Archive for the ‘Windows 10’ Tag

Step by Step Azure NAT Gateway – Static Outbound Public IP address #ANG #NAT #WVD #Azure #Security #Cloud #MVPBuzz #AzOps #ITPRO #VirtualNetworks #PowerShell   Leave a comment

There a several ways on using an external IP in Azure, What method to use is up to you. Remember there is no good or wrong but only different opinions or insights on how to use it.

Public IP addresses allow Internet resources to communicate inbound to Azure resources. Public IP addresses also enable Azure resources to communicate outbound to Internet and public-facing Azure services with an IP address assigned to the resource. The address is dedicated to the resource, until it is unassigned by you. If a public IP address is not assigned to a resource, the resource can still communicate outbound to the Internet, but Azure dynamically assigns an available IP address that is not dedicated to the resource.

Some of the resources you can associate a public IP address resource with are:

  • Virtual machine network interfaces
  • Internet-facing load balancers
  • VPN gateways
  • Application gateways
  • Azure Firewall
  • NAT Gateway

Matching SKUs must be used for load balancer and public IP resources. You can’t have a mixture of basic SKU resources and standard SKU resources. You can’t attach standalone virtual machines, virtual machines in an availability set resource, or a virtual machine scale set resources to both SKUs simultaneously.

Virtual Network NAT (network address translation) simplifies outbound-only Internet connectivity for virtual networks. When configured on a subnet, all outbound connectivity uses your specified static public IP addresses. Outbound connectivity is possible without load balancer or public IP addresses directly attached to virtual machines. NAT is fully managed and highly resilient.

image

So this is only for the Outbound connection. why not use the Resource group IP this is also “static” ? using this IP means that al VM’s must be in the same resource group and when the resource group changed the IP is also changing.

image

NAT is compatible with standard SKU public IP address resources or public IP prefix resources or a combination of both. You can use a public IP prefix directly or distribute the public IP addresses of the prefix across multiple NAT gateway resources. NAT will groom all traffic to the range of IP addresses of the prefix. Any IP whitelisting of your deployments is now easy.

So How to implement this. a step by step guide. GUI and powershell Looking at my demo setup, There are 2 vm’s both in a different Resource group.

Setting up the NAT gateway is done by 3 tabs to fill in the name and what vnet to use

https://robertsmit.wordpress.com/

We add a new NAT gateway.

image

We create a new resource group and choose NAT gateway name.

The Timeout we leave this on 4 min for now.

image

We configure an external IP and with a standard SKU. Basic is not supported.

image

the next step is choose the External outbound IP pool minimal is 2 and max is 256. this is not needed but only if you want to have a pool of External IP’s else it just go the one external ip

image

you can select max 2 prefixes

image

Configure which subnets of a virtual network should use this NAT gateway. Subnets with Basic load balancers or virtual machines that are using a Basic public IP are not compatible and cannot be used.
Note: While you do not have to complete this step to create a NAT gateway, the NAT gateway will not be functional until you have added at least one subnet. You can also add and reconfigure which subnets are included after creating the NAT gateway.

image

in the last step we tag the NAT gateway to a subnet. When checking the VM’s on this subnet for the outbound IP ( remember the VM does not need a public IP on the network card)

image

Here I have 2 VM’s getting both an IP from the prefix

imageimage

If there is only a small prefix then both machines will get the same external outbound IP

imageimage

With this time flow it recycles the External IP, depending on the scope and usage.

image

So in just a few steps you can use a useful gateway for all your outbound traffic.

Building this in Powershell is also easy. I use a semi automatic script as I want to choose my network. but you can change this to a fixed network if you want.

remember this will need the az.network latest module. in the old modules there is no get-AzNatGateway command. without this the posh is not working.

First we have some parameters

# Set the variables for the NAT Gateway.
$rg = ‘rg-rsm-natgw001’
$Location = ‘Westeurope’
$sku = ‘Standard’
$PublicIpname = ‘pup-rsm-natgw001’
$Publicprefixname = ‘pxp-rsm-natgw001’
$NatGatewayname=’gwn-rsm-natgateway001′

#create Rsource group
New-AzResourceGroup -Name $rg -Location $Location 

image

First we make some external IP and or a range.

#create Standard SKUP public IP
$publicIP = New-AzPublicIpAddress -Name $PublicIpname -ResourceGroupName $rg -AllocationMethod Static -Location $Location -Sku $sku
$publicIP | Select-Object Name, ResourceGroupName, IpAddress, IdleTimeoutInMinutes, ProvisioningState

https://robertsmit.wordpress.com

With the Zone attribute you can create zone redundancy, but this is not needed for this resource.

