OWSUG.ca

Over the past few months we have made a big deal about the storage features of Windows Server 2012, including how the built-in iSCSI Software Target allows you to build a low-cost software-SAN (storage area network) for small environments, and how that lets you create a Hyper-V Failover Cluster without the expense of an actual SAN appliance.  We have also made a huge deal about building a Private Cloud with System Center 2012.  What we did not mention is how to add your Software SAN as a Storage Device in System Center Virtual Machine Manager (VMM), a crucial component to putting it all together.

System Center VMM allows for three types of storage appliances:

• Windows-based file server (as managed storage device)
• Storage device that is managed by an SMI-S (Storage Management Initiative – Specification) provider
• Storage Device that is managed by an SMP provider

It is the second of these that we are going to focus on.  In order to complete this setup you will need the following:

• Download Windows Server 2012
  
• Download System Center 2012

You can download the evaluation software by clicking on the links above.

Step 1: Configure an iSCSI Software Target

• Create an iSCSI Software Target in Windows Server 2012.

Step 2: Install System Center VMM

• This should be done on a separate server, although both can be virtualized on the same host.  Ensure that you have network connectivity properly configured.  System Center VMM needs to be a member of an Active Directory Domain; although your iSCSI Target does not have to be, it makes security easier to manage.
  
  Note: I only now realized that we do not have a step-by-step article for installing the various System Center 2012 components which will be corrected over the next several weeks.

Step 3: Prepare your iSCSI Target

1. In order to configure your Target as an SMI-S Provider it is important that you add a couple of extra Role Services and Features in Windows Server 2012. 
• Follow the provided video of how to do this within Server Manager access
  
• Or via PowerShell enter the following command:
  
  Add-WindowsFeature WindowsStorageManagementService
  
2. Once completed, patch your OS with the latest updates followed by the installation of KB 2758246.
3. Next you have to install the Microsoft SMI-S Provider on your Target server.  It is located on the media for System Center VMM 2012 at x:\amd64\Setup\msi\iSCSITargetProv.  Alternately it is stored on your VMM server at \Program Files\Microsoft System Center 2012\Virtual Machine Manager\setup\msi\iSCSITargetProv.  It is a quick install that does not look like it is doing very much.
4. As a best practice, reboot the Target server once this is done.  Alternately you can simply restart the Microsoft iSCSI Target Service.

Step 4: Register the SMI-S Provider

1. Back in the Target server, and back in PowerShell!  We have to register the iSCSI target as an SMI-S Provider, and provide a ConnectionURI. Via PowerShell enter the following command:
   
   Register-SmisProvider
   
2. When prompted I supply credentials for an account with Local Administrator rights on the Target server.

Step 5: Add Storage in VMM

At this point you are ready to add the iSCSI Target as a Storage Device in System Center VMM. 

1. In the Fabric context click Add Storage under Add Resources. 
2. In the Select Provider Type screen select Add a storage device that is managed by an SMI-S provider.
3. In the Specify Discovery Scope screen:
1. select SMI-S WMI from the Protocol drop-down;
2. Type the FQDN of your Target server in the box Provider IP address or FQDN;
3. Ensure that TCP/IP port is 5989;
4. Select (or create) a Run As account with privileges on the Target server.  (remember that your Target server does not need to be a Domain Member; this part is easier and cleaner if it is).
5. Click Next.
4. On the Gather Information screen select your Target server and click Next.
5. On the Select Storage Devices screen select the drive (or drives) that you will convert to shared storage.
1. Select the check box next to the device;
2. In the Classification drop-down select the classification you will add this storage under. (If no classifications exist then click on the Create Classification… button.
3. Click Next
   
6. On the Summary screen click Finish.  As with most screens in System Center 2012 you could also click the View Script button if you plan to make this a repeatable task.
7. When your job (Sets Storage Array) is listed as completed then you are done!

Conclusion

Microsoft is making it easier for you to build out its tools in a sustainable lab environment, as well as in smaller IT environments.  However these tools are a poor substitute for the real thing; if your business needs the efficiency and stability of a proper SAN for your production environment then there are many storage providers who make great products.  For smaller environments, as well as for labs and classrooms, the software solutions are a great tool to learn, build, and practice. 

Many of you know that used to do a lot of VMware training… primarily for a company called VMTraining.  So I was thrilled when they reached out to me recently and asked if I was willing to do a webinar on Hyper-V for their customers… and for anyone else who was interested.  While it is not in response to it, the webinar does follow a similar one done recently by one of their senior instructors that put forth that vSphere is the best hypervisor.  I have said many times over the past year that Hyper-V can go head to head with any competitive product, and I am happy to step up to that challenge.

Join me this afternoon at 1:00pm CST (2pm Eastern, 11am Pacific) for a one hour session on why Microsoft’s Hyper-V is truly the best hypervisor on the market today!  Register here and listen in… if you weren’t sure before then you will be after the hour!

http://www.vmtraining.net/technical-webinars/us-051713

…And to be ready to play with it, Download and install Windows Server 2012 in your lab. You can download the full Windows Server 2012 with Hyper-V, or you can download and install the free Hyper-V Server 2012.

