Book :- Implementing security for your Hyper-V and other services on Windows Server 2012 R2

I'd like to introduce and highly recommend one of the best books which was just released to the market on the topic of security on Windows Server 2012 R2. This book will:

• Provide beginner to advanced level content on the topic of security
• Include many step-by-step hands-on labs and exercises
• Include guides on how to configure commonly-used security services such as Network Access Protection, Network Policy Services, Dynamic Access Control, and many more.
• Include also contents on how to configure security for Hyper-V
• Fit also the need of those managing Windows Server 2008 (R2) environments

This book is a must-read if you care about the security of your Hyper-V and virtualization environment. This book is great for those who are tired of searching for good contents and would like to read something which is so right to the point. You can have more information about this book from here: www.windowsserversecurity.com

You can also order it directly from here  and get 50% discount till the end of October .

Slide:-Extending On-Premise Infrastructure to Cloud

 

In this session, we have talked about different scenario to use Azure Storage, Network, Compute and Disaster Recovery.

Slide

Extending On-Premise Infrastructure To Cloud from Lai Yoong Seng

Slide : Managing and Automating Hybrid Cloud Infrastructure

 

During Cloud and Enterprise Workshop at Microsoft Malaysia office, I have talked about introduction of Hybrid Cloud, managing private cloud and public cloud using System Center Suite, Hybrid Cloud Storage using Storsimple and Azure Site Recovery.

Slide

Managing and Automating Hybrid Cloud Infrastructure from Lai Yoong Seng

New SSD Based Instance for Azure VMs and Cloud Services

 

Today Microsoft has just released a new set of VM sizes for Microsoft Azure. It’s called D-Series of VM which offering faster vCPU (60% faster than A Series) and more memory (up to 112GB) and the most important is have a local SSD disk (up to 800GB) to enables much faster IO reads and writes. The following was the new set of VM sizes:-

Name	Number of vCPU	Memory (GB)	SSD Local Disk (GB)	Max IOPS
Standard_D1	1	3.5	50	500
Standard_D2	2	7	100	1000
Standard_D3	4	14	200	2000
Standard_D4	8	28	400	4000
Standard_D11	2	14	100	1000
Standard_D12	4	28	200	2000
Standard_D13	8	56	400	4000
Standard_D14	16	112	800	8000

Microsoft Migration Accelerator–Part 1

 

We just been granted access to test Microsoft Migration Accelerator (MA) in our lab environment. Currently it is in limited preview and our post today is subject to change when public release.

Let have a simple walkthrough on the Preview version of this product:-

Backend technology

It is using InMage (a company acquired by Microsoft on July 11, 2014), an innovator in the emerging area of cloud based business continuity.

Management Portal

A one stop multitenant portal which allow you to discover source and migrate the source to Azure.

Source machine can be

• Vmware
• AWS Cloud
• Hyper-V
• Physical Server

Workload should run on

• Windows Server 2008 R2
• Windows Server 2012
• Windows Server 2012 R2

How MA Works ?

Initially we thought by accessing the portal was the only step to migrate workload to Azure. However, we spent almost a day  to build the infrastructure (I’m work very slow and trying to learn as much as I can on MA). The following components are require to built before we can use MA:-

a) Master Target (MT)– VM on Azure, act as a target for replication. It is used as a target for replicating disk from source and also contains the retention data. Retention data is the log of prior changes allowing you to recover a VM to prior point in time or to a prior application consistent point. One Master Target can accommodate migration of 15 disks to Azure.

b) Configuration Server (CS)– VM on Azure. It provides user interface and feeds data from MT to MA. Regular synchronization happens between CS and MA.

c) Process Server (PS) – VM on-prem. Process Server facilitates communication between Mobility Service on source Enterprise and MT on Azure. It provides caching, queuing, compression, encryption and bandwidth management from itself to the Master Target

d) MA – multitenant portal. It allow you to discover source and migrate to Azure.

e) Mobility Service – an agent that is installed on each of the servers in source. It will capture data in real time enabling, sync selected volumes, filter all writes made to protected volumes, defining consistent bookmarks consistency points.

