Configuring roles for your server

Microsoft Windows Graphic

The Configure Your Server Wizard provides a central location from which you can install or remove the server roles available on a server running Windows Server 2003. After installing a server role, you can use Manage Your Server to manage that role.

Manage Your Server provides a central location from which you can manage the server roles installed through the Configure Your Server Wizard. Manage Your Server starts automatically the first time you log on to your server computer with administrative credentials.

  • Server roles
  • Typical setup for a first server
  • File server role: Configuring a file server
  • Print server role: Configuring a print server
  • Application server role: Configuring an application server
  • Mail server role: Configuring a mail server
  • Terminal server role: Configuring a terminal server
  • Remote access/VPN server role: Configuring a remote access/VPN server
  • Domain controller role: Configuring a domain controller
  • DNS server role: Configuring a DNS server
  • DHCP server role: Configuring a DHCP server
  • Streaming media server role: Configuring a streaming media server
  • WINS server role: Configuring a WINS server
  • Windows® SharePoint® Services server role: Configuring a Windows SharePoint Services server
  • To remove a server role

Security Configuration Wizard

After you configure roles for your server, you can use the Security Configuration Wizard to create or apply a security policy to the server. For more information, see Security Configuration Wizard.

Note

  • XOX


Server roles

Microsoft Windows Graphic

Windows Server 2003 operating systems provide several server roles. To configure a server role, install the server role by using the Configure Your Server Wizard, and manage your server roles by using Manage Your Server. After you finish installing a server role, Manage Your Server starts automatically.

To determine which server role is appropriate for you, review the following information about the server roles that are available with Windows Server 2003:

File server role overview

Print server role overview

Application server role overview

Mail server role overview

Terminal server role overview

Remote access/VPN server role overview

Domain controller role overview

DNS server role overview

DHCP server role overview

Streaming media server role overview

WINS server role overview

Windows® SharePoint® Services server role overview

File server role overview

File servers provide and help you manage access to files. If you plan to use disk space on this computer to store, manage, and share information such as files and applications, configure this computer as a file server.

After configuring the file server role, you can do the following:

  • Manage storage by using the File Server Management snap-in, which provides a centralized interface through which you can manage storage.
  • Use File Server Resource Manager to analyze how disk space is used on a server, to set quotas to limit the size of a volume or folder subtree, and to prevent certain types of files from being saved to a folder or volume.
  • Use Distributed File System (DFS) to replicate data from servers in branch locations to servers in hub datacenters. The data can be then backed up centrally, which eliminates the need to back up data in the branches. Using the DFS Management snap-in, you can also group shared folders located on different servers and present them to users as a virtual tree of folders known as a namespace. A namespace provides numerous benefits, including increased availability of data, load sharing, and simplified data migration.
  • Use Storage Manager for SANs to provision storage on one or more Fibre Channel or Internet SCSI (iSCSI) storage subsystems on a storage area network (SAN).

For more information about implementing this server role, see File server role: Configuring a file server.

Print server role overview

Print servers provide and manage access to printers. If you plan to manage printers remotely, manage printers by using Windows Management Instrumentation (WMI), or print from a server or client computer to a print server by using a URL, configure this computer as a print server.

After configuring the print server role, you can do the following:

  • Use a browser to manage printers. You can pause, resume, or delete a print job, and view the printer and print job's status.
  • Use the new standard port monitor, which simplifies installation of most TCP/IP printers on your network.
  • Use Windows Management Instrumentation (WMI), which is the management API created by Microsoft that enables you to monitor and control all system components, either locally or remotely. The WMI Print Provider enables you to manage print servers, print devices, and other printing-related objects from the command line. With WMI Print Provider, you can use Visual Basic (VB) scripts to perform administrative printer functions. For more information, see Windows Management Instrumentation Command-line (WMIC) tool.
  • Print from XOX clients to print servers running Windows Server 2003 by using a Uniform Resource Locator (URL).
  • Connect to printers on your network by using Web point-and-print for single-click installation of a shared printer. You can also install device drivers from a Web site.

For more information about implementing this server role, see Print server role: Configuring a print server.

Application server role overview

An application server is a core technology that provides key infrastructure and services to applications hosted on a system. Typical application servers include the following services:

  • Resource pooling (for example, database connection pooling and object pooling)
  • Distributed transaction management
  • Asynchronous program communication, typically through message queuing
  • A Just-in-Time object activation model
  • Automatic XML Web Service interfaces to access business objects
  • Failover and application health detection services
  • Integrated security

Windows Server 2003 operating systems include an application server that contains all of this functionality and other services for development, deployment, and runtime management of XML Web services, Web applications, and distributed applications.

When you configure this server as an application server, you will be installing Internet Information Services (IIS) along with other optional technologies and services such as COM+ and ASP.NET. Together, IIS and the Windows Server 2003 operating systems provide integrated, reliable, scalable, secure, and manageable Web server capabilities over an intranet, the Internet, or through an extranet. IIS is a tool for creating a strong communications platform of dynamic network applications.

For more information about implementing this server role, see Application server role: Configuring an application server.

Mail server role overview

To provide e-mail services to users, you can use the Post Office Protocol 3 (POP3) and Simple Mail Transfer Protocol (SMTP) components included with Windows Server 2003 operating systems. The POP3 service implements the standard POP3 protocol for mail retrieval, and you can pair it with the SMTP service to enable mail transfer. If you plan to have clients connect to this POP3 server and download e-mail to local computers by using a POP3-capable mail client, configure this server as a mail server.

After configuring the mail server role, you can do the following:

  • Use the POP3 service to store and manage e-mail accounts on the mail server.
  • Enable user access to the mail server so that users can retrieve e-mail from their local computer by using an e-mail client that supports the POP3 protocol (for example, Microsoft Outlook).

For more information about implementing this server role, see Mail server role: Configuring a mail server.

Terminal server role overview

With Terminal Server, you can provide a single point of installation that gives multiple users access to any computer that is running a Windows Server 2003 operating system. Users can run programs, save files, and use network resources all from a remote location, as if these resources were installed on their own computer.

After configuring the terminal server role, you can do the following:

  • Confirm Internet Explorer Enhanced Security Configuration settings.
  • Centralize the deployment of programs on one computer.
  • Ensure that all clients use the same version of a program.

Important

  • In addition to configuring a terminal server, you must install Terminal Server Licensing and configure a Terminal Server License Server. Otherwise, your terminal server will stop accepting connections from unlicensed clients when the evaluation period ends 120 days after the first client logon. For more information about Terminal Server Licensing, see Terminal Server Licensing.

For more information about implementing this server role, see Terminal server role: Configuring a terminal server.

Remote access/VPN server role overview

Routing and Remote Access provides a full-featured software router and both dial-up and virtual private network (VPN) connectivity for remote computers. It offers routing services for local area network (LAN) and wide area network (WAN) environments. It also enables remote or mobile workers to access corporate networks as if they were directly connected, either through dial-up connection services or over the Internet by using VPN connections. If you plan to connect remote workers to business networks, configure this server as a remote access/VPN server.

Remote access connections enable all of the services that are typically available to a LAN-connected user, including file and print sharing, Web server access, and messaging.

After configuring the remote access/VPN server role, you can do the following:

  • Control how and when remote users access your network.
  • Provide network address translation (NAT) services for the computers on your network.
  • Create custom networking solutions using application programming interfaces (APIs).

For more information about implementing this server role, see Remote access/VPN server role: Configuring a remote access/VPN server.

Domain controller role overview

Domain controllers store directory data and manage communication between users and domains, including user logon processes, authentication, and directory searches. If you plan to provide the Active Directory directory service to manage users and computers, configure this server as a domain controller.

Notes

  • You cannot add the domain controller role to a certification authority (CA). If your computer is already a CA, the domain controller role is not available in the Configure Your Server Wizard.
  • Computers running XOX, cannot function as domain controllers. For more information about XOX, see Overview of XOX.

After configuring the domain controller role, you can do the following:

  • Store directory data and make this data available to network users and administrators. Active Directory stores information about user accounts (for example, names, passwords, and phone numbers), and enables other authorized users on the same network to access this information.
  • Add additional domain controllers to an existing domain to improve the availability and reliability of network services.
  • Improve network performance between sites by placing a domain controller in each site. With a domain controller in each site, you can handle client logon processes within the site without using the slower network connection between sites.

For more information about implementing this server role, see Domain controller role: Configuring a domain controller.

DNS server role overview

The Domain Name System (DNS) is the TCP/IP name resolution service that is used on the Internet. The DNS service enables client computers on your network to register and resolve user-friendly DNS names. If you plan to make resources in your network available on the Internet, configure this server as a DNS server.

Important

  • If you plan to include computers on the Internet on your network, use a unique DNS domain name. For more information about DNS namespace planning, see Namespace planning for DNS.

After configuring the DNS server role, you can do the following:

  • Host records of a distributed DNS database and use these records to answer DNS queries sent by DNS client computers, such as queries for the names of Web sites or computers in your network or on the Internet.
  • Name and locate network resources using user–friendly names.
  • Control name resolution for each network segment and replicate changes to either the entire network or globally on the Internet.
  • Reduce DNS administration by dynamically updating DNS information.

For more information about implementing this server role, see DNS server role: Configuring a DNS server.

DHCP server role overview

Dynamic Host Configuration Protocol (DHCP) is an IP standard designed to reduce the complexity of administering address configurations by using a server computer to centrally manage IP addresses and other related configuration details used on your network. If you plan to perform multicast address allocation, and obtain client IP address and related configuration parameters dynamically, configure this server as a DHCP server.

After configuring the DHCP server role, you can do the following:

  • Centrally manage IP addresses and related information.
  • Use DHCP to prevent address conflicts by preventing a previously assigned IP address from being used again to configure a new computer on the network.
  • Configure your DHCP server to supply a full range of additional configuration values when assigning address leases. This will greatly decrease the time you spend configuring and reconfiguring computers on your network.
  • Use the DHCP lease renewal process to ensure that client configurations that need to be updated often (such as users with mobile or portable computers that change locations frequently) can be updated efficiently and automatically by clients communicating directly with DHCP servers.

For more information about implementing this server role, see DHCP server role: Configuring a DHCP server.

Streaming media server role overview

Streaming media servers provide Windows Media Services to your organization. Windows Media Services manages, delivers, and archives Windows Media content, including streaming audio and video, over an intranet or the Internet. If you plan to provide audio and video content streams to clients and to other Windows Media servers, configure this computer as a streaming media server.

After configuring the streaming media server role, you can do the following:

  • Stream Windows Media-based content, including entertainment programming and advertising, over a network in a variety of ways to create a Web-based radio or television station.
  • Stream internal business communications, such as meetings, speeches, and training, over a corporate intranet, and stream external business communications to customers, vendors, and business partners over the Internet.
  • Transmit the information only to users who have been authorized to access the content, by distributing unique user licenses and by limiting access to your server resources.

For more information about implementing this server role, see Streaming media server role: Configuring a streaming media server.

WINS server role overview

Windows Internet Name Service (WINS) servers map IP addresses to NetBIOS computer names and NetBIOS computer names back to IP addresses. With WINS servers in your organization, you can search for resources by computer name instead of IP address, which can be easier to remember. If you plan to map NetBIOS names to IP addresses or centrally manage the name-to-address database, configure this server as a WINS server.

After configuring the WINS server role, you can do the following:

  • Reduce NetBIOS–based broadcast traffic on subnets by permitting clients to query WINS servers to directly locate remote systems.
  • Support earlier Windows and NetBIOS–based clients on your network by permitting these types of clients to browse lists for remote Windows domains without requiring a local domain controller to be present on each subnet.
  • Support DNS–based clients by enabling those clients to locate NetBIOS resources when WINS lookup integration is implemented. For more information, see WINS lookup integration.

For more information about implementing this server role, see WINS server role: Configuring a WINS server.

Windows SharePoint Services server role overview

With a Windows SharePoint Services server, you can easily create Web sites where teams can communicate, share documents, and work together on a project. Windows SharePoint Services sites provide a central storage and collaboration space for documents, information, and ideas. Members can easily upload documents, share information in lists, and maintain a shared calendar on their Windows SharePoint Services sites. Windows SharePoint Services sites are dynamic, and interactive—members of the site can contribute their own ideas and content as well as comment on or contribute to other people's.

After configuring the Windows SharePoint Services server role, you can do the following:

  • Grant members access to the default Windows SharePoint Services site and start using the site.
  • Customize your Windows SharePoint Services site to include the elements your team needs.
  • Migrate data from an existing Web site to your Windows SharePoint Services site.
  • Create additional sites or turn on Self-Service Site Creation.

For more information about implementing this server role, see Windows SharePoint Services server role: Configuring a Windows SharePoint Services server.


Typical setup for a first server

The following information describes how to install and configure the first server on a network by using the Typical setup for a first server option in the Configure Your Server Wizard.

Important

  • Before you configure the first server on a network, see Checklist: Configuring the typical setup for a first server.

The typical setup for a first server will not run if any of the following conditions are met:

  • The computer is running XOX.
  • The computer is running XOX.
  • The computer is joined to a domain.
  • The computer is already configured as a domain controller.
  • The computer is not a domain controller, but the Active Directory Installation Wizard has already been started.
  • The computer is a certification authority (CA).
  • The computer is already configured as a DNS server.
  • The computer is already configured as a DHCP server.
  • There are zero IP-enabled network adaptors.
  • There is only one IP-enabled network adaptor and the DHCP lease test succeeds.
  • The computer is already running Routing and Remote Access.
  • The computer does not have at least one NTFS partition.
  • The current session is a remote session.

Typical setup configuration process

The typical setup configuration process implements the following steps:

  • Installs Active Directory and promotes the computer to a domain controller.

    When you promote a server to a domain controller, a domain is automatically created on the network. After you promote a server to a domain controller, you can then promote other servers to domain controllers. For more information, see Domain controllers.

    When you configure your server using the typical setup for a first server, the local administrator's password is automatically set as the Restore Mode Administrator password.

  • Sets up an application naming context in Active Directory on this domain controller for use by Telephony API (TAPI) client applications. For more information, see Application directory partitions.
  • Installs Domain Name System (DNS) and creates a full domain name for your network.

    DNS is a networking protocol for naming computers and network services that is organized into a hierarchy of domains. TCP/IP networks, such as the Internet, use DNS naming to locate computers and services through user-friendly names. When a user enters a DNS name in an application, DNS services can resolve the name to other information associated with the name, such as an IP address.

    For example, most users prefer a friendly name such as server1.example.microsoft.com to locate a computer such as a mail server or Web server on a network. However, computers use numeric addresses to communicate over a network. To make it easier to use network resources, DNS provides a way to map the user-friendly name for a computer or service to its numeric address. For more information, see DNS domain names.

  • Changes the default NetBIOS name. You can change the default NetBIOS name on this page. For example, if your Active Directory DNS domain name is yoursmallbusiness.local, the default NetBIOS domain name is YOURSMALLBUSINE. You may want to change this to CORP or to your own abbreviation for your business name for ease of use. For more information about NetBIOS, see NetBIOS name resolution.
  • Assigns a preferred DNS server with the same IP address that you specified for this server. For more information, see How DNS query works.
  • Assigns a DNS forwarder. For more information, see Understanding forwarders.
  • Installs the DHCP Server service.

    DHCP uses a client/server model. The network administrator establishes one or more DHCP servers that maintain TCP/IP configuration information and provide it to clients. With a DHCP server installed and configured on your network, DHCP–enabled clients can obtain their IP address and related configuration parameters dynamically each time they start and join your network. DHCP servers provide this configuration in the form of an address lease offer to requesting clients.

  • Assigns a static IP address, if one is not already assigned to the private network connection. For more information, see Name resolution for TCP/IP.
  • Assigns a subnet mask (that is, if none has been configured on this server). By default, the Configure Your Server Wizard assigns a subnet mask of 255.255.255.0. For more information, see Subnet masks.
  • Installs the Routing and Remote Access service (that is, if more than one network connection is detected).

Next steps: Typical setup for a first server

After you complete the Configure Your Server Wizard, the computer is ready for use as the server on your network. It has been configured as a domain controller, a DNS server, a DHCP server, and possibly as a remote access/VPN server. For more information about each of these roles, see

  • Domain controller role: Configuring a domain controller
  • DNS server role: Configuring a DNS server
  • DHCP server role: Configuring a DHCP server
  • Remote access/VPN server role: Configuring a remote access/VPN server

The following table lists some of the additional tasks that you can perform on your server. To manage the new services on this server, do the following:

  • XOX

Note

  • If you demote this server so that it is no longer a domain controller, you must remove the TAPI application partition by using the Tapicfg.exe utility. For more information, see To remove a TAPI application directory partition.
Task | Reference
Make additional configuration changes to the DNS server. | Checklist: Installing a DNS server; To configure a new DNS server
Install additional domain controllers, if necessary. | To create an additional domain controller
Configure additional options for the DHCP server. | Checklist: Installing a DHCP server
(Optional) Monitor and measure various aspects of the DNS server to prevent and troubleshoot performance degradation. | Monitoring DNS server performance
(Optional) Monitor and measure various aspects of the DHCP server to prevent and troubleshoot performance degradation. | Monitoring DHCP server performance; DHCP performance monitoring reference
(Optional) Install and configure additional domain controllers. | Checklist: Creating an additional domain controller in an existing domain
(Optional) Select the appropriate security level for domain administration. | Using the Active Directory Installation Wizard


File server role: Configuring a file server

A file server provides a central location on your network where you can store and share files with users across your network. When users require an important file that is intended to be accessed by many users, such as a project plan, they can access the file remotely on the file server instead of having to pass the file between their separate computers. If your network users will need access to the same files and applications, or if centralized backup and file management are important to your organization, you should configure this computer as a file server.

The file server role uses many features that are already installed as part of the Windows Server 2003 operating system, such as NTFS, Disk Defragmenter, and DFS Namespaces. By default, the file server role installs the following features:

  • File Server Management

    The File Server Management console provides a centralized tool for managing your file server. Using File Server Management, you can create and manage shares, set quota limits, create storage utilization reports, replicate data to and from the file server, manage Storage Area Networks (SANs), and share files with UNIX and Macintosh systems.

  • Storage Reporting

    Storage reports enable you to analyze how disk space is used on a server. For example, you can generate on-demand or scheduled reports that identify duplicate files. You can then delete these duplicates to reclaim disk space.

  • Quotas and File Screening

    Quotas enable you to limit the size of a volume or folder subtree. You can configure Windows to notify you when quota limits are reached. File screening enables you to prevent certain types of files from being saved to a folder or volume. File screening helps to ensure that users do not save non-critical data or files that might violate intellectual property laws on the server.

  • DFS Management

    The DFS Management snap-in enables you to manage data replication from servers in branch locations to servers in hub datacenters. The data can be then backed up centrally, which eliminates the need to back up data in the branches. Using the DFS Management snap-in, you can also group shared folders located on different servers and present them to users as a virtual tree of folders, known as a namespace. A namespace provides numerous benefits, including increased availability of data, load sharing, and simplified data migration.

In addition, you have the option of upgrading an existing file server with additional tools such as:

  • DFS Replication

    DFS Replication is a state-based, multimaster replication engine that supports replication scheduling and bandwidth throttling. DFS Replication uses a compression algorithm known as Remote Differential Compression (RDC), which can be used to efficiently update files over a limited-bandwidth network by replicating only the changed file blocks when files are updated.

  • Storage Manager for SANs

    Storage Manager for SANs enables you to provision storage on one or more Fibre Channel or iSCSI storage subsystems on a storage area network (SAN).

  • Microsoft Services for Network File System

    Microsoft Services for NFS enables file sharing in a mixed environment of computers, operating systems, and networks.

  • Services for Macintosh

    Services for Macintosh enables Windows-based and Macintosh client computers to share files and printers, and to remotely connect to a Microsoft network.

This topic explains how to use both Manage Your Server and the Configure Your Server Wizard to install and configure a file server for the first time, or to upgrade an existing file server. After you complete the Configure Your Server Wizard, you will have a fully functioning file server. When you have finished setting up a basic file server, you can complete additional tasks by using Manage Your Server.

This topic covers:

Before you begin

Adding the file server role to a server

Upgrading the file server role on an existing file server

Removing the file server role

Next steps: Completing additional tasks

Before you begin

Before you configure your computer as a file server, verify whether:

  • The computer is joined to an Active Directory domain as a member server. You can improve security and user authentication by joining the computer to an Active Directory domain.
  • All existing disk volumes use the NTFS file system. FAT32 volumes are not secure, and they do not support file and folder compression, disk quotas, file encryption, or individual file permissions.
  • Windows Firewall is enabled. For information, see Security Configuration Wizard Documentation (http://www.microsoft.com/). If Windows Firewall is enabled, you must select File and Printer Sharing on the Exceptions tab in Windows Firewall in order for the file server role to function properly.
  • The Security Configuration Wizard is installed and enabled. For information about the Security Configuration Wizard, see Security Configuration Wizard.

Adding the file server role to a server

If the file server role is not yet installed on the server, you can add it. The file server role includes features such as the File Server Management snap-in, Storage Reporting, Quotas and File Screening, the DFS Management snap-in, DFS Replication, Storage Manager for SANs, Microsoft Services for Network File System, and Services for Macintosh.

To install the file server role

  1. Start the Configure Your Server Wizard by doing either of the following:
    • In Manage Your Server, click Add or remove a role. By default, Manage Your Server starts automatically when you log on to the computer. XOX
    • XOX
  2. Continue clicking Next until you reach the Server Role page.
  3. On the Server Role page, click File Server, and then click Next.
  4. On the Summary of Selections page, click Next to start the Add File Server Role Wizard.
  5. On the Welcome to the Add File Server Role Wizard page, click Next.
  6. On the File Server Environment page, review the following optional components and select those that you want to install:
    • Replicate data to and from this server

      This option installs DFS Replication, which is a state-based, multimaster replication engine that supports replication scheduling and bandwidth throttling. DFS Replication uses a compression algorithm known as Remote Differential Compression (RDC), which can be used to efficiently update files over a limited-bandwidth network by replicating only the changed file blocks when files are updated.

    • Manage a SAN (Storage Area Network)

      This option installs Storage Manager for SANs and the Virtual Disk Service (VDS) (version 1.1), which enables you to provision storage on one or more Fibre Channel or iSCSI storage subsystems on a storage area network (SAN).

    • Share files with UNIX systems

      This option installs Microsoft Services for Network File System, which enables file sharing in a mixed environment of computers, operating systems, and networks.

    • Share files with Macintosh computers

      This option installs Services for Macintosh, which enables Windows-based and Macintosh client computers to share files and printers, and to remotely connect to a Microsoft network.

  7. Click Next to install the file server role.

    When installation is complete, the Configure Your Server Wizard displays the This Server Is Now a File Server page, and you must restart your computer. To review all of the changes made to your server by the Configure Your Server Wizard, or to ensure that a new role was installed successfully, click Configure Your Server log. The Configure Your Server Wizard log is located at systemroot\Debug\Configure Your Server.log. To close the Configure Your Server Wizard, click Finish.

Note

  • You can add components later in Add or Remove Programs in Control Panel. In Add or Remove Programs, click Add/Remove Windows Components, click Management and Monitoring Tools, click Details, click the components you want to add, and then click OK.

Upgrading the file server role on an existing file server

If you already have the file server role installed on your computer running Windows Server 2003 with Service Pack 1 (SP1), you have the option of upgrading it with additional tools such as File Server Management, File Server Resource Manager (FSRM), Distributed File System (DFS) (providing namespaces and replication), Storage Manager for SANs, Microsoft Services for Network File System, and Services for Macintosh. You can use Manage Your Server to determine whether the file server role is installed on your server.

To upgrade your file server

  1. Open Manage Your Server. XOX
  2. On the Managing Your Server Roles page, click File server, and then click Upgrade this role.
  3. On the Welcome to the Add File Server Role Wizard page, click Next.
  4. On the File Server Environment page, review the optional components and select those that you want to install.
  5. Click Next to upgrade the file server role.

