Server Manager automatically creates server groups based on the roles of managed servers. When you select a role-based group in the left pane, the Servers panel shows the managed servers that have this role. As shown in Figure 6-1, the details for the selected server group provide the following information for all servers in the group:

You can refresh the server details manually by tapping or clicking the Refresh Servers button on the toolbar. Otherwise, Server Manager refreshes the details periodically for you. If you want to set a different default refresh interval, tap or click Manage and then tap or click Server Manager Properties. Next, set the new refresh interval in minutes and then tap or click OK.

Figure 6-1. View the status details for installed roles.

When you select All Servers in Server Manager, the Roles And Features pane provides details on the current roles and features that are installed on all managed servers. As you set out to add roles to a server, keep in mind that some roles cannot be added at the same time as other roles, and you have to install each role separately. Other roles cannot be combined with existing roles, and you’ll see warning prompts about this.

Adding server roles and features

You can add a server role or feature by following these steps:

1. In Server Manager, select Add Roles And Features on the Manage menu. This starts the Add Roles And Features Wizard.

   Note

   If the wizard displays the Before You Begin page, read the introductory text and then tap or click Next. You can avoid seeing the Before You Begin page the next time you start this wizard by selecting the Skip This Page By Default check box before tapping or clicking Next.

2. On the Select Installation Type page, Role-Based Or Feature-Based Installation is selected by default. Tap or click Next.

3. On the Select Destination Server page, shown in Figure 6-2, you can choose to install roles and features on running servers or virtual hard disks. Only servers that are running Windows Server 2012 or later and that have been added for management are listed. Either select a server from the server pool or select a server from the server pool on which to mount a virtual hard disk (VHD). If you are adding roles and features to a VHD, tap or click Browse and then use the Browse For Virtual Hard Disks dialog box to locate the VHD. When you are ready to continue, tap or click Next.

   

   Figure 6-2. Select the server or virtual hard disk to use for the installation.

4. On the Select Server Roles page, shown in Figure 6-3, select the role or roles to install. Some roles cannot be added at the same time as other roles. You have to install each role separately. Other roles cannot be combined with existing roles, and you’ll see warning prompts about this. A server running a Server Core installation can act as a domain controller and hold any of the flexible single-master operations (FSMOs) roles for Active Directory.

   

   Figure 6-3. Select the roles to install.

5. If additional features are required to install a role, you see an additional dialog box. Tap or click Add Features to close the dialog box and add the required features to the server installation. Tap or click Next to continue.

6. With some roles, you see an extra wizard page, which provides additional information about using and configuring the role. You might also have the opportunity to install additional role services as part of a role. Read the information page and select additional role services to install as appropriate.

7. On the Select Features page, select the feature or features to install. If additional features are required to install a feature you selected, you see an additional dialog box. Tap or click Add Features to close the dialog box and add the required features to the server installation. When you are ready to continue, tap or click Next.

8. On the Confirm Installation Selections page, tap or click the Export Configuration Settings link to generate an installation report that can be displayed in Internet Explorer.

   TROUBLESHOOTING: Accessing binary source files

   Access to binary source files is required to install server roles, role services, and features successfully. If the server on which you want to install roles or features doesn’t have all the required binary source files, the server gets the files from Windows Update by default or from a location specified in Group Policy.

   You also can specify an alternate path for the source files. To do this, click the Specify An Alternate Source Path link, type that alternate path in the box provided, and then tap or click OK. If you mount a Windows image and make it available on the local server, you can enter the alternate path as c:mountdirwindowswinsxs. For network shares, enter the UNC path to the share, such as \CorpServer36WS12. For mounted Windows images, enter the WIM path prefixed with WIM: and include the index of the image to use, such as WIM:\CorpServer36WS12install.wim:4.

   For information on managing binary source files, see “Managing server binaries” later in this chapter.

9. Restarting the destination server might be required to complete the installation of some roles and features. To restart the destination server automatically if required, select the related check box. If you do not select this check box and a restart is required, you will need to restart the server manually to complete the installation.

10. After you review the installation options and save them as necessary, tap or click Install to begin the installation process. The Installation Progress page tracks the progress of the installation. If you close the wizard, tap or click the Notifications icon in Server Manager and then tap or click the link provided to reopen the wizard.

11. When Setup finishes installing the server with the roles and features you selected, the Installation Progress page will be updated to reflect this. Review the installation details to ensure that all phases of the installation were completed successfully. If any portion of the installation failed, note the reason for the failure. Review the Server Manager entries for installation problems and take corrective actions as appropriate.

Inside OUT: Completing additional installation tasks

Any additional actions that might be required to complete the installation are listed when Setup finishes installing the roles and features you selected. Typically, you have a link you can click to begin these additional tasks. For example, installing a domain controller is a multipart process that begins with installing the components required for the role. After this, you must promote the server and configure directory services—all of which can be done in Server Manager.

If you close the Add Roles And Features Wizard, tap or click the Notifications icon in Server Manager to display a list of recent notifications, as shown in the graphic that follows:

In this example, there are several important notifications:

• The first notification tells you that the automatic refresh of server information failed. This can happen for several reasons, with the most common reason being that one or more of the servers added for management is offline or otherwise inaccessible.

• The second notification tells you that CorpServer64 must be restarted to complete the installation of an added feature. You also could confirm that a restart was required by selecting the All Servers node in Server Manager, where you’d see a status of Online - Restart Pending For CorpServer64 (as long as the server was online and accessible). Finally, tapping or clicking the Add Roles And Features link opens the Add Roles And Features Wizard, where you’d see the Installation Progress page and could note exactly what had been installed to require the restart.

• The third notification tells you that CorpServer64 has a post-deployment configuration task that needs to be performed for DHCP. Tapping or clicking Complete DHCP Configuration opens the DHCP Post-Install Configuration Wizard.

Binaries needed to install roles and features are referred to as payloads. With Windows Server 2012 R2, payloads normally are stored in subfolders of the Windows Side-by-Side folder (%SystemDrive%WindowsWinSXS). However, to enhance security, you can disable roles and features and remove the payload used to install these roles and features. When you remove a payload, servers try to get the required binary files from Windows Update by default. In Group Policy, you can configure an alternative to Windows Update by specifying an alternative download location.

If you want to remove binaries, you use Windows PowerShell to do this and not Server Manager. The ServerManager module for Windows PowerShell is the command-line counterpart of Server Manager.

import-module servermanager

import-module servermanager

The Get-WindowsFeature cmdlet returns a detailed list of a server’s current state with regard to roles, role services, and features. When you type get-windowsfeature at a Windows PowerShell prompt, you see the state of each role, role service, and feature listed as one of the following:

As shown in the partial listing that follows, each role, role service, or feature is listed by display name and then by its management naming component:

[ ] Active Directory Certificate Services         AD-Certificate           Removed
    [ ] Certification Authority                   ADCS-Cert-Authority      Removed
    [ ] Certificate Enrollment Policy Web Serv... ADCS-Enroll-Web-Pol      Removed
    [ ] Certificate Enrollment Web Service        ADCS-Enroll-Web-Svc      Removed
    [ ] Certification Authority Web Enrollment    ADCS-Web-Enrollment      Removed
    [ ] Network Device Enrollment Service         ADCS-Device-Enrollment   Removed
    [ ] Online Responder                          ADCS-Online-Cert         Removed
[X] Active Directory Domain Services          AD-Domain-Services           Installed
[ ] Active Directory Federation Services      AD-Federation-Services       Available
  [ ] Federation Service                      ADFS-Federation              Available
  [ ] AD FS 1.1 Web Agents                    ADFS-Web-Agents              Available
    [ ] AD FS 1.1 Claims-aware Agent          ADFS-Claims                  Available
    [ ] AD FS 1.1 Windows Token-based Agent   ADFS-Windows-Token           Available
  [ ] Federation Service Proxy                ADFS-Proxy                   Available
[X] Active Directory Rights Management Se...  ADRMS                        Installed

By using Install-WindowsFeature followed by the management name, you can install a role, role service, or feature and get its binaries if necessary. Use –includeallsubfeature when adding components to add all subordinate components. Use –includemanagementtools when adding components to add the related management tools.

You can uninstall a role, role service, or feature by using Uninstall-WindowsFeature. If you specify a top-level role with role service and feature subcomponents, the subcomponents are also uninstalled.

To uninstall a role, role service, or feature and then remove the related binaries from the Windows Side-By-Side folder, you use the –Remove parameter with Uninstall-WindowsFeature. If you specify a top-level role with role service and feature subcomponents, the binaries for the subcomponents are also removed.

Use –includemanagementtools when removing components to remove the related management tools.

In the previous example, Active Directory Certificate Services and its subcomponents were removed. Knowing this, you could retrieve the binaries for the role, subordinate role services, and features and then install these components and the related management tools by entering the following command:

install-windowsfeature ad-certificate –includeallsubfeature -includemanagementtools

Because adding or removing components requires administrator privileges, you must run this command at an elevated Windows PowerShell prompt.

By default, when you use Install-WindowsFeature, payloads are restored through Windows Update. You can use the –Source parameter to restore a payload from a Windows Imaging (WIM) mount point. For example, if an image for Windows Server 2012 R2 is available at the network path \ImageServer32WinServer12R2EE, you could specify the source as follows:

install-windowsfeature -name ad-certificate -includeallsubfeature
-source \imageserver18winserver12r2ee

The path you specify is used only if the required binaries are not found in the Windows Side-By-Side folder on the destination server. You also can mount the Windows Server 2012 R2 distribution media and use the WindowsWinSXS folder from the installation image as your source. To do this, follow these steps:

You can use Group Policy to control whether Windows Update is used to restore payloads and to provide alternate source paths for restoring payloads. The policy you want to work with is Specify Settings For Optional Component Installation And Component Repair, which is under Computer ConfigurationAdministrative TemplatesSystem. This policy also is used for obtaining payloads needed to repair components.

If you enable Specify Settings For Optional Component Installation And Component Repair (as shown in Figure 6-5), you can do the following:

Figure 6-5. Configure component installation and repair through Group Policy.

You manage roles, role services, and features by using the following cmdlets, which are part of the ServerManager module:

When applicable, you can do the following:

Installable roles, role services, and features have a corresponding component name that identifies the component so that you can manipulate it from the Windows PowerShell prompt. This also is true for supplemental components you’ve made available by downloading and installing their installer packages from the Microsoft website. You specify the list of components to install using the –Name parameter. This parameter matches actual component names and not display names. With Get-WindowsFeature, you can use wildcard characters. With Install-WindowsFeature and Uninstall-WindowsFeature, you cannot use wildcards but can use pipelining to get the required input names from another command, such as Get-WindowsFeature.

Every installable role, role service, and feature has a component name. This name identifies the component so that it can be manipulated from the prompt. Remember, supplemental components are made available by downloading and installing their installer packages from the Microsoft website.

Table 6-3 provides a hierarchical listing of the component names associated with roles, related role services, and related subcomponents. When you are installing a role, you can use the –IncludeAllSubFeature parameter to install all the subordinate role services and features listed under the role and the –IncludeManagementTools parameter to install the related management tools.

Table 6-4 provides a hierarchical listing of the component names associated with features and related subfeatures. When you are installing a feature, you can use the –IncludeAllSubFeature parameter to install all the subordinate second-level and third-level features listed under the feature and the –IncludeManagementTools parameter to install the related management tools.

You can install roles, role services, and features by typing Install-WindowsFeature ComponentName at an elevated prompt, where ComponentName is the management name of the component to install as listed in Table 6-3 or Table 6-4. In the following example, you install DHCP Server and the DHCP console for managing DHCP Server on CorpServer15:

Install-windowsfeature dhcp –ComputerName corpserver15 –includemanagementtools

Here, you don’t need to include the –IncludeAllSubFeature parameter because DHCP Server doesn’t have any subordinate role services or features. As Windows PowerShell works, you see a Start Installation progress bar. When the installation is complete, you see the result. The output for a successful installation should look similar to the following:

Success Restart Needed Exit Code      Feature Result
------- -------------- ---------      --------------
True    No             Success        {DHCP Server}

As you can see, the output specifies an exit code, a list of the exact change or changes made, whether the installation was successful, and whether a restart is needed. The exit code can be different from the Success status. For example, if the components you specify are already installed, the exit code is NoChangeNeeded, as shown in this sample output:

Success Restart Needed Exit Code             Feature Result
------- -------------- ---------             --------------
True    No             NoChangeNeeded        {}

Here, you see that Install-WindowsFeature was successful but didn’t actually make any changes. The Feature Result also shows no changes.

You don’t have to name the component or components explicitly that you want to install. Install-WindowsFeature accepts redirected output for component names, enabling you to use another command to get the name or names of the components you want to work with. For example, if you want to install multiple components, such as all .NET components across the multiple .NET frameworks that are available, you could use Get-WindowsFeature to help you do this, as shown in the following example:

get-windowsfeature -name NET-* | install-windowsfeature

Here, you use Get-WindowsFeature to obtain a list of components with names that start with NET– and then pipe that list to Install-WindowsFeature. The result is that you install all .NET components across all available .NET frameworks.

Component installation doesn’t always succeed, and that’s a common reason that the server cannot be accessed, as shown in this example with accompanying error text:

Success Restart Needed Exit Code      Feature Result
------- -------------- ---------      --------------
False   Maybe          Failed         {}
install-windowsfeature : WinRM cannot process the request. The following error
occurred while using Kerberos authentication: Cannot find the computer
corpserver15. Verify that the computer exists on the network and that the
name provided is spelled correctly.

Here, Windows Remote Management (WinRM) couldn’t connect to the remote computer. Typically, this occurs because the server is offline or otherwise unavailable. This also could occur if you entered an incorrect server name.

Inadequate user rights is another common reason for component installation to fail, as shown in this example, with accompanying error text:

install-windowsfeature : You do not have adequate user rights to make changes to
the target computer. If you are already a member of the Administrators group on
the target computer, the changes might have failed because of security restrictions
imposed by User Account Control. Try running Install-WindowsFeature in a Windows
PowerShell session that has been opened with elevated rights (Run as administrator).
Success Restart Needed Exit Code      Feature Result
------- -------------- ---------      --------------
False   No             Failed         {}

Normally, when you are using Windows PowerShell for administration, you use an elevated, administrator prompt, and your current credentials pass through to remote computers you work with. However, if your account doesn’t have appropriate user rights, you need to provide different credentials; you can do this by using the –Credential parameter. You’ll be prompted for the user’s password if you follow the –Credential parameter with a user name, as shown in this example:

Install-windowsfeature dns -credential "CPANDLwrstanek" –includemanagementtools

Here, you just type the password and press Enter when prompted to run the command with the named account’s permissions. Rather than entering credentials for an account each time you want to perform administration, you can store credentials and then refer to the stored credential, as shown in this example:

$cred = get-credential
install-windowsfeature dns -credential $cred –includemanagementtools

Here, you use Get-Credential to prompt for a user name and password and then store those credentials in the $cred variable. Next, you refer to the stored credentials to install DNS. Because the credentials are stored for the duration of your current Windows PowerShell session, you can refer to them as needed for additional administration.

To test the installation prior to performing that actual operation, you can use the –Whatif parameter, as shown in the following example:

get-windowsfeature -name BIT* | install-windowsfeature -whatif

If you run this command, you might be surprised to see that BitLocker components are included along with BITS components. To resolve this, you need to be more specific when specifying the component name to match. If you intend to install BitLocker and BitLocker Network Unlock, you can use the following command instead:

get-windowsfeature -name bitlock* | install-windowsfeature -whatif

If a restart is required to complete an installation, you can have Install-WindowsFeature restart the computer by including the –Restart parameter. For planning purposes, especially on highly active production servers, keep in mind that both successful and failed installations could require a restart.

You can uninstall roles, role services, and features by typing Uninstall-ServerManager ComponentName at an elevated command prompt, where ComponentName is the name of the component to uninstall as listed in Table 6-3 or Table 6-4. Because Uninstall-ServerManager automatically uninstalls any subordinate role services and features of the specified component, you normally want to test the uninstallation prior to performing that actual operation. To do this, you can use the –Whatif parameter, as shown in the following example:

uninstall-windowsfeature net-framework-45-features -whatif

Here, you want to uninstall .NET Framework 4.5 and related features, which include .NET Framework 4.5 (NET-Framework-45-Core), ASP.NET 4.5 (NET-Framework-45-ASPNET), and multiple subcomponents of WCF Services (NET-WCF-Services45). However, if you want to uninstall only the WCF Services, you enter the following instead:

uninstall-windowsfeature net-wcf-services45

As with Install-WindowsFeature, you don’t have to name the component or components explicitly that you want to uninstall. Uninstall-WindowsFeature accepts redirected output for component names, enabling you to use another command to get the name or names of the components you want to work with. For example, if you want to uninstall multiple components, such as all .NET components across the multiple .NET frameworks that are available, you could use Get-WindowsFeature to help you do this, as shown in the following example:

get-windowsfeature -name NET-* | uninstall-windowsfeature

To ensure that the command works exactly as expected, you should test the command first by using the –Whatif parameter, as shown in the following example:

get-windowsfeature -name NET-* | uninstall-windowsfeature -whatif

As with installing components, the command output specifies whether a restart is required to complete the task. If a restart is required to complete a removal, you can have Uninstall-WindowsFeature restart the computer by including the –Restart parameter.

If an error occurs, and Uninstall-WindowsFeature cannot perform the specified operation, you see an error. Tips and techniques for resolving common errors are discussed in the previous section, Installing components at the prompt.