Author Archive

Windows 10 version 1903 May update prepair Windows Update Delivery Optimization #Windows10 #ConfigMgr #DO #DeliveryOptimization #Waas #WUDO   Leave a comment

With the up coming Windows 10 1903 version you better be prepared, and save some bandwidth by setting up the right settings like Delivery Optimization. https://blogs.windows.com/windowsexperience/2019/04/08/releasing-the-may-2019-update-to-the-release-preview-ring/#XSwellpKSbo6oeum.97

What is Delivery Optimization ?

Windows Update Delivery Optimization helps you get Windows updates and Microsoft Store apps more quickly and reliably.

In many business networks, downloading apps and updates can be slow, inefficient, and, in many markets, expensive. When speaking with our customers, we often hear that they have regional facilities in limited and/or metered markets where devices download the same content, redundantly impacting coveted bandwidth and, ultimately, the organization’s financial bottom line. In almost any network, Delivery Optimization can be a highly effective tool, efficiently delivering content to devices and reducing the need for more internet bandwidth.

Delivery Optimization for Windows 10

Windows Update Delivery Optimization works by letting you get Windows updates and Microsoft Store apps from sources in addition to Microsoft, like other PCs on your local network, or PCs on the Internet that are downloading the same files. Delivery Optimization also sends updates and apps from your PC to other PCs on your local network or PCs on the Internet, based on your settings. Sharing this data between PCs helps reduce the Internet bandwidth that’s needed to keep more than one device up to date or can make downloads more successful if you have a limited or unreliable Internet connection.

When Windows downloads an update or app using Delivery Optimization, it will look for other PCs on your local network (or from the Internet, depending on your settings) that have already downloaded that update or app. Windows doesn’t download the entire file from one place. Instead, the download is broken down into smaller parts. Windows then gets parts of the update or app from the PCs that have it, and parts from Microsoft. Windows uses the fastest, most reliable download source for each part.

Delivery Optimization creates a local cache, and stores files that it has downloaded in that cache for a short period of time.

you can turn this on in the update settings of Windows 10

Delivery Optimization for Windows 10

But there is also a GPO control that can be used. But you need the latest ADMX files in your PolicyDefinitions folder. If you are uncertain if you have the latest file check here to get the files

Administrative Templates (.admx) for Windows 10 October 2018 Update (1809)

https://www.microsoft.com/en-us/download/details.aspx?id=57576

Delivery Optimization for Windows 10Delivery Optimization for Windows 10

With this GPO setting you can control the settings for Delivery Optimization

Delivery Optimization for Windows 10Delivery Optimization for Windows 10

All these settings depends on your need and how your network is configured.

You can also use Delivery Optimization with SCCM. Microsoft recommends that you optimize Windows 10 quality update delivery using Configuration Manager with express installation files and a peer caching technology

image

the SCCM client settings

Delivery Optimization for Windows 10

above a good overview on the difference between the different caching options.

To get some details on the caching there are some history charts and activity charts. these are depending on the system.

Delivery Optimization for Windows 10image

In this case these are just my lab machines so no big improvements here, and the machines are redeployed etc so for graphs not the best show models.

Delivery Optimization for Windows 10Delivery Optimization for Windows 10

other adjustments can be made on cache settings or bandwidth, 

Get-DeliveryOptimizationStatus

Delivery Optimization for Windows 10

Get-DeliveryOptimizationPerfsnap
Get-DeliveryOptimizationPerfsnapThisMonth

Delivery Optimization for Windows 10

Recommended Setting for Delivery Optimization  Quick-reference table   

Quick-reference table:

Use case Policy Recommended value Reason
Hub & spoke topology Download mode 1 or 2 Automatic grouping of peers to match your topology
Sites with > 30 devices Minimum file size to cache 10 MB (or 1 MB) Leverage peers-to-peer capability in more downloads
Large number of mobile devices Allow uploads on battery power 60% Increase # of devices that can upload while limiting battery drain
Labs with AC-powered devices Content Expiration 7 (up to 30) days Leverage devices that can upload more for a longer period


 

More info about Delivery-Optimization can be found here : https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Delivery-Optimization-Scenarios-and-configuration-options/ba-p/280195

 

 

Follow Me on Twitter @ClusterMVP

Follow My blog https://robertsmit.wordpress.com

Linkedin Profile Robert Smit MVP Linkedin profile

Google  : Robert Smit MVP profile

Posted April 12, 2019 by Robert Smit [MVP] in Windows Server 2019

Tagged with

First look on the new Azure Sentinel cloud-native with Azure Notebooks free service #Jupyter #SIEM #SIEMaaS #Azure #Sentinel   2 comments

Azure Sentinel is Microsoft’s cloud-native SIEM that provides intelligent security analytics for your entire enterprise at cloud scale.
This SIEM as a Service (SIEMaaS) solution is designed as a cloud-based security-monitoring platform that leverages the power of the cloud for analytics and detections.

https://azure.microsoft.com/en-us/services/azure-sentinel/

there is a good video  https://www.youtube.com/watch?v=XXZp6LQZSJU&feature=youtu.be 

Limitless cloud speed and scale
Azure Sentinel is the first SIEM built into a public cloud platform to help your security analysts focus on what really matters.

Easily connect your data sources
Azure Sentinel provides simple and easy integration with signals and intelligence from security solutions whether they are on premises, in Azure, or in other clouds.
Azure Sentinel provides seamless integration with Microsoft 365, Azure, and other Microsoft products, including Microsoft’s security products.

Detect suspicious activities in your organization
Azure Sentinel fuses together unique machine learning algorithms, world-class security research, and the breadth and depth of the critical security data available to Microsoft as a major enterprise vendor. Azure Sentinel helps you detect both known and unknown attack vectors, detecting threats across all stages of the kill chain.

Investigate and remediate breaches
Azure Sentinel gives you visibility into all the entities involved in an alert and provides a simple and instinctive UI to investigate the detection, helping you easily understand the scope of the breach.
To cut down on the volume of alerts you get, Azure Sentinel automatically investigates alerts to help you determine what action to take, enabling you to move from alert to remediation in minutes, at scale.
Leveraging the power of Logic Apps, Azure Sentinel helps you respond to incidents instantly, using built-in orchestration and automation playbooks.

Joining the Preview program give you the enable option and you will need some configuration in the Azure portal. Overall a great overview in the new dash boarding. one thing is I need more screens to show all this.

Azure Sentinel cloud-native Azure Notebooks  Azure Sentinel cloud-native Azure Notebooks

You will need a workspace I you have already one you can use this or just create a new one

Azure Sentinel cloud-native Azure Notebooks

I’ll pick my current one as all my VM’s are reporting into this.

Azure Sentinel cloud-native Azure Notebooks  

Now we can install the add-on for data collection, there is already a big list.

Azure Sentinel cloud-native Azure Notebooks

As I already had a workspace there is already some content to use, at this point I don’t have any incidents, so no cases and alerts

Azure Sentinel cloud-native Azure Notebooks

I think this is a grate feature the “hunting” predefined query’s ready to run and adjustable to your need.

Azure Sentinel cloud-native Azure Notebooks

Reuse the custom query, for better adjustment in your site.

Azure Sentinel cloud-native Azure Notebooks

You can find more samples on github https://github.com/Azure/Azure-Sentinel

Azure Sentinel cloud-native Azure Notebooks

Also the Azure Notebooks for Azure Sentinel is a new option, create your Project in Jupyter

 

image

Azure Notebooks for Azure Sentinel

What is Azure Notebooks?

Azure Notebooks is a free hosted service to develop and run Jupyter notebooks in the cloud with no installation. Jupyter is an open source project that lets you easily combine markdown text, executable code (Python, R, and F#), persistent data, graphics, and visualizations onto a single, sharable canvas called a notebook.

How do Azure Notebooks work?

Interactive Azure Notebooks provides security insights and actions to investigate anomalies and hunt for malicious behaviors. Each Azure Notebook is purpose-built with a self-contained workflow for a specific use case. Visualizations are included in each Azure Notebook for faster data exploration and threat hunting. Click on the button below to clone our prebuilt investigation and hunting Azure Notebooks into projects that belong to you. Modify and tailor your projects to your environment. Either run the Azure Notebooks for free or, for better performance, run them on a dedicated virtual host. Click here to learn more.

Using the Notebooks locally or in other environments

Azure Sentinel will provision notebooks and supporting modules for you in Azure Notebooks. You can also download the notebooks and modules and use them locally in a supported Python environment (Anaconda is recommended) or another notebook hosting environment such as Azure Databricks or a JupyterHub environment that supports Python 3.6 or later.

 

image 

With the import a copy will be made from the Github to your own repository to get you started.

image 

this take some time after this the project page is opening for you.

image

You can check the samples and adjust them for your needs

image 

Checking the Logs in the Azure Sentinel will give you a nice dashboard with all the content. I have limited amount of data in this so no big lines or exceptions.

image

A Sample dashboard with the infrastructure query in Azure Sentinel

A Sample dashboard with the infrastructure query in Azure Sentinel

A Sample dashboard with the infrastructure query in Azure Sentinel

A Sample dashboard with the infrastructure query in Azure Sentinel

A Sample dashboard with the general overview query in Azure Sentinel

A Sample dashboard with the infrastructure query in Azure Sentinel

Some are based on multiple pages, big screens are needed or smaller fonts but overall this is a nice addition to the Azure Family.

A Sample dashboard with the infrastructure query in Azure Sentinel

Azure Sentinel will take some time to get this running and configuring but once there is data you will see a very nice new tool that can help you to solve your problems in Azure better an quickly.

See and stop threats before they cause harm, with SIEM reinvented for a modern world. Azure Sentinel is your birds-eye view across the enterprise. Put the cloud and large-scale intelligence from decades of Microsoft security experience to work. Make your threat detection and response smarter and faster with artificial intelligence (AI). Eliminate security infrastructure setup and maintenance, and elastically scale to meet your security needs—while reducing IT costs.

