Showing posts with label SBS CodePlex. Show all posts
Showing posts with label SBS CodePlex. Show all posts

Thursday, 14 October 2010

SBS 2008 Setup Guide V1.7.0

This will be our preliminary set up checklist for getting an SBS 2008 install configured once the base OS install has completed. This post will compliment what is in our SBS 2008 Blueprint book. It will also provide the foundation for a chapter in our upcoming SBS 2008 Advanced Blueprint book.

There will be some minor tweaks and modifications to this list as we go along with our installs. If things change a lot, then we will run a new post and call it V2. :)

For the most part, items in the list will be fleshed out in the SBS 2008 Blueprint book. Items that we have encountered beyond the book, will be addressed in existing or subsequent blog posts.

The following assumes that the server manufacturer’s prep disk was used to update the BIOS, motherboard firmware, RAID controller firmware, backplane firmware, and any other device’s onboard firmware prior to installing the SBS 2008 OS. The firmware update step is an absolutely critical one for the stability of the server.

Here is our list so far:

  1. Install the manufacturer’s drivers.
      1. RAID including RAID monitoring/status software.
      2. Chipset.
      3. Video.
      4. NIC (Do not team). Unplug or disable any extra NICs for now.
      5. Management suites from the hardware manufacturers will be installed later on in this process.
      6. We do not install System Center Essentials that is provided by Intel on our Intel based SBS 2008 servers.
    1. Desktop
        1. Set the desktop resolution for the monitor attached.
          • Keep in mind that some remote management modules such as Dell’s DRAC may not work if the monitor’s resolution is set too high.
        2. Enable desktop icons.
      1. GUI Customization
          1. Windows Explorer.
          2. Start Menu.
          3. Notification Area.
          4. Add a Desktop Toolbar to the Task Bar .
          5. Internet Explorer.
            1. Add http://download.microsoft.com to Trusted Sites.
          6. Task Manager Process Column Customization.
        1. Partitioning
            • RAID 1+0 is our default (4 disks) + hot spare. Name after the amount of storage is the drive label.
              • 640GB (4x 320GB SATA)
              • C: 100GB SS-SBS (Rename to SBS name)
              • S: 25GB SwapFile (8GB RAM * 1.5 with wiggle room)
              • L: 515GB NetworkData
          • Move the optical drive letter to Z:.
          • Move the Swap File (Reboot and use the above script to speed it up).
          • Copy and paste this services shutdown batch file onto the desktop (previous blog post).
            • Right click and Run as Administrator.
            • Batch file will improve reboot times by 50%-75%!
          • Install and configure Print Services Role: SBS 2008 Terminal Services and HP Printer Drivers (previous blog post).
          • Windows Native Tools Management Console modifications
              1. Add the Group Policy Management Console
              2. Add the Print Management snap-In (after adding the Print Server Role).
              3. Add the Share and Storage Management snap-in.
              4. Add the File Server Resource Manager snap-in.
              5. Add the TS Gateway Manager.
              6. Add the Windows Server Backup snap-in.
            1. Run MMC and add the local Computer Certificate store snap-in and save to the desktop for later use.
                • Can be found in the SBS Native Tools console.
              • Configure an authoritative time source for the SBS OS.
                1. Blog Post: SBS 2008 Physical And Hyper-V – Set Up the Domain Time Structure.
                2. TechNet: Synchronize the Source Server time with an external time source for Windows SBS 2008 migration.
                3. Once the commands have run, an error message or two may show in the Event Logs soon to be replaced by a successful connection to the authoritative time source.
                4. Note Oliver Sommer’s comments in the above article.
              • Enable ShadowCopies on the NetworkData partition and set a schedule. We use before hours, coffee, lunch, coffee, and after hours for the schedule.
              • DHCP IPv4 Properties (DNS updates & credentials)
                • Domain: SBSDomain.local
                  • Extension is required.
              • DHCP additional exclusions for printers (x.1-10) and servers (x.250-254).
              • DNS Settings for Scavenging at 7 days and AD integrated zones.
              • Create a 5GB Soft Quota (File Server Resource Manager).
              • Add Network Service to IIS WAMREG admin service to eliminate DCOM 10016 errors in the event logs (links to MS KB920783 article).
                • Note that the BPA will pick up any previous log entries and claim that the problem still exists. The error is safe to ignore once the edit has been completed.
