SBS 2008 Setup Guide V1.7.0

This will be our preliminary set up checklist for getting an SBS 2008 install configured once the base OS install has completed. This post will compliment what is in our SBS 2008 Blueprint book. It will also provide the foundation for a chapter in our upcoming SBS 2008 Advanced Blueprint book.

There will be some minor tweaks and modifications to this list as we go along with our installs. If things change a lot, then we will run a new post and call it V2. :)

For the most part, items in the list will be fleshed out in the SBS 2008 Blueprint book. Items that we have encountered beyond the book, will be addressed in existing or subsequent blog posts.

The following assumes that the server manufacturer’s prep disk was used to update the BIOS, motherboard firmware, RAID controller firmware, backplane firmware, and any other device’s onboard firmware prior to installing the SBS 2008 OS. The firmware update step is an absolutely critical one for the stability of the server.

Here is our list so far:

1. Install the manufacturer’s drivers.

   1. RAID including RAID monitoring/status software.
   2. Chipset.
   3. Video.
   4. NIC (Do not team). Unplug or disable any extra NICs for now.
   5. Management suites from the hardware manufacturers will be installed later on in this process.
   6. We do not install System Center Essentials that is provided by Intel on our Intel based SBS 2008 servers.

2. Desktop

   1. Set the desktop resolution for the monitor attached.
      • Keep in mind that some remote management modules such as Dell’s DRAC may not work if the monitor’s resolution is set too high.
   2. Enable desktop icons.

3. GUI Customization

   1. Windows Explorer.
   2. Start Menu.
   3. Notification Area.
   4. Add a Desktop Toolbar to the Task Bar .
   5. Internet Explorer.
      1. Add http://download.microsoft.com to Trusted Sites.
   6. Task Manager Process Column Customization.

4. Partitioning

   • RAID 1+0 is our default (4 disks) + hot spare. Name after the amount of storage is the drive label.
     • 640GB (4x 320GB SATA)
     • C: 100GB SS-SBS (Rename to SBS name)
     • S: 25GB SwapFile (8GB RAM * 1.5 with wiggle room)
     • L: 515GB NetworkData
5. Move the optical drive letter to Z:.
6. Move the Swap File (Reboot and use the above script to speed it up).

7. Copy and paste this services shutdown batch file onto the desktop (previous blog post).

   • Right click and Run as Administrator.
   • Batch file will improve reboot times by 50%-75%!
8. Install and configure Print Services Role: SBS 2008 Terminal Services and HP Printer Drivers (previous blog post).

9. Windows Native Tools Management Console modifications

   1. Add the Group Policy Management Console
   2. Add the Print Management snap-In (after adding the Print Server Role).
   3. Add the Share and Storage Management snap-in.
   4. Add the File Server Resource Manager snap-in.
   5. Add the TS Gateway Manager.
   6. Add the Windows Server Backup snap-in.

10. Run MMC and add the local Computer Certificate store snap-in and save to the desktop for later use.

    • Can be found in the SBS Native Tools console.
11. Configure an authoritative time source for the SBS OS.
    1. Blog Post: SBS 2008 Physical And Hyper-V – Set Up the Domain Time Structure.
    2. TechNet: Synchronize the Source Server time with an external time source for Windows SBS 2008 migration.
    3. Once the commands have run, an error message or two may show in the Event Logs soon to be replaced by a successful connection to the authoritative time source.
    4. Note Oliver Sommer’s comments in the above article.

12. Enable ShadowCopies on the NetworkData partition and set a schedule. We use before hours, coffee, lunch, coffee, and after hours for the schedule.

