Windows Server 2022 - Guide/Lab

📋 Minimale Systeemvereisten

🖥️ Minimale Systeemvereisten voor Windows Server 2022 VMs

🔧 Uitvoeringsstappen

• Stap 1.1: Controleer Windows versie

  1. Rechtsklik op Start menu

  2. Selecteer "System"

  3. Controleer Windows versie onder "Windows specifications"

• Stap 1.2: Controleer hardwarevirtualisatie

  1. Open Taakbeheer (Ctrl+Shift+Esc)

  2. Ga naar tabblad "Performance"

  3. Selecteer "CPU" aan de linkerkant

  4. Controleer of "Virtualization: Enabled" wordt weergegeven

• Stap 1.3: BIOS/UEFI virtualisatie inschakelen

  Als virtualisatie niet is ingeschakeld:

  1. Herstart de computer
  2. Druk op DEL/F2/F10/F12 tijdens opstarten (verschilt per fabrikant)
  3. Zoek naar: Intel VT-x, AMD-V, SVM Mode, Virtualization Technology
  4. Schakel deze optie(s) in
  5. Sla op en herstart (meestal F10)
• Stap 1.4: Download benodigde ISO bestanden

  Download de volgende ISO's van Microsoft:

  • Windows Server 2022 (evaluation)
  • Windows 11 (indien client-VM's nodig zijn)

  Sla deze op in een folder zoals: C:\ISO\

🖱️ Via Windows Features GUI

• Stap 2.1: Open Windows Features

  1. Druk op Windows toets + R

  2. Type: optionalfeatures

  3. Druk Enter

• Stap 2.2: Selecteer Hyper-V componenten

  Vink de volgende opties aan:

  • ☑ Hyper-V
  • ☑ Hyper-V Management Tools
  • ☑ Hyper-V Platform
• Stap 2.3: Installeer en herstart

  Klik OK en wacht tot de installatie voltooid is. Windows zal vragen om te herstarten.

🚨 Veelvoorkomende Fouten & Oplossingen

🌐 Virtual Switch Types

🔧 NAT Switch Setup (Aanbevolen voor Lab)

• Stap 3.1: Open Hyper-V Manager

  1. Zoek naar "Hyper-V Manager" in Start menu

  2. Rechtsklik en selecteer "Run as administrator"

• Stap 3.2: Maak Internal Switch

  1. Klik rechts op je Hyper-V host in de linker paneel

  2. Selecteer "Virtual Switch Manager"

  3. Kies "Internal" en klik "Create Virtual Switch"

  4. Geef de switch een naam: "NATSwitch"

  5. Klik "Apply" en daarna "OK"

• Stap 3.3: Configureer NAT Gateway

  1. Open Control Panel

  2. Ga naar "Network and Sharing Center"

  3. Klik op "Change adapter settings"

  4. Rechtsklik op "vEthernet (NATSwitch)"

  5. Selecteer "Properties"

  6. Dubbelklik op "Internet Protocol Version 4 (TCP/IPv4)"

  7. Stel IP-adres in: 10.0.0.1

  8. Subnet mask: 255.255.255.0

  9. Klik OK

• Stap 3.4: Configureer NAT

  1. Open Control Panel → System and Security → Administrative Tools

  2. Dubbelklik op "Routing and Remote Access"

  3. Rechtsklik op je server en selecteer "Configure and Enable Routing and Remote Access"

  4. Kies "Network address translation (NAT)"

  5. Selecteer de externe netwerkadapter

  6. Klik Finish

🌐 Network Topology Diagram

Host Machine (Windows 10/11)
├── Physical NIC (Ethernet/WiFi)
│   └── External Switch (Bridged to physical network)
│       └── Internet Access
├── Virtual Switch (NATSwitch - 10.0.0.0/24)
│   ├── VM: LAB-DC01 (DC, DHCP, DNS) - 10.0.0.10
│   │   ├── Gateway: 10.0.0.1
│   │   └── DNS: 10.0.0.10 (self)
│   ├── VM: LAB-SRV01 (IIS, File Server) - 10.0.0.11+
│   ├── VM: LAB-CLIENT01 (Domain Member) - 10.0.0.100+
│   └── NAT Router (10.0.0.1 → Internet)
└── Internal Communication (No Internet)
                            

🖥️ Domain Controller VM (Windows Server 2022)

• Stap 4.1: Maak Domain Controller VM

  1. Open Hyper-V Manager

  2. Klik rechts op je Hyper-V host

  3. Selecteer "New" → "Virtual Machine"

  4. Klik "Next"

  5. Geef naam: "LAB-DC01"

  6. Kies Generation 2

  7. Stel Startup memory in: 4096 MB

  8. Configureer networking: NATSwitch

  9. Maak virtual hard disk: 60 GB

  10. Selecteer Windows Server 2022 ISO

  11. Klik Finish

• Stap 4.2: Configureer VM Hardware

  1. Rechtsklik op LAB-DC01 in Hyper-V Manager

  2. Selecteer "Settings"

  3. Ga naar "Processor"

  4. Stel Number of virtual processors in: 2

  5. Ga naar "Memory"

  6. Zet "Enable Dynamic Memory" uit

  7. Stel RAM in op 4096 MB

  8. Klik OK

• Stap 4.3: Installeer Windows Server
  1. Selecteer LAB-DC01 in Hyper-V Manager
  2. Klik "Connect" in de onderste paneel
  3. Klik "Start" om de VM te starten
  4. Druk een toets om van DVD te booten
  5. Selecteer: Windows Server 2022 Standard (Desktop Experience)
  6. Accepteer licentievoorwaarden
  7. Kies: Custom Install
  8. Selecteer de drive en klik Next
  9. Stel Administrator wachtwoord in na installatie

🖥️ VM Layout Diagram

Hyper-V Host
┌─────────────────────────────────────────────────────────────┐
│ Host OS: Windows 10/11 Pro/Enterprise                       │
│ RAM: 16GB+ | CPU: 4+ cores | Storage: 256GB+ SSD            │
├─────────────────────────────────────────────────────────────┤
│ Hyper-V Role Installed                                      │
│ Virtual Switch: NATSwitch (10.0.0.0/24)                     │
├─────────────────────────────────────────────────────────────┤
│ VM 1: LAB-DC01 (Domain Controller)                          │
│ ├─ OS: Windows Server 2022 Standard                         │
│ ├─ RAM: 4GB | CPU: 2 cores | HDD: 60GB                      │
│ ├─ Roles: AD DS, DHCP, DNS                                  │
│ └─ IP: 10.0.0.10 (Static)                                   │
├─────────────────────────────────────────────────────────────┤
│ VM 2: LAB-SRV01 (Member Server)                             │
│ ├─ OS: Windows Server 2022 Standard                         │
│ ├─ RAM: 4GB | CPU: 2 cores | HDD: 60GB                      │
│ ├─ Roles: IIS, RDS, Certificate Services, File Services     │
│ └─ IP: 10.0.0.11+ (DHCP)                                    │
├─────────────────────────────────────────────────────────────┤
│ VM 3: LAB-CLIENT01 (Client)                                 │
│ ├─ OS: Windows 11 Pro                                       │
│ ├─ RAM: 4GB | CPU: 2 cores | HDD: 60GB                      │
│ ├─ Domain Member: lab.local                                 │
│ └─ IP: 10.0.0.100+ (DHCP)                                   │
└─────────────────────────────────────────────────────────────┘
                            

🔧 Active Directory Domain Services (AD DS)

• Stap 5.1: Installeer AD DS Role

  1. Open Server Manager

  2. Klik op "Manage" → "Add Roles and Features"

  3. Klik "Next" tot "Server Roles"

  4. Vink aan: "Active Directory Domain Services"

  5. Klik "Add Features" als gevraagd

  6. Klik "Next" en daarna "Install"

  7. Wacht tot installatie voltooid is

• Stap 5.2: Configureer Domain Controller

  1. Klik op het vlaggetje rechtsboven in Server Manager

  2. Klik op "Promote this server to a domain controller"

  3. Kies "Add a new forest"

  4. Voer root domain name in: lab.local

  5. Stel Directory Services Restore Mode password in

  6. Klik "Next" door alle schermen

  7. Klik "Install"

  8. Server herstart automatisch

• Stap 5.3: Controleer AD DS Installatie

  1. Open Server Manager na herstart

  2. Klik op "Tools" → "Active Directory Users and Computers"

  3. Controleer of lab.local domain zichtbaar is

🗑️ AD Recycle Bin en Objectherstel

Vereisten

• Forest functional level ≥ Windows Server 2008 R2
• Enterprise Admin-rechten

Stappen

1. Stap 5.4: Controleer het forest functional level

   Controleer het forest functional level.

2. Stap 5.5: Schakel de Recycle Bin forest-wide in

   Schakel de Recycle Bin forest-wide in (eenmalig).

3. Stap 5.6: Zoek en herstel het verwijderde object

   Zoek en herstel het verwijderde object.

PowerShell

(Get-ADForest).ForestMode

Enable-ADOptionalFeature 'Recycle Bin Feature' -Scope ForestOrConfigurationSet -Target 'lab.local' -Confirm:$false

Get-ADObject -Filter 'name -like "John*"' -IncludeDeletedObjects -Properties * |
  Where-Object { $_.isDeleted -eq $true } |
  Select-Object Name, DistinguishedName, ObjectGUID

Restore-ADObject -Identity 

Validatie

• Object is zichtbaar in ADUC met originele attributen/groepslidmaatschappen.
• Directory Service-log toont herstelgebeurtenissen.

🔐 Group Managed Service Accounts (gMSA) voor Services

Vereisten

• Domain functional level ≥ Windows Server 2012
• KDS Root Key in het forest (eenmalig)
• Doelserver is domeinlid

Stappen

1. Stap 5.6: Maak (eenmalig) de KDS Root Key aan

   Controleer of de KDS Root Key bestaat en maak deze aan indien nodig.

2. Stap 5.7: Maak de gMSA aan en sta de doelserver toe het wachtwoord op te halen

   Maak de gMSA aan en configureer de juiste permissies.

3. Stap 5.8: Installeer en test de gMSA op de doelserver

   Installeer de gMSA op de doelserver en test de functionaliteit.

4. Stap 5.9: Koppel de gMSA aan de gewenste service/app

   Configureer de service om de gMSA te gebruiken volgens productspecifieke instructies.

PowerShell

# Eenmalig in het forest
Add-KdsRootKey -EffectiveTime (Get-Date).AddHours(-10)

# gMSA aanmaken (voorbeeld)
New-ADServiceAccount -Name "gmsa-iis$" -DNSHostName "lab.local" `
 -PrincipalsAllowedToRetrieveManagedPassword "LAB-SRV01$"

# Op de doelserver
Install-ADServiceAccount -Identity "gmsa-iis$"
Test-ADServiceAccount -Identity "gmsa-iis$"

Validatie

• Test-ADServiceAccount retourneert True.
• Service/app draait onder LAB\gmsa-iis$ zonder logon errors.

📡 DHCP Server

• Stap 5.9: Installeer DHCP Role

  1. Open Server Manager

  2. Klik "Manage" → "Add Roles and Features"

  3. Vink aan: "DHCP Server"

  4. Klik "Add Features" als gevraagd

  5. Klik "Next" en "Install"

• Stap 5.10: Authorize DHCP Server

  1. Open Server Manager

  2. Klik "Tools" → "DHCP"

  3. Rechtsklik op de DHCP server

  4. Selecteer "Authorize"

• Stap 5.11: Configureer DHCP Scope

  1. In DHCP console, vouw server uit

  2. Rechtsklik op "IPv4"

  3. Selecteer "New Scope"

  4. Klik "Next"

  5. Geef naam: "LabScope"

  6. IP range: 10.0.0.100 tot 10.0.0.200

  7. Subnet mask: 255.255.255.0

  8. Klik "Next" door alle schermen

  9. Klik "Finish"

🔄 DHCP Failover

• Stap 5.12: Configureer DHCP Failover

  PowerShell voorbeeld (load-balancing 50/50 voor scope 10.0.0.0/24):

  # PowerShell voorbeeld (load-balancing 50/50 voor scope 10.0.0.0/24)
  Add-DhcpServerv4Failover -Name "LAB-FO" -ComputerName "LAB-DC01" `
    -PartnerServer "LAB-DC02" -ScopeId 10.0.0.0 -LoadBalancePercent 50 `
    -SharedSecret "StrongSecret!"
                               

🚨 Veelvoorkomende Fouten & Oplossingen

🏢 Active Directory Hierarchy Diagram

Forest: lab.local
├── Tree: lab.local
│   ├── Domain: lab.local
│   │   ├── OU: Domain Controllers
│   │   │   └── LAB-DC01 (DC, GC, FSMO Roles)
│   │   ├── OU: Servers
│   │   │   ├── LAB-SRV01 (Member Server)
│   │   │   └── LAB-SRV02 (Member Server)
│   │   ├── OU: Workstations
│   │   │   └── LAB-CLIENT01 (Domain Member)
│   │   ├── OU: Users
│   │   │   ├── Administrator
│   │   │   └── Domain Users
│   │   └── OU: Groups
│   │       ├── Domain Admins
│   │       ├── Domain Users
│   │       └── Server Operators
│   ├── Sites and Services
│   │   └── Default-First-Site-Name
│   │       └── LAB-DC01 (Domain Controller)
│   └── DNS Zones
│       ├── lab.local (AD-Integrated)
│       └── _msdcs.lab.local (AD-Integrated)
└── Trust Relationships
    └── (Potential trusts to other domains/forests)
                            

📚 Aanvullende Bronnen

⏰ Tijdssynchronisatie/NTP voor AD

🔧 NTP Configuratie & Validatie

• Stap 5.12: PDC Emulator NTP Setup

  Configureer PDC voor externe tijd synchronisatie:

  # Configureer PDC voor externe NTP
  w32tm /config /manualpeerlist:"time.windows.com,0x8" /syncfromflags:manual /reliable:yes /update
  
  # Herstart Windows Time service
  net stop w32time && net start w32time
                              

• Stap 5.13: NTP Status Controle

  Valideer tijd synchronisatie:

  # Controleer NTP configuratie
  w32tm /query /configuration
  
  # Controleer NTP status
  w32tm /query /status
  
  # Forceer synchronisatie
  w32tm /resync /rediscover
                              

🔐 gMSA voor Services

• Stap 5.14: KDS Root Key aanmaken

  Voorwaarde voor gMSA - eenmalige actie per forest:

  Add-KdsRootKey -EffectiveTime (Get-Date).AddHours(-10)
                              

• Stap 5.15: gMSA aanmaken

  Maak een nieuwe gMSA voor een service:

  New-ADServiceAccount -Name "gmsa-iis$" -DNSHostName "lab.local" `
    -PrincipalsAllowedToRetrieveManagedPassword "LAB-SRV01$"
                              

• Stap 5.16: gMSA installeren op doelserver

  Installeer de gMSA op de server waar de service draait:

  Install-ADServiceAccount -Identity "gmsa-iis$"
  Test-ADServiceAccount -Identity "gmsa-iis$"
                              

🌐 DNS Best Practices

⚙️ DNS Scavenging Setup

• Stap 5.17: Enable DNS Scavenging

  Configureer automatische opruim van oude records:

  # Enable scavenging op DNS server properties
  # Server Aging/Scavenging: Enable automatic scavenging
  # Scavenging period: 7 days
  # Refresh interval: 7 days
  # No-refresh interval: 7 days
                              

🔀 Conditional vs Standard Forwarders

📡 DHCP Verdieping

🔧 DHCP Scope Options Configuratie

• Stap 5.18: Configureer Essentiële Scope Options

  Stel kritische DHCP opties in:

  # Scope Options configuratie:
  # 003 Router: 10.0.0.1
  # 006 DNS Servers: 10.0.0.1, 8.8.8.8
  # 015 DNS Domain Name: lab.local
  # 044 WINS/NBNS Servers: (indien nodig)
  # 046 WINS/NBT Node Type: 0x8 (Hybrid)
                              

🔄 DHCP-DNS Dynamic Updates

• Stap 5.19: Enable DHCP-DNS Integration

  Configureer automatische DNS registratie:

  # DHCP Server properties:
  # Enable DNS dynamic updates: Always dynamically update DNS records
  # Discard A and PTR records when lease is deleted: Enabled
  # Dynamically update DNS records for DHCP clients: Enabled
                              

🏗️ AD-Topologie en FSMO-rollen

🔄 FSMO Rol Overdracht

• Stap 5.20: Controleer FSMO Rol Locatie

  Bepaal welke DC welke rollen heeft:

  # Controleer FSMO rollen
  netdom query fsmo
  
  # Of via PowerShell:
  Get-ADDomainController -Filter * | Select Name, OperationMasterRoles
                              

• Stap 5.21: FSMO Rol Overdracht

  Verplaats FSMO rollen naar andere DC:

  # Via PowerShell (voorbeeld voor PDC Emulator)
  Move-ADDirectoryServerOperationMasterRole -Identity "LAB-DC02" -OperationMasterRole PDCEmulator
  
  # Of via GUI: Active Directory Users and Computers
  # Rechtsklik domain → Operations Masters
                              

🌐 Sites & Services Configuratie

• Stap 5.22: AD Site Aanmaken

  Maak sites voor optimale replicatie:

  # Nieuwe site aanmaken
  New-ADReplicationSite -Name "Lab-Site-01"
  
  # Subnet toekennen aan site
  New-ADReplicationSubnet -Name "10.0.0.0/24" -Site "Lab-Site-01"
  
  # Site link configureren
  New-ADReplicationSiteLink -Name "Lab-SiteLink" -SitesIncluded "Lab-Site-01","Default-First-Site-Name"
                              

📁 OU-Ontwerp Richtlijnen

🔐 Certificate Services Keuzes

📊 CA-Keuzehulp Tabel

🔗 CDP/AIA Publicatiepatronen

• Stap 5.23: CDP/AIA Configuratie

  Configureer Certificate Revocation en Authority Information:

  # CDP (Certificate Revocation List) locaties:
  # 1. LDAP (Active Directory)
  # 2. HTTP (Web server)
  # 3. File share (voor offline toegang)
  
  # AIA (Authority Information Access) locaties:
  # 1. LDAP (voor AD clients)
  # 2. HTTP (voor niet-AD clients)
  # 3. File share (fallback optie)
                              

📶 NPS en 802.1X

🏢 Lab Scenario: WLAN met EAP-TLS

• Stap 5.24: NPS Server Configuratie

  Installeer en configureer NPS:

  # Installeer NPS rol
  Install-WindowsFeature NPAS -IncludeManagementTools
  
  # Configureer RADIUS clients (Access Points/Switches)
  # Client IP: 10.0.0.50
  # Shared Secret: StrongRadiusSecret2024!
                              

• Stap 5.25: EAP-TLS Network Policy

  Maak EAP-TLS policy voor wireless toegang:

  # Network Policy Settings:
  # Policy Name: Wireless EAP-TLS
  # Type of network access server: Unspecified
  # Conditions:
  #   - NAS Port Type: Wireless - IEEE 802.11
  #   - User Groups: Domain Users
  # Constraints:
  #   - Authentication Methods: Microsoft: Smart Card or other certificate
  #   - Less secure authentication methods: Disabled
                              

🔒 RRAS VPN-Profielen

📊 VPN Protocol Matrix

🛡️ VPN Hardening Checklist

• Cipher Suite Configuratie

  Configureer sterke encryptie voor VPN verbindingen.

• Certificate Requirements

  Gebruik certificaten voor wederzijdse authenticatie.

• Split vs Full Tunnel

  Bepaal juiste tunnel configuratie gebaseerd op security requirements.

• Multi-Factor Authentication

  Implementeer MFA voor VPN toegang.

• Session Timeouts

  Configureer idle timeouts en session limits.

🔄 Hyper-V Replica Verdieping

🧪 Test Scenario's

• Stap 5.26: Planned Failover Uitvoeren

  Geplande overgang naar replica:

  # Planned failover stappen:
  1. Stop productie VM
  2. Controleer replica status: Get-VMReplication
  3. Start planned failover: Start-VMFailover -VMName "VM01" -Confirm:$false
  4. Complete failover: Complete-VMFailover -VMName "VM01"
  5. Start gerepliceerde VM
  6. Update DNS records indien nodig
                              

• Stap 5.27: Unplanned Failover

  Disaster recovery procedure:

  # Unplanned failover stappen:
  1. Bevestig primaire site niet beschikbaar
  2. Controleer replica health: Get-VMReplication
  3. Start unplanned failover: Start-VMFailover -VMName "VM01" -Confirm:$false
  4. Complete failover: Complete-VMFailover -VMName "VM01"
  5. Start VM op replica site
  6. Configureer reverse replication indien gewenst
                              

🔐 Authenticatie & Firewall Matrix

⚖️ Failover Clustering Extra's

📊 Quorum-Wizard Keuzehulp

🔄 Dynamic Quorum & Witness

• Stap 5.28: Dynamic Quorum Configuratie

  Enable dynamic quorum voor betere fault tolerance:

  # Enable dynamic quorum
  (Get-Cluster).DynamicQuorum = 1
  
  # Configureer dynamic witness
  Set-ClusterQuorum -NodeAndFileShareMajority "\\FileServer\Witness"
                              

💾 Lab Opties voor Shared Storage

• iSCSI Target Server Setup

  Configureer iSCSI voor shared storage testing:

  # Installeer iSCSI Target Server
  Install-WindowsFeature FS-iSCSITarget-Server
  
  # Maak virtual disk voor iSCSI
  New-IscsiVirtualDisk -Path "C:\iSCSI\ClusterDisk.vhdx" -Size 100GB
  
  # Configureer iSCSI target
  New-IscsiServerTarget -TargetName "ClusterTarget" -InitiatorIds "IQN:*"
                              

💽 Storage en Hyper-V Tuning

🔧 vCPU:vCore Ratio Richtlijnen

🧠 Dynamic Memory Richtlijnen

• Stap 5.29: Dynamic Memory Configuratie

  Configureer dynamic memory per workload:

  # Voor web server VM:
  Set-VMMemory -VMName "WebServer01" -DynamicMemoryEnabled $true `
      -MinimumBytes 1GB -MaximumBytes 8GB -BufferPercentage 20
  
  # Voor SQL Server VM:
  Set-VMMemory -VMName "SQL01" -DynamicMemoryEnabled $false `
      -StartupBytes 16GB
                              

🔢 vNUMA voor Zware Workloads

• Stap 5.30: NUMA Optimization

  Configureer virtual NUMA voor betere performance:

  # Enable vNUMA spanning
  Set-VMProcessor -VMName "HeavyWorkload01" -MaximumCountPerNumaNode 8
  
  # Configureer memory per NUMA node
  Set-VMMemory -VMName "HeavyWorkload01" -MaximumAmountPerNumaNodeBytes 4GB
                              

🔌 Host Power Profile Checklist

• High Performance Power Plan

  Zorg dat host altijd maximale performance levert.

• CPU Parking Disabled

  Voorkom dat CPU cores worden geparkeerd.

• Minimum/Maximum Processor State: 100%

  Stel processor states in voor consistente performance.

• USB Selective Suspend: Disabled

  Voorkom energiebesparing op USB devices.

🖥️ Client VM Aanmaken

• Stap 6.1: Maak Windows 11 VM

  1. Open Hyper-V Manager

  2. Klik "New" → "Virtual Machine"

  3. Naam: "LAB-CLIENT01"

  4. Generation: 2

  5. Memory: 4096 MB

  6. Network: NATSwitch

  7. Virtual hard disk: 60 GB

  8. Installation media: Windows 11 ISO

  9. Finish

🌐 Domain Join Test

• Stap 6.2: Controleer Netwerk & DNS

  1. Start de client VM

  2. Open Command Prompt

  3. Type: ipconfig /all

  4. Controleer IP adres (moet 10.0.0.x zijn)

  5. Test DNS: nslookup lab-dc01.lab.local

• Stap 6.3: Join Domain

  1. Rechtsklik op Start → System

  2. Klik "Rename this PC (advanced)"

  3. Klik "Change" onder "Computer name"

  4. Selecteer "Domain"

  5. Voer in: lab.local

  6. Voer domain admin credentials in

  7. Klik OK → herstart

📁 File Services Test

• Stap 6.4: Test File Share

  1. Open File Explorer

  2. In adresbalk: \\lab-dc01\LabShare

  3. Klik Enter

  4. Maak een test bestand

  5. Controleer of het werkt

📋 Test Checklist

🌐 IIS Installatie

• Stap 7.1: Installeer Web Server Role

  1. Open Server Manager

  2. Klik "Manage" → "Add Roles and Features"

  3. Selecteer "Web Server (IIS)"

  4. Klik "Add Features" als gevraagd

  5. Kies gewenste IIS features:

  • ☑ Web Server
  • ☑ Common HTTP Features
  • ☑ Health and Diagnostics
  • ☑ Security
  • ☑ Application Development
  • ☑ Management Tools

  6. Klik "Next" en "Install"

⚙️ Geavanceerde IIS Configuratie

• Stap 7.2: IIS Manager Openen

  1. Server Manager → "Tools" → "Internet Information Services (IIS) Manager"

  2. Vouw server uit in linker paneel

  3. Klik op "Sites" → "Default Web Site"

• Stap 7.3: Website Binding Configureren

  1. Rechtsklik op "Default Web Site" → "Edit Bindings"

  2. Klik "Add" voor nieuwe binding

  3. Type: http, IP address: All Unassigned, Port: 80

  4. Host name: (leeg voor default)

  5. Klik OK

• Stap 7.4: MIME Types Configureren

  1. Selecteer website → "MIME Types"

  2. Klik "Add" voor custom types:

  • .json → application/json
  • .woff → application/font-woff
  • .woff2 → application/font-woff2

