Qué vas a conseguir
Manejar un Windows Server (2019, 2022 o 2025) para lo que se pide en operaciones: añadir un rol sin asistente, parchearlo un martes por la noche sin que nadie lo note, y saber leer el visor de eventos para decir con datos qué pasó.
Antes de empezar
- Acceso por RDP o, mejor, por PowerShell remoto (
Enter-PSSession srv-files-01) con una cuenta de administración del servidor. Instala RSAT y Windows Admin Center si no están: la mitad del trabajo se hace sin entrar. - Saber qué servicio da el servidor y quién depende de él: es lo que decide la ventana de parcheo y a quién avisas.
- Un ticket de cambio aprobado para cualquier cosa que reinicie.
1. Instalar un rol o característica
Ejemplo: un servidor de ficheros nuevo necesita el rol File Server y la herramienta de administración de deduplicación.
Get-WindowsFeature | Where-Object Installed | Select-Object -ExpandProperty NameFileAndStorage-ServicesStorage-Services...Get-WindowsFeature FS-FileServer, FS-Data-Deduplication, RSAT-File-Services | Select-Object Name, InstallStateName InstallState---- ------------FS-FileServer AvailableFS-Data-Deduplication AvailableRSAT-File-Services AvailableInstall-WindowsFeature FS-FileServer, FS-Data-Deduplication -IncludeManagementToolsSuccess Restart Needed Exit Code Feature Result------- -------------- --------- --------------True No Success {Data Deduplication, File Server, File Server ...}Restart Needed: No es lo que esperas en la mayoría; cuando dice Yes (p. ej. al instalar Hyper-V), el rol no funciona hasta reiniciar. En Server Core (sin interfaz) esto es la única forma, y es la razón de aprenderlo así.
2. Parchear sin cortar el servicio
La rutina mensual, en este orden:
- Antes: snapshot o copia reciente (Veeam de la noche anterior vale), ticket de cambio con la ventana, y aviso a los que dependen del servicio.
- Ver qué hay pendiente y aprobarlo (si hay WSUS o Windows Update for Business, ya llega filtrado):
Install-Module PSWindowsUpdate -Scope AllUsers -Force # una vezGet-WindowsUpdateComputerName Status KB Size Title------------ ------ -- ---- -----SRV-FILES-01 ------ KB5044281 712MB 2026-10 Cumulative Update for Microsoft server operating system version 21H2SRV-FILES-01 ------ KB5043066 45MB Security Update for .NET FrameworkInstall-WindowsUpdate -AcceptAll -IgnoreReboot...Reboot is required.- Reiniciar en la ventana, no al acabar de instalar:
Restart-Computer -ComputerName srv-files-01 -Wait -For PowerShell -Timeout 900desde tu equipo espera a que vuelva y te devuelve el control. - Después: que el servicio responde (un
Test-NetConnectional puerto, abrir el recurso compartido, un inicio de sesión de prueba), que no hay errores nuevos en el visor de eventos, y cerrar el ticket con la hora.
En un clúster de conmutación por error (ficheros, SQL, Hyper-V), el truco para no cortar es parchear nodo a nodo: Suspend-ClusterNode -Drain mueve los roles al otro nodo, parcheas y reinicias ese, Resume-ClusterNode, y repites. Cluster-Aware Updating lo automatiza.
Un servidor con Pending reboot desde hace semanas es un servidor a medio parchear: las actualizaciones no se aplican hasta reiniciar, y el siguiente parche fallará con 0x800f0922 o similar. Test-PendingReboot (módulo del mismo nombre) te lo dice en una línea para toda la lista de servidores.
3. Leer el visor de eventos con criterio
Abrirlo y mirar es perder la tarde. Pregúntale lo concreto:
# 1. ¿Qué errores y críticos hubo desde el último arranque?Get-WinEvent -FilterHashtable @{LogName="System"; Level=1,2; StartTime=(Get-Date).AddDays(-1)} | Group-Object Id, ProviderName | Sort-Object Count -Descending | Select-Object -First 5 Count, NameCount Name----- ---- 14 7031, Service Control Manager 3 5719, NETLOGON 1 1074, User32# 2. ¿Quién reinició el servidor y por qué? (1074 planificado, 6008 apagado sucio, 41 Kernel-Power)Get-WinEvent -FilterHashtable @{LogName="System"; Id=1074,6008,41} -MaxEvents 3 | Select-Object TimeCreated, Id, @{n="Msg";e={$_.Message.Substring(0,[math]::Min(110,$_.Message.Length))}}TimeCreated Id Msg----------- -- ---21/10/2026 23:41:02 1074 The process C:\Windows\system32\winlogon.exe (SRV-FILES-01) has initiated the restart of computer SRV-FILES-01 on behalf of user CONTOSO\laura.prado for the following reason: Operating System: Service pack (Planned)# 3. ¿Qué servicio se cae y cuándo? (7031/7034 = terminó inesperadamente)Get-WinEvent -FilterHashtable @{LogName="System"; Id=7031,7034} -MaxEvents 5 | Select-Object TimeCreated, @{n="Svc";e={$_.Properties[0].Value}}TimeCreated Svc----------- ---21/10/2026 08:02:11 Print Spooler21/10/2026 07:47:55 Print SpoolerLas tres consultas cubren casi todo: qué se repite (la primera), por qué se reinició (la segunda: un 6008 sin 1074 antes es un apagón o un cuelgue) y qué servicio falla (la tercera). Un 5719 de NETLOGON repetido es el servidor sin contacto con un controlador de dominio al arrancar: red o DNS. Lo demás se busca por ID en la documentación de Microsoft, con el texto exacto.
4. Lo que miras cada semana
Get-Service | Where-Object {$_.StartType -eq "Automatic" -and $_.Status -ne "Running"}: servicios automáticos parados.Get-PSDrive -PSProvider FileSystem: disco libre; y en un servidor de ficheros,Get-DedupStatus.Get-WindowsUpdateyTest-PendingReboot.- El visor de eventos con la consulta 1 de arriba.
- En Windows Admin Center, todo esto para varios servidores en una pantalla, sin RDP.
Siguientes pasos
- Pon la rutina de parcheo en un script con
PSWindowsUpdatesobre la lista de servidores, con el reinicio en la ventana y el informe al final: es el mismo patrón que la guía de PowerShell. - Aprende Server Core: los servidores nuevos sin interfaz tienen menos parches, menos superficie y se gestionan igual desde PowerShell y Admin Center.
- En el Nivel 3 verás Hyper-V y, en el 4, los clústeres, el DR y la nube híbrida donde estos servidores acaban viviendo.
¿Falta algo o en tu entorno es distinto? Escríbeme y lo corrijo.
What you'll get
Handle a Windows Server (2019, 2022 or 2025) for what operations asks: add a role without a wizard, patch it on a Tuesday night without anyone noticing, and know how to read Event Viewer to say, with data, what happened.
Before you start
- Access by RDP or, better, by PowerShell remoting (
Enter-PSSession srv-files-01) with a server admin account. Install RSAT and Windows Admin Center if they are missing: half the work is done without logging on. - Know what service the server provides and who depends on it: that decides the patch window and who you warn.
- An approved change ticket for anything that reboots.
1. Install a role or feature
Example: a new file server needs the File Server role and the deduplication management tool.
Get-WindowsFeature | Where-Object Installed | Select-Object -ExpandProperty NameFileAndStorage-ServicesStorage-Services...Get-WindowsFeature FS-FileServer, FS-Data-Deduplication, RSAT-File-Services | Select-Object Name, InstallStateName InstallState---- ------------FS-FileServer AvailableFS-Data-Deduplication AvailableRSAT-File-Services AvailableInstall-WindowsFeature FS-FileServer, FS-Data-Deduplication -IncludeManagementToolsSuccess Restart Needed Exit Code Feature Result------- -------------- --------- --------------True No Success {Data Deduplication, File Server, File Server ...}Restart Needed: No is what you expect for most; when it says Yes (e.g. installing Hyper-V), the role does not work until you reboot. On Server Core (no GUI) this is the only way, and the reason to learn it like this.
2. Patch without cutting the service
The monthly routine, in this order:
- Before: a snapshot or recent backup (last night's Veeam is fine), a change ticket with the window, and a heads-up to those who depend on the service.
- See what is pending and approve it (with WSUS or Windows Update for Business it already arrives filtered):
Install-Module PSWindowsUpdate -Scope AllUsers -Force # onceGet-WindowsUpdateComputerName Status KB Size Title------------ ------ -- ---- -----SRV-FILES-01 ------ KB5044281 712MB 2026-10 Cumulative Update for Microsoft server operating system version 21H2SRV-FILES-01 ------ KB5043066 45MB Security Update for .NET FrameworkInstall-WindowsUpdate -AcceptAll -IgnoreReboot...Reboot is required.- Reboot in the window, not right after installing:
Restart-Computer -ComputerName srv-files-01 -Wait -For PowerShell -Timeout 900from your device waits for it to come back and hands control back to you. - After: the service responds (a
Test-NetConnectionto the port, opening the share, a test logon), no new errors in Event Viewer, and close the ticket with the time.
On a failover cluster (files, SQL, Hyper-V), the trick to avoid downtime is to patch node by node: Suspend-ClusterNode -Drain moves the roles to the other node, you patch and reboot that one, Resume-ClusterNode, and repeat. Cluster-Aware Updating automates it.
A server with Pending reboot for weeks is a half-patched server: updates don't apply until it reboots, and the next patch fails with 0x800f0922 or similar. Test-PendingReboot (module of the same name) tells you in one line for the whole server list.
3. Read Event Viewer with intent
Opening it and browsing wastes the afternoon. Ask it something specific:
# 1. Which errors and criticals since yesterday?Get-WinEvent -FilterHashtable @{LogName="System"; Level=1,2; StartTime=(Get-Date).AddDays(-1)} | Group-Object Id, ProviderName | Sort-Object Count -Descending | Select-Object -First 5 Count, NameCount Name----- ---- 14 7031, Service Control Manager 3 5719, NETLOGON 1 1074, User32# 2. Who rebooted the server and why? (1074 planned, 6008 dirty shutdown, 41 Kernel-Power)Get-WinEvent -FilterHashtable @{LogName="System"; Id=1074,6008,41} -MaxEvents 3 | Select-Object TimeCreated, Id, @{n="Msg";e={$_.Message.Substring(0,[math]::Min(110,$_.Message.Length))}}TimeCreated Id Msg----------- -- ---21/10/2026 23:41:02 1074 The process C:\Windows\system32\winlogon.exe (SRV-FILES-01) has initiated the restart of computer SRV-FILES-01 on behalf of user CONTOSO\laura.prado for the following reason: Operating System: Service pack (Planned)# 3. Which service keeps dying and when? (7031/7034 = terminated unexpectedly)Get-WinEvent -FilterHashtable @{LogName="System"; Id=7031,7034} -MaxEvents 5 | Select-Object TimeCreated, @{n="Svc";e={$_.Properties[0].Value}}TimeCreated Svc----------- ---21/10/2026 08:02:11 Print Spooler21/10/2026 07:47:55 Print SpoolerThe three queries cover almost everything: what repeats (the first), why it rebooted (the second: a 6008 without a 1074 before it is a power cut or a hang) and which service fails (the third). A repeated NETLOGON 5719 is the server with no contact to a domain controller at boot: network or DNS. The rest is looked up by ID in Microsoft's documentation, with the exact text.
4. What you check every week
Get-Service | Where-Object {$_.StartType -eq "Automatic" -and $_.Status -ne "Running"}: automatic services that are stopped.Get-PSDrive -PSProvider FileSystem: free disk; and on a file server,Get-DedupStatus.Get-WindowsUpdateandTest-PendingReboot.- Event Viewer with query 1 above.
- In Windows Admin Center, all of this for several servers on one screen, without RDP.
Next steps
- Turn the patching routine into a script with
PSWindowsUpdateover the server list, with the reboot in the window and a report at the end: the same pattern as the PowerShell guide. - Learn Server Core: new servers without a GUI have fewer patches, less surface, and are managed the same from PowerShell and Admin Center.
- In Level 3 you'll see Hyper-V and, in Level 4, clusters, DR and the hybrid cloud where these servers end up living.
Is something missing, or different in your environment? Get in touch and I'll fix it.
Tech Career Lab · newsletter
¿Te ha servido? Cada dos semanas envío una idea práctica para perfiles IT: LinkedIn, proyectos, networking y procesos de selección.Found this useful? Every two weeks I send one practical idea for IT professionals: LinkedIn, projects, networking and hiring processes.
Apúntate y llévate las 33 ideasSign up and get the 33 ideas →