Installing Windows Server 2003

12/2008

Standard or Enterprise Version?

Windows Server 2003 R2 is the currently supported version of Windows Server in the UMROOT forest.
Administrators can install the new Windows Server 2008 and it should work, but it is not yet supported
by ITCS. The Windows Server 2003 R2 two disk set is available from ITCS Licensing. You must purchase a
license for the server and you will receive a product key.

 Standard Edition(Recommended)
For simple small deployments, the Standard Edition 32 bit version is adequate. This edition will
run on up to 4 processors with up to 4GB RAM. The 64 bit version can address 32 GB RAM.
 Enterprise Edition
Enterprise Edition will run on up to 8 processors with up to 32GB and adds clustering. The 64 bit
edition can address 1 TB RAM. 64 bit editions require 64 bit hardware drivers and can be trickier
to install.

Hardware Requirements

 RAM
2GB RAM is adequate for a small to medium deployment
 Processor
Single 2Ghz processor
 Hard Drive
20GB minimum C: drive for the system (40GB strongly recommended. D: and additional drives
should be configured for programs and data. Size limitations are listed below.
 Hard Drive Fault Tolerance
The best use of space and fault tolerance is to configure the server for RAID5, then create a
20GB – 40GB logical drive for the C: drive and use the remaining space for other logical drives.
You can configure this before or after you start to install Windows Server.
 You can add and configure additional physical disk drives and arrays.

Windows Volume Size Limitations and Management

 Although the size limitations for Windows volumes are very large, you may want to consider
smaller volumes taking into account restore time and putting all your information on one drive
that can fail.
 Volumes other than the C: drive can be set up after Windows has been installed using the Disk
Management tool. Control Panel > Computer Management > Storage > Disk Management.
Right click on disk to “Convert to Dynamic Disk”

1
  Maximum size of a basic volume
2 TB
 Maximum size of a dynamic volume
 2 TB for simple and mirrored (RAID-1) volumes.
 Up to 64 TB for spanned and striped (RAID-0) volumes. (2 TB per disk with a maximum
of 32 disks per volume.)
 Up to 62 TB for RAID-5 volumes. (2 TB per disk with a maximum of 32 disks per volume
and 2 TB used for parity.)
http://www.microsoft.com/windowsserversystem/storage/getstorfacts.mspx

Prerequisites

 Obtain the latest drivers for the hardware. Some manufacturers like Dell and HP provide and
install CD that installs the necessary drivers and prompts for the Windows CD. This is the easiest
way to install a server.
 Configure the RAID array or other disks for a 20GB minimum primary partition for the C
drive.(40GB strongly recommended)
 Have the product key from ITCS Licensing handy.
 (Optional) Request an Organizational Unit (OU) within Active Directory to be created for your
organization. This will provide you with an OU Admin user ID and the name of the first server for
your organization.
http://www.umich.edu/~lannos/windows/central-accounts-JoinForestAsOU.html

The following does not cover every screen and prompt that will be presented to you during the
install, it covers the screens and prompts that ask for settings we consider important, or were
determined to be confusing spots we felt needed clarification.

Note: This covers a standard installation from the Windows Server CD and not the recommended
vendor installation, but most of the necessary settings and decisions are the same.

The text-based portion of the Setup program

 Disconnect server from the network

 Boot the server from the first CD. Follow the on screen instructions to press any key to boot
from the CD. (2 CDs are required)
 You can press F6 if you need to install additional SCSI adapters or other mass-storage devices. If
you do you will be asked to supply a floppy disk with the drivers and you CANNOT browse it (or
a CD for that matter). Make sure you have one handy.
 Select or create the partition on which you will install Windows Server 2003. Depending upon
your existing disk configuration choose one of the following:
 If the hard disk is unpartitioned, you can create and size the partition on which you will
install Windows Server 2003. 40GB Recommended.
 If the hard disk already has a partition that is large enough, you can install Windows
Server 2003 on that partition.

