O serviço de Active Directory Federation Service nunca esteve tão em evidência como nestes últimos anos devido à adoção de serviços na nuvem pelas empresas. Conectar a identidade do Active Directory on-premises com serviços na nuvem pode ser uma desafio. Diferente dos protocolos NTLM e Kerberos que não foram desenvolvidos para a Internet o ADFS atua como um provedor de identidade para  aplicações web modernas. Os desenvolvedores de software estão trabalhando com frameworks de desenvolvimento que remove do código a sua identidade e delega para um terceiro esta função. Você já deve ter acessado algum site de compra na Internet que além de permitir de criar uma usuário e senha também a opção de autenticar com sua conta do Facebook, Google ou Microsoft Live ID, estas empresas tem seus serviços de provedor de identidade. Na Microsoft exitem 3: Microsoft Live ID, Azure AD e ADFS.

O ADFS 3.0 suporta três protocolos de sign-in:

WS-Federation

• Desenvolvido por um grupo de empresas, incluindo Microsoft;
• Utilizado para integração com a plataforma .NET e produtos Microsoft (SharePoint, Azure, Dynamics CRM);
• Token no formato SAML 1.1;
• Mais informações em https://msdn.microsoft.com/en-us/library/ms951235.aspx e https://msdn.microsoft.com/en-us/library/bb498017.aspx.

SAML-P

• Desenvolvido por um comitê técnico do OASIS;
• Sigla de Security Assertion Markup Language (Linguagem de Marcação de Assertivas de Segurança);
• Padrão para intercâmbio de informações de autenticação e autorização entre diferentes domínios de segurança;
• Implementado como um protocolo baseado na troca de mensagens XML, atende a diversos cenários de aplicação web, incluindo SSO e propagação de identidade;
• Utilizado para integração com aplicações terceiras como: Oracle WebLogic, Lotus Notes e SAP;
• Token no formato SAML 2.0;
• Mais informações em http://go.microsoft.com/fwlink/?LinkId=193996.

OAuth

• Desenvolvido pelo Internet Engineering Task Force (IETF);
• Utilizado para integração com aplicações Single Page Application (SPA), Universal Windows Plataform (UWP) e mobile WindowsPhone, IOS e Android;
• Token no formato JWT – JSON Web Token;
• Mais informações em http://oauth.net/ e https://msdn.microsoft.com/en-us/library/dn633593.aspx.

Neste artigo vou explicar passo a passo e dar dicas para você instalar da melhor maneira o ADFS 3.0 no seu ambiente.

O ADFS 3.0 exige pouca memória, disco e processador e em 100% dos casos que trabalhei com ADFS as máquinas eram virtuais. 2 processadores, 4 GB de memória e 100 GB de disco são suficientes. O Windows Internal Database ( nativo no Windows Server ) também é uma barata e eficiente escolha como banco de dados e será usada neste exemplo.

O ADFS é totalmente sensível e dependente de certificados digitais, você precisará de 3, mas só um deles o Service Communications precisará ser público, confiável e válido na Internet. Não use certificados emitidos por Certificates Authorities Internas como o ADCS nem certificados autoassinados para esta finalidade, além de não confiável e não estar na lista de Trust Root Certificate Authorities das máquinas a lista de certificados revogados raramente estão disponíveis para consulta.

NÃO ECONOMIZE AQUI, COMPRE UM CERTIFICADO ! No meu laboratório usarei o certificado *.labpfe.com que foi emitido pela DigiCert válido por um ano. Importe o certificado na máquina com o respectiva chave privada. (já dá para notar que certificados Wild Card são suportados)

Se o seu Active Directory está no nivel functional WS 2012 / R2 poderá utilizar uma conta de serviço chamada gMSA ( Group Managed Service Accounts ). Diferente de uma conta de usuário que é usada como serviço a gMSA você não define uma senha explicitamente, existe uma negociação direta entre o serviço e o serviço de KDC ( key distributed center ) do Domain Controller correspondente. O principal benefício deste modelo é não afetar o serviço quando a senha expira ou é alterada. Fica a dica. Mas procure saber se o seu serviço suporta este tipo de conta, o ADFS suporta e vamos ensiná-lo/a como configure-lo.

Para habilitar o gMSA no Active Directory você precise executar o seguinte commando:

C:\Add-KdsRootKey

Você poderá ter que esperar até 10 horas depois deste commando para que este serviço esteja disponível em todos os controladores de domínio da floresta, não tenha pressa, aguarde este período.

