Unit 1: Installing Windows Server, Configuring Network & Creating a Virtual Environment — Comprehensive Study Guide

1. Enterprise System Administration & Windows Server Deployment Planning

1.1 The Role of the Modern System Administrator

System administration in an enterprise environment involves orchestrating hardware, operating platforms, directory services, and network connectivity to guarantee business continuity, operational resilience, and stringent security. An effective administrator balances workload availability with principle-of-least-privilege security postures and scalable capacity planning.

CODECopy Code
+-----------------------------------------------------------------------------------+
|                         ENTERPRISE SERVER LIFECYCLE                               |
|                                                                                   |
|  [Capacity Planning] ──> [Hardware Provisioning] ──> [OS Installation / Core]    |
|           │                                                    │                  |
|           v                                                    v                  |
|  [Security Baseline] <── [Hyper-V Virtualization] <── [Network & NIC Teaming]    |
+-----------------------------------------------------------------------------------+

1.2 Workload Profiling and Server Edition Selection

Before deployment, administrators evaluate technical requirements against Windows Server licensing and edition capabilities:

1. Windows Server Standard Edition:
   • Designed for physical or lightly virtualized environments.
   • Grants rights to run up to two Operating System Environments (OSEs) or Hyper-V containers per license pack when all physical cores on the server are licensed.
   • Supports core roles including Active Directory Domain Services (AD DS), DNS, DHCP, Print Services, and Web (IIS).
2. Windows Server Datacenter Edition:
   • Built for highly virtualized private and hybrid cloud architectures.
   • Provides rights to run unlimited Hyper-V virtual machines and containers.
   • Exclusive advanced capabilities: Storage Spaces Direct (S2D), Shielded Virtual Machines, Host Guardian Service, and software-defined networking (SDN) stacks.
3. Windows Server Essentials Edition:
   • Aimed at small enterprises (up to 25 users and 50 devices).
   • Does not require client access licenses (CALs) but lacks clustering, Hyper-V nested virtualization, and enterprise directory scaling.

1.3 Installation Mode: Server Core vs. Desktop Experience

A foundational architectural decision during setup is choosing between Server Core and Desktop Experience:

2. Server Hardware Architecture & Remote Management

2.1 Enterprise Hardware Form Factors

• Rackmount Servers (1U, 2U, 4U): Standardized 19-inch rack units. High density, ideal for enterprise data centers with central power distribution units (PDUs) and raised-floor cooling.
• Blade Servers: Ultra-dense compute modules slotted into a shared chassis providing centralized redundant power supplies, shared high-speed backplanes, and consolidated cooling fans.
• Tower Servers: Standalone upright units suited for branch offices or small businesses without dedicated server rooms.

2.2 Redundancy and Fault Tolerance

Production servers must eliminate single points of failure (SPOF):

• Redundant Power Supplies (1+1 or 2+2): Hot-swappable power supplies plugged into separate, out-of-phase power circuits or uninterruptible power supply (UPS) units.
• Error-Correcting Code (ECC) Memory: Memory architecture that detects and corrects single-bit memory corruptions dynamically, preventing silent system crashes.
• Hot-Pluggable Storage: SAS/NVMe drives configured in hot-swap caddies that allow disk replacement while the storage controller and OS remain fully operational.

2.3 Out-of-Band (OOB) Hardware Management

Out-of-band management operates on a dedicated processor embedded on the motherboard with an independent network interface:

• Dell iDRAC (Integrated Dell Remote Access Controller)
• HPE iLO (Integrated Lights-Out)
• Lenovo XClarity Controller (XCC)
• IPMI (Intelligent Platform Management Interface): Industry standard protocol.

Capabilities: Remote bare-metal power cycling, virtual KVM (keyboard, video, mouse) over IP, remote ISO mounting, thermal monitoring, hardware event logs (SEL), and out-of-band BIOS/firmware flashing even when the host operating system is completely crashed or powered down.

