Cloud and Datacenter Management Blog

Microsoft Hybrid Cloud blogsite about Management


Leave a comment

#MVPLABSerie Azure Update Management Center (Preview) and #AzureArc enabled Servers #AzureHybrid

Microsoft Azure Update Management Center (Preview)

Update management center (preview) is a unified service to help manage and govern updates for all your machines. You can monitor Windows and Linux update compliance across your deployments in Azure, on-premises, and on the other cloud platforms from a single dashboard. Using Update management center (preview), you can make updates in real-time or schedule them within a defined maintenance window. Here you can find more information about Azure Update Management Center

In the following step-by-step guide, we will start with Azure Update Management Center (Preview) and Microsoft Azure Arc enabled Windows Servers running on-premises in my mvplab.local domain.

With getting started you can configure the environment.

I start here with my Azure Arc enabled Storage Server.

You have options like Hotpatch

We Check manually for Updates on Windows Server mvpstore01
Click on OK for Assessment.

Here are the Windows Server Security updates.
You can click on One-time-Update
But first we look in Update Management Center.

Here you see the Pending Windows Updates in Azure Update Management Center
Open query 

Microsoft Azure Resource Graph Explorer can be really powerful tool

When you have to manage many Windows Servers you can get the status
of these Azure Arc enabled servers and export the results into a CSV file.
Here you find some Azure Resource Graph Explorer queries

Now we start to Install One-time Updates.

Include Update Classification
Click on Add

Click on Next

Select the option if you want to reboot or not.

Review and Install

Updates installed on the Azure Arc Enabled Windows Server.

In Azure Update Management Center Overview Dashboard
you can see that one machine is completed.

For Monitoring you can make your own workbooks.

I like this History, to see if updates are successful or not.

Conclusion

Microsoft Azure Update Management Center is still in Preview but it’s a new way to manage all of your updates on your Servers on-premises with Azure Arc enabled, or on Azure Cloud, but also in other Clouds if you want. One Update Management Center from the Azure Portal is Awesome to work with and gives you control and overview of your update compliance in your datacenter(s).
Important: This Great tool is still in preview and not for production environments yet until it’s made GA by Microsoft and you have the full support on this awesome management tool.

JOIN Azure Hybrid Community Group on LinkedIn

 


Leave a comment

MVPLAB Serie Installing SCOM 2022 monitoring with SQL Cluster #SCOM #MVPBuzz

System Center 2022 Operations Manager (SCOM)

Before we can install Microsoft System Center Operations Manager 2022 in my mvplab.local domain, I installed the following:

Installing Operations Manager creates a management group. The management group is the basic unit of functionality. At a minimum, a management group consists of a management server, the operational database, and the reporting data warehouse database.

  • The management server is the focal point for administering the management group and communicating with the database. When you open the Operations console and connect to a management group, you connect to a management server for that management group. Depending on the size of your computing environment, a management group can contain a single management server or multiple management servers.
  • The operational database is a SQL Server database that contains all configuration data for the management group and stores all monitoring data that is collected and processed for the management group. The operational database retains short-term data, by default 7 days.
  • The data warehouse database is a SQL Server database that stores monitoring and alerting data for historical purposes. Data that is written to the Operations Manager database is also written to the data warehouse database, so reports always contain current data. The data warehouse database retains long-term data.

When Operations Manager reporting functionality is installed, the management group also contains a Reporting server which builds and presents reports from data in the data warehouse database.

These core components of a management group can exist on a single server, or they can be distributed across multiple servers, as shown in the following image.

In my Test LAB mvplab.local I will install the Management Server on a Windows Server Insider member Server and the Operational Database with the Data Warehouse Database on the SQL Cluster Instance. Here you find more Microsoft Information about System Center 2022 Operations Manager

Architecture SCOM 2022

IMPORTANT : In my MVPLAB I’m working with Windows Server Insider Preview Builds and with SQL Server 2022 CTP2.1 Preview version on a Cluster and is not supported yet for Production workloads, then you have to wait for Microsoft to make it General Available!

Now we have a SQL Cluster Instance running in my mvplab.local domain, I’m going to install Microsoft System Center 2022 Operations Manager (SCOM) for monitoring in the following step-by-step guide :

Run SCOM_2022 as Administrator

Click on Next

Click on Accept the Agreement.
Click on Next

Extract the files to your location.
Click on Next

Click on Extract

Completed Click on Finish

Run Setup

Click on Install

I’m installing only the Management Server and Operations Console.
When this was Production I would install every feature on separated Servers with
two Management Servers.
Click on Next

Select installation location
Click on Next

Click on Next

Give your Management Group a Name.
Click on Next

Agree with the License Terms.
Click on Next

Select de SQL Instance and Port.
Set Database Size.
and Data File Folders.
Click on Next

Here you can select de Instance for data warehouse database.
Click Next

Select the Service accounts
Click on Next

Click on Next

Check the Summary.
Click on Install

SCOM 2022 Installation in Progress.

Processing

SCOM License we set later.

I have installed both databases in one SQL Instance for in my MVPLAB.

 

System Center 2022 Operations Manager (SCOM)

Now you can Configure the Management Packs in SCOM for your environment and set the Alerts. More information about System Center 2022 Operations Manager can you find here :

What’s New in Operations Manager

What is in an Operations Manager management pack?

Microsoft System Center Blog on MS Tech Community

In the following MVPLAB Serie Blogpost I will Install Microsoft System Center Operations Manager Web Server 2022 for Monitoring with your web browser.


Leave a comment

MVPLAB Serie Installing SQL Server 2022 CTP on Windows Server Insider Cluster #SQLServer #WIMVP

SQL Server 2022 CTP2.1

In this blogpost of MVPLAB Serie, we are going to install Microsoft SQL Server 2022 CTP2.1 on my Windows Server Insider Preview Cluster in mvplab.local domain. Before this blogpost I installed the following basics in mvplab.local domain :

Now we are going to install the Backend of the datacenter, and that is SQL Server 2022 CTP2.1 on a Cluster resource with the first SQL Instance for databases which is High Available (HA).

First we download SQL Server 2022 CTP2.1

SQL Server 2022 Preview is the most Azure-enabled release of SQL Server yet, with continued innovation in security, availability, and performance.

  • Integration with Azure Synapse Link and Azure Purview enables customers to drive deeper insights, predictions, and governance from their data at scale.
  • Cloud integration is enhanced with disaster recovery (DR) to Azure SQL Managed Instance, along with no-ETL (extract, transform, and load) connections to cloud analytics, which allow database administrators to manage their data estates with greater flexibility and minimal impact to the end-user.
  • Performance and scalability are automatically enhanced via built-in query intelligence.
  • There is choice and flexibility across languages and platforms, including Linux, Windows, and Kubernetes.

Mount the ISO file and Copy the files to a local disk location, then run Setup as Administrator with your personal Domain Administrator Account to install SQL Server 2022 CTP2.1. Before the installation read Configure Cluster accounts in Active Directory (AD)

Click on Yes.

Click on the left on Installation
Then Click on New SQL Server Failover Cluster Installation

Here I choose for the Developer edition.
Click on Next

Accept the License terms
Click on Next

Check for Updates (recommended)
Click on Next

Check the Warnings and solve issues.
Click on Next

I Installed only the default for SQL Database.
(You can install later Shared SQL Features if you need them.)
Click on Next

Specify a network name for the New SQL Server Failover Cluster.
mvpsql01
Click on Named Instance and type INSTANCE01
Click on Next

Click on Next

Select your Cluster disk
Click on Next

Select IPv4 and type the IP-Address of your Cluster Resource
mvpsql01
Then Click on Next

Select your domain Service accounts and type the passwords.
Select if you want Maintenance Tasks privilege to your SQL Server Database Engine Service.
Click Next

Here you can add the SQL Admin Group from Active Directory (AD)
Click on top tab Data Directories

I Changed the User Database Log Directory.
Here you can set your directories.
Have a look at the Other TAB fields, I set Memory later.
When you finished all the Tabs then click Next

Check the Summary and click on Install

SQL Server 2022 CTP2.1 Installed Successfully Click on Close.

This was on the first mvpfs01.mvplab.local, now you have to do the installation on the other node mvpfs02.mvplab.local.
Here we will add a SQL Node to the Cluster.

 

Click on the left on Installation
Then Click on Add Node to a SQL Server Failover Cluster

Add Node in Progress

Add Node to SQL Server 2022 CTP2.1 Failover Cluster is Successful
Click on Close

Here you see your SQL Server 2022 CTP2.1 Cluster Instance Running in Failover Cluster Manager.

Here I installed the new Microsoft SQL Server Management Studio (SSMS) version 19 preview 2

Connecting the High Available SQL 2022 CTP2.1 Cluster Resource Instance01.

