Windows 2012 server security checklist for corporate company standard/recommended check-list

Hello All,
Good Day.
I am looking for Windows 2012 server security checklist (standard hardening
settings), would you kindly assist me by providing Wintel 2012 standard/recommended check-list ASAP?
Thanks in advance.

Hi,
The Microsoft Security Compliance Manager 3.0 tool is designed to provide you with an end-to-end solution to help you plan, deploy, and monitor security baselines for computers running Windows Server 2012 in your environment.
For more detailed information, please refer to the articles below:
Windows Server 2012 Security Baseline
http://technet.microsoft.com/en-us/library/jj898542.aspx
Security Hardening Tips and Recommendations
http://social.technet.microsoft.com/wiki/contents/articles/18931.security-hardening-tips-and-recommendations.aspx
Regards,
Mandy
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Similar Messages

Maximum LUN size for Windows 2012 server

Dear All
What is the Maximum size of the LUN that can be provided to windows 2012 server. Earlier it was 2 TB for windows 2008 server has the policy changed or it is still
the same.
Regards
Zubair

Hi,
Would you please let me know if your OS version is Windows Server 2012 or Windows Server 2012 Essentials? If it’s Windows Server 2012, you’d better ask the question in the File Services and
Storage forum. We will get a better assistance there.
File Services and Storage
http://social.technet.microsoft.com/Forums/en-US/winserverfiles/threads
Best Regards,
Andy Qi
Andy Qi
TechNet Community Support

New Platform Support for ColdFusion 10 and ColdFusion Builder 2.0.1: Windows 8 and Windows 2012 Serv

Microsoft Windows 8 and Microsoft Windows 2012 server are now supported platforms for ColdFusion 10. The new Windows installers are available for download to all retail and licensing customers as well on the trials download page.
The ColdFusion Builder 2.0.1 installers have also been updated to support Windows 8. The existing MAC OS X installer for ColdFusion Builder 2.0.1 has also been certified to now support MAC OS X 10.8.
Refer this technote for more details about the support.

@Adam @CarlV
>what's the version number when you dump the server scope?
ColdFusion Server - Evaluation 10,0,8,284032
OK I see, the I button reports differently to Settings Summary.
About ColdFusion »
System Information
Server Details
Server Product ColdFusion
Version 10,0,8,284032
Tomcat Version 7.0.23.0
Edition Enterprise (Trial)
Serial Number
Operating System Windows Server 2012
OS Version 6.2
Update Level /D:/ColdFusion10/cfusion/lib/updates/chf10000008.jar
Server Settings > Settings Summary
System Information
Server Details
Server Product ColdFusion
Version ColdFusion 10,284032
Edition Enterprise (Trial)
Operating System Windows Server 2012
OS Version 6.2
Update Level /D:/ColdFusion10/cfusion/lib/updates/chf10000008.jar
Adobe Driver Version 4.1 (Build 0001)
Regards Carl M.

Microsoft security compliance manager 3.0 in windows 2012 server

Hi All,
I am completely new in SCM. I have assigned to verify and check why SCM is required for environment, what and how SCM works. I have downloaded SCM from
https://www.microsoft.com/en-us/download/details.aspx?id=16776.
After download i am able to install it in 2008 std x64 bit but my target is to install it in 2012 server x64 bit. I am not able to install it.
It's showing do not have feature of .Net Framework 3.5 and installation is getting closed suddenly. I tried to download .Net Framework3.5 but not able to install it as showing not supported or showing alternet path. I am not holding any CD/DVD of Windows
2012 server. Only ISO.
Please help me.
Thanking you in advance!
Abhijit

Hi,
Thanks for your post.
SCM Baselines for Windows 8.1, IE 11 and Server 2012 R2 are now live!
http://blogs.technet.com/b/secguide/archive/2014/09/04/scm-baselines-for-windows-8-1-ie-11-and-server-2012-r2-are-now-live.aspx
For more SCM related issue, i think you may ask in:
https://social.technet.microsoft.com/Forums/en-US/home?forum=compliancemanagement
Regards.
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

Windows Assessment and Deployment Kit (ADK) for Windows 2012 Server

Hi
I need to download Windows ADK for Windows 2012 Server. The link mentioned on microsoft website "http://www.microsoft.com/en-in/download/details.aspx?id=30718" is not reachable. Can anyone please tell me, from where I can download Windows ADK for
2012 Server.
Thanks
Manik Bansal

Hi Johan, Hi Manik,
Your reply with the link for the Windows Assessment and Deployment Kit (ADK) for Windows® 8 at http://www.microsoft.com/en-us/download/details.aspx?id=30652 has been very much appreciated.
I have also found a new and updated link to the *NEW* Windows Assessment and Deployment Kit (Windows ADK) for Windows 8.1 at http://www.microsoft.com/en-us/download/details.aspx?id=39982 that was released and published on 2013-Oct-17.
Please note that this ADK can be used with Windows Server 2012, but there are some important differences between the Windows 8 ADK and the Windows Server 2012 ADK. The TechNet summary of the ADK may be explored at the link http://technet.microsoft.com/en-us/library/jj200116.aspx
The details of the ADK for Windows 8 may be explored at the link http://go.microsoft.com/fwlink/?LinkId=248647
Thank you,
Michael C.

