Windows Server Installation on Bare Metal

What You'll Learn

Prerequisites & What You'll Need

Before starting, gather the following. Missing any item will stall the installation mid-process.

• A dedicated server (rented or owned) with bare metal access.

• A licensed Windows Server 2019 or 2022 ISO downloaded from Microsoft Volume Licensing or Evaluation Center.

• A USB flash drive (8 GB or larger) — all data will be erased.

• Rufus (Windows) or Balena Etcher (cross-platform) to write the ISO.

• Your product key (or plan to use KMS/MAK activation later).

• IPMI / iDRAC / iLO credentials (if managing remotely via Leo Servers control panel).

• Server hardware RAID controller drivers if applicable (downloaded in advance).

Windows Server Edition Comparison

Step 1: Prepare the Bootable Installation Media

You need to write the Windows Server ISO to a USB drive to create a bootable installer.

Method A: Using Rufus (Recommended on Windows)

• Download Rufus from rufus.ie — use the portable version, no installation needed.

• Insert your USB flash drive. Open Rufus. Under Device, select your USB drive.

• Under Boot selection, click SELECT and browse to your Windows Server ISO file.

• Set Partition scheme to GPT and Target system to UEFI (non CSM) for modern servers.

• Leave all other settings default. Click START. Confirm the format warning.

• Wait for the write to complete (~5–10 minutes). Do not remove the drive until Rufus shows READY.

Method B: Using DISM (Command Line)

# List disks to identify USB drive number
Get-Disk

# Clear and format USB (replace X with your USB disk number)
Clear-Disk -Number X -RemoveData -Confirm:$false
New-Partition -DiskNumber X -UseMaximumSize -IsActive | Format-Volume -FileSystem FAT32 -NewFileSystemLabel "WIN_SERVER"

# Mount ISO and copy contents to USB
Mount-DiskImage -ImagePath "C:\path\to\windows_server_2022.iso"
Copy-Item -Path "D:\*" -Destination "E:\" -Recurse

Step 2: Configure BIOS / UEFI Settings

Access the BIOS/UEFI to ensure the server is configured correctly before booting the installer.

Entering BIOS

Power cycle the server and press the appropriate key during POST:

Required BIOS Settings

• Boot Mode: Set to UEFI (disable Legacy/CSM if possible). Windows Server fully supports UEFI Secure Boot.

• Secure Boot: Leave Enabled (recommended). If you encounter driver issues post-install, disable temporarily.

• Boot Order: Move USB Drive or CD/DVD to the top.

• RAID Mode: If using a hardware RAID card, configure arrays here first. For NVMe or single drives, set SATA/NVMe mode to AHCI.

• Virtualization: Enable Intel VT-x / AMD-V if you plan to run Hyper-V.

• Save & Exit: Press F10 to save and restart.

Step 3: Boot from USB Installation Media

• Insert the bootable USB drive into the server (or attach via IPMI virtual media).

• Power on or restart. During POST, press the one-time boot key (usually F11 or F12) to access the boot menu without permanently changing BIOS settings.

• Select your USB drive. Choose the UEFI: USB Drive option if two entries appear.

• When you see "Press any key to boot from CD or DVD..." — press a key within 5 seconds.

• The Windows Setup loading screen will appear. This can take 1–3 minutes.

Step 4: Running the Windows Setup Wizard

Language & Regional Settings

• Select Language to install, Time and currency format, and Keyboard. Click Next.

• Click Install now.

• Enter your product key, or click "I don't have a product key" to activate later. Click Next.

Select the OS Edition

For most Leo Servers deployments, select Windows Server 2022 Standard (Desktop Experience).

License Agreement

• Read and accept the License Terms. Click Next.

• Select Custom: Install Windows only (advanced) — NOT the Upgrade option.

Step 5: Disk Partitioning

This is the most critical step to organize your server's storage.

Load Storage Controller Drivers (if needed)

If no drives appear, your RAID controller needs a driver:

• Click Load driver → Browse.

• Navigate to your second USB containing the RAID drivers, select the folder, and click Next.