2
  If the hard disk has an existing partition, you can delete it to create more unpartitioned
space for the new partition.
 If you select a new partition during Setup, create and size only the partition on which
you will install Windows Server 2003. After installation, use Disk Management to
partition the remaining space on the hard disk.
 Select to format the partition as NTFS (quick)
 Setup will then begin copying necessary files and then the computer will restart in graphical
mode, and the installation will continue.

The GUI-based portion of the Setup program

 Select Next for Current System Locale and Current Keyboard Layout.
 Type your name and organization. Use whatever you want. Department, school or college
name and University of Michigan work well.
 Type the product key you got from ITCS Licensing.
You must purchase a separate license for each server you install, although they
will all use the same product key.
Contact ITCS Licensing here to purchase a license key:
http://www.itd.umich.edu/sw-info/microsoft/microsoft-products.html
 Select “Per Device or Per User” license mode.
 The computer name should start with your assigned department prefix followed by any
suffix. For example, itcs-server1. If this is your first server, it should be the name of the
bootstrap computer you named on the OU Request Form. The computer name is easily
changed later. Limiting the server name to 15 characters allows it to be backwardly
compatible with older systems.
 Enter a password for the local Administrator account and write it down. 15 characters with
a variety of character is recommended. Using the same password on multiple servers is not
recommended. You won’t need to use this very often.
 Set time zone to EST and Daylight Savings.

Network Settings

 If you have a NIC that is not supported and Windows Server 2003 cannot detect it, or if you
don't have a NIC at all, setup will skip this step and you will immediately go to the final
phase of the setup process.
 Select Custom Settings.
 Highlight the TCP/IP selection and press Properties.
 Enter the IP address, subnet mask and default gateway. Servers should always use a static
IP address.
 Enter the following campus DNS server addresses.
141.211.125.17
141.211.144.17
 Select the Advanced button. Enter the following WINS server addresses:
141.211.3.100
141.211.125.100
 Join a workgroup with any name. You will join the domain in another step.
 Setup finishes and boots Windows Server 2003.

3
  Plug into network because the Windows Firewall will be turned on blocking all ports.
 Logon as Administrator with the password you entered above.
 You will be prompted to install Disk 2 of R2. This install is very quick.
 Basic installation is complete

Post Installation Tasks

Initial Configuration and Patching

 Open Internet Explorer and choose Windows Update. Upgrade to Microsoft Update.
Download and install all patches. Reboot.
 Set the screen resolution to something you are comfortable with. Control Panel > Display
 (Optional) Configure server for Remote Desktop. Control Panel > System > Remote. Check
box for Enable Remote Desktop on this computer. (Need to configure firewall for RDP and
client. See below)
 Configure additional logical disks and volumes using the Disk Management tool. Control
Panel > Computer Management > Storage > Disk Management.
 Disable Scalable Networking from the c:\ prompt:
netsh int ip set chimney disabled
 The Windows Firewall is turned on by default with no exceptions. This will block
legitimate and non legitimate traffic to your server and requires further configuration.
Open Control Panel >Windows Firewall. Verify that the firewall is on and that no
exceptions are selected at this time.

Join the domain

 Go to Control Panel > System > Computer Name. Select Change button.
 Make sure the computer name matches your bootstrap computer name or has otherwise
been added to Active Directory in advance.
 Test that you can ping the domain, adsroot.itcs.umich.edu.
 Select Member of domain radio button and enter adsroot.itcs.umich.edu.
 When prompted, enter your OU Admin credentials with the following format:
umroot\dept-ouadmin1
 You should see a Welcome to the domain message and then reboot.

Administrator Configuration

 Change “Log on to” drop down menu to (this computer) and logon as Administrator again
with the password you entered above.
 Start > Administrative Tools > Computer Management.
Select Local Users and Groups
Select Groups
Select Administrators
Select Add…
Enter your OU Admins group, umroot\dept-ouadmins and select Check Names
 Logoff

4
  Change Log on to” drop down menu to UMROOT and logon as your OU Admin account,
umroot\dept-ouadmin1. You will now be logged onto the server as a Local Administrator
and to the domain as your department OU Admin.

Important Security Considerations and Tasks

 Unless you choose a campus only subnet, your server is live on the Internet and targeted
by numerous script kiddies. You must put your “Shield Up”!
 Campus Internet routers are currently configured with a “temporary” block of ports 135-
139, 445 and 161. This provides some minimal protection for the most attacked ports, but
also blocks off campus access to file sharing on your server. See Remote Access section
below.
 Install the latest version of Mcafee Antivirus.
 Configure Automatic Updates to download, but not install updates. Control Panel > System
> Automatic Updates. Since this is a server, you probably want to control when the server
installs patches and reboots.
 Patch Tuesday: Microsoft releases patches on the 2nd Tuesday of every month. Installing
these patches as soon as possible is the single most important task you can do to secure
your server.
 Sign up for the Microsoft Technical Security Bulletin,
http://www.microsoft.com/technet/security/bulletin/notify.mspx
 Consider joining the U-M Virtual Firewall Service. There is currently no charge.
http://www.itcom.itd.umich.edu/firewall/
 Configure the Windows Firewall and the Security Configuration Wizard.

Windows Firewall

The Windows Firewall is turned on by default with no exceptions which will not make a very
good server. On the other hand, some applications and tools open up parts of the firewall for you
which can quickly turn your firewall into something resembling Swiss Cheese. Unless you are using
the U-M Virtual Firewall Service, you must understand and configure the Windows Firewall.

 Firewall is on by Default.
The Windows Firewall blocks all ports with no exceptions turned on.
 Exceptions
Many exceptions are configured on the Exceptions tab, but not enabled. Examples of useful
exceptions are Remote Desktop and File Sharing. Select the Properties button to see details
including port numbers, etc. You can enable an exception by simply checking the exception
box.
 Scope
Warning: Be aware that the default scope of an exception is to open access to the Internet.
Other choices include ”This subnet” or a “Custom List”.
 “This subnet “works well if you only have one subnet and you don’t need users to
access your server from elsewhere on campus or remotely.
 “Custom List” is the most flexible. Multiple subnets and subnets masks can be
added.

5
  A full list of campus subnets is listed here:
http://www.itcom.itd.umich.edu/backbone/umnet/
 U-M Virtual Private Network (VPN).
141.211.4.0/255.255.252.0 or 141.211.4.0/22
See http://www.itcom.itd.umich.edu/vpn/ for up to date details.

Security Configuration Wizard (SCW)

The Security Configuration Wizard is an automated server hardening tool that analyzes the current
configuration and applications running on your server and then secures the following. Turns off
unused services

 Creates firewall exceptions for needed ports (scope is Internet)

 Configures Auditing
 Configures some registry settings for additional security.

Wait to run this tool until after your server is configured with all your applications and
configurations.

 Install SCW using Control Panel > Add Remove Programs > Windows Components
 Run the tool, accepting all the suggestions, but noting them along the way.
 At the Network Ports section, all exceptions will be configured for Internet access. You can
scope down the exceptions here or configure the firewall manually later.
 Save the Security Policy and Apply Now or wait until a later time.
 Reboot

Remote Access

Commonly used network ports are blocked at the campus Internet router and hopefully also
blocked by the Windows Firewall and/or the Campus Virtual Firewall Service. The simplest way to
provide remote access for you and your users is through the U-M Virtual Private Network (VPN).
http://www.itcom.itd.umich.edu/vpn/

Additional Resources

Setting up your Active Directory Environment

http://www.umich.edu/~lannos/windows

Installing Windows 2003 (with screen shots)

http://www.petri.co.il/install_windows_2003.htm

6
7