And you can connect the SQL Instance with Azure Data Studio 😉

With Azure Data Studio you can install marketplace extensions working with your SQL Instance.
Here you find more information about Microsoft Azure Data Studio

+


Leave a comment

MVPLAB Serie Cluster Aware Updating – CAU for Windows Server Insider #WindowsServerInsider #MVPBuzz #Winserv

Cluster Aware Updating (CAU)

In my last MVPLAB Serie blogpost, I wrote about setting-up a Microsoft Domain mvplab.local and making a Windows Server Insider Cluster with an iSCSI Target Host Server for Shared iSCSI Storage provisioning. First thing I did was Installing Windows Admin Center for Hybrid IT Management. With WAC we can Manage the Cluster Nodes but also the Cluster, Installing new features via Windows Admin Center like Kubernetes for running Containers and microservices. But first we start with Microsoft Cluster Aware Updating to keep your Cluster up-to-date.

Windows Admin Center Cluster Manager

Installing Cluster Aware Updating

In the following steps you can see how easy it is to install Cluster Aware Updating with Windows Admin Center on your Windows Server Cluster, in my case mvpcl01.mvplab.local

Go to your Windows Server Insider Cluster

In Cluster Manager, go to Updates.
Click on Add Cluster Aware Updating Role

Successfully configured Cluster Aware Updating (CAU)

On both Cluster Nodes is the Update Available.
Click on Install

Click on Install

Look at the status to see what is happening on the Cluster Nodes.

First Cluster Node is done

Both Cluster Nodes are updated successfully.

Here you can read more about Microsoft Cluster Aware Updating

Conclusion

Microsoft Windows Admin Center is the Administrator Management tool to use in your hybrid datacenter. You see how easy it is to configure Cluster Aware Updating (CAU) on your Cluster. When you use Windows Server Core or Azure Stack HCI then Windows Admin Center is really handy instead of command-line tools or PowerShell scripting.  here you can find more information about
Cluster Aware Updating requirements and Best Practices

Here you can JOIN the Windows Admin Center Community Group on LinkedIn


Leave a comment

MVPLAB Serie Windows Server Insider Cluster with ISCSI Target Server #WindowsServerInsider #Winserv

mvplab.local Domain

I have made a new MVPLAB with Microsoft Windows Server Insider Preview Build 25158 to install Services and Features for learning but also to give Microsoft feedback about the products. When the MVPLAB domain and Clusters are ready in basic then I can use new Microsoft Azure Hybrid solutions as well, like Azure Arc Kubernetes services and Azure Cloud Defender for Servers and SQL.
Before we start, you need to become a Windows Server Insider so that you can download the newest Windows Server Insider Builds ISO.
Here you get more information for the Windows Server Insider Program registration 

After the free registration you can download the new Microsoft Windows Server Insider Builds here :

While I’m writing a new blogpost, Microsoft published a new Build 25169.
Here you can download the ISO or VHDX file

To Build your Test and innovation LAB with the newest Microsoft technologies, you need a platform to Build on. Of course Microsoft Azure Cloud Services is Awesome to work with and Great to make test environments but I like to make a Azure Hybrid scenario with Azure Cloud and On-premises datacenter services like for example a Microsoft SQL Cluster with Cluster resources / Instances.
So my MVPLAB will be Azure Hybrid and for On-premises I use Windows Server Hyper-V to make virtual servers.

It’s Great when your hardware provider like Dell is Microsoft Azure Stack HCI compliant to build your Hyper Converged Infrastructure in your on-premises datacenter.

Microsoft Azure Stack HCI Solution

When you work with Microsoft Azure and Azure Stack HCI, you really need Windows Admin Center for Hybrid IT Management.
This is a Great Administrator tool for managing your Windows Servers, Clusters, Azure Stack HCI, and Azure VM’s in a Hybrid environment.

Windows Admin Center Cluster Overview

Now that we have everything and Hyper-V is running, we will build the Following Windows Servers with the Insider Preview Build:

  • MVPDC01 ( the first domain controller for mvplab.local domain )
  • MVPStore01 ( ISCSI Target Host for deploying ISCSI Virtual Disks to my Cluster)
  • MVPFS01 ( Cluster Node 01 of Cluster MVPCL01 )
  • MVPFS02 ( Cluster Node 02 of Cluster MVPCL01 )

I install all the virtual servers with 50GB local harddisk for OS and start with 4GB of Dynamic Memory and a Nic.
Only the Cluster nodes get two Nics (One for Heartbeat of the Cluster)
This is for my MVPLAB, but for Production environments I always start with 3 Nics ( 1 = Production 2 = Heartbeat 3 = Storage )

In Hyper-V we make a New Virtual Machine with these specifications and we attach the Windows Server Insider Preview Build ISO.
We install Windows Server Insider Preview Build default and after the installation we set the NIC IP-Address on static and gave the Server the name MVPDC01. Then I installed all the Windows Updates, and after that I started Server Manager to install the Active Directory Feature :

Active Directory just follow the wizard and don’t forget to run DCPromo to
build your domain.

Active Directory and DNS is running locally like
mvplab.local

So now is my domain and DNS running in my MVPLAB, but what do I need more first to build a Windows Server Insider Cluster?
We need Shared storage, so we build a Windows Server Insider ISCSI Target Host to provision Shared VHD’s via ISCSI Initiator to the Cluster Nodes.

The Next member Windows Server Insider is MVPStore01.mvplab.local joined in our new domain. Here I installed the iSCSI Host features:

Start Server Manager and the Add Server role :
– iSCSI Target Server
– iSCSI Target Storage Provider

Click on Install

In Hyper-V Settings of the Virtual Machine MVPStore01, I have installed a extra disk of 25GB so that we can use that for iSCSI Target Host which is now running on this Server. Now we can provision storage when the new Windows Server Insider Cluster MVPCL01.mvplab.local is installed with the iSCSI Initiator to get Cluster storage. So now we are first going to build a Windows Server Insider Cluster and after that we will provision the Cluster Storage.

Installing a Windows Server Cluster with Insider preview Build 25158.

I deployed two member servers MVPFS01.mvplab.local and MVPFS02.mvplab.local into the new domain. they have static IP-Address and are working fine with DNS resolving. On both Servers I installed the Feature Failover Clustering

Failover Clustering Installed.

from here we are going to install the new Windows Server Insider Cluster MVPCL01.mvplab.local

Start Failover Cluster Manager.
Create Cluster.

Click on Next

select the two new Cluster Nodes
Click on Next

Select Yes, run configuration validation tests
Click on Next

Click on Next

Run all tests
Click Next

Confirmation
Click Next

Type in the new Cluster name => mvpcl01
IP-Address => 192.168.2.43
Click Next

Confirmation
Click on Next

Creating Cluster….

We now have a Cluster mvpcl01.mvplab.local running, but without storage and without the witness disk. the iSCSI initiator is running on both Cluster nodes, so now we have to provision storage to the Cluster via the iSCSI Target Host MVPStore01.mvplab.local.

iSCSI Storage provisioning to Windows Server Insider Cluster

via the Server Manager of the iSCSI Target host, we are going to create a new iSCSI Virtual Disk for both Cluster Nodes :

Click on New iSCSI Virtual Disk

iSCSI Virtual Disk Name
Click on Next

Type in the Size I’m using 20GB of 24,9 because I need also a Quorum disk for the Cluster.
Select Fixed Size.
Click on Next.

New iSCSI Target
Click on Next

Give the iSCSI Target a Name
Click on Next

Add the Access Servers via iSCSI Initiator
Click on Next

Here you can set Authentication if you want.
Click on Next

Confirmation
Click on Create

the iSCSI Virtual Disk is successfully created.

the iSCSI Target VHD is not connected yet.
Now we connect with iSCSI Initiator from the Cluster Nodes.
The work on iSCSI Taget Host MVPStore01.mvplab.local is Done.

When you start the iSCSI Initiator it will set the services and the firewall settings on the Server.
You have to do this on both Cluster nodes.

First we add the Target portal and that is our iSCSI Taget Host MVPStore01.mvplab.local with
IP-Address 192.168.2.46 with port 3260.
This is under the discovery tab.

Select Targets tab
you see the Target mvpstore01 Inactive.
Select and click on Connect.

If you had Multi-path IO running, you could enable Multipath too.
Click on Ok

The iSCSI Taget Virtual Disk is connected.

On the iSCSI Target Host MVPStore01.mvplab.local is the target now also in Connected status.

You now can now bring the 20GB disk Online via Disk Management and give it a drive letter
for the Cluster.
Then you can add the 20GB disk via Storage of Cluster Manager tool.

 

 

You can make Cluster Shared Volume.

I made a Cluster for a SQL Instance and I made
a 2GB iSCSI Taget VHD for the Witness Disk.

So Now we have Cluster storage running and failovers are working, now we need to configure Quorum witness disk via
Failover Cluster Manager.

Go to more actions on the Cluster.
Configure Cluster Quorum

Click on Next

Select the quorum witness
Click on Next

You can configure your witness on different locations.
I will select our 2GB witness disk on our Cluster

Select the Quorum disk
Click on Next

Confirmation
Click on Next

You have successfully configured the quorum settings for the Cluster
Click on Finish

Witness disk is running.

So my Microsoft Windows Server Insider Cluster is ready for workloads, if you want to you can run a Cluster validation to see
if everything is okay. Now my MVPLAB is ready for the next installation on my Cluster and that is :

Installing the Newest SQL Server 2022 CTP2.1 on my Windows Server Insider Cluster.

But that will be a next Blogpost : Installing SQL Server 2022 CTP2.1 on a Windows Server Cluster 😉
Follow me on Twitter : @Jamesvandenberg

 


Leave a comment

Running #Ubuntu and #Debian Linux distro on Windows Server 2022 Preview with #WSL2

Running Ubuntu and Debian Linux Distro on Windows Server 2022
Preview Build 25120.1010 with WSL 2.0

In the Week of MS-Build 2022 Event, Microsoft is announcing that WSL 2.0 is coming to Windows Server 2022 Preview Build on twitter.

In the following step-by-step guide we will install Windows Subsystem for Linux 2.0 (WSL) on Microsoft Windows Server 2022 Insider Preview Build 25120.1010 to run Ubuntu and Debian Linux Distro’s.

Here you can download Windows Server 2022 Insider Preview Build ISO or VHDX disk
when you are registered as a Windows Insider.

Windows Server 2022 Insider Preview Build 25120 Installed.

Install the latest updates.

Open Windows Server Manager.

I Have installed the following :

  • Containers ( because I like this for later in my MVP Lab )
  • Hyper-V
  • Windows Subsystem for Linux
  • VirtualMachine Platform
  • Reboot the System after installation.

dism.exe /online /enable-feature /featurename:VirtualMachinePlatform /all /norestart

When the Virtual Server is up, you have to bring it down to make nested virtualization possible when you run your server on a Hyper-V Host like me.

On the host in PowerShell administrator mode :

Set-VMProcessor -VMName WIN2022 -ExposeVirtualizationExtensions $true

Start the Virtual Machine.

wsl –install

wsl –update

WSL 2.0 is Installed

wsl –status

wsl –install -d Ubuntu

I did the same for Debian wsl –install -d debian

Here you can see both Linux distro’s on Windows Server.

Here we are running both WSL 2.0 Linux distro’s Ubuntu and Debian on Windows Server Insider Preview Build together at the same time 😉

Here I’m running VSCode on Remote WSL Debian Linux distro.

More information about Microsoft WSL you can find here on Docs.

Important:

All this is still in Preview and not ready for production environment yet. I installed this all in my MVP Test Lab for learning and testing. Hope you find this useful for your test environment to play with the newest Windows Server 2022 Insider Preview and WSL 2.0 with
all kind of Linux distro’s.


Leave a comment

Windows Admin Center and Deploying Windows Server Insider Build 25099 Core #WindowsAdminCenter #Winserv #WIMVP

Windows Admin Center Version 2110.2 Build 1.3.2204.19002

Windows Admin Center is a customer-deployed, browser-based app for managing servers, clusters, hyper-converged infrastructure, and Windows PCs. It comes at no additional cost beyond Windows and is ready to use in production. Learn more about Windows Admin Center.

Benefits

  • Simple and modern management experience
  • Hybrid capabilities
  • Integrated toolset
  • Designed for extensibility

Languages
Chinese (Simplified), Chinese (Traditional), Czech, Dutch (Netherlands), English, French, German, Hungarian, Italian, Japanese, Korean, Polish, Portuguese (Brazil), Portuguese (Portugal), Russian, Spanish, Swedish (Sweden), Turkish

In the following step-by-step guide I will deploy Windows Server 2022 Insider Build 25099 Core Edition with Windows Admin Center tool together with some great features for managing Windows Servers in a secure hybrid way with Microsoft Azure Cloud services. Like Azure Defender for Cloud, Azure Backup Vault, Azure Monitor, Security and more.
So I have Windows Admin Center 2110.2 installed and I have a Windows Server 2022 Hyper-V Server for my Virtual Machines in my MVPLAB Domain.
Now we will deploy the new Windows Server 2022 Insider Preview Build 25099.

In WAC on my Hypervisor in Virtual Machines

When you explore and open your Hyper-V Host and go to Virtual Machines, you can Click on Add and then on New for Creating your Windows Server Insider VM.

Create a New Windows Server Insider VM called StormTrooper01

Here you can configure your new Windows Server 2022 Insider VM with the following :

  • What kind of Generation VM (Gen 2 Recommended)
  • The path of your Virtual Machine and the path of your virtual disk(s)
  • CPU and you can make nested Virtualization too
  • Memory and use of Dynamic Memory
  • Network select the Virtual Switch
  • Network Isolation by VLAN
  • Storage, Create the size of the Virtual Disk. Choose an ISO or Select an existing VHD(x)

I Created a New 70GB OS Disk
and I want to Install the New Windows Server Insider OS from ISO.
Click on Browse

Here you Browse Default on your Hyper-V Host and select the ISO.

When the Windows Server ISO is selected you can hit Create

We get the Notification that the virtual machine is successfully created.

Only the Virtual Machine is now made with your specs and visible on the Hyper-V Host.
Select the New Virtual Machine (StormTrooper01) click on Power and hit Start.

After you started the VM, you can double click on it and go to Connect.
Click on Connect to the Virtual Machine.

Now you are on the console via VM Connect.

Click on Install Now

We are installing Windows Server 2022 Insider Core edition, because we have WAC 😉

Installing Windows Server 2022 Insider Core Preview Build 25099 via Windows Admin Center

Create New Administrator Password.

And here we have Sconfig of the Windows Server 2022 Core.
via Virtual Machine Connect.

Now we can add and connect the New Virtual Machine with Windows Server 2022 Insider Preview Build in Windows Admin Center via IP-Address.

The Next step is to join the Windows Server 2022 Insider to my Domain MVPLAB.

Click on the Top on Edit Computer ID
Click on Domain and type your domain name.
Click op Next
Add your administrator account for joining the server
Reboot the VM.

Windows Server 2022 Insider Preview Core edition is domain joined.

Now we have the New Microsoft Windows Server 2022 Insider Preview Build 25099 running in Windows Admin Center, we can use all the tooling provided by WAC also in a Azure Hybrid way. Think about Azure Defender for Cloud, Azure Monitor. In Microsoft Windows Admin Center we also have a topic Azure Hybrid Center :

Here you see all the Azure Hybrid benefit features for your Windows Server 2022 Insider.

  • Microsoft Azure Arc
  • Azure Backup
  • Azure File Sync
  • Azure Site Recovery
  • Azure Network Adapter
  • Azure Monitor
  • Azure Update Management
  • and More…

Microsoft Azure and the Windows Admin Center Team made the wizards customer friendly and easy to get those Azure Hybrid services for your Windows Server.
When you have your Server running, you want to make backups and Monitoring your Server for management. And after that you want to be in control of your security of your new Server. In the following steps you see some examples on the same Windows Server 2022 Insider Preview Build:

Microsoft Azure Backup via WAC

Click on Azure Backup
Select your Azure Subscription and the Azure Backup Vault.
Select your data and make the schedule.

Enter the Encryption passphrase and Apply.

Here you have Azure Backup Vault working together with WAC.

Azure Defender for Cloud Security

Click op Microsoft Defender for Cloud
Click on Setup
Add the right Azure Subscription and Workspace
Click on Setup.

Configuring Azure Defender for Cloud agent and Subscription.

Azure Defender for Cloud in Windows Admin Center on your Windows Server 2022 Insider Preview Build.

In Windows Admin Center there is also a Security tab for the Windows Server.

Here you can see your Secured-Core status

Here you can see if your system is supported for this security features 🙂

Enable the supported features and Restart de Virtual Machine.

And here you see my status overview.

Further more you can manage RBAC in Windows Admin Center when you have to work with different kind of users.

You can find RBAC in settings.

Conclusion

Windows Server Insider Core edition and Windows Admin Center are working better together! You have all the tools you need to startup your Windows Server and
manage it with WAC. Windows Admin Center is getting better and better to manage your Hybrid Datacenter and keep you as an Administrator in Control!
So is how I manage my MVPLAB but also for Production workloads I use Windows Admin Center and the Azure Portal together. With Microsoft Azure Arc Services
Azure Hybrid becomes your solution where Windows Admin Center can Support you with making Azure Stack HCI Clusters with Azure Kubernetes for your DevOps environment.

Windows Admin Center Community Group on LinkedIn


Leave a comment

#Microsoft Windows Server and SMB Protocol #Winserv #WindowsServer2022

Server Message Block (SMB)

The Server Message Block (SMB) Protocol is a network file sharing protocol, and as implemented in Microsoft Windows is known as Microsoft SMB Protocol. The set of message packets that defines a particular version of the protocol is called a dialect. The Common Internet File System (CIFS) Protocol is a dialect of SMB. Both SMB and CIFS are also available on VMS, several versions of Unix, and other operating systems.
Here you can see the versions of MS-CIFS and download free white papers

Today SMBv1 is a not save protocol and will be used by hackers for man in the middle attacks to compromise your data and systems. SMBv1 is a weak protocol and should not be used in your environment. There are still a lot of Windows Servers 2012 R2 in the world running in datacenters with SMBv1 by Default enabled. To make your Windows Server more secure, you can disable SMBv1 protocol via a Group Policy Object (GPO).

In the following steps we will disable SMBv1 on Windows Servers via GPO.

Open Group Policy Management in your Domain.

Click on Group Policy Object with your right mouse button.
Click on New.

Give your policy a Name.

I made also an temporary Exception policy.

Right click on your new Policy Object.
Click on Edit.

Go to Computer Configuration => Preferences => Windows Settings
Click on Registry.

Click on New and then on Registry Item.

Here you have to add the following Registry Properties:

Set these settings.

Set Path: HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters

Click on Apply for these Registry settings.

SMBv1 Disable setting is set in the Policy Object.

This is the path where we push the policy via GPO.

Here we Link the Existing GPO to the OU with the Windows Server 2012 R2
to disable SMBv1 Protocol.

Select your new Policy to disable SMBv1 Protocol.

We have now Linked the new GPO to Disable SMBv1

GPUpdate /force on your Server to disable SMBv1
To get the new GPO active on your Server.

Policy Update successfully.

GPResult /r to see the results.

Get-SmbServerConfiguration | Select EnableSMB1Protocol

or

Get-SmbServerConfiguration

You can still as a administrator enable SMBv1 on your Server with :

Set-SmbServerConfiguration -EnableSMB1Protocol $true

When the Server gets a reboot, SMBv1 will be disabled by GPO again.

When you have maintenance window for updates for example, you can un-install the SMBv1 Feature in Server Manager. This procedure needs a restart of the Windows Server.

Go to Server Manager remove features.

Click on Remove Roles and Features.

Remove the mark at SMB 1.0/CIFS File Sharing Support Feature.

Click on Remove.

Click on Close and Reboot the Server

Now SMBv1 protocol on the Windows Server is disabled and will use a higher version of SMB like version 2.x or 3.x.

More Microsoft information can be found here on Docs.

SMB over QUIC on Windows Server 2022

SMB over QUIC introduces an alternative to the TCP network transport, providing secure, reliable connectivity to edge file servers over untrusted networks like the Internet. QUIC is an IETF-standardized protocol with many benefits when compared with TCP:

  • All packets are always encrypted and handshake is authenticated with TLS 1.3
  • Parallel streams of reliable and unreliable application data
  • Exchanges application data in the first round trip (0-RTT)
  • Improved congestion control and loss recovery
  • Survives a change in the clients IP address or port

SMB over QUIC offers an “SMB VPN” for telecommuters, mobile device users, and high security organizations. The server certificate creates a TLS 1.3-encrypted tunnel over the internet-friendly UDP port 443 instead of the legacy TCP port 445. All SMB traffic, including authentication and authorization within the tunnel is never exposed to the underlying network. SMB behaves normally within the QUIC tunnel, meaning the user experience doesn’t change. SMB features like multichannel, signing, compression, continuous availability, directory leasing, and so on, work normally.

Client Server Handshake and Data transfer differences.

Here you find a Great blogpost of Ned Pyle

SMB over QUIC: Files Without the VPN

Conclusion

When you still have Windows Servers running with SMBv1 by default enabled, for security you should disable SMBv1 protocol as soon as possible! Otherwise you make it easy for hackers to compromise your data with man in the middle attacks. In Windows Server 2019 and higher SMBv1 is disabled by default. Have a look at SMB over QUIC in your test environment and learn how secure it is and how it works for your security and data.


Leave a comment

Windows Admin Center 21.10 Build 1.3.2111.01001 Secured-Core #Security #WindowsAdminCenter

Windows Admin Center Security

Secured-core – recommended for the most sensitive systems and industries like financial, healthcare, and government agencies. Builds on the previous layers and leverages advanced processor capabilities to provide protection from firmware attacks.

In Windows Admin Center Security you can Configure Secured-Core :

Secured-Core in Windows Admin Center 21.10

You can activate 6 secured-Core feature :

  • Hypervisor Enforced Code Integrity (HVCI)
  • Boot DMA Protection
  • System Guard
  • Secure Boot
  • Virtualization-based Security (VBS)
  • Trusted Platform Module 2.0 (TPM2.0)

You now can simply activate the Security Feature.
Needs a Reboot

Hypervisor Enforced Code Integrity (HVCI) is enabled.

More information about Secured-Core Features

Windows Admin Center Community on LinkedIn


Leave a comment

What’s New in Windows Server 2022 Security! #Winserv #Security #WindowsServer2022 #SecOps

Microsoft Security Compliance Toolkit 1.0

The Microsoft Security Configuration Toolkit enables enterprise security administrators to effectively manage their enterprise’s Group Policy Objects (GPOs).  Using the toolkit, administrators can compare their current GPOs with Microsoft-recommended GPO baselines or other baselines, edit them, store them in GPO backup file format, and apply them via a domain controller or inject them directly into testbed hosts to test their effects. For more information, see Windows Security Baselines.

 

Baseline security policies for Windows Server 2022.

But what’s new in Microsoft Windows Server 2022?

Here we have some new Windows Server 2022 security features :

  • Secured-core server

  • Hardware root-of-trust

  • Firmware protection

  • Virtualization-based security (VBS)

  • Secure connectivity

    • Transport: HTTPS and TLS 1.3 enabled by default on Windows Server 2022

    • Secure DNS: Encrypted DNS name resolution requests with DNS-over-HTTPS

    • Server Message Block (SMB): SMB AES-256 encryption for the most security conscious

    • SMB: East-West SMB encryption controls for internal cluster communications

    • SMB over QUIC

  • Azure Arc enabled Windows Servers

  • Windows Admin Center

  • Azure Automanage – Hotpatch

You can read more information on these topics on Microsoft Docs

Windows Server 2022 security features

In the following steps you will see some of the security features of Microsoft Windows Server 2022.

When your Windows Server 2022 is running on a Hypervisor like Hyper-V, you can set Memory integrity under Windows Security to ON.
This prevents attacks from inserting malicious code into high security processes. When you set this security feature on, the Server needs a reboot to activate.
Memory Integrity needs a reboot.

Windows Security Notifications.

By default Virus & Threat protection notification is active, when you want notifications about Microsoft defender firewall blocking a new application, you have to turn this feature on and select the firewalls.

In Windows security we have also ransomware protection. 
Protect your files against threats like ransomware, and see how to restore files in case of an attack.
You can do this by Controlled folder access.
Protect files, folders and memory on your Server from unauthorized changes by software.

Protected folders.

New in Windows Server 2022 is Tamper protection in Windows Security.
This Prevents others from tampering with important security features.

 

This was all Microsoft Windows Server 2022 security in the VM, but how about your Windows Server 2022 Hyper-V Hypervisors?

Hypervisor-protected Code Integrity (HVCI) is a virtualization based security (VBS) feature available in Windows. In the Windows Device Security settings, HVCI is referred to as Memory Integrity.

HVCI and VBS improve the threat model of Windows and provide stronger protections against malware trying to exploit the Windows Kernel. VBS leverages the Windows Hypervisor to create an isolated virtual environment that becomes the root of trust of the OS that assumes the kernel can be compromised. HVCI is a critical component that protects and hardens this virtual environment by running kernel mode code integrity within it and restricting kernel memory allocations that could be used to compromise the system.

See Virtualization Based Security System Resource Protections for more details on these protections.

 

Here you find a great video with a session of Jeff Woolsey Principal Program Manager at Microsoft. It’s all about What’s new in Windows Server 2022.

Conclusion

Start with Microsoft Windows Server 2022 today and make your test environment to play with Windows Server 2022 and Security.
Make your core business application solution more secure then ever, and let a ethical hacker do pen tests on your solution.
When you have security by default in your architectural designs, and test your Windows Server 2022 for production workloads it makes a big different to keep your environment and solution safe. And when you monitor your Windows Server 2022 solution pro-active with Azure Monitor, Azure Security Center, Azure Defender like this with Azure Arc enabled Servers

This keeps you in Control on Security by design for your business.