -t me mon tor ng and da y fu scans
■
Keep web browsers secure Unpatched web browsers are a s gn ficant secur ty ssue A ways keep web browsers updated w th the atest secur ty updates
Planning for Security
CHAPTER 3
41
Under The Hood B eyond Passwords—Two-Factor Authentication
P
assword policies are a difficult subject for many small businesses. Serious security using only passwords requires long and complex passwords, changed
regularly and never repeated. That’s a nice goal, but it’s also not something users are going to be all that happy with. If your network contains sensitive information— and whose doesn’t these days?—you should consider providing an additional layer of security beyond simple passwords. Windows Small Business Server 2011 Standard sets reasonable, if somewhat mini-
mal, password policies, but even the best of password policies is a balancing act between making the password difficult to crack and making it easy for users to remember and use so that they aren’t tempted to write it down on the back of their keyboards. The four kinds of authentication methods or factors are ■
Something you know (password)
■
Something you have (token or physical key)
■
Something you are (biometric)
■
Somewhere you are (location)
Of these, only the first three are realistic and usable in a small business environment, though the fourth—location—is starting to be used by banks as one factor to be sure that the person trying to access your bank account is actually you. Passwords alone are a single-factor authentication method—in this case, something you know. Two-factor authentication requires two of the main three factors, and it provides a definite improvement in the surety that the person authenticating to your network is really who he claims to be. By enabling a second authentication factor, your need for overly draconian password policies is greatly reduced. For a second authentication factor, we like the simplicity, moderate cost, and effectiveness of a one-time password (OTP). Generated automatically by a token you carry around with you, the combination of the token, a personal identification number (PIN), and your SBS password provides an additional level of security. Requiring administrators and all remote users to use two-factor authentication is a good way to improve the overall security of the sensitive data on your network. Third-party providers of OTP tokens include AuthAnvil (http://www.authanvil.com), CryptoCard (http://www.cryptocard.com), and RSA SecureID (http://www.rsa.com). Of these, only AuthAnvil is focused on the small business market, with a suite of products that are fully integrated into SBS. Plus their soft tokens run on our users’ phones, greatly simplifying token management and deployment. We use AuthAnvil on our SBS network for all laptops and servers, and for all remote users.
42 CHAPTER 3
Planning Your SBS Network
Securing Wireless Networks W re ess networks us ng the 802 11b, 802 11a, 802 11g, and 802 11n standards are very conven ent but can a so ntroduce s gn ficant secur ty vu nerab t es f not proper y secured To proper y secure w re ess networks, fo ow these recommendat ons ■
Change the defau t password of a access po nts
■
Change the defau t SSID P ck a name that doesn’t revea the dent ty or ocat on of your network
■
Enab e 802 11 (WPA2) encrypt on on the access po nts
■
If the access po nts don’t support WPA2-Enterpr se, don’t use them on your nterna network Note WPA2 provides two methods of authentication: an “Enterprise” method that
makes use of a RADIUS server, and a “Personal” method known as WPA2-Personal that uses a Pre-Shared Key (PSK) instead of a RADIUS server.
■
D sab e the ab ty to adm n ster access po nts from across the w re ess network
For more on configur ng and protect ng w re ess networks, see Chapter 19, “Manag ng Loca Connect v ty ”
Securing Internet Firewalls Most externa firewa dev ces are secure by defau t, but you can take some add t ona steps to max m ze the secur ty of a firewa ■
Change the defau t password for the firewa dev ce! We know th s seems obv ous, but unfortunate y, t s a too often gnored
■
D sab e remote adm n strat on, or m t t to respond ng to a s ng e IP address (that of your network consu tant)
■
D sab e the firewa from respond ng to Internet p ngs OK, we adm t th s s controvers a It’s certa n y a best pract ce, but t can a so make troub eshoot ng a connect v ty ssue remote y a ot harder
■
Enab e Statefu Packet Inspect on (SPI) and protect on from spec fic attacks, such as the P ng of Death, Smurf, and IP Spoofing
■
Leave a ports on the firewa c osed except those needed by the SBS 2011 server
■
Regu ar y check for open ports us ng trusted port-scann ng s tes We use http://www. dslreports.com.
■
Requ re two-factor authent cat on for a access to the firewa
■
Keep the firewa updated w th the atest firmware vers ons, wh ch are ava ab e for down oad from the manufacturer’s webs te
Planning for Security
CHAPTER 3
43
Summary In th s chapter, we covered how to des gn or prepare a network pr or to nsta ng W ndows Sma Bus ness Server 2011 Standard We a so covered bas c nam ng convent ons and how to p an for adequate network secur ty The next chapter covers p ann ng for fau t to erance and fau t avo dance on your SBS network to he p you bu d a re ab e SBS network that can support your bus ness
44 CHAPTER 3
Planning Your SBS Network
CHAPTER 4
Planning Fault Tolerance and Avoidance E
ven the most opt m st c system adm n strator knows that sooner or ater she or he w be faced w th a major prob em We’ cover prepar ng for d sasters n depth n Chapter 28, “D saster P ann ng,” and you shou d refer to that chapter for nformat on on how to prepare for major prob ems and bu d a d saster recovery p an to respond qu ck y and effic ent y to major troub e But as exh arat ng as t may be to work through a major prob em and successfu y recover from t, t’s far better to avo d major prob ems as much as poss b e Th s chapter focuses on the hardware and software too s that he p you to bu d a h gh y ava ab e and fau t-to erant M crosoft W ndows Sma Bus ness Server (SBS) env ronment Remember, however, that hardware and software are on y a sma part of the equat on—bu d ng and dep oy ng for fau t to erance requ res t me, a c ear understandng of the necessary tradeoffs, and—most mportant—d sc p ne Yes, you can avo d most computer downt me, but you’ need to be rea st c about what your resources are and what you can reasonab y afford to spend Because SBS does not support c uster ng (a though we’ cover an nterest ng workaround us ng v rtua zat on n Chapter 6, “Configur ng SBS n Hyper-V”), your opt ons for h gh ava ab ty are somewhat m ted However, you can st take some mportant steps to mprove your ava ab ty and fau t to erance Your pr mary focus needs to be on bu dng fau t to erance nto your server and network nfrastructure Bu d ng fau t-to erant systems doesn’t come w thout costs, n both effort and money In th s chapter, we’ try to he p you make nformed dec s ons about where to most costeffect ve y bu d fau t to erance nto your SBS env ronment, wh e mak ng the best use of your current resources To use th s nformat on, you shou d have a c ear understand ng of the bus ness needs you’re try ng to reso ve, and a rea st c assessment of the resources ava ab e to meet those requ rements When p ann ng for a h gh y ava ab e and fau t-to erant dep oyment, you shou d cons der a po nts of fa ure and work to e m nate any s ng e po nt of fa ure Redundant power supp es, dua -d sk contro ers, mu t p e network nterface cards, and fau t-to erant d sk arrays such as redundant array of ndependent d sks (RAID) are a strateg es you can and shou d emp oy
45
Mean Time to Failure and Mean Time to Recover The two most common metr cs used to measure fau t to erance and avo dance are the fo ow ng ■ ■
Mean time to failure (MTTF) The mean t me unt the dev ce w fa Mean time to recover (MTTR) The mean t me t takes to recover after a fa ure has occurred
A though a great dea of t me and energy s often spent try ng to ower the MTTF, rea ze that even f you have a fin te fa ure rate, an MTTR that s zero or near zero m ght be nd st ngu shab e from a system that hasn’t fa ed Downt me s genera y measured as MTTR d v ded by MTTF, so ncreas ng the MTTF w reduce the downt me—but at a s gn ficant cost Try ng to ncrease the MTTF beyond a certa n po nt can be proh b t ve y expens ve A more cost-effect ve and rea st c strategy, espec a y n the sma bus ness space where resources are fin te and customers are very cost-consc ous, s to spend both t me and resources on managng and reduc ng the MTTR for your most ke y and cost y po nts of fa ure Most modern e ectron c components have a d st nct ve “bathtub” curve that represents the r fa ure character st cs, as shown n F gure 4-1 Dur ng the ear y fe of the component (referred to as the burn- n phase), t’s more ke y to fa When th s n t a phase s over, a component’s overa fa ure rate rema ns qu te ow unt t reaches the end of ts usefu fe, when the fa ure rate ncreases aga n
Normal Aging
Failure Mode
Failure Rate
Burn In
Time Figure 4-1 The norma stat st ca fa ure rates for mechan ca and e ectron c components: a character st c
“bathtub” curve
46 CHAPTER 4
Planning Fault Tolerance and Avoidance
Under The Hood Hard Disk Reliability
T
he typical commodity hard disk of 15 years ago had an MTTF on the order of three years. Today, the manufacturer’s published MTTF for a typical commodity
hard disk is more likely to be 35 to 50 years, with MTTF ratings of server-oriented hard drives hitting 134 years!
At least part of that difference is a direct result of counting only the portion of the curve in the normal aging section, while taking externally caused failure out of the equation. Therefore, a hard disk that fails because of an improperly filtered power spike doesn’t count against the MTTF of the disk, nor does a disk that fails in its first week or two. This might be nice for the disk manufacturer’s statistics, but it doesn’t do much for the system administrator whose system has crashed because of a disk failure. As you can see, it’s important to look at the total picture and carefully evaluate all the factors and failure points on your system. Only by looking at the whole system, including the recovery procedures and methodology, can you build a truly faulttolerant environment.
Protecting the Power Supply The s ng e b ggest fa ure po nt for any network s ts power supp y If you don’t have power, you can’t run your computers It seems pretty obv ous, and most of us s ap an un nterruptb e power supp y (UPS) on the order when we’re buy ng a new server However, th s bare y scratches the surface of what you can and shou d do to protect your network from power prob ems You need to protect your network from four bas c types of power prob ems ■
Local power supply failure Fa ure of the nterna power supp y on a server, router, or other network component
■
Voltage variations Sp kes, surges, sags, and onger-term brownouts
■
Short-term power outages Externa power fa ures ast ng from fract ons of a second to severa m nutes
■
Long-term power outages Externa power fa ures ast ng from severa m nutes to severa hours or even days
Each type of power prob em poses d fferent r sks to your network and requ res somewhat d fferent protect on mechan sms The eve of threat that each poses to your env ronment vares depend ng on the area where you are ocated, the qua ty of power ava ab e to you, and the potent a oss to your bus ness f your computers are down
Protecting the Power Supply
CHAPTER 4
47
Local Power Supply Failure Computer power supp es have made substant a ga ns n the ast 10 years, but they are st one of the greatest r sk po nts A the power cond t on ng, un nterrupt b e power supp es, and externa generators n the wor d won’t he p much f your server’s power supp y fa s Most servers these days e ther come w th a redundant power supp y or have the opt on of nc udng one Take the opt on! The extra cost assoc ated w th add ng a redundant power supp y to a server or cr t ca p ece of network hardware s far ess than the cost of downt me f the power supp y fa s We found th s out the hard way recent y—our ma n server turned out to have a run of bad power supp es The manufacturer knew about the prob em and rep aced them w thout quest on But f t hadn’t been for the second power supp y n t, we’d have been down and out unt the rep acement got to us As t was, they a so rep aced the second power supp y n the server w thout wa t ng for t to fa because t was part of the same batch of bad power supp es If your server, router, or other p ece of network hardware doesn’t have the opt on of a redundant power supp y, order a spare power supp y for t when you order the or g na hardware Don’t count on the hardware manufacturer’s “four-hour response t me,” espec a y when you cons der the cost to your bus ness even f they actua y repa r the equ pment n four hours If you have a spare power supp y n a we -marked cab net where you can eas y find t, you can qu ck y and w th m n ma d srupt on rep ace the fa ed power supp y and return the equ pment to fu funct ona ty Then you can afford to wa t pat ent y for the manufacturer’s serv ce response Note Most major manufacturers use proprietary components in their servers. This usu-
ally means that you can’t count on using an off-the-shelf component, such as a power supply, but must use one specifically designed to fit the particular brand and model of server you have.
Real World It’s Only Useful if You Can Find It!
H
aving a good supply of critical spares is a great idea, but sometimes reality intrudes. Storage can be the weak link here. Most server rooms are not nearly
as spacious as we would like them to be, and in the SBS world a server room might be little more than a lockable closet. If that’s the case, make sure the closet has adequate, filtered ventilation and cooling—servers produce a significant amount of heat, and a poorly ventilated environment will greatly shorten the life of your server.
48 CHAPTER 4
Planning Fault Tolerance and Avoidance
Dust is the enemy of your server—it will impede cooling and can actually short out electrical components. Server rooms should not have carpeting. And remove any printers from the area—printers are dust generators. All too often, the spare parts end up jammed into a bin or shoved onto an upper shelf with inadequate or nonexistent identification. If your network is down and you need a power supply to get it back up, you don’t want to be pawing through a jumble of spare parts looking for the right power supply. Make every effort to develop a single, central, secure location for all spare parts. At least then you have only a single place to search. Then make sure the manufacturer’s part number is visible, and clearly label the computer or computers each part is for. Protect the part from dust and spilled coffee by keeping it in a sealed plastic storage bag. We like to tape a list of the manufacturer’s part numbers, details of the installed hardware, and the list of spare parts we have right inside the case cover of the server itself. It’s easy to find and doesn’t end up getting lost. It does you no good to have a spare power supply if you can’t find it or don’t know you have it. And don’t forget to include the location of any special tools required. It never ceases to amaze us how many different and apparently unique screwdriver bits we need to get into our various computers! We started our toolkit with an inexpensive computer toolkit, and we add tools to it as needed.
F na y, pract ce! If you’ve never rep aced a power supp y before, and you don’t have c ear and deta ed nstruct ons, t w take you orders of magn tude onger to rep ace t when the server s down and everyone s ye ng and the phone keeps r ng ng By pract c ng the rep acement of the power supp es n your cr t ca hardware, you’ save t me and reduce the stress nvo ved Idea y, document the steps you need to perform, and nc ude we - ustrated and deta ed nstruct ons on how to rep ace the power supp es of your cr t ca hardware as part of your d saster recovery standard operat ng procedures If you can swap out a fa ed power supp y n 10 m nutes, rather than wa t ng hours unt an outs de techn c an arr ves, you’ve saved more than enough money to pay for the spare part severa t mes over
Protecting the Power Supply
CHAPTER 4
49
Real World SNMP
S
imple Network Management Protocol (SNMP) has been around for a long time, and it provides a standardized way for devices, including computers, to provide
feedback about their health. Many OEM servers come installed with third-party
management suites that can be configured to notify you of significant events—such as power variations, CPU temperatures, and disk events—that can be a precursor to hard disk failure. If your server comes with such a tool, by all means use it.
Voltage Variations Even n areas w th except ona y c ean power that s a ways ava ab e, the power that s supp ed to your network nev tab y fluctuates M nor, short-term var at ons mere y stress your e ectron c components, but major var at ons can tera y fry them You shou d never, ever s mp y p ug a computer nto an ord nary wa socket w thout prov d ng some sort of protect on aga nst vo tage var at ons The fo ow ng sect ons descr be the types of var at ons and the best way to protect your equ pment aga nst them
Spikes Sp kes are arge but short- ved ncreases n vo tage They can occur because of externa factors, such as ghtn ng str k ng a power ne, or because of nterna factors, such as a arge motor start ng The most common causes of severe vo tage sp kes are externa and outs de your contro The effects can be devastat ng A nearby ghtn ng str ke can eas y cause a sp ke of 1000 vo ts or more to be sent nto equ pment des gned to run on 110 to 120 vo ts Few, f any, e ectron c components are des gned to w thstand arge vo tage sp kes of severa thousand vo ts, and a most a w suffer damage f they’re not protected from them Protect on from sp kes comes n many forms, from the $19 95 power str p w th bu t- n surge protect on that you can buy at your oca hardware store to comp cated arrays of transformers and spec a zed sacr fic a trans stors that are des gned to d e so that others may ve Unfortunate y, those $19 95 power str ps just aren’t good enough They are better than noth ng, but bare y They have a m ted ab ty to w thstand rea y arge sp kes More spec a zed (and more expens ve, of course) surge protectors that are spec fica y des gned to protect computer networks are ava ab e from var ous compan es They d ffer n the r ab ty to protect aga nst rea y arge sp kes and n the r cost There’s a fa r y d rect corre at on between the cost of these products and the r rated capac ty and speed of act on w th n any company’s range of products, but the cost for a g ven eve of protect on can d ffer s gn ficant y from company to company As a ways, f the pr ce sounds too good to be true, t s In genera , these surge protectors are des gned to work by sens ng a arge ncrease n vo tage and creat ng an a ternate e ectr ca path for that excess ve vo tage that doesn’t a ow t to get through to your server In the most severe sp kes, the surge protectors shou d destroy
50 CHAPTER 4
Planning Fault Tolerance and Avoidance
themse ves before a ow ng the vo tage to get through to your server The effect veness of these stand-a one surge protectors depends on the speed of the r response to a arge vo tage ncrease and the mechan sm of fa ure when the r capac ty s exceeded If the surge protector doesn’t respond qu ck y enough to a sp ke, bad th ngs w happen Most UPSs a so prov de some protect on from sp kes They have bu t- n surge protectors, p us so at on c rcu try that tends to buffer the effects of sp kes The effect veness of the sp ke protect on n a UPS s not d rect y re ated to ts cost, however—the overa cost of the UPS s more a factor of ts effect veness as an a ternat ve power source Your respons b ty s to read the fine pr nt and understand the m tat ons of the surge protect on a g ven UPS offers A so remember that just as w th s mp e surge protectors, arge vo tage sp kes can cause the surge protect on to se f-destruct rather than a ow the vo tage through to your server That’s the good news; the bad news s that nstead of hav ng to rep ace just a surge protector, you’re ke y to have to repa r or rep ace the UPS Note Online or continuous UPSs are far more effective at protecting downstream elec-
tronic equipment than standard reactive UPSs. Even though an online UPS typically costs 1.5 to 2 times the price of a standard reactive UPS of the same capacity, it’s money well spent.
F na y, one other sp ke protect on mechan sm can be he pfu —the constant vo tage transformer (CVT) You’re not ke y to see one un ess you’re n a arge ndustr a sett ng, but they are often cons dered to be a suffic ent rep acement for other forms of surge protect on Unfortunate y, they’re not rea y opt ma for sp ke protect on They do fi ter some excess vo tage, but a arge sp ke s ke y to find ts way through However, n comb nat on w th e ther a fu y protected UPS or a good stand-a one surge protector, a CVT can be qu te effect ve They a so prov de add t ona protect on aga nst other forms of vo tage var at on that surge protectors a one can’t beg n to manage
Surges Vo tage surges and sp kes are often d scussed nterchangeab y, but we’d ke to make a d st nct on here For our purposes, a surge asts onger than most sp kes and sn’t near y as arge Most surges ast a few hundred m seconds and are rare y over 1000 vo ts They can be caused by many of the same factors that cause vo tage sp kes Prov d ng protect on aga nst surges s somewhat eas er than protect ng aga nst arge sp kes Most of the protect on mechan sms just d scussed a so adequate y hand e surges In add t on, most CVTs are suffic ent to hand e surges and m ght even hand e them better f the surge s so pro onged that t threatens to overheat and burn out a s mp e surge protector
Protecting the Power Supply
CHAPTER 4
51
Sags Vo tage sags are short-term reduct ons n the vo tage de vered They aren’t comp ete vo tage fa ures or power outages and are shorter than a fu -sca e brownout Vo tage sags can drop the vo tage we be ow 100 vo ts on a 110- to 120-vo t norma ne and cause most servers to reboot f protect on sn’t prov ded Stand-a one surge protectors prov de no defense aga nst sags You need a UPS or a very good CVT to prevent damage from a vo tage sag Severe sags can overcome the rat ng of a but the best constant vo tage transformers, so you genera y shou dn’t use a CVT as the so e protect on aga nst sags A UPS, w th ts battery power supp y, s an essent a part of your protect on from prob ems caused by vo tage sags
Brownouts A brownout s a p anned, de berate reduct on n vo tage from your e ectr c ut ty company Brownouts most often occur n the heat of the summer and are des gned to protect the ut ty company from over oad ng They are not des gned to protect the consumer, however In genera , a brownout reduces the ava ab e vo tage by 5 to 20 percent from the norma va ue A CVT or a UPS prov des exce ent protect on aga nst brownouts, w th n m ts Proonged brownouts m ght exceed your UPS’s ab ty to ma nta n a charge at the same t me that t s prov d ng power at the correct vo tage to your equ pment Mon tor the hea th of your UPS carefu y dur ng a brownout, espec a y because the r sk of a comp ete power outage ncreases f the power company’s vo tage reduct on strategy proves nsuffic ent The best protect on aga nst extended brownouts s a CVT of suffic ent rat ng to fu y support your cr t ca network dev ces and servers If you ve n an area that s subject to brownouts and your budget can afford t, a good CVT s an exce ent nvestment Th s transformer takes the reduced vo tage prov ded by your power company and ncreases t to the rated output vo tage A good constant vo tage transformer can hand e most brownouts for an extended t me w thout prob ems, but you shou d st supp ement the CVT w th a qua ty UPS and surge protect on between the transformer and the server or network dev ce Th s extra protect on s espec a y mportant wh e the power company s attempt ng to restore power to fu vo tage, because dur ng th s per od you run a h gher r sk of exper enc ng power and vo tage fluctuat ons
52 CHAPTER 4
Planning Fault Tolerance and Avoidance
Short-Term Power Outages Short-term power outages ast from a few m seconds to a few m nutes They can be caused by e ther nterna or externa events, but you can rare y p an for them even f they are nterna A server that s unprotected from a short-term power outage w , at the very east, reboot or, at the worst, fa catastroph ca y The best protect on aga nst a short-term power outage s a UPS n comb nat on w th h gh-qua ty sp ke protect on Be aware that many momentary nterrupt ons of power are accompan ed by arge sp kes when the power s restored Further, a ser es of short-term power outages often occur consecut ve y, caus ng add t ona stress to e ectron c components
Long-Term Power Outages Long-term power outages, ast ng from an hour or so to severa days, are often accompan ed by other, more ser ous prob ems un ess your server room s n a very remote ocat on Longterm power outages can be caused by storms, earthquakes, fires, and the ncompetence of e ectr c power ut t es, among other th ngs As such, p ans for dea ng w th ong-term power outages shou d be part of an overa d saster recovery p an (See Chapter 28 for more on d saster p ann ng ) Protect on aga nst ong-term power outages rea y becomes a dec s on about how ong you want or need to funct on f a power s out If you need to funct on ong enough to be ab e to gracefu y shut down your network, a s mp e UPS or a co ect on of them w be suffic ent, assum ng that you’ve s zed the UPS correct y However, f you need to be sure that you can ma nta n the fu funct ona ty of your SBS network dur ng an extended power outage, you’re go ng to need a comb nat on of one or more UPSs and an aux ary generator But before you start spend ng money on generators and fa over sw tches, eva uate the overa nfrastructure supp y ng your power If you’re dependent on Internet connect v ty to do bus ness, t does you no good to be up and runn ng n the m dd e of a two-day power outage f your Internet s a so down
Real World Generators Require Serious Expertise and Maintenance
W
e’ve been involved with more than one operation that depended on—and implemented—auxiliary generators to support their operations during
extended power outages. Included in this group is our office, thanks to the regular (and often extended) outages that the weather here causes. The results of having an auxiliary generator have been rather mixed, however. The one lesson we’ve learned the hard way is that simply buying and installing an auxiliary generator will do little, if anything, to keep you up and running when the power goes out. Generators are complex mechanical and electrical machines that require specialized expertise and consistent, conscientious processes and maintenance.
Protecting the Power Supply
CHAPTER 4
53
If your situation requires an auxiliary generator to supplement your UPSs, you should carefully plan your power strategy to ensure that your generator has sufficient clean load capacity to provide the power your network will require in the event of a long-term power outage. Portable industrial generators often do not provide clean, sine wave power and are not appropriate for computer networks. Verify with the manufacturer that the generator you are considering is rated for electronics and computers. Generators that produce sine wave output and are rated for electronics are inevitably more expensive than the generators intended for most construction jobs. We had to spend nearly twice as much within the same brand and power rating to get a suitable generator for our office. But it has more than paid for itself since! Make sure you have a sufficient fuel source to power the generator for as long as you reasonably expect to have power out. Important For all but the smallest businesses, a generator powered
by piped-in natural gas is a far safer and more appropriate solution than a gasoline-powered generator with all the potential issues that storage of gasoline can entail. To install and set up the generator, you’ll need the expertise of a licensed electrician who has experience installing and configuring generator failover switches. Test your solution to make sure you didn’t miss anything! Further, you should regularly test the effectiveness of your disaster recovery plans and make sure that all key personnel know how to start the auxiliary generator manually in the event it doesn’t start automatically. Finally, you should have a regular preventive maintenance (PM) program in place that services and tests the generator and ensures that it is ready and functioning when you need it. This PM program should include both static tests and full load tests on a regular basis, and it should also call for periodically replacing the fuel to the generator if it’s gasoline powered. One of the best ways to do all of this is to plan and execute a “disaster day” for testing your entire disaster recovery plan in as close to real-world conditions as possible, including running your entire operation from the backup generator.
54 CHAPTER 4
Planning Fault Tolerance and Avoidance
Disk Arrays The most common computer hardware ma funct on s probab y a hard d sk fa ure Even though hard d sks have become more re ab e over t me, they are st subject to fa ure, espec a y dur ng the r first month or so of use They are a so vu nerab e to both catastroph c and degenerat ve fa ures caused by power prob ems Fortunate y, d sk arrays have become the norm for servers, and good fau t-to erant hardware RAID systems are ava ab e and supported on SBS The cho ce of RAID and the part cu ars of how you configure your RAID system can s gn ficant y affect the cost of your servers To make an nformed cho ce for your env ronment and needs, you must understand the tradeoffs and the d fferences n fau t to erance, speed, configurab ty, and so on
Hardware vs. Software RAID can be mp emented at the hardware eve , us ng RAID contro ers, or at the software eve , e ther by the operat ng system or by a th rd-party add-on SBS supports both hardware RAID and ts own software RAID Hardware RAID mp ementat ons requ re ded cated contro ers and cost somewhat more than an equ va ent eve of software RAID However, for that extra pr ce, you get a faster, more flex b e, and more fau t-to erant RAID When compared to the software RAID prov ded n SBS 2010, a good hardware RAID contro er supports more eve s of RAID, on-the-fly reconfigurat on of the arrays, hot-swap and hot-spare dr ves (d scussed ater n th s chapter), and ded cated cach ng of both reads and wr tes Software RAID requ res that you convert your d sks to dynam c d sks We don’t recommend convert ng your system d sk or boot d sks, because dynam c d sks can be more d fficu t to access f a prob em occurs, and the SBS setup and nsta at on program prov des on y m ted support For max mum fau t to erance, we recommend us ng hardware m rror ng (RAID-1) on your system dr ve Dynam c d sks, and the software RAID they support, are a so a prob em for v rtua zat on and shou d not be used when you are v rtua z ng SBS
RAID Levels for Fault Tolerance Except for eve 0, RAID s a mechan sm for stor ng suffic ent nformat on on a group of hard d sks so that even f one hard d sk n the group fa s, no nformat on s ost Some RAID arrangements go even further, prov d ng protect on n the event of mu t p e hard d sk fa ures The more common eve s of RAID and the r appropr ateness n a fau t-to erant env ronment are shown n Tab e 4-1
Disk Arrays
CHAPTER 4
55
Table 4-1 RA D eve s and the r fau t to erance
Level
Number of Disks*
Speed
Fault Tolerance
0
N
+++
---
Str p ng a one Not fau t-to erant— t actua y ncreases your r sk of fa ure—but does prov de for the fastest read and wr te performance
1
2N
+
++
M rror or dup ex S ght y faster read than s ng e d sk, but no ga n dur ng wr te operat ons Fa ure of any s ng e d sk causes no oss n data and m n ma performance h t
3
N+1
++
+
Byte- eve par ty Data s str ped across mu t p e dr ves at the byte eve w th the par ty nformat on wr tten to a s ng e ded cated dr ve Reads are much faster than w th a s ng e d sk, but wr tes operate s ght y s ower than a s ng e d sk because par ty nformat on must be generated and wr tten to a s ng e d sk Fa ure of any s ng e d sk causes no oss of data but can cause a s gn ficant oss of performance
4
N+1
++
+
B ock- eve par ty w th a ded cated par ty d sk S m ar to RAID-3 except that data s str ped at the b ock eve
5
N+1
+
++
Inter eaved b ock- eve par ty Par ty nformat on s d str buted across a dr ves Reads are much faster than a s ng e d sk, but wr tes are s gn ficant y s ower Fa ure of any s ng e d sk prov des no oss of data but resu ts n a major reduct on n performance
6
N+2
+
+++
Rep cated nter eaved b ock- eve par ty Par ty nformat on s d str buted across a dr ves, w th two par ty b ocks on separate dr ves for every str pe Reads are much faster than a s ng e d sk, but wr tes are s gn ficant y s ower Fa ure of any two d sks prov des no oss of data but resu ts n a major reduct on n performance
56 CHAPTER 4
Planning Fault Tolerance and Avoidance
Description
Number of Disks*
Speed
Fault Tolerance
0+1 and 10
2N
+++
++
Str ped m rrored d sks or m rrored str ped d sks Data s str ped across mu t p e m rrored d sks, or mu t p e str ped d sks are m rrored Fa ure of any one d sk causes no data oss and no speed oss Fa ure of a second d sk cou d resu t n data oss Faster than a s ng e d sk for both reads and wr tes
Other
Var es
+++
+++
Array of RAID arrays D fferent hardware vendors have d fferent propr etary names for th s RAID concept Exce ent read and wr te performance Fa ure of any one d sk resu ts n no oss of performance and cont nued redundancy
Level
Description
*In the Number of Disks column, N refers to the number of hard disks required to hold the original copy of the data. The plus and minus symbols show relative improvement or deterioration compared to a system using no version of RAID. The scale peaks at three symbols.
Note RAID is an excellent solution for fault tolerance, but it can’t protect you against
corruption caused by hardware or software failures. Only a good backup of data from before the corruption can protect against that.
When choos ng the RAID eve to use for a g ven app cat on or server, cons der the fo owng factors ■
Intended use W th s app cat on be pr mar y read- ntens ve, such as fi e servng, or w t be predom nant y wr te- ntens ve, such as a transact ona database? SBS servers are heav y wr te- ntens ve, at east on the d sks that M crosoft Exchange uses V rtua zat on s a so h gh y d sk- ntens ve
■
Fault tolerance How cr t ca s th s data, and how much can you afford to ose?
■
Availability Does th s server or app cat on need to be ava ab e at a t mes, or can you afford to reboot t or otherw se take t offl ne for br ef per ods?
■
Performance Is th s app cat on or server heav y used, w th arge amounts of data be ng transferred to and from t, or s th s server or app cat on ess I/O- ntens ve? If th s s your ma n SBS server, t’s heav y used
■
Cost Are you on a t ght budget for th s server or app cat on, or s the cost of data oss or unava ab ty the pr mary dr v ng factor?
You need to eva uate each of these factors when you dec de wh ch type of RAID to use for a server or port on of a server No s ng e answer fits a cases, but the fina answer requ res you to carefu y we gh each of these factors and ba ance them aga nst your s tuat on and
Disk Arrays
CHAPTER 4
57
your needs The fo ow ng sect ons take a c oser ook at each factor and how t we ghs n the overa dec s on-mak ng process
Intended Use The ntended use, and the k nd of d sk access assoc ated w th that use, p ays an mportant ro e n determ n ng the best RAID eve for your app cat on Th nk about how wr te- ntens ve the app cat on s and whether the manner n wh ch the app cat on uses the data s more sequent a or random Is your app cat on a three-square-mea s-a-day k nd of app cat on, w th re at ve y arge chunks of data be ng read or wr tten at a t me, or s t more of a grazer or n bb er, read ng and wr t ng tt e b ts of data from a sorts of d fferent p aces? If your app cat on s re at ve y wr te- ntens ve, you’ want to avo d software RAID or RAID-5 and RAID-6 f other cons derat ons don’t requ re them W th RAID-5 and RAID-6, any app cat on that requ res more than 50 percent wr tes to reads s ke y to be at east somewhat s ower, f not much s ower, than t wou d be on a s ng e d sk or a RAID-1 m rror You can m t gate th s to some extent by us ng more but sma er dr ves n your array and by us ng a hardware contro er w th a arge cache to offload the par ty process ng as much as poss b e RAID-1, n e ther a m rror or dup ex configurat on, prov des a h gh degree of fau t to erance w th no s gn ficant pena ty dur ng wr te operat ons—a good cho ce for the system d sk If your app cat on s pr mar y read- ntens ve and the data s stored and referenced sequent a y, RAID-3 or RAID-4 m ght be a good cho ce Because the data s str ped across many dr ves, you have para e access to t, mprov ng your throughput And because the par ty nformat on s stored on a s ng e dr ve rather than d spersed across the array, sequent a read operat ons don’t have to sk p over the par ty nformat on and are therefore faster However, wr te operat ons are substant a y s ower, and the s ng e par ty dr ve can become an I/O bott eneck dur ng wr te operat ons Note RAID-3 and RAID-4 have been largely supplanted by other RAID technologies,
primarily RAID-5 and RAID-10. In an SBS environment, RAID-3 and RAID-4 are unlikely to be an appropriate choice, and you should consider them only for specialized applications.
If your app cat on s pr mar y read- ntens ve and not necessar y sequent a , RAID-5 and RAID-6 are obv ous cho ces They prov de a good ba ance of speed and fau t to erance, and the cost s substant a y ower than the cost of RAID-1 or RAID-10 D sk accesses are even y d str buted across mu t p e dr ves, and no s ng e dr ve has the potent a to be an I/O bott eneck However, wr tes requ re ca cu at on of the par ty nformat on and the extra wr te of that par ty, s ow ng wr te operat ons down s gn ficant y W ndows Sma Bus ness Server fi e shares are a good fit for RAID 5 and RAID 6, but avo d them for the vo ume that ho ds wr tentens ve database fi es
58 CHAPTER 4
Planning Fault Tolerance and Avoidance
If your app cat on prov des other mechan sms for data recovery or uses arge amounts of temporary storage that doesn’t requ re fau t to erance, a s mp e RAID-0, w th no fau t to erance but fast reads and wr tes, s a poss b ty However, we strong y adv se aga nst RAID-0 on an SBS server un ess you c ear y understand that anyth ng on a RAID-0 array s comp ete y unprotected and s actua y more ke y to fa than a s ng e d sk
Fault Tolerance Carefu y exam ne the fau t to erance of each of the poss b e RAID cho ces for your ntended use A RAID eve s except RAID-0 prov de some degree of fau t to erance, but the effect of a fa ure and the ab ty to recover from subsequent fa ures are d fferent If a dr ve n a RAID-1 m rror or dup ex array fa s, a fu , comp ete, exact copy of the data rema ns Access to your data or app cat on s un mpeded, and performance degradat on s m n ma , a though you do ose the benefit ga ned on read operat ons of be ng ab e to read from e ther d sk Unt the fa ed d sk s rep aced, however, you have no fau t to erance on the rema n ng d sk Once you rep ace the fa ed d sk, overa performance s s gn ficant y reduced wh e the new d sk s n t a zed and the m rror s rebu t Modern RAID contro ers can vary the speed of data reconstruct on when rep ac ng a fa ed d sk, a ow ng you to ba ance the speed of regenerat on aga nst the performance degradat on In a RAID-3 or RAID-4 array, f one of the data d sks fa s, a s gn ficant performance degradat on occurs because the m ss ng data needs to be reconstructed from the par ty nformat on A so, you’ have no fau t to erance unt the fa ed d sk s rep aced If the par ty d sk fa s, you’ have no fau t to erance unt t s rep aced, but a so no performance degradat on Once you rep ace the fa ed d sk, overa performance s s gn ficant y reduced wh e the new d sk s n t a zed and the par ty nformat on or data s rebu t In a RAID-5 array, the oss of any d sk resu ts n a s gn ficant performance degradat on, and your fau t to erance w be gone unt you rep ace the fa ed d sk Once you rep ace the d sk, you won’t return to fau t to erance unt the ent re array has a chance to rebu d tse f, and performance s ser ous y degraded dur ng the rebu d process In a RAID-6 array, the oss of any d sk resu ts n a s gn ficant performance degradat on, but you w st be fau t to erant The fa ure of a second d sk w not cause data oss, but t w eave you w th no fau t to erance Once you rep ace a fa ed d sk, you won’t return to fu fau t to erance unt the ent re array has a chance to rebu d tse f, and performance s ser ous y degraded dur ng the rebu d process If a dr ve n a RAID 0+1 or RAID-10 array fa s, a fu , comp ete, exact copy of the data rema ns Access to your data or app cat on s un mpeded, and performance degradat on s m n ma Unt the fa ed d sk s rep aced, however, you have ncomp ete fau t to erance on the array A second d sk fa ure, f t occurs on the oppos te s de of the m rror, w cause data oss Once you rep ace the fa ed d sk, overa performance s s gn ficant y reduced wh e the new d sk s n t a zed and the m rror s rebu t Modern RAID contro ers can vary the speed of data reconstruct on when rep ac ng a fa ed d sk, a ow ng you to ba ance the speed of regenerat on aga nst the performance degradat on
Disk Arrays
CHAPTER 4
59
RAID systems that are arrays of arrays can prov de for mu t p e fa ure to erance These arrays prov de for mu t p e eve s of redundancy and are appropr ate for m ss on-cr t ca app cat ons that must be ab e to w thstand the fa ure of more than one dr ve n an array
Availability A eve s of RAID, except RAID-0, prov de h gher ava ab ty than a s ng e dr ve However, f ava ab ty s expanded to a so nc ude the overa performance eve dur ng fa ure mode, some RAID eve s prov de defin te advantages over others Spec fica y, RAID-1 and ts der vat ves, RAID-10 and RAID 0+1, prov de enhanced ava ab ty when compared to RAID eve s 3, 4, 5, and 6 dur ng fa ure mode The performance degradat on s m n ma when compared to a s ng e d sk f one ha f of a m rror fa s, whereas a RAID-5 or RAID-6 array has substant a y comprom sed performance unt the fa ed d sk s rep aced and the array s rebu t In add t on, RAID systems that are based on an array of arrays can prov de h gher ava ab ty than RAID eve s 1 through 6 Runn ng on mu t p e contro ers, these arrays are ab e to to erate the fa ure of more than one d sk and the fa ure of one of the contro ers, prov d ng protect on aga nst the s ng e po nt of fa ure nherent n any s ng e-contro er arrangement RAID 1 that uses dup exed d sks runn ng on d fferent contro ers—as opposed to RAID-1 that uses m rror ng on the same contro er—a so prov des th s add t ona protect on and mproved ava ab ty Hot-swap dr ves and hot-spare dr ves (d scussed ater n th s chapter) can further mprove ava ab ty n cr t ca env ronments, espec a y hot-spare dr ves By prov d ng for automat c fa over and rebu d ng, they can reduce your exposure to catastroph c fa ure and prov de for max mum ava ab ty
Performance The re at ve performance of each RAID eve depends on the ntended use The best comprom se for many s tuat ons s arguab y RAID-5 or RAID-6, but you shou d quest on the adequacy of that comprom se f your app cat on s fa r y wr te- ntens ve Espec a y for re at ona database data and ndex fi es where the database s moderate y or h gh y wr te- ntens ve, the performance h t of us ng RAID-5 or RAID-6 can be substant a A better a ternat ve s to use RAID 0+1 or RAID-10 Whatever eve of RAID you choose for your part cu ar app cat on, t w benefit from usng more sma d sks rather than a few arge d sks The more dr ves contr but ng to the str pe of the array, the greater the benefit of para e read ng and wr t ng you’ be ab e to rea ze— and your array’s overa throughput w mprove
60 CHAPTER 4
Planning Fault Tolerance and Avoidance
Cost The de ta n cost between RAID configurat ons s pr mar y the cost of dr ves, potent a y nc ud ng the cost of add t ona array enc osures because more dr ves are requ red for a part cu ar eve of RAID RAID-1—e ther dup ex ng or m rror ng— s the most expens ve of the convent ona RAID eve s because t requ res at east 33 percent more raw d sk space for a g ven amount of net storage space than other RAID eve s Another cons derat on s that RAID eve s that nc ude m rror ng or dup ex ng must use dr ves n pa rs Therefore, t’s more d fficu t (and more expens ve) to add on to an array f you need add t ona space on the array A net 144-g gabyte (GB) RAID 0+1 array, compr s ng four 72-GB dr ves, requ res four more 72-GB dr ves to doub e n s ze—a somewhat daunt ng prospect f your array cab net has bays for on y s x dr ves, for examp e A net 144-GB RAID-5 array of three 72-GB dr ves, however, can be doub ed n s ze s mp y by add ng two more 72-GB dr ves, for a tota of five dr ves RAID arrays based on 2 5- nch dr ves are rap d y rep ac ng trad t ona 3 5- nch dr ves The sma er 2 5- nch dr ves take up ess phys ca space for the same amount of tota storage, wh e consum ng substant a y ess power and generat ng ess heat The n t a cost of the array s essent a y s m ar to that of an equ va ent array us ng 3 5- nch dr ves, but the ongo ng costs are ess Our current preferred array system uses e ght 2 5- nch SAS dr ves configured as RAID 0+1 The ent re array fits n the space of a pa r of standard CD/DVD dr ves
Hot-Swap and Hot-Spare Disk Systems Hardware RAID systems can prov de for both hot-swap and hot-spare capab t es A hot-swap d sk system a ows fa ed hard d sks to be removed and a rep acement d sk to be nserted nto the array w thout power ng down the system or reboot ng the server When the new d sk s nserted, t s automat ca y recogn zed and e ther w be automat ca y configured nto the array or can be manua y configured nto t Add t ona y, many hot-swap RAID systems a ow you to add hard d sks nto empty s ots dynam ca y and automat ca y or manua y ncrease the s ze of the RAID vo ume on the fly w thout a reboot A hot-spare RAID configurat on uses an add t ona , preconfigured d sk or d sks to automatca y rep ace a fa ed d sk These systems can be configured to automat ca y regenerate the array n the event of a fa ure, thus ma nta n ng max ma redundancy When comb ned w th a RAID configurat on that can w thstand mu t p e dr ve fa ures, such as RAID-6, a hot-spare system prov des a very h gh degree of redundancy and ava ab ty Even where you don’t have a hot-spare dr ve a ready configured nto your array, t makes sense to a ways keep a match ng spare dr ve ava ab e n your rep acement-parts cab net Hard dr ves aren’t a that expens ve, and hav ng a spare w save you t me f you have a dr ve fa ure n your array P us, w th dr ve s zes and techno ogy chang ng rap d y, t can be annoyng to try to find a match ng dr ve two or three years after you buy the or g na array
Disk Arrays
CHAPTER 4
61
Redundant Networking Hav ng a server up and runn ng s fa r y use ess f the server can’t commun cate w th the rest of your network or the outs de wor d Bu d ng redundancy nto your power and d sk systems s mportant, but t does you tt e good f your network ng fa s Protect ng aga nst a network-card fa ure can be as s mp e as hav ng a spare network card, dea y of the same type as s n your server In the event of a fa ure, rep ac ng the card takes on y a few m nutes onger than t takes to reboot the server, f you can find the spare A better opt on s to eave the spare card p ugged n to a spare s ot but d sab ed n W ndows F na y, f your server supports t, us ng network card team ng prov des redundancy n the event of fa ure w th h gher throughput under norma operat on But be sure your app cat on supports teamed network ng before mp ement ng t Unfortunate y, SBS doesn’t offic a y support network team ng, and t can p ay havoc w th the SBS w zards G ven that, we don’t recommend t When your network nterface s on the motherboard, as s common these days, t’s genera y not as easy to prov de dent ca redundant network nterfaces un ess they are bu t nto the server Nonethe ess, hav ng a server-qua ty network card ava ab e and ready to drop nto the server n the event of a fa ure can make recovery much qu cker If your bus ness depends on Internet connect v ty (and whose bus ness doesn’t at east requ re ema these days?), one po nt of fa ure that can eas y be m ssed s your Internet connect on So v ng th s prob em, however, s not at a d fficu t—s mp y rep ace your standard router w th a dua -WAN router and br ng n a second Internet serv ce We have both cab e and DSL ava ab e to our office, so we added a X ncom dua -WAN router that does bas c oad ba anc ng when both connect ons are work ng, but st prov des acceptab e bandw dth when e ther connect on s down F na y, under network ng, we strong y suggest your server have a ow- eve network port that can be used to d rect y connect to the server even f the operat ng system s unrespons ve If you have a Hew ett-Packard dev ce, th s s ca ed an LO port (short for ntegrated ghts out) For De , t’s a DRAC (De Remote Access Card) Other server manufacturers have s m ar techno og es Th s s a network card that s powered up and reachab e we before any operatng system gets oaded and s managed ent re y n firmware
Other Spare Parts So you’ve got a spare power supp y, a spare hard dr ve for your array, and a spare NIC Is that enough? We , t puts you way ahead of many bus nesses, but are there any other parts that you shou d keep ava ab e? Any other per phera or card that you cou dn’t run your bus ness w thout s a good cand date for a spare Another cand date s a spare v deo card, though th s s ess cr t ca You can, after a , a ways Remote Desktop nto the server f you need to, and rep acement v deo cards are easy and qu ck to come by
62 CHAPTER 4
Planning Fault Tolerance and Avoidance
Any other cards or per phera s that you wou d have prob ems do ng w thout for the t me t takes to get a new one to rep ace a fa ure s a good cand date for your spare-parts cab net We ke to keep a spare network sw tch w th a few spare network cab es ava ab e Another smart cho ce s to keep a spare of your DSL modem or boundary router
Summary Bu d ng a h gh y ava ab e and fau t-to erant system requ res you to carefu y eva uate both your requ rements and your resources to e m nate s ng e po nts of fa ure w th n the system You shou d eva uate each of the hardware subsystems w th n the overa system for fau t to erance, and ensure that recovery procedures are c ear y understood and pract ced to reduce recovery t me n the event of a fa ure UPSs, redundant power supp es, redundant networkng, and RAID systems are a methods for mprov ng overa fau t to erance Now that we’ve covered the p ann ng and preparat on of your SBS network, t’s t me to move on to the actua nsta at on and setup of SBS In the next part, we’ cover new nsta at ons, m grat ng from an ex st ng SBS or W ndows Server network, and some spec a cons derat ons for us ng v rtua zat on to bu d your SBS network The first chapter n th s next part covers a typ ca first-t me nsta at on of W ndows Sma Bus ness Server 2008
Summary
CHAPTER 4
63
Part II
Installation and Setup CHAPTER 5
Insta ng Sma Bus ness Server 2011 67
CHAPTER 6
Configur ng SBS n Hyper-V 81
CHAPTER 7
grat ng to W ndows Sma Bus ness Server 2011 M Standard 111
CHAPTER 8
Comp et ng the Gett ng Started Tasks 181
CHAPTER 5
Installing Small Business Server 2011 T
h s chapter covers perform ng a c ean nsta at on of M crosoft W ndows Sma Bus ness Server (SBS) 2011 A nsta at ons of SBS 2011 are c ean nsta s because there s no d rect upgrade path from an ex st ng SBS nsta at on—on y a m grat on We’ cover m grat ons n deta n Chapter 7, “M grat ng to W ndows Sma Bus ness Server 2011,” so f you’re nsta ng n an ex st ng W ndows doma n env ronment—e ther SBS or W ndows Server—you’ want to jump ahead to Chapter 7 If you’re nsta ng n a v rtua env ronment, and t’s a fresh nsta , go ahead and read th s chapter, but ho d off on actua y perform ng any of the steps unt you’ve had a chance to read Chapter 6, “Configur ng SBS n Hyper-V ”
Planning Chapters 2 through 4 a ready covered most of the p ann ng ssues assoc ated w th nsta ng SBS, but there are a few more tems to take care of You shou d have the hardware a assemb ed; now t’s t me to ■
Ver fy the phys ca configurat on of the network
■
Dec de on what IP address range you’ be us ng
■
Choose network names
You’ a so want to dec de how the storage on your SBS server shou d be apport oned The nsta at on w zard for W ndows Sma Bus ness Server 2011 s qu te good and asks on y a few bas c quest ons about your bus ness and the network names and passwords you want to use Everyth ng e se s saved for the Gett ng Started task st once the nsta at on comp etes
Planning Partitions One th ng that the nsta at on w zard does not exp c t y ask s how to part t on your hard d sk space The defau t nsta at on w put everyth ng on a s ng e part t on that takes up a the space on your first hard d sk SBS 2011 makes t easy to move data such as user
67
shares and M crosoft Exchange data to new ocat ons whenever you want, so carefu p ann ng up front sn’t cr t ca , espec a y f some of your hard d sk space won’t be v s b e unt the operat ng system s fu y nsta ed and you can nsta dr vers for the space Our recommendat on s to at east create a part t on for the n t a nsta at on, and to s ze t appropr ate y for the system dr ve of SBS We recommend that you create a part t on dur ng the n t a nsta at on screens for Sma Bus ness Server 2011 that s at least 120 g gabytes (GB) n s ze (200 GB s a more rea st c m n mum )
Real World Dividing Storage
A
lthough you can have a single large partition and put everything on it, there are compelling reasons to divide hard-drive space into at least three different
partitions, even if you are using hardware RAID. The three partitions are ■ The ■ A
primary operating system partition.
partition for static storage. Use this primarily for read-intensive storage, such as
company-wide shared folders, application installations, and installation sources. ■ A
partition for data, logs, and other volatile information. This will be the most
active partition and should have a storage technology optimized accordingly. Dividing your storage space into logical partitions in this way makes backups and disaster recovery easier and allows you to focus your efforts on the critical data partition.
Planning Location and Networking The other p ann ng step you shou d take pr or to nsta ng SBS 2011 s to dec de your phys ca ayout and network ng ayout The ma n areas of concern for the phys ca ayout are ■
Server security Is the server secure from unauthor zed phys ca access?
■
Network device security Are the ma n network dev ces secure from unauthor zed phys ca access?
■
Ease of access Is t easy to get to the server, and the connect ons to t, for ma ntenance?
■
Expandability Is there room to add servers as the bus ness grows?
Your SBS server shou d be phys ca y protected, and access to t shou d be contro ed and mon tored A though not every sma bus ness has the uxury of an a r-cond t oned server room w th h gh-secur ty access contro , there are st bas c secur ty steps you can and shou d take
68 CHAPTER 5
Installing Small Business Server 2011
The server (and ma n network ng equ pment) shou d be n a separate room that can be ocked In a p nch, us ng a ockab e cage n a mu t purpose room can work, but then choose your servers for the r no se eve A keycode ock s a good cho ce because t can be eas y changed f an emp oyee eaves, and most keycode ocks a ow for separate keys for nd v dua s and for determ n ng who has been n the room See Chapter 3, “P ann ng Your SBS Network,” for more on p ann ng for secur ty P ann ng the og ca network ng s another mportant step to make sure you’ve done before start ng the actua nsta We ke to use a s mp e spreadsheet that shows the necessary nformat on we’ need for the nsta at on Deta s on the spreadsheet nc ude ■
Internet serv ces prov der (ISP) nformat on, nc ud ng account names, IP addresses, support phone number, and so on
■
Interna network deta s, nc ud ng IP address range, router IP address, number and names of c ents, and number and names of servers
■
DNS and NetBIOS names that w
■
Router configurat on, nc ud ng any updates that are requ red to the router, what ts defau t sett ngs are f you have to reset t, what sett ngs you’ve changed on the router to configure t for SBS, and so on If your router s enab ed for Un versa P ug and P ay (UPnP), SBS can make at east some of the changes for you automat ca y
be used for the new network
Note Many routers default to either 192.168.0.1, 192.168.1.1, or 10.0.0.1 for their IP
address. If you have to reset the router, make sure you have a well-documented way to upload a configuration file to return it to the configuration you’ve chosen for your network. Leaving the router at one of these common defaults can create issues when setting up virtual private networks, so it’s not recommended.
Preparing the Server F na y, there are a few ast steps to take before aunch ng the nsta at on ■
Make sure the server s s zed appropr ate y for the oad under wh ch you p an to p ace t For more nformat on on server s z ng, see Chapter 3
■
If you’re nsta ng on an ex st ng server, back up a data and record any mportant sett ngs
■
Remove the un nterrupt b e power supp y (UPS) management cab e from the server (even f t’s USB)
■
Upgrade the system BIOS to the atest vers on ava ab e
Preparing the Server
CHAPTER 5
69
■
Set the boot order n the BIOS to boot from the DVD before the hard d sk
■
Locate any mass storage dr vers necessary for the system
■
Configure the firewa or router as requ red
Installation The actua nsta at on of W ndows Sma Bus ness Server 2011 s s mp e compared to ear er vers ons of SBS The n t a nsta at on of the operat ng system asks fewer quest ons, and the nsta at on of the SBS port on a so asks far fewer quest ons P us both can be automated or sem -automated us ng answer fi es We’ wa k through a bas c nsta at on first, and then address custom zat ons, advanced sett ngs, and automat on
Installation Process The nsta at on process for W ndows Sma Bus ness Server 2011 s n two stages The first stage nsta s 64-b t W ndows Server 2008 R2 Standard, and the second stage nsta s SBS tse f The mportant th ng here s that the under y ng operat ng system s W ndows Server 2008 R2 Standard There are on y three m tat ons p aced on W ndows Server 2008 R2 by SBS ■
SBS can on y be n a s ng e doma n env ronment—no trust re at onsh ps are poss b e
■
The SBS server must ho d a of the F ex b e S ng e Master Operat on (FSMO) ro es Add t ona doma n contro ers can be nsta ed n the SBS network, but none of the FSMO ro es can be moved
■
A max mum of 75 users or dev ce C ent Access L censes (CALs) are a owed
Installing the Base Operating System Insta ng the under y ng W ndows Server 2008 R2 Standard operat ng system can be done us ng any of the dep oyment methods supported by W ndows Server 2008 R2, but you w usua y do t by boot ng from the W ndows Sma Bus ness Server 2011 Standard D sk1 and fo ow ng these steps 1. At the n t a screen of the Insta W ndows W zard, shown n F gure 5-1, set the oca -
zat on nformat on for th s nsta at on of SBS
70 CHAPTER 5
Installing Small Business Server 2011
Figure 5-1 The f rst nsta at on w ndow
2. C ck Next to open the Insta page of the Insta W ndows W zard, as shown n F gure
5-2
Figure 5-2 The nsta Now page of the nsta W ndows W zard
Installation
CHAPTER 5
71
3. C ck Insta Now to start Set Up The next screen presents the cens ng terms Read the
terms, se ect the box to accept the cens ng terms, and then c ck Next 4. On the next screen, you are asked f you want an Upgrade or a Custom Insta at on
Se ect Custom Insta at on Note You can choose the Upgrade option, but because upgrades to SBS 2011 aren’t pos-
sible, this option will lead you in a merry circle, accomplishing nothing.
5. C ck Custom (Advanced) to open the Where Do You Want To Insta W ndows page
You’ see a st of dr ves and part t ons ava ab e for nsta ng SBS If the dr ve you want to use sn’t sted, c ck Load Dr ver to open the Load Dr ver d a og box shown n F gure 5-3 Dr vers can be oaded from floppy d sk, CD, DVD, or a USB flash dr ve
Figure 5-3 The Load Dr ver d a og box dur ng nsta at on
6. C ck OK to have W ndows search attached removab e med a and d sp ay the resu ts on
the Se ect The Dr ver To Be Insta ed page, shown n F gure 5-4 If the dr ver sn’t d sp ayed, c ck Browse and nav gate to the dev ce and fo der where the dr ver s ocated
Figure 5-4 The Se ect The Dr ver To Be nsta ed page of the nsta W ndows W zard
72 CHAPTER 5
Installing Small Business Server 2011
7. C ck Next to oad the se ected dr ver and return to the Where Do You Want To Insta
W ndows page Se ect the part t on where you want to nsta W ndows 8. C ck Next to beg n the actua nsta at on of W ndows Server 2008 R2 Standard (See
F gure 5-5 ) No further quest ons w beg ns
be asked unt the SBS port on of the nsta at on
Figure 5-5 The nsta W ndows screen shows the progress of nsta at on
Installing the SBS Portion After the under y ng operat ng system s nsta ed, W ndows w og on and the SBS nsta at on w automat ca y start Th s nsta at on w configure your t me zone, your network ng, and your server and W ndows doma n names; configure your bus ness nformat on; and set your adm n strator account and password for the SBS doma n A so dur ng th s process, you’ have a chance to nsta any requ red network ng dr vers, f W ndows doesn’t have a bu t- n dr ver for your network card, and down oad the atest updates to protect your server Note Windows Small Business Server 2011 Standard installation requires that a function-
ing network card be detected prior to installation. If your network card is not automatically detected by Windows Server 2008 R2, you’ll need to download the driver and have it available before the installation of SBS can proceed.
The next screen (see F gure 5-6) asks you to spec fy a setup mode a c ean nsta or a m grat on Se ect C ean Insta , and c ck Next to cont nue the nsta at on
Installation
CHAPTER 5
73
Figure 5-6 Choos ng a setup mode
Cont nue the nsta at on by fo ow ng these steps 1. The Ver fy The C ock And T me Zone Sett ngs page shown n F gure 5-7 opens C ck
the Open Date And T me To Ver fy The C ock And T me Zone Sett ngs nk to the standard W ndows Date And T me d a og box Set the t me zone and current date and t me f they aren’t correct, and c ck OK to return to the Ver fy The C ock And T me Zone Sett ngs page C ck Next
Figure 5-7 Use the Open Date And T me nk on th s page to ver fy the t me and date are
correct y set
2. On the Server Network Configurat on screen, se ect how you want the server to detect
network sett ngs Chose Automat c, or you can spec fy the IP address for your network adapter and server C ck Next
74 CHAPTER 5
Installing Small Business Server 2011
3. C ck Go On ne And Get The Most Recent Insta at on Updates (Recommended) Th s
w
down oad on y cr t ca updates that are d rect y re ated to nsta at on ssues
4. When the update check s comp ete, c ck Next to open the Company Informat on
page shown n F gure 5-8 Th s nformat on w be used to custom ze var ous other areas of SBS Noth ng s requ red here, but there’s no good reason not to enter the nformat on, e ther—none of t s sent to M crosoft
Figure 5-8 Company nformat on screen
5. C ck Next to open the Persona ze Your Server And Your Network screen, supp y a
name for your server and the name for your nterna network, as shown n F gure 5-9 C ck Next
Figure 5-9 Prov d ng a server and doma n name
Installation
CHAPTER 5
75
Real World Choose a Generic Domain Name
T
he temptation is to choose a simple domain name that somehow reflects the name of the company that will be using the SBS server. This makes perfect
sense, and no one will question it. In fact, this is what we used to do when we set up networks for our customers. And it seemed to work fine. Until the first time one
of them merged with another small company and changed their name to reflect the new company. And we had to tell them that there wasn’t any way to change the domain name. The only solution was to rebuild the network from scratch—with all the pain and risk that involved. We learned an important lesson, however. Although it’s important to choose a name that makes sense to users—because they’ll see it every time they log on to their workstations—make it a generic name that reflects function, not the specific company name.
6. C ck Next to add an adm n strator account, as shown n F gure 5-10 Enter a name for
the adm n strator and an account name (user name) for the account SBS 2011 does not a ow the ma n adm n strator account to be named “Adm n strator” See the “Under The Hood” s debar for more deta s on the Adm n strator account
Figure 5-10 The Add A Network Adm n strator Account page of the nsta W ndows Sma Bus
ness Server 2008 W zard
7. C ck Next to open the confirmat on page shown n F gure 5-11 If everyth ng ooks
correct, c ck Next to nsta SBS
76 CHAPTER 5
Installing Small Business Server 2011
Figure 5-11 The conf rmat on page of the nsta W ndows Sma Bus ness Server 2008 W zard
Under The Hood Administrator 500 Account
S
BS requires you to create a new administrator account during a new installation. (We called this account “SBSAdministrator” in the previous examples.) This
administrator account is used for all future administration of SBS, and the original Administrator account—often referred to as the 500 account from an easily recognizable portion of the account’s globally unique identifier (GUID)—is disabled. The new administrator account password is synchronized with the Directory Service Restore Mode (DSRM) Administrator account password, which is used to recover Active Directory if there’s a problem. So far, so good. But when the password changes for the new administrator account, the underlying DSRM Administrator account is not updated. This means that the DSRM Administra-
tor password is tied to that original password and you’ll need to keep a permanent record of it in case you need to recover from a problem with Active Directory. We understand the reasons why Microsoft developers disable the Administrator account, but we think it’s unfortunate that there isn’t a solution in place that would allow the passwords to remain synchronized. However, because SBS 2011 is built on Windows Server 2008 R2, you can use the Restartable AD DS feature, combined with appropriate registry changes, to enable other recovery scenarios. See http:// technet.microsoft.com/en-us/library/cc732714.aspx for more information on using Restartable AD DS.
Installation
CHAPTER 5
77
Using the SBS Answer File Generator New n W ndows Sma Bus ness Server 2008 and st n force n SBS 2011 s the ab ty to s mp fy the SBS port on of the nsta at on us ng an answer fi e The answer fi e s requ red for do ng a m grat on from an ex st ng doma n env ronment, but t’s opt ona for a c ean new nsta at on It does, however, have some advantages because t a ows you to custom ze some port ons of the nsta that aren’t ava ab e n the norma nsta D sc1 of W ndows Sma Bus ness Server 2011 Standard nc udes a too ca ed the SBS Answer F e Generator (SBSAfg exe) to create an answer fi e SBSAfg exe s ocated n the \Too s d rectory To use SBSAfg exe, fo ow these steps 1. Copy the fi e SBSAfg exe from the SBS 2011 D sc1 to your oca hard d sk Where you
copy t sn’t mportant as ong as you can find t 2. From W ndows Exp orer, doub e-c ck SBSAfg to start the SBS Answer F e Too , shown
n F gure 5-12
Figure 5-12 The SBS Answer F e too
78 CHAPTER 5
Installing Small Business Server 2011
3. F
n the fie ds of the Answer F e Too to configure your nsta at on of SBS If you eave a requ red fie d b ank, you’ be prompted for that va ue dur ng the nsta at on
4. When you’ve fi ed n the fie ds of the Answer F e Too , c ck Save As to save the answer
fi e The fi e name shou d be SBSAnswerF e xm 5. To use the answer fi e, copy t to removab e med a such as a USB flash dr ve or USB
hard dr ve and connect the USB dr ve to the SBS server prior to the n t a SBS nsta at on screen (shown ear er n F gure 5-5); SBS w automat ca y oad the answer fi e and proceed to use t dur ng the nsta at on You can a so copy t to the root of any hard d sk attached to the SBS server Note If you create an empty XML file with the name SBSAnswerFile.xml and make it
available to the SBS installation process, as described in step 5, you will have additional options available during the installation process.
Note If you’re installing on a Hyper-V child partition, where there is no USB available,
you can use a virtual floppy drive (VFD) with the SBSAnswerFile.xml on it. Floppy disks work just as well for automating the installation.
Us ng the answer fi e s the on y way you can spec fy a d fferent nterna root DNS doma n name other than “ oca ” If you use the standard SBS nsta at on, t w automat ca y add a oca to the nterna doma n name But when us ng an answer fi e, you can spec fy any root DNS doma n to add
Summary Th s chapter has covered the steps requ red to prepare for and perform a c ean nsta at on of W ndows Sma Bus ness Server 2011 Standard After nsta at on, add t ona configurat on spec fic to your env ronment s done us ng the Gett ng Started task st, wh ch s covered n Chapter 8, “Comp et ng the Gett ng Started Tasks ” Chapter 6, wh ch fo ows, d scusses Hyper-V n genera , and t descr bes the spec a cons derat ons for nsta ng SBS n a Hyper-V env ronment These cons derat ons, wh e spec fic to Hyper-V, are a so re evant n a genera way for any v rtua zat on env ronment Chapter 7 covers m grat ng an ex st ng W ndows Server or W ndows Sma Bus ness Server env ronment to W ndows Sma Bus ness Server 2011 Standard
Summary
CHAPTER 5
79
CHAPTER 6
Configuring SBS in Hyper-V H
yper-V s M crosoft’s hyperv sor-based, nat ve W ndows Server 2008 R2 v rtua zat on so ut on V rtua zat on s one way to s mp fy and conso date your W ndows Sma Bus ness Server (SBS) 2011 server hardware Us ng v rtua zat on for your SBS network can be a cost-effect ve so ut on that prov des an exce ent end-user exper ence wh e a so enab ng mproved d saster recovery and ease of management However, v rtua zat on s s mp y a too , and one you shou d choose when it solves a business problem When we wrote the Microsoft Windows Small Business Server 2003 Administrator’s Companion, v rtua zat on was a t ny fract on of the market and a most exc us ve y the prov nce of very arge organ zat ons M crosoft had no v rtua zat on products and prov ded tt e or no support for compan es and nd v dua s us ng v rtua zat on By the t me we wrote Microsoft Windows Small Business Server 2003 R2 Administrator’s Companion, a huge sh ft had a ready taken p ace M crosoft had bought out a v rtua zat on company and had two products on the market V rtua PC and V rtua Server More and more compan es were ook ng to v rtua zat on as a way to conso date servers, reduce server room footpr nts, and prov de flex b e test env ronments V rtua zat on had gone from the “Hey, that’s k nda neat” phase to the “Hmmm, you know, that m ght just make sense” phase Compan es arge and sma were act ve y nvest gat ng v rtua zat on, p ann ng how to use t, or a ready dep oy ng t Now, fast forward a few years, and v rtua zat on s a way of fe for many of us We cou dn’t beg n to do what we need to do w thout be ng ab e to v rtua ze, and we’re act ve y dep oy ng v rtua so ut ons n product on M crosoft has gone from hav ng a coup e of v rtua zat on products to hav ng a su te of so ut ons around v rtua zat on, nc ud ng bu d ng t r ght n to the operat ng system w th the nc us on of Hyper-V n W ndows Server 2008
81
Real World What’s Different?
W
hy has virtualization suddenly become such a compelling scenario? What has changed? We think that two very important changes are driving the move to
virtualize: official support from Microsoft and the move to 64-bit hardware. Official support means that if you have an issue with Windows or just about any of the Microsoft server applications, and you’re running in a virtualized environment, you’re still supported, and Microsoft support won’t say, “Sorry. Please reproduce that problem on a physical server and we’ll be happy to help you.” This is an impor-
tant concern for anyone using virtualization in a production environment. The wide availability of multicore, 64-bit processors and larger RAM densities is also driving the move to virtualization. The biggest limiting factor for running virtualization on 32-bit Windows is the RAM limitation—you just can’t virtualize very many server workloads on a server that is limited to 4 GB of RAM. With Windows Server 2008 R2, which is available only in 64-bit, and includes native Hyper-V, running many server workloads on a single physical server is easy. For example, while writing this book, we’ve been using an HP DL160 G6 server with 24 gigabytes (GB) of RAM and two quad-core processors. That lets us easily run two copies of Windows Small Business Server 2011 in virtual machines, along with a Premium Add-On server and several Windows 7 and Windows Vista virtual machines. And if we need more, the server will easily handle four times that amount of RAM.
In th s chapter, we’ cover the spec fics of nsta ng and configur ng SBS n a Hyper-V env ronment wh e we a so prov de a genera overv ew of Hyper-V and cover bas c nsta at on and configurat on
Hyper-V Overview W ndows Server 2008 R2 nc udes bu t- n v rtua zat on w th the Hyper-V ro e Hyper-V s hyperv sor-based, nat ve v rtua zat on that uses the hardware v rtua zat on capab t es of the atest Inte and AMD processors to prov de a robust, fast, and resource-conserv ng v rtua env ronment
82 CHAPTER 6
Configuring SBS in Hyper-V
Emulation vs. Hypervisor There are two bas c methods of v rtua z ng operat ng systems emu at on and hyperv sor Emulation bu ds an execut on env ronment on top of the under y ng operat ng system of the host computer and uses software to s mu ate the hardware that s made ava ab e to the guest operat ng systems A hypervisor s software that runs d rect y on the hardware of the phys ca server and prov des a narrow hardware abstract on ayer between the hardware and the base operat ng system The hyperv sor can use the nat ve hardware support n current Inte and AMD processors to mprove the overa performance and secur ty of the hyperv sor
App cat ons
App cat ons
App cat ons
App cat ons
Ch d Part t on W ndows Server 2008 64 b t
Ch d Part t on W ndows Server 2008 32 b t
Ch d Part t on L nux
Parent W ndows Part t on W ndows Server 2008 Core
Applications
Ch d Part t on W ndows Sma Bus ness Server 2008
Because Hyper-V s a hyperv sor and s bu t n to W ndows Server 2008 R2, t runs more effic ent y and nat ve y A server runn ng Hyper-V has mu t p e part t ons, each runn ng nat ve y on the under y ng hardware The first part t on s known as the parent part t on (or somet mes host) and acts as the hardware and operat ng system contro part t on for a the other part t ons where v rtua zed operat ng systems run The other part t ons are child part t ons (or guests), each w th the r own operat ng systems, runn ng d rect y on the hyperv sor ayer, as shown n F gure 6-1
Hypervisor Hardware Abstraction Layer Hyper-V Capable Hardware Figure 6-1 W ndows Server 2008 Hyper V arch tecture
W ndows Server 2003 supported us ng M crosoft V rtua Server 2005 R2 as a v rtua zat on so ut on V rtua Server s not a hyperv sor-based v rtua zat on t s des gned to run on top of an ex st ng operat ng system—the host operat ng system—and prov de an emu ated hardware env ronment for guest operat ng systems, as shown n F gure 6-2
Hyper-V Overview
CHAPTER 6
83
App cat ons
App cat ons
App cat ons
Guest Operat ng System W ndows Server 2003 R2
Guest Operat ng System W ndows Server 2008
Guest Operat ng System L nux
Guest Operat ng System W ndows Server 2008
App cat ons
Virtual Server 2005 R2 SP1 Host Operating System (Windows Small Business Server 2003) Hardware Figure 6-2 M crosoft V rtua Server arch tecture
Hyper-V runs on W ndows Server 2008 R2, nc ud ng Server Core nsta at ons, and s a so ava ab e as a comp ete y free stand-a one server the M crosoft Hyper-V Server 2008 R2, hereafter known as the Hyper-V Server In most cases, a Server Core nsta at on or the HyperV Server s the preferred parent part t on for a server that w be used for v rtua zat on Th s m ts the resource footpr nt of the parent part t on and a so makes t eas er to protect because the number of serv ces and attack vectors s fewer For W ndows Sma Bus ness Server 2011 Standard, we prefer the stand-a one Hyper-V Server or, for nsta at ons us ng a Prem um Add-on, fu W ndows Server 2008 R2 where a graph ca nterface s preferred
Requirements The requ rements for enab ng the Hyper-V ro e on W ndows Server 2008 R2 are ■
Hardware v rtua zat on support (Inte -VT or AMD-V–enab ed CPUs)
■
Hardware data execut on protect on (DEP)–enab ed (Inte XD b t or AMD NX b t)
In add t on to the requ rements for the parent part t on of W ndows Server 2008 R2, each ch d part t on requ res approx mate y 75 megabytes (MB) of RAM and the hard d sk space used by the operat ng system n the ch d part t on
84 CHAPTER 6
Configuring SBS in Hyper-V
F na y, t s mportant that your server have a m n mum of two network nterface cards (NICs) nsta ed, exc us ve of any spec a management NICs such as an HP LO One of these NICs w be reserved for remote management of the parent server and ensures that you can a ways connect to the parent part t on to manage the ch d part t ons
Real World I/O Subsystem
A
ny virtualization solution puts a lot of stress on the hardware of the I/O subsystem, especially the disk subsystem. Each virtual hard disk is a file, and with
multiple operating systems each writing to files independently and concurrently, a lot of I/O traffic is writing to the parent partition’s file system. As a result, a weak or slow I/O subsystem will quickly become the bottleneck limiting the overall performance of the virtual machines. Also, unlike many applications, virtualization tends to be write-intensive, making it essential that you plan your RAID subsystem accordingly. RAID-5 is a much less ap-
pealing alternative as a base RAID choice for the parent operating system. You also do not want to run software RAID on the parent Windows Server 2008 R2. Any RAID subsystem works better the more disks it has. A RAID 0+1 array that has four 1-terabyte disks has 2 terabytes of disk space available, but it is not as fast as a RAID 0+1 array of eight 500-GB disks, which provides the same 2 terabytes of disk space. By adding extra disks, writing to and reading from the array is distributed across more disks, putting less load on each disk. The same stresses apply to the networking portion of the I/O subsystem that apply to the disk portion. Because many virtual machines can connect through a single physical NIC, you’ll want to specify fast and resource-sparing network cards for your Hyper-V server. Here’s a clue: a $20 GigE network card is not going to provide the same satisfactory experience as a quality, server-class network card connected to either the PCI-X or PCIe busses. And if you’re running more than three or four virtual machines, you’re definitely going to want additional NICs to spread the load. If you’re building or specifying a server for Hyper-V (or any virtualization product), don’t skimp on the I/O subsystem. A fast RAID controller with a large cache and a wide array with as many disks as you can manage is an important performance choice. And be especially aware of redundancy. If your Hyper-V server fails because you’ve had two disks in a RAID-5 array fail, not only is the one physical server down, but also your SBS server and every other virtual machine running on that server.
Hyper-V Overview
CHAPTER 6
85
Installation Insta ng Hyper-V on W ndows Server 2008 R2 uses the nat ve W ndows Server 2008 R2 too s—e ther the graph ca Server Manager or, from the command ne, ServerManagerCmd exe or W ndows PowerShe ’s Add-W ndowsFeature cmd et When nsta ng on W ndows Server 2008 R2 Core, use the sconfig ut ty or the Add-W ndowsFeature cmd et
Real World Choosing a Hyper-V Version
C
hoosing the source of your Hyper-V virtualization is a balance among convenience, cost, features, and security, and it isn’t always an easy choice. The three
basic options are ■
Windows Server 2008 R2 Full installation
■
Windows Server 2008 R2 Core installation
■
Microsoft Hyper-V Server 2008 R2
If you bought the Premium Add-on for SBS, you already have a license for Windows Server 2008 R2 Standard. This license gives you the right to install one copy of Windows Server 2008 R2 on the physical server and one copy as a virtual machine, if you use the copy on the physical server only to support virtualization. That’s an important limitation, and one that is often misunderstood. In practice, if you’re using Hyper-V as your virtualization solution, it means you can install only the Hyper-V role on the physical server. No additional roles can be installed or you lose the right to install a second copy of Windows Server 2008 R2 Standard as a virtual machine. And here the distinction between a server role and a server feature is critical. You can’t install Active Directory Domain Services or DNS or DHCP or even Fax Server. They’re all roles, and by installing them you’d lose your right to install an additional copy of Windows Server. But you can install features such as Windows Server Backup, the Windows PowerShell Integrated Scripting Environment (ISE), or the Remote Server Administration Tools (RSAT). Choosing between the Full installation and the Core installation with the Premium Add-on server is really about your comfort level with the command line for the initial setup. But if you’re willing to consider the command line, we think the best bet is the stand-alone Microsoft Hyper-V Server 2008 R2. It’s completely free, you don’t have any issues with licensing because Hyper-V Server doesn’t include any additional roles, and it supports 8 physical processors, 1 terabyte of RAM, and even clustering.
86 CHAPTER 6
Configuring SBS in Hyper-V
Installing on Microsoft Hyper-V Server R2 To nsta the M crosoft Hyper-V Server R2, you fo ow many of the same steps as you wou d when nsta ng W ndows Server, but you don’t need to make any cho ces about wh ch vers on you’re nsta ng because there s on y the one vers on You’ then perform bas c n t a configurat on of the operat ng system, nc ud ng sett ng the IP addresses, sett ng the server name, and configur ng the W ndows F rewa , as deta ed n the fo ow ng sect on You w not be jo n ng the Hyper-V Server to the doma n because the doma n w be a ch d of the parent part t on Scr pts to s mp fy the nsta at on and n t a configurat on are prov ded on the compan on med a that accompan es th s book You w need to enab e remote adm n strat on as part of the nsta at on because there s no graph ca way to d rect y manage or create v rtua mach nes on the Hyper-V Server—the Hyper-V Manager conso e won’t run on Server Core or Hyper-V Server
Initial Configuration The n t a configurat on steps for a bas c Hyper-V Server nsta at on are ■
Set a fixed IP address
■
Change the server name to someth ng reasonab e
■
Enab e remote management through W ndows F rewa
■
Enab e remote desktop
Tab e 6-1 conta ns the sett ngs we’ be us ng dur ng th s nsta scenar o Table 6-1 Sett ngs for the n t a Hyper V Server conf gurat on (examp e)
Setting
Value
IP Address (Management NIC)
192 168 0 4
Gateway
192 168 0 1
DNS Server
192 168 0 2
IP Address (Ch d Part t on NIC)
DHCP
Gateway
192 168 0 1
DNS Server
192 168 0 2
Server Name
Hp160-hyperv
Defau t Desktop Reso ut on
1024x768
Remote Management
Enab e for A Profi es
Installation
CHAPTER 6
87
Important Normally, servers used for SBS 2011 are equipped with only a single net-
work card because SBS 2011 supports only a single NIC configuration. However, if you are using Hyper-V virtualization, you’ll want a second NIC to ensure that you maintain management access to the physical computer even if there are problems with the virtualized SBS. That second NIC can be connected to the same subnet (range of IP addresses) as the primary NIC, or it can be on a completely separate network.
To configure the n t a sett ngs of a Hyper-V Server nsta at on, fo ow these steps 1. Log on to the new y nsta ed M crosoft Hyper-V Server R2 computer You’ be prompt-
ed to change your n t a password 2. After your password change has been accepted, you’ be ogged n to the ma n Hyper-
V Server desktop An un nsp r ng pa r of command w ndows appears, one runn ng Sconfig cmd as shown n F gure 6-3
Figure 6-3 The n t a Sconf g.cmd screen for a new Hyper V Server nsta at on
3. Use the Sconfig cmd menus to configure the n t a sett ngs of the Hyper-V Server Do
not jo n t to a doma n— eave the server n a workgroup The sett ngs we used on our test setup are shown n Tab e 6-1 In add t on, you’ ke y want to se ect Down oad And Insta Updates and enab e Remote Desktop, at a m n mum The n t a configurat on w take at east one reboot, and poss b y two 4. After you’ve fin shed configur ng the Hyper-V Server, you shou d se ect opt on 10 on
the ma n Sconfig menu Th s w d sab e the automat c aunch ng of Sconfig every t me you og on to the server You can a ways get t back by typ ng Start Sconfig from the ma n Cmd w ndow Th s w aunch Sconfig and a so re-enab e the automat c aunch ng 5. Se ect opt on 15 to ex t Sconfig and return to a s mp e Cmd w ndow
88 CHAPTER 6
Configuring SBS in Hyper-V
Installing on Full Windows Server 2008 R2 To nsta the Hyper-V ro e on fu W ndows Server 2008 R2, first comp ete the norma nsta at on and configurat on of W ndows Server 2008 R2, as descr bed n Chapter 24, “Insta ng the Second Server ” When n t a configurat on has comp eted, you can nsta the Hyper-V ro e us ng the fo ow ng steps 1. Open the Server Manager conso e f t sn’t open a ready 2. Se ect Add Ro es from the Act on menu to open the Before You Beg n page of the Add
Ro es W zard 3. Read the adv ce on the Before You Beg n page It’s actua y good adv ce and a use-
fu rem nder If you’ve read the page, understand a ts mp cat ons, and don’t ever want to see the page aga n, se ect the Sk p Th s Page By Defau t check box We eave t unchecked, persona y Note If you’ve already run the Add Roles Wizard and selected Skip This Page By De-
fault, you won’t see the Before You Begin page of the Add Roles Wizard.
4. C ck Next to open the Se ect Server Ro es page of the Add Ro es W zard 5. Se ect Hyper-V from the st of ro es 6. C ck Next to open the Hyper-V page, as shown n F gure 6-4 Th s page descr bes the
Hyper-V ro e and nc udes a Th ngs To Note sect on that has caut ons and adv sor es spec fic to the Hyper-V ro e The page a so has a nk to severa Add t ona Informat on pages w th up-to-date nformat on on Hyper-V
Figure 6-4 The Hyper V page of the Add Ro es W zard
Installation
CHAPTER 6
89
7. After you’ve read the Th ngs To Note sect on, c ck Next to open the Create V rtua
Networks page shown n F gure 6-5
Figure 6-5 The Create V rtua Networks page of the Add Ro es W zard
8. Se ect the ethernet cards you want to create v rtua networks for The genera ru e s to
eave at east one network card not used for v rtua networks to ensure that you ma nta n fu remote connect v ty to the server 9. When the Add Ro es W zard has a the nformat on necessary to proceed, t w
open the Confirm Insta at on Se ect ons page If everyth ng ooks correct, c ck Insta to beg n the nsta at on
10. When the nsta at on comp etes, you’ see the Insta at on Resu ts page The Hyper-V
nsta at on w r ght away
requ re a reboot C ck C ose to comp ete the w zard C ck Yes to reboot
11. After the server reboots, og back on w th the same account you used to add the
Hyper-V ro e The Resume Configurat on W zard w open, and when the configurat on s comp ete, you’ see the fina Insta at on Resu ts page 12. C ck C ose to ex t the w zard
90 CHAPTER 6
Configuring SBS in Hyper-V
Initial Configuration After you’ve nsta ed the Hyper-V ro e, you need to actua y configure Hyper-V and then start add ng v rtua mach nes The management too for Hyper-V s the Hyper-V Manager conso e L ke other management conso es n W ndows Server 2008 R2, t ntegrates nto the Server Manager conso e You can use t there or run t as a stand-a one too We prefer standa one—frank y, t takes up ess screen space Open Adm n strat ve Too s, and se ect Hyper-V Manager from the st to run the stand-a one Hyper-V Manager conso e Note You could run the Hyper-V Manager console by starting it from the command line,
but unlike other Windows Server 2008 management consoles, it’s not put in %windir%\ system32. It is actually in %ProgramFiles%\Hyper-V, which isn’t on your path. The command line for this is “%ProgramFiles%\Hyper-V\virtmgmt.msc” (quotes required)
Note If you’re running Hyper-V on Server Core, you need to install the Hyper-V man-
agement tools onto a Windows 7 or Windows Server 2008 R2 computer and run them remotely. See Microsoft Knowledge Base article 974877 at http://support.microsoft.com/ kb/974877. You use the same steps as if you were running the console locally, but you have to connect to the server first.
Configuring Networks The first step after nsta ng Hyper-V s to configure your networks The step n the Add Ro es W zard creates the network and attaches t to the network cards you se ected Depend ng on the se ect ons you made, the networks created dur ng the nsta m ght need to be changed to reflect the type of network you need And, of course, f you nsta ed on Hyper-V Server, no network configurat on has been done at a Hyper-V supports three k nds of v rtua networks
■
External An externa network s a v rtua network sw tch that b nds to the phys ca network adapter, prov d ng access to resources outs de the v rtua network An externa network can be ass gned to a VLAN
■
Internal An nterna network s a v rtua network sw tch that a ows v rtua mach nes on the server to connect to each other and to the parent part t on An nterna network can be ass gned to a VLAN
■
Private A pr vate network s a v rtua network sw tch that a ows v rtua mach nes to connect to each other, but t prov des no connect on between the v rtua mach nes and the phys ca computer
Initial Configuration
CHAPTER 6
91
Setting Network Type To set your networks to be externa networks, a ow ng them to connect through the phys ca network adapter to outs de the phys ca computer, use the fo ow ng steps 1. Open the Hyper-V Manager conso e f t sn’t a ready open 2. Se ect the Hyper-V computer n the eft pane, and then c ck V rtua Network Manager
n the Act ons pane to open the V rtua Network Manager as shown n F gure 6-6
Figure 6-6 The V rtua Network Manager
3. Se ect the V rtua Network you want to make an externa network Ed t the name to
prov de a more mean ngfu descr pt on, and add any notes you want to add 4. Se ect Externa , and se ect the phys ca network adapter you want to connect th s v r-
tua network to from the drop-down st, as shown n F gure 6-7
92 CHAPTER 6
Configuring SBS in Hyper-V
Figure 6-7 Attach ng a v rtua network to a phys ca adapter to create an externa network
5. C ck OK to c ose the V rtua Network Manager, and app y your changes
Server Settings The next step n configur ng your Hyper-V server s to set the overa server sett ngs and the user-spec fic sett ngs Genera server sett ngs nc ude the defau t ocat on for hard d sks and the defau t ocat on for v rtua mach nes User-spec fic sett ngs nc ude keyboard sett ngs and saved credent a s To set the server sett ngs for a Hyper-V server, use the fo ow ng steps 1. Open the Hyper-V Manager conso e f t sn’t a ready open 2. Se ect the Hyper-V computer n the eft pane, and then c ck Hyper-V Sett ngs n the
Act ons pane to open the Hyper-V Sett ngs d a og box, shown n F gure 6-8
Initial Configuration
CHAPTER 6
93
Figure 6-8 The Hyper V Sett ngs d a og box
3. Se ect V rtua Hard D sks n the eft pane, and enter the top of the path to use as a
defau t for stor ng the v rtua hard d sk (VHD) fi es used by v rtua mach nes You can change the actua path of any spec fic VHD ater Th s just sets the defau t ocat on 4. Se ect V rtua Mach nes n the eft pane, and set the defau t path for stor ng v rtua
mach ne snapshot fi es 5. Se ect Keyboard n the eft pane, and spec fy how spec a W ndows key comb nat ons
(such as A t+Tab and Ctr +Esc) are used 6. Se ect Mouse Re ease Key, and set the defau t key comb nat on to re ease a captured
mouse when connect ng to a v rtua mach ne that doesn’t have ntegrat on components nsta ed 7. Se ect De ete Saved Credent a s or Reset Check Boxes to remove any saved credent a s
on the server or to reset a the Don’t Ask Me Aga n check boxes on the server
94 CHAPTER 6
Configuring SBS in Hyper-V
8. C ck OK to change the sett ngs and return to the ma n Hyper-V Manager Note With the release of Service Pack 1 (SP1) for Windows Server 2008 R2, Hyper-V sup-
ports special Non-Uniform Memory Architecture (NUMA) settings. However, realistically, these are not particularly relevant in an SBS environment, though with the latest dual processor servers they are technically possible. In general, we suggest you leave this setting at the default, enabled.
Real World Default Locations
T
he default locations that Microsoft has chosen for VHD files and snapshot files don’t make any sense at all. The default location is on the system drive of the
parent partition. That’s just a really bad idea. Your VHD files could take up hundreds
of gigabytes of space, possibly terabytes of space. Do they really think your system drive is the right place for all that? Well, we certainly don’t. Frankly, we think they should either ask the question during the install or actually go out and inspect your system and choose an appropriate default based on your system configuration. But they didn’t make that choice, so you need to take steps to fix it. The default for snapshots is also on the system drive of the parent partition, and again these are files that are going to take up a lot of space. Plus, putting these files on the system drive is a bad decision for performance. We suggest creating one or more disk volumes specifically for storing VHDs and snapshots. This makes backups easier, allows you to store your VHDs on your fastest array, and just makes good sense. Even if you had to completely rebuild the server, by having your VHDs and snapshot files on separate volumes, you greatly simplify the recovery process.
Creating a Virtual Machine OK—enough of that gett ng-ready stuff and bas c configurat on The rea reason you’re runn ng Hyper-V s to actua y create and use v rtua mach nes (VMs), so et’s get down to t There are severa ways you can make a VM, but they a start w th the Hyper-V Manager conso e
Creating a Virtual Machine
CHAPTER 6
95
Note System Center Virtual Machine Manager (SCVMM) 2008 R2 fully supports Hyper-V
R2. If you use more than one or two VMs and support more than one host server, SCVMM is a great product. And we’re pretty cautious about saying things like that.
The bas c steps for creat ng a VM are as fo ows ■
Create a new VM, g v ng t a name and ocat on
■
Ass gn RAM to the VM
■
Connect to a network
■
Ass gn or create a v rtua d sk
■
Spec fy where the operat ng system w
be oaded from
The New V rtua Mach ne W zard hand es a these bas c steps but s pretty m ted, and nsuffic ent for creat ng a VM for SBS You’ want to actua y configure the VM further before nsta ng SBS or the SBS second server on your VM We’ start by wa k ng through the steps for creat ng a VM and then show you how to change that bas c VM to be a b t more usefu and flex b e
Creating a Basic VM To create a new VM, fo ow these steps 1. Open the Hyper-V Manager conso e f t sn’t a ready open 2. Se ect the Hyper-V computer n the eft pane, c ck New, and then c ck V rtua Mach ne
on the Act ons menu to start the New V rtua Mach ne W zard 3. If you haven’t d sab ed the Before You Beg n page, you can read the descr pt on of
what’s go ng to happen, or c ck the More About Creat ng V rtua Mach nes nk to open the He p pages for creat ng a VM Se ect the Do Not Show Th s Page Aga n check box so that you don’t have to see th s page aga n 4. C ck Next to open the Spec fy Name And Locat on page, shown n F gure 6-9
96 CHAPTER 6
Configuring SBS in Hyper-V
Figure 6-9 The Spec fy Name And Locat on page of the New V rtua Mach ne W zard
5. Enter a name for the VM, and se ect the Store The V rtua Mach ne In A D fferent Loca-
t on check box When you se ect th s check box, a the fi es for th s VM w be stored n a d rectory w th the same name as the VM, shown be ow n the Locat on fie d Note For this first VM, with a name of hp160-sbs2011 and a default location of E:\
VMs\, the result will be a new directory of E:\VMs\hp160-sbs2011, with the files and subdirectories of the VM stored in it.
6. C ck Next to open the Ass gn Memory page, shown n F gure 6-10 Spec fy the amount
of memory that w be ass gned to the new VM You shou d spec fy the same amount of memory you wou d spec fy for the RAM of a phys ca SBS computer, but do not exceed the memory of the host physical computer.
Creating a Virtual Machine
CHAPTER 6
97
Figure 6-10 The Ass gn Memory page of the New V rtua Mach ne W zard
7. C ck Next to open the Configure Network ng page Se ect the network that the VM
w
be connected to, as shown n F gure 6-11
Figure 6-11 The Conf gure Network ng page of the New V rtua Mach ne W zard
98 CHAPTER 6
Configuring SBS in Hyper-V
8. C ck Next to open the Connect V rtua Hard D sk page, shown n F gure 6-12
Figure 6-12 The Connect V rtua Hard D sk page of the New V rtua Mach ne W zard
9. Se ect Create A V rtua Hard D sk to create a new, automat ca y expand ng, v rtua
d sk w th a nom na s ze of 127 GB Accept the defau t ocat on, and name or mod fy the d sk as appropr ate for your env ronment Even though 127 GB seems ke a ot, we suggest you change the S ze fie d to at east 200 GB The defau t s to create a dynam ca y expand ng hard d sk Now that’s just great f th s sn’t a product on server, but we th nk t’s a good dea to create a fixed-s ze VHD for a product on system Even though dynam c VHDs have gotten a ot faster s nce the or g na re ease of Hyper-V, there’s st a defin te performance advantage to a fixed-s ze VHD To use a fixed-s ze VHD, run the New V rtua Hard D sk W zard and create the d sk first, and then attach t at th s stage of the New V rtua Mach ne W zard, or sk p the Connect V rtua Hard D sk page of the w zard for now and attach a d sk ater Important The maximum size of an IDE VHD in Hyper-V is 2 terabytes (2040 GB,
actually). But a dynamically expanding virtual hard disk doesn’t actually take up any more room on your physical hard disk or array than it needs to. As you expand your use of the VM, the size of the disk will continue to grow, up to the size you set when you create the disk. But if you run out of actual disk space because you overcommitted the total size of dynamic VHDs, ugly things will happen.
Creating a Virtual Machine
CHAPTER 6
99
10. C ck Next to open the Insta at on Opt ons page, as shown n F gure 6-13
Figure 6-13 The nsta at on Opt ons page of the New V rtua Mach ne W zard
The cho ces are ■
Install An Operating System Later Th s opt on requ res you to configure how your operat ng system w
■
be nsta ed manua y before start ng the VM
Install An Operating System From A Boot CD/DVD-ROM Th s opt on a ows you to connect to the phys ca computer’s CD or DVD dr ve, or to mount an ISO fi e stored on the phys ca computer’s hard d sk as f t were a phys ca CD/DVD dr ve
■
Install An Operating System From A Boot Floppy Disk Th s opt on a ows you to connect to a v rtua floppy d sk ( vfd) fi e as f t were a phys ca floppy dr ve
■
Install An Operating System From A Network-Based Installation Server Th s opt on changes the BIOS sett ng for the VM to enab e a network boot from a PXE server, and t a so changes the network card for the VM to be an emu ated egacy network adapter nstead of the defau t synthet c network adapter
11. C ck Next to open the Comp et ng The New V rtua Mach ne W zard summary page, or
c ck F n sh to sk p the ast step On the ast page, you can choose to automat ca y start the new VM as soon as you c ose the w zard, but we th nk that’s a bad opt on Just sk p t—you shou d probab y adjust the sett ngs for the new VM before you start t anyway
100 CHAPTER 6
Configuring SBS in Hyper-V
Machine Settings After you’ve created the VM for your SBS server, you shou d make some changes to the mach ne sett ngs that the New V rtua Mach ne W zard has configured To adjust the sett ngs of a VM, se ect the VM n the center V rtua Mach nes pane of Hyper-V Manager, and c ck Sett ngs on the Act on menu to open the Sett ngs d a og box for the VM, as shown n F gure 6-14
Figure 6-14 The Sett ngs d a og box for the hp160 sbs2011 v rtua mach ne
The sett ngs page of a VM a ows you to contro the v rtua hardware ava ab e to that VM The sett ngs that can be changed on a VM nc ude
■
Add Hardware Add a SCSI Contro er, network adapter, or egacy network adapter
■
BIOS Change the boot order and Num ock state
■
Memory Set the amount of memory ass gned to the VM SBS VMs are m ted to 32 GB of RAM, just as they are on phys ca hardware
■
Processor Set the number of og ca processors ass gned to the VM Th s s m ted to the number of og ca processors ava ab e on the host computer or four og ca processors, wh chever s ess For SBS 2011, ass gn at east two og ca processors, and four s preferred
■
IDE Controllers 0, 1 Set the dr ves connected to each IDE contro er Both Hard D sk and DVD Dr ve types are supported on IDE contro ers Creating a Virtual Machine
CHAPTER 6
101
■
SCSI Controller(s) Set the dr ves connected to the synthet c SCSI contro er Each SCSI contro er s ass gned to SCSI ID7 and can support up to s x v rtua SCSI dr ves SCSI dr ves cannot be used as boot dr ves and are not ava ab e unt ntegrat on components are nsta ed Even f your phys ca dr ves are SCSI or SAS, do not choose SCSI here for your boot d sk That must a ways be IDE
■
Network Adapters Set the network, Mac type, and VLAN connect ons of the synthet c network adapters SBS 2011 supports on y a s ng e network adapter, and you shou d choose a synthet c network adapter (the defau t)
■
Legacy Network Adapters Set the network, Mac type, and VLAN connect ons of the egacy network adapters Each VM s m ted to a max mum of four egacy network adapters Avo d these f at a poss b e—they’re s ow
■
COM 1, COM 2 Set the named p pe used to commun cate w th the phys ca host computer Th s sett ng s essent a y use ess for most th ngs n the SBS env ronment
■
Diskette Drive Set the v rtua floppy dr ve ( vfd) that s connected to the v rtua floppy dr ve No pass-through to the phys ca floppy dr ve on the host (parent) computer s supported Use VFDs for SBS Answer F es to automate dep oyment
Memory and CPU Hyper-V supports a max mum of four processors and 64 GB of RAM per VM On host computers w th fewer than four processors, you’ be m ted to the number of og ca processors on the host tse f And you need to be carefu to not over-spec fy the RAM for VMs on a phys ca computer You need to eave at east 500 Mb of RAM for the host part t on, p us a b t ( ess than 100 Mb) per runn ng VM
Real World Dynamic Memory Allocation
W
indows Server 2008 R2 Service Pack 1 (SP1) and Microsoft Hyper-V Server 2008 R2 SP1 support dynamic memory for Hyper-V virtual machines. Dy-
namic memory allows you to allocate a minimum amount of memory to supported virtual machines, but also set a maximum amount of memory. The Hyper-V host can now dynamically assign memory to virtual machines based on the dynamic memory needs of the virtual machines and their overall memory weighting as set by the administrator. This dramatically enhances your ability to effectively use the resources of the Hyper-V host to support the maximum number of virtual machines without performance degradation.
102 CHAPTER 6
Configuring SBS in Hyper-V
When you configure the settings on a virtual machine, you enable dynamic memory for that machine and you set a Startup RAM and a Maximum RAM, along with a memory buffer percentage, and the memory weight of the virtual machine, as shown in Figure 6-14. The Hyper-V host first attempts to start all the virtual machines that are scheduled to start by allocating the Startup RAM specified to each VM. Once that RAM has been allocated, it looks at the buffer specified for each virtual machine and, if it can, reserves the full buffer to each virtual machine. If it is unable to assign each virtual machine the full buffer specified, it then uses a combination of the weighting of the memory for the virtual machines and the memory pressure of the virtual machines to allocate the available memory resources as effectively as possible. As the memory pressure from each virtual machine changes dynamically over time, the Hyper-V host will be allocated more or less RAM depending on the settings of the VMs on the host and the available RAM resources. To use dynamic memory, your Hyper-V host must be running SP1 and your guest operating systems must be supported. For SBS networks, this means you must install Windows Server 2008 R2 SP1 on the Premium Add-on server if you have one, and upgrade the integration components on the virtual machine. Dynamic memory allocation is not supported for the main SBS server. Additional virtual machines running Windows Server 2003, Windows Server 2008, Windows Vista (Enterprise or Ultimate), or Windows 7 (Enterprise or Ultimate) are also able to take advantage of dynamic memory if they have been upgraded to the latest service pack.
Disks and Controllers Hyper-V uses a pa r of synthet c IDE contro ers for hard d sks and DVD dr ves by defau t You must use an IDE for the boot hard d sk—the synthet c SCSI contro er won’t have dr vers ava ab e n the operat ng system unt after the ntegrat on components are nsta ed If you’re fam ar w th the IDE contro er n V rtua Server 2005, you’ know that t was s ow and on y supported hard d sks up to 127 GB We qu ck y earned to use V rtua Server’s SCSI contro er and floppy d sk to oad the dr vers dur ng nsta at on, great y speed ng up the process But that workaround s no onger necessary and won’t work w th the Hyper-V SCSI contro er The new IDE contro er n Hyper-V has fu LBA-48 support, and t’s much faster than the o d V rtua Server one In W ndows Server 2008 R2 Hyper-V, a v rtua mach nes nc ude a SCSI contro er by defau t You can add add t ona SCSI contro ers f necessary You shou d use a SCSI d sk type for any add t ona data d sks you ass gn to the SBS VM W ndows Server 2008 R2 supports hot add and remove of SCSI hard d sks to runn ng VMs
Creating a Virtual Machine
CHAPTER 6
103
Real World Choosing Disk Types
H
yper-V supports three virtual disk types—dynamically expanding disks, fixedsized disks, and differencing disks.
Dynamically expanding disks are created with a maximum size, and this is the size that the operating system of the VM sees. But the actual .vhd file of the disk takes up only as much space on your physical hard disk or array as absolutely required for the current contents of the VM drive. As the VM requires more storage space, Hyper-V automatically grows the .vhd file. This is very efficient, allowing you to add hard disk space only as absolutely required. But it does result in a slight performance hit every time the disk needs to grow, and more important, the .vhd file tends to become somewhat fragmented over time, also impacting performance. Nonetheless, we almost always use this type of disk for our nonproduction VMs. But not for the main SBS VM. A fixed-size disk is also a .vhd file, but with a fixed-size .vhd file, the .vhd file is created at the full size on disk that it needs to be. It takes a significant amount of time to create the .vhd file, but it will be created as a contiguous file (or as contiguous as the underlying fragmentation of your physical disk or array allows). A differencing disk is an interesting disk type. It is like a dynamic disk in that it gets only as large as it needs to. But a differencing disk is a great way to combine the disk space requirements of multiple VMs. You create the original “base” VM, and then mark the disks as read-only. You can actually delete the VM that created the base disks. Then you create one or more VMs that have the same operating system, and you create them with one or more differencing disks. The differencing disk points to the original base .vhd file, and the only thing that gets saved to the differencing disk is any change from the base VM. This allows multiple VMs to share the same base, simplifying deployment of different versions of the same base system— very useful for quickly building test networks. The biggest disadvantage of differencing disks is their impact on speed. As more VMs point back to the original VHD files, the access to that VHD can be slowed. And if anything causes a change to the original VHD, all the VMs that point to it can be lost. Over time, the size advantage of differencing disks is also reduced as updates and service packs are applied to the differenced VMs. But for a test environment? Differencing disks can be a great speed and resource saver. The final option is a pass-through disk that points directly to the physical partition. This is the fastest option, but it provides the least flexibility. You might choose this option if you are running Microsoft SQL Server on a VM and you have a performance-sensitive application. But even there, we tend to avoid it if at all possible. The difference in performance compared to a fixed-size VHD is small (on the order of 5 percent, we’re told). Spend your money on good disk I/O subsystems and avoid pass-through disks.
104 CHAPTER 6
Configuring SBS in Hyper-V
Network Adapters When you create a new VM, t w automat ca y nc ude a s ng e network adapter Un ess you choose to nsta the operat ng system from the network, t w add one of the synthet c network adapters that are new to Hyper-V These work great and are defin te y the preferred cho ce—un ess you are runn ng an operat ng system that doesn’t have ntegrat on components ava ab e for t If that’s the case, you need to change th s adapter to a egacy network adapter You can’t d rect y change the adapter type—you need to de ete the ex st ng one and add a egacy adapter Because SBS 2011 nc udes the necessary ntegrat on components bu t n to the base operat ng system, you shou d a ways choose a synthet c network adapter un ess you are us ng PXE to boot from the network
COM and Floppy Hyper-V automat ca y configures a pa r of v rtua COM ports (COM1 and COM2) and a v rtua floppy d sk dr ve for each VM But t doesn’t actua y connect them to anyth ng To connect a COM port to the host computer, you need to use named p pes, wh ch are, unfortunate y, useess for fax ng or anyth ng e se we m ght be do ng w th our SBS servers For floppy d sks, you need to create a v rtua floppy d sk fi e ( vfd) A VFD fi e s an mage of a floppy d sk There s no way n Hyper-V to connect d rect y to any ex st ng floppy dr ve on the server
Working with a Virtual Machine Work ng w th a Hyper-V VM s a most dent ca to work ng w th a phys ca computer You shou d do v rtua y everyth ng you need to do from the c ent operat ng system, just as you wou d on a phys ca computer You can connect to the c ent operat ng system us ng Remote Desktop when that s a supported opt on, and you can a ways connect us ng the V rtua Mach ne Connect on You can open the V rtua Mach ne Connect on to a part cu ar VM by e ther doub e-c ck ng the VM n the Hyper-V Manager conso e or se ect ng t and then c ck ng Connect on the Act on menu You can connect e ther oca y from the parent part t on or remote y f you’re runn ng the Hyper-V Remote Management Too s Th s connect on to the VM s the same as the phys ca keyboard, mouse, and mon tor of a phys ca computer However, there are some act ons that need to be performed from the parent part t on, e ther from the Hyper-V Manager conso e or the from the menu bar of the V rtua Mach ne Connect on
Starting, Stopping, Saving, Snapshotting To start a VM, you need to e ther set the VM to automat ca y start or use the Hyper-V Manager conso e to start the VM R ght-c ck the VM n the conso e, and se ect Start from the menu If you have the V rtua Mach ne Connect on for that VM open, you can se ect Start from the Act on menu
Working with a Virtual Machine
CHAPTER 6
105
To stop a VM, you shou d shut down the operat ng system n the VM You can n t ate th s from the Hyper-V Manager conso e or on the V rtua Mach ne Connect on Act on menu, f ntegrat on components are nsta ed n the VM You can a so stop a VM by r ght-c ck ng the VM n the conso e and se ect ng Turn Off, but th s can cause corrupt on ssues for the VM’s operat ng system and s not recommended when other a ternat ves are ava ab e Se ect ng Turn Off s exact y ke pu ng the power cord out of the back of a runn ng phys ca server You can save a VM from the Hyper-V Manager conso e or the V rtua Mach ne Connect on for that VM by se ect ng Save from the Act on menu Th s w save the current state of the VM to d sk and s s m ar to h bernat ng a phys ca computer It does re ease memory and resources back to the parent part t on Paus ng a VM s s m ar to putt ng a phys ca computer nto s eep mode It’s not act ve y do ng anyth ng, but t a so doesn’t re ease any of the VM’s resources back to the parent part t on, except that t sn’t us ng a CPU or do ng any d sk I/O But the RAM t has a ocated to the VM stays unava ab e to other VMs Snapshots are one of the ways VMs are more usefu and flex b e than any phys ca computer Snapshots a ow you to take a “p cture” of a runn ng v rtua mach ne at an exact moment n t me and save t You can revert back to that snapshot ater, start ng up the VM at that exact configurat on Th s s extremely usefu for bu d ng test computers because t ets you try a new configurat on or software app cat on w thout the r sk of hav ng to rebu d the computer f someth ng rea y bad happens, or just w thout wast ng the t me try ng to get back to where you were before the change f t d dn’t work Snapshots can be a powerfu too , g v ng you the ab ty to try someth ng w th the ca m assurance that you can recover comp ete y f t doesn’t work And snapshots happen n seconds Just se ect the VM n the Hyper-V Manager conso e, r ght-c ck, and se ect Snapshot The VM can be runn ng or not— t doesn’t matter After you create a snapshot, the VM returns to ts prev ous state You can rename the snapshot, check the sett ngs that app ed at the t me of the snapshot, de ete t, or even de ete an ent re snapshot subtree A these act ons are ava ab e from the Act ons pane of the Hyper-V Manager conso e or from the Act on menu of the V rtua Mach ne Connect on You can a so revert a VM to ts prev ous snapshot or se ect another snapshot n the tree and app y t As you can see, t’s powerfu stuff, and the poss b t es are someth ng you’ just have to work w th a b t to beg n to understand A caut on, however t’s genera y a really bad idea to use snapshots on product on SBS servers Or on any other doma n contro er
Clipboard The Hyper-V V rtua Mach ne Connect on supports a m ted ab ty to pass the contents of your c pboard between the parent part t on and the runn ng VM On y text can be passed, but th s a ows you to rep ay the text as keystrokes nto the VM To use th s capab ty, you need to copy text to your c pboard on the parent part t on us ng Ctr +C or any other method
106 CHAPTER 6
Configuring SBS in Hyper-V
Then, n the ch d part t on, prepare the ocat on you want to type the text nto, and se ect Type C pboard Text on the C pboard menu of the V rtua Mach ne Connect on The text s typed nto the ch d part t on at the cursor, one character at a t me The other feature of the Hyper-V V rtua Mach ne Connect on C pboard menu s a screen capture ut ty A pretty m ted one, frank y, but t works f what you need to do s capture the ent re screen of the ch d computer To capture the screen, just se ect Capture Screen from the V rtua Mach ne Connect on C pboard menu Th s puts the screen nto your c pboard, and from there you can paste t nto M crosoft Pa nt or any other graph cs program
Real World Screen Capture Utilities
T
he ability to capture screens is essential for any documentation task, and often important for troubleshooting as well. Having an exact picture of the situa-
tion at a specific point in time just makes everything clearer, in our experience. The screen capture utility in Hyper-V only does the full screen. You can’t get screen shots of individual windows or buttons because the key strokes are usually captured from the parent partition, not the child. Our solution is to use a small utility that is much smarter at creating screen shots than anything we could do with the built-in facilities of Windows—HyperSnap (http://www.hyperionics.com). There are other screen capture utilities out there, but we’ve been using HyperSnap for more than 16
years now, and it does an excellent job. We can capture exactly what we want and save it in any format we can imagine. Plus, if we do need to manipulate an image for some reason, HyperSnap has the ability to do that, too. We load a copy of HyperSnap into every test computer we run, using Group Policy to deploy it. And when we needed screen shots for Server Core? Hyperionics created a custom version for us that worked where nothing else had.
SBS in Hyper-V Runn ng SBS as a Hyper-V ch d part t on s a so ut on that we th nk makes a ot of sense M crosoft fu y supports runn ng W ndows Sma Bus ness Server 2011 Standard n a Hyper-V ch d part t on The “M crosoft server software and supported v rtua zat on env ronments” Know edgeBase art c e (http://support.microsoft.com/?kbid=957006) has the fu deta s Add t ona y, the second server that s part of the Prem um Add-on s a so supported One th ng you can’t do, sn’t supported, won’t work, and wou d be a bad dea even f t did work s us ng the SBS server as the parent part t on If you try to run the Hyper-V ro e on the ma n SBS server, you w not be ab e to get everyth ng to work correct y, espec a y DNS You can, however, run the Prem um Add-on server as the parent part t on and run SBS as a ch d, a ong w th a copy of the Prem um Add-on server as a ch d
SBS in Hyper-V
CHAPTER 6
107
Hyper-V shou d a ways run n a part t on where tt e or noth ng e se s go ng on The parent part t on shou d be just that—str ct y a parent Th s keeps the attack surface of the ent re set of v rtua mach nes sma er, reduces the number of reboots requ red, and pr or t zes the resources for the VMs, wh ch shou d be the ones do ng the heavy ft ng We can mag ne scenar os where the parent part t on s a so runn ng a coup e of key nfrastructure ro es as we —DNS and DHCP come to m nd We genera y prefer not to do th s, but t can make fe a b t eas er n some scenar os However, once you start runn ng any other ro es beyond Hyper-V on your parent part t on, you’ve changed the cens ng equat on
Licensing W th W ndows Server 2008 R2 Standard, you are ent t ed to what are ca ed 1+1 cens ng r ghts Th s means you can use the same phys ca cense to nsta W ndows Server 2008 R2 on the parent part t on and the first ch d part t on, as long as the only role you install into the parent is Hyper-V. That’s an mportant m tat on As soon as you start add ng n other ro es, you ose the r ght to run a ch d part t on w thout buy ng a fu cense for t The copy of W ndows Server 2008 R2 Standard that s nc uded n the Prem um Add-on s a fu copy of W ndows Server 2008 R2 and can be used w th these 1+1 r ghts Add t ona y, there s a spec fic exc us on that a ows the parent part t on to not have to be jo ned to the SBS doma n It can run n workgroup mode as ong as t’s on the same phys ca network as the SBS doma n W ndows Server 2008 R2 Enterpr se g ves you the r ght to nsta a parent part t on and four ch d part t ons as ong as that parent part t on s used on y for the Hyper-V ro e As soon as you add n any other ro es to the parent, you ose one of your secondary r ghts W ndows Server 2008 R2 Datacenter g ves you the r ght to nsta a parent part t on and as many ch d part t ons as you want Of course, the actua cost of a Datacenter cense s just a b t out of the reach of most sma bus nesses
Configuration When you configure a ch d part t on for SBS 2011 Standard, you shou d a ocate the same eve of hardware resources to the ch d as you wou d to a phys ca server runn ng SBS 2011 Standard Th s means a minimum of 6 GB of RAM, but we th nk 10 GB s a more appropr ate m n mum for any product on env ronment And ass gn four processor cores to the SBS server VM You shou d a ways use the synthet c network adapters, wh ch are much faster than the egacy emu at on ones And create the same number of v rtua hard d sks for your server as you wou d have arrays w th a phys ca computer We ke to have a m n mum of three d sks— one for the system, one for user space, and one for M crosoft Exchange data Even f your c rcumstances requ re you to have them s tt ng on the same RAID array, hav ng three separate v rtua d sks puts you n a pos t on to add more arrays f you need to and eas y move the VHDs over to the new array to ba ance the oad The one configurat on we see used ncreas ng y as consu tants and others beg n to understand the power and capab t es of 64-b t servers s the “SBS Prem um n a Box” dep oyment
108 CHAPTER 6
Configuring SBS in Hyper-V
Th s starts w th a sma Hyper-V parent part t on, poss b y runn ng the M crosoft Hyper-V Server, and then two ch d part t ons—the first runn ng the ma n SBS server and the second runn ng the Prem um Add-on second server w th SQL Server on t Or, n many dep oyments, a W ndows Server 2008 R2 Standard server runn ng Remote Desktop Serv ces Th s a - n-one so ut on cou d eas y be supported on a s ng e, we -thought-out, m d-range server, w th two quad-core CPUs and 16 to 24 GB of RAM, a good cach ng RAID contro er, and a Ser a -Attached SCSI (SAS) d sk array
Summary V rtua zat on s a hot top c these days, and w th good reason The new capab t es of 64b t servers and M crosoft’s new Hyper-V techno ogy make t a compe ng opt on n many scenar os In th s chapter, we covered the bas cs of us ng Hyper-V to v rtua ze W ndows Sma Bus ness Server 2011 In the next chapter, we cover m grat ng from an ex st ng W ndows Sma Bus ness Server network to SBS 2011
Summary
CHAPTER 6
109
CHAPTER 7
Migrating to Windows Small Business Server 2011 Standard W
th M crosoft W ndows Sma Bus ness Server 2011 Standard (SBS 2011), there s no “upgrade” from any other vers on The on y way to preserve an ex st ng dep oyment of SBS, nc ud ng ema and Act ve D rectory, s to m grate to SBS 2011 Th s s true whether you’re com ng from the 32-b t W ndows Sma Bus ness Server 2003 (SBS 2003), the 64-b t W ndows Sma Bus ness Server 2008 (SBS 2008), or another copy of SBS 2011 M grat on s far more comp ex than a c ean nsta or n-p ace upgrade, a though the SBS team has made a s gn ficant effort to s mp fy the most common cases However, SBS 2011 requ res some s gn ficant changes to your network that you need to p an out ahead of t me ■
SBS 2011 supports on y a s ng e network nterface card (NIC) The preferred SBS 2003 configurat on s two NICs, so f you’re m grat ng from SBS 2003, you’ need to reconfigure t for a s ng e NIC first
■
SBS 2011 Prem um does not nc ude Internet Secur ty and Acce erat on (ISA) If you’re an SBS 2003 Prem um customer runn ng ISA as your firewa , you’ need to rep ace t w th an a ternat ve
■
Your new SBS 2011 server w have a d fferent name than your ex st ng SBS server, and a d fferent IP address The m grat on process w configure DNS to correct for th s
■
The new Companyweb SharePo nt s te w rep ace your ex st ng Companyweb s te You can m grate your ex st ng Companyweb, but the process adds comp ex ty to the m grat on process
■
After you start the m grat on, there rea y s no “undo” button And you’ have 21 days to comp ete the process and remove the o d server from the network
These are a s gn ficant ssues, n our op n on But f you prepare your ex st ng SBS server proper y and p an your m grat on thorough y before beg nn ng the process, the m grat on w succeed
111
In th s chapter, we’ pr mar y be cover ng the m grat on from SBS 2003 because that w be the argest group of m grat ons, but much of what we’ cover here s a so app cab e to m grat ons from SBS 2008 or SBS 2011 If you’re m grat ng from one of these ater vers ons, we recommend st that you read th s chapter thorough y before you beg n, and fo ow the bas c steps here However, you’ use a s ght y d fferent document from M crosoft to refer to dur ng the process
The Migration Process Before you start your SBS 2011 m grat on, you shou d read and understand th s chapter and the appropr ate M crosoft m grat on gu de There are three m grat on gu des, and the one you’ use depends on wh ch vers on of SBS you are m grat ng from The three gu des are ■
“M grate to W ndows Sma Bus ness Server 2011 Standard from W ndows Sma Bus ness Server 2003” at http://technet.microsoft.com/en-us/library/gg563801.aspx
■
“M grate to W ndows Sma Bus ness Server 2011 Standard from W ndows Sma Bus ness Server 2008” at http://technet.microsoft.com/en-us/library/gg615506.aspx
■
“M grate W ndows Sma Bus ness Server 2011 Standard to New Hardware” at http:// technet.microsoft.com/en-us/library/gg616008.aspx
We’ refer to these gener ca y as the Microsoft migration guides, and you shou d a ways refer to the appropr ate one for your spec fic m grat on scenar o The steps n a successfu m grat on are as fo ows 1. Prepare your ex st ng SBS server for m grat on 2. Create the SBSAnswerF e xm us ng the SBS AnswerF e Generator too 3. Insta SBS 2011, us ng the Answer F e to run n m grat on mode 4. Use the M grat on W zard to m grate data and sett ngs from your ex st ng SBS server to
your new SBS 2011 server 5. When m grat on s comp ete, demote your ex st ng SBS server to a doma n member
and then remove t from the doma n You must reformat the server before you can reuse t 6. If you’re us ng Fo der Red rect on n SBS 2003, you’ need to de ete the o d Group
Po cy object (GPO) for fo der red rect on 7. Perform opt ona post-m grat on tasks— nc ud ng mapp ng users to computers and
enab ng fo der red rect on—and M crosoft Exchange tasks such as add ng POP3 connectors and updat ng ma box quotas
112 CHAPTER 7
Migrating to Windows Small Business Server 2011 Standard
Real World A Migration Alternative
W
ith SBS 2003, the Microsoft solution for migration caused significant user disruption and was only a viable solution if you needed to change your SBS
domain name for some reason. In our Microsoft Windows Small Business Server 2003 R2 Administrator’s Companion book, we recommended an alternative solution—Swing Migration (see http://www.sbsmigration.com). Swing Migration uses a temporary domain controller to capture the Active Directory, DNS, and other information from the existing domain controller (the source SBS server) and transfer that to the new SBS 2003 server, allowing the new SBS server to retain the exact same name and IP address as the original source SBS server. Microsoft Exchange data is
generally moved with a simple forklift technique, and SharePoint sites are handled in a similar fashion—overall, an excellent and time-effective way to manage a migration that has several virtues over other methods, including: ■
No disruption or change to SBS client computers.
■
No disruption in email or other network functions except for the final switchover, which can easily be done during normal downtimes. Most work is done offline and can be done on a flexible schedule.
■
Full data and configuration protection.
■ The
ability to restart the process at any point in time with no risk of data loss if
there is a problem. Unfortunately, Swing Migration as it exists for SBS 2003 will not completely work for SBS 2011, although we can see some definite benefits to using a similar process. It certainly covers the server name and IP address change issue, and we can envision how to work around most of the possible email issues. We expect Jeff Middleton, Microsoft MVP for SBS and principal of www.sbsmigration .com, to have a full version of Swing Migration for SBS 2011 soon, and we expect it to be a very good offering—especially if your migration project is not a perfect fit for the Microsoft assumptions. We’ve known Jeff for several years now, and even though his final version of Swing isn’t yet available, we have enough confidence in him to recommend it fully. Because, ultimately, what you really need for any migration is just that—confidence.
The Migration Process
CHAPTER 7
113
Preparing Your Server The most mportant part of any m grat on to SBS 2011 nvo ves proper y prepar ng your ex st ng SBS server The t me and thought you spend on a fu and carefu preparat on of your ex st ng SBS server has a d rect mpact on the success of your m grat on Don’t just start a m grat on w thout first prepar ng Read th s ent re chapter carefu y, and read M crosoft’s m grat on gu de as we Be sure you understand what w happen and what the requ rements are before you start The steps for prepar ng your server are as fo ows 1. Do a fu and comp ete backup of the ex st ng SBS server 2. Insta a current serv ce packs and other updates on the server 3. Configure your network for the m grat on 4. Configure Act ve D rectory 5. Run the Best Pract ces Ana yzer (BPA) to ver fy the hea th of the ex st ng SBS network 6. C ean up and opt m ze the current M crosoft Exchange ma boxes 7. Use the M grat on Preparat on Too to extend the Act ve D rectory schema, mod fy the
M crosoft Exchange Server mode, and extend the t me that both vers ons of SBS can be runn ng to 21 days 8. Ident fy ne-of-bus ness app cat ons runn ng on the ex st ng SBS server, and p an for
the r m grat on
Before You Start You’re go ng to need certa n too s dur ng th s process, and they may or may not a ready be on your source server To s mp fy th ngs and make sure you have everyth ng ready and ava ab e, we suggest you down oad the fo ow ng ahead of t me ■
W ndows PowerShe 2 0 and the Management Framework Core from http:// go.microsoft.com/fwlink/?LinkId=188528
■
M crosoft Base ne Configurat on Ana yzer 2 0 (MBCAv2) from http://go.microsoft.com/ fwlink/?LinkId=188529
■
M crosoft NET Framework 2 0 SP1 from http://go.microsoft.com/fwlink/?linkid=153680
■
M crosoft SBS 2003 Best Pract ces Ana yzer from http://go.microsoft.com/fwlink/ ?LinkId=113752
A so, co ect any other too s you genera y ke to have ava ab e dur ng the bu d process If you create an ISO fi e of these or burn them to a DVD, they’ be ava ab e whenever and wherever you need them For ISO creat on, we ke the s mp c ty of ISO Recorder (http://isorecorder.alexfeinman.com/isorecorder.htm) It’s s mp e, t does the job rea y we , and t’s free
114 CHAPTER 7
Migrating to Windows Small Business Server 2011 Standard
Go ahead and nsta W ndows PowerShe 2 0, MBCAv2, and the BPA on your source server They usua y don’t tr gger a reboot
Back Up Your Existing SBS Server The first and most mportant step n any m grat on s mak ng sure you have a fu and ver fied backup We a do backups, and we hope that we never need to use them But f you aren’t tak ng steps to actua y ver fy that your backup can be restored, you haven’t rea y got a backup you can count on Before beg nn ng any SBS m grat on, t’s essent a that you estabsh a sound fa back pos t on that w a ow you to recover n case someth ng goes wrong Of course, noth ng should go wrong, but we’re firm be evers n Murphy’s Laws—after a , we wrote the books on them! For deta s on how to back up your ex st ng SBS 2003 server, see http://go.microsoft.com/ fwlink/?LinkId=27140, or see Chapter 13, “Back ng Up and Restor ng Data,” n our Microsoft Windows Small Business Server 2003 R2 Administrator’s Companion book (For SBS 2008, see Chapter 16, “Configur ng Backup,” n our Windows Small Business Server 2008 Administrator’s Companion book or Chapter 16 n th s book for SBS 2011 ) In addition to do ng a convent ona backup us ng SBS Backup, we strong y suggest makng an mage backup of at east the system vo ume of your ex st ng SBS server and any other vo umes that are used to store core SBS data fi es, such as M crosoft Exchange data fi es Th s w a ow for a faster fu recovery n the event that you have to cance the m grat on for some reason Products we’ve used for th s mage backup nc ude StorageCraft, Acron s, and W ndows Home Server Current y, we’re us ng, and rea y k ng, W ndows Storage Server 2008 R2 Essent a s to back up the v rtua hard d sks (VHDs) of SBS Whatever backup methods you use, you shou d verify the integrity of the backup by do ng a test restore For mage backups, th s means restor ng the ent re part t on mage to a d sk of equa or greater s ze and, at a m n mum, ver fy ng that fi es can be read and opened For an SBS Backup test, you shou d restore mu t p e fi es from d fferent ocat ons to an a ternate ocat on and ver fy that the fi es can be opened and read
Install Current Updates It seems obv ous to us, but bears repeat ng nonethe ess—br ng your current SBS server up to date, nsta ng a current serv ce packs and secur ty updates If you’re runn ng SBS 2003 R2 or ater, w th bu t- n W ndows Server Update Serv ce (WSUS), th s shou d be happen ng automat ca y But even f you’re sure you are up to date, connect to M crosoft Update to ver fy The m grat on process expects m n mum eve s of serv ce packs, and not be ng fu y “patched up” can create ssues n the m grat on G ven that the m grat on s a one-way process, you rea y don’t want to get we nto t and find you have a b ocker We hope the too s n th s preparat on stage w enab e you to catch any b ockers before you start, but t’s st just a rea y good dea to get a your updates nsta ed before you start
Preparing Your Server
CHAPTER 7
115
Network Configuration Before you can m grate to SBS 2011, you need to configure your ex st ng SBS server for a s ng e NIC Th s means a s gn ficant change for most SBS 2003 networks, because the preferred configurat on for SBS 2003 ca s for two NICs—one connected to the externa Internet and one connected to the nterna SBS network A traffic on the nterna network actua y passes through the SBS server to get to the Internet, as shown n F gure 7-1 C ent
C ent
Sw tch
nternet nterna Ethernet Network
SBS 2003
C ent
C ent
Figure 7-1 Defau t two N C conf gurat on for SBS 2003
Th s configurat on a so uses SBS as the firewa for the SBS network—someth ng t does qu te we when runn ng SBS 2003 Prem um Ed t on w th ISA 2004 Because SBS 2011 requ res a s ng e NIC configurat on, you need to change your SBS 2003 configurat on before the m grat on In a s ng e NIC configurat on, as shown n F gure 7-2, you’ need to add a router and firewa to your ex st ng SBS network, a ong w th reconfigur ng the defau t gateway and other sett ngs for your c ent computer and dev ces nternet
Router
F rewa C ent
C ent
Sw tch nterna Ethernet Network
SBS
C ent
C ent
Figure 7-2 S ng e N C conf gurat on for SBS
116 CHAPTER 7
Migrating to Windows Small Business Server 2011 Standard
Most consumer-grade routers nc ude m n ma firewa capab t es, but they rea y aren’t suffic ent to proper y protect an SBS network You shou d e ther add a firewa app ance n add t on or buy a true firewa router, such as one of the TZ ser es firewa s from Son cWALL (http://www.sonicwall.com/us/products/TZ Series.html) Other poss b t es nc ude WatchGuard firewa s (http://www.watchguard.com) and NETGEAR ProSecure firewa s (http://www. prosecure.netgear.com/products/prosecure-utm-series/models.php) The bas c process of network reconfigurat on uses the fo ow ng steps 1 Reconfigure DHCP for shorter cense t mes (opt ona ), and save the DHCP database 2. D sab e or remove the Internet-fac ng NIC n your ex st ng SBS server 3. Run the Configure E-Ma And Internet Connect v ty W zard (CEICW) to reconfigure
network ng 4. Insta a router/firewa , and connect to Internet 5. Connect the router/firewa to a sw tch on the nterna Ethernet 6. Run the Remote Access W zard to d sab e v rtua pr vate networks (VPNs) and reconfig-
ure Rout ng And Remote Access (RRAS) 7. Reconfigure c ent computers and dev ces w th fixed IP addresses and ver fy DHCP
configurat on
DHCP Reconfiguration A though t’s not abso ute y requ red, you can s mp fy DHCP address reconfigurat on on your SBS network f you shorten the ease t me n advance of beg nn ng the m grat on Th s w a ow c ent computers and dev ces on your network to get updated network nformat on w thout a reboot n a reasonab e t me frame The defau t DHCP ease durat on s e ght days To change the durat on, fo ow these steps 1. Log on to your ex st ng SBS server w th an account that has adm n strat ve pr v eges 2. Open the DHCP conso e (dhcpmgmt msc) 3. In the eft pane, dr
down and se ect the scope you want to change
4. Se ect Propert es from the Act on menu to open the Scope Propert es d a og box
shown n F gure 7-3
Preparing Your Server
CHAPTER 7
117
Figure 7-3 The Scope Propert es d a og box for a DHCP scope
5. Change the Lease Durat on For DHCP C ents va ues to a shorter t me We ke to set an
8-hour ease here 6. C ck OK to c ose the Scope Propert es d a og box and return to the DHCP conso e
C ose the DHCP conso e Another usefu step to take at th s po nt s to back up the DHCP database If you are us ng a standard SBS DHCP w th no reservat ons or other custom zat ons, don’t bother—the w zards w take care of t But f you have done s gn ficant configurat on, you shou d probab y back up your DHCP database to make t eas er to restore that configurat on See the M crosoft Know edge Base art c e at http://support.microsoft.com/kb/962355
Disable or Remove the Second NIC The first essent a step n reconfigur ng your SBS 2003 network from a two NIC SBS network to a s ng e NIC network s to d sconnect the externa y fac ng NIC from your ex st ng Internet connect on and d sab e or remove the network card You can get away w th d sab ng t, but then you’ have more comp a nts from the SBS w zards, so we prefer remov ng t phys ca y from the server After you’ve removed the network card, you need to reconfigure your SBS network to the IP address range you’ use for your Internet connect on
118 CHAPTER 7
Migrating to Windows Small Business Server 2011 Standard
Note You can skip this entire section if you’re migrating from SBS 2008 or SBS 2011,
because you’re already configured for a single NIC with appropriate settings.
Real World Address Ranges
B
ecause you’re reconfiguring your network anyway, now is a good time to make a decision about the IP address range you want to use. The default range of many
routers is 192.168.0.xxx or 192.168.1.xxx. The easy answer is to use whatever the default range of your new router/firewall is. We actually don’t much like that solution because it can cause complications down the road if you’re ever in a situation where you need to set up a static VPN to another network that has chosen that range. We
prefer choosing pretty much any of the other possibilities in the private “C-class” range—anywhere from 192.168.2.xxx to 192.168.254.xxx. The default range for SBS 2003 is actually 192.168.16.xxx, and that’s a good choice that doesn’t seem to interfere with any other common ones we’ve seen. On our networks here, we have used 192.168.16.xxx and 192.168.51.xx for our test networks. The one thing you can not do is choose an address range in the 10.xxx.yyy.zzz private “A-class” range—the SBS 2011 wizards will not support that range.
After you’ve dec ded the range for your new SBS network, you can comp ete the reconfigurat on by fo ow ng these steps 1. Shut down the SBS server 2. D sconnect the Internet-fac ng network cab e from the server, open the server enc o-
sure, and remove the network card 3. Turn on the server It w
ke y take onger than usua to restart—be pat ent
4. Log on to the server w th the ma n Adm n strator account 5. In the eft pane of the Server Management conso e, c ck Internet And E-ma to d sp ay
the Manage Internet And E-ma page as shown n F gure 7-4
Preparing Your Server
CHAPTER 7
119
Figure 7-4 The Manage nternet And E Ma page of the SBS Server Management conso e
6. C ck Connect To The Internet to open the CEICW 7. C ck Next to open the Connect on Type page of the CEICW, as shown n F gure 7-5
Figure 7-5 The Connect on Type page of the CE CW
120 CHAPTER 7
Migrating to Windows Small Business Server 2011 Standard
8. Se ect Broadband, and c ck Next to open the Broadband Connect on page, as shown
n F gure 7-6 Se ect A Loca Router Dev ce W th An IP Address from the My Server Uses drop-down st
Figure 7-6 The Broadband Connect on page of the CE CW
9. C ck Next to open the Router Connect on page shown n F gure 7-7 Type n the IP
address you’ be us ng w th your new router/firewa and the IP addresses for your ISP’s DNS servers Note If your router/firewall does DNS forwarding, you can use the IP address of
the router/firewall for the Primary DNS Server address and leave the Secondary DNS Server address blank. If you want to always use root hints for DNS, you can leave both addresses blank.
Preparing Your Server
CHAPTER 7
121
Figure 7-7 The Router Connect on page of the CE CW
10. Se ect the My Server Uses A S ng e Network Connect on For Both Internet Access And
The Loca Network check box 11. C ck Next If the IP address of the router/firewa
s n a d fferent address range from your prev ous nterna address, you’ see the message shown n F gure 7-8
Figure 7-8 The warn ng message generated dur ng network reconf gurat on
12. C ck Yes to open the nformat on message shown n F gure 7-9 Because we’re not con-
nected to anyth ng at th s po nt, c ck No
Figure 7-9 The f rewa
122 CHAPTER 7
nformat ona message of the CE CW
Migrating to Windows Small Business Server 2011 Standard
13. On the Web Serv ces Configurat on page, se ect the serv ces that you want to be ava -
ab e when your ex st ng SBS server s back on ne 14. C ck Next tw ce more, and then c ck F n sh to comp ete the w zard 15. C ck C ose when the CEICW fin shes
If you’ve chosen to use a d fferent IP address range for your SBS network than the one you’re current y configured to use, now s a good t me to change t by fo ow ng these steps 1. On the Manage Internet And E-ma page of the Server Management conso e, c ck
Change Server IP Address to open the Change IP Address Too d a og box shown n F gure 7-10
Figure 7-10 The Change P Address Too
2. Type n the new IP address for the server and c ck OK When the too comp etes, you’
see the message shown n F gure 7-11
Figure 7-11 When you change the server s P address, t offers to run the CE CW aga n
3. C ck No to comp ete the process and c ose the Change IP Address Too d a og box As
shown n F gure 7-12, the IP address has been reconfigured to po nt to the new router/ firewa that we w nsta at 192 168 51 1
Preparing Your Server
CHAPTER 7
123
Figure 7-12 The P address has changed on the server
Note If you have fixed IP devices on your network, you’ll need to manually reconfigure
their default gateway. This won’t matter for devices that don’t need to connect to the Internet, such as printers, but if you have additional servers or workstations that use fixed IP addresses, you should reconfigure them now to point to the new router.
Install Router and Firewall After you’ve reconfigured your ex st ng SBS to use a s ng e network card, you need to reconnect t to the Internet You need to nsert a router nto the network f you don’t a ready have one, and configure t for the network address range that you’ve chosen for your SBS network In many cases, you’ a ready have a router n p ace—we d d But that router s ke y not a fu -fledged firewa Now s the t me to rep ace t or add an add t ona firewa app ance When you do, you’ need to configure the firewa for your SBS network The port’s SBS 2003 uses nc ude ■
25 S mp e Ma Transfer Protoco (SMTP) Used by M crosoft Exchange for ncom ng and outgo ng ema
■
80 Hypertext Transfer Protoco (HTTP) Outbound, th s port s used to surf the web Inbound, t can be used to n t a y connect to the Remote Web Workp ace s te
124 CHAPTER 7
Migrating to Windows Small Business Server 2011 Standard
■
443 Hypertext Transfer Protoco Secure (HTTPS) It’s used outbound for connect ng to secure webs tes and nbound for connect ng to Remote Web Workp ace
■
444 Companyweb Th s port s used to connect to the SharePo nt Companyweb ntranet s te Open th s port on y f your users connect to Companyweb when work ng remote y
■
3389 Remote Desktop Protoco (RDP) Th s port s used on y f you a ow d rect RDP connect ons from remote ocat ons to your SBS server If you do enab e th s for remote management, you shou d m t the IP addresses that are a owed to connect to spec fic, known, IP addresses
■
4125 Remote Web Workp ace (RWW) Th s port s used by RWW for connect ng remote users to the r desktops
Add t ona ports m ght be n use for spec fic app cat ons on your network, but these are the bas c ncom ng ports that are used by SBS After you’ve nsta ed and configured your router, connect t to your SBS network as shown ear er n F gure 7-2 Ver fy that you have connect v ty from the server and from your workstat ons to a known s te If a workstat on doesn’t have connect v ty, reboot and try aga n Ver fy that the DHCP-ass gned IP address s n the correct range
Under The Hood ISA Server
T
he requirements for migrating SBS 2003 Premium Edition networks that are using ISA Server are somewhat different. The basic premise is the same—you
need to reconfigure your network to use a single NIC. But you’ll also need to remove the ISA Firewall Client from computers on your network. Microsoft’s migra-
tion guide says that you can leave ISA in place during the migration as long as you are running at least ISA 2004 SP3, but we think this is a bad idea. You need to install a real firewall on your network to protect it and the new SBS 2011 server, and leaving ISA in place on the source SBS 2003 server just confuses the issue and leaves additional places where there could be problems during the migration. We started to write up a full set of steps for uninstalling ISA and reconfiguring the workstations on your network, but then we found an excellent resource from Kevin Weilbacher, an SBS MVP. He has posted a step-by-step guide to removing ISA 2004 from SBS 2003, and he is actively maintaining it and updating it to cover issues as they’re reported, with input from many of the other SBS MVPs. For full details on how to remove ISA 2004, see http://msmvps.com/blogs/kwsupport/ archive/2008/09/07/uninstalling-isa-2004.aspx.
Preparing Your Server
CHAPTER 7
125
Disable VPNs Before you beg n the m grat on, you need to d sab e v rtua pr vate network ng to the SBS server If you need VPN access, you shou d choose a router/firewa that can act as a VPN endpo nt U t mate y, however, we th nk a better overa so ut on s to use Remote Web Access (RWA) and avo d VPNs whenever poss b e To d sab e VPNs on the ex st ng SBS server, fo ow these steps 1. Log on to the server w th the ma n Adm n strator account 2. Open the Server Management conso e f t doesn’t open automat ca y 3. In the eft pane of the Server Management conso e, c ck Internet And E-ma
The
Manage Internet And E-ma page opens 4. C ck Configure Remote Access to open the Remote Access W zard 5. C ck Next on the We come page to open the Remote Access Method page as shown n
F gure 7-13
Figure 7-13 The Remote Access Method page of the Remote Access W zard
6. Se ect D sab e Remote Access, c ck Next, and then c ck F n sh 7. When the w zard comp etes, c ck C ose to return to the Server Management conso e
Th s comp etes the network reconfigurat on for your SBS m grat on Now s a good t me to ver fy that a the computers and dev ces on your network are work ng as you’d expect and can connect proper y Pay part cu ar attent on to dev ces such as pr nters, w re ess access po nts, and web cams that have a fixed or DHCP reservat on address to make sure that they are commun cat ng correct y w th the rest of the network
126 CHAPTER 7
Migrating to Windows Small Business Server 2011 Standard
Configuring Active Directory Before you can comp ete the m grat on to SBS 2011, you need to ra se the doma n and forest funct ona eve s of your current SBS 2003 Act ve D rectory The m grat on requ res that the Act ve D rectory forest and doma n funct ona eve be W ndows Server 2003 The defau t for SBS 2003 s the M crosoft W ndows 2000 funct ona eve You can’t move to a W ndows Server 2003 funct ona eve f there are any W ndows 2000 or ear er doma n contro ers n your SBS doma n If there are, you must first demote them from be ng doma n contro ers For W ndows 2000, run Dcpromo exe as a doma n adm n strator to demote the egacy W ndows 2000 doma n contro er If you st have W ndows NT 4 doma n contro ers n your network, you’ need to rebu d these servers as non–doma n contro ers or remove them from the network ent re y G ven that W ndows NT 4 s no onger supported by M crosoft and won’t get any updates or secur ty patches, you need to remove any rema n ng W ndows NT 4 computers To ra se the doma n and forest funct ona eve of your SBS 2003 Act ve D rectory, fo ow these steps 1. Log on to the SBS 2003 server w th an account that has both Doma n Adm ns and
Enterpr se Adm ns pr v eges The Adm n strator account s a good cho ce for th s 2. C ck Start, then c ck Adm n strat ve Too s, and then c ck Act ve D rectory Doma ns
And Trusts to open the Act ve D rectory Doma ns And Trusts conso e shown n F gure 7-14, or you can type doma n msc at the Run menu
Figure 7-14 The Act ve D rectory Doma ns And Trusts conso e
Note Raising the domain functional level is an irreversible change. You can’t later
lower the functional level.
Preparing Your Server
CHAPTER 7
127
3. C ck the doma n (examp e oca n F gure 7-14), and se ect Ra se Doma n Funct ona
Leve from the Act on menu to open the d a og box shown n F gure 7-15
Figure 7-15 The Ra se Doma n Funct ona Leve d a og box
4. Se ect W ndows Server 2003 from the drop-down st (th s shou d be the on y cho ce n
most SBS networks) and then c ck Ra se to ra se the doma n funct ona eve Note If the Current Domain Functional Level is shown as Windows Server 2003, you
won’t be able to change the functional level.
5. C ck OK at the warn ng that th s change can’t be reversed, and c ck OK aga n at the
success message 6. C ck Act ve D rectory Doma ns And Trusts n the eft pane at the top of the tree 7. C ck Ra se Forest Funct ona Leve on the act on menu to open the Ra se Forest Func-
t ona Leve d a og box shown n F gure 7-16 Note Raising the forest functional level is an irreversible change. You can’t later lower
the functional level.
128 CHAPTER 7
Migrating to Windows Small Business Server 2011 Standard
Figure 7-16 The Ra se Forest Funct ona Leve d a og box
8. C ck Ra se You’ see the warn ng message that th s change s rrevers b e as shown n
F gure 7-17
Figure 7-17 Ra s ng the forest funct ona eve s rrevers b e
9. C ck OK If the ra se was successfu , you’ see the nformat ona message n F gure 7-18
Figure 7-18 The Ra se Forest Funct ona Leve success nformat ona message
10. C ck OK to c ose the message, and then c ose the Act ve D rectory Doma ns And Trusts
d a og box
Preparing Your Server
CHAPTER 7
129
Best Practices Analyzer The Best Pract ces Ana yzer (BPA) s a usefu too to run aga nst your SBS server regard ess of whether you’re p ann ng on m grat ng to SBS 2011 mmed ate y or ater on The BPA can dent fy a k nds of prob ems n an SBS env ronment w th over 200 errors, warn ngs, and nformat ona messages about the hea th of your SBS network You can down oad the BPA from http://go.microsoft.com/fwlink/?LinkId=113752 and then nsta t on your SBS 2003 server The Know edge Base art c e for the BPA s 940439 After you’ve down oaded the BPA, execute the SBS2003SP1-KB940439-x86-enu exe fi e to nsta t (The actua fi e name var es depend ng on the anguage ) You can then run the BPA us ng the fo ow ng steps 1. C ck Start, c ck A Programs, and se ect SBS Best Pract ces Ana yzer Too 2. The first t me you run the BPA, you’ be asked f you want to check for new vers ons
every t me you start t, and you’ be offered an opportun ty to check now C ck Yes to rece ve automat c updates, and choose to check now—even w th a fresh down oad, we st got a newer vers on after the check 3. From the We come screen shown n F gure 7-19, you can se ect the opt ons to use for a
scan or v ew a prev ous scan
Figure 7-19 The We come screen of the SBS Best Pract ces Ana yzer
4. C ck Se ect Opt ons For A New Scan to open the Start A Scan page shown n F gure
7-20
130 CHAPTER 7
Migrating to Windows Small Business Server 2011 Standard
Figure 7-20 The Start A Scan page of the SBS BPA
5. Type n a abe for the scan, and c ck Start Scann ng When the scan comp etes, you’
see a summary of the resu ts as shown n F gure 7-21
Figure 7-21 The Scann ng Comp eted summary page of the SBS BPA
Preparing Your Server
CHAPTER 7
131
6. To v ew the resu ts of the scan, c ck V ew A Report Of Th s Best Pract ces Scan A typ -
ca report s shown n F gure 7-22
Figure 7-22 A typ ca report from an SBS BPA scan
7. C ck any sted ssue to see more deta s on the ssue, nc ud ng nks to Know edge
Base art c es on how to correct the ssue The deta screen for the Rece ve S de Sca ng ssue shown n F gure 7-22 s shown n F gure 7-23
132 CHAPTER 7
Migrating to Windows Small Business Server 2011 Standard
Figure 7-23 The Rece ve S de Sca ng ssue deta s from the SBS BPA
8. After you’ve corrected the ssues that cou d prevent a successfu m grat on, run the
BPA aga n by repeat ng steps 4 through 7 to ver fy that a the prob ems are corrected At a m n mum, you shou d correct a cr t ca ssues, and you shou d carefu y eva uate the ssues sted on the A Issues tab and correct any that are poss b e prob ems for your m grat on Important Do not proceed with your migration until all critical issues identified
by the BPA have been resolved. Seriously. The migration will fail if you do. You should also carefully evaluate any additional issues shown on the All Issues tab and resolve as many as possible.
Optimize Exchange Mailboxes You shou d have your users opt m ze the r M crosoft Exchange ma boxes to reduce the t me t takes to m grate them to Exchange 2010 If you’ve been enforc ng str ct ma box m ts, th s ke y sn’t a major ssue However, f you’ve got a coup e of users who are spec a and have ser ous y arge ma boxes, now s a good t me to try to get th s under contro Anyth ng that removes excess ma from the ma boxes s a good th ng, but the most obv ous steps are ■
Ask a users to empty the r De eted Items fo ders
■
Ask a users to empty the r Junk E-ma fo ders
Preparing Your Server
CHAPTER 7
133
■
Ask a users to arch ve a ma
tems o der than some reasonab e date
■
Carefu y nspect Pub c Fo ders, and remove or arch ve any out-of-date or unused contents to reduce the overa s ze of the Pub c Fo der database
■
Make a separate arch ve (PST) of a act ve Pub c Fo ders as a backup
When users have had a reasonab e amount of t me to c ean up the r ma boxes, t’s usua y usefu to exam ne the ma box store n Exchange to see whether any outstand ng y arge ma boxes rema n Th s a ows you to have a more d rect d scuss on w th the owner of the ma box to he p reduce ts s ze You can check the s ze of ma boxes by open ng the Exchange System Manager and nav gat ng to Servers, then servername, then F rst Storage Group, then Ma box Store, and then Ma boxes, as shown n F gure 7-24
Figure 7-24 A very empty M crosoft Exchange Ma box store
Note The mailboxes listed in Figure 7-24 are not typical of a working system but reflect
what you would see on a brand-new system.
Running the Migration Preparation Tool There are severa tasks that need to be done on a SBS 2003 networks to prepare for the actua m grat on, nc ud ng the fo ow ng ■
Upgrade the Act ve D rectory schema
■
Set the M crosoft Exchange Server mode
■
Extend the t me that two SBS servers can coex st n the same network
To make fe eas er, these tasks are automated w th the M grat on Preparat on Too
134 CHAPTER 7
Migrating to Windows Small Business Server 2011 Standard
There’s one other task we’ cover n th s sect on—synchron z ng the t me source On most SBS networks, th s shou d a ready be OK, but t’s cr t ca for the proper m grat on to the new SBS 2011 server, so make sure t’s correct and synched to an externa source Important The changes made by the Migration Preparation Tool are irreversible. You
should ensure that you have a fully tested backup of your existing SBS 2003 server before running the Migration Preparation Tool. The only way to return to your original configuration is to restore your backup.
Before you start the m grat on, you need to upgrade the Act ve D rectory schema to a gn w th the schema used by SBS 2011 To upgrade the schema, you must be ogged on to the exst ng SBS server w th an account that s a member of the Doma n Adm ns, Enterpr se Adm ns, and Schema Adm ns groups The defau t Adm n strator account s n a three groups To ver fy that the account you are us ng s n the necessary groups, open Act ve D rectory Users And Computers and doub e-c ck the account you are us ng C ck the Member Of tab to see a st of groups the account be ongs to, as shown n F gure 7-25
Figure 7-25 The Member Of tab of the Adm n strator account propert es
To run the M grat on Preparat on Too , use the fo ow ng steps 1. Log on to your source server w th an account that has Doma n Adm ns, Enterpr se
Adm ns, and Schema Adm ns pr v eges 2. Insert the first SBS 2011 DVD nto the DVD dr ve of the source server If you have auto-
run enab ed on the source server, you’ see the screen shown n F gure 7-26
Preparing Your Server
CHAPTER 7
135
Figure 7-26 The Autorun screen for W ndows Sma Bus ness Server 2011 Standard when run on
SBS 2003
Note If you don’t have a DVD drive on your existing SBS server, insert the DVD in a
client workstation and copy the entire tools directory to a location on the server and run SourceTool from there.
3. C ck Insta The M grat on Preparat on Too 4. Acknow edge the End-User L cense Agreement (EULA), and c ck Insta and then F n sh
(Leave the Run The M grat on Preparat on Too opt on se ected ) 5. On the Get Important Updates screen, choose e ther Down oad And Insta Updates
(Recommended) or Do Not Down oad Updates Persona y, we avo d down oad ng any add t ona updates at th s po nt, though the offic a M crosoft recommendat on s to a ways down oad updates 6. On the Prepare Your Source Server For M grat on page, se ect the I Have A Backup And
Am Ready To Proceed check box and then c ck Next The too w start updat ng your schema, extend ng your coex stence t me, and configur ng Exchange Server as shown n F gure 7-27 The process takes severa m nutes, so just be pat ent The argest chunk of t me s for the schema upgrade
136 CHAPTER 7
Migrating to Windows Small Business Server 2011 Standard
Figure 7-27 The M grat on Preparat on Too s prepar ng the source server for m grat on
7. When the too comp etes ts tasks, c ck Next and the source server w
be scanned for any add t ona prob ems If any are dent fied, as shown n F gure 7-28, correct them before cont nu ng
Figure 7-28 The M grat on Preparat on Too found an ssue that must be corrected before
cont nu ng
Preparing Your Server
CHAPTER 7
137
8. Rev ew the M grat on Gu de, se ect the check box for t, and then c ck Create An
Answer F e See the steps under Creat ng A M grat on Answer F e, ater n th s chapter After you’ve fin shed creat ng t and stor ng t on the USB or other med a you’ use, c ck F n sh to c ose the W ndows Sma Bus ness Server 2011 Standard M grat on Preparat on Too 9. When you ex t the M grat on Preparat on Too , you’ be prompted to reboot You
shou d reboot your server before go ng any further After you reboot, you need to make sure your ex st ng SBS 2003 server s correct y synchron zed w th an externa t me source To set the t me synchron zat on on your SBS server, use the fo ow ng steps 1. Log on to your ex st ng SBS server w th an account that has Doma n Adm ns pr v eges 2. Open a command w ndow (cmd exe) Type the fo ow ng commands n the w ndow, as
shown n F gure 7-29 w32tm /config /syncfromflags:domhier /reliable:no /update net stop w32time net start w32time
Figure 7-29 Conf gur ng W ndows T me synchron zat on
3. C ose the command w ndow Important If you are running SBS 2003 and SBS 2011 in virtual machines on a Hyper-V
server, the parent partition must have the same time zone, date, and time as the child
