Archive for the ‘Azure’ Tag

Step by Step Azure NAT Gateway – Static Outbound Public IP address #ANG #NAT #WVD #Azure #Security #Cloud #MVPBuzz #AzOps #ITPRO #VirtualNetworks #PowerShell   Leave a comment

There a several ways on using an external IP in Azure, What method to use is up to you. Remember there is no good or wrong but only different opinions or insights on how to use it.

Public IP addresses allow Internet resources to communicate inbound to Azure resources. Public IP addresses also enable Azure resources to communicate outbound to Internet and public-facing Azure services with an IP address assigned to the resource. The address is dedicated to the resource, until it is unassigned by you. If a public IP address is not assigned to a resource, the resource can still communicate outbound to the Internet, but Azure dynamically assigns an available IP address that is not dedicated to the resource.

Some of the resources you can associate a public IP address resource with are:

  • Virtual machine network interfaces
  • Internet-facing load balancers
  • VPN gateways
  • Application gateways
  • Azure Firewall
  • NAT Gateway

Matching SKUs must be used for load balancer and public IP resources. You can’t have a mixture of basic SKU resources and standard SKU resources. You can’t attach standalone virtual machines, virtual machines in an availability set resource, or a virtual machine scale set resources to both SKUs simultaneously.

Virtual Network NAT (network address translation) simplifies outbound-only Internet connectivity for virtual networks. When configured on a subnet, all outbound connectivity uses your specified static public IP addresses. Outbound connectivity is possible without load balancer or public IP addresses directly attached to virtual machines. NAT is fully managed and highly resilient.

image

So this is only for the Outbound connection. why not use the Resource group IP this is also “static” ? using this IP means that al VM’s must be in the same resource group and when the resource group changed the IP is also changing.

image

NAT is compatible with standard SKU public IP address resources or public IP prefix resources or a combination of both. You can use a public IP prefix directly or distribute the public IP addresses of the prefix across multiple NAT gateway resources. NAT will groom all traffic to the range of IP addresses of the prefix. Any IP whitelisting of your deployments is now easy.

So How to implement this. a step by step guide. GUI and powershell Looking at my demo setup, There are 2 vm’s both in a different Resource group.

Setting up the NAT gateway is done by 3 tabs to fill in the name and what vnet to use

https://robertsmit.wordpress.com/

We add a new NAT gateway.

image

We create a new resource group and choose NAT gateway name.

The Timeout we leave this on 4 min for now.

image

We configure an external IP and with a standard SKU. Basic is not supported.

image

the next step is choose the External outbound IP pool minimal is 2 and max is 256. this is not needed but only if you want to have a pool of External IP’s else it just go the one external ip

image

you can select max 2 prefixes

image

Configure which subnets of a virtual network should use this NAT gateway. Subnets with Basic load balancers or virtual machines that are using a Basic public IP are not compatible and cannot be used.
Note: While you do not have to complete this step to create a NAT gateway, the NAT gateway will not be functional until you have added at least one subnet. You can also add and reconfigure which subnets are included after creating the NAT gateway.

image

in the last step we tag the NAT gateway to a subnet. When checking the VM’s on this subnet for the outbound IP ( remember the VM does not need a public IP on the network card)

image

Here I have 2 VM’s getting both an IP from the prefix

imageimage

If there is only a small prefix then both machines will get the same external outbound IP

imageimage

With this time flow it recycles the External IP, depending on the scope and usage.

image

So in just a few steps you can use a useful gateway for all your outbound traffic.

Building this in Powershell is also easy. I use a semi automatic script as I want to choose my network. but you can change this to a fixed network if you want.

remember this will need the az.network latest module. in the old modules there is no get-AzNatGateway command. without this the posh is not working.

First we have some parameters

# Set the variables for the NAT Gateway.
$rg = ‘rg-rsm-natgw001’
$Location = ‘Westeurope’
$sku = ‘Standard’
$PublicIpname = ‘pup-rsm-natgw001’
$Publicprefixname = ‘pxp-rsm-natgw001’
$NatGatewayname=’gwn-rsm-natgateway001′

#create Rsource group
New-AzResourceGroup -Name $rg -Location $Location 

image

First we make some external IP and or a range.

#create Standard SKUP public IP
$publicIP = New-AzPublicIpAddress -Name $PublicIpname -ResourceGroupName $rg -AllocationMethod Static -Location $Location -Sku $sku
$publicIP | Select-Object Name, ResourceGroupName, IpAddress, IdleTimeoutInMinutes, ProvisioningState

https://robertsmit.wordpress.com

With the Zone attribute you can create zone redundancy, but this is not needed for this resource.

#create  IP prefix ( how many IP’s are needed)
$publicIPPrefix = New-AzPublicIpPrefix -Name $Publicprefixname -ResourceGroupName $rg -Location $Location -PrefixLength 29

$publicIPPrefix | Select-Object Name, IPPrefix, PrefixLength, ProvisioningState

image

You can skip this if you want only one external IP.

Next is creating the gateway.


