Rules To Better Windows Servers

Hold on a second! How would you like to view this content?
Just the title! A brief blurb! Gimme everything!
  1. Do you use Group Policy to manage your Windows Update Policy?

    We all know it’s important to keep our servers updated. Unfortunately though, by default, Windows will automatically download and install all new Windows Updates on your servers. This will mean the servers will occasionally restart to install updates when you don’t want them too. You will also get annoying popups trying to get you to restart the computer.
    Note: This rule applied to both client PCs and servers.

    It is also one more reason developers don’t like to join a company domain on their personal laptops!

    Bad Example - Windows 10 shows a ‘Restart now’ – do not accidentally press it! Your production server and your users won't be happy!
    Accidently press Restart Now on a Production server and your users won't be happy!
    Bad example – Remember this nasty one from Vista days?

    Note: Server patching is also achievable via SCCM and you get more control over restarting windows like this. WSUS can also be used in conjunction with group policies to handle restart times better.

    The best ensure you are still downloading updates but not installing them automatically is to use Group Policy.

    1. Create an Organization Unit (OU) in Active Directory, and put all your Production Servers in the OU
      Add all your Production Servers to the Production Server OU
      Add all your Production Servers to the Production Server OU
    2. Create a new Group Policy object and link it to the Production Server OU
      Create a new Group Policy for your Production Servers
      Create a new Group Policy for your Production Servers
    3. Edit the new Group Policy object and drill down to Computer Configuration | Policies | Windows Components | Windows Update
    4. Edit the Configure Automatic Update Properties item and enable it
    5. Set the Configure Automatic Updating option to 3 – Auto download and notify for install
      Edit Configure Automatic Updates Properties and enable Auto download and notify for install
      Edit Configure Automatic Updates Properties and enable 'Auto download and notify for install

    After the new Group Policy propagates, you will notice the update setting is now locked on the servers in the Production Server OU.

    The Group Policy locks the Windows Update setting
    The Group Policy locks the Windows Update setting

    From now on your servers will be updated without unplanned reboots!

    Default domain policy1.png
         Figure: Good example - AD shows the Group Policy setting “3 – Auto download and notify for install”. This policy is applied to the specified OU eg. Production Servers joined to this domain

    ​​Related Rules

  2. Do you wait before applying Service Packs or upgrades?

    After a new Service Pack is released for a product (for example, Exchange 2010 Service Pack 1), users and management can get very excited about new features that the Service Pack will bring that will help them out, or fix problems that they had been having with the product.

    Microsoft generally test their Service Packs very well, but things can go wrong.

    As a general rule, we wait 4 weeks before installing a new Service Pack, and tell everyone to hold their horses.

    Figure 1 - Even though managers and users might be pressing you to install a Service Pack - tell them to hold their horses!

    After the 4 week period has expired perform the following tasks before installing the Service Pack:
    • Do an search for any trending problem when updating to the new Service Pack 
    • Check for any known issues in the Microsoft KB with the Service Pack
    • Read installation documentation
    • Backup your system, or if you are using Hyper-V, take a snapshot
    • Reboot before you are about to install a Service Pack
    Following this rule should prevent disaster in the event that a Service Pack is troublesome.
  3. Web Servers - Do you know how to Setup NLB on Windows Server 2016? (aka Network Load Balancing)

    Downtime occurs when you have a single server setup.

    TODO: This is 2008 R2 – update to 2016
    Note: 2008 R2 was not as reliable as later versions. So it would be better to use failover cluster in Server 2012 R2 or 2016 for a more reliable infrastructure configuration. 

    ​​Use NLB to allow load balancing and failover. On each of your Windows Servers, you will host your website.

    You need to follow these steps to get it up and running:

    1. On all nodes of the NBL cluster, the Network Load Balancing Feature needs to be installed.
      Setup NLB Figure: Install the NLB Feature
    2. Open the Network Load Balancing Manager from Administrative Tools
      Setup NLB Figure: Under the Cluster menu item, click New
    3. Enter the first node in the cluster in ‘Host’ and press ‘Connect’
      Setup NLB Figure: Select the interface for the node
    4. Enter a Priority as 1 (this is just a host identifier)
      Setup NLB Figure: In 'Priority' enter '1'
    5. Setup NLB Figure: Enter a virtual IP address for the cluster. eg.
    6. Choose the IP address of your cluster from the dropdown list Set a Full Internet Name eg.
      Ensure the Multicast Cluster operation mode is selected.
      Setup NLB Figure: Set the 3 cluster parameters
    7. You want sticky sessions so you don’t mistakenly bounce between servers (and lose your state)
      Setup NLB Figure: Leave the Port Rule as default. This will provide sticky session
      Setup NLB Figure: Success. The cluster configuration will show a green icon
    8. Right click the name of the cluster eg. Click Add Host To Cluster
      Setup NLB Figure: Add the 2nd web server with a priority of 2
    9. Open a command prompt and type in wlbs query to verify the cluster:
      Setup NLB Figure: Type in wlbs query to verify the cluster
    10. Ping both nodes and the virtual IP address externally to verify they are all working
  4. Web Servers - Do you get Zero Downtime when Updating a Server?

    If you are dealing with a single server, there is no way to achieve 100% uptime, when updating or restarting a server.

    So set your website up correctly with at least 2 front ends, and 1 backend (the SQL Server).

    Server down, site up Figure: Good Example – When one server goes down, the web site remains up

    Then, use a Network Load Balancer (we recommend Microsoft’s build in NLB) which allows you to spread web site load to multiple servers, but even more helpful when you need to do Windows Updates or make changes to web servers in your environment.

    Follow the below steps on your test server first, get the application tested passed, then move on to production.

    1. Open the Network Load Balancing Manager
    2. Right click on the machine you want to update | Select Control Host | Click Drain Stop drain stop Figure: The 2 green icons indicate both servers are live with users - Do a drain stop on the server you want to make changes too
    3. To view the current connections on the server, open a command prompt and enter netstat -an. You will be able to see the connections list dropping as users are sent to the other server netstat Figure: Run "netstat -an" to view the current connections on the server
    4. Allow the NLB to finish sending the connections to the remaining servers. The server you have drain stopped, will turn red when all the users have been moved to the other server​
      Server turns red Figure: When the server turns red, the connections have been dropped and you're ready to update
    5. Optional – if you are using Hyper-V, take a snapshot of the server you are about to make changes on
    6. Restart
    7. Windows update Figure: Now that the server isn't being hit with users, perform your updates. Click "Restart Now"
    8. Optional – Do a smoke test (open the site and check its working)
    9. Optional – Run any automated tests (for example Telerik Tests)
    10. When the server ready, add it back into the load balancer. Right click on the machine | Select Control Host | Click Start
    11. The server icon will return to green, and users will start being sent to the server again
    12. Server OK Figure: The server will now accept connections again
    13. Follow the same process for the other server (or multiple)

    Congratulations you've just updated your servers with 100% uptime.

  5. Printers - Do You Install Your Printers With Group Policy?

    It is important install your printers automatically to all clients that logon to the domain.

    This can be achieved via Group Policy. This can be set up easily in​ a Microsoft Windows 2008 Server R2:

    Note: It is better to deploy printers via GPO preferences to end users and also for large-scale environments. There are third-party products eg. Tricerat or Printer Logic which makes centralizing printer queues and servers more efficiently.

    • From Server Manager add the Print Services role
    • Install the Print Services role Figure: Install the Print Services role
    • When the role has installed, open Print Management from Administrative Tools
    • Install all your printers by right clicking on Printers and clicking Add Printer
    • Add all of your printers to the server Figure: Add all of your printers to the server
    • Right click on Drivers and choose Add Drivers. From here you will be able to install the x86 and x64 drivers for your printers so all workstations in your organization get the printer drives automatically
    • Add the additional drivers for both x86 and x64 Figure: Add the additional drivers for both x86 and x64
    • Click on Printers in the menu to get a list of your installed printers
    • Right click on the first printer you want to install via group policy and click on Deploy with Group Policy
    • Deploying your printer with Group Policy Figure: Deploying your printer with Group Policy
    • Next, you need to choose a Group Policy Object (GPO) to add the printers too. You may wish to create a new GPO specifically for the printers, which you can do through the Group Policy Management tool in Administrative Tools
    • Select the Group Policy Object (GPO) to add the printers to Figure: Select the Group Policy Object (GPO) to add the printers to
    • Repeat the last 2 steps for each printer you want to add automatically using Group Policy
    • Reboot your workstations and the new printers will be added upon login
  6. Printers - Do you make your Printers easy to find?

    For PCs that are not in the domain, the printers won’t be automatically installed.

    So you should add a DNS alias which maps \\printer to your print server.

    Add the printer via Connect
    Figure: \\printer takes to this window, were you can "Add" the printer via Connect

    Note: It is better to automate mappings via GPO preferences. As a backup, you can allow users to manually map as above.

  7. Do you know what to request if someone wants more RAM and processors on a VM or a PC?

    A “Too slow” is not enough info.​​​

    Request an image of the “Resource Monitor”

    Then after you decide there is justification:

    •           Do a typical action – take a new image or baseline.

    •           give the ​​additional resources e.g. Ram and processors….

    •           Do the typical action again – take another image of the “Resource Monitor”

    •           If there is some improvement, reply “done” (otherwise reply “not done”)


    Note: An ideal email subject prefix for more resources would be e.g. “Performance issue – “Machine name”


    Figure: Use “Resource Monitor” prior to allocating more RAM on a VM

                Figure: If you see something like this, pass their request :-)

  8. Do you turn on file auditing for your file server?

    ​Windows Server has a built-in solution for auditing who accessed your files in a file share or non-shared files in your file system, but it is turned off by default.

    "Advanced Audit Policy Configuration" is a Group Policy setting in Windows that enables several audit options for your files, e.g.:

    1. Object Access - Audit who opened, closed or modified files and folders in your system
    2. Logon/Logoff - Audit who's logged on and off the server

    To get to this setting, you need to:
    1. Open your domain's or server's Group Policy (or Local Group Policy)
    2. Computer Configuration | Windows Settings | Security Settings | Advanced Audit Policy Configuration
    3. Choose the setting that applies to you e.g. Object Access
    4. Edit the subcategory | Check "Success" and "Failure" as best practices
    Figure: Good Example - Auditing Successes and Failures in your file shares

    After that, your server will start logging audit events in the Event Viewer. To filter relevant events, do the following:

    1. Open Window's Event Viewer | Windows Logs | Security
    2. Click "Filter Current Log..." | IDs 4663, 4660, 5145:
      1. 4663 (An attempt was made to access an object) - Event ID when a user accesses a file system file
      2. 4660 (An object was deleted) - Event ID when a user deletes a file system file
      3. 5145 (A network share object was checked to see whether the client can be granted desired access.) - Event ID when a network user accesses a file share file
    3. The relevant logs will start popping up:
      Figure: Good example - Filtered logs with file access information
    4. Click on each entry for a detailed explanation on which file was opened, which IP address was used and which user initiated the action

    This kind of audit tool is an important part of any SysAdmin or Security Engineer to better see what is going on in your Windows environment.