Disable Windows Defender & Windows Update in Azure Stack TP1

If you have been installing or working with Azure Stack TP1 you may have noticed some high process consumption from the windows defender process. Whether you're running on recommended hardware or not you may want to switch this process off during the Technical Preview time frame. Depending on how often you're installing Stack having this automatically done after installation is a great time saver. Additionally Windows update is disabled on some servers but not all servers. Depending whether you want unscheduled reboots or not you may want to ensure windows update is disabled on all servers. Open and Edit Stack Settings 1) In the Stack installer folder find the MicrosoftAzureStackPOC vhdx and mount so you can edit the VHD content. The installer script mounts the VHDX in read only mode, eject it and either right click in explorer and mount or use Powershell.

2) Ensure you make a copy before editing.  Open this XML file located at Drive:\AzureStackInstaller\POCFabricInstaller\POCFabricSettings.xml. You may want to install an XML editor like Notepad++ to help read the file easier.

Disable Windows Defender 3) Search for CreateVM.ps1, you should find a task named ADVM. Find the closing tag for 'Parameters' and add the code line below, inside the parameter tag. This Powershell command will disable defender.

[xml]<PostSetupCmd>powershell.exe /c "set-MpPreference -DisableRealtimeMonitoring $true"</PostSetupCmd>[/xml]

4) Search again for CreateVM.ps1 and repeat for each server role.

Disable Windows Update 5) To ensure windows update is disabled on all systems, go back to the top of the xml file and search for CreateVM.ps1 again. Ensure this code is Inside the Parameters tag you can add the RegKeys node with the following.

[xml] <RegKeys> <Reg><!-- Disable windows update--> <Operation>Add</Operation> <Path>System\ControlSet001\Services\wuauserv</Path> <Value>Start</Value> <Type>REG_DWORD</Type> <Data>4</Data> </Reg> <Reg> <Operation>Add</Operation> <Path>System\ControlSet002\Services\wuauserv</Path> <Value>Start</Value> <Type>REG_DWORD</Type> <Data>4</Data> </Reg> </RegKeys> [/xml]

6) Search again for CreateVM.ps1 and repeat for each server role.

7) If your using notepad++ you can use it to check your XML syntax is correct. Save the file and try a deployment.

Optional

If you feel that you want to add a little more RAM or CPUs to a VM you can do that as well here.

Example Code

[xml]

<Task> <Name>ADVM</Name> <Cmd>CreateVM.ps1</Cmd> <CleanupCmd>DeleteVM.ps1</CleanupCmd> <Dependency>EnableRemotePS</Dependency> <Dependency>EnableVFP</Dependency> <Dependency>CopyVhdx_Local</Dependency> <Retry>5</Retry> <Weight>400</Weight> <Timeout>3400</Timeout> <Parameters> <Name>ADVM</Name> <VMPath>{[FindFreeDisk]:Path}</VMPath> <ProcessorCount>4</ProcessorCount> <RAM>3</RAM> <MinRAM>3</MinRAM> <MaxRAM>4</MaxRAM> <Disk> <Base>{[FindFreeDisk]:Path}\{[Global]:VHDs.OSVHD}</Base> <Features> <Name>AD-Domain-Services,DNS</Name> </Features> </Disk> <Nics> <Nic> <Name>Nic1</Name> <vSwitch>{[SetupvSwitch]:Name}</vSwitch> <VLAN>{[Global]:InternalNetworkVLan}</VLAN> <DHCP>false</DHCP> <IP>192.168.100.2/24</IP> <GW>{[Global]:InternalGW}</GW> <DNSList> <DNS>{[Global]:InternalDNS}</DNS> </DNSList> </Nic> </Nics> <LocalAccounts> <AdministratorPassword>{[Global]:AdminPassword}</AdministratorPassword> <Account> <Name>AzureStackAdmin</Name> <Password>{[Global]:AdminPassword}</Password> <Group>Administrators</Group> </Account> <Account> <Name>AzureStackUser</Name> <Password>{[Global]:AdminPassword}</Password> <Group>Users</Group> </Account> </LocalAccounts> <RegKeys> <Reg><!-- Disable windows update--> <Operation>Add</Operation> <Path>System\ControlSet001\Services\wuauserv</Path> <Value>Start</Value> <Type>REG_DWORD</Type> <Data>4</Data> </Reg> <Reg> <Operation>Add</Operation> <Path>System\ControlSet002\Services\wuauserv</Path> <Value>Start</Value> <Type>REG_DWORD</Type> <Data>4</Data> </Reg> </RegKeys> <PostSetupCmd>powershell.exe /c "set-MpPreference -DisableRealtimeMonitoring $true"</PostSetupCmd> </Parameters> </Task> <!-- ADVM -->

[/xml]

[Unsupported]

How to Connect to Azure Stack via Powershell

Sometimes, when a new product is introduced to the market, some of the basic things are either missing, or not concisely documented. In this case since Azure and Azure stack use the same API and share the same cmdlets, you connect the same way right? The answer is yes, in theory. What's missing from that answer is that for Azure stack you need to setup your Powershell connection using the Add-AzureRMEnvironment command to set the specific AAD endpoints, RM API endpoint, Gallery Endpoint, etc. Since this is a mix of Azure and Azure Stack specific information, we thought a nice, concise script was in order. Now we’re assuming that your stack instance is running TP1 (this should work on TP2 when it ships, but we obviously haven’t tested it yet).

Step 1: Ensure you have the right Powershell Cmdlets on the machine you’ll be running from. For simplicity this is likely the client VM, but you could be running from your VPN connected workstation or, if your a little creative, someplace else. We’re assuming your connected.

• https://github.com/Azure/azure-powershell/releases/download/v1.2.1-February2016/azure-powershell.1.2.1.msi

We’ve found at present this version works well with TP1.

Step 2: Ensure you have some stuff setup in Azure Stack to see:

• Start by opening a browser to portal.azurestack.local, login with the admin AAD account used during setup and create a plan and offer.
• Next, Connect to AAD and a create test AAD user. No special rights needed.
• Login with the test user and Create a subscription using the offer you created. Take note of the subscription name (Hint: by default its named after the offer).
• You should now be able to create some resources. We recommend creating a simple resource group with a single VM and/or a storage account (depending on if your VM Resource Provider is behaving itself). Idea here is to create some objects you can see in Powershell.
• Now hang out and wait for that to complete.

Step 3: Fire up Powershell on the client copy, paste and edit the below script and then run it.

In the script you need to set the following:

• $AADUserName value to the UPN of the test account you used in AAD
• $AADPassword value to the password of the test account you used in AAD
• $AADTenantID value to the domain name used by your AAD tenant.
• If your the creative type and aren’t running a stock instance of TP1 you might need to adjust some DNS names in the script from azurestack.local to match your environment.
• On the Get-AzureRMSubscription command, set the –subscriptionName value to the name of the subscription you created.

That should do it. Any questions/issues, leave a comment.

[powershell] $AADUserName='YourAADAccount@Yourdomain' $AADPassword='YourAADPassword'|ConvertTo-SecureString -Force -AsPlainText $AADCredential=New-Object PSCredential($AADUserName,$AADPassword)

$AADTenantID = "YourAADDomain" Add-AzureRmEnvironment -Name "Azure Stack" ` -ActiveDirectoryEndpoint ("https://login.windows.net/$AADTenantID/") ` -ActiveDirectoryServiceEndpointResourceId "https://azurestack.local-api/" ` -ResourceManagerEndpoint ("Https://api.azurestack.local/") ` -GalleryEndpoint ("Https://gallery.azurestack.local:30016/") ` -GraphEndpoint "https://graph.windows.net/"

$env = Get-AzureRmEnvironment 'Azure Stack' Add-AzureRmAccount -Environment $env -Credential $AADCredential -Verbose Get-AzureRmSubscription -SubscriptionName "youroffer" | Select-AzureRmSubscription Get-AzureRmResource [/powershell]