VMM Error SQL Service account no permission to AD

by

A couple of weeks ago i came across a weird issue what a VMM environment that was running fine.. until then.
When users started the VMM console and logged in, they got a the following error message:

“The SQL Server service account does not have permission to access Active Directory Domain Services (AD DS). Ensure that the SQL Server service is running under a domain account or a computer account that has permission to access AD DS”

The VMM Service was running fine it seemed, users just couldn’t log on. In this case it was a VMM HA Setup, even when failing over the role it still started and was running fine.

When Looking at the VMM error logs in C:\ProgramData\VMMLogs i got a more detailed error message:

Read more

Azure Stack Secret/Certificate Rotation

by

Whoh…! It has been a very long time since I wrote a blog on my site, last blogs were from Ignite, and the 2018 edition is about to start. So time to end the blog silence 🙂

Azure Stack Certificates

Certificates all have there lifetimes fortunately otherwise it will miss it’s goal entirely, so it’s inevitable that we have to rotate some certificates on Azure Stack. I had to rotate the public certificates recently. A public certificate on a multi node Azure Stack POC environment that is of the type Multi SAN Wildcard certificate.  Best practice is to have a separate Wildcard certificate for the different roles of Azure Stack but since this is a POC al names are in one certificate. A lot about the Certificate requirements is describe here.

In this blog I am not explaining how to create the CSR or request the certificate, this is just about testing and rotating the public certificate. More details about generating a CSR can be found here

Prepare Certificate folder

Azure Stack expects a certain folder structure for all certificates and some properties on the .PFX file. The test tool will check for this. There is a powershell file on GitHub called CertDirectoryMaker.ps1 that you could use to create the folder structure. Then add your certificates to the right folder. In this case it was simple 1 certificate in all the folders.

Read more

Ignite 2017 @ Orlando Day 4

by

Day 4:

Azure High Performance Networking

This was a very interesting session with lots of good info. It started of wit VNet integration of Azure Container Service and the ability to give an IP to a single container instead of sharing the IP with several containers.

VNet Service endpoints is also new which gives you the ability to deny internet access to VM’s but allow specific Azure services as Endpoint. So your VM’s can talk to Azure Services or Paas Services without you trying to figure out behind what IPs the endpoints are located and talking to the rest of the internet.

Then NSG’s got a bit less dumber then they were. The applied service tags to NSG’s. So what it means is that you can for example set a tag SQL Servers, or IIS Servers and make all IIS or SQL Servers being tagged by the policy. So you setup one rule with a tag SQL and all your SQL servers wil be bound to that NSG rule instead of creating several rules based on source IP’s of that SQL server.

Read more

Ignite 2017 @ Orlando Day 3

by

The third day at Ignite was kind a hard to start up, it were long day’s and fun long nights but 2 double espresso kind a pushed me out of my morning dip. Ready to start the day!

Azure High Performance Networking:

This sessions was initially not about new stuff. It’s was more to make things more clear about Azure networking. Near the end there was a lot of new stuff about ExpressRoute though!

Public and Microsoft Peering

Earlier I hear some noise from several people that the Office 365 peering, or Public Peering was to be canceled. But now we know that it’s not cancelled but that the 2 peerings have merged. That makes things simpler, but also more complex, because one of the most issue’s I hear customers talking about is that they don’t want to peer with all Azure or Office 365 services and now there is no choice in those either. It’s either none ore all in! But Microsoft must have heard this complaint because the came up with a new feature for ExpressRoute called Route Filters. With the filters you can choose what routes you want advertise to use only the service you want over the ExpressRoute connection. Nicely done! 🙂

Finally monitoring on ExpressRoute!

Read more

Ignite 2017 @ Orlando Day 2

by

The second day of Ignite i started of with a session on:

Azure Stack servicing and updating.

Updates for Azure stack consist of 2 packages or actually 3, but the third is different and not really clear how that is taking place because it will be the OEM vendor package and all vendors can take care of that in their own way. So the first package is for the OS updates for all the VM’s and hosts in the Azure Stack. The second package is about updating the resource providers in Azure stack. The Azure stack can be updated in a disconnected scenario as long as the bits are downloaded and uploaded in the blob storage through the Admin Portal.

Both are pretty big and not yet cumulative. Meaning that you have to run all the updates to get to the latest and you can’t skip an update or something. Updates will be every month and you should not supposed to fall behind more ten 3 months otherwise you will loss support and have to be current first.

Since the entire stack is locked you cannot login with RDP and go to Windows Update and click install updates. To take care of that Azure Stack has an Update Resource Provider. The resource provider gives an wizard in a set of blades to provide a destination to the update packages and install the update or schedule it.

Read more

Ignite 2017 @ Orlando Day 1

by

Today was the first day of Ignite 2017 which was about to kick off with a key note from Satya Nadella. Unfortunately it was a lot of the same slides and info as from Inspire 2017, so it was a bit of a waste of time, and since we had a lot of drinks at some very nice places in Orlando and a sprinkler fight with some InSpark colleague’s the night before it would have been nice to get a couple of more hours of sleep 😉 .

Empower IT and Developer Productivity with Azure
After the keynote i started with the session from Scott Gutherie. It was packed with info but a couple of things besides the session from Corey with Massive VM sizes with 128 Cores and multiple Terrabytes of memory were interesting to me:

  • Update management:
    Update Management is in preview now, and as i noticed in my own subscription not available for all machines, don’t no the prereqs for that yet. But you can enable Update management to scan vm’s for updates it needs on Windows and Llinux. You can also include Onprem Machines. It’s then displayed in a nice dashboard
  • Change Tracking
    With Azure Change Tracking in the OMS suite you can track changes in a VM through Log Analytics on a big nummer of resource. For example on File level, Registry, process and service level. Here to a slick displayed dashboard to get a good overview of what happend.

After a horrible lunch experience the real sessions would start. Here is a quick overview with some valuable take away for myself within my focus

Virtual Machine Diagnostics on Microsoft Azure
This was a short 20 minute session in the OCCC South hall Expo Theather #10. A new powershell script is release to get the health from a VM and output it to a json formated overview. With Get-AzureRMVmHealth.ps1 you can get a quick overview of several details like is my nic up, whats the ip, what port is used for RDP, is the admin account disabled, whats the username, are all vital services for remote access running and lots more! Give it a try with the following command

Read more