Our final setup screenshot on the integration between multiple components:-

Once the above components has setup, you can start by

1. Installing Mobility Services on source machine by using MA. It will push an agent into source machine.

After install Mobility Services, MA portal able to discover the applications installed on it. It can identify MS Exchange server, MS SQL server, FileServer, and SharePoint server farm.

You also can group source together before configure protection. MA simplify multi tier application migration to Azure. It will automatically orchestrates the startup order of application in Azure.

During configure Protection, you can start to protect the selected server by configure “Protect Option”. Define your replication policy (compression, encryption, master target, retention disk, retention range, etc)

It will perform the following 4 steps before creating protection job:- starting with Readiness check, then follow by configuration, prepare target and finally creating protection job.

We will stop here and will be posting Part 2 link soon after we’ve complete our testing.

Stay Tuned!

Microsoft Azure (IaaS) Cost Estimator Tool

Performing estimates on VM move to Azure is a challenge and some information is such bandwidth usage, transaction, etc is difficult to estimate. However, with Microsoft Azure (Iaas) Cost Estimator tool, we can easily scan VMM, Hyper-V Host, VMware or even physical server to collect information based on profiling duration and scanning frequency. It can run over a period of time and report resource consumption and align it to resources and VM sizes within Microsoft Azure.

As a consultant, we always need to do design and cost calculation and this tool come handy to assist us.

Here is an example, when we scan our environment when connecting to VMM.

Result after detected virtual machine from VMM. We can select which VM that we would like to move to Azure

Based on profiling and scanning frequency, it will give recommendation of VM spec when move to Azure

You can select different pricing model based on cost optimized, VM allocated and performance optimized. Each VM can be customize to select different VM sizing.

• Cost Optimized (shown above): Calculates costs based on resources profiled during the length of the scan.
• VM Allocated: Uses 100% of machines capacity (1:1 mapping of available resources or a close as it gets to an Azure VM instance) to calculate costs.
• Performance Optimized: Calculates costs at a slightly higher level of compute than VM Allocated.

You can display costing based on Azure data center location. At this moment, the tool only cater for US datacenter. Therefore for other datacenter location, the tool still can provide good recommendation in term of resource consumption and VM sizes.

To download, click here

Azure Active Directory :- Access Panel Portal

 

The Access Panel is a web based portal that allows an end user with an organization account in Azure Active Directory to view and launch cloud based application to which they have been granted access by the Azure AD administrator.

Before access to portal, you’re require to install “Access Panel Extension” and at this moment only available for

• Internet Explorer 8 or later
• Google Chrome
• Firefox browser

To access the portal, enter the url

https://myapps.microsoft.com

You can view the different of Access Panel Portal video from below.

Azure Active Directory (Free)

Note:- Click [ ] to view in full screen mode

Different:-

• Only can view Application & User Profile
• User Profile limited to change password
• No Company Branding Page

Azure Active Directory Premium

Note:- Click [ ] to view in full screen mode

Different:-

• Able to View Application, Group, Approval and User Profile
• User Profile able to change password, set multi factor authentication settings
• Company Branding page

Video Azure Active Directory : Cloud App Discovery

 

Cloud App Discovery is currently under preview. It come handy when you would like to understand your organization application usage. Once identify application used, the app able to tell you that it is part of the supported SaaS application and you can decide to integrate with Azure Active Directory.

In order for this app to discover, you’re require to install an agent into your desktop/laptop. Then Microsoft Azure AD receives and analyzes logs. Finally it will display the result on the dashboard. Below is the video that I’ve captured based on my user app usage.

Note:- Click on [ ] to view in full screen mode.

An interactive Dashboard which provides an executive summary including:

1. The total number of cloud applications discovered
2. The total number of users using these cloud applications

3. Top 10 applications discovered that can be pivoted by:

   1. Number of web requests to the application
   2. Total volume of data uploaded and downloaded.
   3. Number of unique users.
4. Usage trends over a selectable duration of time for the top 5 applications discovered.

Video:- Azure Active Directory : Multi Factor Authentication and Company Branding Page

 

This video showing the beauty of Azure Active Directory after enabled multi- factor authentication before granted access to portal and displaying company branding web page after detected AAD user account.

MFA is added as the second security authentication besides than using password. In this video, it is showing using MFA Mobile Apps which has installed on Android phone. Enjoy the demo!

Note:- Click on [ ] - Full Screen before click play.

Assign Static IP Address to Azure VM

 

In some scenario, you may want to assign static ip to Azure VM especially domain controller/ DNS VM or plan to stop at some point but retain the ip address for a particular VM. Here is step that may help to configure static IP address to Azure VM.

List down azure VM on your subscription. Type “Get-AzureVM”

Verify that a specific IP address is available before assign. Use cmdlet:- Test-AzureStaticVNetIP

Test-AzureStaticVNetIP –VNetName AzureVnet –IPAddress 10.0.1.4

Assign Static IP to a VM that you previously created. Update-AzureVM cmdlets restart the VM as part of the update process.

Get-AzureVM -ServiceName "MLABDC1" -Name "MLABDC1" | Set-AzureStaticVNetIP -IPAddress 10.0.1.4 | Update-AzureVM

To Remove a Static IP. If you would like to change another ip address, you need to execute below cmdlet to remove it first.

Get-AzureVM –ServiceName :MLABDC1” –Name “MLABDC1” | Remove-AzureStaticVNetIP | Update-AzureVM

VM will automatically get a new Dynamic IP Address after the VM restart as part of the update process.

Connect to Azure Subscription

 

1. Download and Install Azure Powershell from Web Platform Installer.

To ownload Azure Subscription information. The information is contained in a .publishsettingsfile. Open Azure Powershell and type following command

Get-AzurePublishSettingsFile

To Import the publish settings file (change to your publishsetting file that you have downloaded. the file name is different from mine)

import-azurepublishsettingsfile 'C:\temp\MSDN Platforms-Converted Windows Azure  MSDN - Visual Studio Premium-Windows Azure MSDN - Visual Studio Professional-9-6-2014-credentials.publishsettings'

To see Azure Subscription

Get-AzureSubscription

You may have multiple Azure Subscription. Before we start to use, select the correct Azure Subscription. To identify, look for “IsDefault” = True

To Select Other Azure Subscription, type the following command

select-AzureSubscription -SubscriptionName "MSDN Platforms" -Default

To verify, type get-AzureSubscription and make sure the correct subscription has listed as IsDefault=True”. Test by Get-AzureVM

Lastly, before start using make sure that you have updated the help file. It come handy when we would like to search for help on the syntax for Powershell cmdlet.

Update-Help

Comparison Between Storsimple 7020 and 8100 Model

 

Storsimple 7020 and 8100 model is an entry level hybrid cloud storage solution. In today post, we are going to compare this two entry level model to assist you on choosing which model suitable for your environment.

Hardware

Features	Storsimple 7020	Storsimple 8100
Enclosure form factor	1 X 2U	1 X 2U
Network Interface card	4 X 1 Gbps	4 X 1Gbps 2 X 10Gbps
Redundant & Hot Swappable Power Cooling Modules	Yes	Yes
Redundant Controllers	Yes	Yes
Usable Local Hard Disk Capacity	4TB	15 TB
SSD Capacity	600GB	800 GB
Effective Local Capacity (With compression & Dedup)	8-20TB	15- 75TB
Maximum capacity (including cloud)	200 TB	200 TB
Connection to server	iSCSI	iSCSI
Automatic Storage Tiering	Yes	Yes