3. Installation Workflows, Sysprep, and Deployment Services

3.1 Installation Strategies

1. Interactive Clean Install: Booting from UEFI USB/DVD installation media, executing manual disk partitioning via Windows Setup, and applying initial local administrative passwords.
2. In-Place Upgrade: Upgrading an existing server OS to a newer release while preserving configuration, installed roles, and data. Highly discouraged in production due to configuration drift and compatibility bugs.
3. Automated / Unattended Deployment: Utilizing an answer file (autounattend.xml) placed on installation media to automate regional settings, disk partitioning, product keys, local administrator credentials, and post-installation command execution.

3.2 System Preparation Tool (Sysprep.exe)

When cloning virtual machine master images or deploying standardized templates, every system must receive a unique Security Identifier (SID). Duplicating images without generalization leads to catastrophic WSUS, Active Directory, and domain enrollment collisions.

powershellCopy Code
# Executing Sysprep to generalize hardware configuration and regenerate SIDs
C:\Windows\System32\Sysprep\sysprep.exe /generalize /oobe /shutdown

• /generalize: Strips system-specific hardware drivers, unique machine GUIDs, and the Windows Security Identifier (SID).
• /oobe: Configures the machine to enter Out-of-Box Experience on next power-on.
• /shutdown: Powers down the machine immediately so the disk image can be captured without boot modifications.

3.3 Windows Deployment Services (WDS) and PXE

• Preboot Execution Environment (PXE): Network protocol operating over DHCP and TFTP that allows network interface cards (NICs) with PXE-enabled ROMs to download a network boot image (wdsnbp.com or bootx64.efi) and boot into Windows Preinstallation Environment (WinPE).
• WDS Workflow:
  1. Client sends a DHCP Discover with PXE options (Option 60/66/67).
  2. WDS responds with the TFTP server address and the NBP (Network Bootstrap Program) path.
  3. Client boots into boot.wim (WinPE) across the network.
  4. WinPE executes setup and installs install.wim directly to the target system's disk.

4. Physical Network Infrastructure, Cabling & Interface Teaming

4.1 Copper vs. Fiber Cabling Baselines

• Cat6 UTP: Supports 1 Gbps up to 100 meters, and 10 Gbps up to 55 meters in low-crosstalk environments.
• Cat6a STP/FTP: Enhanced shielding, supports 10 Gbps up to the full 100-meter channel distance.
• Multi-Mode Fiber (MMF - OM3/OM4): Uses LED/VCSEL 850nm lasers; optimized for short-reach backbone connections within data centers (up to 300–400 meters for 10G/40G).
• Single-Mode Fiber (SMF - OS2): Uses 1310nm/1550nm narrow laser wavelengths; designed for long-haul metropolitan campus connections exceeding 10 km.

4.2 NIC Teaming (Load Balancing and Failover - LBFO)

NIC Teaming aggregates multiple physical network adapters into a single logical virtual adapter (t-team) to provide fault tolerance and cumulative egress bandwidth.

CODECopy Code
+-----------------------------------------------------------------------------------+
|                            NIC TEAMING ARCHITECTURE                               |
|                                                                                   |
|                      [Logical Team Interface (t-team)]                            |
|                                     │                                             |
|                     +---------------+---------------+                             |
|                     │                               │                             |
|          [Physical Adapter 1]             [Physical Adapter 2]                    |
|             (10 Gbps Port)                   (10 Gbps Port)                       |
|                     │                               │                             |
|                     v                               v                             |
|             [Switch Port 1]                  [Switch Port 2]                      |
|          (Top-of-Rack Switch A)           (Top-of-Rack Switch B)                  |
+-----------------------------------------------------------------------------------+

Teaming Modes:

1. Switch Independent:
   • Physical switches are unaware of the team.
   • Network adapters can be connected to two different, non-stacked physical switches for complete upstream redundancy.
2. Switch Dependent:
   • Requires switch collaboration.
   • Static Teaming (IEEE 802.3ad draft): Manually configured port channels.
   • LACP (Link Aggregation Control Protocol - IEEE 802.1ax / 802.3ad): Dynamically negotiates port aggregation between host and switch, automatically detecting link failures.

