Enabling Disk Encryption for Windows IaaS VMs using PowerShell

 Connect to your Subscription

PS C:\WINDOWS\system32> Login-AzureRmAccount

Create a New Resource Group or use an existing

PS C:\WINDOWS\system32> New-AzureRmResourceGroup -Name “skpkeyvaultgroup” -location “East US”

ResourceGroupName : skpkeyvaultgroup Location          : eastus ProvisioningState : Succeeded Tags              : ResourceId        : /subscriptions/3a0d1a4f-1d45-4dbc-bb68-xxxxxxxxxxxxx/resourceGroups/skpkeyvaultgroup

Create a New Key Vault

PS C:\WINDOWS\system32> New-AzureRmKeyVault -VaultName "skpkeyvault"  -ResourceGroupName "skpkeyvaultgroup" -location "East US"

Vault Name                       : skpkeyvault Resource Group Name              : skpkeyvaultgroup Location                         : East US Resource ID                      : /subscriptions/3a0d1a4f-1d45-4dbc-bb68-891422694ec1/resourceGroups/skpkeyvaultgroup/ providers/Microsoft.KeyVault/vaults/skpkeyvault Vault URI                        : https://skpkeyvault.vault.azure.net Tenant ID                        : 9aaa5c65-a5d0-415f-9964-ac32ea83c1b1 SKU                              : Standard Enabled For Deployment?          : False Enabled For Template Deployment? : False Enabled For Disk Encryption?     : False Access Policies                  : Tenant ID                :    9aaa5c65-a5d0-415f-9964-xxxxxxxxxxx Object ID                :    e0a21a69-899e-4f98-bc0d-xxxxxxxxxx Application ID           : Display Name             :    satish pandita (#EXT#@youemailaddresshotmail.onmicrosoft.com) Permissions to Keys      :    get, create, delete, list, update, import, backup, restore Permissions to Secrets   :    all

Provision a Key Encryption Key to add a key or secret to the key Vault

 PS C:\WINDOWS\system32> $key = Add-AzureKeyVaultKey -VaultName 'skpKeyVault' -Name 'skpFirstKey' -Destination 'Software'

PS C:\WINDOWS\system32> get-azurekeyvaultkey -vaultname "skpkeyvault"

Vault Name : skpkeyvault Name       : skpFirstKey Version    : Id         : https://skpkeyvault.vault.azure.net:443/keys/skpFirstKey Enabled    : True Expires    : Not Before : Created    : 5/14/2016 3:04:29 AM Updated    : 5/14/2016 3:04:29 AM

PS C:\WINDOWS\system32> $key.key.kid

https://skpkeyvault.vault.azure.net/keys/skpFirstKey/1fc92a75728c4d389997f

Next Register and authorize an application with Azure Active Directory

$rgName = ‘skpkeyvaultgroup'

 $vmName = ‘skpvm1'

 $aadClientID = "74ece368-e67c-4aad-8b35-38xxxxxxxxx"

$aadClientSecret = " r1u53gTueP+5On9hRhcHOfMhBNkYH8riecKxxxxxxxx"

$KeyVaultName = ‘skpKeyVault'

$KeyVault = Get-AzureRmKeyVault -VaultName $KeyVaultName -ResourceGroupName $rgname;

$diskEncryptionKeyVaultUrl = $KeyVault.VaultUri

$KeyVaultResourceId = $KeyVault.ResourceId

 Set-AzureRmKeyVaultAccessPolicy -VaultName $KeyVaultName -ServicePrincipalName $aadClientID -PermissionsToKeys all -PermissionsToSecrets all -ResourceGroupName $rgname;

 Set-AzureRmKeyVaultAccessPolicy -VaultName $KeyVaultName -ResourceGroupName $rgname -EnabledForDiskEncryption

 Set-AzureRmVMDiskEncryptionExtension -ResourceGroupName skpvmresourcegroup -VMName $vmName -AadClientID $aadClientID -AadClientSecret $aadClientSecret -DiskEncryptionKeyVaultUrl $diskEncryptionKeyVaultUrl -DiskEncryptionKeyVaultId $KeyVaultResourceId;

Verify the Encryption status

C:\WINDOWS\system32> Get-AzureRmVMDiskEncryptionStatus -ResourceGroupName  skpvmresourcegroup -VMName skpvm1

OsVolumeEncrypted          : True OsVolumeEncryptionSettings : { "diskEncryptionKey": { "secretUrl": "https://skpkeyvault.vault.azure.net/secrets/1528B96D-AA71-4313-AB26-xxxxxxxxxxx D4/77b94cbbb0ed4d73b9109ef0bxxxxx6", "sourceVault": { "id": "/subscriptions/3a0d1a4f-1d45-4dbc-bb68-8914xxxxx/resourceGroups/skpkeyvaultgroup /providers/Microsoft.KeyVault/vaults/skpkeyvault" } }, "keyEncryptionKey": null, "enabled": true } DataVolumesEncrypted       : True

To  disable volume encryption

PS C:\WINDOWS\system32> Disable-AzureRmVMDiskEncryption -ResourceGroupName skpvmresourcegroup -VMName skpvm1 -VolumeType All

 PS C:\WINDOWS\system32> Get-AzureRmVMDiskEncryptionStatus -ResourceGroupName skpvmresourcegroup -VMName skpvm1

