For example, when you want to view all the available features in the Core Version, you can use the command:
dism /online /get-features /format:Table
dism /online /get-features /format:List

[HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\VMware Tools]
“ShowTray”=dword:00000000

Now the VMware Tools tray icon is gone for all the users!

1.) Mount or extract the Microsoft Windows 2008 R2 DVD in your Windows 2003 server (the RADIUS server)
2.) Browse to the following directory
D:\Sources\dlmanifests\microsoft-windows-iasserver-migplugin
3.) Copy this folder to your C: drive of the Windows 2003 server
4.) Open a command line box
5.) Run the iasmigreader.exe
6.) This tool will read your IAS configuration and exports it to C:\Windows\System32\IAS\IAS.txt
7.) Copy this file to your new Windows 2008 R2 NPS server (In my example C:\_IAS)
8.) Open a command line box on your Windowws 2008 R2 NPS server
9.) Enter the following command
netsh nps import filename=”C:\_IAS\IAS.txt”
10.) The configuration will be imported now
11.) Don’t forget to register your NPS service in AD or configuration settings be damned, NPS will just not work.

1.) Login on a Windows 2003 domain controller
2.) Insert the Windows 2008 R2 DVD or attach the ISO
3.) Open a command prompt CMD
4.) Browse to the following map of the Windows 2008 R2 DVD
x:\Support\Adprep
5.) First you’re going to prepare the forest with the new schema extensions
adprep32.exe /forestprep
Note! Because Windows Server 2003 is a 32 bits platform, you’ve to use adprep32.exe. If your’re using adprep.exe, you’ll receive the following error: “The image file adprep.exe is valid, but is for a machine type other than the current machine.” Windows Server 2008 R2 is only available in 64 bits.
6.) Make sure that all the domain controllers are replicated
7.) The next step is to prepare the domain and the GPO’s
adprep32.exe /domainprep /gpprep
Note! When you want to add a Read-Only Domain Controller (RODC) to your environment in the future, you’ve have to execute another command.
adprep.exe /rodcprep
8.) Your domain is now ready for installing the new Windows Server 2008 R2 Domain Controllers.
9.) Run the command DCPROMO on the new Windows Server 2008 R2 machines

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}]=dword:00000001

A nice solution to deploy this registry key to all your desktop computers in your organization, is to use Group Policy Preferences. This is a new feature within Windows Server 2008.

Use can use the following steps to configure this:

1.) Create a new GPO whtin the Group Policy Management Console
2.) Open the new GPO en navigate to the Computer Settings. (It’s a HKEY_LOCAL_MACHINE settings)
3.) Navigate to Preferences \ Windows Settings \ Registry
4.) Create a new Registry Item
5.) Actie: Update
6.) Hive: HKEY_LOCAL_MACHINE
7.) Key Path: SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum
8.) Value name: {F02C1A0D-BE21-4350-88B0-7367FC96EF3C}
9.) Value type: REG_DWORD
10.) Value data: 1 (Decimal), 00000001 (Hexadecimal)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer]
“ShowDriveLettersFirst”=dword:00000004

Core Configuration tasks include:

- Product Licensing
- Networking Features
- DCPromo Tool
- ISCSI Settings
- Server Roles and Features
- User and Group Permissions
- Share Creation and Deletion
- Dynamic Firewall settings
- Display | Screensaver Settings
- Add & Remove Drivers
- Proxy settings
- Windows Updates (Including WSUS)
- Multipath I/O
-Hyper-V including virtual machine thumbnails
- JoinDomain and Computer rename
- Add/remove programs
- Services
- WinRM
-Complete logging of all commands executed

You can download the tool here.

The first step is to enable the Recycle Bin feature. Make sure your functional level is Windows Server 2008 R2 and keep in mind that when you enable this feature, you can’t disable this feature anymore!!

1.) Start the  Active Directory Module for Windows PowerShell
Import-Module ActiveDirectory

2.) View the actual settings of the Recycle Bin feature 
Get-ADOptionalFeature -Filter { name -like “Recycle*” }

3.) Enable the feature for your Active Directory environment 
Enable-ADOptionalFeature “Recycle Bin Feature” -Scope ForestOrConfigurationSet -Target E2K7SP2.LOCAL

4.) View all the deleted Active Directory objects 
Get-ADObject -SearchScope subtree -SearchBase “cn=Deleted Objects,dc=E2K7SP2,dc=LOCAL” -includeDeletedObjects -filter { name -notlike “Deleted*” }

5.) Restore the user objects you want 
Restore-ADObject -Identity “CN=User01\0ADEL:cc40dfd4-f671-4e90-90cc-3c8a33b18391,CN=Deleted Objects,DC=E2K7SP2,DC=LOCAL”
Restore-ADObject -Identity “CN=User02\0ADEL:394ec482-5bb2-4131-bdb4-7c92d7193987,CN=Deleted Objects,DC=E2K7SP2,DC=LOCAL”
Restore-ADObject -Identity “CN=User03\0ADEL:19f1bf8b-0227-486a-bc8d-ca72a342e116,CN=Deleted Objects,DC=E2K7SP2,DC=LOCAL”
Restore-ADObject -Identity “CN=User04\0ADEL:1b00b1c9-1f1f-4b74-b027-fa88feb4069d,CN=Deleted Objects,DC=E2K7SP2,DC=LOCAL”
Restore-ADObject -Identity “CN=User05\0ADEL:970b2597-4cf3-4971-87ea-9ada827e376d,CN=Deleted Objects,DC=E2K7SP2,DC=LOCAL”

6.) With this command you restore all the deleted items (Not Recommended!!)
Get-ADObject -SearchScope subtree -SearchBase “cn=Deleted Objects,dc=E2K7SP2,dc=LOCAL” -IncludeDeletedObjects -filter { name -notlike “Deleted*” } | Restore-ADObject

7.) All deleted Active Directory objects are restored now. Even the group membership of the users are restored!! Cool

– Enter the productkey:
slmgr.vbs -ipk xxxxx-xxxxx-xxxxx-xxxxx-xxxxx

– Activate Windows:
slmgr.vbs -ato

– Rename the computer:
Netdom renamecomputer “%computername%” /newname:SRV-RODC01 /reboot:15

– Show all network interfaces:
Netsh interface ipv4 show interface

– Set a static IP address:
Netsh interface ipv4 set address name=2 source=static address=172.16.1.11 mask=255.255.0.0 gateway=172.16.1.1
(make sure that you’re choosing the right network interface. In this example it’s 2, so name=2 it means interface 2)

– Set a static DNS server:
Netsh interface ipv4 add dnsserver name=2 address=172.16.1.10 index=1

– Turn Remote Desktop (RDP) on:
Cscript %windir%\system32\SCRegEdit.wsf /ar 0

– Enable Remote Desktop (RDP) in the Windows Firewall:
netsh advfirewall firewall set rule group=”remote desktop” new enable=yes
(Note: type this rule in by your self, copy past will give an error!)

– Enable Remote Management (RemoteCMD) in the Windows Firewall:
netsh advfirewall firewall set rule group=”Remote Administration” new enable=yes
(Note: type this rule in by your self, copy past will give an error!)Making the unattended.txt:
Copy and past the following test into the new textfile and save this file on the C: drive of the Core Server.
==================================================
[DCInstall]
InstallDNS=Yes
ConfirmGc=Yes
CriticalReplicationOnly=No
DisableCancelForDnsInstall=No
Password=********
RebootOnCompletion=No
ReplicaDomainDNSName=GPO.local
ReplicaOrNewDomain=ReadOnlyReplica
ReplicationSourceDC=srv-w2k8dc01.gpo.local
SafeModeAdminPassword=********
SiteName=Default-First-Site-Name
UserDomain=GPO.local
UserName=Administrator
==================================================

 – Run the DCPROMO
dcpromo /unattend:c:\unattend.txt15)

– Reboot the Domain Controller
shutdown -r -t 0

As you can see, when you make a connection to the RODC, you’re not be able to make any changes to existing users or groups and the option “New” is hidden when you right-click in your environment.

In the next post i’m going to delete a RODC from the environment. (for example if your server is stolen or something like that).

Well, I’ve done the scouring for you and the default password is wSS2008!

Hopefully that helps someone out!

- Drive Maps
- Environment variables
- Files
- Folders
- Ini files
- Registry keys
- Shortcuts

In my testenvironment I’ve build a custom start menu for the user in my environment. You can do this by using the User Preferences. When you’re using Item-Level targeting, you can manage what users are getting some shortcuts. In this example I’m using Item-Level targeting with Security Groups, so when a user is member of a specific security group, he’ll receive the shortcut in his start menu.

1.) First make a new Group Polciy
2.) Go to User Configuration, Preferences, Windows Settings, Shortcuts
3.) Create a new shortcut
4.) Fill in the right path’s **picture 3**
5.) Go to the Common tab
6.) Enable “Remove this item when it is no longer applied” (note: this will change the “Action” to Replace)
7.) Enable “Item-level targeting” and click “Targeting”
8.) Select the way off targeting (note: in this example I’m using Security Group)
9.) Make the right users members of the security group
10.) Logon to your workstation and check your start menu

As you can see, based on the group membership, User01 get’s his shorcuts to the different applications. This can also be configured on the other User Preferences.

Hive: HKEY_CURRENT_USER
Key: Control Panel\Desktop
Name: ScreenSaveTimeOut
Type: REG_SZ
Value: 3600
(default is 600, 10 minutes)

Hive: HKEY_LOCAL_MACHINE
Key: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Name: AutoAdminLogon
Type: REG_SZ
Value: 1 enable auto logon
Value: 0 disable auto logon

Hive: HKEY_LOCAL_MACHINE
Key: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Name: DefaultUserName
Type: REG_SZ
Value: account to logon automatically (for example: Administrator)

Everything looks fine, but there was a problem with Adobe Reader 9.0. The application wasn’t able to start and I received a EventID 1000 in the event viewer of my Terminal Servers.

—————————————————-
 ”Faulting application AcroRd32.exe, version 9.0.0.332, time stamp 0x4850f0a3, faulting module Annots.api, version 9.0.0.332, time stamp 0x4850e57f, exception code 0xc0000005, fault offset 0x001bd9e0, process id 0xb9c, application start time 0x01c99438e39a6ea2.”
—————————————————- 

So I started to trouble shoot and I found the following solution. This action must be configured on every Terminal Server.

Set the compatibility mode of AcroRd32.exe to Windows XP (Service Pack 2). After this modification, everything works fine!

1) Browse the executable AcroRd32.exe on your Terminal Servers
2) Right-click on the executable and choose properties
3) Go to the Compatibility tab
4) Choose Show settings for all users
5) Enable the compatibility mode Windows XP (Service Pack 2)

To be continued…

The Windows 2003 Domain Controller is configured with a domain upgrade.local, forest functional level is Windows Server 2003 and the domain functional level is Windows Server 2003. This server is also the DNS server for this domain. There’s is one forward lookup zone and I’ve created a reverse lookup zone for the 172.16.10.x Subnet. We’re going to migrate to Windows 2008 Server.

First of all, I’ve installed a second virtual server with Windows 2008 Server and give it a static IP address, a subnet mask and a DNS server.

Now you have to prepare the forest and the domain with the new schema extensions.

D:\sources\adprep\adprep/forestprep and D:\sources\adprep\adprep /domainprep.
(Note: if you want to add a RODC, Read Only Domain Controller, you’ve to run also the following command: adprep /rodcprep. There must be already a Windows 2008 Domain Controller present in the domain before you can add a RODC.)

Now you can run a DCPROMO on the Windows 2008 Server.

The new Windows 2008 Domain Controller is succelfully promoted in the existing domain upgrade.local.

The next step is to move all the FSMO roles to the new Domain Controller. The following settings must be made.

Change the Domain Naming Master Active Directory Domains and Trusts, Operations Master, Change

Change the Schema Master run the following command regsvr32 schmmgmt.dll , now you’re able to add the Schema Snap-in in your Management Console.
Active Directory Schema, Operations Master, Change

   

Change the RID Master, PDC Emulator and the Infrastructure Master Active Directory Users and Computer, Your domain, Operations Masters, Change

Now all the FSMO roles are transfered to the new Server 2008 Domain Controller. Now we can demote the Windows 2003 Domain Controller by running the DCPROMO command.

After this steps and a copple of reboots, the migration is done! You now have a Windows 2008 Domain Controller.

First i’ve build an clean Windows 2003 x64 Server and promoted the server to a new domain controller of upgrade.local.
(note: if you want to upgrade your Windows 2000 Domain Controller to Windows 2008, you’ve first have to do an in-place upgrade to Windows 2003!)

Note: make sure you’ve at least 14000 Mb (14 Gb) free space available on your system partition.

Now place the Windows 2008 DVD in your computer, or mount it in your virtual environment.

Browse to your DVD player (in my environment it’s D:) and go to the following folder D:\sources\adprep.

First we’re going to prepare our forest with the following command: adprep /forestprep. After this command, we’re going to prepare our domain: adprep /domainprep.

- Log into Server Core with an admin account

- Run Regedit from the command prompt and modify the following reg keys:
HKLM\System\CurrentControlSet\Control\Video

- you will find one or more GUIDs. Expand each one to find the one with a VolatileSettings subkey under the 0000 subkey (usually the first GUID)

- Double-click the 0000 key and modify the DefaultSettings.XResolution and DefaultSettings.YResolution values to set your resolution

- Close Regedit

Logoff and log back on to receive the new resolution settings.

Download the Excel sheet

You can filter on the following options:

- Filename (.admx)
- Policy Setting Name
- Scope (User of Machine)
- Policy Path
- Registry information (HKLU or HKLC)
- Requirements
- Explain text
- Supported On
- Reboot required
- Logoff Required

First of all install Windows 2008 Server Core Edition.

Now we are going to enter the productkey and activate it.

1) Enter the productkey:
slmgr.vbs -ipk xxxxx-xxxxx-xxxxx-xxxxx-xxxxx

2) Activate:
slmgr.vbs -ato

3) Show activation:
slmgr.vbs -dli

4) Rename the computer:
Netdom renamecomputer “%computername%” /newname:W2K8CO01 /reboot:15
(use the command set to view all the variables used by Microsoft Windows)

5) Show all network interfaces:
Netsh interface ipv4 show interface 

6) Set a static IP address:
Netsh interface ipv4 set address name=2 source=static address=172.16.1.11 mask=255.255.0.0 gateway=172.16.1.1
(make sure that you’re choosing the right network interface. In this example it’s 2, so name=2 it means interface 2)

7) Set a static DNS server:
Netsh interface ipv4 add dnsserver name=2 address=172.16.1.10 index=1

8.) Turn Remote Desktop (RDP) on:
Cscript %windir%\system32\SCRegEdit.wsf /ar 0 

9) Enable Remote Desktop (RDP) in the Windows Firewall:
netsh advfirewall firewall set rule group=”remote desktop” new enable=yes
(Note: type this rule in by your self, copy past will give an error!)

10) Enable Remote Management (RemoteCMD) in the Windows Firewall:
netsh advfirewall firewall set rule group=”Remote Administration” new enable=yes
(Note: type this rule in by your self, copy past will give an error!)

11) Join the domain:
Netdom join “W2K8CO01″ /domain:testlab.local /usero:administrator /passwordo:*
(This step is only for joining a member server to the domain. For a Domain Controller go to step 12)

12) Preparing the promotion to a Domain Controller:
We need to create a unattend.txt that we are going to use by the DCPROMO. So let’s create a new textfile, type notepad

13) Making the unattended.txt:
Copy and past the following test into the new textfile and save this file on the C: drive of the Core Server.

14) Run the DCPROMO
dcpromo /unattend:c:\unattend.txt15) Reboot the Domain Controller
shutdown -r -t 5

So the second Domain Controller for the domain testlab.local is ready!!

Improved RemoteApp and Desktop Connections
New RemoteApp & Desktop Connection (RAD) feeds provide a set of resources, such as RemoteApp programs and Remote Desktops. These feeds are presented to Windows 7 users via the new RemoteApp & Desktop Connection control panel, and resources are tightly integrated into both the Start menu and the system tray.
The improved RemoteApp and Desktop Connections features in Windows Server 2008 R2 and Windows 7 provide the following improvements:
• Extends Remote Desktop Services to provide tools to enable VDI. The in-box Remote Desktop Services capability is targeted at low-complexity deployments and as a platform for partner solutions, which can extend scalability and manageability to address the needs of more demanding enterprise deployments. VDI includes the following technologies to provide a comprehensive solution:
• Hyper-V™
• Live Migration
• System Center Virtual Machine Manager 2008
• Microsoft Application Virtualization version 4.5 in Microsoft Desktop Optimization Pack (MDOP).
• Vista Enterprise VECD licensing
• Provides simplified publishing of, and access to, remote desktops and applications.  The feeds described above provide access in Windows 7, but using  the new RemoteApp & Desktop Web

Access, users will also be able connect to these resources from Windows Vista and Windows XP.
• Improved integration with Windows 7 user interface. Once accessed, RAD-delivered programs and desktops show up in the Start Menu with the same look and feel of locally installed applications.
A new System Tray icon shows connectivity status to all the remote desktop and RemoteApp connections to which the user is currently subscribed. The experience is designed so that many users won’t be able to tell the difference between a local and remote application.

Improving User Experience through new Remote Desktop Protocol capabilities.
These new capabilities, enabled with Windows Server 2008 R2 in combination with Windows7, improve significantly the experience of remote users, making it more similar to the experience enjoyed by users accessing local computing resources. These improvements include:

• Multimedia Redirection: Provides high-quality multimedia by redirecting multimedia files and streams so that audio and video content is sent in its original format from the server to the client and rendered using the client’s local media playback capabilities.

• True multiple monitor support: Enables support for up to 10 monitors in almost any size, resolution or layout with RemoteApp and remote desktops; applications will behave just like they do when running locally in multi-monitor configurations.

• Audio Input & Recording: VDI supports any microphone connected to a user’s local machine, enables audio recording support for RemoteApp and Remote Desktop. This is useful for VoIP scenarios and also enables speech recognition.

• Aero Glass support: VDI provides users with the ability to use the AeroGlass UI for client desktops; ensuring that remote desktop sessions look and feel like local desktop sessions.

• Direct X redirection: DirectX 9, 10 and 11 applications will render on the server and will be remoted using bitmaps (requiring Direct3D-compatible hardware).  If the application supports the new DirectX 10.1 API with remoting extensions the DirectX (2D& 3D) graphics are redirected to the local client to harness the power of the GPU on the user’s local device, removing the need for a GPU on the server.

• Improved audio/video synchronization: RDP improvements in Windows Server 2008 R2 are designed to provide closer synchronization of audio and video in most scenarios.

• Language Bar Redirection: Users can easily and seamlessly control the language setting (e.g. right to left) for RemoteApp programs using the local language bar.

• Task Scheduler: This adds the ability in Task Scheduler to ensure that scheduled applications never appear to users connecting with RemoteApp. This reduces user confusion.

While RAD improves the end-user experience, RAD also reduces the desktop and application management effort by providing a dedicated management interface that lets IT managers assign remote resources to users quickly and dynamically. Windows Server 2008 R2 includes the following RAD management capabilities to help reduce administrative effort:

• RemoteApp & Desktop Connections control panel applet. Users can easily connect to RemoteApp programs and Remote Desktops using the RemoteApp & Desktop Connections control panel applet in Windows 7.

• Single administrative infrastructure. Both RemoteApp & Desktop connections and RemoteApp and Desktop Web Access are managed from a single management console. This ensures that connections can still be used from Windows XP and Vista by using a Web page.

• Designed for computers that are domain members and standalone computers: The RemoteApp & Desktop feature is easy to configure and use for computers that are members of Active Directory domains and for standalone computers.

• Always up to date. Once a workspace is configured, that workspace keeps itself up to date until it is removed from the user’s desktop. When an admin adds an application or update it automatically appears on users’ Start menu and via that user’s Web Access page.

• Single sign-on experience within a workspace. Ensures that only a single logon is required to access all applications and resources with a RAD connection.

• RemoteApp & Desktop Web Access. This capability provides full integration with RemoteApp & Desktop Connections to ensure a consistent list of applications is available to the user at all times, no matter the desktop OS used. The default web page provides a fresh and inviting look and feel and includes a new Web-based login with integrated single sign-on.

Download the Hyper-V monitor for Windows Sidebar.

To install the feature:

1) Go to Server Manager

2) Add a new feature

3) Select to add the Wireless LAN Service

4) Finish the installation

5) Install your WIFI drivers if not automatically detected.

how many real servers do you have with wireless adapters?

You can also download a Starter GPO Package, this are collections of configured Administrative templates (.admx) policy settings that can be used to create a live Group Policy (GPO).

Download the Starter GPO Package here

There are two Starter GPO Packages, one for Windows Vista and one for Windows XP SP2.

- Windows Vista EC Computer
- Windows Vista EC User
- Windows Vista SSLF Computer
- Windows Vista SSLF User

- Windows XP SP2 EC Computer
- Windows XP SP2 EC User
- Windows XP SP2 SSLF Computer
- Windows XP SP2 SSLF User

The starter GPO’s are based on recommended settings for Specialized Security Limited Functionality (SSLF) and Enterprise Client (EC) environments, as documented in the Security Guides for Windows Visa and Windows XP

After installing both packages, you just have to load the .CAB files into the Starter GPOs container from the installed location (default: %Program Files%\Microsoft Group Policy\StarterGPOs) using GPMC.

First of all I made two “base images”, one Microsoft 2008 Server X86 Enterprise and one Microsoft 2008 Server X64 Enterprise. This two machines will be cloned for the rest of the environment.

The first machine i’ve created is a new domain controller. Let’s see the screenshots i’ve made. There are a copple of new options through the promotion process of this server.

This wizard to install a new domain controller you get by typing in DCPROMO in the run box. A nice new feature you can see in screenshot 10, Export the settings. You can use this file for example promoting a second domain controller unattended, or you can use this file to promote a Server 2008 Core Edtion as a domain controller.

The second domain controller you can promote unattended with the following command: dcpromo /unattended:c:\unattended_dc_config.txt (make sure you select the right textfile).

- Terminal Server 2008
- TS Gateway
- TS RemoteApp
- TS Easy Print
- RODC (Read Only Domain Controller)
- NAP (Network Access Protection)
- Server 2008 Core Edition
- Hyper-V
- PowerShell

To download the presentations of the “Get ready for Windows Server 2008″ seminar, go to the skydrive of Gerald van Grootheest. 

The installation of the new Session Broker takes four steps:

1. Install the TS Session Broker role service on a Server
2. Populate the Session Directory Computers local group
3. Join the Terminal Servers to the Session Broker and make them participate in the Load Balancing
4. Add DNS entries for all Terminal Servers in the same farm.

When you install the Session Broker role service, this can be installed on the same server as the TS Licensing role service.

After installing this role service, there’s a new local security group called Session Directory Computers. Here you’re going to add all of the Terminal Servers that are member of the new Terminal Server Farm.

Next you have to configure all the Terminal Server to join the new Session Broker. This can be done using the following command: TSCONFIG.MSC

Now you are going to configure the group policy on the OU that includes the Terminal Servers.

The last step is to create new DNS entries for all the terminal server in the same farm. Now you are able to connect to the new Terminal Server Farm.

Here’s a great overview how this new Session Broker Role Service works.

Windows 2003 Server:

In Server 2003 you had the option to do this with a registry tweak:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Add a new REG_SZ called DefaultDomainName and fill in your DomainName.

Windows 2008 Server:

In Server 2008 this setting is included in the Group Policy structure.
Computer Settings\Administrative Templates\System\Logon\Default domain for logon
Here you can fill in your domain name.

Configure this option for your terminal server environment and you’ll save a lot telephone calls of users that are able to login, possibly because the domain is standing on locally this computer.

Product Licencing
Networking Features
DCPromo Tool
ISCSI Settings
Server Roles and Features
User and Group Permissions
Share Creation and Deletion
Firewall Settings
Display Settings
Add & Remove Drivers
Screensaver Settings
Windows Updates (Including WSUS)

Download the Windows 2008 Server Core Configurator

powercfg -h off

See the differents before, and after.