Windows 2012 Server Essential

Purchased 2 Lenovo Thinkserver with Windows 2012 Server Essentials.
Both will run as a file server in 2 different physical location. Also 1 server will be running IIS for the main company website with eCommerce application. (ABC.COM)
- Can we setup DNS to reference 1 server as LOC1.ABC.COM and the other location LOC2.ABC.COM and active directory to share users?
- Backup company data on both server.
Any help would be greatly appreciated.

Hi:
Don't think so, each Essentials is a separate domain, holding all the FSMO roles and no trusts are allowed. So the members of each domain in each office will have no access (except via remote access, where they would need an account on the other domain).
And if you mean a public web site I discourage this. Web hosts are cheap to free, and allowing unlimited access to your server is not a secure best practice.
Larry Struckmeyer[MVP] If your question is answered please mark the response as the answer so that others can benefit.

Install Remote Desktop Services Failed on Windows 2012 Server

I understand RDS is not recommended on DC due to security consideration. However since I want to play it at home, it is not much a concern. Such scenario works fine on Windows 2008 R2. But on Windows 2012, the RDS (session-based, have not
tried VDI, but expect same result) installation always fails and is incomplete on DC.
In \Administrative Tools\Terminal Services, I only have RD Licensing Diagnoser and RD licensing manager. The remote desktop service management service cannot be started (Error code: 0x88250001). Is there any extra configuration needed for RDS
working on Server 2012 DC or before the installation? Thanks.
Update: this issue has been solved in Windows 2012 R2 Server. According to
http://blogs.msdn.com/b/rds/archive/2013/07/09/what-s-new-in-remote-desktop-services-for-windows-server-2012-r2.aspx
"Single server RDS deployment including Active Directory. We now support running our RD Connection Broker role service on the same physical instance as an Active Directory Domain Controller. In addition, we published
guidelines for how RD Session Host could be used without the RD Connection Broker."
The guidelines (http://support.microsoft.com/kb/2833839/en-us) primarily apply to Windows 2012 Server.

