Server Guy UK https://docs.microsoft.com/archive/blogs/serverguyuk/feed.xml The Home of All things Windows Server 2016 for the UK Wed, 17 Apr 2019 03:47:47 GMT en-US hourly 1 Windows Server the basis of a sound Hybrid Platform. https://docs.microsoft.com/archive/blogs/serverguyuk/hybrid Sat, 27 Oct 2018 13:15:40 GMT https://blogs.technet.microsoft.com/serverguyuk/?p=1095 First things first, What is a Hybrid Cloud. NIST (US National Institute of Science an Technology) defines Cloud computing as consisting of the following 5 essential characteristics that can appear in 4 deployment models, one of which is Hybrid.  
  1. On-demand self-service
  2. Broad network access
  3. Resource Pooling
  4. Rapid elasticity
  5. Measured service
  Rather than describe each you can read the NIST definition here page 2 is your target. It is safe to say that the Microsoft Azure platform has all of these characteristics and then some.   The four deployment models are
  1. Private cloud
  2. Community cloud
  3. Public cloud
  4. Hybrid cloud
  Again rather than describe all four models you can read them in the NIST definition on page 3, here. I have repeated the hybrid definition below for ease:

Source: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-145.pdf

  We can see straight away that a single on-premises server or even a number of servers cannot be said to be a hybrid cloud. For that we would need to deploy the Microsoft Azure Stack solution and connect it to a second cloud Azure or AWS) to make a hybrid cloud.  

Hybrid workloads

So, in the title I mention hybrid platform. That then is not intended to be a hybrid cloud merely a way of connecting on-premises Windows Servers to available cloud services to bridge the gap and reduce some of the pain points in modern computing platforms.   Microsoft Windows Server 2016 (and soon to be 2019) offers a number of ways you can take advantage of hybrid features. This post is aimed at explaining a couple of these to gain maximum effect for minimum time and cost. The topic foremost in the mind of a Sysadmin / Datacenter manager or even a tech savvy small business IT support worker. The rest of this post is a cut-down technical how-to article (you have been warned)

Backup.

Windows Server and Microsoft Azure provide some excellent solutions to help with these. The new Windows Admin Center also now integrates with these services to make deployment and management much easier in future. The first step, however, is to create an azure subscription to be able to use all those hybrid services. You can choose to use one you already have, pick a free trial or create a pay as you go subscription. So, being armed with a subscription how can we get into the hybrid way?  

Let’s start with on-premises backup.

 On your on-premises Windows Server 2016 install Windows Server Backup, either with PowerShell or with Server Manager (or Windows Admin Center if you have installed it).   Configure your normal on-premises backups (which should already have been done!), that is the on-premises traditional part completed.  

The cloudy bit

Next, we need to create the resources in Azure to support the hybrid backup. You need to create a Recovery Services Vault, this holds the data from backups and also site recovery plans. This can be done in PowerShell, Azure CLI or the Portal. You can also use JSON templates to do this in any of the methods. Azure is nothing if not flexible in its usability.   I used the portal (https://portal.azure.com) and this was the result. Next click the getting started link in the Backup section, as shown and create a backup, choose the platform (Azure or on-premises) and then pick what you want to backup.   The list is impressive. I will choose system state and files and folders. I then get to prepare the infrastructure. To prepare your infrastructure for these options, you need to install the recovery services agent on the machine you are backing up.     You then need to connect the server to the recovery vault by downloading and importing the vault credentials. The final step is to schedule your hybrid backup using Windows Server backup on the on-premises server. From then on you can monitor these backup jobs in the Azure portal and also configure alerts and reports for backup failures. Here you can see the Agent installation wizard in action on the server.   and the result in the Azure portal.   Having created our first Hybrid workload, future posts will help with others such as Azure File Sync, Azure Site Recovery and so on. There really is no better time to delve into the hybrid world with Windows Server. I do ow you a couple more answers from the first question, what will it cost me?   Well in terms of time, this whole hybrid solution from start to finish (starting with an on-premises server and an Azure subscription ready to go0 took less than 20 minutes, including the first backup! In terms of cost. You pay for the storage your backups consume, as below 9LRS is local redundancy (3 copies) and GRS is geographical redundancy (6 copies) You also pay for the backup instances you are running, as below All in all not a huge cost for an added level of comfort and data security, redundancy and rapid recovery.]]> Calling all Windows Server 2008 R2 users. The End is Nigh https://docs.microsoft.com/archive/blogs/serverguyuk/calling-all-windows-server-2008-r2-users-the-end-is-nigh Thu, 26 Jul 2018 11:58:31 GMT https://blogs.technet.microsoft.com/serverguyuk/?p=1025 Microsoft has a very well defined policy for supporting its products, of all types There is mainstream support, extended support and then no support at all. (There is an extra level where you sign a contract to receive special support after the end of extended support period has been reached. This contract is not for normal people of organizations and I dread to think of the cost of one) This blog post is designed to walk you through the venerable Windows Server 2008 (and R2) timeline and hopefully help you make the move to a more modern, secure and feature-rich server operating system. So, what are the important dates for Windows Server 2008 R2, what do they mean? and how do I avoid a last minute rush? Lots of questions there, first the Mainstream support for Windows Server 2008 R2 ended quite sometime ago, checkout the impact of this on your server estate. Essentially for five years from release Microsoft will provide new features as well as security and non-security updates. For the next five years, no new features will be added but you will continue to receive updates. These updates fix security holes, and new attack vectors. Non security updates are also provided. What sort of updates, what sort of attacks are prevented? The graphic below shows some well know critical and non-critical security updates over recent times. Without these your infrastructure is at risk of exploits and all your good work securing your networks and applications would be undone. Now the bad news, the 5 year Extended support period for Windows Server 2008 R2 ends on January 14th 2020. The SQL Server date is even closer at July 9th 2019 If you are still using these platforms in production after those dates, they are unsupported. Microsoft has a number of options and resources to assist you to migrate onto a more modern Windows Server operating system. Bear in mind that Windows Server 2012 is no longer available for sale and if you want to use that you would need to take advantage of the downgrade rights available with some licensing options. In the autumn (fall) Windows Server 2019 is to released, so you have a couple of decisions. Do you wait until it is available or purchase now. If you purchase now, you can use software assurance (as an add on to your purchase) to allow you to upgrade to Windows Server 2019 with no addition licensing costs. Which should you choose? This handy chart shows you which features each of the more modern versions contain. There is an additional decision to be made as well. Do you replace your older out of support (soon) servers by migrating to Azure or for new on-premises servers and go for OEM or ROK licences, which are often the cheapest licenses for new servers. The final consideration would be for server CALs (Client Access Licences). If this is your first Windows Server at a new version such as 2016 or 2019 then you would need to upgrade (replace) your Server CALS as well (either device or user CALS). Despite being an honesty based licensing system, you do not have rights to connect non administrative users to the server remotely without a CAL covering every user or device. Where to start though. well you need to assess what in your current environment requires replacing, the hardware, software and licenses. Microsoft have a handy chart for this too. You may well find that this is a perfect time to consider a hybrid solution for the first time. Future blog posts will cover the hybrid advantages of Windows Server 2016 and Windows Server 2019. Don't delay get migrating today.]]> Windows Admin Center - is the future. https://docs.microsoft.com/archive/blogs/serverguyuk/windows-admin-center-is-the-future Fri, 29 Jun 2018 07:08:07 GMT https://blogs.technet.microsoft.com/serverguyuk/?p=995 The rapid pace of development and updates means that this product is now incredibly mature after so short a development. Windows Admin Center can deliver a complete administrative experience in addition to the 20 plus admin tools already present. Most oft eh MMC snap-ins are covered, as are the Device manager, Disk Manager, Registry editor, the works. The most exciting aspects though are the possible extensions to the product. I posted recently about Windows Storage Migration Service coming soon to a Windows Server 2019 near you. This appears as an extension in the Windows Admin Center. You can see above that both the Storage Migration Service and the brand new Server SYstem Insights service feature as available extensions. You can also see that there are 3rd party extensions being added using the WAC SDK. Finally dont forget that WAC can handle Windows 10 computer management tasks, Failover CLuster tasks and also is the preferred solution for monitoing and managing your Hyper-Converged infrastructure. WAC uses WinRM (the same as PowerShell does) to communicate with servers, WAC can be an internal tool or can be used to manage servers all over the globe if you install the gateway in an accessbile place. The future is bright, the future is WAC. I wonder how long the venerable MMC will last now we have this tool? Why not download it now and get working.]]> Storage Replica in Windows Server 2016 https://docs.microsoft.com/archive/blogs/serverguyuk/srws2016 Tue, 29 May 2018 08:03:06 GMT https://blogs.technet.microsoft.com/serverguyuk/?p=945 Windows Server 2016 - Storage Replica Microsoft released many new technologies into the wild when Windows Server 2016 went generally available in the Autumn of 2016. Some of these such as the new software defined networking model with the Azure Load Balancer built in and the new Network Controller role, along with Storage Spaces Direct (S2D) stole a lot of the thunder. Storage replica was among those new technologies and suffered from the headline features taking all the glory. It is about time Storage Replica got a little more press. This post is intended as a primer for Storage replica in Windows Server 2016 and what is likely to be coming along in Windows Server 2019 this Autumn. So what is Storage Replica, what are its use cases and why would I buy the Datacenter edition to be able to use it? Yes - this is one of the high value product areas that Microsoft restricted to the Datacenter edition of the product in Windows Server 2016.

First, what is Storage Replica?

Well storage replica allows you to replicate data in volumes, it is different from services like OneDrive and Azure File Sync in that this does not handle files it is a block replicator and it absolutely does not care what your blocks are stored on. The storage fabric is not important.  This service is also available synchronously or asynchronously. So Storage replica allows you to copy your disk volumes in real time and therefore gives you a full Disater Recovery (DR) solution, built in for no extra cost. No extra hardware and no extra skills needed to manage the infrastructure. The synchronous replication does require a fast wide network connection with an average round trip latency of 5ms. So for this type of replication you would need fibre cable and a maximum of around 50KM separation. This does not provide full geographic DR but does bridge the gap and does prevent spending many tens or hundreds of thousands of pounds or dollars on a traditional DR solution.
  • Synchronous replication mirrors data within a low-latency network site with crash-consistent volumes to ensure zero data loss at the file-system level during a failure.
  • Asynchronous replication mirrors data across sites beyond metropolitan ranges over network links with higher latencies, but without a guarantee that both sites have identical copies of the data at the time of a failure.
The Principal PM for this service Ned Pyle remarked when I interviewed him for a webinar recently that they had spent two years ensuring that this server would not and could not lose any data and that to date there are zero reports of Storage Replica having data loss issues.

What can I use it for?

Storage Replica has a number of supported deployment options, ranging from replicating disks within a single server, disks between servers and in all sorts of failover-cluster scenarios.   If you have a cluster stretched across two locations, or between two disparate clusters storage replica can handle the volume to volume replication for you. To do this storage replica requires two sets of identical media (recommended) for both source and destination volumes as well as the log disks. These disks are critical as all writes are made to these for the synchronous option, also to make the most of the service, RDMA network cards using Infiniband or iWARP technology should be used.

Is it really worth me buying Datacenter for this?

This depends on your current spend or your need for a DR solution. The good news is that the Storage Replica feature is going to appear in Windows Server 2019 standard edition as well, albeit in a cut down small business type of way, currently the plan is to limit it to a single volume and a mximum size of 1Tb. These figures are still to be confirmed though and if you think you need more and can justify it, then make sure you contact Ned at srfeedback@microsoft.com or feedback on uservoice. Finally the really great news is that Storage Replica features in the new Windows Admin Center and you can create monitor and manage your SR service from a web browser anywhere anytime. My advice is build a lab and get playing with this great service, saves time moeny and a lot of tears when disaster strikes.    ]]> Windows Server 2019 - Storage Migration Service https://docs.microsoft.com/archive/blogs/serverguyuk/sms Mon, 30 Apr 2018 10:00:29 GMT https://blogs.technet.microsoft.com/serverguyuk/?p=905 Windows Server 2019 Preview Builds Back in late March Microsoft announced the first preview build of Windows Server 2019.  In this announcement were many new and improved features. Just a few listed below. Extending your Clusters with Cluster Sets Windows Defender Advanced Threat Protection  Windows Defender ATP Exploit Guard Failover Cluster removing use of NTLM authentication Shielded virtual machines: Offline mode, Alternate HGS, VMConnect and Shielded Linux support Encrypted Network in SDN Performance history for Storage Spaces Direct All of the above will be covered in future posts, but the one new feature missing from the announcement was the all new Storage Migration Service.

Storage Migration Service

In the middle of April, Ned Pyle the head honcho for Storage Replica announced this brand new feature. So, what is it? Who is it aimed at? What does it do?

What is it?

The Storage Migration Service will assist you to migrate data on legacy servers without ANY application or user configuration changes. You can migrate to a modern (Windows Server 2019 Preview) Server from and Windows Server all the way back to 2003. (The pan is to support migrating to and Windows Server but not yet). The service provides fast, consistent, scalable migration managing the complexity and providing a graphical workflow. The data migrated can be unstructured and can be migrated either to Azure or on-premises Windows Server targets.

Who is it aimed at?

This service will be available in both Standard and Datacenter editions of Windows Server 2019 so it is aimed at any size of business that wants to migrate data off legacy devices without having to worry about infrastructure or network changes.

What does it do?

Quite simply it allows a new server to take the place of an old server without the manual tasks normally required, as listed below. Transfer all data, shares, configurations and security for file system and shares. Transfer all files that are currently in use as well as those files your operator privileges do not allow you access to. Transfer all local users and groups and files that have changed since you last transferred them. Network addresses, computer naming and network resolution such as DNS must be transferred. Finally all data security and other attributes must transfer. A pretty long list of tedious configuration just to move some files. So the Storage Migration Service (I am not going to shorten it to SMS, for obvious reasons) is a three stage process. Take a look at the graphic from Ned's initial blog post. The service has an orchestrator (a Windows Server 2019 Preview server) which manages the whole migration and maintains a database of all results.

Stage 1 - Inventory

Nodes to be migrated are selected and the orchestrator gathers the data required.

Stage 2 - Transfer

Having identified all possible data to move the admin then pairs source devices with target devices and chooses the data. The migration is then performed.

Stage 3 - Cutover (in development)

In this stage the new devices supplant the sources in the network and place the old servers in a maintenance state. In this state users and applications cannot see these devices. Ned give a useful list of pre requisites to test this great new service, the best thing for me is that is is managed using the Windows Admin Center the first example of a brand new service where the admin center is the primary tool for management. Also in Ned's blog is a full walkthrough, I can thoroughly recommend giving it a go. Watch this space for more great enhancements to the service.]]> Server Guy Webinars https://docs.microsoft.com/archive/blogs/serverguyuk/server-guy-webinars Thu, 26 Apr 2018 09:24:51 GMT https://blogs.technet.microsoft.com/serverguyuk/?p=855 Shielded Virtual Machines

Software Defined Networking

Storage Spaces Direct

Before we move on to the next series of events, starting with Storage Replica in both the 2016 and upcoming 2019 releases you have a chance to watch the originals again, or catch them for the first time.

So re runs are scheduled.

The first is Server Guy and Shielded Virtual Machines which is scheduled for 4pm UK time on Friday 27th April. This will be followed each Friday at the same time until 11th May with Storage Spaces Direct and Software Defined Networking. You can sign up for the first one here]]> Azure Stack - What, why, and, how? https://docs.microsoft.com/archive/blogs/serverguyuk/azure-stack-what-why-and-how Mon, 26 Mar 2018 10:33:46 GMT https://blogs.technet.microsoft.com/serverguyuk/?p=775 This post is aimed at explaining what Azure Stack is, what it does and how you can go about learning how to use it.

What Azure Stack is

First the facts. Microsoft Azure Stack, according to the Azure Stack Operator Documentation is "Microsoft Azure Stack is a hybrid cloud platform that lets you provide Azure services from your datacenter. " Now as you probably know Microsoft Azure now has over 50 regions made up of 100's of datacenter buildings spread across the face of the globe. There are millions of compute cores providing services as diverse as Traffic Manager, Content Delivery Networks, Machine Learning, HDInsight, SQL Data Warehouse and many more. There is no way that a normal or even a large datacenter can house all these services for you and Azure Stack is not designed to do so. Azure Stack will provide a growing sub set of the Azure services for use in a hybrid (connected) or even a disconnected scenario. Azure Stack is available now in two deployments. There is the Azure Stack licensed for use in production. This is provided as the Azure Stack Integrated System.  The integrated system is available through a small number of  hardware partners, (currently just four Cisco, Dell EMC, HPE and, Lenovo). This allows the hardware vendors to offer a combined system of hardware and software to provide just the flexibility and control you need over your system. The integrated system is available in configurations for 4 nodes to 12 nodes. Support is provided jointly through the hardware partner and Microsoft. This is intended for the deployment of production workloads in a new and innovative manner. Licensing the Azure Stack integrated system is dependent upon the method you use to deploy and can be varied in several ways from Pay as you go (just like Azure) to a consumption model for the disconnected scenario. A later post will cover these in detail. The alternative to the integrated system is the Azure Stack Development Kit (ASDK). ASDK can only be deployed on a single node and is intended to allow you to evaluate and learn all about the platform and its services. ASDK can be provided  within your organization as a developer platform completely consistent with the Azure APIs and tooling. ASDK is not licensed for production workloads. For this reason it comes with the following limitations.
  • ASDK is associated with a single Azure Active Directory (Azure AD) or Active Directory Federation Services (AD FS) identity provider. You can create multiple users in this directory and assign subscriptions to each user.
  • With all components deployed on the single machine, there are limited physical resources available for tenant resources. This configuration is not intended for scale or performance evaluation.
  • Networking scenarios are limited due to the single host/NIC requirement.
Indeed to make sure it is of no practical use in production the ASDK will disable all except for one NIC on the host machine during install. The host machine for the ASDK requires the following specification. The many and complex PowerShell scripts used to install the ASDK check for all of these and will  not allow installation unless you amend those script tests. To be brutally honest doing so is counter-productive since these hardware specs are definitely the minimum to run the ASDK effectively.

Deploying the ASDK

This is not a trivial enterprise! I have installed ASDK several times (it will only work for 180 days each time you install it). The exercise took me between 7 and 10 hours each time. It is however not a complex job. (If you know PowerShell) First you download the Development Kit package. You need to register first. Having downloaded and extracted the files, you need to copy the cloudbuilder.vhdx file to the host machine. Set the host to boot from this VHD and you are good to go. There is now a GUI installer or the PowerShell option. At this point you can choose to use Azure AD or AFDS to provide the identity solution for your deployment. I use Azure AD. Once you have run the InstallAzureStackPOC.ps1 PowerShell script and waited the requisite time. You will be left with a Hyper-V server joined to a domain with the following Virtual Machines (VMs) which form the infrastructure of your Azure Stack Dev Kit. The below diagram shows the logical architecture of the ASDK. The VMs are listed in the table below with their function. Notice there are VMs for Software Load-balancing and Network Controller, services which appear in Windows Server 2016 but originated as Azure services and are used to manage the full Azure public cloud. Interesting note: Any VMs you create in Azure Stack will appear in the Hyper-v host, as shown below Here you can see the VMs alongside two additional VMs with long GUID names one is a Windows Server VM with 28 GB RAM and the other is an Ubuntu VM (cos I love Linux too) with 56 GB RAM.

What azure stack does.

Azure Stack provides a subset of Azure services. There are foundational services which are deployed when you deploy your ASDK, these are; Compute Storage Networking Key Vault There are also additional Platform-as-a-service (PaaS) services which can be configured and installed by an ASDK administrator. App Service Azure Functions SQL and MySQL databases Azure Stack will keep on adding services to this list. The Azure Stack Roadmap is here

Learning How to use Azure Stack

Nowadays this section is always very short and very easy, even if the learning is not. Pluralsight are offering free training for Azure Stack. Microsoft Virtual Academy has some Azure Stack content Channel9 has some great content here Finally the docs.microsoft.com site has all of the Azure Stack documentation in. BUT the very best way to learn is to dive in and understand the differences between Azure and Azure stack operation by deploying it yourself. it can even be deployed on an Azure VM is you like! The Concept of an administrator portal doesn't really exist in Azure, but in Azure stack you have both an Admin portal and an operator portal as shown below. The administrator portal allows you to create your very own marketplace as shown in the first graphic of the post. It also allows the administrator to create plans of resources to then offer out to users who can then create or accept subscriptions based on those offers. Once a user has a subscription he can then deploy resources in exactly the same fashion and methods as Azure. The portal, the PowerShell and the resource manager templates. You can see above the Ubuntu VM I showed in the Hyper-v manager graphic. I have to thank Lenovo UK for the loan of the hardware to deploy my ASDK, it is a Lenovo 9650 with 20 cores and 265GB RAM. More in the next post on Azure Stack, dive in and enjoy.  ]]> Windows Server 2019- Announced https://docs.microsoft.com/archive/blogs/serverguyuk/windows-server-2019-announced Wed, 21 Mar 2018 17:39:13 GMT https://blogs.technet.microsoft.com/serverguyuk/?p=745 Windows Server 2019 In Preview. Erin Chapple the Director of Programme Managed wrote a blog article announcing the release. But what does this mean for the IT Pro and why have got so many editions, versions and changes. Well. The Windows Server world has just caught up with what the Windows Client world has been doing for a couple of years.   There will be Windows Server (SAC) releases twice a year. identified by their date of release i.e the first SAC was 1709 (for September 2017). The Long Term Servicing Channel (LTSC) will be released every two to three years, this follows the previous Server release cycle of 2003 then R2, 2008 then R2, 2012 then R2. There will be no more R2 releases, and there will be two different focuses for the two different channels. Listen very carefully I shall say this only once!   The LTSC will be available in all editions and deployment models (Core, GIU, Nano) Standard, Datacenter, Essentials etc. The SAC will be only a core release and only in Standard and Datacenter. The focus of SAC is Container hosts and container technology as described by Erin in her article The smaller Microsoft make the core image and the nano image the more effective they are as container images and container hosts.

Some of the other headline news

Honolulu will be included in the LTSC build as will Windows Defender Advanced Threat Protection. Helping to create an even more secure platform fit to repel the modern threats we all face.]]> Software Defined Networking - Adding layers of security https://docs.microsoft.com/archive/blogs/serverguyuk/sdn Tue, 06 Feb 2018 10:53:27 GMT https://blogs.technet.microsoft.com/serverguyuk/?p=685 Bringing the Azure fabric into your datacenter Windows Server 2016 Datacenter edition provides access to many great enterprise features that are now absent in the Standard edition product. One of these is Software Defined Networking (SDN). In conjunction with Software Defined Storage (SDS), particularly Storages Spaces Direct (S2D) this creates the first easily achievable single product Software Defined Datacenter (SDDC). Well that's enough acronyms for one post. What does all this mean to the hardworking datacenter architect or administrator? The traditional datacenter contains all of the elements below whether there are 50 physical servers or 5000. In this sort of environment if a typical three tier application is deployed, there are a number of physical tasks required. These include provisioning storage for the application, configuring the network switches and routers to allow or prevent access as required between tiers and provisioning the necessary network subnets and security within those to deploy the application in a secure manner. This can be time consuming and costly in man power and sometime equipment terms. With the release of Windows Server 2016 Microsoft have updated and completely reinvented their Network Virtualization platform. For the techies amongst you in now uses the VXLAN technology instead of the NVGRE technology. In addition Windows Server 2016 now includes many parts of the Azure fabric such as Network Controller (NC), Software Load Balancer (SLB) and Network Security Groups (NSGs).

What can I achieve and why do I need it?

Network virtualization provides the ability to isolate applications and application tiers from other parts of your physical network. This enables multiple instances of the same network address on the same physical network without any conflicts or clashes. Perhaps, more importantly SDN and SDDC also provides the ability to carry out all the deployment actions required without any human intervention. The end result is a much more secure application with more layers of embedded protection. With a non virtualized network, the first two layers of defence should exist in most networks. Firewalls and DDOS defence. Once past those two layer any attacker would have unrestricted movement inside the network and free rein to attack workloads visible there. When you add the SDN layers you automatically gain another layer of network isolation requiring both routing and permissions to access. The Windows Server 2016 Datacenter Firewall (DFW) and the NSGs added to protect those layers add another level of security to the model. Finally the SDN technology allows for virtual appliances to be connected to either further protect or analyse traffic inside the network.

What is the process to achieve this?

To deploy and manage SDN in Windows Server 2016, you require the datacenter edition and you need to deploy a number of physical and virtual roles such as Network Controller and Software Load balancer. Once the architecture is deployed, you can then use either System Center VMM, PowerShell or a 3rd party REST API application to deliver the SDN. As an example, imagine a three tier application with a web server, a file server and an active directory domain controller all of which require different levels of access depending upon your identity, location and role. To fully isolate and secure this application requires only some clever creation of Network Controller policies and deployment using PowerShell. The end result is A fully secured multi-tier application with protection through network isolation, NSG and network address translation. All achieved without any human interaction (once policies are created). The effect is that this can be replicated many times for many different application depending upon demand and location requirements. External customers can access the web tier but not the file server or active directory. The internal application staff can also access the file server to collect data whilst no one but IT administrators can access the active directory. A fully secure application, and with the GDPR coming in to force on 25th May this is another great reason for investing in Windows Server 2016 datacenter. Why not download the evaluation and check it out! If you haven't the time for that then head on off to https://www.microsoft.com/handsonlabs to experience all the joys of the new server features in short learning experiences.290 labs including this one helping you to deploy SDN without building the environment first. Finally tweet @serverguyuk or email him at serverguy@microsoft.com letting him know how you got on.  ]]> Shielded Virtual Machines - Protect your workloads https://docs.microsoft.com/archive/blogs/serverguyuk/shielded Wed, 03 Jan 2018 15:34:03 GMT https://blogs.technet.microsoft.com/serverguyuk/?p=665 Microsoft Trust Center It would be fair to say that a large proportion of the workloads running in on-premises datacentres are virtualized, that is running on either Hyper-V or VMWare hypervisors (other hypervisors are available). This allows a single physical server to run many different virtual servers, saving space, energy and cost. A little known fact is that the vast majority of these workloads are accessible to the administrators of the Hypervisor, when in most cases they have no need to see or use the VMs running on their hardware. Even if you have the privileges necessary to back up a Hyper-V or VMWare host, you can actually gain access to the VMs running on them. In most businesses this does not impact upon security or data integrity, however, if you rare responsible for hosting VMs for other departments with higher security needs or for external customers then this can be a major flaw in the security of those workloads. Microsoft have produced a feature set that allows for a Guarded Fabric, preventing fabric administrators from interfering with VMs running on their hosts. There are several ways of achieving this to varying degrees of cost and security, all of which are outside the scope of this introductory post. In short to run Shielded VMs on a Hyper-V host, you need to buy the Datacenter edition of Windows Server 2016. This host can then connect to a Host Guardian Service (another new server role in Windows Server 2016). The Host Guardian service can be installed on a Standard edition server, reducing the cost of licensing this solution. It is best practice to have a highly available solution for the host guardian service to prevent all of your shielded workloads from becoming inaccessible if the host guardian service should fail. The effect of deploying this solution is immediate and complete.
  • The VM can only be started on a guarded host.
  • The host must be healthy and uncompromised
  • The VM is then secure from tampering (all disks run BitLocker drive encryption)
  • The only access to the VM is through a secure remote session with correct credentials (unknown to the host administrator)
  • All live migration traffic is encrypted
  • All memory dumps in the event of a crash are encrypted
  • Hyper-V manager cannot be used to access the VM
  Why not take a look at this Microsoft Mechanics Video to see it in action.   [embed]https://www.youtube.com/embed/Vp5E1-4Ks8E[/embed]]]>