Load Distribution Algorithms:

• Address Hash: Hashes packet attributes (IP addresses and TCP ports) to assign traffic flows across physical adapters.
• Hyper-V Port: Binds specific virtual machines to distinct physical adapters in the team.
• Dynamic: Combines aspects of address hash and round-robin flowlets; optimal distribution for general workloads in Windows Server.

5. Enterprise IP Addressing, Subnetting & Infrastructure Services

5.1 Subnetting and Classless Inter-Domain Routing (CIDR)

Enterprise subnets segment broadcast domains, reduce broadcast traffic storms, and enforce security perimeters.

• Subnet mask determines the boundary between Network ID and Host ID.
• Total hosts per subnet formula: $2^{(32 - \text{prefix})} - 2$ (subtracting Network Address and Directed Broadcast Address).

5.2 Dynamic Host Configuration Protocol (DHCP) DORA Process

DHCP automates IPv4/IPv6 allocation across clients:

1. Discover (Broadcast): Client transmits DHCPDISCOVER on UDP port 67 to 255.255.255.255.
2. Offer (Unicast/Broadcast): DHCP server reserves an IP and sends DHCPOFFER with proposed IP, lease duration, subnet mask, default gateway, and DNS servers.
3. Request (Broadcast): Client announces acceptance of the offer via DHCPREQUEST (informing other DHCP servers to release their reserved offers).
4. Acknowledge (Unicast/Broadcast): Server confirms the lease commitment with DHCPACK.

Relay Agents: Routers or IP Helper addresses (ip helper-address <DHCP_IP>) that forward broadcast DHCP packets across layer-3 network boundaries to centralized DHCP servers.

5.3 Domain Name System (DNS) Architecture

DNS provides hierarchical hostname-to-IP resolution:

• Forward Lookup Zones: Resolves Fully Qualified Domain Names (FQDNs) to IP addresses (A record for IPv4, AAAA record for IPv6).
• Reverse Lookup Zones: Maps IP addresses back to domain names using Pointer (PTR) records based on the in-addr.arpa domain hierarchy.
• Authoritative vs. Recursive Resolution:
  • Authoritative servers hold the official DNS zone data for their namespace.
  • Recursive resolvers query root hints, TLD servers, and authoritative servers on behalf of client requests.

6. Hyper-V Architecture and Virtual Machine Management

6.1 Hypervisor Classification

• Type-1 (Bare-Metal) Hypervisors: Runs directly on bare physical server silicon. The hypervisor controls hardware access and schedules CPU/memory directly. (e.g., Microsoft Hyper-V, VMware ESXi, KVM).
• Type-2 (Hosted) Hypervisors: Runs as an application layer on top of a standard host operating system (e.g., Oracle VirtualBox, VMware Workstation). Incurs host OS scheduling and driver translation overhead.

Hyper-V Architecture Note: When Hyper-V is enabled on Windows Server, the host operating system is converted into the Parent Partition (management partition), which accesses hardware via the hypervisor microkernel alongside guest child partitions.

6.2 Generation 1 vs. Generation 2 Virtual Machines

Windows Server provides two generations of virtual hardware architectures:

6.3 Memory Management: Static vs. Dynamic Memory

• Static Memory: Dedicates an unalterable block of physical host RAM to the virtual machine. Guarantees memory allocation but leads to host memory underutilization.
• Dynamic Memory: Reallocates physical host memory dynamically among running VMs using a memory balloon driver:
  • Startup RAM: Memory assigned during VM power-on.
  • Minimum RAM: Smallest amount of memory the VM can be throttled down to post-boot.
  • Maximum RAM: Upper limit of host RAM the VM can consume under heavy load.
  • Smart Paging: Temporary paging mechanism to disk allowing a VM to reboot if host memory is overcommitted when the VM needs its Startup RAM.

