10 Windows Server 2008 Netsh commands you should know

I have written a number of different Netsh articles and other authors have published their own Netsh articles. This just shows how important and innovative Netsh really is. In this article, I will cover 10 Netsh commands that every Windows admin should know. In my opinion. Netsh is so powerful and flexible; I cannot choose the "most important" Netsh commands as the importance of a command will vary from admin to admin. What I can do is to choose the 10 commands that I feel will either show you valuable information or will help you out when you are in trouble. Keep in mind that these commands can be scripted (as they are all command line tools) so whatever you can do with just an individual command on a single machine, you could write a script to perform that command on all machines in your network.

What is Netsh?

Microsoft Windows Netsh is a command line scripting utility. With Netsh, you can view or change the network configuration of your local computer or a remote computer. You can manually run Netsh commands or you can create batch files or scripts to automate the process. Not only can you run these commands on your local computer but also on remote computers, over the network.

Netsh also provides a scripting feature that allows you to run a group of commands in batch mode against a specified computer. With netsh, you can save a configuration script in a text file for archival purposes or to help you configure other computers.

Netsh is not "new" with Windows Server 2008 or Windows Vista. Netsh has been around for a long time. Netsh commands are available in Windows 2000, XP, and Windows Server 2003. What is new are a number of options for Netsh with Windows Server 2008 and Vista. Additionally, I feel that Netsh is underutilized by admins and most admins are not aware of the new Windows Server 2008 and Vista Netsh enhancements. It is my hope to educate Windows admins about the new netsh features and the power of netsh in this article.

What is different about Windows Server 2008 netsh vs. Windows XP?

There are a number of differences even at the core command level between the Windows XP version of netsh and the Windows Server 2008 netsh. To compare these, I ran "netsh /?" in each operating system. While Windows XP has "routing" listed as a context and Windows Server 2008 does not, that is the only context that Win 2008 lacks (and that is included in the Win 2008 RAS context). Otherwise, Windows Server 2008 has the following netsh context options available that Windows XP does not:

• dhcp
• dhcpclient
• http
• ipsec
• lan
• nap
• netio
• rpc
• winhttp

Thus, as you can see, there are many more "context" / options available in Window Server 2008.

With no more delay, let's get started with our Netsh top 10 Netsh commands that every admin should know.

#10 – How to get help

Every Windows admin should know how to get guided help with netsh. This is easy – just use the "/?" command to be guided through what you are trying to do. For example, to show all netsh contexts (categories of options), just type: netsh /?

Figure 1: Results of netsh /? help options

From there, you can select a context and be guided through configuring or showing options in that context. For example, say that I typed netsh lan /?, I would see:

Figure 2: Results of netsh lan /?

From there, I can continue with the guided help by doing-

netsh lan show /?

And, from there, I would see that I can show interfaces with-

netsh lan show interfaces

Being able to guide yourself through the many netsh commands using /? is a very valuable skill.

#9 – Supplying remote machine names and credentials

If you run netsh /? you will see that you can supply the remote machine name & IP address and credentials for the remote machine you will run netsh against. The options are "-r" for the machine, "-u" for the username, and "-p" for the password. Here is an example:

netsh -r WinXP-1 -u winxp-1\administrator -p My!Pass1 interface ip show config

As you can see, I supplied the remote machine name, remote username, and password which allowed me to perform this command over the network. You can perform any of the commands shown here over the network as long as the remote machine supports that command (different operating systems will use different variations of commands).

#8 – Run Netsh in interactive mode or with a script

Netsh can be run either interactively (just you typing commands manually) or when using scripting. Say that you wanted to manually step through some commands on your local machine or remote machine. You could just start by typing netsh at the command line and you would see:

netsh>

From there, you can enter all the netsh commands you want, or even tell netsh to connect to a remote machine with set machine.

On the other hand, you could use netsh –f <scriptfile> and specify a script that netsh would use.

#7 – Open a port on your firewall

With netsh, you can quickly and easily open a port on your firewall if you know the right command. Here is an example of opening port 445-

netsh firewall set portopening tcp 445 smb enable

If the command was successful, you should get a response of "Ok."

#6 – Export your current network configuration to a file and import it

With netsh, exporting and importing your IP address configuration is easy – unlike in the GUI interface. To export your configuration, just do:

netsh –c interface dump > test.txt

Figure 3: Export of IP address configuration and viewing the file

Later on this machine or on a different machine, you could import this configuration with-

netsh –f test.txt

#5 – Try out the latest Netsh uses

As mentioned above, there are a lot of new features in Windows Server 2008 as it pertains to netsh.

Here are the new categories that I see on my Windows Server 2008 system:

• dhcp
• dhcpclient
• http
• ipsec
• lan
• nap
• netio
• rpc
• winhttp

For example, you can configure not only your DHCP client but also your DHCP server. You can configure IPSec encryption, the network access protection (NAP) client, and many more!

As you add other roles & features to your server, you will have additional contexts available to you. For example, if you add the network policy server to Windows Server 2008, you will have "nps" as a net netsh context that can be configured.

For the official Microsoft Windows Server 2008 netsh documentation, see this URL:

Microsoft TechNet- Windows Server 2008 -Netsh Technical Reference

#4 – TCP/IP troubleshooting and interface resets

There are a number of things you can do with netsh to troubleshoot and reset your TCP/IP network interface. Here are some examples:

• Reset all IP protocol stack configurations on your interface and send the output to a log file- netsh int ipv4 reset resetlog.txt
• Install the TCP/IP protocol- netsh int ipv4 install
• UnInstall the TCP/IP protocol- netsh int ipv4 uninstall

#3 – Configure the Windows Advanced Firewall

In my previous article, How to Configure Windows 2008 Advanced Firewall with the NETSH CLI, I discussed how you can now configure the new Windows advanced (bi-directional) firewall using the new advfirewall networking context settings using netsh in Windows Server 2008 and Windows Vista. Of course, you can also configure the traditional Windows firewall. Here are some examples:

• Show all firewall rules - netsh advfirewall firewall show rule name=all
• Delete an inbound advanced firewall rule for port 21 - netsh advfirewall firewall delete name rule name=all protocol=tcp localport=21
• Export Windows Advanced Firewall settings - netsh advfirewall export "c:\advfirewall.wfw"

Perhaps the most common command you might use is the command to enable or disable your Windows firewall, like this:

netsh firewall set opmode disable

or

netsh firewall set opmode enable

However, for more specific information & examples, please see my article, above.

#2 – Configure Wireless Settings

In another article, Configuring Windows Server 2008 & Windows Vista Wireless connections from the CLI using netsh wlan, I discussed how you can now configure wireless networking context settings using netsh in Windows Server 2008 and Windows Vista. Here are some examples:

• Connect to an already defined wireless network- netsh wlan connect ssid="mySSID" name="WLAN-Profil1"
• Show your current wireless settings - netsh wlan show settings
• Add an already exported wireless network profile - netsh wlan add profile filename="Wireless Network Connection-BOW.xml"

However, for more specific information, please see my article, above.

#1 – Configure your IP Address & Network interface settings

As netsh is the "network shell", what better way to use it than to configure your basic network settings? Here are some examples:

• Show your IP address - netsh interface ip show config
• Set an interface to use DHCP for its IP address configuration - netsh interface ip set address name="Local Area Connection" source=dhcp
• Set an interface to use a static IP address for its IP address configuration - netsh interface ip set address "Local Area connection" static 10.0.0.9 255.0.0.0 10.0.0.1 1
• Or, add a DNS Server entry – netsh interface ip add dnsserver "Local Area Connection" 10.0.0.1

For more examples of configuring basic network settings with Netsh, see this article- Petri Knowledgebase – How can I configure TCP/IP settings from the command prompt?

How to Get the Most Out of the Windows 2008 and Vista Networking & Sharing Center

In Windows Server 2008 and in Windows Vista, when you go to Control Panel and look at your network configuration, you will have to use the Networking and Sharing Center. Initially, this may be confusing to veteran Windows Admins. In this article you will not only familiarize yourself with it but you will learn how to use it and how to get the most out of it. Let's get started learning about the Windows Server 2008 & Windows Vista Networking and Sharing Center.

What is the Networking and Sharing Center?

In Windows XP and Windows Server 2003, you had your "Networking Properties" which was really just focused around the configuration of your network adaptors. You could configure things like TCP/IP settings and whether or not the Firewall was enabled. Unfortunately, to configure and check the status of other network functionality like file sharing, you had to go somewhere else. In fact, it was not possible to configure networking functions all in one place.

We all know that one of the most important reasons that you configure networking in Windows is to share files. This is especially true on a Windows Server and it is commonly done on Vista desktop machines in SMBs.

With the new Networking and Sharing Center, you will see how Microsoft has brought many fragmented networking configuration interfaces, together into one "center".

Now, let's take a look at the Networking and Sharing Center. To access the Networking and Sharing Center in Windows Vista and in Windows Server 2008, you go to the Control Panel and click on Networking and Sharing Center. Here is what you will see:

Figure 1: Networking and Sharing Center in Windows Vista

Figure 2: Networking and Sharing Center in Windows Server 2008

While these two versions of the Networking and Sharing Center are different in some ways, their core features are the same. Let's find out what the new Networking and Sharing Center has to offer you.

What does the Networking and Sharing Center offer me?

As you can see from the graphics, both offer a graphical view of the networks that they are connected to and how those networks connect to the Internet.

With the new Networking and Sharing Center, you have the concept of private, public, and domain networks. These are called network "locations". With these network locations, you can tell the OS whether that network adaptor is connected to an insecure network connection (such as directly to the Internet) or more secure networks like private networks or domain networks. Whether your network adaptors are LAN interface, wireless, Dialup, or VPN, each network adaptor is attached to one of these types of networks and is grouped accordingly.

To change the network location for an adaptor, click on the Customize link, next to the adaptor and you will see a window like this:

Figure 3: Set Network Location Customization Window

In this window, you can name your custom network, select whether it is a private or public network, and choose an icon for that new custom network location.

Back in the Networking and Sharing Center window, you can view the status of each of these adaptors by clicking on View Status. From here, you see the traditional network adaptor status and properties interface, like this:

Figure 4: Network Adaptor Status and Properties Window (Vista)

The Networking and Sharing Center also offers the Sharing and Discovery section. In this section, you can configure critical network sharing features. In Windows Server 2008, you can configure the following Sharing and Discovery option:

• Network Discovery
• File Sharing
• Public Folder Sharing
• Printer Sharing

Windows Vista has a couple more options. In its Sharing and Discovery section, you can configure:

• Network Discovery
• File Sharing
• Public Folder Sharing
• Printer Sharing
• Password Protected Sharing
• Media Sharing

Thus, Windows Vista has two more sharing and discovery features – password protected sharing and media sharing.

You can quickly see which of these are ON or OFF with small lights next to each. Additionally, if you click on the dropdown next to each one, you will be given more options and given the option to configure them, such as with Network Discovery:

Figure 5: Sharing and Discovery – Network Discovery Settings – Windows Vista

In this drop down, you can either turn off or on network discovery so that others can see your computer or server. You can also move from a WORKGROUP to a DOMAIN, if you wish. Each of the other sharing and discovery options has similar ON/OFF functionality from this menu.

What else can I do with the Networking and Sharing Center?

Besides the core networking & sharing functions we talked about above, there are a number of ancillary but very useful links on the Networking and Sharing Center menu that you can take advantage of. You can see these in the graphic below:

Figure 6: Other Tasks that can be performed in the Networking and Sharing Center

Some of these other tasks are:

• View computers and devices
• Connect to a network
• Setup a new network
• Manage network connections
• Diagnose and repair network connections
• Manage Internet options
• Configure the Windows Firewall
• Show me all the files and folders I am sharing & all the shared network folders on this computer

How can I get the most out of the Networking and Sharing Center?

Whether you are using Windows Vista or Windows Server 2008, the Networking and Sharing Center has a lot of options and functionality. So how can you get the most out of it? Here are my top 5 ways to get the most out of the Networking and Sharing Center:

1. Set the proper network location for your network adaptor – by using networking locations, your adaptors will be in the right group and you discovery/sharing settings will be set accordingly.
2. Analyze each of your sharing and discovery options – ensure that your network adaptors have the proper sharing and discovery settings to ensure that malicious attackers aren't browsing your system unnecessarily.
3. Look at all the files and folders you are sharing – this is really critical to do on any system that you use or administer. What if you have a PC that has a virus which has opened up a shared folder for use? What if you have a server and a junior admin has mistakenly shared out the entire C Drive of the server with anonymous FULL ACCESS? Both of these are very dangerous conditions with dire consequences. By using the Networking and Sharing Center's Show me all the files and folders I am sharing feature, you could prevent the loss of data.
4. Make sure you have enabled the Windows Firewall – the Windows software firewall has new stateful inbound and outbound functionality in Windows Vista and Sever 2008. Make sure you are taking advantage of it by enabling it on each adaptor.
5. Know what the Networking & Sharing Center is, where it is, and when you can use it

Backup and Recovery Issues with Windows Server 2008 (Part 2)

Windows Server 2008 offers a lot of improvements over Windows 2003, but the backup program is not one of them. Even so, there are a few redeeming features. This article discusses the issues that you need to know about before you attempt to backup your Windows 2008 server.

If you read the first part of this article series, then you know that I am not exactly a big fan of the new Windows Backup program. Even so, I did not want to just write an article bashing the new backup utility, and have that be the end of it. Windows Backup does have some good points, and I would not be doing my job if I did not tell you about them. Therefore I want to wrap up the series by telling you about some of Windows Backups good points.

Before I Begin

Before I get started, there is one additional caveat to using Windows Backup that I want to mention. This really should have gone in my last article, but I forgot to mention it. Windows Backup can only backup volumes that are using the NTFS file system. Volumes formatted using other file systems cannot be backed up.

Simplified Restoration

The best change that Microsoft made in Windows Server backup (at least in my humble opinion) was that they made it a lot easier to perform restorations. Even though you can not pick and choose which files and folders you want to back up, you do have the option of restoring individual files and folders. Of course you have always been able to do that with NTBACKUP.

You will notice Microsoft's simplified restoration if you ever need to restore an incremental backup. Previously, restoring an incremental backup usually meant that you had to restore multiple backups. Now, you can just choose the date that you want to restore your data from, and the restoration process will restore any necessary files or folders automatically, even if the data is scattered across multiple incremental backups.

Another area in which Microsoft has made some improvements to Windows Server Backup is in its ability to restore the Windows operating system. I have to confess that I have yet to use the Windows Server 2008 version of Windows Backup to perform a bare metal restore, but I have used the Windows Vista version. Aside from a couple of minor quirks, performing a bare metal restore is really simple.

If you have ever performed a bare metal restore on a machine that was running Windows Server 2003, using NTBACKUP, then you know that there was quite a bit of work involved in the process. Whenever I have had to perform a full restoration of a Windows Server 2003 machine, I had to install the Windows operating system before I could even begin the restore process. I also found through experience that the restore process usually would not work right unless I also installed the same service pack that the server was running at the time that the backup was made.

In contrast, I performed a bare metal restore of a Windows Vista machine last week. Like Windows Server 2008, Windows Vista also uses the Windows Server backup program. There are some minor differences between the two versions, but they are very similar to each other.

At any rate, I have made a full system backup to a USB hard drive. I then installed a new hard drive into the machine. I did not bother to format the drive, partition it, or do anything else to prepare it for use. I simply inserted my Windows Vista installation disk into the machine and boot off of it. Rather than installing Windows Vista, I chose the Repair option, followed by the option to restore my backup. Windows Backup took care of everything. My hard drive was automatically partitioned and formatted, and my PC was returned to its previous state in no time.

Faster Backups

This leads me to another improvement I want to talk about. Windows Backup seems to run more quickly than NTBACKUP did. I have not actually timed the backup process, but it does feel faster than what I was used to with NTBACKUP, and Microsoft also claims that Windows Backup performs better than NTBACKUP because of the way that uses block level backup technology and the Volume Shadow Copy Services (VSS).

Whenever you perform a full backup, Windows scans the disk that is being backup and copies any hard drive blocks that contain data. These blocks are copied to a .VHD file, which is the same file format as the virtual hard drive files that are used by some of Microsoft's virtualization products. Because of the way that these blocks are copied, the backup is not compressed. It is however smaller than the volume that is being backup, because only blocks containing data are copied.

If you happen to perform an incremental backup, then Windows will scan the hard drive to see which blocks contain new data, or data that has changed since the previous backup was made. Only these blocks are backed up, which makes incremental backups really fast.

Of course this raises the question of what happens to the data that is stored in the virtual hard drive file when you perform an incremental backup. Old data that was previously residing in blocks that are being replaced is written to the shadow copy storage area. The Volume Shadow Copy Service is used to differentiate between backup sets, and to track where the various blocks are being written to within the shadow copy storage.

Bare Metal Restoration

Window Backup's use of block level backup technology has at least one side effect that you need to be aware of when you are performing a bare metal restore. When you perform a bare metal restore using Window Backup, the new hard drive will be partitioned identically to the way that the old one was. If the new hard drive is larger than the old one, you will find that there is lots of wasted space on the drive. That does not mean that you can not use this space, it simply means that the space is not used by default. You always have the option of extending a volume so that you can make use of empty space on the drive.

Manageability

One last thing that I want to mention is that there are some very welcome changes is to Windows Backup in regard to its manageability. For starters, Windows Backup can finally be run within the Microsoft Management Console. This means that you can use the console to manage backups scheduled to run on other servers.

The other really welcome change is that you can control virtually every aspect of the backup process through the WBADMIN command. NTBACKUP was also command line driven, but the WBADMIN command offers a whole lot more flexibility. You can see a summary of some of the WBADMIN commands here.

Backup and Recovery Issues with Windows Server 2008 (Part 1)

Windows Server 2008 offers a lot of improvements over Windows 2003, but the backup program is not one of them. This article discusses the issues that you need to know about before you attempt to backup your Windows 2008 server.

Microsoft has included a low end backup utility (NTBACKUP) with Windows Server ever since Windows NT 3.51 was released. Although NTBACKUP has undergone a few changes over the years, it has always retained the same basic structure. When Microsoft created Windows Server 2008, they decided to completely rewrite the backup application. In doing so, they have made some major changes to it that any Windows Administrator who is considering deploying Windows Server 2008 needs to be aware of.

Compatibility Issues

The first change that many administrators notice is that NTBACKUP is no longer called NTBACKUP, but rather Windows Server Backup. The new name is far from being the most important change though. From an administrator's standpoint, the most important change that you need to be aware of is that Windows Server Backup is not compatible with backups that you have made using NTBACKUP.

If you use NTBACKUP to back your data up to an external hard drive or to a network drive, then the data is encapsulated within a .BKF file. Although Microsoft has used the .BKF format for many years now, they have discontinued support for it in Windows Server 2008.

All is not lost though. If you have data that is backed up in .BKF format, you can restore that data to a Windows 2008 server. You just can not do it natively. Instead, you will have to download Microsoft's Windows NT Backup – Restore Utility. This utility will not allow you to create backups in .BKF format, but it will allow you to restore your data.

That is the good news. The bad news is that unlike its predecessors, Windows Server Backup does not offer support for tape drives. Therefore if you have been using NTBACKUP to write data to tape backup, then you are going to want to leave at least one Windows 2003 server on your network so that you can retrieve the data off of your backup tapes should the need arise.

Access to Windows Server Backup

Another thing about Windows Server Backup that seems to throw some administrators a curve ball is the fact that it is not installed by default. In the past, Microsoft has always included NTBACKUP in a default Windows installation, but if you want to use Windows Server Backup, you have to install it first. Fortunately, this is not difficult to do.

To install Windows Server Backup, open the Server Manager, and click on the Features container. Next, click on the Add Features link, and Windows will display a list of the available features. Select the Windows Server Backup Features check box, and click Next. Take a moment to look at the summary screen and verify that you have selected the correct feature to be installed. Assuming that everything looks good, click the Install button. When the installation process completes, click the Close button.

Loss of Flexibility

Some of Microsoft's decisions in the way that they designed Windows Server Backup almost make sense. For example, I can see why they dropped support for tape drives. It is probably because tape drives are starting to go extinct in favor of disk based backup solutions. Good tape backup drives do not come cheap though, so I wish that Microsoft would continue to allow us to use them, but I digress.

Some of the other design changes really do not make sense to me. For example, if you want to run a scheduled backup, you have to provide Windows with a dedicated hard drive that it can use. Granted, hard drives are cheap these days, but requiring a dedicated drive all but rules out backup media rotation or storing backups offsite. You can use external dedicated hard drives, but there are practicality issues to consider.

Furthermore, when I say that a dedicated drive is required, I do mean dedicated. Windows will not even give you access to the drive through Windows Explorer. You can only access it through Windows Server Backup.

Fortunately, this does not mean that a dedicated hard drive is your only option for backing up Windows. If you are running a scheduled backup, then you pretty much have to write the backup to a dedicated hard drive (although you can get around this restriction if you are into scripting). If you are performing a non scheduled backup, you have the option of writing the backup to a UNC share, or even to removable media.

In my opinion, the area in which Windows Server Backup has lost the most flexibility is in the fact that it does not allow you to backup individual files or folders. Yes, you read that right. The lowest level of granularity that is supported is an entire volume. You can backup a volume, or the entire server, but you really do not have any other choices.

I tend to think that this has something to do with the new backup file format that Windows Server Backup uses. Rather than using .BKF files, Windows Server Backup writes backup in .VHD format. I will talk more about this in the next section.

Why Did They Do It?

So why did Microsoft take a feature that has been working well for the last decade and basically ruin it? Well, I have not had the opportunity to ask anyone at Microsoft this question, but I suspect that it may have something to do with trying to discourage administrators from using Windows Server Backup as an enterprise backup solution.

Microsoft has always told us that NTBACKUP should only be used as a lightweight backup solution, and yet I know plenty of administrators who use it as a comprehensive backup solution for their entire enterprise. Windows Server Backup's restrictions make it easy to backup an individual server, but make it completely impractical to use it to backup an entire organization.

I think that another reason why Microsoft has made these changes may have to do with the new backup format. Rather than writing backups as .BKF files, backups are written as .VHD files. As you may know, .VHD files are virtual hard drive files. You can not take a Windows Server 2008 backup file, link it to Virtual Server, and boot off of it (although that is probably going to be possible at some point in the future). You can however, mount a Windows backup file as a volume in Virtual Server. This feature provides administrators with a very easy way of extracting individual files from a backup set.

Building Test Labs with Hyper-V (Part 1)

When Tom and I used to teach MCSE classes, we always told our students "don't let your production network be your test lab". We told them this on a regular basis because, during our consulting careers, we'd seen far too many admins try to introduce a new product or technology without testing it out in the lab first. All too often, the result was not good. The sad thing is that it didn't have to be that way – if they had only tested the application or service in the lab first, they would have learned about the "undocumented features" and the "gotcha's" in a nice controlled environment that was isolated from their production networks.

On the other hand, life back in the 1990s and early 2000's was a bit different. If you wanted to put together a test lab, you generally built it out of physical hardware. Then you had to install the operating systems and network services and applications on the test lab computers. And if something bad happened that you couldn't explain and that you couldn't back out of, you had to crater the lab and start all over. Sure, there was disk imaging software available, but networks were slow then and high speed USB 2.0 drives weren't available or were very expensive and were not large enough to fulfill the purpose of saving the lab in its entirety, especially if the lab contained five, ten or even more computers.

Things are different now. You don't need to fill a room with a bunch of physical computers to run a useful test lab. With virtualization, you can put all the computers you need to simulate your production network on a single virtual server and then create virtual networks on the virtual server to simulate the type of network segmentation you have on your production network. And with today's high end hardware being available at commodity prices, you can easily create a virtual test lab that can support over 20 virtual machines to participate in a single application or service deployment scenario.

Of course, there are a number of server virtualization platforms available and each of them has its own advantages. For almost a decade, we preferred VMware as our virtualization solution of choice. We began with VMware Workstation 1.0 for creating simple test labs on our Windows 2000 Workstation computers. Then VMware came out with the GSX virtualization platform and we virtualized almost our entire server infrastructure on that. ESX was released and it represented a major advance in server virtualization and enabled configuration and management features that we could only dream of when GSX was released.

There are other server virtualization options available now. The two other big players in the market are Xen and Hyper-V. We've never been Citrix fans (not that we don't like Citrix; we just never had the opportunity to work much with their products) so I can't say too much about what Xen has to offer. However, with Tom joining Microsoft last year, we decided that maybe we should start to move our virtualized infrastructure over from VMware to Hyper-V. That work started this year and continues to this day.

Working on moving our core network and server infrastructure from VMware to Hyper-V gave me the opportunity to learn quite a bit about Hyper-V, although not as much as I would like to know. However, I know enough about it now so that I can put together test labs quickly and easily, and that's what I'm going to share with you today.

A small caveat: In this article, I'm not going to talk about the stuff you can do with System Center Virtual Machine Manager (SCVMM). There are a number of things you can do with that which you can't do with the Hyper-V server right out of the box. If you're interested in being a SCVMM jockey, then check out the information on SCVMM here. This article is more appropriate for people who are relatively new to server virtualization and are curious about how to run a Microsoft product or technology test lab using Hyper-V.

The Base Configuration

In the past, we pretty much created virtual machines as we needed them. If there was a scenario I wanted to test, I would create a collection of virtual machines and then install the products and services that I needed to test. After I was done with the testing, I might save snapshots of the configuration in case I wanted to come back to it, or I might delete the virtual machines. This worked for me over the years, but I knew that there must be a more efficient process to use.

That more efficient process became obvious after Tom joined Microsoft. He worked with Joe Davies (who is also a Principal Writer on the Windows Server team) to put together something they call the "Base Configuration". The Base Configuration is a set of virtual machines that form the core of servers and services that almost any test lab scenario would require. After you create and configure the virtual machines that participate in the Base Configuration, you activate them and save a snapshot of the configuration. This allows you to always return to the base configuration if that's where you want to start. You can find the Base Configuration here.

Virtual Networks

The Base Configuration really ended up saving me quite a bit of time, since I didn't need to recreate virtual machines and core network services configurations each time I needed to test a new scenario. The Base Configuration also includes two virtual networks: the "Corpnet" subnet and the "Internet" subnet. In a virtual environment, there are a number of ways to handle these subnets using Hyper-V. Hyper-V splits virtual networks into three types:

• External Networks. These networks have connectivity to the live network through one of the NICs connected to your virtual server.
• Internal Networks. These networks allow the VMs on the same Internal Network to communicate with one another and also communicate with the host virtual server computer
• Private Networks. These networks allow the VMs to communicate with each other, but not with any host on a live (External) network or with the host virtual server

When I create virtual labs, I prefer to use Private Networks. This protects my production environment and gives me the comforting knowledge that the test lab is entirely isolated from my production network – with the end result being that my lab is protected from my live network and my live network is protected from my test lab.

However, there are times when my virtual lab's VMs need access to the live Internet. This means they need access to a live network connection and need to be assigned valid IP addressing information. In order to do this, an External Network needs to be created in Hyper-V and then a virtual machine can be assigned to the External Network. If the virtual machine is a mobile machine such as a Windows 7 client, you can easily configure the client to be a DHCP client and unplug it from the Private network and plug it into an External network and download the software you need. Then you can plug the VM back into the Private Network.

In the figure below, you can see where this plugging and unplugging is done. On the left side of the dialog box, you see Network Adapter External Live. The Network Adapter is the actual setting, and the current virtual network being used is the External LiveNetwork drop down box in the right side of the dialog box and select the Private network to which I want this virtual machine to connect. network that I created, which is connected to the live network. If I wanted to move this virtual machine back to a private network, I would click the down-arrow in the

Figure 1

While this method works fine for VMs that lend themselves to being moved on and off Private and External networks, not all VMs are so mobility friendly. For example, you don't really want to move a domain controller or an Exchange server on and off the network it was designed to use (which in a test lab environment is going to be a Private or Internal network). In this case, you'll need to configure a dual homed virtual machine that connects the lab environment to the live network. I typically use RRAS for this, but you can use ISA or TMG or whatever software solution you like. One example of how to do this is included in Tom's Test Lab Guide for testing UAG SP1's new Force Tunneling feature, which you can check out here.

The figure below shows a collection of virtual networks I have set up on one of our Hyper-V virtual lab test servers. Private1, Private2 and Private3 are used in the Base Configuration, where Private1 is the Corpnet subnet, Private2 is the Internet subnet, and Private3 is the Homenet subnet (actually, the Homenet subnet is not part of the Base Configuration; it's a subnet that's created in the Test Lab Guide for testing Windows and UAG DirectAccess.) You can see other virtual networks here, such as the Guest Live virtual network, which is an External Network connected to a NIC that is connected to a DMZ segment on our network, so that the virtual TMG firewall on this server can be associated with this Network to control traffic between the DMZ and other networks. Notice how the External networks are associated with a specific network adapter.

Figure 2

If you want to create a new virtual network, just click the Add button as seen in Figure 2 above. This brings you to the dialog box that you see in Figure 3 below. Here you choose what type of virtual network you want to create, and if you want to create an External network, you also choose which NIC you want to associate with that virtual network. Note that you can also take advantage of VLAN tagging on the host OS if you're using that on your live network.

Figure 3

Planning the virtual networks you need for your test lab is the first thing you should do before you start building out the virtual machines. Make a network diagram – whether on a cocktail napkin or in Visio – and this will make it easier to keep track of your virtual networks, especially if you want to test more "interesting" networking scenarios that more closely mirror your production network. After you plan your virtual networks, the next step is to create them. After you create the Hyper-V virtual networks, then you can get to the task of building out the virtual machines, which we'll go into in Part 2 of this article.

Using Windows Server 2008 R2 to Publish Internal Resources

Something that I don't hear a lot about these days is the Windows Routing and Remote Access Service (RRAS). I remember back in the "olden days" when we used to use RRAS for all sorts of things – LAN router, outbound NAT server and reverse NAT server. I don't do that so much anymore because I've been using ISA or TMG firewalls for the last decade, and the ISA or TMG firewall is much more flexible than RRAS.

However, depending on your situation, there might still be times when you'd want to use RRAS. Maybe you need a quick and easy way to publish a service on your intranet and you don't have time to figure out how to do it on the firewall. OK, that's a pretty unlikely scenario. A more realistic situation in today's economy: Maybe you're on a tight budget and can't afford to spend more money for the TMG product. Or how about when you want to test things in a virtual environment? It's a lot easier to use Windows RRAS in a virtual environment than many other options, so why not take advantage of it?

Also, if you're new to Windows, you might not even know about the RRAS service and some of the things it can do. If this is your first time hearing about RRAS, then I think you'll be pleasantly surprised at all you can do with it. And it's built into Windows Server 2008 R2, so you don't have to spring for another program.

In this article, we'll check out the reverse NAT feature in Windows Server 2008 R2 RRAS. Reverse NAT allows you to publish services on the intranet to the Internet. The reason we call it reverse NAT is because the client side of the connection is on the non-NATed side of the RRAS server. What we do with reverse NAT is map an IP address on the external interface of the RRAS server to an IP address on the intranet, for the protocol that you want to allow to communicate.

For example, suppose you have a web server on your intranet that you want to make available to users outside the intranet. A quick and dirty way to do this is to set up a NAT server and use reverse NAT. You configure the NAT server to accept connections on a specific IP address and port number (TCP or UDP; in the case of the generic web server, it would normally be TCP port 80) and then forward those connections to the web server on the same port (TCP port 80). You could even do something called "port redirection" and forward the connection to a different port other than the port on which the connection was received. For example, you publish your web server so that external users use TCP port 80 to connect to the NAT server, but then the web server accepts the forwarded connections on another port, such as TCP port 81. This is one method that can be used to enable you to host multiple web sites on the same web server.

In this example of how to configure the Windows Server 2008 R2 RRAS reverse NAT, I'm going to take advantage of a project that my husband, Tom Shinder, is spearheading along with Joseph Davies at Microsoft. This project is the "Test Lab Series" and you can learn more about the Test Lab concept on Tom's blog. Something that all the Test Labs have in common is the "Base Configuration". We will use the Base Configuration in this article since it creates a nice, standard Test Lab environment on which we can build other articles and demonstrations.

The first thing you should do to complete the exercises described in this article is build out the Base Configuration, which you can find at here.

After you build out that Base Configuration, you can snapshot the virtual machines that participate in the Base Configuration. That enables you to return to the Base Configuration to start a new Test Lab. It's a very nice concept and I wish I'd had something like this years ago because it really saves a lot of time if you do frequent testing.

After you build the base configuration, log on to EDGE1 as CORP\User1. In the Initial Configuration Talks window, click the Add roles link as seen in Figure 1 below.

Figure 1

On the Before You Begin page, shown in Figure 2, click Next.

Figure 2

On the Select Server Roles page, shown in Figure 3, put a checkmark in the Network Policy and Access Services checkbox and click Next.

Figure 3

On the Network Policy and Access Services page, shown in Figure 4, click Next.

Figure 4

On the Select Role Services page, shown in Figure 5, put a checkmark in the Routing and Remote Access Services checkbox. Note that this will also automatically put checkmarks in the Remote Access Service and Routing checkboxes. Click Next.

Figure 5

On the Confirm Installation Selections page, shown in Figure 6, click Install.

Figure 6

On the Installation Results page, shown in Figure 7, click Close.

Figure 7

Now that the RRAS service is installed, you can turn it on. By default, RRAS is not enabled after installation. During the enabling process, you tell the RRAS wizard which roles you want RRAS to perform. To get this started, click Start and point to Administrative Tools and click Routing and Remote Access, as shown in Figure 8.

Figure 8

In the Routing and Remote Access console, shown in Figure 9, right click the EDGE1 (local) entry in the left pane of the console. Click Configure and Enable Routing and Remote Access.

Figure 9

Click Next on the Welcome to the Routing and Remote Access Server Setup Wizard page, shown in Figure 10.

Figure 10

On the Configuration page, shown in Figure 11, you have a number of options. Some of them allow you to configure the server as a remote access VPN server or site to site VPN server. In this example, we want to configure EDGE1 as a reverse NAT server. To do that, select the Network address translation (NAT) option and then click Next.

Figure 11

On the NAT Internet Connection page, shown in Figure 12, select the Use this public interface to connect to the Internet option and then select the Internet Network Interface. Click Next.

Figure 12

On the Completing the Routing and Remote Access Server Setup Wizard page, shown in Figure 13, click Finish.

Figure 13

In the left pane of the console, expand the EDGE1 (local)\IPv4 node and then click on the NAT node. In the right pane of the console, right click on the Internet interface and click Properties, as shown in Figure 14.

Figure 14

In the Internet Properties dialog box, click on the NAT tab, as shown in Figure 15. On the NAT tab, confirm that the Public interface connected to the Internet is selected and that there is a checkmark in the Enable NAT on this interface checkbox.

Figure 15

On the Address Pool tab, shown in Figure 16, you can add all the addresses that are bound to the external interface. Since there are two addresses bound to the external interface of EDGE1, we can add both of those addresses here. Click the Add button. In the Add Address Pool dialog box, enter the first address in the pool in the Start address and the last address in the pool in the End address. Enter the subnet mask in the Mask text box. In this example, the Start address is 131.107.0.2 and the End address is 131.107.0.3. The subnet mask is 255.255.255.0. Click OK in the Add Address Pool dialog box.

Figure 16

You can see the addresses you added now on the Address Pool tab, as shown in Figure 17. Notice the Reservations button. You can use this button to reserve an address on the external interface of the NAT server and forward all traffic from that address to a server on the intranet. You would do this if you wanted to allow all traffic to the server, and not limit the traffic to a specific protocol.

Figure 17

Click on the Services and Ports tab, shown in Figure 18, and you can see a list of the protocols that you can publish through the NAT server. Most of these protocols are "simple" protocols, in that they require a single primary connection. If you want to use a protocol that has multiple primary connections, or requires secondary connections back to the client on the Internet, then you will need a NAT editor. The RRAS NAT server includes several NAT editors to support complex protocols. One example is the FTP NAT editor.

Select the Web Server (HTTP) service and then put a checkmark in its checkbox.

Figure 18

This brings up the Edit Service dialog box that's shown in Figure 19. In the Public address frame, select the On this address pool entry and enter 131.107.0.2 in the text box. In the Private address text box, enter the IP address of APP1, which is 10.0.0.3. Click OK.

Figure 19

Click OK in the Internet Properties dialog box, shown in Figure 20. At this point, the Windows Server 2008 R2 RRAS server is ready to accept connections from Internet hosts at IP address 131.107.0.2 on TCP port 80 and forward those connections to APP1 on the intranet, which is listening for incoming web connections on IP address 10.0.0.3 on TCP port 80.

Figure 20

Now let's test it out! Move CLIENT1 to the Internet subnet (one of the three subnets in the Base Configuration). Open Internet Explorer and in the address bar enter http://edge1.contoso.com. This is the address you configured on the DNS server on INET1 in the base configuration which maps to the IP address 131.107.0.2 on EDGE1. Press ENTER and bang! There's the default Web site on APP1, as shown in Figure 21. Now that was pretty easy, wasn't it?

Figure 21

Click on the NAT node in the left pane of the console. In the right pane of the console, right click Internet and click Show Mappings. Here you will find some interesting and helpful information about mappings used on the Internet Interface for forward and reverse NAT connections. You also can see in the right pane of the console and number of statistics, such as Total mappings, Inbound packets translated, and others, as shown in Figure 22.

Figure 22

Enable Remote Management of Windows Server 2008 R2 Server Core

As you probably know by now, Windows Server 2008 Server Core installation provides a minimal environment for running specific server roles. This reduces the maintenance and management requirements, as well as the attack surface for those server roles. You can read more about Server Core on this site.

One of the challenges of using Server Core is the management aspect. Fortunately, most of the management pain has been solved by usage of local Command Prompt, PowerShell (new to R2 Server core), manually created scripts, 3rd-party graphical user interface tools, and recently in R2, a tool called SCONFIG. Read more about SCONFIG in my Manage Windows Server 2008 R2 Core with SCONFIG article.

Server Core is usually intended to be remotely managed. This makes your life easier, as you can manage remote servers and core installations on your Windows 7 workstation, in the comfort of your own office. To do that, you must first make sure that you initially configure the machine with a proper IP address, add it to a domain (if needed) and open the correct Firewall rules and ports. After doing that, you can relax and start using local GUI-based management tools to remotely manage the server, just like you would for any server.

So, how do you enable these rules? Read on.

The easiest method would be to use the built-in SCONFIG tool.

Log in to the core machine, and launch SCONFIG:

Assuming that the machine is properly joined to a domain, press 4 to enable remote management.

To allow remote management through Server Manager, press 3.

You'll be notified when settings are completed.

You can also press 4 to view the firewall settings, however, this is not necessary.

Next, head on to your Windows 7 workstation where you've got RSAT installed, and run Server Manager. If you do NOT have Server Manager installed, you must enable it (only after installing RSAT) by using the Turn Windows Features On or Off in Control Panel. For more information on installing RSAT, please read Installing Remote Server Administration Tools (RSAT) for Windows 7.

Assuming that both Windows 7 and the remote server core are members of the same Active Directory domain, all you need to do is to right-click on the Server Manager item and select "Connect to Another Computer".

In the Connect to Another Computer window, type the name or browse to the server you wish to connect to.

Note: I strongly suggest you also read my Fix "RPC Server is Unavailable" Error in Windows Server 2008 R2 Remote Disk Management article, as it contains some important information about the firewall rules that need to be enabled on the local computer.

Bingo.