Windows Server Essentials and Small Business Server articles

30 years of Windows Server

Jeff-Woolsey — Thu, 27 Jul 2023 15:10:00 GMT

Happy 30^th Birthday Windows Server!

Thanks in advance for embarking with me on this journey down memory lane. In an effort to keep this blog (relatively) succinct, I have included a generous amount of links throughout in case you’re interested. -Jeff

Greetings everyone! I am delighted to bring to your attention to a memorable event in computing. On July 27th, 1993, Microsoft introduced the inaugural member of the esteemed Windows NT family - Windows NT Server 3.1. This remarkable release, equipped with 32-bit architecture and boasting processor independence, ushered in a new era of computing capabilities. Among its prominent features were preemptive multitasking, multiprocessing, and multiuser support, which collectively elevated the standard of operating systems. Windows NT Server 3.1 laid the cornerstone for a multitude of subsequent Windows and Windows Server iterations.

Numerous volumes have been dedicated to exploring the intricacies of Windows NT 3.1 and its subsequent versions. However, I wish to focus on a select few areas that merit special recognition: Portability, Reliability, and Personality.

Portability stands as a testament to the visionary design of Windows NT. Three decades ago, the processor landscape vastly differed from the present scenario. The ambitious objective was to develop Windows NT in a manner that facilitated seamless migration between diverse hardware architectures with minimal adjustments. This feat was achieved through the implementation of a unified code base, while processor-dependent code was segregated within a custom Hardware Abstraction Layer (HAL) tailored for each specific platform.

Fun fact: Windows NT's initial focus was on the Intel i860 processor, but it subsequently evolved to encompass the Intel x86, MIPS (R4000/R4400), and Digital (DEC) Alpha architectures. Remarkably, this support extended further to include PowerPC, Itanium, and ARM architectures. Despite fluctuations in the number of hardware architectures over the ensuing decades, the unwavering commitment to portability endures to this day with the incorporation of the Arm architecture. Here are a couple of informative links:

Reliability and Robustness: Today, it is often overlooked that a malfunctioning application may encounter errors or unexpected termination, while the unaffected operation of other apps and the operating system is taken for granted. However, this was not the norm three decades ago. It was a prevalent occurrence for misbehaving applications to not only crash themselves but also impact other running applications and even the entire operating system, regardless of whether it was DOS, OS/2, or Macintosh.

Windows NT, on the other hand, was underpinned by a fundamental architectural principle: the operating system must actively shield itself from both internal and external failures, be they inadvertent or deliberate. Additionally, it must demonstrate consistent and predictable responses to software and hardware faults. This goal was achieved through the adoption of a layered design, incorporating distinct user and kernel modes, along with the implementation of protected memory, among other crucial elements. By implementing such robust design elements, Windows NT effectively mitigated the risks posed by misbehaving software, ensuring that failures were contained and isolated, safeguarding the stability and functionality of both the operating system and other concurrently running applications.

Personality: During the development of Windows NT 3.1, graphical user interfaces were still in their formative stages. The visionary approach developed by David Cutler and team was to craft an environment that would demonstrate remarkable flexibility by accommodating multiple user interfaces and supporting applications designed for a diverse range of operating systems. This ambitious endeavor encompassed compatibility with prevailing systems such as DOS, Windows, and OS/2, while also anticipating seamless integration with future platforms.

The achievement of broad software compatibility was realized through the incorporation of several API "personalities," each catering to specific application environments. Notably, Windows NT extended support for the Windows API, POSIX, and OS/2 APIs, the latter two being progressively phased out beginning with Windows XP. Moreover, the integration of a DOS Virtual Machine facilitated partial MS-DOS compatibility, although this feature saw its eventual discontinuation in 64-bit Windows implementations.

Fast forward to the present day, this exceptional adaptability is most prominently showcased in two key features: the Windows Subsystem for Linux (WSL) and the Windows Subsystem for Android. These contemporary components exemplify the continued commitment to versatility, enabling seamless coexistence between disparate environments, and fostering a seamless user experience.

Thirty Years of Innovation

Throughout the course of the past three decades, it is noteworthy to observe the transformation undergone by Windows Server, driven explicitly by the ever-evolving demands of its users and the industry. This journey reveals distinct eras of innovation that have indelibly shaped the product's trajectory.

Server for the Masses

Windows NT 3.x established a highly successful bedrock, and the fusion of its robust engine with the user-friendly Windows 9x graphical user interface (GUI) proved instrumental in propelling Windows NT 4 to new heights. This pivotal development empowered organizations to leverage cost-effective commodity hardware for essential functions like file and print management, as well as for deploying company-wide applications. The significance of this milestone cannot be overstated. In the words of esteemed Microsoft Technical Fellow, Jeffrey Snover:

The thing that made Windows so successful was matching that kernel with a great desktop experience and then running it on PC class hardware. That combo now meant that what used to be -- servers that were run by the high priests and princes of the industry -- now anybody could buy their own server and deploy and run it. That really was the magic.

Y2K and Enterprise

In the subsequent release, the decision was made to shed the NT moniker, bestowing upon the product a title befitting its significance: Windows 2000 Server. As the Y2K commotion unfurled, we embarked upon an era defined by Enterprise-grade capabilities, introducing a new standard of reliability, scalability, and accessibility, substantiated by an impressive five nines. Windows Server 2000 made its indelible mark with the introduction of pioneering features such as Active Directory, Group Policy, enterprise-wide security policies, and centralized groups and permissions. These innovations elevated administrative efficiency and bolstered security measures across organizations.

Building upon this strong foundation, three years later, Windows Server 2003 made its debut, accompanied by the heralding of the .NET framework. This OS release unleashed a prolific wave of applications, dynamically crafted by developers utilizing cutting-edge technologies like ASP.NET, VB.NET, and C#. The outcome was a flourishing ecosystem of applications designed to cater to diverse user needs and preferences.

Datacenter

Windows Server 2008 marked a pivotal juncture, inaugurating the datacenter era with a host of groundbreaking advancements. This release heralded the integration of virtualization capabilities into the operating system through Hyper-V, democratizing the technology and empowering enterprises with virtualized environments. Additionally, the introduction of the Server Core installation option facilitated streamlined and efficient deployments. Furthermore, Windows Server 2008 represented the culmination of the 32-bit versions of Windows Server, paving the way for subsequent releases, all of which are robust 64-bit operating systems, thoughtfully designed to maintain compatibility with 32-bit applications.