 

Follow Me on Twitter @ClusterMVP

Follow My blog https://robertsmit.wordpress.com

Linkedin Profile Robert Smit MVP Linkedin profile

Google  : Robert Smit MVP profile

Posted February 28, 2019 by Robert Smit [MVP] in Azure

Tagged with ,

Secure DevOps Kit for Azure (AzSK) With Security Monitoring #Devops #Azure #AzSK #Security #LogAnalytics #PowerShell   Leave a comment

The Secure DevOps Kit for Azure is a collection of scripts, tools, extensions, automations.

image

The kit is based on Powershell and can be extended to Azure log analytics with some nice dashboarding. But if you have a large subscription the Powershell query can take some time. With this toolkit Devops teams using extensive automation and smoothly integrating security into native Devops workflows helping accomplish secure Devops with these 6 focus areas:

  • Secure the subscription: A secure cloud subscription provides a core foundation upon which subsequent development and deployment activities can be conducted. An engineering team should have the capabilities to deploy and configure security in the subscription including elements such as alerts, ARM policies, RBAC, Security Center policies, JEA, Resource Locks, etc. Likewise, it should be possible to check that all settings are in conformance to a secure baseline
  • Enable secure development: During the coding and early development stages, developers should have the ability to write secure code and to test the secure configuration of their cloud applications. Just like build verification tests (BVTs), we introduce the concept of security verification tests (SVTs) which can check for security of various resource types in Azure
  • Integrate security into CICD: Test automation is a core tenet of devops. We emphasize this by providing the ability to run SVTs as part of the VSTS CICD pipeline. These SVTs can be used to ensure that the target subscription used to deploy a cloud application and the Azure resources the application is built upon are all setup in a secure manner
  • Continuous Assurance: In the constantly changing dev ops environment, it is important to move away from the mindset of security being a milestone. We have to treat security as a continuously varying state of a system. This is made possible through capabilities that enable continuous assurance using a combination of automation runbooks, schedules, etc.
  • Alerting & Monitoring: Visibility of security status is important for individual application teams and also for central enterprise teams. We provide solutions that cater to the needs of both. Moreover, the solution spans across all stages of dev ops in effect bridging the gap between the dev team and the ops team from a security standpoint through the single, integrated views it generates
  • Cloud Risk Governance: Lastly, underlying all activities in the kit is a telemetry framework that generates events capturing usage, adoption, evaluation results, etc. This allows us to make measured improvements to security targeting areas of high risk and maximum usage before others.

Keep in mind that The OMS portal will is retired on January 15, 2019. You can continue to use your existing services and licensing in the Azure portal.

Even in the Azure portal you can still connect to OMS

Complete feature set of Secure DevOps Kit for Azure

Feature Area Secure DevOps Kit Feature
Secure the subscription
  • Subscription Health Check
  • Subscription Provisioning
    • Alerts Configuration
    • ARM Policy Configuration
    • Azure Security Center Configuration
    • Access control (IAM) Hygiene
Enable secure development
  • Security Verification Tests (SVT)
  • Security IntelliSense- VS Extension
Integrate security into CICD
  • AzSK VS Extension-executes SVTs in a CICD pipeline
Continuous Assurance
  • Security scanning via Azure Automation Runbooks
Alerting & Monitoring
  • OMS Solution for AzSK containing:
    • Security dashboard views covering security state/actions
    • Alerts with pertinent search queries
Cloud Risk Governance
  • Control/usage telemetry through Insights

Setting up Secure DevOps Kit for Azure (AzSK)

First make sure you have the right Azure modules installed, I noticed the automation module failed So I added this manualy.

Import-Module AzureRM.Automation

Get-AzSKAzureServicesSecurityStatus -SubscriptionId

image

Installing the Secure DevOps Kit for Azure (AzSK)

Install-Module AzSK -Scope CurrentUser

image

Now that the Powershell modules are installed we can start the (AzSK) Scan

Get-AzSKAzureServicesSecurityStatus –SubscriptionId  ID

image

In this subscription there are 44 items that are been checked

image

Items are been checked on the security issues

image

Nice detailed overview is shown. Also a log folder is been created with all the issues. per resource Item.

image

As you can see I have some failed items and with a High, so I need to take a good look at this and fix this.

image

This maybe one of the best Items here an excel sheet with al the issues listed with the solution mentioned and if this can be automated.

If needed there is an URL that points you to the right solution.

image

As Azure log analytics is great and it can be integrated with some OMS (Azure monitoring Dashboards)

The OMS portal will be retired on January 15, 2019. You can continue to use your existing services and licensing in the Azure portal. So the current documentation need some updating.

image

Pressing the OMS button in the Azure portal brings you to the OMS portal but then nothing. As it is now all Azure portal.

Setting up the dashboards failed on me during the first installation but when I did run this a second time the dashboard was there.  (Timing) 

image

Creating the OMS default dashboard we need to run some powershell scripts.

$omsSubId =”id”   #subscription hosting the OMS workspace

$omsWSId =’OMS ID’

$omsRGName =’omsrsg’     #RG where the OMS workspace is hosted

$azSkViewName = ‘MVP_AzSK_view’ #This will identify the tile for AzSK view in OMS.


    #This command will deploy the AzSK view in the OMS workspace.  
    Install-AzSKOMSSolution -OMSSubscriptionId $omsSubId `

                    -OMSResourceGroup $omsRGName `

                    -OMSWorkspaceId $omsWSId `

                    -ViewName $azSkViewName

image

Note:

1) The blades of the OMS view created by this command will start populating only after AzSK scan events become available in the corresponding OMS workspace.

To understand how to send AzSK events to an OMS workspace see https://aka.ms/devopskit/oms.

2) The OMS view installed contains a basic set of queries over DevOps Kit scan events. Please feel free to customize them once you get familiar with the que

ries.