    When the upgrade is complete, the Configure Your Server Wizard displays the This Server Is Now a File Server page, and you must restart your computer. To review all of the changes made to your server by the Configure Your Server Wizard or to ensure that a new role was installed successfully, click Configure Your Server log. The Configure Your Server Wizard log is located at systemroot\Debug\Configure Your Server.log. To close the Configure Your Server Wizard, click Finish.

Note

  • If you do not want to add any optional components when upgrading the file server role, you can add them later in the Management and Monitoring Tools component, using Add/Remove Windows Components in Add or Remove Programs in Control Panel.

Removing the file server role

If you need to reconfigure your server for a different role, you can remove existing server roles. If you remove the file server role, files and folders on this server are no longer shared and network users, programs, or hosts that depend on those shared resources will be unable to connect to them.

To remove the file server role

  1. Restart the Configure Your Server Wizard by doing either of the following:
    • From Manage Your Server, click Add or remove a role. By default, Manage Your Server starts automatically when you log on. XOX
    • XOX
  2. On the Server Role page, click File server, and then click Next.
  3. On the Role Removal Confirmation page, review the items listed under Summary, select the Remove the file server role check box, and then click Next.
  4. On the File Server Role Removed page, click Finish.

Next steps: Completing additional tasks

After you complete the Configure Your Server Wizard, the computer is ready for use as a basic file server that can store, manage, and share information such as files and applications. The following table lists some of the additional tasks that you can perform on your file server:

Task | Purpose of task | Reference
Consolidate and migrate data this file server | You can consolidate multiple file servers and migrate data from one server to another by using the File Server Migration Toolkit. The tools simplify the process of copying data, which minimizes the user impact of file server consolidation or migration. | Microsoft File Server Migration Toolkit
Make shared resources available offline | Allows users to store local copies of shared resources, so that they can access these resources when they are not connected to the network. | To configure offline settings for a shared resource
Enable quick recovery for shared files and folders | Shadow Copies for Shared Folders provides point-in-time copies of files on network shares. When an original file becomes damaged, users can quickly restore it themselves, which saves money by lowering the number of help desk calls. | To enable Shadow Copies for Shared Folders
Control folder and volume using quotas | Quotas enable you to limit the size of a volume or folder subtree. You can configure Windows to notify you when quota limits are reached. | Quota Management
Organize shares into a DFS namespace | A DFS namespace allows administrators to group shared folders located on different and present them to users as a virtual tree of folders known as a namespace. A namespace provides numerous benefits, including increased availability of data, load sharing, and simplified data migration. | Namespaces
Replicate folders | A DFS Replication group can be used to replicate data between shares. You can do this to geographically replicate data as part of a disaster recovery plan or in conjunction with a DFS namespace to improve data availability. | Replication groups and replicated folders
Provision and manage storage on an SAN | If you have a storage area network (SAN), Storage Manager for SANs allows you to create and manage LUNs (logical units) that are used to allocate space on storage arrays. Storage Manager for SANs simplifies the provisioning of storage on storage area networks (SANs) that support the Virtual Disk Service (VDS) (version 1.1) in both Fibre Channel and iSCSI environments. | Storage Manager for SANs


Print server role: Configuring a print server

If you plan to use this computer to manage and share printers, configure this computer as a print server.

Note

  • XOX

This document explains how to use the Configure Your Server Wizard to quickly meet the most basic requirements of a print server. When you are done setting up a basic print server, you can complete additional configuration tasks, depending on how you want to use this print server.

This topic covers:

  • Before you begin
  • Configuring your print server
  • Next steps: Completing additional tasks

Before you begin

Before you configure your server as a print server, verify whether or not:

  • The operating system is configured correctly. In Windows Server 2003 operating systems, print services depend on the appropriate configuration of the operating system and its services. If you have a new installation of a Windows Server 2003 operating system, you can use the default service settings. No further action is necessary. If you upgraded to a Windows Server 2003 operating system or you want to confirm that your services are configured correctly for best performance and security, verify your service settings by comparing them to the table in Default settings for services.
  • The computer is joined to an Active Directory domain as a member server. If you want to restrict access to a printer, so that some domain users can print to it and other users cannot, or you want the print server to publish shared printers to Active Directory so that domain users can easily search for those printers, the print server must be joined to a domain. If you do not need to perform either of these tasks, the print server does not need to be joined to a domain.
  • All existing disk volumes use the NTFS file system. FAT32 volumes are less secure. For more information about encrypting data stored on NTFS volumes, including spooled print jobs, see Storing Data Securely.
  • Windows Firewall is enabled. For information see Security Configuration Wizard in Windows Server 2003 Service Pack 1 (http://www.microsoft.com/).
  • The Security Configuration Wizard is installed and enabled. For information about the Security Configuration wizard, see Security Configuration Wizard.

The following table lists the information that you need to know before you add a print server role.

Before adding a print server role | Comments
Determine how the print server connects to the printer. If the printer supports Plug and Play and connects to the print server using infrared technology, a universal serial bus (USB) port, or an IEEE 1394 port, the print server will configure itself automatically. You do not need to follow the remaining steps.

Otherwise, if the printer is connected to the print server with a cable, note which server port is used. For printers, LPT1 is the most commonly used port.

If the printer is located away from the print server and uses its own network adapter to receive print jobs, determine the IP address of the network adapter on the printer.
Determine the operating system version of the clients that will send jobs to this printer. | You must have this information to select the correct client printer drivers for your client and server computers. After you add this role, the print server can automatically distribute these drivers to the clients. Additionally, the set of client operating systems determines which of these drivers you need to install on the server during the print server role installation. Note that different drivers are required, depending on whether you have clients running 64-bit systems or 32-bit systems.
At the printer, print a configuration or test page that includes manufacturer, model, language, and installed options. | You need this information to choose the correct printer driver. The manufacturer and model are usually enough to uniquely identify the printer and its language. However, some printers support multiple languages, and the configuration printout usually lists them. Also, the configuration printout often lists installed options, such as extra memory, paper trays, envelope feeders, and duplex units. For network-connected printers, the configuration printout will include the IP address and hostname of the printer, which you will need when installing the printer.
(Optional) Determine whether you need a new or updated printer driver. | Most printers are supported by drivers on the installation CD for the Windows Server 2003 operating system. To save time, you can often skip this step because the wizard that you will use to configure your print server provides compatibility information. If the wizard does not list a driver for your printer, you can look for an update from the printer manufacturer or Windows Update.
Choose a printer name. | Users running Windows-based client computers choose a printer by using the printer name. The wizard that you will use to configure your print server provides a default name, consisting of the printer manufacturer and model. The printer name can contain up to 220 characters.
Choose a share name. | A user can connect to a shared printer by typing this name, or by selecting it from a list of share names. The share name is usually less than 8 characters in length for compatibility with MS-DOS and Windows 3.x clients. However, share names support up to 80 characters in length.
(Optional) Choose a location description and a comment. | These can help identify the location of the printer and provide additional information. For example, the location could be "Second floor, copy room" and the comment could be "Additional toner cartridges are available in the supply room on floor 1." For more information, see Best Practices for Deploying Printer Location with Active Directory (http://www.microsoft.com/).

Configuring your print server

To set up a print server, start the Configure Your Server Wizard by doing either of the following:

  • From Manage Your Server, click Add or remove a role. By default, Manage Your Server starts automatically when you log on. XOX
  • XOX

On the Server Role page, click Print server, and then click Next.

This section covers:

Summary of Selections

Completing the Configure Your Server Wizard

Removing the print server role

Summary of Selections

On the Summary of Selections page, view and confirm the options that you have selected. If you selected Print server on the previous page, the following appears:

  • Install the Print Management Console

To apply the selections shown on the Summary of Selections page, click Next.

Completing the Configure Your Server Wizard

After the Print Management Console is installed, the Configure Your Server Wizard displays the This Server is Now a Print Server page. To review all of the changes made to your server by the Configure Your Server Wizard or to ensure that a new role was installed successfully, click Configure Your Server log. The Configure Your Server Wizard log is located at systemroot\Debug\Configure Your Server.log. To close the Configure Your Server Wizard, click Finish.

Before you start to use your print server, we recommend the following steps:

  • Run Windows Update. For more information, see Windows Update.
  • Run the Security Configuration Wizard. For more information, see Security Configuration Wizard.

Removing the print server role

If you need to reconfigure your server for a different role, you can remove existing server roles. To remove the print server role, restart the Configure Your Server Wizard by doing either of the following:

  • From Manage Your Server, click Add or remove a role. By default, Manage Your Server starts automatically when you log on. XOX
  • XOX

On the Server Role page, click Print server, and then click Next. On the Role Removal Confirmation page, review the items listed under Summary, select the Remove the print server role check box, and then click Next. On the Print Server Role Removed page, click Finish.

Next steps: Completing additional tasks

After you complete the Configure Your Server Wizard, the server is ready for you to add printers. Through Manage Your Server, you can use the following wizards to add printers:

  • Automatically Add Network Printers, to search the subnet the print server is on and discover any network printers that have not already been added
  • Add Printer Wizard, to add a printer manually
  • Add Printer Driver Wizard, to add additional drivers for clients with alternate operating systems
For information about Print Management Console, see Print Management Console (http://www.microsoft.com/).

The following table lists some of the additional tasks that you can perform on your print server.

Task | Purpose of task | Reference
Set the configuration to match installed options. | To provide user access to installed printer options, such as an envelope feeder or extra memory, that are available on some printers. If your printer provides additional features, you must update the configuration so that users can use these features. | To set installable options for a printer
Set printing defaults. | To set the default configuration for clients when they connect to the printer. For example, you can set the default layout or paper source. | To set printing defaults
Assign printer permissions. | To change the permissions that users have for a printer. | To set or remove permissions for a printer
Choose a separator page. | To define a page that appears at the beginning of each printout. | To choose a separator page
Configure network clients to use the printer. | To configure clients to connect to the printers that are shared on this print server. | Connect clients to a printer
Set advanced printer tasks. | To manage your print server more efficiently and effectively. For example, you can schedule alternate printing times, to enable printer location tracking, or to set different priority for different groups. | Use advanced options
Publish a printer in Active Directory. | To help domain users find printers shared by this print server quickly. For this task, the print server must be a member server. | To publish a printer in Active Directory
Configure ports to allow remote administration. | To manage the print server from other computers on the network. | With Windows Firewall enabled, you might need to make specific configuration settings in order to use or remotely administer technologies that ship with Windows Server 2003 operating systems. For information about these settings, see Windows Firewall Settings (http://www.microsoft.com/).


Application server role: Configuring an application server

An application server is a core technology that provides key infrastructure and services to applications hosted on a system. Typical application servers include the following services:

  • Resource pooling (for example, database connection pooling and object pooling)
  • Distributed transaction management
  • Asynchronous program communication, typically through message queuing
  • A Just-in-Time object activation model
  • Automatic XML Web Service interfaces to access business objects
  • Failover and application health detection services
  • Integrated security

Windows Server 2003 operating systems include all this functionality, in addition to services for development, deployment, and runtime management of XML Web services, Web applications, and distributed applications.

This topic explains the basic steps you must follow to configure an application server. This process involves using the Configure Your Server Wizard to configure the server as an application server. When you have finished setting up a basic application server, you can complete additional tasks by using Manage Your Server.

This topic covers:

  • Before you begin
  • Configuring your application server
  • Next steps: Completing additional tasks

Before you begin

Before you configure your computer as an application server, verify that:

  • All existing disk volumes use the NTFS file system. FAT32 volumes are not secure, and they do not support file and folder compression, disk quotas, file encryption, or individual file permissions. To find out the file system type, in My Computer right-click the disk volume, and then click Properties.
  • Your computer has network connectivity and a static or dynamic IP address.

The following table lists the information that you need to know before you add an application server role.

Before adding an application server role | Comments
Understand the following technologies that are installed automatically while configuring your application server:
  • Internet Information Services (IIS)
  • Application Server console
  • COM+
  • Distributed Transaction Coordinator (DTC)
  • IIS 6.0 is a full-featured Web server that provides the infrastructure for .NET and existing Web applications and Web services.
  • COM+ is an extension to the Component Object Model (COM). COM+ builds on COM's integrated services and features, making it easier for developers to create and use software components in any language, using any tool.
  • The Application Server snap-in provides a central location from which you can administer your Web applications. To open the Application Server snap-in, in Manage Your Server, click Manage this application server.
  • Distributed Transaction Coordinator (DTC) coordinates COM+ transactions.
Determine whether you would like to install FrontPage Server Extensions. | FrontPage Server Extensions enable users on a client computer to publish and administer Web sites on a server remotely over a network.
Determine whether you would like to run ASP.NET applications on your server. | ASP.NET is a unified Web development platform that provides the services necessary for developers to build enterprise-class Web applications. You can enable ASP.NET for developing Web applications.

Configuring your application server

To configure an application server, start the Configure Your Server Wizard by doing either of the following:

  • From Manage Your Server, click Add or remove a role. By default, Manage Your Server starts automatically when you log on. XOX
  • XOX

On the Server Role page, click Application server (IIS, ASP.NET), and then click Next.

This section covers:

Application Server Options

Summary of Selections

Completing the Configure Your Server Wizard

Removing the application server role

Application Server Options

On the Application Server Options page, you can choose to install the following optional components with your application server:

  • FrontPage Server Extensions—FrontPage Server Extensions enable multiple users to administer and publish a Web site from a client computer, remotely. Select this option if you want to enable multiple-users to simultaneously create Web sites, or enable users to create Web applications from their client computers, remotely, over the Internet.
  • Enable ASP.NET—ASP.NET is a unified Web application platform that provides the services necessary to build and deploy enterprise-class Web applications. ASP.NET offers a new programming model and infrastructure for more secure, scalable, and stable applications that can target any browser or device. If your Web site includes applications that have been developed by using ASP.NET, select this option. If you are not sure that you need to enable ASP.NET, you can enable it later by using IIS Manager. XOX By enabling ASP.NET, you can use your application server to host ASP.NET applications. Some of the features of ASP.NET include the following:
    • ASP.NET can run side by side with Active Server Pages (ASP) code on Internet Information Services (IIS). If you are already running ASP code, you do not need to upgrade your ASP pages, and you can add ASP.NET pages to your applications.
    • ASP.NET has enhanced performance.
    • ASP.NET supports many languages, including Visual Basic .NET, C#, and JScript .NET.

After you finish, click Next.

Summary of Selections

On the Summary of Selections page, you can view and confirm the options that you have selected. If you selected Application server (IIS, ASP.NET) on the Server Role page, the following appears:

  • Install Internet Information Services (IIS)
  • Enable COM+ for remote transactions
  • Enable Microsoft Distributed Transaction Coordinator (DTC) for remote access

If you selected FrontPage Server Extensions or ASP.NET, the following items also appear:

  • Install FrontPage Server Extensions
  • Enable ASP.NET

To apply the selections shown on the Summary of Selections page, click Next. When you click Next, the Configuring Components page of the Windows Components Wizard appears and then closes automatically. You cannot click Back or Next on this page.

Completing the Configure Your Server Wizard

After the components are configured, the Configure Your Server Wizard displays the This Server is Now an Application Server page. To review all of the changes made to your server by the Configure Your Server Wizard or to ensure that a new role was installed successfully, click Configure Your Server log. The Configure Your Server Wizard log is located at systemroot\Debug\Configure Your Server.log. To close the Configure Your Server Wizard, click Finish.

If the installation was not successful, the Cannot Complete page appears and IIS could not be installed. To troubleshoot the installation, click Configure Your Server log.

Removing the application server role

If you need to reconfigure your server for a different role, you can remove existing server roles. By removing the application server role, you will uninstall all application server components, such as IIS. Your server will no longer support serving Web pages, Web applications, or distributed applications.

To remove the application server role, restart the Configure Your Server Wizard by doing either of the following:

  • From Manage Your Server, click Add or remove a role. By default, Manage Your Server starts automatically when you log on. XOX
  • XOX

On the Server Role page, click Application server (IIS, ASP.NET), and then click Next. On the Role Removal Confirmation page, review the items listed under Summary, select the Remove the application server role check box, and then click Next. When you click Next, the Configuring Components page of the Windows Components Wizard appears and then closes automatically. You cannot click Back or Next on this page. On the Application Server Role Removed page, click Finish.

Next steps: Completing additional tasks

After you complete the Configure Your Server Wizard and enable the features that you need to run your applications, the computer is ready for use as a basic application server. Up to this point, you have completed the following tasks:

  • Installed Internet Information Services (IIS), ASP.NET, and COM+.
  • If necessary, enabled FrontPage Server Extensions.
  • If necessary, enabled ASP.NET.

The following table lists some of the additional tasks that you might want to perform on your application server.

Task | Purpose of task | Reference
Secure your application server. To ensure the security of this server, Microsoft recommends that you implement security precautions, such as firewalls and Internet Protocol security (IPsec), before placing it in a production environment. An application server may be targeted by attackers because of its exposure to the Internet and other networks. You can secure your applications by using authentication protocols, access control, Secure Sockets Layer (SSL), and encryption. Internet Protocol Security (IPSec);
Securing your network with Basic Firewall;
Security in Microsoft Internet Information Services
Secure your files with NTFS. | To secure your Web site, applications, databases, and files, use NTFS permissions. This is essential for a secure site. | To set, view, change, or remove permissions on files and folders
Configure Web Interface for Remote Administration. | To manage your application server by using a Web browser on a remote computer. | Using Web Interface for Remote Administration
Create a Web site. | To create a Web site to host your Web applications. | Web Site Setup in Microsoft Internet Information Services
Create applications with the latest development tools. | To learn about the latest development tools from Microsoft that can help you develop new applications more quickly and efficiently. | Microsoft Web site
Create ASP.NET Web Applications. | To create ASP.NET applications. | Creating ASP.NET Web Application at the Microsoft Web site
Secure your ASP.NET Web applications. | To ensure the security of your ASP.NET applications | ASP.NET Web Application Security at the Microsoft Web site


Mail server role: Configuring a mail server

Configure this computer as a mail server to install E-mail Services, which provides e-mail transfer and retrieval services. E-mail Services includes the POP3 service, which provides e-mail retrieval, and the SMTP service, which provides e-mail transfer. Administrators can use the POP3 service to store and manage e-mail accounts on the mail server. After you configure this computer as a mail server, users can connect to the mail server and retrieve e-mail to their local computer using an e-mail client that supports the POP3 protocol, such as Microsoft Outlook.

This topic explains how to use the Configure Your Server Wizard to install and configure E-mail Services. After you have completed the Configure Your Server Wizard, you must perform additional required steps to create mailboxes. After you have completed the Configure Your Server Wizard and created the appropriate mailboxes, you will have a fully-functioning mail server.

You can configure both member servers and stand-alone servers to be a mail server. However, the default authentication method and the available authentication methods will vary. For more information about the default authentication methods and the available authentication methods, see Before you begin and Configure POP3 Service.

This topic covers:

Before you begin

Configuring your mail server

Next steps: Completing additional tasks

Before you begin

Before you configure your computer as a mail server, verify that:

  • The server on which you intend to install e-mail services has a working Internet connection.
  • There is an NTFS partition available. With an NTFS partition, you can take advantage of the increased security provided by disk quotas. For more information about disk quotas, see Configuring disk quotas for the POP3 service.
  • You have a registered e-mail domain name. Contact your Internet service provider (ISP) for assistance in registering an e-mail domain name.
  • A Mail eXchanger (MX) record for your e-mail domain name exists and matches the name of your server. Contact your ISP to create an MX record.
  • You have configured your server for static addressing. Contact your ISP for the information necessary to configure your server for static addressing. For more information about how to configure your mail server with a static IP address, see To configure TCP/IP for static addressing.
  • Windows Firewall is enabled. For more information, see Security Configuration Wizard in Windows Server 2003 Service Pack 1 (http://www.microsoft.com/).
  • The Security Configuration Wizard is installed and enabled. For more information about the Security Configuration Wizard, see Security Configuration Wizard.

The following table lists the information that you need to know to before you add a mail server role.

Before adding a mail server role | Comments
Determine the appropriate level of security for this server. | A server in this role may be targeted by attackers because of its exposure to the Internet and other networks. To ensure the security of this server, Microsoft recommends that you implement security precautions, such as firewalls and Internet Protocol security (IPsec), before placing it in a production environment. For more information, see Internet Protocol security (IPsec) and Securing your network with Basic Firewall.
Determine the appropriate authentication method for your configuration. You must choose an authentication method before you create any e-mail domains on the mail server. The authentication method can be changed only if there are no existing e-mail domains on the mail server.

If the computer that you are configuring as a mail server is either a member server or a domain controller, the authentication method setting defaults to Active Directory authentication. Otherwise, the setting defaults to local Windows accounts authentication.
Determine that you have a registered e-mail domain name. The e-mail domain must be a registered domain name and it must match the Mail eXchanger (MX) record created by your ISP. If you do not already have an e-mail domain name, contact your ISP for assistance in registering a domain name.

Note

  • The POP3 service supports top-level and third-level domain names. For example, example.com and mailserver.example.com are both supported.

Configuring your mail server

To configure a mail server, start the Configure Your Server Wizard by doing either of the following:

  • From Manage Your Server, click Add or remove a role. By default, Manage Your Server starts automatically when you log on. XOX
  • XOX

On the Server Role page, click Mail server (POP3, SMTP), and then click Next.

This section covers:

Configure POP3 Service

Summary of Selections

Completing the Configure Your Server Wizard

Creating mailboxes

Removing the mail server role

Configure POP3 Service

On the Configure POP3 Service page, under Authentication method, click the appropriate method for your deployment. Windows Server 2003 operating systems support the authentication methods listed in the following table.

Use this authentication method | When
Local Windows accounts | Your mail server is not an Active Directory member server, and you want to store user accounts on the server on which the POP3 service is installed
Active Directory-Integrated | Your mail server is a domain controller or a member server
Encrypted Password File | Your mail server is not using Active Directory, or you do not want to have user accounts for the POP3 service on the local computer

The authentication methods that are available to you depend on the configuration of your server:

  • If the computer on which the POP3 service is running is a member server in an Active Directory domain, all three authentication methods are available.
  • If the computer on which the POP3 service is running is a domain controller, the available authentication methods are Active Directory integrated authentication and encrypted password file authentication.
  • Otherwise, the available authentication methods are local Windows accounts authentication and encrypted password file authentication.

Under E-mail domain name, type your registered e-mail domain name. You can create additional e-mail domains later by using the POP3 service snap-in or the Winpop command-line tool.

After you finish, click Next.

Summary of Selections

On the Summary of Selections page, you can view and confirm the options that you have selected. If you selected Mail server (POP3, SMTP) on the Server Role page, the following appears:

  • Install POP3 and Simple Mail Transfer Protocol (SMTP) to enable POP3 mail clients to send and receive mail

To apply the selections shown on the Summary of Selections page, click Next. After you click Next, the Configuring Components page of the Windows Components Wizard appears and then closes automatically. You cannot click Back or Next on this page.

Completing the Configure Your Server Wizard

After the components are configured, the Configure Your Server Wizard displays the This Server is Now a Mail Server page. To review all of the changes made to your server by the Configure Your Server Wizard, or to ensure that a new role was installed successfully, click Configure Your Server log. The Configure Your Server Wizard log is located at systemroot\Debug\Configure Your Server.log. To close the Configure Your Server Wizard, click Finish.

At this stage, you have a fully-functioning mail server, but you must also create mailboxes for all of the users in the domain who will be sending or receiving e-mail. Without mailboxes, users cannot send or receive e-mail.

However, before you start to use your mail server, we recommend the following steps:

  • Run Windows Update. For more information, see Windows Update.
  • Run the Security Configuration Wizard. For more information, see Security Configuration Wizard.
  • For the mail server role to work correctly, you may need to manually configure Windows Firewall by adding the ports required by POP3 service and SMTP service. For additional information about the ports required, see Windows Firewall Settings (http://www.microsoft.com/).

