SBS 2011 Setup Guide v1.13.0

This list is the guide that we use to set up our SBS 2011 boxes or VMs in a consistent manner. As with earlier versions of SBS, this version too will require a number of post OS install tweaks and configuration steps.

• TechNet: SBS 2011 Release Notes
• Microsoft Support: KB2483007 Windows SBS 2011 Standard Known Post Installation Event Log Errors and Warnings

The following assumes that the server manufacturer’s prep disk was used to update the BIOS, motherboard firmware, RAID controller firmware, backplane firmware, and any other device’s onboard firmware prior to installing the SBS 2008 OS. The firmware update step is an absolutely critical one for the stability of the server.

Note that we do not input the Product Key into the OS until we are ready to put the server into production or are on the edge of finishing up a migration.

The SBS 2011 Setup Steps

1. When installing into a VM set the time.

   • MPECS Inc. Blog: Hyper-V- Preparing A High Load VM For Time Skew
   • Standalone: When virtualizing SBS on a standalone server set the host to poll pool.ntp.org for the correct time. Configure the host’s firewall to allow NTP polling on the local subnet. Then set the SBS VM to poll the host’s IP or hostname for time using the above settings.
   • Clustered: Have the standalone DC polling pool.ntp.org and set as the authoritative time source for the domain. Have SBS and other VMs poll the standalone DC for their time using the above settings.

2. Install the manufacturer’s drivers.

   1. RAID including RAID monitoring/status software.
   2. Chipset.
   3. Video.
   4. NIC (Do not team). Unplug or disable any extra NICs for now.
   5. Management suites from the hardware manufacturers will be installed later on in this process.
   6. We do not install System Center Essentials that is provided by Intel on our Intel based SBS 2008 servers.

3. Desktop

   1. Set the desktop resolution for the monitor attached.
      • Keep in mind that some remote management modules such as Dell’s DRAC may not work if the monitor’s resolution is set too high.
   2. Enable desktop icons:
      1. Click Start –> type: Desktop Icons [Enter].
         • 

4. GUI Customization

   1. Windows Explorer.
      • Extensions, Show hidden . . .
      • 
      • 
   2. Start Menu.
   3. Notification Area.
      •  
      • Remove the Speaker from the System Tray.
        • 
   4. Add a Desktop Toolbar to the Task Bar .
      • 
   5. Internet Explorer.
      1. Add http://download.microsoft.com to Trusted Sites.
   6. Task Manager Process Column Customization.
      • PID, memory usage, maximum memory usage, I/O Bytes (3)

5. Partitioning

   • NEW: RAID 5 with 4x 15K SAS Spindles (four drives) is now our default RAID setup for small clients.
     • For our 8-15 seat clients we will configure 5 15K SAS spindles in RAID 5 plus a hot spare depending on their I/O requirements.
     • With the advent of the 300GB and 600GB Intel 320 Series SSDs we are looking to SSD going forward for those clients that require ultra-high performing storage systems.
     • For clients with around 15 seats or more we are starting to configure a standalone 1U server for virtualization or Hyper-V Cluster directly attached to a Promise VTrak RAID Subsystem (VTE310sD or VTE610sD) for maximum storage flexibility.
   • Name after the amount of storage is the drive label.
     • ~900GB Usable (4x 300GB 15K SAS)
     • C: 150GB SS-SBS (Rename to SBS server name)
     • S: 1.5x RAM xxGB SwapFile (Min. 10GB RAM * 1.5 with wiggle room)
       • 32GB SwapFile
       • SBS 2011 swap file configuration out of the box:
         •  
     • L: 718GB WorkingStorage
   • Note: Exchange 2010 has been designed from the ground up to utilize more RAM. Adding more RAM for Exchange performance would be our priority before adding more spindles to the RAID 10 set.
   • Also, we do not install SATA hard drives of any kind into server settings anymore. In our experience they are too problematic in RAID arrays no matter which manufacturer made them. 
   • MPECS Inc. Blog: SAS versus SATA and Hardware RAID versus Software RAID.
6. Move the optical drive letter to Z:.
7. Move the Swap File (Reboot).