Asinine. Simply Asinine. Microsoft took it out because of $GREED$.
RemoteDesktop has become so popular, they had to break it to make more money. Thats why they discontinued SmallBusinessServer.   If this practice is so tabooo... Why did MS go the opposite direction with SBS 2011 Premium Cal's? SBS2011
had DC, Exchange, RDS and Sharepoint,SQL, RemoteWebWorkplace, OWA all working in perfect harmony. It is an untrue statement then, that it was "allowed but not recommended"
Now you by Server2012 (core + two virtual) and its not enough for all this.
You need at least another $700 for another sever licence to have it all
and who knows if SQL will run on a DC, or Exchange, or R-DERP server. Another reacherous bridge to cross.
By far, the absloute worse release since Millennium. The product is not ready for production, we broke our rule of waiting until the first SP1 upgrade for this and Exchange 2013. Problems with USB drivers and networking running extreamly slow.
Our 2003 SBS server was at least three times as fast, and this server has SAS and SSD drives running. It can't get out of its own way, and IE10 is the most unstable piece of crap to come out of Redmond. Open wide and swallow - Mother Microsoft
knows whats best for you. YOU WILL EAT OUR SLOP AND LEARN TO LIKE IT.   Server2012 AKA "METRO-SERVER"
Now here I sit after 50 Hours back to back setting up a new R-DERP server 2012, AD, Have my RDP licences in my hand at $100 each, and WTH does Microsoft care if I install it on my DC. ITS MY DC. And the cost savings versus the "risk" was
previously MY decision.
Sure, I can install a couple of Virtual HyperV sessions but they are so tempremental to a power-outage in a small business its not worth it. I have to double up my server hard drive resources, buy a $800 battery backup unit and make sure to attach
the cable, and even then, if that Bi**H does not shut down properly, one bit goes awry in a VHD or VHDX file and you are screwed. Restore from lastnights backup and forget about todays work. Not to mention it will probably take a half day to try
to fix it, then recover it then tell the 30 users they lost a days worth of work.
HYPER-V is for test servers and has no place in a small (micro) business environment. 5-30 users.
Microsoft's solution, buy another server. Need Exchange? Buy another server or take the risky cheapskate route and spin up some VHD's. Might as well put a gun to your head and play russian roulette, at least you know you have a one in six
chance of failure. With MS, its a 100% failure for a dirty shutdown power loss, motherboard blows, memory goes corrupt in a few years, your conventional method of recovery is gone, and you have some upchucked VHD file to try to recover some of TODAYS
data from.
Screw server 2012 forever.
I will sell 2008 and SBS2011 Premium unitl it rots in hell like XP (of which there is NOTHING wrong with for the average, WORD, EXCEL, OUTLOOK and QUICKBOOKS that all SMB's use. Its MS $GREED$ Grab the world by the B**ls and squeeze with all
your might to squeeze every dime you can out of *SMB* because big business is going to run thier 2003 Exchange and 2008 servers into ground before they switch to this garbage.
YOU CANNOT INSTALL EXCHANGE 2013 on DC , OR on R-DERP server.
Go buy another server license and server or MOVE TO THE CLOUD and get fleeced every month.
I have 30 DC/R-DERP/Exchange and SBS2011 Premium servers all running for years in perfect harmony, locked down with security so the users can't even WIGGLE with something they are not supposed to work with. They get their apps, cannot install anything
and all these servers are running just fine behind the firewall and perfectly save. The track record of this combination is 100% stable and is up 24/7/365 with no problems. Do yourself a favor and throw this 2012 into the river, you don't need
any weights because it is LEAD and will sink to the bottom by itself.
Why, you ask? Official is "Its for your protection" The real reason? To sell you more $700 server licences.
Maybe for SMB, we start selling Linux NAS Servers, host the Exchange in the cloud and be hearded like cattle to the Microsoft slaughterhouse. One way or another, you are going to bleed.    A little each month to move to the cloud, or
a small fortune if you want to have it in house. Microsoft wants it to be more expensive to have in house. No more buying a server and running it for six years before you upgrade. They can't have in house servers competing with their cloud,
and small businesses are the low hanging fruit ripe for the pickin'.

Windows 2012 Verification of prerequisites for Domain Controller promotion failed

Windows 2012 Verification of prerequisites for Domain Controller promotion failed and gave the below error(In computer management local group and user option is not there as suggested by a solution!)
"Verification of prerequisites for Domain Controller promotion failed. The local Administrator account becomes the domain Administrator account when you create a new domain. The new domain cannot be created because the local Administrator account password
does not meet requirements.
Currently, the local Administrator password is blank, which might lead to security issues. We recommend that you press Ctrl+Alt+Delete, use the net user command-line tool, or use Local Users and Groups to set a strong password for the local Administrator
account before you create the new domain."

OK, the reason you see this error is because when you set up and configured your Windows R2 environment you may have logged into the OS with an account other than Administrator. So, if you created your log in account named Bob, this is throwing off the Server.
So, hit Ctrl-Alt-Delete, and look who you are logged in as, and then change the account you are logging in as and use the local Administrator account. What you may find is that the default Admin account password has not been set.
Check that out and see if that is what you are experiencing.
Best wishes

Windows 2012 server image creation

Hi
I am posting this here as you have worked on imaging OS.
here is the situation:
I am working on creating windows image file (WIM file) for our company and i have already created images for windows 7 and also 3 different type of windows server 2008 without any issue. everything worked as it is supposed to. now i am trying to create an
image from Windows 2012 server. so all my process is same as i did for server 2008 but i get this error:
[error] c:\recovery\WindowsRE\winre.wim <error = 2>
error imaging drive [c:\]
they system ca not find the file specified.
some point to mention:
1- c:\recovery\windowsRE\winre.wim actually exists
2- as i mentioned i ahve done imaging many many times in the same environment and everything works just i get this error when i want to image my windows 2012
3- I boot in PXE environment and then try to run IMAGEX command and create my WIM file.
4- I have about 80 G free disk space on the partition I want to create my image to.
your help is appreciated.

Thanks for your reply.
as i mentioned before imagex works perfectly for all my images ( win7 and also win 2008) it just fails on win2012
about DISM: I have worked with DISM to inject updates into images offline but i didnt know we can create an image of forexample C drive with DISM. is it possible?
I would actually use a "capture image" from a WDS-server, which is actually the easiest way (in my opinion) to create a Wim-file. What you have to do is set up a WDS server, add the boot.wim from e.g. Windows 2012 DVD into boot images, and then right click
it and "create capture image". Once you boot into that, it will help you create a .Wim-file that can be saved to the same disk, external disk (or even to the WDS if wanted).
I used to use imagex for older OS:es, but it doesn't work with Win8/Server2012 in the same way.

