The Official Guide to Installing SBS

[Sparky]

The Official Guide to Installing SBS 2003

A few members have shown an interest in SBS so I thought Id write a mini guide to installing it in a commercial environment. I have installed loads of SBS boxes over the past couple of years for new start businesses and companies that have grown to the point where they have good reason to have a server in their IT infrastructure. I’ve outlined the basics of what has to be considered before installing SBS and what an install is like on a client site. I haven’t gone into great detail on every aspect of an install, everyone will have their own personal preferences when setting up a server. By following this guide you will be able to turn up to a clients site with one of your workmates and install SBS and leave looking like an IT God! (That’s the plan anyway!)


Why SBS?
For very little money a company can have its own domain controller, file server and mail server on one server which will probably satisfy the companies IT needs until the next release of SBS. It’s always worth considering that if the company grows to have more than 75 users or will have other sites then SBS is not going to be the correct option. It is not possible to replicate SBS and it will not support over 75 connections. Also is worth considering spreading your server roles over more than one server if you support more than 75 users. Always remember if the SBS box falls over then there will be no email or files for all the users, hope you can run fast!!


What brand of server?
This is personal choice but always spec the server in terms of fault tolerance and performance. If possible try and get a server which supports hardware RAID 5 and if possible go for a hot swappable RAID. As your SBS will have many roles (e.g. File Server and Mail Server) you have eliminated a single hard disk failure as a potential problem for the server grinding to a halt. Also try and spec the server to have a backup PSU, again this has added fault tolerance to your server spec.


Where do I get SBS from and which version do I want?
If you are buying a server from a well known manufacturer then you will probably have the choice of OS and backup software. If you don’t need ISA or SQL Server then go for the Standard version of SBS 2003. Also at this stage you have to add in the amount of cals required for the users at the company.


What else do I need to purchase?
As previously mentioned try to purchase backup software from the server manufacturer (such as Veritas) and also shop around for Anti-Virus software. You will need AV that supports Exchange and again you will need to buy a suitable amount of licences for the number of PCs on the network. For good practise also purchase a UPS, APC provides an excellent range of UPSs and again you may be able to purchase this with the server. I would recommend buying as much software with the server as this will cut costs for this type of installation.

How do I get the SBS box connected to the internet?
Hopefully the site you will be installing SBS on will have an internet connection enabled (ADSL) so you will need to purchase a suitable ADSL modem and potentially a separate hardware firewall. I personally buy a basic ADSL modem with one Ethernet port and bridge the connection to the WAN port of a hardware firewall which doesn’t have an inbuilt ADSL modem. The site may have a shared connection therefore try and find out who to contact and if you can get static I.Ps setup. Also there is probably a firewall for the shared line, ask if its ok to open ports for potential VPN connections in the future.

What info do I need before going on-site?
The most important piece of info is to try and find out who is responsible for the broadband hosting. Get the name of the person as if any changes are to be made the bill payer usually has to talk to the ISP to get any changes made to the hosting. Before going on-site get the username and password for the broadband account and make sure there is at least one static I.P available for the site. After that get the MX record for the email domain to point at the static I.P and away you go.

Lets Recap.
Ok, so you have bought a nice new server and have a pile of disks with SBS 2003, backup software and have downloaded AV and burned it to CD. You also have enough licences for the server and the AV. A few PCs are included as part of the installation so you ask one of the other guys to lend a hand with the install. As you are an excellent IT engineer you are also going to install a UPS and you have at least 5 tapes for the server. You are also going to show one user how to change the tape and make that person responsible for it for the rest of their life!

You double check all the ISP details and do a quick nslookup on the email domain and check its pointing at the right I.P, you are ready to go!


You arrive at the site (a few days later)...
After getting lost and looking up the A-Z you finally arrive at the clients site. First thing to do is check out what the coffee facilities are like and try and find the boss of the company. You will either get the “Thank f**k you are here, we have been needing this network for monthes” response or the “I thought this was going to be installed next week” response. You get all the boxes into the Office with no help whatsoever and get to work.


Connectivity.
Hook up the ADSL modem\firewall and get a connected to the internet. Give the gateway device a suitable I.P address and log in via the web interface and check that the WAN port has the static I.P you would expect. Decide what the static I.P of the server is going to be and forward port 25 (smtp) to that server. Disable DHCP and then you can focus on the SBS box.

Installing SBS
Find a suitable place for the SBS box and connect it to the firewall device (lets assume it has an inbuilt switch) and then fire up the server. If the server has any pre-installation disks I would recommend you use them. For example Dell server use Openmanage discs which prompt you to create partitions etc and then prompt for SBS discs. The stability of the install is much better when you use the manufactures boot discs. Follow the on-screen instructions to install SBS and the rest will fall into place. For a small installation I would define a small range of 100 I.Ps in the DHCP range and also decide a suitable short domain name. I would generally follow the defaults when installing SBS as this will save any problems when installing service packs in the future.

There are advanced ways in which some components can be installed, for example it is recommended that Exchange Server has its log files on a separate partition from the Exchange store. Technet will give you the more advanced setup ‘how to’ guides.


Finishing off the SBS install:
Follow the ‘To do’ list and complete the required tasks. Also make sure you configure the DNS forwarders to point at the ISPs DNS servers, you didn’t think your SBS box could resolve www.certforums.co.uk all by itself did you? Now its time to create a test account and mailbox. If the email domain is different from the internal domain name then this must be added to recipient policy of Exchange server. Log onto an external email account (e.g hotmail) via webmail and send a test email. If this works ok respond and again check this is received. If all is ok then create all the other users Windows accounts and mailboxes. If email is playing up make sure you can telnet in via port 25 to make sure the firewall is setup ok. Also check the MX records again and double check the recipient policy. If outbound email doesn’t work you may be able to fire the email out through a smarthost, check with the ISP for details.


SBS Extras:
Although SBS comes with its own backup utility it’s not great. Chances are there will be an application (such as Veritas) bundled with the server. Configure the backup and label the tapes. Run a test backup on a tape to make sure everything is ok and to make yourself look important to the staff that have gathered around the new server. Remember to install AV with a suitable Exchange plugin and if supported install a remote administrator app so you can push the AV to the client PCs. No point in walking around each PC clicking “Next, next, next” if you don’t have to.


Add the clients:
Make sure all the clients are set to obtain their I.Ps automatically and then add them to the domain. After logging on have a quick check that you can connect to the internet, this will show if the DNS and gateway is configured correctly in the DHCP scope. If the internet is slooooooow or it takes ages to log on then there is probably a DNS issue somewhere. Check the gateway is the firewall and DNS is pointing at your nice new SBS box. Because you are such a nice guy you configure the Outlook profile and add a default printer for the users. If you are going to be supporting the network you then refuse to set anyone up as a local administrator despite all the begging from the users. If you are just doing the installation because the network is going to be supported by ‘Dave’ because “he knows stuff about computers” you then give everyone domain admin rights and wait for the “the network is shagged” phone call a few monthes later.

Tidy up:
Lob all the discs in a box and put it right beside the server. Chances are if you give it to someone and you turn up on-site they won’t remember where they have put it. Nobody likes having to download a 500MB ISO image when they arrive on site.


The tour:
Finally speak to the boss man and check he is happy with the install. Chances are you will have to set up a couple of distribution lists or a shared mailbox before you leave the site. Set up a share on the server and map a drive on each client PC, hopefully users will put files in there rather than the root of the C: drive. Before you leave and if you are not going to be supporting the network the guy who will be looking after the network will hit you with 5000 questions on how the thing is set up and what should be done if X happens. This is a good time to be as vague as possible and just say, “all you need to do is reboot the server if anything goes wrong” Also plant a few “logic bombs” before leaving; my favourite is hiding the key and locking the front of the server.

On the way home:
So your driving home after a job well done. The phone goes and it’s the boss of the company you have just been at. You fear the worst thinking the network has fallen over before the cheque has even been cashed only to find out he has forgotten his password.

Conclusion:
There are many other areas to consider when doing an installation but that would just take up too much space. Try and decide naming conventions, AD design, password policies before you go on-site. Also its worth setting up the SBS box before going on-site, nothing worse than having a duff RAID controller to mess up your day. Other areas can come into play such as wiring and the actual physical location of the server. The server will probably be in someone’s office but this can’t be helped for small business installs, you didn’t think all installations would be in a nice data centre with air con did you?

[The_Geek]

Very nice, Sparky. Thanks.

Oh, and one last tip;

Never, EVER, expect to hear the words "thank you".

[Baba O'Riley]

Originally Posted by The_Geek

Very nice, Sparky. Thanks.

Oh, and one last tip;

Never, EVER, expect to hear the words "thank you".

Thank what?

Nice post by the way Sparky.

[Bluerinse]

Nice write up Sparky, very interesting indeed.

Tell me, do you set up the reporting feature to email you with a daily server performance report. I find that the reporting feature in SBS is very good.

Do you install the CALs straight away?

Also, do you set up ISA ever?

Do you configure remote access ie VPN or port forward 3389?

[Sparky]

Originally Posted by Bluerinse

Nice write up Sparky, very interesting indeed.

Tell me, do you set up the reporting feature to email you with a daily server performance report. I find that the reporting feature in SBS is very good.

Do you install the CALs straight away?

Also, do you set up ISA ever?

Do you configure remote access ie VPN or port forward 3389?

If I am going to support the network after the install then I will set up Reporting in SBS. Also I will set up reporting from the firewall, AV and also the backup. Veritas can send an email report after a backup job which I find quite useful.

I generally install the CALs when I’m happy with build of the server and I am ready to add the clients to the domain. Is there a good time to add the CALs? Ive never really thought about that before.

For remote access I’ll set up a point to point VPN back to the office with whatever hardware firewall has been installed. I’ll give access to a dedicated remote access PC back at the office by only putting one I.P in the endpoint of the VPN. I generally never forward port 3389 unless there is major problems getting the VPN up and running.

I like ISA but I’ve only installed it as a proxy so I need to get more experience of using it as a firewall. I think I’ll have to try and install it in a lab environment before rolling it out for a new client.

[Bluerinse]

Originally Posted by Sparky

If I am going to support the network after the install then I will set up Reporting in SBS. Also I will set up reporting from the firewall, AV and also the backup. Veritas can send an email report after a backup job which I find quite useful.

I generally install the CALs when I’m happy with build of the server and I am ready to add the clients to the domain. Is there a good time to add the CALs? Ive never really thought about that before.

For remote access I’ll set up a point to point VPN back to the office with whatever hardware firewall has been installed. I’ll give access to a dedicated remote access PC back at the office by only putting one I.P in the endpoint of the VPN. I generally never forward port 3389 unless there is major problems getting the VPN up and running.

I like ISA but I’ve only installed it as a proxy so I need to get more experience of using it as a firewall. I think I’ll have to try and install it in a lab environment before rolling it out for a new client.

That's great Sparky - you are the man!!

[AJ]

Nice one Sparky.

This has just come in time to set one up at home.

Cheers mate

[nugget]

Thanks Sparky.

[JonnyMX]

Excellent post, thanks mate.

We're having a bit of a problem with a SBS at the moment.
It keeps 'forgetting' CALs and we have to keep re-entering them.
It's happening about once a month randomly, i.e. it isn't associated with a backup, AV sweep or any other noticeable job.

After being transferred round Asia twice be Microsoft, a little man suggested that it was the fault of our AV software.

We run Symmantec corporate.

This would obviously mean that there are hundreds of you out there with a Symmantec/SBS combination and you're all having exactly the same problem, right?

Anyone found an answer yet?

[Sparky]

Originally Posted by JonnyMX

Excellent post, thanks mate.

We're having a bit of a problem with a SBS at the moment.
It keeps 'forgetting' CALs and we have to keep re-entering them.
It's happening about once a month randomly, i.e. it isn't associated with a backup, AV sweep or any other noticeable job.

After being transferred round Asia twice be Microsoft, a little man suggested that it was the fault of our AV software.

We run Symmantec corporate.

This would obviously mean that there are hundreds of you out there with a Symmantec/SBS combination and you're all having exactly the same problem, right?

Anyone found an answer yet?

Thanks for the feedback guys, most appreciated. I might write another version with screen shots and some other technical info. I thought this post works well as it gives an overview of an SBS install.

As for the problem with Symantec I don’t think this is the cause of the cal issue. A few clients I support use Symantec corporate edition and we have no problems in regard to cals.

