Guide to hardening Windows 2012r2 server core

Looking for some guides tips on hardening windows 2012 r2 server core

Hi,
Regarding how to secure Windows Server 2012 R2, maybe the following article could help.
Secure Windows Server 2012 R2 and Windows Server 2012
http://technet.microsoft.com/en-us/library/hh831360.aspx
Hope this helps.
Best Regards,
Andy Qi
TechNet Subscriber Support
If you are
TechNet Subscription user and have any feedback on our support quality, please send your feedback
here.
Andy Qi
TechNet Community Support

Similar Messages

Limiting Memory Usage of Exchange 2010sp1 store.exe on a Windows 2012r2 Server?

Hello,
I am running Windows 2012r2 Server with Exchange 2010sp1, 1 forest and 6 mailboxes. So this is not a heavy load for Exchange 2010sp1 to handle. The problem is the Windows 2012r2 server is also used as a file storage server. The problem is the Exchange 2010sp1
is using most of the 16GB of ram available and slowing down the server. Is it possible to limit the Exchange 2010sp1 store.exe to use less memory and if so what are the steps in Windows 2012r2 to complete this task.
I have read that it can be done through ADSI Edit. But the steps they explain are not for Windows 2012r2 and do not match.
Thank You,
Stan

Hi Stan,
Did you change msExchESEparamCacheSizeMax and msExchESEparamCacheSizeMin both attribute of Information Store?
Start ADSIEDIT.msc Navigate to Configuration > Services > Microsoft Exchange > <Organization Name> > Administrative Groups > <Administrative Group> > Servers > <Server Name> > InformationStore
http://eightwone.com/2011/04/06/limiting-exchange-2010-sp1-database-cache/
That ADSIEdit path shouldn't be different on Windows 2012 R2 because it doesn't depend on operating system and it should be always same in Configuration partition of Active Directory.
Besides....
Exchange 2010 SP1 (and SP2) is not supported now so suggest you upgrade to SP3. http://blogs.technet.com/b/rmilne/archive/2013/01/04/end-of-exchange-2010-sp1-support.aspx
Exchange 2010 (with any service pack or update rollups) is not (yet) supported to install on Windows 2012 R2 - http://technet.microsoft.com/library/ff728623(v=exchg.150).aspx

NIC teaming and direct access in windows 2012 server core

Hello All,
I have installed windows 2012 r2 server core and i want to implement direct access with nic teaming enabled.
Has anyone tried this kind of setup? Were they successful in it? Moreover can we configure Direct access when we have NIC teaming configured?
-Ashish

Hi There - NIC teaming in both core and gui is a standard feature and there is no reason (and I have used it successfully) why you cannot do so. As always make sure you look at TCP Offload as per UAG / TMG Days to ensure best performance and also Network
Card Binding Order.
The link for details is here -
http://technet.microsoft.com/en-us/library/hh831648.aspx
Kr
John Davies

Windows 2012R2 Server Image. Setup cannot continue due to a corrupted installation file.

Hello!
When I try to deploy Windows Server 2012R2 64bit on a local machine from my WDS server. I get this error :
"Setup cannot continue due to a corrupted installation file. Contact the vendor of your Windows installation disc or your system administrator for assistance"
This message appear at the last step of the installation. (Finishing Install)
When I burn the image to a DVD I can install it problem free on my Machines. But when I capture said image and try to deploy it, this message appears.
The same message also appears when I try to deploy a Windows 8.1 image.
If I try to install this image with an unattended file. I get an error during "Install features" that there was a problem in "offline Servicing" even tough that field is Empty in my XML file.
The server i'm using has Windows 2012 standard 64bit. And the Image files was downloaded through MSDN.

Glad to hear the issue has been resolved.
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Window 2008 Server Core Domain Controller JRE 6u13 installation fails

Installer used= jre-6u13-windows-x64-p.exe
ERROR
Installer : Wrapper.CreateFile failed with error 3: The system cannot find the path specified.
I tried in safe mode too.
Any ideas?
It does work on a non-domain controller.
Installer used = jre-6u13-windows-i586-p-iftw.exe
ERROR
Windows Installer: Error applying transforms. Verify that the specified transform paths are valid.
I did not check this installer against a non-domain controller.
Installer used = jre-6u13-windows-i586-p-s.exe
INSTALLED SUCCESSFULLY
I did not check this installer against a non-domain controller.
Edited by: shinywindows on Apr 10, 2009 10:34 AM
Edited by: shinywindows on Apr 10, 2009 10:41 AM

I have exact the same issue with JRE 6u14 on Windows 2008. :(
Any idea??

SharePoint 2013 RTM and WIndows Server Core 2012

Hi,
I've got a simple question I couldn't find the answer on the net.
Is SharePoint 2013 officially supported (supported, not just working almost fine) by Microsoft if installed on a Windows 2012 Server Core? Does it depend on the roles of the farm?
If possible I would like to have official sources from Microsoft.
Thanks for helping :)
Cya

First, I guess I should start with a disclaimer. I do work for Microsoft, but I do not speak for the product group and have no authority over what is/is not/will/will be supported with regards to SharePoint 2013.
My assumption however is that we'll treat it the same way we did for SharePoint 2010. It should work just fine and should be supported. The software requirements that Jason points out indicate that SharePoint requires Windows Server
2012 Standard or DataCenter. Choosing to install in core or with a UI doesn't change the fact that you've installed either Standard or DataCenter.
Also, from a support perspective, you can use remote tools in order to perform common tasks, such as checking the event log, restarting services, etc.
Roger Cormier
Microsoft
Premier Field Engineer, SharePoint
Blog: http://blogs.msdn.com/b/rcormier/
Twitter:
LinkedIn:
Note: My posts are provided “AS IS” without warranty of any kind, either expressed or implied, including but not limited to the implied warranties of merchantability and/or fitness for a particular purpose.

Error: 0x800f0922 when trying to install NFS Server Feature on Windows 2012R2

I'm trying to install the "Server for NFS" option under the File and Storage Services role on a Windows 2012R2 server, but I keep receiving an 0x800f0922 error. I've tried the install via the GUI and Powershell. I've also tried using the
DISM utility with different source media for the install, but with the same result.   I ran "SFC /scannow" to check for any missing files/reg keys but it returned no errors. Any thoughts?

Thank you for the help! I did try the suggested steps, but the issue persisted. I was able to resolve the issue by removing software on the server that was using the NFS ports needed for successful installation of the native NFS server.
In our case it was an optional component of our backup software called"Veeam backup vPower NFS".   There is also a known issue with the Qlogic's SanSurfer software using the NFS ports.
There were entries in the System event log that tipped me off:
Event ID: 7000  The Server for NFS Open RPC (ONCRPC) Portmapper service failed to start due to the following error:
A device attached to the system is not functioning.
Event ID: 7001  The Server for NFS Driver service depends on the Server for NFS Open RPC (ONCRPC) Portmapper service which failed to
start because of the following error:

AD FS on 2012 R2 Server Core - management tools

So it seems in 2012 R2, AD FS is now able to be installed in Server Core, I'm assuming because it's no longer part of IIS. However, managing it on Server Core seems "limited" to the use of PowerShell. This is ok but a GUI option from a
client would be nice too. Does anyone know a way to have the MMC snap-in for AD FS on a remote client for management purposes?

Hi,
According to this ms article, i am not find the ad fs is not available on windows server 2012r2 server core:
http://technet.microsoft.com/library/hh831786
Regards.
Vivian Wang
No, you can indeed installed ADFS on 2012 R2 Server Core - I did it. The problem was that the GUI management tools (obviously) aren't available on a pure Server Core install and there doesn't appear to be the ability to use the MMC Add-In from
a client so you're "stuck" using PowerShell to manage it on the ADFS server.
Using PowerShell to manage it isn't a big deal, but as I'm learning about ADFS, I figured a GUI element would be nice to confirm what I've done in PowerShell translated properly to what the various guides give. Arguably, learning on a full GUI server
would have been the better option but, I'm stretched for resources in my Lab environment so this VM needed to consume less resources - which is why I went with Server Core.
Anyway, to get around this, I installed the feature "Graphical Management Tools and Infrastructure." The server is still Server Core, but it now has the ability to run MMC on the server itself, which means I now have the GUI ADFS management
tool on the server itself.
Hopefully for future releases, there will be an ADFS management tool included with the Remote Administration Toolkit