Windows 2012 Server Backup Problems - VSS Error

Our company uses Windows Server Backup to back up our Windows 2012 Server. We back up the host component and the two virtual machines on the server. Every time I install windows updates
on our server my backup jobs stop working and I get a VSS error. In order to get backup working again, I have to recreate my backup job. In order to do this I have to attach all the backup drives to the computer at the same time.
This has been an issue all the way back to when the server was first installed. At that time the person who installed Windows Server talked to Microsoft. Microsoft said the problem would be fixed in the first service pack which they ended
up never releasing. I have looked online, but haven’t found any information on these issues. Are there any fixes for these two problems?

Hi,
Sorry for the delay.
Can you first do a backup then install windows updates? Please provide more detailed message about the VSS error.
Regards,
Mandy
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Windows 2012 Server Remote Desktop Virtualization + Linux Clients

Hello!
I wonder if anyone could shed a little light on this.
We want to implement a Windows 2012 Server with Remote Desktop Virtualization for our office, which has around 12 users. Our company has its core apps developed in VB6.0, and those apps use MySQL as their database. We want clients to run Linux, which will
have no other function than to connect and to Windows 2012 Server and display the remote session. Users need to work as usual, as they would in a local version of a Windows Desktop.
Can this be done? If yes, is the Standard version of Windows 2012 Server the best to accomplish this?
Thank you!

Hi,
Add to Tim, you need to acquire CALs for every user (About 12 in your case).
Remote Desktop Services Client Access Licenses (RDS CALs)
http://technet.microsoft.com/en-us/library/cc753650.aspx
Client Access Licenses and Management Licenses
http://www.microsoft.com/licensing/about-licensing/client-access-license.aspx
In addition, although AD is recommended, you can run RDS in a workgroup.
Regarding how to setup RDS on a single server, you can refer to the following:
Deploying the RDS Quick Start deployment type in Windows Server 2012 (for Session Virtualization)
http://social.technet.microsoft.com/wiki/contents/articles/10421.deploying-the-rds-quick-start-deployment-type-in-windows-server-2012-for-session-virtualization.aspx
Deploying RDS 2012 Single Server – Session Based deployment
http://ryanmangansitblog.wordpress.com/2013/03/11/deploying-rds-2012-single-server-session-based-deployment/
Please Note: Since the website is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.
Hope this helps.
Jeremy Wu
TechNet Community Support

Synchronization fails on Windows 2012 Server

Hello, Running DPM 2012 R2, Protected computer Windows 2012 Standard
I'm backing up only folders (19 GB) on a Windows 2012 server which also have SCCM 2012 installed on it. The initial replica and recovery point creations are successful. Any
scheduled synchronization job scheduled after will fail. The job display "In progress" but there is 0 MB data transferred and will remain in that stage for days until I cancel the job. A reboot of the protected server
resolves the issue temporarily where I might get a couple days of successful synchronization\recovery points but then the job will freeze again. I have looked in the event logs and the logs in Monitoring on the DPM server and also on the protected computer
but have not found any error that points to the cause. Has anyone seen this issue? Will be grateful if someone can point me in the right direction of troubleshooting this issue. Thank you.

Not seeing any errors that stands out. Here is the log from today's synchronization job that is hung.
2B98 2AC0 06/18 14:50:54.265 31 vsssnapshotrequestor.cpp(2078) [00000000028FD320] 123F41D6-B559-4121-A184-AA68B4359C35 NORMAL CVssSnapshotRequestor::DoFailureCleanup [00000000028FD320]
2B98 2AC0 06/18 14:50:54.265 31 vsssnapshotrequestor.cpp(1630) [00000000028FD320] 123F41D6-B559-4121-A184-AA68B4359C35 NORMAL CVssSnapshotRequestor::ReleaseVolumesForSnapshot [00000000028FD320]
2B98 2A40 06/18 15:05:54.409 31 vsssnapshotrequestor.cpp(119) [00000000028FD320] 123F41D6-B559-4121-A184-AA68B4359C35 NORMAL CVssSnapshotRequestor::~CVssSnapshotRequestor [00000000028FD320]
2B98 2A40 06/18 15:05:54.410 31 vsssnapshotrequestor.cpp(2044) [00000000028FD320] 123F41D6-B559-4121-A184-AA68B4359C35 NORMAL CVssSnapshotRequestor::CleanUp [00000000028FD320]
2B98 2A40 06/18 15:05:54.410 31 vsssnapshotrequestor.cpp(1630) [00000000028FD320] 123F41D6-B559-4121-A184-AA68B4359C35 NORMAL CVssSnapshotRequestor::ReleaseVolumesForSnapshot [00000000028FD320]
I ran the VSSADMIN LIST WRITERS command after I cancelled the job and this is the returned message.
"Waiting for response.
These may be delayed if a shadow copy is prepared."

