Training Guide Administering Windows Server 2012 R2 (2014)

---

Lesson summary

Install WSUS in autonomous mode if you want to have an administrator manage updates for computers that report to the WSUS server. Install WSUS in replica mode if you want to have other WSUS servers inherit another WSUS server’s configuration.

Create computer groups using the WSUS console and then use Group Policy to assign computers to these groups.

Create automatic deployment rules to automatically approve updates to WSUS clients. Use automatic deployment rules for computers only where you will not be testing updates prior to deploying them.

Use the WSUS Administrators local group to grant users the ability to manage WSUS update deployments.

Use Windows Intune to manage update deployment to computers that are outside of the perimeter network.

Use System Center 2012 Configuration Manager to deploy updates to third-party products.

Lesson review

Answer the following questions to test your knowledge of the information in this lesson. You can find the answers to these questions and explanations of why each answer choice is correct or incorrect in the “Answers” section at the end of this chapter.

1. You are in the process of configuring WSUS 4.0 to manage software updates for computers in your organization. You have created a WSUS computer group named Sydney-Servers. You want all servers that have computer accounts in the Sydney-Servers OU to be automatically added to this computer group. Which of the following group policies would you configure to assign the servers in the Sydney-Servers OU to the Sydney-Servers WSUS computer group? (Choose all that apply.)

A. Configure Automatic Updates

B. Enable Client-Side Targeting

C. Delay Restart For Scheduled Installations

D. Specify An Intranet Microsoft Update Service Location

2. Your organization has a single WSUS server named SYDNEY-WSUS. You want to ensure that all software updates marked as Security and Critical for Windows Server 2012 R2 are automatically deployed to a group of computers in the Sydney office that are part of the development environment. The deployment of these updates should not require explicit administrator approval. (Choose three. Each answer forms part of a complete solution.)

A. Create a local security group on SYDNEY-WSUS named UpdateTest.

B. Create a WSUS group on SYDNEY-WSUS named UpdateTest.

C. Add all computers that are part of the development environment to UpdateTest.

D. Create an automatic approval rule for Critical and Security updates for the UpdateTest group.

3. You are in the process of configuring WSUS servers in the Melbourne and Perth branch offices. You have already configured a WSUS server in the Sydney head office. You want to have a consistent set of update approvals across the organization, but have each branch office server retrieve updates from the Microsoft Update servers on the Internet. Clients in each branch office should retrieve updates from their local WSUS server. Which of the following settings should you configure? (Choose all that apply.)

A. Configure the Sydney server as a replica of the Melbourne and Perth servers.

B. Configure the Melbourne and Perth servers to store update files locally. Enable the Download files from Microsoft Update; do not download from upstream server option.

C. Configure the Melbourne and Perth servers to not store update files locally.

D. Configure the Melbourne and Perth servers as replicas of the Sydney WSUS server.

Practice exercises

The goal of this section is to provide you with hands-on practice with the following:

Configuring Windows images

Configuring Windows Deployment Services

Deploying and configuring WSUS

To perform the exercises in this section, you need access to an evaluation version of Windows Server 2012 R2. You should also have access to virtual machines SYD-DC, MEL-DC, and CBR-DC, the setup instructions for which are described in the Introduction. You should ensure that you have a checkpoint of these virtual machines that you can revert to at the end of the practice exercises.

Exercise 1: Prepare update files

In this exercise, you download a software update from the Internet. To complete this exercise, perform the following steps:

1. In Hyper-V Manager, right-click SYD-DC, and click Settings.

2. In the Settings For SYD-DC dialog box, shown in Figure 1-23, click Add Hardware, click Network Adapter, and click Add.

FIGURE 1-23 Add network adapter

3. In the Settings For DC dialog box, select the new network adapter.

4. On the Virtual Switch drop-down menu, click the arrow, and select a virtual switch that is connected to an external network adapter.

