SOP for Server Builds [example]

[fraggin]

We have been given a rough draft of a Standard Operating Procedure for Server builds from our director. It is very basic and there are obviously some good ideas and procedures left out. I'm included the main points here. If anything has been overlooked or if you would like to give me some tips/hints that would make this document better, please do so. If you get a good laugh out of this, it would not suprise me.


1. Ensure that the components in the server are compatible with the model of server being built & are compatible with the OS being loaded.
2. Use CAT 5e or CAT 6 cable on all 1 Gbps links.
3. Use hardware RAID 1 on the OS drives, where possible. Never use Software RAID, unless absolutely necessary. This will ensure the ability to seamlessly fail over should the primary drive fail.
4. If the server vendor provides an OS loading wizard, like HP’s Netserver Navigator or Dell’s Server Assistant, use the most current version of it we have to load the OS. This will ensure that the vendor’s drivers are used where applicable & will generally make the OS load easier.
5. Create at least a 12 GB OS partition. This will ensure sufficient capacity for future service packs, etc.
6. Load vendor specific patches, such as BIOS updates, firmware updates (SCSI, RAID, HDD, etc.), or even specific OS patches such as KB252332 on HP LH 3000s and LH 6000s.
7. Patch the OS & any applications using Shavlick, to the current patch level defined by the NetAdmin group.
8. Log the console in using the corresponding administrator account for the group that will be using the server (e.g. ops_admin).
9. Set the local administrator account password according to the standard defined by the NetAdmin group
10. Copy the OS CDs I386 folder to c:\i386. This will ensure that the correct install files are readily available if needed for future changes.
11. Install the server vendor’s management tool (e.g. HP TopTools or Dell Server Manager).
12. Create a shortcut in the start up folder for c:\winnt\system32\taskmgr.exe. Set the Shortcut to ‘run minimized’ and set the name to Task Manager. Open up Task Manager & set options on it to “hide when minimized” on, “always on top” off & “minimize on use” off. This will cause task manager to run in the task tray, showing overall CPU utilization at a quick glance. This is especially useful when a server isn’t responding well via remote control. You can quickly determine if the server’s CPU is saturated or if there is a problem with the remote control process.
13. Open ‘My Computer’. Change the ‘view’ to details. Go to ‘tools’, ‘folder options’. Enable “Display full path” in the address bar & title bar. Enable “show hidden files & folder” and disable “hide extensions for known file types”. Click “Apply to All folders” to set them to all use this format.
14. Remove the “My Documents” shortcut from the desktop & Outlook Express out of Quick Launch (they just aren’t needed on a server and take up valuable real-estate).
15. Rename “My Computer” to be the server name. This helps identify the server when using a KVM or when you have many remote desktop/remote control windows open.
16. Set the screen saver to ‘Logon’ or ‘Windows Default’, 5 minute delay, require password on resume.
17. Set the “Power” settings to never turn anything off. The default is to turn the monitor off after 15 minutes, which sometimes causes you to think a server is down when really the monitor is just ‘asleep’.
18. Install Terminal Services in Admin mode for administrative remote desktop connections.
19. Ensure that the NIC, switch port speed, switch port Rx bandwidth & switch port Tx bandwidth negotiate to the desired speed (should be 1 Gbps or 1000 Mbps on most servers).

[lessthanzero]

At what point is Antiviral installed? I may have overlooked it, but I don't recall reading it in your SOP.

Also, are you remote from the server farms? I've found it better to place a burned ISO of the OS in the cdrom which facilitates remote repair procedures over TCP/IP KVM if necessary. I use Avocent, which gives you BIOS level control...very cool for a centralized/remote datacenter.

Cheers,
<0

[fraggin]

Thanks for the tip.......

[bballad]

any renaming of the admin account? how about adding other aco****s in the domain to local admin? any domain stuff?