OsVolumeEncrypted          : False OsVolumeEncryptionSettings : { "diskEncryptionKey": null, "keyEncryptionKey": null,

"enabled": false } DataVolumesEncrypted       : False

1. If the OS volume is not encrypted,  then the  data volumes cannot be encrypted
2. If you add another data volume later, You can explicitly run the PS cmdlets Set-AzureRmVMDiskEncryptionExtension with -Volumetype Data  or ARM template to turn on encryption on the newly added data volume  or if you  reboot the VM.  the bitlocker extension will encrypt any un-encrypted data volumes presuming the VM was previously configured to encrypt data volumes/all volumes.
3. For bitlocker enabled VMs' you will notice another  Volume "Bek Volume", it is  local volume in which the BitLocker keys [secret] are stored locally so that the encrypted OS volume can boot on start/reboot etc. This volume is local to the VM and is not persisted in storage

Before I proceed with this exercise, Consider to review following blogs for overall information on Azure Backups.

Azure Backup Overview: https://msdn.microsoft.com/en-us/library/azure/hh831419.aspx

Azure Backups with DPM, where Azure Backup Service communicates with DPM server to push backups into Cloud and thus backup all DPM workload to azure as a long term retention. Use Cloud as your tape replacement  and offsite backups..

http://azure.microsoft.com/en-us/documentation/articles/backup-azure-backup-cloud-as-tape/#what-is-the-backup-schedule

http://blogs.technet.com/b/systemcenter/archive/2014/03/16/using-azure-backup-with-dpm.aspx

Azure VM Backups:http://azure.microsoft.com/blog/2015/03/26/azure-backup-announcing-support-for-backup-of-azure-iaas-vms

Power of backing up to Azure: http://azure.microsoft.com/en-us/services/backup/

Backup Pricing:http://azure.microsoft.com/en-in/pricing/details/backup/

 To backup Azure VMs  

1. Discover the Azure VM’s that you want to backup
2. Register the VMs to install backup extension for backup preparation
3. Protect the VM’s by setting backup and retention policy

Few things to note during backup and restore:

      1.You can backup a VM regardless it is online or offline

      2 If you have deleted original VM, you can restore the VM with same or different instance Name on existing or different cloud service

      3. If original VM is online or offline, you cannot restore the VM with same instance name, You have to restore VM with a different instance Name

      4. All disk associated with the VM's will  automatically be restored with data during restore time

      5.No need to deploy any agent on Azure VM's, it is automatically handled by azure-backup service

 In the following example I want to backup a VM called ‘test”, that has and OS and Data disk

Create a Backup Vault in the same region as your Azure VMs

 Form the portal go to “Recovery Services”->”New”-> “Backup Vault”->”Quick Create”. In this example the name for Backup Vault is “AzureBackupVault1” and click on “Create Vault”

Next Click on the “AzureBackupVault1 ->” that was just created

To Protect Azure Virtual Machines, following 3 steps as shown in following screen capture will be performed.

Click on “Discover Virtual Machines”  and  on “Discover” as shown in following picture

Once is discover is completed Click on “Register”

To verify registration is successful. Click on “Jobs”

Next go to “Policies” and define the backup policy and add the registered VM “Test” in the backup policy

Go to “Jobs” to verify the status, as shown below

In my case, I  initiated the first backup:  Go to “Protected Items” and click on “Backup Now”

Next click on “Jobs” to check backup status

To restore the VM, Go to Protected Items, Click on “Restore” and select a Recovery Point

Select the VM Instance Name, it could be different Name or same name in same or different cloud service. In my example I deleted the test VM and restored it with
a new Instance Name

Please Note: VM Name does not change, Instance Name can be changed, depending on how you restore

DISCLAIMER: This posting is provided "AS IS" with no warranties and confers no rights 

In this exercise we will work on using Network Security Group feature, which is part of Azure Networking stack to control traffic between VMs or between subnets within a VNET. This feature allows us to secure backend and frontend server communication. 

Current Configuration in the lab environment:
1.  Storage Accounts:  satishlocalstorage
2. Cloud Service: satishVnet1cloudsvc
3. VNET:

             VNET “SatishVnet1” has 3 subnets   InfraSubnet1, APPSubnet1 and DBSubnet1
                        i. Subnet “InfraSubnet1” 192.168.10.0/ 24  contains VM  ClientVM1
                       ii. Subnet “APPSubnet1”  192.168.11.0/24 contains  VM WebVM1
                      iii. Subnet “DBSubnet1”  192.168.12.0/24 contains VM SQLVM1

Before I set few scenarios for this exercise, let us review the current VNET and VM Configuration to ensure VMs are in correct subnet.
1. Use following PS cmdlets to review current address space for VNET “SatishVnet1”
Get-AzureVNetConfig | select -ExpandProperty XMLconfiguration

<AddressSpace>
  <AddressPrefix>192.168.0.0/16</AddressPrefix>
</AddressSpace>
<Subnets>
  <Subnet name="InfraSubnet1">
    <AddressPrefix>192.168.10.4/24</AddressPrefix>
  </Subnet>
  <Subnet name="APPSubnet1">
    <AddressPrefix>192.168.11.4/24</AddressPrefix>
  </Subnet>
  <Subnet name="DBSubnet1">
    <AddressPrefix>192.168.12.4/24</AddressPrefix>
  </Subnet>
  <Subnet name="GatewaySubnet">
    <AddressPrefix>192.168.0.0/29</AddressPrefix>
  </Subnet>

Or
PS C:\azuretest> Get-AzureVNetConfig -ExportToFile c:\azuretest\satishvnetconfig.xml

2. Review the VM configuration status
PS C:\test\scripts> get-azurevm -ServiceName satishVnet1cloudsvc | select-object name, ipaddress, instancestatus | where  {$_.instancestatus -eq "ReadyRole"}

Name                                    IpAddress                               InstanceStatus
----                                       ---------                                       --------------
ClientVM1                               192.168.10.4                            ReadyRole
SQLVM1                                  192.168.12.4                            ReadyRole
webvm1                                  192.168.10.100                         ReadyRole

 The first thing I want to do is move VM “webvm1” in the correct subnet “APPSubnet1" which is 192.168.11.0/24
(In my scenario since webvm1 is having static IP address, I had to perform additional steps)

3. Get a static IP address of the VM
PS C:\azuretest> $staticipvm=get-azurevm -servicename 'satishVnet1cloudsvc' -name 'webvm1'
PS C:\azuretest> Get-AzureStaticVNetIP -vm $staticipvm

IPAddress
---------
192.168.10.100

 
4. Remove Static IP from VM webvm1 and move it to subnet “APPSubnet1”

PS C:\azuretest> Get-AzureVM -ServiceName satishVnet1cloudsvc -Name webvm1 | Remove-       
                              AzureStaticVNetIP | Update-AzureVM

PS C:\azuretest> Get-AzureVM –ServiceName satishVnet1cloudsvc –Name webvm1 | Set-AzureSubnet –SubnetNames APPSubnet1 | Update-AzureVM

       Wait for a minute or so for the VM to restart

5. Review the VM Configuration Status to verify webvm1 is on 192.168.11.0/24 subnet

Name                                    IpAddress                               InstanceStatus
----                                           ---------                                --------------
ClientVM1                               192.168.10.4                            ReadyRole
SQLVM1                                  192.168.12.4                            ReadyRole
webvm1                                  192.168.11.4                            ReadyRole

Now let us test few scenarios to control traffic between subnets within a VNET

Scenario

a.  Create a rule to allow port 80  from subnet  “InfraSubnet1”  to subnet “APPSubnet1” and block all other traffic from subnet “InfraSubnet1”  to subnet “APPSubnet1”
      (VM “WEBVM1” in subnet “APP1Subnet1” currently listens on TCP port 25/53/80)

b. Block all traffic  to 192.168.11.0 except http inbound from 192.168.10.0/24 to 192.168.11.0/24

c. Create  another  rule to allow another port 25  from subnet  “InfraSubnet1”  to subnet “APPSubnet1” and block all other traffic to subnet “APPSubnet1”

d. Remove the rule that you created for Task  “a” and “c” above and allow VM’s in subnet “APPSubnet1” to listen on a port range from 25 to 80 from subnet “InfraSubnet1” instead of port 25 and 80 only and ensure task “b” does not get affected.

e. Review network security group rules

f. Remove Network Security Group (roll back to default setting)

a) Create a rule to allow port 80  from subnet  “InfraSubnet1”  to subnet “APPSubnet1” and block all other traffic from subnet “InfraSubnet1”  to subnet “APPSubnet1”

 Create a Security Group called "AzureSNG1-80"
PS C:\scripts> New-AzureNetworkSecurityGroup -Name "AzureSNG1-80" -location "East US"

Name                                    Location                              
----                                           --------                               
AzureSNG1-80                      East US

Associate Security Group to "APPSubnet1"
PS C:\ > Get-AzureNetworkSecurityGroup -Name "AzureSNG1-80"  | set-AzureNetworkSecurityGrouptoSubnet -VirtualNetworkName " SatishVnet1" -subnetname "APPSubnet1"

Allow http traffic to  "APPSubnet1" from “InfraSubnet1”
PS C:\ > get-AzureNetworkSecurityGroup -name "AzureSNG1-80" | set-AzureNetworkSecurityRule -Name "Allow Http" -type Inbound -priority 100 -action Allow -sourceaddressprefix "192.168.10.0/24" -sourceportrange "*"  -destinationaddressprefix "192.168.11.0/24" -destinationportrange "80" -protocol TCP

Name  : AzureSNG1-80
Rules :
           Type: Inbound

        Name                 Priority  Action   Source Address  Source Port   Destination      Destination    Protocol
                                                Prefix          Range         Address Prefix   Port Range
        ----                 --------  ------   --------------- ------------- ---------------- -------------- --------
        Allow Http           100       Allow    192.168.10.0/24 *             192.168.11.0/24  80             TCP
      

Block all other traffic from 192.168.10.0/24 to 192.168.11.0/24
PS C:\test\scripts> Get-AzureNetworkSecurityGroup -Name "AzureSNG1-80" | SET-AzureNetworkSecurityRule -name "Block all" -type Inbound -Priority 200 -action Deny -sourceaddressprefix "192.168.10.0/24" -sourceportrange "*" -destinationaddressprefix "192.168.11.0/24" -destinationportrange "*" -protocol *

Name  : AzureSNG1-80
Rules :

           Type: Inbound

        Name                 Priority  Action   Source Address  Source Port   Destination      Destination    Protocol
                                                Prefix          Range         Address Prefix   Port Range
        ----                 --------  ------   --------------- ------------- ---------------- -------------- --------
        Allow Http           100       Allow    192.168.10.0/24 *             192.168.11.0/24  80             TCP
        Block all            200       Deny     192.168.10.0/24 *             192.168.11.0/24  *              *

Test/Verify the results
C:\PortQryV2>portqry -n 192.168.11.4 -p tcp -e 80

Querying target system called:
 192.168.11.4
Attempting to resolve IP address to a name...
Failed to resolve IP address to name
querying...
TCP port 80 (http service): LISTENING
C:\PortQryV2>portqry -n 192.168.11.4 -p tcp -e 25
Querying target system called:
 192.168.11.4
Attempting to resolve IP address to a name...
Failed to resolve IP address to name
querying...
TCP port 25 (smtp service): FILTERED

 b. Block all traffic  to 192.168.11.0 except http inbound  from 192.168.10.0/24 to 192.168.11.0/24

PS C:\> Get-AzureNetworkSecurityGroup -Name "AzureSNG1-80" | SET-AzureNetworkSecurityRule -name "Block all" -type Inbound -Priority 200 -action Deny -sourceaddressprefix "*" -sourceportrange "*" -destinationaddressprefix "192.168.11.0/24" -destinationportrange "*" -protocol *

c. Create  another  rule to allow another port 25  from subnet  “InfraSubnet1”  to subnet “APPSubnet1” and block all other traffic to subnet “APPSubnet1”

PS C:\> get-AzureNetworkSecurityGroup -name "AzureSNG1-80" | set-AzureNetworkSecurityRule -Name "Allow smtp" -type Inbound -priority 110 -action Allow -sourceaddressprefix "192.168.10.0/24" -sourceportrange "*"  -destinationaddressprefix "192.168.11.0/24" -destinationportrange "25" -protocol TCP

d. Remove the rule that you created for Task  “a” and “c” above and allow VM’s in subnet “APPSubnet1” to listen on a port range from 25 to 80 from subnet “InfraSubnet1” instead of port 25 and 80 only and ensure task “b” does not get affected.

PS C:\> Get-AzureNetworkSecurityGroup -name "AzureSNG1-80" | remove-azurenetworksecurityrule -name "Allow http"
PS C:\> Get-AzureNetworkSecurityGroup -name "AzureSNG1-80" | remove-azurenetworksecurityrule -name "Allow smtp"
PS C:\> get-AzureNetworkSecurityGroup -name "AzureSNG1-80" | set-AzureNetworkSecurityRule -Name "Allow Http" -type Inbound -priority 100 -action Allow -sourceaddressprefix "192.168.10.0/24" -sourceportrange "*"  -destinationaddressprefix "192.168.11.0/24" -destinationportrange "25-80" -protocol TCP

e . Review network security group rules

PS C:\> Get-AzureNetworkSecurityGroup -name "AzureSNG1-80" -detailed

Name  : AzureSNG1-80
Rules :

           Type: Inbound

        Name                 Priority  Action   Source Address  Source Port   Destination      Destination    Protocol
                                                Prefix          Range         Address Prefix   Port Range
        ----                 --------  ------   --------------- ------------- ---------------- -------------- --------
        Allow Http           100       Allow    192.168.10.0/24 *             192.168.11.0/24  25-80          TCP
        Block all            200       Deny     *               *             192.168.11.0/24  *              *
        ALLOW VNET INBOUND   65000     Allow    VIRTUAL_NETWORK *             VIRTUAL_NETWORK  *              *

f. Remove the Network Security Group

PS C:\> Get-AzureNetworkSecurityGroup -Name "AzureSNG1-80"  | Remove-AzureNetworkSecurityGroupfromSubnet -VirtualNetworkName " SatishVnet1" -subnetname "APPSubnet1"
PS C:\> Remove-AzureNetworkSecurityGroup "AzureSNG1-80"

More details:

http://msdn.microsoft.com/en-us/library/azure/dn848316.aspx

http://azure.microsoft.com/blog/2014/11/04/network-security-groups/

DISCLAIMER: This posting is provided "AS IS" with no warranties and confers no rights 

Working on creating some VMs in my lab environment, thought why not post it as a reference for others

Service Configurations
1. Storage Accounts: satishlocalstorage, satishvnet1sa
2. Cloud Service: satishcloud, satishVnet1cloudsvc
3. VNET: Satishnetwork (infrasubnet, websubnet SQLsubnet), Satishvnet1 (infrasubnet1, appsubnet1)

Goal

1. Deploy  VMs  in a specific  storage account, cloud service and  VNET
2. Setting a static IP address for your existing VM
3. Create a New VM and configure a static IP during the VM deployment
4. Capturing a Sysprep’ed / generalized VM testvm2 as a template for future deployments  & deploy the image
5. Capturing a running VM image for a quick snapshot & redeploy the VM to a good point in time from the latest capture

1. Deploy  VMs  in a specific  storage account, cloud service and  VNET
Associate subscription to the storageaccount
PS C:\> Set-AzureSubscription -SubscriptionName "yoursubscriptionaname" -CurrentStorageAccountName "satishlocalstorage"
  (All VM’s will now be created in “satishlocalstorage” account” by default

Create a VM and from a latest image release date(best practice)
PS C:\> $image=(get-azurevmimage | where {$_.imagefamily -eq "windows Server 2012 R2 DataCenter"} | sort publisheddate -descending | select-object -first 1).imagename

PS C:\> New-AzureVMConfig -Name "testvm1" -InstanceSize "Basic_A1" -imagename $image | add-azureprovisioningconfig -windows -adminusername userid -Password yourpassword | set-azuresubnet -subnetnames "infrasubnet" | New-AzureVM -ServiceName "satishcloud" –vnetname “satishnetwork”

 VM status
PS C:\> Get-AzureVM -ServiceName "satishcloud" -name "testvm1"  | select-object name, ipaddress, powerstate, servicename

Name                          IpAddress                     PowerState                    ServiceName
----                                    ---------                         ----------                        -----------
testvm1                       10.101.2.4                    Started                             satishcloud

2. Setting a static IP address for your existing VM

Configure VM “testvm1” with a static ip address of 10.101.2.99 or 10.101.2.5(whichever is available)

PS C:\> Test-AzureStaticVNetIP -vnetname "satishnetwork" -IPAddress "10.101.2.5"

 PS C:\> Test-AzureStaticVNetIP -vnetname "satishnetwork" -IPAddress "10.101.2.99"
                               IsAvailable          : True
                                   AvailableAddresses   : {}
                                  OperationDescription : Test-AzureStaticVNetIP
                                  OperationId          : d497b983-d876-3c22-a266-c4eb0c0c773e
                                   OperationStatus      : Succeeded

PS C:\> get-azurevm -servicename "satishcloud" -name "testvm1" |Set-AzureStaticVNetIP -    iPAddress "10.101.2.99" | update-Azurevm
         (This command will restart and update the VM with new static IP address)

PS C:\> Get-AzureVM -ServiceName "satishcloud" -name "testvm1"  | select-object name, ipaddress, powerstate, servicename

                        Name                          IpAddress                     PowerState                    ServiceName
                               ----                                 ---------                                ----------                     -----------
                              testvm1                           10.101.2.99                         Started                       satishcloud

PS C:\> $staticipvm=get-azurevm -servicename 'satishcloud' -name 'testvm1'
PS C:\> Get-AzureStaticVNetIP -vm $staticipvm

                             IPAddress
                                ---------
                             10.101.2.99
   If you want to remove static IP for a VM, run
Get-AzureVM -ServiceName “satishcloud” -Name “testvm1l”  | Remove-AzureStaticVNetIP | Update-AzureVM

3. Create a New VM and with a static IP address

PS C:\> $image=(get-azurevmimage | where {$_.imagefamily -eq "windows Server 2012 R2 DataCenter"} | sort publisheddate -descending | select-object -first 1).imagename

PS C:\> New-AzureVMConfig -Name "Testvm2" -InstanceSize "Basic_A1" -imagename $image  | add-azureprovisioningconfig -windows -adminusername username -Password yourpassword | set-azuresubnet -subnetnames "infrasubnet" | Set-AzureStaticVNetIP -IPAddress "10.101.2.100" | New-AzureVM -ServiceName "satishcloud" –vnetname “satishnetwork”

4.  Capturing a Sysprep’ed / generalized VM "testvm2" as a template for future deployments  & deploy the image

PS C:\>  Save-AzureVMImage -ServiceName satishcloud -Name testvm2 -ImageName webtemplate1 -ImageLabel webtemplate1 -OSState Generalized
(this command will delete the VM testvm2 and create an image from this VM

  Deploy a new VM called webvm1 from the capured generalized image webtemplate1

PS C:\>  New-AzureVMConfig -Name "webvm1" -InstanceSize "Basic_A1" -imagename webtemplate1 | add-azureprovisioningconfig  -windows -adminusername userid1 -Password yourpassword | set-azuresubnet -subnetnames "infrasubnet"  | Set-AzureStaticVNetIP -IPAddress "10.101.2.100" | New-AzureVM -ServiceName "satishcloud" –vnetname “satishnetwork"

PS C:\> get-azurevm -ServiceName "satishcloud" -name "webvm1" | select-object name, ipaddress, status
                                         Name                                    IpAddress                               Status
                                            ----                                           ---------                                  ------
                                         webvm1                                  10.101.2.100                      ReadyRole

5. Capturing a running VM "webvm1" for a quick snapshot & redeploy the VM to a good point in time from the latest capture 

PS C:\> Save-AzureVMImage -ServiceName satishcloud -Name webvm1 -ImageName webvm1snapshot -ImageLabel webvm1snapshot -OSState Specialized
PS C:\> Get-AzureVMImage | where {$_.imagename -like "web*"}  |select-object imagename,category,RoleName
                         

                                 ImageName                               Category                            RoleName
                               ---------                                           --------                                --------
                               webtemplate1                                   User                                    Testvm2
                              webvm1snapshot                          User                                    webvm1

(Next I Deleted the VM webvm1 and redeployed it, all previous configurations were intact including domainjoin in my case 

 PS C:\> Remove-AzureVM -ServiceName "satishcloud" -name "webvm1" -DeleteVHD
PS C:\> New-AzureVMConfig -Name "webvm1" -InstanceSize "Basic_A1" -imagename webvm1snapshot | set-azuresubnet -subnetnames "infrasubnet" | Set-AzureStaticVNetIP -IPAddress "10.101.2.100" | New-AzureVM -ServiceName "satishcloud" –vnetname “satishnetwork”

Note: when the VM is back online,and when you try to login for the first time you will see a dialog pop up stating the VM was not properly shutdown, this may be an expected behavior, as we captured a running VM

Stopped all VMs in cloud service "satishcloud"

PS C:\> get-azurevm -ServiceName "satishcloud" | stop-azurevm

DISCLAIMER: This posting is provided "AS IS" with no warranties and confers no rights 

By default  all VM’s within a VNET can communicate with each other, regardless what address space/subnet they belong to

 By default communication between VNETs is blocked, you can establish communication between  two or more virtual networks together and that too securely with IPsec/IKE S2S VPN tunnels

There could be several reasons why you want to enable communication between VNETS. e.g.

                              You want to setup a custom geo-replication or synchronization  without going over internet

                             Company A wants to share specific data/web services  with Company B in a secure way  without going over internet or an inter org communication that are on multiple VNETS.

                             You want to setup SQL AO

 In my scenario, I want to access:

A website hosted on a  VM named  “web1vnet2” in VNET “SatishVnet2” from from VM named “dc1vnet1” in VNET “SatishVnet1” or ViceVersa

1.  Windows Firewall enabled on every VM with required exceptions in place
2. All endpoints for all VM’s are removed
3. Web2Vnet2 is listening on port 80 only

 I will follow following  6  key sections for this configuration:

1. Plan your IP address ranges    

2. Create your virtual networks

3. Add local networks

4. Create the dynamic routing gateways for each VNet.

5. Connect the VPN gateways

6. Verify connectivity

1. Plan your IP address ranges.  2. Create your virtual networks

VNET1

VNET Name        Cloud Service Name                                     StorageAccountName                  Location

satishVnet1         satishVnet1cloudsvc                                         satishvnet1sa                                East US

VM config

 VNET2

VNET Name        Cloud Service Name                                     StorageAccountName                  Location

satishVnet2         satishVnet2cloudsvc                                      satishvnet2sa                                   West US

VM Config

3. Add local networks

Next we need to configure “Add Local Network” for cross
premises connectivity

From your portal click on

               New->Network
Services->Virtual Network->Add Local Network

For VPN Device IP Address, use any  dummy IP address for now, since we have not
created the gateway yet, once gateway is created we will upate the VPN Device
IP Address with the actual gateway IP

See picture below

and Next specify the address space

Repeat the steps again  for  VNET “SatishVnet2” 

 .

Next you’ll point each VNet to the other as a local network.

In this case I will point VNET  “SatishVnet1” to “SatishVnet2” and  point VNET “SatishVnet2” to “SatishVnet1”

 In the Management Portal, go to the Configure page for VNET “SatishVnet”. Under site-to-site
connectivity, select Connect to the local network, then select SatishVnet2-172addressspace as the local network
and add VPN Gatewaysubnet and then click “Save”

 See screen capture below

.

4. Create the dynamic routing gateways for each VNET

 Go to “Networks”, Select  VNET “SatishVnet1”,  Select “Dashboard”  and create the “Dynamic Routing”

See picture below

Go to “Networks”, Select  VNET “SatishVnet2”,  Select “Dashboard”  and create the “Dynamic Routing”

See picture below

Wait for 15 to 20 minutes till gateway is created

See picture below (the gateway for SatishVnet1

Next we need to update the VPN Device IP address for each “Local Network”  with this new gateway address

.

5. Connect the VPN gateways   

Set the IPsec/IKE pre-shared keys to be the same. You can use it with REST API or PowerShell,  in this example I am using azure PowerShell, see pic below

6. Verify connectivity is established using PowerShell or from portal

On Portal:   Go to Networks-> select VNET “SatishVnet1”->Dashboard

 See picture below

Launching website http://dc1vnet2  from VM dc1vnet1

DISCLAIMER: This posting is provided "AS IS" with no warranties and confers no rights 

 For more details go to : http://msdn.microsoft.com/en-us/library/azure/dn690122.aspx

One of the options to  Monitor EMC Storage e.g. VNX,  CLARIION  is using EMC Storage Integrator v3.0.1151.6309 for Windows Suite that includes ESI Service and ESI SCOM Management Pack.

In this post, I will go through high level steps on monitoring EMC VNX Storage with SCOM 2007 R2/2012

 EMC Software Requirements

• EMC Storage integrator setup file
  (ESI.3.01151.Setup.X64.exe) aka ESI Service                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 Note:  ESI Service is a communication link between ESI and ESI SCOM Management Packs. It supports all EMC Storage systems and its sub components. 
• SCOM Management pack
  (ESI.SCOM.ManagementPscks.3.0.1151.6309.setup.exe)

 Hardware & SCOM version Requirements

•  At least one dedicated Host/VM with Windows Server 2008R2 and up,  on which ESI service will be installed, (Monitoring Station)
•  SCOM 2007 SP1/ SCOM 2007 R2, SCOM 2012 SP1 (SCOM Server)

 Configuration Steps

Once you extract the zip file. Folder “x64” contains EMC Storage integration Service aka ESI Service and Folder “SCOM.ManagementPacks” contains  EMC management pack for SCOM (see below)

INSTALLATION of ESI SERVICE on EMC Monitoring station

Configure a dedicated server /VM as a Monitoring station with SCOM agent installed on it (The Operating system has to be Windows 2008 or Windows 2008 R2 or Windows 2012 only

1. Install  EMC Storage Integrator
2. Verify “ESI Service” is running and as “Network Service”
3. On the monitoring station ,click on “Start” and launch “EMC Storage Integrator”
4. Go to EMC Storage Integrator->Storage Systems->Add Storage System
5. In this scenario, I chose the option   VNX-Block as system type from the drop down menu
6. For username and password, pass the USERID and PASWORD that was created in VNX
7. Specify SPA and SPB IP address ( IP of storage processor)
   1. Repeat step 5 thru 7 for all  type of different storage you have in the environment
8. You can leave port number as 443 as default, or change if you want and configure the access accordingly.
9. Click on test connection, verify the results and the new Arrays will be added under storage systems.

      10. Next we need to publish the connection

1.  Go to “EMC Storage Integration”, -> “Publish Connection”

                   b.    Once you click on Publish Connection following screen will appear

                             i.    Under IP Address /Name you can type “local host or the IP address of this server( EMC Monitoring station)       

                            ii.    Publish to should be “ESI Service”                                
                            iii.   Click  on “Refresh”                                 
                            iv.   Under  “Local -  Storage and Replication Systems”, you will see EMC devices that you added in above step                                   
                            v.    Select the devices and click on “Add”                                     
                           vi.    At this point ESI Service is configured on the EMC Monitoring station

       11.   To confirm HTTP/HTTPS connectivity(communication) between EMC Monitoring station and EMC Storage(VNX in this example),  perform any    of the following steps

             http://IP_OF_EMC_Monitoring_Station:54500/esi/console   or      https://IP_OF_EMC_Monitoring_Station:54501/esi/console 

   If you need to customize ports,  implement new certificates,  refer to document   “EMC Storage Integrator for Windows Suite”

12.  On the EMC Monitoring station change  the following registry to decimal 5120

 Next Step is to Configure  EMC Management PACK on SCOM SERVER

1. Execute the MSI and import the  EMC Management Packs on the SCOM Server
2. You will see the  new View as "EMC Storage Integrator" in SCOM Console

      3.  Configure  Overrides:    In SCOM Console go to:  Authoring->Object Discovery,    Search for “EMC SI Service Discovery”

•  In the above screen capture on the overrides (in this example)
• Discovery is enabled
• Override value  for parameter “ESI Service host” is  the IP address of the server on
  which ESI Service was installed (EMC Monitoring Station)
• If you want ESI Service to connect with an HTTP connection instead of an HTTPS,
  you can set the override for the same(a security risk though)

       4. Next  setup the ESI Monitoring Station as host override

           Go to  Authoring->object Discoveries-  and then Type “EMC SI Service Discovery”

           Click on Override and select “For a  specific  object of class: Windows Computer” and Select the ESI Monitoring Station

      5. For additional overrides, custom configurations, refer to the EMC Storage integrator document

 DISCLAIMER: This posting is provided "AS IS" with no warranties and confers no rights 

Compliance Setting in SCCM 2012 is to asses and remediate the configuration and compliance of servers, workstations, including mobile devices in your organization

In this post, I will pick few examples on using Compliance settings including reporting and reviewing few log files to see the record process information.

 Example1:

Assess/track the file version and report Compliance or Non-Compliance,  if the file version does not match the specified version  that is targeted to a specific device collection that has 2 members

Start with Configuration Item that will contain the configuration settings

Go to “ Asset and Compliance-->Compliance Settings-->Configuration items”

Right click and select “Create  configuration Item”  Enter/select the following values and click “Next”

Select “Always assume application is installed”

If you have an application that has an MSI you can also select “use Windows Installation Detection” Click “Next

 Following Screen will appear and click “New”

After you click on “New” enter setting name and change setting type to “File System” and then click on Browse

When you click on “Browse”, connect to the computer that has the new version of the file and update the check boxes as below, then click on “ADD”

Once you click on “Add” update the file property as below and click “ok”

Click on “Compliance Rules” tab

On “Compliance Rules” tab, edit each rule and Change the “Severity” to Warning for each “Compliance Rule”

Note: when you click on 2nd rule "version check"For Rule "Version check"

At this point the configuration item is created.

Next we will create the “Configuration Baseline” and in this “Configuration Baseline” add the configuration item that we created and deploy it to a collection for compliance evaluation.

Deploy this Configuration Baseline to a “Collection”

Click on “Run summarization”

Now let us check the compliance evaluation/Reporting, which can be reviewed on the client and from the SCCM console.

Evaluating Compliance on the client

On the client workstation Go to control panel-->Configuration Manager-->Actions and refresh “Machine policy Retrieval and Evaluation Cycle”

Go to the “Configuration Tab”, you will see that configuration baseline is assigned to this computer

Click on “Evaluate”  "Refresh"  and then “View Report”

On this Workstation since I am using older version of MSPAINT, it is shown as “Non-Compliant”

The another workstation has the correct file version and is shown as “Compliant

Evaluating the compliance from SCCM Console

Launch Console, Go to Asset and Compliance->Monitoring->Alerts

Go to Monitoring->Deployments

A variety of reports can be generated from: Monitoring->Reporting->Compliance and Setting Management

Example 2:

 In this example, we will use a PowerShell Script to check a specific service and report on compliance/non-compliance

Scenario:

•  If “Spooler Service” is running and the start mode is automatic, It is Compliant
•  If Service is running and start mode is set to manual or disabled, it is non-compliant
•  If service is not running and start mode is automatic or manual or disabled, it is non- Compliant         

Though you can remediate it also by having a remediation script, in this scenario I am not using that feature.

PowerShell script will be used to achieve this goal:

            function CheckService {

              param($Services)

           $Compliance= "Compliant"

           $StoppedServices= Get-WmiObject Win32_Service -Filter {state='stopped' or startmode!='auto'}

       $StoppedServices | ForEach-Object {if ($services -match $_.Name) {$Compliance = "NonCompliant"}}

       $Compliance

}

 $services= "spooler"

checkService-Services $services

Go to SCCM Console->Assets and Compliance->Compliance Settings->Configuration Items

 Start “Create Configuration Wizard”, enter Name, and Click “Next”, select “Operating System that will
assess this configuration for compliance”

Then at the Setting option click “New” and select the setting type “Script” Data type “String” and click on “Add Script”

Under Script Language choose “Windows PowerShell” and import/paste the script, Click “Ok”

Create a compliance rule as below

Next go to configuration baseline, create a new configuration baseline and add “Configuration Item’ to
this baseline and deploy it to a collection, like we did in previous example

 Configuration Packs

Configuration Packs are predefined configuration baselines that you can use to deploy for OS and applications e.g.  Exchange Server 2010, Windows Server 2008,
Windows 7, IE, Microsoft office that contains the configuration items you want to monitor.

 You can get these configuration packs from:

http://technet.microsoft.com/en-us/solutionaccelerators/cc835245.aspx

http://pinpoint.microsoft.com/en-US/applications/microsoft-security-compliance-manager-12884902442

 Download Security Compliance Manager (SCM) from the above site and install it on any workstation/server.

Launch SCM and export the desired Baseline to SCCM DCM 2007 and then go to SCCM 2012 console and import
it under configuration baseline and tweak it based on your requirements.

Deploy it to devices through collections and evaluate on a defined schedule.

Few Log files to review the record process information on the site server and on the client

DCMAgent.log:  Records high-level information about the evaluation, conflict reporting, and remediation of configuration items and applications.

CIAgent.log: Records details about the process of remediation and compliance for compliance settings, software updates, and application management. 

         e.g. from  our example 1 above, CI agent job is initiated with job id 5851XXX for one target machine  (DCMAgent.log on client)

              mspaint baseline is targeted to this collection for evaluation (CMAgent.log on client)

CMReporting.log :  Records information about reporting policy platform results into state messages for configuration items.

 DcmWmiProvider.log Records information about reading configuration item synclets from Windows Management Instrumentation (WMI).              

Technical Reference for Log Files in Configuration Manager & Compliance Settings

http://technet.microsoft.com/en-us/library/hh427342.aspx#BKMK_ClientInstallLog

http://technet.microsoft.com/en-us/library/gg681958.aspx

 DISCLAIMER: This posting is provided "AS IS" with no warranties and confers no rights 

You have already verified that all SQL and SCCM prerequisites are in place and next when you run setup you get the followng error:

The possible cause for this error can be because of the following:

• During the SQL install, you created a named instance that you want to use for SCCM
• You have a default SQL instance installed and you created another named instance  that you want to use for SCCM

The reason for this error is because Configuration Manager 2012, does not support dynamic ports, so you need to go to SQL Server Configuration Manager and set that named instance to use the static Port and restart the SQL Server Service.

 Here are some more details on this:

Creating a named instance is fine, and I personally  prefer using named instance as a better isolation.

When you install SQL and you create a default instance, it automatically assigns a static TCP Port 1433 for this, and if you create another named instance or you installed SQL with a named instance instead of a default instance, In this case the named instances are  configured for dynamic ports by default during installation. 

 As you can see in example below, for named instance SCCM_DB1, under "TCP/IP properties" a TCP Dynamic Port 50705”  for "IP All" and  Dynamic Port 0" for other IP's was assigned. You can check this configuration by going to “SQL Server Network Configuration->Protocols for Named_Instance (the sql instance name you gave)->TCP/IP->IP addresses

To fix this issue, do  the following changes under SQL Server Network Configuration->Protocols for Named_Instance (the sql instance name you gave)->TCP/IP->IP addresses 

• Delete 0 or any other port number e.g 50705  from "TCP Dynamic Ports" Dialog box, Do this for all IP's e.g for "IPAll", "IPV6" , basically do this for each ip address listed in "IP Address" tab under  "TCP/IP Properties"
• Next in the "TCP Port" dialog box  assign a static port for all IP's that contain IP address of your sql server the named instance
• Under "SQL Server Configuration manager->SQL Server Services" Restart the service "SQLServer (instance Name)" and ensure  "SQL Browser" service is running

For more details on  how to configure a SQL server to listen on a specific TCP port see  http://msdn.microsoft.com/en-us/library/ms177440.aspx

 DISCLAIMER: This posting is provided "AS IS" with no warranties and confers no rights 

The attached document in this blog covers SCOM 2012 Upgrade process:

In this document we are using a specific scenario that covers:

• Current SCOM 2007 R2  Infrastructure that is ready for upgrade.
• Challenges with Current SCOM 2007 R2 Infrastructure.
• Business Justification for SCOM 2012 Upgrade.
• SCOM 2012 features.
• Upgrade Process in our lab
• Upgrade steps with screen captures & issues experienced during my upgrade Process in the lab

Note: SCOM 2012 RC bits were used in this scenario

SCOM 2012 Upgrade Documentv2.pdf