Rui Freitas’s Blog https://docs.microsoft.com/archive/blogs/ruif/feed.xml The only way of discovering the limits of the possible is to venture a little way past them into the impossible. [Arthur C. Clarke] Wed, 17 Apr 2019 04:09:32 GMT en-US hourly 1 Installing Nano Server on a MinnowBoard Max (at scale) https://docs.microsoft.com/archive/blogs/ruif/installing-nano-server-on-a-minnowboard-max-at-scale Thu, 18 Aug 2016 14:03:38 GMT https://blogs.technet.microsoft.com/ruif/?p=25 The MinnowBoard MAX is an open hardware embedded board with a relatively powerful 64-bit Intel Atom E38XX series System on a Chip at its core. This board has an enormous range of capabilities for hardware and software developers, it makes it a great platform for Nano Server in IoT. Here I will deploy the Nano Server installation option of Windows Server 2016 on an embedded, non-removable SD Card. This solution offers the similar base functionality and capabilities of SATA, SAS, or NVMe – while being cost effective and offering adequate performance. The PowerShell commands below can be integrated into a script and placed in a Windows PE to automate the deployment of Nano Server, either repeatedly on the same device or at scale in an unlimited number of devices. The same steps apply when deploying on traditional servers. For more details about the MinnowBoard visit https://wiki.minnowboard.org  

What you will need

Hardware list

MinnowBoard Max, 2Gb Memory version preferred 5V power supply SD Card, UHS Speed Class I or II preferred Peripherals: Micro HDMI cable and Monitor, USB Keyboard, Network Cable Optional: USB Flash Drive, 8Gb, USB 3.0 or a Windows Deployment Services Server to boot a PowerShell enabled Windows PE

 
Software list

MinnowBoard Max latest x64 firmware https://firmware.intel.com/projects/minnowboard-max, Visit https://wiki.minnowboard.org/UEFI for how to navigate the firmware

Windows Server 2016 ISO file (latest build available) https://www.microsoft.com/en-us/evalcenter/evaluate-windows-server-technical-preview

Windows 10 ADK https://go.microsoft.com/fwlink/p/?LinkId=526740

Intel Drivers for MinnowBoard Max, download each of the Driver packages and extract the CAB files to individual folders https://catalog.update.microsoft.com/v7/site/ScopedViewInline.aspx?updateid=b454eb7e-0105-408d-a83f-75d450d5797a https://catalog.update.microsoft.com/v7/site/ScopedViewInline.aspx?updateid=e5234c03-6635-4171-bd63-8ab461bd1e2a https://catalog.update.microsoft.com/v7/site/ScopedViewInline.aspx?updateid=b54a9960-677e-49eb-b6dc-d36e0a32b14b https://catalog.update.microsoft.com/v7/site/ScopedViewInline.aspx?updateid=e1d3835c-4fe4-4ce7-9d11-d6822bfafefa https://catalog.update.microsoft.com/v7/site/ScopedViewInline.aspx?updateid=63b26746-3daf-45f5-8611-4bcb3b9fe17e (Opt. A/V) you can also get the drivers from Intel, make sure the files are not in MSI format.

Custom Nano Server answer file, create an unattend.xml file on the nanoserver folder with the following XML content

<?xml version='1.0' encoding='utf-8'?>  
<unattend xmlns="urn:schemas-microsoft-com:unattend" xmlns:wcm="https://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="https://www.w3.org/2001/XMLSchema-instance">  
  <settings pass="offlineServicing">  
    <component name="Microsoft-Windows-UnattendedJoin" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">  
        <OfflineIdentification>                
           <Provisioning>    
             <AccountData></AccountData>  
           </Provisioning>    
         </OfflineIdentification>    
    </component>  
  </settings>  
  <settings pass="oobeSystem">  
    <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">  
        <UserAccounts>
          <AdministratorPassword>
              <Value>Pass@word1</Value>
              <PlainText>True</PlainText>
          </AdministratorPassword>
        </UserAccounts>
        <TimeZone>Pacific Standard Time</TimeZone>  
    </component>  
  </settings>  
</unattend>
 
Environment

To complete the steps described here, you should be familiar with SMB File Server, Active Directory, DHCP, Windows Deployment Services, Windows Pre-Installation Environment and Powershell. In my example here I will be joining the Nano Servers to Active Directory domain, you will need one, a DNS and DHCP. The actual installation will be done from a Windows PE, you can either use a USB flash drive or use a Windows Deployment Services server to boot WinPE over PXE. This WinPE will need to have PowerShell enabled, follow the steps here or any similar guide you prefer. Configure the WDS and load this WinPE into the boot images. Create a shared folder on a Server where you will have the files. In my example, I will use the WDS server with a SMB share (DeployShare) with Nanoserver, Blobs and Drivers folders. Copy the content of the NanoServer folder from the Windows Server 2016 ISO, place the extracted drivers in the drivers folder, the Blobs folders will be used to place the generated AD blobs.

