Windows 2012

 

Installation

 

Installation Active Directory, DNS and DHCP

 

 

AD Infrastructure

How to Build a VMware vSphere VM Template for Windows Server 2008 R2

 

A co-worker and myself were asked to create a VMware vSphere (ESX) template for Server 2008 R2 and it’s not as easy as you might think. Over the course of a day and half and through much research and trial and error, we have come up with the perfect template for our organization. It’s a perfect base template for us but depending on where you intend to deploy it and your own organization’s requirements, you may have to edit it a bit. We intend to tweak the template even further and possibly even create separate images depending on if the VM will be deployed internally or externally. Please do comment if you have any suggestions or think we may have missed something.

Building a VMware template for Server 2008 vs. Server 2008 R2 has some differences. This blog post will cover everything we did to successfully get it working and a detailed explanation of why we chose certain settings.

OS Used: Windows Server 2008 R2 Standard (x64) Volume License Edition

VM Hardware config:

• Single vCPU
• 4 GB RAM
• 40 GB Primary Hard Drive (for Operating System)
• 10 GB Secondary Hard Drive (for Page File
• LSI Logic SAS SCSI Controller
• VMXNet 3 Network Adapter

I know most organizations using Server 2003 have always done a 20 GB C: partition. With 2008, I suggest going to 40 GB OS drives as a standard. Server 2008 (especially x64 versions) requires more space. Out of the box 2008 R2 x64 takes up 10 GB. Also Server 2008 has a component store (c:\windows\winsxs) which is very large. This is because 2008 no longer uses i386, everything is stored locally already in this component store folder. Remember, Server 2008 and any future MS product is all about componentization!! When you install a component from this store, my understanding is that it is “projected” to the OS. So basically Windows 2008 installed components run from this component store essentially. As the system receives updates over time, expect this directory to grow even larger since it never deletes old stuff. Think of the different versions of kind of stacking on each other. I believe with each service pack there is a tool to uninstall components that are no longer necessary or superseded. So stick with a 40 GB OS partition and you should be fine for a long time. You will also notice we have a 10 GB secondary drive for a page file. We’ll get to that later in the article.

Now on to the actual build:

1. First create a new VM
   • Select Custom Configuration
   • Enter VM Name and Inventory Location
   • Select Datastore
   • Select Virtual Machine Version: 7
   • Select “Microsoft Windows Server 2008 R2 (64-bit)” as OS Version
   • # of Virtual Processors: 1
   • Amount of RAM: 4GB
   • Network
     • # of NICs: 1
     • Adapter Type: VMXNET 3
     • Select “Connect at Power On
   • SCSI Controller: LSI Logic SAS
   • Create New Virtual Disk: 40GB
   • Advanced Options: No Change
2. Now prepare the virtual hardware:
   • Edit VM Settings > Options > General Section > Uncheck “Enable logging”
   • Boot Options > Check box to force going into the BIOS on next boot
   • Power on the VM (will go directly to BIOS) > Advanced > I/O Device Configuration:
     • Disable Serial port A
     • Disable Serial port B
     • Disable Parallel port
   • Exit and Save
3. OS Installation and Configuration
   • Install Windows 2008 R2 Standard – Full Install
   • After OS install and reboot, change Administrator Password (will prompt)
   • Disconnect Windows 2008 R2 ISO and set device type to Client Device
   • Set Time Zone
   • VMware Tools Install
     • Install VMtools, choose Custom Install Type
     • Disable the “Shared Folders” drive and install Tools ** Note we are disable Shared Folder due to profile loading issues which was documented even back in ESX 3.5 and VMware Tools here on the VMare Communities forum. I have not personally had an issue leaving it enabled but just to be cautious and the fact we don’t use this feature in our organization, we have left it disabled.
     • Set time synching between the VM and ESX host
     • Reboot after Tools Install
   • Network Configuration
     • From Server Manager, select View Network Connections
     • Right click on Local Area Connection and select properties
     • Uninstall QoS Packet Scheduler and both Link-Layer Topologies (Mapper & Responder) ** We don’t do QOS at the server level, our switches do that. Link Layer is not used by us.
     • Uncheck IPv6 and close network connection screens ** We don’t use IPv6 yet so we disabled it for now
   • Server Name
     • From Server Manger select Change System Properties
     • On System Properties screen click Change on Computer Name Tab
     • Set Server Name and restart
   • Windows Updates
     • From Server Manager under Security Information, select Configure Updates
     • Select Let me choose
     • Under Important Updates, select Never check for updates, click ok
     • Start > All Programs > Windows Update > Check for updates and install all Recommended Updates
   • Enable Remote Desktop, choose “Allow connections from computers running any version of Remote Desktop” (2^nd option)
   • Disable Windows Firewall **Not best practice to disable, but my environment requires it
   • From Server Manager, select “Do not show me this console at logon” and close Server Manager
   • Taskbar Changes
     • Right click 3^rd icon from Start Button (Windows Explorer) and select “Unpin this program from taskbar”
     • Right click 2^nd icon from Start Button (Windows PowerShell) and select “Unpin this program from taskbar”
     • Right click Taskbar and choose Properties and choose Customize under Notification Area
     • Select “Turn system icons on or off”, and turn Volume Off, click Ok
   • System Performance
     • From Server Manager select Change System Properties
     • Select Advanced Tab > Settings and choose “Adjust for best performance”
   • Folder and Search Options
     • Open “Computer” > Select Organize > Choose Folder and search options
     • Under View Tab
       • Select “Show hidden files, folders and drives”
       • Uncheck “Hide extensions for known file types”
   • IE ESC
     • From Security Information Section, select Configure IE ESC
       • Change Administrators to Off and leave Users On ** My reasoning for this is the only “Users” should be service accounts on a server so leaving it On should not matter
   • Change IE Home Page to blank so you don’t get that pesky Internet Exploer Enhanced Security Configuration warning page
   • Under Computer, right click c: and select properties, uncheck “Allow files on this drive to have contents indexed in addition to file properties”
     • Apply changes to c:\ and all subfolder/files
     • Continue/Ignore on Access Denied errors
   • Power Options (from Control Panel)
     • Change option to High Performance
   • Disable Hibernation
     • Command Prompt, enter powercfg.exe –h off
   • Delete the Page file and reboot (so c:\ can be fully defragmented)
   • Run defrag
   • Page File
     • Edit VM Properties
     • Add a 2^nd hard drive (10GB) and change to SCSI (1:0)
     • Run Disk Manager and format as Z:\ drive ** We use Z: as the drive letter so it does not interfere with adding additional drives later on.
     • From Server Manager, select System Properties > Advanced > Performance Settings > Advanced > Virtual Memory Change
       • Assign 1024MB Page file to c:\
       • Assign 5120MB Page file to z:\
   • SNMP
     • Server Manager > Add Features > SNMP
     • Server Manager > Configuration > Services > SNMP > Security
       • Accepted community names – Add your community (as READ ONLY)
       • Accept SNMP Packets from these hosts – Add your hosts (remember to leave localhost in there)
4. Turn VM into a Template
   This procedure will copy the Administrator account profile into the default user profile so that all users that login or that will be created in the future will get the same profile with all the customizations you have done above. When you sysrep a server template and create a new VM from it, a new SID is generated which means a new local Administratior account is created during the sysrep procedure. This means all the customizations you have done will be wiped out above unless you copy all your settings above when you create a new VM. In the past with Server 2003 and even Server 2008, you had the “Copy To” feature to copy a user profile to another. With Server 2008 R2, Microsoft has disabled this feature. It is now done via an unattend.xml file using the “CopyProfile” node. I actually prefer this method now after doing it a few times. This procedure is detailed per the Microsoft KB article http://support.microsoft.com/kb/959753
   • Create unattend.xml in “c:\windows\system32\sysprep” folder as follows. NOTE: Do not copy and paste the text below because WordPress messes up the quotes which will lead to errors during sysprep. Please right click-save as this link and copy and paste from the txt file instead.