#Create NAT gateway
$natGateway = New-AzNatGateway -Name $NatGatewayname -ResourceGroupName $rg -PublicIpAddress $publicIP -PublicIpPrefix $publicIPPrefix -Location $Location -Sku $sku -IdleTimeoutInMinutes 4
$natGateway  | Select-Object Name, ResourceGroupName, IdleTimeoutInMinutes , SKuText | Format-table -autosize –wrap

image

Now that the Gateway is created we can add a subnet to this. I used a point an click so that I can choose the network and subnet. but you can also use a variable to do this.

$virtualNetwork = Get-AzVirtualNetwork | Out-GridView -PassThru -Title "Pick the vnet that will be used for the NAT gateway"

https://robertsmit.wordpress.com

$NATSubnet = Get-AzVirtualNetworkSubnetConfig -VirtualNetwork $virtualNetwork | Out-GridView -PassThru -Title "Pick the Subnet that will be used for the NAT gateway"

image

$NATSubnet.NatGateway = $natGateway
$virtualNetwork | Set-AzVirtualNetwork

The network is chosen and the subnet is selected.

In the Azure portal you can see the result.

https://robertsmit.wordpress.com

 

Follow Me on Twitter @ClusterMVP

Follow My blog https://robertsmit.wordpress.com

Linkedin Profile Robert Smit MVP Linkedin profile

Google  : Robert Smit MVP profile

 

Posted June 2, 2020 by Robert Smit [MVP] in Azure

Tagged with , ,

Update all AZ. Azure Powershell Modules #PowerShell #Azure #Script #modules   Leave a comment

If you do a lot with Azure and PowerShell you may noticed that the latest module is important. as functions may not be there or properties are not listed correctly.

There are plenty of scripts around on how to update these modules. 

With the  Get-InstalledModule you will get a list of the modules on your system

image

When doing get module with the –listAvailable you will see all the versions

Get-Module -Name az.* -ListAvailable

image

here is the powershell code Like I said before there are tons of the same scripts around on github or blog post. So don’t invent the wheel again reuse and modify to your needs

Get-Module -Name az.* -ListAvailable |
  Where-Object -Property Name -ne ‘Az.’ |
  ForEach-Object {
    $currentVersion = [Version] $_.Version
    $newVersion = [Version] (Find-Module -Name $_.Name).Version
    if ($newVersion -gt $currentVersion) {
      Write-Host -Object "Updating $_ Module from $currentVersion to $newVersion"
      Update-Module -Name $_.Name -RequiredVersion $newVersion -Force
      Uninstall-Module -Name $_.Name -RequiredVersion $currentVersion -Force
    }
  }

Running this can tike some time as you can see In this case I have a lot of old and new modules and these are being updated to the latest versions

image

When updating this I had some PowerShell windows still open and got some errors, you can also do this by hand.

For sample  – Install-Module -Name Az.Accounts -RequiredVersion 1.8.0 –Force

image

Hope this helps you to a better Azure PowerShell experience. 

 

 

Follow Me on Twitter @ClusterMVP

Follow My blog https://robertsmit.wordpress.com

Linkedin Profile Robert Smit MVP Linkedin profile

Google  : Robert Smit MVP profile

Posted May 27, 2020 by Robert Smit [MVP] in Azure

Tagged with ,

Starting With Azure Tags: What do my resources Costs .#Azure #Cost #Tags #Cloud #Governance #WiMVP #Mvpbuzz   Leave a comment

When starting With Azure The Costs are important. If you have created a lot of resources you might want to know who owns the resources or what is the purpose of this resource.

Resource management: Your IT teams will need to quickly locate resources associated with specific workloads, environments, ownership groups, or other important information. Organizing resources is critical to assigning organizational roles and access permissions for resource management.

Azure Tags: What do my resources Costs. #Azure #Cost #Tags #Cloud #governance

Tagging resources  is the way to find the resource and keep it with the purpose that you used it for. but over time things may change or added.

There are tons of reasons why you should use Tagging

  • Cost management and optimization
  • Cloud accounting models
  • ROI calculations
  • Cost tracking
  • Budgets
  • Alerts
  • Recurring spend tracking and reporting
  • Post-implementation optimizations
  • Cost-optimization tactics
  • Operations management
  • Security
  • Governance and regulatory compliance
  • Automation
  • Workload optimization

Azure Tags: What do my resources Costs. #Azure #Cost #Tags #Cloud #governance

That way items in your resource groups may be un tagged. You can set policys for this but when there is some wild resource you might wan to check it first be for tagging.

Azure Tags: What do my resources Costs. #Azure #Cost #Tags #Cloud #governance

As you can see the TAG’s are not applied to all the resources.

Azure Tags: What do my resources Costs. #Azure #Cost #Tags #Cloud #governance

When you check the cost on the tag or on the resource group you will see different numbers. For adding the tag to all resources in the Resource group We use a PowerShell line.

First we connect to the Azure subscription or use the CLI

Connect-AzAccount
Login-AzAccount
Get-AzSubscription
Select-AzSubscription -Subscription "Microsoft Azure”

We select the resource group.

$RG = "rsmvprsg01"

When we check that resource group it has a tag. So there is no need to set an tag unless you want to set an extra tag to the resources.

image

Now We are setting the tag to all the resources that are in the resource group. Get-azresourcegroup and set the TAG.

