Server Manager

Windows Server® 2008 R2 eases the task of managing and securing multiple server roles in an enterprise with the Server Manager console. Server Manager in Windows Server 2008 R2 provides a single source for managing a server's identity and system information, displaying server status, identifying problems with server role configuration, and managing all roles installed on the server.

How Server Manager Streamlines Server Administration

Server Manager makes server administration more efficient by allowing administrators to do the following by using a single tool:

  • View and make changes to server roles and features installed on the server.

  • Perform management tasks associated with the operational lifecycle of the server, such as starting or stopping services, and managing local user accounts.

  • Perform management tasks associated with the operational lifecycle of roles installed on the server, including scanning certain roles for compliance with best practices.

  • Determine server status, identify critical events, and analyze and troubleshoot configuration issues or failures.

In this Section

Roles, Role Services, and Features

Adding Server Roles and Features

Removing Server Roles and Features

The Server Manager Main Window

Role Home Pages

Server Manager Command-line Tools

Remote Management with Server Manager

Accessibility Features in Server Manager


Roles, Role Services, and Features

Server Manager in Windows Server® 2008 R2 replaces older management consoles such as Configure Your Server and Manage Your Server. With Server Manager, you prepare the server for deployment by installing logical software packages known as roles, role services, and features.

This topic defines what roles, role services, and features are, and how they are integrated in your enterprise.

What are server roles, role services, and features?

This section defines the terms role, role service, and feature as they apply to Windows Server 2008 R2.

Roles

A server role is a set of software programs that, when they are installed and properly configured, lets a computer perform a specific function for multiple users or other computers within a network. Generally, roles share the following characteristics.

  • They describe the primary function, purpose, or use of a computer. A specific computer can be dedicated to perform a single role that is heavily used in the enterprise, or may perform multiple roles if each role is only lightly used in the enterprise.

  • They provide users throughout an organization access to resources managed by other computers, such as Web sites, printers, or files that are stored on different computers.

  • They typically include their own databases that can queue user or computer requests, or record information about network users and computers that relates to the role. For example, Active Directory Domain Services includes a database for storing the names and hierarchical relationships of all computers in a network.

  • As soon as they are properly installed and configured, roles function automatically. This allows the computers on which they are installed to perform prescribed tasks with limited user commands or supervision.

Role services

Role services are software programs that provide the functionality of a role. When you install a role, you can choose which role services the role provides for other users and computers in your enterprise. Some roles, such as DNS Server, have only a single function, and therefore do not have available role services. Other roles, such as Remote Desktop Services, have several role services that can be installed, depending on the remote computing needs of your enterprise.

You can consider a role as a grouping of closely related, complementary role services, for which, most of the time, installing the role means installing one or more of its role services.

Features

Features are software programs that, although they are not directly parts of roles, can support or augment the functionality of one or more roles, or improve the functionality of the server, regardless of which roles are installed. For example, the Failover Clustering feature augments the functionality of other roles, such as File Services and DHCP Server, by allowing them to join server clusters for increased redundancy and improved performance. Another feature, Telnet Client, lets you communicate remotely with a telnet server over a network connection, a functionality that enhances the communication options of the server.


Role, Role Service, and Feature Dependencies in Server Manager

This topic identifies the dependencies that server roles, role services, and features have on other roles, role services, and features in Windows Server® 2008 R2.

Dependencies in Server Manager

As you install roles and prepare to deploy the server, Server Manager prompts you to install any other roles, role services, or features that are required by a role that you want to install. For example, many roles, such as Active Directory Rights Management Services (AD RMS), require Web Server (IIS) to run.

To install and run a program, all programs upon which is depends must also be installed. Some are simply child elements of the role, role service, or feature that is the dependent program. For example, .NET Framework 3.5.1 Features is the parent feature, and Windows Communication Foundation (WCF) Activation is a subfeature of .NET Framework 3.5.1 Features.

Similarly, if you want to remove roles, role services, or features from your computer, messages from Server Manager show you if other programs require the software that you are removing. For example, if you want to remove Web Server (IIS), Server Manager alerts you if other roles that depend on Web Server (IIS) remain on the computer. This complex arrangement of software dependencies is managed by Server Manager and prevents the accidental removal of software that the server requires to perform its assigned tasks. Users are not required to know on what software the roles they want to install depend.

Viewing role, role service, and feature dependencies by using Windows PowerShell

The procedure in this section describes how to use the Server Manager Add-WindowsFeature cmdlet in a Windows PowerShell session to display software that is required by roles, role services, or features that are available in Windows Server 2008 R2. By using the -whatIf parameter, you can view software dependencies without performing an actual installation.

Note

Windows PowerShell cmdlets are not case-sensitive.

To view role, role service, or feature dependencies

  1. Open a Windows PowerShell session with elevated user rights. To do this, click Start, click All Programs, click Accessories, click Windows PowerShell, right-click the Windows PowerShell shortcut, and then click Run as administrator.

  2. Type the following to load the Server Manager module, and then press Enter.

    Import-module ServerManager

  3. If you do not know the command name of the role, role service, or feature for which you want to view dependencies, type the following, and then press Enter. Otherwise, go on to the next step.

    Get-WindowsFeature

    Command names for roles, role services, and features are displayed in the Name column of the results.

  4. Type the following, and then press Enter to run the Add-WindowsFeature cmdlet in -whatIf mode.

    Add-WindowsFeature name -whatIf

    In -whatIf mode, installation does not occur, but the roles, role services, or features upon which the specified role, role service, or feature depends are displayed as output.

    You can show the dependencies for multiple roles, role services, and features by separating the command names of roles, role services, and features with commas, as shown in the following example.

    Add-WindowsFeature Application-Server,Hyper-V -whatIf

    The roles, role services, and features upon which your specified features depend to run are shown in the cmdlet results.

See Also

  • Roles, Role Services, and Features


Adding Server Roles and Features

Windows Server® 2008 R2 eases managing and securing multiple server roles in an enterprise with the Server Manager console. Server Manager in Windows Server 2008 R2 provides a single source for managing a server's identity and system information, displaying server status, identifying problems with server role configuration, and managing all roles installed on the server.

How Server Manager streamlines server administration

Server Manager makes server administration more efficient by allowing administrators to do the following by using a single tool:

  • View and make changes to server roles and features installed on the server.

  • Perform management tasks associated with the operational life cycle of the server, such as starting or stopping services, and managing local user accounts.

  • Perform management tasks associated with the operational life cycle of roles installed on the server. This includes scanning roles for compliance with best practices.

  • Determine server status, identify critical events, and analyze and troubleshoot configuration issues or failures.

The Add Roles Wizard

The Add Roles Wizard simplifies how you install roles on the server, and lets you install multiple roles at one time. Earlier versions of the Windows operating system required administrators to run Add or Remove Windows Components multiple times to install all the roles, role services, and features that are needed on a server. Server Manager replaces Add or Remove Windows Components, and a single session in the Add Roles Wizard can complete the configuration of the server.

The Add Roles Wizard verifies that all the software components that are required by a role install with any role that you select in the wizard. If it is necessary, the wizard prompts you to approve the installation of other roles, role services, or software components that are required by roles that you select.

Most roles and role services that are available for installation require you to make decisions during the installation process that determine how the role operates in your enterprise. Examples include Active Directory® Federation Services (ADFS), which requires the installation of a certificate; or Domain Name System (DNS), which requires you to provide a fully qualified domain name (FQDN).

Before you install a role on the server, we recommend that you read documentation specific to the planning, deployment and operation of the role, available on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkID=122006).

How to add roles and features to the server

In Windows Server 2008 R2, you can add roles or features to the server by using any of the following three procedures.

  • To add roles or features by using the Windows interface

  • To add roles or features by using Windows PowerShell

  • To add roles or features by using a command line

To add roles or features by using the Windows interface

  • In the Roles Summary or Features Summary areas of the Server Manager main window, click either Add Roles or Add Features, depending on the software that you want to install.

    -- or --

    In the Customize this server area of the Initial Configuration Tasks window, click either Add Roles or Add Features.

    Notes
    • The Initial Configuration Tasks window opens by default when a member of the Administrators group logs on to the computer.
    • Server Manager opens when the Initial Configuration Tasks window is closed. You can also open Server Manager by using shortcuts on the Start menu, on the Windows taskbar, or in Administrative Tools.
To add roles or features by using Windows PowerShell

  1. Open a Windows PowerShell session with elevated user rights. To do this, click Start, click All Programs, click Accessories, click Windows PowerShell, right-click the Windows PowerShell shortcut, and then click Run as administrator.

  2. Load the Server Manager module into the Windows PowerShell session before working with Server Manager cmdlets. Type the following, and then press Enter.

    Import-Module Servermanager

    Note

    Windows PowerShell cmdlets are not case-sensitive.

  3. If you do not know the command name of the role, role service, or feature that you want to install, type the following, and then press Enter to return a list of all command names in the Name column. The command name is required for the next step.

    Get-WindowsFeature

  4. Type the following, in which name represents the command name of the role, role service, or feature that was obtained in the previous step, and then press Enter to install a role or feature. The -restart parameter restarts the computer automatically after installation is complete, if a restart of the computer is required by the role or feature.

    Add-WindowsFeature name -restart

    You can install multiple roles, role services, and features by using commas to separate the command names, as shown in the following example.

    Add-WindowsFeature Application-Server,Hyper-V,WAS

Note

For detailed information about other parameters that you can use with the Add-WindowsFeature cmdlet, enter Get-Help Add-WindowsFeature -full, or see Overview of Server Manager Commands.

To add roles or features by using a command line

  1. Open a Command Prompt window with elevated user rights. To open an elevated Command Prompt window, click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.

  2. If you do not know the command name of the role, role service, or feature that you want to install, type the following, and then press Enter to return a list of all roles, role services, and features that are available for installation on the computer, together with their command names.

    ServerManagerCmd.exe -query

    Note

    Windows Command Prompt commands are not case-sensitive.

  3. Type the following, in which name represents the command name of the role, role service, or feature that you want to install, and then press Enter.

    ServerManagerCmd.exe -install name -restart

    You can install multiple roles, role services, and features by using spaces to separate the command names, as shown in the following example.

    ServerManagerCmd.exe -install Application-Server Hyper-V WAS -restart

  4. When installation is complete, verify that the roles, role services, and features were installed by typing the following, and then pressing Enter. Installed roles, role services, and features are highlighted in the query results.

    ServerManagerCmd.exe -query

Roles and features available for installation

The following roles and features are available for installation on computers that are running Windows Server 2008 R2.

Note

The roles and features described in this topic may have been updated since this content was published. To check for updates, or learn more about managing roles and features described in this topic, see the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=122006). Some roles and features might not be available on specialized editions of Windows Server 2008 R2.

  • Roles

  • Features

Roles

Role Name Description

Active Directory Certificate Services

Active Directory Certificate Services Active Directory Certificate Services (AD CS) provides customizable services for issuing and managing certificates in software security systems that use public key technologies. You can use AD CS to create one or more certification authorities (CA) to receive certificate requests, verify the information in the requests and the identity of the requester, issue certificates, revoke certificates, and publish certificate revocation data.

Applications supported by Active Directory Certificate Services include Secure/Multipurpose Internet Mail Extensions (S/MIME), secure wireless networks, virtual private networks (VPN), IP security (IPSec), Encrypting File System (EFS), smart card logon, Secure Socket Layer/Transport Layer Security (SSL/TLS), and digital signatures.

Active Directory Domain Services

Active Directory Domain Services (AD DS) stores information about users, computers, and other devices on the network. AD DS helps administrators securely manage this information and facilitates resource sharing and collaboration between users. AD DS is also required to be installed on the network in order to install directory-enabled applications such as Microsoft Exchange Server and for applying other Windows Server technologies such as Group Policy.

Active Directory Federation Services

Active Directory Federation Services (AD FS) provides Web single-sign-on (SSO) technologies to authenticate a user to multiple Web applications that use a single user account. AD FS accomplishes this by securely federating, or sharing, user identities and permissions, in the form of digital claims, between partner organizations.

Active Directory Lightweight Directory Services

Organizations that have applications which require a directory for storing application data can use Active Directory Lightweight Directory Services (AD LDS) as the data store. AD LDS runs as a non-operating-system service. Therefore, AD LDS does not require deployment on a domain controller. Running as a non-operating-system service allows multiple instances of AD LDS to run at the same time on a single server, and each instance can be configured independently for servicing multiple applications.

Active Directory Rights Management Services (AD RMS)

Active Directory Rights Management Services is information protection technology that works with AD RMS -enabled applications to help safeguard digital information from unauthorized use. Content owners can define exactly how a recipient can use the information, such as who can open, change, print, forward, or take other actions with the information. Organizations can create custom usage rights templates such as "Confidential – Read-Only" that can be applied directly to information such as financial reports, product specifications, customer data, and e-mail messages.

Application Server

Application Server provides a complete solution for hosting and managing high-performance distributed business applications. Integrated services, such as the .NET Framework, Web Server Support, Message Queuing, COM+, Windows Communication Foundation, and Failover Clustering support improve productivity throughout the application life cycle, from design and development through deployment and operations.

Dynamic Host Configuration Protocol Server

The Dynamic Host Configuration Protocol (DHCP) allows servers to assign, or lease, IP addresses to computers and other devices that are enabled as DHCP clients. Deploying DHCP servers on the network automatically provides computers and other TCP/IP based network devices with valid IP addresses and the additional configuration parameters these devices need./these are known as DHCP options, which allow them to connect to other network resources, such as DNS servers, WINS servers, and routers.

DNS Server

Domain Name System (DNS) provides a standard method for associating names with numeric Internet addresses. This lets users refer to network computers by using easy-to-remember names instead of a long series of numbers. Windows DNS services can be integrated with DHCP services, eliminating the need to add DNS records as computers are added to the network.

Fax Server

Fax Server sends and receives faxes, and lets you manage fax resources such as jobs, settings, reports, and fax devices on this computer or on the network.

File Services

File Services provides technologies for storage management, file replication, distributed namespace management, fast file searching, and streamlined client access to files, such as UNIX-based client computers.

Hyper-V™

Hyper-V provides the services that you can use to create and manage virtual computing environments and their resources. Virtual computers operate in an isolated operating environment. This lets you to run multiple operating systems at the same time. You can use a virtualized computing environment to improve the efficiency of your computing resources by using more of your hardware resources.

Network Policy and Access Services

Network Policy and Access Services delivers many different methods to give users local and remote network connectivity, to connect network segments, and to allow network administrators to centrally manage network access and client health policies. With Network Access Services, you can deploy VPN servers, dial-up servers, routers, and 802.11-protected wireless access. You can also deploy RADIUS servers and proxies, and use Connection Manager Administration Kit to create remote access profiles to let client computers to connect to the network.

Print and Document Services

Print and Document Services enables you to centralize print server and network printer management tasks. With this role, you can also receive scanned documents from network scanners, and route the documents to a shared network resource, a Windows SharePoint Services site, or to e-mail addresses.

Remote Desktop Services

Remote Desktop Services provides technologies that enable users to access Windows-based programs that are installed on a remote desktop server, or to access the Windows desktop itself, from almost any computing device. Users can connect to a remote desktop server to run programs and to use network resources on that server.

Web Server (IIS)

The Web Server (IIS) role in Windows Server 2008 R2 lets you share information with users on the Internet, an intranet, or an extranet. Windows Server 2008 R2 delivers IIS 7.5, a unified Web platform that integrates IIS, ASP.NET, and Windows Communication Foundation.

Windows Deployment Services

You can use Windows Deployment Services to install and configure remotely Windows operating systems on computers that have Pre-boot Execution Environment (PXE) boot ROMs. Administration overhead is decreased through the implementation of the WdsMgmt Microsoft Management Console (MMC) snap-in that manages all aspects of Windows Deployment Services. Windows Deployment Services also provides end-users an experience consistent with Windows Setup.

Windows Server Update Services

Windows Server Update Services allows network administrators to specify the Microsoft updates that should be installed, to create separate groups of computers for different sets of updates, and to obtain reports on the compliance levels of the computers and on the updates that must be installed.

Features

Feature | Description
.NET Framework 3.5.1 | The .NET Framework 3.5.1 builds incrementally on the features added in the .NET Framework 3.0, such as enhancements to Windows Workflow Foundation (WF), Windows Communication Foundation (WCF), Windows Presentation Foundation (WPF) and Windows CardSpace.
Background Intelligent Transfer Service | Background Intelligent Transfer Service (BITS) asynchronously transfers files in the foreground or background, throttles the transfers to preserve the responsiveness of other network applications, and automatically resumes file transfers after network connection failures or computer restarts.
BitLocker Drive Encryption | BitLocker Drive Encryption helps protect data on lost, stolen or inappropriately decommissioned computers by encrypting the volume and checking the integrity of early boot components. Data is only decrypted if those components are successfully verified and the encrypted drive is located in the original computer. Integrity checking requires a compatible trusted platform module (TPM).
BranchCache | BranchCache, available on both Windows Server 2008 R2 and Windows 7, enables client computers in a branch office to retrieve content securely and locally, instead of retrieving it from a central office server. Because branch offices are typically connected over slower WAN links, BranchCache reduces WAN traffic, and increases application responsiveness on the client computer.
Connection Manager Administration Kit | Connection Manager Administration Kit (CMAK) generates Connection Manager profiles.
Desktop Experience | Desktop Experience includes features of Windows® 7, such as Windows Media Player, desktop themes, and photo management. Desktop Experience does not enable any of the Windows 7 features by default. You must manually enable them.
Direct Access Management Console | Direct Access Management Console provides direct access setup and monitoring.
Failover Clustering | Failover Clustering allows multiple servers to work together to provide high availability of services and applications. Failover Clustering is frequently used for file and print services, database and mail applications.
Group Policy Management | Group Policy Management makes it easier to deploy, manage, and troubleshoot Group Policy implementations. The standard tool is Group Policy Management Console (GPMC), a scriptable Microsoft Management Console (MMC) snap-in that provides a single administrative tool for managing Group Policy across the enterprise.
Ink and Handwriting Services | Ink and Handwriting Services, new for Windows Server 2008 R2, provides support for handwriting recognition in multiple languages, together with support for using a pen or stylus with a pressure-sensitive computing interface, such as a tablet computer.
Internet Printing Client | Internet Printing Client enables users to connect and print to printers on the local network or over the Internet by using Internet Printing Protocol (IPP). You can use the Internet Printing Client and IPP to connect to the shared printer by using a Web browser (if the print server has the Internet Printing role service installed), or by using the Network Printer Installation Wizard.
Internet Storage Name Server | Internet Storage Name Server (iSNS) provides discovery services for iSCSI storage area networks. iSNS processes registration requests, deregistration requests, and queries from iSNS clients.
LPR Port Monitor | Line Printer Remote (LPR) Port Monitor allows users who have access to UNIX-based computers to print on devices attached to them.
Message Queuing | Message Queuing provides guaranteed message delivery, efficient routing, security, and priority-based messaging between applications. Message Queuing also accommodates message delivery between applications that run on different operating systems, use dissimilar network infrastructures, are temporarily offline, or that are running at different times.
Multipath I/O | Multipath I/O (MPIO), together with the Microsoft Device Specific Module (DSM) or a third-party DSM, provides support for using multiple data paths to a storage device on Windows.
Network Load Balancing | Network Load Balancing (NLB) distributes traffic across several servers, by using the TCP/IP networking protocol. NLB is especially useful for ensuring that stateless applications, such as a Web server that is running IIS, are scalable by adding additional servers as the load increases.
Peer Name Resolution Protocol | Peer Name Resolution Protocol (PNRP) allows applications to register on and resolve names from your computer, so that other computers can communicate with these applications.
Quality Windows Audio Video Experience (qWave) | Quality Windows Audio Video Experience (qWave) is a networking platform for audio and video (AV) streaming applications on IP-based home networks. qWave improves AV streaming performance and reliability by ensuring network quality-of-service for AV applications. It provides admission control, run time monitoring and enforcement, application feedback, and traffic prioritization. On Windows Server platforms, qWave provides only rate-of-flow and prioritization services.
Remote Assistance | Remote Assistance enables you (or a support person) to offer assistance to users who have computer issues or questions. Remote Assistance lets you view and share control of the user’s desktop in order to troubleshoot and fix the issues. Users can also ask for help from friends or co-workers.
Remote Differential Compression | The Remote Differential Compression (RDC) feature is a set of APIs that applications can use to determine whether a set of files have changed, and if that is the case, to detect which sections of the files contain the changes.
Remote Server Administration Tools | Remote Server Administration Tools enables remote management of Windows Server 2008 and Windows Server 2008 R2 from a computer running Windows Server 2008 R2 by allowing you to run some of the management tools and snap-ins for roles, role services, and features on a remote computer.
RPC Over HTTP Proxy | RPC Over HTTP Proxy is a proxy that is used by objects that receive remote procedure calls (RPC) over HTTP. This proxy allows clients to discover these objects even if the objects are moved between servers or if they exist in discrete areas of the network, usually for security reasons.
Services for Network File System | Services for Network File System (NFS) is a protocol that acts as a distributed file system, allowing a computer to access files over a network as easily as if they were on its local disks. This feature is available for installation in Windows Server 2008 R2 for Itanium-based Systems only; in other versions of Windows Server 2008 R2, Services for NFS is available as a role service of the File Services role.
Simple TCP/IP Services | Simple TCP/IP Services supports the following TCP/IP services: Character Generator, Daytime, Discard, Echo, and Quote of the Day. Simple TCP/IP Services is provided for backward compatibility and should not be installed unless it is required.
SMTP Server | Simple Mail Transfer Protocol (SMTP) Server supports the transfer of e-mail messages between e-mail systems.
SNMP Services | Simple Network Management Protocol (SNMP) is the Internet standard protocol for exchanging management information between management console applications—such as HP Openview, Novell NMS, IBM NetView, or Sun Net Manager—and managed entities. Managed entities can include hosts, routers, bridges, and hubs.
Storage Manager for SANs | Storage Manager for Storage Area Networks (SANs) helps you create and manage logical unit numbers (LUNs) on Fibre Channel and iSCSI disk drive subsystems that support Virtual Disk Service (VDS) in your SAN.
Subsystem for UNIX-based Applications | Subsystem for UNIX-based Applications (SUA), together with a package of support utilities available for download from the Microsoft Web site (http://go.microsoft.com/fwlink/?LinkID=139521), enables you to run UNIX-based programs, and compile and run custom UNIX-based applications in the Windows environment.
Telnet Client | Telnet Client uses the Telnet protocol to connect to a remote telnet server and run applications on that server.
Telnet Server | Telnet Server allows remote users, such as those running UNIX-based operating systems, to perform command-line administration tasks and run programs by using a telnet client.
Trivial File Transfer Protocol Client | Trivial File Transfer Protocol (TFTP) Client is used to read files from, or write files to, a remote TFTP server. TFTP is primarily used by embedded devices or systems that retrieve firmware, configuration information, or a system image during the boot process from a TFTP server.
Windows Biometric Framework | Windows Biometric Framework (WBF) allows fingerprint devices to be used to identify and verify identities, and to log on to Windows. WBF includes sub features that are required to let you use fingerprint devices.
Windows Internal Database | Windows Internal Database is a relational data store that can be used only by Windows roles and features, such as AD RMS, Windows Server Update Services, and Windows System Resource Manager.
Windows Process Activation Service | Windows Process Activation Service (WAS) generalizes the IIS process model, removing the dependency on HTTP. All the features of IIS that were previously available only to HTTP applications are now available to applications hosting Windows Communication Foundation (WCF) services by using non-HTTP protocols. IIS 7.5 also uses WAS for message-based activation over HTTP.
Windows Server Backup Features | Windows Server Backup Features allow you to back up and recover your operating system, applications, and data. You can schedule backups to run one time each day or more frequently, and can protect the complete server or specific volumes.
Windows Server Migration Tools | Windows Server Migration Tools lets an administrator migrate some server roles, features, operating system settings, shares, and other data from computers that are running certain editions of Windows Server 2003, Windows Server 2008, or Windows Server 2008 R2 to computers that are running Windows Server 2008 R2. For more information about Windows Server Migration Tools and migrating roles, features, or other data to Windows Server 2008 R2, see the Windows Server Migration Portal (http://go.microsoft.com/fwlink/?LinkID=128554).
Windows System Resource Manager | Windows System Resource Manager (WSRM) is a Windows Server operating system administrative tool that can control how CPU and memory resources are allocated. Managing resource allocation improves system performance and lowers the risk that applications, services, or processes will interfere with one another to reduce server efficiency and system response.
WinRM IIS Extension | Windows Remote Management (WinRM) IIS Extension enables a server to receive a management request from a client computer by using the WS-Management protocol. WinRM is the Microsoft implementation of the WS-Management protocol. This helps secure communication between local and remote computers by using Web-based services.
Windows Internet Name Service Server | Windows Internet Name Service (WINS) Server provides a distributed database for registering and querying dynamic mappings of NetBIOS names for computers and groups used on the network. WINS maps NetBIOS names to IP addresses and solves the problems arising from NetBIOS name resolution in routed environments.
Windows Internal Database | Windows Internal Database is a relational data store that can be used only by Windows roles and features, such as Active Directory Rights Management Services (AD RMS), Windows Server Update Services, and Windows System Resource Manager.
Windows PowerShell Integrated Scripting Environment (ISE) | Windows PowerShell ISE is a graphical host application for Windows PowerShell. Windows PowerShell ISE lets you run commands, and write, edit, run, test, and debug scripts in an environment that displays syntax in colors and that supports Unicode.
Windows TIFF iFilter | Windows Tagged Image File Format (TIFF) iFilter uses optical character recognition (OCR) software to enable users to search for TIFF documents based on textual content in the images.
Wireless LAN Service | Wireless LAN (WLAN) Service configures and starts the WLAN AutoConfig service, regardless of whether the computer has any wireless adapters. WLAN AutoConfig enumerates wireless adapters, and manages both wireless connections and the wireless profiles that contain the settings required to configure a wireless client to connect to a wireless network.
XPS Viewer | An XML Paper Specification (XPS) document is a document format that you can use to view, save, share, digitally sign, and protect your document’s content. You can use XPS viewer to view, search, set permissions for, and digitally sign XPS documents.

See Also

  • Overview of Server Manager Commands


Removing Server Roles and Features

Tools in Windows Server® 2008 R2 let you remove server roles and features with ease. You can remove roles or features by using the Remove Roles or Remove Features wizards, Windows PowerShell, or a command line.

How to remove roles or features from the server

In Windows Server 2008 R2, you can remove roles or features from the server by using any of the following three procedures.

  • To remove roles or features by using the Windows interface

  • To remove roles or features by using Windows PowerShell

  • To remove roles or features by using a command line

To remove roles or features by using the Windows interface

  • In the Roles Summary or Features Summary areas of the Server Manager main window, click either Remove Roles or Remove Features, depending on the software that you want to remove. Follow the instructions that are provided by the wizard as you progress through the removal.
To remove roles or features by using Windows PowerShell

  1. Open a Windows PowerShell session with elevated user rights. To do this, click Start, click All Programs, click Accessories, click Windows PowerShell, right-click the Windows PowerShell shortcut, and then click Run as administrator.

  2. Load the Server Manager module into the Windows PowerShell session before working with Server Manager cmdlets. Type the following, and then press Enter.

    Import-Module Servermanager

    Note

    Windows PowerShell cmdlets are not case-sensitive.

  3. If you do not know the command name of the role, role service, or feature that you want to remove, type the following, and then press Enter to return a list of all command names in the Name column. The command name is required for the next step.

    Get-WindowsFeature

  4. Type the following, in which name represents the command name of the role, role service, or feature that was obtained in the previous step, and then press Enter to remove a role or feature. The -restart parameter restarts the computer automatically after removal is complete, if a restart of the computer is required.

    Remove-WindowsFeature name -restart

    You can remove multiple roles, role services, and features by using commas to separate the command names, as shown in the following example.

    Remove-WindowsFeature Application-Server,Hyper-V,WAS

Note

For detailed information about other parameters that you can use with the Remove-WindowsFeature cmdlet, enter Get-Help Remove-WindowsFeature -full, or see Overview of Server Manager Commands.
To remove roles or features by using a command line

  1. Open a Command Prompt window with elevated user rights. To open an elevated Command Prompt window, click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.

  2. If you do not know the command name of the role, role service, or feature that you want to remove, type the following, and then press Enter to return a list of all roles, role services, and features that are available on the computer, together with their command names.

    ServerManagerCmd.exe -query

    Note

    Windows Command Prompt commands are not case-sensitive.

  3. Type the following, in which name represents the command name of the role, role service, or feature that you want to remove, and then press Enter. The -restart parameter restarts the computer automatically after removal is complete, if a restart of the computer is required.

    ServerManagerCmd.exe -remove name -restart

    You can remove multiple roles, role services, and features by using spaces to separate the command names, as shown in the following example.

    ServerManagerCmd.exe -install Application-Server Hyper-V WAS -restart

  4. When removal is complete, verify that the roles, role services, and features were removed from the computer by typing the following, and then pressing Enter. Installed roles, role services, and features are highlighted in the query results.

    ServerManagerCmd.exe -query

The Remove Roles Wizard

The Remove Roles Wizard simplifies the removal of roles from your server, and allows you to remove multiple roles at one time. You no longer have to open Add or Remove Windows Components multiple times to remove more than one role, role service, or feature installed on the server. A single session in the Remove Roles Wizard can complete the configuration of the server.

Before removing any roles, the Remove Roles Wizard verifies that no software components that are required by any of the remaining roles are removed accidentally. If it is necessary, the wizard prompts you to approve the removal of other roles, role services, or software programs that are required by roles that remain installed. The risk of removing software upon which other roles depend is almost eliminated.

See Also

  • Overview of Server Manager Commands


The Server Manager Main Window

The Server Manager main window lets you view a detailed snapshot of the server's identity information, selected security configuration options, and installed roles and features.

The Resources and Support area of the Server Manager main window contains links that help you keep connected to the latest documentation and downloads, and let you participate in feedback programs that help improve future versions of Windows Server.

The Server Summary area

The Server Summary area displays details about the server that are especially useful during troubleshooting, such as the computer's name and network addresses, and the product ID of the operating system that is running on the computer.

From the Server Summary area, you can activate this copy of Windows, view and change network connections, change system properties, and enable and configure Remote Desktop.

The Server Summary area contains the following collapsible sub-sections:

  • Computer Information

  • Security Information

Computer Information

The following table describes the information that is shown in the Computer Information section.

Field Text | Data Description
Full computer name: | Fully qualified domain name (FQDN) of target server
Domain (or Workgroup if the computer is not domain-joined): | Primary Domain Name System (DNS) suffix
<network connection name 1>: | IP address
<network connection name 2>: | IP address
<network connection name 3>: | IP address
Remote Desktop status | Shows whether Remote Desktop connections are enabled or disabled; that is, whether remote computers that are running Remote Desktop can connect to this computer.
Server Manager Remote Management | Shows whether other computers that are running Windows Server 2008 R2 can be used to manage this computer by using Server Manager.
Product ID (if activated): | Shows the activation status for this copy of Windows. Not activated is displayed if an administrator has not provided the product key associated with this copy of Windows, or has provided a product key, but not yet activated Windows either online or by telephone. Activated is displayed, together with the Windows product ID, if an administrator has provided the correct Windows product key and activated the operating system. To activate Windows, click Activate Windows in the Actions list at the right side of the Computer Information area.

The Do not show me this console at logon check box in the Computer Information section lets administrators prevent Server Manager from opening automatically when they log on to the computer, if they do not need to see Server Manager at every logon. This behavior can also be controlled by the Group Policy setting Local Computer Policy/Computer Configuration/Administrative Templates/System/Server Manager/Do not display Server Manager automatically at logon.

Security Information

The following table describes the information that is shown in the Security Information section.

Field Text | Data Description
Windows Firewall status | Shows whether Windows Firewall is enabled on the server.
Windows Update status | Shows whether the server is configured to download and install Windows software updates automatically
Last checked for updates | Shows the most recent day and time that the server has checked for software updates.
Last installed updates | Shows the most recent day and time that automatic software updates were installed.
Internet Explorer Enhanced Security Configuration (ESC) | Shows whether Internet Explorer Enhanced Security Configuration is enabled for both members of the Administrators group and for other users.

Commands in this section let you change your Windows Firewall, Windows automatic updating, and Internet Explorer Enhanced Security Configuration settings. You can also search Windows Update for new roles to download and install by clicking Check for New Roles.

From the Security Information area, you can also start the Security Configuration Wizard that helps you create a security policy that can be applied to any server on the network. For more information about completing the Security Configuration Wizard, see Security Configuration Wizard documentation available at the Windows Server TechCenter (http://go.microsoft.com/fwlink/?LinkId=91742).

The Roles Summary area

The Roles Summary area of the Server Manager main window shows a list of all roles that are installed on the computer. The names of roles installed on the computer are displayed as hypertext; clicking a role name opens the Server Manager home page for managing the role.

To install additional roles, or remove existing roles, click the appropriate command in the right side margin of the Roles Summary area.

The Go to Manage Roles command in this section opens the Roles home page, on which you can find more detail about installed roles, such as which role services for the role are installed, the role's operational status, and whether event messages about the role are available to read.

For more information about the Roles home page, see Role Home Pages.

The Features Summary area

The Features Summary area of the Server Manager home page header shows a list of all features that are installed on the computer.

To install additional features, or remove existing features, click the appropriate command in the right side margin of the Features Summary area.

Adding and Removing Roles and Features

For information about how to add and remove roles, role services, and features, see Adding Server Roles and Features and Removing Server Roles and Features.


Server Manager and the Security Configuration Wizard

Although role, role service, and feature installations completed in Server Manager are secure by default, you can use the Security Configuration Wizard (SCW) to customize the security of roles, role services, and features in your enterprise.

How Server Manager works with the Security Configuration Wizard

Server Manager and SCW are similar in that they both use the same processes to accomplish the following tasks.

  • Server Manager and SCW both use the same Windows process to determine what roles, role services, and features are installed on a computer and are available for installation.

  • Server Manager and SCW both use the same default policies for services and firewall exceptions.

  • Both Server Manager and SCW use the same tools to determine how roles, role services, and features are dependent upon other roles, role services, and features to run.

Server Manager and SCW are complementary technologies in several ways, as described in the following sections. The focus of Server Manager is on shortening the amount of time it requires to deploy and repurpose servers, and enabling administrators to manage the typical daily operations of roles, role services, and features. SCW, by contrast, aids in the long-term prevention of events, user behaviors, and vulnerabilities that can lead to security failures such as unauthorized access to data.

Policy authoring

SCW allows administrators to define role-based security policies that can be applied to remote computers throughout an enterprise. Server Manager secures roles by default, and takes steps to ensure that remaining roles, role services, and features are secure after removing a role, role service, or feature from the computer, but administrators cannot use Server Manager directly to make custom security changes.

Auditing

SCW allows administrators to compare the current state of a computer's security to existing security policy to ensure policy compliance.

Although Server Manager can display Windows security logs by interfacing with Event Viewer, and show security options selected by administrators (such as whether Windows Firewall and Windows Update are enabled), Server Manager itself does not verify the security of roles, role services, and features after they are installed.

Security hardening

SCW enables fine-grained control over a computer's attack surface, and provides administrators with a scaled ability to harden a computer against attacks based on the security needs of their organization. Server Manager allows administrators to install roles, role services, and features that are secure by default and ready for deployment. In most cases, administrators do not need to run SCW to begin working with roles, role services, and features.

External roles, role services, and features

Server Manager can be used to manage only roles, role services, and features that are included on the Windows Server 2008 product disc. SCW can be used to secure both roles, role services, and features that are included with Windows Server 2008, and those roles, role services, and features not available for installation on the product disc, such as Microsoft SQL Server and Microsoft Exchange Server.

Extensibility

Server Manager cannot be used to install or create third-party roles, role services, and features. SCW offers a public schema for third-party software manufacturers to define new roles, role services, and features that can be secured by using SCW.

Additional references

For more information about the Security Configuration Wizard, see the Security Configuration Wizard Help, scwhelp.chm.


Roles Summary

The Roles Summary section

The Roles Summary section lists roles that are installed on the computer in alphabetical order. To the left of each role is an icon that displays the current general operational status of the role.

Clicking the name of the role in the Roles Summary section opens the home page for that role.

Commands in the margin of the Roles Summary section allow you to open the Roles page, add more roles, or remove installed roles.

Adding and Removing Roles

For information about how to add and remove roles, see Adding Server Roles and Features and Removing Server Roles and Features.


Resources and Support

The Resources and Support section

The Resources and Support section of the Server Manager main window contains commands you can use to change your participation status in the Windows Server® 2008 feedback programs Customer Experience Improvement Program (CEIP) and Windows Error Reporting (WER).

For more information about participating in these programs, see Customer Experience Improvement Program and Windows Error Reporting.

You can find more assistance with managing and deploying your server by visiting the Windows Server® 2008 TechCenter Web site, a link to which is provided in the Resources and Support section.


Features Summary

In Windows Server® 2008, the Features Summary area includes a table listing installed features, and provides command links to add and remove features.

The Features Summary area

The Features Summary area of the Server Manager home page header shows a list of all features that are installed on the computer.

To install additional features, or remove existing features, click the appropriate command in the right margin of the Features Summary area.

Adding and Removing Features

For information about how to add and remove features, see Adding Server Roles and Features and Removing Server Roles and Features.


Customer Experience Improvement Program

Customer Experience Improvement Program

You can help Microsoft improve the quality, reliability, and performance of its operating systems by participating in the Microsoft Customer Experience Improvement Program.

If you accept, Microsoft Corporation collects statistical information about your system configuration, the performance of some components of Windows, and certain types of events. Windows periodically uploads a small file to Microsoft that contains a summary of the information collected. The file is transmitted by using the Internet.

The uploaded data contains no information that identifies you or your company. There are no surveys to complete, and it all happens automatically—you’re never interrupted. You should experience no loss in performance. If your computer is not connected to the Internet, the data is discarded. Microsoft does not share this information with other companies; it is used only by Microsoft in aggregate form for the purpose of improving our software for our customers.

To participate, follow the procedure in To enable the Customer Experience Improvement Program.

If you do not want to participate, follow the procedure in To disable the Customer Experience Improvement Program.

To enable the Customer Experience Improvement Program

You can enable the Customer Experience Improvement Program by using either Server Manager or Initial Configuration Tasks.

To enable the Customer Experience Improvement Program by using Server Manager

To enable the Customer Experience Improvement Program by using Initial Configuration Tasks

To enable the Customer Experience Improvement Program by using Server Manager

Perform the following steps to participate in the Customer Experience Improvement Program by using Server Manager.

To enable CEIP by using Server Manager

  1. Click Start.

  2. Go to Administrative Tools, and click Server Manager.

  3. On the Server Manager home page, expand the Resources and Support area if it is not already open.

  4. Click Configure CEIP to open the Customer Experience Improvement Program Configuration dialog box.

  5. Select Yes, I want to participate in the CEIP. Click OK.

To enable the Customer Experience Improvement Program by using Initial Configuration Tasks

Perform the following steps to participate in the Customer Experience Improvement Program by using Initial Configuration Tasks.

To enable CEIP by using Initial Configuration Tasks

  1. In the Update This Server section of the Initial Configuration Tasks window, click Enable automatic updating and feedback.

  2. On the Enable Windows Automatic Updating and Feedback dialog box, do one of the following.

    • Click Enable Windows automatic updating and feedback to participate in both the Customer Experience Improvement Program and Windows Error Reporting. Click Close. You have completed the procedure.

    • Click Manually configure settings to participate in only the Customer Experience Improvement Program or to change settings.

  3. If you selected Manually configure settings in the previous step, click Change Setting in the Customer Experience Improvement Program area of the Manually Configure Settings dialog box.

  4. On the Customer Experience Improvement Program Configuration dialog box, select Yes, I want to participate in the CEIP. Click OK.

To disable the Customer Experience Improvement Program

You can disable participation in the Customer Experience Improvement Program by using either Server Manager or Initial Configuration Tasks.

To disable the Customer Experience Improvement Program by using Server Manager

To disable the Customer Experience Improvement Program by using Initial Configuration Tasks

To disable the Customer Experience Improvement Program by using Server Manager

Perform the following steps in Server Manager if you do not want to participate in the Customer Experience Improvement Program.

To disable CEIP by using Server Manager

  1. Click Start, point to Administrative Tools, and then click Server Manager.

  2. On the Server Manager home page, expand the Resources and Support area if it is not already open.

  3. Click Configure CEIP to open the Customer Experience Improvement Program Configuration dialog box.

  4. Select No, I don't want to participate. Click OK.

To disable the Customer Experience Improvement Program by using Initial Configuration Tasks

Perform the following steps in Initial Configuration Tasks if you do not want to participate in the Customer Experience Improvement Program.

To disable CEIP by using Initial Configuration Tasks

  1. In the Update This Server section of the Initial Configuration Tasks window, click Enable automatic updating and feedback.

  2. On the Enable Windows Automatic Updating and Feedback dialog box, click Manually configure settings.

  3. Click Change Setting in the Customer Experience Improvement Program area of the Manually Configure Settings dialog box.

  4. On the Customer Experience Improvement Program Configuration dialog box, select No, I don't want to participate. Click OK.

Customer Experience Improvement Program Profile

If you participate in CEIP, you can add a profile that tells Microsoft more about the type of computing enterprise in which your server is deployed. Adding a profile is optional, but it provides richer data that helps Microsoft provide better solutions for your specific enterprise type.

Perform the following steps if you want to add a profile.

To add a CEIP profile

  1. In the Customer Experience Improvement Program Configuration dialog box, select the Yes, I want to participate Windows Server CEIP option.

  2. Use the drop-down menus to select the values that best represent your enterprise, and then click OK.

    • Number of servers your organization has worldwide. Select the numeric range that most accurately represents your organization's server count.

    • Number of desktop and portable PCs your organization has worldwide. Select the numeric range that most accurately represents your organization's combined desktop and laptop computer count.

    • Industry that best represents your organization. If your organization's industry is not closely represented by the options, select Other Services.

See Also

  • Windows Error Reporting
  • The Server Manager Main Window


Windows Error Reporting

Windows Error Reporting

By using Windows Error Reporting, Windows can send descriptions of problems on your server to Microsoft and look for steps you can take to solve them. Windows Error Reporting is enabled by default.

If you choose to send generic information automatically about a problem, Microsoft will send back either the most current solution or use the information to start working on a solution.

Read more about how your information is protected by our privacy policy at the Microsoft Online Crash Analysis Web site.

Windows Error Reporting advanced options

On the Windows Error Reporting Configuration dialog box, the following two options disable Windows Error Reporting:

  • I don't want to participate, and don't ask me again

    This option disables Windows Error Reporting, and prevents it from prompting you to send information about application failures to Microsoft.

  • Ask me about sending reports every time an error occurs

    This option disables Windows Error Reporting, but allows it to prompt you to send information about application failures to Microsoft whenever a failure occurs.

The following two options enable Windows Error Reporting. Each option provides a different level of detail in the information sent to Microsoft when failures occur.

  • Yes, automatically send detailed reports. Notify me if there are possible solutions to the problem.

    When this option is selected, if an application failure occurs, detailed reports are automatically sent to Microsoft. Portions of documents you were working on at the moment a program failed, or data you provided to Web sites or forms may be included in these reports. The contents of log files, and portions of the registry, may also be sent to Microsoft.

  • Yes, automatically send summary reports. Notify me if there are possible solutions to the problem.

    When this option is selected, if an application failure occurs, only non-personal data is sent to Microsoft. Data about your computer's configuration, the program in which you were working, and any operations that triggered the failure is sent to Microsoft.

How to enable Windows Error Reporting

In Windows Server® 2008 R2, you can enable Windows Error Reporting in the following ways:

To enable Windows Error Reporting by using the Initial Configuration Tasks window

To enable Windows Error Reporting by using Server Manager

To enable Windows Error Reporting by using Initial Configuration Tasks

  1. If the Initial Configuration Tasks window is not already open, you can open it by clicking Start, clicking Run, typing oobe in the text box, and then clicking OK.

  2. Click Enable automatic updating and feedback in the Update This Server area.

  3. Click Manually configure settings.

  4. In the Windows Error Reporting area of the Manually Configure Settings dialog box, click Change Setting.

  5. On the Windows Error Reporting Configuration dialog box, select one of the following options described in the previous section, and then Click OK.

    • Yes, automatically send detailed reports

    • Yes, automatically send summary reports

  6. On the Manually Configure Settings dialog box, click Close.
To enable Windows Error Reporting by using Server Manager

  1. Open Server Manager by clicking Start, pointing to Administrative Tools, and then clicking Server Manager.

  2. On the Server Manager home page, expand the Resources and Support area if it is not already open.

  3. Click Configure Windows Error Reporting.

  4. On the Windows Error Reporting Configuration dialog box, select one of the following options, described in the previous section, and then Click OK.

    • Yes, automatically send detailed reports

    • Yes, automatically send summary reports

How to disable Windows Error Reporting

In Windows Server 2008 R2, you can disable Windows Error Reporting in either of the following ways:

To disable Windows Error Reporting by using the Initial Configuration Tasks window

To disable Windows Error Reporting by using Server Manager

You can also enable or disable Windows Error Reporting by configuring its behavior by using Group Policy. Use the Local Group Policy Editor when editing Local Group Policy or, use the Group Policy Management console when editing domain-based Group Policy. You can locate these policy settings in Administrative Templates/Windows Components/Windows Error Reporting.

To disable Windows Error Reporting by using Initial Configuration Tasks

  1. If the Initial Configuration Tasks window is not already open, you can open it by clicking Start, clicking Run, typing oobe in the text box, and then clicking OK.

  2. Click Enable automatic updating and feedback in the Update This Server area.

  3. On the Enable Windows Automatic Updating and Feedback dialog box, click Manually configure settings.

  4. In the Windows Error Reporting area of the Manually Configure Settings dialog box, click Change Setting.

  5. On the Windows Error Reporting Configuration dialog box, select one of the following options, and then click OK.

    • I don't want to participate, and don't ask me again

      This option disables Windows Error Reporting, and prevents it from prompting you to send information about application failures to Microsoft.

    • Ask me about sending reports every time an error occurs

      This option disables Windows Error Reporting, but allows it to prompt you to send information about application failures to Microsoft whenever a failure occurs.

  6. On the Manually Configure Settings dialog box, click Close.
To disable Windows Error Reporting by using Server Manager

  1. Open Server Manager by clicking Start, pointing to Administrative Tools, and then clicking Server Manager.

  2. On the Server Manager home page, expand the Resources and Support area if it is not already open.

  3. Click Configure Windows Error Reporting.

  4. On the Windows Error Reporting Configuration dialog box, select one of the following options, and then click OK.

    • I don't want to participate, and don't ask me again

      This option disables Windows Error Reporting, and prevents it from prompting you to send information about application failures to Microsoft.

    • Ask me about sending reports every time an error occurs

      This option disables Windows Error Reporting, but allows it to prompt you to send information about application failures to Microsoft whenever a failure occurs.

See Also

  • Customer Experience Improvement Program
  • The Server Manager Main Window


Role Home Pages

The Roles page in Server Manager

The Roles page of the Server Manager console contains a Roles Summary section, followed by collapsible sections added for each role that is installed on the computer.

Roles Summary section

The Roles Summary section lists roles that are installed on the computer in alphabetical order. To the left of each role is an icon that displays the current general operational status of the role.

Clicking the name of the role in the Roles Summary section opens the home page for that role.

Role-specific sections

Role-specific sections of the Roles page contain the following subsections.

Subsection name | Description
Role Status | The Role Status subsection shows if recent error and event messages were logged for the role or any services upon which the role depends. Clicking the links in Role Status opens the role-specific home page.
Role Services | The Role Services subsection lists all available role services, provides a brief description of each, and shows which role services are installed on the server. You can use commands in the right side margin of the Role Services subsection to add or remove role services.

Role-specific home pages

Role-specific home pages provide extensive detail about the operational status of a role, and let you to start role-specific management tasks from Server Manager.

Role-specific home pages include the following sections.

Summary section

The Summary section of a role's home page contains the following subsections.

Section name | Description
Events | The Events section shows event and error messages that were logged for the role within the most recent 24 hours. You can open, view, and filter event messages in this section without opening Event Viewer separately. However, you can also use the Go to Event Viewer command in the right side margin of this section to open Event Viewer if it is necessary.
System Services | The System Services section lists the system services upon which the role depends to run, and provides the status and a description of each service. Commands in the System Services section let you open the Services snap-in, stop, and restart services.
Best Practices Analyzer | Best Practices Analyzer (BPA) can help administrators manage server roles within best practice guidelines by allowing them to scan one or more roles that are installed on Windows Server® 2008 R2 for best practice violations, and view detailed results and problem resolution information. For more information about Best Practices Analyzer, see Best Practices Analyzer.
Role Services | The Role Services section lists all available role services, provides a brief description of each, and shows which role services are installed on the server. You can use commands in the right side margin of the Role Services subsection to add or remove role services.

The Filter Events dialog box

The Filter Events command, located in the margin of the Events section, opens the Filter Events dialog box. Although the Filter Events dialog box lets you filter just as you can by using filtering tools in Event Viewer, this dialog box is unique to the role-specific home pages of Server Manager. Event Viewer filters provide more filtering options and criteria. The Filter Events dialog box in Server Manager provides a subset of Event Viewer filter functionality.

The Filter Events dialog box lets you to display selected events in the Events section of a role's home page based on the following three event properties.

  • Levels Events are tagged with the following levels, depending on the severity of the action or condition that triggered the event message. When all levels are selected, events of all levels are displayed in the Events section of the role home page. By default, all levels are selected so that all levels of events show in the Events area.

    • Information. Indicates that a change in an application or component has occurred, such as an operation has successfully completed, a resource was created, or a service started.

    • Warning. Indicates that an issue has occurred that can affect service or result in a more serious problem if action is not taken.

    • Error. Indicates that a problem has occurred, which might affect functionality that is external to the application or component that triggered the event.

    • Critical. Indicates that a failure has occurred from which the application or component that triggered the event cannot automatically recover.

    Selecting the Verbose level provides the maximum amount of data in event messages.

  • Event IDs You can filter events by ID numbers separated by commas, or a range of numbers separated by a dash. To exclude an event number in a range, enter a dash or minus character (-) in front of the number that you want to exclude.

    Note

    The Levels property overrides other properties on the Filter Events dialog box. For example, if you want to filter events for an Error-level message that has an event ID of 620, but the Error level is not selected in the Levels area, event ID 620 will not be displayed. Similarly, if you have applied a filter in which you selected Information-level events and then specified a 12-hour time period, but no Information-level events were logged for the role in the last 12 hours, the Events list shows no events.

  • Time period This property filters for events that have occurred only within the most recent specified time period. By default, the time period is set to 24 hours.

When you change any of the default settings on the Filter Events dialog box and then click OK, the Events area displays a Filtering Enabled message at the bottom of the list of events. Restoring default settings in the Filter Events dialog box (all levels selected, no event IDs specified, 24-hour time period specified) clears the Filtering Enabled message, disabling filtering.

System Services Preferences

Much like the Filter Events dialog box, the System Services Preferences dialog box in Server Manager includes a subset of the information and settings that are available in the Properties dialog box opened from the Services snap-in. Just as you can by using the Properties dialog box for specific services in the Services snap-in, you can use commands in the margin of the System Services area to start, stop, pause, and restart services associated with the operation of a role.

The Server Manager implementation of the Services Preferences dialog box allows you to monitor in the role's home page the status of services that are required by a role. Services associated with the role's operation are listed in the Preferences dialog box, and you can enable or disable monitoring for each service independently.

Important

Default system services are selected for monitoring in the Preferences dialog box for the optimal continuity of the role's operation. Modifying default monitoring settings, especially turning off monitoring for services that are monitored by default, can result in error conditions or status changes in the role's operation.

Resources and Support section

The Resources and Support section provides guidance for managing the role and configuring the role to perform common and recommended tasks in your enterprise.

The Resources and Support section lists recommended configurations for the role. Selecting a configuration displays a description of each that includes a link to a checklist topic that guides you through the tasks that must be performed to complete the configuration.

You can find more assistance with managing and deploying additional aspects of the role by clicking the links in the margin of the Resources and Support section that connect you to the Help and the Windows Server 2008 R2 TechCenter Web site for the role.


Best Practices Analyzer

In Windows management, best practices are guidelines that are considered the ideal way, under typical circumstances, to configure a server as defined by experts. For example, it is considered a best practice for most server technologies to keep open only those ports required for the technologies to communicate with other networked computers, and block unused ports. Although best practice violations, even crucial ones, are not necessarily problematic, they indicate server configurations that can result in poor performance, poor reliability, unexpected conflicts, increased security risks, or other potential problems.

Best Practices Analyzer (BPA) is a server management tool that is available in Windows Server® 2008 R2. BPA can help administrators reduce best practice violations by scanning one or more roles that are installed on Windows Server 2008 R2, and reporting best practice violations to the administrator. Administrators can filter or exclude results from BPA reports that they do not have to see. Administrators can also perform BPA tasks by using either the Server Manager GUI, or Windows PowerShell cmdlets.

BPA can also be used on remote servers that are running Windows Server 2008 R2, by using Server Manager targeted at a remote server. For more information about how to run Server Manager targeted at a remote server, see Remote Management with Server Manager.

Best Practices Analyzer

BPA is installed by default on all editions of Windows Server 2008 R2 except the Server Core installation option.

Note

Instructions for installing Windows PowerShell, and modules for Server Manager and Best Practices Analyzer on the Server Core installation option of Windows Server 2008 R2 are available in Windows Server Migration Tools Installation, Access, and Removal (http://go.microsoft.com/fwlink/?LinkId=134763).

Because the units analyzed by BPA are server roles, the interface for BPA is located on role home pages in the Server Manager console. For more information about roles, see Roles, Role Services, and Features. Best Practices Analyzer is one of the areas of the Summary section of a role’s home page.

How BPA works

BPA works by measuring a role’s compliance with best practice rules in eight different categories of a role’s effectiveness, trustworthiness, and reliability. Results of measurements can be any of the three severity levels described in the following table.

Severity level | Description
Noncompliant | Noncompliant results are returned when a role does not satisfy the conditions of a rule.
Compliant | Compliant results are returned when a role satisfies the conditions of a rule.
Warning | Warning results are returned when a role is compliant as operating currently, but may not satisfy the conditions of a rule if changes are not made to its configuration or policy settings. For example, a scan of Remote Desktop Services might show a warning result if a license server is unavailable to the role, because even if no remote connections are active at the time of the scan, not having the license server prevents new remote connections from obtaining valid client access licenses.

BPA rule categories

The following table describes the categories of best practice rules against which roles are measured during a BPA scan.

Category Name | Description
Security | Security rules are applied to measure a role’s relative risk for exposure to threats such as unauthorized or malicious users, or loss or theft of confidential or proprietary data.
Performance | Performance rules are applied to measure a role’s ability to process requests and perform its prescribed duties in the enterprise, within expected periods of time given the role’s workload.
Configuration | Configuration rules are applied to identify role settings that might require modification for the role to perform optimally. Configuration rules can help prevent setting conflicts that can result in error messages or prevent the role from performing its prescribed duties in an enterprise.
Policy | Policy rules are applied to identify Group Policy or Windows Registry settings that might require modification for the role to operate optimally and securely.
Operation | Operation rules are applied to identify possible failures of a role to perform its prescribed tasks in the enterprise.
Predeployment | Predeployment rules are applied before an installed role is deployed in the enterprise, to let administrators to evaluate whether best practices were satisfied before you use the role in production.
Postdeployment | Postdeployment rules are applied after all required services have started for a role, and the role is running in the enterprise.
BPA Prerequisites | BPA Prerequisite rules explain configuration settings, policy settings, and features that are required for the role before BPA can apply specific rules from other categories. A prerequisite in scan results indicates that an incorrect setting, a missing role, role service, or feature, an incorrectly enabled or disabled policy, a registry key setting, or other configuration has prevented BPA from applying one or more rules during a scan. A prerequisite result does not imply compliance or noncompliance. It means that a rule could not be applied, and therefore is not part of the scan results.

How to open BPA

You can open BPA in the Server Manager console by opening the home page for a server role that supports BPA.

To open BPA in Server Manager

  1. Open Server Manager. To open Server Manager, click Start, point to Administrative Tools, and then click Server Manager.

  2. In the tree pane, open Roles, and then select the role for which you want to open BPA.

  3. In the details pane, open the Summary section, and then open the Best Practices Analyzer area.

Running BPA

For more information about how to run BPA scans, see Running and Filtering Scans in Best Practices Analyzer in this Help.


Running and Filtering Scans in Best Practices Analyzer

You can run Best Practices Analyzer (BPA) scans either from Server Manager, by using the BPA GUI, or by using cmdlets in Windows PowerShell. BPA cmdlets in Windows PowerShell let you scan one or multiple roles at one time, whereas the BPA GUI allows for scanning a single role at a time. You can also instruct BPA to exclude or ignore scan results that you do not have to view.

In this topic

  • Performing Best Practices Analyzer scans on roles

  • Scanning roles that are running on remote computers

  • Excluding scan results

  • Including scan results

  • Archiving scan results

Performing Best Practices Analyzer scans on roles

You can perform BPA scans on roles by using either the BPA GUI in Server Manager, or by using Windows PowerShell cmdlets.

  • Scanning roles by using the BPA GUI

  • Scanning roles by using Windows PowerShell cmdlets

Scanning roles by using the BPA GUI

Follow these steps to scan a single role in the BPA GUI.

To scan a role by using the BPA GUI

  1. Open Server Manager. To open Server Manager, click Start, point to Administrative Tools, and then click Server Manager.

  2. In the tree pane, open Roles, and then select the role for which you want to open BPA.

  3. In the details pane, open the Summary section, and then open the Best Practices Analyzer area.

  4. Click Scan this Role to start a scan.

Scanning roles by using Windows PowerShell cmdlets

Use the following procedures to scan one or more roles by using Windows PowerShell cmdlets. You must be logged on to the computer as a member of the Administrators group to complete this procedure.

Note

The procedures in this section do not show all BPA cmdlets and parameters. For more information about BPA operations in Windows PowerShell, in your Windows PowerShell session, enter Get-Help BPACmdlet -full, where BPACmdlet can be one of the following values.

  • Get-BPAModel

  • Get-BPAResult

  • Invoke-BPAModel

  • Set-BPAResult

To scan a single role by using Windows PowerShell cmdlets

  1. Open a Windows PowerShell session with elevated user rights. To do this, click Start, click All Programs, click Accessories, click Windows PowerShell, right-click the Windows PowerShell shortcut, and then click Run as administrator.

  2. Import the Server Manager module into your Windows PowerShell session. To import the Server Manager module, type the following, and then press ENTER.

    Import-Module ServerManager

  3. Import the BPA module. Type the following, and then press Enter.

    Import-Module BestPractices

  4. Find the model IDs of all role(s) for which BPA scans can be performed by entering the Get-WindowsFeature cmdlet with the qualifier BestPracticesModelId not equal to “null,” as shown in the following example.

    Get-WindowsFeature | Where {$_.BestPracticesModelId -ne $null}

  5. In the results of step 4, locate the model ID of the role for which you want to perform a BPA scan.

  6. Enter the following command to start the BPA scan for that role.

    Invoke-BPAModel -BestPracticesModelId ModelID_from_Step4

    If a BPA scan can be run on a specified role, you can also start a scan by piping the results of the Get-WindowsFeature cmdlet into the Invoke-BPAModel cmdlet as shown in the following example.

    Get-WindowsFeature Model_Name | Invoke-BPAModel
To scan all roles by using Windows PowerShell cmdlets

  1. Open a Windows PowerShell session with elevated user rights. To do this, click Start, click All Programs, click Accessories, click Windows PowerShell, right-click the Windows PowerShell shortcut, and then click Run as administrator.

  2. Import the Server Manager module into your Windows PowerShell session. To import the Server Manager module, type the following, and then press ENTER.

    Import-Module ServerManager

  3. Import the BPA module. Type the following, and then press Enter.

    Import-Module BestPractices

  4. Pipe all roles for which BPA scans can be performed into the Invoke-BPAModel cmdlet to start scans.

    Get-WindowsFeature | Where {$_.BestPracticesModelId -ne $null} | Invoke-BPAModel

Scanning roles that are running on remote computers

Procedures in this section describe how to perform BPA scans on roles installed on remote computers that are running Windows Server® 2008 R2.

Important

You must be a member of the Administrators group on any remote computers on which you want to perform BPA scans.

To scan a remote role by using the Server Manager GUI

  1. Before you can manage a remote computer by using Server Manager, you must prepare the remote computer by following procedures in Remote Management with Server Manager.

  2. Open Server Manager. To open Server Manager, click Start, point to Administrative Tools, and then click Server Manager.

  3. In the Server Manager tree pane, right-click the Server Manager node, and then click Connect to Another Computer.

  4. On the Connect to Another Computer dialog box, select Another computer, and then browse for or enter the name or IP address of another server that is running Windows Server 2008 R2. Click OK.

  5. In the Server Manager tree pane for the remote computer, open Roles.

  6. Select the role home page for the role on which you want to perform a BPA scan.

  7. In the details pane, open the Summary section, and then expand the Best Practices Analyzer area.

  8. In the Best Practices Analyzer area, click Scan this Role.

  9. When the scan is complete, view scan results by double-clicking a result item on the Noncompliant, Compliant, or All tabs.
To scan a remote role by using Windows PowerShell cmdlets

  1. Before you can manage a remote computer by using Server Manager, you must prepare the remote computer by following procedures in Remote Management with Server Manager.

  2. Open a Windows PowerShell session with elevated user rights. To do this, click Start, click All Programs, click Accessories, click Windows PowerShell, right-click the Windows PowerShell shortcut, and then click Run as administrator.

  3. Type the following, in which ComputerName is the name of the remote computer that is running Windows Server 2008 R2, and UserName is the name of a user who is a member of the Administrators group on the remote computer, and then press Enter.

    Enter-PSSession <ComputerName> -credential <UserName>

  4. You are prompted to enter your password in a secure dialog box. Type your password, and then press Enter.

  5. Import the Server Manager module into your Windows PowerShell session. To import the Server Manager module, type the following, and then press ENTER.

    Import-Module ServerManager

  6. Import the BPA module. Type the following, and then press Enter.

    Import-Module BestPractices

  7. Start a BPA scan by piping the role’s model into the Invoke-BPAModel cmdlet. Type the following, and then press Enter.

    Get-WindowsFeature [Role Name] | Invoke-BpaModel

  8. Type the following, and then press Enter.

    configure-wsman.ps1

  9. Type the following, and then press Enter.

    New-RunSpace

  10. Type the following, and then press Enter.

    Start-PSSession

  11. Start a BPA scan on a role that is running on the remote computer by piping the role’s model into the cmdlet that starts BPA scans, Invoke-BpaModel. Type the following, and then press Enter.

    Get-WindowsFeature [Role Name] | Invoke-BpaModel

  12. Obtain the results of the BPA scan. Type one of the following, and then press Enter.

    • Get-BpaResult [BestPracticeModelID]

    • Get-WindowsFeature [Role Name] | Get-BpaResult

Excluding scan results

Because you might not have to see some scan results, especially if you run frequent scans, you can exclude scan results that you do not want to see or that are not relevant to your scan. Excluded scan results are moved to the Excluded tab of the BPA GUI. They can be included again at any time.

  • Excluding scan results by using the BPA GUI

  • Excluding scan results by using Windows PowerShell cmdlets

Excluding scan results by using the BPA GUI

Follow these steps to exclude scan results by using the BPA GUI.

Note

You must run at least one BPA scan on a role before you can use this procedure.

To exclude scan results by using the BPA GUI

  1. Open Server Manager. To open Server Manager, click Start, point to Administrative Tools, and then click Server Manager.

  2. In the tree pane, open Roles, and then select the role for which you want to open BPA.

  3. In the details pane, open the Summary section, and then open the Best Practices Analyzer area.

  4. Select a result from the Noncompliant, Compliant, or All tabs, and then click Exclude.

  5. To exclude multiple results at one time, hold down the Ctrl key when you select results.

Excluding scan results by using Windows PowerShell cmdlets

You can exclude scan results by using the Set-BPAResult cmdlet with the -Exclude parameter. As in the BPA GUI, you can exclude individual result objects, or you can also exclude a set of results whose fields (category, title, and severity, for example) are equal to or contain specified values. For example, you can exclude all Performance results from a set of scan results for a role.

Note

You must run at least one BPA scan on a role before you can use this procedure.

To exclude scan results by using Windows PowerShell cmdlets

  1. Open a Windows PowerShell session with elevated user rights. To do this, click Start, click All Programs, click Accessories, click Windows PowerShell, right-click the Windows PowerShell shortcut, and then click Run as administrator.

  2. Import the Server Manager module into your Windows PowerShell session. To import the Server Manager module, type the following, and then press ENTER.

    Import-Module ServerManager

  3. Import the BPA module. Type the following, and then press Enter.

    Import-Module BestPractices

  4. Exclude specific results from a role scan by entering the following cmdlet.

    Get-BPAResult -BestPracticesModelId Specified Model Id | Where { $_ Field_Name -eq "Value" } | Set-BPAResult -Id Specified Model Id -Exclude $true

    The previous cmdlet retrieves BPA scan result items for the model ID represented by Specified Model Id. The second section of the command filters the results of the Get-BPAResult cmdlet to retrieve only those scan results for which the value for a result field matches the text in quotation marks. The final section of the cmdlet, following the second pipe character, excludes the results filtered by the previous section of the cmdlet.

Including scan results

When you want to view scan results that were excluded, you can include those scan results.

  • To include scan results by using the BPA GUI

  • To include scan results by using Windows PowerShell cmdlets

Including scan results by using the BPA GUI

In the BPA GUI, you can include any excluded scan results by selecting one or more results on the Excluded tab, and then clicking Include.

To include scan results by using the BPA GUI

  1. Open Server Manager. To open Server Manager, click Start, point to Administrative Tools, and then click Server Manager.

  2. In the tree pane, open Roles, and then select the role for which you want to open BPA.

  3. In the details pane, open the Summary section, and then open the Best Practices Analyzer area.

  4. Select a result from the Excluded tab, and then click Include.

  5. To include multiple results at one time, hold down the Ctrl key when you are selecting results.

Including scan results by using Windows PowerShell cmdlets

You can include scan results by using the Set-BPAResult cmdlet with the -Exclude parameter. You can include individual result objects as in the BPA GUI, or a set of results the fields of which (category, title, and severity, for example) are either equal to or contain specified values. For example, you can include all previously-excluded Performance results from a set of scan results for a role.

To include scan results by using Windows PowerShell cmdlets

  1. Open a Windows PowerShell session with elevated user rights. To do this, click Start, click All Programs, click Accessories, click Windows PowerShell, right-click the Windows PowerShell shortcut, and then click Run as administrator.

  2. Import the Server Manager module into your Windows PowerShell session. To import the Server Manager module, type the following, and then press Enter.

    Import-Module ServerManager

  3. Import the BPA module. Type the following, and then press Enter.

    Import-Module BestPractices

  4. Include specific results from a role scan by typing the following cmdlet, and then pressing Enter.

    Get-BPAResult -BestPracticesModelId Specified Model Id | Where { $_Field_Name-eq "Value" } | Set-BPAResult -Id Specified Model Id -Exclude $false

    The previous cmdlet retrieves BPA scan result items for the model represented by Specified Model Id. The second part of the cmdlet, after the first pipe character ( | ) filters the results of the Get-BPAResult cmdlet to retrieve only those scan results for which the value of the result field matches the text in quotation marks. The final part of the cmdlet, after the second pipe character, includes results that are filtered by the second part of the cmdlet, by setting the value of the –Exclude parameter to false.

Archiving scan results

You can archive the result of a BPA scan into an HTML-based report.

  1. Open a Windows PowerShell session with elevated user rights. To do this, click Start, click All Programs, click Accessories, click Windows PowerShell, right-click the Windows PowerShell shortcut, and then click Run as administrator.

  2. Import the Server Manager module into your Windows PowerShell session. To import the Server Manager module, type the following, and then press Enter.

    Import-Module ServerManager

  3. Import the BPA module. Type the following, and then press Enter.

    Import-Module BestPractices

  4. Type the following, and then press Enter to archive the results of a scan.

    Get-BPAResult –BestPracticesModelId Specified Model Id | ConvertTo-Html –As List –CssUri $env:windir\system32\WindowsPowerShell\v1.0\Modules\BestPractices\BestPracticesReportFormat.css > <path to HTML report file>

    The previous cmdlet retrieves the results of the most recent BPA scan for the specified model, and saves them in HTML format, applying the standard cascading style sheets that is stored in the path windir\system32\WindowsPowerShell\v1.0\Modules\BestPractices\BestPracticesReportFormat.css. If you want to substitute cascading style sheets, provide the path to the different cascading style sheets.

  5. To view the archived HTML results of the scan, open an Internet browser, then open the scan results that you archived in the previous step.

See Also

  • Best Practices Analyzer


Server Manager Command-line Tools

Server Manager offers both a set of Windows PowerShell cmdlets and a command-line tool—ServerManagerCmd.exe—to automate the deployment of roles and features on computers that are running Windows Server® 2008 R2.

You can use either Windows PowerShell cmdlets or ServerManagerCmd.exe to install and remove roles, role services, and features. Both Server Manager cmdlets and ServerManagerCmd.exe can display a list of all roles, role services, and features both installed and available for installation on the computer.

Note

Servermanagercmd.exe is deprecated, and is not guaranteed to be supported in future releases of Windows. We recommend that you use the Windows PowerShell cmdlets that are available for Server Manager.

Windows PowerShell and Server Manager

Cmdlets (pronounced command-lets) are built-in command-line tools that are included with Windows PowerShell 2.0, installed by default as part of Windows Server 2008 R2. For more information about Windows PowerShell and how cmdlets work, see the Getting Started guide for Windows PowerShell. To open Getting Started, click Start, click All Programs, click Accessories, click Windows PowerShell 2.0, click Documents, open the folder for your locale, and then double-click GettingStarted.rtf.

To run any Server Manager-related Windows PowerShell cmdlets, you must be running Windows PowerShell with elevated user rights. To do this, click Start, click All Programs, click Accessories, click Windows PowerShell, right-click the Windows PowerShell shortcut, and then click Run as administrator. You must also load the Server Manager module into each new Windows PowerShell session before working with Server Manager cmdlets. To do this, in a Windows PowerShell session opened with elevated user rights, type Import-Module Servermanager, and then press Enter.

Note

For more information about how to start a Windows PowerShell session with all installed modules and snap-ins loaded automatically, see Starting Windows PowerShell with All Modules Loaded.

The following three cmdlets allow you to install, remove, or view information about available roles by using Windows PowerShell. For more information about how to use any of these cmdlets, in a Windows PowerShell session, enter Get-Help cmdlet_name -full, in which cmdlet_name represents one of the following values.

  • Add-WindowsFeature

  • Get-WindowsFeature

  • Remove-WindowsFeature

In this section

This section contains the following topics.

Overview of Server Manager Commands

Creating an Answer File for Server Manager Commands

Interpreting Output from Server Manager Commands

Starting Windows PowerShell with All Modules Loaded


Overview of Server Manager Commands

Server Manager in Windows Server® 2008 R2 offers a set of Windows PowerShell cmdlets for installing, removing, and querying roles, role services, and features, and a command-line tool, ServerManagerCmd.exe, to enable users to perform automated installations or removals of roles, role services, and features. Both command-line options enable users to view logs of their operations, and run queries to display lists of roles, role services, and features both installed and available for installation on a computer.

ServerManagerCmd.exe can be used with an XML answer file to speed up repetitive automated installations or removals of roles or features. For more information about the answer file that you can use with ServerManagerCmd.exe, see Creating an Answer File for Server Manager Commands.

Note

Servermanagercmd.exe is deprecated, and is not guaranteed to be supported in future releases of Windows. We recommend that you use the Windows PowerShell cmdlets that are available for Server Manager.

In this topic

  • Server Manager command-line tools, dism, pkgmgr, and ocsetup

  • Windows PowerShell cmdlets for Server Manager

  • The ServerManagerCmd.exe command

  • Role, role service, and feature command identifiers

Server Manager command-line tools, dism, pkgmgr, and ocsetup

Server Manager command-line tools differ from other command-line tools, such as dism, pkgmgr and ocsetup, that are used to install and remove Windows software packages. We recommend that you use Windows PowerShell cmdlets for Server Manager or the ServerManagerCmd.exe command prompt utility for installing or removing roles, role services, and features on a computer that is running Windows Server 2008 R2.

The following list includes ways in which the Server Manager cmdlet set and command prompt utility differ from dism, pkgmgr and ocsetup, and describes advantages of Server Manager command tools for administrators who want to deploy a server as efficiently as possible.

  • The Server Manager command line is consistent in function and terminology with the deployment and management capabilities of the Server Manager console in the Windows Server 2008 R2 UI.

  • The type of packages or files in which a role, role service, or feature are contained do not have to be known by users. The Server Manager command line requires only the name of the role, role service, or feature that the administrator wants to install or remove. Administrators do not have to provide any path or file names of role, role service, or feature packages.

  • Administrators do not have to specify dependencies between roles, role services, and features when they are using the Server Manager command line. The Server Manager command prompt utility automatically installs any other software packages that are required to use the role, role service, or feature specified in the command.

  • If problems occur with an installation or removal, error handling for ServerManagercmd.exe simplifies troubleshooting and provides clear actions to the user.

  • The -whatIf parameter of ServerManagercmd.exe lets users verify what actions their commands will perform before they initiate commands and change the system. There is no comparable command parameter included with dism, pkgmgr, and ocsetup.

  • The Get-WindowsFeature cmdlet and the -query parameter of ServerManagerCmd.exe give users complete views of which roles, role services, and features are available for installation on the computer, and which are currently installed. There is no comparable parameter included with dism, pkgmgr and ocsetup.

  • Both the input and output of the Server Manager command line is XML based. ServerManagercmd.exe accepts an XML answer file itemizing roles, role services, and features to be installed or removed. Both the results of installation and removal operations, and -query results can be exported to XML files. This enables automation scenarios in which other software can generate and interpret the XML files that are used with the Server Manager command prompt utility.

Windows PowerShell cmdlets for Server Manager

Windows PowerShell cmdlets for Server Manager accept parameters to install or remove one or more roles, role services, and features that are separated by commas.

The following three cmdlets let you install, remove, or view information about available roles by using Windows PowerShell. For more information about and examples of how to use any of these cmdlets, in a Windows PowerShell session into which the Server Manager module is loaded, enter Get-Help cmdlet_name -full, in which cmdlet_name represents one of the following values.

  • Add-WindowsFeature Installs specified roles, role services, and features on the computer. For more information about how to add roles, role services, and features by using this cmdlet, see Adding Server Roles and Features.

  • Get-WindowsFeature Returns a list of all roles, role services, and features that are available for installation on the computer, and displays by using check boxes ([X]) those that are installed. The Get-WindowsFeature cmdlet also returns a list of the command names that you provide in the Add-WindowsFeature and Remove-WindowsFeature cmdlets when you want to add or remove roles, role services, and features. Results of the Get-WindowsFeature cmdlet can be piped into either of the other two Server Manager cmdlets, or into cmdlets that run scans for Best Practices Analyzer, for example.

  • Remove-WindowsFeature Removes specified roles, role services, and features from the computer. For more information about how to remove roles, role services, and features by using this cmdlet, see Removing Server Roles and Features.

Advantages of Windows PowerShell cmdlets for Server Manager

Windows PowerShell cmdlets for Server Manager offer some significant advantages over the ServerManagerCmd.exe command.

  • After Windows PowerShell and the Server Manager cmdlet set are installed by using dism, pkgmgr, or ocsetup, Windows PowerShell cmdlets can be run on a computer that is running the Server Core installation option of Windows Server 2008 R2. Instructions for installing Windows PowerShell and the Server Manager cmdlet set on the Server Core installation option of Windows Server 2008 R2 are available in Windows Server Migration Tools Installation, Access, and Removal (http://go.microsoft.com/fwlink/?LinkId=134763).

  • Windows PowerShell tools and cmdlets are available for performing some management tasks after a role, role service, or feature is installed. For more information about roles, role services, and features that can be managed by using Windows PowerShell tools, see Windows PowerShell about_Modules (http://go.microsoft.com/fwlink/?LinkId=141216).

Requirements for using Server Manager cmdlets

To run any Server Manager-related Windows PowerShell cmdlets, you must be running Windows PowerShell with elevated user rights. To do this, click Start, click All Programs, click Accessories, click Windows PowerShell, right-click the Windows PowerShell shortcut, and then click Run as administrator.

You must also load the Server Manager module into each new Windows PowerShell session before working with Server Manager cmdlets. To do this, in a Windows PowerShell session opened with elevated user rights, type Import-Module Servermanager, and then press Enter.

Note

For more information about how to start a Windows PowerShell session with all installed modules and snap-ins loaded automatically, see Starting Windows PowerShell with All Modules Loaded.

Syntax of Server Manager cmdlets

Add-WindowsFeature [-Name] <string[]> [-IncludeAllSubFeature] [-logPath <string>] [-WhatIf] [-Restart] [-Concurrent] [<CommonParameters>]

Get-WindowsFeature [[-Name] <string[]>] [-logPath <string>] [<CommonParameters>]

Remove-WindowsFeature [-Name] <string[]> [-logPath <string>] [-WhatIf] [-Restart] [-Concurrent] [<CommonParameters>]

Parameters

This section describes the parameters for the Add-WindowsFeature, Get-WindowsFeature, and Remove-WindowsFeature cmdlets.

  • Add-WindowsFeature

  • Get-WindowsFeature

  • Remove-WindowsFeature

Add-WindowsFeature

Parameter Description

-name <string[]>

Specifies the command IDs of roles, role services, or features that you want to install by using the Add-WindowsFeature cmdlet. Or, an array of Feature objects is also accepted.

You can find a list of command IDs for all roles, role services, and features in this topic, or by running the Get-WindowsFeature cmdlet.

-IncludeAllSubFeature

Specifies the installation of all subordinate services and features together with the parent role, role service, or feature that is named in the Name parameter.

-logPath <string>

Specifies a name and location for the log file, other than the default, %windir%\logs\ServerManager.log.

-WhatIf

Displays any operations that are specified for the Add-WindowsFeature cmdlet; for example, displays the Windows features that are also installed because the role, role service, or feature that you want to install depends on them. Adding the -WhatIf parameter to the Add-WindowsFeature cmdlet runs the cmdlet without performing actual installation.I It shows only what would be installed and what would be the results of the cmdlet if it had been run.

-Restart

Restarts the computer automatically when installation is complete, if restarting is required by the roles or features installed.

-Concurrent

Allows concurrent instances of the Server Manager Add-WindowsFeature or Remove-WindowsFeature cmdlets to be running at the same time.

Important

Do not add this parameter unless you are installing roles, role services, or features that are downloaded separately from Windows Server 2008 R2, and you want to install Windows features on which the downloaded technology depends at the same time.

<CommonParameters>

This cmdlet supports the common parameters -Verbose, -Debug, -ErrorAction, -ErrorVariable, -WarningAction, -WarningVariable, -OutBuffer and -OutVariable. For more information about common parameters, in your Windows PowerShell session, type, get-help about_commonparameters, and then press Enter.

Get-WindowsFeature

Parameter Description

-name <string[]>

Specifies the command IDs of roles, role services, or features for which you want to view information.

You can find a list of command IDs for all roles, role services, and features in this topic, or by running the Get-WindowsFeature cmdlet without parameters.

-logPath <string>

Specifies a name and location for the log file, other than the default, %windir%\logs\ServerManager.log. Add this parameter if you want the results of the Get-WindowsFeature cmdlet to be stored in a log.

<CommonParameters>

This cmdlet supports the common parameters -Verbose, -Debug, -ErrorAction, -ErrorVariable, -WarningAction, -WarningVariable, -OutBuffer and -OutVariable. For more information about common parameters, in your Windows PowerShell session, type, get-help about_commonparameters, and then press Enter.

Remove-WindowsFeature

Parameter Description

-name <string[]>

Specifies the command IDs of roles, role services, or features that you want to remove by using the Remove-WindowsFeature cmdlet. Alternatively, an array of Feature objects is also accepted.

You can find a list of command IDs for all roles, role services, and features in this topic, or by running the Get-WindowsFeature cmdlet.

-logPath <string>

Specifies a name and location for the log file, other than the default, %windir%\logs\ServerManager.log.

-WhatIf

Displays any operations that are specified for the Remove-WindowsFeature cmdlet. Adding the -WhatIf parameter to the Remove-WindowsFeature cmdlet runs the cmdlet without performing actual removals. It shows only what would be removed and what would be the cmdlet results if the cmdlet had been run.

-Restart

Restarts the computer automatically when removal is complete, if restarting is required.

-Concurrent

Allows concurrent instances of the Server Manager Add-WindowsFeature or Remove-WindowsFeature cmdlets to be running at the same time.

<CommonParameters>

This cmdlet supports the common parameters -Verbose, -Debug, -ErrorAction, -ErrorVariable, -WarningAction, -WarningVariable, -OutBuffer and -OutVariable. For more information about common parameters, in your Windows PowerShell session, type, get-help about_commonparameters, and then press Enter.

The ServerManagerCmd.exe command

The Server Manager command-line installation accepts parameters to install or remove one or more roles, role services, and features that are separated by spaces. When you want to install or remove more than one role, role service, or feature on a server by using a single command instance, you can also use an XML answer file, especially if you want to configure multiple servers identically. For more information about the answer file that you can use with ServerManagerCmd.exe, see Creating an Answer File for Server Manager Commands.

Note

ServerManagerCmd.exe can be run from any directory on the server's local drives. You must be a member of the Administrators group on the server on which you want to install or remove software.

Important

Because of security restrictions imposed by User Account Control in Windows Server 2008 R2, you must run ServerManagerCmd.exe in a Command Prompt window opened with elevated permissions. To do this, right-click the Command Prompt executable, or the Command Prompt object on the Start menu, and then click Run as administrator.

Syntax of ServerManagerCmd.exe

ServerManagerCmd.exe -query [<query.xml>] [-logPath <log.txt>]

ServerManagerCmd.exe -inputPath <answer.xml> [-resultPath <result.xml> [-restart] | -whatIf] [-logPath <log.txt>]

ServerManagerCmd.exe -install <command-Id> [-setting <setting-name>=<setting value>]* [-allSubFeatures] [-resultPath <result.xml> [-restart] | -whatIf] [-logPath <log.txt>]

ServerManagerCmd.exe -remove <command-Id> [-resultPath <result.xml> [-restart] | -whatIf] [-logPath <log.txt>]

ServerManagerCmd.exe [-help | -?]

ServerManagerCmd.exe -version

Parameters

Parameter Description

-query [<query.xml>]

Displays a list of all roles, role services, and features installed and available for installation on the server. You can also use the short form of this parameter, -q.

If you want the query results saved to an XML file, specify an XML file to replace query.xml.

Note

The results of the -query parameter cannot be used as an answer file with the -inputPath parameter. The XML used by -query results and the XML required in a Servermanagercmd.exe answer file do not validate to the same schema.

-inputPath <answer.xml>

Installs or removes the roles, role services, and features specified in the answer file, an XML file represented by answer.xml. You can also use the short form of this parameter, -p.

For more information about how to create an answer file for use with this parameter, see Creating an Answer File for Server Manager Commands.

-install <Id>

Installs the role, role service, or feature specified by Id. See Role, role service, and feature command identifiers in this topic for a complete list of the role, role service, or feature identifiers from which you can choose to specify for Id. The identifiers are case-insensitive. Multiple roles, role services, and features must be separated by spaces.

The following optional parameters are used with the -install parameter.

  • -setting <setting name>=<setting value> – Specify required settings for the installation. See Role, role service, and feature command identifiers in this topic for a complete list of available settings.

  • -allSubFeatures – Specify the installation of all subordinate services and features together with the parent role, role service, or feature named in the Id parameter of the -install command. Be aware that some role containers do not have a command line identifier to allow installation of all role services. This is the case when role services cannot be installed in the same instance of the Server Manager command. For example, the Federation Service role service of Active Directory Federation Services and the Federation Service Proxy role service cannot be installed by using the same Server Manager command instance.

  • -resultPath <result.xml> – Saves installation results to an XML file represented by result.xml. You can also use the short form of this parameter, -r. You cannot use the -resultPath parameter and the -whatIf parameter in the same instance of ServerManagerCmd.exe.

  • -restart – Adding -restart to the -install command restarts the computer automatically when installation is complete, if restarting is required by the roles or features installed.

  • -whatIf – You can use -whatIf to display any operations specified for the -install command. You can also use the short form of the -whatIf parameter, -w. You cannot use the -resultPath parameter and the -whatIf parameter in the same instance of ServerManagerCmd.exe.

  • -logPath <log.txt> – Use -logPath to specify a name and location for the log file, other than the default, %windir%\temp\servermanager.log.

-remove <Id>

Removes the role, role service, or feature specified by Id. See Role, role service, and feature command identifiers in this topic for a complete list of the role, role service, and feature identifiers from which you can choose to specify for Id. The identifiers are case-insensitive. Multiple roles, role services, and features must be separated by spaces.

The following optional parameters are used with the -remove parameter.

  • -resultPath <result.xml> – Saves removal results to an XML file represented by result.xml. You can also use the short form of this parameter, -r. Be aware that you cannot use the -resultPath parameter and the -whatIf parameter in the same instance of ServerManagerCmd.exe.

  • -restart – Adding -restart to the -remove command restarts the computer automatically when removal is complete, if restarting is required by remaining roles or features.

  • -whatIf – You can use -whatIf to display any operations specified for the -remove command. You can also use the short form of the -whatIf parameter, -w. You cannot use the -resultPath parameter and the -whatIf parameter in the same instance of ServerManagerCmd.exe.

  • -logPath <log.txt> – Use -logPath to specify a name and location for the log file, other than the default, %windir%\temp\servermanager.log.

-help

Display Help for ServerManagerCmd.exe in the Command Prompt window. You can also use the short form, -?.

-version

Display the Server Manager version number. You can also use the short form, -v.

Remarks about ServerManagerCmd.exe

ServerManagerCmd.exe does not support configuration or management of roles and features, after those are installed. Role and feature installations completed by using ServerManagerCmd.exe use default settings. To change role or feature settings, perform role administration tasks, or view status or events for roles and features, you should use the Windows GUI–based Server Manager console. You might have to open other management snap-ins for your role, or use role- and feature-specific command-line tools for managing or configuring specific roles, role services, and features.

Note

Although role and feature installations are secure by default, you should use the Server Manager console to change any default settings to comply with security policies in your enterprise. ServerManagerCmd.exe cannot be used to install and configure applications other than Windows Server 2008 R2 roles, role services, and features. ServerManagerCmd.exe is not supported on computers that are running a Server Core installation of Windows Server 2008 R2. ServerManagerCmd.exe cannot be used for installation or removal of roles, role services, and features on remote computers.

ServerManagerCmd.exe Examples

The following are examples of how Server Manager commands are used.

Querying the installed roles and features on the computer

The following example shows the ServerManagerCmd.exe syntax for performing a query to determine which roles, role services, and features are installed on a computer, and which are available for installation. In this example, the administrator directs Server Manager to save the results of the query to a file, C:\queryResults.xml.

ServerManagerCmd.exe -query C:\queryResults.xml

Installing a role without an answer file

The following shows the ServerManagerCmd.exe syntax for installing Web Server (IIS) and all its role services. The administrator exports the results of the installation to an XML file that is named WebServer.xml. The administrator has also instructed Server Manager to restart the computer automatically when installation is complete, if it is required by the role.

ServerManagerCmd.exe -install Web-Server -allSubFeatures -resultPath C:\Admin\WebServer.xml -restart

Removing features by using an answer file and the ServerManagerCmd.exe command

An administrator is using the following command to repurpose several servers by removing some roles. Commands for the roles to be removed are provided in an answer file that is named RemoveFilePrint.xml. The administrator has added the -whatIf option to the command to display the command operations specified in the removalresults.xml answer file, and show if any software that depends on the items specified for removal in the answer file was also removed.

ServerManagerCmd.exe -inputPath C:\AdminFiles\RemoveFilePrint.xml -resultPath C:\AdminFiles\removalresults.xml -whatIf

Role, role service, and feature command identifiers

The tables in this section match roles, role services, and features that are available in Windows Server 2008 R2 with the command identifiers that you must use with ServerManagerCmd.exe to install or remove them.

  • Role and role service command identifiers

  • Feature command identifiers

Role and role service command identifiers

Active Directory Certificate Services command identifiers | Command value | Notes
Active Directory Certificate Services | AD-Certificate | Certification Authority and Online Certificate Status Protocol can be installed by using the Server Manager command-line interface. Other role services for Active Directory Certificate Services cannot be installed by using the Server Manager command line.
Certification Authority | ADCS-Cert-Authority
Certification Authority Web Enrollment (not installable by using the command line) | ADCS-Web-Enrollment
Online Responder | ADCS-Online-Cert
Network Device Enrollment Service | ADCS-Device-Enrollment
Certificate Enrollment Web Service | ADCS-Enroll-Web-Svc
Certificate Enrollment Policy Web Service | ADCS-Enroll-Web-Pol

Active Directory Domain Services command identifiers | Command value | Notes
Active Directory Domain Services | AD-Domain-Services | After you install Active Directory Domain Services (AD DS), you must run the dcpromo command.. Removing the AD DS role while the computer is operating as a domain controller fails. You must first remove Active Directory Domain Services from the domain controller.
Active Directory Domain Controller | ADDS-Domain-Controller
Identity Management for UNIX | ADDS-Identity-Mgmt
Server for Network Information Service | ADDS-NIS
Password Synchronization | ADDS-Password-Sync
Administration tools for Identity Management for UNIX | ADDS-IDMU-Tools

Active Directory Federation Services command identifiers | Command value | Notes
Active Directory Federation Services | AD-Federation-Services | Active Directory Federation Services should be installed with default settings.
Federation Service | ADFS-Federation
Federation Service Proxy | ADFS-Proxy
Web Agents | ADFS-Web-Agents
Claims-aware Agent | ADFS-Claims
Windows Token-based Agent | ADFS-Windows-Token

Active Directory Lightweight Directory Services command identifiers | Command value | Notes
Active Directory Lightweight Directory Services | ADLDS | None

Active Directory Rights Management Services (AD RMS) command identifiers | Command value | Notes
Active Directory Rights Management Services (AD RMS) | ADRMS | Active Directory Rights Management Services (AD RMS) cannot be installed by using the Server Manager command line.
Active Directory Rights Management Server | ADRMS-Server
Identity Federation Support | ADRMS-Identity

Application Server command identifiers | Command value | Notes
Application Server | Application-Server | If you install the WS-Atomic Transaction Support role service by using the Server Manager command line, by default, WS-Atomic Transaction Support is configured to use a self-signed certificate.
Application Server Foundation | AS-AppServer-Foundation
Web Server (IIS) Support | AS-Web-Support
COM+ Network Access | AS-Ent-Services
TCP Port Sharing | AS-TCP-Port-Sharing
Windows Process Activation Service Support | AS-WAS-Support
HTTP Activation | AS-HTTP-Activation
Message Queuing Activation | AS-MSMQ-Activation
TCP Activation | AS-TCP-Activation
Named Pipes Activation | AS-Named-Pipes
Distributed Transaction Support | AS-Dist-Transaction
Incoming Remote Transactions | AS-Incoming-Trans
Outgoing Remote Transactions | AS-Outgoing-Trans
WS-Atomic Transaction Support | AS-WS-Atomic

DHCP Server command identifiers | Command value | Notes
DHCP Server | DHCP | The DHCP Server role should be installed with default settings.

DNS Server command identifiers | Command value | Notes
DNS Server | DNS | None

Fax Server command identifiers | Command value | Notes
Fax Server | Fax | Fax Server should be installed with default settings.

File Services command identifiers Command value Notes

File Services

File-Services

You cannot install or remove the File Services container by using the Server Manager command line. You can install or remove the File Services container only by using the Server Manager user interface. Be aware that for this reason, there is no command ID available to represent the File Services container.

Because you can configure File Services settings after you install the role, you are not required to specify File Services settings in the Server Manager command-line answer file.

File Server

FS-Fileserver

Distributed File System (DFS)

FS-DFS

DFS Namespace

FS-DFS-Namespace

DFS Replication

FS-DFS-Replication

File Server Resource Manager

FS-Resource-Manager

Services for Network File System

FS-NFS-Services

Windows Search Service

FS-Search-Service

Windows Server 2003 File Services

FS-Win2003-Services

BranchCache for remote files

FS-BranchCache

Indexing Service

FS-Indexing-Service

Hyper-V™ command identifiers | Command value | Notes
Hyper-V™ | Hyper-V |

Network Policy and Access Services command identifiers | Command value | Notes
Network Policy and Access Services | NPAS | Because Network Policy and Access Services settings can be configured after you install the role, you are not required to specify Network Policy and Access Services settings in the command-line answer file.
Network Policy Server | NPAS-Policy-Server
NPAS Routing and Remote Access Services | NPAS-RRAS-Services
Remote Access Service | NPAS-RRAS
Routing | NPAS-Routing
Health Registration Authority | NPAS-Health
Host Credential Authorization Protocol | NPAS-Host-Cred

Print and Document Services command identifiers | Command value | Notes
Print and Document Services | Print-Services | During removal of this role in the Server Manager UI, you are prompted to delete instances of printers configured on the server. By default, these instances are preserved. This is the default behavior of command-line removal of the Print and Document Services role.
Print Server | Print-Server
Internet Printing | Print-Internet
LPD Service | Print-LPD-Service
Distributed Scan Server | Print-Scan-Server

Remote Desktop Services command identifiers | Command value | Notes
Remote Desktop Services | Remote-Desktop-Services | Because Remote Desktop Services settings can be configured after you install the role, you are not required to specify Remote Desktop Services settings in the command-line answer file.
Remote Desktop Server | RDS-RD-Server
RD Licensing | RDS-Licensing
RD Gateway | RDS-Gateway
RAD Web Access | RDS-Web-Access
RD Connection Broker | RDS-Connection-Broker
RD Virtualization | RDS-Virtualization

Web Server (IIS) command identifiers | Command value | Notes
Web Server (IIS) | Web-Server | None
Internet Information Services (Web Server) | Web-WebServer |
Common HTTP Features | Web-Common-Http |
Static Content | Web-Static-Content |
Default Document | Web-Default-Doc |
Directory Browsing | Web-Dir-Browsing |
HTTP Errors | Web-Http-Errors |
HTTP Redirection | Web-Http-Redirect |
WebDAV Publishing | Web-DAV-Publishing |
Application Development | Web-App-Dev |
ASP.NET | Web-Asp-Net |
.NET Extensibility | Web-Net-Ext |
ASP | Web-ASP |
CGI | Web-CGI |
ISAPI Extensions | Web-ISAPI-Ext |
ISAPI Filters | Web-ISAPI-Filter |
Server Side Includes | Web-Includes |
Health and Diagnostics | Web-Health |
HTTP Logging | Web-Http-Logging |
Logging Tools | Web-Log-Libraries |
Request Monitor | Web-Request-Monitor |
Tracing | Web-Http-Tracing |
Custom Logging | Web-Custom-Logging |
ODBC Logging | Web-ODBC-Logging |
Security | Web-Security |
Basic Authentication | Web-Basic-Auth |
Windows Authentication | Web-Windows-Auth |
Digest Authentication | Web-Digest-Auth |
Client Certificate Mapping Authentication | Web-Client-Auth |
IIS Client Certificate Mapping Authentication | Web-Cert-Auth |
URL Authorization | Web-Url-Auth |
Request Filtering | Web-Filtering |
IP and Domain Restrictions | Web-IP-Security |
Performance | Web-Performance |
Static Content Compression | Web-Stat-Compression |
Dynamic Content Compression | Web-Dyn-Compression |
Management Tools | Web-Mgmt-Tools |
IIS Management Console | Web-Mgmt-Console |
IIS Management Scripts and Tools | Web-Scripting-Tools |
Management Service | Web-Mgmt-Service |
IIS 6 Management Compatibility | Web-Mgmt-Compat |
IIS 6 Metabase Compatibility | Web-Metabase |
IIS 6 WMI Compatibility | Web-WMI |
IIS 6 Scripting Tools | Web-Lgcy-Scripting |
IIS 6 Management Console | Web-Lgcy-Mgmt-Console |
FTP Server | Web-Ftp-Server |
FTP Service | Web-Ftp-Service |
FTP Extensibility | Web-Ftp-Ext |

Windows Deployment Services command identifiers | Command value | Notes
Windows Deployment Services | WDS | None
Deployment Server | WDS-Deployment
Transport Server | WDS-Transport

Windows Server Update Services command identifiers | Command value | Notes
Windows Server Update Services | OOB-WSUS |

Feature command identifiers

Features Command Value Notes

Background Intelligent Transfer Service (BITS)

BITS

  • BITS Compact Server

BITS-LWDLServer

  • IIS Server Extension

BITS-IIS-Ext

BitLocker Drive Encryption

BitLocker

Windows BranchCache

BranchCache

Connection Manager Administration Kit

CMAK

Desktop Experience

Desktop-Experience

Direct Access Management Console

DAMC

Failover Clustering

Failover-Clustering

Group Policy Management

GPMC

Ink and Handwriting Services

Ink-Handwriting

  • Ink Support

IH-Ink-Support

  • Handwriting Recognition

IH-Handwriting

Internet Printing Client

Internet-Print-Client

Internet Storage Naming Server

ISNS

LPR Port Monitor

LPR-Port-Monitor

Message Queuing

MSMQ
  • Message Queuing Services

MSMQ-Services

  • Message Queuing Server

MSMQ-Server

  • Directory Service Integration

MSMQ-Directory

  • Message Queuing Triggers

MSMQ-Triggers

  • HTTP Support

MSMQ-HTTP-Support

  • Multicasting Support

MSMQ-Multicasting

  • Routing Service

MSMQ-Routing

  • Messaging Queuing DCOM Proxy

MSMQ-DCOM

Multipath I/O

Multipath-IO

Network Load Balancing

NLB

.NET Framework 3.5.1 Features

NET-Framework

Be aware that the command-line syntax for the .NET Framework 3.5.1 Features does not contain the "." character before NET.

  • .NET Framework 3.5.1

NET-Framework-Core

  • Windows Communication Foundation (WCF) Activation

NET-Win-CFAC

  • HTTP Activation

NET-HTTP-Activation

  • Non-HTTP Activation

NET-Non-HTTP-Activ

Peer Name Resolution Protocol

PNRP

Quality Windows Audio Video Experience

Qwave

Remote Assistance

Remote-Assistance

Remote Differential Compression

RDC

Remote Server Administration Tools

RSAT

  • Role administration tools

RSAT-Role-Tools

  • Active Directory Certificate Services Tools

RSAT-ADCS

  • Certification Authority Tools

RSAT-ADCS-Mgmt

  • Online Responder Tools

RSAT-Online-Responder

  • AD DS and AD LDS Tools

RSAT-AD-Tools

  • AD DS Tools

RSAT-ADDS

  • AD DS Snap-ins and Command-Line Tools

RSAT-ADDS-Tools

  • Active Directory Administrative Center

RSAT-AD-AdminCenter

  • Server for NIS Tools

RSAT-SNIS

  • Active Directory Lightweight Directory Services Tools

RSAT-ADLDS

  • Active Directory PowerShell Snap-in

RSAT-AD-PowerShell

  • Active Directory Rights Management Services (AD RMS) Tools

RSAT-RMS

  • DHCP Server Tools

RSAT-DHCP

  • DNS Server Tools

RSAT-DNS
  • Fax Server Tools

RSAT-Fax

  • File Services Tools

RSAT-File-Services

  • Distributed File System Tools

RSAT-DFS-Mgmt-Con
  • File Server Resource Manager Tools

RSAT-FSRM-Mgmt
  • Services for Network File System Tools

RSAT-NFS-Admin
  • Hyper-V Tools

RSAT-Hyper-V
  • Network Policy and Access Services Tools

RSAT-NPAS
  • Print and Document Services Tools

RSAT-Print-Services
  • Remote Desktop Services Tools

RSAT-RDS
  • Remote Desktop Server Tools

RSAT-RDS-RemoteApp

  • RD Gateway Tools

RSAT-RDS-Gateway
  • RD Licensing Tools

RSAT-RDS-Licensing
  • RD Connection Broker Tools

RSAT-TS-Session-Broker
  • Web Server (IIS) Tools

RSAT-Web-Server
  • Windows Deployment Services Tools

RSAT-WDS

Remote Server Administration Tools feature administration tools

RSAT-Feature-Tools
  • BitLocker Drive Encryption Administration Tools

RSAT-BitLocker
  • BitLocker Drive Encryption Tools

RSAT-Bitlocker-DriveEnc
  • BitLocker Recovery Password Viewer

RSAT-Bitlocker-RecPwd
  • BITS Server Extensions Tools

RSAT-BITS-Server
  • Failover Clustering Tools

RSAT-Clustering
  • Network Load Balancing Tools

RSAT-NLB
  • SMTP Server Tools

RSAT-SMTP
  • WINS Server Tools

RSAT-WINS

RPC over HTTP Proxy

RPC-over-HTTP-Proxy

Simple TCP/IP Services

Simple-TCPIP

SMTP Server

SMTP-Server

SNMP Services

SNMP-Services
  • SNMP Service

SNMP-Service

  • SNMP WMI Provider

SNMP-WMI-Provider

Storage Manager for SANs

Storage-Mgr-SANS

Subsystem for UNIX-based Applications

Subsystem-UNIX-Apps

Telnet Client

Telnet-Client

Telnet Server

Telnet-Server

TFTP Client

TFTP-Client

Windows Biometric Framework

Biometric-Framework

Windows Internal Database

Windows-Internal-DB

Windows PowerShell ISE

PowerShell-ISE

Windows Process Activation Service

WAS
  • Process Model

WAS-Process-Model

  • .NET Environment

WAS-NET-Environment

  • Configuration APIs

WAS-Config-APIs

Windows Server Backup Features

Backup-Features
  • Windows Server Backup

Backup

  • Command-line tools

Backup-Tools

  • Windows Server Backup Cmdlets

Backup-Cmdlets

Windows Server Migration Tools

Migration

Windows System Resource Manager

WSRM

Windows TIFF iFilter

TIFF-iFilter

WinRM IIS Extension

WinRM-IIS-Ext

WINS Server

WINS-Server

Wireless LAN Service

Wireless-Networking

XPS Viewer

XPS-Viewer

See Also

  • Interpreting Output from Server Manager Commands
  • Adding Server Roles and Features
  • Removing Server Roles and Features
  • Windows Script Center


Creating an Answer File for Server Manager Commands

Note

Servermanagercmd.exe is deprecated, and is not guaranteed to be supported in future releases of Windows. We recommend that you use the Windows PowerShell cmdlets that are available for Server Manager.

The Server Manager command-line installation in Windows Server® 2008 R2 accepts parameters to install or remove one role, role service, or feature per command instance. When you want to install or remove more than one role, role service, or feature on a server by using a single command instance, use an XML answer file.

In Windows Server 2008 R2, users create answer files from scratch. The answer file provides the following information to the Server Manager command-line interface:

  • roles, role services, and features users want to install on or remove from a server

  • Configuration settings required to complete installation of roles, role services, or features

Role, role service, and feature dependencies

When you install or remove roles, role services, or features by using the Server Manager GUI, the Add Roles Wizard verifies that all of the software required by a role installs with any role you select in the wizard. If necessary, the wizard prompts you to approve the installation of other roles, role services, or features that are required by roles you select.

The same verification process occurs when you use the Server Manager command line. If you want to install or remove only specific parts of roles or features, you need to specify only the parts you want to install or remove. There is no need to specify all of the required roles and role services for role services you want to install; Server Manager automatically installs or removes the software upon which your desired role service is dependent.

Important

When you remove roles by using an answer file, Server Manager automatically removes all roles and role services that depend on a specified role or role service in your answer file. Adding the -whatIf parameter to your Server Manager command displays a list of all roles and role services that are removed as a consequence of removing a role or role service specified in your answer file.

For example, if you want to install Internet Printing, a role service of Print and Document Services, your answer file needs to specify only Internet Printing; you do not need to specify Web Server (IIS) or specific role services of Web Server (IIS). By default, Server Manager installs parts of Web Server (IIS), another role, which are required for Internet Printing to run. By using the same answer file, you want to remove the Remote Desktop Services role service RD Gateway from the same server. RD Gateway also requires parts of Web Server (IIS) to run. Server Manager removes those role services of Web Server (IIS) that neither RD Gateway nor Internet Printing require to run, but it retains Web Server (IIS) role services still required by Internet Printing.

How the answer file handles parent and child role services

Some roles, role services, and features are containers of child elements that Server Manager installs by default. In the wizards that are part of the Server Manager GUI, when you select a container node for either installation or removal, required child elements are automatically selected. Although you can clear check boxes manually for some child elements, the selected child elements are recommended defaults.

When a container is specified in a command-line installation, the default child elements are automatically included. When a container is specified in a command-line removal, all child elements are removed. For example, when the Print and Document Services role is named in the answer file along with the -install command, the Print Server role service is also installed. However, specifying the removal of the Print and Document Services container results in the removal of the entire role.

If default child elements should not be installed, do not specify the container in the answer file. Specify only the child elements that you want to install or remove.

For example, if you want to install Internet Printing, a role service of Print and Document Services, your answer file needs to specify only Internet Printing; you do not need to specify Print and Document Services or other role services of Print and Document Services. Server Manager installs only Internet Printing and the Print Server role service that it requires, but not LPD Service, another role service subordinate to Print and Document Services.

Creating an answer file for Server Manager commands

You can create the answer file to use with the Server Manager command line in an XML editing program or in a text editing utility such as Notepad. It is recommended that you use an XML editor that can validate your work to an existing XML schema, because it is important to validate your answer file to the Server Manager command-line schema definition. See The Server Manager Command-line Schema in this topic for more information.

Note

The results of the -query parameter cannot be used as an answer file with the -inputPath parameter. The XML used by -query results and the XML required in a Servermanagercmd.exe answer file do not validate to the same schema.

Specifying the identifiers of roles, role services, and features

The Server Manager command line and answer file recognizes the identifiers of roles, role services, and features provided in Overview of Server Manager Commands. Identifiers of roles, role services, and features in the answer file and in the Server Manager command line are case-insensitive, so the capitalization shown in the identifiers is not essential.

Answer file examples

The following are sample answer files. Note that the following heading element must be present in all answer files, and to create well-formed XML, the element must be closed at the end of the answer file. The placeholder action must be replaced with either Install or Remove.

<ServerManagerConfiguration
Action="action"
xmlns="http://schemas.microsoft.com/sdm/Windows/ServerManager/Configuration/2007/1">
…answer file content…
</ServerManagerConfiguration>

Installing DNS Server, Web Server, RD Gateway, Message Queuing Server, and .NET Framework 3.0 Features

In the following example, the administrator wants to install DNS Server, Web Server (IIS), RD Gateway (a role service of Remote Desktop Services), Message Queuing Server (part of the feature Message Queuing), and all parts of .NET Framework 3.5.1 Features.

<ServerManagerConfiguration
Action="Install"
xmlns="http://schemas.microsoft.com/sdm/Windows/ServerManager/Configuration/2007/1">
<Role Id="DNS"/>
<Role Id="Web-Server"/>
<RoleService Id="RDS-Gateway"/>
<Feature Id="MSMQ-Server"/>
<Feature Id="Net-Framework" InstallAllSubFeatures="true"/>
</ServerManagerConfiguration>

The following are the results of this operation.

  • DNS Server: Installed.

  • Web Server (IIS): Has a number of default role services and a dependency on the Windows Process Activation Service (WAS) feature. All default role services and WAS are installed.

  • Remote Desktop Services: The RD Gateway role service is installed, meaning the Remote Desktop Services role is now installed. RD Gateway depends on several Web Server (IIS) role services, along with Network Policy and Access Services, which is also installed.

  • Message Queuing: Only the Message Queuing Server feature element is installed. Other elements of Message Queuing are not installed.

  • .NET Framework 3.5.1 Features: All sub-features of .NET Framework 3.5.1 Features are installed.

Removing DNS Server, RD Gateway, and .NET Framework 3.5.1 Features

In the following example, the administrator wants to remove DNS Server, RD Gateway, and .NET Framework 3.5.1 Features.

<ServerManagerConfiguration
Action="Remove"
xmlns="http://schemas.microsoft.com/sdm/Windows/ServerManager/Configuration/2007/1">
<Role Id="DNS"/>
<RoleService Id="RDS-Gateway"/>
<Feature Id="Net-Framework"/>
</ServerManagerConfiguration>

The following are the results of this operation.

  • DNS Server: Removed

  • Remote Desktop Services: The RD Gateway role service is removed. Other installed role services of Remote Desktop Services are not removed. Web Server (IIS) (upon which RD Gateway was dependent) is not removed.

  • .NET Framework 3.5.1 Features: All sub-features of .NET Framework 3.5.1 are removed. If some sub-features were not previously installed, they are ignored.

The Server Manager command-line schema

XML answer files that are used with the Server Manager command line must validate to the Server Manager command-line schema definition. You can find a copy of this schema on the Microsoft Web site (http://go.microsoft.com/fwlink/?LinkId=81203).


Interpreting Output from Server Manager Commands

Note

Servermanagercmd.exe is deprecated, and is not guaranteed to be supported in future releases of Windows. We recommend that you use the Windows PowerShell cmdlets that are available for Server Manager.

The Server Manager command, ServerManagerCmd.exe, generates output about its operations, and displays highlights of the output on the screen. Server Manager also writes much more verbose output to a text-only log file. You can also configure Server Manager to write the results of command-line operations to an XML-based results file.

This section identifies and describes the codes and messages that are found in Server Manager command output files.

Results of Server Manager command-line operations

By default, Server Manager writes command output to a text-only log file, logname.txt, located at %windir%\logs\ServerManager.log.

Note

Although this log stores output about the operations of the Server Manager command, the output is very verbose and not in a user-friendly format. This log file is useful if it is necessary to contact Microsoft Product Support Services about Server Manager operations.

You can change the default name and location of the log file by adding the -logPath parameter to the Server Manager line command, ServerManagerCmd.exe. For more information about the -logPath parameter and the syntax of ServerManagerCmd.exe, see Overview of Server Manager Commands.

In addition to the text-only log file Server Manager creates by default, you can command Server Manager to store the results of its operations in an XML file with a name and location you provide. The parameter for specifying the name and location of an XML results file is -resultPath.

The -logPath and -resultPath parameters are used at the command prompt, regardless of whether you are using an answer file with the Server Manager command to specify a list of roles or features for removal, or whether you are installing or removing a single item directly at the command line. For more information about the Server Manager command line answer file, see Creating an Answer File for Server Manager Commands.

Examples

The following examples show how you specify the name and path to an XML results file in the Server Manager command.

Example of results file specification in a command with an answer file

ServerManagerCmd.exe -inputPath C:\CmdLine\Remove_roles.xml -resultPath C:\CmdLine\010107.xml

In the preceding example, an administrator has created an answer file named Remove_roles.xml, containing commands to remove several roles from a server. The administrator has specified a results file name and location, C:\CmdLine\010107.xml.

Example of results file specification in a command without an answer file

ServerManagerCmd.exe -install npas -allSubFeatures -r C:\CmdLine\Results\010107.xml -restart

In the preceding example, an administrator has instructed Server Manager to install Network Policy and Access Services. Note that the command name for the role, npas, is case-insensitive.

In this example, all role services of Network Policy and Access Services are installed, as requested with the -allSubFeatures parameter. The administrator uses the short form of the -resultPath parameter, -r, to specify a results file name and path. Finally, the administrator uses the -restart parameter to instruct Server Manager to restart the computer, if necessary, once installation of the Network Policy and Access Services role is complete.

Descriptions of output messages

This section describes the output and results returned by Server Manager in an XML-based results file.

Output messages

The following table identifies and describes messages that the Server Manager command writes to the console window, and to results files.

Message Exit code Text string Notes

Success, no need to restart

0

Success: Installation succeeded.

Success: Removal succeeded.

Two different messages might vary slightly, depending on whether the user specified roles or features in the command.

Success, restart is required

3010

Success: Installation succeeded. A restart is required.

Success: Removal succeeded. A restart is required.

This code is returned when a restart is required. After restarting the computer, you might need to run Server Manager in the Windows Server 2008 R2 user interface to complete required configuration for roles or features.

Argument not valid

4

ArgumentNotValid: Argument not valid {argument}

ArgumentNotValid: Missing the answer file path

ArgumentNotValid: Missing log file path

ArgumentNotValid: Feature not valid: '{name}'. The name of the feature was not found.

ArgumentNotValid: Role not valid: '{name}'. The name of the role was not found.

ArgumentNotValid: The following name has already been specified in the input path: {name}

ArgumentNotValid: The following setting has already been specified in the input path: {setting}

ArgumentNotValid: Not a valid feature. '{name}' is a role.

ArgumentNotValid: Not a valid feature. '{name}' is a role service.

ArgumentNotValid: Not a valid role. '{name}' is a feature.

ArgumentNotValid: Invalid role. The name '{name}' is for a role service.

ArgumentNotValid: Not a valid role service. '{name}' is a feature.

ArgumentNotValid: Not a valid role service. '{name}' is a role.

Occurs when a user provides an argument that does not exist or omits a required part of a specified argument in the Server Manager command line.

Different messages are displayed depending on the argument that requires attention.

{argument} represents the incorrect argument specified by the user.

{name} represents the incorrectly specified name of the role, role service, or feature.

{setting} represents the name of an incorrectly specified or duplicated reference to a setting for a role, role service, or feature.

Error opening or reading input file

110

ReadError: Answer file does not exist: {0}

ReadError: Failed to read the answer file: {0}

ReadError: Failed to load the answer file: {0}. {1}

Occurs if the Server Manager command-line interface cannot read or locate the answer file provided by a user. Different messages are displayed for the same error code (110) depending on the specific reason the answer file could not be loaded.

{0} represents the path and name specified by the user.

{1} represents the exception found by Server Manager.

The recommended troubleshooting, if this error message occurs, is to verify that you have provided the correct name and path to your XML answer file, and verify that the answer file validates to the Server Manager answer file schema and uses the correct element structure. For more information about the correct setup and appearance of a Server Manager command answer file, see Creating an Answer File for Server Manager Commands.

Insufficient permissions or credentials

5

Error: Server Manager can be run only by a member of the built-in Administrators group on the local computer. You should install and remove roles and features only with elevated permissions.

This error occurs if the supplied user credentials do not have local administrative rights on the server, or if a user has not opened the command prompt window with elevated permissions. To do this, right-click the Command Prompt executable, or right-click Command Prompt on the Start menu, and then click Run as administrator.

No change needed

1003

NoChange: No changes were made because the roles and features specified in the answer file are already installed, or have already been removed from the local computer.

Occurs if the roles, role services, or features specified in the answer file to be installed are already installed on the computer, or if the answer file requests their removal and Server Manager found that they did not exist on the computer or have already been removed. In other words, this message occurs if the actions specified in the command result in a null operation.

An instance of a Server Manager wizard is already running on this computer

1004

Error: Another user is running a wizard in the Server Manager user interface.

If one of the Server Manager wizards (Add Roles, Add Features, Add Role Services, Remove Roles, Remove Features, Remove Role Services) is already running, attempts to run the Server Manager command line to install or remove roles, role services, or features fail. Server Manager prevents conflicting user changes to the software packages installed on a server by running only one tool at a time. Either the command-line tools or a Server Manager wizard can be run at one time, but not both simultaneously.

A failure occurred while collecting the list of installed roles or features, or while installing or removing the items specified by the user.

1000

Error: Installation of one or more roles, role services, or features failed. Check the Server Manager log for additional information and try again.

Error: Removal of one or more roles, role services, or features failed. Check the Server Manager log for additional information and try again.

Two different messages might vary slightly, depending on whether the user specified roles or features in the command.

Same as error 1000, except that a restart is required by this error to undo any changes made to the computer.

1001

Error: Installation of one or more roles, role services, or features failed, and a restart is required to undo any changes made to the computer. Check the Server Manager log for additional information and try again.

Error: Removal of one or more roles, role services, or features failed, and a restart is required to undo any changes made to the computer. Check the Server Manager log for additional information and try again.

Error: Installation of the role, role service, or feature failed because the computer must be restarted to complete another installation or removal. After restarting the computer, try to install the role, role service, or feature again.

Error: Removal of the role, role service, or feature failed because the computer must be restarted to complete another installation or removal. After restarting the computer, try to remove the role, role service, or feature again.

The different messages might vary slightly, depending on whether the user specified roles or features in the command.

Generic error

1002

Error: Generic error. {0}

This is a generic error for which there is no troubleshooting information available. In the event you receive this error, it is recommended you verify the syntax of your command, verify that you are logged on to the local computer as a member of the Administrators group, and retry the command.

{0} represents the exception found by Server Manager.

XML results file

The following is an example of the XML results file created by Server Manager when the -resultPath or -r parameter is added to the Server Manager line command, and a path and name are provided in the parameter.

< ServerManagerConfigurationResult
Action="Install"
Time="2006-11-29T14:26:39"
Language="en-US"
Success="true"
RequiresReboot="false"
xmlns="http://schemas.microsoft.com/sdm/Windows/ServerManager/Configuration/2007/1">
<Message Level="Information">Start Installing...</Message>
<Role DisplayName="DHCP Server"
Id="DHCP"
Success="true"
RequiresReboot="false"
RequestedBy="UserSpecified">
<Message Level="Information">Succeeded: [DHCP Server] </Message>
</Role>
<Message Level="Information">Install succeeded.</Message>
</ServerManagerConfigurationResult>

The following table identifies and describes elements found in the results file.

Element or attribute Description

ServerManagerCommandLineResult

Heading element; container for entire file.

Action

Identifies whether the results shown are for an installation or removal operation.

Time

Displays the date and time the operation was completed.

Language

Displays the language code (in the example, this is English-United States) for the localized messages included in the results.

Success

Displays the value "true" if the action was successful for all roles, role services, and features specified in the command; "false" if the action failed for one or more roles, role services, or features.

RequiresReboot

Displays the value "true" if you must restart the computer because of the successful installation or removal operation; "false" if no restart is required.

Xmlns

This attribute references the Server Manager command-line XML schema definition.

Message

All informational, warning, and error messages are included in the body of the XML file. A general message about the entire operation is found at the top level. However, if a message applies to a specific role, role service, or feature, the message is contained within the specific element for that item. Messages are localized in the language specified by the Language attribute.

  • Level Describes whether the message is informational, a warning, or an error.

  • Code If applicable, displays a numerical error or message code. Server Manager error and message codes are described in this topic, in the Text-only log file section.

Role, Role Service, or Feature

Role, Role Service, or Feature elements can occur multiple times in the results file, depending on the objects for which the Server Manager command line answer file requests installation or removal.

  • DisplayName Localized name of the role, role service, or feature.

  • Id The command name for the role, role service, or feature. A list of command names for roles, role services, or features is available in Overview of Server Manager Commands.

  • RootParent Name of the parent object for the value specified in the DisplayName attribute. For example, the parent object of the Request Filtering role service is Web Server.

  • Success Displays a value of "true" if the action specified in the Action attribute was successful on the object specified in DisplayName, and "false" if the action failed.

  • RequiresReboot Displays a value of "true" if the installation or removal of the object specified in the DisplayName attribute requires a restart of the computer, and "false" if no restart is required.

  • Skipped Displays a value of "true" if the roles, role services, or features specified in the answer file to be installed are already installed on the computer, or if the answer file requests their removal, and Server Manager found that they did not exist on the computer, or have already been removed. In other words, this attribute has a "true" value only if the actions specified in the command result in a null operation. Displays a value of "false" if Server Manager completed the actions specified in the command.

  • RequestedBy Displays the reason a role, role service, or feature was installed or removed. There are four possible values.

    • Direct request of a user

    • Required by dependency of another role, role service, or feature

    • A container object was installed or removed, and this object is selected by default

    • All child objects of a container role, role service, or feature were selected (for example, the user added the -allSubFeatures parameter to the Server Manager command)

  • Message See the Message description in the preceding row. Messages nested within Role, Role Service, or Feature elements are specific to that object only.


Starting Windows PowerShell with All Modules Loaded

By default, Windows PowerShell modules and snap-ins are not loaded in Windows PowerShell sessions. This topic describes how to start Windows PowerShell so that all of the installed modules and snap-ins are loaded automatically.

Starting Windows PowerShell with all modules and snap-ins loaded

The following procedure describes how to start a Windows PowerShell session with all modules and snap-ins loaded by default.

To start Windows PowerShell so that all the Windows PowerShell modules and snap-ins are loaded

  • Right-click the Windows PowerShell icon in the taskbar, and then click Import All Modules.

    Note

    In Windows Server® 2008 R2, the Windows PowerShell icon is pinned to the taskbar by default. However, you must start Windows PowerShell one time to make the Import All Modules task appear.


Remote Management with Server Manager

In Windows Server® 2008 R2, you can use Server Manager to perform some management tasks on remote computers. To manage a computer remotely by using Server Manager, you connect Server Manager to a remote computer in the same manner you would connect Microsoft Management consoles (MMCs) for other technologies.

Supported remote management scenarios

The following remote management scenarios are supported from Server Manager in Windows Server 2008 R2.

  • Server to server Server Manager on a full installation of Windows Server 2008 R2 can be used to manage roles and features that are installed on another server that is running Windows Server 2008 R2.

  • Server to Server Core Server Manager on a full installation of Windows Server 2008 R2 can be used to manage roles and features that are installed on a Server Core installation of Windows Server 2008 R2.

  • Client to server Server Manager is installed as part of Remote Server Administration Tools on a computer that is running Windows® 7. This can be used to manage roles and features on a computer that is running either the full or Server Core installations of Windows Server 2008 R2.

Source computer |  | To Remote Computer |  |  | Domain C (added as trusted host)
 |  | Domain A | Domain B | Workgroup |
 | Domain A | √ |  |  |
 | Domain B |  | √ |  |
 | Workgroup |  |  | √ | √
Notes
  • If you are managing a remote computer from a computer that is running Windows 7, start the Windows Remote Management (WinRM) service to allow for the addition of trusted hosts. Open a Command Prompt session with elevated user rights by clicking Start, clicking All Programs, clicking Accessories, right-clicking Command Prompt, and then clicking Run as administrator. Type the following, and then press Enter: net start winrm
  • For remote connections in a Workgroup to Workgroup/Domain scenario, the remote computer must be added to the trusted hosts list on the source computer. To do this, run the following command on the source computer in a Command Prompt window that is opened with elevated user rights.
  • winrm set winrm/config/client @{TrustedHosts="RemoteComputerName"}
  • For remote connections in a Workgroup to Workgroup/Domain scenario, if a user is not logged on by using the source computer’s built-in administrator account, the following WinRM registry key must be configured to allow remote access from the source computer. This change is required because of a User Account Control (UAC) limitation on non-administrator accounts that are members of the Administrators group. To change this registry key, run the following command on the source computer at a command prompt that is opened with elevated user rights.
  • reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f
  • By default, WinRM allows for a maximum of five connections to a remote computer to be active per user. To increase the limit, run the following command on the source computer, in which X represents the number of connections that you want to allow, at a command prompt that is opened with elevated user rights.
  • winrm s winrm/config/winrs @{MaxShellsPerUser="X"}

Security considerations for remote management by using Server Manager

Important

You must be a member of the Administrators group on computers that you want to manage by using Server Manager.

Because Server Manager remote management capability is provided by using Windows PowerShell technology, Server Manager remote management inherits security considerations from Windows PowerShell. A malicious user can try to steal logon credentials provided by an administrator over a remote connection, but generally, this is a low risk. Other potential threats of which there is very low risk include modification of dynamic link libraries (DLLs) by malicious users, or tries to obtain sensitive or personally identifying data in the Server Manager log file. Users who have rights to access the local computer can read Server Manager log files, but log files do not contain sensitive personal or account information such as passwords.

Tasks that you can perform on a remote server by using Server Manager

You can perform the following tasks in Server Manager on a remote computer.

  • View Windows automatic updating status

  • Run Best Practices Analyzer scans on roles. For more information, see Running and Filtering Scans in Best Practices Analyzer.

  • View or change Windows Customer Experience Improvement Program (CEIP) status

  • Configure Windows Error Reporting

  • View or change Windows Firewall information

  • View and manage roles from role home pages

    Note

    To use role- or feature-specific tools or snap-ins in a Server Manager console that is connected to a remote server, those tools must be installed on the source computer by using Remote Server Administration Tools.

  • View Internet Explorer Advanced Security Configuration settings

  • Manage services from a role home page

Tasks that you cannot perform remotely by using Server Manager

Primarily to minimize security risks to your servers, the following tasks cannot be completed in a remote Server Manager session.

  • Add or remove roles, role services, and features

  • Configure Remote Desktop settings

  • Configure System Properties

  • Check for new roles

  • Change Windows automatic updating settings

  • Change network settings

  • Change the computer name or domain membership

  • Change Internet Explorer Advanced Security Configuration settings

  • Run the Security Configuration Wizard, if the source computer is a server that is running Windows Server 2008 R2

Enabling or disabling remote management in Windows Server 2008 R2

To help protect servers from unauthorized access, and before administrators can connect to a computer that is running Windows Server 2008 R2 remotely by using Server Manager, Server Manager remote management must be enabled on the destination computer.

Before you configure a server for remote management by using Server Manager, you must enable several Group Policy settings that control Windows Firewall exceptions. Follow the steps in To set Group Policy for Server Manager remote management to verify that no Group Policy settings override configuration of the server for remote management.

Note

Procedures in this section can be completed only on a computer that is running Windows Server 2008 R2. You cannot enable or disable remote management on a computer that is running Windows 7 because Windows 7 cannot be managed by using Server Manager.

  • To set Group Policy for Server Manager remote management

  • To configure Server Manager remote management by using the Windows interface

  • To configure Server Manager remote management by using Windows PowerShell

To set Group Policy for Server Manager remote management

  1. On the computer that you want to manage remotely, open Local Group Policy Editor. To do this, click Start, click Run, type gpedit.msc in the Open box, and then press Enter.

  2. Expand Computer Configuration, Administrative Templates, Windows Components, Windows Remote Management, and then select WinRM Service.

  3. In the details pane, double-click Allow automatic configuration of listeners.

  4. Select Enabled, and then click OK.

  5. In the tree pane, expand Windows Settings, Security Settings, Windows Firewall with Advanced Security, and then Windows Firewall with Advanced Security.

  6. Right-click Inbound Rules, and then click New Rule.

  7. In the New Inbound Rule Wizard, on the Rule Type page, select Predefined.

  8. On the Predefined pull-down menu, select Remote Event Log Management. Click Next.

  9. On the Predefined Rules page, click Next to accept the new rules.

  10. On the Action page, select Allow the connection, and then click Finish. Allow the connection is the default selection.

  11. Repeat steps 5 through 10 to create new inbound rules for the following two additional predefined rule types.

    • Remote Service Management

    • Windows Firewall Remote Management

  12. Close Local Group Policy Editor.
To configure Server Manager remote management by using the Windows interface

  1. On the computer that you want to manage remotely, open Server Manager. To open Server Manager, click Start, point to Administrative Tools, and then click Server Manager.

  2. In the Server Summary area of the Server Manager home page, click Configure Server Manager Remote Management.

  3. Do one of the following.

    • To let this computer to be managed remotely by using Server Manager, select Enable remote management of this server from other computers.

    • To prevent this computer from being managed remotely by using Server Manager, clear the Enable remote management of this server from other computers check box.

    • If you want to enable remote management, but cannot change the setting, follow the steps in the procedure To set Group Policy for Server Manager remote management, and then go on to the next step.

  4. Click OK.

  5. Verify that exceptions to the following firewall rules are enabled, and are not disabled by Group Policy settings.

    • Remote Service Management (NP-In)

    • Remote Service Management (RPC)

    • Remote Service Management (RPC-EPMAP)

    • Remote Event Log Management (NP-In)

    • Remote Event Log Management (RPC)

    • Remote Event Log Management (RPC-EPMAP)

    • Windows Firewall Remote Management (RPC)

    • Windows Firewall Remote Management (RPC-EPMAP)

    To do this, do the following.

    1. Open the Windows Firewall with Advanced Security snap-in by doing one of the following:

      • In the Security Information area of the Server Manager main window, click Go to Windows Firewall.

      • In the Server Manager tree pane, expand Configuration, and then click Windows Firewall with Advanced Security.

      • Click Start, point to Administrative Tools, and then click Windows Firewall with Advanced Security.

    2. In the Getting Started area of the Windows Firewall with Advanced Security details pane, click Inbound Rules.

    3. In the list of rules, locate the rules that are specified in this step.

    4. If No is displayed in the Enabled column for any of the specified rules, double-click the rule to open the Properties dialog box for the rule.

    5. On the General tab of the rule’s Properties dialog box, select Enabled. Click OK.

      Note

      Although remote management by using Server Manager is still possible if exceptions to the Remote Event Log Management firewall rules are disabled, remote connection times can be very slow, depending on the number of roles and features that are running on the computer that you want to manage, unless exceptions to these firewall rules are enabled. We recommend that you enable Remote Event Log Management firewall rules to prevent connection delays.

To configure Server Manager remote management by using Windows PowerShell

  1. On the computer that you want to manage remotely, open a Windows PowerShell session with elevated user rights. To do this, click Start, click All Programs, click Accessories, click Windows PowerShell, right-click the Windows PowerShell shortcut, and then click Run as administrator.

  2. In the Windows PowerShell session, type the following, and then press Enter.

    Set-ExecutionPolicy -ExecutionPolicy RemoteSigned

  3. Type the following, and then press Enter to enable all required firewall rule exceptions.

    Configure-SMRemoting.ps1 -force -enable

To configure remote management on the Server Core installation option of Windows Server 2008 R2

  1. On the computer that you want to manage remotely, at the command prompt that opens by default when a member of the Administrators group logs on to the computer that is running the Server Core installation option of Windows Server 2008 R2, type the following, and then press Enter.

    Dism.exe /Online /Enable-Feature /FeatureName:NetFx2-ServerCore /FeatureName:MicrosoftWindowsPowerShell /FeatureName:ServerManager-PSH-Cmdlets /FeatureName:BestPractices-PSH-Cmdlets

  2. After the installation has completed, close all applications, and then restart the computer.

    To verify that Windows PowerShell and cmdlets for Server Manager and Best Practices Analyzer are installed, try entering the oclist command, which returns a list of all Windows features that are installed on the computer.

  3. After the operating system has finished loading, log on to the computer as, at minimum, a member of the local Administrators group.

  4. In the Command Prompt window that opens after you have logged on to the computer, type the following to open a Windows PowerShell session, and then press Enter.

    powershell

  5. In the Windows PowerShell session, type the following, and then press Enter.

    Set-ExecutionPolicy -ExecutionPolicy RemoteSigned

  6. Type the following, and then press Enter to enable all required firewall rule exceptions.

    Configure-SMRemoting.ps1 -force -enable

Connecting to remote computers by using Server Manager

Do the following to manage a remote server by using Server Manager.

To connect to another computer by using Server Manager

  1. Open Server Manager. To open Server Manager, click Start, point to Administrative Tools, and then click Server Manager.

  2. In the tree pane, right-click Server Manager, and then click Connect to Another Computer.

  3. In the Connect to Another Computer dialog box, enter the name or IP address of another computer that is running Windows Server 2008 R2 in the Another computer text box, or browse for another server on the network. Click OK.

    In the Another computer string box, you can specify a NetBIOS name, a fully-qualified domain name (FQDN), or an IPv4 or IPv6 address. If no port number is specified, the default port number is used. The following are examples of formats you can specify in the Another computer text box.

    • ComputerName

    • ComputerName:PortNumber

    • IP address: n.n.n.n

    • IPv6 address: [n:n:n:n]

    • IPv4 address with port number: n.n.n.n:PortNumber

    • IPv6 address with port number: [n:n:n:n]:PortNumber

    Note

    If an administrator has changed the computer’s default port number, the nondefault port must be opened in Windows Firewall to allow incoming connections on that port. Port 5985 is opened by default when WinRM is configured as described in To set Group Policy for Server Manager remote management in this topic. Nondefault ports remain blocked until opened. For more information about how to unblock a port in Windows Firewall, see the Help for Windows Firewall. For more information about how to configure WinRM, in a Command Prompt session, type winrm help, and then press Enter.

    After you connect to a remote computer, notice that the name of the computer changes in the Server Manager console. The computer name in the Server Manager node of the tree pane, the Full Computer Name field in the Server Summary area of Server Manager, and the computer name in the console heading all change to the name of the remote computer to which you are connected. Because Server Manager resolves IP addresses to FQDNs, if you connected to a remote computer by using an IP address, the Server Manager console displays the FQDN of the remote computer.

    Note

    If you are connecting to a computer in a different domain by using an IP address, the remote connection might fail, because of DNS Server limitations that can result in a failure to resolve the IP address to a host name. If this occurs, try connecting by specifying an FQDN.

To run the Server Manager Get-WindowsFeature cmdlet on a remote computer from a Windows PowerShell session

  1. Open a Windows PowerShell session with elevated user rights. To do this, click Start, click All Programs, click Accessories, click Windows PowerShell, right-click the Windows PowerShell shortcut, and then click Run as administrator.

  2. Type the following, for which ComputerName is the name of the remote computer that is running Windows Server 2008 R2, and UserName is the name of a user who is a member of the Administrators group on the remote computer, and then press Enter.

    Enter-PSSession <ComputerName> –credential <UserName>

  3. You are prompted to enter your password in a secure dialog box. Type your password, and then press Enter.

  4. In the Windows PowerShell session, type the following to load the Server Manager snap-in, and then press Enter.

    Import-Module ServerManager

  5. Type the following, and then press Enter.

    Get-WindowsFeature

  6. After the results of the Get-WindowsFeature cmdlet are displayed in your Windows PowerShell session, type the following to close the Windows PowerShell session, and then press Enter.

    Exit-PSSession

Managing multiple computers by using Server Manager and MMC

You can also create a custom Microsoft Management Console (MMC) that contains multiple Server Manager snap-ins, each targeted to manage a different remote computer.

To manage multiple computers by using Server Manager and MMC

  1. To open Microsoft Management Console, click Start, click Run, type mmc, and then click OK.

  2. On the File menu, click Add/Remove Snap-in.

  3. In the Available snap-ins list, select Server Manager.

  4. Click Add to add Server Manager to the Selected snap-ins list.

  5. Repeat the previous step as many times as needed to add Server Manager snap-ins to your MMC. Click OK.

  6. In the tree pane of the new MMC, right-click the top node of a Server Manager snap-in, and then click Connect to Another Computer.

  7. In the Connect to Another Computer dialog box, enter the name or IP address of another computer in the Another computer string box, or browse for another server on the network. Click OK.

    After you connect to a remote computer, notice that the name of the computer changes in the Server Manager node of the tree pane.

  8. If you have additional Server Manager snap-ins in the MMC, repeat this procedure from step 6 to connect additional Server Manager snap-ins to other remote computers.

  9. On the File menu, click Save to save your custom MMC.

Remote management from Windows 7

Although computers that are running Windows 7 cannot be managed by using Server Manager, you can install Server Manager on a computer that is running Windows 7 by installing Remote Server Administration Tools. Remote Server Administration Tools for Windows 7 is available for download on the Microsoft Web site (http://go.microsoft.com/fwlink/?LinkId=131280). After Remote Server Administration Tools is installed, you can connect a Server Manager console to a remote computer that is running Windows Server 2008 R2, and perform the management tasks on the destination server that are identified in Tasks you can perform on a remote server by using Server Manager in this topic.

After you install Remote Server Administration Tools on a computer that is running Windows 7, just as on a computer that is running Windows Server 2008 R2, you can create a custom Server Manager MMC to manage multiple remote computers that are running Windows Server 2008 R2. To create a custom Server Manager MMC on a computer that is running Windows 7 and Remote Server Administration Tools, see Managing multiple computers by using Server Manager and MMC in this topic.

To manage remotely from a computer that is running Windows 7

  1. Install Remote Server Administration Tools on the computer that is running Windows 7.

    Download the Remote Server Administration Tools package from the Microsoft Web site, then follow the instructions that are provided on the Download Center page to install Remote Server Administration Tools.

    To use role- or feature-specific tools or snap-ins in a Server Manager console that is connected to a remote server, those tools must be installed on the source computer by using Remote Server Administration Tools.

  2. After Remote Server Administration Tools is installed, open Server Manager. To open Server Manager, click Start, point to Administrative Tools, and then click Server Manager.

  3. In the tree pane, right-click Server Manager, and then click Connect to Another Computer.

  4. In the Connect to Another Computer dialog box, enter the name or IP address of a computer that is running Windows Server 2008 R2 in the Another computer string box, or browse for another server on the network. Click OK.

    After you connect to a remote computer, notice that the name of the computer is displayed in the Server Manager console. You can see the name of the remote computer to which you are connected in the Server Manager node of the tree pane, the Full Computer Name field in the Server Summary area of Server Manager, and the computer name in the console heading.


Accessibility Features in Server Manager

This topic describes two types of keyboard shortcuts: shortcuts for the Server Manager home page and shortcuts for the active window.

Server Manager home page keyboard shortcuts

The following table lists keyboard shortcuts for the menu commands that act on the entire Server Manager console, or the Server Manager home page.

Action | Result
F5 | Refreshes the content of the Server Manager home page.
ALT+SPACEBAR | Displays the window menu.
ALT+F4 | Closes Server Manager.
ALT+A | Displays the Action menu.
ALT+V | Displays the View menu.
ALT+F | Displays the File menu.
ALT+H | Displays the Help menu.

Server Manager active window or object keyboard shortcuts

The following table lists keyboard shortcuts for the menu commands that act on the active window or object (such as a node in the hierarchy pane) in Server Manager.

Action | Result
ALT+MINUS SIGN | Displays the window menu for any page in Server Manager.
SHIFT+F10 | Displays the Action shortcut menu for the selected item.
F1 | Opens the Help topic, if any, for the selected item.
F5 | Refreshes the content displayed by Server Manager.
CTRL+F10 | Maximizes the active page in Server Manager.
CTRL+F5 | Restores the active page in Server Manager.
ALT+ENTER | Displays the Properties dialog box, if any, for the selected item.
F2 | Renames the selected item, if the item can be renamed.

Navigation in Server Manager using the keyboard

The following table lists the keys and key combinations you can use to move in and between panes and grouped areas in any Server Manager page.

Keystroke Action | Result
TAB or F6 | Moves forward between panes in the active window.
SHIFT+TAB or SHIFT+F6 | Moves backward between panes in the active window.
CTRL+TAB or CTRL+F6 | Moves forward between windows.
CTRL+SHIFT+TAB or CTRL+SHIFT+F6 | Moves backward between windows.
PLUS SIGN (+) on the numeric keypad | Expands the selected item.
MINUS SIGN (-) on the numeric keypad | Collapses the selected item.
Asterisk (*) on the numeric keypad | Expands the entire tree below the root item in the active window.
UP ARROW | Moves the selection up one item in a pane.
DOWN ARROW | Moves the selection down one item in a pane.
PAGE UP | Moves the selection to the top item visible in a pane.
PAGE DOWN | Moves the selection to the bottom item visible in a pane.
HOME | Moves the selection to the first item in a pane.
END | Moves the selection to the last item in a pane.
RIGHT ARROW | Expands the selected item. If the selected item does not contain hidden items, behaves like DOWN ARROW.
LEFT ARROW | Collapses the selected item. If the selected item does not contain exposed items, behaves like UP ARROW.
ALT+RIGHT ARROW | Moves the selection to the next item. Performs the same function as the Forward arrow on the toolbar.
ALT+LEFT ARROW | Moves the selection to the previous item. Performs the same function as the Back arrow on the toolbar.