Designing the Server Kernel The Server Kernel is designed to deliver all of the services that are common to all servers. The decision to include a component is based on corporate need as well as licensing mode for the component. If your organization owns a corporate license for a server component, it should be included in the kernel. If your corporation requires a specific function on all servers, the technology supporting it should be included in the kernel. Kernel contents also include the default server configuration. Finalizing the configuration elements of the server and capturing them in an “image” of the Server Kernel can greatly simplify the deployment process for new servers. This configuration should also include the preparation of the presentation section of the server. Making sure that all new user environments created on the server have immediate access to server management tools and server utilities simplifies the server management process as well. Table 1-1 outlines the suggested content for the Server Kernel. Chapter 1: Planning for Windows Server 2003 25 Tip&Tec / Windows Server 2003: Best Practices for Enterprise Deployments / Ruest & Ruest / 222343-x / Chapter 1 Sublayer Suggested Contents Operating system (provides basic system services) Windows Server 2003, Enterprise Edition (most versatile edition) Service Packs and/or hot fixes, if applicable Specific drivers (video, power management, printing, etc.) DLLs (Visual Studio DLLs, .NET Framework CLR, others) Open/TrueType fonts Networking (to apply network standards) Unique protocol Server identification (host name, NetBIOS name, machine name) Domain membership Startup, shutdown, logon, logoff scripts Routing and remote access tools Storage (to standardize the way information is presented) Identical physical drives Identical logical disks (including the local tree for software and the local tree for data) Network tree (based on the Distributed File System or DFS) Security (to standardize access control) System owner User profiles and default Group Policies Local (NTFS) and network access rights and permissions Central access control management Group Policy management Antivirus software Intrusion detection and auditing tools Communications (to standardize the way users interact with each other) Email client Browsers (home page, internal corporate favorites, proxy/firewall controls) Communication tools to users (message from management, from IT, etc.) Data collection tools Table 1-1 Potential Content for the Server Kernel P:\010Comp\Tip&Tec\343-x\ch01.vp Monday, March 24, 2003 11:52:35 AM Color profile: Generic CMYK printer profile Composite Default screen Simpo PDF Merge and Split Unregistered Version - http://www.simpopdf.com 26 Windows Server 2003: Best Practices for Enterprise Deployments Tip&Tec / Windows Server 2003: Best Practices for Enterprise Deployments / Ruest & Ruest / 222343-x / Chapter 1 Configuring Server Roles Next, you need to identify server roles or functions. This is done by grouping service types by service affinity. Certain types of services or functions do not belong together, while others naturally tend to fit in the same category. For servers, you will have roles that are defined by the type of software they run, and thus the type of service they deliver. Seven main categories emerge: • Identity Management Servers These servers are the core identity managers for the network. They contain and maintain the entire corporate identity database for all users and user access. For WS03, these would be servers running Active Directory services. This function should not be shared with any other unless it is a core networking function such as name resolution, though in some cases it may be found on a multi-purpose server. • Application Servers These servers provide application services to the user community. Windows Server 2003 examples would be SQL Server, Commerce Server, and so on. These will of course also include your corporate applications. • File and Print Servers These servers focus on the provision of storage and structured document services to the network. As you will see, these functions are greatly expanded in Windows Server 2003 and form the basis of information sharing within this technology. • Dedicated Web Servers These servers focus on the provision of Web services to user communities. In fact, Windows Server 2003 Web Edition is specifically designed to meet these needs. • Collaboration Servers These servers provide the infrastructure for collaboration within the enterprise. Their services can include SharePoint Team Services, Streaming Media Services, and Real Time Communications. • Network Infrastructure Servers These servers provide core networking functions such as IP addressing or name resolution, including support for legacy systems. They also provide routing and remote access services. • Terminal servers These servers provide a central application execution environment to users. Users need only have a minimal infrastructure to access these servers because their entire execution environment resides on the server itself. Sublayer Suggested Contents Common productivity tools (to standardize common tools) Office automation (current version of Office managed through groups and profiles) Generic graphics and image capture tools Appropriate Service Packs Support tools Resource Kit tools Presentation (to standardize the way users interact with the system) Active Desktop components Menus and Quick Launch area and shortcuts Default User profile and presentation Resource Kit tools Table 1-1 Potential Content for the Server Kernel (continued) P:\010Comp\Tip&Tec\343-x\ch01.vp Monday, March 24, 2003 11:52:35 AM Color profile: Generic CMYK printer profile Composite Default screen Simpo PDF Merge and Split Unregistered Version - http://www.simpopdf.com Chapter 1: Planning for Windows Server 2003 27 Tip&Tec / Windows Server 2003: Best Practices for Enterprise Deployments / Ruest & Ruest / 222343-x / Chapter 1 In addition, server placement comes into play. Placement refers to the architectural proximity or position of the server in an end-to-end distributed system. Three positions are possible: • Inside the intranet • In the security perimeter, often referred to as the demilitarized zone (DMZ) though the perimeter often includes more than just the DMZ • Outside the enterprise Finally, you could add a last server category, the Failsafe Server. This type of server is in fact an exact copy of each of the above categories, but is made of dormant servers that wake up whenever there is a failure within the network. The nature of your business and the level of service you need to provide to users and customers will determine if this last category is required in your enterprise network. Each of these elements will have to be taken into consideration during the elaboration of the solution you design with Windows Server 2003. Migration Considerations It is important to identify the migration path you will use to move from your existing network to the WS03 enterprise network. There are several techniques that can be used to migrate from one network operating system to another. Of course, if you’re implementing a new network based on WS03, migration considerations are not your primary concern. Migrating from an existing operating system would be very easy to do if you could do it while everyone is on vacation or during an annual shutdown of operations. Unfortunately, you will most likely be performing migrations during normal business operations. In addition, you’ll have to make the migration process transparent to users and to the business process. Quite a challenge! Migrations, as opposed to new installations, must take a few factors into consideration. First, you have to ensure that you provide, at the very least, exactly the same service levels users are currently experiencing in your network. Of course, your major goal will be to improve the user network experience, but you should ensure that whatever happens, you will not reduce service levels. This is one of the reasons why you must include user representatives in your network design project. They will help keep you focused. After all, the network is there as a service to them. Second, you have to ensure that you provide comprehensive training programs at all levels of your organization. If you’re moving from Windows NT to WS03, you’ll find that the major training task is technical, not user oriented. While users do experience new features such as interface improvements, it is mostly in manageability and reliability that WS03 improvements abound. Technical staff will have to undergo extensive training. They will have to be prepared well before you implement the new network. In addition, you’ll probably want to ensure that the user training program you deliver occurs at the time you migrate. The best migration results occur when user training is synchronized with the migration program. If you’re running Windows 2000, training will be reduced since the main difference for users is the interface. P:\010Comp\Tip&Tec\343-x\ch01.vp Monday, March 24, 2003 11:52:35 AM Color profile: Generic CMYK printer profile Composite Default screen Simpo PDF Merge and Split Unregistered Version - http://www.simpopdf.com 28 Windows Server 2003: Best Practices for Enterprise Deployments Tip&Tec / Windows Server 2003: Best Practices for Enterprise Deployments / Ruest & Ruest / 222343-x / Chapter 1 Third, you’ll want to ensure that all of your applications run properly in WS03. If you’re running Windows NT, you’ll need to test applications thoroughly to ensure that they operate properly under the new operating system. One of the major reasons for this is the new security model in Windows 2000 and WS03. Users are much more restricted in WS03 than they ever were in NT, thus applications that run under NT do not necessarily run under WS03. More on this topic will be covered in Chapter 7. But there are other advantages in using WS03. WS03 offers an application compatibility mode that is the same as the one offered by Windows XP. This is something that wasn’t available in Windows 2000. Applications should run better in WS03 than in Windows 2000, but nevertheless, you will discover that several of your applications will need to be upgraded or otherwise modified to run properly. Rationalization is a great help here because it means less upgrades. Both rationalization and extensive application compatibility testing should be part of your project. Fourth, you’ll want to determine if you upgrade your systems or if you perform clean installations. The decision will depend on a lot of factors, but the most valuable approach is the new installation. New installations simply offer better stability and reliability since they give you the opportunity to clean up your existing systems. Finally, you’ll need to consider how to migrate your directory and authentication services. WS03 includes an improved Active Directory Migration Tool (ADMT). Version 2 of this tool allows for migration of user accounts and passwords from Windows NT and Windows 2000. It is a good tool for domain consolidation and migration. More on this topic will be discussed in Chapter 10. These aren’t the only considerations you’ll have to take into account when migrating, but they are a good starting point. More on this topic will be discussed throughout this book. Upgrade versus Clean Installation As mentioned earlier, there are some impacts to consider when deciding to upgrade or perform a new installation. Most depend on the status of your current network. Table 1-2 outlines the potential upgrade paths for all versions of WS03.  NOTE There is no upgrade path to Windows Server 2003, Web Edition. Though the upgrade is much easier to perform than a clean installation, when you upgrade from Windows NT to WS03, you will lose some functionality. Windows Server 2003 no longer uses the WINNT folder. It has finally moved to a Windows folder. In addition, like Windows 2000, WS03 uses the Documents and Settings folder to store user profiles. If you upgrade from NT, profiles will be maintained in the WINNT/Profiles folder. This has a bearing on the proper application of Group Policy settings. More on this topic will be discussed in appropriate chapters, but the recommendation is strong: If you are migrating from Windows NT to WS03, prepare to perform clean installations. The impact isn’t the same if you upgrade from Windows 2000. WS03 and Windows 2000 share the same code base, so an upgrade is in fact quite possible, but not if you performed an upgrade to Windows 2000 from Windows NT. In the latter case, you will be facing the same problems you would P:\010Comp\Tip&Tec\343-x\ch01.vp Monday, March 24, 2003 11:52:36 AM Color profile: Generic CMYK printer profile Composite Default screen Simpo PDF Merge and Split Unregistered Version - http://www.simpopdf.com Chapter 1: Planning for Windows Server 2003 29 Tip&Tec / Windows Server 2003: Best Practices for Enterprise Deployments / Ruest & Ruest / 222343-x / Chapter 1 if you upgraded directly from NT to WS03. Of course, in this case, you probably already know all the things you can’t do with your Windows 2000 network. Upgrading from a Windows 2000 network that was implemented as a clean install is quite acceptable, even recommended. In fact, this is the easiest upgrade path since WS03 supports an in-place upgrade and the process can be made quite transparent to users. There is no upgrade path from any of the workstation or desktop versions of Windows to WS03. WS03 is a server and network operating system. Windows 9x, Me, 2000 Professional, and both editions of XP are not designed to perform the same type of work that WS03 is. Using the Technological Lab as a Testing Ground The final preparation activity for your WS03 enterprise network project is the preparation and implementation of a technological laboratory. Since application compatibility testing and proofs of concepts are an integral part of the design and preparation process, the technological laboratory is crucial. The laboratory should contain enough technologies to be able to properly reproduce the organization’s existing IT infrastructure. It should include technologies that are as recent as possible. Most often, organizations use recovered equipment that is not the latest and greatest. This only limits the potential benefits of this lab because its purpose is to work with new technologies. New technologies always require more powerful hardware. If you plan to purchase new equipment for From the Following Versions of Windows… …to a Windows Server 2003 Version Windows NT Server version 4.0 with Service Pack 5 or later Note: Any Windows NT version earlier than 4.0 must first be upgraded to Windows NT version 4.0 with Service Pack 5 Standard Edition Enterprise Edition Windows NT Server version 4.0, Terminal Server Edition, with Service Pack 5 or later Note: If you need full Terminal Server functionality, you must upgrade to Windows 2003, Enterprise Edition Standard Edition Enterprise Edition Windows 2000 Server Standard Edition Enterprise Edition Windows NT Server version 4.0, Enterprise Edition, Service Pack 5 or later Windows 2000 Advanced Server Enterprise Edition Windows 2000 Datacenter Server Datacenter Edition Windows 9x, Me, 2000 Professional, XP Home or Professional No upgrade path These are workstation operating systems Upgrades must be performed as clean installs Table 1-2 Upgrade Paths to WS03 P:\010Comp\Tip&Tec\343-x\ch01.vp Monday, March 24, 2003 11:52:36 AM Color profile: Generic CMYK printer profile Composite Default screen Simpo PDF Merge and Split Unregistered Version - http://www.simpopdf.com 30 Windows Server 2003: Best Practices for Enterprise Deployments Tip&Tec / Windows Server 2003: Best Practices for Enterprise Deployments / Ruest & Ruest / 222343-x / Chapter 1 your implementation project, it is a good idea to prepurchase a few systems and use them for laboratory testing. The lab must also include quick setup and recovery strategies. For example, if technicians are working on a case study that requires the staging of an Active Directory and Windows Server 2003 infrastructure, you won’t want them to have to rebuild it from scratch every time they return to the laboratory. One of the best ways to provide this capability is to use interchangeable disk drives. This allows each technical group to prepare and store their own working environment, which saves considerable time. Another method is to use disk-imaging technologies. This requires a powerful storage server because each environment must be stored independently for the duration of the tests. If access to hardware is an issue, you might consider using virtual machines with VMware. All that is required to design a complex network system based on virtual machines is a few very powerful servers. For example, with a single dual processor Pentium server and one gigabyte of RAM, it is possible to design an entire Active Directory distributed forest. It’s not tremendously fast, but for testing purposes, it works extremely well. In addition, the laboratory will require a special station or stations that are disconnected from the laboratory network and connected to the internal network and the Internet. These stations serve for documentation, research, and software downloads. Ideally, these stations are positioned throughout the lab for ready access by technicians. The most important aspect of the lab will be its activity coordination and resource sharing. Most organizations cannot invest as much as they would like in a laboratory, therefore, most must use timesharing strategies to ensure that technical staff have ready access to the resources they need for testing purposes. Good coordination and structured testing methods can only ensure better testing results. Figure 1-6 illustrates a sample testing laboratory. This lab reproduces a typical internal network with a minimum of equipment. Internal TCP/IP addresses can be used since it does not connect to the external world. More servers can be added to test the migration strategy you will devise, but these can be older and more obsolete systems since you will not be doing performance testing with them. Using a Testing Strategy Since creating an enterprise network is 80 percent planning and preparation and 20 percent implementation, the laboratory is one of the key elements of your future network. To ensure that your preparation phase goes well, you should use very strict testing strategies. Most testing strategies include several stages, each focused on a specific type of test. When building and preparing the enterprise network, you should use the following test types: • Discovery The first test is always an interactive discovery of a new technology. This phase lets you identify the elements of the Technical Architecture for the product.  