Cloud and Datacenter Management Blog

Microsoft Hybrid Cloud blogsite about Management


Leave a comment

Windows Admin Center 21.10 Packet Monitoring Preview Extension #WAC #Winserv

Windows Admin Center Packet Monitoring

Packet monitoring allows you to diagnose your server by capturing and displaying network traffic through the networking stack in a log that is filtered, organized, and easy to follow and manipulate.​

Download Windows Admin Center Here

Filter the Captured packets by PacketMon.

Before you start the capture you can set the filter, with great options and see differences between two IP-Addresses for example.

Capture is running.

You can explore every packet in details for trouble shooting.

You can save your Captures for later.

Conclusion

A great tool for trouble shooting in Windows Admin Center 21.10 with Packet Monitoring (preview) to get the bits and bytes in detail.


Leave a comment

Windows Admin Center 21.10 Build 1.3.2111.01001 Secured-Core #Security #WindowsAdminCenter

Windows Admin Center Security

Secured-core – recommended for the most sensitive systems and industries like financial, healthcare, and government agencies. Builds on the previous layers and leverages advanced processor capabilities to provide protection from firmware attacks.

In Windows Admin Center Security you can Configure Secured-Core :

Secured-Core in Windows Admin Center 21.10

You can activate 6 secured-Core feature :

  • Hypervisor Enforced Code Integrity (HVCI)
  • Boot DMA Protection
  • System Guard
  • Secure Boot
  • Virtualization-based Security (VBS)
  • Trusted Platform Module 2.0 (TPM2.0)

You now can simply activate the Security Feature.
Needs a Reboot

Hypervisor Enforced Code Integrity (HVCI) is enabled.

More information about Secured-Core Features

Windows Admin Center Community on LinkedIn


Leave a comment

What’s New in Windows Server 2022 Security! #Winserv #Security #WindowsServer2022 #SecOps

Microsoft Security Compliance Toolkit 1.0

The Microsoft Security Configuration Toolkit enables enterprise security administrators to effectively manage their enterprise’s Group Policy Objects (GPOs).  Using the toolkit, administrators can compare their current GPOs with Microsoft-recommended GPO baselines or other baselines, edit them, store them in GPO backup file format, and apply them via a domain controller or inject them directly into testbed hosts to test their effects. For more information, see Windows Security Baselines.

 

Baseline security policies for Windows Server 2022.

But what’s new in Microsoft Windows Server 2022?

Here we have some new Windows Server 2022 security features :

  • Secured-core server

  • Hardware root-of-trust

  • Firmware protection

  • Virtualization-based security (VBS)

  • Secure connectivity

    • Transport: HTTPS and TLS 1.3 enabled by default on Windows Server 2022

    • Secure DNS: Encrypted DNS name resolution requests with DNS-over-HTTPS

    • Server Message Block (SMB): SMB AES-256 encryption for the most security conscious

    • SMB: East-West SMB encryption controls for internal cluster communications

    • SMB over QUIC

  • Azure Arc enabled Windows Servers

  • Windows Admin Center

  • Azure Automanage – Hotpatch

You can read more information on these topics on Microsoft Docs

Windows Server 2022 security features

In the following steps you will see some of the security features of Microsoft Windows Server 2022.

When your Windows Server 2022 is running on a Hypervisor like Hyper-V, you can set Memory integrity under Windows Security to ON.
This prevents attacks from inserting malicious code into high security processes. When you set this security feature on, the Server needs a reboot to activate.
Memory Integrity needs a reboot.

Windows Security Notifications.

By default Virus & Threat protection notification is active, when you want notifications about Microsoft defender firewall blocking a new application, you have to turn this feature on and select the firewalls.

In Windows security we have also ransomware protection. 
Protect your files against threats like ransomware, and see how to restore files in case of an attack.
You can do this by Controlled folder access.
Protect files, folders and memory on your Server from unauthorized changes by software.

Protected folders.

New in Windows Server 2022 is Tamper protection in Windows Security.
This Prevents others from tampering with important security features.