While delivering an CANITPRO Camp not to long ago, an IT administrator shared his story as to why he had decided to move his organization's SQL backup to the cloud.  It seemed that his predecessor was very diligent in switching the backup tapes every morning.  He insured backups were created daily, weekly and monthly as well and locked the tapes in a fire proof safe at his home nightly.  One day the organization he worked for has a massive fire and the server room suffered massive damage.  When the servers were replaced, the IT administrator confidently inserted the backup tape only to find that the tape was empty.  The same was true of the weekly and monthly tapes as well.  All the tapes, 2 years worth of backups, stored in the home safe were blank.  It was later realized that the safe used a magnetic lock which wiped or corrupted all the tapes contents every time the safe was locked.

Scenarios such as these occur more often than most realize.  A great way to eliminate the need for tapes is by utilizing the cloud in a backup scenario.  This Step-By-Step, provided by Keith Myer, will take us through instructions on SQL Server 2012 SP1 CU2 native backup capabilities to allow for database backups to be created on Windows Azure.  This solution will allow you to eliminate the requirement for tape backup utilizing a secure online backup solution which can provide instant visibility to your database backups.

SQL Server 2012 Service Pack 1 Cumulative Update 2 provides the ability to backup SQL databases and logs to Windows Azure cloud storage via native SQL Server Backup.  This backup is conducted by both SQL Server Management Objects ( SMO) and Transact-SQL ( T-SQL). Cloud storage backup is a great disaster recovery insurance policy since backups, when completed, are instantly located offsite. What more is that the pay scale of cloud storage economics provides a cost effective solution since Windows Azure storage costs are less than $100/TB per month.  Geo-redundant storage based on current published costs as of this article’s date which costs less than a couple SDLT tapes. Microsoft also provides a current pricing model for Windows Azure Storage via a Price Calculator to ensure the economics meet your organizations needs.

Prerequisites

1. Sign-up for a 90-day trial of Windows Azure so that  the steps included can be completed.
    
   NOTE: When signing up for the process, credit card information will be requested to confirm that you are a legitimate free trial subscriber.  Credit card information is only used to confirm identity and will NOT be charged for any Windows Azure services unless the trial subscription is explicitly convert into a paid subscription at a later date. 
    
   Should you currently have a paid subscription or MSDN subscription for Windows Azure, please ensure that you have activated the Windows Azure Virtual Machines and Virtual Networks Preview Feature.  When signing up for a new free trial account, this feature will automatically be activated.
   
2. Download Cumulative Update 2 for SQL Server 2012 Service Pack 1 and apply it to the SQL Server instance. 

Step 1: Provisioning Cloud Storage

1. Launch the Windows Azure Management Portal and login with the credentials used when activating your Windows Azure 90-Day trial above. 
    
2. Click Storage in the left navigation pane of the Windows Azure Management Portal.
    
   
   Windows Azure Management Portal – Storage Accounts
    
3. On the Storage page of the Windows Azure Management Portal, click +NEW on the bottom toolbar to create a new storage account location.
    
   
   Creating a new Windows Azure Storage Account location
    
4. Click Quick Create on the New > Storage popup menu and complete the fields as listed below:
    
   - URL: XXXbackup01 ( where XXX represents your initials in lowercase )
    
   - Region / Affinity Group: Select an available Windows Azure datacenter region for your new Storage Account. 
    
   NOTE: Because you will be using this Storage Account location for backup / disaster recovery scenarios, be sure to select a Datacenter Region that is not near to you for additional protection against disasters that may affect your entire local area.
    
   Click the Create Storage Account button to create your new Storage Account location.
    
5. Wait for your new Storage Account to be provisioned. 
    
   
   Provisioning new Windows Azure Storage Account
    
   Once the status of your new Storage Account shows as Online, you may continue with the next step.
    
6. Select your newly created Storage Account and click the Manage Keys button on the bottom toolbar to display the Manage Access Keys dialog box.
    
   
   Manage Access Keys dialog box
    
   Click the button located next to the Secondary Access Key field to copy this access key to your clipboard for later use.
    
7. Create a container within your Windows Azure Storage Account to store backups.  Click on the name of your Storage Account on the Storage page in the Windows Azure Management Portal to drill into the details of this account, then select the Containers tab located at the top of the page.
    
   
   Containers tab within a Windows Azure Storage Account
    
   On the bottom toolbar, click the Add Container button to create a new container named “backups”.

Step 2: Performing the SQL Cloud Backup

1.  Launch SQL Server Management Studio and connect to your SQL Server 2012 SP1 CU2 database engine instance.

2. In SQL Server Management Studio, right-click on the database you wish to backup in the Object Explorer list pane and select New Query.
    
   
   SQL Server Management Studio
    

3. In the new SQL Query Window, execute the following Transact-SQL code to create a credential that can be used to authenticate to your Windows Azure Storage Account with secure read/write access:

   CREATE CREDENTIAL myAzureCredential
   WITH IDENTITY='XXXbackup01',
   SECRET=’PASTE IN YOUR COPIED ACCESS KEY HERE';

   Prior to running this code, be sure to replace XXXbackup01 with the name of your Windows Azure Storage Account created above and paste in the Access Key you previously copied to your clipboard.

4. In the SQL Query Window, execute the following Transact-SQL code to perform the database backup to your Windows Azure Storage Account:
    
   BACKUP DATABASE database_name TO
   URL='https://XXXbackup01.blob.core.windows.net/backups/database_name.bak'
   WITH CREDENTIAL='myAzureCredential' , STATS = 5;
    
   Prior to running this code, be sure to replace XXXbackup01 with the name of your Windows Azure Storage Account and replace database_name with the name of your database.
    
   Upon successful execution of the backup, you should see SQL Query result messages similar to the following:
    
   
   Successful Backup Results

Once completed, backups are transported offsite to Windows Azure Storage via an authenticated SSL-encrypted network communications path.  The actual backup data stored on the Windows Azure Storage platform can also be encrypted if Transparent Data Encryption (TDE) is enabled on your original SQL databases.  Details on enabling Transparent Data Encryption in the TechNet Library.

Restoring the SQL Database is a easy as it was to back up.  Simply use the following Transact-SQL syntax to restore the SQL Database back from Windows Azure:

RESTORE DATABASE database_name FROM
URL='https://XXXbackup01.blob.core.windows.net/backups/database_name.bak'
WITH CREDENTIAL=’myAzureCredential’, STATS = 5, REPLACE

BranchCache enables remote offices to have centralized access to file-shares over the wide area network at faster speeds and using less bandwidth. Included in Windows Server 2012 and in some editions of Windows 8, BranchCache is part of a collection of solutions known as “wide area files services” or WAFS solutions.  These type of solutions can be expensive but are included in the box with Windows Server.  Content is stored either on servers that are configured to host the cache or on client computers that are running Windows 8 or Windows 7 when no server is available in the branch office. After a client computer in the branch office requests and receives content from the main office, content is cached at the branch office so that other computers at the same branch office can obtain the content locally rather than downloading the content from the content server over the WAN link.  This solution is also optimal for those organization who have satellite offices connected by LTE or other cellular technology who's data rates could be kept at a minimum should data only be downloaded once as opposed to per request.

BranchCache has two modes of operation as illustrated below:

• Distributed cache mode: content cache at a branch office is distributed among client computers.
• Hosted cache mode: content cache at a branch office is hosted on one or more server computers called hosted cache servers.

Distributed cache mode is designed for small branch offices that do not contain a local server for use as a hosted cache server. Distributed cache mode allows your organization to benefit from BranchCache without the requirement of additional hardware in branch offices.

Prerequisites

Download and install Windows Server 2012 in your lab to complete this exercise. Alternatively you can complete this lab in a virtual lab setup by downloading and installing Hyper-V Server 2012.

Installing BranchCache

1. Install the BranchCache feature on your lab server via the following PowerShell commands:

1. Install-WindowsFeature BrancheCache –IncludeManagementTools

2. Install-WindowsFeature FS-BranchCache –IncludeManagementTools

3. Install-WindowsFeature FS-Data-Deduplication -IncludeManagementTools

4. Restart-Computer

Or the BranchCache feature on your lab server via the Add Roles and Features Wizard found in Server Manager.

 Creating A BranchCache Enabled File Share

1. In Server Manager, navigate to File and Storage Services
   
2. Under Shares, create a new share using the New Share Wizard
   
3. When in the Configure Share Settings screen, enable both Allow caching of share and Enable BranchCache on the file share and click Next
   
4. Overview your setup and click Create

Deploying a Hosted Cache Server

1. On the computer selected to configure as a hosted cache server, run the following PowerShell command to install the BranchCache feature.
   
• Install-WindowsFeature BranchCache -IncludeManagementTools

2. Next configure the domain joined, newly appointed, hosted cache server to register a service connection point in Active Directory for automatic hosted cache server discovery by client computers via running the following PowerShell command

• Enable-BCHostedServer -RegisterSCP
3. Verify the configuration is correct on the new hosted cache server running the following PowerShell command
• Get-BCStatus

Configuring the Windows 8 client to use BranchCache

1. On the Windows 8 client, run PowerShell and type the following command, then press ENTER.

• Enable-BCHostedClient

2. Verify the configuration is correct on the new hosted cache server running the following PowerShell command

• Get-BCStatus
3. Repeat on all computers the would benefit from the BranchCache connection

You organization will now be able to capitalize on bandwidth optimization with the enablement of BranchCache.

There is a lot of new stuff in Windows Server 2012 Active Directory.

• Active Directory management enhancements
  • Active Directory Administrative Center
    • Active Directory Recycle Bin management
    • Fine-Grained Password Policy management
    • Windows PowerShell History Viewer
    • Dynamic Access Control
  • Group Policy enhancements
  • Kerberos constrained delegation changes
• Active Directory deployment enhancements
  • Remote DCPromo and built-in troubleshooting
  • ADPrep integration
  • Improved virtualization support
    • Domain controller cloning
    • Active Directory snapshots
• Active Directory-based activation
  • Active Directory Federation Services 2.1 built in

In this post we will concentrate on Dynamic Access Control (DAC). DAC allows administrators to create and manage central access and audit policies in Active Directory, which can be managed through the AD Administrative Console to help organizations reach data compliance.

**NOTE: DAC is the amalgamation of different features working together. It leverage AD, GPO, File Servers … It is one the more involved Labs we have tackled so far.

Microsoft has focused on the following areas:

• Identify the information that needs to be managed to meet business and compliance requirements
• Apply appropriate access policies to information
• Audit access to information
• Encrypt information

You can now create and managed Central Access and Audit Policies in Active Directory through the ADAC . These policies are based on conditional expressions that take into account the following so that organizations can translate business requirements to efficient policy enforcement and considerably reduce the number of security groups needed for access control:

• Who the user is
• What device they are using, and
• What data is being accessed

Dynamic Access Control integrates claims into Windows authentication (Kerberos) so that users and devices can be described not only by the security groups they belong to, but also by claims such as: "User is from the Finance department" and "User's security clearance is High"

Here is a sample usage of DAC

You king find different scenarios of DAC usage here.

What we will do in this post is setup DAC and create a rule to show the flexibility and the value you can get from this technology.

Step-by-Step: enabling and configuring DAC

DAC is a claim based security feature.

Claims are Active Directory attributes defined to be used with Central Access Policies. The claims can be set for both users and devices. Microsoft added a new container to the Active Directory Administrative Center to implement this new feature.

To configure centralized file-access policies through Dynamic Access Control, we need to configure the following parts.

1. Claim Type
2. Resource properties for files
3. Resource property lists ( add resource property to global)
4. Create new central access rule
5. Create central access policy

First, we logged on our domain controller ITCamp-DC1 and created some accounts for this lab.

1. Create the following users with the attributes indicated:

It's now time to enable Dynamic Access Control for ITCamp.Local

1. Open the Group Policy Management Console, click ITCamp.Local, and then double-click Domain Controllers.
2. Right-click Default Domain Controllers Policy, and select Edit.
3. In the Group Policy Management Editor window, double-click Computer Configuration, double-click Policies, double-click Administrative Templates, double-click System, and then double-click KDC.
4. Double-click KDC support for claims, compound authentication, and Kerberos armoring and select the option next to Enabled. You need to enable this setting to use Central Access Policies.
5. Open an elevated command prompt, and run the following command:

Configure Claim Type

In this step we will configure Claim type for Users. We will add existing Active Directory attributes to the list of attributes that we can use when evaluating dynamic access control. In our case, the user's department and his country

1- After login to the DC , you can just open the Active Directory Administrative Center to start configuring the Dynamic Access Policy (DAP).

2- In the Claim Type Section, click "New" and "Claim Type" in the task pane,

3- Select the attribute you want to use, in our case "c" and in the suggested value section define the countries you want to define. In our Lab we will look for Canada and United States.

4- Repeat for the department attribute with the following suggested value. (HR, Finance, Operations)

Configure Resource properties for files

1- In this step, we will configure the properties which will be downloaded by file servers and used to classify files or directories or shares. The DAC rules will compare user attribute values with resource properties. You can enable existing properties or create new ones.

2- Click on resource property and here you can select the existing resource properties or also you can create the new ones, I have selected Country and Department.

Resource property lists (add resource property to global)

1- Each resource property must be added to at least one resource property list. It will then be downloaded by file servers in your environment. The global resource property list is downloaded by all file servers.

Our properties are already part of the global list.

Create new central access rule

This is when we create a Rule that uses the properties we have defined earlier. This describes which conditions must be met in order for file access to be granted.

1- In the Central Access Rule section, click "New" and "Central Access Rule"

2- Give it a name in the Create Central Access Rule form.

3- In the Permission section, click "Use Following Permissions" and click "Edit"

4- Click "Add" and in the following "permission Entry for Permissions" select The "Authenticated User" as the principal and set the following conditions.

5- Click "OK" you are back to the DAC configuration screen.

Create central access policy

This part is very straight forward.

1- In the Central Access Policy, click "New" and "Central Access Policy" and give the new policy a name in the "Create Central Access Policy" form. We named our CAP. You also need to Add the Central Access Rule you created earlier to the policy.

2- Once that is created we need to tell AD about the policy. In the "Group Policy Management Console" we edited the "Default domain policy" but you can apply a different policy as you see fit. And in the Computer ManagementàPoliciesàWindows SettingsàSecurity settingsàFile SystemàCentral Access Policy, right-click the right pane and select manage Central Access Policy.

3- Add the Policy you created to the Applicable Central Access Policies.

We are done configuring the DAC… well… not quite. We still need to configure our shares and share properties.

To configure the shares the File Server Resource Manager must be installed on the server that will be used as the files server. In our case the file server we are using is VMHost10B.itcamp.local.

1. Logon VMHost10B.itcamp.local as itcamp\administrator
2. In Server Manager, click Add Roles and Features.
3. On the Before you begin page, click Next.
4. On the Select installation type page, click Next.
5. On the Select destination server page, click Next.
6. On the Select Server Roles page, expand File and Storage Services, select the check-box next to File and iSCSI Services, expand, and select File Server Resource Manager.
7. In the Add Roles and Features Wizard, click Add Features, and then click Next.
8. On the Select features page, click Next.
9. On the Confirm installation selections page, click Install.
10. On the Installation progress page, click Close

On the VMHost10B machine we created 2 SMB Shares-Advanced shares. (HR, Finance) select all defaults to complete this part.

