BEEMUG Summer Night: 05/09/2019

July 30, 2019 at 12:55 pm in Azure, beemug, eveningevent, free, Workplace&Mobility by Wim Matthyssen

 

A lot of you are still enjoying a well-earned vacation with family or friends. But we at BEEMUG are already planning our first evening event after summer, which will be held on Thursday 05/09!

clip_image002

During this evening you will have the opportunity to mingle with peers, learn something and meet your local community leaders to ask the questions you have always wanted to ask.

Following our new concept, we changed the location for the event to give everyone the opportunity to (at least once) get there without facing heavy traffic. This time we found a location in Ghent.

The formula is still straightforward and simple: we deliver one session in the field of Workplace and Mobility and one in Cloud and Datacenter with time to network in between the sessions.

The agenda for this evening:

Timeslot Speaker(s) Track
18:00u – 19:00u Welcome + Food & Drinks
19:00u – 20:00u Tim De Keukelaere
Ken Goossens
Session 1: Mobile Device Management, BYOD vs Fully managed devices
20:00u – 20:30u Pitstop
20:30u – 21:30u Wim Matthyssen
Christophe Lams
Session 2: 7 habits every Azure Admin must have
21:30u – …. Network drink

This edition, Cegeka is so kind to host the event at their office in Ghent and they will also sponsor the catering. Also, your parking ticket will be validated at the end of the evening.

clip_image004

Address:

Cegeka Business Solutions NV

Sluisweg 2 Bus 9
9000 Ghent
Belgium

 

Parking B – Ghelamco Arena (next to Brico), Cegeka offices are located at the 4th floor.

clip_image006

So please already mark your agenda’s and join us once again for a cool night out and learn something while you’re at it!

Please register via the below Eventbrite.

clip_image008

Install the Azure Portal app (Preview) to manage your Azure resources

May 8, 2019 at 4:04 pm in Azure, Azure Management, Azure Portal app, Cloud, Preview by Wim Matthyssen

In addition to the Azure Portal and the Azure mobile app, there is now another option available to access and manage all your Azure resources, namely the Azure Portal app. Although it is still in preview, it already gives you the same experience as the Azure Portal, without the need of a browser, like Microsoft Edge or Google Chrome.

This comes in handy, when for example you want to connect to the Azure Portal f from any kind of “Management server” or from a Windows client which has restrictions to use any kind of browser.

To get started you first need to browse to https://preview.portal.azure.com/app/Download and click on the Download the Azure Portal app button to start the download.

clip_image002

clip_image004

Once downloaded you need to run the AzurePortalInstaller.exe file.

clip_image006

Once installed you can now open the Azure Portal app from your Windows 10 Start menu or by opening the search icon on the taskbar and looking for azure.

clip_image008clip_image010

You need to sign in with your Azure account and when you have done that you can start using the app for managing all your Azure resources just like you are used to with the Azure Portal.

clip_image012

clip_image014

image

clip_image018

Hope you enjoy this new app, I already do.

Wim Matthyssen (@wmatthyssen)

Hyper-V: Automatic Virtual Machine Activation

March 8, 2019 at 8:25 am in Automatic Virtual Machine Activation, AVMA, Hyper-V, PowerShell, PowerShell Direct, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019 by Wim Matthyssen

 

With the release of Windows Server 2012 R2 back in 2013, Microsoft introduced a feature called Automatic Virtual Machine Activation (AVMA). AVMA handles the activation process of any of your Hyper-V virtual machines (VMs) running on a physical Hyper-V host which is properly licensed with a Windows Server Datacenter license. In this way you do not have to deal with managing the product keys for each individual VM.

The VM activation process, which binds the VMs activation to the licensed Hyper-V host, takes place during the startup process of the VM. Because the activation takes place between the VM and the Hyper-V host it resides on, you are even able to license VMs in completely isolated environments or remote locations without any Internet connection. When the guest OS is activated, it only rechecks its activation against the host until the next VM reboot, or after 7 days.

