Professional Windows Server 1002003 Security A Technical Reference [Electronic resources] نسخه متنی

Install from Product CD

To install or upgrade directly using the WS2003 product CD, first
start the Setup program by one of these methods:

• Boot the system directly from the product CD if your CD-ROM drive
  supports this method.

• Start Run D:\Setup.exe
  to start Setup where

  D : is your CD-ROM drive.

• Type D:\I386\Winnt.exe at the command prompt
  to install or upgrade systems running MS-DOS or 16-bit Windows.

• Type D:\I386\Winnt32.exe at
  the command prompt to install or upgrade systems running 32-bit
  Windows.

The advantage of the last two methods is that there are a number of
command-line switches that can be used to customize Setup in various
ways, as shown in Tables 4-26 and 4-27.

After Setup copies a minimal version of WS2003 into memory, the text
mode (blue screen) portion of Setup commences. Here, you specify:

• The partition on which WS2003 will be installed (typically,
  

  C :)

• The filesystem with which the partition should be formatted
  (typically, NTFS)

• The directory where the operating-system files will be installed
  (typically,

  C:\Windows )

You can also press F8 at the appropriate point to load device drivers
for SCSI or RAID drives if these are needed.

When the text mode portion of Setup is completed, operating-system
files are copied from the CD to your hard disk, after which your
machine reboots and the GUI mode portion of Setup (the Setup Wizard)
then commences. First, you specify the following general information:

• Regional settings for your geographical location

• Your name and organization

• The licensing mode you have chosen

• The name of your computer

• A password for the local Administrator account

• Any optional WS2003 components you may want to install

• The date and time

Note that if you plan to promote your server to a domain controller, it is important that you set the correct date and time and that these settings agree for all domain controllers on your network. This is because the date and time settings are used for timestamping directory-replication messages for Active Directory. If these settings are wrong, then replication errors may occur, potentially corrupting the directory and leading to serious problems.

Next,
the Setup Wizard guides you through configuring different networking
components for your machine. At this stage:

• Network adapters are detected and
  configured.

• Networking components
  are installed. In a Typical installation, the following components
  are installed by default:

• Client
  for Microsoft Networks

• File and
  Print Sharing for Microsoft Networks

• TCP/IP protocol

• An IP
  address is obtained from a DHCP server if one is available on the
  network (or you can manually specify an IP address, subnet mask, and
  default gateway for your machine).

• You are prompted to join either a workgroup or a domain.

Finally, the various WS2003
networking and optional components you have specified are now
installed, the configuration settings you specified are applied,
temporary files created during Setup are deleted, and the computer reboots
one final time to finish Setup.

Install from Network Distribution Point

To install or upgrade
WS2003 over the network from a
distribution server, start Setup by using your network-client
software to connect to the shared folder on your distribution server.
This shared folder contains the WS2003 source filesthat is,
the contents of the

\I386 folder on the WS2003
product CD. For example, if your target machine is already running NT
4.0 or Windows 95/98, you can simply browse Network Neighborhood to
locate the shared folder on your distribution server and then
double-click on the file

Winnt32.exe to run the
Setup program, or you can type
D:\I386\winnt32.exe from the command prompt.
The Setup program first copies the needed

\I386
files from the distribution server to a temporary folder called

$Winnt$.~ls on your computer. After the files
are copied, the machine reboots and the text mode portion of Setup
begins. From here on, you use the same steps as you would when
installing from a CD.

Unattended Install

To install or upgrade

using the unattended installation
method, first use Setup Manager to create an answer file. You can
find Setup Manager (

Setupmgr.exe ) on your
product CD in

\SUPPORT\TOOLS\Deploy.cab ; just
start it and follow the wizard to specify how your answer file should
respond to prompts during Setup. There are several dozen steps to
follow in the wizard, depending on the choices you make along the
way. By default, the resulting answer file is called

unattend.txt , and it is saved in the folder
where

Setupmgr.exe is located. Setup Manager
also creates a batch file,

unattend.bat , in the
same directory. This batch file demonstrates the use of the
/u switch with

Winnt.exe and
the /unattend switch with

Winnt32.exe for performing automated
installations. You can then customize this batch file for use in your
WS2003 deployment. Finally, if you specified more than one computer
name using the wizard, Setup Manager generates the necessary UDB
files and saves them in the same directory. Note that Setup Manager
is a powerful tool that can be used for much more than just preparing
for automated installations using answer files. For more information
on how to use it, double-click on

deptool.chm in
your

C:\SUPPORT\TOOLS folder.

Then use the answer file and the installation files (either on the
product CD or on a distribution server) to perform an unattended
installation of WS2003. On MS-DOS or Windows for Workgroups machines,
open a command prompt and type:

winnt /u:answerfile
/s:sourcepath
/t:targetdrive

On Windows 95, 98, Me, NT, or 2000 machines, use:

winnt32 /unattend:answerfile
/s:sourcepath
{/syspart:targetdrive
} 
    {/tempdrive:targetdrive
}

You can also use Setup Manager to create a winnt.sif file as your answer file. Copy the winnt.sif file to a floppy disk, insert the WS2003 CD, and power on the system. Immediately after the system starts to boot off the CD, you can insert the floppy and perform an unattended installation.