Once the shares have been created, we need to go the location where the directory has been created and modify the properties of each folders.

To include the classification of these folders.

And in the advanced Security Settings, in the Central Policy Tab, change the "No central Access Policy" to "CAP" the policy we defined.

You can test to see if everything worked well by using the effective Access tab.

That is that start of the value that DAC can bring. But we just skimmed the surface.

So try it for yourself. It's well worth the effort.

You can deploy this in you lab and take advantage of the flexibility this technology can provide. Try it for yourself by downloading Windows Server 2012?

Cheers!

Pierre Roman, MCITP, ITIL | Technology Evangelist
Twitter | Facebook | LinkedIn

Additional Resources

TechNet manual : http://technet.microsoft.com/en-us/library/hh831717.aspx

Hands on lab: http://technet.microsoft.com/en-us/windowsserver/hh968267.aspx (Using Dynamic Access Control to automatically and centrally secure data)

Dynamic Access Control at MMS 2012: http://channel9.msdn.com/posts/Dynamic-Access-Control-Demo-and-Interview

Anyone who has attended one of our #CANITPRO Camps provided across Canada has been appreciative of the fact that actual hardware is provided to run all labs.  Attendees are also appreciative of the amount of hours that Pierre, Mitch, and I put forth in setting up said hardware in every city.  This practice however, is slowly coming to an end and we are currently exploring options to utilize "the cloud" to enable attendees to conduct camps on their own hardware.  As you know, Microsoft has been showcasing Azure's new features as of late and has really "turned up the dial" in pushing organizations to utilize cloud services.  Some IT Administrators have pushed back as their lack of knowledge around the subject has some holding on tight to their on premise servers.

Taking our first steps together into the cloud via this "Step-By-Step" created by DPE colleague Keith Mayer will provide insight and confidence should any IT Professional be interested in deploying Azure within their organization.

Prerequisites

1. Sign-up for a FREE 90-day trial of Windows Azure so that  the steps included can be completed.
    
   NOTE: When signing up for the process, credit card information will be requested to confirm that you are a legitimate free trial subscriber.  Credit card information is only used to confirm identity and will NOT be charged for any Windows Azure services unless the trial subscription is explicitly convert into a paid subscription at a later date. 
    
   Should you currently have a paid subscription or MSDN subscription for Windows Azure, please ensure that you have activated the Windows Azure Virtual Machines and Virtual Networks Preview Feature.  When signing up for a new free trial account, this feature will automatically be activated.
    
2. Login to the Windows Azure Management Portal.
    
   Login to the web-based Windows Azure Management Portal with the same logon credentials you used to sign-up for the FREE 90-day Trial above.  Once you’ve logged in, you should see the main Windows Azure Management portal dashboard.
    
    
    
   On the Windows Azure Management Portal, you’ll find the options for managing Virtual Machines, Virtual Networks and Storage in the cloud.  These are the items we’ll be primarily working with in this article series.
    
3. Define a new Windows Azure Affinity Group.
    
   Affinity Groups in Windows Azure are used to group your cloud-based services together, such as Virtual Machines, Virtual Networks and Storage, in order to achieve optimal performance.  When you use an affinity group, Windows Azure will keep all services that belong to your affinity group running within the same data center as close as possible to each other to reduce latency and increase performance. 
1. Create a new Affinity Group by selecting Settings from the side navigation bar in the Windows Azure Management Portal.  
   
2. On the Settings page, select Affinity Groups from the navigation bar.  
   
3. Click the +CREATE button on the bottom navigation bar.
    
    
   
   On the Create Affinity Group form, enter the following details: 
     
4. Name: Enter a unique name for your new Affinity Group, such as XXXlab01 (where XXX is replaced with your initials) 
   
5. Region: Select the closest Windows Azure data center region to your locale.  This is the data center region in which your services will be provisioned. Be sure to select one of the Windows Azure data center regions in which the Virtual Machines preview offer is currently enabled:
    
     - East US
     - West US
     - West Europe
     - North Europe
     - Southeast Asia
     - East Asia
    
4. Create a new Windows Azure Storage Account.
    
   Virtual Machines that are provisioned in Windows Azure are stored in the world-wide cloud-based Windows Azure Storage service.  In terms of high availability, the Storage service provides built-in storage replication capability – where every VM is replicated to three separate locations within the Windows Azure data center region you select.  In addition, Windows Azure Storage provides a geo-replication feature for also replicating your VMs to a remote data center region.
    
   Create a new Storage account by clicking the +NEW button on the bottom toolbar in the Windows Azure Management Portal and then select Data Services | Storage | Quick Create.  
    
    
    
   Complete the following fields for creating your Storage account: 
1. URL: Enter a unique name for your new storage account, such as XXXlabstor01 (where XXX is replaced with your initials) 
2. Region/Affinity Group: Select the Affinity Group you created in Step 3 above.
3. Enable Geo-Replication: By default, this option is selected.  Leave the default option in place.
4. Click the CREATE STORAGE ACCOUNT button to create your new Windows Azure Storage account.
   
    
5. Download, Install and Configure the Windows Azure PowerShell Management Tools
    
   In addition to managing Windows Azure via the web-based Management Portal, Microsoft also provides a Windows Azure PowerShell module for scripted management of Windows Azure services.  Both the Management Portal and PowerShell will be used in this series, requiring installation and configuration off the Windows Azure PowerShell cmdlets to get prepared. 
    