 

Requirements for AVMA

  • A Hyper-V host running a Datacenter Edition of Windows Server 2012 R2, Windows Server 2016 or Windows Server 2019. Keep in mind that if you migrate an AVMA licensed VM to a Hyper-V host which is not licensed with a Windows Server Datacenter license, the VM will become unlicensed. In this case you should replace the AVMA key in the VM with another valid non AVMA license key.
  • The Hyper-V Data Exchange Service (KVP), which is part of the Integration Services must be enabled on the VM.
  • In the VM itself the Microsoft Hyper-V Activation Component Driver should have an enabled device status and should be working properly.
  • AVMA does not work with other Virtualization Server technologies.

 

Supported Guest Operating Systems for AVMA

Only Windows Server guests are covered by AVMA. The below table shows which guests can be activated by each different Hyper-V host version. All server editions (Datacenter, Standard or Essentials) installed with Desktop Experience or Server Core can be activated.

clip_image002

*AVMA in Windows Server 2019 can also activate Windows Server version 1809, 1803 and 1709.

 

AVMA Keys

The following keys can be used to activated the specific guest operating system of a VM.

Windows Server 2019

clip_image004

Windows Server version 1809

clip_image006

Windows Server version 1803 and 1709

clip_image008

Windows Server 2016

clip_image010

Windows Server 2012 R2

clip_image012

 

Configure AVMA

1) First of all, you should verify that the Data Exchange option is enabled in the Integration Services for the VM.  To ensure this open Hyper-V Manager and right-click the VM and click on Settings…

clip_image014

2) On the Settings Windows, under Management select Integration Services and verify that Data Exchange is marked.

clip_image016

You can also use PowerShell to see if the Data Exchange service is enabled. To get a list of the running Integration Services of a VM, run the following command (replace the VM name by your own) in a PowerShell window (as Administrator) on the Hyper-V host hosting the VM:

clip_image018

To turn on the “Key-Value Pair Exchange” service when it is disabled you need to run the following command:

clip_image020

3) To install an AVMA key in a VM (in my example for a Windows Server 2019 VM), run the following command in a PowerShell window (as Administrator) on the VM.

clip_image022

*The AVMA key can also be provided during an Unattended setup using a unattend.exe setup file. In this way the key is already injected during the build phase of that particular VM.

You can also use PowerShell Direct from the Hyper-V host to activated a specific AVMA key for a VM running on the host. Open a PowerShell window (as Administrator) on the Hyper-V host and run following command:

clip_image024

clip_image026

4) You can verify the correct installation of the AVMA key, by opening All settings – Update & Security – Activation in the VM.

clip_image028

4) You can also verify the VM’s AVMA activation status on the Hyper-V host by opening the Event Viewer and searching for Event ID 12310.

clip_image030

clip_image032

clip_image034

clip_image036

I hope this blog post did learn you something about AVMA and that this feature eases your VM activation process. If you have any questions, always feel free to contact me through my twitter handle.

Wim Matthyssen (@wmatthyssen).

Azure PowerShell Error: “Your Azure credentials have not been set up or have expired, please run Connect-AzureRmAccount to set up your Azure credentials”

February 27, 2019 at 6:28 pm in Azure, Azure credentials, Azure PowerShell by Wim Matthyssen

While working on a new Azure IaaS deployment for a customer, I encountered the following error when running several Azure PowerShell cmdlets.

“Your Azure credentials have not been set up or have expired, please run Connect-AzureRmAccount to set up your Azure credentials”

clip_image002

Running the Connect-AzureRmAccount command for several times, like proposed in the error message, did not solve the problem. Neither did opening a new PowerShell window or even completely restarting my Surface laptop.

clip_image004

I finally got it fixed by running the Remove-AzureRmAccount cmdlet, which removes all credentials and contexts (subscription and tenant information) associated with that specific Azure account.

clip_image006

After executing the Remove-AzureRmccount cmdlet , and after login in again using the Login-AzureRmAccount cmdletall other cmdlets ran again like they should.

clip_image008

clip_image010

Hope this helps!

Wim Matthyssen (@wmatthyssen)

PowerShell: AzCopy download and silent installation

February 22, 2019 at 10:52 am in AzCopy, Azure, Download, PowerShell, PowerShell Script, Silent installation by Wim Matthyssen

AzCopy is a free command-line tool that is offered by Microsoft. It allows you to easily copy and transfer data (data migration) from and to Azure storage. It is designed for high performance transfers and can be deployed on both Windows and Linux systems (separate versions). AzCopy for example allows users to copy data between a file system and a storage account, or between storage accounts. Users have the possibility to select items by specifying patterns, like wildcards or prefixes, to identify the needed files for upload or download. It currently supports Microsoft Azure Blob, File and Table storage.

To automate the download and silent installation process of this useful tool, I wrote the below PowerShell script which does all of the following:

  • Create a Temp folder on the C: drive if not already available.
  • Create an AzCopy download folder in C:\Temp if not already available.
  • Download the latest Azcopy .msi (Windows) file.
  • Install AzCopy silently without any user interaction.
  • Delete the .msi file after installation.
  • Remove the AzCopy folder.
  • Exit the PowerShell window.

 PowerShell script

clip_image002

clip_image004

clip_image006

clip_image008

If you prefer you can download the complete script from the TechNet gallery.

More information and how to use AzCopy you can find over here.

This concludes this blog post, have fun using AzCopy for moving or copying data to or between storage accounts.

Wim Matthyssen (@wmatthyssen)

Hyper-V 2019: Configure antivirus exclusions in Windows Defender Antivirus

January 9, 2019 at 3:43 pm in antivirus exclusions, automatic exclusions, custom exclusions, Hyper-V, PowerShell, Windows Defender Antivirus, Windows Server, Windows Server 2019, Windows Server 2019 Hyper-V, WS2019 by Wim Matthyssen

Running a solid, constantly updated antivirus product on your Hyper-V hosts is a necessity to keep a healthy and secure virtual environment. By using Windows Defender Antivirus, the built-in antimalware solution in Windows Server 2019 you will be provided with next-gen cloud-delivered protection, which includes near-instant detection, always-on scanning and dedicated protection updates.

However, when using any antivirus software on a Hyper-V host, you also risk having issues when it is not configured properly and especially when real-time scanning (or monitoring) is enabled. This can negatively affect the overall host performance and even cause corruption of your virtual machines (VMs) or Hyper-V files.

To avoid these file conflicts and to minimize performance degradations you should implement the following recommend antivirus exclusions (directories, files and processes) on all your Hyper-V hosts, which can be found over here.

Luckily Windows Defender Antivirus automatically enrolls certain exclusions (automatic exclusions), defined by your specific server role. To determine which roles are installed on the server, Windows Defender Antivirus uses the Deployment Image Servicing and Management (DISM) tools. You should be aware that these automatic exclusions will not appear in the standard exclusion list shown in the Windows Security app.

clip_image002

Below you can find a list of the automatic exclusions for the Hyper-V role:

File type exclusions:

  • *.vhd,*.vhdx,*.avhd,*.avhdx,*.vsv,*.iso,*.rct,*.vmcx,*.vmrs

Folder exclusions:

  • %ProgramData%\Microsoft\Windows\Hyper-V
  • %ProgramFiles%\Hyper-V
  • %SystemDrive%\ProgramData\Microsoft\Windows\Hyper-V\Snapshots
  • %Public%\Documents\Hyper-V\Virtual Hard Disks

Process exclusions:

  • %systemroot%\System32\Vmms.exe
  • %systemroot%\System32\Vmwp.exe

Hyper-V Failover Cluster folder exclusions:

  • %SystemDrive%\ClusterStorage

Although the automatic exclusions include almost all recommended Hyper-V antivirus exclusions you still may need to configure additional custom exclusions. These custom exclusions will take precedence over the automatic exclusions but will not conflict if a duplicate exists.

If you prefer to disable automatic exclusions you can run the following PowerShell cmdlet.

Below you can find an additional short list of custom exclusions for a server running the Hyper-V role which you can implement if applicable to your environment. There can be even more exclusions for your specific environment.

  • Any custom virtual machine configuration or hard disk drive directories (for example E:\VMs).

clip_image004

  • Any custom replication data directories, if you’re using Hyper-V Replica.
  • The Vmsp.exe process (%systemroot%\System32\Vmsp.exe)

clip_image006

  • The Vmcompute.exe process (%systemroot%\System32\Vmcompute.exe).

clip_image008

To add these exclusions for Windows Defender Antivirus in the Windows Security app you can follow the below steps.

Open the Windows Security app by clicking the magnifier in the task bar and type defender. Select Virus & threat protection.

clip_image010

Under the Virus & threat protection settings title select Manage settings.

clip_image012

On the Virus & threat protection settings page scroll down to Exclusions setting and click on Add or remove exclusions.

clip_image014

Click Add an exclusion. Click the + icon to choose the type and set the options for each exclusion. When adding an exclusion click Yes if the User Account Control box pops up.

clip_image016

clip_image018

When all custom exclusions are added the screen will look like this.

clip_image020

To remove an added exclusion, press the down arrow next to the exclusion and click Remove.

clip_image022

You can also add these custom exclusions with the use of PowerShell (as administrator). To do so you need to run the below commands.

clip_image024

Hope this helps securing your Hyper-V hosts.

Wim Matthyssen (@wmatthyssen)

Create an Azure Monitor action group with Azure PowerShell

December 27, 2018 at 12:40 pm in action groups, automation, Azure, Azure Monitor, Azure PowerShell, beemug by Wim Matthyssen

Azure Monitor, Microsoft’s built-in monitoring service, allows you to monitor and gain more visibility into the state of your resources from a single place in the Azure portal, to help you quickly find and fix problems.

To notify users that an alert has been triggered, Azure Monitor (and also Service Health alerts) uses action groups. This feature allows an owner of an Azure subscription to group a collection of actions to take when an alert is triggered. Owners can create an action group with functions such as sending an email or SMS, as well as calling a webhook and re-use it across multiple alerts. Action groups can be created through the Azure portal, but to automate the process you can also use Azure PowerShell.

In the below example a new action group, called email-ag, is created. To use the script, copy it and adjust it for your own purpose. Save it as .ps1.

clip_image002

You can check all existing action groups in your subscription, by running the below cmdlet. In my example the previously created action group email-ag is shown.

clip_image004

Like earlier said, you can also Add, validate or manage action groups through the Azure portal by opening Monitor, selecting Alerts and selecting Manage action groups. For more information you can check out the documentation page.

clip_image006

clip_image008

Hope the script comes in handy!

Wim Matthyssen (@wmatthyssen)

Azure: Unable to connect to VMs in a peered VNet from P2S VPN

October 11, 2018 at 8:50 am in Azure, Azure Networking, Azure virtual network, P2S client, P2S VPN, RDP, VNet peering by Wim Matthyssen

These days when setting up a greenfield Azure IaaS environment for customers, we use the hub-spoke network topology with shared services. In this topology the HUB network is used as central point of connectivity and a place to host services that can be consumed by the different workloads hosted in the spoke VNets. All spokes are peered with this Hub network, to isolate all workloads. Whenever I work remotely on these environments, I mostly use a Point-to-Site (P2S) connection to securely connect to the different VNets from my client devices.

However last week while deploying a new environment for a customer, I stumbled upon a problem where I couldn’t RDP (private IP addresses) to the virtual machines (VMs) in the different spokes. The RDP access to the VM’s in the Hub VNet worked without any issues.

clip_image002

This is caused, because by design the P2S client will have routes listed for all VMs in the HUB VNet (which hosts the Virtual Network Gateway). However, even though the HUB VNet and the other VNets are connecting via peering, the P2S client will not have any routes presented in its configuration to discover the VMs in the other VNets. In order for the P2S client to be able to reach all VMs (trough for example RDP) located in the peered VNets, a static route for these VNets should be added in the routes.txt file of that specific connection. You can follow the steps below to get this working.

Solution

Open Run, type %appdata% and press Enter.

clip_image004

Open Microsoft – Network – Connections – Cm and select the right connection folder. Next, open the routes.txt file in Notepad (to open just double-click).

clip_image006

Remark

You can also find the correct path to the routes.txt file in the P2S VPN log file. You can open this file by opening your P2S connection and selecting on Properties instead of Connect. In the opened Properties page select View Log. Search for ActionPath, which will show you the location of the file.

clip_image008

clip_image010

End of remark.

In the opened routes.txt file, add the static routes for the other VNets.

For example:

ADD 10.6.0.0 MASK 255.255.240.0 default METRIC default IF default

ADD 10.7.0.0 MASK 255.255.240.0 default METRIC default IF default

ADD 10.8.0.0 MASK 255.255.240.0 default METRIC default IF default

clip_image012

Save the file, and connect again. You should now be able to RDP to all other VMs in the spoke VNets.

Hope this helps and for any questions feel free to contact me through my Twitter handle.

Wim Matthyssen (@wmathyssen)

Microsoft Ignite 2018 recap

October 4, 2018 at 9:26 am in Microsoft Ignite, Microsoft Ignite 2018, Orlando, Windows, Windows 10, Windows Admin Center by Wim Matthyssen

Last week I visited the Microsoft Ignite 2018 conference in Orlando with some colleagues. 10,000 km of walking later and sitting back her at home thinking about the past exciting week. I tought it’s a good time to write a recap, quietly hoping the writing will help battling jet lag. :)

clip_image002

After a long flight and a stopover at Dulles International Airport in Washington it was really nice that we could pick up our badge directly at the airport which spared us the morning line before the start of the event. I planned almost all my sessions I wanted to follow before the event and the MS Events app really came in handy to check my schedule, get event notifications, messages and to fill in all evaluations. The navigation function in the app also came in really handy telling me how to get from one session to another. You should know that the venue of Ignite was the OCCC, a huge complex on International Drive in Orlando, combining two conference centers and the Hyatt Regency connected together by a Skybridge.

clip_image004

The thing I was really happy about was that I wore comfortable shoes and clothes, because I did a lot of walking, really a lot of walking. I would advise if you’re ever planning to go to Ignite wear shoes were you can at least walk 10 km a day in, otherwise do not do Ignite in them! Orlando itself is a beautiful city, with a lot of theme parks like Universal Studios Florida and Universal’s Islands of Adventure, which hosted the Ignite Celebration on Thursday evening. If you ever have the chance to go there, the Wizarding World of Harry Potter is truly magical.

clip_image006

It was my first time at Ignite and my main focus was to learn as much as possible and get note of all announcements and changes around Azure, and I must say I got lots of that. Next to all Azure related sessions, I also followed a few of them around Windows Admin Center and Windows 10. For the most part, the quality of all sessions I followed was excellent only the rooms were sometimes a bit cold due to the airco.

Announcements

Below you can find some announcements, I gathered during the technical breakout and theater room sessions I followed:

  • Microsoft partners with Adobe and SAP for new Open Data Initiative.
  • Microsoft Teams Screen Sharing which allows you to screenshare in Teams without needing to escalate to a meeting first.
  • SQL Server 2019 preview announced.
  • Windows Server 2019 general availability (GA) in October, together with Windows Server version 1809.
  • Azure Firewall a stateful firewall as a service GA.
  • Windows Virtual Desktop a virtual desktop experience which lets you run Windows 10 in the cloud, available in Preview.
  • Announcement of Microsoft Learn, a new learning platform to optimise your Microsoft skills.
  • Azure SQL Database Managed Instance a new deployment model of Azure SQL Database GA.
  • Azure Blueprints in Preview, which let you define user access, policies and resources in Azure.
  • Azure Management Groups available to organise and governance all your resources between all your subscriptions.
  • Azure Resource Graph GA which allow you to easily query, explore and analyse all your Azure cloud resources at scale.
  • Azure Migrate now also supports Hyper-V.
  • Azure Monitor now includes Log Analytics and Application Insights for collecting and analysing telemetry of your cloud and on-premises resources and applications.
  • There will be 2 models of the Surface Hub 2, the Surface Hub2S coming Q2 2019 and theSurface Hub 2X coming in 2020.
  • Azure Data box, Microsoft’s heavy-duty data transfer appliance is now GA.
  • Announcement of Azure Sphere, a Linux-based operating system created by Microsoft for Internet of Things applications.

If you’re interested in getting an overview of all announcements Microsoft did at Ignite, be sure to check out this Book of News.

Session Overview

Below you can find a few sessions I followed in person and I recommend to take a look at (click the link to get to the YouTube video):

I had a lot of sessions planned in my schedule that I did not manage to attend but I will take time to watch the recordings and slides. Like every year you can catch up the session recordings that are available on YouTube or the Microsoft Tech Community, but if you’re interested you can also download all Ignite content locally with the following PowerShell script from MVP Michel de Rooij (@mderooij): https://gallery.technet.microsoft.com/Ignite-2016-Slidedeck-and-296df316

clip_image008

For everyone who could not attend Ignite in person and still want to get the chance to follow some sessions live and explore the latest cloud technologies, Microsoft has announced, Microsoft Ignite | The Tour. which takes place in a lot of cities all around the world. You can check out the schedule over here: https://www.microsoft.com/en-us/ignite-the-tour/

I want to end this blog post with saying that Microsoft Ignite rocked! It doesn’t matter if you’re an ITPro or DevOps, if you ever have the change to go there, you shouldn’t hesitate because it’s really a great and fantastic experience. In my opinion, there’s not much that Microsoft can do to improve Ignite, everything was handled like it should for such hugh event and the content was great and will keep my busy absorbing in the next few weeks. Hope to be back again in Orlando in November next year

PowerShell: BgInfo Automation script for Windows Server 2012 R2

September 17, 2018 at 10:09 am in Bg, BgInfo, Hyper-V, PowerShell, PowerShell Script, scugbe, VM Template, Windows Server, Windows Server 2012 R2, Windows Sysinternals by Wim Matthyssen

Sometime ago I already wrote a PowerShell script to install the BgInfo tool in an automated way whenever you create a VM Template or a base image (also called golden image) for a Windows Server 2016 Virtual Machine (VM) or physical server, which can be donwloaded here. More information can be found int this previous blog post: http://scug.be/wim/2017/02/23/powershell-bginfo-automation-script/

To return to the current blog post and like you can already figure out from the title, now I also wrote a script to automate the BgInfo installation and configuration for a Windows Server 2012 R2 server (VM or physical server).

This PowerShell script will do all of the following:

  • Download the latest BgInfo tool
  • Create the BgInfo folder on the C drive
  • Extract and cleanup the BgInfo.zip file
  • Download the logon.bgi file which holds the preferred settings
  • Extract and cleanup the LogonBgi.zip file
  • Create the registry key (regkey) to AutoStart the BgInfo tool in combination with the logon.bgi config file
  • Start the tool for the first time
  • Set to start up automatically whenever a user logs on to the server

 

Prerequisites

Windows PowerShell 4.0

 

PowerShell script

To use the script copy and save the above as BgInfo_Automated_WS2012_R2_v1.0.ps1, or whatever name you prefer. Afterwards run the script with Administrator privileges from the server you wish to use for your VM template or physical base image. If you want to change configuration settings, just open the logon.bgi file and adjust the settings to your preferences.

This PowerShell script can also found on the TechNet Gallery: https://gallery.technet.microsoft.com/PowerShell-BgInfo-07ade714

image

image

image

image

image

Hope this script comes in handy for you. If you have and questions or recommendations, please feel free to contact me through my twitter handle.

Wim Matthyssen (@wmatthyssen)