主题： windows-server
-
Windows LAPS: unique local administrator passwords for Windows Server, and who is allowed to read one
Windows LAPS (built in to Windows Server 2019 and 2022 with the April 11, 2023 update or later, and to Windows Server 2025) automatically randomizes and rotates each machine's local administrator password and stores it in Active Directory or Microsoft Entra ID; in AD, Domain Admins can read it by default and every other reader needs an explicitly delegated permission.
-
Windows PowerShell 5.1 versus PowerShell 7 on servers: which one a script actually runs under
PowerShell 7 installs side by side with the built-in Windows PowerShell 5.1 rather than replacing it, under a different executable name, module path and remoting endpoint. An agent that runs 'powershell.exe' when it meant 'pwsh.exe' — or the reverse — silently gets the other engine's module set and defaults.
-
Preparing a new disk in Windows Server: Get-Disk through Format-Volume, and why it starts offline
The PowerShell Storage module sequence from Get-Disk to a mounted, formatted volume — Initialize-Disk -PartitionStyle GPT, New-Partition -UseMaximumSize, Format-Volume, and resizing later with Get-PartitionSupportedSize — plus the SAN policy that leaves some newly attached disks offline by default.
-
Enabling and using PowerShell remoting: WinRM, TrustedHosts, and the second-hop limit
Turning on PowerShell remoting with Enable-PSRemoting, choosing between TrustedHosts and HTTPS transport, running commands with Invoke-Command and Enter-PSSession, and the credential-delegation limit known as the second hop.
-
Checking, installing, and confirming Windows updates without a GUI
sconfig's update page, Get-HotFix's real limits, WSUS as the standard managed-patching path, and a sourced way to detect a pending reboot before scheduling the next maintenance window.
-
Installing Windows Server roles and features from PowerShell without stacking pending reboots
Get-WindowsFeature and Install-WindowsFeature -IncludeManagementTools cover discovery and install, -Source points at Features-on-Demand media when the local component store lacks the files, and the returned object tells the caller whether a restart is still owed.
-
Managing Active Directory users and groups from PowerShell without scanning the whole directory
Get-ADUser with -Filter and -Properties, New-ADUser with a SecureString password, Add-ADGroupMember, and Search-ADAccount/Unlock-ADAccount for lockouts — plus why -Filter * is a trap in a directory with tens of thousands of objects.
-
Windows Event Forwarding: a source-initiated subscription, wecutil, and the EventLog Readers group
In a source-initiated WEF subscription, each source computer pulls its configuration from a collector via Group Policy and pushes matching events to it; wecutil manages the subscription on the collector, and forwarding the Security log needs the NETWORK SERVICE account added to the EventLog Readers group on every source.
-
Backing up and restoring a Windows Server with Windows Server Backup (wbadmin)
Installing the Windows Server Backup feature, running a full or system state backup with wbadmin start backup / start systemstatebackup, listing recovery points with wbadmin get versions, what the tool does not cover, and testing a restore rather than assuming one will work.
-
Building resilient storage on a standalone server with Storage Spaces, and replacing a failed disk
New-StoragePool grouping physical disks, New-VirtualDisk with Mirror or Parity resiliency, watching health with Get-PhysicalDisk and Get-StorageJob, and the documented sequence for swapping a failed disk without losing the pool.
-
Administering DNS Server zones and records from PowerShell, then verifying with Resolve-DnsName
Get-DnsServerZone, adding A and CNAME records, listing records with Get-DnsServerResourceRecord, the scavenging/aging settings that expire stale records, and clearing the resolver cache — with every write checked from the client side, not just the server's own view.
-
IIS administration basics from PowerShell: sites, app pools, logs, and backing up the configuration
Reading sites with the IISAdministration module's Get-IISSite, recycling an application pool, where IIS writes its logs by default, and using appcmd add backup to snapshot applicationHost.config before a configuration change.
-
Hyper-V from PowerShell: virtual machines, checkpoints, and why a checkpoint is not a backup
Get-VM and the shape of a New-VM call, the difference between Standard and Production checkpoints, Export-VM for moving a VM, integration services, and the -ExposeVirtualizationExtensions switch that turns on nested virtualization.
-
Network configuration tools compared: nmcli, netplan, systemd-networkd and their Windows and macOS equivalents
Reading the current network configuration, setting a static address, and setting DNS servers — the same three tasks across NetworkManager's nmcli, Ubuntu's netplan, systemd-networkd, Windows PowerShell's networking cmdlets, and macOS's networksetup.
-
Managing the DHCP Server role from PowerShell: scopes, reservations, authorization, and backup
Get-DhcpServerv4Scope and leases, reserving an address with Add-DhcpServerv4Reservation, authorizing a server in AD with Add-DhcpServerInDC, a failover overview, and backing up the configuration with Backup-DhcpServer before a risky change.
-
Administering Windows Server Core: sconfig, what's missing, and managing it remotely
Server Core trades the desktop shell and local GUI consoles for a smaller code base and attack surface; sconfig covers first-run configuration from the console, and Windows Admin Center or RSAT-equipped machines supply the graphical management that Server Core itself does not.
-
Checking Active Directory health before making any change: dcdiag, repadmin, and the FSMO holders
A pre-change health routine for a domain controller — dcdiag for local diagnostics, repadmin /replsummary and /showrepl for replication, Get-ADDomainController and netdom query fsmo for the domain controller and role-holder inventory, and why the PDC emulator's time source matters.
-
BitLocker on Windows Server: enabling it, checking volume status, and backing up recovery information before you reboot
The BitLocker feature must be installed before manage-bde or Get-BitLockerVolume exist; a recovery-password protector is what lets a locked-out administrator back in, and it is only durable once it has been backed up to Active Directory or Microsoft Entra ID and confirmed present there before the next reboot.
-
Building a scheduled task with the ScheduledTasks module: action, trigger, principal, and result codes
New-ScheduledTaskAction, -Trigger and -Principal compose into a task registered with Register-ScheduledTask; running as NT AUTHORITY\SYSTEM needs no stored password, and Get-ScheduledTaskInfo plus the documented Task Scheduler result constants tell an agent whether the last run actually succeeded.
-
Managing certificates from PowerShell: the Cert: drive, PFX import/export, and binding one to IIS
Browsing Cert:\LocalMachine\My, filtering by expiry with Get-ChildItem, moving a certificate with its private key via Import-PfxCertificate/Export-PfxCertificate, New-SelfSignedCertificate for test use only, and binding the result in IIS with New-WebBinding or checking it with netsh http show sslcert.
机器可读： JSON