 

This was all Microsoft Windows Server 2022 security in the VM, but how about your Windows Server 2022 Hyper-V Hypervisors?

Hypervisor-protected Code Integrity (HVCI) is a virtualization based security (VBS) feature available in Windows. In the Windows Device Security settings, HVCI is referred to as Memory Integrity.

HVCI and VBS improve the threat model of Windows and provide stronger protections against malware trying to exploit the Windows Kernel. VBS leverages the Windows Hypervisor to create an isolated virtual environment that becomes the root of trust of the OS that assumes the kernel can be compromised. HVCI is a critical component that protects and hardens this virtual environment by running kernel mode code integrity within it and restricting kernel memory allocations that could be used to compromise the system.

See Virtualization Based Security System Resource Protections for more details on these protections.

 

Here you find a great video with a session of Jeff Woolsey Principal Program Manager at Microsoft. It’s all about What’s new in Windows Server 2022.

Conclusion

Start with Microsoft Windows Server 2022 today and make your test environment to play with Windows Server 2022 and Security.
Make your core business application solution more secure then ever, and let a ethical hacker do pen tests on your solution.
When you have security by default in your architectural designs, and test your Windows Server 2022 for production workloads it makes a big different to keep your environment and solution safe. And when you monitor your Windows Server 2022 solution pro-active with Azure Monitor, Azure Security Center, Azure Defender like this with Azure Arc enabled Servers

This keeps you in Control on Security by design for your business.


Leave a comment

JOIN Microsoft Ignite 2021 Event November 2-4 #MSIgnite #Azure #Winserv #Windows11 #Hybrid

Microsoft Ignite 2021

Join Microsoft and the Community November 2–4, 2021 to explore the latest tools, training sessions, technical expertise, networking opportunities, and more. You can register here

Here you find some great MSIgnite guidance on Microsoft Tech Community :

Check out what’s new in Security at Microsoft Ignite

Surface at Microsoft Ignite: November 2021

Your Guide to Microsoft Teams at Microsoft Ignite Fall 2021

Windows at Microsoft Ignite: November 2021

A developer’s guide to Ignite 2021

Bring Azure Kubernetes Services to a Hybrid Environment (The Blueprint Files)

Follow @MS_Ignite on Twitter

Of course you can make your own schedule from the session catalog here

Don’t forget your Registration and have a Great innovative Microsoft Ignite 2021 Event 😉

 


Leave a comment

Follow #Microsoft Windows 11 Insider Preview program by Video #WindowsInsiders #WIMVP #Windows11

Watch how Windows 11 is being designed

Are you exited as I am about the New Microsoft Windows 11 Insider preview builds on your device? The Microsoft Windows Insider Program team is keeping you up-to-date about the new features in Windows 11 Insider Preview Build by videos on YouTube.
You can find the Windows Insider Channel here

When you like to start testing new features with Windows 11 Insider Preview Build, you can become a Windows Insider to get started

Before you register as a Windows Insider, It’s important how you want to fly with new releases and or updates of Windows 11 Insider Preview Build. This because there are different Channels and they are explained well at this site.
( Read this first before you begin)

The Windows Insider Program Team is really active on Twitter, I advice you to follow them:

Jason Howard

Amanda Langowski

Brandon LeBlanc

Eddie Leonard

Jen Gentleman

And of course the Windows Insider Program it self on Twitter : @WindowsInsider

Conclusion so far

I Like Windows 11 Insider Preview Build very much. As a Datacenter Administrator I like the New Windows Terminal under the Start button with a right click. The look and feels of Windows 11 Insider Preview Build is awesome and the Microsoft Windows Team did a lot of work to make configuring Windows 11 Insider Preview Build as easy as possible for the end-users. I wish you a lot of fun as a Windows Insider and don’t forget to give your Feedback in the Feedback Hub of Windows Insider.


Leave a comment

Windows Server Insider 2022 Datacenter Azure version #WindowsInsiders #WIMVP #Azure #Winserv

Installing Windows Server Insider Datacenter Azure Edition

In my last blogpost we installed Windows 11 Insider Preview Enterprise Build on a Microsoft Azure Virtual Machine. Now we do the same with Windows Server 2022 Insider build version on Microsoft Azure Cloud.

IMPORTANT

This blogpost is for testing only and not ready for production environments yet!

Before you Search for the Windows Server Insider Preview image, you need some preview features added to your azure subscription first. Here you find more information

One of the features is Inquest Hot patching, which we activate via Azure Cloud Shell with Bash Azure CLI :

az feature register –namespace Microsoft.Compute –name InGuestHotPatchVMPreview
az feature register –namespace Microsoft.Compute –name InGuestAutoPatchVMPreview
az feature register –namespace Microsoft.Compute –name InGuestPatchVMPreview

Register via Azure CLI with these commands.

Feature registration can take up to 15 minutes. To check the registration status:

az feature show –namespace Microsoft.Compute –name InGuestHotPatchVMPreview
az feature show –namespace Microsoft.Compute –name InGuestAutoPatchVMPreview
az feature show –namespace Microsoft.Compute –name InGuestPatchVMPreview

When registration is done, you will see this message.

Once the feature has been registered for your subscription, complete the opt-in process by propagating the change into the Compute resource provider.

Type the following Azure CLI commandline :

az provider register –namespace Microsoft.Compute

Now your Microsoft Azure Subscription is ready for the new Features with the Windows Server 2022 Insider Preview Datacenter Azure Edition Build.

You need the Core edition when you want to try hotpatching.
and you need to be a Windows Server Insider.

Here you can Register for the Windows Server Insider Program

Create the Virtual Machine.

Add Storage to your Virtual Machine.
Because it’s for testing only I selected SSD.

Set your network settings.

Set Management settings like Hotpatch Preview.

At Advanced tab you can add Extensions and Custom scripts.
Click on Review + Create

Validation is passed, Click on Create and the
Windows Server Insider 2022 Datacenter Azure Edition will deploy.

IMPORTANT

Check the Network Security Group (NSG) of the Virtual Machine in Azure and set the security settings!

Set the Security Settings in the NSG.

Because we Installed the Windows Server Insider Core version,
Windows Admin Center (Preview) is very handy for Management.

Running Windows Server 2022 Insider Build 10.0.20348.166 in Azure
with Windows Admin Center (Preview) for Testing.

Now we wait for the Hotpatch 😉

Conclusion

Microsoft Azure Cloud platform is great for testing new products like Windows Server Insider Build versions, Windows 11 Insider Preview and the new Azure features. So when this becomes GA in the future you have already the experience and did some feedback to the Microsoft Product Team 😉


Leave a comment

#WindowsInsiders 11 Preview Enterprise Build in #Azure Cloud

Windows 11 Enterprise Preview in Azure

When you joined the Microsoft Windows Insider Program you can use the Windows 11 preview build images from the Azure Marketplace.
Here you can see the Windows 11 Preview plans in the Microsoft Azure Market place.

As a Windows Insider it’s great to have your machine in the Microsoft Azure Cloud to test new features of Windows 11 Preview. You don’t have to buy compatible hardware for Windows 11 Preview, and you only pay for the machine when you use it in the Cloud.
Here you find the Windows 11 Preview minimal requirements.

In the following steps I deploy Windows 11 Preview Enterprise in Azure Cloud.

Create your Windows 11 Preview Machine in Azure Cloud.

For this you need a Microsoft Azure Subscription to create a Windows 11 Preview Virtual Machine in the Cloud. In the Azure template for deployment you can select the right size Virtual Machine, Storage, networks, and Management extensions like security and Azure Monitor.

Before you Connect your Windows 11 Preview VM, make sure the security for RDP is set in the Network Security Group (NSG)

Set security for your RDP session in the NSG.

Go to Settings => Windows Update => Windows Insider Program.
Click on Get Started.
First step link an account to join the program.
(This must be your Windows Insiders account)

Sign in selection and continue.

