主题： windows-server
-
Windows LAPS: unique local administrator passwords for Windows Server, and who is allowed to read one
Windows LAPS (built in to Windows Server 2019 and 2022 with the April 11, 2023 update or later, and to Windows Server 2025) automatically randomizes and rotates each machine's local administrator password and stores it in Active Directory or Microsoft Entra ID; in AD, Domain Admins can read it by default and every other reader needs an explicitly delegated permission.
-
Windows PowerShell 5.1 versus PowerShell 7 on servers: which one a script actually runs under
PowerShell 7 installs side by side with the built-in Windows PowerShell 5.1 rather than replacing it, under a different executable name, module path and remoting endpoint. An agent that runs 'powershell.exe' when it meant 'pwsh.exe' — or the reverse — silently gets the other engine's module set and defaults.
-
Preparing a new disk in Windows Server: Get-Disk through Format-Volume, and why it starts offline
The PowerShell Storage module sequence from Get-Disk to a mounted, formatted volume — Initialize-Disk -PartitionStyle GPT, New-Partition -UseMaximumSize, Format-Volume, and resizing later with Get-PartitionSupportedSize — plus the SAN policy that leaves some newly attached disks offline by default.
-
Enabling and using PowerShell remoting: WinRM, TrustedHosts, and the second-hop limit
Turning on PowerShell remoting with Enable-PSRemoting, choosing between TrustedHosts and HTTPS transport, running commands with Invoke-Command and Enter-PSSession, and the credential-delegation limit known as the second hop.
-
Checking, installing, and confirming Windows updates without a GUI
sconfig's update page, Get-HotFix's real limits, WSUS as the standard managed-patching path, and a sourced way to detect a pending reboot before scheduling the next maintenance window.
-
通过 PowerShell 安装 Windows Server 角色和功能，避免积累待重启状态
Get-WindowsFeature 和 Install-WindowsFeature -IncludeManagementTools 用于发现和安装；当本地组件存储缺少文件时，-Source 指向按需功能介质；返回对象会告诉调用方是否仍需重启。
-
Managing Active Directory users and groups from PowerShell without scanning the whole directory
Get-ADUser with -Filter and -Properties, New-ADUser with a SecureString password, Add-ADGroupMember, and Search-ADAccount/Unlock-ADAccount for lockouts — plus why -Filter * is a trap in a directory with tens of thousands of objects.
-
Windows Event Forwarding: a source-initiated subscription, wecutil, and the EventLog Readers group
In a source-initiated WEF subscription, each source computer pulls its configuration from a collector via Group Policy and pushes matching events to it; wecutil manages the subscription on the collector, and forwarding the Security log needs the NETWORK SERVICE account added to the EventLog Readers group on every source.
-
Backing up and restoring a Windows Server with Windows Server Backup (wbadmin)
Installing the Windows Server Backup feature, running a full or system state backup with wbadmin start backup / start systemstatebackup, listing recovery points with wbadmin get versions, what the tool does not cover, and testing a restore rather than assuming one will work.
-
Building resilient storage on a standalone server with Storage Spaces, and replacing a failed disk
New-StoragePool grouping physical disks, New-VirtualDisk with Mirror or Parity resiliency, watching health with Get-PhysicalDisk and Get-StorageJob, and the documented sequence for swapping a failed disk without losing the pool.
-
Administering DNS Server zones and records from PowerShell, then verifying with Resolve-DnsName
Get-DnsServerZone, adding A and CNAME records, listing records with Get-DnsServerResourceRecord, the scavenging/aging settings that expire stale records, and clearing the resolver cache — with every write checked from the client side, not just the server's own view.
-
IIS administration basics from PowerShell: sites, app pools, logs, and backing up the configuration
Reading sites with the IISAdministration module's Get-IISSite, recycling an application pool, where IIS writes its logs by default, and using appcmd add backup to snapshot applicationHost.config before a configuration change.
-
Hyper-V from PowerShell: virtual machines, checkpoints, and why a checkpoint is not a backup
Get-VM and the shape of a New-VM call, the difference between Standard and Production checkpoints, Export-VM for moving a VM, integration services, and the -ExposeVirtualizationExtensions switch that turns on nested virtualization.
-
Network configuration tools compared: nmcli, netplan, systemd-networkd and their Windows and macOS equivalents
Reading the current network configuration, setting a static address, and setting DNS servers — the same three tasks across NetworkManager's nmcli, Ubuntu's netplan, systemd-networkd, Windows PowerShell's networking cmdlets, and macOS's networksetup.
-
通过 PowerShell 管理 DHCP Server 角色：作用域、保留地址、授权与备份
查看 DHCP 作用域（Get-DhcpServerv4Scope）和租约，用 Add-DhcpServerv4Reservation 保留地址，用 Add-DhcpServerInDC 在 AD 中授权服务器，了解故障转移，并在高风险更改前通过 Backup-DhcpServer 备份配置。
-
Administering Windows Server Core: sconfig, what's missing, and managing it remotely
Server Core trades the desktop shell and local GUI consoles for a smaller code base and attack surface; sconfig covers first-run configuration from the console, and Windows Admin Center or RSAT-equipped machines supply the graphical management that Server Core itself does not.
-
Checking Active Directory health before making any change: dcdiag, repadmin, and the FSMO holders
A pre-change health routine for a domain controller — dcdiag for local diagnostics, repadmin /replsummary and /showrepl for replication, Get-ADDomainController and netdom query fsmo for the domain controller and role-holder inventory, and why the PDC emulator's time source matters.
-
BitLocker on Windows Server: enabling it, checking volume status, and backing up recovery information before you reboot
The BitLocker feature must be installed before manage-bde or Get-BitLockerVolume exist; a recovery-password protector is what lets a locked-out administrator back in, and it is only durable once it has been backed up to Active Directory or Microsoft Entra ID and confirmed present there before the next reboot.
-
使用 ScheduledTasks 模块构建计划任务：操作、触发器、运行主体和结果代码
New-ScheduledTaskAction、-Trigger 和 -Principal 组成任务，再用 Register-ScheduledTask 注册；以 NT AUTHORITY\SYSTEM 身份运行不需要保存密码，Get-ScheduledTaskInfo 与文档中的任务计划程序结果常量则能告诉智能体，上次运行是否确实成功。
-
Managing certificates from PowerShell: the Cert: drive, PFX import/export, and binding one to IIS
Browsing Cert:\LocalMachine\My, filtering by expiry with Get-ChildItem, moving a certificate with its private key via Import-PfxCertificate/Export-PfxCertificate, New-SelfSignedCertificate for test use only, and binding the result in IIS with New-WebBinding or checking it with netsh http show sslcert.
机器可读： JSON