5. Ensure that you have connected the Windows Server 2012 R2 evaluation edition ISO to the DVD drive connected to IDE Controller 1.

6. Click OK to close the Settings for the SYD-DC dialog box.

7. On Hyper-V Manager, right-click SYD-DC, and click Start.

8. Sign on as Contoso\Don_Funk with the password Pa$$w0rd.

9. On the Server Manager console, click the Local Server node.

10. Click the text next to IE Enhanced Security Configuration.

11. In the Internet Explorer Enhanced Security Configuration dialog box, shown in Figure 1-24, ensure that the Administrators setting is configured to Off, and then click OK.

FIGURE 1-24 Configuring Internet Explorer Enhanced Security Configuration (IE ESC)

12. Click File Explorer on the taskbar.

13. Double-click Local Disk (C:).

14. On the title bar of the Local Disk (C:) window, click the New Folder icon.

15. Name the folder Updates.

16. Repeat step 13 and 14 twice. Name the new folders Images and Mount.

17. Copy the file D:\Sources\Install.wim to C:\images.

18. Open Internet Explorer from the Start screen.

19. On the Internet Explorer dialog box, click Ask Me Later.

20. In the address bar, type http://catalog.update.microsoft.com

21. When prompted, install the Microsoft Update Catalog add-in. You will need to click Yes on a User Account Control dialog box, to click Install to install the update, and to click Run Control to run the add-in.

22. In the Search box, type KB2893294, and click Search.

23. Click Add next to Security Update For Windows Server 2012 R2 (KB2893294). Ensure that you have selected the update for Windows Server 2012 R2 and not the preview.

24. Click View Basket. On the Updates In Your Basket page, shown in Figure 1-25, click Download.

FIGURE 1-25 Microsoft Update Catalog

25. On the Download Options page, navigate to C:\Updates, click OK, and click Continue. When the update completes downloading, click Close.

Exercise 2: Servicing a WIM image

In this exercise, you service a Windows Server 2012 R2 installation image, injecting an update and deploying payload files. To complete this exercise, perform the following steps:

1. On SYD-DC, open an elevated command prompt by right clicking on the Start item and clicking Command Prompt (Admin). Click Yes when prompted on the User Account Control dialog box.

2. Execute the following command to identify the index number of the Standard Server installation.

Dism.exe /get-wiminfo /wimfile:c:\images\install.wim

3. Execute the following command to mount the Standard Edition server image located in Install.wim using the C:\Mount folder.

Dism.exe /mount-image /imagefile:c:\images\install.wim /index:2 /mountdir:c:\mount

4. Execute the following command to apply the software update you downloaded from the Microsoft Update Catalog webpage.

Dism.exe /image:c:\mount /Add-Package /PackagePath:"c:\updates\Security Update for
Windows Server 2012 R2 (KB2893294)"

5. Execute the following command to enable the .NET Framework 3.5 features using the mounted installation media as the source location.

Dism.exe /image:c:\mount /Enable-Feature /all /FeatureName:NetFx3 /Source:d:\
sources\sxs

6. Execute the following command to dismount and commit the modified image.

Dism.exe /Unmount-Wim /MountDir:c:\mount /commit

7. Keep SYD-DC running because you will use it in Exercise 2 and Exercise 3. Do not revert the virtual machine until you complete all practice exercises.

Exercise 3: Deploy Windows Deployment Services

In this exercise, you deploy WDS. To complete this exercise, perform the following steps:

1. Sign on to server MEL-DC as Administrator with the password Pa$$w0rd.

2. Open the Windows PowerShell prompt, and type the following command to join the contoso.com domain.

Add-Computer -DomainName contoso.com

3. In the Windows PowerShell Credentials dialog box, shown in Figure 1-26, type don_funk@contoso.com and Pa$$w0rd, and click OK.