QUICK TIP A sample laboratory datasheet that can be used for the testing portion of the preparation phase for your project can be found at http://www.Reso- Net.com/WindowsServer/. P:\010Comp\Tip&Tec\343-x\ch01.vp Monday, March 24, 2003 11:52:36 AM Color profile: Generic CMYK printer profile Composite Default screen Simpo PDF Merge and Split Unregistered Version - http://www.simpopdf.com Chapter 1: Planning for Windows Server 2003 31 Tip&Tec / Windows Server 2003: Best Practices for Enterprise Deployments / Ruest & Ruest / 222343-x / Chapter 1 • System test Once the first stages of discovery have been performed, you move to automation of an installation process. This test focuses on evaluation of the automated procedure by itself. • Security issue identification Are there any security issues with the product as installed during system tests? If so, they must be taken into consideration. • Functional test Does the product operate as expected? If not, you must go back to the beginning. • Integration test How does the product behave when merged with other products it may have to coexist with? Are there modifications required to the installation? • Acceptance test Does the final client or user approve of the product as designed and installed? If not, you must modify the installation and configuration. • Deployment test Is remote distribution of this product required? If so, a deployment test must be performed to ensure that it behaves as expected during remote installation. • Uninstall test If uninstallation will eventually be required, it should be tested both interactively and remotely. Figure 1-6 A testing lab should be as complete as possible. P:\010Comp\Tip&Tec\343-x\ch01.vp Monday, March 24, 2003 11:52:37 AM Color profile: Generic CMYK printer profile Composite Default screen Simpo PDF Merge and Split Unregistered Version - http://www.simpopdf.com 32 Windows Server 2003: Best Practices for Enterprise Deployments Tip&Tec / Windows Server 2003: Best Practices for Enterprise Deployments / Ruest & Ruest / 222343-x / Chapter 1 • Quality assurance Once all tests have been performed, a final quality assurance test should be performed. Is all documentation correct and complete? Have all testing procedures been followed correctly? These are some of the questions that must be answered during this phase before final release of the product to the enterprise. Each testing phase is important. If, for any reason, your product fails at any testing stage, it must be rolled back to the previous stage and corrections must be applied. This process is illustrated in Figure 1-7. Following strict guidelines and rigorous testing procedures will only make your final product all the better. This is one of the definitions of enterprise-ready networking. Moving On Your preparations are now complete. You’ve starting working on the architectural design of your WS03 enterprise network. You have identified that a lifecycle approach is the best method to use Figure 1-7 The Product Testing Strategy P:\010Comp\Tip&Tec\343-x\ch01.vp Monday, March 24, 2003 11:52:37 AM Color profile: Generic CMYK printer profile Composite Default screen Simpo PDF Merge and Split Unregistered Version - http://www.simpopdf.com Chapter 1: Planning for Windows Server 2003 33 Tip&Tec / Windows Server 2003: Best Practices for Enterprise Deployments / Ruest & Ruest / 222343-x / Chapter 1 to prepare for the migration to WS03. Now you’re ready to move on to the first stage of the implementation, the analysis of the installation methods used for Windows Server 2003. This is what is covered in the next chapter. Best Practice Summary This chapter recommends the following best practices: • Use the Server Lifecycle to prepare and plan for servers in your Enterprise Network Architecture. • Use the Service Lifecycle to prepare and plan for services within your enterprise network. • Use the PASS model to identify both common and specific components for server construction and management. • Use standard operating procedures to document or automate all procedures within your network. This way, you can be sure of the outcome of the operation. • Learn about the product you are about to deploy. Identify differences to existing products and see how they apply to your environment. • Design an Enterprise Network Architecture before you install your new systems. • Use the Architectural Design Process SOP to design your Enterprise Network Architecture. • Write a project vision for yourself so you and your audience can know where you’re going and what you’re doing. • Don’t forget to look at new ways of doing things when moving to a new technology. • Use a clean installation if you are moving from Windows NT to Windows Server 2003 or if you upgraded from Windows NT to Windows 2000. • Prepare and use a technological laboratory throughout the project to perform proofs of concepts and test the solutions you design. • If you need to perform a new inventory for this project, don’t forget to keep it up to date from now on. Chapter Roadmap Use Figure 1-8 to review the contents of this chapter. P:\010Comp\Tip&Tec\343-x\ch01.vp Monday, March 24, 2003 11:52:37 AM Color profile: Generic CMYK printer profile Composite Default screen Simpo PDF Merge and Split Unregistered Version - http://www.simpopdf.com 34 Windows Server 2003: Best Practices for Enterprise Deployments Tip&Tec / Windows Server 2003: Best Practices for Enterprise Deployments / Ruest & Ruest / 222343-x / Chapter 1 Figure 1-8 Chapter Roadmap P:\010Comp\Tip&Tec\343-x\ch01.vp Monday, March 24, 2003 11:52:38 AM Color profile: Generic CMYK printer profile Composite Default screen Simpo PDF Merge and Split Unregistered Version - http://www.simpopdf.com [...]