$group = Get-AzResourceGroup -Name $rg
Get-AzResource -ResourceGroupName $group.ResourceGroupName | ForEach-Object {Set-AzResource -ResourceId $_.ResourceId -Tag $group.Tags -Force }

 

Azure Tags: What do my resources Costs. #Azure #Cost #Tags #Cloud #governance

When looking in the Billing you might not see this directly

image

Drilling down on the resource you can see it is set.

image

If you did not had set the Tags then you need to define a tag first.

#Force Tags to all resources
#set tag no pre defined
Set-AzResourceGroup -Name $rg -Tag @{ env="Robert Smit"; RSM="ClusterMVP" }

Azure Tags: What do my resources Costs. #Azure #Cost #Tags #Cloud #governance

  • Define what each tag should be used to identify.  Tag name : The exact term used for the tag, e.g. “Application” , “Department” , “Project”
    Values:  List all potential values for each tag name, e.g. “finance”, “website” , “name”
  • Tag names can have up to 512 characters, values can have up to 256
  • These characters aren’t supported with tags: < > % & / ?

$group = Get-AzResourceGroup -Name $rg
Get-AzResource -ResourceGroupName $group.ResourceGroupName | ForEach-Object {Set-AzResource -ResourceId $_.ResourceId -Tag $group.Tags -Force }

Azure Tags: What do my resources Costs. #Azure #Cost #Tags #Cloud #governance

And you can do this also with the Azure CLI

Open the CLI in the Azure portal

image

I’ll use the same settings

env="Robert Smit"; RSM="ClusterMVP"

 

az tag create –name Env

az tag add-value –name Env –value "Robert Smit”

 

Azure Tags: What do my resources Costs. #Azure #Cost #Tags #Cloud #governance

 

Now that the Tags are created we can add them to a resource group

 

az group update -n rsmdemo01–set tags.Env="Robert Smit" tags.MVP=ClusterMVP

 

image

Is sett two tags but you can set just one or multiple.

Enforce tagging rules with Azure policies can done easily as there are many examples here https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/tag-policies

Assign policies for tag compliance

The Link will take you to the Github repository https://github.com/Azure/azure-policy 

image

 

 

Follow Me on Twitter @ClusterMVP

Follow My blog https://robertsmit.wordpress.com

Linkedin Profile Robert Smit MVP Linkedin profile

Google  : Robert Smit MVP profile

Posted May 19, 2020 by Robert Smit [MVP] in Azure

Tagged with ,

Step By Step Azure Files share SMB with native AD support and more #Microsoft #AzureFiles #SMB #SnapshotManagement #Azure #Cloud #MVPBuzz #WiMVP   1 comment

For some time I see all kinds of options to use Azure files, have some great ideas and thoughts. Connecting this over the vpn of use the azure files with a dfs. Useful maybe ? fun absolutely building things just a way that is maybe a bit different is fun and you may see other opportunities on how to use the resources. 

Using Azure Files is not new, But using Azure files with Active directory Authentication is a long waited feature and now that it is GA we can use this.

Azure Files is a shared storage service that lets you access files via the Server Message Block (SMB) protocol, and mount file shares on Windows, Linux or Mac machines in the Azure cloud.
Azure Files supports identity-based authentication over Server Message Block (SMB) through two types of Domain Services: Azure Active Directory Domain Services (Azure AD DS) (GA) and Active Directory (AD).
Azure file shares only support authentication against one domain service, either Azure Active Directory Domain Service (Azure AD DS) or Active Directory (AD).

image

AD identities used for Azure file share authentication must be synced to Azure AD. Password hash synchronization is optional.
AD authentication does not support authentication against Computer accounts created in AD.

So what would be the option to use this, As a Cloud file share, in WVD or RDS, you can connect this directly to your clients if needed.

image

image

AD authentication can only be supported against one AD forest where the storage account is registered to. You can only access Azure file shares with the AD credentials from a single AD forest by default. If you need to access your Azure file share from a different forest
Azure Files supports Kerberos authentication with AD with RC4-HMAC encryption. AES Kerberos encryption is not yet supported.

 

So how to start with Azure Files. In this blog post I created a Powershell script that does the most of the Config to get you started with Azure Files.

First we need to address some parameters

#ResourceGroup name and location
$RG="rsg-blog-fileshare20"
$Location="eastus2"  
$storageaccount="storfileserver20"
$shareName = "blogshare01"

These basis are needed to create the Azure resources but there is also a Special PowerShell module needed AzFilesHybrid Download and unzip the AzFilesHybrid PowerShell module

This module can be download from github and extracted on your machine

image

You may need to set the executionPolicy

#Azure file modules
#Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Scope Currentuser
cd c:\AzFilesHybrid
Unblock-File .\CopyToPSPath.ps1
.\CopyToPSPath.ps1

The CopyToPSPath.ps1 will load the modules that are needed for this.

