Server Management Intro S1 — Cheatsheet
Windows Server, Active Directory, storage, DHCP and DNS — 2024–2025
Table of Contents
- Virtualization and Installation
- Windows Server Basic Management
- Networking and Routing
- Local Users and Filesystem
- Remote Management
- Active Directory
- OUs, Groups and Permissions
- Disks, Volumes and RAID
- DHCP
- DNS
Virtualization and Installation
Hyper-V is a type-1 hypervisor. A VM consists of configuration, virtual CPU/RAM, virtual disks and network adapters.
| Switch type | Scope |
|---|---|
| External | VM ↔ physical network/internet |
| Internal | VM ↔ host and other VMs |
| Private | VM ↔ VM only |
Checklist: meaningful VM name, Generation 2 where supported, sufficient but not excessive RAM/CPU, correct VHDX, correct vSwitch, detach the ISO after installation, and use checkpoints only deliberately.
A checkpoint is not a backup
A checkpoint still depends on the VM files and storage. Use a real backup for recovery after loss or corruption.
Windows Server Basic Management
Get-ComputerInfo
Rename-Computer -NewName SRV01 -Restart
Get-NetIPConfiguration
Get-WindowsFeature
Install-WindowsFeature RSAT-AD-Tools
Get-Service
Get-EventLog -LogName System -Newest 20
Server Manager centralizes roles/features, events, services and remote servers. Windows Admin Center and PowerShell are suited for remote/automated management.
Static IP
New-NetIPAddress -InterfaceAlias 'Ethernet' -IPAddress 192.168.10.10 -PrefixLength 24 -DefaultGateway 192.168.10.1
Set-DnsClientServerAddress -InterfaceAlias 'Ethernet' -ServerAddresses 192.168.10.10
A domain controller uses internal DNS, not a public resolver directly as the preferred DNS.
Networking and Routing
Get-NetAdapter
Get-NetIPAddress
Get-NetRoute
Test-NetConnection 192.168.10.1
Test-NetConnection server -Port 3389
Routing on Windows requires multiple interfaces/subnets and the Remote Access/Routing role, or a suitable forwarding configuration. Clients must use the router as the default gateway, and routers must know both an outbound and a return route.
Windows Firewall works per profile (Domain, Private, Public), direction, protocol/port, program and remote/local addresses.
Get-NetFirewallProfile
New-NetFirewallRule -DisplayName 'Allow HTTPS' -Direction Inbound -Protocol TCP -LocalPort 443 -Action Allow
Local Users and Filesystem
Get-LocalUser
Get-LocalGroup
New-LocalUser -Name 'admin' -Password $password
Add-LocalGroupMember -Group 'Administrators' -Member 'admin'
NTFS permissions: Full Control, Modify, Read & Execute, List, Read, Write and special permissions. Permissions can be explicit or inherited; deny generally wins over allow. Effective access follows from user and group memberships.
Work through groups
Assign permissions to groups, not directly to many individual users. That keeps joiner/mover/leaver management auditable.
Remote Management
| Technology | Use |
|---|---|
| RDP | graphical interactive session |
| PowerShell Remoting/WinRM | management commands and automation |
| MMC/Server Manager | remote consoles |
| Windows Admin Center | browser-based management |
Enable-PSRemoting -Force
Test-WSMan SRV01
Enter-PSSession -ComputerName SRV01
Invoke-Command -ComputerName SRV01,SRV02 -ScriptBlock { Get-Service }
In a domain, WinRM typically uses Kerberos. TrustedHosts is not an equivalent alternative to domain trust and should remain restricted.
Active Directory
AD DS stores identities and directory objects. Key concepts:
| Concept | Meaning |
|---|---|
| Forest | the top security boundary/schema/configuration |
| Tree/domain | DNS name and administrative/replication unit |
| Domain Controller | hosts AD DS and authenticates |
| OU | container for delegation and GPO application |
| Site | physical/network topology for replication and logon |
| Global Catalog | partial copy of forest objects |
Install-WindowsFeature AD-Domain-Services -IncludeManagementTools
Install-ADDSForest -DomainName 'lab.local' -InstallDNS
AD strongly depends on DNS and correct time. Kerberos tolerates only limited clock skew.
OUs, Groups and Permissions
Design OUs for management, delegation and GPOs, not necessarily as an exact copy of the org chart.
| Group scope | Typical use |
|---|---|
| Global | collect accounts with the same role |
| Domain Local | permissions on a resource in the domain |
| Universal | roles across multiple domains |
AGDLP:
New-ADOrganizationalUnit -Name 'Sales' -Path 'DC=lab,DC=local'
New-ADUser -Name 'Ada Lovelace' -SamAccountName 'alovelace' -Path $ou -Enabled $true -AccountPassword $pw
Add-ADGroupMember -Identity 'GG_Sales' -Members 'alovelace'
GPO processing: Local → Site → Domain → OU; settings applied later generally win. Security filtering and WMI filters can restrict scope.
Disks, Volumes and RAID
| RAID | Minimum | Property |
|---|---|---|
| 0 | 2 | striping, fast, no redundancy |
| 1 | 2 | mirroring, 50% capacity |
| 5 | 3 | single parity, one disk failure |
| 6 | 4 | double parity, two failures |
| 10 | 4 | stripe over mirrors, fast and redundant |
RAID increases availability but is not a backup: deletion, ransomware and corruption are replicated too.
Get-Disk
Initialize-Disk -Number 1 -PartitionStyle GPT
New-Partition -DiskNumber 1 -UseMaximumSize -AssignDriveLetter |
Format-Volume -FileSystem NTFS -NewFileSystemLabel Data
GPT is the modern choice and supports large disks and more partitions than legacy MBR.
DHCP
DHCP DORA: Discover → Offer → Request → Acknowledge. A scope contains a pool, subnet mask, lease and options; exclusions are never handed out, and reservations tie a MAC/client ID to a fixed IP.
Key options: 003 Router, 006 DNS Servers, 015 DNS Domain Name.
Install-WindowsFeature DHCP -IncludeManagementTools
Add-DhcpServerv4Scope -Name 'LAN' -StartRange 192.168.10.100 -EndRange 192.168.10.200 -SubnetMask 255.255.255.0
Set-DhcpServerv4OptionValue -ScopeId 192.168.10.0 -Router 192.168.10.1 -DnsServer 192.168.10.10 -DnsDomain 'lab.local'
A DHCP relay is needed between subnets because the initial client broadcasts don't cross routers. In AD, a Windows DHCP server must be authorized.
DNS
| Record | Function |
|---|---|
| A / AAAA | name to IPv4/IPv6 |
| PTR | IP to name |
| CNAME | alias |
| MX | mail server |
| NS | nameserver for a zone |
| SRV | service discovery; essential for AD |
| SOA | zone authority and timers |
Resolve-DnsName dc01.lab.local
Get-DnsServerZone
Add-DnsServerPrimaryZone -NetworkId '192.168.10.0/24' -ReplicationScope Domain
ipconfig /registerdns
ipconfig /flushdns
Forward lookup resolves name → IP; reverse lookup resolves IP → name. A recursive resolver traverses/delegates on behalf of the client and caches according to TTL; authoritative servers give definitive zone answers.
Diagnostic order
- Are IP, prefix and gateway correct?
- Is the DNS server address correct and reachable?
- Can the DNS server itself forward/use root hints?
- Does the record exist in the correct zone, and did replication succeed?
- Is it a caching issue or a genuinely missing record?