Partition Setup (Clean Install)

• Select the target drive for Windows.

• Click New → Apply to let Windows auto-create the required EFI and MSR partitions.

• Select the largest partition labeled Primary.

• Click Next to begin the installation.

Custom Partition Layout via DiskPart

For advanced users, press Shift + F10 to open a Command Prompt, then use DiskPart:

diskpart
list disk
select disk 0
clean
convert gpt
create partition efi size=500
format quick fs=fat32 label="System"
assign letter=S
create partition msr size=128
create partition primary size=153600
format quick fs=ntfs label="Windows"
assign letter=C
create partition primary
format quick fs=ntfs label="Data"
assign letter=D
exit

Step 6: Installation Progress & First Boot

• Windows copies files. This takes 10–25 minutes. The server will reboot automatically.

• Remove the USB drive when the server reboots for the first time.

• On first boot, you are prompted to set the Administrator password. Use a strong password (minimum 12 characters, mixed cases and symbols).

• Log in. Server Manager launches automatically.

Activate Windows Server

slmgr.vbs /ipk XXXXX-XXXXX-XXXXX-XXXXX-XXXXX
slmgr.vbs /ato
slmgr.vbs /xpr

Step 7: Network Configuration

Configure your server's network interface with the IP details provided by Leo Servers.

# Find the adapter name
Get-NetAdapter

# Set static IP (Replace with your Leo Servers IP details)
New-NetIPAddress -InterfaceAlias "Ethernet" -IPAddress "203.0.113.10" -PrefixLength 24 -DefaultGateway "203.0.113.1"

# Set DNS servers
Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses ("8.8.8.8","1.1.1.1")

# Rename Server
Rename-Computer -NewName "LEO-SRV-01" -Restart

Step 8: Install Drivers

Install vendor-specific drivers to improve stability and performance.

• Chipset drivers: From Intel/AMD or your server OEM (Dell, HP, Supermicro).

• NIC drivers: Especially if using Intel X710, Mellanox, or Broadcom 10GbE adapters.

• RAID/HBA controller drivers: LSI MegaRAID StorCLI, HP Smart Array, etc.

Step 9: Install Windows Updates

Applying updates immediately patches known vulnerabilities. You can do this via Start → Settings → Windows Update or via PowerShell:

Install-Module PSWindowsUpdate -Force -Confirm:$false
Install-WindowsUpdate -AcceptAll -AutoReboot

Step 10: Post-Install Security Hardening

A freshly installed Windows Server is not production-ready without basic hardening.

# Enable Windows Firewall for all profiles
Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True

# Block inbound by default on Public
Set-NetFirewallProfile -Profile Public -DefaultInboundAction Block -DefaultOutboundAction Allow

# Allow RDP from a specific Management IP
New-NetFirewallRule -DisplayName "Allow RDP from Mgmt" -Direction Inbound -Protocol TCP -LocalPort 3389 -RemoteAddress "YOUR.IP.HERE" -Action Allow

# Disable unused services like Spooler
Stop-Service -Name Spooler -Force
Set-Service -Name Spooler -StartupType Disabled

Step 11: Enable Remote Desktop (RDP)

# Enable Remote Desktop
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" -Value 0

# Enable NLA (Network Level Authentication)
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name "UserAuthentication" -Value 1

# Allow RDP through Firewall
Enable-NetFirewallRule -DisplayGroup "Remote Desktop"

To connect, open Remote Desktop Connection on your local PC, enter your server's IP address, and log in with the Administrator credentials.

Troubleshooting Common Issues

Setup Cannot Find Drives

Cause: Hardware RAID controller driver not loaded.
Fix: Click "Load driver" in the partition screen and select your RAID driver from the USB.

Server Reboots Back to Installer

Cause: USB drive is still inserted.
Fix: Remove the USB or disconnect the IPMI virtual media during the first reboot.

Can't Connect via RDP

• Verify the IP is reachable via Ping.

• Check that port 3389 is open in Windows Firewall.

• Ensure your Servers network firewall isn't blocking the port.