              • Enable firewall logging and pop-ups: SBS 2008 Windows Firewall with Advanced Security troubleshooting (previous blog post).
              • Create the default Company Shared Folder with required NTFS and share permissions on the L: NetworkData partition.
                  • Share Name: Company.
                  • Quota: 5GB Soft.
                  • Enable Access-based Enumeration.
                  • NTFS Permissions:
                    • Domain Admins = FULL.
                    • Domain Users = Modify.
                  • Share Permissions:
                    • Domain Admins = FULL.
                    • Domain Users = FULL.
                • Create the ClientApps (previous blog post on GP and the ClientApps folder) on the L: NetworkData partition.
                    • Share Name: ClientApps.
                    • Quota: None.
                    • Enable Access-based Enumeration. Subfolders can have custom permissions at a later date to exclude users or groups and thus hide those subfolders at a later date.
                    • NTFS and Share Permissions:
                      • Domain Admins = FULL.
                      • Domain Users = FULL.
                      • Domain Controllers = FULL.
                      • Domain Computers = FULL
                  • Make changes to the WSUS Setup:
                    • WSUS Classifications: Enable all except Drivers.
                      • Driver delivery for Windows Vista and 7 has 
                    • WSUS Sync Schedule: Increase synchronization frequency schedule depending on what products are installed on the server.
                  • Getting Started Tasks – Out of Order
                    1. Configure and take a backup now.
                    2. Times: 12:30, 17:30, 23:00.
                      • Make sure that the backup times and the Volume Shadow Copy snapshots do not happen at the same time.
                    3. Backup Now by right clicking on the configured backup and running it.
                    4. Backup in between each batch of updates.
                  • Exchange Server 2007 Rollup Install (previous blog post). Microsoft Download site search for Exchange 2007 rollup (Microsoft Download Site Search). Check to make sure there are no newer rollups.
                  • Server Updates via WSUS/MU.
                  • Create a new User Role in the SBS Console.
                    • Name: Standard User – Restricted.
                    • Remove all Group Memberships.
                    • Add the Domain Users security group only.
                    • Remove OWA permission.
                    • No RWW or VPN.
                    • Verify permissions in the User Role after it is created.
                    • This role is used for the local admin account deployed via Group Policy later in this guide.
                  • Group Policy Configurations (previous blog post):
                      1. Default Computer Policy:
                        1. Local Policies: User Rights Assignment.
                        2. Local Policies: Security Options.
                          • Enable UAC by default in Group Policy (previous blog post).
                          • NOTE: The UAC structure can be split up between Computers, SBSComputers, and SBSServers GPOs so that domain admin accounts only get prompted on servers.
                        3. Remote Connectivity: Remove the Disconnect option from the Start Menu and add the Windows Security option.
                      2. Windows SBSUsers Policy:
                        1. Configure Screensaver Management. Our default is 45 minutes with logon.scr as the default SS. Password is always required.
                          • 2010-10-18: For Windows 7 we now use scrnsave.scr as the basis for all screensavers which is a blank screen.
                        2. Mapped Network Drive (M: = \\SS-SBS\Company) via Group Policy Preferences
                        3. Set the Companyweb as the default site in IE.
                        4. Add the RWW and OWA URLs to IE’s Favorites.
                      3. Windows SBSComputers Policy:
                        1. Deploy a restricted domain user to _all_ system’s Local Admin Group.
                          1. Create a new user using the Standard User – Restricted Role.
                          2. Deploy to workstation’s Local Admin Group via Group Policy Preferences.
                          3. Remove the user’s mailbox (previous blog post).
                      4. Default Printer Deployment Policy:
                        1. Deploy printers to XP Professional x86 (previous blog post).
                        2. Deploy printers to Windows Vista using the Printer Management snap-in.
                      5. Windows SBSComputers XP Pro Policy:
                        1. Deploy Windows Defender to Windows XP Professional (Optional).