7. Hyper-V Virtual Switch Infrastructure and Network Isolation

7.1 Virtual Switch Types

Hyper-V implements software-defined layer-2 virtual switches executing within the hypervisor:

CODECopy Code
[1. External Virtual Switch]
    VM ───> [ vSwitch ] ───> [ Physical NIC ] ───> Physical Network & Internet

[2. Internal Virtual Switch]
    VM ───> [ vSwitch ] <───> Host Management OS (Isolated from physical network)

[3. Private Virtual Switch]
    VM 1 ───> [ vSwitch ] <─── VM 2 (No Host OS access, no physical network access)

1. External Virtual Switch:
   • Binds directly to a physical network adapter or NIC team.
   • Permits virtual machines to communicate with physical computers on the enterprise LAN, external servers, and the Internet.
   • Can optionally share the physical adapter with the parent management operating system.
2. Internal Virtual Switch:
   • Binds to a virtual network adapter created on the host OS.
   • Enables communication between virtual machines on the same host and between the virtual machines and the host operating system.
   • Blocks external network and Internet traffic.
3. Private Virtual Switch:
   • Purely software-based internal communications channel between virtual machines running on the same Hyper-V host.
   • The host parent OS does not have a virtual adapter on this switch.
   • Excellent for isolated penetration testing labs, quarantine environments, or cluster heartbeats.

7.2 VLAN Tagging in Hyper-V

Virtual machines can participate in 802.1Q tagged Virtual LANs:

• The physical switch trunk port carries tagged frames.
• In Hyper-V VM Network Settings, enabling VLAN Identification injects the designated 802.1Q VLAN ID into outgoing packets and filters incoming traffic, isolating multi-tenant workloads over shared physical uplinks.

8. Common Pitfalls & Administrative Best Practices

• Never Clone Without Sysprep: Cloning a live or un-sysprepped Windows installation creates identical machine SIDs, disrupting Active Directory domain trust relationships and causing WSUS client confusion.
• Avoid Generation 1 for New 64-bit Deployments: Generation 2 VMs boot significantly faster, consume less CPU overhead by eliminating legacy chipset emulation, and support enterprise security baselines like Secure Boot and BitLocker via vTPM.
• Do Not Leave Checkpoints (Snapshots) in Production Indefinitely: While useful during software upgrades, long-running Hyper-V checkpoints cause .avhdx differencing disks to expand dynamically, potentially exhausting physical SAN/CSV storage and degrading disk I/O performance.
• Configure Static IP for Critical Server Roles: Domain Controllers, DNS servers, and Hyper-V cluster nodes should always be assigned static IPv4/IPv6 addresses outside the dynamic DHCP distribution pool.

9. Quick Revision Summary

• Windows Server Editions: Standard (2 OSEs) vs Datacenter (Unlimited OSEs, Storage Spaces Direct).
• Server Core: Headless, low attack surface, fewer reboots, lower resource footprint; managed via PowerShell, RSAT, and Windows Admin Center.
• Hardware Management: Out-of-band management (iDRAC, iLO, IPMI) enables full remote power and KVM access independent of the host OS status.
• Deployment: Sysprep.exe /generalize /oobe /shutdown strips machine SIDs to prepare standardized master disk templates.
• NIC Teaming: Combines multiple NICs for failover and aggregation. Switch Independent mode allows connection to redundant independent switches; LACP dynamically negotiates with switch stacks.
• Hyper-V Generations: Gen 1 relies on legacy BIOS and IDE emulation; Gen 2 uses UEFI, native SCSI, Secure Boot, and synthetic VMBus device drivers.
• Hyper-V Switch Types: External (communicates with external LAN/Internet), Internal (VMs and Host OS only), Private (VM-to-VM only, completely isolated).