Creating mailboxes

To send and receive e-mail, each user must have a unique mailbox in the e-mail domain. You can create mailboxes from either the POP3 service snap-in or at the command line. This procedure uses the POP3 service snap-in. For more information about creating mailboxes or administering the POP3 service at the command line, see Winpop. For more information about creating mailboxes, see To create a mailbox.

Step Comments
Open the POP3 service snap-in. XOX

Notes

  • XOX
  • XOX
Create one or more mailboxes. In the console tree, select the e-mail domain that you specified in the Configure Your Server Wizard (for example, example.com). Right-click the e-mail domain, point to New, and then click Mailbox. Provide the following information:
  • Mailbox Name—the name of the mailbox. The maximum length for a mailbox name is 20 characters for local Windows accounts authentication, and 64 characters for encrypted password file authentication or Active Directory integrated authentication. The minimum length is 1 character.
  • Password—the password to access the mailbox.
  • Confirm Password—retype the password that was specified in the Password box.

If you are using Active Directory integrated authentication or local Windows accounts authentication, select the Create associated user for this mailbox check box, unless a user account already exists with the same name as the mailbox that you want to create. If the check box is already selected, clear it only if an account already exists with the same name as the mailbox that you want to create.

Removing the mail server role

If you need to reconfigure your server for a different role, you can remove existing server roles. By removing the mail server role, you will uninstall all mail server components, such as the POP3 service and SMTP service. After the mail server components are uninstalled, users will no longer be able to send or receive e-mail using that server. Any e-mail that is stored on the computer will not be affected by removing the mail server role and will remain in the mail store.

To remove the mail server role, restart the Configure Your Server Wizard by doing either of the following:

  • From Manage Your Server, click Add or remove a role. By default, Manage Your Server starts automatically when you log on. XOX
  • XOX

On the Server Role page, click Mail server (POP3, SMTP), and then click Next. On the Role Removal Confirmation page, review the items listed under Summary, select the Remove the mail server role check box, and then click Next. After you click Next, the Configuring Components page of the Windows Components Wizard appears, and then closes automatically. You cannot click Back or Next on this page. On the Mail Server Role Removed page, click Finish.

Next steps: Completing additional tasks

After you complete the Configure Your Server Wizard and create mailboxes, the computer is ready for use as a mail server. Up to this point, you have completed the following tasks:

  • Installed the POP3 service and the SMTP service.
  • Configured the POP3 service to use an authentication method.
  • Created an e-mail domain.
  • Created mailboxes.

The Configure Your Server Wizard automatically installs the POP3 service snap-in, which you use to manage your mail server. XOX

The following table lists additional tasks that you might want to perform on your mail server.

Task | Purpose of task | Reference
Provide users with the procedure to configure their e-mail clients to use the mail server. | To connect to the mail server, the user's e-mail client must be configured specifically for the mail server. | Configure e-mail clients
Implement disk quotas. | Disk quotas ensure that the mail store does not use an excessive or unanticipated amount of disk space, which could adversely affect the performance of the server on which the POP3 service is running. You must have an NTFS partition to implement disk quotas. NTFS partitions allow for greater directory and folder security, which better protects e-mail stored on the local hard disk. | Configuring disk quotas for the POP3 service
Configure your mail server to require secure e-mail client authentication. | The POP3 service supports Secure Password Authentication (SPA) for Active Directory integrated authentication and local Windows accounts authentication. Secure Password Authentication requires that all e-mail clients transmit both the user name and password using secure authentication. Secure Password Authentication is more secure than the default of plaintext and, therefore, is recommended over plaintext. Secure Password Authentication must be configured on both the server on which e-mail services are running and on every e-mail client that will connect to the mail server. | To configure the mail server to require Secure Password Authentication; To configure Outlook Express for Secure Password Authentication
Configure ports to allow remote administration. | To manage the mail server role from other computers on the network. | With Windows Firewall enabled, you might need to make specific configuration settings in order to use or remotely administer technologies that ship with Windows Server 2003 operating systems. For information about these settings, see Windows Firewall Settings (http://www.microsoft.com/).


Terminal server role: Configuring a terminal server

Configure this computer as a terminal server by installing the Terminal Server component, which provides centralized deployment of applications.

Using a terminal server, users in remote locations can run programs, save files, and use network resources as though those resources were installed on the users' own computers. By installing programs on a terminal server, you can ensure that all users are using the same version of a program. If you plan to use this computer to allow multiple users to access a program at the same time from a single point of installation, configure this computer as a terminal server.

However, if you plan to use this computer for remote administration on Windows Server 2003 operating systems, you do not need to install Terminal Server. Instead, you can use Remote Desktop for Administration (formerly Terminal Services in Remote Administration mode), which is installed by default on computers running one of the Windows Server 2003 operating systems. After you enable remote connections, Remote Desktop for Administration allows you to remotely manage servers from any client over a LAN, WAN, or dial-up connection. Up to two remote sessions, plus the console session, can be accessed at the same time, without requiring Terminal Server Licensing. For more information about Remote Desktop for Administration, see Remote Administration using Terminal Services.

This topic explains how to use the Configure Your Server Wizard to install and configure a terminal server. After you have completed the Configure Your Server Wizard, you must perform the following additional steps in order to have a basic terminal server.

  • Confirm Internet Explorer Enhanced Security Configuration settings.
  • Configure a Terminal Server License Server. For small deployments, it is acceptable to install both the terminal server and Terminal Server Licensing service on the same physical computer. However, for larger deployments, it is recommended that Terminal Server Licensing be installed on a separate server.

    • Important

    • This step is required. If you do not install Terminal Server Licensing, your terminal server will stop accepting connections from unlicensed clients when the evaluation period ends, 120 days after the first client logon.
  • Install client access licenses (CALs) on the Terminal Server License Server.
  • Install programs on the terminal server.
  • Distribute the latest version of Remote Desktop Connection to clients running earlier versions of Remote Desktop Connection for Windows.
  • Specify which users have permission to connect to the terminal server.

After you have completed both the Configure Your Server Wizard and these additional required tasks, you will have a basic terminal server.

This topic covers:

Before you begin

Configuring your terminal server

Next steps: Completing additional tasks

Before you begin

Before you configure your computer as a terminal server, verify whether or not:

  • The operating system is configured correctly. In Windows Server 2003 operating systems, a terminal server depends on the appropriate configuration of the operating system and its services. If you have a new installation of a Windows Server 2003 operating system, you can use the default service settings. No further action is necessary. If you upgraded to a Windows Server 2003 operating system or you want to confirm that your services are configured correctly for best performance and security, verify your service settings with the table in Default settings for services.
  • The computer is a server on a network or in a domain, but is not a domain controller. Installing Terminal Server on a domain controller affects performance because of the additional memory, network traffic, and processor time required to perform the tasks of a domain controller in a domain.
  • Windows Firewall is enabled. For information, see Security Configuration Wizard Documentation (http://www.microsoft.com/). Enable the Remote Desktop exception in Windows Firewall. If Terminal Server and Terminal Server Licensing are running on separate computers, add TCP port 135 to the Windows Firewall exceptions list.
  • The Security Configuration Wizard is installed and enabled. For information about the Security Configuration Wizard, see Security Configuration Wizard.
  • The computer meets processor and memory requirements for supporting multiple concurrent sessions where different users are logged on. A terminal server requires a minimum of 128 MB RAM, plus additional RAM for each user to support running each user's programs on the server. An additional 10 MB RAM is recommended for each light user, who typically runs one program at a time, and up to 21 MB RAM for each power user, who typically runs three or more programs at the same time. In addition, if you plan to install 16-bit applications on the terminal server, be aware that they consume additional resources when they run in 32-bit environments such as Windows Server 2003 operating systems.
  • There are no programs installed on the computer. You should add the Terminal Server role before you install the programs that you want users to access. If there are programs already installed on the computer, you might have to reinstall them to ensure that they work correctly in the Terminal Server environment.
  • No users are able to log on remotely to the computer. You should allow users to access the terminal server only after you have installed programs, tested their installation, and performed any tuning necessary for the programs to work in a multisession environment. For information about disabling terminal services connections temporarily, see To disable Terminal Services connections.
  • All existing disk volumes use the NTFS file system. FAT32 volumes do not provide either the required level of security for users in a multisession environment or the ability to set file permissions.

Configuring your terminal server

To configure a terminal server, start the Configure Your Server Wizard by doing either of the following:

  • From Manage Your Server, click Add or remove a role. By default, Manage Your Server starts automatically when you log on. XOX
  • XOX

On the Server Role page, click Terminal server, and then click Next.

This section covers:

Summary of Selections

Completing the Configure Your Server Wizard

Confirm Internet Explorer Enhanced Security Configuration Settings

Configuring a Terminal Server License Server

Installing client access licenses on the Terminal Server License Server

Installing programs on the terminal server

Deploying client software

Giving users permission to access the terminal server

Removing the terminal server role

Summary of Selections

On the Summary of Selections page, view and confirm the options that you have selected. If you selected Terminal server on the Server Role page, the following appears:

  • Install Terminal Server

To apply the selections shown on the Summary of Selections page, click Next. The following message appears: "During this process, the Configure Your Server Wizard restarts your computer. Before continuing, close any open programs." If you need to close open programs and you want to cancel the configuration of the terminal server role at this time, you must click Cancel now. When you click Cancel, the Configure Your Server Wizard displays the Cannot Complete page. To close the Configure Your Server Wizard, click Finish. Otherwise, if you click OK, the Configure Your Server Wizard begins the configuration process.

Next, the Configure Your Server Wizard displays the message "Installing Terminal Server." The Configuring Components page of the Windows Components Wizard appears and then closes automatically. You cannot click Back or Next on this page. Then, the Configure Your Server Wizard shuts down the computer and restarts it to accept the configuration changes that make the computer a terminal server.

During the restart process, a dialog box displays progress messages (for example, "Windows is starting up" and "Preparing network connections"). Depending on the size of your network, preparing network connections could take some time. When the Welcome to Windows dialog box appears, press CTRL+ALT+DEL. In the Log on to Windows dialog box, in Password, type your password. To complete the process, wait for the Configure Your Server Wizard to appear on the screen.

Completing the Configure Your Server Wizard

After your server restarts, the Configure Your Server Wizard displays the This Server is Now a Terminal Server page. To review all of the changes made to your server by the Configure Your Server Wizard or to ensure that a new role was installed successfully, click Configure Your Server log. The Configure Your Server Wizard log is located at systemroot\Debug\Configure Your Server.log. To close the Configure Your Server Wizard, click Finish.

Next, you must complete the following steps so that your server is ready to function as a basic terminal server:

  • Run Windows Update. For more information, see Windows Update.
  • Confirm Internet Explorer Enhanced Security Configuration settings.
  • Configure a Terminal Server License Server.
  • Install client access licenses (CALs) on the Terminal Server License Server.
  • Install programs on the terminal server.
  • Deploy the Remote Desktop Connection .msi file to clients not running XOX or Windows Server 2003 operating systems.
  • Give users permission to access the terminal server.

A separate window displays checklists that provide information about these additional requirements. The same information is covered in this document.

To run a terminal server, you need to configure Terminal Server Licensing. For small deployments, you can configure Terminal Server Licensing on the same physical computer as the terminal server. For larger deployments, you should install Terminal Server Licensing on a separate server. If a Terminal Server License Server is already installed, you can skip the steps for configuring a Terminal Server License Server and installing CALs, and begin Installing programs on the terminal server. Otherwise, if the Manage Your Server page displays a message indicating that a Terminal Server License Server was not found, you must configure a Terminal Server License Server before you can use your terminal server.

Confirming Internet Explorer Enhanced Security Configuration settings

After you complete the Configure Your Server Wizard and install Terminal Server, you can configure Internet Explorer Enhanced Security Configuration settings.

If you activate these settings, Internet Explorer applies the following security settings to a user who logs on as an administrator:

  • High security settings to the Internet and Local intranet security zones
  • Medium security settings to the Trusted sites zone

By applying high security settings to the Internet and Local intranet security zones, you disable scripts, Microsoft ActiveX controls, and the Microsoft virtual machine (Microsoft VM) for HTML content in these zones. You also prevent users from downloading files in these zones.

By applying medium security settings to the Trusted sites zone, you set standard browsing functionality. If you use sites for administrative tasks and Web-based applications that an administrator cannot access after you apply these settings, you can add the site addresses to the list of sites in the Trusted sites zone.

To review or change the Internet Explorer Enhanced Security Configuration settings, in Manage Your Server, click Internet Explorer Enhanced Security Configuration.

In Windows Server 2003 operating systems, you can implement enhanced security settings for Internet Explorer for all users and reduce the exposure of your server to Web sites that might pose a security risk. For more information, see Internet Explorer Enhanced Security Configuration.

Configuring a Terminal Server License Server

Configure a Terminal Server License Server, either on the same computer for which you have just configured the terminal server role (for small deployments), or on another computer (recommended for larger deployments). A Terminal Server License Server manages licenses for Terminal Services client connections. You are required to activate a Terminal Server License Server only once, after which the Terminal Server License Server becomes the repository for terminal server client licenses. Until the registration process is completed, your Terminal Server License Server can issue temporary licenses for clients.

Important

  • This step is required. If you do not configure a Terminal Server License Server, your terminal server will stop accepting connections from unlicensed clients at the end of the evaluation period, which is 120 days from the date of the first client logon.

The easiest and quickest way to activate a Terminal Server License Server is by using the Automatic method. To use this method, the computer running the Terminal Services Licensing service must have a direct connection to the Internet. For information about activation methods for computers that are not connected to the Internet, see To activate a Terminal Server License Server by using a Web browser and To activate a Terminal Server License Server by using the telephone.

The following table shows the steps you must take to configure and activate a Terminal Server License Server by using the Automatic method.

Task Comments
Install the Terminal Server Licensing service. Open Add or Remove Programs in Control Panel, and then click Add/Remove Windows Components. In the Windows Components Wizard, select the Terminal Server Licensing check box, and then click Next. If your network includes several domains, or if you are installing the Terminal Server Licensing service on a member server, click Your entire enterprise. If you want to maintain a separate Terminal Server License Server for each domain, or if your network includes workgroups or Windows NT 4.0 domains, click Your domain or workgroup. If you want to change the location of the license server database, specify a new location, and then click Next. The Configuring Components page displays the progress of configuration changes. On the Completing the Windows Components Wizard page, click Finish, and then click Close.

Note

  • XOX
Activate the Terminal Server License Server. Open Terminal Server Licensing, right-click the Terminal Server License Server you want to activate, and then click Activate Server. The Terminal Server License Server Activation Wizard starts. On the Connection method page, under Activation method, click Automatic connection, and then click Next. On the Company Information page, provide the following required information:
  • First name
  • Last name
  • Company name
  • Country or region
Confirm that the information you typed is correct, and then click Next. On the next Company Information page, you can provide the following optional information:
  • E-mail address
  • Organizational unit
  • Company address
  • City
  • State or province
  • Postal code
Confirm that the information you typed is correct, and then click Next. On the Completing the Terminal Server License Server Activation Wizard page, under Status, the following message appears: "Your license server has been successfully activated." If you want to install client licenses now, click Next. If you want to postpone the installation of client licenses, clear the Start Terminal Server Client Licensing Wizard now check box, and then click Finish.

Note

  • XOX

Installing client access licenses on the Terminal Server License Server

After you activate a Terminal Server License Server, the next step is to install client access licenses (CALs) on the Terminal Server License Server.

Important

  • Your Terminal Server License Server can issue temporary licenses that allow clients to use a terminal server for the duration of the evaluation period, which is 120 days from the first client logon. If you do not install CALs on your Terminal Server License Server, unlicensed clients will not be able to connect to your terminal server after the evaluation period has passed.

CALs are digitally-signed certificates that each client stores locally. All CALs are installed on a Terminal Server License Server. When a client logs on to a terminal server for the first time, the terminal server recognizes that the client has not been issued a CAL and locates a Terminal Server License Server to issue a new CAL to the client. For information about specific license requirements, see the Microsoft Web Site. (http://www.microsoft.com/)

Before you install CALs, you must have your licensing agreement numbers ready, and know which method you used to purchase them.

The easiest and quickest way to install CALs on a Terminal Server License Server is by using the Automatic method. To use this method, the computer running the Terminal Services Licensing service must have a direct connection to the Internet. For information about installing CALs for computers that are not connected to the Internet, see To install client license key packs by using a Web browser and To install client license key packs by using the telephone.

The following table shows the steps you must take to install CALs on a Terminal Server License Server by using the Automatic method.

Task Comments
Install CALs on the Terminal Server License Server. On the Terminal Server License Server, open Terminal Server Licensing. Verify that the installation method for the Terminal Server License Server is set to Automatic by right-clicking the Terminal Server License Server for which you want to install CALs, and then clicking Properties. If necessary, on the Installation Method tab, change the installation method to Automatic connection, and then click OK.

In the Terminal Server Licensing console tree, right-click the Terminal Server License Server on which you want to install CALs, click Install Licenses, and then click Next. The Terminal Server CAL Installation Wizard starts. On the Licensing program page, choose the license program under which you purchased your licenses, and then click Next. On the License Code page, type the license code for each license you have purchased, and then click Add after each entry. After you have typed all of the license codes, click Next. The Completing the Terminal Server CAL Installation Wizard page displays a message that the CALs were successfully installed. To close the wizard, click Finish.

Note

  • XOX

Installing programs on the terminal server

At this stage, you have accomplished the following tasks:

  • Completed the Configure Your Server Wizard and configured the terminal server role on your server.
  • Installed Terminal Server Licensing.
  • Activated the Terminal Server License Server.
  • Installed CALs on the Terminal Server License Server.

Now you are ready to install programs on the terminal server. Add or Remove Programs in Control Panel is the preferred method for program installation, and you should use this method whenever possible. This section describes how to use Add or Remove Programs to install programs on a terminal server.

There are other program installation methods, such as the change user command, Windows Installer packages (.msi files), and Group Policy Software Installation. For more information about the change user command, see To install a program by using the change user command. For more information about using Windows Installer, see Assigned and published programs. For more information about Group Policy, see Group Policy.

For improved performance and reduced network traffic, install programs on the local drive of the terminal server instead of on a file server. Ensure that you have enough space to install programs on NTFS file system drives instead of on FAT32 drives. NTFS drives allow you to set file permissions, which you cannot do on FAT32 drives.

If you are installing published programs, you must use another installation method, such as Group Policy Software Installation.

For performance and security reasons, you should use 32-bit programs whenever possible. Most 32-bit programs use the registry to read and write program settings, and need to write only to specific registry values. Running 16-bit programs can reduce the number of users a processor supports by 40 percent and increase the memory required for each user by 50 percent. In addition, some 16-bit programs must be able to write to the directory where the program's .ini file is stored.

RAM and CPU requirements increase approximately linearly with the number of sessions running. To reduce RAM and CPU requirements, consider restricting user or group access to certain program types, disabling unnecessary program features, or installing programs on separate terminal servers.

Some programs have known installation issues in a multisession environment. For information about programs that require installation scripts in order to work correctly in a multisession environment, see Optimizing Applications for Windows 2000 Terminal Services and Windows NT Server 4.0, Terminal Server Edition at the Microsoft Web site. (http://www.microsoft.com/)

Application compatibility considerations

You should install programs from the console session of the terminal server. You can install programs from a remote console session, but this is not the preferred method for installing programs.

Some programs require an application compatibility script to be run after the program is installed. The scripts are stored in the systemroot\Application Compatibility Scripts\Install directory on the terminal server.

You should be aware of the implications of the security mode in which the terminal server operates. There are two security modes:

  • Full security provides the most secure environment for users connecting to a terminal server. To run in this mode, applications must be written to run in the security context of an ordinary user. For Windows Server 2003 operating systems and Windows 2000, full security is the default.
  • Relaxed security enables you to run programs that otherwise might not work at all in the more rigorous Full security mode. However, in Relaxed security mode (also known as Windows NT 4.0/Terminal Server Edition permissions compatibility mode), any user on the system can change files and registry settings in many places throughout the system, although others users' data files might not be visible. A malicious user could exploit this situation by replacing a known and trusted program with a program of the same name but some harmful intent. If the operating system on your terminal server was installed using the Upgrade method, the security mode might be set to Relaxed security. When in doubt, you should choose Full security, test your applications in that mode, and change the security mode only if your test results indicate the need to do so.

The following table shows the steps you must take to install programs on a terminal server, using Add or Remove Programs.

Task | Comments
Ensure that no users are logged on to the terminal server. | Send a message to all users who are logged on to the terminal server. Program installation often requires restarting the computer, and their sessions will be disconnected. You should not allow users to access the terminal server until programs have been installed and tested.
Disable Terminal Services connections temporarily. | Right-click My Computer, click Properties, click the Remote tab, and then clear the Allow users to connect remotely to this computer check box.
Specify Full Security as the security mode. Open Terminal Services Configuration. In the console tree, click Server Settings, right-click Permission Compatibility, and then click Properties. In the Permission Compatibility dialog box, click Full Security, and then click OK.

Note

  • XOX
Install programs from a CD or floppy disk. Ensure that you are logged on as a member of the Administrators group on the terminal server. Open Add or Remove Programs in Control Panel, and then click Add New Programs. Click CD or Floppy. Insert the CD or floppy disk into the appropriate drive, and then click Next. Verify that the installation file is specified correctly in the Open box on the Run Installation Program page, and then click Finish. Follow the instructions in the program's installation wizard. After the program is installed, edit and run any applicable scripts to tailor the program for a multisession environment.

Note

  • XOX
Test the installation.

Ensure that event logging is enabled, by opening Services in Administrative Tools. Create a temporary user account that mimics the settings of the user or users who will access the program, and use the account to log on to the terminal server. Start the program and step through some basic tasks. Then, use Event Viewer to determine which files or directories need Write access and which registry keys require Read access by the user for correct operation. Note that this process might not find all files, directories, and registry keys for which the application requires access in all user scenarios. The only way to ensure that you have accounted for all access requirements is to perform tasks manually.

Some programs enable users to start other programs. For example, Microsoft Access has a toolbar that can be used to start other Microsoft Office programs. If you want users to have access only to specified programs when they log on to the terminal server, you should disable toolbar access from within programs that you install on the terminal server.

Note

  • XOX
Tune programs for multisession use. | Use a text editor such as Notepad to modify any scripts, and then run the scripts to tune any programs that require it. To obtain the scripts, see Optimizing Applications for Windows 2000 Terminal Services and Windows NT Server 4.0, Terminal Server Edition at the Microsoft Web site. (http://www.microsoft.com/)
Run application compatibility scripts. | Navigate to the systemroot\Application Compatibility Scripts\Install directory on the terminal server, and run scripts for any programs that require them.
Enable remote connections on the terminal server. Right-click My Computer, click Properties, click the Remote tab, and then check the Allow users to connect remotely to your computer check box.

Note

  • Depending on your desktop settings, My Computer might not appear on your desktop. XOX

Deploying client software

Remote Desktop Connection, formerly known as the Terminal Services Client, is installed automatically on computers running XOX and Windows Server 2003 operating systems. For performance and security reasons, computers running earlier versions of Microsoft Windows, including Windows 2000 Server, Windows 2000 Professional, Windows NT 4.0, Windows 98, and Windows 95, should have the latest version of Remote Desktop Connection installed.

There are several ways to deploy the client software:

  • Share the Msrdpcli.msi file, and use Microsoft IntelliMirror to distribute it to workstations running Windows 2000.
  • Download Remote Desktop Connection directly from the Microsoft Web site. (http://www.microsoft.com/downloads)
  • Place the .msi file in a shared folder residing on a server on the network.

This topic describes how to install the client software from a shared folder residing on a server on the network.

Before you deploy the client software, decide whether you want the software to be installed for the use of a single user or for anyone who uses the client computer. You will make this choice during the deployment process.

The following table shows the steps you must take to deploy the latest version of Remote Desktop Connection to clients running earlier versions of either Windows or Remote Desktop Connection.

Task | Comments
Share the client setup folder. On the computer running a Windows Server 2003 operating system, open Windows Explorer. Navigate to the systemroot\System32\Clients\Tsclient\win32 folder, right-click the win32 folder, click Sharing and Security. On the Sharing tab, click Share this folder, and then click OK.