Our next step is importing the module AzFilesHybrid

Import-Module -name AzFilesHybrid -Force

image

Our next step is connect to our Azure subscription

#Connect to Azure
Connect-AzAccount

#Select the target subscription for the current session use your subscription ID
Get-AzSubscription
Select-AzSubscription –SubscriptionId  11111111-1111111111-111111111-11111-1

image

Now that the Azure subscription is connected we make a resource group and the storage account with the share.
#create Rsource group
New-AzResourceGroup -Name $RG -Location $Location

image

#create storage account
New-AzStorageAccount -ResourceGroupName $RG -Location $Location -Name $storageaccount -SkuName Standard_LRS -AccessTier Hot

image

#create storage Fileshare
New-AzRmStorageShare -ResourceGroupName $RG -StorageAccountName $storageaccount -Name $shareName -QuotaGiB 1024  #| Out-Null

image

Now that the storage account is created and the share we make a computer account for the AD rights, optional is the OU location where the computer account is stored.

Important action het is that this should run on a domain joined computer, as it needs to have access to the domain to create the computer account. Needless to say but you need a proper AD account to create the Computer account.

#join azure files to AD
Join-AzStorageAccount -ResourceGroupName $RG -Name $storageaccount -DomainAccountType "ComputerAccount" -OrganizationalUnitName "File Servers"

image

Now that the computer account is created we can move to the next steps, As I want to add a privatepoint and make sure my local DNS can find the fileshare.

image

So how does this look like in the Azure portal.

image

Here is the fileshare and file server with all the configuration options

image

The share is AD ready. The Option is enabled and ready to use

Now that we have the share in place we can configure the share. First we test the Connection from the Server to the Azure file share.

#test SMB connection
Test-NetConnection -ComputerName storfileserver20.file.core.windows.net -CommonTCPPort SMB

image

The file share can be used, but wait there is more, it al depends on your configuration. If you use the share only in Azure then DNS forwarders are not need, but just in case.

This works but we will create an endpoint now to make sure the share is not listening to all requests

image

You can use private endpoints for your Azure Storage accounts to allow clients on a virtual network (VNet) to securely access data over a Private Link. The private endpoint uses an IP address from the VNet address space for your storage account service. Network traffic between the clients on the VNet and the storage account traverses over the VNet and a private link on the Microsoft backbone network, eliminating exposure from the public internet.

Using private endpoints for your storage account enables you to:

  • Secure your storage account by configuring the storage firewall to block all connections on the public endpoint for the storage service.
  • Increase security for the virtual network (VNet), by enabling you to block exfiltration of data from the VNet.
  • Securely connect to storage accounts from on-premises networks that connect to the VNet using VPN or ExpressRoutes with private-peering.

 

Creating the Private endpoint is a bit tricky in PowerShell and quicker in the GUI if you do this in several steps as in the blog post.

image

So we give the Connection a name and place it in a region

image

Selecting the Resource that we want to point, in this case it is the Files server and I bind this to the Network

imageimage

All the steps are completed.

image image

Now that the PrivateLink is created We add the DNS zone if not already done. this is needed when local Clients “on-premises” want to connect to the share   

This DNS zone is needed as we want to access from the on-premises Machine to the Azure share. connected over the VPN tunnel. You can also choose to connect over the internet, Or have the option to add the Azure file share to the DFS

First we are making a DNS forwarder rule that is needed for the creating DNS forwarding rule set, which defines which Azure services you want to forward requests.

$ruleset=New-AzDnsForwardingRuleSet -AzureEndpoints StorageAccountEndpoint
$ruleset.DnsForwardingRules

image

image

The Core.windows.net forwarder is needed. the IP 168.63.129.16 is the Microsoft DNS

# Deploy and configure DNS forwarders
New-AzDnsForwarder -DnsForwardingRuleSet $ruleSet -VirtualNetworkResourceGroupName "rsg-vnet-sponsor01" -VirtualNetworkName "Azure-vnet-sponsor01" -VirtualNetworkSubnetName "Management"

image

Confirm DNS forwarders:

Resolve-DnsName -Name storfileserver20.file.core.windows.net

image

Make sure you configure on the on-premises DNS the Forwarder to the Azure DNS, in this case to my Azure AD VM that runs also DNS

image

image

Now that the DNS is in place we can connect to the Azure files share in the cloud but also on premises with the connection routed to the VPN tunnel instead of direct to the internet.

 

Setting Permissions on the Azure Files Shares is not complicated.

With the general availability of AADDS authentication for Azure Files, Microsoft introduced three Azure built-in roles for granting share-level permissions to users:

•Storage File Data SMB Share Reader allows read access in Azure Storage file shares over SMB.

•Storage File Data SMB Share Contributor allows read, write, and delete access in Azure Storage file shares over SMB.

•Storage File Data SMB Share Elevated Contributor allows read, write, delete and modify NTFS permissions in Azure Storage file shares over SMB.

 

Azure Files supports the full set of NTFS basic and advanced permissions. You can view and configure NTFS permissions on directories and files in an Azure file share by mounting the share and then using Windows File Explorer or running the Windows icacls or Set-ACL command.

To configure NTFS with Admin permissions, you must mount the share by using your storage account key from your domain-joined VM.

The following sets of permissions are supported on the root directory of a file share:

  • BUILTIN\Administrators:(OI)(CI)(F)
  • NT AUTHORITY\SYSTEM:(OI)(CI)(F)
  • BUILTIN\Users:(RX)
  • BUILTIN\Users:(OI)(CI)(IO)(GR,GE)
  • NT AUTHORITY\Authenticated Users:(OI)(CI)(M)
  • NT AUTHORITY\SYSTEM:(F)
  • CREATOR OWNER:(OI)(CI)(IO)(F)
Mount a file share from the command prompt

Use the Windows net use command to mount the Azure file share. Remember to replace the placeholder values in the following example with your own values. For more information about mounting file shares, see Use an Azure file share with Windows.

net use <desired-drive-letter>: \\<storage-account-name>.file.core.windows.net\<share-name> /user:Azure\<storage-account-name> <storage-account-key>

Configure NTFS permissions with icacls

Use the following Windows command to grant full permissions to all directories and files under the file share, including the root directory. Remember to replace the placeholder values in the example with your own values.

icacls <mounted-drive-letter>: /grant <user-email>:(f)

 

An other option with Azure files is Connect your Azure files to the DFS server

First I had to play a bit with the naming convention as the root of the file is not the share.

Below is the azure folder. so the share name would be \\storfileserver20.file.core.windows.net\blogshare03

image

As I use now the internal DNS and with the DFSN link 

image

I can do domain name \ share and the files are being placed on the Azure file share. here you can also see that the naming is one step deeper. in the domain share name then there is the linked folder to the Azure Files.

On the time that I wrote this blog the Azure files snapshots came also GA.

image

there is no scheduled counter behind this. just press and shoot but with an script or automation account you can create  nice solutions to keep your files save.

Hope this blog is helpful, It helped me to play with this and got some other ideas than just pasting the net use command  to a device and then place the files. still there is nothing wrong with that.

 

Follow Me on Twitter @ClusterMVP

Follow My blog https://robertsmit.wordpress.com

Linkedin Profile Robert Smit MVP Linkedin profile

Google  : Robert Smit MVP profile

Posted May 11, 2020 by Robert Smit [MVP] in Azure, Windows 10

Tagged with , ,

How to join Windows Server 2019 to the Azure AD #AAD #Winserv #WIMVP #AD #Hybrid #Azure   Leave a comment

For Some time it is possible to join devices to the Azure AD. Personally I know this was working for Windows 10 but Windows Server 2019, in this blog post I’ll show some ideas and thoughts. It would be nice  if native Azure MFA would work to log on. Also for some options your Azure AD needs to be at least P1.

Organizations can now utilize Azure Active Directory (AD) authentication for their Azure virtual machines (VMs) running Windows Server 2019 Datacenter edition or Windows 10 1809 and later. Using Azure AD to authenticate to VMs provides you with a way to centrally control and enforce policies. Tools like Azure Role-Based Access Control (RBAC) and Azure AD Conditional Access allow you to control who can access a VM. This Blog shows you how to create and configure a Windows Server 2019 VM to use Azure AD authentication and how to remove the Azure AD join and switch back to Active directory Domain join.

The following Windows distributions are currently supported during the preview of this feature:

  • Windows Server 2019 Datacenter
  • Windows 10 1809 and later

So the machine below is in a workgroup but Azure AD joined. on a server is it not visible that the machine is Azure AD joined in the UI.

image

In the Configuration properties in an Azure VM we can set the following properties. Login with AAD credentials. This is during creation of the new VM that way the VM is directly Azure AD joined.

image

Just deployed a new VM. and this VM is Azure AD joined, but what if you want to domain join this machine can we do a hybrid domain join for short NO.

image

Remember Some options only work if you have a P1 or a P2 Azure AD license here you can find the differences https://azure.microsoft.com/en-us/pricing/details/active-directory/

image

Looking at the devices in the Azure AD devices we can see the Server is Azure AD Joined.

image

Giving Access to the VM can be based on RBAC

Two RBAC roles are used to authorize VM login:

  • Virtual Machine Administrator Login: Users with this role assigned can log in to an Azure virtual machine with administrator privileges.
  • Virtual Machine User Login: Users with this role assigned can log in to an Azure virtual machine with regular user privileges.

To allow a user to log in to the VM over RDP, you must assign either the Virtual Machine Administrator Login or Virtual Machine User Login role. An Azure user with the Owner or Contributor roles assigned for a VM do not automatically have privileges to log in to the VM over RDP. This is to provide audited separation between the set of people who control virtual machines versus the set of people who can access virtual machines.

Select the VM and choose IAM press Add and add role assignment. just as you do with other workloads.

image

image

Or use the Azure CLI

$username=(az account show –query user.name –output tsv)

$vm=(az vm show –resource-group rsg-adjoin001 –name 2019vmadjoin –query id -o tsv)

az role assignment create  –role "Virtual Machine Administrator Login" –assignee $username –scope $vm

image

But what If we want to do a Domain join ?

There is no hybrid domain join and no console unjoin. Redeploy would not be the best option right.

image

With the DSRegCmd /Leave we can unregister the VM from the Azure AD.

image

now back to the Domain join without a reboot we can join the VM direct to the Classic Active directory.

image

Remember a reboot is needed for this.

image

Now the VM is normal AD joined.

This option is still in preview and after removing the Azure AD still shows that the VM is Azure Ad joined, it seems there is no trigger to remove the AADLoginForWindows extention in the VM.

The hybrid join could me a great addition to make VM’s connectable with Azure MFA. But for now we can assign policy’s and rules.