8. SBS 2011: Do _not_ Copy and paste this services shutdown batch file onto the desktop (previous blog post).

   • The Exchange 2010 team has addressed the issues of having Exchange installed on a DC with this version. Exchange 2007 had shutdown timing issues thus the long shutdown times.
9. Install and configure Print Services Role: SBS 2008 Terminal Services and HP Printer Drivers (previous blog post).
   • 

10. Windows Native Tools Management Console modifications

    1. Add the Group Policy Management Console
    2. Add the Print Management snap-In (after adding the Print Server Role).
    3. Add the Share and Storage Management snap-in.
    4. Add the File Server Resource Manager snap-in.
    5. Add the Remote Desktop Services Manager snap-in.
    6. Add the Windows Server Backup snap-in.
       • 
11. Configure an authoritative time source for the SBS OS.
    1. Blog Post: Hyper-V- Preparing A High Load VM For Time Skew
       • This is the best methodology to date for setting up a VM’s Windows Time Service.
    2. Blog Post: SBS 2008 Physical And Hyper-V – Set Up the Domain Time Structure.
       • The default time.windows.com is not a reliable source.
    3. TechNet: Synchronize the Source Server time with an external time source for Windows SBS 2008 migration.
    4. Once the commands have run, an error message or two may show in the Event Logs soon to be replaced by a successful connection to the authoritative time source.
    5. Note Oliver Sommer’s comments in the above article.

12. Enable ShadowCopies on the WorkingStorage partition and set a schedule. We use before hours, coffee, lunch, coffee, and after hours for the schedule.

13. DHCP IPv4 Properties (DNS updates & credentials)
    • 
    • Enable Name Protection and set the credentials.
14. DHCP additional exclusions for printers (x.1-10 if not present) and servers (x.250-254).
15. DNS Settings for Scavenging at 7 days and AD integrated zones.
16. Verify NIC Binding Order Settings: Blog Post: Slow Network Speeds with SBS 2008 and 2011: NIC Binding Order
17. Create a 10GB Soft Quota (File Server Resource Manager).
18. Enable firewall logging and pop-ups: SBS 2008 Windows Firewall with Advanced Security troubleshooting (previous blog post).
    1. Customize the firewall setup for QuickBooks.
       1. QuickBooks Connection Diagnostic Tool Post (Previous blog post).
    2. Customize the firewall setup for Simply Accounting (Previous blog post).

19. Create the default Company Shared Folder with required NTFS and share permissions on the L: WorkingStorage partition.

    • Share Name: Company.
    • Quota: 10GB Soft.
    • Enable Access-based Enumeration.
    • NTFS Permissions:
      • Domain Admins = FULL.
      • Domain Users = Modify.
      • Leave default machine based permissions.
    • Share Permissions:
      • Everyone = FULL.

20. Create the ClientApps (previous blog post on GP and the ClientApps folder) on the L: WorkingStorage partition.

    • Share Name: ClientApps.
    • Quota: None.
    • Enable Access-based Enumeration. Subfolders can have custom permissions at a later date to exclude users or groups and thus hide those subfolders at a later date.
    • NTFS Permissions:
      • Domain Admins = FULL
      • Domain Users = FULL
      • Domain Controllers = FULL
      • Domain Computers = FULL
    • Share Permissions:
      • Everyone = FULL
21. Make changes to the WSUS Setup:
    • WSUS Classifications: Enable all.
    • WSUS Sync Schedule: Increase synchronization frequency schedule depending on what products are installed on the server.

22. Getting Started Tasks – Out of Order

    1. Configure and take a backup now.
    2. Times: 12:30, 17:30, 23:30.
       • Make sure that the backup times and the Volume Shadow Copy snapshots do not happen at the same time.
    3. Backup Now by right clicking on the configured backup and running it.

    4. Backup in between each batch of updates.

23. Windows Server 2008 R2 Service Packs

    1. Download and install the latest Windows Server 2008 R2 Service Pack (Bing Search)
       1. Be aware that the install process may take a while.
       2. 

24. Exchange 2010 Updates

    • Out of the box SBS 2011 has Exchange 2010 SP1 installed.
      • Exchange Update Rollup Search on Microsoft Downloads
      • Exchange Service Pack Search on Microsoft Downloads

25. Server Updates via WSUS/MU.

    • Update to the latest SBS Update Rollup first.
    • Run updates according to the following product groups:
    • Windows Server 2008 Standard R2
      • Run OS Updates at around 10-15 per reboot cycle.
      • Run OS Security Updates at around 5-10 per reboot cycle.
    • Exchange SP1/2/3 or Exchange Rollup RU1/2/3/etc 
    • .NET
      • If .NET v1 is present update first.
      • Do .NET v2 and v2.x updates one at a time.
      • Do .NET v3 and v3.x updates one at a time.
      • Do .NET v4 and v4.x updates one at a time.
      • Reboot between each cycle as requested.
    • SQL
      • Start with 2005 versions.
      • Next to 2008 versions.
      • Next to 2008 R2 versions.
    • WSUS, and others.
    • SharePoint Foundation Updates should be run separately.
      • Back Up Before SharePoint Updates!
      • NOTE: Official SBS Blog: You Must Manually Run PSCONFIG after Installing SharePoint 2010 Patches
26. Create a new User Role in the SBS Console.
    • Name: Standard User – Restricted.
    • Remove all Group Memberships.
    • Add the Domain Users security group only.
    • Remove OWA permission.
    • No RWW or VPN.
    • Verify permissions in the User Role after it is created.
    • This role is used for the local admin account deployed via Group Policy later in this guide.

27. Create and configure the Group Policy Central Store (Previous blog post).

28. OPTION: Raise both Domain and Forest Functional level to 2008 R2

    • This is accomplished in AD Domains and Trusts.

    • 

29. Group Policy Configurations (previous blog post):

    1. Windows Computer Policy:
       1. Firewall Exceptions:
       1. Enable Remote Event Log Management (previous blog post).
       2. Remote Volume Management
       3. Remote Desktop Protocol and RemoteFX Protocol
       2. Set limits to the RDP setup on the server and clients (previous blog post).
       3. Local Policies: User Rights Assignment.
       4. Local Policies: Security Options.
          • Enable UAC by default in Group Policy (previous blog post).
          • NOTE: The UAC structure can be split up between Computers, SBSComputers, and SBSServers GPOs so that domain/local admin accounts only get prompted on servers.
       5. Remote Connectivity: Restrict certain RDP related settings (previous blog post).
    2. Windows SBSUsers Policy:
       1. Configure Screensaver Management. Our default is 45 minutes with logon.scr as the default SS. Password is always required.
          • 2010-10-18: For Windows 7 we now use scrnsave.scr as the basis for all screensavers which is a blank screen.
       2. Mapped Network Drive (M: = \\SS-SBS\Company) via Group Policy Preferences
       3. Set the Companyweb as the default site in IE.
       4. Add the RWW and OWA URLs to IE’s Favourites.
    3. Windows SBSComputers Policy:
       1. Deploy a restricted domain user to _all_ system’s Local Admin Group.
          1. Create a new user using the Standard User – Restricted Role.
          2. Deploy to workstation’s Local Admin Group via Group Policy Preferences.
          3. Remove the user’s mailbox (previous blog post).
    4. Windows Printer Deployment Policy:
       1. Deploy printers to XP Professional x86 (previous blog post).
       2. Deploy printers to Windows Vista using the Printer Management snap-in.
    5. Windows SBSComputers XP Pro Policy:
       1. Deploy Windows Defender to Windows XP Professional (Optional).
30. Install the server hardware manufacturer’s management software suite.
31. Set the SBS Domain Password Polices (60-75 days, 10-12 characters minimum with complexity).
    • Note that all user’s passwords will reset to request a new password!
32. Enable Folder Redirection to SBS.
    • Changing the security settings in the default GPO for redirection will show FR as not enabled in the SBS Console.
    • We remove the Exclusive Access setting on any folders redirected to remove complications when it comes time to migrate the client to a new server.
33. OR: Enable Folder Redirection to an separate server (previous blog post).
34. Remove the Public share in the SBS Console.
35. Self-issued certificate: copy the package to the Network Admin\SBS folder in the Company shared drive. (We create a Network Admin folder in the Company Shared Folder at all client sites).
36. If using a GoDaddy certificate, make sure to install the GoDaddy Intermediate certificates (download page) into the Intermediate Certification Authorities store individually to avoid any issues later.
    1. Install the gd_cross_intermediate.crt first
    2. Install the gd_intermediate.crt second
    3. Disable All Uses for GoDaddy Class 2 root certificate in Trusted Root Certification Authorities if present.
       • Check for this one after installing the actual certificate at step 5.
    4. Restart the IISAdmin service.
    5. Install the GoDaddy certificate using the wizard.