Windows 7 Client 'sees' an old version of windows 2012 server share

Hi All,
I have a problem which seems to be a common theme looking at other threads. Here's the overview of the problem:-
I have multiple windows 7 clients and a windows 8.1 client within a 2008 Server in a domain.
I also have a Windows 2012R2 Server which is not joined to the domain. There is a Share on the 2012R2 which has the Caching Option turned off. Everyone full control on Share & File permissions.
One of the Windows 7 machines in Explorer when it looks at
\\2012server\share sees an old version of the folder. It seems that SMB 2 chaching is working too well. Not even pressing F5 or clicking View, Refresh updates windows explorer.
It took a reboot to get the workstation to see the up to date contents of the share on the 2012 server.
We don't seem to have that behaviour with that client against the 2008 server.
I have seen this behaviour on another machine un-related to us at another location which was in a workgroup with a 2012 server and no domain.
Questions:-
Is there some sort of problem with Windows 7 workstations working against 2012 Servers in a non-domain setting or is it just Windows 7 against 2012 servers period?
I understand that Windows 7 utilises SMB1 & SMB2. SMB2 introduced caching. If the server has turned off the share cache option should the client cache the contents of the share or the information about the files & folders & 'file not found'
information?
I want to open a file handle to a file on a network share so I can read and write data to it. But I also want to know that when I look at the folder to open the file I'm actually looking at the live version of the folder and files in the folder and
not a cached version of the folder. If it's a cached version the file might be there already but I won't see it.
Is there an API call that tells the client to get a fresh view of the server share so I can be absolutely sure that when I look for a file on the server I'm getting the correct answer and not one from cache.
I first posted the question with the same subject "Windows 7 Client 'sees' an old version of windows 2012 server share" in the Windows 7 Networking Fourm
https://social.technet.microsoft.com/Forums/en-US/23bf3627-987b-4c27-8062-85a284a2cda4/windows-7-client-sees-an-old-version-of-windows-2012-server-share?forum=w7itpronetworking and it was suggested I repost in here. Please do take the time to read
the thread which will save time with suggestions that have already been covered.
As the computers that can be affected by this problem are not mine I cannot enforce or guarantee that any of my 'client base' will apply any hotfixes. I will also not have the ability to tweak registry settings as I can't guarantee Admin Access.
It seems that we need to go back to SMB1 as all the tweaks to SMB since those days have introduced problems with the basic requirement of sharing files from a share on a server for Read/Write purposes. I have tried turning a network back to SMB1 and that
has resolved a lot of the issues but then I found a post/MS blog that states not to leave the network on SMB1
The Caching option of the share had already been turned off. Surely Windows clients should not cache any information about the share but I think that is not the case.
Thanks is advance
Robert

Hi Shaon,
Thanks for looking into this.
If this is a known issue, why isn't the hotfix rolled into a general windows update if this is a known problem? However this doesn't just affect domain joined workstations.
Surely it's basic functionality for a networked computer to access files and folders on a network file server. It's what networks were invented for at the end of the day.
I am unable to apply hotfixes to these computers that are having the problem due to the fact they are not mine but my customers.
At one of my customers sites I disabled SMB2 from the server and network clients as well as disabling the network adapter power saving option. This seemed to resolve the issues that I saw on one client that seemed to be 30 minutes behind the rest of
the network. The hotfix you link to states that it is for Domain joined computers. At my customer site the PC's are not in a domain at all, just a workgroup with workstations and a 2012r2 server. Will the hotfix be applicable to non-domain machines?
Also many clients seemed to loose the file handle to an open file on the server. I'll get them to turn SMB2 back on at some point after I send out some updates but all the problems I see seem to be caused by the caching functions in SMB2. SMB1 is good and
stable. It's SMB2 that seems to be causing the problems as it was designed from the ground up for caching.
Has this networking issue been resolved in Windows 8, 8.1 and 10?
As I am unable to apply a hotfix to 1000's of PC's that are not mine, is there an API call or something where I can get the windows client to stop lying and get me the current state of a folder on the server?
Will Turning off ClientSideCaching fix the issue? HKLM\SYSTEM\CurrentControlSet\Services\MrxSmb\Parameters\
CSCEnabled
Or will every machine need to be tuned individually according to the following guide:-
https://social.technet.microsoft.com/Forums/windowsserver/en-US/7bd9978c-69b4-42bf-90cd-fc7541ccb663/forum-faq-troubleshooting-network-file-copy-slowness?forum=winserverPN ?
Robert