                    1. Install the server hardware manufacturer’s management software suite.
                    2. Set the SBS Domain Password Polices (60-75 days, 10-12 characters minimum with complexity).
                      • Note that all user’s passwords will reset to request a new password!
                    3. Enable Folder Redirection.
                      • Changing the security settings in the default GPO for redirection will show FR as not enabled in the SBS Console.
                      • We remove the Exclusive Access setting on any folders redirected to remove complications when it comes time to migrate the client to a new server.
                    4. Remove the Public share in the SBS Console.
                    5. If using the self-issued certificate, copy the package to the Network Admin\SBS folder in the Company shared drive. (We create a Network Admin folder in the Company Shared Folder at all client sites).
                      • If using a GoDaddy certificate, make sure to install the GoDaddy Intermediate certificates (download page) into the Intermediate Certification Authorities store individually to avoid any issues later.
                        1.  gd_intermediate.crt
                        2. gd_cross_intermediate.crt
                        3. Disable All Uses for GoDaddy Class 2 root certificate in Trusted Root Certification Authorities.
                        4. Restart the IISAdmin service.
                        5. Install the GoDaddy certificate using the wizard.
                    6. Move the relevant data folders to the L: partition. We move all but the Exchange databases.
                        1. WSS (SharePoint) Data.
                        2. Users’ Shared Folders.
                          1. Re-enable Access-based Enumeration
                        3. Users’ Redirected Folders Data.
                          1. Re-enable Access-based Enumeration
                        4. WSUS Update Repository Data.
                      1. SBS Console Getting Started Tasks.
                          1. Connect to the Internet.
                          2. Customer Feedback options.
                          3. Set up your Internet address.
                          4. Configure a Smart Host for Internet e-mail.
                          5. Add a trusted certificate.
                          6. Configure server backup: Earlier in this checklist.
                          7. Add new users (use the multiple wizard under users if there are a lot of users to add).
                          8. Connect computers: http://connect.
                          9. Share Printers via Group Policy for Windows Vista and PushPrinterConnections.exe for Windows XP Pro SP3 (both links are previous blog posts).
                          10. Set up Office Live Small Business.
                        1. Configure the Reports e-mail addresses.
                        2. Copy Logon Failure XML code (CodePlex site) into a new Event ID Filter and set an e-mail to fire when a failed logon occurs.
                        3. Configure Workstations on the domain.
                        4. Create and configure the Group Policy Central Store.
                        5. Enable an MFP or Copier to Scan To E-mail Destined To A Companyweb SharePoint Library (previous blog post).
                        6. Enable and configure Windows Search Services on SBS 2008 or a Windows Server 2008 RTM/R2 file server and Libraries on Windows 7 (Official SBS Blog post).
                          1. Install the Search Service.
                          2. Add the share to Windows 7 Libraries.
                          3. Click start and start typing and watch those network files results flow!
                        7. Fix the SharePoint 2436 Search errors (Official SBS Blog post).
                        8. Fix the networking settings for Add-On Congestion Control Provider, Receive Window Auto-Tuning Level, Receive-Side Scaling State, Task Offload (previous blog post)
                        9. Download, install, and run the SBS 2008 Best Practices Analyzer.
                          1. The BPA will pick up a lot of the little things that need to be configured such as advanced OS networking features that should be disabled, the SharePoint 2436 error above, and others.
                        10. Change the initial domain administrator’s password if using an Answer File (remember to reset the DHCP credentials, and any Event Log event fired Task too). Note that if the admin account has not been logged off since changing the Password Policies, a log off and log on again will require a password change anyway.
                        11. Configure Custom Views and e-mail Task triggers for Event IDs (SBS Native Tools Management):
                        12. OPTIONS:
                        13. Customize the SBS Console Reports.
                        14. Run a backup. Crash the server. Restore the Backup. Deliver.