Note

  • XOX
Install Remote Desktop Connection. | On the client computer, click Start, click Run, and then, in Open, type \\ServerName\win32, where ServerName is the name of the computer where the shared folder is located. Double-click the msrdpcli.msi file to start the InstallShield Wizard for Remote Desktop Connection, and then click Next. Read the License Agreement, click I accept the terms in the license agreement, and then click Next. Type your name and organization in the Customer Information page, click Anyone who uses this computer (all users), and then click Next. On the Ready to Install the Program page, either click Back to review or change any of your installation settings, or click Install to begin the installation. To complete the installation, click Finish.

Giving users permission to access the terminal server

By default, on Windows Server 2003 operating systems, members of the Administrators and Remote Desktop Users groups can use Terminal Services connections to connect to a remote computer. The Remote Desktop Users group is not populated by default, so you must decide which users and groups should have permission to log on remotely, and then manually add them to this group.

Important

  • You must use the Remote Desktop Users group to grant selected users and groups the necessary permission to make Terminal Services connections to remote computers.
  • Membership in the Remote Desktop Users group does not also put the user into the local Users group. Depending on the contents of your local Users group, you might need to add the user to that group also.

Before you give users permission to access the terminal server, you must:

  • Check the membership of the Administrators group to ensure that you know who has access to the terminal server.
  • Decide which users should have permission to access the terminal server.
  • Determine which users must also be added to the local Users group.

The following table shows the steps you must take to give users permission to access the terminal server.

Task Comments
Add users to the Remote Desktop Users group. Open Computer Management (Local), and in the console tree, click Local Users and Groups. In the details pane, double-click the Groups folder, double-click Remote Desktop Users, and then click Add. In the Select Users dialog box, click Locations to specify the search location. To specify the types of objects that you want to search for, click Object Types. In this case, you want to search for Users or Groups. Type the name that you want to add in the Enter the object names to select (examples) box, and then click Check Names. When the name is located, click OK.

Note

  • XOX
Add users to the local Users group, if they are not already members. Open Computer Management (Local), and in the console tree, click Local Users and Groups. In the details pane, double-click the Groups folder, double-click Users, and then click Add. In the Select Users dialog box, click Locations to specify the search location. To specify the types of objects that you want to search for, click Object Types. In this case, you want to search for Users or Groups. Type the name that you want to add in the Enter the object names to select (examples) box, and then click Check Names. When the name is located, click OK.

Note

  • XOX

Removing the terminal server role

If you need to reconfigure your server for a different role, you can remove existing server roles. If you remove the terminal server role, you will need to reinstall all software, review and update any file or registry permissions for which you changed default values, and review and update any software restriction policies that were used to control programs running on the terminal server.

To remove the terminal server role, restart the Configure Your Server Wizard by doing either of the following:

  • From Manage Your Server, click Add or remove a role. By default, Manage Your Server starts automatically when you log on. XOX
  • XOX

On the Server Role page, click Terminal server, and then click Next. On the Role Removal Confirmation page, review the items listed under Summary, select the Remove the terminal server role check box, and then click Next. The following message appears: "During this process, the Configure Your Server Wizard restarts your computer. Before continuing, close any open programs." If you need to close open programs and you want to cancel the removal of the Terminal Server role at this time, you must click Cancel now. When you click Cancel, the Configure Your Server Wizard displays the Cannot Complete page. To close the Configure Your Server Wizard, click Finish. Otherwise, if you click OK, the Configure Your Server Wizard begins the removal process.

Next, the Configure Your Server Wizard displays the "Removing Terminal Server" message. The Configuring Components page of the Windows Components Wizard appears, displays messages about the configuration changes being made to the computer, and then closes. The Configure Your Server Wizard shuts down the computer and restarts it to accept the configuration changes that remove this role.

During the restart process, a dialog box displays progress messages, for example, "Windows is starting up" and "Preparing network connections." Depending on the size of your network, preparing network connections could take some time. When the Welcome to Windows dialog box appears, press CTRL+ALT+DEL. In the Log on to Windows dialog box, in Password, type your password. To complete the process, wait for the Configure Your Server Wizard to appear on the screen. On the Terminal Server Role Removed page, click Configure Your Server log to see a record of your changes, and then click Finish.

After you remove the terminal server role, you should:

  • Reinstall all software.
  • Review any file or registry permissions for which you changed default values and, if necessary, make changes.
  • Review any software restriction policies used to control programs running on the terminal server and, if necessary, make changes.

Next steps: Completing additional tasks

After you complete the Configure Your Server Wizard and associated tasks, the computer is ready for use as a basic terminal server that can accept multiple connections from remote clients. Up to this point, you have completed the following tasks:

  • Run the Configure Your Server Wizard.
  • Activated a Terminal Server License Server.
  • Installed CALs on the Terminal Server License Server.
  • Installed applications on the terminal server.
  • Deployed the Remote Desktop Connection .msi file to clients not running XOX or Windows Server 2003 operating systems.
  • Configured user permissions for user access to the terminal server.

The following table lists some additional tasks you might want to perform on your terminal server.

Task | Purpose of task | Reference
Manage Terminal Services connections. | To enable, disable, rename, or delete a connection. | Manage Terminal Services connections
Specify connection permissions. | To grant terminal server access only to selected users and groups. To identify which users and groups are permitted to perform a given task or tasks on the terminal server. | Managing Terminal Services Users; Managing permissions on connections
Configure terminal server settings using either Group Policy or Terminal Services Configuration. | To configure settings such as Active Desktop, temporary folders, and session limits for individual users. | Configure server settings
Deploy Remote Desktop Web Connection. | To allow users to create a Remote Desktop connection within Internet Explorer, even though the Remote Desktop Connection client is not installed on their computers. | About Remote Desktop Web Connection
Control programs running in a terminal server session. | To protect terminal servers and users from unknown, or possibly malicious, programs. | Using Software Restriction Policies in XOX and Windows Server 2003 operating systems to Protect Against Unauthorized Software at the Microsoft Web site. (http://www.microsoft.com/)
Configure Session Directory settings. | To ensure that users are transparently reconnected to the original server hosting their disconnected Terminal Server sessions. This task applies to terminal servers that are part of a cluster of terminal servers, and requires that a server running either XOX, or a XOX, is visible on the network, and has the Session Directory service enabled. This session directory server should not be the server on which the Terminal Server role is configured. | Load balancing and terminal servers


Remote access/VPN server role: Configuring a remote access/VPN server

You can configure a server that allows remote users to access resources on your private network over dial-up or virtual private network (VPN) connections. This type of server is called a remote access/VPN server. Remote access/VPN servers can also provide network address translation (NAT). With NAT, the computers on your private network can share a single connection to the Internet. With VPN and NAT, your VPN clients can determine the IP addresses of the computers on your private network, but other computers on the Internet cannot.

This topic explains the basic steps for configuring a remote access/VPN server using Manage Your Server, the Configure Your Server Wizard, and the Routing and Remote Access Server Setup Wizard. After you finish configuring a basic remote access/VPN server, you can complete additional configuration tasks, depending on how you want to use the remote access/VPN server.

This topic covers:

Before you begin

Configuring your remote access/VPN server

Next steps: Completing additional tasks

Before you begin

Before you configure your server as a remote access/VPN server, you should verify whether or not:

  • The operating system is configured correctly. In Windows Server 2003 operating systems, remote access and VPN depend on the appropriate configuration of the operating system and its services. If you have a new installation of a product in a Windows Server 2003 operating system, you can use the default service settings. No further action is necessary. If you upgraded to a product in a Windows Server 2003 operating system or you want to confirm that your services are configured correctly for best performance and security, verify your service settings by comparing them to the table in Default settings for services.
  • Your server is correctly configured for optimal security for your network needs. Because your remote access/VPN server will connect your private network, the Internet, and your remote clients, you must make sure the server is secure. The security of your private network depends on the security of your remote access/VPN server. For more information, see Security information for remote access.
  • Windows Firewall is enabled. For information, see Windows Firewall Settings (http://www.microsoft.com/).
  • The Security Configuration Wizard is installed and enabled. For information about the Security Configuration wizard, see Security Configuration Wizard.
  • This computer has two network interfaces, one that connects to the Internet and one that connects to the private network. The connection to the Internet must be a dedicated connection with enough bandwidth that VPN users can connect to your private network and users on your private network can connect to the Internet. The connection to computers on your private network must be made through a hardware device, such as a network adapter.
  • All needed network protocols have been installed for your network interfaces. For more information, see Network interfaces.

The following table lists the information that you need to know before you configure a remote access/VPN server.

Before adding a remote access/VPN server role | Comments
Run Windows Update. | Run Windows Update to verify that your server has the most current operating system updates installed. For more information, see Windows Update.
Configure ports to allow remote administration | If this remote access/VPN server will be managed remotely, configure ports to allow remote access by administrators. With Windows Firewall enabled, you might need to make specific configuration settings in order to use or remotely administer technologies that ship with Windows Server 2003 family operating systems. For information about these settings, see Windows Firewall Settings (http://www.microsoft.com/).
Determine which network interface connects to the Internet and which network interface connects to your private network. | During configuration, you will be asked to choose which network interface connects to the Internet. If you specify the incorrect interface, your remote access/VPN server will not operate correctly.
Determine whether remote clients will receive IP addresses from a Dynamic Host Configuration Protocol (DHCP) server on your private network or from the remote access/VPN server that you are configuring. | If you have a DHCP server on your private network, the remote access/VPN server can lease 10 addresses at a time from the DHCP server and assign those addresses to remote clients. If you do not have a DHCP server on your private network, the remote access/VPN server can automatically generate and assign IP addresses to remote clients. If you want the remote access/VPN server to assign IP addresses from a range that you specify, you must determine what that range should be.
Determine whether you want connection requests from VPN clients to be authenticated by a Remote Authentication Dial-In User Service (RADIUS) server or by the remote access/VPN server that you are configuring. | Adding a RADIUS server is useful if you plan to install multiple remote access/VPN servers, wireless access points, or other RADIUS clients to your private network. For more information, see Internet Authentication Service.
Determine whether VPN clients can send DHCP messages to the DHCP server on your private network. | If a DHCP server is on the same subnet as your remote access/VPN server, DHCP messages from VPN clients will be able to reach the DHCP server after the VPN connection is established. If a DHCP server is on a different subnet than your remote access/VPN server, make sure that the router between subnets can relay DHCP messages between clients and the server. If your router is running a Windows Server 2003 operating system, you can configure the DHCP Relay Agent service on the router to forward DHCP messages between subnets.
Verify that all users have user accounts that are configured for dial-up access. | Before users can connect to the network, they must have user accounts on the remote access/VPN server or in Active Directory. Each user account on a stand-alone server or a domain controller contains properties that determine whether that user can connect. On a stand-alone server, you can set these properties by right-clicking the user account in Local Users and Groups and clicking Properties. On a domain controller, you can set these properties by right-clicking the user account in the Active Directory Users and Computers console and then clicking Properties. For more information, see Dial-in properties of a user account and Active Directory Users and Computers.

Configuring your remote access/VPN server

To configure a remote access/VPN server, start the Configure Your Server Wizard by doing either of the following:

  • From Manage Your Server, click Add or remove a role. By default, Manage Your Server starts automatically when you log on.
  • XOX

On the Configuration Options page, click Custom configuration, and then click Next. On the Server Role page, click Remote access/VPN server, and then click Next.

This section describes the steps in the Routing and Remote Access Server Setup Wizard for configuring a remote access/VPN server that is not part of an Active Directory domain or part of a network with DNS or DHCP servers. If you follow these steps, you will configure a remote access/VPN server that provides both dial-up and VPN access for remote access clients, provides NAT for computers on your private network, generates and assigns IP addresses for remote access clients, and locally authenticates connection requests.

This section covers:

Summary of Selections

Using the Routing and Remote Access Server Setup Wizard

Completing the Configure Your Server Wizard

Completing configuration in Routing and Remote Access

Removing the remote access/VPN server role

Summary of Selections

On the Summary of Selections page, you can view and confirm the options that you have selected. If you clicked Remote access/VPN server on the Server Role page, the following line appears:

  • Run the Routing and Remote Access Server Setup Wizard to set up routing and VPN

To apply the selections shown on the Summary of Selections page, click Next. The Configure Your Server Wizard starts the Routing and Remote Access Server Setup Wizard. If you cancel the Routing and Remote Access Server Setup Wizard, your remote access/VPN server will not be configured, the Routing and Remote Access service will not be started, and the Configure Your Server Wizard will display the Cannot Complete page.

When you complete the Routing and Remote Access Server Setup Wizard and the Configure Your Server Wizard, the Routing and Remote Access service is started automatically.

Using the Routing and Remote Access Server Setup Wizard

After you choose the remote access/VPN role and confirm your Summary of Selections by clicking Next in the Configure Your Server Wizard, the Routing and Remote Access Server Setup Wizard starts.

This section describes the following steps in the Routing and Remote Access Server Setup Wizard:

Configuration

VPN Connection

IP Address Assignment

Name and Address Translation Services

Address Assignment Range

Managing Multiple Remote Access Servers

Completing the Routing and Remote Access Server Setup Wizard

Configuration

On the Configuration page, click Virtual Private Network (VPN) access and NAT, and click Next.

Important

  • This document describes the Virtual Private Network (VPN) access and NAT configuration only. If you decide to choose a different configuration, review the documentation for Routing and Remote Access before you complete the Routing and Remote Access Server Setup Wizard. This document will not help you complete any other role than Virtual Private Network (VPN) access and NAT. For more information about other configurations, see Common configurations for remote access servers.

VPN Connection

On the VPN Connection page, click the network interface that connects this computer to the Internet. The network interface you choose will be configured to receive connections from VPN clients. Any interface you do not choose will be configured as a connection to your private network.

In Network Interfaces, the Enable security on the selected interface by setting up Basic Firewall check box will already be selected. Do not clear this check box. This option configures Basic Firewall, a dynamic packet filtering service that helps protect your private network from unsolicited network traffic.

After you finish, click Next.

IP Address Assignment

On the IP Address Assignment page, the Automatically option is selected automatically. Do not change the selection. This selection configures your server to generate and assign IP addresses to remote clients.

After you finish, click Next.

Name and Address Translation Services

On the Name and Address Translation Services page, the Enable basic name and address services option is selected automatically. Do not change the selection. This selection configures your server to automatically assign IP addresses to any computer on your private network that requests one. The selection also configures your server to forward name resolution requests to a DNS server on the Internet.

After you finish, click Next.

Address Assignment Range

The Address Assignment Range page displays the range of addresses that is defined for assignment to any computer on your network that requests one. This range is generated based on the IP address of the network adapter you chose on the VPN Connection page. Review the information presented.

After you finish, click Next.

Managing Multiple Remote Access Servers

On the Managing Multiple Remote Access Servers page, the No, use Routing and Remote Access to authenticate connection requests option is selected automatically. Do not change the selection. This selection configures your server to authenticate connection requests locally by using Windows authentication, Windows accounting, and locally stored remote access policies.

After you finish, click Next.

Completing the Routing and Remote Access Server Setup Wizard

On the Completing the Routing and Remote Access Server Setup Wizard page, review the summary information. Verify that:

  • The correct network interface is configured to provide VPN access.
  • Dial-up and VPN clients are assigned to your private network for addressing.
  • Client connections are accepted and authenticated by using remote access policies for this remote access/VPN server.
  • NAT is configured for the correct network interface.
  • Clients will be assigned IP addresses from the correct range.

If any of the summary information is incorrect, click Back, and then change the information.

If you click Finish, you will not be able to open the Routing and Remote Access Server Setup Wizard again, unless you either remove the remote access/VPN server role from within the Configure Your Server Wizard or disable Routing and Remote Access from the Routing and Remote Access snap-in.

After you have ensured that the summary information is correct, click Finish. A message will appear informing you that, to support the relaying of DHCP messages from remote access clients to a DHCP server, you must open Routing and Remote Access on the remote access/VPN server and configure DHCP Relay Agent with the IP address of a DHCP server. Click OK. The Routing and Remote Access service will be started automatically, and the Configure Your Server Wizard will reappear.

Completing the Configure Your Server Wizard

After you complete the Routing and Remote Access Server Setup Wizard, the Configure Your Server Wizard displays the This Server is Now a Remote Access/VPN Server page. To review all of the changes made to your server by the Configure Your Server Wizard or to ensure that a new role was installed successfully, click Configure Your Server log. The Configure Your Server Wizard log is located at systemroot\Debug\Configure Your Server.log. To close the Configure Your Server Wizard, click Finish.

You are now ready to complete configuration for your remote access/VPN server in Routing and Remote Access.

Completing configuration in Routing and Remote Access

To open Routing and Remote Access, click Manage this remote access/VPN server from Manage Your Server. You can also open Routing and Remote Access from Administrative Tools. XOX

In Routing and Remote Access, double-click the server you have just configured, and then click Remote Access Policies. The default remote access policy is set to deny all access to everyone. Your users will not be able to connect to your remote access/VPN server until you edit the default policy to allow access or replace the default policy with your own policies. Review the default policy by double-clicking it, and then edit it to specify the access that you want to allow your users.

If this server has been previously configured as a remote access/VPN server or if IAS has been configured on this server, the remote access policy or policies that appear in Routing and Remote Access might be configured differently from the default remote access policy. Carefully review all of your remote access policies to ensure that you have allowed and denied remote access according to your network needs. Be sure that you are not accidentally allowing or denying more remote access to your network than you intend.

For more information, see Add a remote access policy, Introduction to remote access policies, and To re-create the default remote access policy.

After you have configured remote access policies, you have completed all necessary configuration for a remote access/VPN server on a network without a DHCP server. If your network uses a DHCP server, you must also configure the DHCP Relay Agent before configuration is complete. In Routing and Remote Access, double-click IP Routing, right-click DHCP Relay Agent, and then click Properties. Type the IP address of the DHCP server for your network in Server address, click Add, and then click OK.

Removing the remote access/VPN server role

If you need to reconfigure your server for a different role, you can remove existing server roles. When you remove the remote access/VPN server role, your server will no longer provide dial-up or VPN access for remote access clients. Additionally, your server will no longer provide NAT for computers on your private network. Remote users will not be able to connect to your private network, and the computers on your private network might not be able to connect to the Internet. Basic Firewall will no longer protect the computers on your private network. After removing the remote access/VPN server role, consider adding another firewall to protect the computers on your private network, if your network does not already have one. Test your private network to make sure computers on the private network have the level of access to the Internet required by your business needs. Reconfigure remote access policies in IAS to deny all remote access attempts.

To remove the remote access/VPN server role, restart the Configure Your Server Wizard by doing either of the following:

  • From Manage Your Server, click Add or remove a role. By default, Manage Your Server starts automatically when you log on. XOX
  • XOX

On the Server Role page, click Remote access/VPN server, and then click Next. On the Role Removal Confirmation page, review the items listed under Summary, select the Remove the remote access/VPN server role check box, and then click Next. In the dialog box that asks you to confirm that you want to disable the router and remove the remote access configuration, click Yes. On the Remote Access/VPN Server Role Removed page, click Finish.

Next steps: Completing additional tasks

After you complete the Configure Your Server Wizard and complete configuration in Routing and Remote Access, your server is ready for use as a remote access/VPN server that provides both VPN access and NAT. Up to this point, you have completed the following:

  • Started the Routing and Remote Access service.
  • Configured your server to accept VPN and dial-up connections.
  • Configured your server to provide NAT for your private network.
  • Configured remote access policies to allow users to connect to the server running Routing and Remote Access.
  • If the network uses a DHCP server, configured the DHCP Relay Agent to forward DHCP messages from remote access clients to the DHCP server.

If you have completed all of these tasks, you have created a basic remote access/VPN server that will allow remote computers to connect to your server with a dial-up or a VPN connection and provide network address translation (NAT) for your private network.

The following table lists additional tasks that you might want to perform on your remote access/VPN server.

Task | Purpose of task | Reference
Configure static packet filters. | To add static packet filters to better protect your network. | To add local host filters
Configure services and ports. | To choose which services on your private network you want to make available for remote access users. | To configure services and ports
Adjust logging levels for routing protocols. | To configure the level of event details that you want to log. You can decide what information you want to track your log files. | To log details for a routing protocol
Configure the number of VPN ports. | To add or remove VPN ports. | To add PPTP or L2TP ports
Create a Connection Manager profile for your users. | To manage the client connection experience for your users and simplify troubleshooting client connections. | Connection Manager Administration Kit
Add Certificate Services. | To configure and manage a certification authority (CA) on a server for use in a public key infrastructure (PKI). | Certificate Services; Computer certificates for L2TP/IPSec VPN connections
Increase remote access security. | To protect your remote users and your private network by enforcing the use of secure authentication methods, requiring higher levels of data encryption, and more. | Security information for remote access
Increase VPN security. | To protect your remote users and your private network by requiring the use of secure routing and tunneling protocols, configuring account lockout, and more. | Security information for VPN


Domain controller role: Configuring a domain controller

Domain controllers store data and manage user and domain interactions, including user logon processes, authentication, and directory searches. If you plan to use this server to provide the Active Directory directory service to network users and computers, configure this server as a domain controller.

To configure a server as a domain controller, install Active Directory on the server. There are four options available in the Active Directory Installation Wizard. You can create an additional domain controller in an existing domain, a domain controller for a new child domain, a domain controller for a new domain tree, or a domain controller for a new forest. If you are not sure which role you need, read about each role by clicking the role option.

Notes

  • If you have already installed a domain controller role and you want to view next steps, in the list below, click the domain controller configuration that you installed, and then click Next steps: Completing additional tasks.
  • If you need to reconfigure your server for a different role, you can remove existing server roles. By removing the domain controller role, you will uninstall Active Directory from this server. After Active Directory has been uninstalled, this server will no longer participate in replication of directory objects and domain-based user authentication requests. For more information, see the sections below.
Click the type of domain controller role that you want to create:
Creating an additional domain controller for an existing domain
Creating a domain controller for a new forest
Creating a domain controller for a new child domain
Creating a domain controller for a new domain tree

Creating an additional domain controller for an existing domain

Create additional domain controllers when you want to improve the availability and reliability of network services. By adding additional domain controllers, you can provide fault tolerance, balance the load of existing domain controllers, provide additional infrastructure support to sites, and improve performance by making it easier for clients to connect to a domain controller when they log on to the network. For example, as seen in the following illustration, by adding a new domain controller (DC2) to the microsoft.com domain, it helps offset the load on other domain controllers.

An additional domain controller is used to load balance and provide fault tolerance.

This topic explains the basic steps that you must follow to create an additional domain controller in your organization.

This process involves using the Configure Your Server Wizard and the Active Directory Installation Wizard to install Active Directory on this server. When you have finished setting up your domain controller, you can complete additional configuration tasks.

This topic covers:

Before you begin

Configuring your domain controller

Next steps: Completing additional tasks

Before you begin

Before you configure your server as a domain controller, verify that:

  • TCP/IP configuration settings for the server are correct, particularly those used for DNS name resolution. For more information, see To configure TCP/IP to use DNS
  • All existing disk volumes use the NTFS file system. Active Directory requires at least one NTFS volume in which to store the SYSVOL folder and its contents. FAT32 volumes are not secure, and they do not support file and folder compression, disk quotas, file encryption, or individual file permissions.

The following table lists the information that you need to know before you add an additional domain controller.