Switced from Full GUI installation to minimal server interface or server core and stucked on black screen with no option

hi.
i have a virtual machine running Windows Server 2012 R2 Data Center Edition, using Hyper-V technology, as a lab machine to test and practice core features.
I tried to test the ability of switching to Core (and even the Minimal Server Interface after stuck and revert!)
using Powershell commands as bellow:
Import-Module ServerManager
Uninstall-WindowsFeature Server-Gui-Shell -Restart
and it goes well until windows configured removal features and reboots. but
after that the VM will stuck in a black screen.
Tried to reach RUN TASK window to bring up CMD.EXE or any thing but even the ALT+CTRL+DEL (ALT+CTRL+END in VM) is not working and technically i cant do anything. considering CPU USAGE in hyper-V Manager is changing for the VM, i let the VM
work but after 2 hours i just got enough!
any idea why is this happening?
Thanks for helping and spending time on this.
some info about the situation:
( METHOD : http://blogs.technet.com/b/puneetvig/archive/2012/10/16/switch-between-full-and-core-in-windows-server-2012-using-powershell-3-0.aspx )
HOST Machine:
Windows Server 2012 R2
Edition: Data Center
Activation Status: Fully Activated
VM Machine:
Windows Server 2012 R2
Data Center Edition
first installation option: Full GUI
Running services : NONE
not activated (no need to activate since its just a lab VM)
Hyper-V Machine Generation 2

Hi 888ta8pa,
Did you install some server role or feature on this vm, Server 2012r2 server core support the following applicable roles, please uninstall the unsupported rule and feature
then try again.
Server Core is an installation option that is capable of the following server roles.
•Active Directory (AD)
•Active Directory Lightweight Directory Services (ADLDS)
•DHCP Server
•DNS Server
•File Services
•BITS Server
•BranchCache
•HyperV
•IIS
•Printing Services
•Streaming Media Services
•iSCSI
•Load Balancing
•MPIO
•qWave
•Telnet
•Unix Migration
•Active Directory Certificate Services
The related KB:
Server Core for Windows Server 2012 R2 and Windows Server 2012
http://msdn.microsoft.com/en-us/library/hh846323(v=vs.85).aspx
Hope this helps.
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Sharepoint 2010 on Windows 2012R2 and claims based authentication

Hello,
We have installed a sharepoint 2010 SP2 CU dec 2014 on a Windows 2012R2 server.
The installation went without problems.
However, we want to use claims based authentication on a certain web app pool.
Therefore some configuration on IIS is required.
The first issue we ran into, is the web application pool uses ASP.NET 2.0, which is the default settings.
However, using this ASP.NET Version 2.0 the feature "Providers" and ".net users" are invisible.
When changing the .net version to 4.0, the features comes back again.
I can fill in the connection strings without problem.
The providers feature however, gives me the following errors:
There is a duplicate .... sections defined.
When googling on this error, it seems that on .net 4.0 these sections are already globbally defined in the machine.config, So i removed these entries in the machine.config
These are the lines that are "double"
<section name="scriptResourceHandler" type="System.Web.Configuration.ScriptingScriptResourceHandlerSection, System.Web.Extensions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" requirePermission="false"
allowDefinition="MachineToApplication"/>
<section name="jsonSerialization" type="System.Web.Configuration.ScriptingJsonSerializationSection, System.Web.Extensions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" requirePermission="false" allowDefinition="Everywhere"
/>
<section name="profileService" type="System.Web.Configuration.ScriptingProfileServiceSection, System.Web.Extensions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" requirePermission="false" allowDefinition="MachineToApplication"
/>
<section name="authenticationService" type="System.Web.Configuration.ScriptingAuthenticationServiceSection, System.Web.Extensions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" requirePermission="false"
allowDefinition="MachineToApplication" />
So after removing these lines, i can get into Providers feature in IIS.
but, when i click on "Add..." i get the following error:
Add Provider
There was an error while performing this operation.
Details:
This method cannot be called during the application's pre-start initialization phase.
OK
I spent to much time already to solve this issue and i hope that someone can give me some advice to address this issue.