 

Follow Me on Twitter @ClusterMVP

Follow My blog https://robertsmit.wordpress.com

Linkedin Profile Robert Smit MVP Linkedin profile

Google  : Robert Smit MVP profile

Posted April 6, 2020 by Robert Smit [MVP] in Windows Server 2019

Tagged with , , ,

Step by Step Azure Active Directory (Azure AD) Connect Cloud Provisioning   Leave a comment

Recently a new option for AD sync is in preview Azure AD Connect cloud provisioning, Azure AD Connect Cloud Provisioning can run in a tenant already using Azure AD Connect Sync, Support for synchronizing to an Azure AD tenant from a multi-forest disconnected Active Directory forest environment. This is currently not possible with AD connect. and many organizations are struggling with this.

Simplified installation with light-weight provisioning agents: The agents act as a bridge from AD to Azure AD, with all the sync configuration managed in the cloud.

  • Multiple provisioning agents can be used to simplify high availability deployments, particularly critical for organizations relying upon password hash synchronization from AD to Azure AD.

Azure Active Directory (Azure AD) Connect Cloud Provisioning

The common scenarios include merger & acquisition, where the acquired company’s AD forests are isolated from the parent company’s AD forests and companies that have historically had multiple AD forests.

Azure Active Directory (Azure AD) Connect Cloud Provisioning

Multiple provisioning agents can be used to simplify high availability deployments, particularly critical for organizations relying upon password hash synchronization from AD to Azure AD.

Azure Active Directory (Azure AD) Connect Cloud Provisioning

Here I have a sample of 3 the same used accounts but different domain, now with the Azure Active Directory (Azure AD) Connect Cloud Provisioning they are synced into a single AAD.

image

If there is a firewall between your servers and Azure AD, configure the following items:

Ensure that agents can make outbound requests to Azure AD over the following ports:

Port number and How it’s used

  • 80  Downloads the certificate revocation lists (CRLs) while validating the SSL certificate
  • 443 Handles all outbound communication with the service
  • 8080(optional) Agents report their status every 10 minutes over port 8080, if port 443 is unavailable. This status is displayed on the Azure AD portal.

Also the Following URL’s need to be unblocked.

You can test access using the test portal  https://aadap-portcheck.connectorporttest.msappproxy.net/

msappproxy.net domain Ports Test Tool

Now that I know that all the ports are open we can start with the deployment.

Go to the Azure portal and open the Active directory Blade.

https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/AzureADConnect

image

When clicking the Provisioning link the new window opens with the download Agent in the ribbon.

image

Now that we have downloaded the Agent we can start the installation, Keep in mind if you don’t have installed the latest .NET version you need to install this and it will take a kernel reboot.

Azure Active Directory (Azure AD) Connect Cloud Provisioning

Azure Active Directory (Azure AD) Connect Cloud Provisioning

A quick setup and our next step is the Configuration.

Azure Active Directory (Azure AD) Connect Cloud ProvisioningAzure Active Directory (Azure AD) Connect Cloud Provisioning

Us a service account for the Sync, and keep in mind that your domain settings are correct else all the accounts got synced with the *.onmicrosoft.com

Azure Active Directory (Azure AD) Connect Cloud Provisioning

My local Active directory domain.

image

In this demo I use the Administrator but don’t use this account in you production site. Create a proper account for this.

Azure Active Directory (Azure AD) Connect Cloud Provisioningimage

Now that the AD is connected we can kick off the sync and move on to the next steps/

Azure Active Directory (Azure AD) Connect Cloud Provisioning

image

The Agent is creating two services on the sync server.

Azure Active Directory (Azure AD) Connect Cloud Provisioning

In the Azure portal you can see the sync status. I did already do a couple of installs so no panic if your layout is different.

Azure Active Directory (Azure AD) Connect Cloud ProvisioningAzure Active Directory (Azure AD) Connect Cloud Provisioning

Now we are checking if the Agent is running and use review all agents as default there is an extra step to take

image 

In previews you can always give feedback so when the product is GA there is a good chance that the menu’s will change.

Azure Active Directory (Azure AD) Connect Cloud Provisioning

As you can see it is active, If it is not active check the Services on the on-premises server where you installed the Agent

You can also your external public IP

Azure Active Directory (Azure AD) Connect Cloud Provisioning

You can also check the services state:

  • Microsoft Azure AD Connect Agent Updater (in charge of updating to the latest agent version)
  • Microsoft Azure AD Connect Provisioning Agent (in charge of the synchronization)

Our next step is configuring the Azure AD Connect cloud provisioning, using password hash and setup a notification email.

Azure Active Directory (Azure AD) Connect Cloud Provisioning

Now that the configuration is complete we are ready for production

Azure Active Directory (Azure AD) Connect Cloud Provisioning

we save this config and check the agent health status.

Azure Active Directory (Azure AD) Connect Cloud Provisioning

For testing you can use the Cloud applications portal. https://myapps.microsoft.com

Azure Active Directory (Azure AD) Connect Cloud Provisioning

When logging in you will see the apps that are assigned to that user.

Configuration changes are synced every 2 minutes while the provisioning interval is every 40 minutes.