Before adding an additional domain controller role | Comments
Determine which sites require a domain controller. | If your network is divided into sites, it is good practice to put at least one domain controller in each site to enhance network performance. When users log on to the network, a domain controller must be contacted as part of the logon process. If clients have to connect to a domain controller located in a different site, the logon process can take a long time.
Determine whether to add an additional domain controller over the network or through backup media taken from an existing domain controller. | With Windows Server 2003 operating systems, you can install Active Directory on member servers using a restored backup taken from a domain controller running Windows Server 2003. You can store this backup on any backup media (for example, tape, CD, or DVD) or a shared network resource. By using restored backup files to create an additional domain controller, you greatly reduce the network bandwidth used when you install Active Directory over a shared network resource. You still need network connectivity to replicate all new objects and recent changes for existing objects to the new domain controller. For more information about creating an additional domain controller from backup media, see Creating additional domain controllers.
Determine whether you want your new domain controller to host a global catalog. | A global catalog stores a full copy of all objects in the directory for its host domain and a partial copy of all objects for all other domains in the forest. To optimize network performance in a multiple-site environment, consider adding global catalogs for select sites. In a single-site environment, a single global catalog is usually sufficient to cover common Active Directory queries. However, in a multiple-site environment it is recommended that you use global catalogs in each site. For more information about when to add global catalogs in a multiple site environment, see Global catalogs and sites.
Domain controllers running Windows 2000 or Windows Server 2003 are available. | The domain must have at least one other domain controller running Windows 2000 or Windows Server 2003 to add an additional domain controller. Active Directory domain controllers cannot be configured as backup domain controllers (BDCs) for Windows NT domains.
Obtain the administrative credentials necessary to add a domain controller. | To add an additional domain controller to an existing domain, you must be a member of the Domain Admins group or the Enterprise Admins group in Active Directory, or you must have been delegated the appropriate authority.
Identify the DNS domain name of the Active Directory domain to which you want to add the additional domain controller. | You need to provide the DNS domain name when you use the Active Directory Installation Wizard.

Configuring your domain controller

To configure an additional domain controller, start the Configure Your Server Wizard by doing either of the following:

  • From Manage Your Server, click Add or remove a role. By default, Manage Your Server starts automatically when you log on. XOX
  • XOX

On the Server Role page, click Domain Controller (Active Directory), and then click Next.

This section describes each of the steps in this process and outlines the required choices and decisions you will make as you configure your domain controller. The following sections cover these configuration steps:

Summary of Selections

Using the Active Directory Installation Wizard

Completing the Configure Your Server Wizard

Removing the domain controller role

Summary of Selections

On the Summary of Selections page of the Configure Your Server Wizard, you can view and confirm the options that you have selected. If you selected Domain Controller (Active Directory) on the previous page, the following appears:

  • Run the Active Directory Installation Wizard to configure this server as a domain controller

To apply the selections shown on the Summary of Selections page, click Next.

Using the Active Directory Installation Wizard

After you click Next, the Active Directory Installation Wizard starts automatically. If this is the first time you have installed Active Directory on a server, click Active Directory Help for more information about Active Directory.

After you finish reading about Active Directory, click Next. You can return to this page from any place in the wizard until you click Finish on the last page. On the Operating System Compatibility page, read the information and then click Next. If this is the first time you have installed Active Directory on a server running Windows Server 2003, click Compatibility Help for more information.

This section describes the following steps in the Active Directory Installation Wizard:

Domain Controller Type

Network Credentials

Additional Domain Controller

Database and Log Folders

Shared System Volume

Directory Services Restore Mode Administrator Password

Summary

Domain Controller Type

On the Domain Controller Type page of the Active Directory Installation Wizard, click Additional domain controller for an existing domain.

As part of the process for creating an additional domain controller, the wizard deletes all local accounts, cryptographic keys, and encrypted data such as encrypted files and e-mail on the server. To prevent loss of data, follow the recommendations on the Domain Controller Type page before continuing to the next page.

After you finish, click Next.

Network Credentials

On the Network Credentials page, type the user name, password, and domain of the user account you want to use.

Option | Comments
User name | Type the name of a user account that has the necessary administrative credentials. The user account must be a member of the Domain Admins group for the target domain, or a member of the Enterprise Admins group, or must have been delegated the appropriate authority.
Password | Type the password for the user account. This should always be a strong password. For more information, see Strong passwords.
Domain | Type the full DNS name of the domain in which this user name and password are valid (for example, child.microsoft.com). This is also the domain where you want to add an additional domain controller.

After you finish, click Next.

Additional Domain Controller

On the Additional Domain Controller page, type the full DNS name of the domain to which you want to add this domain controller. A full DNS name is also referred to as a fully qualified domain name (FQDN). Active Directory domains are named with DNS names and follow the same hierarchical structure of DNS.

After you finish, click Next.

Database and Log Folders

On the Database and Log Folders page, type the locations in which you want to install the database and log folders, or click Browse to choose the locations. To avoid any problems with installing or removing Active Directory, it is important to confirm that you have sufficient disk space to host the directory database and log files. The Active Directory Installation Wizard requires 250 megabytes (MB) of disk space for the Active Directory database and 50 MB for the log files. It is recommended that you store these files on an NTFS partition.

After you finish, click Next.

Shared System Volume

On the Shared System Volume page, accept the default location in which you want to install the Sysvol folder, or click Browse to choose a location. The Sysvol folder must be stored on an NTFS volume since it contains files that are replicated between domain controllers in a domain or forest. These files include scripts, system policies for Windows NT 4.0 and earlier, the Netlogon and Sysvol shared folders, and Group Policy settings.

After you finish, click Next.

Directory Services Restore Mode Administrator Password

On the Directory Services Restore Mode Administrator Password page, type and confirm the password that you want to assign to the restore mode Administrator account for the server. You should use strong passwords for directory restore mode passwords. For more information, see Strong passwords.

Important

  • You must know this password to restore a backup copy of the System State for this domain controller.

You use this password when the domain controller starts in Directory Services Restore Mode. If this is the first time you have installed Active Directory on a server, click Active Directory Help for more information about the restore mode password.

After you finish, click Next.

Summary

On the Summary page, review the information, and then click Next.

After you complete the installation, click Finish. To restart your computer and implement the changes, click Restart Now.

Completing the Configure Your Server Wizard

After your server restarts, the Configure Your Server Wizard displays the This Server is Now a Domain Controller page. To review all of the changes made to your server by the Configure Your Server Wizard or to ensure that a new role was installed successfully, click Configure Your Server log. The Configure Your Server Wizard log is located at systemroot\Debug\Configure Your Server.log. To close the Configure Your Server Wizard, click Finish.

Removing the domain controller role

If you need to reconfigure your server for a different role, you can remove existing server roles. By removing the domain controller role, you will uninstall Active Directory from this server. After Active Directory has been uninstalled, this server will no longer participate in replication of directory objects and domain-based user authentication requests.

To remove the domain controller role, restart the Configure Your Server Wizard by doing either of the following:

  • From Manage Your Server, click Add or remove a role. By default, Manage Your Server starts automatically when you log on. XOX
  • XOX

On the Server Role page, click Domain Controller (Active Directory), and then click Next. On the Role Removal Confirmation page, review the items listed under Summary, select the Remove the domain controller role check box, click Next, and then follow the steps in the Active Directory Installation Wizard.

Next steps: Completing additional tasks

After you complete the Active Directory Installation Wizard, the server is configured as a domain controller. You can use it to store data, manage objects, and provide information to users, computers, and applications. Up to this point, you have created an additional domain controller for an existing domain.

The following table lists some of the additional tasks that you might want to perform on your domain controller.

Task | Purpose of task | Reference
Secure the new domain controller in a locked room. | To ensure that no one can physically access the domain controllers. | Domain controllers; Securing Active Directory
Use strong encryption techniques to secure account passwords. | To secure account passwords on the new domain controller. | The system key utility

Creating a domain controller for a new forest

Create a domain controller for a new forest when you want to upgrade a Windows NT domain to become the first domain in a new forest, segment your network for administrative autonomy, provide a security boundary to protect sensitive data, isolate the scope of directory replication, or use a noncontiguous DNS namespace that is different from an existing forest on your network. For example, as seen in the following illustration, the microsoft.com forest is the first Active Directory domain in an organization.

A forest can be used as the first Active Directory domain in your organization.

This topic explains the basic steps that you must follow to configure a domain controller for a new forest in your organization.

This process involves using the Configure Your Server Wizard and the Active Directory Installation Wizard to install Active Directory on this server. When you have finished setting up your domain controller, you can complete additional configuration tasks.

This topic covers:

Before you begin

Configuring your domain controller

Next steps: Completing additional tasks

Before you begin

Before you configure your server as a domain controller, verify whether or not:

  • TCP/IP configuration settings for the server are correct, particularly those used for DNS name resolution. For more information, see To configure TCP/IP to use DNS
  • All existing disk volumes use the NTFS file system. Active Directory requires at least one NTFS volume in which to store the SYSVOL folder and its contents. FAT32 volumes are not secure, and they do not support file and folder compression, disk quotas, file encryption, or individual file permissions.

The following table lists the information that you need to know before you add a domain controller for a new forest.

Before adding a new domain controller role for a new forest | Comments
Verify that DNS is properly configured for your organization. | You need to confirm that DNS is properly configured on your network and that it supports dynamic updates and service (SRV) resource records. If you are setting up Active Directory for the first time in your organization, and you do not currently have a DNS infrastructure configured, the Active Directory Installation Wizard sets up and configures DNS on this server during the Active Directory installation process. Active Directory requires DNS to function and share the same hierarchical domain structure. For example, microsoft.com is a DNS domain and an Active Directory domain.
Obtain the administrative credentials necessary to create a forest. | To create a new forest, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority.

Configuring your domain controller

To configure a domain controller, start the Configure Your Server Wizard by doing either of the following:

  • From Manage Your Server, click Add or remove a role. By default, Manage Your Server starts automatically when you log on. XOX
  • XOX

On the Server Role page, click Domain Controller (Active Directory), and then click Next.

This section describes each of the steps in this process and outlines the required choices and decisions you will make as you configure your domain controller. The following sections cover these configuration steps:

Summary of Selections

Using the Active Directory Installation Wizard

Completing the Configure Your Server Wizard

Removing the domain controller role

Summary of Selections

On the Summary of Selections page of the Configure Your Server Wizard, you can view and confirm the options that you have selected. If you selected Domain Controller (Active Directory) on the previous page, the following appears:

  • Run the Active Directory Installation Wizard to configure this server as a domain controller

To apply the selections shown on the Summary of Selections page, click Next.

Using the Active Directory Installation Wizard

After you click Next, the Active Directory Installation Wizard starts automatically. If this is the first time you have installed Active Directory on a server, click Active Directory Help for more information about Active Directory.

After you finish reading about Active Directory, click Next. You can return to this page from any place in the wizard until you click Finish on the last page. On the Operating System Compatibility page, read the information and then click Next. If this is the first time you have installed Active Directory on a server running Windows Server 2003, click Compatibility Help for more information.

This section describes the following steps in the Active Directory Installation Wizard:

Domain Controller Type

Create New Domain

New Domain Name

NetBIOS Domain Name

Database and Log Folders

Shared System Volume

DNS Registration Diagnostics

Permissions

Directory Services Restore Mode Administrator Password

Summary

Domain Controller Type

On the Domain Controller Type page, click Domain controller for a new domain.

After you finish, click Next.

Create New Domain

On the Create New Domain page, click Domain in a new forest.

After you finish, click Next.

New Domain Name

On the New Domain Name page, type the full DNS name for the new domain. Provide a full DNS name for the new Active Directory forest that you are about to create (for example, headquarters.example.microsoft.com). A full DNS name is also referred to as a fully qualified domain name (FQDN). Active Directory domains are named with DNS names and follow the same hierarchical structure of DNS. When choosing DNS names to use for your Active Directory forest, start with the registered DNS domain suffix that your organization has reserved for use on the Internet, such as microsoft.com.

After you finish, click Next.

NetBIOS Domain Name

On the NetBIOS Domain Name page, verify the NetBIOS name. Although Active Directory domains are named according to DNS naming standards, you still need to define a NetBIOS name when you create Active Directory domains. NetBIOS names should match the first label of the DNS domain name whenever possible. When the Active Directory domain has a first label DNS name that is different from its NetBIOS name, the FQDN is constructed using the DNS domain name, not the NetBIOS name. For example, if the first label in the full DNS domain name is "child" (child.microsoft.com is the FQDN) and the NetBIOS domain name is "sales", the FQDN remains "child.microsoft.com".

After you finish, click Next.

Database and Log Folders

On the Database and Log Folders page, type the location in which you want to install the database and log folders, or click Browse to choose a location. To avoid any problems with installing or removing Active Directory, it is important to confirm that you have sufficient disk space to host the directory database and log files. The Active Directory Installation Wizard requires 250 megabytes (MB) of disk space for the Active Directory database and 50 MB for the log files. It is recommended that you store these files on an NTFS partition.

After you finish, click Next.

Shared System Volume

On the Shared System Volume page, type the location in which you want to install the Sysvol folder, or click Browse to choose a location. The Sysvol folder must be stored on an NTFS volume since it contains files that are replicated between domain controllers in a domain or forest. These files include scripts, Windows NT 4.0 and earlier system policies, the NETLOGON and SYSVOL shares, and Group Policy settings.

After you finish, click Next.

DNS Registration Diagnostics

On the DNS Registration Diagnostics page, verify that the DNS settings are correct.

If a diagnostic error appears under Diagnostic Results, click Help for more information about how to resolve the error.

After you finish, click Next.

Permissions

On the Permissions page, click the level of application compatibility that you want with pre-Windows 2000, Windows 2000, or Windows Server 2003 operating systems.

On servers running Windows NT 4.0 and earlier, read access for user and group information is assigned to anonymous users so that existing applications, including Microsoft BackOffice, SQL Server, and some non-Microsoft applications, function correctly. In Windows 2000 and Windows Server 2003 operating systems, members of the Anonymous Logon group have read access to this information only when the group is added to the Pre-Windows 2000 Compatible Access group.

Option | Comments
Permissions compatible with pre-Windows 2000 server operating systems | Click this option if you want the Anonymous Logon group and the Everyone security groups to be added to the Pre-Windows 2000 Compatible Access group.
Permissions compatible only with Windows 2000 or Windows Server 2003 operating systems | Click this option to prevent members of the Anonymous Logon group from gaining read access to user and group information.

After you select one of these options, you can manually switch between the backward compatible and high-security settings on Active Directory objects. To do this, open Active Directory Users and Computers, and then add the Anonymous Logon security group to the pre-Windows 2000 Compatible Access security group.

After you finish, click Next.

Directory Services Restore Mode Administrator Password

On the Directory Services Restore Mode Administrator Password page, type and confirm the password that you want to assign to the restore mode Administrator account for the server. You should use strong passwords for directory restore mode passwords. For more information, see Strong passwords.

Important

  • You must know this password to restore a backup copy of the System State for this domain controller.

You use this password when the domain controller starts in Directory Services Restore Mode. If this is the first time you have installed Active Directory on a server, click Active Directory Help for more information about the restore mode password.

After you finish, click Next.

Summary

On the Summary page, review the information, and then click Next.

After you complete the installation, click Finish. To restart your computer and implement the changes, click Restart Now.

Completing the Configure Your Server Wizard

After your server restarts, the Configure Your Server Wizard displays the This Server is Now a Domain Controller page. To review all of the changes made to your server by the Configure Your Server Wizard or to ensure that a new role was installed successfully, click Configure Your Server log. The Configure Your Server Wizard log is located at systemroot\Debug\Configure Your Server.log. To close the Configure Your Server Wizard, click Finish.

Removing the domain controller role

If you need to reconfigure your server for a different role, you can remove existing server roles. By removing the domain controller role, you will uninstall Active Directory from this server. After Active Directory has been uninstalled, this server will no longer participate in replication of directory objects and domain-based user authentication requests.

To remove the domain controller role, restart the Configure Your Server Wizard by doing either of the following:

  • From Manage Your Server, click Add or remove a role. By default, Manage Your Server starts automatically when you log on. XOX
  • XOX

On the Server Role page, click Domain Controller (Active Directory), and then click Next. On the Role Removal Confirmation page, review the items listed under Summary, select the Remove the domain controller role check box, click Next, and then follow the steps in the Active Directory Installation Wizard.

Next steps: Completing additional tasks

After you complete the Active Directory Installation Wizard, the server is configured as a domain controller. You can use it to store data, manage objects, and provide information to users, computers and applications. Up to this point, you have created a domain controller for a new forest.

The following table lists some of the additional tasks that you might want to perform on your domain controller.

Task | Purpose of task | Reference
Secure the new domain controller in a locked room. | To ensure that no one can physically access the domain controllers. | Domain controllers; Securing Active Directory
Use strong encryption techniques. | To secure account passwords on the new domain controller. | The system key utility
Verify and authenticate the validity of each user. | To enhance forest-wide security by using public key cryptography. | Public key infrastructure
Require all domain users to use strong passwords. | To prevent unauthorized access to your organization. | Strong passwords
Enable audit policy. | To receive notification of actions that could pose a security risk. | Auditing policy
Enforce account lockouts on user accounts. | To decrease the possibility of an attacker compromising your domain through repeated logon attempts. | User and computer accounts
Enforce password history on user accounts. | To decrease the possibility of an attacker compromising your domain. | Enforce password history
Enforce minimum and maximum password ages on user accounts. | To decrease the possibility of an attacker compromising your domain. | Minimum password age; Maximum password age
Implement SID Filtering. | To prevent attacks from malicious users who might try to grant elevated user rights to another user account. | "Using Security Identifier (SID) Filtering to Prevent Elevation of Privilege Attacks" at the Microsoft Web site.(http://www.microsoft.com/)
Implement smart cards. | To provide tamper-resistant user authentication and e-mail security. | Smart card overview
Restrict user, group, and computer access to shared resources and filter Group Policy settings. | To secure resources. | Security groups
Create forest trusts (as appropriate). | To manage the security relationship between two forests, and simplify security administration and authentication across forests. | Forest trusts
Assign user rights to new security groups. | To specifically define the administrative role of members in the domain. | User rights assigned to security groups in Active Directory

Creating a domain controller for a new child domain

Create a domain controller for a new child domain when you want to create a domain that shares a contiguous namespace with one or more existing domains. This means that the name of the new domain contains the full name of the parent domain. For example, as seen in the following illustration, child.microsoft.com is a child domain of microsoft.com. As a best practice, create new domains as children of the forest root domain.

A child domain is used to form a contiguous namespace with its parent.

This topic explains the basic steps that you must follow to configure a domain controller for a new child domain in your organization.

This process involves using the Configure Your Server Wizard and the Active Directory Installation Wizard to install Active Directory on this server. When you have finished setting up your domain controller, you can complete additional configuration tasks.

This topic covers:

Before you begin

Configuring your domain controller

Next steps: Completing additional tasks

Before you begin

Before you configure your server as a domain controller, verify whether or not:

  • TCP/IP configuration settings for the server are correct, particularly those used for DNS name resolution. For more information, see To configure TCP/IP to use DNS.
  • All existing disk volumes use the NTFS file system. Active Directory requires at least one NTFS volume in which to store the SYSVOL folder and its contents. FAT32 volumes are not secure, and they do not support file and folder compression, disk quotas, file encryption, or individual file permissions.

The following table lists the information that you need to know before you add a domain controller.

Before adding a domain controller role | Comments
Identify the DNS domain name of the Active Directory domain to which you want to add the domain controller. | You need to provide the DNS domain name for the parent domain of this new child domain.
Verify that the network speed is adequate when installing Active Directory. | The server on which you want to install Active Directory and create a child domain should have access to the network over a high-speed connection.
Determine which sites require a domain controller. | If your network is divided into sites, it is good practice to put at least one domain controller in each site to enhance network performance. When users log on to the network, a domain controller must be contacted as part of the logon process. If clients have to connect to a domain controller located in a different site, the logon process can take a long time.
Determine whether you want your new domain controller to host a global catalog. | A global catalog stores a copy of all Active Directory objects in a forest on a domain controller. The global catalog stores a full copy of all objects in the directory for its host domain and a partial copy of all objects for all other domains in the forest. To optimize network performance in a multiple-site environment, consider adding global catalogs for select sites. In a single-site environment, a single global catalog is usually sufficient to cover common Active Directory queries. However, in a multiple-site environment it is recommended that you use global catalogs in each site. For more information about when to add global catalogs in a multiple site environment, see Global catalogs and sites.
Obtain the administrative credentials necessary to create a child domain. | To add a new child domain, you must be a member of the Domain Admins group (in the parent domain) or the Enterprise Admins group in Active Directory, or you must have been delegated the appropriate authority.

Configuring your domain controller

To configure a domain controller, start the Configure Your Server Wizard by doing either of the following:

  • From Manage Your Server, click Add or remove a role. By default, Manage Your Server starts automatically when you log on. XOX
  • XOX

On the Server Role page, click Domain Controller (Active Directory), and then click Next.

This section describes each of the steps in this process and outlines the required choices and decisions you will make as you configure your domain controller. The following sections cover these configuration steps:

Summary of Selections

Using the Active Directory Installation Wizard

Completing the Configure Your Server Wizard

Removing the domain controller role

Summary of Selections

On the Summary of Selections page of the Configure Your Server Wizard, you can view and confirm the options that you have selected. If you selected Domain Controller (Active Directory) on the previous page, the following appears:

  • Run the Active Directory Installation Wizard to configure this server as a domain controller

To apply the selections shown on the Summary of Selections page, click Next.

Using the Active Directory Installation Wizard

After you click Next, the Active Directory Installation Wizard starts automatically. If this is the first time you have installed Active Directory on a server, click Active Directory Help for more information about Active Directory.

After you finish reading about Active Directory, click Next. You can return to this page from any place in the wizard until you click Finish on the last page. On the Operating System Compatibility page, read the information and then click Next. If this is the first time you have installed Active Directory on a server running Windows Server 2003, click Compatibility Help for more information.

This section describes the following steps in the Active Directory Installation Wizard:

Domain Controller Type

Create New Domain

Network Credentials

Child Domain Installation

NetBIOS Domain Name

Database and Log Folders

Shared System Volume

DNS Registration Diagnostics

Permissions

Directory Services Restore Mode Administrator Password

Summary

Domain Controller Type

On the Domain Controller Type page, click Domain controller for a new domain.

After you finish, click Next.

Create New Domain

On the Create New Domain page, click Child domain in an existing domain tree.

After you finish, click Next.

Network Credentials

On the Network Credentials page, type the user name, password, and domain of the user account that you want to use.

Option | Comments
User name | Type the name of a user account that has the necessary administrative credentials. The user account must be a member of the Domain Admins group (in the parent domain), or a member of the Enterprise Admins group, or must have been delegated the appropriate authority.
Password | Type the password for the user account. This should always be a strong password. For more information, see Strong passwords.
Domain | Type the full DNS name of the domain in which this user name and password are valid.

After you finish, click Next.

Child Domain Installation

On the Child Domain Installation page, verify the parent domain, and then the name for the new child domain. Active Directory domains are named with DNS names and follow the same hierarchical structure of DNS. When choosing DNS names to use for your child domain, consider names with either geographical or divisional scope within your organization (for example, newyork.microsoft.com or sales.microsoft.com).

Following the DNS standards, domain names are fully qualified domain names (FQDN), which consist of the name of the domain appended to the names of the parent domains and root domains using the dot (.) character format. For example, an Active Directory domain named "child" and a parent domain named "microsoft.com" have an FQDN (also referred to as a complete DNS name) of "child.microsoft.com".

After you finish, click Next.

NetBIOS Domain Name

On the NetBIOS Domain Name page, verify the NetBIOS name. Although Active Directory domains are named according to DNS naming standards, you still need to define a NetBIOS name when you create Active Directory domains. NetBIOS names should match the first label of the DNS domain name whenever possible. When the Active Directory domain has a first label DNS name that is different from its NetBIOS name, the FQDN is constructed using the DNS domain name, not the NetBIOS name. For example, if the first label in the full DNS domain name is "child" (child.microsoft.com is the FQDN) and the NetBIOS domain name is "sales", the FQDN remains "child.microsoft.com".

Database and Log Folders

On the Database and Log Folders page, type the location in which you want to install the database and log folders, or click Browse to choose a location, and then click Next. To avoid any problems with installing or removing Active Directory, it is important to confirm that you have sufficient disk space to host the directory database and log files. The Active Directory Installation Wizard requires 250 megabytes (MB) of disk space for the Active Directory database and 50 MB for the log files. It is recommended that you store these files on an NTFS partition.

