UK Platforms

SCCM: COLLECTION DASHBOARD REPORT

Matt Balzan — Mon, 04 Mar 2019 19:30:28 GMT

Hello! My name is Matt Balzan and I am a PFE with the Windows and Devices team, in the UK. I was recently at a customer where they asked me if I could analyse why their collections were taking so long to evaluate (at least 4 hours!). After digging about in their database I found they had way too many collections with Incremental Updates or collections with hardly any members in them - this resulted in a massive performance hit on their database. In total there were:

over 11000 collections
over 8000 with fewer than 5 members or less
some crazy sql queries taking over an hour long to run - not good! :(

As we know SCCM logs everything in logfiles and its own SQL database. Therefore all that was required was to create a dashboard to display the following information:

total collections in environment (CAS or Primary standalone)
collections with less than 5 members (this links to a sub-report)
all sites collections taking less than 10 seconds to evaluate
all sites collections taking between 10 & 20 seconds to evaluate
all sites collections taking longer than 20 seconds to evaluate
highest collection modifier
weekly collection modifiers and their totals
collection refresh types count
WQL & SQL query script used per collection and more...

And here it is. See content and use explained below. TOP & MID SECTION This report is split into 3 parts: The TOP section displays the evaluation times which range from 0-10, 10-20 and 20 and above in seconds. The yellow and red charts are hyper-linked to the tables shown in the bottom section. The MID section displays the Collection Refresh Types, Total Collections and Collections with less than 5 members, the Highest Collection Modifier plus some modifier details. The Collection Refresh Types is also hyper-linked to table in the BOTTOM section. BOTTOM SECTION Tables displayed:

COLLECTION EVALUATIONS >20 SECS
COLLECTION EVALUATIONS 10-20 SECS
COLLECTION INCREMENTAL & FULL SCHEDULED REFRESH TYPES

total of collections with 5 members or less
chart showing you all the collections with their member count total
table with a legend showing the following detail:

Upload both reports in same root folder/path in your SSRS server.
Update your datasource for both rdl reports.
Ensure you have SELECT permissions for the tables mentioned below (or you or your DBA can use the sql script below).

GRANT SELECT ON [Collection_Rules_SQL] TO [smsschm_users]

GRANT SELECT ON [Collections_L] TO [smsschm_users]

GRANT SELECT ON [Collections_G] TO [smsschm_users]

Download the reports from here: [Collection_Dashboard_Reports] TIPS

Using the Report Builder, you can set the report to auto refresh by applying the setting in seconds:

Also, check above if your Language is set accordingly to ensure the correct date/time format! Since I am in the UK, mine is set to en-GB

Now you can start troubleshooting those problematic collections, begin tackling the ones that are taking too long to evaluate and investigate why the SQL/WQL queries are taking too long to return the desired data. Hope this helps with your SCCM Collection housekeeping! In the next blog I will show you how to fix the issues with your collections and the best practices to keep your environment in good shape. 😊 ++Special kudos to Ross Moore & Doug Varner for testing this in their environments! DISCLAIMER The sample files are not supported under any Microsoft standard support program or service. The sample files are provided AS IS without warranty of any kind. Microsoft further disclaims all implied warranties including, without limitation, any implied warranties of merchantability or of fitness for a particular purpose. The entire risk arising out of the use or performance of the sample files and documentation remains with you. In no event shall Microsoft, its authors, or anyone else involved in the creation, production, or delivery of the files be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, or other pecuniary loss) arising out of the use of or inability to use the sample scripts or documentation, even if Microsoft has been advised of the possibility of such damages. Matt Balzan | Premier Field Engineer | SCCM, Application Virtualisation

INTUNE: REPORT ALL DEVICES THAT ARE NON-COMPLIANT BECAUSE THEY ARE INACTIVE

AnilAbraham — Sat, 23 Feb 2019 16:42:44 GMT

It’s me Anil Abraham again with a quick blog. These days my job involves walking into customers and talking about modern device management and how to shift from the traditional management methods to the new ways. Obviously, Intune plays a big part in modern device management.

More often these days, I get asked the question of how about reporting and the flexibility we had with SCCM in terms of capability that came with SSRS that let us create custom reports. Customer Query:- The other day one of the customers asked me a question, how to report all devices in Intune that are reported as non-compliant because they have not reported back to Intune in the last 30 days. 30 days because in Intune that is the default setting for a device to be marked non - compliant if it hasn't checked in. Microsoft Graph is your answer. For those that are new to Microsoft Graph start @ https://developer.microsoft.com/en-us/graph/ The data that Intune exposes, be it inventory data, policy or apps, they are all exposed via Microsoft Graph. For people familiar with Graph and Intune, the query that gives the result is

https://graph.microsoft.com/v1.0/deviceManagement/ deviceCompliancePolicySettingStateSummaries/ DefaultDeviceCompliancePolicy.RequireRemainContact/ deviceComplianceSettingStates?$filter=state eq 'nonCompliant'

For people who are new to this... Sign into Graph Explorer (https://developer.microsoft.com/graph/graph-explorer/) using an account that has delegated permissions to read the properties and classes that you are after. More details @ https://docs.microsoft.com/en-us/graph/permissions-reference For a quick view of the data that is held within Intune and exposed via Graph, an example of all the enrolled devices is as below. Getting there... I started looking at the API for Intune @ https://docs.microsoft.com/en-us/graph/api/resources/intune-graph-overview?view=graph-rest-1.0 From the request, I know, I am after a specific device compliance setting, so first step is to find all the device compliance policy settings, which I found was listed @ https://docs.microsoft.com/en-us/graph/api/intune-deviceconfig-devicecompliancepolicysettingstatesummary-get?view=graph-rest-1.0 From the above I could identify the query to be run in Graph Explorer as https://graph.microsoft.com/v1.0/deviceManagement/deviceCompliancePolicySettingStateSummaries This gives me a list of settings that are part of compliance policies as below in the graph explorer. Going through the list I could identify the value that I was after as below. I hear you ask, what is so much about it as there is this list you could Export from the Intune Web console. A sample from test tenant is below. The intention of this blog is to give an overview of the Graph and access to data within. As you can see the numbers from the graph explorer matches what you see for the "Is Active" setting. You also have the option to export the report at this level. You could drill down further in the Intune Report as below. There is an export option here too and you could get the data into Excel but it gives you all the devices, both compliant and non-compliant and then you should filter in Excel to get the data that you are after. Let’s look at how to do all this in Graph Explorer. From the previous exercise in Graph Explorer we know the ID of the setting that we are after is DefaultDeviceCompliancePolicy.RequireRemainContact. Further constructing the query to report only on the above said setting and devices to show only that compliance setting value, I built the query as below https://graph.microsoft.com/v1.0/deviceManagement/ deviceCompliancePolicySettingStateSummaries/ DefaultDeviceCompliancePolicy.RequireRemainContact/deviceComplianceSettingStates Result is as below The result shows all the 12 devices in my test tenant and the compliance state for each of those devices against the DefaultDeviceCompliancePolicy.RequireRemainContact setting. Sample data for a device that is non-compliant is as below. As you can see the value that we are after is the value of the property "state". So, with that knowledge building the query to show only the devices that are non-compliant for that setting would be

https://graph.microsoft.com/v1.0/deviceManagement/deviceCompliancePolicySettingStateSummaries/DefaultDeviceCompliancePolicy.RequireRemainContact/deviceComplianceSettingStates?$filter=state eq 'nonCompliant'

In action the result would look like below. The result is the 9 devices that are non-compliant because they have not contacted Intune for the last 30 days. But, I can hear you say, Anil I want to report all this programmatically and reporting through Graph Explorer is not an option in an enterprise. If there is enough interest and I can find some time I will put a Part 2 to show how we could automate all this. Hope you find this helpful....

Office 365 ProPlus - How To: Add previously excluded components

NandanSheth — Fri, 08 Feb 2019 19:40:03 GMT

If you have installed a Office 365 ProPlus with a custom XML file with excluded components and then struggled to add components that users needed, this post should help you with the process of pushing additional components to managed devices.

Hello, Nandan here again. When I last wrote a blog post I was based in Reading, UK and have since relocated to Dublin. It’s been a busy but interesting last few months with the transition. Back working with customers, helping them with their move to a modern desktop, I ran into an interesting query last week. One of my customers is in the process of deploying Windows 10 with Office 365 ProPlus. As part of the operating system deployment, they are deploying a generalized Office configuration. The XML file that is being used to configure the Office client excludes a specific set of components and the setup process works exactly as it is expected to. The components that are excluded are not available on the system. Here is a snippet of the XML file to show the components that are not being deployed. As you can see, we are excluding Access, Skype for Business and both OneDrive components - OneDrive Desktop and OneDrive Groove. Now, certain users within the organization need to work with Access databases. So obviously, they will need Access on their systems. The business wants to make Access available to users on demand when they need it and not have it installed as a standard component of Office. This is understandable and a common practice. To perform this installation, we have created a second XML file which does not have the exclusion for Access. In the first instance, Office is installed successfully without Access. In the second instance, with the modified XML file, setup runs and when the over-the-top install completes Access is still missing. So, how do we resolve this problem to ensure Access is deployed for users that have a need for this component? As it turns out, there are two ways to do this. Simple and Dirty: Install Access as an Independent Application Create a new XML: We use AccessRetail as the Product ID. 16.0.9126.2295 - the Version element - is an Office 365 ProPlus Semi Annual Channel build from the 1803 release of Office 365 ProPlus and when Access is installed, it is the right branch and version as needed. This is the dirty approach because now, Office 365 ProPlus and Access 2016 show up as two separate applications in the Add Remove Programs dialog box. Access might need separate patch management and also, I am not 100% sure if Access will update in line with how other O365 ProPlus components would. I haven't used the Office 365 ProPlus components with this configuration and this will need a considerable amount of testing to ensure things work as expected. Finally, if you are using multiple language packs, there will be one entry for each language pack. In our case, we had 18 entries in Add Remove Programs because we were using 9 language packs (this will be cleaned up in a separate exercise). Cosmetically, this is a nightmare. The Cleaner Way To begin with, I modified my second XML file to add logging for the Office 365 ProPlus installation. I also used SysInternal’s Process Monitor to track any file and registry activity that was happening on the system while an over-the-top-install was running to install the missing Access components. The logs revealed some interesting information. About three seconds in after calling setup.exe, we see the following information in the log file:

01/21/2019 11:46:06.522      SETUP (0x28ec) 0x1b0c        Click-To-Run General Telemetry      aoh9t       Medium TryLaunchClient::HandleStateAction {"MachineId": "71f7769c1fca0c488833235052d1f416", "SessionID": "1eb0e35a-e57c-4051-b6a2-497355a89d17", "GeoID": 242, "Ver": "16.0.9126.2295", "C2RClientVer": "16.0.9126.2295", "ContextData": "{\"message\":\"Launching executable\",\"ClientExeName\":\"OfficeClickToRun.exe\",\"Parameters\":\"culture=en-us defaultplatform=False allowcdnfallback=False deliverymechanism=7ffbc6bf-bc32-4f92-8982-f9dd17fd3114 platform=x86 productreleaseid=none forcecentcheck= lcid=1033 b= storeid= piniconstotaskbar=FALSE autoactivate=1 productstoadd=O365ProPlusRetail.16_en-us_zh-cn_cs-cz_hu-hu_ms-my_pl-pl_ko-kr_sk-sk_th-th_x-none scenario=CLIENTUPDATE updatesenabled=True acceptalleulas=True cdnbaseurl=http://officecdn.microsoft.com/pr/7ffbc6bf-bc32-4f92-8982-f9dd17fd3114 version=16.0.9126.2295 sclcacheoverride=0 mediatype=Local baseurl=\\\"C:\\\\Users\\\\username\\\\file_location\\\\OfficeC2R\\\" o365proplusretail.excludedapps=groove,lync,onedrive sharedcomputerlicensing=0 flt.useexptransportinplacepl=unknown flt.useoutlookshareaddon=unknown flt.useofficehelperaddon=unknown\"}"}

We can see that setup is correctly identifying that Access should be installed. However, the end result is not aligned with our requirements or expectations. A process monitor trace gives us some more information.

11:46:06.7572701      OfficeClickToRun.exe  684       10964  RegSetValue HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Scenario\CLIENTUPDATE\ExcludedApps       SUCCESS Type: REG_SZ, Length: 78, Data: o365proplusretail_groove,lync,onedrive
11:46:12.0268475      OfficeClickToRun.exe  10468       1264   RegSetValue HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Scenario\INSTALL\ExcludedApps       SUCCESS Type: REG_SZ, Length: 78, Data: o365proplusretail_groove,lync,onedrive
11:46:12.1683621      OfficeClickToRun.exe  10388       10132  RegQueryValue HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Scenario\INSTALL\ExcludedApps       SUCCESS Type: REG_SZ, Length: 78, Data: o365proplusretail_groove,lync,onedrive
11:46:12.1683934      OfficeClickToRun.exe  10388       10132  RegQueryValue HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Scenario\INSTALL\ExcludedApps       SUCCESS Type: REG_SZ, Length: 78, Data: o365proplusretail_groove,lync,onedrive
11:46:12.1685581      OfficeClickToRun.exe  10388       10132  RegQueryValue HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration\O365ProPlusRetail.ExcludedApps       SUCCESS Type: REG_SZ, Length: 56, Data: access,groove,lync,onedrive
11:46:12.1686073      OfficeClickToRun.exe  10388       10132  RegQueryValue HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration\O365ProPlusRetail.ExcludedApps       SUCCESS Type: REG_SZ, Length: 56, Data: access,groove,lync,onedrive
11:46:12.1688617      OfficeClickToRun.exe  10388       10132  RegSetValue HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Scenario\INSTALL\ExcludedApps       SUCCESS Type: REG_SZ, Length: 92, Data: O365ProPlusRetail_access,groove,lync,onedrive
11:46:12.1902420      OfficeClickToRun.exe  10388       10132  RegQueryValue HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Scenario\INSTALL\ExcludedApps       SUCCESS Type: REG_SZ, Length: 92, Data: O365ProPlusRetail_access,groove,lync,onedrive
11:46:12.1902609      OfficeClickToRun.exe  10388       10132  RegQueryValue HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Scenario\INSTALL\ExcludedApps       SUCCESS Type: REG_SZ, Length: 92, Data: O365ProPlusRetail_access,groove,lync,onedrive
11:46:12.1903673      OfficeClickToRun.exe  10388       10132  RegSetValue HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration\O365ProPlusRetail.ExcludedApps       SUCCESS Type: REG_SZ, Length: 56, Data: access,groove,lync,onedrive
11:46:12.1913449      OfficeClickToRun.exe  10388       10132  RegQueryValue HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration\O365ProPlusRetail.ExcludedApps       SUCCESS Type: REG_SZ, Length: 56, Data: access,groove,lync,onedrive

Setup.exe calls into OfficeClickToRun.exe which is querying the ExcludedApps value from the initial install. It sees that Access was excluded in the initial deployment, and then reconfigures the Configuration\O365ProPlusRetail.ExcludedApps to reflect the original configuration that excluded Access. The setup process then completes without enabling the components for Access and it does not show up as installed. To resolve the issue, we ended up using a simple batch file that first modified the registry before invoking setup.exe. As you can see below, this really as simple as simple can get.

===== START BATCH FILE ===== 

reg.exe add HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v O365ProPlusRetail.ExcludedApps /d REG_SZ /v groove,lync,onedrive /f
setup.exe /configure .\OfficeC2R_1803_Access_Config.xml

===== END BATCH FILE =====

This works great and when setup.exe completes an over-the-top install, Access is included on the Office deployment and works just as expected. On my side, I am trying to see if I can reproduce this problem on a test environment and then flag this with the product group for some more investigation as I have seen threads on various forums where people have experienced similar problems. Once I have an update, I will refresh the content of this post with relevant information. In the meantime…

If you experience any inconsistencies with Office 365 ProPlus installations, irrespective of which build you are installing, see if you are using the latest version of the Office Deployment Tools. The tooling is update frequently, and can be downloaded from HERE. The latest version is 16.0.11306.33602, dated 14^th January 2019 (at the time this post was written) and which is what we used while trying to crack this problem.
If you need to deploy Office 365 ProPlus and need to author your configuration.xml files, try using https://config.office.com. This is a great online tool that lets you create your configuration files without having to remember the tags and structure of the XML file.
For more details on Office Customization, refer to THIS.
And finally, refer to this link for the configuration options for the office deployment tool.

5 Second Delays Add Up – The Case of the 4 Hour + In-Place Upgrade

NandanSheth — Mon, 18 Jun 2018 14:39:44 GMT

[How does simple configuration oversight affect in-place upgrades for Windows 10? Read on to find out.] Hello, Nandan here again! Over the last couple of years, as businesses have started adopting Windows as a Service, one of the big changes in managing the Windows life-cycle is the in-place upgrade. Clearly, with the shorter release cadence, it isn’t possible to “rebuild” a user’s device every time a new build of Windows 10 is approved for deployment within the organization. So, we upgrade in-place from 1703 to 1709 to 1803 and so on. One of the most common problems that I have seen with this approach is the amount of time it takes for an in-place upgrade to complete. In an ideal scenario, this process should take between 45 minutes to an hour. This is the time I have seen on my personal desktop at home, which is a stand-alone, unmanaged device. This is also the unofficial guide time for the in-place upgrade. I say unofficial, because it’s very difficult to put a finger on exactly how long the in-place upgrade should take. There are various factors involved. How many users are using the machine, and how many profiles do we have on the system being upgraded? How large are these user profiles? Where is the user data stored? Is the AV configured for real-time scanning for write operations (because a lot of data is being written to the disk during the in-place upgrade, real-time scanning can directly influence the time this process takes)? At a very high level, the following steps are involved in the upgrade process:

The Windows 10 OS image is downloaded
The Windows setup engine runs through various compatibility checks as a way to ensure there are no known issues with applications, drivers, BIOS, etc
User data is inventoried; this is needed so that it can be restored at the end of the upgrade process
Setup then completes the actual upgrade of the operating system – this process involves laying out the new operating system on to the disk and moving the old operating system out of the way

I will be following up with a separate post that dissects the in-place upgrade in a few weeks. A few months ago, one of the customers I was working with sent me an email. They were transitioning from 1607 to 1709 and had observed that in-place upgrades were taking over 4 hours plus at the longest, with an average time somewhere between 2.5 to 3 hours. In either case, compared to the normally expected upgrade times, this was way off the mark. To get to the bottom of this, we donned our troubleshooting hats and began picking through the logs to see where the delays were and how we could bring the upgrade times to an acceptable value. The test machines we were using were shared systems with multiple user profiles. User files and documents were redirected to a NAS device and a few of them had their Documents folder as large as 25 GB. We started with the most important log that is used for issues in the Windows setup process – the setupact.log file. This file is found under the C:\$Windows.~BT\Sources\Panther folder. The folder is normally hidden, so you might need to toggle the settings for hidden files and folders from Explorer options if you don’t see it. The customer was using an in-place upgrade task sequence in SCCM to perform the upgrade. The delays we see below were observed after the operating system image download had completed and setup.exe had been invoked. The big delays were happening after the OS finished downloading the image and the first reboot, and then post the first reboot.

Time taken after the OS image was downloaded to first reboot: 150 minutes
Time taken for the upgrade to complete after the first reboot: 100 minutes

The log started showing some very clear patterns. Below is a snippet showing 5 second delays: The next snippet shows similar delays, but this time the delays were up to 10 seconds. There are a couple of things to note here:

What are those strange characters that we see in the file names? This is out of scope for the current discussion, and I will revisit this when I work on the dissection of the in-place upgrade.
And probably, the bigger question - what is happening during these 5 or 10 second delays?

Considering we are accessing a network share, my first thought was this could be a networking issue. Two tools popped out from the arsenal – Procmon and Network Monitor. I decided to start with Procmon. We started running setup for the upgrade, manually this time, because we knew that the actual download of the image was not causing any delays. By running setup from a USB stick, we were able to speed up the troubleshooting process. After starting setup, we monitored the setupact.log file for the phase where user data is processed, which is where we see the delays above and then started a Procmon trace. For the delays, the trace showed… The status code for these operations is 0xC0000199. This translates to: And, these operations were performed by setuphost.exe, which was running under the context of the System account. On digging around further, I found that the path to the network share was using the CNAME record for the NAS device hosting the file shares. In the paths we see in the snippets above, SERVER is an alias, not the actual hostname. So, we started testing this further. On a test system, we opened a command window running under the context of the system account (PSExec to the rescue).

Try to map a drive using the A record for the NAS device – Successful
Try to map a drive using the CNAME record for the NAS device – 0xC0000199 after 5 seconds

That second result is the same symptom we were seeing during the In-Place Upgrade. This got us looking at authentication options for the NAS and how the appliance was generally configured. The customer was using Kerberos authentication for the NAS device, and the problem seems to be related to issues with how authentication options and SPNs are registered for the records that point back to the NAS. We found an interesting article on the NetApp website (the customer was also using a NetApp filer for their storage requirements). https://kb.netapp.com/app/answers/answer_view/a_id/1030858 The final resolution was missing SPNs. For the name in the A record there were SPNs registered. For the name in the CNAME record, there were no SPNs registered. Registering SPNs for the CNAME record got the connections to the shares working, using the alias. Once this was done, upgrades started completing in a 45 to 60 minute range – which is what the normally expected times for an in-place upgrade are and what the customer was also expecting. For those that don’t normally work on DNS and networking – an easy way to understand the CNAME record is a nickname or an alias.

Name to IP Address mapping – A Record
Alias to Name mapping – CNAME Record

For example, your name is Jonathan and your phone number is 123456. Friends and family know you as John. In DNS terms, this would be stored as:

Jonathan (A Record) 123456
John (CNAME Record) Jonathan

Anyone looking for the phone number can look for John or Jonathan, and they will receive the same number. In the same way, when you create a DNS name record for your NAS filer, it might map the IP address to a complex name like filer-xxxxxx-serial_number.domain.com. However, you might want to make it easier to access the NAS device and just call it fileserver.domain.com. In this case, you end up with:

filer-xxxxxx-serial_number.domain.com (A Record) 192.168.100.120
filerserver.domain.com (CNAME Record) filer-xxxxxx-serial_number.domain.com

Which means… fileserver.domain.com maps to filer-xxxxxx-serial_number.domain.com maps to IP address Ultimately, the CNAME or the A record map to the same underlying IP address. Here’s a good article describing these records - https://support.dnsimple.com/articles/differences-between-a-cname-alias-url/ For information on Service Principal Names, review - https://msdn.microsoft.com/en-us/library/ms677949(v=vs.85).aspx

Say No to Long Term Servicing Channel (LTSC)

Greg Nottage — Mon, 11 Jun 2018 12:54:47 GMT

Hello, my name is Greg Nottage and I am a Consultant with the Windows and Devices team in the UK. I often work with customers who are in the process of transitioning to Windows 10 but are considering the use of Windows 10 Long Term Servicing Channel (often shortened to LTSC and also previously known as Long Term Servicing branch which was shortened to LTSB – thanks Marketing team :-). When we look at managing Windows 10 through the same lens as we’ve all done for the past 20 years or so (i.e. a new operating system release cycle of approximately one every 3 to 5 years), it's easy to see why customers would think LTSC is the right solution for them,. However, with the launch of Windows 10, Microsoft introduced a new concept for release management – Windows as a Service (or WaaS for short). I won’t dwell on the details of the concept, as it’s been well documented before – but I will say that, in a nutshell, WaaS represents an increased frequency of change (given the bi-annual release cycle that is the new normal). Organisations do need to prepare for WaaS appropriately to ensure the best success - but once correctly implemented, the mid- to long-term results will reduce IT overhead as the changes being introduced are incremental in nature. LTSC has its place – specifically it is meant for devices that have single (often mission-critical) use-cases such as:

Systems that power manufacturing or medical equipment
Embedded systems in kiosks, such as ATMs or airport ticketing systems

You might notice that the above examples are typical of ‘embedded style’ devices – and you would be right. LTSC 2016 shares the same codebase as Windows 10 IoT, which is the evolution of Windows Embedded OS – and you wouldn’t have considered widely deploying Embedded OS everywhere. The point of this article is to help to dispel any myths that may exist and to help you understand why wide adoption of LTSC is a bad idea.

Why not LTSC?

It may be tempting for organisations to look at LTSC and determine that this more closely matches the historic Windows release cycle, however the recommended Windows 10 version that should be widely deployed is the Semi-Annual Channel (SAC, formerly known as Current Branch for Business or CBB). I’ve spoken to customers who held a misconception that the SAC version of Windows 10 prevented the permanent removal of certain standard applications that are pre-installed with Windows 10 (like the Xbox app etc.). This is not correct and should not be a reason for adopting LTSC. Pre-installed applications can be removed and consumer features can be disabled. These activities have been covered by Michael Niehaus in his previous posts and I recommend customers bookmark these articles:

As a general guideline, devices that fulfill the following criteria are considered general-purpose devices and should be paired with Windows 10 using the Semi-Annual Channel servicing option:

Devices that run productivity software such as Microsoft Office
Devices that use Windows Store applications
Devices that are used for general Internet browsing (for example, research or access to social media)

Note: Gartner agrees with this approach (see Rethink Windows 10 LTSB Deployment Based on Microsoft's Updated Guidance) It is also worth mentioning that if you have deployed Windows 10 LTSC, all is not lost. It is possible to perform an in-place upgrade to the SAC version of Windows 10, which is the recommended solution to align with Microsoft guidance on the broad use of SAC instead of LTSC. To further explain the reasoning behind the use of SAC over LTSC, please read the following key points:

Using LTSC means missing out on new OS enhancements that are included in SAC releases – particularly new security features
LTSC does not keep pace with new silicon releases in the same way SAC does – so LTSC 2016 does not support Intel chips beyond the ‘Kabylake’ generation
Windows Analytics Upgrade Readiness does not support LTSC
No support for the modern Edge browser
No support for Cortana
No support for Windows Store
No support for Surface hardware
LTSC does not support ConfigMgr Express Updates
In-Place Upgrade from Windows 7 to Windows 10 is not supported for LTSC
From January 2020, Microsoft Office 365 will not be supported on LTSC
LTSC does not keep pace with feature enhancements to Windows Defender ATP
Potential Independent Hardware and Software Vendor support and limitations on LTSC
Non-security operating system fixes and enhancements may not get back-ported to LTSC
Loosely defined LTSC release cycles make planning ahead more difficult

I hope this clarifies your understanding around the use Windows 10 LTSC and helps to explain the reasoning behind why you should deploy SAC, and not LTSC. If you have any questions or comments about this post, please leave a comment below. EDIT (18-06-2018): A colleague has recommended I link to Todd Furst's excellent session from Ignite that also helps explain more on this subject - https://channel9.msdn.com/Events/Ignite/Microsoft-Ignite-Orlando-2017/THR2010R EDIT(22-08-2018): A couple of colleagues noticed that the above Ignite link was no longer working, so I've amended it to one that is. Many thanks to those who pointed this out.

Deploy Custom GPO via Microsoft Intune

AnilAbraham — Wed, 30 May 2018 09:56:54 GMT

Hello! My name is Anil Abraham, and I am a Senior PFE with the Windows and Devices team, in the UK. Modern management for Windows 10 is a hot topic and with Autopilot, Azure AD Join and management using Intune, a question that customers keep asking me is, "Would MDM ever replace Group Policy?" With a smile, I say, "I don't know." The next question is, "what if I have custom ADMX files, like those for Google Chrome!". The answer is, you should be using Microsoft Edge :) But hey, you know we are Microsoft, we have great products and our engineers provide great solutions to help you. So, today, I want to illustrate how you can manage settings for third party applications with custom ADMX templates using Microsoft Intune. The application in focus for this post is Google Chrome. Group policy templates for Google Chrome can be downloaded from here. Note: This is an external link and is subject to change. The procedure below will use the concepts of ADMX backed MDM policies, the details of which are available here. I understand how the ADMX policies are interpreted, especially the ones shipped with Windows. But what was of interest to me was the following statement: “An ADMX file can either be shipped with Windows (located at %SystemRoot%\policydefinitions) or it can be ingested to a device through the Policy CSP URI (./Vendor/MSFT/Policy/ConfigOperations/ADMXInstall).”

Ingesting an ADMX

So essentially, our first step is to ingest the custom ADMX for Google Chrome through the Policy CSP. This link further explains how to ingest the ADMX template into the policy CSP and then subsequently apply the settings we want – in this example, the "Show Home Button" setting. With all that knowledge let’s look at how this translates to an MDM policy in Intune. The first step is to create Custom Windows 10 policy to ingest the ADMX as shown below. I am assuming you know how to do this. If you are new to this, refer to the link . Key points to note are as below:

OMA-URI :
 ./Vendor/MSFT/Policy/ConfigOperations/ADMXInstall/GoogleChrome/Policy/AppAdmxFile01

Data Type:
 String

Value:
 The value for the string will be the contents of the policy set available in the Chrome ADMX template. Download the txt file from here and copy the contents to the String Value field.

Note: The OMA-URI has two attributes that are user defined. They are the application name (GoogleChrome in this case) and the ADMX file name (AppAdmxFile01 in this case). The ADMX file name will change based on the file you are using. As long as it is unique on the device, it does not matter what you have called the last part. The URI determines whether the policy is a user or a device policy. This link explains how you construct them for device or user. Once you have saved the policy assign it to group of your choice. In my case I am assigning a machine level policy and on the machine where the policy is applied, you should see the registry keys added as below: HKLM\SOFTWARE\MICROSOFT\PolicyManager\AdmxInstalled HKLM\Software\Microsoft\PolicyManager\AdmxDefault

Set the ShowHomeButton

Now that we know the ADMX for Google Chrome has successfully been ingested on to the local machine, let’s look at how we can set the homepage URL. In the ADMX, the section for the homepage is as below: To apply this policy via the OMA-URI we first need to build it. The link gives you an idea of how the policy can be built. Things to note from the ADMX snippet above are the registry key that would be set once the policy applies, the parent category and the value. Within the ADMX, the parent category for ShowHomeButton is googlechrome and is as below: Using the guidelines in the articles above, I constructed the OMA-URI for the setting with the details below:

./Device/Vendor/MSFT/Policy/Config/GoogleChrome~Policy~googlechrome/ShowHomeButton

To explain that in parts

./Vendor/MSFT/Policy/Config/ remains same for all machine polices
GoogleChrome is your application name you chose on the ADMX ingestion URI.
ShowHomeButton is the actual category that we are setting in our example which translates to the reg key Software\Policies\Google\Chrome\ShowHomeButton.

There is an easier way to double check this if you have successfully ingested the ADMX to a machine. The below registry key would give you an idea of what it should look like. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\AdmxDefault\A8FC3654-6BCD-42AA-92BC-E1B20B96557B\GoogleChrome~Policy~googlechrome\ShowHomeButton The last part of the key is the OMA-URI that we are after. Note the ‘\’ need to replace with ‘/’ in the OMA-URI.The GUID A8FC3654-6BCD-42AA-92BC-E1B20B96557B will be specific to your machine. Now that we have constructed the OMA URI we need to create the Windows 10 custom policy as shown below in Intune. The key values are:

OMA-URI:
./Device/Vendor/MSFT/Policy/Config/GoogleChrome~Policy~googlechrome/ShowHomeButton

Data Type:
 String

Value:

Save the policy and assign it to the same group that you assigned the admx policy to. The data id is the text id of the category that you are setting from the ADMX which in our case is the HomepageLocation_Recommended. After the machine has downloaded the policy, you should see the registry key as in the screenshot below: From a monitoring perspective, you should see the per-setting status to be a success as below: On the client, event ID 814 and 831 will be recorded for successful application of the policy as below: From a Chrome perspective, you should see the option enabled but the button is disabled and the setting is managed. Please note that if you are creating both the ADMX and the setting policy together it might take a couple of policy downloads before the policy applies to the device. The ADMX has to exist on the device before the policy setting can apply. I hope this provides a good starting point to help you get started with managing policies for custom ADMX templates through Intune and better understanding of how to use Policy CSP on Window 10 latest versions for this purpose.

Azure Cost Optimisation Series - Enable Hybrid Use Benefit (HUB) Using PowerShell

Neil Bird [Msft] — Wed, 07 Mar 2018 13:50:57 GMT

Hello all, My name is Neil Bird, I am a Premier Field Engineer (PFE) in the UK Cloud & Infrastructure team. I am passionate about helping customers get the most out of Microsoft Azure and Windows Server technologies. This is the second blog post in a series where I will be sharing some information, scripts and approaches to help with Azure Cost Optimisation for IaaS. This week I want to highlight the massive savings customers can benefit from if they have purchased "Windows Server Datacentre with Software Assurance" licences for their on-premises workloads. Software Assurance (SA) licencing enables customers to deploy new (or upgrade existing) Windows Server instances using latest version of Windows Server. However, in addition to always being able to use the latest version of Windows Server Operating System, Software Assurance enables customers to make savings on Virtual Machine running costs in Azure. This makes Software Assurance even more compelling, as the savings can soon add up to huge amounts depending on the number of VM instances you have deployed in Azure. Extract from: Azure Hybrid Benefit for Windows Server

For customers with Software Assurance, Azure Hybrid Benefit for Windows Server allows you to use your on-premises Windows Server licenses and run Windows virtual machines on Azure at a reduced cost. You can use Azure Hybrid Benefit for Windows Server to deploy new virtual machines from any Azure supported platform Windows Server image or Windows custom images.

Azure Hybrid Use Benefit Eligibility: If you would like to know if you / your organisation is eligible to enable Hybrid Use Benefit in Azure, you need to determine if you have purchased "Windows Server Datacenter with Software Assurance" licences for your on-premises environment and if so, the number of licences you hold. To find this out, you could ask your internal Software Asset Management team (if applicable) who could look in your organisation's Microsoft Volume Licence Service Centre (VLSC) portal. Alternatively, you could ask your Microsoft Software Reseller / Partner, or if you are a Microsoft Premier customer you could ask your Microsoft Technical Account Manager (TAM), who would be able to provide assistance. Windows Server Datacenter vs Standard Licences: "Windows Server Datacenter with Software Assurance" allows customers to use the licence on-premises AND in Azure (at the same time). "Windows Server Standard with Software Assurance" allows customers to use the licence on-premises OR in Azure (Not at the same time). Number of Windows Server Datacenter with SA Licences Held: For each "Windows Server Datacenter with Software Assurance" licence held (16 cores or a 2-Processor Licence), you are eligible to deploy "Up to two VMs and up to 16 cores" with Hybrid Use Benefit (HUB) Enabled. For example: You can enable HUB on "two VMs with 8 vCPUs each, or one VM with 16 vCPUs" per "Windows Server Datacenter with Software Assurance" (16 cores or a 2-Processor) licence your organisation has purchased. Or to put it another way: For each "16 Core or 2 Proc Windows Server Datacenter with Software Assurance Licence" you have already purchased for On-Premises, you can Enable Hybrid Use Benefit (HUB) on either "2 x 8 vCPU VMs" or "1 x 16 vCPU VM" in Azure. I would like to point out that I am not a licensing specialist, if you have questions on the above or would like to understand more about Azure Hybrid Use Benefit there are a few official Microsoft articles that fully explain the Benefits, Rules and Use Cases for Azure Hybrid Use Benefit (AHUB). There is also a Pricing Calculator tool available. Links to these articles are below:

Note - This information is correct at the time this blog post was published. I would always recommend and advise that customers review the latest official Microsoft documentation for any updated terms with regards to Azure HUB. How do I Enable Hybrid Use Benefit on VMs in Azure? You may have been using Azure to deploy Windows VMs without realising your organisation is eligible to enable Azure Hybrid Use Benefit, this was the case for two customers I have been working with recently. After we determined the number of Windows Server Datacenter with Software Assurance licences they held, they both wanted to "Enable HUB on All Windows VMs in All of their Subscriptions" so that they could instantly start saving on the running cost of their IaaS VMs. To help my customers enable Hybrid Use Benefit on all of their existing Windows VM, in all of their subscriptions in Azure, I wrote a PowerShell script to automate the task and to provide additional audit / reporting information. The script had the following requirements / capabilities:

Include a "Simulate Mode" Option (This enabled them to audit their subscription(s) and understand what the script "would do" if they run it in update mode)
Export information to a CSV File. (This includes VM Name, Resource Group, Size, HUB Enabled (Yes / No), Script Action and Subscription Name and ID)
Provide a "Totals Count" showing the number VMs that have had HUB Enabled (This is useful for reporting on success / failure or VMs that are not compatible with HUB such as Linux VMs)
Pass a "Subscription Name", if you do not want to process all subscriptions. (Useful if you have a large number of subscriptions.)
Include a "Yes / No" confirmation prompt prior to enabling HUB on a per subscription basis (Useful if you want to update the majority of your subscriptions, but not all of them.)

I wanted to share my PowerShell script with you, so that other customers can benefit from being able to Enable Hybrid Use Benefit on all existing Windows VMs in all of your Azure subscriptions, using a single PowerShell script. Example screenshot of the script in action: Example screenshot of the script results: Dependencies: The script requires: "AzureRM" Module v3.2 or above.

Install-Module AzureRM

Or if you already have the "AzureRM" Module installed, check it is running the latest version:

Update-Module -Name AzureRM

Example Syntax to Execute the Script: Simulate Mode:

.\azure-enable-hybrid-use-on-all-vms.ps1

Update Mode: (The script displays a yes/no prompt per subscription prior to Enabling HUB on Windows VMs in that subscription)

.\azure-enable-hybrid-use-on-all-vms.ps1 -SimulateMode $False

Output from the Script: The script generates a CSV file called 'azure-enable-hybrid-use-audit-report.csv' which provides details of the VMs and either the "Action the Script Would Perform" (Simulate Mode), or the "Action the Script has Taken" (Simulate Mode Disabled). Download Link: Download the PowerShell Script from the TechNet Gallery Feedback: Please let me know if this PowerShell script is useful by posting a comment below. What about Enabling Hybrid Use Benefit for New VM Deployments? The PowerShell script I have shared with you is designed to Enable HUB on Existing Windows VMs, that is, VMs that have already been deployed into an Azure subscription. For new VM deployments it is possible to enable HUB using ARM JSON or PowerShell so that newly deployed VMs have HUB enabled from their initial creation date. Deploy a New VM with HUB Enabled using ARM JSON Parameter: Within your Resource Manager templates, an additional parameter licenseType must be specified. Edit your Resource Manager template to include the "license type" as part of the compute provider and deploy your template as normal. Example below:

"properties": {  
   "licenseType": "Windows_Server",
   "hardwareProfile": {
        "vmSize": "[variables('vmSize')]"
   }

Deploy a New VM using PowerShell: When deploying a VM in Azure using PowerShell, there is an additional parameter -LicenseType that can be specified. Example below using the final New-AzureRmVM cmd-let to set the licensing type: Build VM Configuration as normal using this example for New-AzureRmVMConfig: $VM = New-AzureRmVMConfig..... New-AzureRmVM -ResourceGroupName "myResourceGroup" -Location "West US" -VM $VM -LicenseType "Windows_Server" I hope you can use this PowerShell script to help Optimise the Cost of your Azure IaaS Deployments by enabling Hybrid Use Benefit on all existing Windows VMs deployed in your subscription(s). View other blog posts in the Azure IaaS - Cost Optimisation Series http://aka.ms/AzureIaaSCostOptimisation Cheers Neil

Azure Cost Optimisation Series - Identify Orphaned Disks Using PowerShell

Neil Bird [Msft] — Wed, 21 Feb 2018 12:57:07 GMT

Hello all, Neil Bird here again, I am a Premier Field Engineer (PFE) in the UK Cloud & Infrastructure team. I am passionate about helping customers get the most out of Microsoft Azure and Windows Server technologies. This is the first in a series of blog posts where I will be sharing some information, scripts and approaches to help with Azure Cost Optimisation for IaaS. Many (if not all) of the organisations I speak to have a strategy to migrate to public cloud in the near future, whether they are migrating their entire data centre or have a hybrid-cloud strategy, it is very easy for them to benefit from the increased Agility, Availability and Hyper-Scale offered by Microsoft Azure. Azure provides the ability for customers to be able to very quickly and easily expand (scale horizontally) or shrink services dynamically depending on their business requirements. This elasticity and Azure's "pay as you go" model are a key business enabler, providing organisation with the flexibility to react to market conditions, new opportunities or internal projects with lightning speed. For Infrastructure as a Service (IaaS) workloads, if you are spinning up (deploying) and tearing down (deleting) virtual machines (VMs) on a regular basis, there is a safety feature built into Azure whereby a VMs Disks are NOT automatically deleted when the VM itself is removed. This scenario (NOT deleting the disks) happens when a VM is deleted without deleting it's parent Resource Group, which is often the case if you have multiple VMs in the same Resource Group, possibly for RBAC delegation purposes. For example, if you were to select a single VM in the Azure Portal and delete it (without deleting the Resource Group), this would mean that the OS Disk, Data Disk(s) and Network Interface associated with that VM would NOT automatically be deleted, these Disks effectively become "Orphaned" and would still incur storage costs in your subscription(s).

When you delete a virtual machine (VM) in Azure, by default, any disks that are attached to the VM aren't deleted. This feature helps to prevent data loss due to the unintentional deletion of VMs. After a VM is deleted, you will continue to pay for unattached disks.

This behaviour and some example PowerShell code to identify Orphaned Unmanaged and Managed Disks (disks that are no longer associated with a VM) are described in the following support article: https://docs.microsoft.com/en-us/azure/virtual-machines/windows/find-unattached-disks The sample PowerShell code included in the article above is very useful, however I received feedback from a couple of enterprise customers in the UK that it did NOT provide sufficient information for them to be able to make an informed decision as to whether it is safe to delete a disk or not. i.e - the "Disk URI" alone is not enough information. Following this feedback, I decided to create a more comprehensive PowerShell script that provides the following functionality:

Export data to a CSV File. (particularly useful if you have multiple subscriptions to audit, as the script appends audit data to the same file)
Output additional properties of the Orphaned Disks. (such as "Disk Size", "Last Modified" and "Standard / Premium" Type and "Disk Space Used in GB" for Unmanaged Disks").
Ability to select the Target Azure Subscription from a list / GUI. (The subscription name can also be passed as a parameter if preferred)
Integrate checking for both Managed and Unmanaged Disks into a single script.
If Delete parameter is set to $True, display an additional User Confirmation Prompt prior to deleting Orphaned Disks. (additional script safety mechanism)

I wanted to share my PowerShell script with you, so that other customers can benefit from the additional disk information that can be exported when you audit your subscription(s) to Identify Orphaned Disks, the script can also Optionally Delete the disks that are identified; this is controlled using a script parameter that is off by default. Example screenshot of the script in action: Dependencies: The script requires: "AzureRM" Module v3.2 or above.

Install-Module AzureRM

Example Syntax to Execute the Script: Audit Mode:

.\azure-get-orphaned-disks.ps1

Audit and Optional Delete Mode: (The script still displays a yes/no prompt to confirm deletion)

.\azure-get-orphaned-disks.ps1 -DeleteUnattachedDisks $True

Excluding a Managed Disk: After reviewing the CSV Audit Report, if you would like to exclude one or more Managed Disks from being deleted, this is possible by creating a "Delete Resource Lock" on the Managed Disk(s). This might be relevant for scenarios such as Azure DevTest Labs that could have Managed Data Disks that are not currently attached to a VM. Or you might have a Disk that is required but is not always attached to a VM. To create a "Delete Resource Lock" from the Azure Portal, find the Managed Disk --> Settings --> Locks --> "Add". Give the Lock a Name and select the Lock type as "Delete", then "OK" to save. Excluding an Entire Storage Account: After reviewing the CSV Audit Report, if you would like to exclude a specific Storage Account (SA) from being processed by the script, it is possible to temporarily create a "Read Only Lock" on the individual SA. This would prevent the deletion of All Unmanaged (VHD) Disks in that SA. This can be done from the Azure Portal, find the Storage Account --> Settings --> Locks --> "Add". Give the Lock a Name and select the Lock type as "Read-only", then "OK" to save. After running the script, you could delete the Read-only Lock from the SA. Note - Please make sure you do not impact other services if you create a Read-only lock on a SA, you may need to arrange a maintenance window if applicable. Download Link: Download the PowerShell Script from the TechNet Gallery The goal and purpose of this script is to enable you to make an informed decision about an Orphaned Disk in your subscription(s) before deleting it. However, please make sure you perform enough due diligence during your audit / analysis and that you have backups in place prior to deleting any disks. Feedback: Please let me know if this PowerShell script is useful by posting a comment below. I hope you can use it to help optimise the cost of your Azure subscription(s) by deleting orphaned disks that are no longer required. View other blog posts in the Azure IaaS - Cost Optimisation Series http://aka.ms/AzureIaaSCostOptimisation Cheers Neil

Awesomeness Made Easy With PowerBI

MS Dave Coles — Tue, 12 Dec 2017 16:45:04 GMT

Hi all, My name is Dave Coles and I'm a Senior Premier Field Engineer based in the UK who specializes in SCCM and Application Virtualization. As we know, creating reports in SCCM using SSRB is a joyful experience second only to having root canal treatment at the Dentist. Therefore when I heard the phrase, "Can I create a dashboard from that….. " from customers, I hid my inner pain and smiled knowing that I was about to lose hours creating the necessary outputs. Recently, customers have been requesting a floor plan "Heat Map", I already know of a customer that uses this and can only assume word has spread. However, having worked with PowerBI a lot recently, not only can I create this fiendish dashboard easily, but I can do so with a genuine smile (for those who've known me for a few years this is no mean achievement). By following the basic information needed below; you can also achieve the same, smiling lesson excluded. Items required (links to any downloads will be provided at point of reference). 1) PowerBI , Desktop Edition is suitable. 2) Synoptic Panel Add in by OKviz for PowerBI. 3) A SVG editor, online editor available at https://synoptic.design/ for customers with internet access. 4) A Data Source. 5) A Floor Plan Image. For this example I am using a generic floor plan image obtained from Bing, which is contained within the Demo Offlice Plan Files Link below. Demo-Office-Plan.-Files Additionally, for the data source, I created a test Excel Spreadsheet containing the following fields (Note: Name is my computer name). First Step was to download and import the Synoptic Panel Add-in. Synoptic Panel Download Link I needed to map the following Computers to areas (zones) on the image that PowerBI would recognise (shown in the next step).

HR1	HR
HR2	HR
FIN1	FINANCE
FIN2	FINANCE
PERS1	PERS
PERS2	PERS
MGR1	MGMT
IT1	IT
IT2	IT
AV1	AV
AV2	AV
AV3	AV
Proj1	Projects
Proj2	Projects
Proj3	Projects
Proj4	Projects
Rec1	Reception

This is achieved by using a SVG editor to create named zones over the image, or put another way, just use the SVG editor to draw squares over each desk and make sure each square is named after the respective computer located there. Image below shows each location (desk) on the image where the corresponding area was created and named accordingly. PowerBI will use the names to map the data to the image. The completed image was then saved as an SVG to a local folder. PowerBI was opened and the Synoptic Panel imported as per the following link. How To Add a Plug in to PowerBI The Data Source was then added. Selecting the Synoptic Panel add in places the object into the workspace. Place and size according to your dashboard layout requirements. The floor plan will not be available for import until data has been assigned to the add-in. Example image below shows synoptic panel with no data assigned. From the fields section the field: Name was dragged to the corresponding Category Data Area Last AV Update to the Measure Data Area Health State to the State Measure Area Now the data has been assigned the add in shows an additional tool bar from which the floor plan is imported. From the format section of the add in Data Labels were enabled and colour states applied for the Health Check settings. The Floor Plan then reflected the current AV update Status. To demonstrate a more comprehensive dashboard, the following standard components were added. 1) A table showing last login time. 2) A Pie Chart showing Health Status. 3) A Pie Chart showing Device Guard Roll-out Status. SCCM provides a richer and more dynamic data source. Integrate this with the intuituve interface and flexibilty of PowerBI and you have the ability to create dashboards with ease. No more worries about inner or outer joins, data types or clunky interface. Awesomeness at your fingertips! So, create away …. and smile DISCLAIMER The sample files are not supported under any Microsoft standard support program or service. The sample files are provided AS IS without warranty of any kind. Microsoft further disclaims all implied warranties including, without limitation, any implied warranties of merchantability or of fitness for a particular purpose. The entire risk arising out of the use or performance of the sample files and documentation remains with you. In no event shall Microsoft, its authors, or anyone else involved in the creation, production, or delivery of the files be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, or other pecuniary loss) arising out of the use of or inability to use the sample scripts or documentation, even if Microsoft has been advised of the possibility of such damages. David Coles | Senior Premier Field Engineer | SCCM, Application Virtualisation

Azure Resource Manager (ARM) - Automate Installation of VM Extensions using PowerShell and JSON

Neil Bird [Msft] — Mon, 31 Jul 2017 14:44:44 GMT

Hello all Neil Bird here from the Cloud & Infrastructure team in the UK. I am a Premier Field Engineer (PFE) specialising in helping customers get the most out of Microsoft Azure and Windows Server technologies. One of my customers recently asked me if there was an easy way to install the BGInfo Extension on all of the Azure Resource Manager (ARM) VMs running in their Azure subscription. They had found a previous Azure Blog on VM Extensions, but this was from back in 2014 which meant the PowerShell cmdlets and example code was for Azure Service Manager (ASM), aka - "Classic VMs" and therefore is NOT valid for ARM VMs. I hope everyone is using ARM for their Azure workloads, or if not, that you have plans to migrate from ASM to ARM in the near future. If you require more information on the difference between ASM and ARM, the following article provides useful information: Azure Resource Manager vs. Classic Deployment: Understand deployment models and the state of your resources

Background:

Azure virtual machine extensions are small applications that provide post-deployment configuration and automation tasks on Azure virtual machines. For example, if a virtual machine requires software installation, anti-virus protection, or Docker configuration, a VM extension can be used to complete these tasks.

Solution:

The script framework I created and that I am sharing with you today is a PowerShell script that can be used to automate the installation of Any VM Extension. I have added lots of comments in green to make it easier to understand what actions the code is performing. I am aware that it is possible to install VM Extensions using a PowerShell "One-Liner". However, I prefer to include prerequisite checks (logic) and an output showing the overall results as part of the installation process, this is useful when processing a large number of VMs and/or multiple subscriptions. The pre-install checks ensure the VMs are in the "correct state" to install an Extension, for example: in the BGInfo Extension scenario the checks ensure the following conditions are true:

The VM has a Windows based OS installed, (OS compatibility check)
The VM is Running, required to Install Extensions
The VM does NOT already have the Extension Installed

If you use a PowerShell One-Liner to install VM Extensions, the installation could throw an error for any VM(s) that fail these tests. For example: if a VM is NOT running, it is NOT possible to install an Extension. The reason I have called the PowerShell script a "framework" is that it can be used to install any VM Extension. Although the original request was for BGInfo, I used Parameters for the "Extension Type" (i.e. Name) and "Publisher Name". This means you can easily install any other Extension using the same script, including Extensions that require additional "Settings". I will provide more information on how to specify Extension settings later in the post.

Script Prerequisites:

You need access to an Azure Subscription that has one or more ARM VMs deployed in it.
The script must be executed from a device that has Azure PowerShell Installed, i.e - the AzureRM.Compute v3.2 or above module.

Updating AzureRM Module:

# Install the Azure Resource Manager modules from the PowerShell Gallery
Install-Module AzureRM

Script Parameters:

To make the script simple to use and familiarise yourself with its use, I have left the Default Extension as BGInfo. This means if you would like to install the BGInfo Extension on the VMs running in your subscription, you only need to specify the "-SubscriptionName "" parameter (or alternatively you could edit the parameter in the Params section of the code, Line 144). This parameter is a string value that stores the name of the subscription you would like the script to process. Optionally also include the "-ProcessAllVMs" switch when executing the script. This switch instructs the script to "process ALL of the VMs in the subscription". Note - If this is NOT specified the script will only process the first 3 x VMs in the subscription. For full details of the Script Parameters, including Syntax and a few Examples, once you have downloaded the script (URL link below), open a PowerShell prompt, change directory to the location you have saved the script to and run:

get-help .\azure-install-vm-extension.ps1 -full

The "get-help -full" command will output the Script Synopsis, Description, Parameters, Examples, Links and Notes.

Download The Script:

Recommended: Download the script from The Microsoft TechNet Gallery.

Sample Script:

Without further ado, find below a sample PowerShell script that can be used to "Install an Extension on ALL Powered On, ARM VMs in a Subscription".

Important Note - The Warranty statement shown in the .NOTES section of the script is standard wording for "sample scripts". As with anything that makes changes to IT systems, it is always highly recommended to perform acceptance tests against a "non-production or test subscription" prior to implementing in a live / production subscription(s). In addition to following your organisation's Change Control / Release Management / Pipeline processes and procedures. (Of course, you already know this, but I wanted to call this out.)

Once you have downloaded the script, you can make changes or review the code in your favourite Script Editor, my "coding weapon of choice" is the awesome (and free) Visual Studio Code with the optional PowerShell Extension Installed :-) The code from the script "azure-install-vm-extension.ps1" is shown below, so you can review it whilst reading this blog (if you wish to). To skip reviewing the code / continue reading the the blog, click here.

##########################################################################################################

<#

.SYNOPSIS

Automates the installation of Extensions on VMs in an Azure Subscription.

Performs checks to ensure VM is in the correct state to install an extension.

.DESCRIPTION

Script framework to install VM Extensions on All of the VMs in a subscription.

The Extension "Type" and "Publisher" are specified as parameters.

If these parameters are NOT specified at execution, the script defaults to installing the "BGInfo" Extension on Windows VMs.

The script performs the following checks to ensure a VM is in the "correct state" to install the extension:

1) VM is Running (NOT deallocated / stopped).

2) VM is using an Operating System that is compatible with the Extension (configured as parameters).

3) VM does not currently have the extension installed.

.PARAMETER SubscriptionName

Mandatory parameter. This can be configured in the script Params section or by passing as a pipeline parameter.

The Name of the Azure Subscription you wish to process.

.PARAMETER VMExtensionName

Mandatory parameter with default of "BGInfo".

The Name (Type) of the VM Extension you wish to install.

This parameter is Case Sensitive, due to the comparison used to test if the Extension is already installed

The PowerShell code below can be used to obtain a full list of the VM Extensions that are available in an Azure region.

# Edit the $location variable with your target region

[string]$location = "uksouth"

Get-AzureRmVmImagePublisher -Location $location | `

Get-AzureRmVMExtensionImageType | `

Get-AzureRmVMExtensionImage | Select Type, PublisherName | ft *

.PARAMETER VMExtensionPublisher

Mandatory parameter with default of "Microsoft.Compute".

The Publisher of the VM Extension you wish to install.

.PARAMETER ProcessAllVMs

Include this parameter if you would like to "Process ALL VMs in the subscription".

If this parameter is NOT included the script will only process the first 3 x VMs in the subscription.

This is a safety measure to prevent unintentionally installing the Extension on ALL VMs.

.LINK

https://blogs.technet.microsoft.com/ukplatforms/2017/07/31/azure-resource-manager-arm-automate-installation-of-vm-extensions-using-powershell-and-json

.EXAMPLE

.\azure-install-vm-extension.ps1 -SubscriptionName "Visual Studio Enterprise"

Installs the default VM Extension configured in the script parameters (BGInfo) on first 3 x Windows VMs in the "Visual Studio Enterprise" subscription.

.EXAMPLE

.\azure-install-vm-extension.ps1 -SubscriptionName "Visual Studio Enterprise" -ProcessAllVMs

Installs the default VM Extension configured in the script parameters (BGInfo) on ALL of the Windows VMs in the "Visual Studio Enterprise" subscription.

.EXAMPLE

.\azure-install-vm-extension.ps1 -SubscriptionName "Visual Studio Enterprise" `

-VMExtensionName "IaaSAntimalware" `

-VMExtensionPublisher "Microsoft.Azure.Security" `

-VMExtensionWindowsCompatible $true `

-VMExtensionLinuxCompatible $false `

-VMExtensionSettingsFilePath "C:\scripts\IaaSAntimalware-Config.json" `

-ProcessAllVMs

Installs the "IaaSAntimalware" VM Extension on ALL of the Windows VMs in the "Visual Studio Enterprise" subscription.

Configures the "IaaSAntimalware" Extension settings using the configuration in the "C:\scripts\IaaSAntimalware-Config.json" file.

Example JSON Schema for "Microsoft Antimalware" Extension, "C:\scripts\IaaSAntimalware-Config.json" file:

{

"AntimalwareEnabled": true,

"RealtimeProtectionEnabled": true,

"ScheduledScanSettings": {

"isEnabled": true,

"day": "7",

"time": "120",

"scanType": "Quick"

},

"Exclusions": {

"Extensions": "",

"Paths": "%windir%\\SoftwareDistribution\\Datastore\\DataStore.edb;%windir%\\SoftwareDistribution\\Datastore\\Logs\\Edb.chk",

"Processes": ""

}

For full details on how to configure the "Microsoft Antimalware Extension" settings including file exclusions, see the following article:

"Microsoft Antimalware for Azure Cloud Services and Virtual Machines"

(https://docs.microsoft.com/enus/azure/security/azure-security-antimalware)

.NOTES

THIS CODE-SAMPLE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED

OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR

FITNESS FOR A PARTICULAR PURPOSE.

This sample is not supported under any Microsoft standard support program or service.

The script is provided AS IS without warranty of any kind. Microsoft further disclaims all

implied warranties including, without limitation, any implied warranties of merchantability

or of fitness for a particular purpose. The entire risk arising out of the use or performance

of the sample and documentation remains with you. In no event shall Microsoft, its authors,

or anyone else involved in the creation, production, or delivery of the script be liable for

any damages whatsoever (including, without limitation, damages for loss of business profits,

business interruption, loss of business information, or other pecuniary loss) arising out of

the use of or inability to use the sample or documentation, even if Microsoft has been advised

of the possibility of such damages, rising out of the use of or inability to use the sample script,

even if Microsoft has been advised of the possibility of such damages.

#>

##########################################################################################################

###############################

## SCRIPT OPTIONS & PARAMETERS

###############################

#Requires -Version 3

#Requires -Modules AzureRM

# Version: 1.1

<# - 28/07/2017

* added progress bar and confirmation prompt.

* added "-ProcessAllVMs" switch, without this script only processes 3 x VMs by default.

* added parameter to specify a "SettingString" configuration file for Extension settings.

* added counters to provide an "installation results" report when the script completes.

- 14/07/2017

* initial script creation.

#>

# Define and validate mandatory parameters

[CmdletBinding()]

Param(

# Azure Subscription Name

[parameter(Position=1)]

[string]$SubscriptionName = "SUBSCRIPTION NAME",

# ***** EDIT ABOVE WITH YOUR SUBSCRIPTION NAME, OR PASS AS SCRIPT PARAMETER *****

# VM Extension Name (Case sensitive for "Extensions.id.Contains" comparison)

[parameter(Position=2)]

[string]$VMExtensionName = "BGInfo",

# VM Extension Publisher

[parameter(Position=3)]

[string]$VMExtensionPublisher = "Microsoft.Compute",

# VM Extension Windows OS Compatible

[parameter(Position=4)]

[bool]$VMExtensionWindowsCompatible = $true,

# VM Extension Linux OS Compatible

[parameter(Position=5)]

[bool]$VMExtensionLinuxCompatible = $false,

# VM Extension JSON Settings File Path

[parameter(Position=6)]

[string]$VMExtensionSettingsFilePath = "",

# Process All VMs in Subscription Switch, if not present script only processes first 3 VMs

[parameter(Position=7)]

[switch]$ProcessAllVMs

)

# Set strict mode to identify typographical errors

Set-StrictMode -Version Latest

# Make the script verbose by default

$VerbosePreference = "Continue"

##########################################################################################################

#####################################

## FUNCTION 1 - Install-VMExtension

#####################################

Function Install-VMExtension {

# Connect to Azure

Write-Host "`nPrompting for Azure Credentials and Authenticating..."

# Login to Azure Resource Manager (ARM), if this fails, stop script.

Login-AzureRmAccount -SubscriptionName $SubscriptionName -ErrorAction Stop

# Get all ARM VMs in Subscription

[array]$VMs = Get-AzureRMVM -Status -ErrorAction Stop

# Counter for Progress bar and $ProcessAllVMs switch

$VMsProcessed = 0

# Loop through all VMs in the Subscription

ForEach ($VM in $VMs) {

# Check if the ProcessAllVMs switch has NOT been set

if(!$ProcessAllVMs.IsPresent) {

# We are NOT Processing All VMs (switch NOT present), stop after first 3 x VMs

if($VMsProcessed -eq 3) {

# Write informational message about use of the -ProcessAllVMs switch

Write-Host "`nINFO: Script Stopping."

 Write-Host 'INFO: To process more than the first 3 x VMs in a subscription, Set the -ProcessAllVMs parameter when executing the script.'

# Break out of the ForEach Loop to stop processing

Break

}

# Show the Progress bar for number of VMs Processed...

$VMsProcessed++

Write-Progress -Activity "Processing VMs in ""$($SubscriptionName)>""..." `

-Status "Processed: $VMsProcessed of $($VMs.count)" `

-PercentComplete (($VMsProcessed / $VMs.Count)*100)

# Ensure the VM OS is Compatible with Extension

if(($VM.OSProfile.WindowsConfiguration -and $VMExtensionWindowsCompatible) `

-or ($VM.OSProfile.LinuxConfiguration -and $VMExtensionLinuxCompatible)) {

# Ensure the Extension is NOT already installed

if(($VM.Extensions.count -eq 0) -or (!(Split-Path -Leaf $VM.Extensions.id).Contains($VMExtensionName))) {

# If VM is Running

if($VM.PowerState -eq 'VM running') {

# Output the VM Name

Write-Host "$($VM.Name): requires $($VMExtensionName), installing..."

# Get the latest version of the Extension in the VM's Location:

[version]$ExtensionVersion = (Get-AzureRmVMExtensionImage -Location $VM.Location `

-PublisherName $VMExtensionPublisher -Type $VMExtensionName).Version `

| ForEach-Object { New-Object System.Version ($PSItem)} | `

Sort-Object -Descending | Select-Object -First 1

[string]$ExtensionVersionMajorMinor = "{0}.{1}" -F $ExtensionVersion.Major,$ExtensionVersion.Minor

# If the $VMExtensionSettingFilePath parameter has been specified and the file exists

if(($VMExtensionSettingsFilePath -ne "") -and (Test-Path $VMExtensionSettingsFilePath)) {

# Import Extension Config File

$VMExtensionConfigfile = Get-Content $VMExtensionSettingsFilePath -Raw

# Install the Extension with SettingString parameter

$ExtensionInstallResult = Set-AzureRmVMExtension -ExtensionName $VMExtensionName `

-Publisher $VMExtensionPublisher -TypeHandlerVersion $ExtensionVersionMajorMinor -ExtensionType $VMExtensionName `

-Location $VM.Location -ResourceGroupName $VM.ResourceGroupName `

-SettingString $VMExtensionConfigfile -VMName $VM.Name

} else { # $VMExtensionSettingFilePath does NOT exist

# Install the Extension WITHOUT SettingString parameter

$ExtensionInstallResult = Set-AzureRmVMExtension -ExtensionName $VMExtensionName `

-Publisher $VMExtensionPublisher -TypeHandlerVersion $ExtensionVersionMajorMinor -ExtensionType $VMExtensionName `

-Location $VM.Location -ResourceGroupName $VM.ResourceGroupName `

-VMName $VM.Name

} # Install Extension with SettingString parameter if file specified and exists

# Installation finished, check the return status code

if($ExtensionInstallResult.IsSuccessStatusCode -eq $true) {

# Installation Succeeded

Write-Host "SUCCESS: " -ForegroundColor Green -nonewline; `

Write-Host "$($VM.Name): Extension installed successfully"

$Global:SuccessCount++

} else {

# Installation Failed

Write-Host "ERROR: " -ForegroundColor Red -nonewline; `

Write-Host "$($VM.Name): Failed - Status Code: $($ExtensionInstallResult.StatusCode)"

$Global:FailedCount++

}

} else {

# VM is NOT Running

Write-Host "WARN: " -ForegroundColor Yellow -nonewline; `

Write-Host "$($VM.Name): Unable to install $($VMExtensionName) - VM is NOT Running"

$Global:VMsNotRunningCount++

# Could use "Start-AzureRmVM -ResourceGroupName $vm.ResourceGroupName -Name $VM.Name",

# wait for VM to start and Install extension, possible improvement for future version.

}

} else {

# VM already has the Extension installed.

Write-Host "INFO: $($VM.Name): Already has the $($VMExtensionName) Extension Installed"

$Global:AlreadyInstalledCount++

}

# Extension NOT Compatible with VM OS, as defined in Script Parameters boolean values

} else {

# Linux

if($VM.OSProfile.LinuxConfiguration -and (!$VMExtensionLinuxCompatible)) {

# VM is running Linux distro and $VMExtensionLinuxCompatible = $false

Write-Host "INFO: $($VM.Name): Is running a Linux OS, extension $($VMExtensionName) is not compatible, skipping..."

$Global:OSNotCompatibleCount++

# Windows

} elseif ($VM.OSProfile.WindowsConfiguration -and (!$VMExtensionWindowsCompatible)) {

# VM is running Windows $VMExtensionWindowsCompatible = $false

Write-Host "INFO: $($VM.Name): Is running a Windows OS, extension $($VMExtensionName) is not compatible, skipping..."

$Global:OSNotCompatibleCount++

# Error VM does NOT have a Windows or Linux Configuration

} else {

# Unexpected condition, VM does not have a Windows or Linux Configuration

Write-Host "ERROR: " -ForegroundColor Red -nonewline; `

Write-Host "$($VM.Name): Does NOT have a Windows or Linux OSProfile!?"

} # Extension OS Compatibility

} # ForEach VM Loop

} # end of Function Install-VMExtension

# Setup counters for Extension installation results

[double]$Global:SuccessCount = 0

[double]$Global:FailedCount = 0

[double]$Global:AlreadyInstalledCount = 0

[double]$Global:VMsNotRunningCount = 0

[double]$Global:OSNotCompatibleCount = 0

[string]$DateTimeNow = get-date -Format "dd/MM/yyyy - HH:mm:ss"

Write-Host "`n========================================================================`n"

Write-Host "$($DateTimeNow) - Install VM Extension Script Starting...`n"

Write-Host "========================================================================`n"

# Prompt for confirmation...

if($ProcessAllVMs.IsPresent) {

[string]$VMTargetCount = "ALL of the"

} else {

[string]$VMTargetCount = "the first 3 x"

}

# User prompt confirmation before processing

[string]$UserPromptMessage  = "Do you want to install the ""$($VMExtensionName)"" Extension on $($VMTargetCount) VMs in the ""$($SubscriptionName)"" Subscription?"

if(!$ProcessAllVMs.IsPresent) {

$UserPromptMessage = $UserPromptMessage + "`n`nNote: use the ""-ProcessAllVMs"" switch to install the Extension on ALL VMs."

}

$UserPromptMessage = $UserPromptMessage + "`n`nType ""yes"" to confirm....`n`n`t"

[string]$UserConfirmation = Read-Host -Prompt $UserPromptMessage

if($UserConfirmation.ToLower() -ne 'yes') {

# Abort script, user reponse was NOT "yes"

Write-Host "`nUser typed ""$($UserConfirmation)"", Aborting script...`n`n" -ForegroundColor Red

Exit

} else {

# Continue, user responded "yes" to confirm

Write-Host "`nUser typed 'yes' to confirm...." -ForegroundColor Green

Write-Host "Processing...`n"

# Call Function to Install Extension on VMs

Install-VMExtension

}

# Add up all of the counters

[double]$TotalVMsProcessed = $Global:SuccessCount + $Global:FailedCount + $Global:AlreadyInstalledCount `

+ $Global:VMsNotRunningCount + $Global:OSNotCompatibleCount

# Output Extension Installation Results

Write-Host "`n"

Write-Host "========================================================================"

Write-Host "`tExtension $($VMExtensionName) - Installation Results`n"

Write-Host "Installation Successful:`t`t$($Global:SuccessCount)"

Write-Host "Already Installed:`t`t`t$($Global:AlreadyInstalledCount)"

Write-Host "Installation Failed:`t`t`t$($Global:FailedCount)"

Write-Host "VMs Not Running:`t`t`t$($Global:VMsNotRunningCount)"

Write-Host "Extension Not Compatible with OS:`t$($Global:OSNotCompatibleCount)`n"

Write-Host "Total VMs Processed:`t`t`t$($TotalVMsProcessed)"

Write-Host "========================================================================`n`n"

[string]$DateTimeNow = get-date -Format "dd/MM/yyyy - HH:mm:ss"

Write-Host "`n========================================================================`n"

Write-Host "$($DateTimeNow) - Install VM Extension Script Complete.`n"

Write-Host "========================================================================`n"

Executing the Script:

Download the script from the TechNet Gallery. Open a PowerShell prompt, change directory into the same location where you downloaded / saved the script to and type:

.\azure-install-vm-extension.ps1 -SubscriptionName "Name of your subscription"

If you wish to install the Extension (script defaults to BGInfo) on All VMs in the Subscription, add the parameter: -ProcessAllVMs

Script Output:

Example output from the PowerShell script is shown in the screenshot below. The script displays a "Progress Bar" that calculates the Percentage Complete based on number of VMs in the subscription. It also shows the Name of the VM that is currently being processed and finally once complete it provides Individual Counters and a Total for the number of Extension Installations:

What about installing VM Extensions other than BGInfo?

As described earlier, the script can be used to install any VM Extension, as the "Extension Name" (Type) and "PublisherName" are both parameters. To obtain a full list of the VM Extensions that are available in a particular region you can use the PowerShell code below. This example returns the "Type" (Name) and "PublisherName" for All VM Extensions in the UK South region:

# Edit below location variable with your target region

[string]$location = "uksouth"

Get-AzureRmVmImagePublisher -Location $location | `

Get-AzureRmVMExtensionImageType | `

Get-AzureRmVMExtensionImage | Select Type, PublisherName | ft *

Another common requirement and highly recommended practice is to install Anitmalware on all VMs, this could be Microsoft's Antimalware Extension or an alternative offered by one of our partners. To use the sample script above to install the Microsoft Antimalware Extension all you would need to do is set the two parameters below:

-VMExtensionName = "IaaSAntimalware"

-VMExtensionPublisher = "Microsoft.Azure.Security"

Additional Info: If you plan to install the Microsoft Antimalware Extension, you may also want to consider configuring "File Path, Process Name or File Extension Exclusions for the Real Time Scanner". As you know, file system exclusions vary depending on the specific workload deployed on a VM, however Microsoft provides a list of recommendations which are documented here: Virus scanning recommendations for Enterprise computers that are running currently supported versions of Windows To configure Exclusions for the "Real Time Scanner" component of the Microsoft Antimalware VM Extension, you need to either create a PowerShell hash table storing the properties or alternatively use a simple ARM JSON Template, my preference is a JSON file and an example is shown below: Save this file as "IaaSAntimalware-Config.json" after adding your required exclusions in the relevant sections.

{

"AntimalwareEnabled": true,

"RealtimeProtectionEnabled": true,

"ScheduledScanSettings": {

"isEnabled": true,

"day": "7",

"time": "120",

"scanType": "Quick"

},

"Exclusions": {

"Extensions": "",

"Paths": "",

"Processes": ""

}

To define Exclusions in the "Extensions", "Paths" and "Processes" sections of the JSON file, the syntax is a "List of Semi-Colon Delimited Values". "Paths" also require an escape character for the backslash (i.e - double backslashes). For example:

"Paths": "%windir%\\SoftwareDistribution\\Datastore\\DataStore.edb;%windir%\\SoftwareDistribution\\Datastore\\Logs\\Edb.chk",

For full details on how to configure Antimalware Settings such as Exclusions, see Microsoft Antimalware for Azure Cloud Services and Virtual Machines. Now that you have created your "Default File Exclusions Configuration File" saved in JSON format, we can use the -VMExtensionSettingsFilePath parameter to pass the File Path of the JSON file to the script. An example PowerShell command line to install the Microsoft Antimalware Extension is shown below:

.\azure-install-vm-extension.ps1 -SubscriptionName "Visual Studio Enterprise" -VMExtensionName "IaaSAntimalware" -VMExtensionPublisher "Microsoft.Azure.Security" -VMExtensionWindowsCompatible $true -VMExtensionLinuxCompatible $false -VMExtensionSettingsFilePath "C:\scripts\IaaSAntimalware-Config.json" -ProcessAllVMs

The example above could be used to "Automate the installation of the Microsoft Antimalware Extension on All Windows VMs running in a Subscription."

I am sharing this sample script as I believe it will be useful to other customers who have a requirement to automate the installation of VM Extensions across their Azure IaaS environments. However.......

Important: As mentioned earlier regarding Warranty of sample scripts. Please ensure that you Test Automation Scripts against a "Test / Dev Subscription" or against a "Subset of VMs" prior to implementing against your Production Subscription(s). You are responsible for testing and validating the desired outcomes are achieved by the code you execute.

Possible Future Improvements:

Make use of PowerShell Jobs to process multiple VM Extension installations concurrently.
Add an option to turn on VM's that are not running, install the extension, then turn them off again.
Update script to work with Azure Automation.
Add code to allow a -Whatif parameter, to report on what the script "would do", useful for Change Control documentation.
...The list is endless, but I hope to find time to add some of these soon.... :-)

If you find this sample script useful, please add a comment or suggestion below.

This is useful for existing VMs, but what about new VM deployments?

Ok, yes yes, this is only half of the story! The sample script above is great for installing Extensions on existing VMs that have already been deployed into a subscription. However as we continue to transition into an "Infrastructure as Code" (JSON Templates) and "Configuration as Code" (DSC) world, the recommended approach is to provision (deploy) your VMs with the required Extensions (and Configuration) automatically installed. This can be achieved by leveraging the declarative programming model offered by ARM JSON Templates. In its simplest form, adding the code below to an existing JSON would automatically install the BGInfo Extension on a VM when it is deployed:

{

"type": "Microsoft.Compute/virtualMachines/extensions", "name": "BGInfo", "apiVersion": "2016-04-30-preview", "scale": null, "location": "[resourceGroup().location]", "properties": {

"publisher": "Microsoft.Compute", "type": "BGInfo", "typeHandlerVersion": "2.1", "autoUpgradeMinorVersion": true

}

The "Name" property can be customised if you want to include the VM Name, but this is optional. And you would also require a "dependsOn" property specifying "[resourceId('Microsoft.Compute/virtualMachines', parameters('virtualMachineName'))]" or similar, depending on the parameter name you use for the VMs Name. There are lots of other useful examples on the Azure Windows VM Extension Configuration Samples page that provide details of how to automatically install Extensions as part of your VM deployments. Using JSON based templates allows you to make further use of parameters.json files to store all of the settings (such as Antimalware Exclusions for specific roles) along with the code that deploys and configures the VM.

And finally, there are hundreds of Azure Quickstart Templates resources available in the gallery. These provide JSON Template examples for tasks such as how to "Join a VM to an existing AD Domain", through to deploying "Storage Spaces Direct (S2D)" or even deploying an entire "RDS Farm" automatically.

I hope you found this blog post useful.

Cheers Neil