Windows/Server

Download

• https://www.microsoft.com/de-de/evalcenter/download-windows-server-2025
  • https://go.microsoft.com/fwlink/?linkid=2293216&clcid=0x407&culture=de-de&country=de

Active Directory

• Rename server

Rename-Computer -NewName "RDS" -Restart

• Server Manager -> Add roles -> Active Directory Domain Services + DNS

Install-WindowsFeature AD-Domain-Services, DNS -IncludeManagementTools

• Active Directory -> Promote -> Add new forest (ad.example.de)

$SecurePassword = Read-Host -Prompt "SafeMode Admin Password" -AsSecureString

Install-ADDSForest -DomainName "ad.example.com" -DomainNetbiosName "AD" -InstallDns -SafeModeAdministratorPassword $SecurePassword

Remote Desktop Services

• Add user group

Import-Module ActiveDirectory
New-ADGroup "RDS allow log on" -GroupScope Global -GroupCategory Security

• Install role

Install-WindowsFeature RDS-RD-Server,RDS-Licensing -IncludeManagementTools
Restart-Computer

• Group Policy Management (gpmc.msc)
  • Forest → Domains → ad.example.de → Right click: Domain Controllers → Create GPO: "RDS"
  • Right click: "RDS" → Edit

Computer Configuration → Policies → Administrative Templates → Windows Components → Remote Desktop Services → Remote Desktop Session Host → Licensing

-> Use the specified Remote Desktop license servers: Enable and add Server FQDN
-> Set the Remote Desktop licensing mode: Per User

Computer Configuration → Policies → Windows Settings → Security Settings → Local Policies → User Rights Assignment 
-> Allow log on through Remote Desktop Services → add "Administrators", "RDS allow log on"

• Update policies

gpupdate

• Verify policies
  • "secpol"

• Enable users - Add users to groups:
  • Remote Desktop Users
  • RDS allow log on

• Show logged-in users

query user
query session

Time Service

w32tm /query /status
w32tm /query /peers
w32tm /query /source

w32tm /resync
w32tm /resync /force

#Standalone
w32tm /config /manualpeerlist:"time.cloudflare.com,0x8 time.google.com,0x8 0.de.pool.ntp.org,0x8" /syncfromflags:manual /update
net stop w32time
net start w32time
w32tm /resync /force

Windows Search Services

• Install

Install-WindowsFeature Search-Service -IncludeManagementTools
Get-WindowsFeature Search-Service                                 # Verify

• Enable Service

Start-Service WSearch
Set-Service WSearch -StartupType Automatic
Get-Service WSearch

• Check Indexer Status

Get-CimInstance -Namespace "root\cimv2" -ClassName "Win32_Service" | Where-Object {$_.Name -eq "WSearch"}

control.exe srchadmin.dll

• Disable perUser Index

Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Search" -Name "EnablePerUserCatalog" -Value 0 -Type DWord
Restart-Service WSearch
control.exe srchadmin.dll
-> rebuild index

Windows Defender

• Status

Get-MpComputerStatus | Select-Object AMRunningMode, AntivirusEnabled, RealTimeProtectionEnabled
Get-MpComputerStatus | Select-Object *Updated*, *Enabled*, *Running*
Get-MpComputerStatus

Get-Service | Where-Object {$_.DisplayName -like "*Defender*" -or $_.DisplayName -like "*Security*"} | Format-Table Name, DisplayName, Status

• Exclusions

Get-MpPreference | Select-Object -Property Exclusion*

Add-MpPreference -ExclusionPath "C:\MyFolder"
Add-MpPreference -ExclusionPath "C:\MyFolder\myfile.exe"
Add-MpPreference -ExclusionProcess "myapp.exe"

• Restart

Automatic Updates (without WSUS)

# Enable automatic updates
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -Name "NoAutoUpdate" -Value 0

# Configure automatic updates (4 = auto download and schedule install)
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -Name "AUOptions" -Value 4
# 2 = Notify for download and auto install
# 3 = Auto download and notify for install
# 4 = Auto download and schedule the install
# 5 = Allow local admin to choose setting

Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -Name "ScheduledInstallDay" -Value 0
# 0 = every day, 1 - 7 = sunday - saturday

Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -Name "ScheduledInstallTime" -Value 3
# Hour of the day in 24-hour format ( 3 = 03:00 )

M365

• Set OneDrive Default Dir / Not working??

New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft" -Name "OneDrive" -Force

New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\OneDrive" -Name "DefaultRootDir" -Value "D:\%username%\OneDrive" -PropertyType String -Force