IMPORTANT

Here you select your Windows Insider Channel, read the information and choose your
Windows Insider Build Channel. As a Windows Insider MVP I choose for the Dev Channel to give feedback to the product Team and get the first new features of Windows 11 Preview.

Read the recommendations and click on Continue.

Review the Agreements for your Device.
Click on Continue if you agree.

Restart the Virtual Machine into the Dev Channel for
the latest updates.

Set your Windows Update Advanced options.

Here we have Windows 11 Preview Insider Build 22000.160 on Azure Cloud 😉

After this I went to the Windows Insider Feedback Hub to do my settings :

At Settings of the Feedback Hub you can update the software.
and of course your personal settings.

I Like the Windows Insider Feedback Hub in Dark mode.

IMPORTANT

When you are ready with testing and sending feedback to Microsoft don’t forget to Stop the Virtual Machine! This save you money.

Conclusion

Microsoft Azure Cloud Services and Windows 11 Preview Insider Builds working together gives you flexibility and as a Windows Insider you can test every Windows 11 Preview Build from any place with a Internet connection. I like to give Microsoft feedback to make Windows Awesome for everyone on the planet 🙂

Follow Windows Insiders on Twitter :

@WindowsInsider

Jason Howard

Amanda Langowski

Brandon LeBlanc

Eddie Leonard

Jen Gentleman

Windows 11

 

 


Leave a comment

Azure Monitor Insights for Arc enabled Kubernetes Clusters anywhere #Azure #Kubernetes

Azure Monitor Insights for Monitoring your Containers.

In the last blogpost I wrote about Microsoft Azure Arc Services and how to connect a Docker for Desktop Kubernetes Cluster for testing your DevOps solution like Container Apps, Functions, App Services in a test environment. Here you find the Link to the Installation.

One of the Microsoft Azure Arc features is Azure Monitor Insights for monitoring your Kubernetes Cluster and the Containers.

Azure Arc Insights for Kubernetes Cluster anywhere

In the following step-by-step guide we will configure Azure Monitor Insights for your Kubernetes Cluster.

I Connected my Analytics Workspace CloudMVPLab.
Click on Configure.

Onboarding your Kubernetes Cluster will take some minutes.

After a while your Kubernetes Cluster Analytics data will show in Insights.

Here you see a navigation bar with the following topics

  • What’s New
  • Cluster
  • Reports
  • Nodes
  • Controllers
  • Containers.

Insights reports of the Kubernetes Cluster

Here you can Click on default reports of your Kubernetes Cluster.

Storage Capacity and Health Status report of your Kubernetes Cluster.

Storage Capacity more in Details.

Deployments Report of your Kubernetes Cluster.

Workload details Report of your Kubernetes Cluster.

Kubelet report of your Kubernetes Cluster

Data Usage of your Kubernetes Cluster

Data Usage

Insights the Nodes of the Kubernetes Cluster

Insights of the Nodes and on the right you can view Analytics.

Here you can work with Log Analytics on your Cluster.

Insights in Controllers of your Kubernetes Cluster

Insights of your Controllers

Insights Containers of your Kubernetes Cluster

Container Insights of your Kubernetes Cluster

Container Insights with Azure Log Analytics.

So with Azure Arc Enabled Kubernetes Clusters you can monitoring your Cluster and running Containers to keep you in Control on what is happening on the Cluster but also with your Container Apps and microservices. After this you can set Alerts and notifications when something is going wrong or offline. With this running you can start running your own App services, Containers or Azure functions on your Kubernetes Cluster.

Microsoft Senior Cloud Advocate Thomas Maurer explains in this awesome video how to add Azure App Services to your Kubernetes Cluster

Conclusion

This configuration with Docker for Desktop Kubernetes Cluster is for testing purpose only and can be used for your own DevOps solutions before you deploy on Production Ready Clusters. With Azure Arc Enabled Kubernetes Clusters you get the powerful Microsoft Azure Features and solutions in a secure way on your Kubernetes Cluster. I wish you lot of success with Azure Arc Enabled Kubernetes Clusters to make Awesome Apps and IT solutions for the Business 😉


Leave a comment

#AzureArc Services with Docker for Windows #Kubernetes Cluster for Testing #DevOps #MSBuild

Microsoft Build 2021 Global virtual event

I Hope everyone had a Great Microsoft Build 2021 Online Conference this week. Microsoft announced a lot of new features and Hybrid Cloud Solutions at Build 2021 🙂 If you missed this Awesome Build 2021 event, you can watch the highlights on demand here.

Microsoft also launched MSBuild Book of News 2021

Build 2021 Resources: Build consistent hybrid and multicloud applications with Azure Arc

DevOps and developers are increasingly using microservices-based architectures with containerized applications for agility and flexibility. Azure Arc extends the single control plane from Azure to enable you to build apps consistently across hybrid and multi-cloud environments. With this information I was thinking, can I connect Microsoft Azure Arc Services to my Surface Book 3 with Windows 10 Preview Insiders Build 21390 and Docker for Windows with Kubernetes Cluster 1.19.7 active?

IMPORTANT: The following step-by-step guide is for testing purpose only.

Installing Docker for Windows with Kubernetes Cluster on Windows 10

First you need to have Docker for Windows 10.

System requirements

Your Windows machine must meet the following requirements to successfully install Docker Desktop.

WSL 2 backend

  • Windows 10 64-bit: Home, Pro, Enterprise, or Education, version 1903 (Build 18362 or higher).
  • Enable the WSL 2 feature on Windows. For detailed instructions, refer to the Microsoft documentation.
  • The following hardware prerequisites are required to successfully run WSL 2 on Windows 10:

Here you can download Docker Desktop for Windows

With docker desktop for Windows you can switch between Windows Containers and Linux Containers. When you want to have a Kubernetes Cluster on your Windows 10 device active you have to switch to Linux Containers in the taskbar like this :

It’s now active for Linux Containers. (Default)

Right Click on the Docker tray icon and go to Settings.
Then go to Kubernetes to enable your Cluster locally on your Windows 10 Device.
When you apply it take some minutes for the installation.

When you see the Kubernetes icon on green, then your Cluster is running.

When you do a lot of DevOps work you use Microsoft Visual Studio Code for Free, because here you can see your Kubernetes Cluster and try your own code or Apps.

Kubernetes Cluster is running locally on your Windows 10 device.

Installing Microsoft Azure Arc Agent

The next step is to install the Microsoft Azure Arc agent on your Windows 10 device.

Login in your Azure Subscription, if you don’t have one you can start here

Search for Azure Arc in your subscription.

Click on Servers and Click on Add.

Click on add a Single Server.
Click on Generate Script.

Prerequisites for the Azure Arc Agent.

Select your Azure Subscription and Resource Group
Choose your Region.
Operating System is Windows. ( your Windows10 device)
Click on Next.

You can add your TAG here.
More information about Azure Tags

Here you can download the Installation script or do a Copy of the Azure Arc Agent.

Open PowerShell ISE in Administrator mode.
Paste the Azure Arc Agent PowerShell Script.
Click on run.

When you see this message open your browser and go to
https://microsoft.com/devicelogin

Copy the Code in the last rule of PowerShell here and click on Next.

Enter your Azure Subscription account here and click on Next.

Connection is made with Azure you can close this screen.

Azure Arc Agent is connect with your Windows 10 Device.

Here you see my Azure Arc Enabled Machine.

Now your Windows 10 device, my Surface Book 3 is connected with Microsoft Azure Arc Services.

Register a Kubernetes Cluster with Azure Arc

The last step is to register your kubernetes Cluster with Microsoft Azure Arc Services.

Click on kubernetes Clusters on the left.
Click on Register a Kubernetes Cluster with Azure Arc.

The prerequisites to add your Kubernetes Cluster to Azure Arc

Select your Azure Subscription
Select your Resource Group
Give your Cluster a Name in Azure
Select Region.
Are you behind a Proxy Server? Yes or No

Here you can add your TAG to the Kubernetes Cluster.

The Next step is to run the Script, you can do that with PowerShell or Bash. I Did this via Azure CLI and with Helm 3.

Microsoft Azure CLI active with Helm 3

Copy the Bash commando into your Azure CLI like here.

This operation might take a couple of minutes.

Done, the Kubernetes Cluster is added to Azure Arc.

Dockkube was successfully connected to Azure.

Kubernetes Cluster with Azure Arc

Now you Have connected your Kubernetes Cluster to Azure Arc Services, you can start exploring the extensions :

Kubernetes Cluster – Azure Arc extensions

You can work with GitOps on your Kubernetes Cluster via Azure Arc Services

GitOps on your Kubernetes Cluster via Azure Arc.

More Features like Security, Monitoring, Automation :

Features for Kubernetes in Azure Arc Services.

Here you see in Visual Studio Code your Azure-Arc Helm Release.

Conclusion

“Learn how to write once and run anywhere using your preferred cloud-native application services. Ensure governance, compliance and security for your deployments, all through a single pane of glass management experience in Azure.”

With Microsoft Azure Arc Services you bring Azure Cloud Technology anywhere for your Apps, Containers, microservices.
I Hope this is a first start for exploring and testing your Hybrid Cloud solution. Wish you a lot of fun and happy coding 😉

 


Leave a comment

Security by Design with #Azure Security Center and Azure Defender #ASC #Security #SecOps

Azure Architecture

Security by Design is increasingly becoming the mainstream development approach to ensure security of software systems. Security architectural design decisions are based on well-known security tactics, and patterns defined as reusable techniques for achieving specific quality concerns. In the following steps we will make a security baseline for Windows Servers with different tools.

1.Microsoft Security Compliance Toolkit

The Microsoft Security Configuration Toolkit enables enterprise security administrators to effectively manage their enterprise’s Group Policy Objects (GPOs).  Using the toolkit, administrators can compare their current GPOs with Microsoft-recommended GPO baselines or other baselines, edit them, store them in GPO backup file format, and apply them via a domain controller or inject them directly into testbed hosts to test their effects. A security baseline is a group of Microsoft-recommended configuration settings that explains their security impact. These settings are based on feedback from Microsoft security engineering teams, product groups, partners, and customers. A lot of hacks are based on registry settings, so that’s why Windows Server Security Baseline is important.
You can download the Microsoft Security Compliance Toolkit here

2. Windows Defender Firewall with Advanced Security

Windows Defender Firewall with Advanced Security is an important part of a layered security model. By providing host-based, two-way network traffic filtering for a device, Windows Defender Firewall blocks unauthorized network traffic flowing into or out of the local device. Windows Defender Firewall also works with Network Awareness so that it can apply security settings appropriate to the types of networks to which the device is connected. Windows Defender Firewall and Internet Protocol Security (IPsec) configuration settings are integrated into a single Microsoft Management Console (MMC) named Windows Defender Firewall, so Windows Defender Firewall is also an important part of your network’s isolation strategy. So set only the firewall ports you need end to end.

Windows Security Setting Firewall & Network Protection
Select Advanced settings

Windows Defender Firewall Advanced settings
Set only active what you need!

3. Windows Defender Security Virus & Threat Protection

Schedule a Full Scan in the Night for Threats
and Set the Windows Security options.
Keep your Defender and Virus definition files up-to-date.

4. Windows Updates

When your Windows Server is ready for production, you have to keep it Up-to-Date with Windows Updates. It’s not only the Windows Security patches, but all the software that’s running on your Server. One software leak is enough for a hacker to compromise your Server.

Windows Updates

Have a look at the Microsoft Update Catalog

Lot of Companies are using Microsoft WSUS Services or Microsoft Endpoint Configuration Manager to deploy the software Life cycle Management Security updates to Servers to keep them secure as possible. These are not only Microsoft Security Updates but also from third party Software vendors, like adobe, Google, etc.

5. Security Monitoring and Remediation

This Cycle is important for Security!

IT departments have multiple teams with different disciplines, so when the Windows Server is ready
for the Administrator it goes to the Application Admin in a different IT Team. They will install the Application software and maybe
some software connections with other Servers by a third IT Team. To get in control of those security steps is important, because when a IT Consultant of a third party vendor is installing old legacy software you will have hacker leaks again and that’s making your Server vulnerable. Here is where Azure Security Center and Azure Defender will support you in monitoring and remediation of security issues.

It doesn’t matter where your Windows Server is installed, in Azure Cloud or On-premises in your datacenter, it can connect securely via internet for monitoring the Server. When it’s on-premises you can install the Microsoft Arc agent

Microsoft Azure Arc Connected Machine Agent.

Azure Arc enabled Server from On-premises

When the Microsoft Azure Arc Agent is installed on the Server, you can use these Azure Services for example :

  • Azure Update Management
  • Azure Monitoring
  • Azure Security Center with Azure Defender
  • Azure Policies for Compliance
  • Change Tracking and Inventory
  • Insights
  • Automation of Tasks

These Microsoft Azure features are supporting you to keep your Server as safe as possible and your security Up-to-Date.

From here you can add the Windows Server to Microsoft Azure Security Center with the right log analytics workspace.

Microsoft Azure Security Center Recommendations

Remediate Security Configurations on the Arc enabled Server

Remediation of Vulnerabilities on your Windows Server (Arc Enabled)

Azure Defender is a built-in tool that provides threat protection for workloads running in Azure, on premises, and in other clouds. Integrated with Azure Security Center, Azure Defender protects your hybrid data, cloud-native services, and servers and integrates with your existing security workflows, such as SIEM solutions and vast Microsoft threat intelligence, to streamline threat mitigation.

Workflow of Azure Defender for Vulnerability Scanning.

When Azure Security Center and Azure Defender are installed, you can do a Vulnerability Assessment on your Azure Arc enabled Server which is on-premises datacenter before your Windows Server is going in Production.

Vulnerabilities after Assessment on Windows Server with Arc enabled with remediation
This happens a lot when there is third party software installed on the Server.

To get a list of your high security vulnerabilities, you can use the Azure Resource Graph explorer.

Azure Resource Graph Explorer
Here you can download your high risks into a CSV or Pin to a Dashboard.

6. Compliance and Security Policies

Learn how Microsoft products and services help your organization meet regulatory compliance standards.
When you have to manage a lot of Windows Servers or Linux Servers, you want them compliant with the right security policies.

Here you find all the Microsoft Compliance Offerings

Regulatory Compliance of your environment.

With Azure Security Policy you can configure your Compliance.

in the following steps you will see an Sample alert :

Sample Alerts with Mitre ATT&CK Tactics

Take Action on the Security Alert.

Related entities

Mitigate the Threat
Prevent future attacks
Trigger automated response
or
Suppress similar Alerts.

Security by Design Conclusion

Before you begin with deploying Windows Servers in your datacenter or in the Azure Cloud, it’s good to make a High Level design with your security set for the right compliance of your new Windows Server. You can use all the security On-Premises for Windows Server but with Azure Security Center, Azure Monitor, Azure Arc Services, Azure Defender you get all the security Insights and remediation options when a vulnerability is discovered. Windows Server and Azure Security Center is better together for Security Management.

Microsoft Security

If you want to keep your Windows Servers secure as possible, you need to keep doing these steps above. Continuous Monitoring and remediate vulnerabilities is a on-going process for SecOps and Administrators. Make it hackers difficult to add ransomware on your Servers.  One more important IT Service, is your Backup / Disaster Recovery solution. This should be secure from hackers and from ransomware encryption. I always say think of this rule :

More information

Microsoft Azure Security Center on GitHub

Overview of the Azure Security Benchmark (V2)

Become an Azure Security Center Ninja

Azure Security Center in the Field by Yuri Diogenes

Introduction to Azure Defender

Join the Microsoft Azure Monitor & Security for Hybrid IT Community Group on LinkedIn