EmailRSS

Tag Archives: Server

Tasks – Weekly, Monthly, Biyearly Checklist

Posted on by

I am a sucker for a good checklist! To keep things running smoothly in our environment, I work through a weekly, monthly, and 6-month maintenance check. While some of these items won’t be applicable to your environment, I hope that sharing them will give you a few ideas to make your organization run a bit better!

Items on this list are not completely scripted or are things that I want a physical set of eyes on regularly. You won’t see things like stale AD computer and user cleanup because these things are fully automated already. Next week’s post will highlight those types of tasks.

Weekly To-Do

Security

Servers

  • Check DFS reports between File Servers
  • Check volume usage and rate of growth
  • Any critical errors in Server Manager Events?
  • Check SCCM component status
  • Check AppLocker errors on servers

Network

DR

  • Check on GPO backup
  • Check Backup Logs/Storage Space
  • Check RAID status on remote servers

Monthly To-Do

  • Software Updates

Biyearly To-Do

SCCM

• Run Find and Create Device Models Script
• Run Find and Create BIOS Versions Script

• Set age in comments attribute for each new model collection
• Add new models to Model | Less than 5 years old collection
• Add any models 5 years or older to the Model | 5 years or older

These last three steps are used for state reporting. When combined with collections that identify primary user type of a device, we can quickly see the number of staff and student devices by OS and by their age group (less than five years old / five years or older).

Active Directory Health

Backup and Firmware Upgrades

Servers

DR

And that is it! If you have questions about a specific task or want to share your maintenance schedule, feel free to leave a comment!

Who can shutdown your servers?

Posted on by

Have you accidentally shut down a server or your own workstation? While you meant to just reboot, that device is now shutting down. It is even worse if it was a physical machine – at a remote location.

Not that I’m speaking from personal experience or anything…

Your task today is to prevent accidental shutdowns for your important machines. Let’s control who can shut down the system, using Group Policy[note]not to be confused with shutting down the system using Group Policy[/note].

I could have sworn I hit restart…

Often, every user that can log on interactively to a server also has permission to shut that server down. Open gpedit.msc on a server and browse to Local Computer Policy\Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment. If you have any shared client machines (such as a jump machine/management VM), you will see Users listed. On a server OS, you won’t see Users listed by default. But ask yourself, do you really trust all of your administrators not to hit the wrong button? 🙂

Don’t edit the local computer policy. First, decide what accounts should have access to shut down[note]Does anyone else feel that shut down should be a single word? Like shutdown.[/note] a server. I limit this to the domain admin account, elevated admin accounts, and a few service accounts. Add these users to a security group named something like Security – URA – Shut down the system

Next, make your changes in the Group Policy Management Console. There are two common approaches to take. Either:

  • Create a new GPO named something like Security – URA – Shut down the system ; edit the setting pictured above, and link it to your servers / domain controllers OU.
  • Edit an existing general server GPO to restrict the shutdown permissions. If you do this route, make sure any server OUs with blocked inheritance and your domain controller OU is included.

Either way, be sure to comment why these changes were made, who made them, and when they were made. That is all that you need to do! With accidental shutdowns stopped, you won’t have to make the drive of shame to turn on that remote server.[note]Not that I’m speaking from personal experience or anything… [/note]

Let’s Encrypt – Installing Free Trusted SSL Certificates on Windows Server Automatically

Posted on by

Ever get tired of paying for another certificate to use on a new server? Let me introduce you to Let’s Encrypt and show you how easy it is to install and maintain free, trusted certificates on your Windows machines.

Another free and trusted certificate from Let’s Encrypt

How does Let’s Encrypt work?

First, a bit of background information. Let’s Encrypt is completely free and trusted by every major CA. Like other open projects, it is donor supported. Donors include Cisco, Google, Microsoft, and Mozilla.

When a certificate is issued, it is valid for just 90 days. And I know what you are thinking – “90 days, I’ll be replacing certificates all of the time!”

With Let’s Encrypt, the entire process – from requesting to renewal – is designed to be automated! Once setup, certificate management should be just another task that occurs in the background, automatically. Automation can be achieved a few ways. For a Windows machine, my preferred method is to use the Win Acme tool.

How to Use Win Acme with Let’s Encrypt

Originally, I used a PowerShell script to do this but found that the Win Acme tools were easier to use. The tools can be downloaded from here.

Once the .ZIP has been downloaded, extract it to a server needing a certificate. If you plan on using it on several severs, store it on a share and use Group Policy File Preferences to deploy it.

Next, ensure that the server is publicly accessible through HTTP by using the full name that you need a certificate for. Certificates have to be verified before being issued; verification using a DNS name for the host is one of the supported methods. In the screenshot, you can see that I have an HTTPS binding for letsencrypt.deployhappines.com on an IIS server. You would also want to make sure that the name is accessible over port 80. You can read about other validation methods here.

On the server, launch an elevated command prompt and run letsencrypt.exe /? 

For a single IIS site, you would want to press N to create a new certificate and then 1. After pressing 1, you should see a list of sites available on your server. Because the server in this screenshot already had a certificate, I was not prompted to configure any notifications settings or accept the EULA.

Continue through the prompts until the certificate is installed. Win-acme should automatically load the certificate into the Web Hosting certificate store for the server and bind it in IIS. To see it immediately, you can restart your site in IIS. Additional options are available if you need to install a certificate for other server roles, such as Exchange or RDS.

Finally, you should see a new win-acme scheduled task in Task Scheduler. This task will automatically renew and replace your certificates when they are near expiration.

So, what do you think about Let’s Encrypt? Do you currently use it? Do you want to use it?

Using Handbrake and PowerShell to Shrink Videos in Redirected Folders

Posted on by

Videos, specifically .MP4s, are probably the largest files on your file servers. In part, this is due to the explosion of cheap cameras that record very high definition video. The latest iPhone can record video at 4K yetI have some projectors that can’t show a resolution greater than 720p! Talk about a waste of space.

So, what is a server admin to do? The same thing we did to pictures, shrink some files with PowerShell! Below, you will see a screenshot of the same video before and after conversion!

The script will:

  • automatically go through a network share that is used for folder redirection / home folders.
  • Convert MP4 files to a 720p resolution. If you want a higher or lower resolution, edit line 255 by changing the preset value.
  • Remove the old file if it is larger than the new file.
  • Reset all ownership and permissions
  • Tag the file so that future conversions run faster.

Continue reading →

Blogs that I Follow – (an early) 2018 Edition

Posted on by

Finding a mentor is one of the quickest ways to become an expert! Following technology blogs, either through email notifications or a service like Feedly, can give you access to experts around the globe. The collection below, organized by technology, lists any blogs that I follow. Items in blue are new as of the last update. Items crossed out are off my list. This list changes depending on the content of the blog, if the blog is still active, and what I am currently trying to master.

Of course, you can also subscribe to DeployHappiness by email (top right corner of any page) or through RSS: http://feeds.feedburner.com/Deployhappiness. If I missed any great blogs, let me know in the comments below!

Active Directory/Group Policy:

Desktop Management and Deployment:

Scripting/PowerShell:

Servers:

System Center:

Tech Information/Other:

  • Windows for IT Pros