All agent activities are logged into the Applications and Services Logs\Microsoft\AzureADConnect\ProvisioningAgent\Admin

image

AgentUpdater for any agent updated activities (you will see there if there has been an update) or ProvisioningAgent for any provisioning activities.

 

Follow Me on Twitter @ClusterMVP

Follow My blog https://robertsmit.wordpress.com

Linkedin Profile Robert Smit MVP Linkedin profile

Google  : Robert Smit MVP profile

Posted February 12, 2020 by Robert Smit [MVP] in Azure

Tagged with , , ,

Step by Step Windows Virtual Desktop Troubleshooting Manual Add VM to HostPool #WVD #RDS #Azure #MSIgnite #MVPBuzz #Cloud   2 comments

Windows virtual desktop is GA and already there are tons of blog post on how to install windows virtual desktop, first steps on windows virtual desktop.

I see a huge demand on WVD, Customers wants to try this and see the difference between the traditional RDS setup.  And yes its all Azure but thanks can be build and tested. and there comes all the different builds and setups. Different places to go, and management is a pain no GUI available from Microsoft there is only PowerShell. Not a bad thing but testing the windows virtual desktop leaves me multiple tenants and host pools dead.

Well I thought lets do a Step By Step windows virtual desktop, Well not exactly I’ll believe you can follow the wizard in Azure and Do all the prereq’s by your self. In this blog post it could be that not all host pools and tenant names are the same as I had a lot of test WVD configs.

As we all know the Infrastructure that is needed for windows virtual desktop, we also know that a lot can go wrong and then where to look ?

image

So to start with windows virtual desktop I created a little Powershell script that does step 1

Install-Module -Name Microsoft.RDInfra.RDPowerShell
Import-Module -Name Microsoft.RDInfra.RDPowerShell

#Setup Settings, TenantName of WVD tenant, Hostpool name
$Hostpool       = “WVDpool01”
$HPFriendlyName  = “Win10 + O356”
$TenantName     = “ClusterMVP”
$TenantGroupName = “Default Tenant Group”
$AppGroupName    = “Desktop Application Group”
$AadTenantId    = “111111-2222222-33333”
$subscriptionId = “111111-2222222-33333″
$UPN=”adminclu@clustermvp.local”

#Sign in to Windows Virtual Desktop
Add-RdsAccount -DeploymentUrl “https://rdbroker.wvd.microsoft.com&#8221;

#New Tenant Keep in mind that Access rights need to be set before doing the next step.
New-RdsTenant -Name $tenantName -AadTenantId $AadTenantId -AzureSubscriptionId $subscriptionId
#
#Hostpool
#Create new Hostpool
New-RdsHostPool -TenantName $tenantName -FriendlyName $HPFriendlyName -name $hostpool -ValidationEnv $true
Get-RdsHostPool -TenantName $tenantName

 

When Doing these steps I already got errors not on the script but on the basic steps

image

Get-RdsTenant : User is not authorized to query the management service.

The user is global admin uber god in Azure and in the domain. Well you need to give the account that you are using for the installation access. in the Virtual Desktop APP.

image

I like to see what happened so often I use an extra Get- to see the values .

But these errors I hate them, Why can it be so hare to deploy some machines and use RDS, Well it’s a 3 fase installer.

  • Granting the Domain + subscription
  • Powershell stuff to prep things
  • Install Azure VM’s

And then the setup needs to embed in your infrastructure. Think I saw a lot of issues, during the first RDMI rollouts I thought this is complicated a created a full rollout script, but things changed during the program and at some points I could not get windows virtual desktop Installed several tries etc not good,

Tons of failure on all kind of errors samples are below.

—————————————————————————————–

VM has reported a failure when processing extension ‘joindomain’

the error is Deployment error: “VMExtensionProvisioningError”.
Details error message are:
{“code”:”DeploymentFailed”,”message”:

Operation ‘Update VM’ is not allowed on VM ‘FIBWVD-0’ since the VM is marked for deletion.

“The resource operation completed with terminal provisioning state ‘Failed’.”

statusCode”: “Conflict”,

“VM has reported a failure when processing extension ‘joindomain’. Error message:
\”Exception(s) occured while joining Domain

Error message: \\\”DSC Configuration

——————————————————————————————–

Well I have multiple Domain names added to my Azure AD and Running a VM as DC with multiple domain names.  Azure Connect syncs them to Azure AD but standard well it depends, That’s why I thought lets create a backwards blog about windows virtual desktop #WVD.

More about errors can be found here 

https://docs.microsoft.com/en-us/azure/virtual-desktop/diagnostics-role-service#common-error-scenarios

 

During all my test I noticed my Tenant Names where in use and different all meshed up. Removing them is easy but also in steps.

First my sample here

Get-RdsHostPool -TenantName ACACOMPUTERS

image

This shows you the host pools for the login user

get-RdsAppGroup -TenantName ACAComputers -HostPoolName ACA-HostPool

image

So removing the hostpool is not

Remove-RdsHostPool -TenantName ACAComputers -HostPoolName ACA-HostPool

image

That seems logical, then lets see the application groups

get-RdsAppGroup -TenantName ACAComputers -HostPoolName ACA-HostPool

image

There are Two application Groups : the default one and an extra created.