     
     <?xml version="1.0" encoding="utf-8"?> 
     <unattend xmlns="urn:schemas-microsoft-com:unattend"> 
     <settings pass="specialize"> 
     <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> 
     <RegisteredOrganization>Your Organization Name</RegisteredOrganization> 
     <RegisteredOwner>Your Registered Owner</RegisteredOwner> 
     <CopyProfile>true</CopyProfile> 
     </component> 
     </settings> 
     <cpi:offlineImage cpi:source="wim:f:/sources/install.wim#Windows Server 2008 R2 SERVERSTANDARD" xmlns:cpi="urn:schemas-microsoft-com:cpi" /> 
     </unattend>
     

     
     
   
   
   
   • At command prompt, type the following command:
     
     C:\windows\system32\sysprep\sysprep.exe  /generalize /unattend:unattend.xml
   
   
   
   • System Preparation Tool 3.14
     
     
     
     • Choose Enter System OOBE
     
     
     
     • Check Generalize button
     
     
     
     • Leave shutdown option as reboot
     
     
     
     • Click OK
     
     
     
     
   
   
   
   
   
   
   
   • Release the IP and turn VM into a template in Virtual Center
   
   
   
   
   

   I hope this guide we wrote helps someone out there and saves you time. If you have any suggestions or questions, please leave a comment. I can take screenshots of any parts above you are confused on. I am also interested in knowing about more performance related customizations you guys might use we can add to your template so if you have any, please let me know.

   
   

How to Build a Windows 2008 VMware ESX VM Template

NOTE – VMware Virtual Center 2.5 Update 4 or vCenter 4 is required to use Guest Customizations with Windows 2008.

http://www.vmware.com/support/vi3/doc/vi3_vc25u4_rel_notes.html#whatsnew

For Windows 2008 R2 if you are installing on vSphere 4 without Update 1  or on ESX 3.5 without update 5 set the Template VM OS to Windows 2008 instead of Windows 2008 R2. After a new VM is deployed from the template and guest customization as finished you can set the OS back to Windows 2008 R2.

1. Use an ISO for faster OS setup.

2. Build a new VM that has at least 1 GB RAM and a 20 GB drive.

3. Attach the Windows 2008 ISO to the CD/DVD drive and set it to connect at power on.

4. On the VM Edit Settings window go to the Options tab and in the General section uncheck the Enable logging check box.

5. Go to the Boot Options section and check the box to force going into the BIOS on next boot.

6. Power on the VM and when the setup screen appears go to Advanced, I/O Device Configuration.

7. Disable the Serial and Parallel ports.

8. Go to the Boot menu and set the CD-ROM first in the boot order.

9. Save, exit and install Windows 2008, during the install choose either Standard or Enterprise.

10. On first boot up after install set the Administrator password.

11. Close the “Initial Configuration Tasks” window, after the VMware Tools have been installed we will configure the server.

12. Close the “Server Manager” window.

13. Disconnect the Windows 2008 ISO and set the device type to Client Device.

14. Install VMware Tools, choose Custom install type.

15. Disable the “Shared Folders” driver. This driver can cause issues with profiles unloading properly.

16. Set the “Hardware acceleration” to Full before reboot.

17. After reboot from the VMware Tools install configure the time zone.

18. Configure Networking. Uninstall these networking components. It is best to remove any components not needed to free up resources.

a. QoS Packet Scheduler – Not needed unless you are doing QoS at the Windows layer instead of the L2/L3 switch layer.

b. Link Layer Topology Discovery components – http://en.wikipedia.org/wiki/Link_Layer_Topology_Discovery

c. Uncheck TCP/IP v6

19. Leave the IP address set to DHCP unless DHCP isn’t available on the network.

20. Set the computer name to W2K8TEMPALTE

21. Download and install updates. Turn on Windows Updates to download and notify before install.

22. Check for updates and install the latest critical and recommended updates. If the updates fail to download restart and try again.