We also periodically publish updated/richer queries at: https://aka.ms/devopskit/omsqueries.

image

Checking the OMS – log analytics workspace it has not much issues as this is a test subscription and if it was all perfect then there is no fun.

image

image

and with longer logging and more Items in azure you will get a different overview.

image

There are lots of options you can set and there is a detailed description on how to use this on Github

Setting up ARM policys is also one of the options

Set-AzSKARMPolicies –SubscriptionId

image

So get started with the DevOpsKit https://github.com/azsk/DevOpsKit-docs 

image

https://github.com/azsk/DevOpsKit-docs/tree/master/05-Alerting-and-Monitoring

AzSK Security Controls Portal @https://aka.ms/azskosstcp

With this it’s a nice tool and yes a bit time consuming but learned a lot and make me see things different in the Azure Subscription 

And If you combine this directly and not afterwards then this could be your time saver to fix all the security items

image

 

Follow Me on Twitter @ClusterMVP

Follow My blog https://robertsmit.wordpress.com

Linkedin Profile Robert Smit MVP Linkedin profile

Google  : Robert Smit MVP profile

Posted January 24, 2019 by Robert Smit [MVP] in Azure

Tagged with , , ,

Step by Step SQL Server 2019 FCI Cluster on Storage Spaces Direct (S2D) Windows Server 2019 #S2D #SQL #SQLserver2019 #BigData #WinServ #WSSD   Leave a comment

This blog is about creating a new SQL cluster with a Failover instance based on a storage space direct configuration. There are a lot off opinions on do’s and don’t for on prem and in Azure with S2D. This is not the blog post on this discussion.  This is just a post on SQL 2019 on Windows server 2019 storage space direct because I can!

And in a later blog post we are extending this to Azure. Still it always depends on running a Full SQL server or use a managed instance in Azure. But for now the new SQL server 2019 is the basic of our cluster running on a Windows Server 2019 cluster. As this time the installation will be GUI based as I got often the question on the screens. normally I run some PowerShell or a command line script that will do the job in several minutes

What are the new features in SQL Server 2019, the list below is just a short list for a full updated list go to the link below.

OR if you want to run a managed SQL server in Azure : https://azure.microsoft.com/en-us/pricing/details/sql-database/managed/

SQL database engine

 

The Database Engine is the core service for storing, processing, and securing data. The Database Engine provides controlled access and rapid transaction processing to meet the requirements of the most demanding data consuming applications within your enterprise. The Database Engine also provides rich support for sustaining high availability.

 

 

https://docs.microsoft.com/en-us/sql/sql-server/sql-server-technical-documentation?view=sql-server-ver15

What’s new in SQL Server 2019

  • Installation of SQL Server is supported on x64 processors only. It is no longer supported on x86 processors.
  • SysPrep is supported for all installations of SQL Server. SysPrep now supports failover cluster installations
  • Always On Availability Groups – secondary replica connection redirection
  • SQL Server Machine Learning Services failover clusters
  • the operating system requirements for the principal editions of SQL Server
  • SQL Server Management Studio (SSMS) 18.0 (preview)
  • Azure Data Studio
  • Azure Data Studio
Always On Availability Groups – more synchronous replicas (CTP 2.0)
  • Up to five synchronous replicas: SQL Server 2019 preview increases the maximum number of synchronous replicas to 5, up from 3 in SQL Server 2017 (14.x) . You can configure this group of 5 replicas to have automatic failover within the group. There is 1 primary replica, plus 4 synchronous secondary replicas.

  • Secondary-to-primary replica connection redirection: Allows client application connections to be directed to the primary replica regardless of the target server specified in the connection string. This capability allows connection redirection without a listener. Use secondary-to-primary replica connection redirection in the following cases:

    • The cluster technology does not offer a listener capability.
    • A multi subnet configuration where redirection becomes complex.
    • Read scale-out or disaster recovery scenarios where cluster type is NONE.

SQL Server Enterprise /SQL Server Standard :

  1. Windows Server 2019
  2. Windows Server 2016
  3. Windows Server 2012 R2
  4. Windows Server 2012

The supported storage types for data files are:

As the SQL server 2019 is still in preview I download the evaluation version.  Get your SQL server here

SQL Server 2019 

Pick the version you want, in our case I select the download media.

SQL Server 2019

Pick the ISO format do download this.

SQL Server 2019

The SQL installation is done on my cluster. described in the blog post below

step by step Windows Server 2019 File Server clustering With powershell or GUI

https://robertsmit.wordpress.com/2018/11/29/step-by-step-windows-server-2019-file-server-clustering-with-powershell-or-gui-cluster-ha-azure-windowsadmincenter-windowsserver2019/

In this Windows server 2019 cluster I created a S2D formatted with ReFS. There is plenty of info to find on my blog how to create the S2D in the cluster.

https://robertsmit.wordpress.com/2016/01/05/using-windows-storage-spaces-direct-with-hyper-converged-in-microsoft-azure-with-windows-server-2016/

https://robertsmit.wordpress.com/2017/11/09/azure-storage-spaces-direct-s2d-standard-storage-vs-premium-storage/

We have a Windows server 2019 Cluster in place with the Storagespace direct configuration.

