Windows Server
Your JD lists "Install, configure, and maintain Windows/Linux servers", "Monitor server health, backups, and performance", "Perform patching, upgrades, and system hardening".
Server roles vs features
A role is the software that delivers a service. A feature is a supporting part of the OS.
Get-WindowsFeature | Where-Object {$_.InstallState -eq 'Available'}
Install-WindowsFeature AD-Domain-Services, DHCP -IncludeManagementTools
Install-WindowsFeature AD-Domain-Services -IncludeManagementTools
Install-WindowsFeature RSAT-AD-Tools -IncludeAllSubFeature
| Role | What it is for |
|---|---|
| Active Directory Domain Services | The core — identities and policy |
| DNS Server | Name resolution for the domain |
| DHCP Server | Automatic IP assignment |
| File and Storage Services | Shares, quotas, ReFS, deduplication |
| Print Server | Central printer queues and drivers |
| Web Server (IIS) | Sites, APIs |
| Hyper-V | Virtualisation |
| Remote Desktop Services | Session hosts |
| Failover Clustering | High availability |
Promoting a domain controller installs DNS automatically. Installing the AD DS feature on an already-promoted DC does nothing, and doing it wrongly leaves you with a broken domain. Know which command you are running.
Monitoring server health
# Disk — the most common cause of server slowness
Get-PhysicalDisk | Select-Object FriendlyName, HealthStatus
Get-Volume | Select-Object DriveLetter,
@{n='FreeGB';e={[math]::Round($_.SizeRemaining/1GB,1)}},
@{n='SizeGB';e={[math]::Round($_.Size/1GB,1)}}
# Services
Get-Service | Where-Object {$_.Status -ne 'Running'} |
Select-Object Name, Status, StartType
# Patch level
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10
# DNS service health on a DC
Test-NetConfiguration -ComputerName dc01.corp.local
| Signal | Threshold |
|---|---|
| Free disk under 15% | Predictable failure. Free space first, always. |
| Disk queue length sustained > 2 | Storage is the bottleneck |
| CPU sustained > 80% | Investigate the process |
| Event 51 / ID 7 | Failing disk |
| Pagefile on the data volume | Degrades everything |
When you join a new server to an existing fleet, check free disk space and patch level before anything else. It is what an experienced engineer does first and it impresses immediately.
Patching
# Windows Update via command line
UsoClient StartScan
UsoClient StartDownload
UsoClient StartInstall
# What is pending
Get-WindowsUpdateLog # writes to the desktop as WindowsUpdate.log
At scale you will meet WSUS (Microsoft's patch server) or Intune / Configuration Manager (Microsoft Endpoint Configuration Manager), which download, test and stage patches before rolling them out.
Production environments use rings: test → pilot → production, with a reboot window. Never force a reboot of a production server during business hours — coordinate it.
Hardening
Windows Server ships insecure by design so it can be configured many ways. Hardening closes that.
| Control | Action |
|---|---|
| SMB signing | Required by default since Windows 2016 — leave it on |
| SMBv1 | Disable. It is the most exploited Windows protocol in history. |
| LSA protection | Run as administrator → LSA protection |
| Credential Guard | Virtualises LSASS on supported hardware |
| RDP | Require Network Level Authentication |
| BitLocker | Encrypt data volumes |
| TLS | Disable SSL 3.0 and TLS 1.0/1.1 |
| Local admin | Use a managed admin tier, not a shared domain admin account |
| Firewall | Enable the Windows Firewall on every profile |
# Disable SMBv1
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol
# Check the state of the important ones
Get-SmbServerConfiguration | Select-Object EnableSMB1Protocol,
EnableSMB2Protocol, EnableSecuritySignature
# Firewall profiles
Get-NetFirewallProfile | Select-Object Name, Enabled
"I would not use a Domain Admin account for day-to-day work. Day-to-day accounts belong to a tiered delegated group; Domain Admin is reserved for the handful of tasks that genuinely require it, such as joining a DC or installing a new forest."
Backups
| Type | What it stores | Restore needs |
|---|---|---|
| Full | Everything | One set |
| Incremental | Changes since the last backup of any type | The whole chain |
| Differential | Changes since the last full | Full + one |
RPO and RTO
- RPO — how much data you can afford to lose. Measured in time.
- RTO — how long you can afford to be down. Measured in time.
| Workload | Example RPO / RTO |
|---|---|
| File server | 24 h / 8 h |
| SQL database | 15 min / 1 h |
| Domain controller | 1 h / 4 h |
The 3-2-1 rule
3 copies, on 2 different media, 1 offsite.
# See when a backup last succeeded — this is the question auditors ask
Get-WinEvent -LogName 'Microsoft-Windows-Backup/Operational' -MaxEvents 20
wbadmin get versions
The question "when did you last test a restore?" is asked in every senior interview and in every audit. A green "Backup succeeded" log only proves the job ran — it proves nothing about whether the data is restorable.
File and print services
# SMB shares
Get-SmbShare
New-SmbShare -Name "Projects" -Path "C:\Shares\Projects" `
-ChangeAccess "CORP\Domain Admins"
Get-SmbShareAccess -Name "Projects"
# NTFS permissions — separate from share permissions
icacls "C:\Shares\Projects"
With both NTFS and share permissions set, Windows applies the more restrictive of the two. Say that confidently — it is a classic question and almost nobody gets it right.
Common interview questions
A server is slow. Where do you look?
Disk first. Check free space, then queue length, then physical disk health
(Get-PhysicalDisk), then disk-related events 7, 51 and 55. Then CPU and
memory. Free space below about 15% causes a surprising number of "slow
server" reports on its own.
How do you know your patching policy is working?
Inventory patch level across the estate and compare against the target ring —
Get-HotFix per machine, aggregated from inventory. Then verify the WSUS or
Intune console shows approvals and deployment states, and confirm reboot
health, because a machine that has not rebooted is not actually patched
despite the agent reporting success.