1. Download and Install the Windows Azure PowerShell cmdlets. Note that a restart may be required after installing this module.
2. Right-click on Windows PowerShell in your Start Menu or Start Screen and choose Run As Administrator.
3. Set the PowerShell Execution Policy for scripts by running the following command at the PowerShell command prompt:
    
        PS C:\> Set-ExecutionPolicy RemoteSigned
    
4. Import the Windows Azure PowerShell module and supporting cmdlets by running the following command at the PowerShell command prompt:
    
        PS C:\> Import-Module Azure
    
5. Download and save your Windows Azure Publish Settings file by running the following command at the PowerShell command prompt:
    
        PS C:\> Get-AzurePublishSettingsFile
    
6. Import the saved Windows Azure Publish Settings file by running the following command at the PowerShell command prompt:
    
        PS C:\> Import-AzurePublishSettingsFile 
               "full_path_to_saved_file.publishsettings"
   

Step 1: Register a DNS Server in Windows Azure

Register the internal IP address that our domain controller VM will be using for Active Directory-integrated Dynamic DNS services by performing the following steps:

1. Sign in at the Windows Azure Management Portal with the logon credentials assigned when signing up for your Free 90-Day Windows Azure Trial.
    
2. Select Networks located on the side navigation panel on the Windows Azure Management Portal page.
    
3. Click the +NEW button located on the bottom navigation bar and select Networks | Virtual Network | Register DNS Server.
    
4. Complete the DNS Server fields as follows:
    
   - NAME: XXXlabdns01
    
   - DNS Server IP Address: 10.0.0.4
    
5. Click the REGISTER DNS SERVER button.
   

Step 2: Define a Virtual Network in Windows Azure

Define a common virtual network in Windows Azure for running Active Directory, Database and SharePoint virtual machines by performing the following steps:

1. Sign in at the Windows Azure Management Portal with the logon credentials assigned when signing up for your Free 90-Day Windows Azure Trial.
    
2. Select Networks located on the side navigation panel on the Windows Azure Management Portal page.
    
3. Click the +NEW button located on the bottom navigation bar and select Networks | Virtual Network | Quick Create.
    
4. Complete the Virtual Network fields as follows:
    
   - NAME: XXXlabnet01
    
   - Address Space: 10.---.---.---
    
   - Maximum VM Count: 4096 [CIDR: /20]
    
   - Affinity Group: Select the Affinity Group defined in the Prerequisites section above.
    
   - Connect to Existing DNS: Select XXXlabdns01 – the DNS Server registered in Exercise 1 above.
    
5. Click the CREATE A VIRTUAL NETWORK button.
   

Step 3: Deploy a New Windows Server 2012 VM in Windows Azure

In this exercise, you will provision a new Windows Azure VM to run a Windows Server 2012 on the Windows Azure Virtual Network provisioned in Exercise 2.

1. Sign in at the Windows Azure Management Portal with the logon credentials assigned when signing up for your Free 90-Day Windows Azure Trial.
    
2. Select Virtual Machines located on the side navigation panel on the Windows Azure Management Portal page.
    
3. Click the +NEW button located on the bottom navigation bar and select Compute | Virtual Machines | From Gallery.
    
4. In the Virtual Machine Operating System Selection list, select Windows Server 2012, December 2012 and click the button.
    
5. On the Virtual Machine Configuration page, complete the fields as follows:
    
   - Virtual Machine Name: XXXlabad01
    
   - New Password and Confirm Password fields: Choose and confirm a new local Administrator password.
    
   - Size: Small (1 core, 1.75GB Memory)
    
   Click the button to continue.
    
   Note: It is suggested to use secure passwords for Administrator users and service accounts, as Windows Azure virtual machines could be accessible from the Internet knowing just their DNS.  You can also read this document on the Microsoft Security website that will help you select a secure password: http://www.microsoft.com/security/online-privacy/passwords-create.aspx.
    
6. On the Virtual Machine Mode page, complete the fields as follows:
    
   - Standalone Virtual Machine: Selected
    
   - DNS Name: XXXlabad01.cloudapp.net
    
   - Storage Account: Select the Storage Account defined in the Prerequisites section above.
    
   - Region/Affinity Group/Virtual Network: Select XXXlabnet01 – the Virtual Network defined in Exercise 2 above.
    
   - Virtual Network Subnets: Select Subnet-1 (10.0.0.0/23)
    
   Click the button to continue.
    
7. On the Virtual Machine Options page, click the button to begin provisioning the new virtual machine.
    
   As the new virtual machine is being provisioned, you will see the Status column on the Virtual Machines page of the Windows Azure Management Portal cycle through several values including Stopped, Stopped (Provisioning), and Running (Provisioning).  When provisioning for this new Virtual Machine is completed, the Status column will display a value of Running and you may continue with the next exercise in this guide.
    
8. After the new virtual machine has finished provisioning, click on the name ( XXXlabad01 ) of the new Virtual Machine displayed on the Virtual Machines page of the Windows Azure Management Portal to open the Virtual Machine Details Page for XXXlabad01.
   

Step 4: Configure a Windows Server Active Directory Forest in a Windows Azure VM

In this exercise, you will install and configure a new Windows Server 2012 Active Directory Forest on the VM deployed in Exercise 3.

1. On the Virtual Machine Details Page for XXXlabad01, make note of the Internal IP Address displayed on this page.  This IP address should be listed as 10.0.0.4. 
    
   If a different internal IP address is displayed, the virtual network and/or virtual machine configuration was not completed correctly.  In this case, click the DELETE button located on the bottom toolbar of the virtual machine details page for XXXlabad01, and go back to Exercise 2 and Exercise 3 to confirm that all steps were completed correctly.
    
2. On the virtual machine details page for XXXlabad01, click the Attach button located on the bottom navigation toolbar and select Attach Empty Disk.  Complete the following fields on the Attach an empty disk to the virtual machine form:
    
   - Name: XXXlabad01-data01
    
   - Size: 10 GB
    
   - Host Cache Preference: None
    
   Click the button to create and attach the a new virtual hard disk to virtual machine XXXlabad01.
    
3. On the virtual machine details page for XXXlabad01, click the Connect button located on the bottom navigation toolbar and click the Open button to launch a Remote Desktop Connection to the console of this virtual machine.  Logon at the console of your virtual machine with the local Administrator credentials defined in Exercise 3 above.
    
   Wait for the Server Manager tool to launch before continuing with the next step.
    
4. In the Server Manager window, format the disk attached in Step 2 above by launching the Computer Management tool from the Tools menu located on the top navigation bar.
    
1. In the Computer Management window, click on Disk Management in the left navigation pane.
    
2. When prompted with the Initialize Disk dialog box, click the OK button to continue.
    
3. Right-click on the unallocated disk space on Disk 2 and select New Simple Volume… from the pop-up menu.
    
4. In the New Simple Volume Wizard, click the Next button on each page to accept all default values. 
    
5. Click the Finish button on the last page of the wizard to create a new F: volume.
    
6. When the new volume has finished the formatting process, close the Computer Management window.
    
5. In the Server Manager window, install Active Directory Domain Services by launching the Add Roles and Features wizard from the Manage menu located on the top navigation bar.
    
1. In the Add Roles and Feature Wizard dialog box, click the Next button three times to advance to the list of Roles to install.
    
2. In the list of roles, check the checkbox for the Active Directory Domain Services role.  When prompted to add additional features, click the Add Features button.
    
3. Click the Next button until you advance to the Confirm installation selections page of the wizard.  Click the Install button to begin the installation process.
    
4. When the installation of Active Directory Domain Services has completed, do not click the Close button.  Instead, click the link titled Promote this server to a domain controller.  
    
   This will launch the Active Directory Domain Services Configuration Wizard.
    
5. In the Active Directory Domain Services Configuration Wizard dialog box, select the deployment operation for Add a new forest.
    
6. In the Root domain name: field, enter contoso.com as the name of the root domain in the new Active Directory forest.  Click the Next button.
    
7. On the Domain Controller Options page of the wizard, enter and confirm a recovery password in the Directory Services Restore Mode (DSRM) password fields.  Click the Next button.
    
8. On the DNS Options page of the wizard, ignore the warning message and click the Next button to continue.
    
9. On the Additional Options page of the wizard, accept the default value for NetBIOS domain name and click the Next button.
    
10. On the Paths page of the wizard, change the Database folder, Log files folder and SYSVOL folder paths to begin with F: instead of C:. Click the Next button.
     
11. On the Review Options page, click the View Script button.  A PowerShell script snippet will be displayed in a Notepad window.  This snippet includes the cmdlets needed to Install a new Active Directory forest via PowerShell with the options selected in the wizard.  Save this snippet to your Documents folder for future reference as a file named PSSnippet-Install-ADDSForest.ps1 and close the Notepad window.
     
12. On the Review Options page, click the Next button.
     
13. On the Prerequisites Check page, ignore the warnings displayed and click the Install button.  The warnings displayed are due to the dynamic IP addressing used within Windows Azure Virtual Networks and do not apply to this cloud environment.
     
    The Active Directory Domain Services configuration process will be begin for the new AD Forest.
     
    When the Active Directory configuration process is complete, the server will automatically restart.
    

Step 5: Export / Import Lab Virtual Machines

At this point the Windows Server 2012 Active Directory Forest VM is now functional amidst the cloud-based lab.  Be aware that as long as a virtual machine is provisioned, it will continue to accumulate compute hours against your Free 90-Day Windows Azure Trial account even in a shutdown or any other of virtual machine state.

To save our compute hours for productive study time, one can leverage the Windows Azure PowerShell module to automate export and import tasks to de-provision the virtual machine when not in use and re-provision our virtual machine when it is needed again. 

This step will utilize Windows PowerShell to automate:

• De-provisioning lab virtual machines when not in use
• Re-provisioning lab virtual machines when needed again. 

Once configured, the PowerShell snippets below will spin up your cloud-based lab environment when needed.

Note: Prior to beginning this exercise, please ensure that the Windows Azure PowerShell module has been downloaded, installed and configured as outlined in the Prerequisite section of this step-by-step guide. 

1. De-provision the lab. Use the Stop-AzureVM and Export-AzureVM cmdlets in the PowerShell snippet below to shutdown and export lab VMs when they are not being used.  
    
   # Specify the Name of the VM to Export
    
   $myVM = "XXXlabad01" 
    
   # Stop the VM prior to exporting it
    
   Stop-AzureVM -ServiceName $myVM -Name $myVM 
    
   # Set the Export folder path for the VM configuration file.  Make sure this folder exists!
    
   $ExportPath = "C:\ExportVMs\ExportAzureVM-$myVM.xml" 
    
   # Export the VM to a file
    
   Export-AzureVM -ServiceName $myVM -name $myVM -Path $ExportPath  
    
   # After you've confirmed that the Export file exists, delete the VM
    
   Remove-AzureVM -ServiceName $myVM -name $myVM
    
2. Re-provision the lab. Use the Import-AzureVM and Start-AzureVM cmdlets in the PowerShell snippet below to import and start lab VMs when needed again.
    
   # Specify the Name of the VM to Import
   
   $myVM = “XXXlabad01" 
    
   # Specify the Name of the Virtual Network on which to Import the VM
    
   $myVNet = "XXXlabnet01"
   
   # Specify the Import Path of the VM’s exported configuration file.
    
   $ImportPath = "C:\ExportVMs\ExportAzureVM-$myVM.xml"    
    
   # Import the VM to Windows Azure
    
   Import-AzureVM -Path $ImportPath | New-AzureVM -ServiceName $myVM -VNetName $myVNet  
    
   # Start the VM
    
   Start-AzureVM -ServiceName $myVM -name $myVM
   

Learn more support features Windows Azure has to offer and have a chance in winning your own lab computer by participating in the free Microsoft offered Virtual Academy.  Complete two TechNet evaluations, and take the selected Microsoft Virtual Academy courses for your chance at a $5,000 grand prize or a chance to win a HP EliteBook Revolve and two chances to win 400 Microsoft Points.  

Hello folks,

A new feature of Windows Server 2012 called Storage Spaces is designed to change the storage task for enterprises by providing an in-box storage virtualization that can use low-cost commodity storage devices. We’ve covered Storage Spaces a few time already:

• Storage Pools… Dive right in!
• Windows Server 2012 IT Camp – Lab #3 - Thin vs. Fixed provisioning… That is the storage management question.

for this Step-by-Step we’ll look at Data Deduplication.  and how we enable and configure it on a Volume create on a Storage pool.  We’ll assume your storage pool is created and is in use with data on it.  for my lab I copied my families' picture library on it.  (I know that there are a lot of duplicates).

Data Deduplication in Windows Server 2012 stores more data in less physical space. It achieves greater storage efficiency than was possible in previous releases with Single Instance Storage or NTFS Compression. It can run on dozens of large volumes of primary data simultaneously without affecting other workloads on the server.

Deduplication maintains redundancy to ensure that the data is recoverable in the event of data corruption. Deduplication is only on files on a file server; it is not supported for Exchange databases and SQL databases.

Today, we will do 3 things with data deduplication.

1. Install deduplication
2. Enable and configure deduplication on an existing volume
3. Observe the results of deduplication

Install

1- From the Add Roles and Features Wizard, under Server Roles, File and Storage Services, File and iSCSI Services and select Data Deduplication 

Click Next until the Install button is active, and then click Install.

When complete click Close

Enable and configure deduplication on an existing volume

1- From the Server Manager dashboard, right-click a data volume and choose Configure Data Deduplication. The Deduplication Settings page appears.

2- Select the Enable data deduplication check box, enter the number of days that should elapse from the date of file creation until files are deduplicated, enter the extensions of any file types that should not be deduplicated, and then click Add to browse to any folders with files that should not be deduplicated.

** for the purpose of this lab we set the number of days to 0. If you set MinimumFileAgeDays to 0, deduplication will process all files, regardless of their age. This is suitable for a test environment, where you want to exercise maximum deduplication. In a production environment, however, it is preferable to wait for a number of days (the default is 5 days), because files tend to change a lot for a brief period of time before the change rate slows. This allows for the most efficient use of your server resources.

3- Click Apply to apply these settings and return to the Server Manager dashboard

4- In Server Manager, under File and Storage Services, and Servers, right-click the server and select Deduplication Schedule to continue to set up a schedule for deduplication.

That is it.  Data deduplication has been setup and configured.

Observe the results of deduplication

Let’s use PowerShell to see the results of the data Deduplication.

1) on the Server console Click Windows PowerShell.

2) Type Start-DedupJob -Type Optimization -Volume F:, and then press ENTER.

3) Type Get-Dedupjob, and then press ENTER. Run this command every few seconds until there are no active jobs.

4) Type Get-DedupStatus, and then press ENTER.

you can also look at the properties of the volume to show how much space you have saved.

Go ahead and try it for yourself.

You can deploy this in you lab and take advantage of the flexibility this technology can provide. Try it for yourself by downloading Windows Server 2012?

Cheers!

Pierre Roman, MCITP, ITIL | Technology Evangelist
Twitter | Facebook | LinkedIn

More Information

Data Deduplication Overview

http://technet.microsoft.com/en-us/library/hh831602.aspx