After you finish, click Next.

Shared System Volume

On the Shared System Volume page, type the location in which you want to install the Sysvol folder, or click Browse to choose a location. The Sysvol folder must be stored on an NTFS volume since it contains files that are replicated between domain controllers in a domain or forest. These files include scripts, Windows NT 4.0 and earlier system policies, the NETLOGON and SYSVOL shares, and Group Policy settings.

After you finish, click Next.

DNS Registration Diagnostics

On the DNS Registration Diagnostics page, verify that the DNS settings are correct.

If a diagnostic error appears under Diagnostic Results, click Help for more information about how to resolve the error.

After you finish, click Next.

Permissions

On the Permissions page, click the level of application compatibility that you want with pre-Windows 2000, Windows 2000, or Windows Server 2003 operating systems.

On servers running Windows NT 4.0 and earlier, read access for user and group information is assigned to anonymous users so that existing applications, including Microsoft BackOffice, SQL Server, and some non-Microsoft applications, function correctly. In Windows 2000 and Windows Server 2003 operating systems, members of the Anonymous Logon group have read access to this information only when the group is added to the Pre-Windows 2000 Compatible Access group.

Option | Comments
Permissions compatible with pre-Windows 2000 server operating systems | Click this option if you want the Anonymous Logon group and the Everyone security groups to be added to the Pre-Windows 2000 Compatible Access group.
Permissions compatible only with Windows 2000 or Windows Server 2003 operating systems | Click this option to prevent members of the Anonymous Logon group from gaining read access to user and group information.

After you select one of these options, you can manually switch between the backward compatible and high-security settings on Active Directory objects. To do this, open Active Directory Users and Computers, and then add the Anonymous Logon security group to the pre-Windows 2000 Compatible Access security group.

After you finish, click Next.

Directory Services Restore Mode Administrator Password

On the Directory Services Restore Mode Administrator Password page, type and confirm the password that you want to assign to the restore mode Administrator account for the server. You should use strong passwords for directory restore mode passwords. For more information, see Strong passwords.

Important

  • You must know this password to restore a backup copy of the System State for this domain controller.

You use this password when the domain controller starts in Directory Services Restore Mode. If this is the first time you have installed Active Directory on a server, click Active Directory Help for more information about the restore mode password.

After you finish, click Next.

Summary

On the Summary page, review the information, and then click Next.

After you complete the installation, click Finish. To restart your computer and implement the changes, click Restart Now.

Completing the Configure Your Server Wizard

After your server restarts, the Configure Your Server Wizard displays the This Server is Now a Domain Controller page. To review all of the changes made to your server by the Configure Your Server Wizard or to ensure that a new role was installed successfully, click Configure Your Server log. The Configure Your Server Wizard log is located at systemroot\Debug\Configure Your Server.log. To close the Configure Your Server Wizard, click Finish.

Removing the domain controller role

If you need to reconfigure your server for a different role, you can remove existing server roles. By removing the domain controller role, you will uninstall Active Directory from this server. After Active Directory has been uninstalled, this server will no longer participate in replication of directory objects and domain-based user authentication requests.

To remove the domain controller role, restart the Configure Your Server Wizard by doing either of the following:

  • From Manage Your Server, click Add or remove a role. By default, Manage Your Server starts automatically when you log on. XOX
  • XOX

On the Server Role page, click Domain Controller (Active Directory), and then click Next. On the Role Removal Confirmation page, review the items listed under Summary, select the Remove the domain controller role check box, click Next, and then follow the steps in the Active Directory Installation Wizard.

Next steps: Completing additional tasks

After you complete the Active Directory Installation Wizard, the server is configured as a domain controller. You can use it to store data, manage objects, and provide information to users, computers and applications. Up to this point, you have created a new domain or additional domain controller for an existing domain.

The following table lists some of the additional tasks that you might want to perform on your domain controller.

Task | Purpose of task | Reference
Secure the new domain controller in a locked room. | To ensure that no one can physically access the domain controller. | Domain controllers; Securing Active Directory
Use strong encryption techniques. | To secure account passwords on the new domain controller. | The system key utility
Require all domain users to use strong passwords. | To prevent unauthorized access to your organization. | Strong passwords
Enable audit policy. | To receive notification of actions that could pose a security risk. | Auditing policy
Enforce account lockouts on user accounts. | To decrease the possibility of an attacker compromising your domain through repeated logon attempts. | User and computer accounts
Enforce password history on user accounts. | To decrease the possibility of an attacker compromising your domain. | Enforce password history
Enforce minimum and maximum password ages on user accounts. | To decrease the possibility of an attacker compromising your domain. | Minimum password age; Maximum password age
Implement SID Filtering. | To prevent attacks from malicious users who might try to grant elevated user rights to another user account. | "Using Security Identifier (SID) Filtering to Prevent Elevation of Privilege Attacks" at the Microsoft Web site.(http://www.microsoft.com/)
Implement smart cards. | To provide tamper-resistant user authentication and e-mail security. | Smart card overview
Restrict user, group, and computer access to shared resources and filter Group Policy settings. | To secure resources. | Security groups
Assign user rights to new security groups. | To specifically define the administrative role of members in the domain. | User rights assigned to security groups in Active Directory

Creating a domain controller for a new domain tree

Create a domain controller for a new domain tree when you want to create a domain that has a DNS namespace that is not related to the other domains in the forest. This means that the name of the tree root domain (and all of its children) does not have to contain the full name of the parent domain. A forest can contain one or more domain trees. For example, as seen in the following illustration, msn.com is a new domain tree in the microsoft.com forest.

A domain tree is used to form a noncontiguous namespace within the forest.

This topic explains the basic steps that you must follow to configure a domain controller for a new domain tree in your organization.

This process involves using the Configure Your Server Wizard and the Active Directory Installation Wizard to install Active Directory on this server. When you have finished setting up your domain controller, you can complete additional configuration tasks.

This topic covers:

Before you begin

Configuring your domain controller

Next steps: Completing additional tasks

Before you begin

Before you configure your server as a domain controller, verify whether or not:

  • TCP/IP configuration settings for the server are correct, particularly those used for DNS name resolution. For more information, see To configure TCP/IP to use DNS
  • All existing disk volumes use the NTFS file system. Active Directory requires at least one NTFS volume in which to store the SYSVOL folder and its contents. FAT32 volumes are not secure, and they do not support file and folder compression, disk quotas, file encryption, or individual file permissions.

The following table lists the information that you need to know before you add a domain controller.

Before adding a domain controller role | Comments
Verify that the network speed is adequate when installing Active Directory. | The server on which you want to install Active Directory should have access to the network over a high-speed connection.
Determine whether you want your new domain controller to host a global catalog. | A global catalog stores a copy of all Active Directory objects in a forest on a domain controller. The global catalog stores a full copy of all objects in the directory for its host domain and a partial copy of all objects for all other domains in the forest. To optimize network performance in a multiple-site environment, consider adding global catalogs for select sites. In a single-site environment, a single global catalog is usually sufficient to cover common Active Directory queries. However, in a multiple-site environment it is recommended that you use global catalogs in each site. For more information about when to add global catalogs in a multiple site environment, see Global catalogs and sites.
Obtain the administrative credentials necessary to add a new domain tree. | To create a new domain tree, you must be a member of the Domain Admins group (in the forest root domain) or the Enterprise Admins group in Active Directory, or you must have been delegated the appropriate authority.

Configuring your domain controller

To configure a domain controller, start the Configure Your Server Wizard by doing either of the following:

  • From Manage Your Server, click Add or remove a role. By default, Manage Your Server starts automatically when you log on. XOX
  • XOX

On the Server Role page, click Domain Controller (Active Directory), and then click Next.

This section describes each of the steps in this process and outlines the required choices and decisions you will make as you configure your domain controller. The following sections cover these configuration steps:

Summary of Selections

Using the Active Directory Installation Wizard

Completing the Configure Your Server Wizard

Removing the domain controller role

Summary of Selections

On the Summary of Selections page of the Configure Your Server Wizard, you can view and confirm the options that you have selected. If you selected Domain Controller (Active Directory) on the previous page, the following appears:

  • Run the Active Directory Installation Wizard to configure this server as a domain controller

To apply the selections shown on the Summary of Selections page, click Next.

Using the Active Directory Installation Wizard

After you click Next, the Active Directory Installation Wizard starts automatically. If this is the first time you have installed Active Directory on a server, click Active Directory Help for more information about Active Directory.

After you finish reading about Active Directory, click Next. You can return to this page from any place in the wizard until you click Finish on the last page. On the Operating System Compatibility page, read the information and then click Next. If this is the first time you have installed Active Directory on a server running Windows Server 2003, click Compatibility Help for more information.

This section describes the following steps in the Active Directory Installation Wizard:

Domain Controller Type

Create New Domain

Network Credentials

New Domain Tree

NetBIOS Domain Name

Database and Log Folders

Shared System Volume

DNS Registration Diagnostics

Permissions

Directory Services Restore Mode Administrator Password

Summary

Domain Controller Type

On the Domain Controller Type page, click Domain controller for a new domain.

After you finish, click Next.

Create New Domain

On the Create New Domain page, click Domain tree in an existing forest.

After you finish, click Next.

Network Credentials

On the Network Credentials page, type the user name, password, and user domain of the user account that you want to use.

Option | Comments
User name | Type the name of a user account that has the necessary administrative credentials. The user account must be a member of the Domain Admins group (in the forest root domain), or a member of the Enterprise Admins group, or must have been delegated the appropriate authority.
Password | Type the password for the user account. This should always be a strong password. For more information, see Strong passwords.
Domain | Type the full DNS name of the domain in which this user name and password are valid.

New Domain Tree

On the New Domain Name page, type the full DNS name for the new domain tree. Provide a full DNS name for the new domain tree that you want to create. Active Directory domains are named with DNS names and follow the same hierarchical structure of DNS.

Following the DNS standards, domain names are fully qualified domain names (FQDN), which consist of the name of the domain appended to the names of the parent domains and root domains using the dot (.) character format. It is not recommended that you use a single label DNS name for an Active Directory domain name. A single label DNS name is a name without a parent or root domain name.

After you finish, click Next.

NetBIOS Domain Name

On the NetBIOS Domain Name page, verify the NetBIOS name. Although Active Directory domains are named according to DNS naming standards, you still need to define a NetBIOS name when you create Active Directory domains. NetBIOS names should match the first label of the DNS domain name whenever possible. When the Active Directory domain has a first label DNS name that is different from its NetBIOS name, the FQDN is constructed using the DNS domain name, not the NetBIOS name. For example, if the first label in the full DNS domain name is "child" (child.microsoft.com is the FQDN) and the NetBIOS domain name is "sales", the FQDN remains "child.microsoft.com".

After you finish, click Next.

Database and Log Folders

On the Database and Log Folders page, type the location in which you want to install the database and log folders, or click Browse to choose a location. To avoid any problems with installing or removing Active Directory, it is important to confirm that you have sufficient disk space to host the directory database and log files. The Active Directory Installation Wizard requires 250 megabytes (MB) of disk space for the Active Directory database and 50 MB for the log files. It is recommended that you store these files on an NTFS partition.

After you finish, click Next.

Shared System Volume

On the Shared System Volume page, type the location in which you want to install the Sysvol folder, or click Browse to choose a location. The Sysvol folder must be stored on an NTFS volume since it contains files that are replicated between domain controllers in a domain or forest. These files include scripts, Windows NT 4.0 and earlier system policies, the NETLOGON and SYSVOL shares, and Group Policy settings.

After you finish, click Next.

DNS Registration Diagnostics

On the DNS Registration Diagnostics page, verify the DNS settings are correct.

If a diagnostic error appears under Diagnostic Results, click Help for more information about how to resolve the error.

After you finish, click Next.

Permissions

On the Permissions page, click the level of application compatibility that you want with pre-Windows 2000 and Windows 2000 or Windows Server 2003 operating systems.

On servers running Windows NT 4.0 and earlier, read access for user and group information is assigned to anonymous users so that existing applications, including Microsoft BackOffice, SQL Server, and some non-Microsoft applications, function correctly. In Windows 2000 and Windows Server 2003 operating systems, members of the Anonymous Logon group have read access to this information only when the group is added to the Pre-Windows 2000 Compatible Access group.

Option | Comments
Permissions compatible with pre-Windows 2000 server operating systems | Click this option if you want the Anonymous Logon group and the Everyone security groups to be added to the Pre-Windows 2000 Compatible Access group.
Permissions compatible only with Windows 2000 or Windows Server 2003 operating systems | Click this option to prevent members of the Anonymous Logon group from gaining read access to user and group information.

After you select one of these options, you can manually switch between the backward compatible and high-security settings on Active Directory objects. To do this, open Active Directory Users and Computers, and then add the Anonymous Logon security group to the pre-Windows 2000 Compatible Access security group.

Directory Services Restore Mode Administrator Password

On the Directory Services Restore Mode Administrator Password page, type and confirm the password that you want to assign to the restore mode Administrator account for the server. You should use strong passwords for directory restore mode passwords. For more information, see Strong passwords.

Important

  • You must know this password to restore a backup copy of the System State for this domain controller.

You use this password when the domain controller starts in Directory Services Restore Mode. If this is the first time you have installed Active Directory on a server, click Active Directory Help for more information about the restore mode password.

After you finish, click Next.

Summary

On the Summary page, review the information, and then click Next.

After you complete the installation, click Finish. To restart your computer and implement the changes, click Restart Now.

Completing the Configure Your Server Wizard

After your server restarts, the Configure Your Server Wizard displays the This Server is Now a Domain Controller page. To review all of the changes made to your server by the Configure Your Server Wizard or to ensure that a new role was installed successfully, click Configure Your Server log. The Configure Your Server Wizard log is located at systemroot\Debug\Configure Your Server.log. To close the Configure Your Server Wizard, click Finish.

Removing the domain controller role

If you need to reconfigure your server for a different role, you can remove existing server roles. By removing the domain controller role, you will uninstall Active Directory from this server. After Active Directory has been uninstalled, this server will no longer participate in replication of directory objects and domain-based user authentication requests.

To remove the domain controller role, restart the Configure Your Server Wizard by doing either of the following:

  • From Manage Your Server, click Add or remove a role. By default, Manage Your Server starts automatically when you log on. XOX
  • XOX

On the Server Role page, click Domain Controller (Active Directory), and then click Next. On the Role Removal Confirmation page, review the items listed under Summary, select the Remove the domain controller role check box, click Next, and then follow the steps in the Active Directory Installation Wizard.

Next steps: Completing additional tasks

After you complete the Active Directory Installation Wizard, the server is configured as a domain controller. You can use it to store data, manage objects, and provide information to users, computers and applications. Up to this point, you have created a new domain or additional domain controller for an existing domain.

The following table lists some of the additional tasks that you might want to perform on your domain controller.

Task | Purpose of task | Reference
Secure the new domain controller in a locked room. | To ensure that no one can physically access the domain controller. | Domain controllers; Securing Active Directory
Use strong encryption techniques. | To secure account passwords on the new domain controller. | The system key utility
Require all domain users to use strong passwords. | To prevent unauthorized access to your organization. | Strong passwords
Enable audit policy. | To receive notification of actions that could pose a security risk. | Auditing policy
Enforce account lockouts on user accounts. | To decrease the possibility of an attacker compromising your domain through repeated logon attempts. | User and computer accounts
Enforce password history on user accounts. | To decrease the possibility of an attacker compromising your domain. | Enforce password history
Enforce minimum and maximum password ages on user accounts. | To decrease the possibility of an attacker compromising your domain. | Minimum password age; Maximum password age
Implement SID Filtering. | To prevent attacks from malicious users who might try to grant elevated user rights to another user account. | "Using Security Identifier (SID) Filtering to Prevent Elevation of Privilege Attacks" at the Microsoft Web site.(http://www.microsoft.com/)
Implement smart cards. | To provide tamper-resistant user authentication and e-mail security. | Smart card overview
Restrict user, group, and computer access to shared resources and filter Group Policy settings. | To secure resources. | Security groups
Assign user rights to new security groups. | To specifically define the administrative role of members in the domain. | User rights assigned to security groups in Active Directory


DNS server role: Configuring a DNS server

Domain Name System (DNS) servers host records of a distributed DNS database and use the records they host to resolve DNS name queries sent by DNS client computers, such as queries for the names of Web sites or computers in your network or on the Internet. If you plan to use this computer to answer DNS queries for computers in your network, then add the DNS server role.

This topic explains the basic steps you must follow to configure a DNS server for either a small organization or a branch office in a large organization. For both scenarios, this topic explains the basic steps you must follow to configure a DNS server and configure it with a DNS zone for your network. This topic will also cover how to forward queries for external resources to a DNS server either run by an Internet service provider (ISP), as in the case of a small organization, or run by the central office of a large organization, as in the case of the branch office.

This process involves using the Configure Your Server Wizard, the Configure a New DNS Server Wizard, and Manage Your Server to configure the server as a DNS server. When you have finished setting up a DNS server, you can complete additional configuration tasks, depending on how you want to use the DNS server.

Note

  • A DNS server is not usually necessary in a small business because the Windows Internet Name Service (WINS) name resolution method is used to locate network resources, and resources on the Internet are located using the DNS servers run by an ISP. However, as more networks are becoming integrated with the Internet, DNS is becoming more common in small networks.

    Using DNS in your network does not necessarily require that you administer a DNS infrastructure. If you have a small network in which information is maintained dependably, then you can choose to have your DNS namespace administered by a different organization that specializes in DNS administration, such as your government or an ISP. In this case, the different organization will host and administer your DNS information for you or integrate your computers with an existing DNS server hosted in its network.

This topic covers:

Before you begin

Configuring your DNS server

Next steps: Completing additional tasks

Before you begin

Before you configure your computer as a DNS server, verify whether or not:

  • The operating system is configured correctly. In Windows Server 2003 operating systems, the DNS Server service depends on the appropriate configuration of the operating system and its services, such as TCP/IP. If you have a new installation of a Windows Server 2003 operating system, then you can use the default service settings. No further action is necessary. If you upgraded to a Windows Server 2003 operating system, or if you want to verify that your service settings are configured correctly for the best performance and security, then see Default settings for services.
  • All available disk space is allocated. You can use Disk Management or DiskPart.exe to create a new partition from unallocated space. For more information, see To create a partition or logical drive.
  • All existing disk volumes use the NTFS file system. FAT32 volumes are not secure, and they do not support file and folder compression, disk quotas, file encryption, or individual file permissions.
  • Windows Firewall is enabled. For information see Security Configuration Wizard in Windows Server 2003 Service Pack 1 (http://www.microsoft.com/).
  • The Security Configuration Wizard is installed and enabled. For information about the Security Configuration wizard, see Security Configuration Wizard.
  • Run Windows Update. For more information, see Windows Update.

The following table lists the information that you need to know before you add a DNS server role.

For all organizations
Before adding a DNS server role | Comments
Determine if you are adding the DNS server role to support Active Directory. | If you are going to deploy Active Directory, then the DNS servers used to support Active Directory will be installed and configured automatically by the Active Directory Installation Wizard. For more information, see Typical setup for a first server and Domain controller role: Configuring a domain controller.
Inventory the security policies of your network and company to see how they can be maintained when broadcasting DNS data over the Internet. | DNS was originally designed as an open protocol and is therefore vulnerable to attackers. Windows Server 2003 DNS provides features for a very secure DNS infrastructure. To configure DNS to support these security policies, have your company's security policies available when designing and deploying your DNS server, zones, and resource records. For more information, see Security information for DNS.
Review the DNS checklist. | Review the information in Checklist: Installing a DNS server.
For a small organization
Before adding a DNS server role | Comments
Choose the first DNS domain name for your company. | Choosing the first DNS domain name for your company involves selecting a domain name that is unique within the DNS namespace of the Internet. If your organization has a Web site, use your existing Web site name as a starting point for your DNS domain name. If the name of your Web site is www.humongousinsurance.com, create the first domain name as an extension of this name using the subdomain name corp, for example, corp.humongousinsurance.com.
Check with your ISP to determine that your network Internet Protocol (IP) addresses are registered with an Internet registrar. | In order for your DNS deployment to work over the Internet, both the IP addresses and DNS domain name used by your network must be registered with an authorized Internet registrar. These organizations are responsible for assigning IP addresses and DNS domain names and keeping public records of the assignments. If you are connected to the Internet, then your company's network is most likely a subnet of your ISP's network. In this case, the IP addresses of the subnet will have been registered with the Internet registrar.
Register your DNS domain name with an Internet registrar. | Register the DNS domain name you will use for your company even if you are deploying DNS in a private network. If you do not register the name and later attempt to use it on the Internet, or connect to a network that is connected to the Internet, you might find that the name is unavailable because some other company has registered the name. You can also have your ISP register your DNS domain name for you. When deciding on your DNS domain name, search the Internet to see what domain names are available using one of the Web sites provided by an authorized Internet registration authority. To search the Internet for available domain names, see the Internet Network Information Center (InterNIC) Web site. XOX
Understand that the name of the first DNS zone this DNS server will host is the same as the DNS domain name you registered. | When you configure the DNS server role, you will define the first DNS zone that this DNS server will host using the domain name of the DNS domain of your network, such as corp.humongousinsurance.com.
Obtain the IP address of one or more DNS servers hosted by your ISP to use as a forwarder. | You will configure the DNS server with a forwarder to send queries for names that are not in your network to a DNS server at your ISP.
For a branch office in a large organization
Before adding a DNS server role | Comments
Obtain the DNS domain name for your network from your central office. | The first DNS domain name for your branch office is a subdomain of a domain used in the network at your central office. For example, if your central office uses the domain name corp.humongousinsurance.com, the DNS domain name for your branch office could be seattle.corp.humongousinsurance.com. Always confirm that your DNS domain name has been properly delegated from the central office.

Configuring your DNS server

To configure a DNS server, start the Configure Your Server Wizard by doing either of the following:

  • From Manage Your Server, click Add or remove a role. By default, Manage Your Server starts automatically when you log on. XOX
  • To open the Configure Your Server Wizard, click Start, point to All Programs, point to Administrative Tools, and then click Configure Your Server Wizard.

On the Server Role page, click DNS server, and then click Next.

This section covers:

Summary of Selections

Setting a static DNS server IP address

Using the Configure a DNS Server Wizard

Completing the Configure Your Server Wizard

Removing the DNS server role

Summary of Selections

On the Summary of Selections page, view and confirm the options that you have selected. If you selected DNS Server on the Server Role page, the following appears:

  • Install DNS Server
  • Run the Configure a DNS Server Wizard to configure DNS

If the Summary of Selections page lists these two items, click Next. If the Summary of Selections page does not list these two items, click Back to return to the Server Role page, click DNS server, and then click Next.

Setting a static DNS server IP address

After you click Next, the Configure Your Server Wizard installs the DNS Server service. During the installation of the DNS Server service, the Configure Your Server Wizard determines whether the IP address for this server is static or is configured automatically. DNS servers are located by DNS clients by using static IP addresses, and an IP address that is automatically configured can cause problems for DNS clients when the IP address changes.

If this server is currently configured to obtain its IP address automatically, the Configuring Components page of the Windows Components Wizard appears and prompts you to configure this server with a static IP address. In the Local Area Connection Properties dialog box, click Internet Protocol (TCP/IP), and then click Properties. In the Internet Protocols (TCP/IP) Properties dialog box, click Use the following IP address, and then type the static IP address, subnet mask, and default gateway for this server. In Preferred DNS server, type the IP address of this server. In Alternate DNS server, type the IP address of the DNS server hosted by your ISP or central office. When you finish setting up the static addresses for your DNS server, click OK, and then click Close.

Notes

  • For a small organization, the static IP address for this server will be used to register the DNS domain name for your company with an authorized Internet registrar. The Internet registrar will map the DNS domain name for your company with the IP address so that computers on the Internet looking for computers in your network will know the IP address of the DNS server for your network.
  • For a branch office, the static IP address for this server will be used in the domain name delegation configured on a DNS server at the central office of your organization. Computers in your organization and on the Internet looking for computers in your network will use the IP address of the DNS server for your network. For this reason, it is very important that you do not change the IP address of this server after you have added the DNS server role.

