DNS

Installation

1. Open Server Manager
2. Click Manage
3. Click Add Roles and Features
4. The Add Roles and Features Wizard window will appear
   1. On the Before you begin screen click Next
   2. On the Select installation type window click Role-based or feature-based installation and click Next.
   3. On the Server destination server window select
      1. Select a server from the server pool
      2. Under Server Pool select the server name

• Click Next

1. On the Select server roles screen select DNS
   1. On the pop-up window click Add Features
   2. Click Next
2. On the Select features screen click Next
3. On the DNS Server screen click Next
4. On the Confirm installation selections screen click Restart the detitanation server automatically if required. Click Yes to the pop-up then click Install
5. Wait for the installation to complete.
6. Once the installation is complete click the Close

Configuration

1. Click Start -> Windows Administrative Tools -> DNS.
2. In the DNS Manager window click on the server name.
3. In the right pane, right-click Forward Lookup Zones and then click New Zone…
4. In the New Zone Wizard on the Welcome screen click Next.
5. On the Zone Type screen select Primary zone and click Next.
6. On the Zone Name screen enter the name of the Zone and click Next
7. On the Zone File screen leave the default selections and click Next.
8. On the Dynamic Update screen select Allow both nonsecure and secure dynamic updates and click Next.
9. On the Complete the New Zone Wizard screen click Finish.

DHCP

Installation

1. Open Server Manager
2. Click Manage
3. Click Add Roles and Features
4. The Add Roles and Features Wizard window will appear
   1. On the Before you begin screen click Next
   2. On the Select installation type window click Role-based or feature-based installation and click Next.
   3. On the Server destination server window select
      1. Select a server from the server pool
      2. Under Server Pool select the server name

• Click Next

1. On the Select server roles screen select DHCP
   1. On the pop-up window click Add Features
   2. Click Next
2. On the Select features screen click Next
3. On the DHCP Server screen click Next
4. On the Confirm installation selections screen click Restart the detitanation server automatically if required. Click Yes to the pop-up then click Install
5. Wait for the installation to complete.
6. Once the installation is complete click the Close

5. On the Server Manager window click the Warning icon at the top and then click Complete DHCP Configuration.
6. The DHCP Post-Install configuration wizard opens up.
   1. On the Description screen click Commit.
   2. On the Summary screen click Close.

 Configuration

1. Click Start -> Windows Administrative Tools -> DHCP.
2. In DHCP window expand the server in the left pane.
3. Right-click IPv4 and click New Scope…
4. The New Scope Wizard window appears.
   1. Click Next.
   2. On the Scope Name screen enter a name and description for the scope and click Next.
   3. On the IP Address Range screen enter the Start IP address and End IP address Verify that the Subnet mask is correct and then click Next.
   4. On the Add Exclusions and Delay screen do not enter any information, click Next.
   5. On the Lease Duration screen change the Days to 1, click Next.
   6. On the Configure DHCP Options screen select Yes and click Next.
   7. On the Router (Default Gateway) screen do not enter an IP address, click Next.
   8. On the Domain Name and DNS Servers screen enter the IP address of the server and click Add, then click Next.
   9. On the WINS Servers screen do not enter any IP address, click Next.
   10. On the Activate Scope screen select Yes and then click Next.
   11. On the Completing the New Scope Wizard screen click Finish.
5. Reboot the server.

MDT

Installation

1. Install ADK
   10. Go to Windows ADK website and download the latest Windows ADK for Windows 10.
   11. Run exe
   12. The Windows Assessment and Deployment Kit – Windows 10 window opens.
   13. On the Specify Location screen
       1. select the Download the Windows Assessment and Deployment Kit – Windows 10 for installation on a separate computer radio button.
       2. Browse to the desired download path to save the files.

• Click Next

1. On the Windows Kits Privacy screen select No and then click Next.
2. On the License Agreement screen click Accept.
3. On the Download is complete screen click Close.
4. Copy the files to the server if needed.
5. Open the folder with the downloaded files.
6. Run adksetup.exe
7. The Windows Assessment and Deployment Kit – Windows 10 window opens.
8. On the Specify Location screen browse to the desired install path and click Next.
9. On the Windows Kits Privacy screen select No and then click Next.
10. On the License Agreement screen click Accept.
11. On the Select the features you want to install screen select the following items and then click Install
    1. Deployment Tools
    2. Windows Preinstallation Environment (Windows PE)

• User State Migration Tool (USMT)

1. Wait for the installation to complete.
2. Uncheck Learn more about the Windows Assessment and Deployment Kit and then click Close.

2. Install MDT
   1. Go to the Microsoft Deployment Toolkit site and download the latest version of MDT.
   2. Run the MDT setup.
   3. On the Welcome screen click Next.
   4. On the End-User License Agreement screen select I accept the terms in the License Agreement and click Next.
   5. On the Custom Setup screen select the desired installation location and click Next
   6. On the Customer Experience Improvement Program screen select I don’t want to join the program at this time and click Next.
   7. On the Ready to install screen click Install.
   8. When the installation completes click Finish.

Configuration

Adding Deployment Share

1. Click Start -> Microsoft Deployment Toolkit -> Deployment Workbench.
2. The Deployment Workbench window opens.
3. An existing deployment share can be added or a new one can be created.
   1. Opening an existing deployment share.
      1. Right-click Deployment Shares and click Open Deployment Share.
      2. The Open Deployment Share Wizard appears.

• On the Path screen browse to the deployment share and click Next.

1. On the Summary screen click Next.
2. When the operation completes click Finish on the Confirmation screen.

1. Creating a new deployment share.
   1. Right-click Deployment Shares and click New Deployment Share.
   2. The New Deployment Share Wizard appears.

• On the Path screen browse to the desired location for the new deployment share and then click Next.

1. On the Share screen type in the desired name of the share or leave the default and then click Next.
2. On the Descriptive Name screen type in a description for the share and then click Next.
3. On the Options screen select the options you would like to have the deployment perform and then click Next. Note: these can be changed later.

• On the Summary screen review the selections and then click Next.
• Once complete click Finish on the Confirmation screen.

Update username and password for Deployment Share

1. Create Deployment service account
   1. Click Start -> Windows Administrative Tools -> Computer Management.
   2. Expand System Tools -> Local Users and Groups.
   3. Right-click Users and click New User…
   4. On the New User window enter the information for the MDT Deployment service account and then click Create.
   5. Close the Computer Management window
2. Set Share and Security Permissions
   1. Open File Explorer.
   2. Navigate to the deployment share.
   3. Right-click on the deployment share and click Properties.
   4. Set the following permissions for the Deployment service account on the Deployment share.
      1. Share permissions – Read
      2. Security permissions – Read & Execute, List Folder Contents, Read
   5. Add Deployment service account to the Bootstrap.ini file.
      1. Open the MDT Deployment Workbench.
      2. Right-click the deployment share and then click Properties.
      3. Click the Rules tab and then click Edit ini in the lower right of the Properties windows.
      4. The Bootstrap.ini file will open in Notepad.
      5. Under the [Default] section of the Bootstrap.ini file enter the following information.
         1. UserID=Deployment service account name
         2. UserDomain=Name of the deployment server

• UserPassword=Password for the deployment service account

1. Save and close the Bootstrap.ini file.
2. Close the deployment share Properties window.
3. Right-click on the Deployment share and click Update Deployment Share.
4. On Options screen of the Update Deployment Share Wizard select Completely regenerate the boot images and then click Next.
5. Click Next on the Summary
6. Click Finish on the Confirmation

Windows Deployment Services (WDS)

Installation

1. Open Server Manager
2. Click Manage
3. Click Add Roles and Features
4. The Add Roles and Features Wizard window will appear
   1. On the Before you begin screen click Next
   2. On the Select installation type window click Role-based or feature-based installation and click Next.
   3. On the Server destination server window select
      1. Select a server from the server pool
      2. Under Server Pool select the server name

• Click Next

1. On the Select server roles screen select Windows Deployment Services
   1. On the pop-up window click Add Features
   2. Click Next
2. On the Select features screen click Next
3. On the WDS screen click Next
4. On the Select role services screen select both Deployment Server and Transport Server, click Next
5. On the Confirm installation selections screen click Restart the detitanation server automatically if required. Click Yes to the pop-up then click Install
6. Wait for the installation to complete.
7. Once the installation is complete click the Close

Configuration

1. Click Start -> Windows Administrative Tools -> Windows Deployment Services.
2. The Windows Deployment Services window opens.
3. In the left pane expand Servers
4. Right-click on the server and click Configure Server
5. The Windows Deployment Service Configuration Wizard
   1. On the Before You Begin screen click Next
   2. On the Install Options screen select Standalone server, click Next
   3. On the Remote Installation Folder Location screen select the location path and then click Next.
   4. On the Proxy DHCP Server screen select both options and then click Next
   5. On the PXE Server Initial Settings screen select Respond to all client computers (known and unknown), click Next.
   6. On the Task Progress screen, click Finish when it completes.
6. If the WDS server did not start, right-click the server and select All Tasks -> Start.
7. Right-click on the server and click Properties.
8. On the server properties page go to the Boot tab.
   1. Under the PXE Boot Policy section select Continue the PXE boot unless the user presses the ESC key for both Known and Unknown clients.
   2. Click OK
9. Under the server right-click Boot Images and click Add Boot Image…
10. The Add Image Wizard window appears.
    1. On the Image File screen browse to the file location of the MDT boot image (it is in the boot folder in the deployment share) and then click Next.
    2. On the Image Metadata screen type in the name and description for the image and then click Next.
    3. On the Summary screen review the information and then click Next.
    4. On the Task Progress screen click Finish when complete.

Finished

##################################################################
# Microsoft provides programming examples for illustration only, 
# without warranty either expressed or implied, including, but not 
# limited to, the implied warranties of merchant-ability and/or 
# fitness for a particular purpose. 
#
# This sample assumes that you are familiar with the programming 
# language being demonstrated and the tools used to create and debug 
# procedures. Microsoft support professionals can help explain the 
# functionality of a particular procedure, but they will not modify 
# these examples to provide added functionality or construct 
# procedures to meet your specific needs. If you have limited 
# programming experience, you may want to contact a Microsoft 
# Certified Partner or the Microsoft fee-based consulting line at 
# (800) 936-5200. 
#
# For more information about Microsoft Certified Partners, please 
# visit the following Microsoft Web site:
# https://partner.microsoft.com/global/30000104
#
###################################################################

Param(
[Parameter(Mandatory=$true)][string]$object
)

#This will load the PowerShell SSH module.
if (Import-Module -name posh-ssh -ErrorAction Ignore) {write-host "Module is loaded"}
else {
    write-host "Module is not loaded"
    write-host "Module is being loaded"
    #############################################################################
    #The Posh-SSH.zip file needs to be copied to the Modules directory prior to running.
    #DO NOT CHANGE THIS
    $targetondisk = "$($env:USERPROFILE)\Documents\WindowsPowerShell\Modules"
    ##############################################################################
    $directory = Get-Location
    $file = $directory.Path + "\Posh-SSH.zip"
    New-Item -ItemType Directory -Force -Path $targetondisk | out-null
    $shell_app=new-object -com shell.application
    $zip_file = $shell_app.namespace($file)
    Write-Host "Uncompressing the Zip file to $($targetondisk)" -ForegroundColor Cyan
    $destination = $shell_app.namespace($targetondisk)
    $destination.Copyhere($zip_file.items(), 0x10)
    Write-Host "Module has been installed" -ForegroundColor Green
    Import-Module -Name Posh-SSH
}



#This function will copy the tar file and install file to the target system and then install them.
Function InstallSCCM ($linuxsystem, $creds)
{
    #####################################################
    #Update these variables for your environment.  The Tar file and install file are to be local to the systme running the script.
    $CCMTarFile = "C:\temp\script\ccm-Universalx64.tar"
    $CCMInstallFile = "C:\temp\script\install.sh"
    $SiteCode = "STC"
    $MP = "MP-FQDN"
    #####################################################
    $tempdir = "/tmp/sccmInstall"
    [securestring]$passwd = $creds.Password.Copy()
    $session = New-SSHSession -ComputerName $linuxsystem -Credential $creds
    $shell = New-SSHShellStream -SessionId $session.SessionId

    If ($session.Connected) {

        Write-Host "Installing SCCM on " $linuxsystem
        $shell.Read()
        Start-Sleep -Seconds 2
        $shell.Read()
        Invoke-SSHStreamExpectSecureAction -ShellStream $shell -Command "sudo su -" -ExpectString "ssword" -SecureAction ($passwd) > $null
        $shell.Read()

        $shell.WriteLine("mkdir $($tempdir)")
        $shell.Read()
        $shell.WriteLine("chmod 777 $($tempdir)")
        $shell.Read()

        Set-SCPFile -ComputerName $linuxsystem -Credential $creds -LocalFile $CCMTarFile -RemotePath $tempdir
        Set-SCPFile -ComputerName $linuxsystem -Credential $creds -LocalFile $CCMInstallFile -RemotePath $tempdir

        $shell.writeline("ls $($tempdir)")
        $shell.Read()
        Start-Sleep -s 2
       

        $fileexist = $shell.Read()
    
        IF ($fileexist -match "ccm-Universalx64.tar" -and $fileexist -match "install.sh") {
    
            $shell.WriteLine("chmod +x $($tempdir)/install.sh")
            write-host "Starting Installation..."
            $shell.WriteLine("$($tempdir)/install.sh -mp " + $MP + " -sitecode " + $SiteCode + " -clean $($tempdir)/ccm-Universalx64.tar")
    
            Do {
                $output = $shell.Read()
               } until ($output -match "complete")
            
            $output
            write-host "Performing Clean-up"
            Start-Sleep -s 5
            $shell.WriteLine("rm -rf $($tempdir)")
            Start-Sleep -s 5
            $shell.Close()
            Remove-SSHSession -SessionId $session.SessionId > $null
        }
        Else {
            write-host "Files do not exist on system"
            $shell.WriteLine("rm -rf $($tempdir)")
            $shell.Close()
            Remove-SSHSession -SessionId $session.SessionId > $null
        }
    }
    Else {
        write-host "Failure to connect to system"
        get-sshsession | Remove-SSHSession > $null
    }
}

#Asks for Linux Credentials
$creds = Get-Credential

#tests if the parameter is a single system name or a file with a list of systems.
If (Test-Path $object) {
    foreach ($linuxsystem in Get-Content -Path $object){
        InstallSCCM $linuxsystem $creds
        }
    $creds.Password.Dispose()
    }
Else {
    $linuxsystem = $object
    InstallSCCM $linuxsystem $creds
    $creds.Password.Dispose()
    }

Configuring the RRAS Server's NICs...

• Uncheck everything except for TCP/IPv4.
• Go into the properties of TCP/IPv4 and configure:
  • IP Address
  • Gateway
  • DNS Servers
  • Advanced Settings -> WINS -> Disable NetBIOS over TCP

• Uncheck TCP/IPv6.
• Go into the properties of TCP/IPv4 and configure:
  • IP Address
  • DNS Servers

Installing the RRAS Roles and Features...

• Before You Begin: Click Next
• Installation Type: Role-based -> Click Next
• Server Selection: Select a server from the server pool -> RRAS-Server -> Click Next
• Server Roles: Check Remote Access -> Click Next
• Features: Click Next
• Remote Access: Click Next
  • Role Services:
    • Direct Access and VPN (RAS)
      • Click Add Features on the pop-up window
    • Routing
    • Click Next
• Web Server Role (IIS): Click Next
  • Role Services
    • Accept Defaults: Click Next
• Confirmation: Click Install

Setting up / configuring the VPN in Azure...

• Name - RRAS-S2S-Vnet
• Address space - 10.2.0.0/16
  • There will need to be 2 subnets created so the address space here will have to be big enough for your 2 subnets.  I am going to have 2 /24 subnets under this to help clarify the differences in the 2 subnets.
• Subnet name - default
  • This is the subnet you will use for your Azure VMs.
• Subnet address range - 10.2.0.0/24
  • This is the address range that will be used for the Azure VMs.
• Subscription - pick your subscription
• Resource group - S2S-Test
  • This is creating a resource group that we will use for the rest of the resources.
• Location - Pick the location you want your Virtual Network to reside.

• Name - GatewaySubnet
  • This has to be the name of the subnet for the Virtual Network Gateway.
• Address Range - 10.2.1.0/24
  • This is the IP range for the RRAS server to use.

• Gateway type: VPN
• VPN type: Route-based
• Subscription: your Azure subscription

• Name: RRAS-S2S-LclNetGW
• IP address: Enter the public IP address of network that the RRAS server is on
• Address space: This is where the on prem network address space is set (e.g. 192.168.1.0/24).
• Subscription: Select your Azure subscription
• Resource group: S2S-Test
• Location: East US

On the Add connection blade fill in the following:

• Name: RRAS-S2S-LclNetGW-Connection
• Connection type: Site-tosite (IPsec)
• Virtual network gateway: RRAS-S2S-VnetGW
• Local network gateway: RRAS-S2S-LclNetGW
• Shared key (PSK): Enter in any alphanumeric key as the key
• Resource group: S2S-Test
• Location: East US

Now we go back to the RRAS server...

1. Welcome to the Routing and Remote Access Server Setup Wizard: Click Next
2. Configuration: Select Secure connection between two private networks, click Next
3. Demand-Dial Connections: Select Yes, click Next
4. IP Address Assignment: Select Automatically, click Next
5. Completing the Routing and Remote Access Server Setup Wizard: Click Finish

1. Welcome to the Demand-Dial Interface Wizard: Click Next
2. Interface Name: Type in Azure S2S, click Next
3. Connection Type: Select Connect using virtual private network (VPN), click Next
4. VPN Type: Select IKEv2, click Next
5. Destination Address: Enter in the Public IP address of the Azure Virtual Network Gateway, click Next
6. Protocols and Security: Check Route IP packets on this interface, click Next
7. Static Routes for Remote Networks: Click Add
   • Static Route: Select Remote Network Support using IPv4:
     • Destination: 10.2.0.0
     • Network Mask: 255.255.255.0
     • Metric: 24
     • Click OK
   • Click Next
8. Dial-Out Credentials: Type Azure for the User name, click Next
9. Completing the Demand-Dial Interface Wizard: Click Finish

Troubleshooting

Background:

Something seemed a bit off...

AHA! I realized what the issue was...

Symptoms:

• CCMEXEC service will not stay running.
  • [root@system ~]# service ccmexecd status Checking for service ccmexec ccmexec.bin is stopped
• Centrify is installed on the system.
• In the scxcm.log
  • You see that the client begins to run and discovers the management points
  • There are no errors and may only be a couple of warnings about STATEID
  • The log files ends without error
• In the /var/log/messages file the following errors are shown
  • kernel: ccmexec.bin[xxxx]: segfault at xxxxxx ip xxxxxxx sp xxxxxxx error 15
  • kernel: ccmexec.bin[xxxx]: general protection ip:xxxxxxx sp:xxxxxxxxx error:0 in libcrypto.so.1.0.1e[xxxxxxxxxxxxxx]

Troubleshooting:

• [root@system ~]# locate libcrypto /opt/microsoft/omi/lib/libcrypto.so.0.9.8 /usr/lib64/.libcrypto.so.1.0.1e.hmac /usr/lib64/.libcrypto.so.10.hmac /usr/lib64/libcrypto.so.1.0.1e /usr/lib64/libcrypto.so.10 /usr/share/centrifydc/lib/libcrypto.so /usr/share/centrifydc/lib/libcrypto.so.0.9.8

• [root@system ~]# rpm –qa openssl openssl-1.0.1e-30

• [root@system ~]# openssl version OpenSSL 0.9.8w-fips

• [root@system ~]# ls -lh /opt/microsoft/omi/lib libcrypto.so.0.9.8 -> /usr/lib64/libcrypto.so libssl.so.0.9.8 -> /usr/lib64/libssl.so

• [root@system ~]# find / -name "libcrypto*" -exec ls -l {} \; /opt/microsoft/omi/lib/libcrypto.so.0.9.8 -> /usr/lib64/libcrypto.so /usr/lib64/libcrypto.so -> libcrypto.so.1.0.1e /usr/lib64/libcrypto.so.1.0.1e /usr/share/centrifydc/lib64/libcrypto.so -> libcrypto.so.0.9.8 /usr/share/centrifydc/lib64/libcrypto.so.0.9.8

Resolution:

• Verify that the CCMEXEC service is stopped.
  • [root@system ~]# service ccmexecd status Checking for service ccmexec ccmexec.bin is stopped
• Change the ln (link) reference for both libssl and libcrypto in the /opt/microsoft/omi/lib/ directory.
  • [root@system ~]# cd /opt/microsoft/omi/lib/ [root@system lib]# rm libssl.so.0.9.8 rm: remove symbolic link `libssl.so.0.9.8'? y [root@system lib]# rm libcrypto.so.0.9.8 rm: remove symbolic link `libcrypto.so.0.9.8'? y [root@system lib]# ln -s /usr/share/centrifydc/lib64/libcrypto.so libcrypto.so.0.9.8 [root@system lib]# ln -s /usr/share/centrifydc/lib64/libssl.so libssl.so.0.9.8
• Start the CCMEXEC service [root@system lib]# service ccmexecd start Starting ccmexec: Starting ccmexec: [ OK ] [root@system lib]# Logging Configuration File for SCX CM::/opt/microsoft/configmgr/etc/scxcm.conf
• Check to see if the CCMEXEC service is running of if it stopped [root@system lib]# service ccmexecd status Checking for service ccmexec ccmexec.bin (pid xxxx) is running...