FIGURE 1-26 PowerShell credentials

4. Type the following command into the Windows PowerShell prompt to restart the computer.

Restart-Computer

5. Sign on to server MEL-DC as Contoso\don_funk with the password Pa$$w0rd.

6. Connect the Windows Server 2012 R2 installation media to the emulated DVD drive of MEL-DC.

7. On the Server Manager console, launch the Add Roles And Features Wizard from the Manage menu.

8. On the Before You Begin page of the Add Roles And Features Wizard, click Next.

9. On the Select Installation Type page, click Role-based or Feature-based installation, and click Next.

10. On the Select Destination Server page, click MEL-DC.contoso.com, and click Next.

11. On the Select Server Roles page, click DHCP Server. When prompted to add additional features, click Add Features.

12. On the Select Server Roles page, click Windows Deployment Services. When prompted, click Add Features. Verify that the Add Roles And Features Wizard appears similar to Figure 1-27, and click Next.

FIGURE 1-27 Adding roles and features

13. On the Features page, click Next.

14. On the DHCP Server page, click Next.

15. On the WDS page, click Next.

16. On the Select Role Services page, verify that Deployment Server and Transport Server are selected, as shown in Figure 1-28, and click Next.

FIGURE 1-28 Adding the WDS Role Services

17. On the Confirmation page, click Install.

18. When the installation completes, click Close to close the Add Roles And Features Wizard. Refresh Server Manager Console.

19. On the Tools menu, click DHCP.

20. On the DHCP console, click Mel-dc.contoso.com.

21. On the Action menu, click Authorize.

22. On the DHCP console, click IPv4. On the Action menu, click New Scope. This will start the New Scope Wizard. Click Next.

23. On the Scope Name page, type the name WDS Scope, and click Next.

24. On the IP Address Range page, shown in Figure 1-29, enter the following settings and click Next:

Start IP Address: 10.10.10.100

End IP address: 10.10.10.200

Length: 24

Subnet Mask: 255.255.255.0

FIGURE 1-29 Creating a DHCP scope

25. On the Add Exclusions And Delay page, click Next.

26. On the Lease Duration page, click Next.

27. On the Configure DHCP Options page, click Yes, I Want To Configure These Options Now, and click Next.

28. On the Router (Default Gateway) page, click Next.

29. On the Domain Name And DNS Servers page, verify that 10.10.10.10 is present, as shown in Figure 1-30, and then click Next.

FIGURE 1-30 Configuring DHCP options

30. On the WINS Servers page, click Next.

31. On the Activate Scope page, click Yes, I Want To Activate This Scope Now, and click Next.

32. On the Completing The New Scope Wizard page, click Finish.

33. Close the DHCP console.

Exercise 4: Configure Windows Deployment Services

In this exercise, you configure WDS and import installation and boot images. To complete this exercise, perform the following steps:

1. Open the Windows Deployment Services console from the Tools menu in Server Manager.

2. Expand Servers. Click MEL-DC.contoso.com. On the Action menu, click Configure Server. This will launch the Windows Deployment Services Configuration Wizard. Click Next.

3. On the Install Options page, shown in Figure 1-31, click Integrated With Active Directory, and then click Next.

FIGURE 1-31 Configuring WDS

4. On the Remote Installation Folder Location page, verify that C:\RemoteInstall is selected, and click Next.

5. In the System Volume Warning dialog box, click Yes.

6. In the Proxy DHCP Server dialog box, shown in Figure 1-32, verify that Do Not Listen On DHCP And DHCPv6 Ports, and Configure DHCP Options For Proxy DHCP are selected; then click Next.

FIGURE 1-32 Configuring Proxy DHCP Server

7. In the PXE Server Initial Settings dialog box, click Respond To All Client Computers (Known And Unknown) and Require Administrator Approval For Unknown Computers as shown in Figure 1-33, and click Next. Click Finish to complete the Windows Deployment Services Configuration Wizard.