37. Move the relevant data folders to the L: partition. We move all but the Exchange databases.

    1. WSS (SharePoint) Data.
    2. Users’ Shared Folders.
       1. Re-enable Access-based Enumeration
    3. Users’ Redirected Folders Data.
       1. Re-enable Access-based Enumeration
    4. WSUS Update Repository Data.

38. SBS Console Getting Started Tasks.

    1. Connect to the Internet.
    2. Customer Feedback options.
    3. Set up your Internet address.
    4. Configure a Smart Host for Internet e-mail.
    5. Add a trusted certificate.
    6. Configure server backup: Earlier in this checklist.
    7. Add new users (use the multiple wizard under users if there are a lot of users to add).
    8. Connect computers: http://connect.
    9. Share Printers via Group Policy for Windows Vista and PushPrinterConnections.exe for Windows XP Pro SP3 (both links are previous blog posts).
39. Configure the Reports e-mail addresses.
40. Configure Workstations on the domain.
41. Official SBS Blog: How to Configure SBS 2011 Standard to Accept E-mail for Multiple Authoritative Domains
42. E-mail Enable the SharePoint Foundation Companyweb site (Official SBS Blog Post).  Then:
43. Enable an MFP or Copier to Scan To E-mail Destined To A Companyweb SharePoint Library (previous blog post).
    1. Run the following in an elevated Exchange Management Shell to increase the allowed attachment size (100MB is our default):
       1. Set-ReceiveConnector "Copier Send to E-mail" -MaxMessageSize 100MB
    2. Make sure to verify the largest file size setting in SharePoint.
       1. Aimless Ramblings: Large Files in SBS 2008’s Companyweb
44. OPTION: If using Exchange 2010 AntiSpam set up a library on Companyweb called Spam.
1. E-mail enable the library with spam@companyweb
2. Set Exchange AntiSpam to REDIRECT instead of DELETE to spam@companyweb
45. Change the Default Message Size Limits for outgoing and inbound messages in the Exchange Management Shell:
    1. Set-TransportConfig –MaxSendSize 25MB –MaxReceiveSize 25MB
    2. Set-ReceiveConnector “Windows SBS Internet Receive ServerName” –MaxMessageSize 25MB
    3. Set-SendConnector “Windows SBS Internet Send ServerName” –MaxMessageSize 25MB
    4. Check the status for each connector:
       • Get-TransportConfig | ft name, MaxSendSize, MaxReceiveSize
       • Get-ReceiveConnector | ft name, MaxMessageSize
       • Get-SendConnector | ft name, MaxMessageSize
       • Get-mailbox | ft name, MaxSendSize, MaxReceiveSize
    5. Hat Tip: LAN-Tech: Quickie: changing message size limits on SBS STD 2008 and 2011
46. Enable Single Item Recovery in Exchange Server 2010 – Exchange Team Blog.
47. Enable and configure Windows Search Services on SBS 2008 or a Windows Server 2008 RTM/R2 file server and Libraries on Windows 7 (Official SBS Blog post).
    1. Install the Search Service (On SBS 2011 it may already be installed).
       1. If so: Click Start –> type Search.
       2. Click Indexing Options in the results.
          • 
       3. Verify that all company shared folders are being indexed.
    2. Add the Company folder share (or Public folder share) to Windows 7 Libraries.
    3. Click start and start typing and watch those network files results flow!
48. Fix the networking settings for Add-On Congestion Control Provider, Receive Window Auto-Tuning Level, Receive-Side Scaling State, Task Offload (previous blog post).
    • SBS 2008 related … tentative at this point.
49. Download, install, and run the SBS 2011 Best Practices Analyzer.
    • The BPA will pick up a lot of the little things that need to be configured such as advanced OS networking features that should be disabled and others.
    • The SBS 2011 BPA requires the Microsoft Baseline Configuration Analyzer 2.0.
50. Change the initial domain administrator’s password if using an Answer File (remember to reset the DHCP credentials, and any Event Log event fired Task too).
    • Note that if the admin account has not been logged off since changing the Password Policies, a log off and log on again will require a password change anyway.