13. DHCP IPv4 Properties (DNS updates & credentials)
    • Domain: SBSDomain.local
      • Extension is required.
14. DHCP additional exclusions for printers (x.1-10) and servers (x.250-254).
15. DNS Settings for Scavenging at 7 days and AD integrated zones.
16. Create a 5GB Soft Quota (File Server Resource Manager).
17. Add Network Service to IIS WAMREG admin service to eliminate DCOM 10016 errors in the event logs (links to MS KB920783 article).
    • Note that the BPA will pick up any previous log entries and claim that the problem still exists. The error is safe to ignore once the edit has been completed.
18. Enable firewall logging and pop-ups: SBS 2008 Windows Firewall with Advanced Security troubleshooting (previous blog post).

19. Create the default Company Shared Folder with required NTFS and share permissions on the L: NetworkData partition.

    • Share Name: Company.
    • Quota: 5GB Soft.
    • Enable Access-based Enumeration.
    • NTFS Permissions:
      • Domain Admins = FULL.
      • Domain Users = Modify.
    • Share Permissions:
      • Domain Admins = FULL.
      • Domain Users = FULL.

20. Create the ClientApps (previous blog post on GP and the ClientApps folder) on the L: NetworkData partition.

    • Share Name: ClientApps.
    • Quota: None.
    • Enable Access-based Enumeration. Subfolders can have custom permissions at a later date to exclude users or groups and thus hide those subfolders at a later date.
    • NTFS and Share Permissions:
      • Domain Admins = FULL.
      • Domain Users = FULL.
      • Domain Controllers = FULL.
      • Domain Computers = FULL
21. Make changes to the WSUS Setup:
    • WSUS Classifications: Enable all except Drivers.
      • Driver delivery for Windows Vista and 7 has 
    • WSUS Sync Schedule: Increase synchronization frequency schedule depending on what products are installed on the server.

22. Getting Started Tasks – Out of Order

    1. Configure and take a backup now.
    2. Times: 12:30, 17:30, 23:00.
       • Make sure that the backup times and the Volume Shadow Copy snapshots do not happen at the same time.
    3. Backup Now by right clicking on the configured backup and running it.
    4. Backup in between each batch of updates.

23. Exchange Server 2007 Rollup Install (previous blog post). Microsoft Download site search for Exchange 2007 rollup (Microsoft Download Site Search). Check to make sure there are no newer rollups.

    • 2010-01-13: Exchange Service Pack 2 is now Available (previous blog post).
    • 2010-10-18: Exchange Service Pack 3 is now available (MSFT download site).

24. Server Updates via WSUS/MU.

    • Update to the latest SBS Update Rollup first.
    • Old caveat: Do not WSS SP2 For Now.
    • Prepare SBS 2008 for the WSS SP2 Update.
      • Download and install: KB977022 - SharePoint Pre SP2. Note that there are x86 and x64 versions of the update!
        • Official SBS Blog: A Tip for Preventing Certain Sharepoint Connectivity Failure in SBS 2008.
      • Apply WSS v3 SP2 before SQL service packs and updates as a just in case.
    • Run updates according to the following product groups:
      • Windows Server 2008 x64
      • Exchange 2007 SP1/2/3
      • .NET
      • SQL
      • WSS, WSUS, and others.
25. Create a new User Role in the SBS Console.
    • Name: Standard User – Restricted.
    • Remove all Group Memberships.
    • Add the Domain Users security group only.
    • Remove OWA permission.
    • No RWW or VPN.
    • Verify permissions in the User Role after it is created.
    • This role is used for the local admin account deployed via Group Policy later in this guide.