The STS web.config:<?xml version="1.0" encoding="utf-8"?>
<configuration>
<system.serviceModel>

<behaviors>
<serviceBehaviors>
<behavior name="SecurityTokenServiceBehavior">

<serviceMetadata httpGetEnabled="true" />

<serviceThrottling maxConcurrentCalls="65536" maxConcurrentSessions="65536" maxConcurrentInstances="65536" />
</behavior>
</serviceBehaviors>
</behaviors>

<services>
<service name="Microsoft.IdentityModel.Protocols.WSTrust.WSTrustServiceContract" behaviorConfiguration="SecurityTokenServiceBehavior">

<endpoint address="" binding="customBinding" bindingConfiguration="spStsBinding" contract="Microsoft.IdentityModel.Protocols.WSTrust.IWSTrust13SyncContract" />

<endpoint name="ActAs" address="actas" binding="customBinding" bindingConfiguration="spStsActAsBinding" contract="Microsoft.IdentityModel.Protocols.WSTrust.IWSTrust13SyncContract" />

<endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange" />
</service>
<service name="Microsoft.SharePoint.Administration.Claims.SPWindowsTokenCacheService">
<endpoint address="" binding="customBinding" bindingConfiguration="SPWindowsTokenCacheServiceHttpsBinding" contract="Microsoft.SharePoint.Administration.Claims.ISPWindowsTokenCacheServiceContract" />
</service>
</services>

<bindings>
<customBinding>
<binding name="spStsBinding">
<binaryMessageEncoding>
<readerQuotas maxStringContentLength="1048576" maxArrayLength="2097152" />
</binaryMessageEncoding>
<httpTransport maxReceivedMessageSize="2162688" authenticationScheme="Negotiate" useDefaultWebProxy="false" />
</binding>
<binding name="spStsActAsBinding">
<security authenticationMode="SspiNegotiatedOverTransport" allowInsecureTransport="true" defaultAlgorithmSuite="Basic256Sha256" messageSecurityVersion="WSSecurity11WSTrust13WSSecureConversation13WSSecurityPolicy12" />
<binaryMessageEncoding>
<readerQuotas maxStringContentLength="1048576" maxArrayLength="2097152" />
</binaryMessageEncoding>
<httpTransport maxReceivedMessageSize="2162688" authenticationScheme="Negotiate" useDefaultWebProxy="false" />
</binding>
<binding name="SPWindowsTokenCacheServiceHttpsBinding">
<security authenticationMode="IssuedTokenOverTransport" />
<textMessageEncoding>
<readerQuotas maxStringContentLength="1048576" maxArrayLength="2097152" />
</textMessageEncoding>
<httpsTransport maxReceivedMessageSize="2162688" authenticationScheme="Anonymous" useDefaultWebProxy="false" />
</binding>
</customBinding>
</bindings>
</system.serviceModel>
<system.webServer>
<security>
<authentication>
<anonymousAuthentication enabled="true" />
<windowsAuthentication enabled="true">
<providers>
<clear />
<add value="Negotiate" />
<add value="NTLM" />
</providers>
</windowsAuthentication>
</authentication>
</security>
<modules>
<add name="WindowsAuthenticationModule" />
</modules>
</system.webServer>
<system.net>
<connectionManagement>
<add address="*" maxconnection="10000" />
</connectionManagement>
</system.net>
<connectionStrings>
<add connectionString="Server=sqldb_qa_sharepoint2010;Database=SG_SHP_Claims_Authentication;Integrated Security=true" name="SHP_Claims_Authentication" />
</connectionStrings>
</configuration>
I have backupped the machine.config and restored it (the file i edited was in the following dir: C:\Windows\Microsoft.NET\Framework\v4.0.30319\Machine.config)

Windows 2012R2 does not boot automatically after BSOD

I have a Windows 2012R2 server with some critical applications.
Sometimes one of that applications causes BSOD. It doesn't matter why - I need the server to reboot and continue running without manual intervention. Instead of it server restarts and then stays on "Choose an option" screen (with Continue/Use
a device/Troubleshoot/Turn off your PC options).
After that I need to go to server room and press Continue manually. It is not an option for me because it can happen during the night and server will not be operational until the morning. Is there the way to skip that screen automatically?

Hi,
Thank you for posting your issue in the forum.
I am trying to involve someone familiar with this topic to further look at this issue. There might be some time delay. Appreciate your patience.
Thank you for your understanding and support.
Best Regards,
Justin Gu

Failing to install Domain Services on a Windows 2012R2 without internet connection

Hello
i have a windows 2012r2 server without internet connection.
when i try to add the Domain Services role it failed in the Feature installation phase
i even tried to provide an alternate location from a ISO source but that didn't help either
im lost here what should i do?
i attached the fail screenshot
Thanks
Guy

What error is shown in Event Viewer when the install fails?
Is it the first 2012 R2 DC in a lower level domain?
Try installing ADDS via PowerShell:
Import-Module ServerManager
Install-windowsfeature -name AD-Domain-Services –IncludeManagementTools
The other thing that it could be is an issue with the WID (Windows Internal Database)
Check in the Event Viewer for anything to do with Service: MSSQL$MICROSOFT##WID and perhaps try this:
Adjust your domain (or domain controller if appropriate) security policy to allow “NT SERVICE\MSSQL$MICROSOFT##WID” to log on as a service, a GPO setting that can be found under Computer Configuration > Policies > Windows Settings > Security Settings
> Local Policies > User Rights Assignment.
Kind Regards
Michael Coutanche
Blog:
Twitter: LinkedIn:
Note: Posts are provided “AS IS” without warranty of any kind, either expressed or implied, including but not limited to the implied warranties of merchantability and/or fitness for a particular purpose.

Install Guide - SQL Server 2014, Failover Cluster, Windows 2012 R2 Server Core

I am looking for anyone who has a guide with notes about an installation of a two node, multi subnet failover cluster for SQL Server 2014 on Server Core edition

Hi KamarasJaranger,
According to your description, you want configure a SQL Server 2014 Multi-Subnet failover Cluster on Windows Server 2012 R2. Below are the whole steps for the configuration. For the detailed steps about the configuration, please download
and refer to the
PDF file.
1.Add Required Windows Features (.NET Framework 3.5 Features, Failover Clustering and Multipath I/O).
2.Discover target portals.
3.Connect targets and configuring Multipathing.
4.Initialize and format the Disks.
5.Verify the Storage Replication Process.
6.Run the Failover Cluster Validation Wizard.
7.Create the Windows Server 2012 R2 Multi-Subnet Cluster.
8.Tune Cluster Heartbeat Settings.
9.Install SQL Server 2014 on a Multi-Subnet Failover Cluster.
10.Add a Node on a SQL Server 2014 Multi-Subnet Cluster.
11.Tune the SQL Server 2014 Failover Clustered Instance DNS Settings.
12.Test application connectivity.
Regards,
Michelle Li

How to manage Workgroup Windows 2012r2 core Server Firewall

How to manage Workgroup Windows 2012r2 core Server Firewall?
Ideas?
I have tried most things I can, and it always returns error connecting

Hi,
Any update?
Just checking in to see if the suggestions were helpful. Please let us know if you would like further assistance.
Best Regards,
Andy Qi
TechNet Subscriber Support
If you are
TechNet Subscription user and have any feedback on our support quality, please send your feedback
here.
Andy Qi
TechNet Community Support

Guide to hardening Windows 2012r2 server core

Similar Messages

Maybe you are looking for