Some notes on Windows Server Core setup

This is a work in progress, just a bunch of notes for future myself if I need to do this again.

Windows Server Core does not not have a UI, just a command line.

Start with sconfig (docs), from there you can enable remote desktop, install updates, install roles.

You can then connect to the server via remote desktop and use the console from there. There are also other options like remote powershell, remote server management and so on. Enable Hyper-V.

Install Windows Admin Center either on your local client or on the server (or on a dedicated server) to be able to use UI to setup hyper-v and control most of the other server settings. Although this did not work well for me, it was taking too long to do anything and many actions failed often.

Windows Admin Center did not let me move virtual machines between my two windows servers (one of which was much newer), so I had to manually export and import the VMs.

Controlling Hyper-V can also be done via powershell, or you can remotely control it via hyper-v manager from another server:
https://learn.microsoft.com/en-us/virtualization/hyper-v-on-windows/quick-start/try-hyper-v-powershell

You can also install a Hyper-V admin (separate from the Hyper-V itself), to your windows clilent, and try managing your server from there, but I could not make it work for some reason.

This will list all hyper-v powershell commands:

Get-Command -Module hyper-v

Command to export the vm on the source machine:

Export-VM -Name YourVmName -Path E:\Folder\Where\To\Store\The\ExportVm

Importing VM usually fails, as a few settings on the target machine (such as paths to VHDs, or network adapter names) are different from the source machine.

On setting up your domain accounts

It’s better to not use domain admin accounts (which is your YourDomain\Administrator user or any other user from YourDomain\Domain Administrators group). If malicious agent gets access to the domain administrator token (if it’s used a lot – there’s higher probability of this), he can access all the domain computers and can damage all of them. So it’s best to create a separate non-domain admin group, add administrators there and add that group to local administrators group on all servers (can be done via group policy): https://petri.com/manage-workstations-without-domain-admin-rights/

Leave a comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.