26. Group Policy Configurations (previous blog post):

1. Default Computer Policy:
   1. Local Policies: User Rights Assignment.
   2. Local Policies: Security Options.
      • Enable UAC by default in Group Policy (previous blog post).
      • NOTE: The UAC structure can be split up between Computers, SBSComputers, and SBSServers GPOs so that domain admin accounts only get prompted on servers.
   3. Remote Connectivity: Remove the Disconnect option from the Start Menu and add the Windows Security option.
2. Windows SBSUsers Policy:
   1. Configure Screensaver Management. Our default is 45 minutes with logon.scr as the default SS. Password is always required.
      • 2010-10-18: For Windows 7 we now use scrnsave.scr as the basis for all screensavers which is a blank screen.
   2. Mapped Network Drive (M: = \\SS-SBS\Company) via Group Policy Preferences
   3. Set the Companyweb as the default site in IE.
   4. Add the RWW and OWA URLs to IE’s Favorites.
3. Windows SBSComputers Policy:
1. Deploy a restricted domain user to _all_ system’s Local Admin Group.
1. Create a new user using the Standard User – Restricted Role.
2. Deploy to workstation’s Local Admin Group via Group Policy Preferences.
3. Remove the user’s mailbox (previous blog post).
4. Default Printer Deployment Policy:
   1. Deploy printers to XP Professional x86 (previous blog post).
   2. Deploy printers to Windows Vista using the Printer Management snap-in.
5. Windows SBSComputers XP Pro Policy:
   1. Deploy Windows Defender to Windows XP Professional (Optional).
27. Install the server hardware manufacturer’s management software suite.
28. Set the SBS Domain Password Polices (60-75 days, 10-12 characters minimum with complexity).
    • Note that all user’s passwords will reset to request a new password!
29. Enable Folder Redirection.
    • Changing the security settings in the default GPO for redirection will show FR as not enabled in the SBS Console.
    • We remove the Exclusive Access setting on any folders redirected to remove complications when it comes time to migrate the client to a new server.
30. Remove the Public share in the SBS Console.
31. If using the self-issued certificate, copy the package to the Network Admin\SBS folder in the Company shared drive. (We create a Network Admin folder in the Company Shared Folder at all client sites).
    • If using a GoDaddy certificate, make sure to install the GoDaddy Intermediate certificates (download page) into the Intermediate Certification Authorities store individually to avoid any issues later.
      1.  gd_intermediate.crt
      2. gd_cross_intermediate.crt
      3. Disable All Uses for GoDaddy Class 2 root certificate in Trusted Root Certification Authorities.
      4. Restart the IISAdmin service.
      5. Install the GoDaddy certificate using the wizard.

32. Move the relevant data folders to the L: partition. We move all but the Exchange databases.

    1. WSS (SharePoint) Data.
    2. Users’ Shared Folders.
    1. Re-enable Access-based Enumeration
    3. Users’ Redirected Folders Data.
    1. Re-enable Access-based Enumeration
    4. WSUS Update Repository Data.

33. SBS Console Getting Started Tasks.

1. Connect to the Internet.
2. Customer Feedback options.
3. Set up your Internet address.
4. Configure a Smart Host for Internet e-mail.
5. Add a trusted certificate.
6. Configure server backup: Earlier in this checklist.
7. Add new users (use the multiple wizard under users if there are a lot of users to add).
8. Connect computers: http://connect.
9. Share Printers via Group Policy for Windows Vista and PushPrinterConnections.exe for Windows XP Pro SP3 (both links are previous blog posts).
10. Set up Office Live Small Business.
34. Configure the Reports e-mail addresses.
35. Copy Logon Failure XML code (CodePlex site) into a new Event ID Filter and set an e-mail to fire when a failed logon occurs.
36. Configure Workstations on the domain.
37. Create and configure the Group Policy Central Store.
38. Enable an MFP or Copier to Scan To E-mail Destined To A Companyweb SharePoint Library (previous blog post).
39. Enable and configure Windows Search Services on SBS 2008 or a Windows Server 2008 RTM/R2 file server and Libraries on Windows 7 (Official SBS Blog post).
    1. Install the Search Service.
    2. Add the share to Windows 7 Libraries.
    3. Click start and start typing and watch those network files results flow!
40. Fix the SharePoint 2436 Search errors (Official SBS Blog post).
41. Fix the networking settings for Add-On Congestion Control Provider, Receive Window Auto-Tuning Level, Receive-Side Scaling State, Task Offload (previous blog post)
42. Download, install, and run the SBS 2008 Best Practices Analyzer.
    1. The BPA will pick up a lot of the little things that need to be configured such as advanced OS networking features that should be disabled, the SharePoint 2436 error above, and others.
43. Change the initial domain administrator’s password if using an Answer File (remember to reset the DHCP credentials, and any Event Log event fired Task too). Note that if the admin account has not been logged off since changing the Password Policies, a log off and log on again will require a password change anyway.

44. Configure Custom Views and e-mail Task triggers for Event IDs (SBS Native Tools Management):

    • E-mail on Event IDs for low disk space (previous blog post).
    • E-mail on Event ID for Failed Logon Attempts (previous blog post). SBS Console flag also in this post.
    • E-mail on Event ID for Failed Backup.

45. OPTIONS:

    • Configure a mapped network drive for the Companyweb SharePoint site (previous blog post).
    • Configure TS to allow two concurrent connections to the server (useful for training or working with someone on a problem).
    • Configure BGInfo to publish on all desktops (previous blog post).
    • Configure ISA 2006 with port 987 for remote Companyweb access (previous blog post).
    • Configure a GPO setting with an XP WMI filter and deliver WindowsDefender to all XP Pro workstations via GP.
    • Download and install Office 2007 ADM/ADMX Group Policy Objects to manage Office 2007 via GP.

46. Customize the SBS Console Reports.

    • SBS Console XML Customizations on CodePlex.
    • SBSDeveloper.com: SBS Reporting Plugins XML.

47. Run a backup. Crash the server. Restore the Backup. Deliver.

One thing to keep in mind when it comes to checklists is that they are never meant to be a replacement for the materials they summarize!

It is very important to understand why the various steps need to be accomplished, how those steps can change over time due to changes in the operating system, the hardware configurations underneath the OS, and the technician’s own growth in experience and understanding.

The “why” leads to an ability to understand how things are going wrong when they do. Note that we are saying, “when” and not “if” things go wrong.

Troubleshooting

• Post OS Setup

  • You receive an “invalid certificate” error message, when you try to use Remote Web Workplace, when you run the Internet Address Management Wizard, or when you run the Fix My Network Wizard.
    • Has to do with putting the RWW URL in the CA Name field in the Answer File Generator.
  • Fix the SharePoint 2436 Crawler Errors.
    • The registry change needs to be done.
    • The second step of disabling the Loopback Check (KB 896861) may be needed.

UPDATES:

• 2009-05-11: V1.0.1 – Added a step and a few sub steps for Group Policy settings.
• 2009-05-14: V1.0.2 – Added the IE SBSUsers settings.
• 2009-05-19: V1.1.0 – Added some tweaks and changes to the existing steps.
• 2009-05-23: V1.1.1 – Added the option to map the Companyweb site to a network drive.
• 2009-05-29: V1.2.0 – Significant changes and adjustments made with some additional steps too.
• 2009-09-05: V1.2.1 – Added the option for allowing copiers and MFPs to relay e-mail through to users and a SharePoint library, the Troubleshooting section, and some formatting changes.
• 2010-01-14: Numerous updates including the Exchange 2007 SP2 mention.
• 2010-01-17: v1.4.1 – Added the need to set up time synchronization as well as cleaned up some HTML code.
• 2010-01-27: v1.4.2 – Added the blog post link for configuring the time service step.
• 2010-05-01: v1.5.0 – Numerous changes and updates to the process.
• 2010-10-18: v1.6.0 – Restructured some of the step’s order to better represent the work flow such as backing up SBS _before_ applying the Exchange service place. Numerous other changes.
• 2010-10-25: v1.7.0 – Added some steps and some clarifications for the steps.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*All Mac on SBS posts will not be written on a Mac until we replace our now missing iMac! (previous blog post)

Windows Live Writer

Subscribe in a reader