FIGURE 1-33 Configuring PXE Server Initial Settings

8. On the Windows Deployment Services console, click MEL-DC.contoso.com. On the Action menu, click All Tasks, and click Start.

9. In the Server dialog box, click OK.

10. Click Install Images. On the Action menu, click Add Install Image.

11. On the Image Group page of the Add Image Wizard, type the name Contoso-2K12R2 next to Create An Image Group; then click Next.

12. On the Image File page, type the location \\syd-dc\c$\images\install.wim, as shown in Figure 1-34, and click Next.

FIGURE 1-34 Adding image

13. In the Available Images dialog box, ensure that all four images are selected, and click Next.

14. On the Summary page, click Next. When the images are imported, click Finish.

15. On the Windows Deployment Services console, click Boot Images. On the Action menu, click Add Boot Image.

16. In the Image File location dialog box, shown in Figure 1-35, type d:\sources\boot.wim and click Next.

FIGURE 1-35 Adding boot image

17. On the Image Metadata page, accept the default image name and description, and click Next.

18. On the Summary page, click Next. Click Finish to close the Add Image Wizard.

19. Click Multicast Transmissions. On the Action menu, click Create Multicast Transmission.

20. On the Transmission Name page of the Create Multicast Transmission Wizard dialog box, type Contoso Server Deployment and click Next.

21. On the Image Selection page, shown in Figure 1-36, select Contoso-2K12R2, and click Next.

FIGURE 1-36 Creating a multicast transmission

22. On the Multicast Type page, click Auto-Cast, and click Next.

23. On the Operation Complete page, click Finish.

Exercise 5: Import driver package

In this exercise, you import a driver package into WDS. To complete this exercise, perform the following steps:

1. On the WDS console, right-click on the Drivers node, and click Add Driver Package.

2. On the Driver Package Location page of the Add Driver Package Wizard, click Select All Driver Packages From A Folder, and enter the address c:\windows\system32\driverstore as shown in Figure 1-37, and click Next.

FIGURE 1-37 Import driver packages

3. On the Available Driver Packages, ensure that all packages are selected as shown in Figure 1-38, and click Next.

FIGURE 1-38 List of available driver packages

4. On the Summary page, click Next.

5. On the Task Progress page, click Next.

6. On the Failed Package page, click Next.

7. On the Driver Groups page, click Create A New Driver Group Named, and type 2K12R2-VM as shown in Figure 1-39, and then click Next.

FIGURE 1-39 List of available driver packages

8. On the Task Complete dialog box, clear the check next to Modify The Filters For This Group Now, and click Finish.

Exercise 6: Deploy WSUS

In this exercise, you deploy the WSUS server role on ADL-DC. To complete this exercise, perform the following steps:

1. Sign on to server ADL-DC as Administrator with the password Pa$$w0rd.

2. Open the Windows PowerShell prompt and type the following command to join the contoso.com domain.

Add-Computer -DomainName contoso.com

3. In the Windows PowerShell Credentials dialog box, shown in Figure 1-40, type don_funk@contoso.com and Pa$$w0rd, and click OK.

FIGURE 1-40 PowerShell credentials

4. Type the following command into the Windows PowerShell prompt to shut down the computer.

Stop-Computer

5. In Hyper-V Manager, right-click ADL-DC, and click Settings.

6. In the Settings For ADL-DC dialog box, click Network Adapter, and click Add.

7. In the Settings For ADL-DC dialog box, select the new network adapter.

8. On the Virtual Switch: drop down menu, click the arrow and select a virtual switch that is connected to an external network adapter.

