Mike’s Windows and things blog

PowerShell and DNS Reverse Lookup Zones

MikeKammer — Tue, 07 Aug 2018 15:18:48 GMT

Welcome back! I know you've missed me

Today, I wanted to talk about PowerShell and DNS. I have a customer who is looking to clean up records which have grown out of control over the years. This customer has many reverse lookup zones, like any company which has various offices throughout the world. They were looking for a way to use PowerShell to pull all the old records, so they could verify them before going in and deleting the records.

Oh, and before we get too much further into this, there is some code being used in this project, so…

*DISCLAIMER*

This Sample Code is provided for illustration purposes only and is not intended to be used in a production environment. THIS SAMPLE CODE AND ANY RELATED INFORMATION ARE PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR PURPOSE. We grant You a nonexclusive, royalty-free right to use and modify the Sample Code and to reproduce and distribute the object code form of the Sample Code, provided that You agree: (i) to not use Our name, logo, or trademarks to market Your software product in which the Sample Code is embedded; (ii) to include a valid copyright notice on Your software product in which the Sample Code is embedded; and (iii) to indemnify, hold harmless, and defend Us and Our suppliers from and against any claims or lawsuits, including attorneys' fees, that arise or result from the use or distribution of the Sample Code.

Moving on!

This customer did not have scavenging turned on, which is not uncommon, but would have prevented the need to clean up mismatching and old records from happening. Scavenging is a setting on Windows DNS servers which will clean out records if the servers have not checked in after a specific length of time. Here's a blog on how to configure it through the GUI. That blog is a little old, so here's the setting on a Windows Server 2012 R2, being set at the zone level:

But that's not the point of this post! The point is, we needed to get a list of all the records, exported in a way that would be easy for us to understand and manipulate.

I found this article in the Microsoft scriptcenter, which was a great starting point, and did almost everything the customer needed. My first step was to get the data where we could read it. This script did that, and pretty much nothing else ;p

A few quick notes:

all the DNS PowerShell commands require an Administrator PowerShell prompt. Failure to do so will get you a Permission Denied error.
You must have the DnsServer module loaded to get these commands to work
I've been using PowerShell version 4 on Windows Server 2012 R2

#Get all the records

$records = Get-DnsServerResourceRecord -ZoneName contoso.com -RRtype A

#Filter out dynamic records

$records = $records | where Timestamp -ne $null

#Filter out records with Timestamp newer than 1/1/2018

$records = $records | where Timestamp -le 1/1/2018 | Out-GridView

#Get reverse zone

$reverse = Get-DnsServerResourceRecord -ZoneName 10.168.192.in-addr.arpa -RRtype PTR

#Filter out dynamic records

$reverse = $reverse | where Timestamp -ne $null

#Filter out records with Timestamp newer than 1/1/2018

$reverse= $reverse | where Timestamp -le 1/1/2018 | Out-GridView

After taking a short break, we decided that what we really needed was to get all the reverse lookup zones, without having to call them one by one. That should be easy, we should just be able to pull all the zones into a variable and then a foreach loop and export it out. Easy peasy!

Should is such a great word.

First objective was to get just the reverse lookup zones. I knew I was going to need to use the Get-DnsServerZone cmdlet, but exactly how was I going to get just the reverse zones, and all of them?

A little poking around and a little trial and error bought me to pull this command, putting all the reverse lookup zones into a variable ($revZones):

$revZones = (Get-DnsServerZone | Where-Object {$_.isReverseLookupZone -eq $true}).ZoneName

Test lab output:

That's exactly what I want to see. Now, I only need to throw this into a foreach loop and we'll be golden. Here's my first try at a loop:

foreach ($zone in $revZones){

$records = Get-DnsServerResourceRecord -ZoneName $zone

$list += $records

}

That's full of a lot of stuff I'm not interested in, so a small adjustment of adding -RRType Ptr

will get me just the records I want.

Much better output:

Now I'm going to just send it all to Out-GridView and we should be good. I chose Out-GridView because I wanted a quick view of my output in something that I could manipulate and export if I wanted to. Eventually we'll push the data to a .csv file.

foreach ($zone in $revZones){

$records = Get-DnsServerResourceRecord -ZoneName $zone -RRType Ptr

$list += $records

}

$list | Out-GridView

Output:

Almost what I'm looking for. That HostName is not enough information though. You can see several of my servers have the same HostName, but are clearly not the same server. What's missing here is the rest of the address. As they're all in different reverse lookup zones, I need to be able to see that here, or the data is useless. In addition to not having all the information I need, it's got more than I care for as well. I filter on PTR records, so I don't need the record type, and for my purposes now I don't really need TimeToLive either.

So, I do a select * and pull up all the possible data that I can choose from.

It looks like I want DistinguishedName to pull the full IP address, but now I see something else weird.

Look at the two RecordData columns. What just happened?

That's definitely not what I'm looking for. I need my server names! Since they showed up there once, I know they're in there somewhere, I just need to find them. Let's take a look at all RecordData has to offer.

Sounds like PSComputerName might be what we're looking for. Let's grab that value, and just the few other things we want for our final output and see what we get.

Nope! RecordData is blank! Time to try again. Perhaps the PtrDomainName will give us the information we're looking for.

There we go! Just what I was looking for!

Last thing to be done is to export it to a .csv file and we're all set. For my testing I use -NoTypeInformation and -Force to remove the first line of type information from the file and to overwrite the file. I tend to run lots of tests before I'm finally happy with my results and changing the name each time or getting an error because the file already exists from my previous testing, and that annoys me. When I'm satisfied with the result, I won't want to overwrite the file, but for testing I prefer to blast through files as needed.

Here's the final script and a sample of the .csv file.