                        One thing to keep in mind when it comes to checklists is that they are never meant to be a replacement for the materials they summarize!

                        It is very important to understand why the various steps need to be accomplished, how those steps can change over time due to changes in the operating system, the hardware configurations underneath the OS, and the technician’s own growth in experience and understanding.

                        The “why” leads to an ability to understand how things are going wrong when they do. Note that we are saying, “when” and not “if” things go wrong.

                        Troubleshooting

                        UPDATES:

                        • 2009-05-11: V1.0.1 – Added a step and a few sub steps for Group Policy settings.
                        • 2009-05-14: V1.0.2 – Added the IE SBSUsers settings.
                        • 2009-05-19: V1.1.0 – Added some tweaks and changes to the existing steps.
                        • 2009-05-23: V1.1.1 – Added the option to map the Companyweb site to a network drive.
                        • 2009-05-29: V1.2.0 – Significant changes and adjustments made with some additional steps too.
                        • 2009-09-05: V1.2.1 – Added the option for allowing copiers and MFPs to relay e-mail through to users and a SharePoint library, the Troubleshooting section, and some formatting changes.
                        • 2010-01-14: Numerous updates including the Exchange 2007 SP2 mention.
                        • 2010-01-17: v1.4.1 – Added the need to set up time synchronization as well as cleaned up some HTML code.
                        • 2010-01-27: v1.4.2 – Added the blog post link for configuring the time service step.
                        • 2010-05-01: v1.5.0 – Numerous changes and updates to the process.
                        • 2010-10-18: v1.6.0 – Restructured some of the step’s order to better represent the work flow such as backing up SBS _before_ applying the Exchange service place. Numerous other changes.
                        • 2010-10-25: v1.7.0 – Added some steps and some clarifications for the steps.

                        Philip Elder
                        MPECS Inc.
                        Microsoft Small Business Specialists
                        Co-Author: SBS 2008 Blueprint Book

                        *All Mac on SBS posts will not be written on a Mac until we replace our now missing iMac! (previous blog post)

                        Windows Live Writer

                        Saturday, 1 May 2010

                        SBS 2008 Set Up Guide v1.5.0 Released

                        We just changed our SBS 2008 Setup Guide with a number of additions as well as some restructuring.

                        The Guide is provided to help us provide a consistent install experience for SBS 2008.

                        The more consistent we are in our installs, the simpler troubleshooting becomes if there is a problem with something on the software side of things or the hardware side of things.

                        Having that consistency also makes it a lot easier for a technician working with multiple SBS boxes throughout the day to accomplish their job.

                        BGInfo by SysInternals takes are of putting the server name and IP address on the desktop so that they have one of many visual cues as to which server they are managing.

                        Philip Elder
                        MPECS Inc.
                        Microsoft Small Business Specialists
                        Co-Author: SBS 2008 Blueprint Book

                        *Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

                        Windows Live Writer

                        Tuesday, 21 April 2009

                        SBS 2008 Setup Checklist V1.1.0

                        *I goofed on an update in WLW. The updated post: SBS 2008 Setup Checklist*

                        This will be our preliminary set up checklist for getting an SBS 2008 install configured once the base OS install has completed. This post will compliment what is in our SBS 2008 Blueprint book. It will also provide the foundation for a chapter in our upcoming SBS 2008 Advanced Blueprint book.

                        There will be some minor tweaks and modifications to this list as we go along with our installs. If things change a lot, then we will run a new post and call it V2. :)

                        For the most part, items in the list will be fleshed out in the SBS 2008 Blueprint book. Items that we have encountered beyond the book, will be addressed in existing or subsequent blog posts.

                        The following assumes that the server manufacturer’s prep disk was used to update the BIOS, motherboard firmware, RAID controller firmware, backplane firmware, and any other device’s onboard firmware prior to installing the SBS 2008 OS. The firmware update step is an absolutely critical one for the stability of the server.

                        Here is our list so far:

                        1. Install the manufacturer’s drivers.
                          1. RAID including RAID monitoring/status software.
                          2. Chipset.
                          3. Video.
                          4. NIC (Do not team). Unplug or disable any extra NICs for now.
                        2. GUI Customization
                          1. Windows Explorer.
                          2. Start Menu.
                          3. Notification Area.
                          4. Add a Desktop Toolbar to the Task Bar .
                          5. Internet Explorer .
                          6. Task Manager Process Column Customization.
                        3. Partitioning
                          • RAID 1+0 is our default (4 disks) + hot spare. Name after the amount of storage is the drive label.
                            • 640GB (4x 320GB SATA)
                            • C: 100GB SS-SBS (Rename to SBS name)
                            • S: 25GB SwapFile (8GB RAM * 1.5 with wiggle room)
                            • L: 515GB NetworkData
                        4. Move the optical drive letter to Z:.
                        5. Move the Swap File (Reboot).
                        6. Install and configure Print Services Role: SBS 2008 Terminal Services and HP Printer Drivers (previous blog post).
                        7. Windows Native Tools Management Console mods
                          1. Add the Group Policy Management Console
                          2. Add the Print Management snap-In (after adding the Print Server Role).
                          3. Add the Share and Storage Management snap-in.
                          4. Add the File Server Resource Manager snap-in.
                          5. Add the Windows Server Backup snap-in.
                        8. Run MMC and add the local Computer Certificate store snap-in and save to the desktop for later use.
                        9. Enable Access-based Enumeration on the NetworkData partition.
                        10. Enable ShadowCopies on the NetworkData partition and set a schedule. We use before hours, coffee, lunch, coffee, and after hours for the schedule.
                        11. DHCP IPv4 Properties (DNS updates & credentials)
                        12. DHCP additional exclusions for printers (x.1-10) and servers (x.250-254).
                        13. DNS Settings for Scavenging.
                        14. Create a 5GB Soft Quota (File Server Resource Manager).
                        15. Add Network Service to IIS WAMREG admin service to eliminate DCOM 10016 errors in the event logs (links to MS KB920783 article).
                        16. Enable firewall logging and pop-ups: SBS 2008 Windows Firewall with Advanced Security troubleshooting (previous blog post).
                        17. Create the default Company Shared Folder with required NTFS and share permissions on the L: NetworkData partition.
                          • Share Name: Company.
                          • Quota: 5GB Soft.
                          • Enable Access-based Enumeration.
                          • NTFS Permissions:
                            • Domain Admins = FULL.
                            • Domain Users = Modify.
                          • Share Permissions:
                            • Domain Admins = FULL.
                            • Domain Users = FULL.
                        18. Create the ClientApps (previous blog post on GP and the ClientApps folder) on the L: NetworkData partition.
                          • Share Name: ClientApps.
                          • Quota: None.
                          • Enable Access-based Enumeration. Subfolders can have custom permissions at a later date to exclude users or groups and thus hide those subfolders at a later date.
                          • NTFS and Share Permissions:
                            • Domain Admins = FULL.
                            • Domain Users = FULL.
                            • Domain Controllers = FULL.
                            • Domain Computers = FULL
                        19. WSUS Classifications: Enable all except Drivers.
                        20. WSUS Sync Schedule: Increase synchronization frequency schedule depending on what products are installed on the server.
                        21. WSUS Updates: Add an automatic approval for Definition Updates.
                        22. Exchange Server 2007 Rollup Install (previous blog post). Microsoft Download site search for Exchange 2007 rollup (Microsoft Download Site Search). Check to make sure there are no newer rollups.
                        23. Server Updates via WSUS/MU.
                        24. Group Policy Configurations (previous blog post):
                          1. Default Computer Policy:
                            1. Local Policies: User Rights Assignment.
                            2. Local Policies: Security Options.
                              1. Enable UAC by default in Group Policy (previous blog post).
                            3. Remote Connectivity: Remove the Disconnect option from the Start Menu and add the Windows Security option.
                          2. Windows SBSUsers Policy:
                            1. Configure Screensaver Management. Our default is 45 minutes with logon.scr as the default SS. Password is always required.
                            2. Mapped Network Drive (M: = \\SS-SBS\Company) via Group Policy Preferences
                            3. Set the Companyweb as the default site in IE.
                            4. Add the RWW and OWA URLs to IE’s Favorites.
                          3. Windows SBSComputers Policy:
                            1. Set up restricted domain user (no e-mail too), deploy to workstations via GPPref, and move new user to Local Administrators group via GPPref as well.
                          4. Default Printer Deployment Policy:
                            1. Deploy printers to XP Professional x86 (previous blog post).
                            2. Deploy printers to Windows Vista using the Printer Management snap-in.
                          5. Windows SBSComputers XP Pro Policy:
                            1. Deploy Windows Defender to Windows XP Professional (Optional).
                        25. Set up Windows Live OneCare if needed. (Soon not to be – SBS Blog)
                        26. Install the server hardware manufacturer’s management software suite.
                        27. Set the SBS Domain Password Polices (60 days, 10 characters minimum).
                        28. Enable Folder Redirection.
                        29. Remove the Public share in the SBS Console.
                        30. If using the self-issued certificate, copy the package to the Network Admin\SBS folder in the Company shared drive. (We create a Network Admin folder in the Company Shared Folder at all client sites)
                        31. Move the relevant data folders to the L: partition. We move all but the Exchange databases.
                          1. WSS (SharePoint) Data.
                          2. Users’ Shared Folders.
                          3. Users’ Redirected Folders Data.
                          4. WSUS Update Repository Data.
                        32. SBS Console Getting Started Tasks.
                          1. Connect to the Internet.
                          2. Customer Feedback options.
                          3. Set up your Internet address.
                          4. Configure a Smart Host for Internet e-mail.
                          5. Add a trusted certificate.
                          6. Configure server backup: 12:30, 17:30, 23:00.
                          7. Windows Live OneCare for Server.
                          8. Add new users (use the multiple wizard under users if there are a lot of users to add).
                          9. Connect computers: http://connect.
                          10. Share Printers via Group Policy for Windows Vista and PushPrinterConnections.exe for Windows XP Pro SP3 (both links are previous blog posts).
                          11. Set up Office Live Small Business.
                        33. Configure the Reports e-mail addresses.
                        34. Copy Logon Failure XML code (CodePlex site) into a new Event ID Filter and set an e-mail to fire when a failed logon occurs.
                        35. Configure Workstations on the domain.
                        36. Create and configure the Group Policy Central Store.
                        37. Download, install, and run the SBS 2008 Best Practices Analyzer.
                        38. Change the initial domain administrator’s password if using an Answer File (remember to reset the DHCP credentials, and any Event Log event fired Task too). Note that if the admin account has not been logged off since changing the Password Policies, a log off and log on again will require a password change anyway.
                        39. Configure Custom Views and e-mail Task triggers for Event IDs (SBS Native Tools Management):
                        40. OPTIONS:
                        41. Customize the SBS Console Reports.
                        42. Run a backup. Crash the server. Restore the Backup. Deliver.

                        One thing to keep in mind when it comes to checklists is that they are never meant to be a replacement for the materials they summarize!

                        It is very important to understand why the various steps need to be accomplished, how those steps can change over time due to changes in the operating system, the hardware configurations underneath the OS, and the technician’s own growth in experience and understanding.

                        The “why” leads to an ability to understand how things are going wrong when they do. Note that we are saying, “when” and not “if” things go wrong.

                        UPDATED 2009-05-11: V1.0.1 – Added a step and a few sub steps for Group Policy settings.

                        UPDATED 2009-05-14: V1.0.2 – Added the IE SBSUsers settings.

                        UPDATED 2009-05-19: V1.1.0 – Added some tweaks and changes to the existing steps.

                        Philip Elder
                        MPECS Inc.
                        Microsoft Small Business Specialists
                        Co-Author: SBS 2008 Blueprint Book

                        *All Mac on SBS posts will not be written on a Mac until we replace our now missing iMac! (previous blog post)

                        Windows Live Writer

                        Tuesday, 17 March 2009

                        SBS 2008 – New CodePlex URL and Backup Failure Filter Added

                        We just uploaded the XML to create a custom Event Viewer filter for failed backups onto the SBS CodePlex site. Once that XML has been set into a custom view in the Event Viewer we can attach a task to fire an e-mail off to us if the backup does indeed fail.

                        09-03-17 SBS 2008 CodePlex Site

                        SBS CodePlex 

                        Note that the previous URL to access the CodePlex site was:

                        The new URL is:

                        Have a look at the various SBS Console custom alerts as well as the custom Event Viewer filters that are to be found on the site.

                        The XML code on the site can be packaged up and become part of the SBS setup done for production SBS 2008 boxes by default.

                        Philip Elder
                        MPECS Inc.
                        Microsoft Small Business Specialists
                        Co-Author: SBS 2008 Blueprint Book

                        *All Mac on SBS posts will not be written on a Mac until we replace our now missing iMac! (previous blog post)

                        Windows Live Writer