Blake

https://support.microsoft.com/en-us/help/3002547/you-cannot-enable-the-microsoft-.net-framework-3.5-feature-on-windows-server-2012-r2,-windows-server-2012,-windows-8.1,-or-windows-8-after-you-install-security-update-2966827-or-2966828
Looks like you have been following that. 
 
I'd say assuming this isn't a prod environment, just uninstall the 2 security updates and try again... then re-install the KB after. 

Milestone is free for up to 8 cameras, very good software.

Yeah, milestone is the beez kneez. Except your looking at some serious dollarydoos if you need to deploy across a number of remote sites. I remember pitching it our execs.. as soon as they saw the price they decided to keep the current 'adhoc' system.

So did Sophos, until they took down the marketing page. No AV provider is 100% effective, good protection is like an onion multiple layers (i.e. access controls, firewall, IPS, etc etc, preferably from different vendors). 

So did Sophos, until they took down the marketing page. No AV provider is 100% effective, good protection is like an onion multiple layers (i.e. access controls, firewall, IPS, etc etc, preferably from different vendors). 

FYI, Microsoft didn't invent domains, they existed well before MS. You can make domains from any server really, it's just that Windows computers definable have a better time with Active Directory.
 
Look up RHDS, OpenSSO or Tivoli for mor info.

@Droidbot is partially correct. However, most servers are designed to be run in a cool, dust free space. You you run it in your garage for a few months you'll see it might start thermal throttling, depending on the amount of dust in the area. Normally you'll be fine, but due to the cramped internals of a server, if your running in this environment, try to open it up and clean it out every 6 months or so.
 
Air conditioned environments are also better, if you want it to last longer.
 

Got the WSUS update for windows 10 support?
 
Also, double check that the GPO's security filtering and delegation settings are correctly configured (make sure authenticated users can read the GPO, otherwise even though they might be in scope, the computer account might not have read access to the GPO so it can't actually see that that GPO is in scope, so it never applies it).
 
Another thing that you will want to do after the initial sync is to run some maintenance, seriously just get rid of all the superseded updates, you'll find that if your running WSUS from the internal database it tends to chug unless you maintain it well (if you have a SQL cluster, throw it on that instead).

@Droidbot is partially correct. However, most servers are designed to be run in a cool, dust free space. You you run it in your garage for a few months you'll see it might start thermal throttling, depending on the amount of dust in the area. Normally you'll be fine, but due to the cramped internals of a server, if your running in this environment, try to open it up and clean it out every 6 months or so.
 
Air conditioned environments are also better, if you want it to last longer.
 

No way to convince management to get a new physical box? Just thinking the T320, is going to be out of support also/cost of support will likely be cost prohibitive at this point. 
 
Also, I'd try to stay away from an in place upgrade if possible. spin up a new system, and migrate the role individually (i.e. migrate the FSMO roles to make the 2012/2016 VM the PDC, make sure everything is replicated to new system power down 2k8 box, make sure nothing breaks, etc etc).

He's going to have an AD environment, spinning up a WSUS VM wont really be that difficult, so that issue is voided.
Really, should be using cluster aware updating anyway to prevent a production server from just rebooting and taking everything down, this would also sort out the DNS/HA issues. In all seriousness, why would you run a mission critical service that requires 24/7 up time on a single server without a way to mitigate a server reboot/single point of failure?
 
Looking at his list of services:
Active Directory, will have the 2012r2 box as a failover.
DHCP, can be configured as active/active or active/passive with the 2012r2 box.
DNS, will most likely be integrated with AD, I'd assume that 2k16 would be primary DNS and 2k12r2 as secondary, no issues here assuming only one system goes down at a time).
File Shares, setup a DFS share and then your good on this side also (assuming you have enough space on both servers).
Printer Sharing, I haven't had to look at this one for a long time, but I know you can cluster this service bac in 2k3 days so i am assuming you still can. worst case scenario people can just not print for a day or two (which is fine 99% of the time unless you work in a printing press shop....). 
IIS, Bit more complicated if your doing network load balancing etc, but there isn't any reason this couldn't be Clustered, it'll really depend on the application pools, etc.

This one is better? https://www.amazon.com/Routing-Switching-200-125-Official-Library/dp/1587205815/ref=sr_1_1?s=books&ie=UTF8&qid=1493007053&sr=1-1&keywords=Cisco+CCNA+Routing+and+Switching+200-125

Not 100% correct, but close enough, fuck it, works this way in practice.

Yeah you can delete them. That is just the SID of an "unknown to the current install of windows" user. Most likely a user that was created then delete in the current install or if you re-installed Windows over the top of an older install, then transferred out files from the windows.old folder, every user account/group will still have it's SID imprinted on each file.
 
They are fine to delete, assuming you don't move he drive back and forward between this and another system (if you do you'll have to re-apply the permissions on the next system).
 
No issues.Give this a read for more info on permissions. Very old, but most of it still applies. This is even better...

prove it.
prove it.
 
 
 

Email Boss outlining why you think it is a bad idea (it's nor a server, it looks like he is just using a server case), CC HR.
Boss will reply saying you are wrong, forward this to your personal email address.
 
Bring it up occasionally, just enough that he knows it is still an issue. drop hints when in staff room to other staff/hr so they know you have an issue with it.
Shit hits the fan at some point.
 
Boss throws you under the bus.
 
You print email out and give to HR.
Computer gets re-built to requirements for sitting in auditorium.
Issue resolved.
 

FYI, you posted an update that only effects systems already running in EFI mode...
 
Nah, it's that the install media everyone creates isn't UEFI compatible. Easiest way to tell is to look for bootmgr.efi in the root of your install media, then check in the sources folder for a install.esd if you see these and no install.wim/boot.wim you should be good to go (while these doesn't force an efi compatable version being installed, it is a whole lot more likely that if you fail to boot to the usb you will go change the bios to 'uefi mode' then try and remember how to use dism to extract the wim and create a new bootable media.
 
 

Weird, didn't know we had so many silicon fabrication expert/engineers on the forum 

you would need something to send the wake on lan packet first. Actually generating said packet isnt the hardest thing in the world. However it depends what languages you know, obviously if your a windows stack developer you'll have a harder time automating this if the only other system on your network is a switch.

99% of the time they are case specific. All my HP gear is the tool-less rails, which are great. I know alot of other OEM stuff is also similar.
 

'Sure'
 
Security is like an onion, many layers, just because there are 'better' firewalls doesn't mean you should disable the built-in one without a very good reason (i.e. mission critical software that conflicts with the windows firewall, use of other 3rd party firewall, etc). Both 1st part and 3rd party firewalls/av have their pros and cons (mainly cost versus manageability).
 
 

But what about my Active/Passive or Active/Active cluster?
 
/s. I know what you mean.

But what about my Active/Passive or Active/Active cluster?
 
/s. I know what you mean.

gigabit should be fine for 3-4 people... what exactly are they loading? and what exactly are they loading it from?
Really depends if they even need it. While yes etherchannel is great, the bottle neck could very well be the server, which would mean upgrading to a LACP compatible switch would be pointless (or only start to pay for itself after then next round of server upgrades).

Not really,
 
Server manager is completely different in 2k8.
 
2k12 also supports a heck of a lot more features.
 
Easiest thing for op will be to right click to folder he wants to share, make sure share permissions are set to full and then use NTFS permissions to set ACL's.
When it asks for username and password (assuming no AD here) he just needs to enter: [fileserverhostname]\[user] as username and password.