 

Update the MinnowBoard Max Firmware and configure

Connect the MinnowBoard to the monitor, the USB Keyboard to the upper white USB port, the Ethernet cable and as last the power connector. To boot and run Nano Server we need a 64-bit UEFI firmware. It is highly probable that your MinnowBoard has a 32-bit UEFI firmware. Follow the instructions on the Wiki to identify which one is installed in you board. You will need to know it to run the correct version of the firmware update utility. To update the firmware, follow the instructions on the Intel MinnowBoard MAX Binary Usage Release Notes. Power off the board and insert the SD Card. The card will need to be set as non-removable for Windows to be able to boot from it. For that, power on the board and press F2 during POST and in the menu select (type exit if you got to the UEFI shell)

Device manager >> System Setup >> South Cluster Configuration >> LPSS & SCC Configuration !! ACPI Reporting MMC/SD Media As <Non-Removable> !!

Setup any other parameter you may need, like Intel VT. On boot manager set the first boot options to EFI Misc Device and the second to PXE over IPv4. Save the configuration and restart, the MinnowBoard should be booting to WinPE from the WDS Server.

 

Install Nano Server

The first step once WinPE start is to define some parameters that I will use throughout the deployment process. I will need an account with permissions to create new AD computer accounts and also access the file share where I have my files. I will also define a server that I will use to generate the AD blob for my Nano server machine account, what packages to install on my Nano Server and the network location where I can find those files. 
$user = 'administrator'
$domain = 'ws2012r2domain'
$password = ConvertTo-SecureString -String 'Pass@word1' -AsPlainText -Force
$cred = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $domain'\'$user, $password
$BlobSvr = 'ws2016wds'
$DShare = '\\'+$BlobSvr+'\DeployShare'
$Packages = 'NanoServer-Compute','NanoServer-DCB','NanoServer-Defender','NanoServer-DSC','NanoServer-FailoverCluster','NanoServer-Host','NanoServer-OEM-Drivers','NanoServer-SecureStartup','NanoServer-Storage'
### other Packages ###'NanoServer-Containers','NanoServer-DNS','NanoServer-Guest','NanoServer-IIS','NanoServer-SCVMM','NanoServer-ShieldedVM','NanoServer-SoftwareInventoryLogging'
  Specific to my hardware configuration, my network takes a few seconds to come online. I added this loop to wait for the network to be ready by testing the connection against my WDS server. 
while ((Test-Connection -ComputerName $BlobSvr -Count 1 -Quiet) -ne 'true')
    {
    Write-Host "Waiting for network ..."
    sleep -Seconds 2
    }
  Next I map a network drive to the WDS server, It will not be using the mapped drive, but it will help maintain an authenticated SMB session with the server. 
New-PSDrive -Name "Y" -Root $DShare -PSProvider "FileSystem" -Credential $cred
  Now is were the fun part begins. We will need a name for the Nano server to provision the Active Directory account and create a blob used to join the server to the Domain during first boot. In my example I will be using the NIC MAC address (for being unique) and will add a prefix to identify it as the Host OS. The next set of commands read the MAC address and manipulate the string to a valid ComputerName and then connect to the domain joined WDS server to generate the AD blob. The AD blob is saved to a folder on the share. 
[string]$mac = (Get-WmiObject -Class win32_networkadapter).macaddress
$Computername = "HST" + $mac.TrimStart().Replace(":","").Substring(0,12)

$DJoin = "C:\windows\system32\djoin.exe /provision /reuse /domain $domain /machine $Computername /savefile $DShare\blobs\$Computername.blob"
$GetBlob = Invoke-WmiMethod -Class win32_process -Name create -ArgumentList $DJoin -ComputerName $BlobSvr -Credential $cred -Impersonation Delegate -Authority kerberos:$domain'\'$BlobSvr
It is good to perform these first, if it fails there is no point in continuing.
  Next step is to identify the SD Card disk, clean it and create the system partitions 
$PDisk = Get-PhysicalDisk |? BusType -EQ SD |Get-Disk
$PDisk | Clear-Disk -RemoveData -RemoveOEM -Confirm:$false
$PDisk | Initialize-Disk -PartitionStyle GPT
 
New-Partition -DiskNumber $PDisk.Number -Size 128Mb -DriveLetter S -GptType "{ebd0a0a2-b9e5-4433-87c0-68b6b72699c7}" | Format-Volume -FileSystem FAT32 -NewFileSystemLabel System 
New-Partition -DiskNumber $PDisk.Number -UseMaximumSize -DriveLetter W -GptType "{ebd0a0a2-b9e5-4433-87c0-68b6b72699c7}" | Format-Volume -FileSystem NTFS -NewFileSystemLabel Windows
  With the partitions created it is time to apply the base Nano image and the Nano packages. WIM index 1 is Standard Edition and index 2 datacenter, the packages are identified as an array of strings defined earlier, modify these as needed. Other Windows features can also be enabled offline at this point. 
Expand-WindowsImage -ImagePath "$DShare\NanoServer\NanoServer.wim" -Index 2 -ApplyPath W:\

ForEach($Package in $Packages)
	{
	$Cabs = Get-ChildItem "$DShare\NanoServer\Packages\" -Recurse -Include *$Package*.cab | Sort-Object -Descending
	ForEach ($Cab in $Cabs)
		{
		Add-WindowsPackage -Path w:\ -PackagePath $Cab.FullName
		}
	}

Enable-WindowsOptionalFeature -FeatureName File-Services -Path W:\
  Now that the image is applied to the SD card, we need to ensure the Nano Server has all the drivers to boot and operate the Hardware. In the next steps we will use the WinPE drivers for SD Card and USB storage devices and apply them to the image, similarly will apply all the MinnowBoard specific drivers from the drivers folder. 
Add-WindowsDriver -Path w:\ -driver (Get-Item -Path X:\Windows\System32\DriverStore\FileRepository\sdstor.inf_amd64_*) -Recurse -Verbose
Add-WindowsDriver -Path w:\ -driver (Get-Item -Path X:\Windows\System32\DriverStore\FileRepository\sdbus.inf_amd64_*) -Recurse -Verbose
Add-WindowsDriver -Path w:\ -driver (Get-Item -Path X:\Windows\System32\DriverStore\FileRepository\usbstor.inf_amd64_*) -Recurse -Verbose
Add-WindowsDriver -Path w:\ -driver (Get-Item -Path X:\Windows\System32\DriverStore\FileRepository\usbhub3.inf_amd64_*) -Recurse -Verbose
Add-WindowsDriver -Path w:\ -driver (Get-Item -Path X:\Windows\System32\DriverStore\FileRepository\usbxhci.inf_amd64_*) -Recurse -Verbose

Add-WindowsDriver -Path w:\ -Driver "$DShare\Drivers\Minnowboard" -Recurse -Verbose
  As next step, create the Boot Configuration Database and the boot loader files to the S: partition and set it as a UEFI system partition 
Invoke-Command -ScriptBlock {Bcdboot w:\windows /s s: /f UEFI} 

Set-Partition -DiskNumber $PDisk.DiskNumber -PartitionNumber 1 -GptType "{c12a7328-f81f-11d2-ba4b-00a0c93ec93b}"
  The last step is to read the AD blob created previously, place it it in the unattend.xml file and apply the unattended to the image. During the first boot this blob will be read and the Nano server will join the domain without requiring user input. 
$unattendxml = [xml](Get-Content "$DShare\nanoserver\unattend.xml")
$blob = (Get-Content -Encoding ASCII -Path "$DShare\blobs\$Computername.blob").ToString()
$blob = $blob.Substring(0,$blob.Length -1)
$unattendxml.unattend.settings[0].component.OfflineIdentification.Provisioning.AccountData = $blob
$unattendxml.Save('X:\unattend.xml')

Apply-WindowsUnattend -Path W:\ -UnattendPath X:\unattend.xml
New-Item -Path W:\Windows\Panther -ItemType Directory -Force
Copy-Item -Path X:\unattend.xml -Destination W:\Windows\Panther\ -Force
  And this will be all, once you reboot ensure the boot order has the UEFI Misc Device as first. Windows will create a new entry for the Windows Boot Manager to keep the BCD and the firmware info synchronized. You can use the local recovery console and/or PowerShell remote to configure and manage your ano Servers.      ]]> Building a PowerShell enabled WinPE for UEFI native boot https://docs.microsoft.com/archive/blogs/ruif/building-of-a-powershell-enabled-winpe-for-uefi-native-boot Tue, 12 Jul 2016 13:29:51 GMT https://blogs.technet.microsoft.com/ruif/?p=105 Summary: The Windows Preinstallation Environment (WinPE) is a small operating system used to install, deploy, and repair  many editions of Windows. The baseline WinPE is on its own a very powerful tool, but it is when you enable PowerShell that it reveals the full potential. In my instructions below make it very simple to create a custom WinPE 64 bit for UEFI native boot using a USB Flash Drive.   Before you start, you will need to install the most recent Windows Assessment and Deployment Kit (Windows ADK), on the computer you are going to use to create the WinPE USB. Get the Windows ADK from the Hardware Dev Center or the latest build from Connect. You will also need a USB flash drive that can be completely cleaned. The capacity will depend of the size and how many Windows images, drivers and tools you will keep in the drive, and whenever possible use USB 3.0 for increased performance.   Once the Windows ADK is installed, start a PowerShell CLI or ISE. The first step is to create two variables with Path to the WinPE files in the ADK and to a temporary folder were we will customize the WinPE and USB flash drive content. 
$WinADK=”C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64”
$WinPETemp=’C:\WinPETemp’
  Next is to create the file structure in the temporary folder and copy the minimum required files from the ADK. This includes the EFI folder with the Windows Boot Manager, the Boot folder with the Boot Configuration Data Store, and the actual WinPE image to the Sources folder. The mount folder will be used to mount the WinPE image file. 
New-Item -ItemType Directory -Path “$WinPETemp\PEDrive\Sources” -Force
Copy-Item -path “$WinAdk\en-us\winpe.wim” -Destination “$WinPETemp\PEDrive\Sources\boot.wim” -Force
Copy-Item -path “$WinAdk\Media\Boot” -Destination “$WinPETemp\PEDrive\” -Recurse
Copy-Item -path “$WinAdk\Media\EFI” -Destination “$WinPETemp\PEDrive\” -Recurse
New-Item -ItemType Directory -Path “$WinPETemp\Mount” –Force
  With all the files in place, the next step is to mount and add the WinPE packages to the base WinPE image. The next set of commands will mount the image and add these from the ADK. 
Mount-WindowsImage -ImagePath “$WinPETemp\PEDrive\Sources\boot.wim” -Index 1 –path “$WinPETemp\Mount”
Add-WindowsPackage -PackagePath “$WinAdk\Winpe_OCS\WinPE-WMI.cab” -Path “$WinPeTemp\Mount” –IgnoreCheck
Add-WindowsPackage -PackagePath “$WinAdk\Winpe_OCS\en-us\WinPE-WMI_en-us.cab” -Path “$WinPeTemp\Mount” -IgnoreCheck
Add-WindowsPackage -PackagePath “$WinAdk\Winpe_OCS\WinPE-WMI.cab” -Path “$WinPeTemp\Mount” –IgnoreCheck
Add-WindowsPackage -PackagePath “$WinAdk\Winpe_OCS\en-us\WinPE-WMI_en-us.cab” -Path “$WinPeTemp\Mount” –IgnoreCheck
Add-WindowsPackage -PackagePath “$WinAdk\Winpe_OCS\WinPE-NetFx.cab” -Path “$WinPeTemp\Mount” –IgnoreCheck
Add-WindowsPackage -PackagePath “$WinAdk\Winpe_OCS\en-us\WinPE-NetFx_en-us.cab” -Path “$WinPeTemp\Mount” –IgnoreCheck
Add-WindowsPackage -PackagePath “$WinAdk\Winpe_OCS\WinPE-Scripting.cab” -Path “$WinPeTemp\Mount” –IgnoreCheck
Add-WindowsPackage -PackagePath “$WinAdk\Winpe_OCS\en-us\WinPE-Scripting_en-us.cab” -Path “$WinPeTemp\Mount” –IgnoreCheck
Add-WindowsPackage -PackagePath “$WinAdk\Winpe_OCS\WinPE-PowerShell.cab” -Path “$WinPeTemp\Mount” –IgnoreCheck
Add-WindowsPackage -PackagePath “$WinAdk\Winpe_OCS\en-us\WinPE-PowerShell_en-us.cab” -Path “$WinPeTemp\Mount” –IgnoreCheck
Add-WindowsPackage -PackagePath “$WinAdk\Winpe_OCS\WinPE-DismCmdlets.cab” -Path “$WinPeTemp\Mount” –IgnoreCheck
Add-WindowsPackage -PackagePath “$WinAdk\Winpe_OCS\en-us\WinPE-DismCmdlets_en-us.cab” -Path “$WinPeTemp\Mount” –IgnoreCheck
Add-WindowsPackage -PackagePath “$WinAdk\Winpe_OCS\WinPE-EnhancedStorage.cab” -Path “$WinPeTemp\Mount” –IgnoreCheck
Add-WindowsPackage -PackagePath “$WinAdk\Winpe_OCS\en-us\WinPE-EnhancedStorage_en-us.cab” -Path “$WinPeTemp\Mount” –IgnoreCheck
Add-WindowsPackage -PackagePath “$WinAdk\Winpe_OCS\WinPE-StorageWMI.cab” -Path “$WinPeTemp\Mount” –IgnoreCheck
Add-WindowsPackage -PackagePath “$WinAdk\Winpe_OCS\en-us\WinPE-StorageWMI_en-us.cab” -Path “$WinPeTemp\Mount” –IgnoreCheck
  This point is the best time to customize the WinPE image that will be loaded to the RAM drive, also known as the X:\ drive. In this example I will just make two simple customizations; add PowerShell CLI to auto start and set the PowerShell execution policy to unrestricted so I can run my unsigned PowerShell scripts without the need to modify the policy on every WinPE boot. 
### Add powershell CLI to startnet.cmd
Add-Content -Path $WinPeTemp\Mount\Windows\system32\startnet.cmd -Value 'start /MAX PowerShell'

### Set powershell script execution policy to unrestricted
Reg.exe load hklm\TempHive "$WinPeTemp\Mount\Windows\system32\Config\SOFTWARE"
Set-ItemProperty -Path HKLM:\TempHive\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell -Name ExecutionPolicy -Value Unrestricted
Reg.exe unload hklm\TempHive
If you plan to use this WinPE image on a Windows Deployment Services server, it is a good idea to add a line to startnet.cmd to map a network drive, very similar to add the PowerShell CLI but using the NET USE command
  Once all the customizations are done we just need to dismount the WinPE image and commit all the changes. 
Dismount-WindowsImage -path “$WinPETemp\Mount” -Save
Important note here is that the WinPE image cannot exceed 500Mb due to the RAM drive limitations. If you need to access large files keep them in the USB flash drive but outside the WinPE image. in the example here copy them to the PEDrive folder and they will be accessible to WinPE on the USB flash Drive. Another option is to keep your large files in a file share and remote access them from the WinPE
  As a last step we need to identify the USB Flash Drive, set the partition style to GPT and format it as FAT32. Then copy all the files in the temporary PEDrive folder to the drive. If you will be using WDS this next step is not required as will you only need to import the modified boot.wim in the temporary folder to the boot images in the WDS Server. 
$Disk= Get-Disk | Where-Object { $_.BusType –eq ‘USB’ } | Out-Gridview –passthru
if ($Disk)
 { 
 Get-Disk -Number ($Disk.number) | Get-Partition | Remove-partition -confirm:$false
 Clear-Disk -Number $Disk.Number -RemoveData -RemoveOEM -confirm:$false | Set-Disk -Number $Disk.DiskNumber -PartitionStyle GPT
 $Partition = New-Partition -DiskNumber $Disk.Number -UseMaximumSize -GptType "{ebd0a0a2-b9e5-4433-87c0-68b6b72699c7}"
 Add-PartitionAccessPath -DiskNumber $Partition.DiskNumber -PartitionNumber $Partition.PartitionNumber -AccessPath “$WinPETemp\Mount”
 Format-Volume -Partition $Partition -FileSystem FAT32 -NewFileSystemLabel PowerPE -Force

 Copy-Item -Path "$WinPETemp\PEDrive\*" -Destination "$WinPETemp\Mount" -Recurse -Force

 Remove-PartitionAccessPath -DiskNumber $Partition.DiskNumber -PartitionNumber $Partition.PartitionNumber -AccessPath “$WinPETemp\Mount”
 }
The UEFI firmware will look for the bootx64.efi file in the FSx:EFI\boot folder and will be able to boot WinPE without the need of a Master Boot Record.
  The different system vendors will have different interfaces to boot from the USB drive, but all of them should have that option.]]>