9. Click OK to close the Settings For ADL-DC dialog box.

10. Start ADL-DC.

11. Sign on to server ADL-DC with the Contoso\don_funk account.

12. Click File Explorer on the taskbar and then double-click Local Disk (C:).

13. Click the New Folder item on the title bar. Name the new folder Updates.

14. On the Manage menu of the Server Manager console, click Add Roles And Features.

15. On the Before You Begin page of the Add Roles And Features Wizard, click Next.

16. On the Select Installation Type page, click Role-based or Feature-based Installation, and click Next.

17. On the Select Destination Server page, click ADL-DC.contoso.com, and click Next.

18. On the Select Server Roles page, click Windows Server Update Services.

19. In the Add Roles And Features Wizard pop-up dialog box, click Add Features. Click Next.

20. On the Features page, click Next two times.

21. On the Select Role Services page, shown in Figure 1-41, select both WID Database and WSUS Services, and click Next.

FIGURE 1-41 Adding WSUS roles

22. On the Content Location Selection page, type the address c:\updates, and click Next.

23. On the Web Server Role (IIS) page, click Next twice.

24. On the Confirm Installation Selections page, click Install.

25. When the installation completes, close the Add Roles And Features Wizard.

Exercise 7: Configure WSUS

In this exercise, you configure the WSUS server role on ADL-DC. To complete this exercise, perform the following steps:

1. From the Tools menu on the Server Manager console, open the Windows Server Update Services console.

2. In the Complete WSUS Installation dialog box, shown in Figure 1-41, click Run. After the post–installation configuration completes, click Close.

FIGURE 1-42 Complete WSUS Installation dialog box

3. On the Before You Begin page of the Windows Server Update Services Configuration Wizard, click Next.

4. On the Microsoft Update Improvement Program page, click Next.

5. On the Choose Upstream Server page, click Synchronize From Microsoft Update, as shown in Figure 1-43, and click Next.

FIGURE 1-43 Choosing the upstream server

6. On the Specify Proxy Server page, click Next.

7. On the Connect To Upstream Server page, click Start Connecting. This operation may take several minutes to complete. When the operation completes, click Next.

8. On the Choose Languages page, click Next.

9. On the Choose Product page, shown in Figure 1-44, select Windows Server 2012 R2, and click Next.

FIGURE 1-44 Choosing products

10. On the Choose Classifications page, click All Classifications, and click Next.

11. On the Set Sync Schedule page, click Synchronize Manually, and click Next.

12. On the Finished page, click Finish.

Exercise 8: WSUS groups and rules

In this exercise, you configure WSUS groups and rules on ADL-DC. To complete this exercise, perform the following steps:

1. From the Tools menu on the Server Manager console, open Windows Server Update Services.

2. On the Update Services console, expand ADL-DC\Computers, and click All Computers.

3. In the Actions pane, click Add Computer Group.

4. In the Add Computer Group dialog box, shown in Figure 1-45, type Sydney Servers, and click Add.

FIGURE 1-45 Add Computer Group dialog box

5. Repeat steps 3 and 4 to add the Brisbane Servers computer group.

6. Click Options, and then click Automatic Approvals.

7. In the Automatic Approvals dialog box, click New Rule.

8. In the Add Rule dialog box, shown in Figure 1-46, select the following options and then click OK:

When An Update Is In A Specific Classification: Critical Updates

When An Update Is In A Specific Product: Windows Server 2012 R2

Approve The Update For: Sydney Servers

Name: Sydney Servers Critical Updates

FIGURE 1-46 Adding an approval rule

Suggested practice exercises

The following additional practice exercises are designed to give you more opportunities to practice what you’ve learned and to help you successfully master the lessons presented in this chapter.

Exercise 1 Use the Microsoft Update Catalog and the Dism.exe command-line utility to locate Windows Server 2012 R2 device drivers and add them to the Datacenter Edition image of Windows Server 2012.

Exercise 2 Use WDS to perform a PXE deployment of Windows Server 2012 R2 to a virtual machine that does not have an operating system installed.

Exercise 3 Create WSUS groups for development Exchange and SQL Servers. Configure automatic deployment rules to automatically approve critical updates for Exchange and SQL Server for the Exchange and SQL groups, respectively.