51. Input the PID and Activate.

52. Control the Microsoft##SSEE WSUS Database’s memory Usage

    • SBS 2011 – WSUS SQL Memory Usage Is Very High – How To Reduce It

53. Configure Custom Views and e-mail Task triggers for Event IDs (SBS Native Tools Management):

    • E-mail on Event IDs for low disk space (previous blog post).
    • E-mail on Event ID for Failed Logon Attempts (previous blog post). SBS Console flag also in this post.
    • E-mail on Event ID for Failed Backup.

54. OPTIONS:

    • Configure a mapped network drive for the Companyweb SharePoint site (previous blog post).
    • Configure TS to allow two concurrent connections to the server (useful for training or working with someone on a problem).
    • Configure BGInfo to publish on all desktops (previous blog post).
    • Configure a GPO setting with an XP WMI filter and deliver WindowsDefender to all XP Pro workstations via GP.
    • Copy Logon Failure XML code (CodePlex site) into a new Event ID Filter and set an e-mail to fire when a failed logon occurs.

55. Customize the SBS Console Reports.

    • SBS Console XML Customizations on CodePlex.
    • SBSDeveloper.com: SBS Reporting Plugins XML.

56. Run a backup. Crash the server. Restore the Backup. Deliver.

One thing to keep in mind when it comes to checklists is that they are never meant to be a replacement for the materials they summarize!

It is very important to understand why the various steps need to be accomplished, how those steps can change over time due to changes in the operating system, the hardware configurations underneath the OS, and the technician’s own growth in experience and understanding.

The “why” leads to an ability to understand how things are going wrong when they do. Note that we are saying, “when” and not “if” things go wrong.

Troubleshooting

Post OS Setup

• Microsoft Indicated
  • The Official SBS Blog: The Ultimate Guide to SBS 2008 Setup Failures
  • A huge list of the various things that can impact a good install of SBS 2008/2011 Standard.
  • Microsoft KB 2483007: Windows SBS 2011 Standard Known Post Installation Event Log Errors and Warnings
    • EventID 6772 SharePoint timer
    • DCom 10016 spfarm
    • EventID 6 SBS datacollectorservice
    • EventID 8230 on VSS status 1376
• SBS 2011 OS related
  • SBS VM time keeps loosing synchronization with the correct time.
    • Blog Post: Hyper-V- Preparing A High Load VM For Time Skew
  • Blog Post: SBS 2011 Error – WBCommandletInBuiltTracing failed to start 0xC0000035
    • This condition exists in the RTM/Gold build. It is not a show stopper.
  • Blog Post: SBS 2011 Standard Setup Crashes Unexpectedly- Error- Cannot commit configuration changes because
  • Blog Post: .
• Exchange 2010 Related
  • Blog Post: SBS 2011 – Exchange Services Do Not Start
• SharePoint Foundation Related
  • Blog Post: SBS 2011 – SharePoint Foundation Event ID 6398 – Access Denied Every 30 Minutes
• Microsoft Knowledgebase Articles and Hotfixes
  • Trend Micro and other AntiVirus vendors that still use TDI.SYS
    • Microsoft Support: KB2493361: Slow Network Performance on SBS 2011
  • Microsoft KB 2489744: Windows SBS 2011 Standard Certificate may fail to install on a Vista or Windows 7 Client

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer