Changing MAC Address on Hyper-V and routing fails

With a traditional computer, running Windows, you can simply go to the network card, change the MAC address and everything works as expected. 

But recently I did this on a Hyper-V server in a SCVMM network and while it would work correctly on the local subnet it could not route to a adjacent connected network. I would fail to ping the remote router.

So to correct this make sure you update the MAC Address in SCVMM computer object.

Hyper-V media disconnection

Got an issue with Hyper-V servers connected to media?

Run this.

[string[]]$cn = Get-ADComputer -Filter * -SearchBase 'OU=Hypervisors,OU=Services,DC=internal' | select -ExpandProperty dnshostname

$vm = Get-VM -ComputerName $cn -Name *

$vm | Get-VMDvdDrive | ? DvdMediaType -ne None | Set-VMDvdDrive -Path:$null

Typical End User…

 

Animation by Lisa Larson-Walker. Images by Den Rise/Shutterstock, courtesy of Rosa Menkman/Flickr Creative Commons.

A simple under the covers description of NTLM/Kerberos

I did not write this, but I liked it. All credit to Summit7.

NTLM

NTLM is a Windows challenge/response authentication protocol that leverages the interactive use of a login box that requires the end user to input their network credentials manually. Those credentials would include the users Username, password and domain name if logging into an organizations domain.

Plain English: end users log in by entering a username, password and domain into a login box. That being said we need to understand at least the basics of the process.

1. NTLM authenticates end users by first creating an encrypted one-way hash of the users password, discarding the original password and then sending the user name to the server in plain text.
2. The server responds to the client with a 16-bit challenge called a nonce.
3. The client encrypts the nonce and the hash of the users password and returns them to the server. This is the Response.
4. The server in turn sends three items to the domain controller; the users name, the challenge sent to the client and the clients response to the challenge. The domain controller retrieves the hash of the user name is has received from the Security Account Manager (SAM) database and uses that hash to encrypt the challenge.
5. Once the challenge has been encrypted by the domain controller it is compared to the challenge encrypted by the client and if they match the end user is authenticated successfully.

Plain English: If you enter your password incorrectly the hashes will not match and you won’t be able to log into the network.

Kerberos

The Kerberos security protocol has been a part of Windows since Windows Server 2000 and was intended as a replacement for NTLM. Obviously that hasn’t happened and the two can often be found working together or in a mixture across Windows environments everywhere.

Kerberos is a Windows Security Protocol designed to authenticate users and services on an organisations network and relies on three components; a client, a service and a trusted third party. The trusted third party in most Windows networks would likely be the Key Distribution Center (KDC) which creates the shared secret that is leveraged to allow access to the service. A simple view of the process might look like this:

1. A user account is created in the domain and assigned a password.
2. The Kerberos client adds a text string, or a SALT and the Kerberos version number to the unencrypted password and runs them through a process known as the “string2key” This conversion generates the “shared secret”.
3. At the client the user enters their username and password and requests access to an application or service.
4. When the user submits their username and password the Kerberos client creates the secret key on the client based on that information. Because the client uses the same key to generate the secret key that the KDC does the two will match, or should anyway. If they don’t match authentication fails and access id denied.

Plain English: If you enter your password incorrectly the hashes will not match and you won’t be able to log into the network.

Thanks to Summit7 for this – full link –> http://summit7systems.com/claims-based-authentication-adfs-3-0-and-sharepoint-2013-beginners-guide/

Setup a secure point-to-site connection to a virtual network in Azure

Configure the network and gateway

Log in to the Azure portal (http://manage.windowsazure.com/). Create a new Virtual Network. Click Custom Create. On the DNS Servers and VPN Connectivity page, then click on: 

• Configure Point-To-Site VPN: Select the checkbox.
• On the Point-To-Site Connectivity page, specify the IP address range from which your VPN clients will receive an IP address when connected. Don't overlap with an on-premise address.

Update the IP range for the Azure subnet

When your virtual network has been created, you will see Created listed under Status on the networks page in the Azure portal. Once your virtual network has been created, you can create your dynamic routing gateway.

 

The gateway type must be configured as dynamic. Static routing gateways will not work with this feature.

1. In the portal, on the Networks page, click the virtual network that you just created, and navigate to the Dashboard page.
2. Create Gateway. It can take around 15 minutes for the gateway to create.

 

Generate and upload certificates

Previously, you were required to generate your own self-signed certificate. Now, you can now use certificates that you generated using an enterprise solution. You can upload up to 20 root certificates to Azure.

Option 1: Planning to use an enterprise certificate solution, the steps within each section will be different, but you'll still need to do the following:

• Identify or generate a root certificate.
• Upload the root certificate .cer file to Azure.
• Generate a client certificate.
• Export and install the client certificate.

Option 2: Planning to use a self-signed certificate, use the steps:

• One way to create an X.509 certificate is by using the Certificate Creation Tool (makecert.exe). To use makecert, download and install Microsoft Visual Studio Express, which is free of charge.
• Navigate to the Visual Studio Tools folder and start the command prompt as Administrator.
• The command in the following example will create and install a root certificate in the Personal certificate store on your computer and also create a corresponding .cer file that you'll later upload to the Azure portal.
• Change to the directory that you want the .cer file to be located in and run the following command, where RootCertificateName is the name that you want to use for the certificate. If you run the following example with no changes, the result will be a root certificate and the corresponding file RootCertificateName.cer.

Because you have created a root certificate from which client certificates will be generated, you may want to export this certificate along with its private key and save it to a safe location where it may be recovered.

• Download Visual Studio 2013 Express and makecert is included. http://www.visualstudio.com/en-us/downloads/download-visual-studio-vs.aspx

C:\Program Files (x86)\Windows Kits\8.1\bin\x64>makecert -sky exchange -r -n "CN=NewRootCertName" -pe -a sha256 -len 4096 -ss My "NewRootCertFile.cer"

• NewRootCertName refers to the self-signed root certificate that you generated.

Upload the root certificate .cer file to the Azure portal

1. In the Azure portal, on the Certificates page for your virtual network, click Upload a root certificate.

Generate a client certificate

The steps below are for generating a client certificate. On the same computer that you used to create the self-signed root certificate, open a Visual Studio command prompt window as administrator.

1. Change the directory to the location where you want to save the client certificate file. RootCertificateName refers to the self-signed root certificate that you generated. If you run the following example (changing the RootCertificateName to the name of your root certificate), the result will be a client certificate named "ClientCertificateName" in your Personal certificate store.

C:\Program Files (x86)\Windows Kits\8.1\bin\x64>makecert.exe -n "CN=NewClientCertificateName" -pe -sky exchange -m 96 -ss My -in "NewRootCertName" -is my -a sha256



2. All certificates are stored in your Personal certificate store on your computer. If you want to reuse it export it

Installing a client certificate on each computer that you want to connect to the virtual network is a mandatory step.

The steps below will walk you through installing the client certificate manually.

1. A client certificate must be installed on each computer that you want to connect to the virtual network. This means you will probably create multiple client certificates and then need to export them. To export the client certificates, use certmgr.msc. Right-click the client certificate that you want to export, click all tasks, and then click export.
2. Export the client certificate with the private key. This will be a .pfx file. Make sure to record or remember the password (key) that you set for this certificate.
3. Copy the .pfx file to the client computer. On the client computer, double-click the .pfx file in order to install it. Enter the password when requested. Do not modify the installation location.

Configure your VPN client

The client requires both a client certificate and the proper VPN client configuration in order to connect.

Create the VPN client configuration package

1. In the Azure portal, on the Dashboard page for your virtual network, navigate to the quick glance menu in the right corner and click the VPN package that pertains to the client that you want to connect to your virtual network.

2. After you generate and download the VPN client package from the Azure portal, you can install the client package on the client computer from which you want to connect to your virtual network.

3. If you plan to install the VPN client package to multiple client computers, make sure that they each also have a client certificate installed. The VPN client package contains configuration information to configure the VPN client software built into Windows. The package does not install additional software.

Install the VPN configuration package on the client and start the connection. Done.

 

 

This information is a simplification of the article https://azure.microsoft.com/en-us/documentation/articles/vpn-gateway-point-to-site-create/#create-your-certificates

Script to strip out details from phone numbers ( brackets in this example )

 

 

#requires -Modules ActiveDirectory

<#

.SYNOPSIS

    Removes and brackets () from phone number fields of an Active Directory

.EXAMPLE

    .\Remove brackets from phones.ps1

.NOTES

   Developed By:

     n: Dave Colvin

     e: dave.colvin_at_experteq.com

     m : +61411265846

#>

Import-Module ActiveDirectory

clear-host

Get-ADUser -Filter {sAMAccountName -like "dave.colv.in*"} -SearchBase "OU=Users,DC=int" -searchscope subtree -Properties telephoneNumber, facsimileTelephoneNumber, homePhone, ipPhone, displayName |

foreach {

write-host "updating -> " $_.displayName

if ($_.telephoneNumber) {set-aduser -identity $_ -replace @{telephoneNumber=$_.telephoneNumber -replace '[()]',''}}

if ($_.facsimileTelephoneNumber) {set-aduser -identity $_ -replace @{facsimileTelephoneNumber=$_.facsimileTelephoneNumber -replace '[()]',''}}

if ($_.homePhone) {set-aduser -identity $_ -replace @{homePhone=$_.homePhone -replace '[()]',''}}

#if ($_.ipPhone) {set-aduser -identity $_ -replace @{ipPhone=$_.ipPhone -replace '[()]',''}}

            }

Get SQL Server Product Keys for Local and Remote Servers

This script you download and paste into PowerShell, then call function Get-SqlServerKeys and it outputs to the console. Nice and easy.

 

https://gallery.technet.microsoft.com/scriptcenter/Get-SQL-Server-Product-4b5bf4f8

Script to read in email addresses and set passwords, enable accounts

Hopefully the blog does not mundge the code… Self explanatory I hope…

 

 

Import-Module activedirectory

# Based on email addresses in file, sets password to common or predefined (choose below) and enable accounts

#

#format of CSV:

#

#importfile.csv

#email,password

#First.Last@ment.gov.au,SecretPassword!1

#dave.colv.in,SecretPassword!1

#Write-Output "Startup "

Import-Csv ".\ChurnReset.csv" | Foreach {

$email = $_.email

$dynamicPW = $_.password     #use this the passwords in the CSV

$setPW = "davecolvin00111!!" #use this for a preset password

#Write-Output "checking user -> $email password -> $dynamicPW"

try {

#Get-ADUser $user

$user = Get-ADUser -Filter {mail -like $email } -SearchBase "DC=dec,DC=int" -searchscope subtree -Properties samAccountName

Set-ADAccountPassword $user -NewPassword (ConvertTo-SecureString $setPW -AsPlainText -force) -Reset

Enable-ADAccount $user

Write-Output "$user, Password reset and enabled"

    } catch

    { Write-Output "$user,Error" }

}   # <-remove if you want a log file instead of screen       | Out-File PassChange.log

The scale of apathy..

A friend wanted to know what was lower on the scale of apathy then Meh. So I have put together the scale:

Apathetic

indifference

lack of interest

lack of enthusiasm

lack of concern

unconcern

uninterestedness

unresponsiveness

impassivity

dispassion

lethargy

languor

ennui

listlessness

torpor

acedia

inertia

coolness

passivity

coldness

stoicism

nonchalance

phlegm

sluggishness

unconcern

insensibility

unresponsiveness

impassivity

passiveness

impassibility

unfeelingness

emotionlessness

meh

Google Chrome getting business ready

Google now support GPO policy templates for administrators who want to set Chrome policies on their corporate-managed devices.

Download the policy templates zip file here and view the Chromium developer site for additional information.

 

Enter chrome://policy in your Chrome address bar, and Chrome will display all the policies which are currently in effect for that browser.

 

Policies which say “Applies to: Current user” are cloud-based user policies set from the Admin console, or they could be OS-user policies set by Group Policy Objects (GPO). Group policies can be per user or per machine. Device policies will show up as “Device” on Chrome devices, and “Machine” on Windows/Mac/Linux computers.

Machine Policies are applied through Group Policy Objects (GPO) on Windows and through the Admin console for Chrome OS ("Applies to: Device"). These are device-specific and apply to all users, regardless of which browser they’re using or whether or not they’re signed into Chrome or the device.

OS-user policy is applied to Chrome when a user signs into their corporate-managed computer. These policies are set using GPO on Windows. OS-user policies take precedence over cloud policies set for Chrome.

Chrome Profile refers to a user’s Chrome experience when he signs in to the Chrome browser on his machine. These are also called cloud-based user policies in the documentation, and they’re set by an administrator using the Admin console.

 

When there is a conflict between policies set on different scopes, the one that’s higher on the list above takes precedence. Machine Policies take precedence over OS-user and Chrome Profile policies.

https://support.google.com/chrome/a/answer/187202?hl=en

Windows Licences and Azure

Windows Server 2012 r2 brings a consistent licensing model and common features (for enterprises). These options are Standard and Datacenter.

Both Standard and Datacenter editions provide the same set of features; the only thing that differentiates the editions is the number of Virtual Machines (VMs). A Standard edition license will entitle you to run up to two VMs on up to two processors (subject to the VM use rights outlined in the Product Use Rights document). A Datacenter edition license will entitle you to run an unlimited number of VMs on up to two processors.

All features that are available in the Datacenter edition are also available in the Standard edition, including high availability features like failover clustering. The only difference between the two editions will be virtualization rights.

 

Hyper-V and Azure?

Windows Server licenses are not eligible for License Mobility through Software Assurance. The license to run Windows Server in the Azure environment is included in the per-minute cost of your Windows Virtual Machine. Licenses for use of Windows Server on-premises (whether in a VHD or otherwise) must be obtained separately through volume licensing.

Can you, the customer bring their own image that has applications and middleware on top of Windows Server?

Yes, Azure will charge the Windows Server Virtual Machine rate applicable for their instance. Customers are responsible for proper licensing of any application or middleware in the image.

Do you need Windows Server CALs to connect to a Windows Server image that is running in Azure Virtual Machines?

No. Windows Server CALs are not required for accessing Windows Server running in the Azure environment because the access rights are included in the per-minute charge for the Virtual Machines. Use of Windows Server on-premises (whether in a VHD or otherwise) requires obtaining a separate license and is subject to the normal licensing requirements for use of software on-premises.

 

Windows Server 2012 R2 Editions

	Windows Server Datacenter	Windows Server Standard
Maximum number of users	based on CALs	based on CALs
Maximum SMB Connections	16,777,216	16,777,216
Maximum RRAS Connections	unlimited	unlimited
Maximum IAS Connections	2,147,483,647	2,147,483,647
Maximum number of 64-bit sockets	64	64
Maximum RAM	4 TB	4 TB
Server can join a domain	Yes	Yes
DirectAccess	Yes	Yes

Server Roles

	Windows Server Datacenter	Windows Server Standard
Active Directory Certificate Services	Yes	Yes
Active Directory Domain Services	Yes	Yes
Active Directory Federation Services	Yes	Yes
AD Lightweight Directory Services	Yes	Yes
AD Rights Management Services	Yes	Yes
Application Server	Yes	Yes
DHCP Server	Yes	Yes
DNS Server	Yes	Yes
Fax Server	Yes	Yes
File Services	Yes	Yes
Hyper-V	Yes	Yes
Network Policy and Access Services	Yes	Yes
Print and Document Services	Yes	Yes
Remote Access	Yes	Yes
Terminal Services Application Sharing	Yes	Yes
Terminal Services Gateway	Yes	Yes
Web Services (IIS)	Yes	Yes
Windows Deployment Services	Yes	Yes
Windows Essentials	Yes	Yes
Windows Media Services support (Streaming Media Services)	See Installation Options documentation	See Installation Options documentation
WINS Server	Yes	Yes

Features

	Windows Server Datacenter	Windows Server Standard
RODC – read only domain controller	Yes	Yes
Automatic Virtual Machine Activation	Both guest and host	As guest
Best Practices Analyser	Yes	Yes
BranchCache Hosted Server	Yes	Yes
BranchCache P2P Cache	Yes	Yes
Windows Control Panel	Yes	Yes
Distributed File System Replication	Yes	Yes
Data Deduplication	Yes	Yes
ISCSI target support	Yes	Yes
DirectAccess	Yes	Yes
Dynamic Memory (in virtualization)	Yes	Yes
Failover Clustering	Yes	Yes
"Hot" add/replace RAM	Yes	Yes
IPAM (IP Address Management)	Yes	Yes
Microsoft Management Console	Yes	Yes
Minimal Server Interface	Yes	Yes
Network Load Balancing	Yes	Yes
Support for Non-volatile Memory Express	Yes	Yes
Windows PowerShell	Yes	Yes
Server Core mode	Yes	Yes
Server license logging	Yes	Yes
Server Manager	Yes	Yes
SMB Direct and SMB over RDMA	Yes	Yes
Storage Management Service	Yes	Yes
Storage Spaces	Yes	Yes
Volume Activation Services	Yes	Yes
VSS (Volume Shadow Copy Service) integration	Yes	Yes
Windows Server Update Services	Yes	Yes

 

 

 

These are non-typical enterprise customer editions. Just here for completeness.

	Windows Server Essentials	Windows Server Foundation	Microsoft Hyper-V Server	Windows Storage Server Standard	Windows Storage Server Workgroup
Maximum number of users	25	15	unlimited	unlimited	50
Maximum SMB Connections	16777216	30	16,777,216	16,777,216	250
Maximum RRAS Connections	50	50	250	50	50
Maximum IAS Connections	50	10	50	50	50
Maximum number of 64-bit sockets	2	1	64	64	1
Maximum RAM	64 GB	32 GB	4 TB	4 TB	32 GB
Server can join a domain	For migration only	For migration only	Yes	Yes	Yes
DirectAccess	See documentation	Yes	No	Yes	Yes

Server Roles

	Windows Server Essentials	Windows Server Foundation	Microsoft Hyper-V Server	Windows Storage Server Standard	Windows Storage Server Workgroup
Active Directory Certificate Services	Yes	Yes	No	No	No
Active Directory Domain Services	Required	Yes (optional)	No	No	No
Active Directory Federation Services	Yes	Yes	No	No	No
AD Lightweight Directory Services	No	Yes	No	Yes	Yes
AD Rights Management Services	Yes	Yes	No	No	No
Application Server	Yes	Yes	No	No	No
DHCP Server	Yes	Yes	No	Yes	No
DNS Server	Yes	Yes	No	Yes	No
Fax Server	Yes	Yes	No	No	No
File Services	Yes	Yes	Limited features	Yes	Yes
Hyper-V	No	No	Yes	Yes	No
Network Policy and Access Services	Yes	Yes	No	No	No
Print and Document Services	Yes	Yes	No	Yes	Yes
Remote Access	Yes	Yes	No	No	No
Terminal Services Application Sharing	No	Yes	No	No	No
Terminal Services Gateway	No	See documentation	No	No	No
Web Services (IIS)	Yes	Yes	No	Yes	Yes
Windows Deployment Services	Yes	Yes	No	No	No
Windows Essentials	Default	No	No	No	No
Windows Media Services support (Streaming Media Services)	Yes	See Installation Options documentation	No	No	No
WINS Server	Yes	Yes	No	Yes	No

Features

	Windows Server Essentials	Windows Server Foundation	Microsoft Hyper-V Server	Windows Storage Server Standard	Windows Storage Server Workgroup
RODC – read only domain controller	No	No	No	No	No
Automatic Virtual Machine Activation	As guest	No	No	No	No
Best Practices Analyser	Yes	Yes	Yes	Yes	Yes
BranchCache Hosted Server	Yes	Yes	No	Yes	No
BranchCache P2P Cache	Yes	Yes	No	Yes	Yes
Windows Control Panel	Yes	Yes	No	Yes	Yes
Distributed File System Replication	Yes	Yes	No	Yes	Yes
Data Deduplication	No	No	No	Yes	No
ISCSI target support	Yes	Yes	No	Yes	Yes
DirectAccess	Yes	Yes	No	Yes	Yes
Dynamic Memory (in virtualization)	Yes	No	No	Yes	No
Failover Clustering	No	No	Yes	Yes	No
"Hot" add/replace RAM	Yes	No	Yes	Yes	Yes
IPAM (IP Address Management)	Yes	Yes	No	Yes	Yes
Microsoft Management Console	Yes	Yes	Remote only	Yes	Yes
Minimal Server Interface	No	No	No	Yes	Yes
Network Load Balancing	Yes	Yes	No	Yes	Yes
Support for Non-volatile Memory Express	Yes	Yes	Yes	Yes	Yes
Windows PowerShell	Yes	Yes	Yes	Yes	Yes
Server Core mode	No	No	Yes--the only option	after setup	after setup
Server license logging	Yes	Yes	Yes	Yes	Yes
Server Manager	Yes	Yes	From a remote computer	Yes	Yes
SMB Direct and SMB over RDMA	Yes	Yes	Yes	Yes	Yes
Storage Management Service	Yes	Yes	Basic file server only	Yes	Yes
Storage Spaces	Yes	Yes	Yes	Yes	Yes
Volume Activation Services	No	No	No	No	No
VSS (Volume Shadow Copy Service) integration	Yes	Yes	No	Yes	Yes
Windows Server Update Services	Yes	No	No	No	No