Windows Server Administration via PowerShell
Companion skill to windows-powershell (parent) covering Windows Server roles and features managed through PowerShell. Targets Windows Server 2019/2022/2025. For security-specific topics (Windows Firewall, BitLocker, Defender, auditing), see windows-ps-security.
Reference Files
Detailed code examples, patterns, and configuration are in the reference files below. Read the relevant file when working on that area.
| File |
Covers |
| iis-hyperv-storage-certs-monitoring.md |
IIS web server, Hyper-V VM management, file server/SMB, WSUS, Certificate Services, and server monitoring |
| roles-ad-dns-dhcp.md |
server roles/features, Active Directory administration, Group Policy, DNS Server, and DHCP Server |
Anti-Patterns
| Anti-Pattern |
Why It Fails |
Correct Approach |
Using Set-ADUser in a loop instead of bulk operations |
One LDAP call per user; 1000 users = 1000 network round trips; takes minutes instead of seconds |
Use pipeline: `Get-ADUser -Filter ... |
| Managing GPOs without version control |
No rollback capability; conflicting edits between admins; no audit trail for changes |
Export GPOs to XML backup before changes; store in git; document every GPO change with business justification |
| Not testing GPO changes in a lab OU first |
A bad GPO applied to production OUs can lock out users, break applications, or disable services domain-wide |
Create a test OU with representative test accounts/computers; apply and validate GPO there first; then link to production |
| Using local admin accounts instead of gMSAs for services |
Password rotation is manual; shared passwords get leaked; no accountability for service account usage |
Use Group Managed Service Accounts (gMSAs); automatic password rotation; tied to specific computer accounts |
| Disabling Windows Firewall instead of creating proper rules |
Exposes all services to the network; violates CIS benchmarks; lateral movement becomes trivial for attackers |
Create specific inbound rules for required services; use Group Policy to enforce firewall state; log dropped traffic |
Related Skills
| Scope |
Skill |
| PowerShell fundamentals (parent) |
windows-powershell |
| Windows security (firewall, BitLocker, Defender, auditing) |
windows-ps-security |
| CMD / batch scripting |
windows-cmd |
1---2name: windows-ps-server-admin3description: Use when administering Windows Server via PowerShell — Active Directory (users, groups, OUs, GPO), DNS Server, DHCP Server, IIS/web hosting, Hyper-V VM management, Windows Server Update Services (WSUS), file server/shares (SMB), Print Server, Certificate Services, and server roles/features installation. Part of the windows-ps-* skill family.4---56# Windows Server Administration via PowerShell78Companion skill to `windows-powershell` (parent) covering Windows Server roles and features managed through PowerShell. Targets Windows Server 2019/2022/2025. For security-specific topics (Windows Firewall, BitLocker, Defender, auditing), see `windows-ps-security`.910<HARD-RULE>11Always confirm the Windows Server version before applying advice. Cmdlets, module availability, and feature names vary between Server editions and versions.12```powershell13Get-ComputerInfo | Select-Object WindowsProductName, WindowsVersion, OsBuildNumber14[System.Environment]::OSVersion15Get-WindowsFeature | Where-Object Installed16```17</HARD-RULE>1819<HARD-RULE>20Never run destructive Active Directory commands (Remove-ADUser, Remove-ADOrganizationalUnit, Remove-ADGroup, Remove-ADComputer) without explicit user confirmation. Always verify the target object with Get-AD* first. AD deletions can cascade and are difficult to reverse without authoritative restores.21</HARD-RULE>2223<HARD-RULE>24Always run PowerShell as Administrator (elevated session) for server role management. Most Server cmdlets require elevation and will silently fail or throw access-denied errors without it.25</HARD-RULE>2627---2829## Reference Files3031Detailed code examples, patterns, and configuration are in the reference files below. Read the relevant file when working on that area.3233| File | Covers |34|---|---|35| [iis-hyperv-storage-certs-monitoring.md](iis-hyperv-storage-certs-monitoring.md) | IIS web server, Hyper-V VM management, file server/SMB, WSUS, Certificate Services, and server monitoring |36| [roles-ad-dns-dhcp.md](roles-ad-dns-dhcp.md) | server roles/features, Active Directory administration, Group Policy, DNS Server, and DHCP Server |3738---3940---4142## Anti-Patterns4344| Anti-Pattern | Why It Fails | Correct Approach |45|---|---|---|46| Using `Set-ADUser` in a loop instead of bulk operations | One LDAP call per user; 1000 users = 1000 network round trips; takes minutes instead of seconds | Use pipeline: `Get-ADUser -Filter ... | Set-ADUser -Property value`; or use LDIFDE for bulk imports |47| Managing GPOs without version control | No rollback capability; conflicting edits between admins; no audit trail for changes | Export GPOs to XML backup before changes; store in git; document every GPO change with business justification |48| Not testing GPO changes in a lab OU first | A bad GPO applied to production OUs can lock out users, break applications, or disable services domain-wide | Create a test OU with representative test accounts/computers; apply and validate GPO there first; then link to production |49| Using local admin accounts instead of gMSAs for services | Password rotation is manual; shared passwords get leaked; no accountability for service account usage | Use Group Managed Service Accounts (gMSAs); automatic password rotation; tied to specific computer accounts |50| Disabling Windows Firewall instead of creating proper rules | Exposes all services to the network; violates CIS benchmarks; lateral movement becomes trivial for attackers | Create specific inbound rules for required services; use Group Policy to enforce firewall state; log dropped traffic |5152---5354## Related Skills5556| Scope | Skill |57|---|---|58| PowerShell fundamentals (parent) | `windows-powershell` |59| Windows security (firewall, BitLocker, Defender, auditing) | `windows-ps-security` |60| CMD / batch scripting | `windows-cmd` |
joogy06