#create  IP prefix ( how many IP’s are needed)
$publicIPPrefix = New-AzPublicIpPrefix -Name $Publicprefixname -ResourceGroupName $rg -Location $Location -PrefixLength 29

$publicIPPrefix | Select-Object Name, IPPrefix, PrefixLength, ProvisioningState

image

You can skip this if you want only one external IP.

Next is creating the gateway.


#Create NAT gateway
$natGateway = New-AzNatGateway -Name $NatGatewayname -ResourceGroupName $rg -PublicIpAddress $publicIP -PublicIpPrefix $publicIPPrefix -Location $Location -Sku $sku -IdleTimeoutInMinutes 4
$natGateway  | Select-Object Name, ResourceGroupName, IdleTimeoutInMinutes , SKuText | Format-table -autosize –wrap

image

Now that the Gateway is created we can add a subnet to this. I used a point an click so that I can choose the network and subnet. but you can also use a variable to do this.

$virtualNetwork = Get-AzVirtualNetwork | Out-GridView -PassThru -Title "Pick the vnet that will be used for the NAT gateway"

https://robertsmit.wordpress.com

$NATSubnet = Get-AzVirtualNetworkSubnetConfig -VirtualNetwork $virtualNetwork | Out-GridView -PassThru -Title "Pick the Subnet that will be used for the NAT gateway"

image

$NATSubnet.NatGateway = $natGateway
$virtualNetwork | Set-AzVirtualNetwork

The network is chosen and the subnet is selected.

In the Azure portal you can see the result.

https://robertsmit.wordpress.com

 

Follow Me on Twitter @ClusterMVP

Follow My blog https://robertsmit.wordpress.com

Linkedin Profile Robert Smit MVP Linkedin profile

Google  : Robert Smit MVP profile

 

Posted June 2, 2020 by Robert Smit [MVP] in Azure

Tagged with , ,

Installing tenant attach with Microsoft Endpoint Configuration Manager Update 2002 #MEMCM #MEMAC #ConfigMgr   Leave a comment

At MSIgnite 2019 was announced that SCCM is now MEMCM and that Intune and MEMCM can be managed in one portal. With the update 2002 this option is finally there.  Microsoft Endpoint Manager is an integrated solution for managing all of your devices. Microsoft brings together Configuration Manager and Intune into a single console called Microsoft Endpoint Manager admin center.

Where to start with Microsoft Endpoint Configuration Manager for this update.

Installing tenant attach with Microsoft Endpoint Configuration Manager Update 2002

http://endpoint.microsoft.com/

When opening the Microsoft Endpoint Configuration Manager console the update is not there. this is the update is released in Rings and I want to download this update from the fast ring. When starting this make sure your servers are healthy and are patched. If you run a tight virus scanner on the MEMCM then you may need to disable this during the install

Installing tenant attach with Microsoft Endpoint Configuration Manager Update 2002

 

Microsoft Endpoint Configuration Manager

 

As the update is rolled out globally in the coming weeks, it will be automatically downloaded, and you’ll be notified when it’s ready to install from the “Updates and Servicing” node in your Configuration Manager console. If you can’t wait to try these new features, see these instructions on how to use the PowerShell script to ensure that you are in the first wave of customers getting the update. By running this script, you’ll see the update available in your console right away. 

https://download.microsoft.com/download/7/c/4/7c48f2c7-f433-414b-a901-753a61c7956d/EnableEarlyUpdateRing2002.exe

Microsoft Endpoint Configuration Manager

After downloading and extracting the file we have a PowerShell script

image

Running this Powershell script in Admin Mode. With the Server name and I do a verbose to see a bit more output.

C:\EnableEarlyUpdateRing2002> .\EnableEarlyUpdateRing2002.ps1 -siteServer mvpsccm17 -Verbose

Microsoft Endpoint Configuration Manager

C:\EnableEarlyUpdateRing2002> .\EnableEarlyUpdateRing2002.ps1 -siteServer mvpsccm17 –Verbose

Now that the Script has run the Update services will trigger the fast ring to get the update

image

Press check for updates and do a refresh.

Microsoft Endpoint Configuration Manager

The Microsoft Endpoint Configuration Manager update 2002 is now available for download.

Microsoft Endpoint Configuration Manager

imageimage

Now that the Update is downloaded we can trigger the Install.

Microsoft Endpoint Configuration Manager

This Process is a Next Next Close wizard and the only choice you need to make is run the agent in a test collection or strait into production

imageMicrosoft Endpoint Configuration Manager

Here you have the option to test this update in an isolated Collection.

image

In this case I go strait into the production as this is my demo lab server

imageMicrosoft Endpoint Configuration Manager

I Accept and my end date of the SA.

