Tag: Microsoft

Azure

Azure: Cost Optimisation – Enabling Hybrid Use Benefit (HUB)

I used to spend most of my time discussing with customers the benefits of moving business services to the cloud. Most no longer need to be convinced, in fact many have already dabbled with services and instead are looking for guidance on how to enforce governance and better manage costs.

Cost optimisation in Azure is a large topic and by adopting a number of technologies and processes it is possible to make rewarding cost savings.

Along with investing in reserved instances one of the biggest cost savers for Windows VMs can be make through the use of the Microsoft Hybrid Use Benefit (HUB).

What is Hybrid Use Benefit (HUB)

The Azure Hybrid Benefit helps you get more value from your Windows Server licences and save up to 40 per cent* on virtual machines. You can use the benefit with Windows Server Data Centre and Standard edition licences covered with Software Assurance or Windows Server Subscriptions. Depending on the edition, you can convert or re-use your licences to run Windows Server virtual machines in Azure and pay a lower base compute rate (Linux virtual machine rates).

* Actual savings may vary based on region, instance type or usage.

Paragraph from HUB FAQ

It’s worth noting that licensing entitlement is different between Windows Server Datacentre and Windows Server Standard editions.

  • Windows Server Datacentre with Software Assurance allows you to use the license on-premises and simultaneously in Azure
  • Windows Server Standard with Software Assurance allows you to use the license on-premises or in Azure

With both editions, each two-processor licence or each set of 16-core licences are entitled to two instances of up to 8 cores, or one instance of up to 16 cores.

Enabling Hybrid Use Benefit 

Hybrid Use Benefit can be enabled when deploying a Windows VM either from the marketplace, as part of an ARM template or PowerShell script. It can also be enabled post deployment.

I’ve focused on PowerShell and outlined below are a few commands that might be of use. Its also worth mentioning that its possible to do the majority of this through the portal or Azure CLI.

Dependencies

The first thing to do is make sure that you have the Azure PowerShell module installed.

If you already have the module installed, I would suggest checking that you are running the latest version. This can be done by running the following command.

How do I know if Hybrid Use Benefit is enabled on a VM?

Its possible to check if Hybrid Use Benefit is enabled on a machine by looking at the virtual machines blade in the Azure Portal.

Browse to the virtual machine blade, from the top ribbon select Edit columns and then add Azure Hybrid Benefit to the selected columns list.

Once the Hybrid Use Benefit column has been added to the blade view, its easy to scan down and see which machines have been enabled or not.


As you would expect, its also straight forward to pull back the same information across all machines using a simple PowerShell command.

The following PowerShell snippet outputs just the Windows machines that HUB is enabled for and ignores the rest.

This screenshot is of the above PowerShell snippet being run from within Azure Cloud Shell.

Converting an already deployed VM

For Windows machines deployed with Pay-as-you-go licensing, its a simple process to convert them to Hybrid Use Benefit. As before this can either be done from within the Azure portal or using a simple PowerShell command such as the one below.

NOTE: Changing the license type only updates the machines metadata flag. This means there is no downtime or service interruption to the system. 

Converting back to Pay-as-you-go Licensing

Reverting the VM to Pay-as-you-go licensing is done using the same command. This time, the licensing type needs to be changed to None before running.

Change the license type of every Windows VM in the subscription

Updating the license type of multiple VMs one at a time can be very time consuming. To speed things up, I would recommend reviewing the following script created by Neil Bird a Premier Field Engineer at Microsoft.

The script not only allows you to change the licensing type across all Windows VMs but it also offers a Simulate Mode where no changes are actually made. Instead, LOG and CSV export files are generated to show what changes the script would make if ran in Update Mode.

https://gallery.technet.microsoft.com/Azure-Enable-Hybrid-Use-1977e089

 

For more details checkout the Microsoft document site https://azure.microsoft.com/en-gb/pricing/hybrid-benefit/

Application Gateway

Azure: Application Gateway https to https redirect

One key feature of the Application Gateway service is its support for Secure Sockets Layer (SSL) termination. This feature means that the overhead of encrypting and decrypting traffic can be offloaded to the gateway, rather than have this impact performance on the backend web server.

This does however mean that communication between the application gateway and the backend web server is unencrypted which in some cases, perhaps due to security or compliance requirements, may not be acceptable. For those situations, the application gateway also fully supports end to end SSL encryption.

For the purpose of this article, the assumption has been made that SSL termination is enabled on the gateway. Standard web traffic should now be redirected to the https listener so that web requests don’t just fail when they are unable to traverse the application gateway over https.

Enabling https to https redirection

When an application gateway is configured with SSL termination, a routing rule is used to redirect https traffic to the https listener. The remainder of this article steps through configuring this routing rule.

Assumptions

The following assumptions have been made:

  • https and https listeners already exist
  • Azure PowerShell module version 3.6 or later is installed.

NOTE: To check what version of PowerShell is installed and for help on upgrading it if required, see Install Azure PowerShell module.

Configuring the routing rule

1. The first thing we need to do is get the application gateway object and store it as a variable

2. Get the existing https listener

3. Get the existing https listener

4. Now create a redirection configuration using a permanent redirect and targeting the existing listener

5. Get the newly created redirect configuration

6. Add a new rule to handle the redirect from the https listener

7. Finally, update the application gateway

To make it a little simpler to copy all steps, they have been combined into one script below. A copy of the file can also be downloaded from my GitHub repository app-gateway-https-https-redirect.ps1

More information about the application gateway and all of its features can be found by following the link to Microsoft document repository – https://docs.microsoft.com/en-us/azure/application-gateway/

Azure

Azure: Disabling the Windows Firewall on an virtual machine from the portal

The RDP client is one of the most heavily utilised tools in a system administrator’s toolkit. There are alternatives, for example, console access, PowerShell, iLO or in the case of a physical machine the locally connected keyboard and monitor. This is fine for on-premise machines but for machines running in the cloud, most of the alternative methods are not an option and RDP becomes a critical method of connectivity.

Over the past months I have seen an increase in the number of customers that have adjusted the guest Windows OS firewall, inadvertently locking themselves out and making it impossible to manage their Azure virtual machines.


The following article outlines one of the methods I have successfully used when restoring access. This method makes use of the Azure virtual machine Custom Script Extension and a snippet of PowerShell.

1. The first step is to open your preferred PowerShell editor and paste in the following code.

Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy
\DomainProfile' -name "EnableFirewall" -Value 0

Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\
PublicProfile' -name "EnableFirewall" -Value 0

Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\
Standardprofile' -name "EnableFirewall" -Value 0

These commands update local registry values which in turn disables the three firewall profiles on the next machine reboot.

A copy of the file can be downloaded from my GitHub disablefw.ps1.


2. Save the file as <filename>.ps1

3. Now login to the Azure portal and browse to the virtual machine that is having connectivity problems.

4. From the blade of the virtual machine, select Extensions


5. Click the +Add button and select Custom Script Extension from the popup menu.


6. Click on the folder icon to browse to where the <filename>.ps1 file has been stored and after selecting the file, click Open to upload it.


7. The virtual machine extension can now be installed by clicking OK.

NOTE: Additional Arguments are optional and for this task should be left blank.

8. Once the extension is installed, the Azure portal will report that provisioning has been successful.


9. It’s now time to restart the virtual machine before retrying an RDP connection.


This has proven to be very useful to me on a number of occasions, hopefully it will be of assistance to others.

As always, if any mistakes are spotted, feel free to leave me a comment.

Server 2008

Changing the Network Location of a Windows 2012 R2 Server Network Connection

It’s sometimes necessary to manually change the network location configuration of a Windows 2012 R2 Servers network connection. There are two common approaches to this, either by Local Group Policy or PowerShell. In this post I will be stepping through how to implement either method.

Windows classifies networks connections into one of three profiles, each profile configures the server with different firewall settings.

  • Private: Used for computers on a private or home network. This allows you to see computers and devices, while making your computer discoverable.
  • Public: Used for computers on a pubic network such as a coffee shop or internet café. Designed to keep your computer from being visible to other computers around you and to help protect your computer from any malicious software from the Internet.
  • Domain: Used for computers that belong to enterprise network.

By default new network connections are configured with the public profile, however, if ADDS (Active Directory Domain Services) are found on the network, the profile automatically changes to domain.

Changing the Network Location by Local Group Policy

1. Run gpedit.msc to open the Local Group Policy Editor

2. Navigate to Computer Configuration / Windows Settings / Security Settings / Network List Manager Policies and double click the appropriate Network Name

3. From the popup window select the Network Location tab, then select the correct location type

CNL03
4. Click OK and close the Local Group Policy Editor

CNL04
5. Finally checking back in the Network and Sharing Center, the network profile should now display the options chosen in the previous steps.

CNL05

Changing the Network Location by PowerShell

As with most things on Server 2012 it is possible to use PowerShell to change the network category. We first need to list the network connections and make note of the InterfaceIndex associated with the network connection we are looking to reconfigure.

1. Open an elevated PowerShell prompt and run the following CmdLet

Get-NetConnectionProfile

CNL06
2. Make note of the InterfaceIndex for the network connection that requires its location changing. We can then use the following command to change the connections network location type

Set-NetConnectionProfile -InterfaceIndex <ID> -NetworkCategory <Category>

For Example:

Set-NetConnectionProfile -InterfaceIndex 12 -NetworkCategory Private

CNL07
3. To confirm changes have been made, rerun the Get-NetConnectionProfile CmdLet and review the NetworkCategory reflects the change.

CNL08

Azure

Microsoft Partner Technology Solutions Professional (P-TSP) for Azure

I’ve recently been nominated and accepted by Microsoft as a Partner Technology Solutions Professional (P-TSP) in Azure!

The Microsoft Partner Technology Solutions Professional Program (P-TSP) is a select group chosen from the various Microsoft partners to act as an extension of the Microsoft’s internal Technology Specialist team. The program is geared to offer real world experience and guidance for Microsoft customers during pre-sales engagements or architectural guidance for enterprise solutions and upgrades.

I’m over the moon to have been put forward for this program and keen to begin integrating more with the guys at Microsoft. I wait to see where this opportunity leads me.

 

Events

Events: Silversands Azure Seminar at Mercedes Benz World

One of the activities I get involved with from time to time is presenting at customer seminars. Recently I was asked to participate in an Azure round table event hosted at Mercedes Benz World.

Key discussion points included:

  • Azure Site Recovery
  • Azure Backup
  • RemoteApp
  • StorSimple
  • Azure AD Premium
  • Express Route

The feedback from the event was great and two lucky customers were even able to take to the test track.

 

Azure Networking

Test Network Speed and Latency to Azure

Just a quick post to mention one of the many Azure tools out there. This one in particular is for the network admin who have the need or are just interested in checking network connection speed and latencies to the Azure data centres.

TestLat001

https://azurespeed.com comes with a number of useful tests and is ideal during the project planning stage. For example, when planning to migrate a LOB application to Azure, which region would offer the best user experience.

Features include:

Latency Test
This test allows administrators to test network latency to Azure Storage in worldwide data centres.

CDN Test
This is currently unavailable do to attackers.

Upload Speed Test
This test makes it possible to checkout upload speeds to Azure Blob Storage located in different worldwide data centres.

Large File Upload Speed Test
This test allows administrators to test large file uploads to Azure Blob Storage, again in worldwide data centres, with additional upload options.

Download Speed Test
As the title suggests, this test monitors download speeds from different data centres when downloading a 100MB file.

Live Streaming Latency Test
Test latency from remote Azure Media Services live streaming.

Cloud Region Finder
Cloud Region Finder enables you to quickly lookup cloud and region information of application deployment, try it by entering url or ip address now! Currently Azure, AWS, AliCloud are supported.

Traffic Manager Test
Demonstrates the capability’s of Azure Traffic Manger.

Azure Online Tools available.
Additional Azure Online Tools.

A short but hopefully interesting post and well worth a quick visit! 🙂

Backup Vault

Azure Backup: Installing Microsoft Azure Backup

As mentioned in my previous post here Microsoft have added the ability to backup additional workloads such as SQL, Exchange, Hyper-V and SharePoint to the cloud. Essentially this version of Microsoft Azure Backup is actually nothing more than a rebranded version of System Center Data Protection Manager with the backup to tape option replaced with the cloud and the ability to integrate with System Center removed. However, where no separate license is required, I believe this now opens the door to many new enterprises and I’m sure it will become a very favourable cloud backup solution.

In this post I will step through the process of configuring a Microsoft Azure Backup Vault, installing Microsoft Azure Backup and registering it with the previously created vault.

Apart from the extra application workloads, the main difference Azure Backup has to the Azure backup agent is the fact that as with DPM, it requires its own server to run on. This server can be configured as:

  • Physical or Virtual (on-premise or in the cloud)
  • Windows Server 2008 R2 SP1, 2012 and 2012 R2.

NOTE: The server must NOT have SCDPM or the SCDPM agent installed, nor should the Microsoft Azure Backup agent be installed and registered with an Azure Backup Vault.

Hardware Requirements

  • Processor: Minimum: 1 GHz, dual-core CPU, Recommended: 2.33 GHz, quad-core CPU
  • Memory: Minimum: 4GB, Recommended: 8GB
  • OS Disk: Minimum: 3GB, Recommended 3GB
  • Dedicated Data Storage Disk: Recommended storage pool size is 1.5 times the size of protected data
  • Disk space of at least 5% of the data backed-up to the cloud is required by the Microsoft Azure Backup agent for its scratch location. (By default this is on the OS drive but it can be moved to a dedicated disk)

Additional Prerequisites

  • Microsoft Azure Backup server should have internet connectivity
  • Microsoft Azure Backup server must be domain joined
  • Microsoft Azure Backup server must have .Net 3.5, .Net 4.0 and .Net 3.5 SP1 features installed
  • Microsoft Azure Backup server should have Windows Management Framework 4.0 installed.

Create a Microsoft Azure Backup Vault

Once a base server has been prepared, the next step is to preconfigure the Azure Backup Vault. The Microsoft Azure Backup Serer will be registered with the vault later.

To create an Azure Backup Vault, firstly browse to https://manage.windowsazure.com and sign in to the Azure Portal with your credentials.

Scroll down the left hand menu and click on the  Recovery Services tab.

ABS001
In the main window click on CREATE A NEW VAULT.

ABS002
Select Backup Vault > Quick Create before giving the backup vault a Name and Region and clicking the check to create the Backup Vault. The Region will be the location  in which the data is stored, choosing the correct location can help reduce network latency when backup up data to Azure.

ABS003
Once the Backup Vault has successfully been created it will appear in the list of recovery services resources as Active.

ABS004
Once items have been archived to the Backup Vault its not possible to change the replication type, so its at this point we need to decided how this should be configured.

  • Geo-Redundant Storage (GRS) maintains six copies of your date. Three times within the primary region and three times in a secondary region. In the event of a failure at the primary region, by sporting data in GRS, Azure Backup ensures that your data is durable. (One thing to note here is that the data in the secondary region can only be accessed by Microsoft during a failure to their systems)
  • Locally Redundant Storage (LRS) maintains three copies of your data. The data is replicated three times within a single facility in a single region. This would protect your data from normal hardware failures, but not form failure of an entire Azure facility.

By default a Backup Vault is configured with Geo-Redundant Storage, to change this click on CONFIGURE before changing the replication option and clicking SAVE to complete the change.

ABS005

Installing Microsoft Azure Backup Server

Before we can begin the install of Microsoft Azure Backup server we need to first download the installation software for Azure Backup and also the Backup Vault credentials which are needed for registering the server with the Backup Vault. Both downloads can be found on the Quick Start tab of the Backup Vault.

Microsoft Azure Backup can also be downloaded directly from here

ABS006
Microsoft Azure Backup comes split up into six separate files, five .bin files and  single .exe. Download them all to the same location and then run MicrosoftAzureBackupInstaller.exe, this will begin the setup wizard.

On the first screen click Next to continue.

ABS007
On the next screen choose a location for setup to extract its files or leave the default. When happy with the location, click Next.

ABS008
Click on Extract to begin extracting the install files.

ABS009
By default, Execute setup.exe is checked, leave this checked and click Finish if you wish to continue with the installation. Otherwise, uncheck the option and click Finish.

ABS010
On the Microsoft Azure Backup splash screen select to install Microsoft Azure Backup.

ABS011
On the Welcome page, click Next.

ABS012
On the next page click on the Check button to confirm the server meets software and hardware requirements. Resolve any issues that are raised before continuing by clicking the Next button.

ABS013
Choose whether to use a new or existing instance of SQL then click Check and Install to begin prerequisite checks and install any missing Windows components.

ABS014
As long as all prerequisites mentioned at the beginning of the post are installed, the only warning message that should be displayed is to warn the SISFilter has been installed and the server requires a reboot.

Reboot the server and then restart the installer.

ABS015
Once the server has been rebooted, click Check Again and once the computer meets all software and hardware requirements, click Next.

ABS016
The next step is to choose the file locations for the program files, database files and scratch folder, then click Next.

NOTE: As mentioned in the prerequisites, the scratch location must have free space of at least 5% of the data backed up to the cloud.

ABS017
Enter a strong password for the restricted local user accounts the wizard creates, then click Next.

ABS018
Choose whether or not to use Microsoft Update, then click Next.

ABS019
Review configuration and click Install to begin installation.

ABS020
The next stage of the installation installs the Microsoft Azure Recovery Service Agent. If the server connects to the internet by a proxy, this is where the proxy settings need to be added.

Click Next.

ABS022
By clicking Install, setup checks for all prerequisites, installs any that are missing and completes the installation of the Microsoft Azure Recovery Services Agent.

ABS023
Click Next.

ABS024
After the Microsoft Azure Recovery Services Agent has been installed, the next step is to register this server with the Microsoft Azure Backup Vault that was configured at the beginning of this process. To do this browse to the credentials file downloaded from the Backup Vault, then click Next.

ABS025
Enter a passphrase or click the Generate Passphrase button to automatically generate a passphrase. The passphrase requires the minimum of 16 characters. The passphrase should also be saved somewhere safe, if lost it will not be possible to recover data from the cloud or connect other Microsoft Backup Servers to the online replicas.

Click Next to continue.

ABS026
Once the connection has been created to the Azure Backup Vault, the installer continues with the installation of SQL Server, SQL Tools and Microsoft Azure Backup.

ABS027
Once installation has complete, click Close.

ABS028
At this point in the setup process, Microsoft Azure Backup has been installed and associated with the cloud storage in the selected Microsoft Azure Backup Vault. However, before its possible to configure the first protection group and begin backing up data, local storage needs to be added. To do this, double click on the Microsoft Azure Backup icon on the server desktop to open the application.

ABS029a
Click on Management.

ABS029
Click on Disks, then on Add.

ABS030
Select the disk that will be added to the storage pool, click Add then OK.

ABS031
If everything has gone correctly, the disk will appear in the list of disks available to the storage pool.

ABS032
Microsoft Azure Backup is now installed and configured with local and cloud storage. It is now ready to begin configuring protection groups and start to backup data.

That’s it for this post, in future articles I plan to cover more Azure Backup processes so don’t forget to check back!

Azure

Changing an Azure Virtual Network connection from site-to-site VPN to ExpressRoute

With more businesses becoming reliant on the cloud and on-premises datacenters being extended to Azure, ExpressRoute is becoming ever more popular. For customers that already have in place a site-to-site VPN, one of the first things to do after the ExpressRoute circuit has been previsioned is to switch the virtual network connection from a site-to-site VPN to the ExpressRoute circuit.

The following article works through the various steps involved in this process, including:

  • Checking the status of the ExpressRoute circuit
  • Updating the Virtual Network configuration
  • Linking ExpressRoute to the Virtual Network

NOTE: Migrating an existing virtual network from a site-to-site VPN to an ExpressRoute circuit will cause a short amount of lost connectivity between your on-premises network and your virtual network.

If like me you have access to multiple Azure subscriptions, the first thing to do is check you are in the right one. Using the cmdlet below we can pull back the details for the subscription that we are currently working in.

Get-AzureSubscription -Current

vpn2er01
To change subscriptions if required use:

Select-AzureSubscription -SubscriptionID "Subscription ID"

Once working in the correct subscription it is time to import the ExpressRoute PowerShell module. The module doesn’t load by default when PowerShell is run but it is found on the local drive and was installed by the Azure PowerShell installer.

To import the module run:

Import-Module 'C:\Program Files (x86)\Microsoft SDKs\Azure\PowerShell\ServiceManagement\Azure\Azure.psd1'
Import-Module 'C:\Program Files (x86)\Microsoft SDKs\Azure\PowerShell\ServiceManagement\Azure\ExpressRoute\ExpressRoute.psd1'

vpn2er02

Checking the status of the ExpressRoute circuit

It is now possible to check that the ExpressRoute circuit has been provisioned correctly and is in the correct state. Use the Get-AzureDedicatedCircuit cmdlet to pull back information about the current circuits.

Before its possible to assign this circuit to a virtual network we need to make sure that the ServiceProviderProvisioningState is Provisioned and that the Status is Enabled. Once this is the case the circuit is ready!

vpn2er03

Updating the Virtual Network configuration

The first thing we need to do to is update the configuration of the virtual network gateway. To do this we need to first remove the current gateway which will then allow us to make configuration changes. This can be done via the portal and clicking on the Delete Gateway button or by using the Remove-AzureVNETGateway PowerShell cmdlet.

vpn2er04
The next step in configuring the virtual network involves resizing the existing gateway subnet. The site-to-site gateway supports a maximum size of a /29 subnet whereas the ExpressRoute gateway supports a minimum gateway subnet size of /28. As always this can be done either in the management portal or via PowerShell.

VPN2ExpressRoute006
After resizing the gateway subnet but before recreating a new gateway, we need to configure the virtual network for an ExpressRoute connection. To do this open the virtual network configuration tab and check the Use ExpressRoute checkbox in the management portal then click save.

VPN2ExpressRoute007
The final step in upgrading the virtual network configuration is to create a new Gateway. From within the management portal click the CREATE GATEWAY button to recreate the gateway.

VPN2ExpressRoute008
Once the gateway has completed provisioning, the final stage is to link the virtual network to your existing ExpressRoute circuit.

Linking ExpressRoute to the Virtual Network

At this point we can double check the ExpressRoute circuit is still in the correct state,  then finally link the circuit with the virtual network.

Get-AzureDedicatedCircuit

$Vnet = "VirtualNetwork-1"
$ServiceKey = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
New-AzureDedicatedCircuitLink -ServiceKey $ServiceKey -VNetName $Vnet

VPN2ExpressRoute009

A full listing of ExpressRoute PowerShell Cmdlets can be found in this Microsoft article Azure ExpressRoute PowerShell Cmdlets

That’s it for this post, hope its of some help 🙂

Azure

Adding Partner of Record to an Azure subscription

If you have been working with O365 for some time, one thing you would have come across would be the ability to add your company as the Partner of Record for your customers O365 tenancy.  This setting has made it across to Azure and it’s now possible to add yourself as Partner of Record within an Azure subscription. As you would imagine, it’s very straightforward to make this change.

1. The first step is to browse to https://account.windowsazure.com/ and login.

2. Then click on the Subscriptions tab followed by the subscription that you wish to update the settings.

3. From here you will see the following menu displayed down the right hand side of the page.

AzurePoR001

4. Select Partner Information from the menu, this will popup the Partner Information dialog box.

AzurePoR002

5. Type your MPN ID into the Microsoft Partners ID box and click on the check to finalise the update.

I would recommend updating this wherever possible, however, although there is no impact on support or services that your customer get from Microsoft, it’s important to make sure they are happy for you to be the Partner of Record for their subscription. Longer term not only will it allow you to keep up to date with any communications between Microsoft and your customer but there are plans moving forward for Microsoft to use this to allow your customers Azure consumption to count towards competencies and so forth.

NOTE: This is being rolled out gradually and you may find the option is currently greyed out or missing in older subscriptions.