Graphic User Interface (Gui) Tools

What is it?

Windows Server has long shipped with a set of GUI tools to perform administration tasks for managing servers. Some of these tools work on local and remote systems, but others work only on local machines.

What does it look like?

There have been numerous attempts to standardize the look and experience of GUI management tools, including the Control Panel, Microsoft Management Console (MMC), Server Manager, and, more recently, Honolulu. The result is that there is no single coherent GUI experience for managing Windows Server. But that is not why we don’t use GUIs in this book. If you want to pursue modern IT, we strongly recommend against using GUIs to do management for the following reasons:

• Quality control: If you have a change you need to perform on 100 servers and that change involves 100 mouse clicks, what are the chances you’ll reproduce those mouse clicks in order 100 times? (Hint: 0)

• Lack of productivity: Imagine the effort required to run a GUI on 100 machines to perform an operation. Now image the effort required if you have 1,000 machines or that you need to do this work for the thousands of test VMs that you create every week.

• Lack of peer review/auditing: How confident are you giving a new-hire admin privileges to 100 production machines and having perform arbitrary GUI operations? Can you peer review or audit their mouse clicks?

What can it do?

GUI tools are great tools for learning a technology or running a single server for a small business, but they have minimal to no role in modern IT.

Where do I learn more?

Don’t.

Powershell¹

¹ Most of the things we’ll be doing with PowerShell require Administrator privileges, so start PowerShell by right-clicking the icon and selecting Run As Administrator.

What is it?

PowerShell is a powerful automation framework that is cross platform. Companies can utilize this framework to build tooling to help them more effectively administer their entire IT Enterprise.

What does it look like?

PowerShell is built around cmdlets, which perform actions and are stored in modules. The actions in the cmdlets are usually in the format verb-noun.

For example, if you want to get all the processes on a system, you use the Get-Process cmdlet as follows:

Get-Process

Or

Get-Process -Name lsass

Another example would be if you want to retrieve the last 10 events in the security event log for a Windows server. You would use the cmdlet Get-Eventlog as follows

Click here to view code image

Get-Eventlog -LogName Security -Newest 10

The output is shown in Figure 6-5.

If you used the optional -ComputerName parameter on Get-Eventlog, you could target remote computers. You could even wrap this in a script and collect log data from 100 machines automatically, search for a pattern in the data collected, and trigger an alert somewhere if a condition is detected!

PowerShell is all about a set of small tools that can be stitched together using the pipeline character (|). It’s designed to create an environment where you can think about what you want, type it, and get the results. Imagine that you want to Get all the Processes Where the HandleCount was greater than 2000, sort them by HandleCount, and then Format it as a Table showing the Name, ID, and HandleCount. Here is how you do that in PowerShell:

Click here to view code image

Get-Process |
   Where HandleCount –ge 2000 |
   Sort HandleCount |
   Format-Table Name,ID,HandleCount

What can it do?

You can use PowerShell to manage your environment that spans across multiple clouds. For example, you can use it to manage creating users, creating virtual machines, failing over a database, and many other tasks. PowerShell can reduce the amount of time required to do standard day-to-day administration tasks to improve the efficiency of the IT team.

Where do I learn more?

The help that ships with PowerShell is amazingly good. Start by using the Get-Help cmdlet and take it from there. If you to prefer watching videos, many people have successfully used a series of Microsoft Virtual Academy video talks to learn PowerShell. The best way to find these are go to the Microsoft Virtual Academy (mva.microsoft.com) and search for “Snover PowerShell.” Look for the following:

• Getting Started with Microsoft PowerShell

• Advanced Tools & Scripting with PowerShell 3.0 Jump Start

Powershell Desired State Configuration (Dsc)

What is it?

Desired State Configuration (DSC) is an essential part of the configuration, management, and maintenance of Windows-based servers. It allows a PowerShell script to specify the configuration of the machine using a declarative model in a simple standard way that is easy to maintain and understand. This is a subset of PowerShell; in a sense, you could consider this the next level of PowerShell skills.

What does it look like?

Following is a sample DSC configuration layout that installs the IIS Role on servers dedicated to being a web server and Hyper-V on servers dedicated to being a VM Host:

Click here to view code image

Configuration Lab1 {

    Node $AllNodes.Where{$_.Role -eq 'WebServer'}.NodeName
    {
        WindowsFeature IISInstall {
            Name    = 'Web-Server'
            Ensure  = 'Present'
        }

    }
    Node $AllNodes.Where{$_.Role -eq 'VMHost'}.NodeName
    {
        WindowsFeature HyperVInstall {
            Name    = 'Hyper-V'
            Ensure  = 'Present'
        }
    }
}

$MyData =
@{
    AllNodes =
    @(
        @{
            NodeName     = 'Web-1'
            Role         = 'WebServer'
        },
        @{
            NodeName     = 'Web-2'
            Role         = 'WebServer'
        },
        @{
            NodeName     = 'VM-2'
            Role         = 'VMHost'
        }
    )
}

Lab1 -ConfigurationData $MyData -Verbose

The very last line does the following:

• It creates a subdirectory using the name of the configuration ’Lab1’.

• It generates a set of Managed Object Format (MOF) files, one for each node to be configured into that subdirectory (for example, .Lab1Web-1.mof).

The MOF files are compiled versions of the configuration and are read and interpreted by the Local Configuration Manager engine on the machine to be configured. At this stage, you have defined the configurations you want. Later we show you how to implement those configurations using the Start-DSCConfiguration cmdlet.

What can it do?

PowerShell DSC is a very powerful tool that can help you deploy software and maintain state on machines in a standardized manner. You can use it to integrate into the CI/CD process to ensure that when a piece of software gets updated you can update the DSC configuration scripts to deploy the new software.

Where do I learn more?

Again, the help that ships with PowerShell is your best starting point. Type

Click here to view code image

>  help about_DesiredStateConfiguration

and take it from there.

If you to prefer watching videos, many people have successfully used a series of Microsoft Virtual Academy talks on PowerShell to learn PowerShell and DSC. The best way to find these are go to the Microsoft Virtual Academy (mva.microsoft.com) and search for “Snover PowerShell.” Specifically, look for the following:

• Getting Started with PowerShell Desired State Configuration

• Advanced PowerShell Desired State Configuration (DSC) and Custom Resources

Cloud Shell

What is it?

Cloud Shell is the ability to run a console window in a browser. It’s currently available from the Azure Portal but also will be available from other websites in the future. Cloud Shell enables you to run a Bash/Linux or PowerShell/Windows session.

Each environment includes the latest version of the Azure tools and other tools, including gvim, git, and sqlcmd. Interestingly, the PowerShell/Windows environment allows you also to run Bash, and the Bash/Linux environment allows you also to run PowerShell.

The PowerShell environment mounts Azure as a drive, which allows you to navigate and interact with Azure resources the same way would a file system. For example,

Click here to view code image

> dir azure:*VirtualMachines* |group PowerState

What does it look like?

Figure 6-6 shows the Cloud Shell in action directly from the browser. It looks and feels like traditional PowerShell Windows! We are listing the status of the Virtual Machines in our Azure Subscription.

From Cloud Shell, you can administer your Azure Resources and perform tasks as necessary.

What can it do?

Ultimately Cloud Shell gives you the ability to use familiar tooling like PowerShell to manage a complex environment like Azure.

Where do I learn more?

Visit docs.microsoft.com/en-us/azure/cloud-shell/overview to get more information about Cloud Shell.

Azure Automation

What is it?

Whereas PowerShell is a task automation and configuration management framework, Azure Automation (AA) is a task automation and configuration management solution built on top of PowerShell. AA is a product designed to be used by teams to manage production environments. AA runs as a cloud service in Azure but can manage any Windows, Linux, or MacOS machine anywhere—whether it is running in Azure, in AWS, in GCE, or on premises (via an Azure Automation Gateway).

AA is the solution that transforms ad hoc scripting into formal production management. It enables teams to create formal repositories of production scripts under source code control (no more losing track of your scripts, accidental deletions, or questions about who/when/how did this production script change). It provides a secure central repository for managed assets (for example, credentials to be used to manage systems, common parameters to be used by all scripts). It provides scheduling and integration with other products/web services so that scripts can be run on regular intervals or in response to events. It also provides logging and output management so that you know when scripts were run, and you can look back on previous runs to examine the script results.

What does it look like?

AA has many different sections to it, including source control, DSC, runbooks, and assets. Figure 6-7 shows AA and some demo runbooks. The figure also shows the menu of other options you could potentially configure and use.

What can it do?

AA was built to automate processes that can be executed in PowerShell and Python across private and public environments! You can use it to create users, provision infrastructure, and do an endless number of other tasks. You also can integrate AA with Microsoft Operations Management and Security Suite to respond to alerts and trigger actions based on the data. You can use it via webhooks, which opens up another significant amount of potential integration points. AA also can leverage DSC and enforce configurations to act as a pull server across private and public clouds.

Where do I learn more?

Visit azure.microsoft.com/en-us/services/automation/ for more information.

Creating Users

Creating a user in PowerShell requires a few cmdlets to complete the entire process.

First, you use the cmdlet New-ADUser with the following syntax:

Click here to view code image

New-ADUser -Name 'Joe Bloggs' -UserPrincipalName [email protected]

The user is created, but because of the way New-ADUser creates the account, it does not have a password and therefore can’t be enabled. You need to use the Set-ADAccountPassword cmdlet as follows:

Click here to view code image

Set-ADAccountPassword -Identity 'Joe Bloggs'

This prompts you for a new password to set for the user. If you want to get fancier, you can encode the password as a secure string and use it as part of the command as follows:

Click here to view code image

$securePW = ConvertTo-SecureString -String 'Password01' -AsPlainText -Force

If we use the $securepassword variable now, which stores the secure string we need, we could use the -newpassword parameter for the Set-ADAccountPassword cmdlet to include the password rather than being prompted for it. Now the syntax will be as follows:

Click here to view code image

Set-ADAccountPassword -Identity 'Joe Bloggs' -NewPassword $securePW

You also could use the -AccountPassword parameter for New-ADUser cmdlet as well and eliminate this line completely.

Finally, you use the Enable-AdAccount cmdlet to enable the account as follows:

Click here to view code image

Enable-AdAccount -Identity 'Joe Bloggs'

These are the individual steps and work! Now you make this useful by building a tool script to create an AD user with extra properties. Take the following code and save it to a file named New-TeamMate.ps1:

Click here to view code image

param
(
    [string]$GivenName,
    [string]$Surname,
    [string]$EmployeeID,
    [string]$Department
)
<# Make this script more readable by creating a hashtable whose names
   match the parameters of New-AdUser and then 'splat' them.
   Get Details by typing:
   > Help about_Splatting
#>
$pw = 'Password123!'
$accountPassword = ConvertTo-SecureString -String $pw -AsPlainText -Force

$param = @{
    GivenName   = $GivenName
    Surname     = $Surname
    Name        = "$Surname, $GivenName"
    SamAccount  = "$GivenName.$Surname"
    EmployeeID  = $EmployeeID
    Department  = $Department
    Office      = '41/5682'
    City        = 'Redmond'
    State       = 'Washington'
    Company     = 'Fourth Coffee'
    Country     = 'US'
    AccountPassword = $accountPassword
}


New-AdUser @param
        Enable-AdAccount -Identity $param.SamAccount
Write-Verbose "Added $GivenName $Surname"

When you execute this script, you can run the script with the parameters as follows:

Click here to view code image

./New-TeamMate.ps1 -GivenName John -Surname Doe -EmployeeID 12345 -Department IT

This creates a user with a default password and default settings for office, city, and so on.

Once Fourth Coffee delivers its new customer-focused applications, the company will be hiring a lot of users, so you should modify this script to be able to work against a CSV file like this:

Click here to view code image

JPS> cat .NewHire.csv
GivenName,SurName,EmployeeID,Department
Mary,Breve,3000,IT
Sandeep,Java,3001,Development
Sarah,Bean,3002,Accounting

All you need to do is modify the parameter block and wrap the rest of the script in a process script block:

Click here to view code image

param
(
    [Parameter(Mandatory=$true, ValueFromPipelineByPropertyName=$true)]
    [string]$GivenName,
    [Parameter(Mandatory=$true, ValueFromPipelineByPropertyName=$true)]
    [string]$Surname,
    [Parameter(Mandatory=$true, ValueFromPipelineByPropertyName=$true)]
    [string]$EmployeeID,
    [Parameter(Mandatory=$true, ValueFromPipelineByPropertyName=$true)]
    [string]$Department
)
process
{
<# Make this script more readable by creating a hashtable whose names
   match the parameters of New-AdUser and then 'splat' them.
   Get Details by typing:
   JPS> Help about_Splatting
#>
$PW = 'Password123!'
$accountPassword = ConvertTo-SecureString -String $PW -AsPlainText -Force

$param = @{
    GivenName   = $GivenName
    Surname     = $Surname
    Name        = "$Surname, $GivenName"
    SamAccount  = "$GivenName.$Surname"
    EmployeeID  = $employeeID
    Department  = $department
    Office      = '41/5682'
    City        = 'Redmond'
    State       = 'Washington'
    Company     = 'Fourth Coffee'
    Country     = 'US'
    AccountPassword = $accountPassword
}
New-AdUser @param
Enable-AdAccount -Identity $samaccount
Write-Verbose "Added $GivenName $Surname"
}

This enables you to do the following:

Click here to view code image

JPS> Import-Csv '.NewHire.csv'  |.New-TeamMate.PS1 -verbose

VERBOSE: Added Mary Breve
VERBOSE: Added Sandeep Java
VERBOSE: Added Sarah Bean

Congratulations! You are well on your way to massive, no-drama productivity through the magic of PowerShell.

You could continually evolve this script with things like enabling the user principal in other systems like Exchange or a customer Human Resources application.

Disabling User’s Account Not Active in 30 Days

Another common task is identifying users who haven’t being logged on in more than 30 days and disabling them. First, you can use the Search-ADAccount cmdlet³

³ By default, the Active Directory LastLogonTimeStamp attribute is correct, but it has a very slow update frequency (think weeks). It’s not a real-time logon tracking mechanism. You can learn more details by reading the blog at blogs.technet.microsoft.com/askds/2009/04/15/the-lastlogontimestamp-attribute-what-it-was-designed-for-and-how-it-works/.

Click here to view code image

Search-ADAccount -AccountInactive -TimeSpan 30.00:00:00 -UsersOnly

This gives you a list of accounts that have not been logged on for more than 30 days. You can disable these accounts by using the Disable-ADAccount cmdlet. Fourth Coffee has a policy to disable inactive accounts every month. It implements this using the scheduling capabilities of AA and the following script:

Click here to view code image

Search-ADAccount -AccountInactive -TimeSpan 30.00:00:00 -UsersOnly |
    Disable-ADAccount

Group Management

You also could automate aspects of group management. If you need to add a user to a group, you can use PowerShell to do it. Following is a basic script that takes a username and group and adds the user into it. Although there are many different ways of doing this, and probably PowerShell now has new tools to do it in a single command, we’re showing you this method to demonstrate a principle of taking a multistep task and turning it into a script:

Click here to view code image

param
(
    [string]$Useraccount,
    [string]$domaingroup
)
$user = Get-ADUser -Identity $useraccount
$group = Get-ADGroup -Identity $domaingroup
Add-ADGroupMember $group –Member $user

You can call this script AddGroupMembers.ps1 and use the following syntax to execute it:

Click here to view code image

.AddGroupMembers.ps1 -UserAccount 'Joe Bloggs' -DomainGroup 'Domain Admins'

We have examined three areas for identity which we can take and build an automated solution to match the functionality of the manual process and deliver efficiency by reducing the amount of time it takes to perform the task. These tasks also could be ported to AA and wrapped with a self-service portal to provide more power to the end users and free up time for IT staff to perform more important tasks.

Reviewing Logs Across Multiple Computers

A common task is trying to find out events across multiple computers to see if it is a common failure.

Say you want to look at the last 10 entries in the application log from a list of servers listed in a file named AllServers.txt. You can use the Invoke-Command and Get-Eventlog cmdlets as follows:

Click here to view code image

Invoke-Command -ComputerName (Cat AllServers.Txt) {
    Get-Eventlog -LogName Application -Newest 10 |
    Select MachineName, EventID, Source, Message
} |Format-Table

The output is displayed as follows

Click here to view code image

MachineName              EventID Source                             Message
------------             -------  -------                           --------
sq101.fourthcoffee.com    4098   Group Policy Registry              The computer
                                                                    'AllowKMSUpgrade'
sq101.fourthcoffee.com    1704   SceCli                             Security policy in the
                                                                    Group po
sq101.fourthcoffee.com     916   ESENT                              services (896,G,0) The
                                                                    beta fea
sq101.fourthcoffee.com     916   ESENT                              svchost (4968,G,0) The
                                                                    beta fea
sq101.fourthcoffee.com      31   Microsoft-Windows-Spell-Checking   Failed to update 1
                                                                    user custom
sq101.fourthcoffee.com     916   ESENT                              SettingSyncHost
                                                                    (10220,G,0) The
sq101.fourthcoffee.com     916   ESENT                              SettingSyncHost
                                                                    (10220,G,0) The
sq101.fourthcoffee.com    1001   Windows Error Reporting            Fault bucket
                                                                    146962385495655736
sq101.fourthcoffee.com   16384   Software Protection Platform Service Successfully
                                 scheduled Software

sq101.fourthcoffee.com    1003   Software Protection Platform Service The Software
                                 Protection service
dc01.fourthcoffee.com       15   SecurityCenter                    Updated Windows
                                                                   Defender status
dc01.fourthcoffee.com       15   SecurityCenter                    Updated Windows
                                                                   Defender status
dc01.fourthcoffee.com      916   ESENT                             SettingSyncHost
                                                                   (10440,G,0) The
dc01.fourthcoffee.com     1001   Windows Error Reporting           Fault bucket
                                                                   128049445031, type
dc01.fourthcoffee.com     1001   Windows Error Reporting           Fault bucket
                                                                   128049445031, type
dc01.fourthcoffee.com     1001   Windows Error Reporting           Fault bucket
                                                                   128049445031, type
dc01.fourthcoffee.com     1001   Windows Error Reporting           Fault bucket
                                                                   128049445031, type
dc01.fourthcoffee.com     1001   Windows Error Reporting           Fault bucket
                                                                   128049445031, type
dc01.fourthcoffee.com     1001   Windows Error Reporting           Fault bucket
                                                                   128049445031, type
dc01.fourt

Get-EventLog is a good simple cmdlet, but it is better to invest in learning the Get-WinEvent cmdlet, which is more capable and much faster. The Event ID for a failed logon is 4625, but Get-EventLog does not allow you to specify that ID, so you would have to use the following:

Click here to view code image

Get-EventLog -LogName Security | where {$_.EventID -eq 4265}

Here is a fast and effective way to get the failed login events from all servers.

Click here to view code image

Invoke-Command -ComputerName (Cat AllServers.Txt) {
    Get-WinEvent -FilterHashTable @{LogName='security'; id=4625 }
}

Port Scanner

Often when you deploy systems you can have connectivity problems, or if you need to test your firewall rules to see whether a port responds, you need to simulate a connection. You can use PowerShell to implement a lightweight port scanner as follows:

Click here to view code image

param
(
    [string]$ComputerName,
    [String[]]$ports

)
$ErrorActionPreference='silentlycontinue'
Write-host 'Attempting to Connect...'
foreach($port in $ports)
{
    $test = Test-NetConnection -Port $port -ComputerName $ComputerName
    if($test.TcpTestSucceeded -eq $false)
    {
        Write-host "Connection to $ComputerName failed, Port $port is not listening"
        -ForegroundColor Red -BackgroundColor Black
    }
    else
    {
        write-host "Connection to $ComputerName Succeed, Port $port is listening"
        -ForegroundColor Green -BackgroundColor Black
    }
}

The syntax for using this for multiple ports to be scanned would be as follows:

Click here to view code image

.New-BasicPortScanner.ps1 -ComputerName TestMachine -Port 80,53,1024

This is obviously a simple scanner, but it again highlights the potential tasks you can automate to become more efficient.

Firewall

Fourth Coffee uses Group Policy to turn off all its firewalls, but the company isn’t trying to ensure the firewall is properly configured. Fourth Coffee needs a quick way to identify across multiple computers if a firewall rule has made it.

First, you should check whether the firewall is turned on; checking this on a remote machine involves using the invoke-command cmdlet and the Get-NetFirewallProfile cmdlet as follows:

Click here to view code image

Invoke-command -computername dc01 -scriptblock {Get-NetFirewallProfile}

The output for the domain profile is listed here:

Click here to view code image

Name                            : Domain
Enabled                         : True
DefaultInboundAction            : NotConfigured
DefaultOutboundAction           : NotConfigured
AllowInboundRules               : NotConfigured
AllowLocalFirewallRules         : NotConfigured
AllowLocalIPsecRules            : NotConfigured
AllowUserApps                   : NotConfigured
AllowUserPorts                  : NotConfigured
AllowUnicastResponseToMulticast : NotConfigured
NotifyOnListen                  : False
EnableStealthModeForIPsec       : NotConfigured
LogFileName                     : %systemroot%system32LogFilesFirewallpfirewall.log
LogMaxSizeKilobytes             : 4096
LogAllowed                      : False
LogBlocked                      : False
LogIgnored                      : NotConfigured
DisabledInterfaceAliases        : {NotConfigured}
PSComputerName                  : dc01

Now that you know the firewall is enabled, you can check the rules and the ruleset, and you can filter on inbound-only rules using the following syntax:

Click here to view code image

Invoke-command -computername dc01 -scriptblock {Get-NetFirewallProfile `
-Name Domain |Get-NetFirewallRule |where {$_.Direction -eq 'Inbound'}}

This command lists all the rules and their state (allowed or denied). You can perform further checks or loop across all profiles to determine all the rule states.

Azure—Network Security Groups

If you’re working in Azure, you can generate new network security groups and rules and enforce traffic policies across an entire estate in a matter of minutes.

You use the New-AzureRMNetworkSecurityRuleConfig cmdlet to generate a new rule you want applied. In this example, we want to allow Port 22 for SSH:

Click here to view code image

$nsg = Get-AzureRmNetworkSecurityGroup -ResourceGroupName FourthCoffeeNSG `
-Name FrontEnd-Net

$rule1 = New-AzureRmNetworkSecurityRuleConfig -Name rdp-rule `
-NetworkSecurityGroup $nsg -Description 'Allow SSH' -Access Allow '
-Protocol Tcp -Direction Inbound `
-Priority 100 -SourceAddressPrefix Internet -SourcePortRange * `
-DestinationAddressPrefix * -DestinationPortRange 22

  Set-AzureRmNetworkSecurityGroup -NetworkSecurityGroup $nsg

We can loop this across multiple existing Network Security groups using PowerShell and enforce any new security boundaries.

Finding Which Patches are Deployed

Unpatched servers are the number-one cause of preventable security breaches. The day after the CEO of a public company was fired because of a security breach because of unpatched servers, Charlotte was called into the Fourth Coffee CEO’s office. She walked out of that office with what she referred to as her “Salary Continuation Program.” She had a clear mission to inventory every system in the enterprise and to ensure that they were patched within 60 days.

Charlotte’s hair was on fire, and Eddie turned out to be a bucket of water. Moments after her meeting with the CEO, Charlotte held an emergency staff meeting to discuss how the team would get on top of this issue and find out where they were. Charlotte wanted everyone engaged on the problem and was growing irritated as she watched Eddie typing away on his laptop; she assumed he was writing an email. Minutes later, Eddie interrupted and brought the meeting to a halt by saying the single word, “DONE!”.

While everyone else had been arguing about charters, timelines, and whether to bring in contractors, Eddie wrote the following script:

Click here to view code image

$allComputers = Get-ADComputer -Filter 'ObjectClass -neq "Computer"'
$patches = Get-CimInstance -ComputerName $allcomputers.Name -ClassName
Win32_QuickFixEngineering
$patches | Export-Csv .Patches.csv
Invoke-Item .Patches.csv

Eddie said, “I just ran a script to generate an Excel spreadsheet that shows every computer and every patch installed on those computers.” When Joe asked how long the company had been able to do that, Eddie replied, “About 45 seconds. I just finished the script. This will give us quick answers, but if you give me a few more minutes, I’ll write some helper scripts to generate reports as well.”

Checking Storage Pool Health on Remote Machines

If you want to look at the health of storage pools that you’ve built on various machines, you can connect to the machine via a CIM session using the new-cimsession, and then you can use the Get-StoragePool cmdlet to use the CIM session you’ve created to retrieve the data from the remote machine.

Click here to view code image

$cimsession = new-cimsession -computername sql01
Get-StoragePool -cimsession $cimsession

The output of the command is shown here:

Click here to view code image

FriendlyName OperationalStatus HealthStatus IsPrimordial IsReadOnly PSComputerName
------------ ----------------- ------------ ------------ ---------- --------------
Primordial   OK                Healthy      True         False      sql01
sqldata      Read-only         Unknown      False        True       sql01
sqldata      Read-only         Unknown      False        True       sql01
Primordial   OK                Healthy      True         False      sql01

If you observe the output, you see the health status listed so you can determine what is healthy, what is unhealthy, and what is in an unknown status and requires further investigation.

You can create a script that loops across multiple machines and generates a report for all the storage pools so that you have one place to loop versus manually performing the task on each machine.

Creating a File Share

To rapidly create files shares, you can use the New-SmbShare cmdlet, like so:

Click here to view code image

New-SmbShare -Name 'UserStore' -Path 'D:UserStore'
-FullAccess 'FourthCoffeeAdministrators', 'FourthCoffeeDomain Users', 'FourthCoffee
Domain Admins'

You also can do this with remote machines by creating a CIM Session to a remote machine and executing the New-SmbShare cmdlet with the -cimsession parameter.

Creating a Virtual Disk

If Fourth Coffee implemented Storage Spaces Direct on their hosts and needed to create a new virtual disk for users to store data on, the company also could implement it rapidly in PowerShell. Using the New-VirtualDisk cmdlet as follows would create a 100 GB disk ready for use:

Click here to view code image

New-VirtualDisk -StoragePoolFriendlyName StoragePool01
-FriendlyName UserDataStore10 -Size 100GB -ProvisioningType Fixed
-ResiliencySettingName Simple

You could easily parameterize this or create code to enumerate the resources and check what is available in the pool before provisioning.

Resizing a Disk

If you’re running out of space on your storage virtual disks, you can use PowerShell to increase the amount of space available using the Resize-VirtualDisk cmdlet:

Click here to view code image

Resize-VirtualDisk -FriendlyName 'UserDataStore10' -Size (200GB)

Change the Ip Address

A simple task like changing the IP address of a machine can take a minute or two on any machine. You can use the New-NetIPAddress cmdlet to change the IP address of a machine as part of a setup script. We show the basic usage of the New-NetIPAddress cmdlet here:

Click here to view code image

New-NetIPAddress –InterfaceAlias 'Wired Ethernet Connection'
-IPv4Address '172.18.0.100' –PrefixLength 24 -DefaultGateway 172.18.0.254

Then you can update the DNS servers the network interface card uses to the appropriate DNS servers using the Set-DnsClientServerAddress cmdlet like this:

Click here to view code image

Set-DnsClientServerAddress -InterfaceAlias 'Wired Ethernet Connection'
-ServerAddresses 172.18.0.1, 172.18.0.2

You also can perform this command using a CIMSession. For example, you can provision a machine on a DHCP network and then remotely connect to it and change it to a static IP address.

Flush Dns

Occasionally DNS on a machine doesn’t flush its cache quickly enough, you and we need to force a flush of the cache to allow for proper name resolution. You can use the Clear-DnsClientCache cmdlet to clear the DNS cache locally or remotely.

For a local machine DNS cache, simply run the following from an elevated PowerShell:

Clear-DnsClientCache

For a remote machine, create a CIM session and then execute the following:

Click here to view code image

$cimsession = new-cimsession -computername dc01
Clear-DnsClientCache -CimSession $cimsession

A valid day-to-day use of this would be when you’re working with Azure Site Recovery. As part of the recovery plan, you need to clear clients’ DNS cache for them to properly resolve to the newly recovered servers in the disaster recovery site.

Capture Network Trace

Capturing traffic on a system to analyze whether you are having problems like latency or disconnects in your application becomes a useful troubleshooting technique. PowerShell enables you to build a tool that you can use to capture network traffic data using the following steps:

1. Build a timestamp using the Get-Date cmdlet:

   Click here to view code image

   $timestamp = Get-Date -f yyyy-MM-dd_HH-mm-ss

2. Create the capture session and give it a friendly name using the New-NetEventSession:

   Click here to view code image

   New-NetEvenltSession -Name NetCapture
   -LocalFilePath d: emp$env:computername-netcap-$timestamp.etl -MaxFileSize 512

3. Specify the type of capture provider you want to use. In this case, NetCapture using the Add-NetEventPacketCaptureProvider cmdlet:

   Click here to view code image

   Add-NetEventPacketCaptureProvider -SessionName NetCapture

4. Start the capture using the Start-NetEventSession cmdlet:

   Click here to view code image

   Start-NetEventSession -Name NetCapture

5. Stop the capture using the Stop-NetEventSession cmdlet:

   Click here to view code image

   Stop-NetEventSession -Name NetCapture

CIM Sessions can be used to perform this on remote computers.

Virtual Machine Deployment

A key to driving efficiency in an organization is the delivery of resources in a timely fashion. There are many examples across IT organizations of virtual machines being requested for applications, and it may take several weeks before they are deployed.

This is one process where an automated framework should be implemented with a self-service portal to minimize the IT resources involved in the overall deployment. This does not mean IT resources will allow any virtual machines to be deployed to their environment; rather that users will request a new virtual machine, and IT resources will be notified to approve or deny the request. If the request is approved, the virtual machine will be deployed based on the parameters; if the request is denied, a notification will be sent to the end user who submitted the request.

Figure 6-8 shows a flow chart of the process you could use for virtual machine provisioning.

Figure 6-9 shows a sample architecture you could use to take the request in and perform the deployment task. You use on-premises and public cloud resources to achieve the solution and leverage the tooling that you have (such as ServiceNow, SharePoint, AA, and PowerShell).

Over the next few pages, we show you some of the sample PowerShell we could have used as a base to deploy virtual machines across some of the virtualization environments we find in organizations today. In our architecture in Figure 6-9, we use a SharePoint webpage that controls the type of data we get; it will have a drop-down list for the environment people want this deployed to.

We can abstract the cloud environments from the users by using terminology like Production, Test, Dev, and so on instead of Hyper-V, VMware, Azure, and AWS. Similarly, we can abstract all the information we require to make proper choices for deployment from the user and make those forms user friendly.

When it gets into AA, our control scripts parse out the data and call the relevant deployment script to ensure that it goes to the right environment. We can even get our control scripts to check environment capacity before deploying and make alternative decisions based on what the scripts discover.

Deploying to Hyper-v

Here is an example of a PowerShell command you could use to create a virtual machine in Hyper-V. This creates a hash table of the parameters that will be used to create the virtual machine:

Click here to view code image

$VMName = 'Server01'

$VM = @{
  Name = $VMName
  MemoryStartupBytes = 2147483648
  Generation = 2
  NewVHDPath = "C:Virtual Machines$VMName$VMName.vhdx"
  NewVHDSizeBytes = 53687091200
  BootDevice = 'VHD'
  Path = "C:Virtual Machines$VMName"
  SwitchName = (Get-VMSwitch).Name[0]
}

New-VM @VM

We can wrap this with parameters to capture all the variables required and deploy the virtual machine.

Normally Hyper-V is managed using System Center Virtual Machine Manager, which also has PowerShell cmdlets to deploy a virtual machine. A sample script for that would be like this:

Click here to view code image

param
(

    [string]$vmmserver,
    [string]$templatename='WindowsServer2016Datacenter'
 )

Get-VMMServer -ComputerName $VMMServer


$VMTemplate = $TemplateName
$VMHostGroup = Get-VMHostGroup -Name 'All Hosts'

$HostRatings = @(Get-VMHostRating -DiskSpaceGB 120 -Template $VMTemplate `
-VMHostGroup $VMHostGroup -VMName $VMName | where { $_.Rating -gt 0 })

 If($HostRatings.Count -eq "0")
 {
  throw "No hosts meet the requirements for the virtual machine"
 }
 If ($HostRatings.Count -ne 0)
 {

  $VMHost = $HostRatings[0].VMHost
  $VMPath = $HostRatings[0].VMHost.VMPaths[0]


  $VMJobGroup = [System.Guid]::NewGuid()

  Get-Template -VMMServer $VMMServer | where { $_.Name -eq $VMTemplate }


  New-VM -Template $VMTemplate -Name $VMName -Description "New VM" -VMHost $VMHost -Path
$VMPath -JobGroup $VMJobGroup -RunAsynchronously `
  -ComputerName "*" -JoinWorkgroup "WORKGROUP" -RunAsSystem -StopAction SaveVM
}

The deployment requires the VMM server name; in this example, we default it to the Windows Server 2016 Template, which has been prestaged in the VMM server. We could add parameters for the virtual machine name, join it to the domain, and even have postscript executions happen. VMM server has the host rating system, which we can use to help us determine the best host placement taking another job and automating using technology.

Deploying to Vmware

VMware has the ability to deploy via PowerShell; it uses the PowerCLI client. It’s similar to System Center Virtual Machine Manager; we can discover our hosts and, in VMware’s case, the datastores and dynamically choose where the virtual machine should be deployed. The example script that follows shows a basic script you can use to rapidly deploy a Windows Server 2016 virtual machine into a VMware estate.

Click here to view code image

param
(
    [string]$vcenter,
    [string]$VMName,
    [string]$Password="Password123!"
)

$secpass = ConvertTo-SecureString -String $Password -AsPlainText -Force
$domaincreds = New-Object ' System.Management.Automation.PSCredential('FourthCoffee
Adminisrator', $secpass)

Connect-VIServer –Server $vcenter
$VMHOST="VMHOST01"
$DATASTORE="SSDStore01"

New-OSCustomizationSpec -Name 'WindowsServer2016' -FullName $VMName
-OrgName 'FourthCoffee' -OSType Windows -ChangeSid
-AdminPassword $secpass -Domain 'FOURTHCOFFEE' -DomainCredentials $domaincreds '
-AutoLogonCount 1

$OSSpecs = Get-OSCustomizationSpec -Name 'WindowsServer2016'

$VMTemplate = Get-Template -Name 'Server2016Template'

New-VM -Name '$VMName' -Template $VMTemplate -OSCustomizationSpec $OSSpec '
-VMHost $VMHOST -Datastore $DataStore

Deploying to Azure

There are multiple ways of deploying a virtual machine to Azure. Here are the three most common:

• The portal

• PowerShell/CLI

• ARM templates

You can automate virtual machine deployment with PowerShell/CLI or ARM templates. Sometimes you even can use a combination of both.

For the first example, we show a sample using PowerShell that could be used in AA to deploy a Windows Server Virtual machine.

In the first section, we ask for the parameters, and we introduce the more complex Power-Shell features like mandatory parameters and the ValidateNotNullOrEmpty() method to ensure we don’t leave a parameter that needs a value, empty. Then we move on to collect our credentials using the Azure Automation cmdlet Get-AutomationPSCredential. We then build the virtual machine configuration and pass that to the final New-AzureRMVM cmdlet.

Click here to view code image

param
(
[Parameter(Mandatory=$true)]
    [string]$VMname,
    [ValidateNotNullOrEmpty()]
    [string]$AzureRegion = "uswest2",
    [ValidateNotNullOrEmpty()]
    [string]$ImageName = "WindowsServer2016",
    [ValidateNotNullOrEmpty()]
    [string]$VMSize = "Standard_D1",
    [ValidateNotNullOrEmpty()]
    [string]$ResourceGroup

)

If ($ImageName -eq "WindowsServer2016")
{
   $PublisherName = "MicrosoftWindowsServer"
   $offer = "WindowsServer"
   $skus = "2016-Datacenter"
}

$cred = Get-AutomationPSCredential -Name "Azure"
$vm = New-AzureRmVMConfig -VMName $VMName -VMSize $VMSize

$vm = Set-AzureRmVMOperatingSystem `
    -VM $vm `
    -Windows `
    -ComputerName $VMName `
    -Credential $cred `
    -ProvisionVMAgent -EnableAutoUpdate

$vm = Set-AzureRmVMSourceImage `
    -VM $vm `
    -PublisherName $PublisherName `
    -Offer $Offer `
    -Skus $skus `
    -Version latest

$vm = Set-AzureRmVMOSDisk `
    -VM $vm `
    -Name "$VMNAme_OSDisk" `
    -DiskSizeInGB 128 `
    -CreateOption FromImage `
    -Caching ReadWrite

 $vm = Add-AzureRmVMNetworkInterface -VM $vm -Id $nic.Id

 New-AzureRmVM -ResourceGroupName $resourcegroup -Location $AzureRegion -VM $vm

ARM templates are slightly different, however. They’re defined in a JSON file. This file describes the infrastructure to be deployed. It also includes taking parameters, defining usable variables, and providing outputs. This is infrastructure as code, and when we start to adopt concepts like DevOps into Fourth Coffee’s IT organization, this will be a cornerstone of driving consistency and efficiency throughout the company’s environments.

The following is a sample ARM template for deploying a Windows Virtual Machine:

Click here to view code image

{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.
json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "adminUsername": { "type": "string" },
    "adminPassword": { "type": "securestring" }
  },
"variables": {
    "vnetID": "[resourceId('Microsoft.Network/virtualNetworks','myVNet')]",
    "subnetRef": "[concat(variables('vnetID'),'/subnets/mySubnet')]",
  },
  "resources": [
    {
      "apiVersion": "2016-03-30",
      "type": "Microsoft.Network/publicIPAddresses",
      "name": "myPublicIPAddress",
      "location": "[resourceGroup().location]",
      "properties": {
        "publicIPAllocationMethod": "Dynamic",
        "dnsSettings": {
          "domainNameLabel": "myresourcegroupdns1"
        }
      }
    },
    {
      "apiVersion": "2016-03-30",
      "type": "Microsoft.Network/virtualNetworks",
      "name": "myVNet",
      "location": "[resourceGroup().location]",
      "properties": {
        "addressSpace": { "addressPrefixes": [ "10.0.0.0/16" ] },
        "subnets": [
          {
            "name": "mySubnet",
            "properties": { "addressPrefix": "10.0.0.0/24" }
          }
        ]
      }
    },
    {
      "apiVersion": "2016-03-30",
      "type": "Microsoft.Network/networkInterfaces",
      "name": "myNic",
      "location": "[resourceGroup().location]",
      "dependsOn": [
        "[resourceId('Microsoft.Network/publicIPAddresses/', 'myPublicIPAddress')]",
        "[resourceId('Microsoft.Network/virtualNetworks/', 'myVNet')]"
      ],
      "properties": {
        "ipConfigurations": [
          {
            "name": "ipconfig1",
            "properties": {
              "privateIPAllocationMethod": "Dynamic",
              "publicIPAddress": { "id": "[resourceId('Microsoft.Network/publicIPAddresses','myPublicIPAddress')]" },
              "subnet": { "id": "[variables('subnetRef')]" }
            }
          }
        ]
      }
    },
    {
      "apiVersion": "2016-04-30-preview",
      "type": "Microsoft.Compute/virtualMachines",
      "name": "myVM",
      "location": "[resourceGroup().location]",
      "dependsOn": [
        "[resourceId('Microsoft.Network/networkInterfaces/', 'myNic')]"
      ],
      "properties": {
        "hardwareProfile": { "vmSize": "Standard_DS1" },
        "osProfile": {
          "computerName": "myVM",
          "adminUsername": "[parameters('adminUsername')]",
          "adminPassword": "[parameters('adminPassword')]"
        },
        "storageProfile": {
          "imageReference": {
            "publisher": "MicrosoftWindowsServer",
            "offer": "WindowsServer",
            "sku": "2012-R2-Datacenter",
            "version": "latest"
          },
          "osDisk": {
            "name": "myManagedOSDisk",
            "caching": "ReadWrite",
            "createOption": "FromImage"
          }
        },
        "networkProfile": {
          "networkInterfaces": [
            {
              "id": "[resourceId('Microsoft.Network/networkInterfaces','myNic')]"
            }
          ]
        }
      }
    }
  ]
}

We can use CLI, PowerShell, REST API, or Portal to deploy this template.

When considering automation in Azure, ARM Templates is the preferred choice. Even if you use AA as the controlling engine, you can store your templates in a public repository and have AA call to the public repository during runbook execution and execute the template.

Deploying to Aws

If you want to deploy to AWS, you can use PowerShell to achieve this. The following is a base script that will deploy an AWS virtual machine. In the first section, we ask for the parameters, and we use the more complex PowerShell features like mandatory parameters and the ValidateNotNullOrEmpty() method. We proceed to build the credentials to connect to AWS, and the Get-AutomationPSCredential cmdlet is Azure Automation–specific, allowing us to store the credential and retrieve it securely when our script executes. Then we retrieve the image and build the virtual machine.

Click here to view code image

param (
    [Parameter(Mandatory=$true)]
    [string]$VMname,
    [ValidateNotNullOrEmpty()]
    [string]$AWSRegion = "us-west-2",
    [ValidateNotNullOrEmpty()]
    [string]$EC2ImageName = "WINDOWS_2012R2_BASE",
    [ValidateNotNullOrEmpty()]
    [string]$MinCount = 1,
    [ValidateNotNullOrEmpty()]
    [string]$MaxCount = 1,
    [ValidateNotNullOrEmpty()]
    [string]$InstanceType = "t2.micro"
    )


$AwsCred = Get-AutomationPSCredential -Name "AwsCred"
$AwsAccessKeyId = $AwsCred.UserName
$AwsSecretKey = $AwsCred.GetNetworkCredential().Password


Set-AWSCredentials -AccessKey $AwsAccessKeyId -SecretKey $AwsSecretKey -StoreAs AWSProfile
Set-DefaultAWSRegion -Region $AWSRegion


$ami = Get-EC2ImageByName $EC2ImageName -ProfileName AWSProfile -ErrorAction Stop


Write-host "Creating new AWS Instance..."
$NewVM = New-EC2Instance `
    -ImageId $ami.ImageId `
    -MinCount $MinCount `
    -MaxCount $MaxCount `
    -InstanceType $InstanceType `
    -ProfileName AWSProfile `
    -ErrorAction Stop
 $InstanceID = $NewVM.Instances.InstanceID
 $NewVM


Write-host "Applying new VM Name...."
New-EC2Tag -Resource $InstanceID -Tag @( @{ Key = "Name" ; Value = $VMname}) -ProfileName
AWSProfile
Write-host ("Successfully created AWS VM: " + $VMname)

Because this is a public cloud, we don’t have to worry about capacity issues, but we do have to worry about cost! That is why in the SharePoint workflow we have approval steps, or in the control scripts we probe the ticket in ServiceNow to see that it has been approved.

Containers

Although deploying virtual machines in an automated fashion definitely leads to greater efficiency for the datacenter, another transformation could take place to push Fourth Coffee to the next level.

In the next set of examples, we slightly move away from PowerShell to take a look at infrastructure as code with Dockerfiles. A Dockerfile describes the environment you want to deploy, including adding files to the container and executing or installing anything required to run the application. Here’s an example:

Click here to view code image

FROM microsoft/windowsservercore
ADD ApacheInstall.ps1 /windows/temp/ApacheInstall.ps1
ADD VCRedistInstall.ps1 /windows/temp/VCRedistInstall.ps1
RUN powershell.exe -executionpolicy bypass c:windows empApacheInstall.ps1
RUN powershell.exe -executionpolicy bypass c:windows empVCRedistInstall.ps1
WORKDIR /Apache24/bin
CMD /Apache24/bin/httpd.exe -w

In our example, we use the windowsservercore base image for our container, copy two scripts for deploying Apache webserver and Visual C redistributable, run these scripts to install the software, and then start Apache.

The ApacheInstall.ps1 file would look as follows:

Click here to view code image

Invoke-WebRequest -Method Get `
-Uri http://www.apachelounge.com/download/VC14/binaries/httpd-2.4.25-win64-VC14.zip
-OutFile c:apache.zip


Expand-Archive -Path c:apache.zip -DestinationPath c:
Remove-Item c:apache.zip -Force

As you can see, we’re downloading the file from the public Apache source and extracting it.

Every time we deploy this container, it’s provisioned in this exact manner—pulling our base image, downloading the components required, installing them, and then launching the Apache web server.

If we scale out the container instances, the exact same procedure would occur. Of course, we could commit our changes to the container and have our custom “base” image to launch each and every time.

Then why use Dockerfiles? Why not just build our own application into a custom image and deploy the custom image each time? Well, this is exactly like the process of a virtual machine deployment for an application. Someone has to deploy the app and commit the image each time. With the Dockerfile, we can write out the steps to deploy the image (or add a PowerShell script!) and allow it to deploy it.

Think of it in terms of DevOps. More importantly, what if Fourth Coffee chooses to implement a CI/CD pipeline?

The development team needs an environment where they can deploy and test their application. If we are close to capacity on the virtualization platforms they have implemented, requesting additional resources to try something new will be a difficult ask. Given that a container footprint is considerably less, we could use that technology to give them an environment easily. What’s more, if they use a cloud-based container service like Azure Container Service and then deploy to Docker on premises, it won’t matter because they will describe their environment through Dockerfiles or Docker Compose files.

Following is a sample Docker Compose file that references a folder where the web Dockerfile exists and the db Dockerfile exists, comprising the “application”:

version: '2.1'
services:
 web:
  build: ./web
  ports:
   - "80:80"
  depends_on:
   - db
  tty:
    true
 db:
  build: ./db
  expose:
   - "1433"
  tty:
    true
networks:
 default:
  external:
   name: "nat"

The development team and the operations team work on building a small container host environment and begin the process of describing the applications and operating systems that will run their software in a Dockerfile to tie all parts of an application (that is, the database and the front end) together. They will describe them in a Docker Compose file that will reference the Dockerfiles.

These Docker Compose files can be “played” against any Docker container deployment and will build out the service. The development team can verify its functionality, while operations can determine how to monitor it. Best of all, once all the verification is done, the same process applies to moving between the development, test, and production environments.

When the development team releases a new update based on feedback and monitoring data, the Docker Compose file gets updated to point to the new application, and a redeploy happens.

In a DevOps pipeline scenario, the development team would integrate the creation of the Docker Compose files and deployment into the entire process so that when they commit code, it gets validated under automated tests (which may involve deploying to a container). Then it’s deployed into the test environments and, if it passes another set of tests, finally moves into the production environment. All this happens without IT operations being directly involved. The operations team would have been involved from the start of planning and working out this process, however.

Remember also that this process can be done across cloud environments. For example, the dev and test environments might be on premises, and the production environment might be in the cloud. The number of scripts we need to support multiple environments for deploying a virtual machine is considerably less than the number we need for containers.

For CI/CD, Figure 6-10 shows a flow of how we would build a pipeline with Visual Studio team services.

The code is written and committed to a source control repository. The automation build and test begin to ensure code functionality. Once it is ready and has passed the tests, it moves on to release management, which pushes the image to the container registry and then can invoke a deployment process with the latest software.

This helps bring a modern IT environment closer to Fourth Coffee. When they choose to implement a mobile ordering system, the container element will allow for great efficiency and agility for all teams.

Over the course of this chapter, we have talked about the areas Fourth Coffee will need to invest in to deliver on datacenter efficiency. There are millions of examples available on the internet for almost any scenario you can think of. A lot of the technical samples work today; however, like all things in IT, they need to be updated over time as the technology changes. If Fourth Coffee applies the life cycle principals we’ve discussed, then updates will happen naturally to enable the company to eat the elephant and deliver on the promises of a modern IT infrastructure.