All Answers

By default (and by Microsoft’s design), the configuration wizard will setup the server as a primary domain controller if an AD domain does not already exist on the server. However, if the server is already set up as a domain controller, then the configuration wizard should recognize that and just configure Windows Server Essentials on the server accordingly (without messing about with the existing domain configuration). For more info on that see:

Deploy Windows Server Essentials in an existing Active Directory environment

Thus, you “should” be fine to run the configuration wizard on your existing DC. That being said… Microsoft designed the behavior of the configuration wizard (not me), and so I make no guarantees whatsoever that your existing domain configuration will remain completely untouched. Just make sure that you have a working backup of your server before you proceed as a just in case.

Thank you, as always, for your thorough responses, Mike.

I have done this so many times over the years, so I had followed almost all of the instructions you resent. (That’s what I had in the screenshots I was unable to upload.) The one piece I’d forgotten was to actually Enable the RADC Web Feed. SMH

I’m all set!

Best regards,
Edgar T.

Thank you Mike for the reply.

I finally had to purchase a new domain name compatible with Windows Essentials.

I have another question regarding the custom domain name procedure.

I followed your procedure because it is the best described alternative when remotewebaccess.com is no longer available to set up. I’m in the process to install a clean WS 2012 R2 server with Essentials Experience. I managed to get it up and running, but in your procedure for Let’s Encrypt Certificate and Certify The Web, it’s preferable to use your PowerShell script to to allow the native tools built into Essentials to configure the SSL certificate properly.

Since I’m installing a WS 2012 R2 server, I’m not and can’t use your PowerShell script. So, would you be so kind to tell me what I have to do manually every time the certificate get’s renewed?

Thanks

Unfortunately, Microsoft hasn’t added the more secure security ciphers, that our webserver host requires, to the older (and now defunct/unsupported) versions of Windows Server (e.g. 2011, 2012, and 2012 R2). Therefore, the older versions of our WHS/WSE RemoteApp and WSE WorkFolders add-ins are no longer available (seeing as they cannot securely reach out to our webserver any longer).

Windows Server Essentials natively configures the newly installed SSL certificate in multiple places on the Essentials server (besides in just the RD Gateway). All our PowerShell script does is write the newly installed SSL cert’s thumbprint to the Windows Registry, which in turn, then alerts our WSE RemoteApp and WSE WorkFolders add-ins to run the native methods in Windows Server Essentials in order to properly configure the new SSL cert for use in Windows Server Essentials (similar to what happens when you first “configure”, or “repair”, Anywhere Access via the server Dashboard).

The PowerShell script itself doesn’t do anything much per se. Rather, there’s code in our add-ins that call the appropriate native methods within Windows Server Essentials in order to properly install/setup/configure the SSL cert on the Essentials server. You’d need to be able to write a WSS add-in, and know all of the appropriate native methods to call in order to replicate that functionality, and that’s not something that can be done with a simple PowerShell script I’m afraid.

I’ve been thinking about adding that same functionality to the WSEE Installer itself so that folks who don’t want to install our ad-ins can still properly configure a custom/vanity domain name in Windows Server Essentials using certify the web, but (I haven’t gotten around to doing that as of yet, and) that would only apply to Windows Server 2019/2022/2025 and so it still wouldn’t help you with 2012 R2 I’m afraid.

I strongly suggest that you move up to using (at least) Window Server 2016 Essentials, rather than relying on the older (and now fully unsupported by Microsoft) Windows Server 2012 R2 Essentials, but if that’s not an option for you, then the best that you’ll be able to do is to set up certify the web to install the SSL cert into the RD Gateway for you as Mariëtte Knap describes over here.

Thanks, I unfortunately have to stick with WS 2012 R2 for a while longer. I’ll adjust my setup per Mariëtte Knap and hope for the best.

Thank you for your help. I am good with following instructions, but I am only an intermediate user. So the issue here is that I am encountering an issue with Certify the Web GoDaddy API. Please look at the screenshot below.

Is there any alternative to GoDaddy that offer all-in-one solution to small customers like me (domain host, Dynamic DNS and API)?

Thank you.

Thank you for all your help. :- ) I’ll try the configuration again with these instructions.

I’ve managed to figure out how to use a “.uk” TLD when setting up a new custom/vanity domain name in Anywhere Access (and it sure wasn’t easy). I’ll be releasing updated versions of each of my software products later this week that implement the fix (i.e. that will allow folks to manually set up a new domain name in Anywhere Access when using a “.uk” top level domain). I’ll update this post just as soon as the updates are available for download.

EDIT: Okay, the updated versions of the WSEE Installer, WSE RemoteApp, and WSE WorkFolders with support for “.uk” and “.top” TLDs have been released.

NOTE: Essentials already includes support for a large number of TLDs, but if anyone happens to come across one that doesn’t work, then just let us know and we can add support for it (on-the-fly).

I’ve managed to figure out how to use a “.top” TLD when setting up a new custom/vanity domain name in Anywhere Access (and it sure wasn’t easy). I’ll be releasing updated versions of each of my software products later this week that implement the fix (i.e. that will allow folks to manually set up a new domain name in Anywhere Access when using a “.top” top level domain). Unfortunately, the fix is only for use under Windows Server 2016 or greater I’m afraid.

Hi Mike, here’s the copy/paste of the error.
From what i read, i have done the update just as user, not via right-click “Run as Admin” option. so should it be run again as ‘right-click Admin’ or only the command as shown below?

Log Name: Application
Source: EssentialsRoleSetupUpdater
Date: 7-6-2024 17:33:01
Event ID: 0
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Domain.MOOK.local
Description:
Error occurred while attempting to grant built-in Administrators account full control access permissions to:
C:\Program Files\Windows Server\Bin\WebApps\CertWebService\CertWebService.svc

System.TimeoutException
Command execution timed out:
takeown.exe /F “C:\Program Files\Windows Server\Bin\WebApps\CertWebService\CertWebService.svc” /A
Event Xml:
<Event xmlns=”http://schemas.microsoft.com/win/2004/08/events/event”>
<System>
<Provider Name=”EssentialsRoleSetupUpdater” />
<EventID Qualifiers=”0″>0</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime=”2024-06-07T15:33:01.9066434Z” />
<EventRecordID>180887</EventRecordID>
<Correlation />
<Execution ProcessID=”0″ ThreadID=”0″ />
<Channel>Application</Channel>
<Computer>Domain.MOOK.local</Computer>
<Security />
</System>
<EventData>
<Data>Error occurred while attempting to grant built-in Administrators account full control access permissions to:
C:\Program Files\Windows Server\Bin\WebApps\CertWebService\CertWebService.svc

System.TimeoutException
Command execution timed out:
takeown.exe /F “C:\Program Files\Windows Server\Bin\WebApps\CertWebService\CertWebService.svc” /A</Data>
</EventData>
</Event>

I’ve personally never come across a situation like this before, but I do know that the Windows Server Essentials Management Service can be really finicky about the specific disks that are installed/being used. Over the years, I’ve seen all kinds of issues being reported by various folks stating that the service won’t start or stay running due to the particular disks or disk configuration that they were using (RAID arrays, size of the disks, type of SSD, drivers, etc., etc.). I have no idea why things are so touchy in this area for some folks, but not for others. Guess that’s just one of the quarks that we all have to live with when using Essentials I’m afraid.

Thanks ArtinNC for your tip about deleting the Windows Backup catalog in order to resolve the service not starting/running issue. I haven’t come across that one before, but will definitely add it to my book of tricks. ;- )