How do I add my Custom Workflow Activity to FIM 2010 R2 SP1 installed on Windows 2012 server?

Hellos.
I have tried and failed to add my custom.dll into the Windows Server 2012 GAC.
We have a version of FIM 2010 R2 Sp1 running on Windows Server 2008 R2 and that was no problem. There seemed to be a gacutil.exe present on the system which added my assembly.
I cannot find gacutil.exe on the Windows 2012 Server.
I have downloaded and installed Windows SDK for Windows 8. However, when I try the gacutil.exe /i <myCustom.dll> nothing seems to happen.
Are there any guidelines how to add custom workflow activities to FIM when installed on a Windows Server 2012 system?
TIA
*HH

Well yes. It is fine when FIM is hosted on Windows Server 2008 R2.My difficulty is that I am using FIM 2010 R2 Sp1 and Windows Server 2012. No GACutility executable.
However, the problem has been resolved. Powershell can be used to modify the assemblies.
I opened a RunAs Administrator PS session. My assembly is in folder c:\Temp
Using Windows Explorer I browsed the folder c:\windows\assembly and noted the System.EnterpriseServices entries: version (2.0.0.0) and public key token (b03f5f7f11d50a3a)
(My version is 2.0.0.0 because when installing FIM and SharePoint 2013 the instructions I used suggested setting .Net version to be 2.0)
These powershell commands got me going...
PS C:\temp> [System.Reflection.Assembly]::Load("System.EnterpriseServices, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a")
GAC Version Location
True v4.0.30319 C:\Windows\Microsoft.Net\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50...
PS C:\temp> $publish = New-Object System.EnterpriseServices.Internal.Publish
PS C:\temp> $publish.GacInstall("c:\temp\RunPowershellLibrary.dll")
PS C:\temp>
PS C:\temp>
PS C:\temp> iisreset
Amazingly I can see the assembly RunPowershellLibrary in my Windows 2012 GAC. :-)
Also, what is more cheering is that the custom activity actually works with FIM 2010 R2 Sp1.

How to change the root domain name in window 2012 server

Got a window 2012 server build up. My root domain name looks something like corp.marketing Well I seems to have missed to add the last .com or .local. How do I add the .com to my existing root domain name please. The server is new, will
go online in few days time. Thanks for all the help.

I have a similar question and not sure if this is the right place. I had set a server with corp.brighterworld.com but the install wizard anywhere access had me believe that microsoft's strongly preferred domain name prefix was remote.brighterworld.com so
I contacted GoDaddy and had it reissued as remote. but when I went to reconfigure for the new name. I had already set the server for being a CA, and in that process it issued like 4 or 5 certificates. So I had tried to rebuild the machine from scratch, but
the it didn't wipe everything, but rather saved previous state which left the old certificate stuff to be dealt with. Any hints or help out here for us having to learn this stuff the hard way?
Thanks,
Mark Saxton

Windows 7 SP1 client file lock on network share hosted ny WIndows 2012 Server

Hello
I have one strange problem after migration from Windows 2003 Server to Windows 2012 Server R2 Standard.
All migration tasks went well but two things do not work.
In Computer Management you have The Opened Files feature and if you open any file that is located on the network share hosted by Windows 2012 R2 form Windows 7 SP1 and then close it
it remains open in the Opened Files tab (even if you wait an hour). There is no problem with Windows XP SP3. The issue exist only with Windows 7.
The session view of sessions to the file server do not work. If I try to open it I get the message that the application is not responding.
Can someone help me with that ?
About the environment:
It is one server Domain migrated form 2003 to 2012R2.
The domain and forest level was raised to 2012 R2.
I have made clean install of Windows 2012 R2 and then migrated AD.
Best Regards
Sebastian Sala

Hi Sebastian,
>>There is no problem with Windows XP SP3. The issue exist only with Windows 7.
T>>he session view of sessions to the file server do not work. If I try to open it I get the message that the application is not responding.
Based on the description, please check event logs in Event Viewer to see if there were some related events logged. Besides, does this phenomenon happen all Windows 7 clients? We can try to restart the client to see if it helps.
Best regards,
Frank Shen
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

Windows 2012 server security checklist for corporate company standard/recommended check-list

Similar Messages

Maybe you are looking for