No meu laboratório eu executei o commando forçandoa hora como se fosse 10 horas atrás permitindo que eu continuasse o setup do ambiente. NÃO FAÇA ISSO EM PRODUÇÃO. Faça por fases, execute o commando em um dia e o resto do setup no outro.

Uma dica rápida para ver o nível functional da floresta é executar o commando Get-ADForest

Instale a função Active Directory Federation Services

Aguarde o fim da instalação e em seguida clique no ícone para iniciar o setup de configuração. Escolha a opção Create the first federation server in a federation server farm.

IMPORTANTE: Não existe mais a opção em instalar em Standalone ( um único servidor ) mesmo que você tenha uma única máquina a criação em Farm Mode é mandatória.

Você precisa ser um Domain Admin configurar o ADFS não basta ser um Local Admin. Por padrão ele sugere o mesmo usuário que está “logado” na máquina.

No campo SSL Certificate escolha seu certificado, informe o nome da sua farm, no meu caso adfs.labpfe.com e o nome amigável que aparecerá na tela de login do ADFS Forms Based Authentication.

Aqui chegou a hora de informar a conta de serviço gMSA, só escolha este modelo se atendeu os requisites explicados no início deste artigo ( nivel functional da floresta e o Root Key habilitado e aguardado no mínimo 10 horas). No campo informe um nome para a conta, observe que não é necessário digitar uma senha. Caso contrário escolha a opção “Use an existing domain user account or group MSA” e informe uma conta e senha previamente criada no AD ( este conta pode ser Domain Users somente ).

Deixe a opção Create a database on this server using Windows Internal Database. Se preferir utilize um servidor SQL server existente. Lembre-se ! Se o seu SQL Server não estiver em Cluster e ficar indisponível toda autenticação no ADFS será comprometida.

Opcionalmente instale tudo pelo PowerShell, este é um exemplo do commando. Simples mas não muito usual porque você precisará ter o ThumbPrint do certificado em mãos.

Aguarde o fim do setup, em seguida abra o DNS Manager e crie um registro A com o nome da sua farm que foi definida no setup apontando para o IP do servidor.

IMPORTANTE : NÃO USE TIPO DE REGISTRO CNAME ( APELIDO ) POIS NÃO É SUPORTADO. SE EXISTIR UM BALANCEADOR DE CARGA DE REDE NA FRENTE APONTE PARA O ENDEREÇO IP VIP

Faça um teste simples de ping e veja se o novo da farm esta respondendo com sucesso.

DICA : Quando acessar o ADFS pela primeira vez inevitavelmente terá a segunte experiência : um pop up será aberto para autenticação e o single sign on não acontecerá. Isso acontece não por um problema no AFDS mas sim por uma característica do Internet Explorer que pelo fato de estar acessando um serviço com nome público neste caso adfs.labpfe.com o navegador acredita que não esta na intranet e sim na Internet. Para corrigir isso faça o seguinte :  Abra o internet explorer na máquina do usuário ou na sua, escolha opções de Internet, guia security, escolha local intranet e clique no botão Sites, e depois em Advanced. Adicine aqui o endereço do seu ADFS iniciando em https:

É claro que aqui estará pensando em como fazer isso em massa/lote para vários computadores da rede, afinal todos eles terão que ter esta configuração. Recomendo este artigo que explica como fazer isso.

https://blog.thesysadmins.co.uk/group-policy-internet-explorer-security-zones.html

Uma vez configurado, acesse o endereço https://fqdnadfsname/adfs/ls/idpinitiatedsignon.aspx. No meu caso https://adfs.labpfe.com/adfs/ls/idpinitiatedsignon.aspx. Clique em Sign In. ( todo ADFS bem configurado precisa expor este endpoint na Internet).

Ao clicar em Sign In você deve ser autenticado diretamente ( isso é logon único, sso, foi aproveitado o token Kerberos da sua máquina). Se abrir um Pop up você não configurar o local intranet sites no item acima corretamente.

Dica agora sobre o certificado. Por padrão o certificado gerado para Token Signing e Decrypting é auto-assinado e válido por um ano. Um ano é muito pouco tempo em especial para o Token Signing.

Vamos definir um periodo maior de tempo para estes certificados, vamos alterar para 5 anos ou 1825 dias.

Podemos ver o resultado da alteração executando o commando Get-ADFSProperties

Execute os commandos abaixo para forçar de maneira urgente a alteração dos certificados Token Signing e Decrypting

Ao abrir a console do ADFS/Certificates, a data de expiração do certificado foi alterado para 2021 e não mais 2017 como originalmente ( 5 anos )

Outra dica bacana é alterar o logo de ilustração padrão do ADFS, aquela imagem grande Azul a esquerda do formulário.

Copie uma imagem com resolução 1420 x 1080 pixesls da sua preferência e execute o commando acima referenciando a imagem. Veja o resultado como ficou legal. Se você quer saber todos os commandos para alterar outras áreas do formulário leia este artigo: https://technet.microsoft.com/en-us/library/dn280950.aspx

DICA:  O ADFS Proxy no ADFS 3.0 não existe mais. O serviço que expôe o ADFS na Internet agora se chama Web Appliction Proxy (WAP) e é uma subfeature do Remote Access e não mais do ADFS.

Não publique diretamente o ADFS na rede local diretamente na Internet. O WAP é alvo para um artigo dedicado somente para ele, pois além de atuar como ADFS Proxy ele tem outra função de publicação muito interessante que explicarei em um novo artigo. Até lá.

Nesta série de artigos de migração de serviços do Windows Server 2003 para Windows Server 2012 R2 hoje vamos ensiná-los como migrar o serviço de Internet Auhentication Services. O serviço de RADIUS / IAS é o serviço que permite dispositivos como roteadores, switchs ou pontos de acesso sem fio possam se autenticar no AD baseado em uma chave pré-compartilhada. Basicamente as informações que precisam ser migradas são : RADIUS Clients e as Políticas.

Abra o Internet Authentication Service no Windows Server 2003 e faça um levantamento dos dispositivos cadastrados e também das politicas existentes.

Agora instale um novo servidor com Windows Server 2012 R2 e em seguida instale a função Network Policy and Access Services

Em Network Policy and Access Services clique em Next.

Em select rule service selecione a opção Network Policy Server e clique em next.

Confirme e finalize a instalação.

A instalação do NPS adicionará um utilitário na pasta C:\Windows\SysW0W64\IasMigReader.exe

Copie este arquivo para o IAS do Windows 2003 Server na pasta C:\Windows\System32\IasMigReader.exe. Execute o aplicativo na linha de comando sem nenhuma sintaxe. Um arquivo chamado ias.txt será gerado na pasta C:\Windows\System32\IAS\ias.txt como ilustra a figura.

Copie este arquivo para o servidor NPS novo do Windows Server 2012 R2 e execute o seguinte comando :

NETSH NPS IMPORT IAS.TXT

Abra o a console do NPS e verá que em RADIUS Clients já aparecem as duas entradas dos dois roteadores sem fio existentes no IAS do 2003.

Clique em Connection Request Policies para garantir que as politicas também foram migradas.

Lembre-se que todos os dispositvos clientes provavelmente estão configurados para usarem o endereço IP do servidor RADIUS antigo ou seja o IAS 2003, ao invés de acessar um a um e trocar pelo novo IP, simplesmente altere o IP dos servidores. Libere o IP do servidor IAS 2003 colocando um IP temporário e altere o IP do novo servidor com o IP do servidor 2003. Pronto, simples e indolor !

Maybe you have observed two different states when you turn off a virtual machine in Azure: Stopped and Stopped (Deallocated). The question is whether what state machines continue to be charged.

You can stop the virtual machine by connecting via RDP and off by Windows, in this case it will be with status Stopped in this state it will continue charging and the internal IP and the public will be preserved.

Please note that the IP addresses were kept

It has been the state of the machine is in Stopped (Deallocated) means that you have made a shutdown by Web Management Interface Azure ( SHUTDOWN BUTTON ). In this way the cost of virtual machine will not be charged, but the public and internal IP will be deleted.

Note that the IP addresses were excluded (internal and public), if you do not book a public IP (maximum of 5 per signature), you may notice that you have a web site or application on this machine, the web site / application will be unavailable and when turning it back as a new public IP will be provisioned. You have to do a DNS entry manually if you are accessing by a proper name.

If your virtual machines are in production, already gave to note that you should never turn off the virtual machine for the web interface of Azure.

This week is very important , Azure Team is officially releasing in General Availability Azure Remote App (ARA), if you like of Remote Desktop Services, you will love ARA. Imagine the following situation : delivery your Windows Apps (LOB), Office or any app that run on Windows Server 2012 R2 to your users from their desktops, tablets Windows, IOS and Android and your cell mobile Windows Phone without to need to implement nothing on premises, basically contract them as a service, friendly we can call them like RDP as a Service. Don’t confuse with VDI (Virtual Desktop Infrastructure), in first wave only publishing apps will be available, you can’t publish a desktop to your thin clients. Microsoft is studying and validating this possible scenario in the future. By the way let’s focus how to publish your Windows App internally on Azure Remote App.

You can deploy ARA to two ways : HYBRID and CLOUD

HYBRID mode allows you establishing a VPN between Azure Remote App Tenant / Network and you on premises environment and join your virtual machine image with your windows apps installed to your Active Directory Domain. However if your windows app needs to connect to a database or to do a query to any service to your on premises network ( client-server ) , it is possible.

CLOUD mode is more simple, less complex comparing to HYBRID scenario, you don’t need establishing VPN and your identity can be provided by Azure Active Directory or ADFS on premises. It resides completely in Azure and is created using the Quick create option in the Azure management portal.

TIP : Your subscription for Azure Remote App comes with template image that contain Office 2013 for trial use programs.

I am supposing that you already created Remote App service, but you don’t do that yet, create Remote App service. It can take up to 30 minutes to provision your service. After your Remote App service has been created, go to the Remote App quick start page to continue, during your publishing you need do select your custom image including your internal windows app, it is here that begins my article.

Azure Remote App uses Virtual Machines Generation 1 to provide publishing applications, VM Generation 2 is not supported so far, by the way you can’t deploy VHDX file, only VHD, it can be Dynamically or Fixed, we suggest Dynamically to accelerate upload and consume less space on Azure Storage, furthermore Encryption File System (EFS) need to be disabled and Remote Desktop Session Host and Desktop Experience installed. So let’s create a virtual machine on Hyper-V ( Hyper-V Server or Hyper-V Client of your Windows 8).

I am using my laptop with Windows 8.1 Hyper-V. Open your Disk Management (DISKMGMT.MSC), to Action menu and select Create VHD, select VHD format and Dynamically expanding. Take care to size, VHD must be maximum of 127 GB and multiple of 1024, it is mandatory, if you don’t do that you can have issues when try to do upload to Azure Store Blob. I have create a file of 60 GB of size, so 60 x 1024 = 61440 MB.

The disk must be initialized using the Master Boot Record (MBR) partitioning style. The GUI partition table (GPT) partition is not supported.

Create volume, select NTFS file system and 64K on Allocation unit size to better performance, on Volume label, fill out to your preference name, here is AzureRemoteAppCI.

After that, detach VHD to release disk.

Open your Hyper-V Manager, create a new virtual machine, chose your preference path folder and select Generation 1 ( be careful, don’t choose Generation 2)

Select your VHD file that you created previously, use an existing virtual hard disk. ( memory and processors you need to adjust to your app, at least 2 processors and 2 GB of memory is recommended )

Select your ISO of Windows Server 2012 R2.

Start VM and during installation select Standard version with GUI interface.

You can create more than one volume but only one instance of operation system must be installed

Wait for finishing operation system installation. ( Don’t forget only WS 2012 R2 is supported ).

Take a Log On, don’t join virtual machine on domain and install from Server Manager the following role and feature : Role Remote Desktop Session Host and Feature Desktop Experience

Desktop Experience under User Interfaces and Infrastructure

Wait for rebooting, after disable EFS, Run the following command at an elevated command windows:

C:\Fsutil behavior set disableencryption 1

Now it is time to install your application ( don’t install your windows app before RDSH, Desktop Experience installed ). For testing purpose I have download Project My Screen App, this software project my Windows Phone screen to my monitor, it is a interesting app to do demos for Windows Phone. You can do download it here. Of course here is time to install your Windows App ( .MSI file )

http://www.microsoft.com/en-us/download/details.aspx?id=42536

VERY IMPORTANT : Open your OneNote or Notepad and register full PATH and .exe file. Because you will not have access to VM Desktop do browser this file when you want to publish it, you need know it.

In my lab is that below

C:\Program Files (x86)\ProjectMyScreenApp\ProjectMyScreenApp.exe

Take all settings that you need like configuration files, database setting and other thinks. All right ? Test your application, run it a lot time to guarantee that all was done, Now it is time to do a system preparation and to do upload VHD to Azure Storage Cloud.

SYSPREP the image. At an elevated command prompt, run the following commando :

C:\Windows\System32\Sysrep\Sysprep.exe /generalize /oobe /shutdown

Note : Don’t use the /mode:vm switch of the SYSPREP command even through this is a virtual machine.

Wait for VM is shutdown, open your Azure Portal, select Remote App session and TEMPLATE IMAGES, select Upload a Template Image arrow.

Fill out of a friendly name of your custom image in my case ProjectMyScreenApp-TEMPLATE and region that you want to deploy, click to arrow.

Download script powershell Upload-AzureRemoteAppTemplateImage.ps1

Open your Azure Power Shell as a Administrator, run Add-AzureAccount cmdlet, fill out with your credential of Azure Subscription. Copy and past all command how are in COMMAND TO RUN DIALOG BOX, don't change nothing, after you run a dialog prompt will open to you select your VHD, upload will start, wait for finishing, it can take some minutes if your internet access is not so good. Just wait !!

When all are done, you are going to see templates available and Ready to use.

Now we are going to publish our windows app, clique App Services, REMOTE APP, Quick Create, put your Friendly name, select your region and select your template that you have been created

Wait for finishing, after click on Dashboard and publish remote app programs

Now put your friendly name that remote users will see and full path of your .EXE app

Give access permission, select on USER ACCESS and put your e-mail address, in my case my personal email, you have your Active Directory objects synchronized by DIRSYNC or Azure Active Directory Sync, you can grant access for your corporate users like alias@domain.com. Flag should be green. One invite will be sent to users inside.

Done ! Now do download of Azure Remote App client, just access link below, it does not matter if your device is IOS, Android or Windows, it is smart do detect your operation system and suggest you a correct version.

https://www.remoteapp.windowsazure.com/

When you open Microsoft RemoteApp, you need to put your e-mail, my e-mail address is @outlook.com, it will redirect to authentication page of outlook.com, when I put my e-mail and password will show for us. If you are using your AD users, it will redirect to your Active Directory Federation Service (ADFS) Web Application Proxy ( or ADFS Proxy ) page.

Click on your Window App and wait for open. Done Project My Screen App is working and showing for me. 

Believe or not, you can access by your Windows Phone too, just download from Windows Store, REMOTE DESKTOP APP, it is available here

http://www.windowsphone.com/pt-br/store/app/microsoft-remote-desktop-preview/299b09ab-207e-441c-9e8e-c8d66c20b76b 

Clique on + button and inform your credentials, done, all apps are available to you connect.

All apps are available for me to use.

When you click in Paint, it starts and

When I click on Project My Screen app I have a Project My Screen inside of my real physical Project My Screen

Azure Remote App Rocks ! This is all guys, I hope that this article can help you day by day of IT Pro Azure Admin !

Official document of Cloud Deployment for Azure Remote App is here.

http://azure.microsoft.com/en-us/documentation/articles/remoteapp-create-cloud-deployment/

Everyone knows the physical address (MAC address) of a network adapter must be unique, this condition is also true for virtual network adapters, if two or more virtual machines have the same MAC address, you are going to see Event ID 28, Source: VMSMP often appears in event view of the Hyper-V host. This is a real problem because one of the machines lose network connectivity affecting services.

Microsoft has ownership of the MAC addresses that begin by 00-15-5D. This address scope is reserved for Hyper-V. If you run the command IPCONFIG /ALL in a virtual machine and the MAC address starts with 00-15-5D know that this virtual machine is running on Hyper-V. Did you know that?  For you to see which address scope Mac Address, open Hyper-V, right click the server name and select Virtual Switch Manager, then select MAC Address Range in the category Global Network Manager. I did this on my server and look down the start and end addresses.

There are a range of initial and final that known as minimum and maximum respectively address. Note that both the minimum and maximum address 00-15-5D begin with and the last address begins with 00 and ends with FF. Let's convert the address 00 and FF hex to decimal.

00 hexadecimal = 00 decimal

FF hexadecimal = 255 decimal

That means we have 254 available MAC addresses on Hyper-V, the first virtual machine created will have the MAC address 00-15-5D-00-03-01, the second one 00-15-5D-00-03-02 and so on until you reach the 00-15-5D-00-03-254 address. But as the addresses 00-03 were created? If you run the command ipconfig on the host Hyper-V you will have the answer. The third and the fourth octet of the IP address 172.16.0.3 were converted from decimal to hexadecimal

00 decimal = 00 hexadecimal

03 decimal = 03 hexadecimal

Gilson you're saying that the range of MAC address of Hyper-V physical server is created based on the IP address of the server? Yes, that's right, it uses the third and fourth IP address. This information is stored in the following registry key

 HKLM\SOFTWARE\Microsoft\Windows NT\CurrentCurrentVersion\Virtualization

When you change the IP of the server and restarts the service of Hyper-V the range of MAC address does not change. Have you noticed that if another Hyper-V server has even temporarily the 172.16.0.3 IP address, it will have the same range of MAC address and the virtual machines have the same MAC address that a conflict will occur? Carefully before installing the Hyper-V in Windows make sure that the IP address used was never used on another Hyper-V server before, because there is a possibility of generating a conflict problem in the environment.

If you have two or more Hyper-V servers with the same range of MAC address, you have a problem, you must remove the two registry keys on one of the Hyper-V servers, remove the MaximumMacAddress and MinimumMacAddress keys and restart the service Hyper-V (no need to restart the server), In my lab I changed the address of the Hyper-V 172.16.0.3 to 172.16.0.4. After that, restart the service below:

Observe that MAC address range on Hyper-V was changed from 00-03 to 00-04

And the virtual machines that already had the old MAC address 00-03 with conflict? they will be dynamically changed to 00-04? The answer is no, only new virtual machines created. To solve the existing MAC addresses on virtual machines 00-03 to 00-04, you need to remove the virtual network and add a new one.

After all this, take a look at the new MAC virtual machine and make sure that the address was changed to the 00-04 range, making these changes the IP address is lost, you need to configure it again.

For finished this post, don’t forget that System Center Virtual Machine Manager 2008/2012 takes a different approach when managing virtual machines and MAC addresses by using static MAC addresses from a defined pool. This pool is used across all hosts. By default the pool is in the range of 00-1D-D8-B7-1C-00 to 00-1D-D8-F4-1F-FF for 3,998,719 available MAC addresses

NUMA attempts to close the gap between the speed of processors and the memory they use by providing separate memory on a per-processor basis, thus avoiding the performance hit caused when multiple processors try to access the same memory. Each block of dedicated memory is known as a NUMA node.

The default virtual NUMA topology that is projected into a Hyper-V VM is optimized to match the host’s NUMA topology, as shown in this figure.

A node consists of a set of memory and logical processors. I'll teach you how to identify the amount of memory and logic processor that each node has. This is very important because when you start a virtual machine, it creates an affinity with one of the nodes in a virtual machine should not have more memory than a node, because in this case you will need access to a memory in the remote node, this is called NUMA Spanning, and it is enabled by default in Hyper-V as shown in the image below.

I'm using my corporate notebook, and standard notebook will rarely have more than one Node NUMA, in large servers is common to have between 4-8 nodes in. First I open the Task Manager to see the number of logical processors and memory available.

Task Manager to see total memory

Observe that my computer has 4 logical processor and 8 GB of memory.

Open Performance Monitor and look for Hyper-V VM Vid Numa Node counter, expand arrow and, select PageCount and ProcessorCount and click on Add and OK, here you can see immediately how many nodes in Instances of select objects, there is only one Numa Node : VID NUMA0

Now, change visualization mode to Report

Ignore the last three zeros, immediately you already can see in ProcessorCount the number of Logical Processors that are 4, value that was expected. Now to determine how many memory we need to do some calculations. Each PageCount is equivalent 4KB, so open your Calculator.

Take the amount of PageCount and multiply it by 4.

divide the value by 1024 twice, this way you will find the value in GB.

There, we found the value 7.8 we can consider 8GB which is exactly the amount of physical memory on the computer. Do the same for all nodes in order to determine the other values??. You will observe that the values ??are equal, and that the sum of all processors and memory of each node must match exactly the maximum amount identified by the Task Manager

Hello everybody, everyday often some information technology professionals ask me if it is possible to install Hyper-V on a virtual machine. We all know that a HYPERVISOR can only be installed and officially supported in production physical servers, this prevents many professionals study and increase your knowledge of Hyper-V.

If you have tried to install the Hyper-V in Windows Server 2008 R2 or 2012 through Server Manager probably encountered the following message: The following message appears preventing you from continuing the process: Hyper-V can not be installed: The hypervisor is already running.

Now I have good news and bad news for you who are eager to learn how to install the Hyper-V virtual machine. The good news is that through PowerShell you can install but the bad news is that unfortunately you are not able to start the virtual machines, but for self-study lab and is already a great improvement you can create a cluster of Hyper-V and verify in practice how it all works. However I will teach you how to install the Hyper-V as well as the Cluster service.

The first thing you need to do is to open and change the PowerShell execution policy scripts to RemoteSigned then run the following command to install the Hyper-V :

Enable-WindowsOptionalFeature –Online -FeatureName Microsoft-Hyper-V –All -NoRestart

PS: Do not restart the virtual machine

The above command installs only the hypervisor but does not install the administration tools, so you can manage the Hyper-V within the virtual machine you must install RSAT for Hyper-V to do this run the following command:

 Install-WindowsFeature RSAT-Hyper-V-Tools -IncludeAllSubFeature

Now I suppose you want to create a cluster then you need to install the Cluster service,  run:   

Install-WindowsFeature RSAT-Clustering -IncludeAllSubFeature

Optionally you can install Multipath I/O to enable multiple paths to the storage, if this is your case follow:

Install-WindowsFeature Multipath-IO

The image below shows a summary of all commands, simply restart to finalize the virtual machine with the command:

Restart-Computer

Done ! Now just open the console of the Hyper-V Manager and create a virtual machine, note that I created a virtual machine named VM-VM-INSIDE. Create your cluster and have fun !!!

DON’T FORGET ! BEFORE STARTING IT IS IMPORTANT TO KNOW THAT THIS ENVIRONMENT IS NOT SUPPORTED BY MICROSOFT. USE IT ONLY FOR SELF STUDY AND LABORATORY OF CLUSTER OF HYPER-V

So,I decided to do step by step all procedures to install Oracle Linux on Hyper-V, of course first step was to make a download of ISO of Oracle Linux from Oracle Web Site (www.oracle.com), I’ve used the version Release 6 Update 3 64 bits. I didn’t to try to use oldest versions but feel free to validate it. 

Make a download of LIS 3.4 HERE http://www.microsoft.com/en-us/download/details.aspx?id=34603

Second step was to create a Virtual Machine without Network Interfaces ( yes ! no NICs synthetic or legacy). So create a VM into Hyper-V normally after remove Network Adapter, attach ISO and start it. Take a look VM settings below :

After that, install operating system using default values, during installation you will observe that Network settings will be not available to set IP address, don’t worry and continue and finish installation. Select “Install or upgrade an existing system”

Everybody know that Oracle Linux is a copy of Red Hat Linux, on the past there companies had contracts agreements broken because all customers that decided to use Oracle on Linux, Red Hat always was recommended, both companies won and had revenues. Leaving disagree between these companies, let’s go back to this article, Configure Network button will not be available, don’t worry and go, clique Next.

Wait for finishing, logon root and your password, use VI editor, it is easier and simple. I hope that you know it, it not visit http://www.linux.org/article/view/using-the-vi-editor

Edit /etc/grup.conf

# vi /etc/grub.conf set default = 1

# vi /etc/sysconfig/kernel, delete –uek from last of DEFUALT KERNEL..line

Reboot ( it is mandatory )

Insert ISO LIS 3.4 into virtual dvd

login as root again

# mount /dev/cdrom /media

# cd /media/RHEL63

Install Hyper-V Integration Services, execute ./install.sh

# ./install.sh

Shutdown virtual machine (#halt)

Insert Network Adapter (not legacy)

Start VM, integration services should be fine, before editing and configure network settings below

# cd /etc/sysconfig/network-scripts

# cp ifcfg-lo ifcfg-eth0

Edit ifcfg-eth0 and define your configurations (ip, mask, device name…)

#vi /etc/sysconfig/network-scripts/ifcfg-eth0

DEVICE=eth0

BOOTPROTO=static

IPADDR=YOUR IP

NETMASK=YOUR MASK

ONBOOT=yes

NAME=eth0

Now create or edit /etc/sysconfig/network file and include below information, gateway is yours

# vi /etc/sysconfig/network ( if it does not exist please create it )

NETWORKING=yes

HOSTNAME=your hostname

GATEWAY= your IP gateway

Edit /etc/resolv.conf and put at least one DNS IP server

# vi /etc/resolv.conf

nameserver 8.8.8.8

or use system-config-network utility

Select Device Configuration

Finally, execute # ifup eth0 to start network interface 0 and after # ifconfig, observe that network interface eth0 is being showed now.

Linux Integration Services provides support for the modinfo command. To get module information for each installed kernel module, run the following command :

#/sbin/modinfo hv_vmbus

This command can be repeated for all kernel modules (hv_vmbus, hv_netvsc, hv_storvsc, hv_blkvsc, and hv_utils).

To verify that all subcomponents are running as the root user, issue the following command at a shell prompt :

,Remember : Don’t FORGET if your VM is on High Availability and you want to do Live Migration, MAC Address needs to be Static and no Dynamic

Change it on Advanced Features on Network Adapter Properties VM.

Well done ! Welcome to Linux on Hyper-V !! Interoperability is here !

Officially Oracle Linux is not supported by Microsoft, but it works perfectly. To learn more about which operating systems are officially supported, please visit : http://technet.microsoft.com/en-us/library/cc794868(v=ws.10).aspx

Windows Server 2012: The Definitive Cloud OS

Everybody knows that you can’t promote Additional Domain Controllers running Windows Server 2008 R2 for example to AD 2003 Forest by default if you didn’t extend Schema before. But take care, now if you admin account is member of Schema Admins and Enterprise Admins and you try to promote a Windows Server 2012 as Domain Controller you can make this, like Exchange Server without extending Schema manually before, this is new in WS 2012.

The tip is, if you know the number of Schema you know which version of you Active Directory and if you already ready to promote on Active Directory newest. Basically there are five ways to discover your AD Schema Version, before I explain for you, please take a look this table below.

First I am going to show how to discover this number using Registry, choice any Domain Controller and open REGEDIT, navigate on HKLM\System\CurrentControlSet\Services\Parameters, and look Schema Version value, this example the number was 31, if you see the table above, it means that only Domain Controllers 2003 are allowed if Domain and Forest Functional Level is set to Windows Server 2003 obviously.

Now I hope that this same number will be in other location (attributes), otherwise I’ll get frustrated, well, let’s show this.

Through ADSIEDIT, open it in an Domain Controller, don’t forget that Active Directory 2003 and higher has five partitions, Schema, Configuration, Domain, DomainDnsZones and ForestDnsZones. Connect and expand CN=Schema,CN=Configuration and clique in properties, localize objectVersion attribute and take a look value number, 31.

Through command line, it is so simple, simply run : C:\Windows\System32\SCHUPGR.EXE, observe line Current Schema Version, it is 31

Through DSQUERY command DSQUERY * CN=Schema,CN=Configuration,DC=contoso,DC=corp –Scope base –attr objectVersion

And finally, using PowerShell, Get-ADObject “CN=Schema,CN=Configuration,DC=Contoso,DC=Corp” –Properties objectversion

So now if you want to know which version you’re up and ready to promote new Domain Controllers, use the following methods above.

Enjoy and have fun !

You can switch between a Server Core installation and full installation in Windows Server 2012 because the different between these installation options is contained in two specific Windows features that can be added or removed. The firs feature, Graphical Management Tools and Infrastructure (Server-Gui-Mgmt-Infra), provides a minimal server interface and server management tools such as Server Manager and the Microsoft Management Console (MMC). The second feature, Server Graphical Shell (Server-Gui-Shell), is dependent on the first feature and provides the rest of the GUI experience, including Windows Explorer.

To convert a full installation to a Server Core installation, just remove these two features in Server Manager. Note that removing the first feature will automatically remove the second.

This first example I will remove only Graphical Management Tools and Infrastructure

After rebooting you can see this interface, called minimal server interface, SCONFIG command interface behind and Dashboad (ServerManager) in front.

Now when I remove the second option, Server Graphical Shell and after rebooting

I can see only prompt command, execute C:\PowerShell and open PowerShell command, execute C:\[PS] Get-WindowsFeature and take a look User Interface and Infrastructure session, all sub session will be unchecked.

Probably you are thinking that is possible to convert a Core to Full the same way, yes, you are right, in fact only install this two feature again and return a Full Version quickly ! Simple do it (Add-WindowsFeature Server-Gui-Shell) and reboot it

During reboot you are going to see  this screen, Configuring Windows feature, don’t turn off you computer . 

Nice, now you have a Full installation of Windows Server 2012 again. Enjoy !

The relationship between the Minimal Server Interface and the Server with a GUI installation levels is illustrated here.