[Bluerinse]

Originally Posted by JonnyMX

Excellent post, thanks mate.

We're having a bit of a problem with a SBS at the moment.
It keeps 'forgetting' CALs and we have to keep re-entering them.
It's happening about once a month randomly, i.e. it isn't associated with a backup, AV sweep or any other noticeable job.

After being transferred round Asia twice be Microsoft, a little man suggested that it was the fault of our AV software.

We run Symmantec corporate.

This would obviously mean that there are hundreds of you out there with a Symmantec/SBS combination and you're all having exactly the same problem, right?

Anyone found an answer yet?

Make sure your AV program is not scanning \windows\system32\lls folder as per this link..

http://www.webservertalk.com/archive...-7-328717.html

And be aware of what Microsoft say here..

http://download.microsoft.com/downlo...3/TSHT_SBS.htm

Troubleshooting Client Computer Licensing
Users are unable to log on to the network or access network resources

Cause: If Small Business Server 2003 cannot validate the number of installed client access licenses (CALs), the number of available licenses will be reset to five. This can occur if Active Directory is unavailable or if the license store becomes corrupt. When this happens, you will receive an error message that will also be logged to the System event log. The following error is also recorded in the Application event log:

"No license was available for user Domain\Username using product Productname. Use Licensing from the Administrative Tools folder to ensure that you have sufficient licenses."

Solution: To correct this problem, restore the CALs from a valid license store using the Restore License Wizard, or from System backup using the Backup or Restore Wizard. Alternately, you can use the Add License Wizard to reissue them.
Note
To complete the following procedures, you must be logged on as a member of the Domain Admins security group.

To restore CALs using the Restore License Wizard

Click Start, point to Administrative Tools, and then click Licensing.

Details about the currently installed CALs appear in the details pane.

Click Restore Licenses.

Follow the instructions to specify the file name and location of the backup file from which you want to restore the CALs.
To restore CALs using the Backup or Restore Wizard

Insert the correct tape into the tape drive, or connect the removable hard drive to the system

Open the Backup or Restore Wizard. To do this, click Start, click Run, type ntbackup, and then click OK.

If the Backup or Restore Wizard does not recognize the backup media, the Recognizable Media Found dialog box appears. Select Allow Backup Utility.

On the Backup or Restore page, select Restore files and settings.

On the What to Restore page, under Items to restore, select the files or folders that you want to restore, and then click Next.

On the Completing the Backup or Restore Wizard page, review the settings. If you want to change the location to which the backup is restored or how the existing files that you are backing up are handled, click Advanced.
On the Where to Restore page, you can change the location to which your files are restored, or you can choose to have your files restored to a single folder.


On the How to Restore page, you can choose what to do with the versions of the files that already exist on your computer.


On the Advanced Restore Options page, if you chose to restore to the original location on the Where to restore page, ensure that the Restore junction points, but not the folders and the file data they reference check box is selected. If you chose to save to a different location, ensure that the check box is not selected.


Note
Do recover files through a Remote Desktop session.

To reissue CALs to the same server

Click Start, point to Administrative Tools, and then click Licensing.

Details about the currently installed CALs appear in the details pane.

In the details pane, click Add Client Licenses to open the Add License Wizard, and then follow the wizard instructions.

On the Contact Method page, select whether you will use the Internet or the telephone to reissue licenses.

After completing the wizard, refresh the Licensing console to verify the successful reissue of the CALs.
Note
You will be required to provide the license codes that you received when you purchased the CALs.

Note
If you have a choice between using the telephone or using the Internet to activate CALs, it is recommended that you use the Internet.

Note
If you are using the telephone to activate the CALs, be prepared to provide a customer service representative with the Installation IDs from the Confirmation Information page in the wizard. You can print both the contact information and Installation IDs from the Confirmation Information wizard page.

Note
If you have made changes to the hardware configuration of your computer since first adding the CALs, you may be required to transfer licenses rather than reissue them.

Note
To avoid the need to reissue CALs, it is recommended that you restore licenses from backup whenever possible.

[JonnyMX]

Thanks Pete - great info!

I did eventually set the AV scan to ignore the Lic files, and touch wood, haven't had an issue since.

It did just seem to be such a ridiculous scenario - AV scan brings entire office to its knees.

Mental.