Microsoft Endpoint Configuration Manager Microsoft Endpoint Configuration Manager

Well this was a pretty strait forward process now in the back ground Microsoft Endpoint Configuration Manager is updating the servers.

image

The progress can be followed in the log files when go to status the logs will be opened.

image

when the preparations are done Microsoft Endpoint Configuration Manager will start the installation. This can take some time so be patient. Don’t do a sudden reboot etc.

image

If you had a pending reboot the installation will fail, Reboot the server first then do the update.

image

Or check the Task Manger when the update is finished.

image

When the Update is Finished and opening the Microsoft Endpoint Configuration Manager Admin Console The update of the console is triggered and need to install.

 image

image

image

The update is installed. and we can configure Co-Management

imageimage

The default setting for device upload is All my devices managed by Microsoft Endpoint Configuration Manager. If needed, you can limit upload to a single device collection.

image I choose Allimage

imageimageimageimageimage

Now that the installation is finished we can see the connector.

image

You can verify this in the Azure AD there is an app registration called ConfigMgrSvc

image

 

  1. Open CMGatewaySyncUploadWorker.log from <ConfigMgr install directory>\Logs.
  2. The next sync time is noted by log entries similar to Next run time will be at approximately: 04/02/2020 11:45:05

image

  1. For device uploads, look for log entries similar to Batching N records. N is the number of devices uploaded to the cloud.
  2. The upload occurs every 15 minutes for changes. Once changes are uploaded, it may take an additional 5 to 10 minutes for client changes to appear in Microsoft Endpoint Manager admin center. http://endpoint.microsoft.com/

In a browser, navigate to http://endpoint.microsoft.com/  or https://aka.ms/memac

below You see only MEMAC

image

When the Machines are Hybrid AD joined you can see both devices. the sync take some time.

image

This is the start to manage the devices from MEMAC. In the next blog I’ll show you more on the management.

 

Follow Me on Twitter @ClusterMVP

Follow My blog https://robertsmit.wordpress.com

Linkedin Profile Robert Smit MVP Linkedin profile

Google  : Robert Smit MVP profile

Celebrate World Backup Day & WIN with #Altaro!   Leave a comment

 

Celebrate World Backup Day & WIN with Altaro!

We all remember how grateful we were to have backup software when facing so many data loss mishaps and near-catastrophes.

clip_image002

If you manage your company’s Office 365 data, celebrate this World Backup Day with Altaro. All you have to do is sign up for a 30-day free trial of Altaro Office 365 Backup. If you share your biggest backup mishap with them, you get a chance to WIN one of the Grand Prizes:

· DJI Mavic Mini Drone FlyCam Quadcopter,

· Google Stadia Premiere Edition,

· Ubiquity UniFi Dream Machine

· Logitech MX Master 3 Advanced Wireless Mouse.

And guess what? For any eligible subscription they give you a guaranteed Amazon voucher!

What are you waiting for? Sign up now!

Good luck & happy World Backup Day!

 

 

Follow Me on Twitter @ClusterMVP

Follow My blog https://robertsmit.wordpress.com

Linkedin Profile Robert Smit MVP Linkedin profile

Google  : Robert Smit MVP profile

Share this:

Posted March 19, 2020 by Robert Smit [MVP] in Altaro

Tagged with

Windows 10 version 1903 May update prepair Windows Update Delivery Optimization #Windows10 #ConfigMgr #DO #DeliveryOptimization #Waas #WUDO   Leave a comment

With the up coming Windows 10 1903 version you better be prepared, and save some bandwidth by setting up the right settings like Delivery Optimization. https://blogs.windows.com/windowsexperience/2019/04/08/releasing-the-may-2019-update-to-the-release-preview-ring/#XSwellpKSbo6oeum.97

What is Delivery Optimization ?

Windows Update Delivery Optimization helps you get Windows updates and Microsoft Store apps more quickly and reliably.

In many business networks, downloading apps and updates can be slow, inefficient, and, in many markets, expensive. When speaking with our customers, we often hear that they have regional facilities in limited and/or metered markets where devices download the same content, redundantly impacting coveted bandwidth and, ultimately, the organization’s financial bottom line. In almost any network, Delivery Optimization can be a highly effective tool, efficiently delivering content to devices and reducing the need for more internet bandwidth.

Delivery Optimization for Windows 10

Windows Update Delivery Optimization works by letting you get Windows updates and Microsoft Store apps from sources in addition to Microsoft, like other PCs on your local network, or PCs on the Internet that are downloading the same files. Delivery Optimization also sends updates and apps from your PC to other PCs on your local network or PCs on the Internet, based on your settings. Sharing this data between PCs helps reduce the Internet bandwidth that’s needed to keep more than one device up to date or can make downloads more successful if you have a limited or unreliable Internet connection.

When Windows downloads an update or app using Delivery Optimization, it will look for other PCs on your local network (or from the Internet, depending on your settings) that have already downloaded that update or app. Windows doesn’t download the entire file from one place. Instead, the download is broken down into smaller parts. Windows then gets parts of the update or app from the PCs that have it, and parts from Microsoft. Windows uses the fastest, most reliable download source for each part.

Delivery Optimization creates a local cache, and stores files that it has downloaded in that cache for a short period of time.

you can turn this on in the update settings of Windows 10

Delivery Optimization for Windows 10

But there is also a GPO control that can be used. But you need the latest ADMX files in your PolicyDefinitions folder. If you are uncertain if you have the latest file check here to get the files

Administrative Templates (.admx) for Windows 10 October 2018 Update (1809)

https://www.microsoft.com/en-us/download/details.aspx?id=57576

Delivery Optimization for Windows 10Delivery Optimization for Windows 10

With this GPO setting you can control the settings for Delivery Optimization

Delivery Optimization for Windows 10Delivery Optimization for Windows 10

All these settings depends on your need and how your network is configured.

You can also use Delivery Optimization with SCCM. Microsoft recommends that you optimize Windows 10 quality update delivery using Configuration Manager with express installation files and a peer caching technology

image

the SCCM client settings

Delivery Optimization for Windows 10

above a good overview on the difference between the different caching options.

To get some details on the caching there are some history charts and activity charts. these are depending on the system.

Delivery Optimization for Windows 10image

In this case these are just my lab machines so no big improvements here, and the machines are redeployed etc so for graphs not the best show models.

Delivery Optimization for Windows 10Delivery Optimization for Windows 10

other adjustments can be made on cache settings or bandwidth, 

Get-DeliveryOptimizationStatus

Delivery Optimization for Windows 10

Get-DeliveryOptimizationPerfsnap
Get-DeliveryOptimizationPerfsnapThisMonth

Delivery Optimization for Windows 10

Recommended Setting for Delivery Optimization  Quick-reference table   

Quick-reference table:

Use case Policy Recommended value Reason
Hub & spoke topology Download mode 1 or 2 Automatic grouping of peers to match your topology
Sites with > 30 devices Minimum file size to cache 10 MB (or 1 MB) Leverage peers-to-peer capability in more downloads
Large number of mobile devices Allow uploads on battery power 60% Increase # of devices that can upload while limiting battery drain
Labs with AC-powered devices Content Expiration 7 (up to 30) days Leverage devices that can upload more for a longer period


 

More info about Delivery-Optimization can be found here : https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Delivery-Optimization-Scenarios-and-configuration-options/ba-p/280195

 

 

Follow Me on Twitter @ClusterMVP

Follow My blog https://robertsmit.wordpress.com

Linkedin Profile Robert Smit MVP Linkedin profile

Google  : Robert Smit MVP profile

Posted April 12, 2019 by Robert Smit [MVP] in Windows Server 2019

Tagged with

Welcome to Olympia Set up your own Windows Insider Lab for Enterprise #Olympia #Office365 #EnterpriseMobility #WindowsServer #Microsoft #Azure #WindowsInsiders #SCCM   2 comments

 

Olympia V2 is the next step for enabling Windows Insiders to try new and pre-release Windows 10 Enterprise features. Windows Insider Lab for Enterprise v2 provides a complete Microsoft 365 deployment and management testing environment that can be run directly on your own machines. The lab features both client and administrative functionality, including System Center Configuration Manager Preview plus connectivity to Office 365 and Enterprise Mobility Security evaluation trials. Customers can also add the latest Windows 10 Insider Preview Enterprise build to the lab. 

This is a great lab toolkit, to start with the new features. It is easy to setup with a great learning curve.

First we download the entire Lab. it around 14GB

The table below lists the virtual machines, which will be imported and created in Hyper-V:

Server Name

Roles & Products

HYD -DC1

Active Directory Domain Controller, DNS, DHCP, Certificate Services

Windows Server 2016

HYD-CM1

System Center Configuration Manager Technical Preview Branch – Version 1808 (Note: After installing a baseline version, you can then use in-console updates to bring your installation up-to-date with the most recent preview version. See Section 4.)

Windows Deployment Services

Microsoft Deployment Toolkit

Windows 10 ADK

Windows Software Update Services

Microsoft SQL Server 2014

Windows Server 2016

HYD-APP1

Microsoft BitLocker Administration and Monitoring

Microsoft SQL Server 2014

Windows Server 2016

HYD-GW1

Remote Access for Internet Connectivity

Windows Server 2016

HYD-CLIENT1 (Optional)

If the Windows 10 Insider Preview ISO image is imported, this machine will be created with windows installed and will be Domain Joined

HYD-CLIENT2 (Optional)

If the Windows 10 Insider Preview ISO image is imported, this machine will be created with windows installed and will be Domain Joined

HYD-CLIENT3 (Optional)

If the Windows 10 Insider Preview ISO image is imported, this machine will be created with windows installed and will be on Workgroup

HYD-CLIENT4 (Optional)

If the Windows 10 Insider Preview ISO image is imported, this machine will be created with windows installed and will be on Workgroup

The VM list in Hyper-v

image

The table below lists the credentials and access type available in the default implementation:

Windows Insider Lab for Enterprise

After that just extract the files, keep in mind the setup extract the files at the current location of the setup files. You can move the VM’s afterwards

Windows Insider Lab for Enterprise

Starting the setup and extracting the VM’s

Windows Insider Lab for Enterprise

Select your Vswitch on the Hyper-v server

Windows Insider Lab for Enterprise

Select a insiders ISO or download one,

Windows Insider Lab for Enterprise

Plenty of room in the Windows Server 2019 Hyper-v server with Storage Spaces direct.

Windows Insider Lab for Enterprise

The extracting can take up some time depends on the disks and CPU speed for extraction

Windows Insider Lab for EnterpriseWindows Insider Lab for Enterprise

After the Extraction Several VM’s are added to the Hyper-v Server

image

The Gateway will route all the data to internet.

image

Windows Insider Lab for Enterprise

The setup is done the full lab is installed, there are several laps that you can do and setup

image

Windows Insider Lab for Enterprise

The domain structure that is created is the basic for all the labs

Windows Insider Lab for Enterprise

A SCCM site is created and ready for use. As this is the Technical preview I already got the 1812 Build

Windows Insider Lab for Enterprise

 

image

In the Azure Active directory we set some custom pictures.

image 

image

Customize these screens is easy done in the Azure portal

image

Next step is use SCCM and Intune to manage your systems. This lab is perfect for showing all the options.

 

The Setup is Complete and ready to use, this lab is a great way to self explore the new features.

     Lab Objectives

This guide is designed to provide step-by-step guidance in demonstrating the basic functionality of the feature.

·         Lab Setup

o   On-Premises Environment

o   Cloud Environment

o   On-Premises Environment Post Setup Manual Steps

·         Servicing

o   Windows Analytics Update Compliance

·         Deployment & Management

o   Modern Device Deployment

o   Modern Device Management with AutoPilot

o   Co-Management

o   Modern Application Management with Intune

o   Enterprise State Roaming

·         Security

o   Windows Information Protection

o   Windows Defender Advanced Threat Protection

o   Windows Defender Application Guard

o   Windows Defender Exploit Guard

o   Windows Hello

o   Credential Guard

o   Device Encryption (MBAM)

o   Device Guard – User Mode Code Integrity

·         Compatibility

o   Windows Analytics Upgrade Readiness

o   Browser Compatibility

o   Desktop Bridges

·         Additional Labs

o   MDM WINS over GP

o   MAM FAQ

The Windows Insider Lab for Enterprise was designed for Windows Insiders who want to try new experimental and pre-release Enterprise Privacy and Security features. There are two versions of the lab:

· Windows Insider Lab for Enterprise v1 – provides a client-side view of the latest Microsoft 365 enterprise features through access to Olympia Corp – a virtual corporation has been set up to reflect the IT infrastructure of real world business. 

· Windows Insider Lab for Enterprise v2 – provides a complete Microsoft 365 deployment and management testing environment that can be run directly on your own machines. The lab features both client and administrative functionality, including System Center Configuration Manager Preview plus connectivity to Office 365 and Enterprise Mobility + Security evaluation trials.

 

Follow Me on Twitter @ClusterMVP

Follow My blog https://robertsmit.wordpress.com

Linkedin Profile Robert Smit MVP Linkedin profile

Google  : Robert Smit MVP profile

Posted January 8, 2019 by Robert Smit [MVP] in Azure

Tagged with , ,

  • Twitter

  • RSS Azure and Microsoft Windows Server Blog

  • %d bloggers like this: