windows-server – DevOps & Infrastructure skill for AI agents

Windows Server Administration

Windows Server management and PowerShell automation for production workloads including IIS web hosting, Active Directory domain services, and system maintenance.

When to Use

• Provisioning or configuring Windows Server 2019/2022 instances
• Setting up IIS websites, application pools, and bindings
• Managing Active Directory users, groups, and Group Policy
• Automating administrative tasks with PowerShell
• Reviewing Windows Event Logs for troubleshooting
• Applying and managing Windows Updates on servers

Confirm the exact server, domain, roles, maintenance window, backups and rollback before changes. Forest promotion, DNS changes, updates/reboots, group membership and SYSTEM tasks are separate privileged operations. Protect exported logs; do not clear incident evidence. ServerManager, IIS and AD module availability differs between Windows PowerShell and PowerShell 7; use a supported host for each module.

Prerequisites

• Administrator account on the target server
• PowerShell 5.1+ (built-in) or PowerShell 7+ installed
• Remote Desktop or WinRM access configured
• Windows Server 2019 or 2022 (Desktop Experience or Server Core)

PowerShell Administration Essentials

# Check PowerShell version
$PSVersionTable.PSVersion

# Get system information
Get-ComputerInfo | Select-Object CsName, OsName, OsVersion, OsArchitecture

# List running processes sorted by CPU
Get-Process | Sort-Object CPU -Descending | Select-Object -First 20

# List all services and their status
Get-Service | Where-Object { $_.Status -eq 'Running' }

# Restart a service
Restart-Service -Name W3SVC -Force

# Get disk space on all drives
Get-PSDrive -PSProvider FileSystem | Select-Object Name, @{N='Used(GB)';E={[math]::Round($_.Used/1GB,2)}}, @{N='Free(GB)';E={[math]::Round($_.Free/1GB,2)}}

# Check uptime
(Get-Date) - (Get-CimInstance Win32_OperatingSystem).LastBootUpTime

# Open firewall port
New-NetFirewallRule -DisplayName "Allow HTTPS" -Direction Inbound -Protocol TCP -LocalPort 443 -Action Allow

# List firewall rules
Get-NetFirewallRule | Where-Object { $_.Enabled -eq 'True' -and $_.Direction -eq 'Inbound' } | Select-Object DisplayName, Action

# Set DNS client server addresses
Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses ("10.0.0.2","10.0.0.3")

# PowerShell remoting to another server
Enter-PSSession -ComputerName server02 -Credential (Get-Credential)

# Run a command on multiple remote servers
Invoke-Command -ComputerName server01,server02,server03 -ScriptBlock { Get-Service W3SVC }

Server Roles and Features

# List all available roles and features
Get-WindowsFeature

# Install IIS with management tools
Install-WindowsFeature -Name Web-Server -IncludeManagementTools

# Install Active Directory Domain Services
Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools

# Install DNS Server
Install-WindowsFeature -Name DNS -IncludeManagementTools

# Install DHCP Server
Install-WindowsFeature -Name DHCP -IncludeManagementTools

# Install File Server with deduplication
Install-WindowsFeature -Name FS-FileServer, FS-Data-Deduplication

# List installed features only
Get-WindowsFeature | Where-Object Installed | Select-Object Name, InstallState

# Remove a feature
Uninstall-WindowsFeature -Name Telnet-Client

IIS Web Server Setup

# Import the IIS administration module
Import-Module WebAdministration

# Create a new application pool
New-WebAppPool -Name "ProductionPool"
Set-ItemProperty IIS:\AppPools\ProductionPool -Name processModel.identityType -Value 4  # ApplicationPoolIdentity
Set-ItemProperty IIS:\AppPools\ProductionPool -Name managedRuntimeVersion -Value ""     # No managed code (reverse proxy)

# Create a new website
New-Website -Name "MyApp" `
  -Port 443 `
  -Ssl `
  -HostHeader "www.example.com" `
  -PhysicalPath "C:\inetpub\myapp" `
  -ApplicationPool "ProductionPool" `
  -SslFlags 1

# Add an HTTP binding (does not redirect until a redirect rule is installed)
New-WebBinding -Name "MyApp" -Protocol http -Port 80

# Bind an SSL certificate to the HTTPS site
$cert = Get-Item "Cert:\LocalMachine\My\<verified-certificate-thumbprint>"
New-Item IIS:\SslBindings\0.0.0.0!443!www.example.com -Value $cert -SSLFlags 1

# Create a virtual directory
New-WebVirtualDirectory -Site "MyApp" -Name "static" -PhysicalPath "C:\inetpub\static"

# Start, stop, and restart a site
Start-Website -Name "MyApp"
Stop-Website  -Name "MyApp"
Restart-WebAppPool -Name "ProductionPool"

# List all websites and their state
Get-Website | Select-Object Name, State, PhysicalPath, @{N='Bindings';E={$_.Bindings.Collection.bindingInformation}}

# Enable IIS logging with W3C format
Set-WebConfigurationProperty -PSPath "IIS:\Sites\MyApp" `
  -Filter "system.webServer/httpLogging" `
  -Name "dontLog" -Value $false

# URL Rewrite: redirect HTTP to HTTPS (requires URL Rewrite module)
# web.config rule:
@'
<rule name="HTTP to HTTPS" stopProcessing="true">
  <match url="(.*)" />
  <conditions>
    <add input="{HTTPS}" pattern="off" />
  </conditions>
  <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="Permanent" />
</rule>
'@

Active Directory Basics

# Promote server to a new domain controller in a new forest
Install-ADDSForest `
  -DomainName "corp.example.com" `
  -DomainNetBIOSName "CORP" `
  -InstallDns:$true `
  -SafeModeAdministratorPassword (Read-Host "DSRM recovery password" -AsSecureString) `
  -Force:$true

# Create an Organizational Unit
New-ADOrganizationalUnit -Name "Engineering" -Path "DC=corp,DC=example,DC=com"

# Create a new AD user
New-ADUser -Name "Jane Smith" `
  -SamAccountName "jsmith" `
  -UserPrincipalName "[email protected]" `
  -Path "OU=Engineering,DC=corp,DC=example,DC=com" `
  -AccountPassword (Read-Host "Initial user password" -AsSecureString) `
  -Enabled $true `
  -ChangePasswordAtLogon $true

# Add user to an existing, approved ordinary group
Add-ADGroupMember -Identity "Engineering" -Members "jsmith"

# Search for users in an OU
Get-ADUser -Filter * -SearchBase "OU=Engineering,DC=corp,DC=example,DC=com" | Select-Object Name, SamAccountName, Enabled

# Disable a user account
Disable-ADAccount -Identity "jsmith"

# Unlock a locked-out account
Unlock-ADAccount -Identity "jsmith"

# Reset a user password
Set-ADAccountPassword -Identity "jsmith" -Reset -NewPassword (Read-Host "New user password" -AsSecureString)

# List all domain controllers
Get-ADDomainController -Filter * | Select-Object Name, IPv4Address, Site

# Check AD replication status
Get-ADReplicationPartnerMetadata -Target "dc01.corp.example.com"
repadmin /replsummary

Windows Update Management

# Install the PSWindowsUpdate module (from PowerShell Gallery)
Install-Module -Name PSWindowsUpdate -Force

# Check for available updates
Get-WindowsUpdate

# Install all available updates (auto-reboot if needed)
Install-WindowsUpdate -AcceptAll -AutoReboot

# Install only critical and security updates
Install-WindowsUpdate -Category "Security Updates","Critical Updates" -AcceptAll

# View update history
Get-WUHistory | Select-Object -First 20 Title, Date, Result

# Schedule weekly patching in an approved maintenance window
$action  = New-ScheduledTaskAction -Execute "powershell.exe" `
  -Argument "-NoProfile -Command Install-WindowsUpdate -AcceptAll -AutoReboot"
$trigger = New-ScheduledTaskTrigger -Weekly -DaysOfWeek Sunday -At 2am
Register-ScheduledTask -TaskName "WeeklyPatching" -Action $action -Trigger $trigger -User "SYSTEM" -RunLevel Highest

# WSUS configuration via Group Policy (registry keys)
# HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
# WUServer = http://wsus.corp.example.com:8530
# WUStatusServer = http://wsus.corp.example.com:8530

Event Log Analysis

# View the 50 most recent System log errors
Get-EventLog -LogName System -EntryType Error -Newest 50

# Search for specific event IDs (e.g., unexpected shutdowns = 6008)
Get-EventLog -LogName System -InstanceId 6008

# Use Get-WinEvent for advanced filtering (newer cmdlet)
Get-WinEvent -FilterHashtable @{
    LogName   = 'Application'
    Level     = 2   # Error
    StartTime = (Get-Date).AddDays(-1)
} | Select-Object TimeCreated, Id, Message -First 20

# Search Security log for failed logons (Event ID 4625)
Get-WinEvent -FilterHashtable @{
    LogName = 'Security'
    Id      = 4625
} | Select-Object TimeCreated, @{N='Account';E={$_.Properties[5].Value}}, @{N='Source';E={$_.Properties[19].Value}} -First 30

# Export events to CSV for analysis
Get-WinEvent -FilterHashtable @{ LogName='System'; Level=1,2 } |
  Export-Csv -Path C:\Logs\system-errors.csv -NoTypeInformation

# Clearing logs destroys evidence; export and verify retention approval first.
# Clear-EventLog -LogName Application

# Set maximum log size
Limit-EventLog -LogName Application -MaximumSize 512MB -OverflowAction OverwriteAsNeeded

Scheduled Task

… (full content is in the download package)