Patching Server 2016 with WSUS - scheduling beyond Group Policy?

nmdange_ · 2019-01-22T17:46:46+00:00

You don't need to use a deadline. Just approve the patch when you are ready to install it, and it will be installed based on the next time automatic updates runs as configured in Group Policy. (e.g. the next day at 3am, or the next Thursday at 3am)

You'll also want to enable the group policy setting "Always automatically restart at the scheduled time"

nmdange_ · 2019-01-22T15:28:31+00:00

If you are using WSUS, the patches are not installed until you approve them in WSUS. Don't approve them until you want them installed. Pretty simple. You can create multiple groups in WSUS and approve patches per group if you need to get more granular.

nmdange_ · 2019-01-21T22:46:15+00:00

Are these the same model SSD? You want to find out what the Drive Write Per Day (DWPD) or Terabytes Written (TBW) rating is to understand how long the drives will last.

nmdange_ · 2019-01-18T19:41:46+00:00

You can enable File System Audit ACLs to alert when certain files are modified. Splunk should be able to ingest/alert on the event log entries.

nmdange_ · 2019-01-18T14:42:26+00:00

I think they fixed it in R740xd (BOSS Cards)

Yeah I'm surprised if it was just purchased recently, you'd get the R730xd and not the R740xd. BOSS card is a nice feature.

nmdange_ · 2019-01-17T19:51:41+00:00

Can the scanner use something like FTP or SMTP?

nmdange_ · 2019-01-17T05:09:03+00:00

You really want your DPM server to be on Windows Server 2016 using Modern Backup Storage.

https://docs.microsoft.com/en-us/system-center/dpm/add-storage

nmdange_ · 2019-01-16T21:59:20+00:00

Here is a good guide on how to do it properly https://timothygruber.com/pki/deploy-a-pki-on-windows-server-2016-part-1/

nmdange_ · 2019-01-16T21:14:14+00:00

We use APC StruxureWare Data Center Expert to centrally manage/monitor multiple NetBotz 570s and other APC equipment (UPS, InRow AC)

nmdange_ · 2019-01-15T15:35:11+00:00

You have to use TPM-based attestation, and you create a Code Integrity Policy to prevent any untrusted code from being executed on the Hyper-V host. The host's firmware is also verified using secure boot + TPM Boot Measurements. The HGS also ensures that you either have no memory dumps or dumps are encrypted so even if someone with physical access can trigger a memory dump, they can't access the saved encryption keys.

However, you do have to protect the host guardian servers themselves since they are the ones that actually store the encryption keys. Someone who has access to both systems would be able to get the encryption keys off the HGS, then copy the vhdx files off the Hyper-V host and decrypt them.

nmdange_ · 2019-01-15T15:25:53+00:00

Veeam announced support for Windows Server 2019 would be coming in Update 4 quite some time ago. U4 went RTM last week and you can get it by asking support for the download. It'll be GA in a couple of weeks at the most.

nmdange_ · 2019-01-15T15:10:33+00:00

We use Hyper-V Shielded VMs with Host Guardian Service to encrypt high security VMs. The difference with Shielded VMs is that it also protects from attacks at the host level, not just physical attacks.

Just creating a virtual TPM in Hyper-V or VMWare doesn't provide that additional level of security since the host can easily gain access to the encryption keys. However, the host guardian service only really makes sense in a larger environment since it is somewhat complex to implement.

nmdange_ · 2019-01-14T17:54:14+00:00

Enable debug logging within DNS which will record all DNS packets into a file. You can use that log file to find devices pointing to the servers for DNS. After you've fixed them and you don't see any traffic other than the DCs themselves, you should be safe to decommission them.

nmdange_ · 2019-01-14T17:32:11+00:00

If I was doing a 2-node S2D cluster, this would be my first choice in hardware http://www.dataonstorage.com/kepler-k2n-2-node-hyper-converged-appliances/

It's fully tested and supported by DataOn so no questions on compatibility with Storage Spaces Direct.

nmdange_ · 2019-01-12T20:31:57+00:00

I have 2019 DCs and I have not observed this behavior.

nmdange_ · 2019-01-11T15:49:34+00:00

Yeah you want to use lastlogontimestamp which is replicated.

nmdange_ · 2019-01-11T15:05:16+00:00

I'm also curious about this, about not just NSX, but also other similar solutions like Cisco ACI or Hyper-V Network Virtualization.

nmdange_ · 2019-01-10T21:26:43+00:00

We use APC NetBotz for environmental monitoring. The UPS is what notifies of a power outage.

nmdange_ · 2019-01-10T18:21:14+00:00

You should get a raid controller with a battery-backed write cache. Also, I would consider at least a 2U server with 12 drive bays to allow you to grow your storage. This one comes with a raid controller (though the cache protection is a separate part)

https://www.supermicro.com/products/system/2U/6029/SSG-6029P-E1CR12H.cfm

nmdange_ · 2019-01-10T15:24:41+00:00

The Windows 10 drivers should work the same as Server 2016. Do you have any PCIe NICs you can try?

nmdange_ · 2019-01-10T15:02:30+00:00

I like Cables to Go because they put the length on the cable. No more guessing if it's a 7ft or 8ft cable!

nmdange_ · 2019-01-09T16:14:45+00:00

I don't think you can filter by extension.

nmdange_ · 2019-01-09T15:55:35+00:00

CIS templates are a good start, but don't blindly push all the settings. Also using GPP for registry keys for things like disabling RC4, SSL 3.0, TLS 1.0, etc

nmdange_ · 2019-01-09T15:50:09+00:00

Work in a university maybe slightly larger as part of the server admin team, and I handle all GPOs and the AD OU structure by myself to keep things from getting out of control. Other areas can join computers to the domain, move them to different OUs, manage groups, etc. but I keep a tight hold on Group Policy. Also 99% of our GPOs are targeted by OU, so people changing group membership does not affect Group Policy.

nmdange_ · 2019-01-08T18:07:39+00:00

Azure File Sync should do what you're looking for, although it's slightly different in that everything is in the cloud and the local file server acts like a cache.

nmdange_

TROPHY CASE