Management

Features	Storsimple 7020	Storsimple 8100
Management	On-premise Web GUI	Azure Storsimple Manager
Multi-Device Management	No	Yes

Features/Security

Features	Storsimple 7020	Storsimple 8100
Compression	Yes	Yes
DE duplication	Yes	Yes
Encryption AES-256	Yes	Yes
High Performance	No	Yes

Data Protection

Features	Storsimple 7020	Storsimple 8100
Local Snapshot	Yes	Yes
Cloud Snapshot	Yes	Yes
Cloud Clone	Yes	No
Instant Recovery	No	Yes
Microsoft VSS Support with Consistent Backup	Yes. Using Storsimple Data Protection Console	Yes. Using Storsimple Snapshot Manager
Data Portability	Yes. With another storsimple appliance	Yes. With another storsimple appliance or Storsimple Virtual Appliance

Cloud Storage

Features	Storsimple 7020	Storsimple 8100
Cloud Storage	Supported 8 cloud storage provider.	Azure Storage

Use Cases

	Storsimple 7020	Storsimple 8100
Departmental SQL Workload	No	Yes
Storage for VM	Limited	Yes
File Shares + Archive	Yes	Yes
Archive	Yes	Yes
Supported use by backup software	Veeam Backup and Replication	Veeam Backup and Replication

Hope the above comparison table help you to decide which model is suitable for your environment.

Storsimple:- Error Code “CSA_STATUS_SYSTEM_TIME_SKEWED”

 

Scenario:-

• Receive an alert email notification mentioned that cloud connect is unreachable
• Error code “CSA_STATUS_SYSTEM_TIME_SKEWED”

Other Errors:-

======= Header ======== HTTP/1.1 403 Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature. Content-Length: 435 Content-Type: application/xml Server: Microsoft-HTTPAPI/2.0 x-ms-request-id: 4e097a3a-0001-001e-7a53-66bb0c000000 Date: Thu, 04 Sep 2014 00:23:01 GMT ======== Error ======== AuthenticationFailedServer failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature. RequestId:4e097a3a-0001-001e-7a53-66bb0c000000 Time:2014-09-04T00:23:01.8382492ZRequest date header too old:

Symptom:-

• Unable to access Storsimple via web console

Resolution:-

• To fix this issue, access to StorSimple with ssh or serial console and execute “web restart” command,
• Or reboot StorSimple appliance

Create Virtual Machine Using PDT

In this post we are going to look on another alternative way to create virtual machine. The tool that we are going to use is Microsoft Powershell Deployment Toolkit (PDT). We have modified the default PDT variable to just use it for

• Provisioning a virtual machine with different configuration
• Assign IP Address
• Join to Domain

This come handy when you just would like to provisioning several virtual machine without install any roles/application and then pass Application team for application deployment.

Pre-requisite:-

a) Windows Server 2012 R2 Hyper-V

b) Downloaded PDT from Technet Gallery:- Click here

c) Base image either Windows Server 2008 R2, Windows Server 2012 or Windows Server 2012 R2. You can refer to our previous post on how to create

• Windows Server 2012 or 2012 R2 Sysprep Image – Click here
• Windows Server 2008 R2 – click here

Note:- Just create a virtual machine, do not run downloader.ps1 and installer.ps1. In this exercise, we are “NOT” setting up System Center deployment.

