Managing Windows Server 2012 Systems : Configuring Roles, Role Services, and Features (part 4) - Managing server binaries

You can remove a server role by following these steps:

When Setup finishes modifying the server configuration, you’ll see the Removal Progress page. Review the modification details to ensure that all phases of the removal process were completed successfully. As necessary, note any additional actions that might be required to complete the removal, such as restarting the server or performing additional removal tasks. If any portion of the removal failed, review the Server Manager entries for removal problems and take corrective actions as appropriate.

Binaries needed to install roles and features are referred to as payloads. With Windows Server 2012, payloads normally are stored in subfolders of the Windows Side-by-Side folder (%SystemDrive%\Windows\WinSXS). However, to enhance security, you can disable roles and features and remove the payload used to install these roles and features. When you remove a payload, servers try to get the required binary files via Windows Update by default. In Group Policy, you can configure an alternative to Windows Update. You do this by specifying an alternative download location.

If you want to remove binaries, you use Windows PowerShell to do this and not Server Manager. The ServerManager module for Windows PowerShell is the command-line counterpart of Server Manager.

import-module servermanager

import-module servermanager

The Get-WindowsFeature cmdlet returns a detailed list of a server’s current state with regard to roles, role services, and features. When you type get-windowsfeature at a PowerShell prompt, you’ll see the state of each role, role service, and feature listed as one of the following:

As shown in the partial listing that follows, each role, role service, or feature is listed by display name and then by its management naming component:

[ ] Active Directory Certificate Services         AD-Certificate           Removed
    [ ] Certification Authority                   ADCS-Cert-Authority      Removed
    [ ] Certificate Enrollment Policy Web Serv... ADCS-Enroll-Web-Pol      Removed
    [ ] Certificate Enrollment Web Service        ADCS-Enroll-Web-Svc      Removed
    [ ] Certification Authority Web Enrollment    ADCS-Web-Enrollment      Removed
    [ ] Network Device Enrollment Service         ADCS-Device-Enrollment   Removed
    [ ] Online Responder                          ADCS-Online-Cert         Removed
[X] Active Directory Domain Services          AD-Domain-Services           Installed
[ ] Active Directory Federation Services      AD-Federation-Services       Available
  [ ] Federation Service                      ADFS-Federation              Available
  [ ] AD FS 1.1 Web Agents                    ADFS-Web-Agents              Available
    [ ] AD FS 1.1 Claims-aware Agent          ADFS-Claims                  Available
    [ ] AD FS 1.1 Windows Token-based Agent   ADFS-Windows-Token           Available
  [ ] Federation Service Proxy                ADFS-Proxy                   Available
[X] Active Directory Rights Management Se...  ADRMS                        Installed

By using Install-WindowsFeature followed by the management name, you can install a role, role service, or feature and get its binaries if necessary. Use –includeallsubfeature when adding components to add all subordinate components. Use –includemanagementtools when adding components to add the related management tools.

You can uninstall a role, role service, or feature using Uninstall-WindowsFeature. If you specify a top-level role with role service and feature subcomponents, the subcomponents are uninstalled as well.

To uninstall a role, role service, or feature and then remove the related binaries from the Windows Side-By-Side folder, you use the –Remove parameter with Uninstall-WindowsFeature. If you specify a top-level role with role service and feature subcomponents, the binaries for the subcomponents are removed as well.

Use –includemanagementtools when removing components to remove the related management tools.

In the previous example, Active Directory Certificate Services and its subcomponents were removed. Knowing this, you could retrieve the binaries for the role, subordinate role services, and features and then install these components as well as the related management tools by entering the following command:

install-windowsfeature ad-certificate -includeallsubfeature -includemanagementtools

Because adding or removing components requires administrator privileges, you must run this command at an elevated PowerShell prompt.

By default, when you use Install-WindowsFeature, payloads are restored via Windows Update. You can use the –Source parameter to restore a payload from a Windows Imaging (WIM) mount point. For example, if an image for Windows Server 2012 is available at the network path \\ImageServer32\WinServer12EE, you could specify the source as follows:

install-windowsfeature -name ad-certificate -includeallsubfeature
-source \\imageserver18\winserver12ee

The path you specify is used only if the required binaries are not found in the Windows Side-By-Side folder on the destination server. You also can mount the Windows Server 2012 distribution media and use the Windows\WinSXS folder from the installation image as your source. To do this, follow these steps:

You can use Group Policy to control whether Windows Update is used to restore payloads and to provide alternate source paths for restoring payloads. The policy you want to work with is Specify Settings For Optional Component Installation And Component Repair, which is under Computer Configuration\Administrative Templates\System. This policy also is used for obtaining payloads needed to repair components.

If you enable Specify Settings For Optional Component Installation And Component Repair (as shown in Figure 5), you can do the following:

Figure 5. Configuring component installation and repair through Group Policy.