Technology Chronicles

Azure AD user management scripts

Shijimol AK — Sun, 11 Jun 2017 19:13:11 GMT

Recently I had an opportunity to create couple of scripts for a customer for Azure AD management linked with o365 . We have all these resources available in our documentation, albeit scattered at different places . Few scripts were also tweaked to meet certain specific requirements. I am sharing the same here for the benefit of the larger community Import modules: The first step is to import all modules required for O365 management. We have detailed steps available in this TechNet article :https://technet.microsoft.com/en-us/library/dn568015.aspx I have put all the commands together in this script importmodules_o365 Edit the script as appropriate before execution to provide your environment specific parameters like domain name. I have provided comments regarding that wherever required. Once you have imported all the required PowerShell modules, some common AD management tasks can be done using the scripts available in this zip file : Management_Scripts View and export list of users with different user roles Use the script exportrole.ps1 to get details of user roles. By default the script will pull out list of users with the role 'Company Administrator' to a file named username.csv . You can modify the rolename to get the corresponding users with that role assigned. List of roles are also given at the end of the script. Password expiry date of users The script passwordexpirydates.ps1 will extract this info to a csv titled passwordexpirydates.csv Last password change date of users Execute the script Passwordchangedate.ps1 will extract this info to a csv titled userpasswordchangedate.csv List of blocked users You can use the script Blockedusers.ps1 to get information on blocked users if any

OS and Data disk encryption of Azure IaaS Windows VMs

Shijimol AK — Sun, 29 Jan 2017 21:36:11 GMT

VM disk encryption is achieved using Bitlocker encryption of Windows VMs and DMcrypt in Linux VMs. It leverages Azure KeyVault services to store your encryption keys which is again an additional level of security. The process is quite straight forward and encryption can be done for new as well as existing VMs. In case of Windows IaaS VMs, we can encrypt both the OS and Data disk, while in case of Linux IaaS VMs the data disk can be encrypted.You will have to use the ARM deployment model to leverage this feature, since it does not work with the classic model. There are ARM templates readily available in GitHub that can readily help you with the encryption of existing and New VMs. In this blog, I am going to focus on the end to end procedure for Windows VM OS and Data disk encryption using KeyVault by leveraging these templates Prerequisites: 1) Create an Azure KeyVault This can be now done from the ARM portal itself. KeyVault is available in the Azure Portal in preview mode. You can create a new keyVault by providing basic information like KeyVault Name , Resource group Name,Location etc. In addition to that , by default your user account will have access in the "Access Policies". You can edit the "Advanced Access Policy" and enable all the three options given there Alternately, you can also use the ARM template available at this location to create a KeyVault: https://github.com/Azure/azure-quickstart-templates/tree/master/101-key-vault-create This template will create a KeyVault for you with all the three advanced access policies including the Volume encryption policy that we need for Disk encryption 2) Create an application in Azure AD with permission to access KeyVault: This is a very important step since you will be using this application id and key during VM encryption

Select the organization's active directory from the classic portal and select the application tab

2.Click on add from the bottom menu to add a new application. Select the first option, ie add an application my organization is developing 3. Provide name of the application in the next step 3. Add the Sign-on URL and App URI. You can enter any value here in URI format, it need not have to be an existing application. Only requirement is that it should be unique for an organization 4.Now click on configure, and copy the client Id of the application 5.Next we need the application key. This can be generated from the portal from under the keys session. Select duration as 1 year from the drop down. Once you save the configuration, a key will be displayed which can be copied over 6. Next step is to provide this application access to keyvault. It can be done from an Azure PowerShell window using the following command Set-AzureRmKeyVaultAccessPolicy -VaultName $keyVaultName -ServicePrincipalName $aadClientID -PermissionsToKeys 'WrapKey' -PermissionsToSecrets 'Set' -ResourceGroupName $rgname You have to set the variables $keyVaultName,$aadClientID,$rgname to have values of your keyvault name, client id of the application that we got at Step 4 above and Resource group name Now you have the client id and the key that you will need during the ARM template execution. Now lets proceed with the VM disk encryption Create a new encrypted VM using ARM template and KeyVault Deploy the following template available in GitHub to encrypt a new VM : https://github.com/Azure/azure-quickstart-templates/tree/master/201-encrypt-create-new-vm-gallery-image Click on the "deploy to Azure" option in the page to deploy the ARM template directly in Azure Provide the mandatory parameter values like VM name, admin username, password, Storage account name, Virtual network, subnet,keyvault name and keyvault resource group along with the client ID and Client Secret of the Azure AD application that we created earlier. Additionally there will be two options for Key Encryption key and URL.It is not mandatory and we are not using that in this example. You can then agree to the terms and conditions , click on purchase and the deployment of encrypted VM will start Encrypt an existing VM using ARM template and keyvault Deploy the following template available in GitHub to encrypt an existing VM : : https://github.com/Azure/azure-quickstart-templates/tree/master/201-encrypt-running-windows-vm Deploy the template to Azure and provide details of the VM that you want to encrypt.'Volume type' can be OS,Data or All(default value) depending on which disk you want to encrypt Check encryption status Now that you have enabled the encryption you might want to verify the status. There are few ways to check this. Easiest way is to check from the Azure portal. Navigate to the Disks information of the VM from the portal. It will show the OS disk status as Encrypted. You can check the data disk encryption status by using Azure PowerShell command Get-AzureRmVmDiskEncryptionStatus and providing resource group name and Vmname as parameters Get-AzureRmVmDiskEncryptionStatus -ResourceGroupName $rgname -VMName $Vmname You will see OSVolumeEncrypted and DataVolumesEncrypted status as True if encryption is enabled You can also check the status of disk encryption from within the VM using ‘manage-bde’ command and providing the drive letter as parameter. Sample output given below Also, it can been seen from the GUI of the server , the drives will have a lock signal associated Now you know how to enable disk encryption for protection of data at rest in Azure!!!! Ref: https://azure.microsoft.com/en-us/documentation/articles/best-practices-network-security/https://azure.microsoft.com/en-in/documentation/articles/azure-security-disk-encryption/

How to protect your on-prem physical machines using ASR

Shijimol AK — Tue, 24 Jan 2017 22:25:54 GMT

BC/DR is a key consideration for all organizations big or small. Thanks to Azure, we now have an affordable and easy to implement BC/DR solution . Azure site recovery service(ASR) can be used for a multitude of disaster recovery scenarios, with an economic pay-as-you-go costing model. The DR scenarios catered to by ASR currently are: DR site in Azure - Physical machines to Azure -VMware environment to Azure - Hyper-v(with or without VMM) to Azure DR site in a secondary DC, and orchestration by ASR -VMM site to site -VMware/Physical to VMware -VMM to VMM(SAN replication) This week in my Azure labs, I tried out the first scenario, ie DR from On-Prem Physical machines to Azure. This blog is all about my little experiment and some tips and tricks that I learned during the same. The following link , which explains the procedure for protecting Physical/VMware environment is a good starting point: https://azure.microsoft.com/en-in/documentation/articles/site-recovery-vmware-to-azure/ I will use this article as reference point, which is very detailed and well written. I will be going into further more details on few of the areas mentioned in the link .Based on my experience, I think it will be helpful for someone trying to set up a Physical server to Azure replication for the first time. You should ensure that the prerequisites for physical server protection mentioned in the link are taken care of. You need to run the Site Recovery Unified SetUp for installing the configuration and process server. Refer to "Step 2: Set up the source environment" in the link above for details on initial set up of the vault, setting up configuration server, registering it in Azure etc. These steps are pretty straight forward. Detailed explanation of the configuration server setup on-prem is also mentioned in Step 2 of the article Lets assume that you done the initial vault creation , configuration server setup , created target environment in Azure(Resource group, storage, network etc) and have also created the replication policies to be used. All these come under "Step 1: Prepare your infrastructure" in your site recovery vault. These steps are again clearly explained in the official documentation : https://azure.microsoft.com/en-in/documentation/articles/site-recovery-vmware-to-azure/ Now lets see what needs to be done at the physical server end to enable the protection: Steps to be done on Physical server: 1)Set up the registry key entry 2)Enable the following in Allow an app or feature through Firewall. > File and print sharing >Windows Management Instrumentation 3)Add an account that has admin privilege in the target physical machine in the cspsconfigtool. It can be found in the following location in the configuration server Click on Add account 4)In my case, the physical machine was not added to domain. Hence I added a local admin user. The friendly name can be anything, it is just for identifying that account in Azure portal. 5)Now you can install the mobility agent on the physical server. The installer can again be found in the configuration server at the following location. You need to select the installer based on the operating system type. In my case I selected the Windows installer Select option to install Mobility service Enter Configuration server IP and Passphrase Specify install location. That is all that is required. You can go to the next step and wait for the installation to be complete Steps to be done in Azure portal: Now that the mobility agent is installed, you can refresh the configuration server in the Azure management portal Go to -> Settings->Site recovery infrastructure->Servers select the configuration server and click refresh server Click ok on the message and wait for the refresh to be completed. Once the refresh is completed, ideally the new physical server will be reflected in the connected agents list Now you can go ahead and enable replication for your physical server. In the Management portal, go to ->Settings->Site Recovery->Enable replication Enter the source. This will be your configuration server .Machine type will be Physical machines and Process server in this installation is same as configuration server Configure the target environment in Azure.

You need to select the target physical server at the next step. Click on the + sign

Enter details of your on prem physical server, ie server name , IP and the OS type

In the configure replication settings page, select the replication policy that you had created earlier

Now all the steps are done, and you can click "Enable replication" to protect your on-prem physical server

You can click on notifications to see progress of the task. You can also go to ->Jobs->"Site Recovery Jobs"-> and select the "Enable protection" job to see the status

If you see all green ticks, your machine protection is enabled . You can see the status of replication from site recovery vault>->Replicated Items. Once the replication is completed, the status will be shown as protected