• Removes if there is any existing WinRM listener for HTTPS.
• Creates a self-signed certificate
• Creates the WinRM HTTPS listener with above self-signed certificate
• Configure firewall

• Azure today does not allow more than one custom script extension for a given VM. Hence if user has already taken advantage of this, the Task will not be able to add its own script extension.
• If the resource group has Load balancer, then the Task will not be able to configure appropriate In bound rules. User will have to configure the same.
• If Azure VM has remote UAC enabled, then this would still prevent remote PowerShell execution during deployment. The custom script extension does not disable the remote UAC. User will have to modify the same.

Pre-requisite:

I am assuming you have the PowerShellGet Module installed in your automation agent. If not follow the instructions in PowerShellGallery page to install the module. This provides the Install-module command-let that you would need to install AzureRM.

a) To check/verify the version of AzureRM module that is present in your machine

Get-Module -Name AzureRM -ListAvailable

b) To install a specific module execute below commands

Install-Module -Name AzureRM -RequiredVersion <ver>. You can find the versions available from PowerShell gallery page.

Install-AzureRM

Refer MSDN for more details on the command.

c) To uninstall existing versions execute below commands

Uninstall-AzureRM

Uninstall-Module -Name AzureRM

Post uninstall you should not have any modules present in the modules install path. This is typically in C:\Program Files\WindowsPowerShell\Modules. But you can find the actual path in your machine using Get-Module command.

Azure VM pre-requisites

• From within Azure VM run below command to check if you have winrm listener for HTTPS.

‘WinRM e winrm/config/listener’

• If winrm listener is not already configured, configure winrm for HTTPS

winrm create winrm/config/Listener?Address=*+Transport=HTTPS  @{Hostname="<*.westus.cloudapp.azure.com>";CertificateThumbprint="<thumbprint>"}

You can create a self-signed certificate (using makecert.exe) for server authentication and use it.

Example:

makecert -sk "mydomain.com" -ss My -sr localMachine -r -n "CN=mydomain.com" -a sha1 -eku "1.3.6.1.5.5.7.3.1"

• Verify if winrm lister is proper

‘WinRM e winrm/config/listener’

Please note that, using TfsLabConfig.exe would still be the recommended way, wherever possible.

#######################################################################################
#/// <Valid permissions that can be set>
#        /// Permission to query properties or status of Lab Management artifacts
#        /// </summary>
#        Read = 1,
#        /// <summary>
#        /// Permission to import virtual machine images into Lab Management
#        /// </summary>
#        Create = 2,
#        /// <summary>
#        /// Permission to create new Lab Management artifacts eg. creating LabEnvironment or creating LabTemplate from LabSystem.
#        /// </summary>
#        Write = 4,
#        /// <summary>
#        /// Permission to update properties of existing Lab Management artifacts
#        /// </summary>
#        Edit = 8,
#        /// <summary>
#        /// Permission to delete existing Lab Management artifacts
#        /// </summary>       
#        Delete = 16,
#        /// <summary>
#        /// Permission to start machines
#        /// </summary>
#        Start = 32,
#        /// <summary>
#        /// Permission to stop machines
#        /// </summary>
#        Stop = 64,
#        /// <summary>
#        /// Permission to pause machines
#        /// </summary>
#        Pause = 128,
#        /// <summary>
#        /// Permission to create, apply and delete virtual machine snapshots
#        /// </summary>
#        ManageSnapshots = 256,
#        /// <summary>
#        /// Permissions to create, query or change properties of Lab Locations
#        /// </summary>
#        /// <remarks>Lab Locations are places that contain virtual machines, such as Host Groups and Library Shares</remarks>
#        ManageLocation = 512,
#        /// <summary>
#        /// Permission to delete Lab Locations
#        /// </summary>
#        DeleteLocation = 1024,
#        /// <summary>
#        /// Permission to change permissions on any Lab Management artifact
#        /// </summary>       
#        ManagePermissions = 2048,
#        /// <summary>
#        /// Permission to change permissions on children (in security hierarchy) of any Lab Management artifact
#        /// </summary>
#        ManageChildPermissions = 4096,
#
#        ManageTestMachines = 8192
###########################################################################

#Function to deny permission for a user on an object
function Deny-LabPermissions
{
    param (
        [Parameter(Mandatory = $true)]
        $objecturi,
        [Parameter(Mandatory = $true)]
        $useridentity,
        [Parameter(Mandatory = $true)]
        $labinheritancechange,
        [Parameter(Mandatory = $true)]
        $denymask
        )

    process
    {
        $permlist = New-Object System.Collections.Generic.List``1[Microsoft.TeamFoundation.Lab.Client.LabPermissionChange];
        $labpermissionchange = New-Object Microsoft.TeamFoundation.Lab.Client.LabPermissionChange;
        $labpermissionchange.Denymask = $denymask;
        $labpermissionchange.IdentityName = $useridentity;
        $permlist.Add($labpermissionchange);

        $labsecuritydesc = New-Object Microsoft.TeamFoundation.Lab.Client.LabSecurityDescriptor;
        $labsecuritydesc.LabInheritanceChange = $labinheritancechange;
        $labsecuritydesc.LabPermissionChanges = $permlist;

        $labService.UpdateObjectSecurity($labsecuritydesc, $objecturi);
    }
}

#Function to allow permission for a user on an object
function Allow-LabPermissions
{
    param (
        [Parameter(Mandatory = $true)]
        $objecturi,
        [Parameter(Mandatory = $true)]
        $useridentity,
        [Parameter(Mandatory = $true)]
        $labinheritancechange,
        [Parameter(Mandatory = $true)]
        $allowmask
        )

    process
    {
        $permlist = New-Object System.Collections.Generic.List``1[Microsoft.TeamFoundation.Lab.Client.LabPermissionChange];
        $labpermissionchange = New-Object Microsoft.TeamFoundation.Lab.Client.LabPermissionChange;
        $labpermissionchange.Allowmask = $allowmask;
        $labpermissionchange.IdentityName = $useridentity;
        $permlist.Add($labpermissionchange);

        $labsecuritydesc = New-Object Microsoft.TeamFoundation.Lab.Client.LabSecurityDescriptor;
        $labsecuritydesc.LabInheritanceChange = $labinheritancechange;
        $labsecuritydesc.LabPermissionChanges = $permlist;

        $labService.UpdateObjectSecurity($labsecuritydesc, $objecturi);
    }
}

# Specify the tfs collection url, projectName and test controllerName
$tfsCollectionUrl = New-Object System.URI("<collectionURL>");
$projectName = "<ProjectName>";

# Load Client Assembly
[Reflection.Assembly]::Load(“Microsoft.TeamFoundation.Client, Version=12.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a”);
[Reflection.Assembly]::Load(“Microsoft.TeamFoundation.Common, Version=12.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a”);
[Reflection.Assembly]::Load(“Microsoft.TeamFoundation.Lab.Client, Version=12.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a”);
[Reflection.Assembly]::Load(“Microsoft.TeamFoundation.Lab.Common, Version=12.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a”);
 
# Connect to tfs
$tfsCollection = [Microsoft.TeamFoundation.Client.TfsTeamProjectCollectionFactory]::GetTeamProjectCollection($tfsCollectionUrl);
$labService = $tfsCollection.GetService([Microsoft.TeamFoundation.Lab.Client.LabService]);

#To find valid permission for each object type. Not all objects have all permission types.
$labService.GetValidPermissionsForObject([Microsoft.TeamFoundation.Lab.Client.TeamProjectCollectionHostGroup]);
$labService.GetValidPermissionsForObject([Microsoft.TeamFoundation.Lab.Client.TeamProjectCollectionLibraryShare]);
$labService.GetValidPermissionsForObject([Microsoft.TeamFoundation.Lab.Client.TeamProjectHostGroup]);
$labService.GetValidPermissionsForObject([Microsoft.TeamFoundation.Lab.Client.TeamProjectLibraryShare]);

#you can also specify TFS groups - $identitylist.Add("[DefaultCollection]\Project Collection Administrators");
$useridentity = "<domain\user>;
$identitylist = New-Object System.Collections.Generic.List``1[String];
$identitylist.Add($useridentity);

#A sample to list and modify permissions for user(s) on Host group
$hglist = New-Object System.Collections.Generic.List``1[String];
$hglist.Add("All Hosts"); #Sample Host group name
$hglist.Add("All Hosts_HG1"); #Sample Host group name
$hgsecurity = $null;
$hglist |  ForEach-Object -Process {
    #Find the corresponding URI
    $tpchgqueryspec = New-Object Microsoft.TeamFoundation.Lab.Client.TeamProjectCollectionHostGroupQuerySpec;
    $tpchgqueryspec.Name = $_;
    $hg = $labService.QueryTeamProjectCollectionHostGroups($tpchgqueryspec);
    $hguri = $hg[0].Uri.AbsoluteUri;

    #List Current permission
    $hgsecurity = $labService.GetObjectSecurity($identitylist, $hguri);
    $hgsecurity;

    #Update permission
    $allowmask = 2048; # Manage permissions. Refer list above.
    $denymask = 1023; # delete location. Refer list above.

    "Changing permission for " + $useridentity + " on object " + $hguri;
    Allow-LabPermissions -objecturi $hguri -useridentity $useridentity -labinheritancechange $true -allowmask $allowmask;
    Deny-LabPermissions -objecturi $hguri -useridentity $useridentity -labinheritancechange $true -denymask $denymask;   
}