Four flavors. Pick by workload, not feature count.
The licensing question precedes the technical question.
Pick the surface area before the role.
Smaller install = smaller attack surface = fewer patches.
sconfig for basic config. Default for production. ~6 GB.sconfig, walk through option 8 (network) and option 15 (exit to PowerShell). (Right-side animation previews the menu.)One console, many servers. Roles vs features matters.
Server Manager is the dashboard. Roles install workloads. Features add capabilities.
Get-WindowsFeature, Install-WindowsFeature, Uninstall-WindowsFeature. Scriptable; faster than the wizard.Verb-noun pattern. Pipe and discover.
Once you know the pattern, PowerShell becomes self-documenting.
Verb-Noun. Predictable.Get-Verb lists them all.Get-Command -Noun X finds everything touching X.|.Get-Command -Noun *Disk* in class. The verb-noun pattern reveals what's available without memorization.
Three nesting levels. Each has a different security boundary.
The hierarchy is also the security and replication boundary.
corp.hexworth.com and na.corp.hexworth.com are one tree.Multi-master. Mostly. The FSMO roles are the exception.
Every DC can write, except for the five FSMO roles that require a single owner.
netdom query fsmo, point out which DC owns which FSMO role. (Right-side animation shows what students will see.)Group nesting strategy that scales across the forest.
Don't grant permissions directly to users. Nest groups to control sprawl.
OUs are for admin model + Group Policy targeting.
Design your OU structure by who manages what, not by org chart.
Basic is the modern default. Dynamic is legacy.
Spanned/striped volumes belong to Storage Spaces now, not Dynamic Disks.
GPT is the default. MBR is legacy compatibility.
If the firmware is UEFI, use GPT. Period.
MBR2GPT.exe converts without data loss. One-way.MBR2GPT.exe from an elevated prompt converts without data loss.Software-defined storage. Pool + virtual disk + volume.
Aggregate physical disks into a pool. Carve virtual disks with the resiliency you choose.
PowerShell beats Disk Management for repeatability.
Wire one disk in PowerShell once, script it for the next hundred.
Get-Disk, Get-Partition, Get-Volume.Set-Disk -IsOffline $false, then Initialize-Disk -PartitionStyle GPT.New-Partition piped to Format-Volume.New-StoragePool, New-VirtualDisk, New-Volume.Get-Disk | Format-Table to confirm.
Bare-metal vs hosted. Hyper-V is Type 1.
Even when Hyper-V looks like it's "running on Windows," Windows is actually a VM on the hypervisor.
Gen 2 is the default. Gen 1 is legacy compat.
Gen 2 = UEFI + Secure Boot + modern device stack. Use Gen 2 unless you have a reason.
Three types. Each maps to a different network goal.
Pick the switch type by who needs to reach whom.
Checkpoints are point-in-time snapshots. Not backups.
Two checkpoint types. One is for prod, one is not.
New-VM, Checkpoint-VM, Restore-VMCheckpoint, Remove-VMCheckpoint.Get-VMCheckpoint -VMName 'WS01'.Checkpoint-VM -Name 'WS01': VSS captures consistent state.
Operator makes a breaking change in the guest. App misbehaves.
Restore-VMCheckpoint -Name 'WS01': VM reverts to checkpoint.
VM is back to the consistent state at checkpoint time. Damage undone.
Both isolate workloads. They isolate at different levels.
VMs virtualize the hardware. Containers virtualize the OS.
Process isolation vs Hyper-V isolation. Same container, different isolation.
Same Docker image, but the runtime chooses between two isolation models.
docker run --isolation=process or --isolation=hyperv. Default depends on host.Why the isolation model decides the tenant boundary.
The security ladder in motion: process isolation shares the host kernel; Hyper-V isolation adds a per-container kernel boundary (closer to VM-level); a full VM adds a complete guest OS boundary.
Six commands cover 90% of daily container work.
Learn six commands. The rest is variations.
docker pull. download an image from a registry.docker run -it. create + start + attach.docker ps -a. list all containers (running and stopped).docker exec -it. run a command inside a running container.docker stop / start. lifecycle control.docker rm / rmi. delete containers / images.nanoserver:ltsc2022, run, exec, exit, remove. The lifecycle in 60 seconds.Nano = the OS image for containers. Dockerfile = how you bake custom images.
Nano Server is no longer a standalone install. It's a container base image.
nanoserver (smallest), servercore (Server APIs), server (full Windows).FROM, COPY, RUN, CMD. docker build bakes it.
Multiple servers pretending to be one. With shared storage and a heartbeat.
High availability means a workload survives a single node dying.
The vote-based system that prevents split-brain.
If half the nodes can't see the other half, who's still alive? Quorum answers that.
All nodes can read and write the same volume at the same time.
CSV is what makes shared-nothing Hyper-V clustering possible.
C:\ClusterStorage\Volume1, ...\Volume2 on every node.Patch the cluster without downtime. One node at a time.
CAU automates the rolling-patch dance so you don't have to.
What we covered. What's coming.