Windows Server Core notes

(some commands taken from Sander Berkouwer: How to install a Server Core R2 Domain Controller)

For most tasks, you can use sconfig.cmd. But, if you’re not running Server Core, or you just want to know how to do it yourself, here are some examples in no particular order:

• Set the local Administrator account to never expire:
  wmic useraccount where "name='Administrator'" set passwordexpires=false
• Get a list of network interfaces:
  netsh int ipv4 show int
• Set a static IP address:
  netsh int ipv4 set addr local static 192.2.0.100 255.255.255.0 192.2.0.1
  The local parameter is the name of the interface.
• Set DNS server(s):
  netsh int ipv4 set dns local static 192.2.0.2 primary
• Set secondary, tertiary, …, DNS servers:
  netsh int ipv4 add dns local 192.2.0.3
• Rename the computer:
  netdom renamecomputer %computername% /NewName:new-name
• Join a domain:
  netdom join %computername% /domain:deep6.test
• License the computer:
  cscript slmgr.vbs /ipk YC6KT-GKW9T-YTKYR-T4X34-R7VHC
  cscript slmgr.vbs /ato
• Configure Windows Update:
  

  cd /d %SystemRoot%\System32
  net stop wsuaserv
  cscript scregedit.wsf /AU /4
  net start wsuaserv

  The 4 means Automatically download and schedule installation.
• Change the Windows Update schedule:
  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v ScheduledInstallTime /t reg_dword /d 12 /f
  The above example sets the time to 12:00 (noon).
• Install Windows Updates:
  wuauctl /detectnow
  You might have better luck with the sconfig.cmd helper; it calls a ‘fancy’ VBScript that uses the Microsoft.Update.Session COM object.
• Change the timezone:
  1. Find your timezone string:
     tzutil /l
     (That’s lowercase “ell”, though the command itself isn’t case-sensitive.)
  2. Set the timezone:
     tzutil /s "Pacific Standard Time"

In addition, cscript scregedit.wsf /cli shows some other useful commands.

To promote the machine to be a domain controller (in this example, in a new forest):

dcpromo /NewDomain:forest /NewDomainDNSName:deep6.test /ReplicaOrNewDomain:domain /InstallDNS:yes /SafeModeAdminPassword:hunter2

You could instead create an answer file for unattended installation:

[DCInstall] 
NewDomain=forest
NewDomainDNSName=deep6.test
ReplicaOrNewDomain=domain
InstallDNS=Yes
SafeModeAdminPassword=hunter2

And then run:

dcpromo /unattend:unattend.txt

PowerShell version (may require role addition – to be tested):

Import-Module ADDSDeployment ; Install-ADDSForest -CreateDnsDelegation:$false -DatabasePath "C:\Windows\NTDS" -DomainMode "WinThreshold" -DomainName "deep6.test" -DomainNetbiosName "DEEP6" -ForestMode "WinThreshold" -InstallDns:$true -LogPath "C:\Windows\NTDS" -NoRebootOnCompletion:$false -SysvolPath "C:\Windows\SYSVOL" -Force:$true

The ‘easiest’ way to do command-line administration of AD is probably with the ds* commands. Here are some examples to get you started:

• Find a user:
  dsquery user -name Administrator
• Set an account’s password to never expire:
  dsmod user "cn=Administrator,cn=Users,dc=deep6,dc=test" -pwdneverexpires yes
• Find a user, then set an account’s password to never expire :-)
  dsquery user -name Administrator | dsmod user -pwdneverexpires yes

If you’re feeling penitent, here are some wmic commands instead:

• Find a user:
  

  C:\>wmic /namespace:\\root\directory\ldap path ds_user ^
  More? where "ds_cn='Administrator'" get ds_distinguishedName,ds_userAccountControl
  DS_distinguishedName                        DS_userAccountControl
  CN=Administrator,CN=Users,DC=deep6,DC=test  66048

Unfortunately it’s not possible to use wmic to set user properties; the Active Directory (DS) WMI Provider has a quirky way of updating properties.

dnscmd.exe is the usual command-line utility for DNS management.

• Enumerate zones:
  dnscmd /enumzones
• Add a new zone:
  dnscmd /zoneadd 0.168.192.in-addr.arpa. /dsprimary
  The /dsprimary switch stores the primary zone in Active Directory.
• Allow only secure updates to a zone:
  dnscmd /config 0.168.192.in-addr.arpa. /allowupdate 2
  2 means secure updates.
• Display zone data:
  dnscmd.exe /zoneprint

---

Feel free to contact me with any questions, comments, or feedback.