The specific cluster configuration is debatable, in a typical SQL configuration you would have multiple disks.

image

Our Cluster with storage spaces. In storage spaces all disks come from the same disk pool if you create things default. then multiple disk has a different purpose. As you want to manage the SQL different than others.

image

Our SQL Installation is done this time by the GUI, show you the screens and options. you can always use the one liner to install the SQL server unattended.

 

image

And no I do not use the normal cluster installation but I use the advanced Cluster prep and completion. these two steps gives me a bit more freedom and flexibility it the installation fails.

image

The choice is developer but can also be the one with a product key.

imageimage

Just do the updates direct as it is a new version and on a new OS, just to make sure that I run the latest bits.

image

I got a warning on the Firewall as I turned this off during the installation. This is configured by a GPO when I place the Cluster in the Right AD OU

image

Selecting the features and the installation folders.

image

Do I go for a default instance or a named instance. I always go for a named instance. Its easy and better management. In the old days some applications just want to run on a default instance.

image

My service account that has JEA Just enough Access

image

C:\Program Files\Microsoft SQL Server\150\Setup Bootstrap\Log\20181217_034408\ConfigurationFile.ini

If you want to use a unattended install you can use this ini file to get the same or adjusted values during the install

image

Ini file content.

image

image

Now that the first step is completed we can do the completion step.

Now the second step is needed to finish the SQL 2019 installation on the first node

image

But running the wizard if failed on me, as the error said the Cluster is not verified!

image

I just need to run the Cluster validation.

image

image

Now with the Passed Cluster validation we try again.

image

Now this looks good lets stat the installation of the SQL 2019

image

With the Named instance and usage of an Alias, I can easy change this or move the SQL to another cluster.

image

The installation will show me what cluster groups I can use and which are used at the moment.

image

Selecting the right disks for the installation remember These are the Storage space direct disks that are created with the cluster installation. See my other blog post about creating S2D on Windows Server 2019

image

A fixed IP is needed unless you use the DHCP checkbox.

image

Some applications needs special Collation, when changing this it is an Instance setting and can’t be changed again.

image

Normally you will place the SQL admins or some groups. this is a demo cluster so admin access only

image

Select the right disks and change this in the location fields.

imageimage

Selecting multiple files for the Temp DB and the DB location

image

Also in this step we get a Ini file as output this can be reused if needed.

 

image

imageimage

Now that the installation on one node is ready you can see the SQL resources in the cluster. As I did only the install on one node we need to do the Add node installation to get the installation done for a full FCI.

image

The Step to add an extra cluster node with the SQL installation is an easy step.

image

Follow the Wizard and use the Same account that you used before.

 

image

As the SQL studio is no longer a default installation you need to download the bits from Microsoft.

image

SSMS 18.0 Public Preview 6 is now available, and is the latest generation of SQL Server Management Studio that provides support for SQL Server 2019 preview!

SSMS 17.9.1 is the current General Availability (GA) version of SSMS

Download SQL Server Management Studio 17.9.1 
Download SQL Server Management Studio 17.9.1 Upgrade Package (upgrades 17.x to 17.9.1)

Version Information

  • Release number: 17.9.1
  • Build number: 14.0.17289.0
  • Release date: November 21, 2018

image

As we are using the 2019 We need to have the latest version

imageimageimage

Now we have the studio ready and can access the SQL instance.

image

In the next blogs I’ll show you how to extend the SQL to Azure.

image

Below is an overview of the SQL disks based on storage spaces direct.

image

With All these steps I hope you can build your own cluster and play with this. As for production never use a next next Finish installation there is always some custom tweaks needed to get the best performance.

 

Follow Me on Twitter @ClusterMVP

Follow My blog https://robertsmit.wordpress.com

Linkedin Profile Robert Smit MVP Linkedin profile

Google  : Robert Smit MVP profile

Posted January 15, 2019 by Robert Smit [MVP] in SQL, SQL Server 2019

Tagged with ,

Welcome to Olympia Set up your own Windows Insider Lab for Enterprise #Olympia #Office365 #EnterpriseMobility #WindowsServer #Microsoft #Azure #WindowsInsiders #SCCM   2 comments

 

Olympia V2 is the next step for enabling Windows Insiders to try new and pre-release Windows 10 Enterprise features. Windows Insider Lab for Enterprise v2 provides a complete Microsoft 365 deployment and management testing environment that can be run directly on your own machines. The lab features both client and administrative functionality, including System Center Configuration Manager Preview plus connectivity to Office 365 and Enterprise Mobility Security evaluation trials. Customers can also add the latest Windows 10 Insider Preview Enterprise build to the lab. 

This is a great lab toolkit, to start with the new features. It is easy to setup with a great learning curve.

First we download the entire Lab. it around 14GB

The table below lists the virtual machines, which will be imported and created in Hyper-V:

Server Name

Roles & Products

HYD -DC1

Active Directory Domain Controller, DNS, DHCP, Certificate Services

Windows Server 2016

HYD-CM1

System Center Configuration Manager Technical Preview Branch – Version 1808 (Note: After installing a baseline version, you can then use in-console updates to bring your installation up-to-date with the most recent preview version. See Section 4.)

Windows Deployment Services

Microsoft Deployment Toolkit

Windows 10 ADK

Windows Software Update Services

Microsoft SQL Server 2014

Windows Server 2016

HYD-APP1

Microsoft BitLocker Administration and Monitoring

Microsoft SQL Server 2014

Windows Server 2016

HYD-GW1

Remote Access for Internet Connectivity

Windows Server 2016

HYD-CLIENT1 (Optional)

If the Windows 10 Insider Preview ISO image is imported, this machine will be created with windows installed and will be Domain Joined

HYD-CLIENT2 (Optional)

If the Windows 10 Insider Preview ISO image is imported, this machine will be created with windows installed and will be Domain Joined

HYD-CLIENT3 (Optional)

If the Windows 10 Insider Preview ISO image is imported, this machine will be created with windows installed and will be on Workgroup

HYD-CLIENT4 (Optional)

If the Windows 10 Insider Preview ISO image is imported, this machine will be created with windows installed and will be on Workgroup

The VM list in Hyper-v

image

The table below lists the credentials and access type available in the default implementation:

Windows Insider Lab for Enterprise

After that just extract the files, keep in mind the setup extract the files at the current location of the setup files. You can move the VM’s afterwards

Windows Insider Lab for Enterprise

Starting the setup and extracting the VM’s

Windows Insider Lab for Enterprise

Select your Vswitch on the Hyper-v server

Windows Insider Lab for Enterprise

Select a insiders ISO or download one,

Windows Insider Lab for Enterprise

Plenty of room in the Windows Server 2019 Hyper-v server with Storage Spaces direct.

Windows Insider Lab for Enterprise

The extracting can take up some time depends on the disks and CPU speed for extraction

Windows Insider Lab for EnterpriseWindows Insider Lab for Enterprise

After the Extraction Several VM’s are added to the Hyper-v Server

image

The Gateway will route all the data to internet.

image

Windows Insider Lab for Enterprise

The setup is done the full lab is installed, there are several laps that you can do and setup

image

Windows Insider Lab for Enterprise

The domain structure that is created is the basic for all the labs

Windows Insider Lab for Enterprise

A SCCM site is created and ready for use. As this is the Technical preview I already got the 1812 Build

Windows Insider Lab for Enterprise

 

image

In the Azure Active directory we set some custom pictures.

image 

image

Customize these screens is easy done in the Azure portal

image

Next step is use SCCM and Intune to manage your systems. This lab is perfect for showing all the options.

 

The Setup is Complete and ready to use, this lab is a great way to self explore the new features.

     Lab Objectives

This guide is designed to provide step-by-step guidance in demonstrating the basic functionality of the feature.

·         Lab Setup

o   On-Premises Environment

o   Cloud Environment

o   On-Premises Environment Post Setup Manual Steps

·         Servicing

o   Windows Analytics Update Compliance

·         Deployment & Management

o   Modern Device Deployment

o   Modern Device Management with AutoPilot

o   Co-Management

o   Modern Application Management with Intune

o   Enterprise State Roaming

·         Security

o   Windows Information Protection

o   Windows Defender Advanced Threat Protection

o   Windows Defender Application Guard

o   Windows Defender Exploit Guard

o   Windows Hello

o   Credential Guard

o   Device Encryption (MBAM)

o   Device Guard – User Mode Code Integrity

·         Compatibility

o   Windows Analytics Upgrade Readiness

o   Browser Compatibility

o   Desktop Bridges

·         Additional Labs

o   MDM WINS over GP

o   MAM FAQ

The Windows Insider Lab for Enterprise was designed for Windows Insiders who want to try new experimental and pre-release Enterprise Privacy and Security features. There are two versions of the lab:

· Windows Insider Lab for Enterprise v1 – provides a client-side view of the latest Microsoft 365 enterprise features through access to Olympia Corp – a virtual corporation has been set up to reflect the IT infrastructure of real world business. 

· Windows Insider Lab for Enterprise v2 – provides a complete Microsoft 365 deployment and management testing environment that can be run directly on your own machines. The lab features both client and administrative functionality, including System Center Configuration Manager Preview plus connectivity to Office 365 and Enterprise Mobility + Security evaluation trials.

 

Follow Me on Twitter @ClusterMVP

Follow My blog https://robertsmit.wordpress.com

Linkedin Profile Robert Smit MVP Linkedin profile

Google  : Robert Smit MVP profile

Posted January 8, 2019 by Robert Smit [MVP] in Azure

Tagged with , ,

Extend you File server with Azure File Sync and Migrate with Windows Admin Center #WindowsServer #Azure #AFS #WAC #HybridCloud #FileServer   4 comments

In the former blog post :https://robertsmit.wordpress.com/2018/11/29/step-by-step-windows-server-2019-file-server-clustering-with-powershell-or-gui-cluster-ha-azure-windowsadmincenter-windowsserver2019/

I created a File share on a Cluster to make the share HA. This is more the traditional way to make the share HA. But what if you have multiple locations and you want to use this share in Azure. Big internal lines between the Datacenter and copy the files to Azure (DFS) method. but that’s old. Better use the Azure File Sync option the files are synced to all the Server and available in Azure. Better and faster.

#bettertogether  

 With Azure File Sync , shares can be replicated on-premises or in Azure and accessed through SMB or NFS shares on Windows Server. Azure File Sync is useful for scenarios in which data needs to be accessed and modified far away from an Azure datacenter, such as in a branch office scenario. Data may be replicated between multiple Windows Server endpoints, such as between multiple branch offices. Azure File Sync transforms Windows Server into a quick cache of your Azure file share. You can use any protocol that’s available on Windows Server to access your data locally, including SMB, NFS, and FTPS. You can have as many caches as you need across the world.

To get started with the Azure File Sync we need a Storage account in Azure.

Deploy Azure File Sync

We create a storage account in Azure.

Remember this works only on Windows Servers ! System Requirements:

  • A server running Windows Server 2012 R2, Windows Server 2016 or Windows Server 2019:

    Version
    Supported SKUs
    Supported deployment options

    Windows Server 2019
    Datacenter and Standard
    Full (server with a UI)

    Windows Server 2016
    Datacenter and Standard
    Full (server with a UI)

    Windows Server 2012 R2
    Datacenter and Standard
    Full (server with a UI)

 

Now that the storage account is created we are starting with the Azure File Sync creation in Azure.

Deploy Azure File Sync Deploy Azure File Sync

Name the Storage Sync Service , and create a resource group.

The next step is register the Onpremise server to Azure with the Azure File Sync Agent

Deploy Azure File Sync

Azure File Sync  Agent download https://go.microsoft.com/fwlink/?linkid=858257

The installation is in two steps.

  1. Installing the agent
  2. Configuring the Agent

Deploy Azure File Sync

After the download install the Agent on the File server, As I use a Cluster install the Agent on every node of the Cluster.

Deploy Azure File SyncDeploy Azure File SyncDeploy Azure File SyncDeploy Azure File Sync

Now that the agent is installed the Second wizard pops up for the configuration and if needed a update.

imageDeploy Azure File Sync

So far so good. As the Agent is connecting to Azure there are some additional components needed.

Deploy Azure File Sync

As this Cluster was a fresh installation and I did not used the PowerShell command for Azure here I need to install the AzureRM modules (or AZ module)

https://go.microsoft.com/fwlink/?linkid=856959

Installing and updating the modules.

Install-Module -Name AzureRM –AllowClobber

Deploy Azure File Sync

With this command you can see the current Powershell version

Get-Module -Name AzureRM -List | select Name,Version

 

Deploy Azure File Sync

Now that the PowerShell commands are installed we can refresh the page and the installation continues

Deploy Azure File Sync

If you are using a CSP subscription in Azure then you need to set this check box. and use your tenant ID

Deploy Azure File Sync

In all other subscriptions keep this default

Deploy Azure File Sync

Pick the right Resource group the one with the created Storage Sync services in it. else the field will be empty.

Deploy Azure File Sync

Select a resource group that contains a Storage Sync Service, or use the Azure portal to create one in this resource group.

Deploy Azure File Sync

When this process is done we can configure the rest in the Azure portal.

Deploy Azure File Sync

As you can see the Cluster CNO object is named here

In the pane that opens, enter the following information to create a sync group with a cloud endpoint:

  • Sync group name: The name of the sync group to be created. This name must be unique within the Storage Sync Service, but can be any name that is logical for you.
  • Subscription: The subscription where you deployed the Storage Sync Service.
  • Storage account: If you select Select storage account, another pane appears in which you can select the storage account that has the Azure file share that you want to sync with.
  • Azure file share: The name of the Azure file share with which you want to sync.

Next is creating the Sync group.

Deploy Azure File Sync

 

Deploy Azure File SyncDeploy Azure File Sync

Pick a name for the Sync group name. and the proper Storage account that we created earlier. In this storage account we did not create a File share this is needed to hold the Files. so the azure file share check box is not showing you anything.

Go the the storage account and create a File share

Deploy Azure File Sync

With this created the creation of the Sync group can be completed.

Deploy Azure File Sync

Next step is creating some endpoints. this means bind the local share to the services and sync this to the Azure storage account share.

Deploy Azure File Sync

Deploy Azure File Sync

Adding the endpoint and pick the registered server and the file share that will be synced.

Deploy Azure File SyncDeploy Azure File Sync

If you want to enable cloud Tiering and fill in the values. In this demo I don’t use this.

Note:

Only NTFS volumes are supported. ReFS, FAT, FAT32, and other file systems are not supported.

Failover Clustering

Windows Server Failover Clustering is supported by Azure File Sync for the "File Server for general use" deployment option. Failover Clustering is not supported on "Scale-Out File Server for application data" (SOFS) or on Clustered Shared Volumes (CSVs).

The Azure File Sync agent must be installed on every node in a Failover Cluster for sync to work correctly.

In my demo the Share is not listed, I already know why, As I used ReFS for the cluster disk.

This can be painful as you need to format that disk and move all the data to a temp location.

Deploy Azure File Sync        Deploy Azure File Sync

After changing the disk format and a refresh you can see that the deployment is pending and working.

Deploy Azure File SyncDeploy Azure File Sync

 

After this you have a full Hybrid file share Fully redundant on premise and a off load to Azure.