AppGroupName    : Desktop Application Group

AppGroupName    : MVP-WVD

Remove-RdsAppGroup -TenantName ACAComputers -HostPoolName ACA-HostPool -Name “MVP-WVD” –Verbose

image

even with the verbose nothing no warning no error.

Remove-RdsHostPool -TenantName ACAComputers -HostPoolName ACA-HostPool -Verbose

image

Now the Hostpool can be removed and no warning

 

image

Setting up a fresh new installation of WVD is easy, but the first setup is a bit painful but if you follow the steps you can’t go wrong.

GO to the  https://rdweb.wvd.microsoft.com Add the Azure AD ID keep in mind if you are running a CSP subscription or you are not the owner it may that your account is blocked to create enterprise apps then this will fail and you can’t setup WVD.

image

Do this for Client and Server

image

Then give the users access to the Windows Virtual Desktop App, these are the installation accounts.

image

Open the app and add users or groups.

image

 

image

Now you can sign in and start the deployment

#Sign in to Windows Virtual Desktop
Add-RdsAccount -DeploymentUrl https://rdbroker.wvd.microsoft.com

image

 

image

 

WVD service principal name Powershell

 

You can also use a service principal name

#############

Set users or Create service principal name

# create the service principal:
$aadContext = Connect-AzureAD
$svcPrincipal = New-AzureADApplication -AvailableToOtherTenants $true -DisplayName “Windows Virtual Desktop Svc Principal”
$svcPrincipalCreds = New-AzureADApplicationPasswordCredential -ObjectId $svcPrincipal.ObjectId

#Here are the three credentials you should write down and the cmdlets you need to run to get them
$svcPrincipalCreds.Value
$aadContext.TenantId.Guid
$svcPrincipal.AppId

#Set Rolassignment
New-RdsRoleAssignment -RoleDefinitionName “RDS Owner” -ApplicationId $svcPrincipal.AppId -TenantName $tenantName

#Sign in with the service principal
$creds = New-Object System.Management.Automation.PSCredential($svcPrincipal.AppId, (ConvertTo-SecureString $svcPrincipalCreds.Value -AsPlainText -Force))
Add-RdsAccount -DeploymentUrl “https://rdbroker.wvd.microsoft.com” -Credential $creds -ServicePrincipal -AadTenantId $aadContext.TenantId.Guid

image

This is All perfect But often I noticed that the WVD host where added to the domain but failed in something, the VM was fine and there was a folder with the deployment agent. and this got me thinking what If you install this on what ever OS, You could even use the WVD portal to connect to your own laptop.

 

Manual ADDING New WVD (Windows virtual desktop) Host to the Pool or a failed on.

The manual add Server to the host pool is also a process when you start with 1 server and add later extra servers to the pool.

but we will need a token to add the WVD host to the pool, like in RDS add the Role not the Role is an agent that is running on the VM

image

There are several ways to export the key I like them to capture this in screen and to the clipboard.

$WVDToken = New-RdsRegistrationInfo -TenantName $tenantName -HostPoolName $hostpool -ExpirationHours 2
$WVDToken.Token | Set-Clipboard
##
$WVDToken.Token

#When using the Clipboard then use this.
Export-RdsRegistrationInfo -TenantName $tenantName -HostPoolName $hostpool | Select-Object -ExpandProperty Token | Set-Clipboard

Now we have the key but it is only valid for 2 hours.

image

Now I go to my failed Windows 10 host and start the installation of the Agent.

image

If you don’t have the Agent installer you can download it. In this case I use a failed WVD host during deployment.

Download and install the Windows Virtual Desktop Agent.

imageimage

Use the Token in the installer

imageimage

The next installer is the bootloader 

Download and install the Windows Virtual Desktop Agent Bootloader.

image

 

imageimageimageimage

Now that the Agent and the Bootloader is installed. We need two more steps.

Download the Windows Virtual Desktop side-by-side stack and run the installer.

As a final step – Download this script to activate the side-by-side stack. Save this as powershell script “ps1” or run this directly.

image

image

After running the SxS components you and use the portal  https://rdweb.wvd.microsoft.com/webclient/index.html

image

In this setup I used the Full desktop – This is also default –

image

Running this in a Window or use the Remote app in your Windows

image

  • Download the Remote Desktop client here.
  • Install the client. You don’t need administrator privileges if you are only installing it for your own user account.
  • Open the newly installed Remote Desktop app.
  • On the Let’s get started screen, click Subscribe to subscribe to a feed.

imageimage

Installation source on a failed WVD host

image

 

[!IMPORTANT] To help secure your Windows Virtual Desktop environment in Azure, we recommend you don’t open inbound port 3389 on your VMs. Windows Virtual Desktop doesn’t require an open inbound port 3389 for users to access the host pool’s VMs. If you must open port 3389 for troubleshooting purposes, we recommend you use just-in-time VM access.

 

 

 

Follow Me on Twitter @ClusterMVP

Follow My blog https://robertsmit.wordpress.com

Linkedin Profile Robert Smit MVP Linkedin profile

Google  : Robert Smit MVP profile

Posted November 20, 2019 by Robert Smit [MVP] in Azure

Tagged with , ,

  • Twitter

  • RSS Azure and Microsoft Windows Server Blog

  • %d bloggers like this: