This Microsoft E-Book gives you an overview about security in Windows 11 with in different layers of security.
Different Security Layers in Windows 11
Be aware of all the Microsoft security features in Windows 11 and download the free Microsoft Windows 11 Security Book here
Windows Admin Center is a customer-deployed, browser-based app for managing servers, clusters, hyper-converged infrastructure, and Windows PCs. It comes at no additional cost beyond Windows and is ready to use in production. Learn more about Windows Admin Center.
Benefits
Languages
Chinese (Simplified), Chinese (Traditional), Czech, Dutch (Netherlands), English, French, German, Hungarian, Italian, Japanese, Korean, Polish, Portuguese (Brazil), Portuguese (Portugal), Russian, Spanish, Swedish (Sweden), Turkish
In the following step-by-step guide I will deploy Windows Server 2022 Insider Build 25099 Core Edition with Windows Admin Center tool together with some great features for managing Windows Servers in a secure hybrid way with Microsoft Azure Cloud services. Like Azure Defender for Cloud, Azure Backup Vault, Azure Monitor, Security and more.
So I have Windows Admin Center 2110.2 installed and I have a Windows Server 2022 Hyper-V Server for my Virtual Machines in my MVPLAB Domain.
Now we will deploy the new Windows Server 2022 Insider Preview Build 25099.
In WAC on my Hypervisor in Virtual Machines
When you explore and open your Hyper-V Host and go to Virtual Machines, you can Click on Add and then on New for Creating your Windows Server Insider VM.
Create a New Windows Server Insider VM called StormTrooper01
Here you can configure your new Windows Server 2022 Insider VM with the following :
I Created a New 70GB OS Disk
and I want to Install the New Windows Server Insider OS from ISO.
Click on Browse
Here you Browse Default on your Hyper-V Host and select the ISO.
When the Windows Server ISO is selected you can hit Create
We get the Notification that the virtual machine is successfully created.
Only the Virtual Machine is now made with your specs and visible on the Hyper-V Host.
Select the New Virtual Machine (StormTrooper01) click on Power and hit Start.
After you started the VM, you can double click on it and go to Connect.
Click on Connect to the Virtual Machine.
Now you are on the console via VM Connect.
Click on Install Now
We are installing Windows Server 2022 Insider Core edition, because we have WAC 😉
Installing Windows Server 2022 Insider Core Preview Build 25099 via Windows Admin Center
Create New Administrator Password.
And here we have Sconfig of the Windows Server 2022 Core.
via Virtual Machine Connect.
Now we can add and connect the New Virtual Machine with Windows Server 2022 Insider Preview Build in Windows Admin Center via IP-Address.
The Next step is to join the Windows Server 2022 Insider to my Domain MVPLAB.
Click on the Top on Edit Computer ID
Click on Domain and type your domain name.
Click op Next
Add your administrator account for joining the server
Reboot the VM.
Windows Server 2022 Insider Preview Core edition is domain joined.
Now we have the New Microsoft Windows Server 2022 Insider Preview Build 25099 running in Windows Admin Center, we can use all the tooling provided by WAC also in a Azure Hybrid way. Think about Azure Defender for Cloud, Azure Monitor. In Microsoft Windows Admin Center we also have a topic Azure Hybrid Center :
Here you see all the Azure Hybrid benefit features for your Windows Server 2022 Insider.
Microsoft Azure and the Windows Admin Center Team made the wizards customer friendly and easy to get those Azure Hybrid services for your Windows Server.
When you have your Server running, you want to make backups and Monitoring your Server for management. And after that you want to be in control of your security of your new Server. In the following steps you see some examples on the same Windows Server 2022 Insider Preview Build:
Click on Azure Backup
Select your Azure Subscription and the Azure Backup Vault.
Select your data and make the schedule.
Enter the Encryption passphrase and Apply.
Here you have Azure Backup Vault working together with WAC.
Click op Microsoft Defender for Cloud
Click on Setup
Add the right Azure Subscription and Workspace
Click on Setup.
Configuring Azure Defender for Cloud agent and Subscription.
Azure Defender for Cloud in Windows Admin Center on your Windows Server 2022 Insider Preview Build.
In Windows Admin Center there is also a Security tab for the Windows Server.
Here you can see your Secured-Core status
Here you can see if your system is supported for this security features 🙂
Enable the supported features and Restart de Virtual Machine.
And here you see my status overview.
Further more you can manage RBAC in Windows Admin Center when you have to work with different kind of users.
You can find RBAC in settings.
Windows Server Insider Core edition and Windows Admin Center are working better together! You have all the tools you need to startup your Windows Server and
manage it with WAC. Windows Admin Center is getting better and better to manage your Hybrid Datacenter and keep you as an Administrator in Control!
So is how I manage my MVPLAB but also for Production workloads I use Windows Admin Center and the Azure Portal together. With Microsoft Azure Arc Services
Azure Hybrid becomes your solution where Windows Admin Center can Support you with making Azure Stack HCI Clusters with Azure Kubernetes for your DevOps environment.
The Server Message Block (SMB) Protocol is a network file sharing protocol, and as implemented in Microsoft Windows is known as Microsoft SMB Protocol. The set of message packets that defines a particular version of the protocol is called a dialect. The Common Internet File System (CIFS) Protocol is a dialect of SMB. Both SMB and CIFS are also available on VMS, several versions of Unix, and other operating systems.
Here you can see the versions of MS-CIFS and download free white papers
Today SMBv1 is a not save protocol and will be used by hackers for man in the middle attacks to compromise your data and systems. SMBv1 is a weak protocol and should not be used in your environment. There are still a lot of Windows Servers 2012 R2 in the world running in datacenters with SMBv1 by Default enabled. To make your Windows Server more secure, you can disable SMBv1 protocol via a Group Policy Object (GPO).
In the following steps we will disable SMBv1 on Windows Servers via GPO.
Open Group Policy Management in your Domain.
Click on Group Policy Object with your right mouse button.
Click on New.
Give your policy a Name.
I made also an temporary Exception policy.
Right click on your new Policy Object.
Click on Edit.
Go to Computer Configuration => Preferences => Windows Settings
Click on Registry.
Click on New and then on Registry Item.
Here you have to add the following Registry Properties:
Set these settings.
Set Path: HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters
Click on Apply for these Registry settings.
SMBv1 Disable setting is set in the Policy Object.
This is the path where we push the policy via GPO.
Here we Link the Existing GPO to the OU with the Windows Server 2012 R2
to disable SMBv1 Protocol.
Select your new Policy to disable SMBv1 Protocol.
We have now Linked the new GPO to Disable SMBv1
GPUpdate /force on your Server to disable SMBv1
To get the new GPO active on your Server.
Policy Update successfully.
GPResult /r to see the results.
Get-SmbServerConfiguration | Select EnableSMB1Protocol
or
Get-SmbServerConfiguration
You can still as a administrator enable SMBv1 on your Server with :
Set-SmbServerConfiguration -EnableSMB1Protocol $true
When the Server gets a reboot, SMBv1 will be disabled by GPO again.
When you have maintenance window for updates for example, you can un-install the SMBv1 Feature in Server Manager. This procedure needs a restart of the Windows Server.
Go to Server Manager remove features.
Click on Remove Roles and Features.
Remove the mark at SMB 1.0/CIFS File Sharing Support Feature.
Click on Remove.
Click on Close and Reboot the Server
Now SMBv1 protocol on the Windows Server is disabled and will use a higher version of SMB like version 2.x or 3.x.
More Microsoft information can be found here on Docs.
SMB over QUIC introduces an alternative to the TCP network transport, providing secure, reliable connectivity to edge file servers over untrusted networks like the Internet. QUIC is an IETF-standardized protocol with many benefits when compared with TCP:
SMB over QUIC offers an “SMB VPN” for telecommuters, mobile device users, and high security organizations. The server certificate creates a TLS 1.3-encrypted tunnel over the internet-friendly UDP port 443 instead of the legacy TCP port 445. All SMB traffic, including authentication and authorization within the tunnel is never exposed to the underlying network. SMB behaves normally within the QUIC tunnel, meaning the user experience doesn’t change. SMB features like multichannel, signing, compression, continuous availability, directory leasing, and so on, work normally.
Client Server Handshake and Data transfer differences.
Here you find a Great blogpost of Ned Pyle
SMB over QUIC: Files Without the VPN
When you still have Windows Servers running with SMBv1 by default enabled, for security you should disable SMBv1 protocol as soon as possible! Otherwise you make it easy for hackers to compromise your data with man in the middle attacks. In Windows Server 2019 and higher SMBv1 is disabled by default. Have a look at SMB over QUIC in your test environment and learn how secure it is and how it works for your security and data.
Packet monitoring allows you to diagnose your server by capturing and displaying network traffic through the networking stack in a log that is filtered, organized, and easy to follow and manipulate.
Download Windows Admin Center Here
Filter the Captured packets by PacketMon.
Before you start the capture you can set the filter, with great options and see differences between two IP-Addresses for example.
Capture is running.
You can explore every packet in details for trouble shooting.
You can save your Captures for later.
A great tool for trouble shooting in Windows Admin Center 21.10 with Packet Monitoring (preview) to get the bits and bytes in detail.
Secured-core – recommended for the most sensitive systems and industries like financial, healthcare, and government agencies. Builds on the previous layers and leverages advanced processor capabilities to provide protection from firmware attacks.
In Windows Admin Center Security you can Configure Secured-Core :
Secured-Core in Windows Admin Center 21.10
You can activate 6 secured-Core feature :
You now can simply activate the Security Feature.
Needs a Reboot
Hypervisor Enforced Code Integrity (HVCI) is enabled.
More information about Secured-Core Features
Join Microsoft and the Community November 2–4, 2021 to explore the latest tools, training sessions, technical expertise, networking opportunities, and more. You can register here
Here you find some great MSIgnite guidance on Microsoft Tech Community :
Of course you can make your own schedule from the session catalog here
Are you exited as I am about the New Microsoft Windows 11 Insider preview builds on your device? The Microsoft Windows Insider Program team is keeping you up-to-date about the new features in Windows 11 Insider Preview Build by videos on YouTube.
You can find the Windows Insider Channel here
When you like to start testing new features with Windows 11 Insider Preview Build, you can become a Windows Insider to get started
Before you register as a Windows Insider, It’s important how you want to fly with new releases and or updates of Windows 11 Insider Preview Build. This because there are different Channels and they are explained well at this site.
( Read this first before you begin)
The Windows Insider Program Team is really active on Twitter, I advice you to follow them:
And of course the Windows Insider Program it self on Twitter : @WindowsInsider
I Like Windows 11 Insider Preview Build very much. As a Datacenter Administrator I like the New Windows Terminal under the Start button with a right click. The look and feels of Windows 11 Insider Preview Build is awesome and the Microsoft Windows Team did a lot of work to make configuring Windows 11 Insider Preview Build as easy as possible for the end-users. I wish you a lot of fun as a Windows Insider and don’t forget to give your Feedback in the Feedback Hub of Windows Insider.
Installing Windows Server Insider Datacenter Azure Edition
In my last blogpost we installed Windows 11 Insider Preview Enterprise Build on a Microsoft Azure Virtual Machine. Now we do the same with Windows Server 2022 Insider build version on Microsoft Azure Cloud.
IMPORTANT
This blogpost is for testing only and not ready for production environments yet!
Before you Search for the Windows Server Insider Preview image, you need some preview features added to your azure subscription first. Here you find more information
One of the features is Inquest Hot patching, which we activate via Azure Cloud Shell with Bash Azure CLI :
az feature register –namespace Microsoft.Compute –name InGuestHotPatchVMPreview
az feature register –namespace Microsoft.Compute –name InGuestAutoPatchVMPreview
az feature register –namespace Microsoft.Compute –name InGuestPatchVMPreview
Register via Azure CLI with these commands.
Feature registration can take up to 15 minutes. To check the registration status:
az feature show –namespace Microsoft.Compute –name InGuestHotPatchVMPreview
az feature show –namespace Microsoft.Compute –name InGuestAutoPatchVMPreview
az feature show –namespace Microsoft.Compute –name InGuestPatchVMPreview
When registration is done, you will see this message.
Once the feature has been registered for your subscription, complete the opt-in process by propagating the change into the Compute resource provider.
Type the following Azure CLI commandline :
az provider register –namespace Microsoft.Compute
Now your Microsoft Azure Subscription is ready for the new Features with the Windows Server 2022 Insider Preview Datacenter Azure Edition Build.
You need the Core edition when you want to try hotpatching.
and you need to be a Windows Server Insider.
Here you can Register for the Windows Server Insider Program
Create the Virtual Machine.
Add Storage to your Virtual Machine.
Because it’s for testing only I selected SSD.
Set your network settings.
Set Management settings like Hotpatch Preview.
At Advanced tab you can add Extensions and Custom scripts.
Click on Review + Create
Validation is passed, Click on Create and the
Windows Server Insider 2022 Datacenter Azure Edition will deploy.
IMPORTANT
Check the Network Security Group (NSG) of the Virtual Machine in Azure and set the security settings!
Set the Security Settings in the NSG.
Because we Installed the Windows Server Insider Core version,
Windows Admin Center (Preview) is very handy for Management.
Running Windows Server 2022 Insider Build 10.0.20348.166 in Azure
with Windows Admin Center (Preview) for Testing.
Now we wait for the Hotpatch 😉
Microsoft Azure Cloud platform is great for testing new products like Windows Server Insider Build versions, Windows 11 Insider Preview and the new Azure features. So when this becomes GA in the future you have already the experience and did some feedback to the Microsoft Product Team 😉
When you joined the Microsoft Windows Insider Program you can use the Windows 11 preview build images from the Azure Marketplace.
Here you can see the Windows 11 Preview plans in the Microsoft Azure Market place.
As a Windows Insider it’s great to have your machine in the Microsoft Azure Cloud to test new features of Windows 11 Preview. You don’t have to buy compatible hardware for Windows 11 Preview, and you only pay for the machine when you use it in the Cloud.
Here you find the Windows 11 Preview minimal requirements.
In the following steps I deploy Windows 11 Preview Enterprise in Azure Cloud.
Create your Windows 11 Preview Machine in Azure Cloud.
For this you need a Microsoft Azure Subscription to create a Windows 11 Preview Virtual Machine in the Cloud. In the Azure template for deployment you can select the right size Virtual Machine, Storage, networks, and Management extensions like security and Azure Monitor.
Before you Connect your Windows 11 Preview VM, make sure the security for RDP is set in the Network Security Group (NSG)
Set security for your RDP session in the NSG.
Go to Settings => Windows Update => Windows Insider Program.
Click on Get Started.
First step link an account to join the program.
(This must be your Windows Insiders account)
Sign in selection and continue.
IMPORTANT
Here you select your Windows Insider Channel, read the information and choose your
Windows Insider Build Channel. As a Windows Insider MVP I choose for the Dev Channel to give feedback to the product Team and get the first new features of Windows 11 Preview.
Read the recommendations and click on Continue.
Review the Agreements for your Device.
Click on Continue if you agree.
Restart the Virtual Machine into the Dev Channel for
the latest updates.
Set your Windows Update Advanced options.
Here we have Windows 11 Preview Insider Build 22000.160 on Azure Cloud 😉
After this I went to the Windows Insider Feedback Hub to do my settings :
At Settings of the Feedback Hub you can update the software.
and of course your personal settings.
I Like the Windows Insider Feedback Hub in Dark mode.
IMPORTANT
When you are ready with testing and sending feedback to Microsoft don’t forget to Stop the Virtual Machine! This save you money.
Microsoft Azure Cloud Services and Windows 11 Preview Insider Builds working together gives you flexibility and as a Windows Insider you can test every Windows 11 Preview Build from any place with a Internet connection. I like to give Microsoft feedback to make Windows Awesome for everyone on the planet 🙂
Follow Windows Insiders on Twitter :
Azure Monitor Insights for Monitoring your Containers.
In the last blogpost I wrote about Microsoft Azure Arc Services and how to connect a Docker for Desktop Kubernetes Cluster for testing your DevOps solution like Container Apps, Functions, App Services in a test environment. Here you find the Link to the Installation.
One of the Microsoft Azure Arc features is Azure Monitor Insights for monitoring your Kubernetes Cluster and the Containers.
In the following step-by-step guide we will configure Azure Monitor Insights for your Kubernetes Cluster.
I Connected my Analytics Workspace CloudMVPLab.
Click on Configure.
Onboarding your Kubernetes Cluster will take some minutes.
After a while your Kubernetes Cluster Analytics data will show in Insights.
Here you see a navigation bar with the following topics
Here you can Click on default reports of your Kubernetes Cluster.
Storage Capacity and Health Status report of your Kubernetes Cluster.
Storage Capacity more in Details.
Deployments Report of your Kubernetes Cluster.
Workload details Report of your Kubernetes Cluster.
Kubelet report of your Kubernetes Cluster
Data Usage of your Kubernetes Cluster
Data Usage
Insights of the Nodes and on the right you can view Analytics.
Here you can work with Log Analytics on your Cluster.
Insights of your Controllers
Container Insights of your Kubernetes Cluster
Container Insights with Azure Log Analytics.
So with Azure Arc Enabled Kubernetes Clusters you can monitoring your Cluster and running Containers to keep you in Control on what is happening on the Cluster but also with your Container Apps and microservices. After this you can set Alerts and notifications when something is going wrong or offline. With this running you can start running your own App services, Containers or Azure functions on your Kubernetes Cluster.
Microsoft Senior Cloud Advocate Thomas Maurer explains in this awesome video how to add Azure App Services to your Kubernetes Cluster
This configuration with Docker for Desktop Kubernetes Cluster is for testing purpose only and can be used for your own DevOps solutions before you deploy on Production Ready Clusters. With Azure Arc Enabled Kubernetes Clusters you get the powerful Microsoft Azure Features and solutions in a secure way on your Kubernetes Cluster. I wish you lot of success with Azure Arc Enabled Kubernetes Clusters to make Awesome Apps and IT solutions for the Business 😉
Cloud and Datacenter Management Blog 