Disk Imaging

The following steps are
involved in deploying WS2003
using disk-imaging software. However, since WS2003
doesn't include disk-imaging software, you must
purchase a third-party disk-imaging product to perform the
deployment. As a result, the steps may differ depending on the
instructions included with the software you purchase.

1. Install the System Preparation Tool
   (

   Sysprep.exe ) from the WS2003 Resource Kit or
   from the

   \SUPPORT\TOOLS folder on the WS2003 CD.

2. Install and configure WS2003 on the computer whose configuration you
   will use to clone a master disk image. Typically, you do this on a
   test computer, not a production server. Also, install any
   applications you want on your servers, but make sure that your
   disk-imaging tool supports cloning of these applications. (There can
   be problems cloning some applications that use security identifiers
   [SIDs] or some similar security mechanism to ensure the uniqueness on
   the network of their associated services.)

3. Run

   Sysprep.exe on your master computer. This
   utility prepares the hard disk on the master computer for cloning by
   deleting the SIDs and any other user- or computer-specific
   information from the machine.

4. If you want to perform unattended installations using disk imaging,
   you can run Setup to create a

   Sysprep.inf file,
   which is the equivalent of an answer file for performing automated
   installations using disk imaging (optional). Start the Setup Manager
   Wizard and proceed as follows:

   Create an answer file Sysprep Install WS2003
   Yes, fully automate the installation specify
   answers for various prompts displayed during Setup

   The result of running the wizard is the creation of the file
   

   Sysprep.inf , which is used by the disk-imaging
   software to control the installation steps.
   

   Sysprep.inf is saved by default in a new
   directory called

   \Sysprep , which also contains
   the

   Sysprep.exe utility, a batch file, and other
   files and folders used in disk-imaging installations.

5. Now reboot your master computer and run your third-party disk-imaging
   software on the computer to create a master disk image. Save the disk
   image you create in a shared folder on a file server to prepare for
   network installation using disk imaging. You can also save the image
   on a CD if you want to be able to archive images more easily.

6. Finally, copy the image from the share point on the file server to
   the target computers that you want to clone the image to, and restart
   these computers to start the cloning process. This step may vary
   depending on the disk-imaging software being used.
   

   Sysprep is used during cloning to create new
   unique SIDs for each target computer the image is cloned onto.
   Sysprep also creates a "mini-Setup"
   program for the target computer, which runs the first time the target
   computer is booted. The mini-Setup takes only about 5 minutes instead
   of the 45 to 60 minutes of regular Setup, and the only prompts are
   for accepting the EULA, specifying the user and company, specifying
   the workgroup or domain, specifying regional settings and TAPI
   location, and specifying networking protocols and services to be
   used. (But if you are using a

   Sysprep.inf file,
   then this mini-Setup is bypassed entirely.) Once installation is
   complete, the

   \Sysprep folder is typically
   deleted from the target computers.

For more information on using

Sysprep ,
double-click on the

deptool.chm file in your

C:\SUPPORT\TOOLS folder, or see the

Windows Server 2003 Resource Kit .

Upgrade from NT

The Setup procedure is
almost the same as for performing a fresh
installation of WS2003, as described earlier in this topic.

Upgrade a Standalone Server

There are no special issues involved here.

Upgrade a Member Server

There are no special issues involved here.

Upgrade a Domain Controller

The Setup Wizard prompts you for whether you want to create:

• A new domain or a child domain of an existing domain. Choose New
  Domain for your first primary domain controller (PDC) since a PDC
  actually defines a domain. For the other PDCs, the choice you make
  depends on the domain model you want to create.

• A new forest or a domain tree within an existing forest. Choose New
  Forest for your first PDC. For the other PDCs, the choice you make
  depends on the domain model you want to create.

Setup prompts you for where you want to locate your

SYSVOL directory and your Active Directory data
and log file (must be an NTFS partition). Make sure you choose a
partition with enough free spacewhen the SAM database on an NT
domain controller is upgraded to Active Directory, it may occupy as
much as 10 times the disk space as the original SAM database.

For backward-compatibility reasons, upgraded domain controllers are
in WS2003 interim domain functional level by default. This means
that:

• WS2003 member servers and XP desktop machines see the upgraded domain
  controller as a WS2003 domain controller.

• NT servers and workstations see it as an NT PDC.

Install Optional Windows Components

Control Panel Add or Remove Programs Add/Remove Windows Components select category Details select components

Categories that have
grayed-out checkboxes have some but
not all components already installed.

Install Third-Party Applications

Control Panel Add or Remove Programs Add New Programs {CD or Floppy | Windows Update}

Check Windows Update
for the latest enhancements and
fixes for your server. You can also use the new Automatic Updates
feature to download and install updates automatically; see

Automatic Updates earlier in this chapter.

Run the Program Compatibility Wizard

Start All Programs Accessories Program Compatibility Wizard select program select a compatibility mode for testing purposes select display settings for testing select
user account privileges test settings try another mode if required send results of test to Microsoft

Manually Configure Compatibility Settings

Right-click on application or shortcut Properties Compatibility select mode select display settings select user account privileges