Deploy Azure File Sync

As last the best option to get the data into this HA file share is using the Windows Admin Center 

In Windows Admin Center there is a great options Storage Migration Services

image

Opening Windows admin Center and select the source this will be scanned and when done the files can be migrated. (the scanning can take some time)

image

image

When the scanning is done the files and shares are listed. more info can be found here https://youtu.be/WCWxAp27ERk

 

Follow Me on Twitter @ClusterMVP

Follow My blog https://robertsmit.wordpress.com

Linkedin Profile Robert Smit MVP Linkedin profile

Google  : Robert Smit MVP profile

Posted December 4, 2018 by Robert Smit [MVP] in Azure

Tagged with ,

step by step Windows Server 2019 File Server clustering With powershell or GUI #Cluster #HA #Azure #WindowsAdminCenter #WindowsServer2019   4 comments

Installing the Cluster is easy now days. But just this I post a little blog on how to do this, In my blog stats it shows that the 2012 post is still very active , so time for an update to Windows Server 2019. in the creation there isn’t much changed, it gets only easier. but If you still not in PowerShell you got more clicks to do an less Coffee. And Windows Admin Center is also a great addition to manage a cluster. This blog post is also usable in Azure Only you need to add Storagespacesdirect and a CSV file share. 

Just install a bare metal (VM) windows Server 2019 and do a domain join and the fun can start.

Installing the Cluster Feature in powershell

Install-WindowsFeature –Name Failover-Clustering –IncludeManagementTools

#Create cluster validation report
Test-Cluster -Node MVP19-01,MVP19-02

#Create new Cluster
New-Cluster -Name MVP1911-27 -Node MVP19-01,MVP19-02 -NoStorage -StaticAddress "10.255.255.45"

#place witness file on USB device from my router

Set-ClusterQuorum -FileShareWitness \\SERVER\SHARE -Credential $(Get-Credential)

Now that the basic cluster is ready we start with the HA share

image

File share witness enhancements We enabled the use of a file share witness in the following scenarios:

  • Absent or extremely poor Internet access because of a remote location, preventing the use of a cloud witness.
  • Lack of shared drives for a disk witness. This could be a Storage Spaces Direct hyperconverged configuration, a SQL Server Always On Availability Groups (AG), or an * Exchange Database Availability Group (DAG), none of which use shared disks.
  • Lack of a domain controller connection due to the cluster being behind a DMZ.
  • A workgroup or cross-domain cluster for which there is no Active Directory cluster name object (CNO). Find out more about these enhancements in the following post in Server & Management Blogs: Failover Cluster File Share Witness and DFS.

    We now also explicitly block the use of a DFS Namespaces share as a location. Adding a file share witness to a DFS share can cause stability issues for your cluster, and this configuration has never been supported. We added logic to detect if a share uses DFS Namespaces, and if DFS Namespaces is detected, Failover Cluster Manager blocks creation of the witness and displays an error message about not being supported.

that’s it the cluster is created, we can start with the File server

Next is installation of the file server role

image

A restart is needed! After the restart we can build the cluster with the HA file share

$servers = ("MVP19-01", "MVP19-02") 
foreach ($server in $servers) {Install-WindowsFeature -Name file-services -ComputerName $server}

Now that the File Server Role is added we can add the Disk. Or use a disk that you already added before.

First we need to add a disk this can be done in the Failover Cluster manager or with PowerShell

image image

Get-ClusterAvailableDisk | Add-ClusterDisk

image

The Roles are there and the Disk is added

imageimage

Next step is adding the File server Role to the Cluster and add the HA File Share.

In this case I have a fail over disk and I use the File Server for general use.

image

image image

So when adding the Disk it is not showing the disk. This is The disk is added to the cluster but the disk isn’t formatted!

image

Keep in mind that formating the cluster disk while it is online is not possible. You need to set the disk in maintenance mode else the format will fail.

image image

So after the disk format we will see the Disk appear and can be added to the File server

 

imageimage

After this the File server is up and running. As you can see the setup is screen intense, building this with PowerShell is a lot faster.

Powershell

add-ClusterFileServerRole -Storage "Cluster Disk 1" -Name MyFiles

New-SmbShare -Name "Data" -Path "J:\Data" -EncryptData $True

Quick steps with powershell and even the share is created and encrypted

image

Next step is adding the file share.

image

go for the Quick setup

imageimage

Pick the disk and select the folder with the data on the disk, if there is no data then create a folder that will hold the data later.

image

as you can see the UNC path from the File Server.

image image

As you can see the settings can be adjusted for you needs and also set the right access, and keep in mind this needs to be don on the Cluster Level!

image

All Done

image

So creating a File Server and 2 file shares is Click intensive if you don’t use PowerShell.

But What about Windows Admin Center ? yes that would be an option also except here you can’t create a cluster role.

cluster management in Windows Admin Center

image

You can create a new role but no file server /share etc.

But when the share is created and running like now you can use Windows Admin Center for migration the data to the file share.

image

But more and more options are coming in Windows Admin Center below are some links that you can use to add your request to the UserVoice

https://docs.microsoft.com/en-us/windows-server/manage/windows-admin-center/use/manage-failover-clusters

More Coming

Failover cluster management in Windows Admin Center is actively under development and new features will be added in the near future. You can view the status and vote for features in UserVoice:

Feature Request

Show more clustered disk info

Support additional cluster actions

Support converged clusters running Hyper-V and Scale-Out File Server on different clusters

View CSV block cache

See all or propose new feature

+++++++++++++++

 

Follow Me on Twitter @ClusterMVP

Follow My blog https://robertsmit.wordpress.com

Linkedin Profile Robert Smit MVP Linkedin profile

Google  : Robert Smit MVP profile

Posted November 29, 2018 by Robert Smit [MVP] in Windows Server 2019

Tagged with

  • Twitter

  • RSS Azure and Microsoft Windows Server Blog

  • %d bloggers like this: