Cert Guide - MCSA 70-740 Chapter 19 Maintaining Servers

Windows Firewall (MpsSvc)

Microsoft reccomends leaving Windows Firewall Service Enabled.

Configure Automatic Updates and Specify Intranet Microsoft Update Service Location.

This is the main settings for WSUS client behavior

The following are installed when WSUS is installed

- .NET API and Windows Powershell cmdlts - Windows Internal Database (WID), which is used by WSUS - Services used by WSUS, includeing the following: + Updating Services + Reporting Web Service + Client Web Service + Simple Web Authentication Web Service + Server Synchronization Service + DSS Authentication Web Service

WSUS system requirements

- 1.4 GHz x64 (2GHz or faster is recommended.) - Additional 2GB of RAM over what is required by the server and all other services or software. - 20 GB (40 GB or greater recommended) - 100 Mbps or greater following is required in some cases - For viewing reports, WSUS required Microsoft Report Viewer Redistributable 2008. - Microsoft .NET Framework 4.0 must be installed on the server where the WSUS server role will be installed. - Te account you plan to use to install WSUS must be a member of the local administrator's group.

Other settings to control the behavior of WSUS clients.

- Automatic updates detection frequency - Allow Signed updates from an untranet Microsoft Update Service Location.

Settings for restarts

- Delay restart for Scheduled Installations - Re-Prompt for Restart with Scheduled Installations - No Auto-Restart with with Logged on users for Scheduled Automatic Updates Installations

Windows Server Backup features

- Drive Support: Doesn't support tape or optical drives that aren't accessible through file system. - Scheduling: Can schedule only a single job and is limited to running the job either daily or multiple times per day. - Job Types: Windows Server Backup DOES NOT enable you to perform full, incremental, and differential backups on a per-job basis. - Different Backup Format: Windows Server backup writes its backup files in VHDX format, which makes them accessible using hyper-v or disk management snap-in

Settings for when client computer is shut down

- Enabling Windows update power management to automatically wake up the system to install scheduled updates - Reschedule Automatic Updates scheduled installations

2 types of system state restores

- Non-authoritative: This restores replace active directory from the backup but then allow its overwriting from the active directory synchronization process from other domain controllers. - Authoritative: This restores require you to restart the computer in Directory Services Restore mode by pressing F8 during boot. You restore the system state by using Wbadmin followed by Ntdsutil.exe to specify active directory objects to selectively restore.

Backup for web (IIS) server

- Static files are not a problem for Windows Server backup - Web servers connected to backend databases (IE: SQL) might be accessing databases stored on other servers. Windows Backup performs VSS backups of SQL Server databases for this purpose. - Configuration files (XML) for an IIS web server are located in Windows\System32\intserv; you must remember to back up these files to properly backup IIS.

WSUS role installed on a separate computer

- The Database server cannot be configured as a domain controller - The WSUS server cannot run Remote Desktop Services - The database Server must be in the same Active Directory domain as the WSUS server, or must have a trust relationship with the Active Directory domain of the WSUS server. - The WSUS server and the database server must be in the same time zone or must be synced to the same coordinated universal time (Greenwich Mean time) source.

Manage Windows defender

- WMI - Windows PowerShell - Group Policy

Microsoft recommendation for protection against malware

- Windows Defender Network Inspection service - Windows Error Reporting Service - Windows Update Service

Change how Windows updates download

- Windows Update in Control Panel, Install updates automatically - Group Policy: Use the path: Administrative Templates\Windows Components\Windows Update\Configure Automatic Updates. - AUOptions registry key: The following 2 values allow Windows Update to automatically download and install definition updates: + Install updates automatically + Download updates but let me choose whether to install them

Hyper-V backups methods

- You can backup Virtual machines as though there are separate systems, by running Windows Server Backup in the guest OS - You can back them up as part of the host server, by backing up the virtual machine files and the virtual hard disks.

Wbadmin get versions

Lists details of backup recoverable from the local computer or, if another location is specified, from another computer

Wbadmin get disks

Lists disks that are now online

Best practice for Test environment

Create at least one computer group to test updates before you deploy the updates to other computers.

Wbadmin get items

Lists the items included in a backup

Wbadmin disable backup

Disables the backups

Wbadmin restore catalog

Recovers a backup catalog from a specified storage location in the case where the backup catalog on the local computer has been corrupted.

Wbadmin delete catalog

Removed the backup catalog on the local computer

Wbadmin delete systemstatebackup

Removes one or more system state backups

Wbadmin start backup

Runs a one-time backup

Wbadmin start systemrecovery

Runs a recovery of the full system (at least all the volumes that hold the OSs state)

Wbadmin start recovery

Runs a recovery of the volumes, applications, files, or folder specified

Wbadmin start systemstatebackup

Runs a system state backup

Wbadmin start systemstaterecovery

Runs a system state recovery

Wbadmin get status

Shows the status of the running backup or recovery operations

Wbadmin stop job

Stops the running backup or recovery operation

WSUS groups

This allows you to test and target updates to specific computers. There are 2 default groups: - All Computers - Unassigned computers

Install-WindowsFeature -Name Windows-Defender-GUI

This command installs Windows Defender on PowerShell

Install-WindowsFeature -Name Windows-Server-Antimalware

This command will disable Windows Defender, by uninstalling it.

sc query Windefend

This command will verify that Windows Defender is rinning on the server.

Windows Server Backup

This is a backup software program that you can use to back up your volumes with the following as destinations: - Internal Hard Drive - External Hard drive - Writable DVD drive - Network share

Windows Defender

This is malware protection that is included with and built into Windows 8. This software helps identify and remove viruses, spyware, and other malicious software. It runs in the background and notifies you when you need to take specific action. However, you can use it anytime to scan for malware if your computer isn't working properly or if you clicked a suspicious link online or in an email message.

Windows Defender Service (Windefend)

This is the main Windows defender service that needs to be running at all times

Windows Server Update Services (WSUS)

This permits you to deploy the latest Microsoft product updates in a more controlled and flexible manner than how clients and servers might ordinarily receive these enhancements.

Windows Defender Network Inspection Service (Wdnissvc)

This service is innvoked when Windows Defender encounters a trigger to load it.

Windows Error Reporting Service (Wersvc)

This service sends error reports to Microsoft.

Wbadmin.exe

This will selectively restore just the system state.

Client-Side Targeting

To move computers from the unassigned group, use group policy to cause systems to automatically add themselves to the group you want updated; the Group Policy setting is Enable Client-Side Targeting.

Server-Side Targeting

To move computers from unassigned group right-click the system in the update service console and choose change membership.

Windows Update (Wuauserv)

Windows update is needed to get definition updates and anti-malware engine updates.

Wbadmin enable backup

configures and enables a regular scheduled backup