Skip to content

Server Management S2 — Cheatsheet

Deployment, GPO, AD infrastructure, file sharing, DHCP/DNS and recovery — 2024–2025

Table of Contents

Base Installations

An integration lab starts with consistent naming, a network plan, DNS, time and roles. Windows domain members use the AD DNS server. Linux hosts get a static address or reservation, the correct hostname/FQDN and time synchronization.

Test-NetConnection dc01.lab.local -Port 53
Add-Computer -DomainName lab.local -Credential LAB\Administrator -Restart

hostnamectl set-hostname linux01.lab.local
ip address
ip route
resolvectl status
timedatectl

DNS before domain join

Many Kerberos and join issues are DNS issues. Test A/AAAA, SRV and reverse resolution before suspecting credentials.

PXE Deployment

PXE lets a client boot over the network and fetch an image/installation environment.

client DHCP/PXE discovery
   → IP + boot server/boot information
   → bootloader via TFTP
   → WinPE
   → installation image and unattended configuration

WDS or a deployment platform manages boot and install images. Watch out for BIOS/UEFI architecture, DHCP/PXE relay, VLANs, TFTP/firewall and driver support.

When DHCP and PXE run on different servers, prefer IP helpers/relay configuration. Blindly setting vendor options 66/67 can break different client architectures.

Group Policy

GPOs contain Computer Configuration and User Configuration. Processing typically follows LSDOU: Local → Site → Domain → OU; within the same level, link order determines priority.

Mechanism Effect
Enforced prevents being overridden by a lower OU
Block inheritance blocks non-enforced parent links
Security filtering applies only to selected principals
WMI filter applies based on a system property
Loopback user policy follows computer location (merge/replace) 
gpupdate /force
gpresult /h C:\Temp\gpresult.html
Get-GPResultantSetOfPolicy -ReportType Html -Path C:\Temp\rsop.html

GPO Preferences configure settings but can be changed by the user/app; Policies are typically enforced. Don't put passwords in Group Policy Preferences.

Global Catalog and FSMO

The Global Catalog contains a full copy of the own domain and a partial attribute set of other forest domains. It supports forest-wide searches, UPN logon and universal group membership.

FSMO roles

Role Scope Task
Schema Master forest schema changes
Domain Naming Master forest add/remove domains
RID Master domain RID pools for SIDs
PDC Emulator domain time, password priority, legacy/PDC tasks
Infrastructure Master domain cross-domain object references 
netdom query fsmo
Move-ADDirectoryServerOperationMasterRole -Identity DC02 -OperationMasterRole 0,1,2,3,4

A transfer happens in a controlled way with a working old DC; seize only when the old role holder definitively won't return.

IAM Hardening

  • Separate regular and administrative accounts.
  • Use least privilege and administrative tiering.
  • Limit Domain Admins; use delegated administration.
  • Set strong password/account-lockout/Kerberos policies.
  • Use LAPS for unique local administrator passwords.
  • Disable legacy/problematic protocols where possible.
  • Audit privileged group changes and failed logins.
Get-ADDefaultDomainPasswordPolicy
Get-ADGroupMember 'Domain Admins'
Search-ADAccount -LockedOut

NTFS and AGDLP

Effective access combines share and NTFS permissions; over the network, the most restrictive combination applies. NTFS supports inheritance and granular ACLs.

Accounts → Global role group → Domain Local resource group → Permissions

Example:

Ada → GG_Directie → DL_DirectieShare_RW → Modify on D:\Shares\Directie

icacls D:\Shares\Directie
Get-Acl D:\Shares\Directie | Format-List

Use Modify for normal data management; Full Control also allows changing permissions/ownership. Avoid individual ACEs and explicit deny unless truly necessary.

SMB, DFS and NFS

Windows SMB

New-Item -ItemType Directory D:\Shares\Directie
New-SmbShare -Name Directie -Path D:\Shares\Directie -ChangeAccess LAB\DL_DirectieShare_RW
Get-SmbShareAccess Directie
Get-SmbSession
Get-SmbOpenFile

SMB signing protects integrity/authenticity; SMB encryption also protects confidentiality. Don't use SMBv1.

DFS

  • DFS Namespace provides one logical path, e.g. \\lab.local\Data.
  • DFS Replication synchronizes folders between servers.
  • A namespace is not automatic data redundancy; that requires multiple folder targets and replication.

Watch out for conflicts, staging quota, AD replication, backlog, and the fact that open files aren't replicated like a database cluster.

Samba

Samba provides SMB for Linux and can work standalone or AD-integrated. Both filesystem permissions/ACLs and share configuration must allow access.

testparm
smbclient -L //server -U user
systemctl status smb

NFS

# /etc/exports
/srv/data 192.168.10.0/24(rw,sync,root_squash)

exportfs -ra
showmount -e server
mount -t nfs server:/srv/data /mnt/data

NFS uses Unix identities; consistent UID/GID or centralized identity mapping is crucial.

Redundant DHCP

Windows DHCP failover replicates leases and configuration between two partners.

Mode Behavior
Load balance both servers share clients
Hot standby active server + reserve

MCLT limits lease renewal during communication problems. Failover doesn't replace correct relay configuration or a backup of the DHCP configuration.

Get-DhcpServerv4Failover
Get-DhcpServerv4Scope
Get-DhcpServerv4Lease -ScopeId 192.168.10.0

In hybrid DHCP, Windows and Linux can serve scopes, but avoid overlapping pools and keep options, reservations and DNS updates consistent.

Redundant DNS

AD-integrated zones use multimaster AD replication and secure dynamic updates. Linux/BIND can be a secondary for a classic primary zone via zone transfer, if explicitly allowed.

Zone type Property
Primary writable master copy
Secondary read-only copy via AXFR/IXFR
Stub mainly SOA/NS/glue for delegation
AD-integrated writable on DCs within replication scope 
Get-DnsServerZone
Get-DnsServerResourceRecord -ZoneName lab.local
Resolve-DnsName -Server dc02 lab.local -Type SOA

A client with two DNS servers doesn't use the second as round-robin load balancing, but per resolver behavior when there's no/an invalid answer. Both must correctly know the same internal namespace.

Business Continuity, Backup and Recovery

Term Meaning
RPO maximum acceptable data loss in time
RTO maximum acceptable recovery time
Backup recovery copy of data/system state
HA limiting downtime through redundancy
DR recovery after a large-scale disaster

3-2-1 rule

3 copies → on 2 media types → 1 offsite

Modern extension: at least one offline/immutable copy and zero errors after verification.

Backup Contents
Full all selected data
Incremental changes since the last backup of any type
Differential changes since the last full
System State critical Windows/AD configuration

Restore is the real test

A successful backup job doesn't prove RPO/RTO are achievable. Run periodic restore tests and document the full procedure, credentials and dependencies.

Recovery order follows dependencies: platform/storage → identity/DNS → network services → applications → data → functional validation.