... organization best Identity Servers First In Windows Server 20 03, migrating Identity Servers means working with Active Directory, the same as in Windows 20 00 If you’re already running Windows 20 00, this step should be relatively easy to perform since you can upgrade a Windows 20 00 domain controller and run a “mixed” environment of Windows 20 00 and Windows Server domain controllers Then when all your servers... satisfying results for users Per server can be compared to workgroups in Chapter 2: repari g f r Ma sive Installa ions of - indows Server 20 03 47 Simpo PDF PMerge nandoSplit sUnregistered tVersion W http://www.simpopdf.com that it is a distributed licensing mode Each server has its own licenses that are independent of other servers So for Server A you can have 10 licenses and for Server B you can have... Enterprise Edition Itanium Enterprise Edition x86 Datacenter Edition Itanium Datacenter Edition Minimum CPU speed 133 MHz 133 MHz 133 MHz 733 MHz 400 MHz 733 MHz Recommended CPU speed 550 MHz 550 MHz 733 MHz 733 MHz 733 MHz 733 MHz Minimum RAM 128 MB 128 MB 128 MB 128 MB 5 12 MB 5 12 MB Recommended minimum RAM 25 6 MB 25 6 MB 25 6 MB 25 6 MB 1 GB 1 GB Maximum RAM 2 GB 4 GB 32 GB 64 GB 64 GB 5 12 GB Minimum number... 4 2 W i PDF Mergee and 0 3 : B Unregistered Version r-phttp://www.simpopdf.com Simpo n d o w s S e r v r 2 0 Split e s t P r a c t i c e s f o r E n t e r i s e D e p l o y m e n t s migrate them first and simply get both performance and stability improvements from Windows Server 20 03 If your corporate applications are based on commercial software products that already have “designed for Windows Server. .. File and Print Server, mirror information and data between an existing server and the new server, and then migrate users and PCs to the new server remotely so that you can decommission the old system Microsoft offers information on third-party products for Windows systems at http://www.microsoft.com /windows2 000/partners/serversolutions.asp Next, you’ll want to consider migration approaches for application... tVersion W http://www.simpopdf.com Figure 2- 3 The new Windows Server 20 03 application execution folder structure Commercial applications that are modified to use this new architecture are often also modified to support every aspect of the Microsoft Designed for Windows Server 20 03 Logo program This means that they will provide an integrated installation mechanism based on the Windows Installer service... not operate properly on Windows Server 20 03 unless everyone is given an account with elevated privileges, something no enterprise network would allow If you must run legacy applications on Windows Server 20 03, you will need to unlock the system’s core folders and the registry While this may be acceptable for applications that are intended for users, it is totally unacceptable for applications that are... before you begin installing servers Choosing the Migration Approach First, you need to decide how you want to migrate: will you perform new installations or upgrades? Chapter 1 discussed this issue at length If you are moving from Windows NT to Windows Server 20 03, or if you are moving from a Windows 20 00 network that was upgraded from Windows NT, you should take advantage of this opportunity to perform... Preparing for Massive Installations Anyone who has installed any version of Windows since Windows NT is familiar with the various elements that must be identified before beginning the installation process First, Windows Server 20 03 requires a minimum hardware level The minimum hardware requirements for each version of WS03 are identified in Table 2- 2 Requirements Web Edition Standard Edition x86 Enterprise. .. Collaboration Servers, Network Infrastructure Servers, and Terminal Servers Each of these must take its own migration path to Windows Server 20 03 Because of this, you would only migrate Member Servers first if you had a minimal network infrastructure in place and if you have already begun the migration process for server- based corporate applications If, for example, you have very few existing Member Servers . http://www.simpopdf.com 26 Windows Server 20 03: Best Practices for Enterprise Deployments Tip&Tec / Windows Server 20 03: Best Practices for Enterprise Deployments / Ruest & Ruest / 22 2343-x /. Windows Server 20 03: Best Practices for Enterprise Deployments Tip&Tec / Windows Server 20 03: Best Practices for Enterprise Deployments / Ruest & Ruest / 22 2343-x / Chapter 2 Figure 2- 1. Windows Server 20 03: Best Practices for Enterprise Deployments Tip&Tec / Windows Server 20 03: Best Practices for Enterprise Deployments / Ruest & Ruest / 22 2343-x / Chapter 2 Figure 2- 2