Azure Server management tools is currently in preview. Any data collected by Server management tools will be stored in the US.!
As this is a preview you can play with this and it is Cool a nice web management. With the Management server you can manage your on premise AzureStack or Deploy a Template with SCVMM. or just turnoff al your domain controllers. Oh ok I must re-think my security Policy.
As many Azure is External in some cases it is handled just like a server in a DMZ site. So “real dangerous” this is the Cloud directly connected to the WEB.
This DMZ is now turned and be able to manage your internal servers, what is some one has my azure account that has this gateway…. Well I think this is a cool new feature with a lot of new options. In fact I created a cluster in the Azure GUI but it is running on premises.
Server management tools enables you to remotely manage machines running Windows Server 2016 Technical Preview. Currently, the tools offer the following capabilities:
- View and change system configuration
- View performance across various resources and manage processes and services
- Manage devices attached to the server
- View event logs
- View the list of installed roles and features
- Use a PowerShell console to manage and automate
The Server management tools connection is routed through a Server management tools gateway. When you create a new connection, you will have the opportunity to create a new gateway or select an existing gateway if one already exists in the same resource group. Click on Create to establish a connection to your Windows Server 2016 Technical Preview machine and start exploring the features available today.
Open your Azure management portal and search : Server management tools in the marketplace
Select the Server management tools and a new window opens with the network layout on how things are connected.
So Hit Create
The Create option opens a new menu with all kinds of options Name Subscription , Resourcegroup.
As this is my first server I create it all Fresh so no connections to other Resource Groups
Configuring a new Server management tools Gateway
If you are creating a new gateway, you will see the following status:
Click to open the Gateway Configuration page and read carefully and follow the directions to set up your on-premises machine or Azure VM as the gateway.
An Server management tools gateway is required to enable communication between the Microsoft Azure portal and your Windows Server 2016 machine. A gateway is typically deployed and configured on the same local network as the Windows Server machine(s) you wish to manage. The customized gateway deployment package below allows you to install the gateway software on a machine of your choice, and automatically configures the gateway profile to register with your Azure subscription. The deployment package must be run locally on the machine that you want to designate as the Server management tools gateway.
Steps to configure your gateway
Save the File on your Windows Server 2016
Use the generated link to download the gateway deployment package now, or copy the link URL to download the package later from the machine on which you intend to install the package.
-
From the machine that you want to designate as the gateway, unzip the package and run GatewayService.MSI.
-
Once the gateway installation completes, return to the Microsoft Azure portal and reopen your Server management tools connection.
-
You should now be able to manage your Windows Server 2016 machine if the Microsoft Azure portal can reach it through the gateway.
The Extracted File is the installation file with the JSON config file.
A quick setup is needed on the Windows Server 2016.
As you can see there is an extra Services running on the Windows Server 2016
When I do a Refresh in the Azure Resource Group.
The manage as command is there just go to the Manage As and fill in the server admin account to manage this server
Fill in the account I us a Local Account as in this scenario I’ll not jumping thru my domain.
You have established a remote connection to your resource and are now able to perform management tasks on it through the Azure Portal.
Some errors here with no surprise My local Firewall and Remote management WINRM is not configured as the text below described.
Unable to connect to the server ‘mvpmgt01’: WinRM cannot process the request. The following error with errorcode 0x80090311 occurred while using Kerberos authentication: There are currently no logon servers available to service the logon request. Possible causes are: -The user name or password specified are invalid. -Kerberos is used when no authentication method and no user name are specified. -Kerberos accepts domain user names, but not local user names. -The Service Principal Name (SPN) for the remote computer name and port does not exist. -The client and remote computers are in different domains and there is no trust between the two domains. After checking for the above issues, try the following: -Check the Event Viewer for events related to authentication. -Change the authentication method; add the destination computer to the WinRM TrustedHosts configuration setting or use HTTPS transport. Note that computers in the TrustedHosts list might not be authenticated. -For more information about WinRM configuration, run the following command: winrm help config.
Managing Workgroup machines
In order to manage workgroup machines (e.g. non-domain-joined Nano Servers), run this command as an administrator on the Server management tools gateway machine:
This setting is different than in the guide in Azure
winrm set winrm/config/client’@{TrustedHosts="< NAME OR IP >"}’
When creating a Server management tools connection to the workgroup machine, use the machine’s IP address as the computer name.
Additional connectivity requirements
If you wish to connect using the local Administrator account, you will need to enable this policy on the target machine by running the following command in an administrator session on the target machine:
REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1
If you wish to connect to a workgroup machine which is not on the same subnet as the gateway, run the following command in an administrator session on the target machine:
NETSH advfirewall firewall add rule name="WinRM 5985" protocol=TCP dir=in localport=5985 action=allow
Now it is play time
As you can see you can manage the local server, there are more options like powershell and event viewer but this is not easy to use in the web-GUI
Happy Stacking
Robert Smit
Twitter: @clustermvp
Cloud and Datacenter MVP
Robert Smit MVP Blog 