$list = $null

# retrieve all Reverse Lookup Zones

$revZones = (Get-DnsServerZone | Where-Object {$_.isReverseLookupZone -eq $true}).ZoneName

# retrieve all PTR records from zones

foreach ($zone in $revZones){

$records = Get-DnsServerResourceRecord -ZoneName $zone -RRType Ptr | Select DistinguishedName, Timestamp,@{name='RecordData';Expression={$_.RecordData.PtrDomainName}}

$list += $records

}

# Export the compiled list

$list | Out-GridView

$list | Export-Csv -Path "C:\users\testadmin\Desktop\zones.csv" -NoTypeInformation

Output:

That's it for now! I'll be working to refine this more, cleaning up the data a little, and doing a compare against forward lookup zones. That one will take a bit longer, but I'm it will be an adventure!

Servicing Channels Explained

MikeKammer — Fri, 13 Jul 2018 13:44:12 GMT

Hello all! As you might imagine, at a company like Microsoft we get a lot of questions. That's a crazy thought, right? You also might be able to imagine that we get a lot of internal emails. Even crazier, right?! In some of our internal emails, we get a Question of the Day. Sometimes these are for internal eyes only, but sometimes the information is for the world at large. I'm blogging today to share a case where the question posted resulted in information that could benefit everyone. This question is regarding our new servicing channels, which – at first – can be kind of confusing. This Question of the Day with its answer comes from Jeff Woolsey, one of our Principal Program Managers. I found his answer really clears up the differences between the Long Term Servicing Channel (LTSC) and the Semi-Annual Channel (SAC). Read on and let me know what you think! Question of the Day Q: My customer has questions about the Windows Server 2016, Windows Server version, 1709 and Windows Server version 1803. Can I use Windows Update or WSUS to update from Windows Server 2016 to Windows Server version 1709 or 1803? A: Here's how the Long Term Servicing Channel (LTSC) and the Semi-Annual Channel (SAC) work for Windows Server.

Windows Server 2016 is LTSC only

LTSC servicing is monthly cumulative bug fixes and security updates only, no features delivered via servicing. No features.
Reread #1.
LTSC is for:
- Traditional apps: Exchange, SQL Server, SharePoint Server, SAP, Oracle, Line of Business apps
- Infrastructure workloads like Hyper-V, Software Defined Storage, Software Defined Networking
- General purpose workloads: File Servers, Domain Controllers, Print Servers
LTSC can be used for containers, but your developers will be unhappy because they will want the frequent updates being delivering in the SAC.
SUPPORT: LTSC is supported for 5 Years of Mainstream Support and 5 Years of Extended Support. This is the model Microsoft has used for Windows Server going back almost 20 years.
LTSC is available via all channels: FPP, OEM, VL, EDU

To summarize, the LTSC is the way we've been delivering Windows Server for almost 20 years. The LTSC is "business as usual."

Windows Server, version is SAC

SAC contains new features and new innovation targeted for new cloud apps and containers along with monthly cumulative bug fixes and security updates.
1. New features and innovation get rolled into the next LTSC. See picture below.
SAC is for containers and new cloud apps.
SUPPORT: SAC is supported for 18 MONTHS. Yes, MONTHS.
1. Because SAC is supported for 18 MONTHS, it's ideal for containers where DevOps simply changes out the container base image and rebuilds the container. This process usually takes MINUTES if not less.
2. Because SAC is supported for 18 MONTHS, customers have overwhelmingly told us they will not use this channel for infrastructure or for traditional workloads because no one upgrades their Exchange, SAP or Storage Infrastructure every 18 months.
SAC is available to customers via Software Assurance or via Azure

Lastly, customers can and should use both channels. For Software Assurance and Azure customers, they have the advantage of being able to use both as appropriate and we encourage it.

Use LTSC for your traditional apps (Exchange, SQL Server, SharePoint, Oracle, SAP, etc.)
Use SAC for your new container and cloud apps or for your lift and shift scenarios modernizing legacy apps

Cheers, -Jeff =============================================================================== Other points:

There is no such thing as Windows Server 2016 SAC. It does not exist. Windows Server 2016 is LTSC only.
There is no such thing as Windows Server 2016 1709 or Windows Server 2016 1803. The SAC versions are Windows Server, version 1709 and Windows Server, version 1803 respectively.
SAC is not an update of LTSC, it is a different channel. It is not pushed down via WU or available via WSUS. It requires a new installation. This is logical because SAC and LTSC target different scenarios with different support lifecycles. SAC targets containers and fast-moving application where an 18-month support lifecycle is easily manageable, while LTSC targets traditional application are deployed and a 10 year support lifecycle is desirable.

The LTSC and SAC Relationship To better understand the relationship between the two channels see the diagram below. Notice that LTSC and SAC will simultaneously ship and then SAC will continue forward being release twice a year. That innovation is focused on containers and cloud applications. Within 2-3 years, the two release sync again and all of the application innovation from the SAC releases are rolled into the next LTSC release along with innovation for traditional apps and infrastructure roles. In terms of upgrades, we will offer in-place upgrades from Windows Server 2012 R2 and Windows Server 2016 to Windows Server 2019 as they are both part of the same channel. In terms of the SAC channel, containers are serviced differently than traditional deployments. With containers, upgrading the base involves replacing the base image and rebuilding the container which is part of a continuous integration, continuous development model.

Windows Admin Center – First Experiences

MikeKammer — Tue, 26 Jun 2018 11:21:50 GMT

Hello everyone! I recently set up a test environment in the Azure Government portal. The Azure Government environment is slightly different from the standard Azure portal, and I want to get familiar with some of the differences. While exploring this new environment, I figured it would also be a good time to try out the new way to manage my infrastructure, whether on premises or in the cloud - the new Windows Admin Center (WAC)! Before getting into the meat of this blog, here's some information about how I've configured this lab.

This is not an environment that I am going to be keeping around forever, so it is not set up exactly as I would set up a production or permanent test lab.
None of my servers have public IP addresses, so to manage them I set up a jump host (JumpHost.ContosoGov.com). This is where I'll install the WAC and run any other management tools that are needed - Group Policy Management and Active Directory Users and Computers.
The WAC can also run locally on a machine if not acting as a proxy between clients and servers, but typically is just used for testing in this configuration.
The WAC is very lightweight and does not need a client installed on any endpoints. It uses Remote PowerShell and WMI over WinRM, so there are only a few ports which need to be opened and which may already be for remote management.
WAC will only run on Windows 10 (at least version 1709), Windows Server 1709 or higher, or Windows Server 2016. See supported Operating Systems here for reference.

For a better understanding of the traffic and configuration I'm describing, see the image below: Now, on to the meat! First things first, you'll need to download the installer which is available at https://aka.ms/wacdownload. The version I downloaded and installed is 1804.25, which is currently the latest version available. I downloaded the .MSI to my jump host server since my plan was to use it as my management point for everything in my test environment. Unsurprisingly the .MSI launches a wizard which is straightforward and familiar looking to anyone who has used a Microsoft installer before. As shown below, I like to have desktop shortcuts, so I checked the box to create one, but that's a personal preference. I left the default check to allow the installer to modify the trusted hosts settings on my jump host. This was an easy choice, it is much easier to let the installer do what it knows how to do and save myself some manual configuration later. Next up was configuration of the management site which defaults to port 443, the port for SSL. This means that we need to have a certificate to connect to this port. This being a temporary test environment, I don't have any certificates to use. Fortunately, the installer will take care of that too, and will create a self-signed certificate for you. The caveat to this is that the certificate is only good for 60 days and is not trusted by default by any clients that connect to it. If this were a production environment, or even a test environment which I planned on keeping around, I would get a proper, trusted certificate. One more click and we're all finished! Fast, easy, and straightforward. And here's our handy desktop shortcut! You'll notice from the screen-grab above that I have Google Chrome installed here. One of the things to be aware of is that the WAC will only run on modern browsers, so your choices are Microsoft Edge or Google Chrome. As I'm running the WAC on Windows Server 2016, I cannot install the Edge browser and so I have installed Chrome. When launching the WAC for the first time, we're asked what browser we want to use. You can try Internet Explorer if you like (I did), but it's not going to work. So, once you've satisfied your curiosity about Internet Explorer, choose to use Google Chrome and always open it with that app. The first time the Windows Admin Center is launched, there is an alert that the connection is not private. Click on the Advanced button to access the button to let you continue. Here's what it looks like if you are using Edge from a Windows 10 workstation (and you would click on the Go on to the webpage (not recommended) link to proceed): After clicking Proceed to jumphost.contosogov.com (unsafe) to pass the warning you'll get a prompt from the WAC itself looking for a login. This is going to be the account you will use to manage the servers and workstations, so it should either be a member of the Domain Admins group or another group which will have administrative privileges on those machines. The first time in the WAC you will get a short two-page tour of the center. I've included screenshots here, so you can just skip the tour when you do the install. There's not much to see in it. Now we get into the real fun: the actual user interface! Since this is the first install of the product, we only have one machine to manage - the local server the client is installed on. The information here is straightforward: we get the full name of the machine, what type it is, the last time we connected to it, the account we are managing it as, and any tags we have assigned to it. Now we need to add other machines for us to manage. Click on the Add button to bring up the Add Connections options. We currently have four options to choose from:

Server
Windows PC
Failover Cluster
Hyper-Converged Cluster

Now my lab only has servers, so I clicked the Add Server Connection button to bring up the server screen. Here we have the option to Add Tags and to either add a server or import servers from a list. For testing out this new management tool I only want to add a single server. I start with my domain controller, AZDC01. After entering the name, I am prompted to enter credentials again to manage the server. And here is where I ran into my first problem. I used the same account which I had logged into the jump host, and logged into the WAC, to connect to the domain controller. That account is also a domain administrator, so I should have had no issues connecting at all, but instead I got an accessed denied message. Reading through the documentation here, I saw this code to configure single sign-on (I had skipped large portions of the article as it did not apply to my situation). I tested it out on one of my web servers first. $gateway = "JumpHost" $node = "WEB01" $gatewayObject = Get-ADComputer -Identity $gateway $nodeObject = Get-ADComputer -Identity $node Set-ADComputer -Identity $nodeObject -PrincipalsAllowedToDelegateToAccount $gatewayObject This worked like a charm, and WEB01 was added to my list of machines to be managed. This is a handy take-away tip if you're like me and skimmed the documentation. Unfortunately, that's not really the way I wanted to handle adding connections. Sure, that script can be modified to run through a list of servers and that would be fine. But, I wanted to make sure that as new servers come online in the future they wouldn't get missed. To that end, I decided to create a security group (CONTOSOGOV\WAC) and push it to all computers in my domain as a member of the local administrators group through group policy. Again, this is my test environment, and one that will not be kept around, so I targeted the Default Domain Policy. If I were planning on keeping my lab intact, or in a production environment, I would instead target OUs with my servers instead of blanketing the entire domain. Now that I did that, I had to give it a good bit of time to replicate and apply to the servers. After my wait, I tried adding another server. This time it was web02, which is a Windows 2016 Server Core. Again, I got access denied from the sign in pop-up! But this time I used the "Use another account for this connection" option. I use the same account (CONTOSOGOV\Zuko) and got another prompt from the webpage. The odd thing here is that it goes back and forth between entering the passwords, between the web page and this WAC log in, and eventually takes. Looking into what was causing this behavior, I checked out the event logs. The WAC has its own event log under the Applications and Services Logs -> Microsoft-ServerManagementExperience. Here I had a lot of Event ID 0's, but a few of them were errors. Looking at the errors, they show a 401 message – PSRemotingTransportException. Access is denied. This error occurs when the prompt from the browser happens, not when logging into the application. I have not verified this yet with a Windows 10 client and the Edge browser, but it has consistently occurred for me in the Chrome browser with several different user accounts and every server I have attached to. The error only happens when making the initial connection. Once through the back and forth with the browser, the server gets added to the WAC and is available for management. It's not visible from the image above, but there is a checkbox next to each server that when you take your mouse over the area you can see. Since we just added WEB02, we have never connected and collected data, so we'll do that now. I clicked the checkbox next to WEB02 and my options in the top row are now available for me to choose from. I click Connect to pull information from the server. You can see we now have pulled in a lot of management options. Remember, this tool is designed to replace most of your existing Microsoft Management Consoles (MMCs) and other management tools, so there's a lot to explore in here. Here's just a small sampling of what is available in WAC. You can see performance data, change the server name, and even restart or shutdown the server: You can browse through the file structures on the servers and transfer files to/from the target server: You can dig through event logs (and yes, I see the irony of using the old school Event Log Viewer in my earlier example. 😊For documentation purposes I hadn't officially connected to a server in the WAC, and needed to show how to view the errors) : You can even use PowerShell remotely: There are some details to consider:

While I set my group policy preference to push the CONTOSOGOV\WAC group to the local admins group on all my machines, that does not apply to domain controllers (DCs).
Domain controllers don't have local groups, and if the account that is being used to manage the servers is not a Domain Administrator, they will not be able to manage any DCs. Not to worry, you can connect to the WAC with a non-privilege account and use a privileged account to connect to any DCs.

There are a lot of features to be discovered here, and I plan on digging into them over the coming weeks and reporting back on what I've discovered. Let me know what you think, and if you have any questions!

Windows Server – What’s New and What’s Next BRK1038

MikeKammer — Thu, 31 May 2018 14:44:15 GMT

Hello all, It's been a while since I've posted a new summary on the 2017 Ignite sessions, work is an all-encompassing thing. As a reminder, Microsoft Ignite was held in Orlando, Florida from September 25^th to the 29^th 2017. Here are all the sessions for you to browse and watch at your convenience. The sessions are between 45 and 75 minutes each, and while I will be summarizing one of the sessions here, I definitely recommend watching the entire video, as every session has lots of great information. I'll be calling out key times in order to highlight specific wording or a demo – or something I want to call your attention to. For the second installment, we are going to cover session BRK1038 – Windows Server What's New and What's Next. Please leave me comments, questions, and any session you would like to see covered! This session is presented by Erin Chapple, General Manager Windows Server, and Chris Van Wesep, Director Product Marketing. I started working on this blog post a while ago, before work took over and kept me way too busy, so some of the things mentioned here as 'coming soon' are already here now. That doesn't make the presentation and video any less relevant though. All the information is good, and it's also gathered here in one place for easy reference. For me, it's also easier to grasp new concepts and technologies when I can hear someone explaining it as well as being able to read through the details. I feel like it's a richer learning experience that way, so if you can, be sure to check out the links to the video when you find the topics especially interesting. First up we have a few Windows Server 2016 customer case studies:

Rackspace and their Security
a Government agency and their Storage experience
biBERK and their application uses.

5:27 - Customer case studies - Security 7:27 - Storage 10:36 - Applications 15:16 - Demo - Azure File Sync Here is the Azure File Sync announcement, where you can learn all about how the new Azure File Sync will allow you to extend your on-premises file servers into Azure. This is a great new feature which offers near real time syncing into Azure and allows for tiering of files between your on-premises systems and those in the cloud. Enabling this feature allows you to keep all your most frequently accessed files on local servers and those less frequently used files in the cloud. There are a great number of scenarios where Azure File Sync will be useful, including a potential replacement for Distributed File System (DFS), disaster recovery, and high availability. 19:39 - Release Cadence Moving forward, Microsoft is changing the way in which they are releasing Windows Server updates and versions. There will be two new "Channels" that Microsoft releases. The Semi Annual Channel (SAC), which releases twice a year, and the Long Term Servicing Channel (LTSC), which will release every 2-3 years. The SAC releases are intended for fast moving development, with the latest and greatest technologies available. These releases will only have 18 months of mainstream support, and no extended support after that. That's an important detail to be aware of. Many companies take their time in applying updates and may even skip some patches. SAC releases won't support that way of thinking, you must stay up to date, at most two versions behind the most recent release. SAC releases are only available through Software Assurance (SA) or on Azure, and use the naming convention of Windows Server plus version, such as Windows Server 1709. The LTSC releases are the releases that we - as tech people - are used to. Being released every 2-3 years, they will have 5 years of mainstream support and then another 5 years of extended support. These releases are available through all standard channels and follow the naming convention which we are accustomed to, Windows Server followed by the year of release, such as Windows Server 2016 This is not an either-or type of situation. Many companies are likely to have a mix of both types of Windows Servers, and it's important to understand the differences between the two. 25:46 - Server Core is available in the SAC and the LTSC, and Nano Server is now only the base for containers and is no longer able to hold any infrastructure roles. The GUI is only available in the LTSC releases. This way you do not need to be concerned with the quick release cadence of the SAC while still getting the benefits of running Server Core. But if you really want that GUI experience, the SAC releases will not work for you. 29:00 - Fall release Windows Server 1709 - Hybrid application Platform, Modern Management Windows Server 1709 is the first Windows Server available in the SAC and was released with the goal of increasing density, increasing performance, and allowing for the latest technology available at a fast pace. Containers are also a big part of this release, with some great new additions. SMB support has been enabled as well as Linux containers with Hyper-V isolation! This was a highly requested feature and we're happy to have it available. The Windows subsystem handles the hardware, but the container itself is pure Linux. 37:18 - Demo - Enabling Cloud apps with Nano Server & containers 46:23 - Demo - Project Honolulu Here's one of those things that was not available at the time of Ignite but has since seen general availability. Project Honolulu is no longer called Project Honolulu, it is now the Windows Admin Center (WAC). The WAC is the new browser-based management tool that gives you full control of your server infrastructure. This new tool can replace most - if not all - of your existing MMC snap-in, and you can perform other functions with it. You can restart or shutdown systems, configure roles and features, and it's all agentless (one of the best features!). The WAC uses remote PowerShell and WMI over WinRM for easy use. 55:32 Software Assurance With Software Assurance (SA) you get rights to future products as they come out (ex 1709), and the same is true of semi-annual releases. The Azure Hybrid Benefit is the least expensive way to operate Windows server in the cloud as it gives you the right to run up to 2 VMS (up to 16 core) for each on-prem license. There is a new level called Premium Assurance which gives time to focus on moving forward, adding 6 extra years of the product, so 5+5+6 instead of the standard 5+5. For those companies which struggle to retire old hardware and software, or need that extra time for upgrades and migrations, this is a huge benefit. For a small increase in the cost of licenses, there are six whole years of extra support instead of the annual extended support which must be purchased at a higher rate. 1:00:43 Time to upgrade! Speaking of buying extended support, Windows Server 2008 and Windows 2008 R2 are closing in on end of support. By January of 2020, they will officially no longer be supported, and your only option will be the annual extended support plan that was just mentioned or moving to the Premium Assurance plan. If this affects you, this would be a good time to start planning. 1:02:46 Microsoft and Docker Modernize Traditional Apps (MTA) Program This is a joint venture with Docker and other companies to assist you with your modernization efforts. In a five-day event, Docker will help you containerize and migrate your apps, which can be moved to Azure or kept on-premises. This is a great opportunity to get assistance moving those pesky legacy apps to a modern infrastructure. 1:05:39 Windows Insider Program Join the Insiders Program! This is the only way to see new releases and beta features. There won't be more Technical Previews released, only Insider Preview builds. Q&A 1:08:41 – The demo showing docker commands, can you take any application and containerize it? Not necessarily. The application must be GUI-less. The biggest push right now is old .NET and Java apps. Anything that has a remote GUI, remote management, there is no GUI in a container. Second part of question – Will future Exchange servers be able to be put into a container? We are already seeing it in SQL. There have been a few million downloads of SQL to containers already. That's just the SQL engine, not all of SQL's features make sense to go into a container. Can't speak broadly that everything will end up in a container, but Microsoft is looking through options. With so many companies moving to Office 365, does it make sense to try and containerize Exchange? The answer is still being looked at. 1:11:07 - Will Project Honolulu be backported to work with older server versions? Project Honolulu (now Windows Admin Center) can manage back to Windows Server 2012 from the server management perspective. Since the WAC does more than just manage, not all features may be available. 1:11:43 - Project Honolulu is accessed through a browser, so where is the web server that is managing it? The management client can be installed in different ways. It can be installed on a target server, run locally on a workstation, or it can be run off a server in the middle. Follow up question – If the web server is located on a server other than one being managed, is it talking over legacy remoting protocols? No, the WAC uses PowerShell and WMI. 1:13:00 – The premise of containers is that you can take an app that has been running on Windows 2003 happily for years, put it into a Windows 2003 container, and deploy the container on Windows 2016? There are no 2003 containers, you would put it in container running Server 2016 Server Core. Continuation - But then you have to test everything again, what's the big benefit, the application gets a new environment? Might as well just put it on a Server 2016 VM! Working with customer running a .NET 3 app on Server 2003 R2, what are the benefits of moving to Server Core and putting it in a container on Server 2016? Many benefits:

Now running on a supported OS
Just by moving to 2016, upped the security with kernel protections, credential guard, remote credential guard, defender is built in, and performance will skyrocket too
Also, now it has been moved into a more DevOps workflow

And continuing - But what's the benefit of doing that in Docker? The container now doesn't have full OS, don't have to manage OS, self-contained, developer can use that as unit of deployment. Benefit probably more from developer perspective than IT, but still have big benefits. There you have it, what's new and what's next for Windows Server! I hope this was beneficial to you! Leave me a comment or request for a particular session or technology you'd like to see covered, and I'll do my best to get it to you! Here's the link to my first Ignite blog on Server clustering and storage in case you missed it.

Server Clustering and Storage – Hyper Converged BRK3324

MikeKammer — Fri, 05 Jan 2018 20:41:54 GMT

Hello all, Microsoft Ignite was held in Orlando, Florida from September 25^th to the 29^th last year. If, like me, you were unable to attend, you will probably, like me, be digging through all the sessions to get all the latest news and information. Like me, your time is probably limited and since the Ignite session videos are anywhere from forty-five minutes to an hour and a half, the number of sessions one can get through are probably few, if any. I will be putting together a series of posts that summarize the videos and presentations that I hope will help you get the most out of the sessions without having to watch the entire video. If you have the time, I definitely recommend watching the entire video, as every session has lots of great information. I'll be calling out key times for when you will want to catch the speaker's exact wording, or if there is something extra special I want to draw your attention to. For the first installment, we are going to cover session BRK3324 – Server Clustering and Storage – Hyper Converged. Please leave me comments, questions, and any session you would like to see covered! This session is presented by Elden Christensen and Mallikarjun Chadalapaka, Program Managers from the High Availability Storage team from the Windows Division of Microsoft. Hyper converged infrastructure really builds on Storage Spaces Direct (abbreviated as S2D), new technology in Server 2016 that allows users to utilize local attached drives to create highly available, highly scalable software-defined storage at a fraction of the cost of traditional SAN or NAS arrays. As my customer starts rolling out Server 2016, S2D is going to be one of my talking points as I really believe it's going to be big going forward. 2:13 - Stretch clusters are new in Server 2016,and use storage replica to bring an end to end solution around stretch clusters for high availability (HA) and disaster recovery (DR). The SQL PFE that I work with at my customer is hoping to implement stretch clusters with SQL 2016 as we implement Server 2016. About 90% of the clusters that I currently deal with are SQL, so we're really excited about the prospect of implementing stretch clusters. 4:30 – With an S2D cluster, you can create a Scale-out File Server and turn your hardware into a NAS (Network Attached Storage) device! With Server 2016, you can make a share with NVMe (NVMe is a communications interface/protocol developed specially for SSDs by a consortium of vendors including Intel, Samsung, Sandisk, Dell, and Seagate) on an S2D cluster. This is exciting technology, providing ridiculously fast speeds for access to shares and allows us to get the best performance out of our SSD drives now. With Storage Spaces Direct, we can have millions of IOPS by creating an NVMe fabric. And now you can put SQL on top of S2D – drives appear as Cluster Shared Volumes (CSV) -- nothing special or different -- so any current experience with CSV volumes still applies and no new training is required. Again, we're hoping to roll out S2D and stretch clusters for our SQL environment at my customer, and since the drives will appear as CSVs, our Database Admins will likely not notice any difference at all. S2D can also be used inside a VM. Since there is no concept of shared storage, S2D can take virtual drives - VMs, Azure, AWS, etc. and allow them to be used for an S2D deployment. This is also particularly exciting for me because my customer is a VMWare shop, and if we can enable S2D using their existing virtual infrastructure, I think that'll be an easy jumping off point to start discussions to migrate to Hyper-V, or at least to enable the features in Azure. 7:22 - The next features discussed in the presentation are available in the Insiders build, which is easy to sign up for and download. If you have the development space for it, I highly recommend signing up for it and testing out all the goodness coming down the road. Data deduplication, which involves finding and removing duplication within data without compromising its fidelity or integrity, is now supported with ReFS (Resilient File System), which could increase storage efficiency upwards of 95%. 8:55 – Demo for DeDup of drives with the new Honolulu interface. Honolulu is an exciting new management interface for your Windows servers. If you haven't seen it yet, you should check it out! 11:13 - Another demo, this time of hyper converged cluster manager, again using the new Honolulu interface. I really think hyper converged infrastructure is where the future is at, so be sure to check out the demo. 17:35 – The Health Service is a new feature in Windows Server 2016 that improves the day-to-day monitoring and operational experience for clusters running Storage Spaces Direct. It can detect when drives fail, and it will then automatically remove them or automatically add drives back when they've been replaced and will then add the drives to the cluster they belong to. This is such a great feature as it really removes a lot of the more mundane tasks of managing disks. Scoped spaces can be resilient to losing two nodes per data set because of the way the volumes are written. There is self-healing logic in S2D and clusters, and ways to validate improvements for S2D requirements. This is going to make life easier for systems admins! 23:28 – MSDTC (Microsoft Distributed Transaction Coordinator, which tracks all parts of the transactions process, even over multiple resource managers on multiple computers),is now supported on S2D. All clusters use SMB, and now we can encrypt SMB Communication. BitLocker is supported on 2016 S2D for encryption of data at rest and encrypted SMB for data in motion. This is great for everyone who is security conscious, and these days, that really should be everyone! 26:14 - Cluster Sets are loosely coupled group of clusters: computer, storage, or hyper-converged. Software Designed Data Center (SDDC) can now scale out to thousands of nodes, allowing for a large-scale set and limiting the software fault boundary. Like I said earlier, most of the clusters I deal with are SQL clusters, and this customer has many different clusters ranging from 2 nodes to 8 nodes and running Server 2008 R2 and Server 2012 R2. By adding in new 2016 servers, we can start using cluster sets for easier management, and be much less concerned over a cluster running low on resources. 29:30 - Cluster sets can be heterogenous between the clusters but should still be as homogenous as possible inside each cluster. It's easy to add just a compute node to the cluster (or just a storage node), take down nodes, and to patch nodes with zero downtime. by migrating workloads amongst the cluster set. We're really looking forward to implementing rotating upgrades and zero-downtime patching. 33:00 solution view 34:28 Logical fault domains – use Azure-like semantics allowing for reuse of existing Azure skills. As more and more companies are adopting a hybrid infrastructure, we want to make sure as many of our standard nomenclatures and skills apply to the new technologies as well as technology currently in our environment. Logical fault domains is one of the ways we'll be doing that. 35:25 Demo of a management cluster with three worker clusters using PowerShell and Failover Cluster Manager. 39:55 When to deploy clusters vs cluster sets? For us, I'm really pushing for the Hyper Converged Infrastructure and the combination of all the heterogenous servers should help push my customer to see the benefits of using Cluster Sets. 43:25 - High Availability with Enhanced VM Start Ordering is – This new feature allows apps to span over several VM's and allows you to set a delay in restarting VMs. For example, start VM1, with a configured delay, and then start VM2. This is not just a simple timer anymore, it can trigger off OS heartbeat, or other services. The triggers can also be set on apps that are throwing events in an event log. Since my customer is currently a VMWare shop, the Enhanced VM Start Ordering isn't on my personal roadmap yet, but again it might help sway them to make the move to Hyper-V. 46:09 - Azure Enlightened Clusters Clusters can now detect when they are running on Azure (or any public cloud). This is an incredibly helpful new ability for clusters. Being able to use Stretch Clusters to push part of the cluster to Azure and have the cluster know which VMs are in Azure is a huge benefit. The Enlightened Clusters can detect Azure maintenance events, which will help with troubleshooting cluster issues. With an Azure configure setup, there will be modified heartbeats with upped thresholds when dealing with Azure so resources don't fail over as fast due to network latency. For me, this is an easy way to get my customer to start moving workloads into Azure. Stretch a node or two up there and see how easy it is and what the performance is like, and then later start migrating more and more. 50:55 You can now move a cluster to another domain – this is still in the Insider preview! Sign up for the to check it out as this is big. I've had several customers who wanted, and in some cases needed, to set up a cluster without having it joined to a domain. Now you can dynamically change clusters from one domain to another, breaking AD dependencies In the future a cluster can be built in a lab environment then be removed from the lab domain, and finally be reestablished in production by running some PowerShell commands. However, clusters cannot be Azure Active Directory (AAD) joined at this time. Q&A 58:20 - Q: Is a 2-node cluster supported with S2D? A: Yes, and it supports a cloud witness (Azure blob) or file server witness. Also, you do not need nVME, it can be mixed with SSD, HDD, etc 59:20 – Q: Can I do stretch cluster sets for DR purposes? A: From a design perspective, yes. However, it has not been approved yet and has only been tested for a single site. 59:56 – Q: Regarding VM start ordering - if SQL server is restarted, can they be set to then reboot the app and front end? A: Yes, groupings of groups can be defined, and then polices can be set up inside of the groups. For example, servers can be set in tiers and to wait for three servers to be up in one tier before the next tier are started. 1:01:07 – Q: Will storage replica work across a WAN?

A: Absolutely, either synchronous and asynchronous replication both are both supported in a stretch cluster.

1:01:50 – Q: Are any of these features available in 1709, or just Insider build? A: Just Insider build. 1:02:18 – Q: What's with 1709 and R2's? A: Aligning server with client, SAC (Semi Annual Cadence) releases (every 6 months) are only supported for 18 months. There will also be LTSC (Long Term Service Chanel) releases (same as for the last 20 years)- supported for 5 + 5 years, and you can buy premium support afterwards. Server 2016 is LTSC, 1709 is a SAC release, and the branding is changed to just Windows Server MonthYear. 1:04:35 – Q: When will Azure templates for S2D be available? A: 3-4 templates are available now, here's a blog discussing templates, clustering, and high-availability. 1:04:58 – Q: Are Windows cluster sets available with LTSC or just Insider build?

A: Windows cluster sets are only available with Insider build (not in 1709 either).

1:05:30 – Q: Can we set up a VM cluster and S2D with just 2 nodes?

A: Yes, you can deploy with just 2 nodes. Can you use existing servers? Maybe not. Not all vendors have S2D solutions and it is recommended to get one that does. You would want to use hardware that is validated. Have people used JBOD (Just a Bunch Of Disks) successfully? Yes. Would it be recommended? No.

1:07:34 – Q: Is there any way to manage durability of drives in an all flash cluster?

A: We have a blog discussing drive writes per day and endurance requirements with S2D. Is there a good mechanism? Not really, maybe PowerShell might work. Are SSD's reporting back to PowerShell? Maybe not, no real standard on that yet.

1:09:10 – Q: What kind of performance impact can be expected from enabling deduplication?

A: Depends on the workload being deduplicated. DeDup is done on rotation. ReFS done on rotation, data lands on caching device, then mirrored partition, then rotate data and dedup as data moves between tiers. For a flat design that runs on periodic basis (24hrs by default), that can be tuned as a scheduled task.

1:10:30 – Q: Is dedup supported for more than VDI and VHDX backup

A: Yes.

1:10:45 – Q: Are there any file size limitations?

A: Yes, there are volume and file size limitations. There is an article on it.

1:11:26 – Q: S2D has a limit is 1 PB for storage. Can cluster storage expand the limit?

A: If you want more storage, add another S2D cluster.

So that's my blog on Ignite sessions. What did you think? Leave a comment! Is there a session or technology you'd like me to review? Leave a comment! Like my font? Leave a comment!

Deploy Server 2016 – Part 2

MikeKammer — Tue, 19 Dec 2017 10:49:15 GMT

Welcome everyone to Part 2 of my experiences deploying Server 2016. In Part 1, I gave a breakout of the stages of my deployment, and some of the details about our initial Group Policies. This post will follow the next steps of Stage One, where we build out the first 2016 server in the environment, apply the policies, and submit the server to our security team for scanning. Picking up where we left off, I have taken the two policies that were created, Server 2016 Security Policy and Server 2016 Standard Policy, to the Server 2016 Organizational Unit (OU). Before we start building our 2016 server, we will create a new Computer Object in the Build Staging OU in the Server 2016 OU structure. Do this by opening Active Directory Users and Computers and browse to the Server 2016-> Build Staging OU. Right click on Build Staging and choose New -> Computer. The reason we are creating our computer object in Active Directory before we do the actual creation is that we want to be certain that all our policies are applying to the servers from the moment they join the domain. This will help ensure the security of the servers and of our environment. In the New Object – Computer wizard, enter the Computer Name of the new 2016 Server. Since we've already applied the policies at a higher OU, they will flow down and apply to any objects in the sub OUs, so our newly created computer object will receive them with no additional work. And now we move on to the creation of the server itself! Following our plans for Stage One, we will install the server with the Desktop Experience. There are plenty of sites out there that detail the installation process for Server 2016 (like this one, and this one) so I won't duplicate the process here. I will call out the one part of the install that is important to us: the 'Select the operating system you want to install' screen, where it defaults to the Windows Server 2016 Datacenter edition. Don't be misled by the name, that is the CORE install, and not what we're looking for right now. We'll come back to that another day, but for right now, be sure to click on Windows Server 2016 Datacenter (Desktop Experience) before clicking next. Now that our server is built and powered on, we'll log in as the local administrator and configure the server with a new IP address, name, and then we'll join the domain. Again, there are many resources detailing how to go through the initial configuration of a 2016 server (like here, here, and here), so I won't beat that to death here. I will show that I am going to join the CONTOSO.COM domain and my machine will be named CONTOSO16. With the machine joined to the domain, we can verify that it is accepting the group policies by running the Group Policy Results Wizard from the Group Policy Management Console and check the Applied GPOs section. Now that we have verified our new CONTOSO16 server has received the appropriate group policies, we can ask our security team to scan the server and verify that it meets all the requirements. For our test environment, they are testing to ensure all our policies are correct, and that they have been applied. In our case, we have had several failures, listed here.

Issue 1: Ensure 'Audit PNP Activity' is set to 'Success'
Issue 2: Ensure 'Network access: Restrict clients allowed to make remote calls to SAM' is set to 'Administrators: Remote Access: Allow'
Issue 3: Disable IPv6 (Ensure TCPIP6 Parameter 'DisabledComponents' is set to '0xff (255)')

Issues 1 and 2 are new options for Server 2016, and Issue 3 has been a corporate preference. Microsoft recommends keeping IPv6 enabled, even if it is not being configured for use in the environment, but this is not a hard rule and in this customer's environment they have chosen to disable it. Because Issues 1 and 2 are new, even when loading the newest templates into our PolicyDefinitions folder on our central store in %systemroot%\ SYSVOL\sysvol\CONTOSO.COM\Policies, if we open the Group Policy Management Console from any server below 2016 or a workstation with the Remote Server Administration Tools (RSAT) that is below Windows 10, we won't be able to see those new features. Also, any other new settings will only be visible from either a Windows 10 workstation or a 2016 server. Here's the view from our 2012 R2 Domain Controller: And here it is from a 2016 server: Resolving the issue of turning off IPv6 is a little more complicated. As I've stated, Microsoft's official stance is to not turn it off, so there is no built-in policy to do so. Fortunately, there are a lot of great people out there and there are some template files which can be downloaded to help us resolve this issue. This link has an article on how to do so, and I'll summarize it here. Once you have downloaded the IPv6Configuration.zip file, extract both the ADMX and ADML files. If your domain has a central store for the policies, the IPv6Configuration.admx files should be placed in the %SystemRoot%\SYSVOL\domain\Policies\PolicyDefinitions folder as shown below. If your domain is not using a central store (fix that, they should be), then place the file in the %SystemRoot%\PolicyDefinitions folder on each of your Domain Controllers or the machine where you are editing your group policies (i.e. a machine with the RSAT installed). Depending on how many Domain Controllers you have, you'll quickly realize that a central store is much more efficient. Now place the IPv6Configuration.adml file in the %SystemRoot%\SYSVOL\domain\Policies\PolicyDefinitions\en-US folder (replacing en-US as needed with your country code). Again, if you are not using a central store (which you should be), the file should be placed in the %SystemRoot%\PolicyDefinitions\en-US folder (replacing en-US as needed with your country code). Now that we've loaded in the IPv6 templates, we can see them in our Group Policy Editor. The new template will be visible in Computer Configuration -> Policies -> Administrative Templates -> Network -> IPv6 Configuration. Once we open and set the policy to Enabled, we'll see there are a lot of options in the drop-down menu. Since our customer does not want IPv6 but Microsoft recommends not disabling it, we'll choose Prefer IPv4 over IPv6 components to do this. While this policy specifies Windows 7 and Windows Server 2008, it still applies to newer versions of Windows Server and Windows clients. After enabling and configuring the IPv6 policy, we will verify it has taken effect on our new server. From the command prompt on our CONTOSO16 server, we run the IPCONIFG /ALL command and verify that there is no setting for IPv6. Now that we have verified that all our issues have been resolved, we can submit it back to the security team and have them run their scans for the official record. Our result this time: SUCCESS! Our server has passed all the necessary checks for the Development environment. After completing our server build and passing the security checks, we can pass off our server to the VMWare administrators so that they can turn it into a template and deploy it to other environments for agent installation and further testing. As our deployment project moves along, I'll post more details of the actions taken. Please post your comments, and if there's anything you'd like more details on, let me know!

Deploying Server 2016 Part 1

MikeKammer — Thu, 30 Nov 2017 16:07:42 GMT

Hello all! My name is Mike and I am currently a Platforms PFE at Microsoft and have been for the past two years. I’ve been working with Microsoft Server technologies for the past 17 or so years, starting with Windows NT and working on every version of server operating system since then. I’ve dabbled in other Microsoft technologies such as System Center Configuration Manager, but the server platform, Active Directory, and Group Policy is where I’ve spent most of my time. This is the first installment of a series of posts on how I’ve deployed Server 2016 in a customer’s environment. I’ve mimicked most of the details but have hidden names to protect the innocent. For my installation, we want to get the most out of the new features of Server 2016 but for various reasons can’t implement everything all at once, so we have a rough plan for introducing Server 2016. In short, we’re going to start with virtual machines with a GUI, and work towards Server Core deployments and potentially some Nano servers. Upgrading the domain controllers will be a separate project and won’t be covered now. The current environment is a VMWare shop, and has a mixture of Server 2008 R2 and Server 2012 R2. Most of the environment is virtualized, with only select physical servers which have their images managed by MDT. We’ll be breaking the larger project out into four stages: Stage 1:

Develop base VM GUI image – Lab
Develop Group Policies – Lab
Test Group Policies and GUI image – Lab
Deploy policies and image to lower environments

Stage 2:

Develop base VM Core image – Lab
Develop base Physical GUI image – Lab
Upgrade MDT – Lab
Deploy base VM GUI image – Production
Test VM Core image – Lab
Test Physical GUI image - Lab
Deploy group policies – Production
Deploy images to lower environments

Stage 3:

Develop Hyper-V Physical GUI image – Lab
Develop Hyper-V Physical Core image – Lab
Deploy SCVMM to manage Hyper-V environment – Lab
S2D – multiple physical machines – Lab
Upgrade MDT - Production
Deploy base VM Core image – Production
Deploy base Physical GUI – Production
Deploy Hyper-V images to lower environments
Deploy SCVMM to lower environments
Deploy S2D to lower environments

Stage 4:

Deploy Hyper-V images – Production
Deploy SCVMM – Production
Deploy S2D – Production

We’re starting out with our test lab, which is where one should always start. Always remember, don’t test new changes in production! Our first job is to ensure that any new Server 2016 machines on the network will have appropriate Group Policies applied to them when they first join the domain. We have created an OU structure that will mimic the production environment and will allow us to apply the polices as needed. Any new 2016 servers must be added to one of the four appropriate OUs: Build Staging, DEV, PROD, or QA. Our Group Policies are applied at the Server 2016 OU and they filter down to the other four OUs. We have developed two specific Server 2016 policies: Server 2016 Security Policy which is full of security settings and features all the auditing, firewall, local account, and other service lockdown settings and Server 2016 Standard Policy, which contains all the other general server configuration settings. We created these two policies by backing up the existing Server 2012 policies and restoring them into newly created blank policies. This sped up our ability to deploy the policies with the same settings we already knew we needed and wanted, and then we added in new settings which were unique to Server 2016. We also took this time to remove some of the settings which were deprecated or otherwise no longer applied to the environment. Following is a sample of the settings in the Server 2016 Security Policy: A sample of the settings in the Server 2016 Standard Policy: Our goal here is to ensure we have a solid base image which will pass the security screens before we move on and start installing all the necessary agents and standard software. Once our base image passes the security test, we will set it as a template for other lower environments and begin the installation of all the agents and standard software. As of this writing, we are in the process of tweaking the Group Policies to ensure they are updated from the previous 2012 policies and will be submitting them to the security team for testing. Stay tuned for the results and next steps!