Using the Configure a DNS Server Wizard

After you click Close, the Configure a DNS Server Wizard starts. If you cancel the Configure a DNS Server Wizard, the DNS Server service remains installed, but it cannot distribute IP addresses to clients until you create a scope. If you choose to create a scope later, you can do so using the DNS console.

This section describes the following steps in the Configure a DNS Server Wizard:

Select Configuration Action

Primary Server Location

Zone Name

Dynamic Update

Forwarders

Completing the Configure a DNS Server Wizard

Select Configuration Action

On the Select Configuration Action page, select Create a forward lookup zone, and then click Next.

Primary Server Location

To specify that this DNS server will host a DNS zone that contains DNS resource records for your network resources, on the Primary Server Location page, select This server maintains the zone, and then click Next.

Zone Name

On the Zone Name page, in Zone name, specify the name of the DNS zone for your network, and then click Next. The name of the zone is the same as the name of the DNS domain for your small organization or branch office.

Dynamic Update

On the Dynamic Update page, click Allow both nonsecure and secure dynamic updates, and then click Next. This will automate the update of the DNS resource records for the resources in your network.

Forwarders

On the Forwarders page, click Yes, it should forward queries to DNS servers with the following IP addresses, and then click Next. By selecting this configuration, you forward all DNS queries for DNS names outside of your network to a DNS server at either your ISP or central office. Type one or more IP addresses used by DNS servers run by either your ISP or central office.

Completing the Configure a DNS Server Wizard

On the Completing the Configure a DNS Server Wizard page of the Configure a DNS Server Wizard, you can click Back to change any of the settings. To apply your selections, click Finish.

Completing the Configure Your Server Wizard

After you complete the Configure a DNS Server Wizard, the Configure Your Server Wizard displays the This Server is Now a DNS Server page. To review all of the changes made to your server by the Configure Your Server Wizard or to ensure that a new role was installed successfully, click Configure Your Server log. The Configure Your Server Wizard log is located at systemroot\Debug\Configure Your Server.log. To close the Configure Your Server Wizard, click Finish.

Removing the DNS server role

If you need to reconfigure your server for a different role, you can remove existing server roles. If you remove the DNS server role from this server, you should configure the TCP/IP settings of this server, and any clients using this server as their DNS server, with the IP address of a different DNS server.

To remove the DNS server role, restart the Configure Your Server Wizard by doing either of the following:

  • From Manage Your Server, click Add or remove a role. By default, Manage Your Server starts automatically when you log on. XOX
  • XOX

On the Server Role page, click DNS server, and then click Next. On the Role Removal Confirmation page, review the items listed under Summary, select the Remove the DNS server role check box, and then click Next. After you click Next, the Configuring Components page of the Windows Components Wizard appears and then closes automatically. You cannot click Back or Next on this page. On the DNS Server Role Removed page, click Finish.

Next steps: Completing additional tasks

After you complete the Configure Your Server Wizard and the Configure a New DNS Server Wizard, your server is ready for use as a DNS server. Up to this point, you have completed the following tasks:

  • Set the DNS server to use a static IP address.
  • Configured the DNS zone for your network.
  • Configured the DNS server to forward all DNS queries for DNS names outside your network to a DNS server at your ISP or central office.

When you complete the Configure Your Server Wizard, it automatically installs the DNS snap-in, which you use to manage your DNS server. XOX

The following table lists some of the additional tasks that you might want to perform on your DNS server.

Tasks | Purpose of task | Reference
Configure the computers in your network to use this DNS server as their preferred DNS server. | To connect your DNS clients to the DNS server and dynamically update the zone with the DNS resource records required for name resolution. | To configure TCP/IP to use DNS; Dynamic update
If this server is a multihomed computer, configure the DNS Server service to respond to queries on the local network IP address only. | To secure your DNS server from external queries. For example, a server acting as proxy server can have two network adapters, one for the intranet and one for the Internet. If that server is also running the Windows Server 2003 DNS Server service, you can configure the service to only use the intranet network adapter. By configuring this server to respond only to queries on the local network IP address, you will secure the server from unwanted Internet queries. | To restrict a DNS server to listen only on selected addresses
Verify the server configuration. | To ensure that the DNS configuration performed using the Configure a New DNS Server Wizard is correct. | Verifying server configuration
Verify DNS server responsiveness by using the nslookup command. | To verify that the DNS server is able to resolve DNS queries for resources in your network. | To verify DNS server responsiveness using the nslookup command
Verify that a resource records exist in DNS. | To verify that the computers that use the DNS server can be located on the network. | To verify A resource records exist in DNS
Configure ports to allow remote administration. | To manage the DNS server from other computers on the network. | With Windows Firewall enabled, you might need to make specific configuration settings in order to use or remotely administer technologies that ship with Windows Server 2003 operating systems. For information about these settings, see Windows Firewall Settings (http://www.microsoft.com/).

The example companies, organizations, products, domain names, e-mail addresses, logos, people, places, and events depicted herein are fictitious. No association with any real company, organization, product, domain name, e-mail address, logo, person, places, or events is intended or should be inferred.


DHCP server role: Configuring a DHCP server

DHCP servers centrally manage IP addresses and related information and provide it to clients automatically. This allows you to configure client network settings at a server, instead of configuring them on each client computer. If you want this computer to distribute IP addresses to clients, then configure this computer as a DHCP server.

This topic explains the basic steps you must follow to configure a DHCP server. When you have finished setting up a basic DHCP server, you can complete additional configuration tasks, depending on how you want to use the DHCP server.

This topic covers:

Before you begin

Configuring your DHCP server

Next steps: Completing additional tasks

Before you begin

Before you configure your computer as a DHCP server, verify that:

  • You are familiar with DHCP concepts such as scopes, leases, and options. For more information, see DHCP terminology.
  • The operating system is configured correctly. In Windows Server 2003 operating systems, DHCP depends on the appropriate configuration of the operating system and its services. If you have a new installation of a Windows Server 2003 operating system, then you can use the default service settings. No further action is necessary. If you upgraded to a Windows Server 2003 operating system, or if you want to confirm that your services are configured correctly for best performance and security, then verify your service settings by using the table in Default settings for services.
  • This computer has a static IP address. For more information, see To configure TCP/IP for static addressing.
  • All existing disk volumes use the NTFS file system. FAT32 volumes are not secure, and they do not support file and folder compression, disk quotas, file encryption, or individual file permissions.
  • Windows Firewall is enabled. For more information see Security Configuration Wizard in Windows Server 2003 Service Pack 1 (http://www.microsoft.com/).
  • The Security Configuration Wizard is installed and enabled. For information about the Security Configuration wizard, see Security Configuration Wizard.

When you add the DHCP server role, you create one scope that defines the range of IP addresses that the DHCP server allocates to the clients on one subnet. You need to create one scope for each subnet that has clients that you want to manage by using DHCP. The following table lists the information that you need to know before you add the DHCP server role, so that you can create the first scope. You need to collect the same information for each additional scope.

Before adding a DHCP server role | Comments
Review DHCP security issues. | Security issues might affect the way you deploy DHCP servers. For more information about DHCP security best practices, see Security information for DHCP.
Identify the range of IP addresses that the DHCP server should allocate to the clients. | Use the entire range of consecutive IP addresses that make up the local IP subnet. In many cases, a private address range is the best choice. For more information and a list of all the IP address ranges approved for use on private networks, see RFC 1918, "Address Allocation for Private Internets", at the Internet Engineering Task Force Web site. XOX
Determine the correct subnet mask for the clients. | When the DHCP server leases an IP address to a client, the server can specify additional configuration information, including the subnet mask.
Identify any IP addresses that the DHCP server should not allocate to clients. | For example, a server or a network-connected printer often has a static IP address, and the DHCP server must not offer this IP address to clients.
Decide the duration of the lease of the IP addresses. | The default is eight days. In general, the duration of the lease should be equal to the average time that the clients on this subnet are active. For example, the ideal duration might may be longer than eight days if the clients are desktop computers that are rarely turned off, or it might be shorter than eight days if the clients are mobile devices that frequently leave the network or are moved between subnets.
(Optional) Identify the IP address of the router (default gateway) that the clients should use to communicate with clients on other subnets. | When the DHCP server leases an IP address to a client, the server can specify additional configuration information, including the IP address of the router.
(Optional) Identify the name of the DNS domain of the clients. | When the DHCP server leases an IP address to a client, the server can specify additional configuration information, including the name of the DNS domain to which the clients belong.
(Optional) Identify the IP address of the DNS server that the clients should use. | When the DHCP server leases an IP address to a client, the server can specify additional configuration information, including the IP address of the DNS server that the clients should contact to resolve the name of another computer.
(Optional) Identify the IP address of the WINS server that the clients should use. | When the DHCP server leases an IP address to a client, the server can specify additional configuration information, including the IP address of the WINS server that the clients should contact to resolve the NetBIOS name of another computer.

Configuring your DHCP server

To configure a DHCP server, start the Configure Your Server Wizard by doing either of the following:

  • From Manage Your Server, click Add or remove a role. By default, Manage Your Server starts automatically when you log on. XOX
  • XOX

On the Server Role page, click DHCP server, and then click Next.

This section covers:

Summary of Selections

Using the New Scope Wizard

Completing the Configure Your Server Wizard

Removing the DHCP server role

Summary of Selections

On the Summary of Selections page, view and confirm the options you have selected. If you selected DHCP Server on the previous page, the following appears:

  • Install DHCP Server
  • Run the New Scope Wizard to configure a new DHCP scope

To apply the selections shown on the Summary of Selections page, click Next. After you click Next, the Configuring Components page of the Windows Components Wizard appears, and then closes automatically. You cannot click Back or Next on this page.

Using the New Scope Wizard

After you click Next, the Configure Your Server Wizard installs the DHCP Server service, and then starts the New Scope Wizard to collect information and add the DHCP server role. If you cancel the New Scope Wizard, the DHCP Server service remains installed, but it cannot distribute IP addresses to clients until you create a scope. If you choose to create a scope later, you can do so using the DHCP console.

This section describes the following steps in the New Scope Wizard:

Scope Name

IP Address Range

Add Exclusions

Lease Duration

Configure DHCP Options

Router (Default Gateway)

Domain Name and DNS Servers

WINS Servers

Activate Scope

Completing the New Scope Wizard

Scope Name

On the Scope Name page, in Name, type a name for the scope that you are creating. In Description, type a description (this is optional). Most networks have several subnets, and each subnet requires its own scope, so a DHCP server usually manages multiple scopes. Choose a name and description that help you distinguish between the various scopes.

After you finish, click Next.

IP Address Range

On the IP Address Range page, define the range of IP addresses in this scope by typing the IP addresses at the start and the end of that range. The wizard uses the IP addresses that you type to determine the correct subnet mask. The correct subnet mask automatically appears in Subnet mask.

In the unusual case where the clients on this subnet need to use a subnet mask other than the one that the wizard provides, you must type it in Subnet mask, or type the number of bits of the subnet mask in Length.

After you finish, click Next.

Add Exclusions

On the Add Exclusions page, you can define the IP addresses that the DHCP server should not allocate to clients. For example, the DHCP server itself has a static IP address that must not be allocated to clients. The same is true of the default gateway and of various network devices, such as network-connected printers. You must exclude these IP addresses so that the DHCP server does not allocate them to clients.

It is recommended that you exclude more IP addresses than you currently need, because it is easier to truncate an exclusion range than it is to expand it. Exclude IP addresses from the beginning or the end of the range of possible IP addresses, not from the middle. For example, if the range of IP addresses on this subnet is from 10.0.0.1 to 10.0.0.255, and you want to exclude ten IP addresses, then define the exclusion range as either of the following:

  • 10.0.0.1 to 10.0.0.10
  • 10.0.0.245 to 10.0.0.255

For each range of IP addresses that you want to exclude, type the IP address at the beginning of the range in Start IP address, type the IP address at the end of the range in End IP address, and then click Add.

This step eases client administration, but it is optional. If you leave all fields of this page blank and click Next, clients will still be able to obtain IP addresses from the DHCP server.

After you finish, click Next.

Lease Duration

On the Lease Duration page, you can define how long a client can use an IP address from this scope.

The DHCP server leases IP addresses to its clients. Each lease has an expiration date and time. The client must renew the lease if it is going to continue to use that IP address. The default duration of the lease is eight days.

This step eases client administration, but it is optional. If you leave all fields of this page blank and click Next, clients will still be able to obtain IP addresses from the DHCP server.

After you finish, click Next.

Configure DHCP Options

On the Configure DHCP Options page, you can specify whether to configure DHCP options.

It is recommended that you accept the default, Yes, I want to configure these options now, and click Next, even if you do not want to configure the options. If you choose No, I will configure these options later, then the following occurs:

  • The New Scope Wizard creates the scope but does not activate it, and you must use the DHCP console to activate the scope in order for clients to receive IP addresses from this scope. For information about how to activate a scope using the DHCP console, see To activate a scope.
  • You will not see the next four wizard pages described below. Continue reading at Completing the New Scope Wizard.

Router (Default Gateway)

On the Router (Default Gateway) page, you can specify the routers (also known as default gateways) that clients should use. You can add as many IP addresses as there are routers on this subnet.

This step eases client administration, but it is optional. If you leave all fields of this page blank and click Next, clients will still be able to obtain IP addresses from the DHCP server.

After you finish, click Next.

Domain Name and DNS Servers

On the Domain Name and DNS Servers page, you can specify the name of the domain that clients on this subnet should use when they resolve DNS names.

You can also specify the DNS server that clients should use to resolve DNS names. You can type the IP address of that DNS server, or you can type its name and click Resolve, and the wizard will determine the IP address for you. You can add several DNS servers.

This step eases client administration, but it is optional. If you leave all fields of this page blank and click Next, clients will still be able to obtain IP addresses from the DHCP server.

After you finish, click Next.

WINS Servers

On the WINS Servers page, you can specify the WINS server that clients should communicate with to register and resolve NetBIOS names. You can type the IP address of that WINS server, or you can type its name and click Resolve, and the wizard will determine the IP address for you. You can add several WINS servers.

This step eases client administration, but it is optional. If you leave all fields of this page blank and click Next, clients will still be able to obtain IP addresses from the DHCP server.

After you finish, click Next.

Activate Scope

On the Activate Scope page, you can activate the scope or choose to activate it later. In most cases, you should accept the default setting and activate the scope now. If you choose to activate the scope later, you can do so by using the DHCP console. You must activate the scope to allow clients on the subnet of this scope to obtain IP addresses from the DHCP server.

After you finish, click Next.

Completing the New Scope Wizard

On the Completing the New Scope Wizard page, you can click Back to change any of the settings. To apply your selections, click Finish.

Completing the Configure Your Server Wizard

After you complete the New Scope Wizard, the Configure Your Server Wizard displays the This Server is Now a DHCP Server page. To review all of the changes made to your server by the Configure Your Server Wizard or to ensure that a new role was installed successfully, click Configure Your Server log. The Configure Your Server Wizard log is located at systemroot\Debug\Configure Your Server.log. To close the Configure Your Server Wizard, click Finish.

To verify that your server is secure and has the most recent updates, do the following:

  1. Run Windows Update. For more information, see Windows Update.
  2. Run the Security Configuration Wizard. For more information, see Security Configuration Wizard.

Removing the DHCP server role

If you need to reconfigure your server for a different role, you can remove existing server roles. If you remove the DHCP server role, you must reconfigure clients to obtain IP addresses from another DHCP server. Also, if you want clients to continue using the IP addresses distributed by this server, you must configure another DHCP server to distribute those addresses.

To remove the DHCP server role, restart the Configure Your Server Wizard by doing either of the following:

  • From Manage Your Server, click Add or remove a role. By default, Manage Your Server starts automatically when you log on. XOX
  • XOX

On the Server Role page, click DHCP server, and then click Next. On the Role Removal Confirmation page, review the items listed under Summary, select the Remove the DHCP server role check box, and then click Next. After you click Next, the Configuring Components page of the Windows Components Wizard appears and then closes automatically. You cannot click Back or Next on this page. On the DHCP Server Role Removed page, click Finish.

Next steps: Completing additional tasks

After you complete the Configure Your Server Wizard, the computer is ready for use as a basic DHCP server that can manage IP addresses and related information. Up to this point, you have installed the DHCP Server service and created one scope that manages IP addresses and related information for the clients on one subnet. If you want to manage clients on other subnets, you must create additional scopes. If you have not activated the scope, then you must activate the scope to allow clients on the subnet of this scope to obtain IP addresses from the DHCP server.

When you complete the Configure Your Server Wizard, it automatically installs the DHCP console, which you use to manage your DHCP server. XOX

The following table lists some of the additional tasks that you might want to perform on your DHCP server.

Task | Purpose of task | Reference
Activate existing scopes. | To activate scopes that you created with the New Scope Wizard that are not currently active. | To activate a scope
Authorize the DHCP server in Active Directory. | To detect unauthorized DHCP servers and prevent them from starting or running on your network. | Authorizing DHCP servers
Add support for a routed network. | To enable the DHCP server to act as a relay agent, which forwards DHCP messages between subnets. | Configure the DHCP Relay Agent
Assign a server-based scope option. | To simplify administration by setting default values that all new scopes will inherit. | To assign a server-based option
Change or view scope properties. | To change or view the properties of an existing scope. | To change or view scope properties
Create new scopes. | To create scopes that support clients on other subnets. | To create a new scope
Add a client reservation. | To define an IP address that the DHCP server should not allocate to a client because another client is permanently using it. | To add a client reservation
Configure ports to allow remote administration. | To manage the DHCP server from other computers on the network. | With Windows Firewall enabled, you might need to make specific configuration settings in order to use or remotely administer technologies that ship with Windows Server 2003 operating systems. For information about these settings, see Windows Firewall Settings (http://www.microsoft.com/).


Streaming media server role: Configuring a streaming media server

You can use Windows Media Services to stream audio and video content to clients over the Internet or an intranet. Clients might be computers or devices that play back the content by using a player, such as Windows Media Player, or they might be computers running Windows Media Services (called Windows Media servers) that proxy, cache, or redistribute your content. Clients can also be custom applications that have been developed with the Windows Media Software Development Kit (SDK).

If you want this computer to provide audio and video content streams to clients and to other Windows Media servers, then configure this computer as a streaming media server.

Note

  • Windows Media Services is not available on the 64-bit versions of the Windows® Server 2003 Itanium-based systems family.

This topic explains the basic steps you must follow to configure a streaming media server. When you have finished the basic steps, you can complete additional configuration tasks, depending on how you want to use the streaming media server.

This topic covers:

Before you begin

Configuring your streaming media server

Next steps: Completing additional tasks

Before you begin

Before you configure your computer as a streaming media server, verify whether or not:

  • The operating system is configured correctly. In Windows Server 2003 operating systems, Windows Media Services depends on the appropriate configuration of the operating system and its services. If you have a new installation of a Windows Server 2003 operating system, you can use the default service settings. No further action is required. If you upgraded to a Windows Server 2003 operating system, or if you want to confirm that your services are configured correctly for best performance and security, then verify your service settings using the table in Default settings for services.
  • All existing disk volumes use the NTFS file system. FAT32 volumes are not secure, and they do not support file and folder compression, disk quotas, file encryption, or individual file permissions.
  • Windows Firewall is enabled. For information see Security Configuration Wizard in Windows Server 2003 Service Pack 1 (http://www.microsoft.com/).
  • The Security Configuration Wizard is installed and enabled. For information about the Security Configuration wizard, see Security Configuration Wizard.

Configuring your streaming media server

To configure a streaming media server, start the Configure Your Server Wizard by doing either of the following:

  • From Manage Your Server, click Add or remove a role. By default, Manage Your Server starts automatically when you log on. XOX
  • XOX

On the Server Role page, click Streaming media server, and then click Next.

This section covers:

Summary of Selections

Completing the Configure Your Server Wizard

Completing the streaming media server role configuration

Removing the streaming media server role

Summary of Selections

On the Summary of Selections page, view and confirm the options that you have selected. If you selected Streaming media server on the Server Role page, the following appears:

  • Install Windows Media Services

To apply the selections shown on the Summary of Selections page, click Next. After you click Next, the Configuring Components page of the Windows Components Wizard appears and then closes automatically. You cannot click Back or Next on this page.

After you click Next on the Summary of Selections page, the Configure Your Server Wizard installs Windows Media Services. Unlike many other services, Windows Media Services is installed without any input from the administrator.

Completing the Configure Your Server Wizard

After the components are configured, the Configure Your Server Wizard displays the This Server is Now a Streaming Media Server page. To review all of the changes made to your server by the Configure Your Server Wizard or to ensure that a new role was installed successfully, click Configure Your Server log. The Configure Your Server Wizard log is located at systemroot\Debug\Configure Your Server.log. To close the Configure Your Server Wizard, click Finish.

Before you start to use your streaming media server, Microsoft recommends the following steps:

  • Run Windows Update. For more information, see Windows Update.
  • Run the Security Configuration Wizard. For more information, see Security Configuration Wizard.

Completing the streaming media server role configuration

After you complete the Configure Your Server Wizard, the computer is ready for use as a basic streaming media server that can provide digital media content to clients and to other streaming media servers. Additional configuration is usually required, and the specific steps depend on your requirements. This section explains the basic decisions you must make in order to configure the streaming media server.

Note

  • If you have installed Windows Media Services on this computer, you can view Windows Media Services Help. To open Windows Media Services Help, click Start, click Run, and then type hh wmserver.chm.

The streaming media server role supports many scenarios, which Windows Media Services Help describes in detail. For more information, see Scenarios (http://www.microsoft.com/) in Windows Media Services Help. Most scenarios require you to reconfigure an existing publishing point or create a new one. You need to make one decision, or possibly two, and the results determine which of the three main publishing point configurations you should use. The following table shows how the decisions relate to configurations.

If you | And you want to use | Use this publishing point configuration
Want clients to control playback | One server connection per client | On-demand, unicast
Do not want clients to control playback | One server connection per client | Broadcast, unicast
Do not want clients to control playback | One server connection, shared by all clients | Broadcast, multicast

Control of playback

Control of playback means that the client should be able to start, stop, pause, rewind, and fast-forward digital media content. With on-demand, unicast, the client controls the playback, and the user experience is similar to playing a movie from a VCR or a DVD player. This type of playback requires an on-demand publishing point. An on-demand publishing point distributes pre-recorded content, such as audio and video files. When you add the streaming media server role, the wizard creates an on-demand publishing point named <Default>. You can distribute your media files from this publishing point, or you can create another publishing point. The configuration steps for an on-demand publishing point are similar to those presented in Stream Windows Media files on-demand (http://www.microsoft.com/) in Windows Media Services Help. If you choose to use an on-demand publishing point, you must use unicast delivery.

If the client does not control playback, the user experience is similar to viewing a television program. This type of playback requires a broadcast publishing point. This type of publishing point distributes pre-recorded and live content. When you add the streaming media server role, the wizard creates a broadcast publishing point named Sample_Broadcast that contains sample content. You should leave this sample broadcast publishing point intact and create a new broadcast publishing point. If you choose to create a broadcast publishing point, see Server connections.

For more information about on-demand and broadcast publishing point types, see About publishing point types (http://www.microsoft.com/) in Windows Media Services Help.

Using firewalls

If you plan to stream content from a Windows Media server on a network to clients on the Internet, you may need to open additional ports in your firewall to prevent clients from having problems receiving the content. Also, to make sure that your content is always available to clients that connect to your server using a URL that starts with a Microsoft Media Server (MMS) moniker (mms://), ensure that ports on your firewall are opened for all of the connection protocols that might be used during protocol rollover. For more information, see Using firewalls (http://www.microsoft.com/) in Windows Media Services Help.