23. Enable Remote Desktop

24. Disable the Windows Firewall.

25. Below is a screen shot of how the server should be configured.

26. Check the box to “Do not show this window at logon” and click Close.

27. When the Server Manager window opens check the box to “Do not show me this console at logon” and close Server Manager.

28. Go to the Taskbar properties and check these boxes.

29. Go to the Start Menu tab and check these boxes.

30. Click Customize and check these boxes.

31. Go to the Notification Area tab and check these boxes.

32. Click OK.

33. Go to Computer properties on the desktop and set the Performance options below.

34. Right-click on the desktop and go to Personalization.

35. Go to Screen Saver and set it to blank.

36. Disable the system screen saver, this is the screen saver that starts when no user is logged into the system. Go to start run and type regedit. Browse to this registry path “HKEY_USERS\.DEFAULT\Control Panel\Desktop” and delete the SCRNSAVE.EXE name.

37. Go to Sounds, when prompted choose No.

38. Set the Sound scheme to No Sounds.

39. Click on Change desktop Icons and uncheck the boxes below.

40. Go to Settings Control Panel. Go to View and choose Status Bar and Details

41. Go to Tools, Folder Options, View tab and check/uncheck these boxes.

42. Apply and apply to folders.

43. Delete the Desktop.ini files on the desktop.

44. Right-click on the desktop and arrange icons by Name.

45. Go to Start, Programs, Administrative Tools, Server Manger and click on Configure IE ESC, set it to off for both Administrators and Users.

46. Go to Internet Explorer properties and set the home page to blank.

47. Go to the Advanced tab and check/uncheck these boxes.

48. Clear the C:\Users\Administrator\AppData\Local\Temp folder.

49. Go to the properties of the C drive and uncheck the “Index this drive for faster searching” box, click apply and choose Apply changes to drive c:\ only.

50. Go to the cmd prompt and type powercfg.exe -h off to disable hibernation. This command also deletes the hiberfile.sys from C:\

51. Delete the page file and reboot. This is so the C drive can be fully defragmented.

52. After reboot login and delete the pagefile.sys from the C: drive. Defragment the C: drive. After defragmentation completes reconfigure the page file system managed.

53. Go to Control Panel, Power options and set the Power Plan to High performance.

54. Click the change plan settings and set both options to Never.

55. Stop and disable the Windows Firewall service.

56. Create a new temporary user named ptemp and add the user to the local administrators group.

57. Log out an login as ptemp

58. Go to Computer properties, Advanced system settings, User Profiles, Settings

59. Select Administrator and choose Copy To… Type C:\Users\Default and change Permitted to use to Authenticated Users.

NOTE – FOR WINDOWS 2008 R2 FOLLOW THESE INSTRUCTIONS FOR COPYING THE USER PROFILE. – http://jeremywaldrop.wordpress.com/2009/09/18/how-to-copy-profiles-in-windows-2008-r2-and-windows-7/

60. Logout and login as Administrator, delete the ptemp user profile and user account.

61. Go to C:\Users\Default and delete the old NTUSER.DAT{ files.

62. Delete these folders.

63. Shutdown the VM.

64. Convert the VM to a template.

65. Create a Windows 2008 Customization Specification for Windows 2008. You do not need to worry about the sysprep files. In Vista and Windows 2008 sysprep is in C:\Windows\System32\sysprep. When the guest OS type is set to Vista VMware VC knows that the sysprep files are already on the OS.

66. When a new VM gets deployed from this template choose your Windows 2008 specification.

67. On first boot up the VM will boot up to a login screen, do not login the VM will reboot automatically after a minute. On the next boot up you should see this screen appear.

68. And this screen. This process may take a few minutes, so be patient.

69. The VM will automatically reboot again. Login and shutdown the VM.

71. The VM is now ready for use.