Professional Windows Server 1002003 Security A Technical Reference [Electronic resources] نسخه متنی

This topic describes concepts and procedures for installing and
upgrading to WS2003, installing optional Windows components, and
installing third-party applications. Windows Product Activation and
Windows Program Compatibility Mode are also covered.

Install Windows Server 2003

The way you deploy WS2003 depends on several factors:

Scope of deployment

It's one thing to upgrade


two or three servers from NT
or W2K to WS2003 in a small company; it's another
thing entirely when you have to upgrade thousands of servers across
multiple locations in a large enterprise. In the first scenario, you
would probably run Setup directly from the product CD, but when the
number of servers exceeds about a dozen, automated installations
become a more practical solution.

Hardware homogeneity

With large numbers of

servers having identical
hardware configurations, disk imaging is a simple and efficient way
of installing or upgrading them. If servers are from a multitude of
different vendors and have customized hardware configurations, disk
imaging is probably not much of a time-saver.

Staff availability

If only a few staff members
are performing the
deployment, you need to consider some form of automated installation
either using answer files and UDB files or using disk imaging. If the
server-to-staff ratio is small, however, it may not be cost-effective
to spend the time learning how to perform these types of
installations. It may simply be better to install or upgrade from the
CD or from a network distribution server.

Installation Methods

The standard deployment methods for installing or upgrading to WS2003
include the following:

Product CD

Here,

Setup.exe is

run directly from the WS2003 CD to
install or upgrade the system. You typically use this method when you
have only a few servers to deploy in your network. You are limited
mainly by the number of CDs you have and the number of staff members
who are available to respond to the prompts as Setup is run.

Distribution point

Setup can also be run over the network by copying the WS2003
installation files to a folder on a file server and sharing the
folder. File servers that share the WS2003 installation files are
called distribution servers, and a shared folder containing the
installation files is called a distribution point. The machines to be
installed or upgraded then connect to the distribution point to start
Setup, either by creating a network boot disk (see http://www.bootdisk.com) or by mapping a
drive to the share. This method can be used to simultaneously deploy
dozens or even hundreds of servers. You are limited mainly by the
speed of the distribution servers, the network bandwidth available,
and the number of staff members available to respond to the prompts
as Setup is run.

It's not a good idea simply to insert the WS2003 CD into a machine and share it for network installation. The read-access time of a CD-ROM is much slower than that of the typical hard drive. So while it might take a bit longer than usual to perform a network installation of 10 servers from a shared folder, it will take forever to do the same from a shared CD-ROM!

Unattended installation

Using a tool called

Setup Manager
(

Setupmgr.exe ) that's included
in

\SUPPORT\TOOLS\DEPLOY.CAB on your product CD,
you can create answer files and UDB files for performing unattended
installations either over the network or from the product CD. An
answer file is a specially formatted text file that answers some or
all of the prompts during installation. This allows installations and
upgrades to be performed without any user interaction other than
starting the Setup process. A uniqueness database file, or UDB file,
is a specially formatted text file that supplements or overrides some
of the information in the answer file. While the answer file provides
responses to general prompts, such as which optional components to
install or which domain to join, UDB files are typically used to
provide system-specific information, such as the names of computers
or their IP addresses if DHCP is not being used. You would typically
have one answer file for a group of servers in the same department or
with the same function, and each installation or upgrade of a server
would require its own UDB file. Setup Manager can also be used to
create a distribution point for unattended network installs and to
create

Sysprep.inf files for unattended installs
using disk imaging.

Disk imaging

Disk imaging (also called disk duplication or disk cloning) is the
process of making an exact bit image of a hard
drive. You first create a
master image of the system/boot disk of a template WS2003 system and
then copy or clone this image to other systems. This can be a very
efficient method for deploying a large number of new installations of
WS2003, but only when the systems you are deploying have identical or
very similar hardware configurations. One of the great advantages of
disk imaging is that you can use it to install not just a bare-bones
version of WS2003 but also a fully loaded server with numerous
preinstalled applications. WS2003 includes a utility called the
System Preparation Tool (

Sysprep.exe ), which can
be used to prepare a system for cloning by ensuring that the cloned
systems will have their own unique SIDs.

Sysprep
works by deleting the SIDS on your existing system, which generates
unique SIDs on the target systems when they are restarted after the
image has been cloned to them. WS2003 doesn't itself
include disk-imaging software, so

Sysprep must
be used in conjunection with third-party disk-cloning software.

WinPE

The Windows
Preinstallation
Environment (WinPE) is a tool available to original equipment
manufacturers (OEMs) that can be used to create bootable ISO images
of customized WS2003 configurations for rapid, mass deployment of
identical systems. If you are a large enterprise customer, you may be
able to obtain WinPE from Microsoft and use it instead of disk
imaging for mass deployments.

Before Installation

You need to consider some things and make some decisions prior to
installing or upgrading a system to WS2003:

Read the release notes

Make sure you read

Relnotes ,

Readme1st.txt , and any other last-minute
documentation on the product CD concerning installation issues.

Hardware compatibility

You must ensure that

all your hardware is fully
supported by WS2003. The quickest way to do this is to use the Check
System Compatibility feature of Setup, which can be started from the
product CD menu. You can also consult the WS2003 Hardware
Compatibility List (HCL), which lists devices whose drivers have been
tested for and comply with WS2003. Microsoft supports only hardware
that is listed on the HCL, so be sure to comply with this list if you
want to be eligible for Microsoft's technical
support. The HCL can be found on Microsoft's web
site at http://www.microsoft.com/hwtest/hcl/.

Hardware requirements

You must also meet
the minimum hardware requirements
for installing WS2003, though experience says you should go well
beyond the recommended hardware requirements if you want satisfactory
performance. Table 4-22 lists the minimum hardware
requirements for different editions of WS2003, while Table 4-23 shows recommended hardware. Table 4-24 displays the maximum RAM and supported number
of processors for each edition.

Disk partitioning

Although a 2.5-GB partition


will suffice for installing WS2003, use at
least a 4-GB partition to leave room for additional WS2003 components
you may want to install later. You can create and delete partitions
during the text-based initial portion of Setup, but Microsoft
recommends that you use Setup only to create the partition on which
you plan to install WS2003 and then use the Disk Management console
after the installation is complete to create and format other
partitions. Besides speeding up Setup, using Disk Management gives
you the option of converting your disk subsystem to dynamic storage
so you can create extended and fault-tolerant volumes.

Filesystem

During the text-based

portion of Setup, you can specify which
filesystem formats the partition on which you install WS2003. You can
choose between FAT, FAT32, and NTFS, but the logical choice is NTFS.
NTFS provides additional security and manageability through NTFS file
and folder permissions, EFS encryption, disk compression, and disk
quotas. The only reason you might want to choose FAT or FAT32 is if
you want to be able to dual-boot your system, but this is a highly
unlikely choice with a production server.

Licensing mode

Decisions about how you
want to license your server
must be made prior to installation. The three aspects of WS2003
Licensing are:

• One server license is required to license your right to install and
  run WS2003 on the computer.

• Multiple client-access licenses (CALs) are required to license client
  computers with the right to connect to your server and access its
  services. (In addition to determining the number of CALs you require,
  you also need to decide whether you will license these CALs in a
  per-server or per-seat mode.)

• Additional licenses may be required if you have other Microsoft
  applications installed and running on your server.

Security model

You need to decide
whether your server will be installed as
a standalone server that is part of a workgroup or as a member server
belonging to a domain. If you plan to join the computer to a domain
during Setup, then you will need:

• The name of the domain you plan to join (e.g.,
  

  mtit.com ).

• A computer account to be created for your computer in the domain you
  plan to join. This can be done by creating the computer account ahead
  of time using Active Directory Users and Computers, or you can create
  the computer account during Setup, provided you have the credentials
  of an administrator in the domain (member of the Domain Admins group
  for the domain).

• An available domain controller and DNS server for the domain.

Dynamic Update

If your system is
connected to the Internet
during Setup, you can use the new Dynamic Update feature of WS2003 to
automatically download the latest Setup files and device drivers
during installation.

Other system preparation issues

If any existing partitions from a previous operating system have been
compressed with DriveSpace or DoubleSpace, make sure you uncompress
them. If you have a mirror set from a previous operating system,
break the mirror prior to upgrading, then recreate the mirror set
after the upgrade is complete. Finally, if you are using a UPS,
disconnect it before installing WS2003 on a machine.

After Installation

After installation is complete, you can log on to your standalone
server (if the server belongs to a workgroup) or member server (if
the server belongs to a domain) and perform various postinstallation
tasks.

Windows Product Activation

You
must
activate your software after installing it. Windows Product
Activation (WPA) is a process that links your product key with your
hardware configuration and is used by Microsoft to discourage
software piracy. Activation can be performed over the Internet or
using the telephone, and no personal information is
collectedin fact, the hardware information itself is hashed so
that Microsoft doesn't even know what hardware you
are using. If you don't activate Windows in the
required grace period (30 days), you will be unable to log on to your
system, so make sure you use WPA the first time you log on to your
new system. Note that customers with enterprise volume licensing
agreements don't have to activate their systems.

Verify Installation

You should check
to
see if everything went well during Setup:

• Check Event Viewer to see if there are any error or warning messages
  associated with the installation process. Also, configure your event
  log settings as desired.

• Use Services in Computer Management to check that all services set to
  Automatic have started successfully.

• Use Device Manager in Computer Management to ensure that your
  hardware devices have been detected properly and assigned appropriate
  resource settings.

• Verify your IP address, DNS, and WINS settings by typing
  ipconfig /all at the
  command prompt. Also, try connecting to a shared folder on the
  network to see if your network connection is working properly.

Additional Configuration

Additional configuration steps you may want to perform immediately
include:

• Use Display in the Control Panel to configure your display for at
  least 800 x 600 screen resolution.

• Use Power Options in the Control Panel to configure your ACPI power
  scheme. Servers should generally have their hard drives configured
  

  not to power down during idle times.

• Use System in the Control Panel to configure your Startup and
  Recovery settings as desired.

Add Roles

When you first log on to your newly installed or upgraded system, the
Manage Your Server Wizard runs, prompting you to add roles to your
server. Supported roles include domain controller, file server, print
server, application server, and so on.

Upgrade to WS2003

Upgrading W2K servers to WS2003 is basically trivial, so this section
focuses mainly on upgrading NT servers.

Upgrade Versus Install

Installing means putting

WS2003 on a newly formatted
partition or putting it on a partition having another operating
system to create a multiboot machine. Upgrading means replacing an
earlier operating system with WS2003. Installing means that you have
to specify all of the user- and computer-specific settings for your
machine, either by answering prompts during Setup or by using answer
files to perform automated installations. Upgrading means that the
existing user- and computer-specific settings from the previous
operating system are carried over as much as possible to WS2003.
Upgrading also means that your existing applications
don't need to be reinstalled and reconfigured,
provided, of course, that these applications are fully compatible
with WS2003.

Upgrade Paths

The supported upgrade paths
for
Standard and Enterprise Editions of WS2003 are shown in Table 4-25. Note also that:

• You can upgrade Standard Edition to Enterprise Edition.

• You can't upgrade any platform to Web Edition.

• If you want to upgrade to Datacenter Edition, you should contact your
  OEM.

Upgrade Process

When upgrading
an
NT Server-based network to WS2003, you have a choice of which servers
to upgrade first:

Upgrade member servers first

This approach provides your network with many of the advantages of
WS2003, including new management tools, group policies, support for
USB and Plug and Play hardware, an updated version of NTFS with
support for encryption and disk quotas, new services, better printing
support, and so on. Without Active Directory, however, you must
maintain your old NT Server domains until you upgrade your domain
controllers. Nevertheless, you may want to choose this method since
it gives you many of the advantages of WS2003 while allowing you to
buy time to learn the complexity of Active Directory.

Upgrade domain controllers first

This approach immediately provides you with all of the WS2003
features described earlier, plus the power and scalability of having
Active Directory on your network. The downside is that you really
have to know how Active Directory works before you start implementing
it since you don't want to create a directory
structure only to have to tear it down and rebuild it later.

The key thing, of course, with upgrading your servers is always to
make a full backup of your system before you upgrade. Apart from
that, the methods and approaches for upgrading to WS2003 are
identical to those for performing clean installs, as discussed
previously in this chapter.

Install Optional Windows Components

After installing WS2003
and adding roles to your server,
you can install optional Windows components using Add or Remove
Programs in the Control Panel. The additional components you have
vary a bit with the OS edition, but generally include:

Accessories and Utilities

Certificate Services

Fax Services

Indexing Service

Internet Explorer

Internet Information Services (IIS)

Management and Monitoring Tools

Message Queuing

Networking Services

Other Network File and Print Services

POP3 Service

Remote Installation Services

Remote Storage

Terminal Server

Terminal Server Licensing

UDDI Services

Update Root Certificates

Windows Media Services

Install Third-Party Applications

You can also use Add or

Remove Programs to install
third-party applications on your server from floppy, CD-ROM, DVD-ROM,
or software distribution points on your network.
It's best to make sure that your third-party
applications are compatible with WS2003 before installing them.
Programs that are fully compatible with WS2003 are certified as such
through Microsoft's Certified for Windows (CfW)
program. See Veritest's web site at cert.veritest.com/CfWreports/server/ for a
searchable database of CfW products.

Program Compatibility Mode

If you're upgrading instead of installing, you
probably have legacy applications on your server that were designed
for W2K, NT, or even Windows 95/98/Me. In this case, you can use a
new feature of WS2003 called Program Compatibility Mode to configure
these applications to run as well as possible on the new platform.
What you can do is first test your applications to see if they run
properly after the OS is upgraded, and if
"issues" appear, try running them
under one of the following compatibility modes:

Windows 95

Windows 98/Me

NT 4.0 with Service Pack 5

W2K

You can also configure the display settings to ensure compatibility
as follows:

Run in 256 colors

Run in 64 x 480 screen resolution

Disable themes

The easiest way to test your programs is to run the Program
Compatibility Wizard. Alternatively, you can manually try different
compatibility settings to see the result. If your application still
doesn't run well after this, you can visit the
vendor's web site to see if there is a patch or
update for the program to make it work under WS2003. You can also
visit the Windows Update web site to ensure your system files and
drivers are fully up to date, as driver problems may be affecting
your third-party programs.