Default:-

• VM Location = C:\VMs
• Virtual Processor = 2
• Computer name start with prefix = MS4U
• Dynamic memory =

Startup –1024MB
Min – 512MB
Max – 2048MB
Buffer 20%

• Virtual Switch = External
• Assign static IP starting from 192.168.168.70
• Gateway = 192.168.168.254
• DNS = 192.168.168.201
• Automatic start = nothing
• Delay = 0
• Automatic stop = Save
• DVD = None
• Additional 1 data disk =Yes

VM Name	Processor	Memory	Data Disk
TestVM1	default	default	default
TestVM2	default	Startup –1024MB Min – 512MB Max – 8192MB Buffer 5%	Create 3 additional disk with each 50GB size
TestVM3	default	Startup –2048MB Min – 2048MB Max – 2048MB Buffer 20%	default
TestVM4	default	default	default

Modify the default variable.xml or just create a new variable.xml with just below information. Example:- Create 4 Windows Server 2012 R2 Virtual Machine

<?xml version="1.0" encoding="utf-8"?> <Installer version="2.0">   <Variable Name="RegisteredUser" Value="Lab" />   <Variable Name="RegisteredOrganization" Value="MS4U Corporation" />   <Variable Name="InstallerServiceAccount" Value="icglab\!Installer" />   <Variable Name="InstallerServiceAccountPassword" Value="P@ssw0rd" />   <VMs>     <Count>4</Count>     <Default>       <Host>Localhost</Host>       <VMFolder>C:\VMs</VMFolder>       <VHDFolder>C:\VMs</VHDFolder>       <VMName>         <Prefix>MS4U</Prefix>         <Sequence>1</Sequence>       </VMName>       <Processor>2</Processor>       <Memory>         <Startup>1024</Startup>         <Minimum>512</Minimum>         <Maximum>2048</Maximum>         <Buffer>20</Buffer>       </Memory>       <NetworkAdapter>         <VirtualSwitch>External</VirtualSwitch>         <MAC>           <Prefix>00:15:5D:65:01:</Prefix>           <Sequence>4</Sequence>         </MAC>         <IP>           <Prefix>192.168.168.</Prefix>           <Sequence>70</Sequence>           <Mask>24</Mask>           <Gateway>192.168.168.254</Gateway>           <DNS>192.168.168.201</DNS>         </IP>       </NetworkAdapter>       <OSDisk>         <Parent>C:\VHD\WS12R2D.vhdx</Parent>         <Type>Copy</Type>       </OSDisk>       <DataDisks>         <Count>1</Count>         <Format>VHDX</Format>         <Size>50</Size>       </DataDisks>       <DVD>False</DVD>       <AutoStart>         <Action>Nothing</Action>         <Delay>0</Delay>       </AutoStart>       <JoinDomain>         <Domain>icglab.local</Domain>         <Credentials>           <Domain>icglab.local</Domain>           <Password>P@ssw0rd</Password>           <Username>administrator</Username>         </Credentials>         <OrganizationalUnit>Computers</OrganizationalUnit>       </JoinDomain>       <AdministratorPassword>P@ssw0rd</AdministratorPassword>     </Default>     <VM Count="1">       <VMName>TestVM1</VMName>     </VM>     <VM Count="2">       <VMName>TestVM2</VMName>       <Memory>         <Startup>1024</Startup>         <Minimum>512</Minimum>         <Maximum>8192</Maximum>         <Buffer>5</Buffer>       </Memory>       <DataDisks>         <Count>3</Count>         <Format>VHDX</Format>         <Size>50</Size>       </DataDisks>     </VM>     <VM Count="3">       <VMName>TestVM3</VMName>       <Memory>         <Startup>2048</Startup>         <Minimum>2048</Minimum>         <Maximum>2048</Maximum>         <Buffer>20</Buffer>       </Memory>     </VM>     <VM Count="4">       <VMName>TestVM4</VMName>     </VM>   </VMs> </Installer>

Output when execute VMCreator.ps1:-

Above script will create:-

• Generation 1 VM. To modify to generation 2 VM, on the default section, do add

<VMGeneration>2</VMGeneration>

• If your base image is dynamic disk, then the target VM will be dynamic disk as well. By default, the script is using differencing disk.

<Parent>C:\VHD\WS12R2D.vhdx</Parent>
<Type>Copy</Type>

• The <Count>4</Count> must match to the end value of VM Count :-

<VM Count="4">

Please feel free to modify the script according to your environment.