Hey all

So I have been quite for a while… this is mainly due to high workloads but also I moved!

I am now a resident in San Francisco!

Will be trying to put more online in the coming weeks as I come across little bits…

John

There are tons of examples out there and to be honest this is for as much my reference to go back and grab it when I need it.

so here is a simple script nothing fancy whatsoever but functional

First part lets collect the name you want to assign to the Virtual Machine you are building in Azure! and import the AzureRM module. I am specifically calling AzureRM as I am importing all azure resource modules. However I could just call the ones I need

$vmname = "<insert-your-VM-Name>"
import-module AzureRM

These next two lines are for me specifically, I have multiple subscriptions and want to deploy to a specific one so I am just getting all subscriptions available and then referencing the one of interesting. Interestingly enough you need to specify the tenantId and subscriptionID to select the subscription of interest now…

$subs = Get-AzureRmSubscription -All
Select-AzureRmSubscription -TenantId $subs[4].TenantId -SubscriptionId $subs[4].SubscriptionId

Next I select the storage account, in the subscription I am working with there is just one… in your environment you might want to filter out

$storacct = Get-AzureRmStorageAccount

Next we construct the name for the VHD and access the public blob endpoint URI so we can construct a full path to the VHD for later use

$diskname = $vmname + "_OSDisk"
$vhduri = $storacct.PrimaryEndpoints.Blob.OriginalString + "vhds/${diskname}.vhd"

Next we specify out the resource group name we want to assign our VM to, I had previous created one I wanted to use. and then we also specify the location because it seems ever CmdLet wants it now

$rg = "SCDEMO"
$loc = "North Europe"

Next we select the image we are interested in, and you can vary this as you need

$image = get-azurermvmimage -Location $loc -PublisherName "MicrosoftWindowsServer" -Offer "WindowsServer" -Skus "2012-R2-Datacenter" -Version 4.0.20150916

Now we grab the Vnet and Subnet I previously created as I generally have these in place and don’t really want to create one every time I create a Virtual machine

$vNet = Get-AzureRmVirtualNetwork
$subnet = Get-AzureRmVirtualNetworkSubnetConfig -VirtualNetwork $vNet

Now I create new nic with construct the nic name from the VMName, honestly you can assign what ever name you want to a nic as long as its unique to the resource group

$nic = New-AzureRmNetworkInterface -Name "${vmname}_nic1" -Subnet $subnet -Location $loc -ResourceGroupName $rg

We need to capture some credential information, I chose to do it this way as I will loop this code up into a function and want the same username and password for everything but you can prompt using get-credentials if you want

$secpassword = convertto-securestring "LS1setup!" -asplaintext -force
$username = "msadmin"
$creds = New-Object System.Management.Automation.PSCredential($username, $secpassword)

Now here is the part that in every example I see you pipe everything along and more times than not I see people struggle with copying the pipe and getting to work, so I decided to do it this way… First I create the VMConfig variable to store all my settings in and as you can see I constantly reference it in each line.

In this first line I create the variable as previously said, assign the VM Name and specify the size

$vmconfig = New-AzureRmVMConfig  -VMName $vmname -VMSize "Standard_A2"

Next we configure some items around the Operating system, like the local admin credentials and the computername which is the same as the VM Name in my case but you can choose to have it different.

Set-AzureRmVMOperatingSystem -Windows -VM $vmconfig -ProvisionVMAgent -EnableAutoUpdate -Credential $creds -ComputerName $vmname

Next we specify the source image to “clone” off as such…

Set-AzureRmVMSourceImage -VM $vmconfig -PublisherName $image.PublisherName -Offer $image.Offer -Skus $image.Skus -Version $image.Version

As NICS are a separate object now we need to assign our previously created NIC to the actual VM

Add-AzureRmVMNetworkInterface -VM $vmconfig -Id $nic.Id

Now we tell the config we need to build a disk with a specific name and URI and give it the options as required

Set-AzureRmVMOSDisk -VM $vmconfig -Name $diskname -VhdUri $vhduri -Caching ReadWrite -CreateOption fromImage

Last but not least I deploy VM with all of the configuration options

New-AzureRMVM -ResourceGroupName $rg -Location $loc -VM $vmconfig

As I said not pretty but it works

Here is another case I was asked about how to have internal clients use the WSUS server they have published when connected to the corporate network and when outside the corporate network to use Microsoft Update

First a simple PowerShell Script

###################################################################3

$intWsusServer = "internalwsus.contoso.com"

$ErrorActionPreference = "SilentlyContinue"

$ping = New-Object System.net.networkinformation.ping

$results = $ping.Send($intWsusServer)

if (!$results)

{

#This means we cant resolve so we are outside the network and use microsoft update

Set-ItemProperty -erroraction "SilentlyContinue" hklm:\software\Policies\Microsoft\Windows\WindowsUpdate\AU\UseWUServer 1

}

else

{

#this means we are inside the network and says to usse internal WSUS server

Set-ItemProperty -erroraction "SilentlyContinue" hklm:\software\Policies\Microsoft\Windows\WindowsUpdate\AU\UseWUServer 0

}

##################################################################

Save this to a file and Push this to the client so it is local on the machine.

Next Create a task in task scheduler as follows

1. Create Basic Task

2. Select Specific Event

3. Configure Trigger as specified

4. Click Start a program

5. Enter location of script

6. Click Finish

And you are done!

Every time the network connection is connected it will invoke the script and test if it can ping the internal server, if it can it will use it , if not it will use Microsoft update

Use the following link to push a task out to all clients via GPO, as part of the same GPO you can have a script which pulls the ps1 file down first

https://technet.microsoft.com/en-us/library/cc725745.aspx

Today I was working on a case for a customer where every web page he visited he got a security error in all browsers.

The main message was “Could not Establish a Trust”

It was a Windows 2008 R2 Server and after validating the name was correct on the certificate they were trying to connect to I looked at the certificate chain and verified it against the Trusted Root Certificate Store on the LocalMachine

Anyway we found that there was only 8 certificates in the Trusted Root Store which is definitely not correct!

So we need to take them from another box and import and here is a little PowerShell Script to help you do it!

First we define the Type variable which will be specifying for later that we will export a certificate

$type = [System.Security.Cryptography.X509Certificates.X509ContentType]::Cert

Next we gather all the certificates from the Trusted Root Store in a working Machine

$certs = get-childitem -path cert:\LocalMachine\AuthRoot

Finally we loop true all certificates and in my examples case we export to a .DER file in the c:\temp directory

foreach($cert in $certs)
{
    $hash = $cert.GetCertHashString()
    $path = "c:\temp\" + $hash + ".der"
     [System.IO.File]::WriteAllBytes($path, $cert.export($type) )
}

It gives the name of the file as the Certificate Hash

And voila all the root certificates have been exported and you can copy and import on to the “broken” machine!

hopefully now things are getting less hectic so I will start blogging again!

look out for some posts very soon..

In Windows Azure Pack you have the ability to link your Automation runbooks to an "Event"

One of the common things that I see is about providing a disaster recovery solution to a customer especially in a multi tenant environment..

During VM creation we link our runbook to the Event as shown

Now everytime a virtual machine is created it will run my EnableHyperVReplicaVM runbook

In the runbook code we access a hidden variable called $PSPrivateMetaData

The important thing first is to get the VMM Job ID, as this allows us to monitor completion of the VMM Job before trying to enable hyper-v replica as otherwise it will fail!

Another part in this runbook is we use the Get-AutomationConnection to allow us to execute against the VMM server and use the Service management automation Assets to the fullest!

Anyway here is the code! And remember there are hundreds of other ways of doing this! J

workflow EnableHyperVReplicaforVM

{

$params = $PSPrivateMetaData.params

$VMMJobID = $PSPrivateMetaData.VMMJobId

$vmmserver = Get-AutomationConnection -Name 'VMMConnection'

$SecurePassword = ConvertTo-SecureString -AsPlainText -String $vmmserver.Password -Force

$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $vmmserver.username, $SecurePassword

$replicaserver = "svvmasp15.corp.contoso.com"

$masterserver = "svvmasp16.corp.contoso.com"

$jobFinalState = InlineScript {

Import-Module VirtualMachineManager

While ((Get-SCJob -ID $USING:VMMJobId).Status -eq 'Running')

{

$jobProgress = (Get-SCJob -ID $USING:VMMJobId).ProgressValue

Start-Sleep -Seconds 3

}

$JobState = (Get-SCJob -ID $USING:VMMJobId).Status

Return $JobState

} -PSComputerName $VmmServer.ComputerName -PSCredential $Credential

$params = $params -split (',') -replace ('"','') -replace ('{','') -replace ('}','')

$vmname = InlineScript

{

Foreach ($p in $USING:params)

{

$key = ($p -split (':'))[0]

$value = ($p -split (':'))[1]

if(($key -eq "Name") -and ($value -ne "null"))

{

return $value

}

}

}

write-output "JobSate Result form VMM: $jobFinalstate"

write-output "VMName: $vmname"

$represult = inlinescript {

Import-Module Hyper-V

Enable-VMReplication –VMName $using:vmname –ReplicaServerName $using:replicaserver –ReplicaServerPort 80 -authenticationtype kerberos

start-vminitialreplication -vmname $using:vmname

$result = (get-vm -name $using:vmname).ReplicationState

return $result

} -PSComputerName $masterServer -PSCredential $Credential

if ($represult -eq "Enabled")

{

$replicaenabled = $true

}

else

{

$replicaenabled =$false

}

write-output "ReplicaEnabledResult: $replicaenabled"

}

Last week in barcelona I had to privilege to present a session called In depth Introduction to Service Management Automation!

We have a nice room and it was pretty full… the best part about it is that it is recorded!

So if you want to check the session see the channel 9 link below!

https://channel9.msdn.com/Events/TechEd/Europe/2014/CDP-B336

By no means is this a unique idea but here is my version…. :)

The problem is trying to validate a certificate on a secure port which you cannot browse to!

For example Lync services can run on port 5061 and you will not be able to browse to that … at least I never was able to :)

anyway here is a quick powershell script to do it for you and give you some information on the certificate back

Copy and paste from here

param([parameter(Mandatory=$true)][string]$computername,[parameter(Mandatory=$true)][int]$port)

#Create a TCP Socket to the computer and a port number
$tcpsocket = New-Object Net.Sockets.TcpClient($computerName, $port)

#test if the socket got connected
if(!$tcpsocket)
{
    Write-Error "Error Opening Connection: $port on $computername Unreachable"
    exit 1
}
else
{
    #Socket Got connected get the tcp stream ready to read the certificate
    write-host "Successfully Connected to $computername on $port" -ForegroundColor Green -BackgroundColor Black
    $tcpstream = $tcpsocket.GetStream()
    Write-host "Reading SSL Certificate...." -ForegroundColor Yellow -BackgroundColor Black
    #Create an SSL Connection
    $sslStream = New-Object System.Net.Security.SslStream($tcpstream,$false)
    #Force the SSL Connection to send us the certificate
    $sslStream.AuthenticateAsClient($computerName)

    #Read the certificate
    $certinfo = New-Object system.security.cryptography.x509certificates.x509certificate2($sslStream.RemoteCertificate)
}

$returnobj = new-object psobject
$returnobj |Add-Member -MemberType NoteProperty -Name "FriendlyName" -Value $certinfo.FriendlyName
$returnobj |Add-Member -MemberType NoteProperty -Name "SubjectName" -Value $certinfo.SubjectName
$returnobj |Add-Member -MemberType NoteProperty -Name "HasPrivateKey" -Value $certinfo.HasPrivateKey
$returnobj |Add-Member -MemberType NoteProperty -Name "EnhancedKeyUsageList" -Value $certinfo.EnhancedKeyUsageList
$returnobj |Add-Member -MemberType NoteProperty -Name "DnsNameList" -Value $certinfo.DnsNameList
$returnobj |Add-Member -MemberType NoteProperty -Name "SerialNumber" -Value $certinfo.SerialNumber
$returnobj |Add-Member -MemberType NoteProperty -Name "Thumbprint" -Value $certinfo.Thumbprint
$returnobj

A while ago I did a blog post and it leverage the Lync Client SDK  to do call testing but it was dependant on the users being in your contact list. This is ok to a degree but what if you needed to just provide an input list of sip uri’s that you needed to query.

So I updated it :)

The main 2 changes are I put it into a function and I used a sub-method that is under the $client.contactmanager called GetContactByURI. this method requires a single line of text to search for and it can return the contact object that we need to add to an IM or a call etc.. the $client btw is the instance of the lync client that is running.

refer to the previous post for most of the explanation but I have tried to comment the code out pretty well.

<#
.SYNOPSIS
Runs an automated script to send a user an IM message, followed by a phone call. If the user picks up it puts the call on hold, plays a recorded file and hangs up
.DESCRIPTION

  Create a file called inputfile.txt and enter each sipuri line by line, this script will test each user and generate a report at the end of it
.PARAMETER Inputfile

.EXAMPLE
.\LyncAutomatedTest.ps1 -inputfile inputfile.txt
#>

[CmdletBinding()]
param([Parameter(Mandatory=$true)][ValidateScript({Test-Path $_})][string]$inputfile)

function TestSIPURI($sipuri,$client)
{

    write-verbose "Testing For $sipuri has begun"
    $conversation = $client.ConversationManager.AddConversation()
    $contact = $client.ContactManager.GetContactByUri($sipuri)
    $null= $conversation.AddParticipant($contact)

    #First Send an Instant Message so we need the InstantMessage Modality
    $IMType = 1
    $PlainText = 0
    $data = New-Object "System.Collections.Generic.Dictionary[Microsoft.Lync.Model.Conversation.InstantMessageContentType,String]"
    $data.Add($PlainText, "This is an Automated Test... The Lync System Has Been Patched. Your desktop phone will be rung shortly to check its operation, The call will connect be put on hold where you will here some music and then end please wait until it completes")
    #This sets the modality type
    $message = $conversation.Modalities[$IMType]
    write-host "Sending Status IM"
    $null = $message.BeginSendMessage($data, $null, $data)
    #Sleeping to allow the instant message to go through
    sleep 20

    #for audio call changing the modality tpype
    $ModalityType = 2
    $message = $conversation.Modalities[$ModalityType]
    write-host "Making Phone Call"
    $null = $message.BeginConnect($null,$null)
    sleep 20
    if ($message.state -eq "Connected")
    {
        $usercontact = $contact.uri.split(":")[1]
        write-host "Successfully Connected Voice Call to:`t $usercontact"
        #Idea to playback a WMA file which says the system is testing itself
        sleep 10
        write-host "Switching Call to OnHold For Playback Music"
        $message.BeginHold($null,$null)
    }
    else
    {
        $usercontact = $contact.uri.split(":")[1]
        write-host "Could Not Connect a Voice Call to:`t $usercontact"
    }
    sleep 10
    write-host "Ending Call"
    #end the call
    $message.Conversation.End()
}

#########################################Main Script Code#########################################

cls
write-host "##################################################################"
write-host "#             Welcome to the Automated Test Call Script          #"
write-host "#                  We will begin the sequence now                #"
write-host "##################################################################"

write-verbose "check if the module is loaded"
$module = get-module -Name "Microsoft.Lync.Model"

#if module is not loaded check it exists and then load else exit
if ($module -eq 0)
{
    Write-Verbose "checking is assemblies are installed and at the correct path"
    $assemblyPath = "C:\Program Files (x86)\Microsoft Office 2013\LyncSDK\Assemblies\Desktop\Microsoft.Lync.Model.dll"
    $assemblyexist = test-path $assemblyPath
    if ($assemblyPath -eq $false)
    {
        cls
        Write-Error -Message "Lync SDK Not Detected Please Download it From https://www.microsoft.com/en-IE/download/details.aspx?id=36824"
        exit 0
    }
        Write-Verbose "importing assembly"
        Import-Module $assemblyPath
}

#use [Microsoft.Lync.Model.ContactInformationType]:: Value here to get the contacttype field you want to use
#50 stands for SIP URI
$contacttype = 50

#Get the client instance we are working with this is the current process lync is operating under
$client = [Microsoft.Lync.Model.LyncClient]::GetClient()
#we start to build a conversation here in an inactive state and we can add stuff to it

Write-Verbose "getting users from $inputfile"
$users = get-content $inputfile
write-host "Processing Users please be patient..."
foreach ($User in $users)
{
    Write-host "Processing $User"
    $result = TestSipURI $user $client
}

write-host "Finished"
write-host "Please check $reportfile for all results"