The momentum of datacenter innovation surged forward with the subsequent releases, Windows Server 2012 and Windows Server 2012 R2. These iterations showcased substantial enhancements in performance, scalability, and automation, ushering in a new era of datacenter efficiency and productivity. The evolution of PowerShell, rapidly maturing, witnessed the addition of thousands of commandlets, bolstering administrative capabilities and empowering users with unparalleled control over system management. Moreover, the introduction of SMB3 brought forth a comprehensive suite of capabilities, encompassing SMB Direct, SMB Multichannel, Transparent Failover, and end-to-end encryption, redefining network file sharing and data access. Hyper-V, in particular, underwent an impressive transformation, incorporating a plethora of features, such as VM replication, Generation 2 VMs, massive scalability and performance improvements, and supporting an array of Live Migration methods. Notably, Hyper-V achieved a pioneering feat by being the first hypervisor to deliver Live Migration through a network connection alone, thereby eliminating the dependency on shared storage.

Distributed, Hybrid Cloud

As we entered the era of cloud computing, a transformative inflection point emerged with the ascendance of cloud applications and containers, reflected in the swift adoption of the Azure Kubernetes Service—the most rapidly growing Azure service at that time.

Windows Server 2016, unveiled in October 2015, represented a landmark release, as it marked the introduction of Windows Containers support, offering both process and Hyper-V isolation. This significant milestone enabled containerization of applications, promoting portability and scalability. Alongside this groundbreaking feature, Windows Server 2016 boasted a myriad of additional enhancements, encompassing DNS Policies, Defender, SMB3.1, Storage QoS, Storage Replica, Storage Spaces Direct, Rolling Cluster upgrades, Hyper-V production checkpoints, Network Virtualization, Web Application Proxy, IIS 10.0, PowerShell 5, Windows Server Containers, and Nano Server.

Windows Server 2019 followed suit in November 2018, witnessing a rapid acceleration in engineering investments to further enhance Windows Containers, WSL (Windows Subsystem for Linux), Kubernetes support, Storage Migration Services, System Insights, Shielded Virtual Machines, Windows Admin Center, OpenSSH, and a host of other features.

Now, with the latest release—Windows Server 2022—we are presented with an impressive array of new capabilities. Among its standout features are Secured-core server, new SMB encryption and compression mechanisms, and Storage Migration Service improvements. Additionally, the release delivers a series of enhancements to Windows containers, including an extended container support duration of five years, a highly requested feature from users. Windows Server 2022 also introduces a new edition, Windows Server 2022 Datacenter: Azure Edition. This edition builds upon the extensive features of the Datacenter edition, introducing additional enhancements such as hotpatching, SMB over QUIC, Storage Replica Compression, and Azure Extended Networking. The Azure Edition further reinforces Windows Server's seamless integration with the Azure ecosystem, fostering a cohesive and dynamic cloud computing experience.

A Profound Thank You

As you can see, it’s been quite a journey and we’re hard at work on the next release. A huge thank you to all of you from the Windows/Windows Server team. We appreciate your support and input to help us deliver the next release.

Jeff Woolsey, Principal PM Manager

P.S. Orin Thomas and I took this opportunity to have a chat about this historic milestone. You can watch below.

Updated information about Windows Small Business Server 2011 Product Support Lifecycle

sabiswas — Mon, 14 Sep 2020 17:25:20 GMT

This blogs post underlines the Product Support Lifecycle of Windows Small Business Server 2011 and its individual components. The support lifecycle for Windows Small Business Server 2011 is determined by its individual component’s support lifecycles.

We are publishing this information as Windows SBS 2011 integrated components will reach its end of support soon. Here are the individual products included with Windows Small Business Server 2011 (Standard/Premium Add-on) and their support lifecycle timelines.

The Extended Support End Date for the following products are as follows:

For more details please browse to http://support.microsoft.com/lifecycle/search/ and search for individual products.

End of support refers to the date when Microsoft no longer provides automatic fixes, updates, or online technical assistance. This is the time to make sure you have the latest available update or service pack installed. Without Microsoft support, you will no longer receive security updates that can help protect your PC from harmful viruses, spyware, and other malicious software that can steal your personal information.

Microsoft is committed to provide support to customers facing issues when migrating to supported versions.

A fix for Virtual Private Network issue in Windows Server 2016 Essentials has been released

sabiswas — Tue, 10 Sep 2019 20:52:45 GMT

There is a known issue with Virtual Private Network failure every 24-48 hours in Windows Server 2016 Essentials due to domain certificate auto-renewal. We are pleased to share that the fix for this issue has been included with the following Cumulative Update for Windows Server 2016:

https://support.microsoft.com/en-us/help/4512495

The issue is described here in brief:

In Windows Server 2016 Essentials SKU or Essentials role, when the domain name setup is done using a Windows Live account and the Virtual Private Network is configured by running the Anywhere Access wizard, we may experience issues with SSTP based Virtual Private Network.

VPN may work for a day or two and then fails with the following error:

The issue occurs due to a failure while enumerating the Subject Alternative Name (SAN) extension in the certificate, parsing the DNS entries and matching it with the domain name. This failure results in a certificate auto-renewal which causes a certificate hash mismatch in the registry. When a remote client attempts to establish an SSTP VPN connection, it fails to do it because of this certificate hash mismatch.

Resolution: The fix for this issue has been included with the Cumulative Update (August) for Windows Server 2016. You can install it via Windows Update or from the following link:

https://support.microsoft.com/en-us/help/4512495

Windows 10 1903 feature update breaks the client connector

sabiswas — Thu, 27 Jun 2019 23:32:32 GMT

This article describes the issue – Windows 10 1903 feature upgrade removes the already installed client connector and breaks the Essentials features such as client backup, Remote Web Access, LaunchPad App etc. The issue only applies to Windows 10 client connected to Windows Server 2016 Essentials, Windows Server 2012 R2 Essentials, Windows Server 2012 Essentials and Windows Small Business Server 2011 Essentials. This article also covers related topic such as the current workaround.

If you have a Windows 10 machine connected to a Windows Server 2016 Essentials, Windows Server 2012 R2 Essentials, Windows Server 2012 Essentials or Windows Small Business Server 2011 Essentials and you apply the Windows 10 1903 feature update, all the following features on the client computer stop to work:

Client Backup
LaunchPad App
Remote Web Access
Essentials related services will be removed

This issue was described in the past in this blog.

Current Workaround: The user needs to manually remove the "Client Connector for Windows Server Essentials" and reinstall it via the connect website on the affected Windows 10 client machine.

Office 365 Integration fails with "Cannot connect to Microsoft online services" in Windows Server 2012 R2 Essentials

sbs-team — Fri, 05 Apr 2019 00:15:18 GMT

First published on TechNet on Mar 14, 2018
We have found a new issue with Windows Server Essentials Dashboard integration wizard with Microsoft Office 365. The Integrate with Microsoft Office 365 wizard may fail to complete with the following error:

In the C:\ProgramData\Microsoft\Windows Server\Logs\ SharedServiceHost-EmailProviderServiceConfig.log, we may find the following exception:

BecWebServiceAdapter: Connect to BECWS failed due to known exception : System.ServiceModel.EndpointNotFoundException: There was no endpoint listening at https://bws902-relay.microsoftonline.com/ProvisioningWebservice.svc?Redir=1098557810&Time=636356539931802459 that could accept the message. This is often caused by an incorrect address or SOAP action. See InnerException, if present, for more details. ---> System.Net.WebException: Unable to connect to the remote server ---> System.Net.Sockets.SocketException: No connection could be made because the target machine actively refused it 157.56.55.77:443

We can see the provisioning endpoint that the wizard is trying to reach, by running the command: ipconfig /displaydns

However, when we attempt to browse that URL (provisioning web service) in a browser, it may fail with the following exception:

Additionally, when we attempt to do a telnet test to this remote server through the port 443, it fails:

The issue occurs due to a web exception when the Bec Web Service API tries to reach out to the remote endpoint for provisioning purpose. The address is written to the following registry key on the server:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Server\Productivity\O365Integration\Settings\

Name: BecEndpointAddress

Type: String value

Resolution : To resolve the issue, follow these steps:

Launch the registry editor console and take a backup of the following key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Server\Productivity\ O365Integration

Click HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Server\Productivity\O365Integration\ Settings , on the right pane delete the BecEndPointAddress key and click Yes

Exit the registry editor console and proceed to run the Integrate with Microsoft Office 365 wizard

How to configure ASR in Windows Server Essentials 2016

sbs-team — Fri, 05 Apr 2019 00:14:24 GMT

First published on TechNet on Sep 13, 2017
Hello Windows Server Essentials friends,

Windows Server Essentials (or the Essentials Experience role found in Windows Server Standard or Datacenter) can be leveraged to quickly provision and enable a full Disaster Recovery site in the cloud using built-in Microsoft Azure integration features. The solution is composed of two Azure products:

Azure Virtual Network: https://azure.microsoft.com/en-us/services/virtual-network/

Azure Site Recovery: https://azure.microsoft.com/en-us/services/site-recovery/

Using Windows Server Essentials wizards and setting up the hardware in a working configuration can be challenging and there are a few steps and prerequisites to consider before deploying the server.

Two of our bright stars in the Windows Server Essentials community are Daniel Santos and Alex Fields. Alex is from Minneapolis and he wrote a new series of blogs (leveraging Daniels's great analysis work) to help folks navigate through the configuration of the hardware and the Windows Server Essentials operating system to enable this disaster recovery solution.

Check out Alex's blog series on itpromentor.com for a detailed rundown of the configuration steps:

Part 1: Pre-requisites https://www.itpromentor.com/asr-wse-part-1/

Part 2: Configuring https://www.itpromentor.com/asr-wse-part-2/

Part 3: Failover and failback https://www.itpromentor.com/asr-wse-part-3/

Here is what the topology looks like:

Cheers and good luck!

Scott M. Johnson
Senior Program Manager
Windows Server Essentials
@SuperSquatchy

Windows Home Server 2011 End of Mainstream Support

sbs-team — Fri, 05 Apr 2019 00:14:12 GMT

First published on TechNet on Jul 03, 2017
Windows Home Server 2011 mainstream support ended in the second quarter of 2016. You can see all of the support lifecycle dates on the Microsoft Lifecycle page here .

What does this mean for you?

This means that Microsoft will no longer issue security updates for the Home Server-specific components that make up Windows Home Server 2011. If you are still running Windows Home Server 2008 or Windows Home Server 2011, Microsoft recommends bringing in a new device running Windows Server Standard or Windows Server Essentials and migrating your roles, features and data to the new appliance. Today’s new hardware is significantly faster and cheaper and can better handle the latest Windows security infrastructure, roles and features. Customers moving to a modern operating system will benefit from dramatically enhanced security, broad device support, higher user productivity, and a lower total cost of ownership through improved management capabilities.

Why migrate from Windows Home Server to Windows Server Essentials?
The latest versions of Windows Server Essentials support improvements in security, scalability, and manageability, and it contains device driver support for new hardware and silicon.
• Simplified setup. There is no easier way to set up a server than using the Windows Server Essentials Out-of-Box experience. Windows Server Essentials configures AD, certificate services, and DNS. It helps get a public domain name set up, and it generates and installs SSL certificates and everything you need to get started with your own hybrid cloud setup.
• Data redundancy and single pool of storage . Windows Server Essentials includes a feature called Storage Spaces that provides data redundancy and storage pooling functionality like that provided by Drive Extender in WHS. Windows Server Essentials has a much more reliable and resilient storage subsystem.
• Centralized PC backup and restore. Windows Server Essentials includes the next generation version of the centralized PC backup and restore functionality from Windows Home Server 2011 as well as centralized File History storage for all your PCs. Windows Server Essentials supports up to 75 PC backups vs. Windows Home Server’s 25 PC backup limitation. Windows Server Essentials 2016 also supports backing up volumes to Azure and backing up VMs to Azure Site Recovery (ASR).
• Centralized PC and server health monitoring. Windows Server Essentials includes health monitoring, both for the server itself as well as for all the connected PCs.
• Document and media sharing. Windows Server Essentials can share content using SMB, iSCSI or NFS. Windows Server Essentials 2016 no longer includes the media streaming codecs, however, we found that people were not actually using that feature and they prefer to decode in the respective media applications.
• Remote access. Windows Server Essentials has the remote access gateway feature that automatically generates SSL certificates for your server from GoDaddy. Essentials includes a web-based client for accessing home documents and media, and you can also remote desktop into the server if needed for administration purposes.

The Home Server line of products had a very enthusiastic fan following -- it introduced the concept of a server in the house to the world and books appeared to make sense of it all.

Microsoft learned quite a bit helping and supporting hundreds of thousands of home users and small businesses to deploy Windows Server. If you are looking to upgrade your old Windows Home Server, now is a great opportunity to look at the new devices available and move to a modern platform.

For more information about Windows Server Essentials see the documentation site and it can be purchased at the Microsoft store .

Cheers,
Scott M. Johnson
Senior Program Manager
Windows Server Essentials

Windows Server Essentials 2016 – Update two on Remote Web Access

sbs-team — Fri, 05 Apr 2019 00:14:00 GMT

First published on TechNet on Jun 26, 2017
Hello,

An update for the remote web access feature went live in May and so the workaround suggested in this previous blog can be undone. Users will now be able to get to http://servername/remote or https://servername.remotewebaccess.com/remote without errors, regardless of how long the server has been online.

Thanks,
Scott Johnson

Information about SBS 2008 Product Support Lifecycle

sbs-team — Fri, 05 Apr 2019 00:13:57 GMT

First published on TechNet on May 03, 2017
This blogs post underlines the Product Support Lifecycle of the Windows Small Business Server 2008 and its individual components. The support lifecycle for Windows Small Business Server 2008 is determined by its individual component's support lifecycles.

We are publishing this information as a few SBS 2008 integrated components have reached its end of support. Here are the individual products included with Windows Small Business Server 2008 (Standard/Premium) and their support lifecycle timelines.

The Extended Support End Date for the following products are as follows:

For more details please browse to http://support.microsoft.com/lifecycle/search/ and search for individual products.

End of support refers to the date when Microsoft no longer provides automatic fixes, updates, or online technical assistance. This is the time to make sure you have the latest available update or service pack installed. Without Microsoft support, you will no longer receive security updates that can help protect your PC from harmful viruses, spyware, and other malicious software that can steal your personal information.

Microsoft is committed to provide support to customers facing issues when migrating to supported versions.

Windows Server Essentials 2016 - Update on Remote Web Access

sbs-team — Fri, 05 Apr 2019 00:13:46 GMT

First published on TechNet on Apr 17, 2017
Hello,

Remote Web Access, a feature inside Windows Server Essentials 2016 (also used in the Windows Server Essentials role that is available in Windows Server Standard 2016 and Windows Server Datacenter 2016) may cause users to experience trouble connecting remotely. The issue occurs after Office 365 with AAD Integration is completed and a certain amount of time passes without a reboot, typically 36-48 hours.

The server will be responsive, but the https://servername/remote web site will indicate that it is not accessible and will redirect users to their Administrator with the following message:

"Cannot connect to Remote Web Access. Please contact the person who manages the server. "

There is a temporary workaround discussed on the windows server forum here , and it is a safe workaround to use until the fix is available. The issue is caused by WCF connections not being cleaned up by the Essentials provider framework and they are no longer removed by the CLR in Windows Server 2016. To verify this, you can check the amount of WCF connections by running the following PowerShell command in an elevated console:

netstat -a | select-string ':65532' | measure-object -line

There should be 100-300 connections typically.

The fix has been tested and checked in and it will be available in the May update package for Windows Server 2016. When the kb article is published and the fix is available, I will post about it here.

Thanks,
Scott Johnson
Windows Server Essentials

Windows Server 2016 Essentials is now GA

sbs-team — Fri, 05 Apr 2019 00:13:43 GMT

First published on TechNet on Oct 25, 2016
Windows Server 2016 Essentials has reached the GA (General Availability) milestone as a part of Windows Server 2016 launch. The product is now available in all channels.

For more details, visit the following links:

https://blogs.technet.microsoft.com/hybridcloud/2016/09/26/announcing-the-launch-of-windows-server-2016/

https://www.microsoft.com/en-us/evalcenter/evaluate-windows-server-2016-essentials

Fix for Office 365 Integration issue with Windows Server 2012 R2 Essentials has been released

sbs-team — Fri, 05 Apr 2019 00:13:40 GMT

First published on TechNet on Oct 25, 2016
There was a known issue about Microsoft Office 365 Integration failure on Windows Server 2012 R2 Essentials due to exceeding the maximum message size quota for incoming messages while retrieving the subscription information. We are pleased to inform that the fix for this issue has been included with latest monthly quality rollup for Windows Server 2012 R2:

https://support.microsoft.com/en-us/kb/3192404

Detailed information about the issue is mentioned below:

Microsoft Office 365 may fail to integrate with Windows Server 2012 R2 Essentials with the following exception:

The file SharedServiceHost-EmailProviderServiceConfig.log located at the C:\ProgramData\Microsoft\Windows Server\Logs folder may show the following exception:

The issue occurs due to a scalability issue conflicting with default output buffer size used for subscriptions. This causes a failure during the retrieval of any O365 subscription and breaks the O365 integration feature.

Resolution: The fix for this issue has been included with the monthly quality rollup for Windows Server 2012 R2. Install the following rollup on the server:

https://support.microsoft.com/en-us/kb/3192404

Note: This is an optional update and will be promoted to a mandatory one in the next update cycle.

Updated inbox component in Windows Server 2012 R2 Essentials for client connector

sbs-team — Fri, 05 Apr 2019 00:13:20 GMT

First published on TechNet on Jul 24, 2016
[This post comes to us courtesy of Schumann GE from Product Group and Sandeep Biswas from Global Business Support]

We are happy to announce that the fix for client side issues due to Windows 10 feature upgrade that was discussed in the following SBS Blog has been released:

https://blogs.technet.microsoft.com/sbs/2016/01/22/windows-10-feature-upgrade-breaks-client-connector-for-window-server-2012-r2-essentials-windows-server-2012-essentials-and-windows-small-business-server-2011-essentials/

The inbox fix for Windows Server 2012 R2 has been included with the following update rollup:

https://support.microsoft.com/en-in/kb/3172614

Note: This is an optional update and will be promoted to a mandatory one in the next update cycle.

Windows SBS 2011, Windows SBS 2008 and impact of MS16-072

sbs-team — Fri, 05 Apr 2019 00:13:16 GMT

First published on TechNet on Jul 20, 2016
[This post comes to us courtesy of Susan Bradley, Wayne Small and Schumann GE (from Product Group)]

On June 14, 2016 Microsoft released MS16-072 KB3159398 to fix a vulnerability in Group Policy whereby an attacker can allow elevation of privilege if an attacker launches a man-in-the-middle (MiTM) attack against the traffic passing between a domain controller and the target machine on domain-joined Windows computers. After MS16-072 is installed, user group policies are retrieved by using the computer’s security context. This by-design behavior change protects domain joined computers from a security vulnerability. Any Group policy that performs Security filtering on a per user basis will need to be adjusted now work after MS16-072.

For SBS 2008 and SBS 2011 in particular there are several group policies set up in the product for purposes of controlling the users’ desktop environment and Windows Software Update Services (WSUS) that are directly impacted by this change and will need adjustment in order to continue to work after the application of this patch.

There will be no automated patch to fix this issue on the SBS 2011 platform, thus we recommend that you take the following action to ensure that the default group polices on the SBS 2008 and SBS 2011 server are adjusted as well as checking if any group policies you have placed on the systems are impacted.

I would like to thank various blogs and resources that provided additional information that I am relying on in order to provide the information for the SBS community.

If you’d like to review these additional resources, I’d recommend reviewing Jeremy Moskowitz’s blog , and Darren Mar-Elia’s blog . Additional resources include the AskDS blog , and the JH consulting blog . I would recommend reviewing these additional resources if you manage different Server platforms as the commands and PowerShell scripts are slightly different for different versions of Windows Server.

Prior to MS16-072, Group policy could be set up with security filtering uniquely for computer users. Both the SBS 2008 and SBS 2011 systems as part of the SBSMonitoring service run a routine that every 20 minutes there is a service that synchronizes the SBS created (“stamped”) users with the Security Filtering on the “Windows SBS User Policy” so that the SBS can deploy specific settings to the users desktop environment. If you merely add the Domain computers READ right to the security filtering section in group policy (or any other manual change to security filtering), 20 minutes later you will find this right removed. So we must add this domain computer READ right in a specific way.

I’d first recommend that you review your server(s) and workstations to confirm that the patch has been deployed. Secondly, you will need to review your group policies to asses if they are impacted. An excellent PowerShell script you can use to check your systems is from the PoSHChap blog .

To begin, log into your SBS 2011 server. Find Windows PowerShell under Accessories/Windows PowerShell. Right mouse click and click on Run as Administrator.

Now copy and paste the following script to review what group polices are impacted:

Copy below this line

===============================================================================

#Load GPO module
Import-Module GroupPolicy

#Get all GPOs in current domain
$GPOs = Get-GPO -All

#Check we have GPOs
if ($GPOs) {

#Loop through GPOs
foreach ($GPO in $GPOs) {

#Nullify $AuthUser & $DomComp
$AuthUser = $null
$DomComp = $null

#See if we have an Auth Users perm
$AuthUser = Get-GPPermissions -Guid $GPO.Id -TargetName “Authenticated Users” -TargetType Group -ErrorAction SilentlyContinue

#See if we have the ‘Domain Computers perm
$DomComp = Get-GPPermissions -Guid $GPO.Id -TargetName “Domain Computers” -TargetType Group -ErrorAction SilentlyContinue

#Alert if we don’t have an ‘Authenticated Users’ permission
if (-not $AuthUser) {

#Now check for ‘Domain Computers’ permission
if (-not $DomComp) {

Write-Host “WARNING: $($GPO.DisplayName) ($($GPO.Id)) does not have an ‘Authenticated Users’ permission or ‘Domain Computers’ permission – please investigate” -ForegroundColor Red

}   #end of if (-not $DomComp)
else {

#COMMENT OUT THE BELOW LINE TO REDUCE OUTPUT!

Write-Host “INFORMATION: $($GPO.DisplayName) ($($GPO.Id)) does not have an ‘Authenticated Users’ permission but does have a ‘Domain Computers’ permission” -ForegroundColor Yellow

}   #end of else (-not $DomComp)

}   #end of if (-not $AuthUser)
elseif (($AuthUser.Permission -ne “GpoApply”) -and ($AuthUser.Permission -ne “GpoRead”)) {

#COMMENT OUT THE BELOW LINE TO REDUCE OUTPUT!
Write-Host “INFORMATION: $($GPO.DisplayName) ($($GPO.Id)) has an ‘Authenticated Users’ permission that isn’t ‘GpoApply’ or ‘GpoRead'” -ForegroundColor Yellow

}   #end of elseif (($AuthUser.Permission -ne “GpoApply”) -or ($AuthUser.Permission -ne “GpoRead”))
else {

#COMMENT OUT THE BELOW LINE TO REDUCE OUTPUT!

Write-Output “INFORMATION: $($GPO.DisplayName) ($($GPO.Id)) has an ‘Authenticated Users’ permission”

}   #end of else (-not $AuthUser)

}   #end of foreach ($GPO in $GPOs)

}   #end of if ($GPOs)

===============================================================================

Copy above this line

Script courtesy of https://blogs.technet.microsoft.com/poshchap/2016/06/16/ms16-072-known-issue-use-powershell-to-check-gpos/

Either paste the script into your PowerShell window on the server or save it as a .ps1 script and run it. You should see several red warnings that several of your group policies do not have the right permissions.

In reading various scripts online – It turns out there are different PowerShell commands for GP Permissions in 2008/2008R2 vs later versions of Windows. So be aware the solution provided in this blog post specifically works on 2008 and 2008 R2 and does not work on 2012 and 2012 R2. Specially the difference is simple – for 2008 and 2008 R2, replace the Get-GPPermission and Set-GPPermission commands with Get-GPPermissions and Set-GPPermissions in the script and it will work fine.

Secondly – given we have a large number of SBS sites still, I did some specific testing with it. The results of the script means that the following policies are affected by this issue and MAY NOT APPLY if you don’t add the Authenticated Users OR Domain Computers as READ on the Delegation tab for that GPO.

Windows SBS User Policy

SharePoint PSConfig Notification Policy

Update Services Server Computers Policy

Update Services Client Computers Policy

Microsoft have indicated specific conditions for using either Authenticated Users OR Domain Computers with the READ permission. I’ve done quite a bit of investigation and in conversation with Group Policy MVPs, have decided that I will implement this consistently using the Domain Computers group as this works for all scenarios.

Now we need to adjust the permissions so that the group policies work after the installation of MS16-072 , the patch of KB3159398 .

For SBS 2011 in the PowerShell window cut and paste the following script:

Copy below this line

===============================================================================

Import-Module GroupPolicy

Get-GPO -All | Set-GPPermissions -TargetType Group -TargetName "Domain computers" -PermissionLevel GpoRead

===============================================================================

Copy above this line

The first line calls the Group policy module for PowerShell, the second line adds the Domain Computers READ right to the delegation tab so that the Security filtering set up by the server can continue to process.

The script should scroll through the settings and adjust the group policies.

The script has done what it needs to do.   If you’d like to visually see the impact, if you go to any Group policy object you will now see Domain Computers on the delegation tab with READ rights.

On the Group policy object of Windows SBS User policy you should now see

Domain Computers with a Read right to the Group policy object.

Now run the testing script again to confirm that your group policy permissions have been adjusted.

Once again copy and paste the following script in the PowerShell window or save it as a .ps1 script:

Copy below this line

===============================================================================

#Load GPO module
Import-Module GroupPolicy

#Get all GPOs in current domain
$GPOs = Get-GPO -All

#Check we have GPOs
if ($GPOs) {

#Loop through GPOs
foreach ($GPO in $GPOs) {

#Nullify $AuthUser & $DomComp
$AuthUser = $null
$DomComp = $null

#See if we have an Auth Users perm
$AuthUser = Get-GPPermissions -Guid $GPO.Id -TargetName “Authenticated Users” -TargetType Group -ErrorAction SilentlyContinue

#See if we have the ‘Domain Computers perm
$DomComp = Get-GPPermissions -Guid $GPO.Id -TargetName “Domain Computers” -TargetType Group -ErrorAction SilentlyContinue

#Alert if we don’t have an ‘Authenticated Users’ permission
if (-not $AuthUser) {

#Now check for ‘Domain Computers’ permission
if (-not $DomComp) {

Write-Host “WARNING: $($GPO.DisplayName) ($($GPO.Id)) does not have an ‘Authenticated Users’ permission or ‘Domain Computers’ permission – please investigate” -ForegroundColor Red

}   #end of if (-not $DomComp)
else {

#COMMENT OUT THE BELOW LINE TO REDUCE OUTPUT!

Write-Host “INFORMATION: $($GPO.DisplayName) ($($GPO.Id)) does not have an ‘Authenticated Users’ permission but does have a ‘Domain Computers’ permission” -ForegroundColor Yellow

}   #end of else (-not $DomComp)

}   #end of if (-not $AuthUser)
elseif (($AuthUser.Permission -ne “GpoApply”) -and ($AuthUser.Permission -ne “GpoRead”)) {

#COMMENT OUT THE BELOW LINE TO REDUCE OUTPUT!
Write-Host “INFORMATION: $($GPO.DisplayName) ($($GPO.Id)) has an ‘Authenticated Users’ permission that isn’t ‘GpoApply’ or ‘GpoRead'” -ForegroundColor Yellow

}   #end of elseif (($AuthUser.Permission -ne “GpoApply”) -or ($AuthUser.Permission -ne “GpoRead”))
else {

#COMMENT OUT THE BELOW LINE TO REDUCE OUTPUT!

Write-Output “INFORMATION: $($GPO.DisplayName) ($($GPO.Id)) has an ‘Authenticated Users’ permission”

}   #end of else (-not $AuthUser)

}   #end of foreach ($GPO in $GPOs)

}   #end of if ($GPOs)

===============================================================================

Copy above this line

Script courtesy of https://blogs.technet.microsoft.com/poshchap/2016/06/16/ms16-072-known-issue-use-powershell-to-check-gpos/

Your resulting testing screen should not show any red warnings and instead be filled with white and yellow comments:

Your SBS 2011 default group polices will now function as usual.

If you’d like to make all future group polices you set up work by default with the new behavior, you can follow the advice in the section entitled “Making the change permanent in Active Directory for future / newly born GPOs” in the Jeremy Moskowitz’s blog .

For SBS 2008, you’ll need to manually add the READ permission right to the delegation tab as shown:

On the Group policy object of Windows SBS User policy you should now see

Survey - Windows Server Essentials Features

sbs-team — Fri, 05 Apr 2019 00:12:07 GMT

First published on TechNet on Feb 23, 2016
The Windows Server Essentials team would like to hear from the User Community. You are invited to participate in this program to help us prioritize our feature planning for v.Next products. Your feedback is very important to us.

To participate in this program, please visit the following web site:

http://wse2014.azurewebsites.net/take_survey.php?x=NTQ0MDI%3D

Update-WSUS 3.0 SP2 on SBS 2011

sbs-team — Fri, 05 Apr 2019 00:12:04 GMT

First published on TechNet on Jan 27, 2016

[ This blog is a Re-Post of the Blog Published on the SUS Blog ]

As indicated in a previous post , we are making changes to WSUS 4.0 and later that will provide a smoother Windows 10 servicing experience. Because WSUS 3.0 SP2 is already in extended support (receiving no support at all after July 2017), and we are not ...read more

Read the complete post at blogs.technet.com/.../what-to-do-if-you-re-on-wsus-3-0-sp2-or-sbs-2011.aspx

WS 2008 R2 , WSUS 3.0 SP2 , WS 2008 , Windows 10

WMI Group Policy Filter issue on Windows 10 breaks Folder Redirection Windows Server 2012 R2 Essentials, Windows Server 2012 Essentials and Windows Small Business Server 2011 Essentials

sbs-team — Fri, 05 Apr 2019 00:12:01 GMT

First published on TechNet on Jan 22, 2016

Folder Redirection Group Policy setup by the Essentials Dashboard needs to be modified. The issue is caused by the WMI Group Policy filters which compare OS build number not working as expected on Windows 10.

Learn more about the issue

User needs to modify the group policy WMI Filter to fix the issue where folder redirection does not work:

Launch the group policy management console:
- Press Windows Key and “R”
- Popped-up Run windows –Type gpmc.msc in the “Open” text box
- Click OK
Modify the WMI Group Policy Filter as the following:
- Once you launch the group policy editor, scroll to the bottom where the wmi filters reside.
- Right click it and select “edit”, and bring up the filter.
- Change it from select * from Win32_OperatingSystem where (Version >= “6.1%”) and ProductType= “1” to select * from Win32_OperatingSystem where Version like “10.%” or Version >=”6.1″

Thanks to Robert Pearman, Gary LeTourneau, Susan Bradley and Grey Lancaster.

Windows 10 Feature Upgrade breaks client connector for Window Server 2012 R2 Essentials, Windows Server 2012 Essentials and Windows Small Business Server 2011 Essentials

sbs-team — Fri, 05 Apr 2019 00:11:58 GMT

First published on TechNet on Jan 22, 2016

[This post comes to us courtesy of Schumann GE from Product Group and Sandeep Biswas from Global Business Support]

This article describes the issue – Windows 10 feature upgrade removes the already installed client connector and breaks the Essentials features such as client backup, Remote Web Access, LaunchPad APP etc. The issue only applies to Windows 10 client connected to Windows Server 2012 R2 Essentials, Windows Server 2012 Essentials and Windows Small Business Server 2011 Essentials. This article also covers related topics such as the current workaround and the coming fix.

If you have a Windows 10 machine connected to a Windows Server 2012 R2 Essentials, Windows Server 2012 Essentials or Windows Small Business Server 2011 Essentials server and you apply the Windows 10 feature upgrades (such as 1511), all the client connections to Essentials server will be lost. The following features will stop working –

Client Backups
LaunchPad APP
Remote Web Access
Client Domain-Joined (DNS pointing to Essentials Server will be stopped)
Essentials related services will be removed.

What is Windows 10 Feature Upgrade?

In Windows 10, Microsoft publishes two types of Windows 10 releases broadly to the public on an ongoing basis:

Feature upgrades that install the latest new features, experiences, and capabilities on devices that are already running Windows 10. Because feature upgrades contain an entire copy of Windows, they are also what customers use to install Windows 10 on existing devices running Windows 7 or Windows 8.1, and on new devices where no operating system is installed.
Servicing updates that focus on the installation of security fixes and other important updates.

Learn more about Windows 10 servicing options for updates and upgrades.

Upcoming Fix

Currently we are working with the Windows Core team to fix this issue.

Windows Server 2012 R2 Essentials
- There will be a new package available for Windows 10 Client Connector of Windows Server 2012 R2 Essentials. There will also be an inbox fix for Windows Server 2012 R2 Essentials for this issue. The inbox fix will be shipped via Windows Update to the server.
- We recommend to connect the Windows 10 client one more time to Windows Server 2012 R2 Essentials when the fix is out.
Windows Server 2012 Essentials and Windows Small Business Server 2011 Essentials
- Due to different root cause of the issue, the fix on these two products doesn’t require any new package of client connector or server update. Also user doesn’t need to reconnect the Windows 10 client to these servers. The issue will be fixed as the same timeline as Windows Server 2012 R2 fix is out.

We will keep on updating the progress of the fix and announce the release of the fix when it is available. The fix is expected in the coming months; we are trying our best to get it published ASAP. Once there is a more detailed schedule, we will update this blog as well.

Current Workaround before the coming fix

Before the fix is out, user has to reconnect the Windows 10 client to the SBS/Essentials server again after any Windows 10 Feature Upgrade.

Via this blog, we will help to let you know if there is any upcoming Windows 10 Feature upgrade that could break your installed client connector and remind you to connect the client computer again. This is just a temporary solution before the fix is out.

Currently, after Windows 10 feature upgrade, when you connect your Windows 10 client to the SBS/Essentials server, you will find there is no client backup history on the LaunchPad on the client side. This is also a known issue. You can find the history and previous backups on the server Dashboard. This issue will be fixed in the coming fix as well.

Thanks to the MVPs, user’s feedback and report on this issue – Susan Bradley, Mark Berry, Tim Groves. We’ll update this blog and also add another post once the fix of this issue is published. Thanks for your support.

Changes implemented by Essentials Role on Windows Server 2012 R2

sbs-team — Fri, 05 Apr 2019 00:11:55 GMT

First published on TechNet on Dec 23, 2015
[This post comes to us courtesy of Sandeep Biswas and Rituraj Choudhary from Global Business Support]

Today we will discuss about the changes made to the server when the Essentials Experience role is installed and configured on a Windows Server 2012 R2 machine in an existing Active Directory domain.

The Essentials role requires the following server roles and their dependent features to be installed:

1. .Net Framework 4.5 Features

2. BranchCache

3. Remote Server Administration Tools

4. Web Server (IIS)

5. Windows Process Activation Service

6. Windows Server Backup

Additionally, while configuring the server using the Configure Windows Server Essentials wizard, the following role is installed:

1. Active Directory Certificate Services

When the Essentials role is configured on a Server, it automates certain changes to the server. These are described below:

Active Directory Modifications

1. The Server’s machine account is added as a member of the following groups:

a. Pre-Windows 2000 Compatible Access : A backward compatibility group which allows read access to all users and groups in the domain

b. Cert Publishers : Members of this group are permitted to publish certificates to the directory

2. The following Managed Service Accounts are created:

a. MediaAdmin: Service account used by Windows Server Essentials Media Streaming Service during configuration

b. ServerAdmin : Service account used by Windows Server Essentials Management Service during configuration

3. The ServerAdmin account is added as a member of the Administrators, Domain Admins and the Enterprise Admins groups. The MediaAdmin account is added as a member of the Administrators group

4. The following Global Security Groups are created:

a. WseAltertAdministrators : Users with permissions to view alerts in the network

b. WseAllowAddInAccess : Users with permissions to access Windows Server Essentials Add-ins

c. WseAllowComputerAccess : Users with permissions to access computer remotely in Remote Web Access

d. WseAllowDashboardAccess : Users with permissions to access Dashboard remotely in Remote Web Access

e. WseAllowHomePageLinks : Users with permissions to access links gadget in Remote Web Access

f. WseAllowMediaAccess : Users with permissions to access the media library in Remote Web Access

g. WseAllowShareAccess : Users with permissions to access shared folders in Remote Web Access

h. WseInvisibleToDashboard : Domain users that are hidden from Windows Server Essentials Dashboard

i. WseManagedGroups : Groups managed by Windows Server Essentials

j. WseRemoteAccessUsers : Users with permissions to use VPN to connect to the server network remotely

k. WseRemoteWebAccessUsers : Users with permissions to use Remote Web Access

5. The Domain Admins Security group is added as a member of all the Essentials’ specific Global Security groups except the following:

a. WseInvisibleToDashboard

b. WseManagedGroups

Windows Server Essentials services that are installed and configured

1. Windows Server Essentials Computer Backup Service : This service helps you to backup data from and restore data to a client computer

2. Windows Server Essentials Health Service : This service evaluates key health criteria and generates alert notifications when an important condition is met

3. Windows Server Essentials Management Service : This is the centralized management pivot for Windows Server Essentials Experience role. It manages system settings and backgrounds of Windows Server Essentials

4. Windows Server Essentials Media Streaming Service : This service provides media streaming from the server to the client computers

5. Windows Server Essentials Notification Service : This service manages the Notifications Provider Service for the Windows Server Essentials Experience role

6. Windows Server Essentials Provider Registry Service : This service registers and enables discoverability of server role services and providers on computers running Windows Server Essentials

7. Windows Server Essentials Storage Service : This service manages the storage of the server

Web sites that are added and configured to the Internet Information Services (IIS) Manager console

1. Default Web Site

- Bin
- CertEnroll
- CertSrv
- Connect
- Customization
- home
- Remote
- Resources
- services

2. Mac Web Service

- bin

3. WSS Certificate Web Service

- Bin
- download

Active Directory Certificate Services components that are configured

1. Certification Authority : Root CA is used to issue certificates to users, computers and services, and to manage their validity

2. CA Web Enrollment : Web enrollment allows users to connect to a CA by means of a Web browser in order to:

Request and review certificate requests

Retrieve certificate revocation lists (CRLs)

Perform smart card certificate enrollment

Note : When you attempt to deploy Windows Server Essentials Experience role on a workgroup box, the configuration will first ask you to bring up a new Active Directory domain and configure other roles and features that the role depends on. Once it completes successfully, the Essentials role configuration will begin. For more information, please refer to this blog.

Client Connector availability with Windows Home Server, Small Business Server and Windows Server Essentials for Supported Client OS

sbs-team — Fri, 05 Apr 2019 00:11:50 GMT

First published on TechNet on Nov 17, 2015

[This post comes to us courtesy of Schumann GE from Product Group, Sabir Chandwale and Sandeep Biswas from Global Business Support]

[This post is updated on October 21, 2015]

In today’s post we will discuss about the client connector availability for supported client OS joined to the following Server OS:

Windows Home Server 2011

Small Business Server 2011 Essentials

Small Business Server 2011 Standard / Premium

Windows Server Essentials 2012

Windows Server Essentials 2012 R2

Windows Server 2012 R2 Standard/Datacenter with Essentials Experience Role

Client OS: Windows 7

SERVER OS	Client OS
Windows 7
Installation	Client Connect to Server	Client Backup	Client Backup restore	Package availability	Known Issue
Windows Home Server 2011	Working	Working	Working	Working	INBOX	NONE
Small Business Server 2011 Essentials	Working	Working	Working	Working	INBOX	NONE
Small Business Server 2011 Standard	Working	Working	NA	NA	INBOX	NONE
Windows Server Essentials 2012	Working	Working	Working	Working	INBOX	NONE
Windows Server Essentials 2012 R2	Working	Working	Working	Working after client OS hotfix installation	Auto download from DLC	NONE

Client OS: Windows 8/8.1

SERVER OS	Client OS
Windows 8 / Windows 8.1
Installation	Client Connect to Server	Client Backup	Client Backup restore	Package availability	Known Issue
Windows Home Server 2011	Working	Working	Working	Working	INBOX	NONE
Small Business Server 2011 Essentials	Working	Working	Working	Working	INBOX	NONE
Small Business Server 2011 Standard	Working	Working	NA	NA	INBOX	NONE
Windows Server Essentials 2012	Working	Working	Working	Working	INBOX	NONE
Windows Server Essentials 2012 R2	Working	Working	Working	Working after client OS hotfix installation	Auto download from DLC	NONE

Client OS: Windows 10 RTM

SERVER OS	Client OS
Windows 10 RTM
Installation	Client Connect to Server	Client Backup	Client Backup restore	Package availability	Known Issue
Windows Home Server 2011	Working	Working	Working	Working	INBOX	NONE
Small Business Server 2011 Essentials	Working	Working	Working	Working	INBOX	NONE
Small Business Server 2011 Standard	Working	Working with work-around	NA	NA	INBOX	Follow instructions as mentioned under Appendix-A
Windows Server Essentials 2012	Working	Working	Working	Working	INBOX	NONE
Windows Server Essentials 2012 R2	Requires manually installation	Working	Working	Working	X64 X86	User needs to manually download and install the client connector until the fix on the server is available which is being targeted to be released tentatively in October November 17, 2015.

Appendix-A

User needs to add the following two lines to the XML file on the server located at -
C:\Program Files\Windows Small Business Server\Bin\WebApp\ClientDeployment\packageFiles\supportedOS.xml

So what do we mean by the te rms used above:

Working: No user functional loss when the client OS is upgraded to Windows 10 RTM. There is no change on the Current User Experience

INBOX: The client connector software is available on the respective server and it is not required by the user to download it manually and install. There is no change on the Current User Experience

Auto download from DLC : The client connector software is automatically downloaded from the download center when user runs http://servername/connect on the client. There is no change on the Current User Experience

Working after client OS hotfix installation: It requires the user to install the client OS Hotfix manually for the Client Restore to function properly

NA: The respective feature is not applicable

NONE: No issues experienced while in-house repro

Resolution (Updated on 29/07/2015):

The Client Connector for Windows 10 to connect to Windows Server 2012 R2 Essentials has been released.

For x64 bit Windows 10 Client download it from here .

For x86 bit Windows 10 Client download it form here .

Note :

- The Client Connector needs to be manually downloaded and installed on the Windows 10 Client OS . Once the installation is completed follow the steps listed below,

- Click on Start, All Apps

- Scroll down till "Windows Server Essentials", expand and run "Windows Server Essentials Connector Configuration Wizard".

This is a known issue and the fix on the server is being targeted to be released tentatively in October 2015.

Once the fix is patched, then there will be no user intervention required, all the downloading, installation and configuration will be automatically carried out

- With the release of Windows Server 2016 Essentials, all client connector software will be available and no user intervention will be needed.

Update (21/10/2015):

- There will be a Windows Update released on 17th,November 2015 for Windows Server 2012 R2 Essentials.

- This Windows Update will enable the Windows 10 clients to be joined to the Windows Server 2012 R2 Essentials. In current scenario, the user has to download and install the client connector manually on the Windows 10 client, this manual process would not be required after applying this Windows Update to the Server.

- This Windows Update will not affect any of the existing Windows 10 clients connected to the Windows Server 2012 R2 Essentials.

Update (17/11/2015):

The update to support auto-redirection of Windows Server 2012 R2 Essentials for Windows 10 client connector is now available at:

https://support.microsoft.com/en-us/kb/3105885