🔒 SSL/TLS Setup

• Stap 7.5: SSL Certificaat Installeren

  1. IIS Manager → Server naam → "Server Certificates"

  2. Klik "Import" voor bestaand certificaat

  3. Of "Create Certificate Request" voor nieuw certificaat

  4. Selecteer .pfx bestand en voer wachtwoord in

• Stap 7.6: HTTPS Binding Toevoegen

  1. Rechtsklik website → "Edit Bindings"

  2. Klik "Add"

  3. Type: https, Port: 443

  4. Selecteer SSL certificaat

  5. Klik OK

• Stap 7.7: SSL Settings Configureren

  1. Selecteer website → "SSL Settings"

  2. Vink aan: "Require SSL"

  3. Kies "Accept" voor client certificates indien nodig

🛡️ Security Hardening

• Stap 7.8: Request Filtering

  1. Website → "Request Filtering"

  2. Configureer file extensions:

  • Blokkeer: .asp, .exe, .bat
  • Toestaan: .html, .css, .js, .jpg

  3. Stel URL lengte limits in

• Stap 7.9: Directory Browsing Uitschakelen

  1. Website → "Directory Browsing"

  2. Zorg dat dit uitgeschakeld is

• Stap 7.10: Default Documents Configureren

  1. Website → "Default Document"

  2. Stel volgorde in: index.html, index.htm, default.aspx

🏊 Application Pools

• Stap 7.11: Application Pool Aanmaken

  1. IIS Manager → "Application Pools"

  2. Rechtsklik → "Add Application Pool"

  3. Naam: "MyAppPool"

  4. .NET CLR Version: v4.0

  5. Process Model: ApplicationPoolIdentity

• Stap 7.12: Application Pool Settings

  1. Rechtsklik Application Pool → "Advanced Settings"

  2. Process Model:

  • Idle Time-out: 20 minutes
  • Maximum Worker Processes: 1

  3. Recycling:

  • Regular time interval: 1740 minutes
  • Private memory usage: 500MB

🔄 URL Rewrite en Redirects

• Stap 7.13: URL Rewrite Module Installeren

  1. Download URL Rewrite module van Microsoft

  2. Installeer via Web Platform Installer of Microsoft installer

  3. Web-Url-Auth (URL Authorization) is een aparte Windows Feature - schakel deze alleen in als je URL Authorization policies nodig hebt

• Stap 7.14: Rewrite Rules Aanmaken

  1. Website → "URL Rewrite"

  2. Klik "Add Rule" → "Blank Rule"

  3. Pattern: ^(.*)$

  4. Rewrite URL: {R:1}

  5. Conditions: HTTP to HTTPS redirect

⚡ Performance Optimization

• Stap 7.15: Compression Inschakelen

  1. Server level → "Compression"

  2. Vink aan: "Enable dynamic content compression"

  3. Vink aan: "Enable static content compression"

  4. MIME types: text/*, application/javascript

• Stap 7.16: Output Caching Configureren

  1. Website → "Output Caching"

  2. Klik "Add" voor cache rules:

  • Extension: .css, Kernel cache enabled
  • Extension: .js, Kernel cache enabled
  • Extension: .png, User-mode cache
• Stap 7.17: Connection Limits Instellen

  1. Website → "Advanced Settings"

  2. Limits:

  • Connection Time-out: 120 seconds
  • Maximum concurrent connections: 1000

📊 Monitoring en Logging

• Stap 7.18: Logging Configureren

  1. Website → "Logging"

  2. Log file format: W3C

  3. Log file directory: C:\inetpub\logs\LogFiles

  4. Fields: Date, Time, Client IP, Method, URI, Status

• Stap 7.19: Failed Request Tracing

  1. Website → "Failed Request Tracing Rules"

  2. Klik "Add" voor nieuwe rule

  3. Status codes: 400-599

  4. Providers: ASP, ISAPI, WWW Server

🔧 Troubleshooting IIS

📚 Aanvullende Bronnen

📁 File Server Installatie

• Stap 8.1: Installeer File Services

  1. Server Manager → "Add Roles and Features"

  2. Selecteer "File and Storage Services"

  3. Vink aan: "File and iSCSI Services"

  4. Kies: "File Server", "DFS Namespaces", "DFS Replication"

  5. Klik "Install"

🔗 DFS Namespace Setup

• Stap 8.2: Maak DFS Namespace

  1. Server Manager → "Tools" → "DFS Management"

  2. Rechtsklik "Namespaces" → "New Namespace"

  3. Server name: lokale server

  4. Naam: "LabNamespace"

  5. Type: Domain-based

  6. Klik "Next" door alle schermen

• Stap 8.3: Voeg Folder toe

  1. Rechtsklik op namespace → "New Folder"

  2. Naam: "SharedDocs"

  3. Voeg folder target toe: "\\server\share"

  4. Klik OK

🔐 NTFS en Share Permissions

• Stap 8.4: NTFS Permissions Configureren

  1. Rechtsklik folder → "Properties" → "Security"

  2. Klik "Advanced" voor geavanceerde permissions

  3. Configureer:

  • Domain Admins: Full Control
  • Domain Users: Modify
  • Authenticated Users: Read & Execute

  4. Vink aan: "Replace all child object permissions"

• Stap 8.5: Share Permissions Instellen

  1. Rechtsklik folder → "Properties" → "Sharing"

  2. Klik "Advanced Sharing" → "Permissions"

  3. Stel share permissions in:

  • Everyone: Read
  • Domain Admins: Full Control

  4. Effectieve permissions = NTFS ∩ Share permissions

🔐 SMB Signing en Encryptie

• Stap 8.5: SMB Signing Server-breed Configureren

  Server-brede signing vereisen:

  # Server-brede signing vereisen
  Set-SmbServerConfiguration -RequireSecuritySignature $true -EnableSecuritySignature $true -Force
                              

• Stap 8.6: Share-versleuteling Inschakelen

  Share-versleuteling inschakelen per share:

  # Share-versleuteling inschakelen (per share)
  Set-SmbShare -Name "SharedDocs" -EncryptData $true
                              

🔄 DFS Replication

• Stap 8.6: Replication Group Aanmaken

  1. DFS Management → "Replication"

  2. Rechtsklik → "New Replication Group"

  3. Type: Multipurpose replication group

  4. Naam: "LabReplication"

  5. Selecteer 2+ servers voor replicatie

• Stap 8.7: Replicated Folder Toevoegen

  1. Klik "Add" bij Replicated Folders

  2. Naam: "SharedDocs"

  3. Lokale paden: C:\DFSRoot\SharedDocs

  4. Memberships: Beide servers selecteren

• Stap 8.8: Replication Schedule Configureren

  1. Selecteer replication group → "Connections"

  2. Rechtsklik connection → "Properties"

  3. Schedule: "Replicate continuously"

  4. Bandwidth: "Full bandwidth"

  5. Of configureer custom schedule

📊 Storage Quotas

• Stap 8.9: File Server Resource Manager Installeren

  1. Server Manager → "Add Roles and Features"

  2. Selecteer "File Server Resource Manager"

  3. Klik "Install"

• Stap 8.10: Quota Template Aanmaken

  1. Server Manager → "Tools" → "File Server Resource Manager"

  2. Rechtsklik "Quota Templates" → "Create Quota Template"

  3. Template name: "User Quota 1GB"

  4. Space limit: 1 GB

  5. Configureer warning levels

• Stap 8.11: Quota Toepassen op Folder

  1. Rechtsklik "Quotas" → "Create Quota"

  2. Selecteer folder pad

  3. Kies template of custom settings

  4. Vink aan: "Auto apply template and create quotas on existing and new subfolders"

🛡️ File Screening

• Stap 8.12: File Screen Template Aanmaken

  1. File Server Resource Manager → "File Screening Management"

  2. Rechtsklik "File Screen Templates" → "Create File Screen Template"

  3. Template name: "Block Executables"

  4. File groups: Executable files

  5. Active screening: Block

• Stap 8.13: File Screen Toepassen

  1. Rechtsklik "File Screens" → "Create File Screen"

  2. Selecteer folder pad

  3. Kies template

  4. Configureer exceptions indien nodig

🌐 BranchCache

• Stap 8.14: BranchCache Inschakelen

  1. Server Manager → "Add Roles and Features"

  2. Selecteer "BranchCache"

  3. Kies "Hosted Cache" mode

  4. Klik "Install"

• Stap 8.15: BranchCache Configureren

  1. PowerShell: Enable-BCHostedServer -RegisterSCP

  2. Stel cache size in: Set-BCCache -SizeBytes 10GB

  3. Configureer firewall rules voor BranchCache

• Stap 8.16: Client BranchCache Inschakelen

  1. Group Policy → Computer Configuration

  2. Policies → Administrative Templates → Network → BranchCache

  3. Enable "Turn on BranchCache"

  4. Set "Set BranchCache Hosted Cache mode"

🔍 File Services Monitoring

• Stap 8.17: File Share Auditing Inschakelen

  1. Group Policy → Computer Configuration

  2. Policies → Windows Settings → Security Settings

  3. Local Policies → Audit Policy

  4. Enable: "Audit object access"

• Stap 8.18: Folder Auditing Configureren

  1. Rechtsklik folder → "Properties" → "Security" → "Advanced"

  2. Auditing tab → "Add"

  3. Selecteer users/groups

  4. Audit events: Create, Delete, Modify

🚨 Troubleshooting File Services

📚 Aanvullende Bronnen

🏗️ RDS Architectuur Overzicht

🖥️ RDS Installatie

• Stap 9.1: Installeer RDS Role

  1. Server Manager → "Add Roles and Features"

  2. Selecteer "Remote Desktop Services"

  3. Kies deployment type: "Standard deployment"

  4. Selecteer gewenste role services

  5. Klik "Install"

🔗 RD Connection Broker

• Stap 9.2: Configureer Connection Broker

  1. Server Manager → "Remote Desktop Services" → "Collections"

  2. Klik "Create Session Collection"

  3. Naam: "Lab Collection"

  4. Add RD Session Host servers

  5. Configureer user groups

• Stap 9.3: High Availability Configureren

  1. Deploy multiple Connection Brokers

  2. Configureer database voor session storage

  3. Stel failover in voor redundancy

🌐 RD Web Access

• Stap 9.4: RD Web Access Configureren

  1. Open RD Web Access site: https://server/RDWeb

  2. Klik "Connect to a remote PC" of "RemoteApp programs"

  3. Configureer SSL certificaat voor HTTPS

  4. Stel authentication method in

• Stap 9.5: RemoteApp Programs Publiceren

  1. Server Manager → "Remote Desktop Services" → "Collections"

  2. Selecteer collection → "RemoteApp Programs"

  3. Klik "Add RemoteApp Programs"

  4. Selecteer applicaties om te publiceren

  5. Configureer program properties

🖥️ RD Session Host

• Stap 9.6: Session Host Settings Configureren

  1. Open Group Policy Management Console (GPMC)

  2. Edit de relevante GPO (bijv. Default Domain Policy)

  3. Ga naar Computer Configuration → Policies → Administrative Templates → Windows Components → Remote Desktop Services → Remote Desktop Session Host

  4. Configureer connection settings:

  • Security layer: SSL
  • Encryption level: High
  • Authentication: Required
• Stap 9.7: Session Time Limits Instellen

  1. Group Policy → Computer Configuration

  2. Policies → Administrative Templates → Windows Components → Remote Desktop Services

  3. Configureer:

  • Set time limit for active sessions
  • Set time limit for disconnected sessions
  • Terminate session when time limits are reached

🚪 RD Gateway

• Stap 9.8: RD Gateway Installeren

  1. Server Manager → "Add Roles and Features"

  2. Selecteer "Remote Desktop Services" → "RD Gateway"

  3. Klik "Install"

• Stap 9.9: RD Gateway Configureren

  1. Server Manager → "Tools" → "Remote Desktop Gateway Manager"

  2. Configureer SSL certificaat

  3. Stel CAP (Connection Authorization Policies) in

  4. Configureer RAP (Resource Authorization Policies)

• Stap 9.10: Network Policies Configureren

  1. Open NPS console

  2. Maak Network Policy voor RD Gateway

  3. Configureer conditions en constraints

  4. Stel authentication methods in

🔐 RDS Licensing

• Stap 9.11: Configureer RDS Licensing

  1. Server Manager → "Tools" → "Remote Desktop Services" → "RD Licensing Manager"

  2. Rechtsklik op server → "Activate Server"

  3. Kies "Automatic connection" of voer licentiesleutel in

  4. Configureer license server

• Stap 9.12: License Types Configureren

  1. Rechtsklik license server → "Properties"

  2. Configureer license type:

  • Per User: Voor roaming users
  • Per Device: Voor dedicated workstations

  3. Stel license server discovery in

⚙️ Session Configuration

• Stap 9.13: Remote Desktop Session Host Settings

  1. Open Group Policy Management Console (GPMC)

  2. Edit de relevante GPO (bijv. Default Domain Policy)

  3. Ga naar Computer Configuration → Policies → Administrative Templates → Windows Components → Remote Desktop Services → Remote Desktop Session Host → Connections

  4. Configureer RDP-Tcp properties:

  • Security: SSL (TLS 1.2)
  • Encryption: High
  • Authentication: Required
• Stap 9.14: User Profile Disks

  1. Collection properties → "User Profile Disks"

  2. Enable User Profile Disks

  3. Stel UNC pad in: \\server\share

  4. Configureer disk size limits

🛡️ RDS Security Hardening

• Stap 9.1: Disable TLS 1.0 and enforce TLS 1.2

  Schakel TLS 1.0 uit; gebruik minimaal TLS 1.2.

  Gebruik PowerShell om TLS configuratie aan te passen:

  # Disable TLS 1.0
  New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0" -Force
  New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0" -Name "Enabled" -Value 0 -PropertyType "DWord" -Force
  New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0" -Name "DisabledByDefault" -Value 1 -PropertyType "DWord" -Force
  
  # Enforce TLS 1.2
  New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2" -Force
  New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2" -Name "Enabled" -Value 1 -PropertyType "DWord" -Force
  New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2" -Name "DisabledByDefault" -Value 0 -PropertyType "DWord" -Force
  
  # Disable weak cipher suites
  Disable-TlsCipherSuite -Name "TLS_RSA_WITH_AES_128_CBC_SHA"
  Disable-TlsCipherSuite -Name "TLS_RSA_WITH_AES_256_CBC_SHA"
                              

  Herstart de server na deze wijzigingen.

• Stap 9.2: Session Limits Management via Group Policy

  Gebruik NLA en beheer sessielimieten via Group Policy i.p.v. de verouderde "Session Host Configuration"-console.

  Configureer sessielimieten:

  1. Ga naar Group Policy → Computer Configuration → Policies → Administrative Templates → Windows Components → Remote Desktop Services → Remote Desktop Session Host → Connections
  2. Enable "Set time limit for active but idle Remote Desktop Services sessions"
  3. Enable "Set time limit for disconnected sessions"
  4. Enable "End session when time limits are reached"
  5. Stel gewenste time limits in (bijv. 2 uur voor idle, 1 uur voor disconnected)
• Stap 9.15: Network Level Authentication Inschakelen

  1. Group Policy → Computer Configuration

  2. Policies → Administrative Templates → Windows Components → Remote Desktop Services

  3. Enable "Require user authentication for remote connections by using Network Level Authentication"

• Stap 9.16: Restrictie van Poorten en Protocollen

  1. Firewall rules voor RDP (3389)

  2. SSL/TLS configuratie voor encryptie

  3. Disable insecure protocols (RDP 6.0 or lower)

• Stap 9.17: Multi-Factor Authentication

  1. Azure AD integration voor MFA

  2. RADIUS authentication voor third-party MFA

  3. Certificate-based authentication

📊 RDS Monitoring

• Stap 9.18: Performance Counters

  1. Performance Monitor → Add Counters

  2. RDS counters:

  • Active Sessions
  • Total Sessions
  • CPU Usage per Session
  • Memory Usage per Session
• Stap 9.19: Event Logging

  1. Event Viewer → Applications and Services Logs

  2. Microsoft → Windows → RemoteDesktopServices

  3. Configureer alerts voor critical events

🚨 RDS Troubleshooting

💾 Backup Installatie

• Stap 10.1: Installeer Windows Server Backup

  1. Server Manager → "Add Roles and Features"

  2. Selecteer "Windows Server Backup"

  3. Klik "Install"

📋 Backup Schema

• Stap 10.2: Open Windows Server Backup

  1. Server Manager → "Tools" → "Windows Server Backup"

• Stap 10.3: Maak Backup Schedule

  1. Klik "Backup Schedule" in rechter paneel

  2. Kies "Custom"

  3. Selecteer te backuppen items:

  • ☑ Bare metal recovery
  • ☑ System state
  • ☑ Local disks

  4. Kies backup destination (external drive of network share)

  5. Stel schedule in (dagelijks/wekelijks)

Herstelscenario's (System State/AD)

• Stap 10.4: Beschikbare back-ups ophalen

  Gebruik wbadmin om beschikbare back-ups te bekijken:

                              wbadmin get versions
                              

• Stap 10.5: System State herstel uitvoeren

  Voer system state recovery uit met gekozen versie:

                              wbadmin start systemstaterecovery -version: -quiet
                              

Autoritatieve Restore (Directory Services Restore Mode)

• Stap 10.6: Start in DSRM

  1. Herstart de DC in Directory Services Restore Mode

  2. Log in met DSRM wachtwoord

• Stap 10.7: ntdsutil gebruiken voor autoritatieve restore

  1. Open Command Prompt als Administrator

  2. Start ntdsutil: ntdsutil

  3. Activeer NTDS instance: activate instance ntds

  4. Ga naar authoritative restore: authoritative restore

  5. Selecteer object/OU: restore object "CN=User,OU=Users,DC=lab,DC=local"

  6. Exit en herstart normaal

• Stap 10.8: Replicatie valideren

  Controleer dat de restore correct is gerepliceerd naar andere DCs

🔐 AD CS Installatie

• Stap 11.1: Installeer AD CS

  1. Server Manager → "Add Roles and Features"

  2. Selecteer "Active Directory Certificate Services"

  3. Kies role services:

  • ☑ Certification Authority
  • ☑ Certificate Enrollment Web Service
  • ☑ Certificate Enrollment Policy Web Service

  4. Klik "Install"

⚙️ CA Configuratie

• Stap 11.2: Configureer Certification Authority

  1. Klik op het vlaggetje in Server Manager

  2. Klik "Configure Active Directory Certificate Services"

  3. Selecteer "Certification Authority"

  4. Kies "Enterprise CA"

  5. Stel CA type in: "Root CA"

  6. Configureer overige instellingen

🔐 OCSP en NDES Implementatie

• Stap 11.3: Online Responder Installeren

  PowerShell commands:

                      # Online Responder
                      Install-WindowsFeature ADCS-Online-Cert -IncludeManagementTools
                      Install-AdcsOnlineResponder
                              

• Stap 11.4: NDES Installeren

  PowerShell commands:

                      # NDES (SCEP)
                      Install-WindowsFeature ADCS-Device-Enrollment -IncludeManagementTools
                      Install-AdcsNetworkDeviceEnrollmentService
                              

🔒 Beveiligingsverharding Checklist

• CA Private Key Beveiligen

  Bescherm CA private key met hardware security module (HSM) of sterke wachtwoorden.

• Certificaat Templates Configureren

  Gebruik veilige certificaat templates met juiste sleutelgroottes en geldigheidsperiodes.

• Certificaat Intrekking Inschakelen

  Configureer CRL en OCSP voor certificaat intrekking controle.

• Minste Privileges Implementeren

  Verleen certificaat inschrijfrechten alleen aan geautoriseerde gebruikers en computers.

• CA Logs Monitoren

  Schakel auditing in en monitor certificaat uitgifte en intrekking logs.

🔄 WSUS Installatie

• Stap 12.1: Installeer WSUS

  1. Server Manager → "Add Roles and Features"

  2. Selecteer "Windows Server Update Services"

  3. Kies "WSUS Services" en "Database"

  4. Klik "Install"

⚙️ WSUS Post-Installatie

• Stap 12.2: Configureer WSUS

  1. Open WSUS Admin Console

  2. Kies upstream server (Microsoft Update)

  3. Selecteer producten om te synchroniseren

  4. Kies classificaties (Critical Updates, Security Updates, etc.)

  5. Stel synchronisatie schedule in

• Stap 12.3: Configureer Client Settings

  1. Group Policy Management → Create new GPO

  2. Computer Configuration → Policies → Administrative Templates

  3. Windows Components → Windows Update

  4. Configure "Specify intranet Microsoft update service location"

  5. Voer WSUS server URL in

🔒 Beveiligingsverharding Checklist

• WSUS Database Beveiligen

  Bescherm WSUS database met sterke authenticatie en encryptie.

• Update Goedkeuring Configureren

  Implementeer goedkeuringsproces voor update deployment om ongeautoriseerde wijzigingen te voorkomen.

• WSUS SSL Inschakelen

  Configureer SSL/TLS voor veilige communicatie tussen WSUS server en clients.

• Minste Privileges Implementeren

  Verleen WSUS beheerrechten alleen aan geautoriseerde administrators.

• Update Compliance Monitoren

  Monitor regelmatig update compliance en behandel niet-compatibele systemen.

🌐 RRAS Installatie

• Stap 13.1: Installeer RRAS Role

  1. Server Manager → "Add Roles and Features"

  2. Selecteer "Remote Access"

  3. Kies "DirectAccess and VPN (RAS)"

  4. Selecteer "Routing"

  5. Klik "Install"

🔒 VPN Server Configuratie

• Stap 13.2: Configureer RRAS

  1. Server Manager → "Tools" → "Routing and Remote Access"

  2. Rechtsklik op server → "Configure and Enable Routing and Remote Access"

  3. Kies "Custom configuration"

  4. Vink aan: "VPN access" en "NAT"

  5. Klik "Next" en "Finish"

• Stap 13.3: Configureer VPN Properties

  1. Rechtsklik op server → "Properties"

  2. Tab "Security" → Configureer authentication

  3. Tab "IPv4" → Enable IPv4 forwarding

  4. Configureer address assignment (DHCP/static pool)

🔒 Beveiligingsverharding Checklist

• VPN Encryptie Configureren

  Gebruik sterke encryptie protocollen (IKEv2, SSTP) voor VPN verbindingen.

• Multi-Factor Authenticatie Inschakelen

  Implementeer MFA voor VPN toegang om beveiliging te verbeteren.

• VPN Toegang Beperken

  Beperk VPN toegang tot specifieke IP bereiken en gebruikersgroepen.

• VPN Logs Monitoren

  Schakel logging in en monitor VPN verbindings pogingen en fouten.

• Firewall Regels Configureren

  Stel firewall regels in om de VPN server te beschermen tegen ongeautoriseerde toegang.

🔐 NPS Installatie

• Stap 14.1: Installeer NPS

  1. Server Manager → "Add Roles and Features"

  2. Selecteer "Network Policy and Access Services"

  3. Kies "Network Policy Server"

  4. Klik "Install"

📋 RADIUS Client Configuratie

• Stap 14.2: Configureer RADIUS Clients

  1. Server Manager → "Tools" → "Network Policy Server"

  2. Vouw "RADIUS Clients and Servers" uit

  3. Rechtsklik "RADIUS Clients" → "New"

  4. Voer friendly name in

  5. IP address van de client (router/switch)

  6. Shared secret (sterk wachtwoord)

📊 Network Policies

• Stap 14.3: Maak Network Policy

  1. Rechtsklik "Network Policies" → "New"

  2. Policy name: "VPN Access Policy"

  3. Type of network access server: "Remote Access Server (VPN-Dial up)"

  4. Conditions: User Groups, NAS Port Type

  5. Constraints: Authentication methods, Encryption

  6. Settings: Framed Protocol (PPP), Service-Type (Framed)

🔒 Beveiligingsverharding Checklist

• RADIUS Communicatie Beveiligen

  Gebruik sterke shared secrets en schakel RADIUS over TLS in waar mogelijk.

• Authenticatie Methodes Configureren

  Implementeer sterke authenticatie methodes zoals EAP-TLS of PEAP.

• NPS Logging Inschakelen

  Configureer uitgebreide logging voor authenticatie en autorisatie gebeurtenissen.

• Netwerk Beleid Implementeren

  Maak restrictieve netwerk beleid gebaseerd op gebruikersgroepen en device compliance.

• RADIUS Verkeer Monitoren

  Monitor regelmatig RADIUS authenticatie pogingen en blokkeer verdachte IPs.

🚀 DirectAccess Prerequisites

• Stap 15.1: Controleer Prerequisites

  1. Active Directory Domain

  2. PKI Infrastructure (Certificate Services)

  3. Network Location Server (IIS website)

  4. Public IP address en DNS naam

  5. Windows 8/10/11 clients

⚙️ DirectAccess Setup

• Stap 15.2: Configureer Remote Access

  1. Server Manager → "Tools" → "Remote Access Management"

  2. Klik "Run the Remote Access Setup Wizard"

  3. Kies "Deploy DirectAccess only"

  4. Configureer network topology

  5. Stel DirectAccess client GPO in

  6. Configureer DNS en IP-HTTPS

🔒 Beveiligingsverharding Checklist

• Certificaat Vereisten Configureren

  Vereis computer certificaten voor DirectAccess client authenticatie.

• IPsec Encryptie Inschakelen

  Gebruik sterke IPsec encryptie voor alle DirectAccess verkeer.

• Gezondheidscontroles Implementeren

  Configureer NAP of device gezondheidscontroles voor DirectAccess clients.

• DirectAccess Toegang Beperken

  Beperk DirectAccess tot geautoriseerde gebruikers en compliant devices.

• DirectAccess Logs Monitoren

  Schakel logging in en monitor DirectAccess verbindingsgebeurtenissen.

⚖️ NLB Cluster Setup

• Stap 16.1: Installeer NLB Feature

  1. Server Manager → "Add Roles and Features"

  2. Selecteer "Network Load Balancing"

  3. Klik "Install"

• Stap 16.2: Maak NLB Cluster

  1. Server Manager → "Tools" → "Network Load Balancing Manager"

  2. Rechtsklik "Network Load Balancing Clusters" → "New Cluster"

  3. Voer host IP address in

  4. Configureer cluster IP address

  5. Kies cluster operation mode (Unicast/Multicast)

  6. Configureer port rules

🔒 Beveiligingsverharding Checklist

• NLB Authenticatie Configureren

  Schakel authenticatie in voor NLB cluster beheer en monitoring.

• Port Rules Beveiliging Implementeren

  Configureer restrictieve port rules en schakel onnodige protocollen uit.

• NLB Encryptie Inschakelen

  Gebruik versleutelde communicatie voor NLB heartbeat en beheer verkeer.

• Cluster Gezondheid Monitoren

  Stel monitoring en alerts in voor NLB cluster gezondheid en prestaties.

• NLB Hosts Beveiligen

  Zorg ervoor dat alle NLB cluster hosts correct beveiligd en gepatched zijn.

📊 Performance Monitor

• Stap 17.1: Open Performance Monitor

  1. Server Manager → "Tools" → "Performance Monitor"

  2. Klik "Performance Monitor" in linker paneel

• Stap 17.2: Voeg Counters toe

  1. Klik groene + knop

  2. Selecteer "Network Interface"

  3. Kies counters:

  • Bytes Total/sec
  • Current Bandwidth
  • Packets/sec

  4. Selecteer netwerk adapter

  5. Klik "Add" en "OK"

🔍 Resource Monitor

• Stap 17.3: Open Resource Monitor

  1. Start → "resmon.exe"

  2. Tab "Network" voor netwerk monitoring

  3. Bekijk TCP Connections, Listening Ports

  4. Monitor network utilization per process

🔒 Beveiligingsverharding Checklist

• Prestatie Data Beveiligen

  Bescherm prestatie monitoring data met juiste toegangscontroles.

• Alert Drempels Configureren

  Stel alerts in voor beveiligingsgerelateerde prestatie problemen en anomalieën.

• Audit Logging Inschakelen

  Schakel auditing in voor prestatie monitoring configuratie wijzigingen.

• Monitor voor Anomalieën

  Stel monitoring in voor ongewoon netwerkverkeer of systeemgedrag.

• Monitoring Tools Beveiligen

  Zorg ervoor dat monitoring tools bijgewerkt zijn en beschermd tegen ongeautoriseerde toegang.

🔧 Optioneel: Geavanceerde Monitoring met Windows Admin Center

☁️ Optioneel: Azure Monitor Integratie

📊 Monitoring Best Practices

• Stel Baselines Vast

  Monitor normale prestatie levels om anomalieën te identificeren

• Stel Alerts In

  Configureer alerts voor CPU > 80%, Geheugen > 90%, Schijfruimte < 10%

• Regelmatige Review

  Bekijk monitoring data wekelijks en pas drempels aan indien nodig

• Log Retentie

  Configureer juiste log retentie beleid voor compliance

🛡️ Windows Defender Antivirus

• Stap 18.1: Open Windows Security

  1. Start → "Windows Security"

  2. Klik "Virus & threat protection"

  3. Klik "Manage settings"

  4. Configureer real-time protection

  5. Stel cloud-delivered protection in

🔥 Windows Firewall Advanced

• Stap 18.2: Advanced Firewall Rules

  1. Windows Security → "Firewall & network protection"

  2. Klik "Advanced settings"

  3. Rechtsklik "Inbound Rules" → "New Rule"

  4. Kies "Custom" voor geavanceerde regels

  5. Configureer protocol, ports, IP ranges

🔒 Security Hardening Checklist

• Real-Time Bescherming Inschakelen

  Zorg ervoor dat Windows Defender real-time bescherming altijd ingeschakeld is.

• Firewall Regels Configureren

  Stel uitgebreide firewall regels in voor inkomend en uitgaand verkeer.

• Attack Surface Reduction Inschakelen

  Configureer attack surface reduction rules om veelvoorkomende exploits te voorkomen.

• Controlled Folder Access Implementeren

  Schakel controlled folder access in om te beschermen tegen ransomware.

• Beveiligingsgebeurtenissen Monitoren

  Bekijk regelmatig Windows Defender logs en beveiligingsgebeurtenissen.

• Windows Firewall Inschakelen

  Zorg ervoor dat Windows Firewall is ingeschakeld en geconfigureerd voor domein- en privénetwerken.

• Beveiligingspatches Toepassen

  Installeer regelmatig de nieuwste Windows updates en beveiligingspatches via WSUS of Windows Update.

• Minste Privileges Implementeren

  Gebruik het principe van minste privileges voor gebruikersaccounts en serviceaccounts. Voorkom het uitvoeren van services als administrator.

• Auditbeleid Configureren

  Schakel auditing in voor beveiligingsgebeurtenissen, account aanmelden/afmelden en objecttoegang.

• LDAP Communicatie Beveiligen

  Schakel LDAP over SSL (LDAPS) in voor veilige directorycommunicatie.

• RDP Beveiliging Configureren

  Schakel Network Level Authentication (NLA) in en beperk RDP tot specifieke IP bereiken.

• SSL Certificaten Gebruiken

  Configureer SSL/TLS certificaten voor veilige RDP verbindingen.

• Minste Privileges Implementeren

  Verleen RDS toegang alleen aan geautoriseerde gebruikers en gebruik Remote Desktop Users groep.

• Sessie Limieten Inschakelen

  Stel sessie timeout en idle disconnect beleid in.

• RDS Logs Monitoren

  Schakel RDS verbindingslogs in en bekijk ze voor beveiligingsmonitoring.

📋 Group Policy Management Console

• Stap 19.1: Open Group Policy Management

  1. Server Manager → Tools → Group Policy Management

  2. Vouw Forest uit → Domains → lab.local

• Stap 19.2: Maak Nieuwe GPO

  1. Rechtsklik op Group Policy Objects → New

  2. Geef naam: "Lab Security Policy"

  3. Klik OK

• Stap 19.3: Configureer GPO Settings

  1. Rechtsklik op nieuwe GPO → Edit

  2. Computer Configuration → Policies → Windows Settings → Security Settings

  3. Configureer password policies, account lockout, audit policies

🔗 GPO Linking

• Stap 19.4: Link GPO aan OU

  1. Vouw Domain uit → Rechtsklik op OU (bijv. Computers)

  2. Selecteer "Link an Existing GPO"

  3. Kies de GPO en klik OK

⚖️ Failover Cluster Setup

• Stap 20.1: Installeer Failover Clustering Feature

  1. Server Manager → Add Roles and Features

  2. Selecteer "Failover Clustering"

  3. Klik Install

• Stap 20.2: Validate Cluster Configuration

  1. Server Manager → Tools → Failover Cluster Manager

  2. Klik "Validate Configuration"

  3. Voeg beide servers toe

  4. Run all tests

• Stap 20.3: Create Failover Cluster

  1. Klik "Create Cluster"

  2. Voeg cluster nodes toe

  3. Configureer cluster name en IP

  4. Kies quorum configuratie

🔄 Cluster Quorum

☁️ Cloud Witness voor clusters

• Stap 20.x: Azure Storage Account aanmaken

  Maak Azure Storage account voor witness:

                      # Azure CLI
                      az storage account create --name mystorageaccount --resource-group myrg --location eastus --sku Standard_LRS --kind StorageV2
                      

• Stap 20.x: Cluster Quorum configureren

  Configureer cluster voor Cloud Witness:

                      # PowerShell
                      $cluster = Get-Cluster
                      $cluster | Set-ClusterQuorum -CloudWitness -AccountName "mystorageaccount" -AccessKey "storagekey"
                      

• Stap 20.x: Quorum validatie

  Test quorum functionaliteit:

                      # PowerShell
                      Test-Cluster
                      Get-ClusterQuorum | Format-List *
                      

💾 Storage Pool Creation

• Stap 21.1: Open Server Manager

  1. Server Manager → File and Storage Services → Storage Pools

• Stap 21.2: Create Storage Pool

  1. Klik "New Storage Pool"

  2. Geef naam: "LabStoragePool"

  3. Selecteer physical disks

  4. Kies storage layout (Simple/Mirror/Parity)

• Stap 21.3: Create Virtual Disk

  1. Rechtsklik op storage pool → "New Virtual Disk"

  2. Kies storage layout en provisioning type

  3. Stel size in

  4. Configureer advanced options

📊 Storage Layout Types

💽 RAID Levels Overzicht

🔧 Hardware RAID Setup

• Stap 22.1: BIOS/UEFI RAID Configuratie

  1. Herstart server en ga BIOS/UEFI setup in

  2. Zoek naar RAID/SATA configuratie

  3. Stel SATA mode in op RAID

  4. Sla op en herstart

• Stap 22.2: RAID Controller BIOS

  1. Druk op RAID controller hotkey tijdens boot (meestal Ctrl+R, F10, etc.)

  2. Selecteer "Create Array"

  3. Kies RAID level (1, 5, 6, 10)

  4. Selecteer physical disks

  5. Configureer array parameters

• Stap 22.3: Logical Drive Creation

  1. Stel stripe size in (64KB voor algemeen gebruik)

  2. Configureer read/write policies

  3. Stel cache instellingen in

  4. Initialiseer array

💻 Software RAID Setup (Windows)

• Stap 22.4: Open Disk Management

  1. Rechtsklik Start → Disk Management

  2. Of: Server Manager → Tools → Computer Management → Disk Management

• Stap 22.5: Initialize New Disks

  1. Rechtsklik op nieuwe disks

  2. Selecteer "Initialize Disk"

  3. Kies MBR of GPT partition style

  4. Klik OK

• Stap 22.6: Create RAID Array

  1. Selecteer unallocated space op eerste disk

  2. Rechtsklik → "New Mirrored Volume" (voor RAID 1)

  3. Of "New RAID-5 Volume" voor RAID 5

  4. Volg wizard voor disk selectie en volume configuratie

📊 RAID Monitoring & Maintenance

• Stap 22.7: RAID Health Monitoring

  1. Gebruik RAID controller management software

  2. Controleer event logs voor disk failures

  3. Stel alerts in voor degraded arrays

  4. Monitor S.M.A.R.T. status van disks

• Stap 22.8: Hot Spare Configuratie

  1. Configureer dedicated hot spare disk

  2. Stel automatic rebuild in bij disk failure

  3. Test hot spare functionality

• Stap 22.9: RAID Array Backup

  1. RAID beschermt niet tegen data corruptie

  2. Implementeer regelmatige backups

  3. Test restore procedures

  4. Document RAID configuratie

🚨 RAID Failure Recovery

🔒 RAID Security Best Practices

• Physical Security

  Bescherm RAID arrays tegen fysieke schade en ongeautoriseerde toegang.

• Access Control

  Beperk toegang tot RAID management interfaces tot geautoriseerde administrators.

• Encryption

  Gebruik disk encryption voor gevoelige data op RAID arrays.

• Regular Monitoring

  Monitor RAID health dagelijks en stel alerts in voor problemen.

• Documentation

  Document RAID configuratie, disk mappings en recovery procedures.

📋 Windows Server Evaluation Editions Vergelijking

🔄 Re-arming Proces

• Stap 23.1: Controleer Huidige Status

  1. Open Command Prompt als Administrator

  2. Voer uit: slmgr /dli

  3. Controleer "Time to expiration" en "Remaining rearm count"

  4. Noteer huidige evaluatie periode

• Stap 23.2: Voer Re-arm Uit

  1. Zorg dat je Administrator rechten hebt

  2. Voer uit: slmgr /rearm

  3. Herstart de server: shutdown /r /t 0

  4. Controleer nieuwe status: slmgr /dli

• Stap 23.3: Valideer Re-arming

  1. Controleer dat evaluatie periode is verlengd

  2. Test alle server functies

  3. Update documentatie met nieuwe verloopdatum

  4. Stel herinnering in voor volgende re-arming

🚨 Voorkomen van Verlopen VM's

• Stap 23.4: Monitoring Setup

  1. Maak PowerShell script voor dagelijkse checks:

  # Daily evaluation license monitoring
  $license = Get-CimInstance SoftwareLicensingProduct | Where-Object { $_.Name -like "*Windows*" }
  $daysLeft = ($license.GracePeriodRemaining / 1440)  # Convert minutes to days
  
  if ($daysLeft -lt 30) {
      Write-Host "WARNING: Only $daysLeft days remaining!" -ForegroundColor Red
      # Send email alert or log to monitoring system
  }
                              

  2. Schedule via Task Scheduler: schtasks /create /tn "LicenseMonitor" /tr "powershell.exe -File C:\Scripts\Check-License.ps1" /sc daily /st 09:00

• Stap 23.5: Automatische Re-arming

  1. Maak unattended re-arm script:

  # Automatic rearm when 30 days remaining
  $license = Get-CimInstance SoftwareLicensingProduct | Where-Object { $_.Name -like "*Windows*" }
  $daysLeft = ($license.GracePeriodRemaining / 1440)
  
  if ($daysLeft -le 30 -and $license.RemainingRearmCount -gt 0) {
      slmgr /rearm
      shutdown /r /t 300 /c "Automatic rearm - restart in 5 minutes"
  }
                              

  2. Test script in lab environment eerst

  3. Implementeer alleen op niet-productie systemen

• Stap 23.6: Disaster Recovery Planning

  1. Maak VM backups voor disaster recovery

  2. Document re-arm limits per VM

  3. Plan migratie naar productie licenties

  4. Stel budget in voor licentie aankoop

🚨 Veelvoorkomende Fouten & Oplossingen

📊 Evaluatie License Dashboard

🔧 PowerShell Automatisering

• Stap 24.1: Basis PowerShell Scripts

  Hyper-V setup script:

  # Hyper-V Installation and Configuration
  Install-WindowsFeature -Name Hyper-V -IncludeManagementTools -Restart
  
  # Create NAT Switch
  New-VMSwitch -Name "NATSwitch" -SwitchType Internal
  New-NetNat -Name "NATNetwork" -InternalIPInterfaceAddressPrefix "10.0.0.0/24"
  
  # Create VM
  New-VM -Name "LAB-DC01" -MemoryStartupBytes 4GB -Generation 2
  Set-VM -Name "LAB-DC01" -ProcessorCount 2
  Add-VMNetworkAdapter -VMName "LAB-DC01" -SwitchName "NATSwitch"
                              

• Stap 24.2: Windows Feature Installation

  Automated role installation:

  # Install AD DS and DNS
  $Features = @(
      "AD-Domain-Services",
      "DNS",
      "DHCP",
      "RSAT-AD-Tools",
      "RSAT-DNS-Server"
  )
  
  foreach ($Feature in $Features) {
      Install-WindowsFeature -Name $Feature -IncludeManagementTools
  }
                              

⚙️ Desired State Configuration (DSC)

• Stap 24.3: DSC Configuration Script

  Voorbeeld DSC configuratie:

  Configuration LabServerConfig {
      Import-DscResource -ModuleName PSDesiredStateConfiguration
  
      Node "LAB-DC01" {
          WindowsFeature ADDS {
              Name = "AD-Domain-Services"
              Ensure = "Present"
          }
  
          WindowsFeature DNS {
              Name = "DNS"
              Ensure = "Present"
              DependsOn = "[WindowsFeature]ADDS"
          }
  
          Service DNSService {
              Name = "DNS"
              State = "Running"
              DependsOn = "[WindowsFeature]DNS"
          }
      }
  }
  
  # Generate MOF files
  LabServerConfig -OutputPath "C:\DSC\Config"
  
  # Apply configuration
  Start-DscConfiguration -Path "C:\DSC\Config" -Wait -Verbose
                              

🚀 CI/CD Pipeline Setup

• Stap 24.4: GitHub Actions Workflow

  Voorbeeld .github/workflows/deploy.yml:

  name: Windows Server Lab Deployment
  
  on:
    push:
      branches: [ main ]
    workflow_dispatch:
  
  jobs:
    lint:
      runs-on: windows-latest
      steps:
      - uses: actions/checkout@v3
      - name: Lint PowerShell
        uses: github/super-linter@v4
        env:
          DEFAULT_BRANCH: main
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          VALIDATE_ALL_CODEBASE: false
          VALIDATE_POWERSHELL: true
  
    test:
      runs-on: windows-latest
      steps:
      - uses: actions/checkout@v3
      - name: Test PowerShell Scripts
        shell: pwsh
        run: |
          $scripts = Get-ChildItem -Path . -Filter "*.ps1" -Recurse
          foreach ($script in $scripts) {
              $errors = $null
              $null = [System.Management.Automation.PSParser]::Tokenize((Get-Content $script.FullName), [ref]$errors)
              if ($errors.Count -gt 0) {
                  Write-Error "Syntax error in $($script.FullName)"
                  exit 1
              }
          }
  
    deploy:
      runs-on: windows-latest
      needs: [lint, test]
      steps:
      - uses: actions/checkout@v3
      - name: Deploy Lab Environment
        shell: pwsh
        run: |
          # Deployment logic here
          Write-Host "Deploying Windows Server Lab Environment..."
                              

📊 Windows Admin Center + Azure Monitor

• Stap 25.1: Windows Admin Center Installatie

  1. Download Windows Admin Center van Microsoft

  2. Installeer op management server: msiexec /i WindowsAdminCenter.msi /qn

  3. Configureer HTTPS certificaat

  4. Voeg servers toe voor beheer

• Stap 25.2: Azure Monitor Agent Installatie

  1. Maak Azure Log Analytics workspace

  2. Download Azure Monitor agent

  3. Installeer op Windows servers:

  # PowerShell installation
  $workspaceId = "your-workspace-id"
  $workspaceKey = "your-workspace-key"
  
  $publicSettings = @{"workspaceId" = $workspaceId}
  $protectedSettings = @{"workspaceKey" = $workspaceKey}
  
  Set-AzVMExtension -ExtensionName "MicrosoftMonitoringAgent" `
      -ResourceGroupName "your-resource-group" `
      -VMName "your-vm-name" `
      -Publisher "Microsoft.EnterpriseCloud.Monitoring" `
      -ExtensionType "MicrosoftMonitoringAgent" `
      -TypeHandlerVersion 1.0 `
      -Settings $publicSettings `
      -ProtectedSettings $protectedSettings
                              

🔍 Centralized Logging Setup

• Stap 25.3: Windows Event Forwarding

  1. Configureer collector server

  2. Group Policy voor source servers:

  # GPO Settings
  Computer Configuration → Policies → Administrative Templates
  → Windows Components → Event Forwarding
  → Configure target Subscription Manager: Enabled
  → SubscriptionManagers: Server=http://collector:5985/wsman/SubscriptionManager/WEC
                              

  3. Maak event subscriptions

  4. Configureer event filters

• Stap 25.4: SIEM Integration

  Microsoft Sentinel setup:

  # Connect Log Analytics to Sentinel
  Connect-AzAccount
  Set-AzContext -SubscriptionId "your-subscription-id"
  
  # Enable Sentinel
  $workspace = Get-AzOperationalInsightsWorkspace -Name "your-workspace" -ResourceGroupName "your-rg"
  New-AzSentinelOnboardingState -Workspace $workspace -SkipDefaultRules
                              

📈 Performance Monitoring Dashboard

• Stap 25.5: Grafana Dashboard Setup

  1. Installeer Grafana op monitoring server

  2. Configureer Azure Monitor data source

  3. Import dashboard templates:

  # Key metrics to monitor
  - CPU Utilization (%)
  - Memory Usage (GB)
  - Disk I/O Operations/sec
  - Network Bytes Total/sec
  - Active Directory Replication Status
  - DNS Query Response Time
  - DHCP Scope Utilization (%)
                              

🚨 Alert Configuration

🖥️ Windows Admin Center (WAC) Gateway

• Stap 25.x: Stille installatie

  Voorbeeld installatie:

                      # Stille installatie (voorbeeld)
                      msiexec /i "WindowsAdminCenter.msi" /qn
                      

• Stap 25.x: Toegang en configuratie

  Toegang tot WAC:

                      # Toegang: https://:443
                      # Voer servers toe en activeer extensies (Updates, Event Viewer, PowerShell, Failover Cluster, etc.)
                      

🔄 Hyper-V Replica Setup

• Stap 26.1: Replica Server Configuratie

  1. Installeer Hyper-V rol op replica server

  2. Configureer firewall: Enable-NetFirewallRule -DisplayName "Hyper-V Replica HTTP Listener"

  3. Enable Hyper-V Replica:

  Set-VMReplicationServer -ReplicationEnabled $true -AllowedAuthenticationType Kerberos `
      -ReplicationAllowedFromAnyIP $false -ReplicationAllowedIPs "192.168.1.0/24" `
      -DefaultStorageLocation "D:\VMReplicas"
                              

• Stap 26.2: VM Replication Inschakelen

  1. Selecteer VM in Hyper-V Manager

  2. Rechtsklik → "Enable Replication"

  3. Voer replica server naam in

  4. Kies replicatie frequency (30 sec - 15 min)

  5. Selecteer VHD's voor replicatie

  6. Configureer recovery points (1-15)

• Stap 26.3: Test Failover Uitvoeren

  1. Selecteer gerepliceerde VM

  2. Rechtsklik → "Test Failover"

  3. Kies recovery point

  4. Controleer of test VM start

  5. Stop test VM na verificatie

⚖️ Failover Clustering Advanced

• Stap 26.4: Cluster Shared Volumes (CSV)

  1. Voeg shared storage toe aan cluster

  2. Create CSV: Add-ClusterSharedVolume -Name "CSV1" -Cluster "CLUSTER01"

  3. Configureer CSV cache indien mogelijk

  4. Test CSV failover tussen nodes

• Stap 26.5: Cluster-Aware Updating (CAU)

  1. Installeer CAU feature: Install-WindowsFeature -Name RSAT-Clustering-PowerShell

  2. Configureer self-updating options:

  Add-CauClusterRole -ClusterName "CLUSTER01" -DaysOfWeek Friday `
      -WeeksOfMonth 1 -TimeOfDay "3:00" -RequireAllNodesOnline $false
                              

  3. Stel update run profiles in

  4. Configureer pre- en post-update scripts

☁️ Azure Site Recovery

• Stap 26.6: ASR Recovery Services Vault

  1. Maak Recovery Services vault in Azure portal

  2. Download ASR provider voor Hyper-V

  3. Installeer op Hyper-V host:

  # Register Hyper-V host with ASR
  $passphrase = Get-Content "C:\Temp\passphrase.txt"
  $friendlyName = "HyperVHost01"
  
  Register-SRProvider -ResourceDetails $friendlyName -Passphrase $passphrase
                              

• Stap 26.7: VM Protection Inschakelen

  1. Selecteer VMs voor bescherming

  2. Configureer replicatie settings:

  • Replicatie frequency: 30 sec - 15 min
  • Recovery points: 1-15 dagen
  • App-consistent snapshots: Enabled

  3. Stel failover en failback policies in

📋 DR Test Procedures

🔄 WSUS Deployment Ringen

• Stap 27.1: WSUS Server Ringen Opzetten

  1. Maak downstream WSUS servers

  2. Configureer upstream/downstream relatie

  3. Stel products en classifications in per ring

• Stap 27.2: Automatische Goedkeuringsregels

  1. Open WSUS Admin Console

  2. Ga naar Options → Automatic Approvals

  3. Create rule voor critical updates:

  # PowerShell voor automatische goedkeuringen
  $wsus = Get-WsusServer
  $rule = $wsus.CreateInstallApprovalRule("Critical Updates")
  $rule.Enabled = $true
  $rule.SetCategories("Critical Updates", "Security Updates")
  $rule.SetComputerGroups("Pilot Group")
  $rule.Save()
                              

📊 WSUS Rapportage Scripts

• Stap 27.3: Compliance Rapportage

  PowerShell script voor niet-gepatchte machines:

  # Get WSUS compliance report
  [reflection.assembly]::LoadWithPartialName("Microsoft.UpdateServices.Administration") | Out-Null
  $wsus = [Microsoft.UpdateServices.Administration.AdminProxy]::GetUpdateServer()
  
  $computers = $wsus.GetComputerTargets()
  $updates = $wsus.GetUpdates() | Where-Object { $_.IsApproved -eq $true }
  
  $report = @()
  
  foreach ($computer in $computers) {
      $neededUpdates = $computer.GetUpdateInstallationInfoPerUpdate() |
          Where-Object { $_.UpdateApprovalAction -eq "Install" -and $_.UpdateInstallationState -ne "Installed" }
  
      if ($neededUpdates.Count -gt 0) {
          $report += [PSCustomObject]@{
              ComputerName = $computer.FullDomainName
              NeededUpdates = $neededUpdates.Count
              LastSync = $computer.LastSyncTime
          }
      }
  }
  
  $report | Sort-Object NeededUpdates -Descending | Format-Table -AutoSize
                              

🔗 Windows Update for Business

• Stap 27.4: WUfB Policy Configuratie

  1. Open Group Policy Management

  2. Create GPO: "Windows Update for Business"

  3. Configure deferral policies:

  Computer Configuration → Policies → Administrative Templates
  → Windows Components → Windows Update
  → Manage updates offered from Windows Update
  
  # Quality Updates Deferral: 7 days
  # Feature Updates Deferral: 365 days
  # Preview Builds: Disabled
                              

• Stap 27.5: Intune Integration

  1. Maak device configuration profile in Intune

  2. Configure Windows Update settings

  3. Stel update rings in:

  • Pilot: Immediate deployment
  • Broad: 7-day delay
  • Critical: 30-day delay

📈 Update Compliance Dashboard

📋 CIS Benchmark Implementatie

• Stap 28.1: Account Policies Hardening

  1. Open Group Policy Management

  2. Configure password policies:

  Computer Configuration → Policies → Windows Settings → Security Settings
  → Account Policies → Password Policy
  
  # Minimum password length: 14 characters
  # Password complexity: Enabled
  # Password history: 24 passwords
  # Maximum password age: 90 days
                              

• Stap 28.2: Audit Policy Configuratie

  1. Advanced Audit Policy Configuration:

  # Enable comprehensive auditing
  Audit Account Logon Events: Success and Failure
  Audit Account Management: Success and Failure
  Audit Directory Service Access: Success and Failure
  Audit Logon Events: Success and Failure
  Audit Object Access: Success and Failure
  Audit Policy Change: Success and Failure
  Audit Privilege Use: Success and Failure
  Audit System Events: Success and Failure
                              

🔐 Advanced Security Features

• Stap 28.3: Credential Guard Setup

  1. Controleer hardware requirements (VT-x, UEFI)

  2. Enable Credential Guard via Group Policy:

  Computer Configuration → Administrative Templates
  → System → Device Guard
  → Turn On Virtualization Based Security: Enabled
  → Select Platform Security Level: Secure Boot and DMA Protection
  → Credential Guard Configuration: Enabled with UEFI lock
                              

  3. Herstart servers voor activatie

• Stap 28.4: LAPS (Local Administrator Password Solution)

  1. Download en installeer LAPS MSI

  2. Extend AD schema: Update-AdmPwdADSchema

  3. Configureer GPO permissions

  4. Stel password complexity in

• Stap 28.5: WDAC (Windows Defender Application Control)

  1. Maak WDAC policy met PowerShell:

  # Create WDAC policy
  New-CIPolicy -Level Publisher -Fallback Hash -FilePath "C:\Policies\WDACPolicy.xml" -UserPEs
  
  # Convert to binary format
  ConvertFrom-CIPolicy -XmlFilePath "C:\Policies\WDACPolicy.xml" -BinaryFilePath "C:\Policies\WDACPolicy.bin"
                              

  2. Deploy via Group Policy of Intune

🛡️ Attack Surface Reduction

• Stap 28.6: ASR Rules Configuratie

  1. Open Windows Security → App & browser control

  2. Enable ASR rules:

  • Block executable files from running unless they meet a prevalence, age, or trusted list criterion
  • Block Office applications from creating child processes
  • Block Office applications from injecting code into other processes
  • Block Win32 API calls from Office macro
  • Use advanced protection against ransomware

🔐 LDAP Signing en Channel Binding

• Stap 28.7: LDAP Signing en Channel Binding afdwingen

  Voorkomt downgrade/relay-aanvallen; hardening voor AD-communicatie:

  1. Open Group Policy Management Console (GPMC)

  2. Maak nieuwe GPO: "SEC-LDAP-Hardening" of gebruik bestaande security GPO

  3. Link GPO op Domain Controllers OU

  4. Navigeer naar: Computer Configuration → Policies → Windows Settings → Security Settings → Local Policies → Security Options

  5. Configureer:

  • "Domain controller: LDAP server signing requirements" = Require signing
  • "Domain controller: LDAP server channel binding token requirements" = Always

  6. Forceer policy update: gpupdate /force

  7. Controleer implementatie via event logs en network captures

👥 Just-In-Time Administration

• Stap 28.7: Azure AD PIM Setup

  1. Enable Azure AD Premium P2

  2. Configureer privileged roles

  3. Stel approval workflows in

  4. Configureer session timeouts

• Stap 28.8: Break-Glass Accounts

  1. Maak emergency administrator accounts

  2. Sla credentials op in secure location

  3. Configureer monitoring voor account gebruik

  4. Document emergency procedures

🔒 RDP Security Hardening

🔐 BitLocker op Servers (incl. Recovery naar AD)

• Stap 28.9: BitLocker Feature Installeren

  PowerShell command:

  # Feature Install
  Install-WindowsFeature BitLocker -IncludeManagementTools
                              

• Stap 28.10: BitLocker Inschakelen

  Voor een drive:

  # Enable BitLocker
  Enable-BitLocker -MountPoint "C:" -EncryptionMethod Aes256 -UsedSpaceOnly -RecoveryPasswordProtector
                              

• Stap 28.11: Network Unlock Configureren

  Configureer Network Unlock voor automatische ontgrendeling op domeinnetwerk:

  # Enable Network Unlock op de server
  Enable-BitLocker -MountPoint "C:" -RecoveryPasswordProtector -UsedSpaceOnly -SkipHardwareTest
  
  # Configureer Network Unlock certificaten
  # Vereist: Certificate Services rol op domain controller
  # Genereer Network Unlock certificaat
  $cert = New-SelfSignedCertificate -Subject "CN=Network Unlock Certificate" -CertStoreLocation "Cert:\LocalMachine\My" -KeyUsage KeyEncipherment -Type DocumentEncryptionCert
  
  # Exporteer certificaat voor distributie naar clients
  Export-Certificate -Cert $cert -FilePath "C:\NetworkUnlock.cer"
                              

• Stap 28.12: Recovery Key Beheer

  Beheer en backup van BitLocker recovery keys:

  # Backup recovery key naar bestand
  $recoveryKey = (Get-BitLockerVolume -MountPoint "C:").KeyProtector | Where-Object {$_.KeyProtectorType -eq 'RecoveryPassword'}
  Backup-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId $recoveryKey.KeyProtectorId -Path "C:\BitLockerRecovery.txt"
  
  # Toon recovery key (voor backup doeleinden)
  (Get-BitLockerVolume -MountPoint "C:").KeyProtector | Where-Object {$_.KeyProtectorType -eq 'RecoveryPassword'} | Select-Object -ExpandProperty RecoveryPassword
  
  # Backup naar Active Directory (als GPO is geconfigureerd)
  manage-bde -protectors -adbackup C:
                              

• Stap 28.13: BitLocker Status Controleren

  Controleer BitLocker configuratie en status:

  # Controleer BitLocker status
  Get-BitLockerVolume
  
  # Controleer protectors
  Get-BitLockerVolume -MountPoint "C:" | Select-Object -ExpandProperty KeyProtector
  
  # Controleer encryption status
  manage-bde -status
  
  # Controleer Network Unlock status
  Get-BitLockerVolume -MountPoint "C:" | Select-Object VolumeStatus, EncryptionPercentage, KeyProtector
                              

• Stap 28.14: BitLocker Auto-Unlock Configureren

  Configureer automatische ontgrendeling voor extra drives:

  # Enable auto-unlock voor data drives
  Enable-BitLockerAutoUnlock -MountPoint "D:"
  
  # Controleer welke drives auto-unlock hebben
  Get-BitLockerVolume | Where-Object {$_.AutoUnlockEnabled -eq $true}
  
  # Disable auto-unlock indien nodig
  Disable-BitLockerAutoUnlock -MountPoint "D:"
                              

🔧 GPO Settings voor BitLocker Recovery naar AD

💾 Storage Spaces Direct (S2D)

• Stap 29.1: S2D Prerequisites Controle

  1. Controleer hardware compatibility:

  • Minimaal 2 servers (max 16)
  • Identieke storage devices
  • 10GbE networking voor storage traffic
  • Windows Server 2016+ Datacenter edition

  2. Valideer met: Test-Cluster -Node $nodes

• Stap 29.2: S2D Cluster Deployment

  1. Enable S2D op cluster:

  Enable-ClusterS2D -ClusterName "S2D-Cluster" -Confirm:$false
  
  # Configureer storage pool
  New-StoragePool -FriendlyName "S2DPool" -StorageSubSystemFriendlyName "*Cluster*" `
      -PhysicalDisks (Get-PhysicalDisk -CanPool $true)
  
  # Create virtual disk
  New-Volume -FriendlyName "S2DVolume" -FileSystem CSVFS_ReFS `
      -StoragePoolFriendlyName "S2DPool" -Size 10TB -ResiliencySettingName Mirror
                              

📊 Filesystem Performance Tuning

• Stap 29.3: ReFS vs NTFS Vergelijking

  ReFS advantages voor VM storage:

  • Automatic integrity checking
  • Real-time corruption detection
  • Storage Spaces integration
  • Better performance voor large files
  • Block cloning voor VM checkpoints
• Stap 29.4: Deduplicatie & Compressie

  1. Enable deduplicatie voor VM storage:

  Enable-DedupVolume -Volume "D:" -UsageType HyperV
  
  # Configureer deduplicatie settings
  Set-DedupVolume -Volume "D:" -MinimumFileAgeDays 3 -MinimumFileSize 256KB
  
  # Start manual deduplicatie
  Start-DedupJob -Volume "D:" -Type Optimization
                              

  2. Monitor deduplicatie savings: Get-DedupStatus

⚡ Performance Optimization

• Stap 29.5: VM Storage Performance

  1. Configureer VM storage QoS:

  # Set storage QoS policy
  New-StorageQosPolicy -Name "VM-Gold" -MinimumIops 100 -MaximumIops 1000 `
      -PolicyType Dedicated
  
  # Apply to VM
  Get-VM "VM01" | Get-VMHardDiskDrive | Set-VMHardDiskDrive -QoSPolicyID $policy.Id
                              

  2. Enable dynamic memory voor betere resource utilization

• Stap 29.6: NUMA Optimization

  1. Controleer NUMA topology: Get-VMHostNumaNode

  2. Configureer VM voor NUMA alignment:

  Set-VMProcessor -VMName "VM01" -MaximumCountPerNumaNode 8 `
      -MaximumCountPerNumaSocket 4 -NumaIsolationGroups $true
                              

  3. Reserve host resources voor VM: Set-VMProcessor -Reserve 50

📈 Storage Performance Metrics

🔍 Troubleshooting Decision Trees

• Stap 30.1: Network Connectivity Issues

  Systematische troubleshooting flow:

  Network Issue Troubleshooting Flow:
  ├── 1. Physical Layer
  │   ├── Check cable connections
  │   ├── Verify NIC link status: Get-NetAdapter
  │   ├── Test cable continuity
  │   └── Check switch port status
  ├── 2. Data Link Layer
  │   ├── Verify VLAN configuration
  │   ├── Check MAC address table
  │   ├── Validate NIC drivers: Get-NetAdapter | Select Name, DriverVersion
  │   └── Test NIC functionality
  ├── 3. Network Layer
  │   ├── Check IP configuration: ipconfig /all
  │   ├── Test gateway reachability: ping 
  │   ├── Verify routing table: route print
  │   └── Check DNS resolution: nslookup 
  ├── 4. Transport Layer
  │   ├── Test port connectivity: telnet  
  │   ├── Check firewall rules: Get-NetFirewallRule
  │   ├── Verify service status: Get-Service
  │   └── Test application connectivity
  └── 5. Application Layer
      ├── Check application logs
      ├── Verify authentication
      ├── Test application configuration
      └── Validate dependencies
                              

🚨 Common Error Codes & Solutions

📋 Runbooks & Procedures

• Stap 30.2: Incident Response Runbook

  1. Detection & Assessment (0-15 min)

  • Monitor alerts en logs
  • Assess impact en urgency
  • Notify stakeholders indien nodig
  • Document initial findings

  2. Containment (15-60 min)

  • Isolate affected systems
  • Stop spread van probleem
  • Implement temporary workarounds
  • Backup critical data

  3. Investigation (1-4 uur)

  • Gather detailed information
  • Analyze root cause
  • Test hypotheses
  • Document findings
• Stap 30.3: Change Management Template

  Change Request Template:

  Change Request #: CR-2024-001
  Title: Windows Server 2022 Feature Update
  Requester: [Name]
  Date Requested: [Date]
  Priority: [High/Medium/Low]
  Risk Level: [Low/Medium/High]
  
  Description:
  [Detailed description of the change]
  
  Impact Assessment:
  - Business Impact: [Description]
  - Technical Impact: [Description]
  - Rollback Plan: [Description]
  
  Implementation Plan:
  1. Pre-change validation
  2. Change execution steps
  3. Post-change validation
  4. Rollback procedures
  
  Approval:
  Change Manager: ___________ Date: ___________
  Technical Lead: ___________ Date: ___________
  Business Owner: ___________ Date: ___________
  
  Post-Implementation Review:
  [Results, issues encountered, lessons learned]
                              

📞 Escalation Matrix

👥 RACI Matrix voor Server Beheer

📝 Change Management Process

• Stap 31.1: Change Request Submission

  1. Document change requirements

  2. Assess impact en risico's

  3. Obtain approvals volgens RACI

  4. Schedule change window

• Stap 31.2: Change Implementation

  1. Pre-change backup

  2. Execute change volgens plan

  3. Validate change success

  4. Document actual vs planned

• Stap 31.3: Post-Change Review

  1. Monitor voor 24-48 uur

  2. Validate business continuity

  3. Document lessons learned

  4. Update procedures indien nodig

🔍 Advanced Audit Configuration

• Stap 31.4: Object Access Auditing

  1. Enable object access auditing:

  # Configureer advanced audit policies
  auditpol /set /subcategory:"File System" /success:enable /failure:enable
  auditpol /set /subcategory:"Registry" /success:enable /failure:enable
  auditpol /set /subcategory:"Handle Manipulation" /success:enable /failure:enable
  
  # Audit specifieke files/folders
  icacls "C:\SensitiveData" /setintegritylevel (OI)(CI)F /t
                              

• Stap 31.5: Security Event Log Monitoring

  1. Configureer event log retention:

  # Set log size en retention
  wevtutil sl Security /ms:104857600  # 100MB
  wevtutil sl Security /rt:true        # Enable retention
  wevtutil sl Security /ab:true        # Archive when full
  
  # Monitor critical events
  Get-WinEvent -LogName Security -FilterXPath "*[System[(EventID=4625)]]" -MaxEvents 10
                              

LDAP Signing en Channel Binding Afdwingen

Doel

Voorkomen van downgrade- en relay-aanvallen op LDAP-communicatie.

Context

Forceer digitale ondertekening en channel binding op Domain Controllers via GPO.

Vereisten

• Toegang tot Group Policy Management (GPMC)

Stappen

1. Maak GPO "SEC-LDAP-Hardening" en link deze aan de Domain Controllers OU.
2. Navigeer: Computer Configuration → Policies → Windows Settings → Security Settings → Local Policies → Security Options.
3. Stel in:
   • Domain controller: LDAP server signing requirements = Require signing
   • Domain controller: LDAP server channel binding token requirements = Always
4. Voer gpupdate /force uit op DC's.

Validatie

• Niet-ondertekende binds falen, LDAPS/signed binds slagen.
• Eventlogs op DC's tonen enforced settings.

Plaatsing

28. Security Hardening (na Audit/ASR).

📊 Compliance Reporting

• Stap 31.6: Automated Compliance Reports

  PowerShell script voor compliance rapportage:

  # Compliance audit script
  $complianceReport = @()
  
  # Check password policies
  $passwordPolicy = Get-ADDefaultDomainPasswordPolicy
  $complianceReport += [PSCustomObject]@{
      Check = "Password Policy"
      Status = if ($passwordPolicy.MinPasswordLength -ge 8) { "Compliant" } else { "Non-Compliant" }
      Details = "Min length: $($passwordPolicy.MinPasswordLength)"
  }
  
  # Check audit policies
  $auditPolicy = auditpol /get /category:*
  $complianceReport += [PSCustomObject]@{
      Check = "Audit Policy"
      Status = if ($auditPolicy -match "Success and Failure") { "Compliant" } else { "Non-Compliant" }
      Details = "Audit settings configured"
  }
  
  # Check service accounts
  $serviceAccounts = Get-ADUser -Filter { ServicePrincipalName -ne "$null" } -Properties *
  $complianceReport += [PSCustomObject]@{
      Check = "Service Accounts"
      Status = if ($serviceAccounts.Count -le 10) { "Compliant" } else { "Review Required" }
      Details = "$($serviceAccounts.Count) service accounts found"
  }
  
  # Generate HTML report
  $complianceReport | ConvertTo-Html -Title "Compliance Report" | Out-File "C:\Reports\Compliance-$(Get-Date -Format yyyyMMdd).html"
                       
  🌐 IPAM Installatie en Provisioning
                       
  
                           ℹ️
                           
  
                               Context: IPAM ontdekt en beheert DHCP/DNS/DHCP failover, IP‑ruimtes en audits.
                           
                       
                       
  
                           
  
                               
                               Stap 31.7: IPAM Feature Installeren
                               
  PowerShell commands:
                               
  Install-WindowsFeature IPAM -IncludeManagementTools
  
  # Provisioning via GPO in het domein
  Invoke-IpamServerProvisioning -ProvisioningMethod Gpo `
    -GpoPrefixName "IPAM" -DomainName "lab.local" -Confirm:$false
  
  # Initialiseren (optioneel overslaan van auto-config)
  Initialize-IpamServer -SkipDnsConfiguration -SkipDhcpConfiguration -SkipNpsConfiguration
                               
                           
                       
                              

🔒 Data Retention & Privacy

📊 Architectuur Diagrammen

• Stap 32.1: Logische Architectuur

  Voorbeeld Mermaid diagram voor Windows Server lab:

  graph TB
      subgraph "Physical Layer"
          H1[Host Machine
  Windows 10/11]
          H2[Physical NIC
  Ethernet/WiFi]
          S1[External Switch
  Bridged Mode]
      end
  
      subgraph "Virtual Layer"
          V1[LAB-DC01
  Domain Controller]
          V2[LAB-SRV01
  Member Server]
          V3[LAB-CLIENT01
  Domain Member]
          VS[NATSwitch
  10.0.0.0/24]
      end
  
      subgraph "Network Services"
          DNS[DNS Server
  10.0.0.1]
          DHCP[DHCP Server
  10.0.0.1]
          NAT[NAT Router
  10.0.0.1]
      end
  
      H1 --> H2
      H2 --> S1
      H1 --> VS
      VS --> V1
      VS --> V2
      VS --> V3
      V1 --> DNS
      V1 --> DHCP
      VS --> NAT
      NAT --> S1
                              

📋 Interactive Checklists

• Stap 32.2: Pre-Deployment Checklist

  🖥️ Hardware Requirements

  CPU supports virtualization (VT-x/AMD-V) Minimum 16GB RAM available 256GB+ free storage space Windows 10/11 Pro/Enterprise
• Stap 32.3: Security Hardening Checklist

  🔒 Security Configuration

  Windows Defender real-time protection enabled Firewall configured for domain/private networks Password policies configured (14+ chars) Audit policies enabled for security events Windows updates installed and current

📖 QR-Code Referenties

• Stap 32.4: Documentatie Links

  QR-codes naar relevante Microsoft documentatie:

  📚

  Windows Server Docs

  docs.microsoft.com/windows-server

  🔧

  PowerShell Docs

  docs.microsoft.com/powershell

  🛡️

  Security Center

  docs.microsoft.com/security

  ☁️

  Azure Docs

  docs.microsoft.com/azure

🔧 Troubleshooting Flowcharts

• Stap 32.5: Network Issue Flowchart

  Visuele troubleshooting guide:

  Network Troubleshooting Decision Tree:
  
  ┌─────────────────┐
  │ No Connectivity │
  └───────┬─────────┘
          │
      ┌───▼───┐
      │ Ping  │
      │ Local?│
      └─┬─────┬┘
        │     │
    ┌───▼──┐ ┌▼────┐
    │ YES  │ │ NO  │
    └──────┘ └─────┘
       │        │
  ┌────▼───┐ ┌──▼────┐
  │Check   │ │Check  │
  │IP Config│ │Gateway│
  └────┬───┘ └────┬──┘
       │          │
  ┌────▼───┐ ┌────▼───┐
  │Fix IP  │ │Fix     │
  │Config  │ │Gateway │
  └────────┘ └────────┘
                              

📈 Performance Dashboard Templates

• Stap 32.6: Grafana Dashboard Setup

  Grafana dashboard voor Windows Server monitoring:

  # Key dashboard panels:
  1. CPU Usage (%) - Gauge panel
  2. Memory Usage (GB) - Time series
  3. Disk I/O (IOPS) - Time series
  4. Network Traffic (Mbps) - Time series
  5. Active Users - Stat panel
  6. Service Status - Status panel
  7. Event Log Errors - Table panel
  8. Backup Status - Stat panel
  
  # Alert conditions:
  - CPU > 80% for 5 minutes
  - Memory > 90% for 10 minutes
  - Disk space < 10%
  - Service down for 5 minutes
                              

🏷️ Naming & IP-plan Tabel

🌐 Voorbeeld IP-plan (10.0.0.0/24)

📋 Implementatie Checklist

• Stap 33.1: Documenteer bestaande conventies

  Inventariseer huidige naamgeving in je omgeving

• Stap 33.2: Definieer nieuwe standaarden

  Maak afspraken over naamgevingsconventies

• Stap 33.3: Update documentatie

  Werk je technische documentatie bij

⚖️ Sizing & Capacity per Rol

📊 Baseline Procedure: Meet eerst, schaal daarna

• Stap 34.1: Vaststellen baseline periode

  Meet gedurende minimaal 2 weken normale operationele load

• Stap 34.2: Performance counters configureren

  Monitor CPU, RAM, Disk I/O, Network utilization

• Stap 34.3: Peak usage analyseren

  Identificeer piekperiodes en resource bottlenecks

• Stap 34.4: Capacity planning uitvoeren

  Bereken toekomstige resource behoeften gebaseerd op growth

• Stap 34.5: Scaling strategie implementeren

  Configureer auto-scaling of manual scaling procedures

📈 Monitoring Metrics

💾 Wat back-uppen per rol + hoe valideren

🔄 Backup Validatie Procedures

• Stap 35.1: Backup integrity controleren

  Verificeer backup files op corruptie en volledigheid

• Stap 35.2: Restore testen uitvoeren

  Test restore procedures in geïsoleerde omgeving

• Stap 35.3: Business continuity valideren

  Zorg dat restored systemen operationeel zijn

📋 Backup Compliance Checklist

🔀 RDS Licensing Decision Tree

RDS Licensing Mode Selection:

┌─────────────────────────────────────┐
│    Aantal unieke users vs devices?   │
└─────────────────┬───────────────────┘
                  │
        ┌─────────▼─────────┐
        │ Users > Devices?  │
        └─────────┬─────────┘
                  │
      ┌───────────▼───────────┐    ┌──────────────┐
      │ JA: Per User License │    │ NEE: Per     │
      │ - Flexibeler         │    │ Device       │
      │ - Kosten per user    │    │ License      │
      │ - Remote access      │    │ - Vast per   │
      └──────────────────────┘    │ device       │
                                  │ - Shared     │
                                  │ workstations│
                                  └──────────────┘

Criteria voor keuze:
• Per User: > 50% van users gebruikt RDS
• Per Device: Dedicated workstations/shift workers
• Mixed: Per User voor flexibility
                            

📊 Licensing Mode Vergelijking

🔍 Verificatie & Monitoring

• Stap 36.1: Licensing mode configureren

  Stel Per User of Per Device in via RD Licensing Manager

• Stap 36.2: License usage monitoren

  Gebruik RD Licensing Manager voor usage rapportage

• Stap 36.3: Compliance controleren

  Valideer dat alle RDS sessies gelicenseerd zijn

📋 RDS Licensing Checklist

🔗 Azure Arc Onboarding

• Stap 37.1: Azure Arc prerequisites controleren

  1. Controleer Windows Server versie (2012 R2 of hoger)

  2. Zorg voor internet connectiviteit naar Azure

  3. Controleer firewall instellingen voor outbound HTTPS

• Stap 37.2: Azure Arc agent installeren

  Download en installeer Azure Arc agent:

  # PowerShell installatie
  Invoke-WebRequest -Uri "https://aka.ms/AzureArcAgent" -OutFile "AzureArcAgent.msi"
  msiexec /i AzureArcAgent.msi /quiet
  
  # Of via Chocolatey
  choco install azure-arc-agent -y
                              

• Stap 37.3: Server registreren bij Azure Arc

  Registreer de server in Azure:

  # Connect to Azure Arc
  Connect-AzAccount
  $subscriptionId = "your-subscription-id"
  $resourceGroup = "your-resource-group"
  
  New-AzConnectedMachine -Name "LAB-DC01" -ResourceGroupName $resourceGroup -Location "West Europe"
                              

📊 Azure Arc Management Features

🔒 Security & Compliance

• Azure Arc security configureren

  Implementeer security best practices voor Azure Arc:

  • Gebruik managed identities voor authenticatie
  • Configureer Azure RBAC voor access control
  • Enable Azure Defender voor threat protection
  • Monitor Azure Arc agent health

🐳 Windows Containers Setup

• Stap 38.1: Container features inschakelen

  Installeer Windows container features:

  # Enable Windows containers
  Install-WindowsFeature -Name Containers
  Restart-Computer
  
  # Install Docker
  Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force
  Install-Module -Name DockerMsftProvider -Repository PSGallery -Force
  Install-Package -Name docker -ProviderName DockerMsftProvider
  Restart-Service docker
                              

• Stap 38.2: Kubernetes cluster deployen

  Gebruik kubeadm voor cluster setup:

  # Install Kubernetes tools
  Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force
  Install-Module -Name KubernetesTools -Repository PSGallery -Force
  
  # Initialize cluster
  kubeadm init --pod-network-cidr=192.168.0.0/16
  
  # Deploy network plugin (Calico)
  kubectl apply -f https://docs.projectcalico.org/manifests/calico.yaml
                              

🔧 Kubernetes op Windows Best Practices

🎮 GPU Setup voor AI/ML

• Stap 39.1: NVIDIA drivers installeren

  Installeer NVIDIA GPU drivers:

  # Download latest NVIDIA drivers
  # Install in clean boot mode
  pnputil.exe -i -a C:\NVIDIA\DisplayDriver\nv_dispi.inf
  
  # Verify installation
  nvidia-smi
                              

• Stap 39.2: CUDA Toolkit installeren

  Installeer CUDA voor GPU computing:

  # Install CUDA Toolkit
  # Download from NVIDIA developer site
  cuda_12.0.0_windows.exe -s nvcc_12.0 cudart_12.0 cufft_12.0 curand_12.0 cusolver_12.0 cusparse_12.0
  
  # Set environment variables
  $env:CUDA_PATH = "C:\Program Files\NVIDIA GPU Computing Toolkit\CUDA\v12.0"
                              

• Stap 39.3: ML frameworks configureren

  Installeer TensorFlow/PyTorch:

  # Install Python and pip
  # Install TensorFlow with GPU support
  pip install tensorflow[and-cuda]
  
  # Install PyTorch
  pip install torch torchvision torchaudio --index-url https://download.pytorch.org/whl/cu121
                              

⚡ Performance Optimization

📱 Microsoft Intune Setup

• Stap 40.1: Intune tenant configureren

  1. Ga naar Microsoft Endpoint Manager admin center

  2. Configureer device enrollment restrictions

  3. Stel device compliance policies in

• Stap 40.2: Autopilot deployment configureren

  Configureer Windows Autopilot:

  # Import Autopilot devices via CSV
  # CSV format: Device Serial Number,Windows Product ID,Hardware Hash,Manufacturer,Model
  
  # Via PowerShell
  Install-Module -Name WindowsAutoPilotIntune -Force
  Connect-MSGraph
  Import-AutoPilotCSV -csvFilePath "C:\AutopilotDevices.csv"
                              

• Stap 40.3: Configuration profiles toepassen

  Deploy device configuration profiles:

  • Device restrictions
  • Endpoint protection settings
  • Wi-Fi en VPN configuraties
  • Application deployment

🔐 Security Management