Changing Azure Stack’s DNS and AD Domain to something other than AzureStack.local

This is another installer modification for Azure Stack TP1 PoC, that unfortunately will require editing more than one file.  I find the fact this edit is necessary, puzzling; once again we will start by mounting MicrosoftAzureStackPOC.vhdx. We will start within PocDeployment\Test-AzureStackDeploymentParameters.ps1 at line 68:

[powershell]$ADDomainName = "AzureStack.local"[/powershell]

Why is this not a parameter? We will also ignore the fact we are editing signed scripts and go ahead and make it one, first deleting that line and subsequently modifying the parameter block (leaving the default as azurestack.local).

[powershell] [CmdletBinding()] Param ( [string] [Parameter(Mandatory = $true)] $PackagePath,

[SecureString] [Parameter(Mandatory = $false)] $AdminPassword,

[PSCredential] [Parameter(Mandatory = $false)] $AADCredential,

[string] [Parameter(Mandatory = $false)] $AADTenant,

[PSCredential] [Parameter(Mandatory = $false)] $TIPServiceAdminCredential,

[PSCredential] [Parameter(Mandatory = $false)] $TIPTenantAdminCredential,

[Parameter(Mandatory = $false)] [Nullable[bool]] $UseAADChina,

[String] [Parameter(Mandatory = $false)] $NATVMStaticIP,

[String] [Parameter(Mandatory = $false)] $NATVMStaticGateway,

[String] [Parameter(Mandatory = $false)] $PublicVLan = $null,

[Parameter(Mandatory = $false)] [string] $ProxyServer,

[Parameter(Mandatory = $false)] [string] $ADDomainName = "AzureStack.local",

[Switch] $Force ) [/powershell]

We will also update yet another hard coded value this time in PocDeployment\Invoke-DeploymentLogCollection.ps1. Look to line 106 and you will find a line like this:

[powershell] ('PublicIPAddresses','GatewayPools','GateWays','loadBalancers','loadBalancerMuxes','loadBalancerManager/config','networkInterfaces','virtualServers','Servers','credentials','macPools','logicalnetworks','accessControlLists') | % { JSONGet -NetworkControllerRestIP "NCVM.azurestack.local" -path "/$_" -Credential $credential | ConvertTo-Json -Depth 20 > "$destination\NC\$($_ -replace '/','').txt" } [/powershell]

Replace the hard coded azurestack.local value with the existing!!! parameter:

[powershell] ('PublicIPAddresses','GatewayPools','GateWays','loadBalancers','loadBalancerMuxes','loadBalancerManager/config','networkInterfaces','virtualServers','Servers','credentials','macPools','logicalnetworks','accessControlLists') | % { JSONGet -NetworkControllerRestIP "NCVM.$($parameters.ADDomainName)" -path "/$_" -Credential $credential | ConvertTo-Json -Depth 20 > "$destination\NC\$($_ -replace '/','').txt" } [/powershell]

Finally we need to modify the main installer script (in duplicate).  DeployAzureStack.ps1 is located both in the root of the Azure Stack TP1 zip file you downloaded and the Installer directory within MicrosoftAzureStackPOC.vhdx.  You can modify the file once and copy it to the other location in whatever order you choose. We are going to start by adding a parameter, $ADDomainName, for the Active Directory DNS name (again leaving the default as azurestack.local):

[powershell] [CmdletBinding()] param ( [SecureString] [Parameter(Mandatory = $false)] $AdminPassword,

[PSCredential] [Parameter(Mandatory = $false)] $AADCredential,

[string] [Parameter(Mandatory = $false)] $AADTenant,

[PSCredential] [Parameter(Mandatory = $false)] $TIPServiceAdminCredential,

[PSCredential] [Parameter(Mandatory = $false)] $TIPTenantAdminCredential,

[Parameter(Mandatory = $false)] [Nullable[bool]] $UseAADChina,

[String] [Parameter(Mandatory = $false)] $NATVMStaticIP = $null, #eg: 10.10.10.10/24

[String] [Parameter(Mandatory = $false)] $NATVMStaticGateway = $null, #eg: 10.10.10.1

[String] [Parameter(Mandatory = $false)] $PublicVLan = $null, #eg: 305

[String] [Parameter(Mandatory = $false)] $ProxyServer,

[String] [Parameter(Mandatory=$false)] $ADDomainName="azurestack.local",

[Switch] $Force,

[Switch] $NoAutoReboot ) [/powershell]

Modify line 102 to accomodate the parameter we’ve created in this and Test-AzureStackDeploymentParameters.ps1. The original line will look like this:

[powershell] $Parameters = & "$DeploymentScriptPath\Test-AzureStackDeploymentParameters.ps1" -PackagePath $PSScriptRoot -AdminPassword $AdminPassword -AADCredential $AADCredential -AADTenant $AADTenant -TIPServiceAdminCredential $TIPServiceAdminCredential -TIPTenantAdminCredential $TIPTenantAdminCredential -UseAADChina $UseAADChina -NATVMStaticIP $NATVMStaticIP -NATVMStaticGateway $NATVMStaticGateway -PublicVLan $PublicVLan -ProxyServer $ProxyServer -Force:$Force [/powershell]

Add the ADDomainName parameter:

[powershell] $Parameters = & "$DeploymentScriptPath\Test-AzureStackDeploymentParameters.ps1" -PackagePath $PSScriptRoot -AdminPassword $AdminPassword -AADCredential $AADCredential -AADTenant $AADTenant -TIPServiceAdminCredential $TIPServiceAdminCredential -TIPTenantAdminCredential $TIPTenantAdminCredential -UseAADChina $UseAADChina -NATVMStaticIP $NATVMStaticIP -NATVMStaticGateway $NATVMStaticGateway -ADDomainName $ADDomainName -PublicVLan $PublicVLan -ProxyServer $ProxyServer -Force:$Force [/powershell]

Unmount the VHD and install to a new domain if you so desire.

[Unsupported]

Modifying Azure Stack POC Install Constraints

Azure Stack’s specific hardware requirements, specifically RAM and Storage, may prevent one from being able to install on available kit.  This is a pretty well known “hack”, however this is enterprise IT so redundancy is a good thing. The constraints are pretty simple to modify for your particular situation.

Once again, we’ll start by mounting the MicrosoftAzureStackPOC.vhdx (I won’t bother covering how to do that).

All of the hardware constraints are enforced through functions in PocDeployment\Invoke-AzureStackDeploymentPrecheck.ps1.

If you look at line 62 within the function CheckDisks you will find a statement that looks like this:

[powershell]$physicalDisks = Get-PhysicalDisk | Where-Object { $_.CanPool -eq $true -and ($_.BusType -eq 'RAID' -or $_.BusType -eq 'SAS' -or $_.BusType -eq 'SATA') }[/powershell]

You can choose to add another allowed bus type e.g. ISCSI, or if you are really adventurous just remove the entire AND clause.

[powershell]$physicalDisks = Get-PhysicalDisk | Where-Object { $_.CanPool -eq $true -and ($_.BusType -eq 'RAID' -or $_.BusType -eq 'SAS' -or $_.BusType -eq 'SATA' -or $_.BusType -eq 'ISCSI') }[/powershell]

or

[powershell]$physicalDisks = Get-PhysicalDisk | Where-Object { $_.CanPool -eq $true}[/powershell]

To modify the RAM contraints look further down, and at line 98 with CheckRAM you will find a very simple test:

[powershell]</p> <p>if ($totalMemoryInGB -lt 96) {<br>&nbsp;&nbsp;&nbsp; throw "Check system memory requirement failed. At least 96GB physical memory is required."<br>}</p> <p>[/powershell]

Modify the value as appropriate:

[powershell]</p> <p>if ($totalMemoryInGB -lt 64) {<br>&nbsp;&nbsp;&nbsp; throw "Check system memory requirement failed. At least 64GB physical memory is required."<br>}</p> <p>[/powershell]

Unmount the VHD, and you are done.  It is worth reiterating that these constraints exist for a reason, and in adjusting or bypassing you should have appropriate expectations for performance and/or stability.

[Unsupported]

Updating the version of the Azure Cmdlets on the Azure Stack ClientVM

This is a trivial fix for an annoying extra post-installation step. The version of Azure Cmdlets installed to the ClientVM with the TP1 installer are not the “approved” version for Azure Stack.  In order to experience any success with the additional Resource Providers you need to update the Cmdlets to version 1.2.1 Download Here.

Once you have obtained the updated MSI, mount the Installer VHD.

Once mounted navigate to the Dependencies folder.

Rename the MSI you downloaded before to azure-powershell.msi and copy over the existing file.

Unmount the image and copy the updated .vhdx to the install source you use.

Azure Stack TP1 POC Stable Install notes

I thought about writing yet another detailed step by step guide for installing TP1, but figured there are enough of those out there. If you need one you can google here. At Azure Field Notes, we're about sharing things we’ve learned thru our experiance in the field, so I decided to hit the high points based on the notes from one of our most stable POC installs to date. Now, this is a fully supported POC, meaning its running on the supported hardware and we’re not modifying any of the install scripts here. We will post other articles soon that cover some of those tricks and tweaks. With that, lets get going:

Hardware:

Dell PowerEdge R630 Dual Intel(R) Xeon(R) CPU E5-2680 v3 @ 2.50GHz 12core (24 cores total) 384GB DDR4 Registered ECC RAM network card: Emulex OCm14104-U1-D 10Gb rNDC (supported for the POC install, not supported for storage spaces direct) Physical Disks: PERC H730 1GB Cache configured as follows 6 300GB SAS 2 disks in a raid 1 mirror for the OS, other 4 disks are pass-through

(Note this box is supported for the POC, but likely won’t match any of the production supported hardware, so don’t go buy a fleet of these expecting to run this stuff in prod). Production supported hardware will be only sold as a pre configured, pre integrated system per this blog post from Mike Neil.

Next the process:

• Perform a complete firmware update of all components
• configure the array with a single raid 1 mirror and 4 non raid disks set to pass-through mode
• Set the Bios to boot from UEFI
• Ensure the time zone and time are set correctly in the Bios
• Load a servicing OS with boot from vhd support (2016 TP5 works well). Ensure you install to the mirror
• Setup a static IP on the NIC
• Copy the stack bits locally
• Copy any drivers needed for the machine locally
• Copy the TP4 VHD from the Stack bits to the root
• Use BCDEdit to change the boot vhd to the TP4 stack vhd.
• Boot the machine, copy any drivers from the local drive to win\inf and reboot
• Enable RDP and set the NIC IP
• Reboot and install chrome or some non edge browser and ensure it is the default (Edge doesn't like the built in admin account by default. You can obviously choose to change its settings, or use IE, but chrome comes in handy).
• Install update KB3124262 if needed
• Disable all except the primary NIC port and ensure you have no more then 4 raw disks in disk manager (should match the 4 SAS disks that are passed through)
• Disable Windows update
• Disable defender
• Double check the system time zone and time and ensure it is correct. (Later if you get an AAD Auth Error talking about verifying the message then your time zone is off, check it again)
• Install Stack. Use an AAD account, set the natVM Static IP to something on the same subnet as your host that isn't used, set the static gateway to your gateway and set the admin password etc.

Script:

[powershell] $secpasswd = ConvertTo-SecureString “urpassword” -AsPlainText -Force $adminpwd = ConvertTo-SecureString “uradminpassword” -AsPlainText -Force $mycreds = New-Object System.Management.Automation.PSCredential (“uraadaccount@yourtenant.com”, $secpasswd) .\DeployAzureStack.ps1 –Verbose -NATVMStaticIP 172.20.40.31/24 –NATVMStaticGateway 172.20.40.1 -adminpassword $adminpwd -AADCredential $mycreds [/powershell]

• Wait a bit and check for errors. I had none after I did all of the above. If you do run into errors, I highly recommend blowing away the TP4 VHD and starting over. Re running the installer appears to work, but we’ve had instability later with random failures when it doesn't complete in one pass.
• Login to the client VM and Install Chrome and set to default browser (see above)
• Go through and disable windows update and defender on all stack VMs (Look for a post on how to do this in an unsupported way as part of the install, some boxes arent domain joined, so a simple GPO wont do it. Update, Matt's post is live HERE)
• Turn off TIP tests once you think things are working properly (from the client VM) (If its around 12am the TIP tests will be running, wait until they are complete and have cleaned up everything]

[powershell] Disable-ScheduledTask -TaskName AzureStackSystemvalidationTask [/powershell]

Probably not required, but seems to speed up demos and such:

• Shutdown the environment
• Up the memory and CPU on all VMs to 16gig min 100%, update cores to 4, 8 or 12 depending on the original setting.
• Start it back up, wait about 10 minutes and then run the validation script to make sure all the services are online properly.

Some additional notes:

• The MUXVM and BGPBM seem to hang occasionally when connected via the hyper-v console. This appears to be Hyper-v on TP4 issues. During these hangs they also seem to stop responding to the network.
• Sometimes rebooting a VM causes the host to bluescreen and reboot (also appears to be a TP4 issue)
• Once your up and running, screens in stack that show a user picker seem to sit and spin for  wile, especially on group pickers. Other things are simple not done (new buttons on some of the resource RPs), or need some time to JIT the first time they’re accessed (Quota menus when creating a plan for example).
• If doing scripted testing, it seems creating and tearing down an empty resource group through Powershell is pretty repeatable. I’d start with deploying a template containing nothing but a resource group if trying to test toolchains. Next least impactful seems to be storage accounts. Compute/Network seems to be the heaviest, and also the most inconsistent with if it will be successful or not on any given attempt.
• You’ll notice we’re not installing any additional Resource Providers. We’ve had significant stability problems with the current builds and so are waiting until new builds are available before loading them in anything but our most bleeding edge environments.
• Finally, Remember folks, its TP1, and according to Mike Neil’s Blog post, we’re a year away.

Disable Windows Defender & Windows Update in Azure Stack TP1

If you have been installing or working with Azure Stack TP1 you may have noticed some high process consumption from the windows defender process. Whether you're running on recommended hardware or not you may want to switch this process off during the Technical Preview time frame. Depending on how often you're installing Stack having this automatically done after installation is a great time saver. Additionally Windows update is disabled on some servers but not all servers. Depending whether you want unscheduled reboots or not you may want to ensure windows update is disabled on all servers. Open and Edit Stack Settings 1) In the Stack installer folder find the MicrosoftAzureStackPOC vhdx and mount so you can edit the VHD content. The installer script mounts the VHDX in read only mode, eject it and either right click in explorer and mount or use Powershell.

2) Ensure you make a copy before editing.  Open this XML file located at Drive:\AzureStackInstaller\POCFabricInstaller\POCFabricSettings.xml. You may want to install an XML editor like Notepad++ to help read the file easier.

Disable Windows Defender 3) Search for CreateVM.ps1, you should find a task named ADVM. Find the closing tag for 'Parameters' and add the code line below, inside the parameter tag. This Powershell command will disable defender.

[xml]<PostSetupCmd>powershell.exe /c "set-MpPreference -DisableRealtimeMonitoring $true"</PostSetupCmd>[/xml]

4) Search again for CreateVM.ps1 and repeat for each server role.

Disable Windows Update 5) To ensure windows update is disabled on all systems, go back to the top of the xml file and search for CreateVM.ps1 again. Ensure this code is Inside the Parameters tag you can add the RegKeys node with the following.

[xml] <RegKeys> <Reg><!-- Disable windows update--> <Operation>Add</Operation> <Path>System\ControlSet001\Services\wuauserv</Path> <Value>Start</Value> <Type>REG_DWORD</Type> <Data>4</Data> </Reg> <Reg> <Operation>Add</Operation> <Path>System\ControlSet002\Services\wuauserv</Path> <Value>Start</Value> <Type>REG_DWORD</Type> <Data>4</Data> </Reg> </RegKeys> [/xml]

6) Search again for CreateVM.ps1 and repeat for each server role.

7) If your using notepad++ you can use it to check your XML syntax is correct. Save the file and try a deployment.

Optional

If you feel that you want to add a little more RAM or CPUs to a VM you can do that as well here.

Example Code

[xml]

<Task> <Name>ADVM</Name> <Cmd>CreateVM.ps1</Cmd> <CleanupCmd>DeleteVM.ps1</CleanupCmd> <Dependency>EnableRemotePS</Dependency> <Dependency>EnableVFP</Dependency> <Dependency>CopyVhdx_Local</Dependency> <Retry>5</Retry> <Weight>400</Weight> <Timeout>3400</Timeout> <Parameters> <Name>ADVM</Name> <VMPath>{[FindFreeDisk]:Path}</VMPath> <ProcessorCount>4</ProcessorCount> <RAM>3</RAM> <MinRAM>3</MinRAM> <MaxRAM>4</MaxRAM> <Disk> <Base>{[FindFreeDisk]:Path}\{[Global]:VHDs.OSVHD}</Base> <Features> <Name>AD-Domain-Services,DNS</Name> </Features> </Disk> <Nics> <Nic> <Name>Nic1</Name> <vSwitch>{[SetupvSwitch]:Name}</vSwitch> <VLAN>{[Global]:InternalNetworkVLan}</VLAN> <DHCP>false</DHCP> <IP>192.168.100.2/24</IP> <GW>{[Global]:InternalGW}</GW> <DNSList> <DNS>{[Global]:InternalDNS}</DNS> </DNSList> </Nic> </Nics> <LocalAccounts> <AdministratorPassword>{[Global]:AdminPassword}</AdministratorPassword> <Account> <Name>AzureStackAdmin</Name> <Password>{[Global]:AdminPassword}</Password> <Group>Administrators</Group> </Account> <Account> <Name>AzureStackUser</Name> <Password>{[Global]:AdminPassword}</Password> <Group>Users</Group> </Account> </LocalAccounts> <RegKeys> <Reg><!-- Disable windows update--> <Operation>Add</Operation> <Path>System\ControlSet001\Services\wuauserv</Path> <Value>Start</Value> <Type>REG_DWORD</Type> <Data>4</Data> </Reg> <Reg> <Operation>Add</Operation> <Path>System\ControlSet002\Services\wuauserv</Path> <Value>Start</Value> <Type>REG_DWORD</Type> <Data>4</Data> </Reg> </RegKeys> <PostSetupCmd>powershell.exe /c "set-MpPreference -DisableRealtimeMonitoring $true"</PostSetupCmd> </Parameters> </Task> <!-- ADVM -->

[/xml]

[Unsupported]