Azure Stack TP1 POC Stable Install notes

I thought about writing yet another detailed step by step guide for installing TP1, but figured there are enough of those out there. If you need one you can google here. At Azure Field Notes, we're about sharing things we’ve learned thru our experiance in the field, so I decided to hit the high points based on the notes from one of our most stable POC installs to date. Now, this is a fully supported POC, meaning its running on the supported hardware and we’re not modifying any of the install scripts here. We will post other articles soon that cover some of those tricks and tweaks. With that, lets get going:

Hardware:

Dell PowerEdge R630 Dual Intel(R) Xeon(R) CPU E5-2680 v3 @ 2.50GHz 12core (24 cores total) 384GB DDR4 Registered ECC RAM network card: Emulex OCm14104-U1-D 10Gb rNDC (supported for the POC install, not supported for storage spaces direct) Physical Disks: PERC H730 1GB Cache configured as follows 6 300GB SAS 2 disks in a raid 1 mirror for the OS, other 4 disks are pass-through

(Note this box is supported for the POC, but likely won’t match any of the production supported hardware, so don’t go buy a fleet of these expecting to run this stuff in prod). Production supported hardware will be only sold as a pre configured, pre integrated system per this blog post from Mike Neil.

Next the process:

• Perform a complete firmware update of all components
• configure the array with a single raid 1 mirror and 4 non raid disks set to pass-through mode
• Set the Bios to boot from UEFI
• Ensure the time zone and time are set correctly in the Bios
• Load a servicing OS with boot from vhd support (2016 TP5 works well). Ensure you install to the mirror
• Setup a static IP on the NIC
• Copy the stack bits locally
• Copy any drivers needed for the machine locally
• Copy the TP4 VHD from the Stack bits to the root
• Use BCDEdit to change the boot vhd to the TP4 stack vhd.
• Boot the machine, copy any drivers from the local drive to win\inf and reboot
• Enable RDP and set the NIC IP
• Reboot and install chrome or some non edge browser and ensure it is the default (Edge doesn't like the built in admin account by default. You can obviously choose to change its settings, or use IE, but chrome comes in handy).
• Install update KB3124262 if needed
• Disable all except the primary NIC port and ensure you have no more then 4 raw disks in disk manager (should match the 4 SAS disks that are passed through)
• Disable Windows update
• Disable defender
• Double check the system time zone and time and ensure it is correct. (Later if you get an AAD Auth Error talking about verifying the message then your time zone is off, check it again)
• Install Stack. Use an AAD account, set the natVM Static IP to something on the same subnet as your host that isn't used, set the static gateway to your gateway and set the admin password etc.

Script:

[powershell] $secpasswd = ConvertTo-SecureString “urpassword” -AsPlainText -Force $adminpwd = ConvertTo-SecureString “uradminpassword” -AsPlainText -Force $mycreds = New-Object System.Management.Automation.PSCredential (“uraadaccount@yourtenant.com”, $secpasswd) .\DeployAzureStack.ps1 –Verbose -NATVMStaticIP 172.20.40.31/24 –NATVMStaticGateway 172.20.40.1 -adminpassword $adminpwd -AADCredential $mycreds [/powershell]

• Wait a bit and check for errors. I had none after I did all of the above. If you do run into errors, I highly recommend blowing away the TP4 VHD and starting over. Re running the installer appears to work, but we’ve had instability later with random failures when it doesn't complete in one pass.
• Login to the client VM and Install Chrome and set to default browser (see above)
• Go through and disable windows update and defender on all stack VMs (Look for a post on how to do this in an unsupported way as part of the install, some boxes arent domain joined, so a simple GPO wont do it. Update, Matt's post is live HERE)
• Turn off TIP tests once you think things are working properly (from the client VM) (If its around 12am the TIP tests will be running, wait until they are complete and have cleaned up everything]

[powershell] Disable-ScheduledTask -TaskName AzureStackSystemvalidationTask [/powershell]

Probably not required, but seems to speed up demos and such:

• Shutdown the environment
• Up the memory and CPU on all VMs to 16gig min 100%, update cores to 4, 8 or 12 depending on the original setting.
• Start it back up, wait about 10 minutes and then run the validation script to make sure all the services are online properly.

Some additional notes:

• The MUXVM and BGPBM seem to hang occasionally when connected via the hyper-v console. This appears to be Hyper-v on TP4 issues. During these hangs they also seem to stop responding to the network.
• Sometimes rebooting a VM causes the host to bluescreen and reboot (also appears to be a TP4 issue)
• Once your up and running, screens in stack that show a user picker seem to sit and spin for  wile, especially on group pickers. Other things are simple not done (new buttons on some of the resource RPs), or need some time to JIT the first time they’re accessed (Quota menus when creating a plan for example).
• If doing scripted testing, it seems creating and tearing down an empty resource group through Powershell is pretty repeatable. I’d start with deploying a template containing nothing but a resource group if trying to test toolchains. Next least impactful seems to be storage accounts. Compute/Network seems to be the heaviest, and also the most inconsistent with if it will be successful or not on any given attempt.
• You’ll notice we’re not installing any additional Resource Providers. We’ve had significant stability problems with the current builds and so are waiting until new builds are available before loading them in anything but our most bleeding edge environments.
• Finally, Remember folks, its TP1, and according to Mike Neil’s Blog post, we’re a year away.

Disable Windows Defender & Windows Update in Azure Stack TP1

If you have been installing or working with Azure Stack TP1 you may have noticed some high process consumption from the windows defender process. Whether you're running on recommended hardware or not you may want to switch this process off during the Technical Preview time frame. Depending on how often you're installing Stack having this automatically done after installation is a great time saver. Additionally Windows update is disabled on some servers but not all servers. Depending whether you want unscheduled reboots or not you may want to ensure windows update is disabled on all servers. Open and Edit Stack Settings 1) In the Stack installer folder find the MicrosoftAzureStackPOC vhdx and mount so you can edit the VHD content. The installer script mounts the VHDX in read only mode, eject it and either right click in explorer and mount or use Powershell.

2) Ensure you make a copy before editing.  Open this XML file located at Drive:\AzureStackInstaller\POCFabricInstaller\POCFabricSettings.xml. You may want to install an XML editor like Notepad++ to help read the file easier.

Disable Windows Defender 3) Search for CreateVM.ps1, you should find a task named ADVM. Find the closing tag for 'Parameters' and add the code line below, inside the parameter tag. This Powershell command will disable defender.

[xml]<PostSetupCmd>powershell.exe /c "set-MpPreference -DisableRealtimeMonitoring $true"</PostSetupCmd>[/xml]

4) Search again for CreateVM.ps1 and repeat for each server role.

Disable Windows Update 5) To ensure windows update is disabled on all systems, go back to the top of the xml file and search for CreateVM.ps1 again. Ensure this code is Inside the Parameters tag you can add the RegKeys node with the following.

[xml] <RegKeys> <Reg><!-- Disable windows update--> <Operation>Add</Operation> <Path>System\ControlSet001\Services\wuauserv</Path> <Value>Start</Value> <Type>REG_DWORD</Type> <Data>4</Data> </Reg> <Reg> <Operation>Add</Operation> <Path>System\ControlSet002\Services\wuauserv</Path> <Value>Start</Value> <Type>REG_DWORD</Type> <Data>4</Data> </Reg> </RegKeys> [/xml]

6) Search again for CreateVM.ps1 and repeat for each server role.

7) If your using notepad++ you can use it to check your XML syntax is correct. Save the file and try a deployment.

Optional

If you feel that you want to add a little more RAM or CPUs to a VM you can do that as well here.

Example Code

[xml]

<Task> <Name>ADVM</Name> <Cmd>CreateVM.ps1</Cmd> <CleanupCmd>DeleteVM.ps1</CleanupCmd> <Dependency>EnableRemotePS</Dependency> <Dependency>EnableVFP</Dependency> <Dependency>CopyVhdx_Local</Dependency> <Retry>5</Retry> <Weight>400</Weight> <Timeout>3400</Timeout> <Parameters> <Name>ADVM</Name> <VMPath>{[FindFreeDisk]:Path}</VMPath> <ProcessorCount>4</ProcessorCount> <RAM>3</RAM> <MinRAM>3</MinRAM> <MaxRAM>4</MaxRAM> <Disk> <Base>{[FindFreeDisk]:Path}\{[Global]:VHDs.OSVHD}</Base> <Features> <Name>AD-Domain-Services,DNS</Name> </Features> </Disk> <Nics> <Nic> <Name>Nic1</Name> <vSwitch>{[SetupvSwitch]:Name}</vSwitch> <VLAN>{[Global]:InternalNetworkVLan}</VLAN> <DHCP>false</DHCP> <IP>192.168.100.2/24</IP> <GW>{[Global]:InternalGW}</GW> <DNSList> <DNS>{[Global]:InternalDNS}</DNS> </DNSList> </Nic> </Nics> <LocalAccounts> <AdministratorPassword>{[Global]:AdminPassword}</AdministratorPassword> <Account> <Name>AzureStackAdmin</Name> <Password>{[Global]:AdminPassword}</Password> <Group>Administrators</Group> </Account> <Account> <Name>AzureStackUser</Name> <Password>{[Global]:AdminPassword}</Password> <Group>Users</Group> </Account> </LocalAccounts> <RegKeys> <Reg><!-- Disable windows update--> <Operation>Add</Operation> <Path>System\ControlSet001\Services\wuauserv</Path> <Value>Start</Value> <Type>REG_DWORD</Type> <Data>4</Data> </Reg> <Reg> <Operation>Add</Operation> <Path>System\ControlSet002\Services\wuauserv</Path> <Value>Start</Value> <Type>REG_DWORD</Type> <Data>4</Data> </Reg> </RegKeys> <PostSetupCmd>powershell.exe /c "set-MpPreference -DisableRealtimeMonitoring $true"</PostSetupCmd> </Parameters> </Task> <!-- ADVM -->

[/xml]

[Unsupported]

How to Connect to Azure Stack via Powershell

Sometimes, when a new product is introduced to the market, some of the basic things are either missing, or not concisely documented. In this case since Azure and Azure stack use the same API and share the same cmdlets, you connect the same way right? The answer is yes, in theory. What's missing from that answer is that for Azure stack you need to setup your Powershell connection using the Add-AzureRMEnvironment command to set the specific AAD endpoints, RM API endpoint, Gallery Endpoint, etc. Since this is a mix of Azure and Azure Stack specific information, we thought a nice, concise script was in order. Now we’re assuming that your stack instance is running TP1 (this should work on TP2 when it ships, but we obviously haven’t tested it yet).

Step 1: Ensure you have the right Powershell Cmdlets on the machine you’ll be running from. For simplicity this is likely the client VM, but you could be running from your VPN connected workstation or, if your a little creative, someplace else. We’re assuming your connected.

• https://github.com/Azure/azure-powershell/releases/download/v1.2.1-February2016/azure-powershell.1.2.1.msi

We’ve found at present this version works well with TP1.

Step 2: Ensure you have some stuff setup in Azure Stack to see:

• Start by opening a browser to portal.azurestack.local, login with the admin AAD account used during setup and create a plan and offer.
• Next, Connect to AAD and a create test AAD user. No special rights needed.
• Login with the test user and Create a subscription using the offer you created. Take note of the subscription name (Hint: by default its named after the offer).
• You should now be able to create some resources. We recommend creating a simple resource group with a single VM and/or a storage account (depending on if your VM Resource Provider is behaving itself). Idea here is to create some objects you can see in Powershell.
• Now hang out and wait for that to complete.

Step 3: Fire up Powershell on the client copy, paste and edit the below script and then run it.

In the script you need to set the following:

• $AADUserName value to the UPN of the test account you used in AAD
• $AADPassword value to the password of the test account you used in AAD
• $AADTenantID value to the domain name used by your AAD tenant.
• If your the creative type and aren’t running a stock instance of TP1 you might need to adjust some DNS names in the script from azurestack.local to match your environment.
• On the Get-AzureRMSubscription command, set the –subscriptionName value to the name of the subscription you created.

That should do it. Any questions/issues, leave a comment.

[powershell] $AADUserName='YourAADAccount@Yourdomain' $AADPassword='YourAADPassword'|ConvertTo-SecureString -Force -AsPlainText $AADCredential=New-Object PSCredential($AADUserName,$AADPassword)

$AADTenantID = "YourAADDomain" Add-AzureRmEnvironment -Name "Azure Stack" ` -ActiveDirectoryEndpoint ("https://login.windows.net/$AADTenantID/") ` -ActiveDirectoryServiceEndpointResourceId "https://azurestack.local-api/" ` -ResourceManagerEndpoint ("Https://api.azurestack.local/") ` -GalleryEndpoint ("Https://gallery.azurestack.local:30016/") ` -GraphEndpoint "https://graph.windows.net/"

$env = Get-AzureRmEnvironment 'Azure Stack' Add-AzureRmAccount -Environment $env -Credential $AADCredential -Verbose Get-AzureRmSubscription -SubscriptionName "youroffer" | Select-AzureRmSubscription Get-AzureRmResource [/powershell]