Windows Server Roles Guide

This is an original planning guide. It is not a vendor manual, an official standard, or legal advice. Example addresses use documentation ranges. Review every command before you paste it.

A role is a job, and Server Core is still a server

A Windows Server can be a domain controller, a DNS server, a DHCP server, a file server, a web server, or a print server. Putting all of them on the first machine works until the patch or the disk takes every job down together. Split roles that have different lifetimes. Domain controllers are not also the only file server. DHCP and DNS can share a host in a small site and should not be a surprise when you rebuild that host.

Server Core has no full desktop. You administer it with PowerShell, remote tools, and the command reference. That is a feature: less to patch and a smaller place to click the wrong wizard. The command reference on this site is the reminder. It does not open a session. If your team cannot administer Core, the decision is training or a desktop install you accept, not a mix you discover at 2 a.m.

Upgrades have a path. An in-place upgrade is one path, and a new server with moved roles is another. The upgrade planner on this site lists the path between versions. A skipped version is not a detail. Read it before the window. Domain controllers have their own order: you do not raise or lower functional levels as a side effect of a file-server upgrade.

The Active Directory guide owns accounts. The Group Policy guide owns policy. IIS has its own pillar. This page decides which machine is allowed to be which role.

A lab with two roles on purpose

The lab has one domain controller that is only a domain controller and DNS, and one member server that is a file server. Write those sentences. Do not add DHCP, IIS, and print on the domain controller because the wizard was open. Confirm you can administer the file server from your workstation without logging on to the domain controller's console for ordinary work.

If you install Server Core for the member server, practise the commands you will need: service status, disk space, and who is logged on. If those commands are not in your notes, you are not ready for Core on a host you cannot stand next to.

Record the Windows version and edition. Run the upgrade planner against the version you intend to be on next year. If the planner says the path is a new build, believe it and plan a move, not an in-place hope.

A shared local administrator password on both boxes is the fundamentals mistake again. Separate accounts. The password is not in the ticket.

A change you can finish

A production role change is adding one role to the host the ticket named, or moving one role to a new host and leaving the old role running until the move is proven. Two role migrations in one window hide which one failed.

Rollback of a new role is to remove it before users depend on it. Rollback of a move is the old host, which you did not demote or shut off in the same window.

List the roles and which host owns each.
Keep the domain controller off the list of casual extra roles.
Choose Core or desktop and write the admin method.
Record the version and the planner's next step.
Add or move one role.
Prove the role from a client.
Leave the old host up until that proof is boring.

Mistakes that outlive the command

Windows Server roles fails in the same few ways. Each one looks finished on the day you type it. The list is here so the ticket can forbid them before the window, not so you can recognise them in an incident review.

Every role on the first server.
A domain controller that is also the only file server and the only web server.
Server Core with no notes on how you will manage it.
An in-place upgrade the planner said to skip.
Raising a domain functional level inside a file-server window.
Shutting off the old host in the same window as the move.
One shared local administrator password.
IIS configured from this page instead of from the IIS pillar.

Decisions to write down before the window

Decision 1 for Windows Server roles. Each role has a host. Combined roles are a written exception. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 2 for Windows Server roles. The domain controller's extra roles are DNS and what the AD guide already required, not a file share. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 3 for Windows Server roles. Core or desktop is chosen, and the admin tool is in the ticket. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 4 for Windows Server roles. The version and the upgrade path are filed. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 5 for Windows Server roles. One role moves or is added in this window. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 6 for Windows Server roles. The old host stays available until the client proof is done. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 7 for Windows Server roles. Functional levels are untouched unless this ticket is about them. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 8 for Windows Server roles. Accounts and policy stay in their guides. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 9 for Windows Server roles. Local admin passwords are unique and not in the ticket. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 10 for Windows Server roles. The command reference was used for Core, and the command you needed was actually there. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 11 for Windows Server roles. A second person read the role-to-host list. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Windows role checks before you remove the old server

Check 1 in Windows role checks before you remove the old server. The role list matches the hosts. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 2 in Windows role checks before you remove the old server. The domain controller is not the file server. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 3 in Windows role checks before you remove the old server. A client used the new role successfully. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 4 in Windows role checks before you remove the old server. The old host is still up if this was a move. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 5 in Windows role checks before you remove the old server. Version and upgrade path are recorded. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 6 in Windows role checks before you remove the old server. Core hosts have a working remote admin path. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 7 in Windows role checks before you remove the old server. No functional level changed as a side effect. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 8 in Windows role checks before you remove the old server. Passwords are not in the ticket. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 9 in Windows role checks before you remove the old server. IIS, if present, is delegated to the IIS guide. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 10 in Windows role checks before you remove the old server. A second person saw the client proof. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 11 in Windows role checks before you remove the old server. Rollback is the old host or the removed role, and it is still possible. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 12 in Windows role checks before you remove the old server. DHCP or DNS changes were their own lines if they happened. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 13 in Windows role checks before you remove the old server. The planner output is filed with the version. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 14 in Windows role checks before you remove the old server. The hostname in the prompt matches the hostname in the ticket for Windows Server roles. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 15 in Windows role checks before you remove the old server. The result line includes the time and the person, not only the command. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 16 in Windows role checks before you remove the old server. You can point at the rollback value without searching a chat history. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 17 in Windows role checks before you remove the old server. Done is a sentence a second person can repeat: the proof for Windows Server roles happened, and the next host is not started early. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Tools for this guide

These tools run in the browser on this site. They do not log into your machines.

Guides in this cluster

These supporting pages belong to this pillar. A published page is linked. The others are named until they are published.