Linux and Windows System Administration Questions

Approach (brief)
Below are exact commands (assume root) to add /dev/sdc to vg_data, create a 200G LV lv_backup, format XFS, mount it at /backup persistently, plus how to extend existing LVs and grow ext4/XFS online.

1) Add /dev/sdc and extend vg_data

# create PV
pvcreate /dev/sdc

# verify
pvs; pvdisplay /dev/sdc

# extend VG
vgextend vg_data /dev/sdc

# verify
vgs; vgdisplay vg_data

2) Create 200G LV /dev/vg_data/lv_backup

lvcreate -n lv_backup -L 200G vg_data

# verify
lvs; lvdisplay /dev/vg_data/lv_backup

3) Create an XFS filesystem

mkfs.xfs -f /dev/vg_data/lv_backup
# label optional:
# xfs_admin -L backup /dev/vg_data/lv_backup

4) Mount at /backup and make persistent

mkdir -p /backup
# get UUID
blkid /dev/vg_data/lv_backup

# add to /etc/fstab (example line using UUID; replace UUID=...)
echo "UUID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx  /backup  xfs  defaults,noatime  0 0" >> /etc/fstab

# mount now
mount /backup

# verify
df -h /backup; mount | grep /backup

Extending an existing LV and growing filesystem online

• Extend LV by 100G (example):

lvextend -L +100G /dev/vg_data/<lvname>
# or extend to use all free space:
lvextend -l +100%FREE /dev/vg_data/<lvname>

• For XFS (online grow):

# grow LV first (as above), then
xfs_growfs /mount/point
# e.g. xfs_growfs /backup

• For ext4 (online grow):

# grow LV first, then
resize2fs /dev/vg_data/<lvname>
# or specify mount point: resize2fs /dev/vg_data/<lvname>  (works online if kernel supports)
# verify
df -h /mount/point; lvs

Notes / best practices

• Ensure filesystem is mounted before xfs_growfs (it requires mount point). resize2fs can grow while mounted for ext4 (online) if kernel supports it.
• Backup critical data before disk/LVM operations. Verify UUID in /etc/fstab. Use udev naming (by-uuid) to avoid device name changes.

Context (Systems Administrator): Quick reference mapping role → primary function → common ports to plan firewall/NAT and troubleshooting.

• Active Directory Domain Services (AD DS) — Provides centralized user/computer authentication, policy and directory services. Ports: TCP 389 (LDAP), TCP/UDP 53 (DNS) often used for AD name resolution; also TCP 636 (LDAPS), TCP 88 (Kerberos).
• DNS Server — Resolves hostnames to IPs for network name resolution. Ports: UDP 53 (queries), TCP 53 (zone transfers, large responses).
• DHCP Server — Assigns IP configuration (IP, gateway, DNS) to clients automatically. Ports: UDP 67 (server), UDP 68 (client).
• File and Storage Services — Hosts SMB file shares, storage management and permissions. Ports: TCP 445 (SMB), TCP 139 (NetBIOS/legacy).
• Print Server — Manages network printers and spooler services. Ports: TCP 515 (LPD), TCP 9100 (RAW/JetDirect), TCP 139/445 (SMB).
• Remote Desktop Services (RDS) — Provides remote GUI sessions and application publishing. Ports: TCP 3389 (RDP).
• Remote Access (VPN/RRAS) — Provides VPN and routing for remote users. Ports: UDP 500/4500 (IPsec/IKE), TCP 1723 (PPTP), UDP 1701 (L2TP).
• Web Server / IIS — Hosts web applications and APIs. Ports: TCP 80 (HTTP), TCP 443 (HTTPS).

Brief approach
Use PowerShell for native service control and sc.exe for low-level config. Verify immediately with service state queries and persistently by checking service start type and registry values that survive reboot.

PowerShell — set to Automatic (Delayed Start)

# Configure
Set-Service -Name "Spooler" -StartupType AutomaticDelayedStart

# Start service now (if desired)
Start-Service -Name "Spooler"

sc.exe — set to Automatic (Delayed Start)

sc.exe config spooler start= delayed-auto
sc.exe start spooler

PowerShell — set to Disabled

Set-Service -Name "Spooler" -StartupType Disabled
Stop-Service -Name "Spooler" -Force

sc.exe — set to Disabled

sc.exe config spooler start= disabled
sc.exe stop spooler

Immediate verification

Get-Service -Name "Spooler" | Select-Object Name, Status, StartType
# Or check sc query
sc.exe query spooler

Persistent verification (across reboots)

• Check service start mode via WMI/ CIM:

Get-CimInstance Win32_Service -Filter "Name='spooler'" | Select-Object Name, StartMode, DelayedAutoStart

• Check registry keys that persist:

reg query "HKLM\SYSTEM\CurrentControlSet\Services\Spooler" /v Start
reg query "HKLM\SYSTEM\CurrentControlSet\Services\Spooler" /v DelayedAutoStart

Notes:

• sc.exe requires the space after the equals sign: start= delayed-auto
• Some PowerShell versions may not show AutomaticDelayedStart in Get-Service; use Get-CimInstance or registry to confirm DelayedAutoStart.

Overview / Approach
Describe steps to bind a cert in IIS, verify server-side bindings, inspect chain/CN-SAN, reproduce browser error, and resolve common handshake issues.

1) Bind certificate to IIS site

• Open IIS Manager → Sites → select site → Bindings → Edit/Add https.
• Choose appropriate IP/port (usually 443) and select certificate from the store.
• Optionally check “Require Server Name Indication (SNI)” for multiple certs on same IP.

2) Verify server-side bindings

• In IIS Manager confirm binding and SNI flag.
• Use netsh to list SSL bindings:

netsh http show sslcert

• Confirm appid, certificate hash (thumbprint), and IP:port mapping.

3) Verify certificate chain and CN/SAN

• Open cert (MMC → Certificates → Local Computer → Personal) and inspect:
  • Subject CN and Subject Alternative Names (SAN)
  • Validity dates (notBefore / notAfter)
  • Issuer and chain (root/intermediate present)
• From client use:

openssl s_client -connect host:443 -servername host

to view chain and negotiated cipher.

4) Troubleshoot browser TLS errors

• Certificate mismatch: Confirm CN/SAN match hostname and SNI enabled if needed.
• Handshake failures: check
  • Private key present and accessible: cert must show “You have a private key that corresponds to this certificate.”
  • Private key permissions: grant MACHINE\IIS_IUSRS or AppPool identity read access to key via certutil or mmc (Right-click key → Manage Private Keys).
  • Expired cert or missing intermediates: install intermediates into Intermediate CA store.
  • Incompatible cipher suites / TLS versions: ensure server supports TLS 1.2/1.3 and common ciphers (use IIS Crypto or registry).
  • Port/firewall/proxy interfering.

5) Validation & remediation

• Restart IIS:

iisreset

• Re-test in browser (clear cache) and with openssl or SSLLabs scan.
• If persistent, enable SCHANNEL event logging and check System/Application logs for TLS errors and detailed failure codes.

Approach summary
Minimize downtime by preparing AD, introducing new DCs, transferring FSMO, demoting old DCs, then rolling upgrade clustered app nodes node-by-node using cluster-aware methods. Verify at each step and have rollback points.

1) Prep & inventory

• Inventory DCs, FSMO holders, domain/forest functional levels, replication health, cluster config and quorum.
• Backup System State of DCs; full cluster-aware backups and application data snapshots.
• Ensure schema and apps support Server 2019/2022.

2) Schema & ADPrep

• Run AD schema update from an administrative session on a new 2019/2022 media:

adprep /forestprep
adprep /domainprep /gpprep

• Verify with:

Get-ADDomain | Select DomainMode
Get-ADForest | Select ForestMode

3) Introduce new DCs (promote)

• Add 2019/2022 servers as additional DCs (install AD DS, promote) on a subset first. Verify replication:

repadmin /replsummary
dcdiag /v

4) FSMO handling

• Transfer FSMO roles to the new DCs once healthy:

Move-ADDirectoryServerOperationMasterRole -Identity NewDC -OperationMasterRole 0,1,2,3,4

• Verify:

netdom query fsmo

5) Demote old DCs

• Demote Server 2012 R2 DCs only after replication and FSMO transfer confirmed. Remove metadata if needed. Re-run health checks.

6) Functional level raise

• Raise domain/forest functional levels only after all DCs run supported OS and app compatibility validated:

Set-ADDomainMode -Identity domain.local -DomainMode Windows2016Domain
Set-ADForestMode -Identity domain.local -ForestMode Windows2016Forest

(Choose 2016/2019/2022 as required)

7) Clustered application nodes — rolling upgrade
Option A — Node-by-node rebuild:

• Evict one node from cluster, patch or rebuild to 2019/2022, rejoin, fail back resources, repeat.
  Option B — Cluster-Aware Updating (if Windows Server 2016+ cluster):
• Use CAU to orchestrate automatic node patching/upgrades.

Procedure per node:

• Move workloads off node (live migrate clustered roles).
• Update OS or replace node with new server joined to cluster.
• Validate cluster state, quorum, and resource health:

Get-ClusterNode
Get-ClusterResource

8) Verification after each stage

• AD: dcdiag, repadmin, event logs, authentication tests, GPO application.
• FSMO: netdom query fsmo.
• Cluster: Get-ClusterNode, Get-ClusterGroup, failover tests, application-level smoke tests.
• Network/DNS: nslookup, AD DNS records.

9) Rollback & contingency

• If failures: restore System State or revert VM snapshot; move FSMO back if needed.
• Keep old servers powered but isolated until full validation complete.

Key notes

• Maintain backups and snapshots at each major step.
• Schedule during low usage windows; communicate maintenance and expected short failovers.
• Test plan in lab before production.