Server connections

With unicast broadcast, the server creates a separate connection to each client. As a result, unicast delivery can consume a large amount of network bandwidth. For example, delivering the same content to 100 clients simultaneously consumes 100 times as much network bandwidth as delivering the content to one client. However, unicast delivery does not require any configuration of network routers and switches. The steps to configure a publishing point for multicast broadcast are similar to those presented in Use your server to publish live content from Windows Media Encoder (http://www.microsoft.com/) in Windows Media Services Help. For more information about unicast delivery, see Delivering content as a unicast stream (http://www.microsoft.com/) in Windows Media Services Help.

With multicast broadcast, the server does not create a connection to any client. Instead, the server delivers the content to a Class D Internet Protocol (IP) address on the network, and any client on the network can receive it. This conserves network bandwidth. For example, a multicast delivery to 100 clients consumes only as much bandwidth as delivery to one client. However, many networks by default do not support multicast delivery. To support multicast delivery, the network routers and switches between the server and the clients must be configured to transmit Class D IP addresses and interpret multicast information packets. The steps to configure a publishing point this way are similar to those presented in Use your server to broadcast a stream published by Windows Media Encoder (http://www.microsoft.com/) in Windows Media Services Help. For more information about multicast delivery, see Delivering content as a multicast stream (http://www.microsoft.com/) in Windows Media Services Help.

Removing the streaming media server role

If you need to reconfigure your server for a different role, you can remove existing server roles. If you remove the streaming media server role, clients will no longer be able to connect to the publishing points of this server, and encoders will no longer be able to send media streams through the server. All content stored or distributed only on this server will become unavailable.

To remove the streaming media server role, restart the Configure Your Server Wizard by doing either of the following:

  • From Manage Your Server, click Add or remove a role. By default, Manage Your Server starts automatically when you log on. XOX
  • XOX

On the Server Role page, click Streaming media server, and then click Next. On the Role Removal Confirmation page, review the items listed under Summary, select the Remove the streaming media server role check box, and then click Next. After you click Next, the Configuring Components page of the Windows Components Wizard appears and then closes automatically. You cannot click Back or Next on this page. On the Streaming Media Server Role Removed page, click Finish.

Next steps: Completing additional tasks

Up to this point, you have installed Windows Media Services. The installation added Windows Media Services to your server, installed the Help file, and created two publishing points that contain sample content.

The following table lists some of the additional tasks that you might want to perform on your streaming media server.

Task | Purpose of task | Reference
Configure security options. | To control access to the streaming media server and its content. | Configuring security options (http://www.microsoft.com/) in Windows Media Services Help
Take the tour. | To become more familiar with Windows Media Services capabilities. | Click Start, click Run, and then type %systemroot%\system32\windows media\server\admin\mmc\hta\tour_.hta
Review streaming media terms and concepts. | To become more familiar with streaming media concepts such as unicast and multicast, on-demand and broadcast, archiving, publishing points, and announcing content. | Understanding terminology (http://www.microsoft.com/) in Windows Media Services Help
Determine how many streaming media servers you need. | To plan ahead for the number of servers you need to install. | Streaming media system overview (http://www.microsoft.com/) and Capacity planning (http://www.microsoft.com/) in Windows Media Services Help
Identify port conflicts. | To prevent problems when Windows Media Services attempts to use the same TCP port as a Web server. | Using HTTP streaming and other services on the same computer (http://www.microsoft.com/) in Windows Media Services Help
Review instructions for upgrading an earlier version of Windows Media Services. | To ensure that you understand how to upgrade other servers running earlier versions of Windows Media Services. | Upgrading Windows Media Services (http://www.microsoft.com/) in Windows Media Services Help
Enable the Windows Audio service. | The Windows Audio service is disabled by default on a new installation of XOX, or XOX. This does not prevent the server from streaming audio to clients, but you should enable audio in order to test content playback on the server. | To enable or disable a service for a hardware profile
Start the Windows Media Services management interface. | To configure your streaming media server. | Click Start, click Run, and then type %systemroot%\system32\windows media\server\admin\mmc\wmsadmin.msc
Manage your streaming media server. | To configure your streaming media server to stream content over an intranet or the Internet. Before you begin streaming content, you must configure settings for your server running Windows Media Services, add and configure publishing points, and set up your content. | Managing your Windows Media server (http://www.microsoft.com/) in Windows Media Services Help
Log data and events. | To record the activity of clients that connect to your content. | Logging data and events (http://www.microsoft.com/) in Windows Media Services Help
Manage and produce content. | Content management methods and priorities will differ from one project to another based on a variety of factors, such as audience demographics, content type, and available equipment. | Content management and production (http://www.microsoft.com/) in Windows Media Services Help
Administer the streaming media server remotely. | To manage the streaming media server from other computers on the network. | Using Windows Media Services Administrator for the Web in Windows Media Services Help
Decide how to obtain content from the Windows Media Encoder. | To determine whether to configure the encoder to push a stream to the server or to configure the server to pull a stream from the encoder. | Sourcing from an encoder (http://www.microsoft.com/) in Windows Media Services Help
Implement a cache/proxy system. | To store the most recently streamed content for use by other clients seeking the same material. During live broadcasts, cache/proxy servers can perform a task called stream splitting, which allows many unicast clients to receive content while only a single stream is sent from the origin server. | Implementing a cache/proxy system (http://www.microsoft.com/) in Windows Media Services Help
Administer the streaming media server remotely. | To manage the streaming media server from other computers on the network. | Using Windows Media Services Administrator for the Web (http://www.microsoft.com/) in Windows Media Services Help


WINS server role: Configuring a WINS server

Windows Internet Name Service (WINS) servers dynamically map IP addresses to computer names (NetBIOS names). This allows users to access resources by computer name instead of by IP address. If you want this computer to keep track of the names and IP addresses of other computers in your network, configure this computer as a WINS server.

This topic explains the basic steps you must follow to configure a WINS server. When you have finished setting up a basic WINS server, you can complete additional configuration tasks, depending on how you want to use the WINS server.

This topic covers:

Before you begin

Configuring your WINS server

Next steps: Completing additional tasks

Before you begin

Before you configure your computer as a WINS server, verify that:

  • You are familiar with WINS concepts such as NetBIOS names, WINS server, WINS clients, and replication partners. For more information, see Understanding WINS.
  • The operating system is configured correctly. In Windows Server 2003 operating systems, WINS depends on the appropriate configuration of the operating system and its services. If you have a new installation of a product in Windows Server 2003, you can use the default service settings. No further action is necessary. If you upgraded to a product in Windows Server 2003 operating system, or if you want to confirm that your services are configured correctly for best performance and security, then verify your service settings using the table in Default settings for services.
  • You know how many WINS servers you need to install and where to locate each server on your network. When you add the WINS server role, you configure this server to maintain a database of computer names and IP addresses. In a large network, you may need to add the WINS server role to additional servers in order to ensure that client computers always have access to at least one WINS server. For more information, see Planning WINS networks.
  • This computer has a static IP address. For more information, see To configure TCP/IP for static addressing.
  • All existing disk volumes use the NTFS file system. FAT32 volumes are not secure, and they do not support file and folder compression, disk quotas, file encryption, or individual file permissions.
  • Windows Firewall is enabled. For more information see Security Configuration Wizard in Windows Server 2003 Service Pack 1 (http://www.microsoft.com/).
  • The Security Configuration Wizard is installed and enabled. For information about the Security Configuration wizard, see Security Configuration Wizard.

Configuring your WINS server

To configure a WINS server, start the Configure Your Server Wizard by doing either of the following:

  • From Manage Your Server, click Add or remove a role. By default, Manage Your Server starts automatically when you log on. XOX
  • XOX

On the Server Role page, click WINS server, and then click Next.

Summary of Selections

Completing the Configure Your Server Wizard

Removing the WINS server role

Summary of Selections

On the Summary of Selections page, view and confirm the options that you have selected. If you selected WINS server on the previous page, the following appears:

  • Install WINS

To apply the selections shown on the Summary of Selections page, click Next. After you click Next, the Configuring Components page of the Windows Components Wizard appears and then closes automatically. You cannot click Back or Next on this page. The Configure Your Server Wizard installs the WINS Server service. Unlike many other services, the WINS service installs without any input from the administrator.

If you cancel Configure Your Server, then WINS Server service is not installed. To install it later, restart Manage Your Server, and add the WINS role.

Completing the Configure Your Server Wizard

After the components are configured, the Configure Your Server Wizard displays the This Server is Now a WINS Server page. To review all of the changes made to your server by the Configure Your Server Wizard or to ensure that a new role was installed successfully, click Configure Your Server log. The Configure Your Server Wizard log is located at systemroot\Debug\Configure Your Server.log. To close the Configure Your Server Wizard, click Finish.

To verify that your server is secure and has the most recent updates, do the following:

  1. Run Windows Update. For more information, see Windows Update.
  2. Run the Security Configuration Wizard. For more information, see Security Configuration Wizard.

Removing the WINS server role

If you need to reconfigure your server for a different role, you can remove existing server roles. If you remove the WINS server role, and this server is the only WINS server that clients can use to register and resolve computer names, you need to add the WINS role to another server. Also, if this server is configured to replicate WINS database information with other WINS servers, then you must reconfigure replication on those other WINS servers.

To remove the WINS server role, restart the Configure Your Server Wizard by doing either of the following:

  • From Manage Your Server, click Add or remove a role. By default, Manage Your Server starts automatically when you log on. XOX
  • XOX

On the Server Role page, click WINS server, and then click Next. On the Role Removal Confirmation page, review the items listed under Summary, select the Remove the WINS server role check box, and then click Next. On the WINS Server Role Removed page, click Finish.

Next steps: Completing additional tasks

After you complete the Configure Your Server Wizard, the computer is ready for use as a basic WINS server that can keep track of server IP addresses and provide this information when a client requests it. Up to this point, you have installed the WINS Server service on one server. If you want to support WINS clients on a complex network, you may need to install additional WINS servers on other subnets.

The following table lists some of the additional tasks that you might want to perform on your WINS server.

Task | Purpose of task | Reference
View WINS name records registered at the server. | Verify that the WINS server is functioning correctly. | Finding and viewing WINS records
Modify WINS server defaults. | WINS uses several default server configuration parameters that determine how NetBIOS name records are managed in the WINS server database. These parameters are usually acceptable. You may want to modify them in special circumstances, such as when a host name change must be made, or when you renumber the network so that clients and servers use a different set of IP addresses. | Modifying server defaults
Configure replication settings on primary and secondary WINS servers. | WINS servers replicate database changes to each other so that each WINS server has the same information about the servers on the network and the IP address of each. | Configuring WINS replication; Configure replication
Configure ports to allow remote administration. | To manage the WINS server from other computers on the network. | With Windows Firewall enabled, you might need to make specific configuration settings in order to use or remotely administer technologies that ship with Windows Server 2003 operating systems. For information about these settings, see Windows Firewall Settings (http://www.microsoft.com/).


Windows SharePoint Services server role: Configuring a Windows SharePoint Services server

Microsoft Windows Graphic

Windows® SharePoint® Services server role: Configuring a Windows SharePoint Services server

Web sites based on Microsoft Windows SharePoint Services 2.0 provide a place where your team can communicate, share documents, and work together on a project. You can create a separate site for every project on which your team is working.

Site users can contribute to the site by using nothing more than a Web browser. However, if users have Windows SharePoint Services-compatible client programs, such as Microsoft Office 2003, installed on their computers, they can work seamlessly with the site, saving files to libraries, editing documents in the client program, and moving or linking that information to the site.

This topic explains the basic steps you must follow to configure a Windows SharePoint Services server. When you have finished setting up a basic Windows SharePoint Services server, you can complete additional configuration tasks, depending on how you want to use the Windows SharePoint Services server.

This topic covers:

  • Before you begin
  • Configuring your Windows SharePoint Services server
  • Next steps: Completing additional tasks

For information about using, installing, or deploying Windows SharePoint Services, see Windows SharePoint Services servers in Technology in Windows Server 2003 (http://www.microsoft.com/).

Before you begin

Before you configure your computer as a Windows SharePoint Services server, verify that:

  • FrontPage 2002 Server Extensions are not running on port 80.
  • Windows Firewall is enabled. For information see Security Configuration Wizard in Windows Server 2003 Service Pack 1 (http://www.microsoft.com/).
  • The Security Configuration Wizard is installed and enabled. For information about the Security Configuration wizard, see Security Configuration Wizard.

The following table lists the information that you need to know before you add a Windows SharePoint Services server role.

Before adding a Windows SharePoint Services server role | Comments
Decide the best way to install Windows SharePoint Services for your organization. You can choose between the following:
  • Easy installation for small deployments
  • Server farm installation with multiple front-end Web servers and multiple back-end database servers

For an easy installation for small deployments, use the Configure Your Server Wizard and Manage Your Server to set up Windows SharePoint Services on a single server with Microsoft SQL Server 2000 Desktop Engine (Windows) (WMSDE) in minutes. This setup uses all default settings.

For a server farm installation, you can start with a basic installation by using the Configure Your Server Wizard or Manage Your Server, and later upgrade your installation to use a remote SQL Server database or a server farm configuration. You can also create a server farm by following the instructions in the Windows SharePoint Services Administrator's Guide (http://www.microsoft.com/).

Are you migrating sites from another server running Windows SharePoint Services? | If you already have a server running Windows SharePoint Services, but you want to move the sites to this new server, use the Microsoft SharePoint Migration Tool (Smigrate.exe). For more information, see "Migrating and Upgrading Web Sites" in the Windows SharePoint Services Administrator's Guide (http://www.microsoft.com/).

Configuring your Windows SharePoint Services server

  1. Run Windows Update. For more information, see Windows Update.
  2. Run the Security Configuration Wizard. For more information, see Security Configuration Wizard.
  3. To configure a Windows SharePoint Services server, start the Configure Your Server Wizard by doing either of the following:
    • From Manage Your Server, click Add or remove a role. By default, Manage Your Server starts automatically when you log on. To open Manage Your Server, click Start, click Control Panel, double-click Administrative Tools, and then double-click Manage Your Server.
    • To open the Configure Your Server Wizard, click Start, click Control Panel, double-click Administrative Tools, and then double-click Configure Your Server Wizard.
  4. On the Server Role page, click SharePoint Services, and then click Next.

This section covers:

  • Summary of Selections
  • Removing the Windows SharePoint Services server role

Summary of Selections

On the Summary of Selections page, view and confirm the options you have selected. If you selected SharePoint Services on the Server Role page, the following appears:

  • Install IIS and ASP.NET
  • Install SharePoint Services

To apply the selections shown on the Summary of Selections page, click Next.

Removing the Windows SharePoint Services server role

If you need to reconfigure your server for a different role, you can remove existing server roles. If you remove the Windows SharePoint Services server role, sites on this server are no longer available to users and they will be unable to connect to them.

  1. To remove the Windows SharePoint Services server role, restart the Configure Your Server Wizard by doing either of the following:
    • From Manage Your Server, click Add or remove a role. By default, Manage Your Server starts automatically when you log on. To open Manage Your Server, click Start, click Programs, double-click Administrative Tools, and then double-click Manage Your Server.
    • To open the Configure Your Server Wizard, click Start, click Programs, double-click Administrative Tools, and then double-click Configure Your Server Wizard.
  2. On the Server Role page, click SharePoint Services, and then click Next. On the Role Removal Confirmation page, review the items listed under Summary, select the Remove the SharePoint Services role check box, and then click Next. On the SharePoint Services Role Removed page, click Finish.

Next steps: Completing additional tasks

Up to this point, you have completed the following tasks:

  • Installed IIS and ASP.NET
  • Installed Windows SharePoint Services and WMSDE
  • Extended the default virtual server with Windows SharePoint Services

After you complete the Configure Your Server Wizard, your Windows SharePoint Services server is configured, and your default Web site is extended with Windows SharePoint Services and ready to use. You can configure Windows SharePoint Services and create sites for your organization.

The following table lists some of the additional tasks that you can perform on your Windows SharePoint Services server.

Task | Purpose of task | Reference
Configure default e-mail server settings | If you want users to be able to sign up for alerts or get invitations to join sites, you need to connect to an SMTP server and set the e-mail address to use for messages. These settings also control the e-mail address for any administrative notifications sent by the server. | For more information, see "Configuring E-Mail Settings" in the Windows SharePoint Services Administrator's Guide (http://www.microsoft.com/).
Install an antivirus scanner compatible with Windows SharePoint Services, and enable antivirus scanning. | Help protect your users from uploading or downloading files that contain viruses, by installing and enabling an antivirus scanner that is compatible with Windows SharePoint Services. | For more information, see "Configuring Antivirus Protection" in the Windows SharePoint Services Administrator's Guide (http://www.microsoft.com/).
Download and install ready-to-use applications | Boost worker productivity by downloading and installing an application for Windows SharePoint Services. These applications are tailored to address specific processes or tasks. There are many to choose from, including recruiting, project management, help desk issue tracking, timesheet and scheduling, event planning, and more. Use the applications as soon as you install them or customize them further to meet your organization’s specific needs and requirements. | For more information, see Windows SharePoint Services Applications (http://go.microsoft.com/fwlink/?LinkId=47987).
Create additional sites or turn on Self-Service Site Creation | Before your users can start using Windows SharePoint Services, they have to have a Windows SharePoint Services site. The first site was created when you extended the virtual server. You can either continue creating sites for your users, or turn on Self-Service Site Creation and let them create their own. | For more information, see "Creating Sites and Subsites" and Configuring Self-Service Site Creation" in the Windows SharePoint Services Administrator's Guide (http://www.microsoft.com/).
Configure ports to allow remote administration. | To manage the Windows SharePoint Services server from other computers on the network. | Windows Firewall Settings (http://www.microsoft.com/)

For more information about the tasks involved in configuring Windows SharePoint Services, see the Windows SharePoint Services Administrator's Guide (http://www.microsoft.com/).


Remove a server role

Microsoft Windows Graphic

To remove a server role

  1. Open Manage Your Server. To open Manage Your Server, click Start, click Control Panel, double-click Administrative Tools, and then double-click Manage Your Server.
  2. Under Managing Your Server Roles, click Add or remove a role.
  3. In the Configure Your Server Wizard, on the Preliminary Steps page, click Next.
  4. On the Server Role page, click the role that you want to remove, and then click Next.
  5. On the Role Removal Confirmation page, select the Remove the server role check box, and then click Next.
  6. On the Server Role Removed page, click Finish.

Important

  • When you remove a server role, you might break dependencies that exist between the server role and other programs. Be sure to test removing the server role in a test environment before doing so on your network.

Notes

  • XOX
  • XOX
  • For more information about removing specific server roles and any dependencies that might be affected, see the following:

    Removing the file server role

    Removing the print server role

    Removing the application server role

    Removing the mail server role

    Removing the terminal server role

    Removing the remote access/VPN server role

    Removing the domain controller role

    Removing the DNS server role

    Removing the DHCP server role

    Removing the streaming media server role

    Removing the WINS server role


Checklist: Configuring the typical setup for a first server

Microsoft Windows Graphic
Step | Reference
Review key concepts for Active Directory. | Active Directory overview
Review key concepts for DNS. | DNS overview
Review key concepts for DHCP. | DHCP overview
Review key concepts for Routing and Remote Access. | Routing overview; Remote access overview
Review key concepts for application directory partitions in Active Directory. | Application directory partitions
Decide on a plan for your DNS domain namespace. Because Active Directory and the namespace have an identical structure, namespace planning is crucial to a smooth deployment of Active Directory. Also, if your network requires a presence on the Internet, verify that you have a registered Internet domain name. | Namespace planning for DNS
Verify that the server has an NTFS partition. | To view the properties of a volume
Determine the name of the DNS zone for which you want this server to be authoritative. If you are setting up a small network with multiple computers connecting to the Internet (such as a home office), you also need the IP address of the DNS server at your Internet Service Provider. | Understanding zones and zone transfer; Dynamic update;Using forwarders
Make additional configuration changes to the DNS server or install additional DNS servers. | Checklist: Installing a DNS server; To configure a new DNS server
Configure additional options for the DHCP server. | Checklist: Installing a DHCP server
(Optional) Monitor and measure various aspects of the DNS server to prevent and troubleshoot performance degradation. | Monitoring DNS server performance
(Optional) Monitor and measure various aspects of the DHCP server to prevent and troubleshoot performance degradation. | Monitoring DHCP server performance; DHCP performance monitoring reference
(Optional) Install and configure additional domain controllers. | Checklist: Creating an additional domain controller in an existing domain
(Optional) Select the appropriate security level for domain administration. | Using the Active Directory Installation Wizard


Preliminary steps: Configuring roles for your server

The following links provide detailed information about the preliminary steps you need to take before you configure a server role.

Step | Reference
Install all modems and network cards. | Installing a modem; Installing devices overview
Attach all necessary cables. | Refer to documentation provided with the server computer manufacturer.
Connect to the Internet. | Make Internet connections
Turn on all peripherals, such as printers or external drives. | Add a printer attached to your computer; Installing devices overview
Have the Setup CD provided with your Windows Server 2003 operating system available, or know your network installation path. | If you installed your operating system remotely by using a network path instead of using a the Setup CD provided with your Windows Server 2003 operating system, you need to use that same network path when you configure your server.


Manage Backup Jobs

The Manage Backup Jobs taskpad allows you add and manage backup jobs on your server by using the Windows Backup Utility. You can also use this utility to restore archived data to the server computer.

Task | Description
Launch Backup Wizard | Starts the Windows Backup Utility, which allows you to specify data backup or restore.

For more information, see Backup overview in online Help.


Manage Shared Folders

The Manage Shared Folders taskpad allows you to view and manage the shared folders on the server. The following section details the tasks available on this taskpad. Some tasks are only available with a shared folder selected.

Task | Description
Add a Shared Folder | Starts the Add Shared Folder Wizard, which adds a new shared folder on the Windows server computer and sets access permissions on it.
Change Shared Folder Properties | Allows you to modify the properties of the selected folder, such as name, path, connection limits, and permissions. Also allows you to publish the folder in Active Directory.
Stop Sharing | Stops sharing the selected folder. The folder and any accompanying data will not be removed.

For more information, see Shared folders in online Help.


Manage Printers

The Manage Printers taskpad enables you to manage the printers on your network. The following section details the tasks available on this taskpad. Some tasks are only available with a printer selected.

Task | Description
Add a Printer | Starts the Add Printer Wizard, which allows you to add a local or network printer to the server. The print device must already be connected.
Change Printer Properties | Allows you to modify the options for the selected printer, such as name, path, permissions, and other advanced properties.
Manage Printer Jobs | Allows you to cancel, pause, or resume print jobs in the selected printer's queue.

For more information, see Printing overview in online Help.


Server Management

Based on Microsoft Management Console 2.0, Server Management is designed for domain administrators and contains the necessary snap-ins and tools for basic daily management. Using the console tree, you can navigate the snap-in structure and access tools from either the menu bar or context-sensitive menus. In the details pane, you can access tools by using taskpad tasks or context-sensitive menus.

Server Management is preconfigured with the following management tools:

Tool | Description
Home Page | Presents iconic shortcuts to the main console tools in Server Management.
Shared Folders | Enables you manage shared folders on the server.
Users | Enables you to add and manage network user accounts.
Printers | Enables you to manage local and network printers.
Backup | Enables you to back up your server.


Manage Users

The Manage Users taskpad allows you to manage, create, and modify server user accounts. The following section details the tasks available on this taskpad. Some tasks are only available with a user account selected.

Task | Description
Add a User | Starts the Add User Wizard, which simplifies user account creation by allowing you to specify several account options from one place.
Change Password | Allows you to change or reset the network password for the selected user.
Add User to a Group | Allows you to specify additional security or distribution group memberships for the selected user.
Enable Account | Enables the selected user account. When a disabled user account is enabled the user will be able to log on to the network and access network resources, such as e-mail or printers.
Disable Account | Disables the selected user account. While the account is disabled, the user is unable to log on to the network or access network resources, such as e-mail or printers. The user account is not removed.
Change User Properties | Allows you to view and modify the properties for the selected user, such as account information, profile, and remote access.
Remove User | Permanently removes the selected user account. Once an account is removed, it cannot be recovered. You will be asked for confirmation.

For more information, see User and group accounts in online Help.