Unless you've standardized on a particular hardware platform, most servers that you'll work with will have different hardware components. This means different servers will probably have different motherboards, disk controllers, graphics cards, and network adapters. Fortunately, Microsoft Windows Server 2003 is designed to work with an extensive list of hardware devices. When you install new hardware, Windows tries to detect the device automatically and then install the correct driver software so that you can use the device. If Windows has a problem with a device, you must troubleshoot the installation, which usually means finding the correct device drivers for the hardware component and installing them.
One thing to keep in mind when working with devices is that, like other software, driver software can contain bugs. These bugs can cause a variety of problems on your servers, and not only could the hardware stop working, but the server could freeze as well. Because of this, you'll want to monitor routinely for hardware problems and take corrective actions as necessary. It is also helpful to maintain a hardware inventory for servers so that you know which devices are installed and who the manufacturers are.
Every hardware component installed on a system has an associated device driver. Drivers are used to handle the low-level communications tasks between the operating system and hardware components. When you install a hardware component through the operating system, you tell the operating system about the device driver it uses. From then on, the device driver loads automatically and runs as part of the operating system.
Windows Server 2003 includes an extensive library of device drivers for display adapters, disk drives, drive controllers, keyboards, mice and other pointing devices, network adapters, and more. These drivers are maintained in a compressed file called Driver.cab. For i386 systems, this file is located in the %SystemRoot%Driver CacheI386 folder. For Intel Architecture 64 (IA-64) systems, this file is located in the %SystemRoot%Driver CacheIA64 folder.
All the drivers in the Driver.cab file are certified to be fully compatible with Windows Server 2003 and are digitally signed by Microsoft to assure you of their authenticity. When you install a new Plug and Play–compatible device, Windows checks this file for a compatible device driver. If one is found, the operating system automatically installs the device. Through Windows Update, Microsoft makes updates to the Driver.cab device drivers available for download and installation.
Inside Out: Installing new drivers
All device drivers provided through Windows Update have been thoroughly tested in the Windows Hardware Quality Labs (WHQL), and you should be able to count on them not to cause your system to crash or become unstable. However, just because driver updates are available doesn't mean you should install them. In a production environment, you'll rarely want to download and install new device drivers without thoroughly testing them yourself first. Better safe than sorry—always. Typically, you install new device drivers because you are experiencing problems with the old drivers. If you aren't experiencing problems, you might not want to update the drivers.
Every hardware driver has an associated Setup Information file. This file ends with the .inf extension and is a text file containing detailed information about the device being installed. The .inf file includes the names of driver files, the location where they are to be installed, version information, Registry settings, and other important configuration information. All devices with drivers included in the Driver.cab file have corresponding .inf files. These files are stored in the %SystemRoot%Inf folder. When you install a new device driver, the driver is written to %SystemRoot%System32Drivers and configuration settings are stored in the Registry. The driver's .inf file is used to control the installation and write the Registry settings. If the driver doesn't already exist in the Driver.cab file (and thus does not already have an .inf file on the system), a copy of the driver's .inf file is written to the %SystemRoot%Inf folder.
Speaking of new device drivers, Microsoft recommends that you use signed device drivers whenever possible. Signed device drivers have a digital signature that authenticates them as having passed extensive testing by the WHQL. The digital signature means that you can count on the device driver not to cause your system to crash or become unstable, and also that the device driver hasn't been tampered with by other installation programs or by a virus program.
The assurances you get with digitally signed drivers aren't applicable to unsigned device drivers. When you install an unsigned driver, there is no guarantee that it has been tested, and if the driver is poorly written, it is much more likely to cause the operating system to freeze or the server to crash than any other program you've installed. That said, there are times when you might have to use an unsigned device driver. In some situations, you might find that a particular device doesn't have a signed device driver. Here, you should check the manufacturer's Web site to see whether a signed driver is available because sometimes there is a signed driver, but it's just not distributed with the device or on the Windows Server 2003 distribution disks. If a signed driver isn't available, you might find that you have to use an unsigned driver. Keep in mind that Group Policy might prevent you from installing an unsigned driver. See the sidebar "Managing Device Driver Settings Through Group Policy" later in this chapter for details.
Note
If you have to install an unsigned driver, proceed cautiously and remember to monitor the system closely. If you find that the system is inexplicably freezing or crashing, the unsigned driver is probably to blame and should be rolled back or uninstalled. Remember, any type of faulty driver can cause the system to fail, even a driver for a display adapter, a network adapter, or a sound card.
By default, Windows Server 2003 warns you when you try to install an unsigned device driver. If you don't want to see this prompt, you can change the driver-signing options to eliminate this warning, and you can also prevent any users from trying to install unsigned drivers.
You can change driver settings by following these steps:
Start the System utility. In the Hardware tab, click Driver Signing.
In the Driver Signing Options dialog box, choose the action you want the Windows operating system to take whenever someone tries to install an unsigned device driver. The options are as follows:
Ignore—This option allows the user to install any unsigned driver without having to see and respond to a warning prompt.
Warn—This option prompts the user each time either to continue with the installation of an unsigned driver or to stop the installation.
Block—This options prevents the user from installing unsigned driver software. Windows Server 2003 will not install any unsigned device driver and will not display a warning prompt.
To apply these options to only the current user, clear the Make This Action The System Default option. Otherwise, select this option to make this the default for all users.
Click OK twice to apply the changes. Note that changes to driver installation made this way can be overridden by Group Policy settings at the site, domain, or organizational unit (OU) level.
Regardless of the settings you choose, Windows Server 2003 will not install drivers with known problems. If you try to install a driver with known issues that could potentially harm the server, the Windows Driver Protection facility will block the installation. A warning is displayed that states the driver is known to cause stability problems and that the Windows operating system will disable it to prevent this from happening. To complete the installation of the device, you must obtain an updated driver.
Inside Out: Managing device driver settings through Group Policy
You can manage device driver settings for computers throughout the organization by using Group Policy. When you do this, Group Policy specifies the least secure setting that is allowed. The exception is when Group Policy is set to Block. When you use this setting, unsigned device drivers can't be installed without overriding Group Policy. The Code Signing For Device Drivers policy controls device driver–signing settings on a per-user basis. This policy is located in User ConfigurationAdministrative TemplatesSystem. Once you enable this policy, you can specify the action to take: Ignore, Warn, or Block. Once enabled, the system doesn't implement any setting less secure than the established setting.
If you're trying to install a device and find that you can't install an unsigned driver, you should first check the System utility settings for driver signing. If you find that the settings are set to Block and you can't change the setting, the Code Signing For Device Drivers policy has been enabled and set to Block in Group Policy. You must override Group Policy to install the unsigned device driver.