Damien Caro's Blog

Windows Server 2012 R2–First look

Damien Caro — Tue, 11 Jun 2013 06:00:00 GMT

Last week during TechEd North America 2013 several announcement were made around Windows Server, Windows Azure and System Center.

After the event, the sessions are available for free online viewing. In order to help you navigate through all the sessions that were presented at the event, I’ve compiled the ones I believe are the most interesting. I'’ve also included some videos that :

Windows Server 2012 R2:

Introduction to Windows Server 2012 R2: http://channel9.msdn.com/Events/TechEd/NorthAmerica/2013/MDC-B205
Hyper-V – What’s new in Windows Server 2012 R2: http://channel9.msdn.com/Events/TechEd/NorthAmerica/2013/MDC-B330
Enhancements with Windows Server 2012 R2 Hyper-V Replica: http://channel9.msdn.com/Events/TechEd/NorthAmerica/2013/MDC-H312
What’s New in Windows Server 2012 R2 Networking: http://channel9.msdn.com/Events/TechEd/NorthAmerica/2013/MDC-B216
Desired State Configuration in Windows Server 2012 R2 PowerShell: http://channel9.msdn.com/Events/TechEd/NorthAmerica/2013/MDC-B302
Storage Spaces: What’s New in Windows Server 2012 R2: http://channel9.msdn.com/Events/TechEd/NorthAmerica/2013/MDC-B218

Windows Azure:

Enabling On-Premises IaaS Solutions with the Windows Azure Pack: http://channel9.msdn.com/Events/TechEd/NorthAmerica/2013/MDC-B364
Administering and Automating On-Premises IaaS Scenarios Using the Windows Azure Pack: http://channel9.msdn.com/Events/TechEd/NorthAmerica/2013/MDC-B362
Windows Azure Services for Windows Server: http://channel9.msdn.com/Events/TechEd/NorthAmerica/2013/MDC-B214

System Center 2012 R2:

Introduction to System Center 2012 R2: http://channel9.msdn.com/Events/TechEd/NorthAmerica/2013/MDC-B206
What’s New in Microsoft System Center 2012 R2 – Virtual Machine Manager: http://channel9.msdn.com/Events/TechEd/NorthAmerica/2013/MDC-B357

I hope that you will enjoy watching these videos as much I did.

See you soon during an IT Camp near you.

Hyper-V Replica Capacity Planner

Damien Caro — Mon, 27 May 2013 06:30:00 GMT

One of the capability that I prefer most with Windows Server 2012 is Hyper-V Replica. Hyper-V Replica enables the replication of a Virtual Machine continuously from one Hyper-V host to another Hyper-V host. The replication can happen across different datacenters, across different domains (they don’t even have to be trusted) as Windows Server 2012 leverage the host network connectivity to carry the data to the replica.

The issue was that every time I started to talk about hyper-v replica, I was asked: how much bandwidth do I need between my systems ? And the answer is obviously “It depends”. It depends on how active is the VMs that you want to replicate. However we have made some simulation, collected data from multiple real life production machines and the team has been able to come up with a model.

Last week the product team has released the “Hyper-V Replica Capacity Planner”. It’s a free tool that helps system engineers to right size the network when they want to implement Hyper-V replica.

You can freely download the tool from this location : http://www.microsoft.com/en-us/download/details.aspx?id=39057

Once downloaded, read the documentation and please run the capacity planner for a reasonable amount of time during the production hours so the data collected are relevant to what you want to achieve.

Enjoy the replication of Virtual Machines !

I see a big cloud !

Damien Caro — Tue, 16 Apr 2013 21:00:00 GMT

Today is definitely a BIG day :)

you probably have seen it in the press, we launched today the IaaS for Windows Azure. It means that from now on, you can run your own Virtual Machine in Windows Azure. This unlock many scenarios and facilitate your move to the public cloud or should I say the hybrid cloud. This is what is described in this blog post from Bill Hiff: http://blogs.msdn.com/b/windowsazure/archive/2013/04/16/the-power-of-and.aspx

So here are some of the multiple benefits brought by the IaaS:

You can run a persistent VM based on images provided by Microsoft or images that you build. You can read more on that here : http://blogs.technet.com/b/dcaro/archive/2013/01/09/you-the-vms-and-the-iaas.aspx
You can create your own Virtual Networks that can be seamlessly integrated with your corporate network with a site to site VPN and using your own IP Address range. More on that here : http://morgansimonsen.wordpress.com/2012/10/24/how-to-connect-your-on-premise-network-to-windows-azure-using-windows-server-as-a-vpn-gateway-2/
You can run your own Active Directory in Azure that you can integrate with your corporate authentication mechanism. More on that here : http://msdn.microsoft.com/en-us/library/windowsazure/jj156090.aspx
You can manage and monitor your Windows Azure workloads the same way you manage and monitor your existing VMs. More on that here : http://blogs.technet.com/b/dcaro/archive/2012/05/02/how-to-monitor-your-windows-azure-application-with-system-center-2012.aspx
We have added the support for what I would call XXXL VM: 8 Cores and 56 GB of RAM ! We have more on that and on the prices here : http://www.windowsazure.com/en-us/pricing/details/virtual-machines/
And you now have templates of VM that have SQL 2012 and SharePoint 2013 pre-installed (or slipstreamed as we usually say).

If you haven’t already done so, you can register for a free three month trial of Windows Azure from this place : https://www.windowsazure.com/en-us/pricing/free-trial/

If you want to learn more on Windows Azure, I recommend that you take the overview course of the Windows Azure Virtual Machines: https://www.microsoftvirtualacademy.com/training-courses/overview-of-windows-azure-virtual-machines-iaas

Happy testing of Windows Azure VM !

System Center 2012 SP1

Damien Caro — Tue, 15 Jan 2013 16:15:00 GMT

The long awaited System Center 2012 Service Pack 1 is now available ! You can freely download it from here : http://technet.microsoft.com/en-US/evalcenter/hh505660.aspx

Don’t forget to also download the evaluation of Windows Server 2012 to get the best combination : http://technet.microsoft.com/en-us/evalcenter/hh670538.aspx

This Service Pack has of course a series of patches that improves the product but has some new features as you can see bellow :

Support of Windows Server 2012 and SQL 2012 :

The SP1 is required to support Windows Server 2012. The support of Windows Server 2012 in two terms :

Supporting it as the operating system on which System Center is installed
Supporting it as the operating system that is monitored / managed by the components of System Center (Virtual Machine Manager, Operation Manager, Orchestrator …)

You can also use SQL 2012 as the underlying database to store the data from the various components of System Center and benefit from the new capabilities of SQL 2012 like the Database Availability Group or some other enhancements (performance, memory allocation …) that we have done on the database engine with SQL 2012.

Additional support of VMware vCenter:

With System Center 2012 SP1 we have updated our list of VMware products we which we are compatible. The official list is maintained here : http://technet.microsoft.com/en-gb/library/gg697603.aspx . The main changes are :

VMware vCenter Server 5.1 and 4.1 are supported

ESX 4.1, ESXi 4.1 and ESX 5.1 only are supported with SP1 (note that ESX 3.5 & ESXi 3.5 have been removed from the RTM edition).

VMM 2012 SP1:

The SP1 brings the capability to leverage network virtualization that is introduced with Windows Server 2012. You can then create your virtualized network in VMM and the agents will nicely and easily push this configuration to the different hosts you have on your network.

On the storage side, we have added the support for Windows Standard-Based Storage Management Service, thin provisioning and discovery of SAS Storage.

Data Protection Manager 2012 SP1:

With SP1, DPM now allows to protect Hyper-V hosts over SMB and improved the performance of the backup of Hyper-V over CSV 2.0 (Cluster Shared Volumes).

DPM also now has the support of de-duplicated volumes. So if you plan to use data de-duplication (a cool feature of Windows Server 2012), you can protect them with DPM 2012 SP1.

Operation Manager 2012 SP1:

If Operation Manager had not changed a lot with System Center 2012, this not the case anymore with the Service Pack 1! Not only does it now supports the Azure SDK but also allows to monitor WCF, MVC and .Net services.

APM is now fully compatible with SharePoint 2010 with allows you to monitor the performance of SharePoint from the application point of view and not just from the “web layer” point of view. APM is now capable of converting the collected traces into an IntelliTrace format.

For those running Linux, CentOS, Debian and Ubuntu can now be monitored with Operation Manager 2012.

And the integration with VMM 2012 that brings the visibility into the network switches in the vicinity dashboard.

Service Manager 2012 SP1 :

Service Manager 2012 SP1 has added a big component around chargeback. You can now :
- Apply price sheets to the VMM Clouds
- Create chargeback reports
- Do a BI analysis with pivot by cost-centers, VMM Clouds, Price sheets

App Controller 2012 SP1 :

App Controller is our single pane of glass to the Clouds as likes the marketing team. This updated version bring two major capabilities :
- A Service Provider Foundation API to create and operate Virtual Machines
- Support for Azure VM (IaaS)
- Migrate a VHD from VMM to Windows Azure

Configuration Manager 2012 SP1:

This updated version of Configuration Manager will not only enable the deployment of Windows 8 in the enterprise but will also seamlessly integrate and configure Windows Intune as being part of your Config Manager deployment.

This new release of Windows Intune allows you to directly manage Windows RT devices, Windows Phone 8 and iPad, iPad2, iPhones and iPod Touch (using iOS 4.0 or later) that you may have deployed in your enterprise. For those devices, you don't need to have an ActiveSync account setup. For Android based devices, we still rely on AES to apply policies to mobile devices.

You can read more on the updated release of Windows Intune here : http://technet.microsoft.com/library/hh452635.aspx

System Center Global Service Monitor:

This is a service based on Windows Azure that will do application monitoring. This service will be broadly available in March 2013. Stay tuned for more information on this as we will come closer to the availability of the service. The availability of the service may not for all the countries in the world at this time.

System Center Advisor:

This free service will allow you to scan you environment and provide advices regarding your configuration. This will help you identify the misconfiguration and avoid problems. Be careful, this service is not available in all the countries in the world.

You can read more about the availability of the various services over the world on this page : http://www.microsoft.com/online/international-availability.aspx

As you can see, this Service Pack 1 is more than just a “bunch of patches” ! It is THE version that will unlock the full power of Windows Server 2012. It will also facilitate its deployment as the platform of the private cloud.

Today is really the Cloud OS "moment" !!!

So don’t hesitate, if you haven’t done so yet, download System Center 2012 with Service Pack 1 here : http://technet.microsoft.com/en-US/evalcenter/hh505660.aspx

Happy Private & Hybrid cloud in 2013 !

Technet documentation in a PDF file

Damien Caro — Mon, 14 Jan 2013 08:30:00 GMT

Who has never dreamed of reading a rather long article on Technet on his (or her) tablet ? Who has never tried to print the same article and find the result disappointing ?

Technet Library is evolving

You may have identified the change but for a few weeks now, the default configuration when you go to the Technet Library is "Lightweight".

This configuration is going to be the standard in the near future.

Create your PDF

If you have tried to print an article some time ago, have a second look.

Let's select Windows Server 2012 as the topic that interest us. Select the "Library" tab then Windows Server 2012.

Then on the right hand side, click on the arrow near the printer

Then select "Print Multiple Topics" and follow the instructions.

Browse the Library for the different articles that you want to read / print and for each of them select "Add This Topic"

Once you have made your selection, simply go to the "Collection" and select the output format that fits your needs.

Now, you can read the documentation of your favorite products !

Enjoy !

You, the System Center and the IaaS

Damien Caro — Fri, 11 Jan 2013 06:00:00 GMT

In a previous post, we talked about how you can move a VM from your Hyper-V Server to Windows Azure using the IaaS service. In this article, we'll see how System Center allows to automate and delegate this rather painfull operation.

Before we start, you need the following in you environment :

A Windows Azure subscription (available for free during 30 days here : http://www.windowsazure.com/en-us/pricing/free-trial/)
An implementation of System Center Virtual Machine Manager (VMM) and System Center App Controller that you can freely download here : http://technet.microsoft.com/en-us/evalcenter/hh505660.aspx
At least one physical machine running Hyper-V. You can download the free operating system, Hyper-V Server 2012, here : http://www.microsoft.com/en-us/server-cloud/hyper-v-server/default.aspx

These are the steps that we will follow to achieve the same result than in our previous post:

Prepare the environment
Store the VM in the library
Deploy the Virtual Machine in Azure using the IaaS

While you read this, keep in mind that those steps can be delegated to someone that has the appropriate permissions but do not need to have a full access to either environment. That person also does not need to have a password to access Azure, App Controller is checking the user's authorizations before allowing it to perform any action on the subscription.

1- Prepare the environment

App controller needs to be configured to talk to SCVMM, for that you have to create a Connection. Follow the steps bellow and enter the required information for the connection to VMM.

You also need to connect App Controller to Windows Azure:

Get the subscription ID in the Azure Management interface here:

Have the Management certificate for this Azure subscription available (or create a new one. An easy way to do it from the server withour Visual Studio : http://www.davidaiken.com/2009/12/21/how-to-create-a-x509-certificate-for-the-windows-azure-management-api/ )

Now, we can fill the wizard used to create the subscription :

In App Controller, you should now see your two environments with view similar to the following one.

We have now configured App Controller.

2- Store the VM in the library

In the cloud jargon, the Library is what becomes your the reference in terms of virtual machine templates and other components that we may use when we deploy a VM (application, database schema etc …).

To start, we have our Virtual Machine (DemoVM) deployed on a priate cloud in our environement as you can see bellow :

In order to be able to "move" that VM to Windows Azure, first we must store the VM to the Library (click on the button "store").

You can verify that the process has completed correctly, the state near the VM is "Stored".

Under App Controller, go to the library. Expand you Azure subscription and if you haven't already done so do the following :

Create a Storage Account
Create a Container (you need to select the folder representing your strorage account)

Now also expand the directory "StoredVms" (this is the default directory where the VMs are stored with Virtual Machine Manager 2012. A directory with the name of the VM appear. Under this directory, you have all the elements necessary to re-start the VM in the private cloud.

Select the VHD in the right pane of App Controller and select "Copy" and click "Paste" in the appropriate Azure container where you want to put your vhd.

Now we are simply creating a VM in Azure using this disk.

3- Deploy the Virtual Machine in Azure using the IaaS

Select the VHD file that has just been uploaded in Azure and click "Deploy". This will automatically populate part of the deployment wizard. fill the missing information and you are good to deploy.

Once the deployment has completed, we have a running VM in Windows Azure as you can see bellow.

That's it !

Enjoy System Center App Controller !

Additional resources and further reading :

If you want to read more about System Center App Controller,here are some nice articles and references :

Overview of App Controller : http://blogs.technet.com/b/server-cloud/archive/2011/10/28/app-controller-enabling-application-self-service.aspx
Technical documentation of App Controller : http://www.microsoft.com/en-us/download/details.aspx?id=29694
A series of short video on App Controller : http://technet.microsoft.com/en-us/video/Video/hh533278

You, the VMs and the IaaS

Damien Caro — Wed, 09 Jan 2013 06:00:00 GMT

There is a lot of literature on internet on how to create a Virtual Machine (VM) using Windows Azure but there is not so much when it comes to moving your Virtual Machines into Azure.

The general idea around this approach is to allow you to take a VM that is running in your datacenter and move it to the cloud. The may steps to perform this are the following :

Make sure the VM is compatible with Azure
Copy the VHD to the cloud
Create the VM with the VHD we have just uploaded

There are additional elements to consider if you want to have service continuity. For example if you want to keep the network connectivity, you need to implement a Virtual Network (post to come later). On this article, we’ll concentrate on the move operation itself.

I'm going to describe how to perform the operation with the user interface then we'll see how to do it with Powershell.

Compatibility of your VM with Windows Azure

At this time, you have to be aware of the following three constraints with the VM you want to move to Windows Azure :

1- The virtual hard disk must have a VHD format.

VHDX are not yet supported, if your VM is running on a VHDX file, don’t panic, you can easily convert a VHDX to a VHD as follow:

Go to the properties of the VM an select the disk you want to convert, click “edit”. In the available actions, select Convert.

You only need to select the format you want :

2- The virtual hard disk must have a fixed size.

Dynamically expanding disks are not supported. If you are using the wizard, you can change this in the next screen :

3- The system disk must not be larger than 127 Gb.

If you have created a VM with a system disk that is larger than 127 Gb, you must shrink it. This can easily be done by using the disk manager in the VM as shown bellow :

Copy the VHD to the cloud

Before you can actually copy the VHD file to Windows Azure, you need to prepare the following three things :

Have the latest Azure Powershell installed on your machine
Have the Azure publishing settings
Have an Azure storage account and a container
Upload the VHD to Azure

1- Get the Azure Powershell cmdlets

You need the latest version from here : https://github.com/WindowsAzure/azure-sdk-tools/downloads

The official page (https://www.windowsazure.com/en-us/manage/downloads/) will be updated soon.

2-Download and Import your publishing settings

Open the “Windows Azure Powershell” that you have just installed and type :

Get-AzurePublishSettingsFile

This will open your browser at this page https://windows.azure.com/download/publishprofile.aspx?client=nodejs&lang=en

Save the .publishsettings file on your computer then type the following command:

Import-AzurePublishSettingsFile C:\AzureCorpAccount.publishsettings

After running this cmdlet, the configuration data to access you subscription are stored in your user profile : C:\Users\<alias>\AppData\Roaming\Windows Azure Powershel.

If you need to clean your environment, you can delete the files in this folder. You’ll have to reimport the publishsettings.

3- Have an azure storage account and container

Create a new Storage Account (unless you already have one that you want to use) :

Give it a name that is unique

Once the creation has completed you can create a container. This step is optional.

The access to the container can be private, it is sufficient for what we want to do.

Now we are ready to copy the file to Azure !

4- Upload the VHD to Azure

The old way was to use CSUpload but now, thanks to the December 2012 Azure Powershell Cmdlets we can simply go to our Azure Powershell and type the following :

Select-AzureSubscription ‘mysubscription’

Add-AzureVHD –LocalFilePath ‘c:\VHD\demovm.vhd’ –Destination ‘http://mynewstorageaccount1.blob.core.windows.net/demo/demovm.vhd”

Note 1: you can copy the storage account name from the Azure web interface.

Note 2: If blob container that you specify does not exist, the powershell cmdlet will create it for you.

Note 3: There is no UI in the Azure management portal as this time to upload a file to a blob container.

Wait for the upload to complete before you continue with the remaining steps.

Once completed :

Now we are ready for the last step.

Create you VM with the VHD we have just uploaded

In order to create your VM, you need to follow those steps :

Create a “disk” that you associate with your VHD file
Create a VM using the Azure disk
Create or verify the endpoint

The VHD that you have uploaded can be associated with the azure object called an “Image”. The main difference between the disk and the image is that an image can be used to create multiple VMs from the same base. Therefore the OS that you plan to use for an Image has to be sysprep’ed. In our case, because we want to move an existing VM to Azure, we will not sysprep it and we must use the Azure disks.

1- Create the Azure “disk” that correspond to our VM

In the user interface, simply go to “Virtual Machines” then “Disks”

Then fill the form as bellow :

The name will be displayed when you create your VM and need to select a disk. You can either type the VHD URL or simply browse through your storage accounts and blob containers.

Don’t forget to check the box indicating that the VHD contains an operating system and specify which type of OS it contains. As a reminder, we support several distributions of Linux in Windows Azure.

2- Create a VM using the Azure disk

You only have to go to the “Virtual Machine Instances” tab to create your VM.

Select “From Gallery” in the wizard.

Select the disk you have just uploaded.

Continue the wizard that will create the VM in Azure.

You will be asked for two different names :

The “Virtual Machine Name”, this is used only into your subscription. It is used for display purposes and has no interference with anything else.
The “DNS Name”, this name is used in Azure to identify your VM on Internet. This name must be unique and the system will verify it before it let you continue the Wizard.

If you have created a Virtual Network, it will appear in the list of places where you can connect your VM. We will cover part of the Azure networking in a different post.

Once the VM has been created we need to verify or create the appropriate endpoints.

3- Create or verify the endpoint

Select the VM that you have just created and go to the “Endpoints” tab.

You should have a configuration similar to this one :

The endpoint that is created by default the one that allows you to RDP to your VM from outside of the Azure datacenter (ie Internet). It can be very useful if you need to see what’s happening in the cloud but, for any reason, if you want or need to disable it, you can safely delete the endpoint and create it again when you need it.

With Powershell :

This step is creating the mot basic network configuration for the VM that we have just uploaded to Azure. In the post related to Azure Networking we’ll cover this aspect in more détails.

With Powershell

0- Prepare your environement

Get the Azure Powershell cmdlets

You need the latest version from here : https://github.com/WindowsAzure/azure-sdk-tools/downloads

The official page (https://www.windowsazure.com/en-us/manage/downloads/) will be updated soon.

Download and Import your publishing settings

Open the “Windows Azure Powershell” that you have just installed and type :

Get-AzurePublishSettingsFile

This will open your browser at this page https://windows.azure.com/download/publishprofile.aspx?client=nodejs&lang=en

Save the .publishsettings file on your computer then type the following command:

Import-AzurePublishSettingsFile C:\AzureCorpAccount.publishsettings

After running this cmdlet, the configuration data to access you subscription are stored in your user profile : C:\Users\<alias>\AppData\Roaming\Windows Azure Powershel.

If you need to clean your environment, you can delete the files in this folder. You’ll have to reimport the publishsettings.

1- Convert the VHDX fle to a fixed VHD file

Convert-VHD -Path .\DemoVHD.vhdx -DestinationPath .\DemoVHD.vhd –VHDType Fixed

With this cmdlet you can use of the –DeleteSource parameter. It will delete the .VHDX file so make sure you have a good backup of the file before using it.

2- Get the Azure publishing settings

Get-AzurePublishSettingsFile

Import-AzurePublishSettingsFile C:\AzureCorpAccount.publishsettings

3- Create the Azure storage account

New-AzureStorageAccount –StorageAccountName 'mynewstorageaccount1' –Location 'West Europe'

4- Upload the VHD file to the Azure blob storage

Select-AzureSubscription ‘mysubscription’

Add-AzureVHD –LocalFilePath ‘c:\VHD\demovm.vhd’ –Destination ‘http://mynewstorageaccount1.blob.core.windows.net/demo/demovm.vhd”

5- Add the VHD to the list of disks we will be able to use later

Add-AzureDisk –DiskName 'DemoDisk' -MediaLocation 'http://mynewstorageaccount1.blob.core.windows.net/demo/demoVHD' -OS Windows

6- Create a VM Configuration

New-AzureVMConfig -DiskName 'DemoDisk' -InstanceSize Small -Name 'DemoVM' | New-AzureVM -ServiceName 'demoVMdcaro' -AffinityGroup 'MyAffinityGroup'

That’s it !

We have moved a Virtual Machine from a hyper-V running on-premises to the cloud, actually Windows Azure !

This post is intentionally going through all the steps you need to do at least the first time you’ll perform this operation. The first time, it may seem a bit long but, once you have you configuration in place and the VM properly configured, moving VMs around from on-premises to the public cloud is a piece of cake.

Also System Center 2012 SP1 brings a nice automation around this process.

Happy testing of the IaaS with Windows Azure !

Additional resources and further reading

Try Windows Azure: You can sign-up for a free trial of 90 days from this location : http://www.windowsazure.com/en-us/pricing/free-trial/

You can read more about Azure and the IaaS on the following sites :

Michael Washam’s blog : http://michaelwasham.com/
Avkash Chauhan’s blog : http://blogs.msdn.com/b/avkashchauhan/archive/2012/11/20/how-does-windows-azure-powershell-import-publishsettings-using-import-azurepublishsettingsfile-command.aspx
Azure documentation to create an image : http://www.windowsazure.com/en-us/manage/windows/common-tasks/upload-a-vhd/
The CSUpload reference page : http://msdn.microsoft.com/en-us/library/windowsazure/gg466228.aspx

This post is relying on the Azure Cmdlet update of December 2012. You will find a complete list of the changes introduced with this release at this location : http://michaelwasham.com/2012/12/14/new-windows-azure-powershell-update-december-2012/

Happy new year !

Damien Caro — Mon, 07 Jan 2013 06:00:00 GMT

Last year has been very rich in term of news for the IT industry. We have launched System Center 2012, Windows Server 2012, SQL 2012 and just before the end of the year Windows Intune. Those three products are creating the foundation for a shift in the IT. Those product are the critical building blocks for the "Cloud", no matter if it is a Private Cloud (running on your premises) or a Public Cloud (running on Microsoft premises for example) or a mix of them with a Hybrid Cloud.

2013 will be a very exciting year from the Datacenter perspective ! We will see this cloud transformation become more and more a reality. We will soon have the Service Pack 1 for System Center 2012 that will bring amongst other capabilities the support of Windows Server 2012 (more on this in the coming days) and Windows Azure will integrate seamlessly with our existing datacenters.

For the moment, enjoy the beginning of the year and see you soon in your country !

Master IT Pro Contest

Damien Caro — Thu, 20 Dec 2012 16:30:00 GMT

Yesterday, I had the pleasure to be the host of the Master IT Pro contest !

The purpose of the contest was to “cook” a Powershell script that would achieve the following tasks :

•Provision 500 accounts in Active Directory that are users from the marketing department and 500 accounts that are users from the finance department

•Ensure that any documents on a share containing social security numbers will be encrypted and only users from the finance department can read it.

The participants had one hour to perform the task with some hints given during the competition :)

As for every script, there are several ways to achieve the given goal. here is one way, I’m always open to discussion looking for a better and faster approach to do it !

Automate the creation of the users :

For this part, I’ll explain you how to easily write a script. So in Windows Server 2012, we have added new cmdlet that allows you to managed AD objects. For example, we’ve added the “New-ADUser” that will create an AD object of the type “user”.
How to use it is easy, simply launch the “Active Directory Administrative Center” as showed in the screen capture bellow and make sure you click on “Powershell History” :

Using ADAC (Active Directoty Administrative Center), create here a test user and copy the powershell cmdlets to the ISE (Integrated Scripting Environment).

It is a very good start and will help you start building your script. Here is what I have when I create an account called '”test” in my environment.

New-ADUser -DisplayName:$username -GivenName:"test" -Name:"test" -Path:"OU=MasterIT,DC=masterit,DC=net" -SamAccountName:"test" -Server:"DC.masterit.net" -Type:"user"

Set-ADAccountControl -AccountNotDelegated:$false -AllowReversiblePasswordEncryption:$false -CannotChangePassword:$false -DoesNotRequirePreAuth:$false -Identity:"CN=test,OU=MasterIT,DC=masterit,DC=net" -PasswordNeverExpires:$false -Server:"DC.masterit.net" -UseDESKeyOnly:$false

Set-ADUser -ChangePasswordAtLogon:$true -Identity:"CN=test,OU=MasterIT,DC=masterit,DC=net" -Server:"DC.masterit.net" -SmartcardLogonRequired:$false

Once we have those basic steps, which you can modify as you like, for example adding some properties to the user and so on, we can start creating the loop that will create the 1000 users all-up.

Creating 1000 users and putting them in the right group:

You have two options here. The first one, that I used at the beginning is to actually create a loop that will create users with an increment in the name but some participants actually notified me that it is not very reusable and using a csv file as an entry is a better approach. I agree with them and here is how to do it :

First import the entries from the CSV file where you have the user list:

$users = import-csv -LiteralPath ".\users.csv" -Delimiter ","

Then we only need to go through each entry of the file. For that, the good thing is that the $users variable is a collection, so we can directly go through the objects of the collection.

foreach ($user in $users)

{ This is where my scrip will go }

Finally here is the script for the first part:

$users = import-csv -LiteralPath ".\users.csv" -Delimiter ","
foreach ($user in $users)
{
      New-ADUser -DisplayName:$username -GivenName:"test" -Name:"test" -Path:"OU=MasterIT,DC=masterit,DC=net" -SamAccountName:"test" -Server:"DC.masterit.net" -Type:"user"
      Set-ADAccountControl -AccountNotDelegated:$false -AllowReversiblePasswordEncryption:$false -CannotChangePassword:$false -DoesNotRequirePreAuth:$false -Identity:"CN=test,OU=MasterIT,DC=masterit,DC=net" -PasswordNeverExpires:$false -Server:"DC.masterit.net" -UseDESKeyOnly:$false
      Set-ADUser -ChangePasswordAtLogon:$true -Identity:"CN=test,OU=MasterIT,DC=masterit,DC=net" -Server:"DC.masterit.net" -SmartcardLogonRequired:$false

}

Of course, if you want, you can use new capabilities of Powershell 3.0 that includes running a workflow with some parallelism.

Deploy Right Management Services (RMS):

Basically the second step of the challenge is about automating the deployment of RMS and the configuration of File Server Resource Manager (FSRM).

Actually, for this step, I wanted to make it easy so I’ve relied on the existing sample that exist on TechNet : http://technet.microsoft.com/en-us/library/hh831572.aspx

If you get all the code, here is what the script looks like :

Set-ADResourceProperty –Enabled:$true –Identity:"CN=Impact_MS,CN=Resource Properties,CN=Claims Configuration,CN=Services,CN=Configuration,DC=masterit,DC=net"
Set-ADResourceProperty –Enabled:$true –Identity:"CN=PII_MS,CN=Resource Properties,CN=Claims Configuration,CN=Services,CN=Configuration,DC=masterit,DC=net"

Update-FSRMClassificationPropertyDefinition
$date = Get-Date
$AutomaticClassificationScheduledTask = New-FsrmScheduledTask -Time $date -Weekly @(3, 2, 4, 5,1,6,0) -RunDuration 0;
Set-FsrmClassification -Continuous -schedule $AutomaticClassificationScheduledTas

New-FSRMClassificationRule -Name "High PII" -Description "Determines if the document has a high PII based on the presence of a Social Security Number." -Property "PII_MS" -PropertyValue "5000" -Namespace @("C:\MasterIT") -ClassificationMechanism "Content Classifier" -Parameters @("RegularExpressionEx=Min=1;Expr=^(?!000)([0-7]\d{2}|7([0-7]\d|7[012]))([ -]?)(?!00)\d\d\3(?!0000)\d{4}$") -ReevaluateProperty Overwrite

$fmjRmsEncryption = New-FSRMFmjAction -Type 'Rms' -RmsTemplate 'MasterIT'
$fmjCondition1 = New-FSRMFmjCondition -Property 'PII_MS' -Condition 'Equal' –Value '5000'
$date = get-date
$schedule = New-FsrmScheduledTask -Time $date -Weekly @('Sunday')
$fmj1=New-FSRMFileManagementJob -Name "High PII" -Description "Automatic RMS protection for high PII documents" -Namespace @('C:\MasterIT') -Action $fmjRmsEncryption -Schedule $schedule -Continuous -Condition @($fmjCondition1)

That’s it, you just need to add both scripts together and you’re good to go !

Conclusion

The purpose of the contest is less to compete than learn the language. I strongly believe that automation will be key in the near future for IT Pros. the ones that know how to automate repetitive tasks and processes in the datacenter will the ones that companies will look for. A recent study from IDC shows that there will be a lack of Cloud-Skilled IT Workers soon. so the better trained you are, the better it will be (http://www.microsoft.com/en-us/news/features/2012/dec12/12-19CloudWorkersWanted.aspx).

Powershell may seem a bit complicated at the beginning but as you have seen here, with few simple steps you can start to automate your most common and repetitive tasks. This will give you the basic knowledge of the language and of course, you build your expertise on it. It will take some time but it is never too early to learn !

More resources on Powershell : http://technet.microsoft.com/en-us/scriptcenter/powershell.aspx

Installing “Remote Destop Web Access” Role on Windows Server 2012

Damien Caro — Mon, 17 Dec 2012 08:30:00 GMT

Recently I was building a demo on Remote Desktop Services and the installation of the role was constantly failing with error 0x800f0922. If you search on Internet, there are all kind of reasons for this error but the one that was corresponding to my situation.

Here are few troubleshooting tips that you can use to explore a similar deployment issue:

Get a log with DISM : To get additional information, use the DISM tool and get a clean log.

Go to %windir%\logs\DISM, rename the existing DISM.log file o the name of your choice.
Open a command prompt and run the following command :
Dism /online /enable-feature /featurename:WebAccess
After the command fail, open the new DISM.log file and look for your error. It may help you understand what is going on.

Cleanup the database : your component database may be corrupted so this first repair step would be to clean it.

Open a command prompt and run the following command :
Dism /online /Cleanup-Image /RestoreHealth
The logs will be in the following locations : %windir%\logs\DISM and %windidr%\logs\cbs
Look for any information regarding your problem in the log files.

Verify the configuration of the default website :

Verify if you have any SSL certificated bound to your default website. Don’t use the IIS Manager console, it will very likely not show you the reality. Use the following command :
netsh http show sslcert
Check if you any certificates bound to “any address” on port 443. They will appear like that :

IP:port                      : 0.0.0.0:443
Certificate Hash             : 23cadab1b5e066d126eea139c28459bbf30c6d5c
Application ID               : {00000000-0000-0000-0000-000000000000}
Certificate Store Name       : MY
Verify Client Certificate Revocation : Enabled
Verify Revocation Using Cached Client Certificate Only : Disabled
Usage Check                  : Enabled
Revocation Freshness Time    : 0
URL Retrieval Timeout        : 10000
Ctl Identifier               : (null)
Ctl Store Name               : (null)
DS Mapper Usage              : Disabled
Negotiate Client Certificate : Disabled

Remove this certificate from the certificate store by using the following command :
Netsh http delete sslcert ipport=0.0.0.0:443

Only the certificate bound to any IP on port 443 is supposed to cause the issue.

With this you should be able to re-start your installation of the “Remote Desktop Web Access” Role and complete successfully.

This issue has been logged in our databases and will be considered for a future update of the product.