Author Archives: manojlovicl

S2D 2.0 (Windows server 2019) – Nested mirror and Nested mirror accelerated parity – how to expand a tier / volume?

As a big fan of S2D since Windows server 2016 and with more than 15 implementation of various systems and configurations I wanted to help you out with resizing of new (only 2 node S2D on Windows server 2019 supported) feature called Nested mirror and Nested mirror accelerated parity volumes.

First of all – just to be short – Microsoft did a great job to address the possibility of two simultaneous failures in two node S2D scenarios. You have the possibility to use two resiliency mechanisms – one that gives you more performance but it takes a lot of space called – Nested mirror (so all the data is written 4 times – 2 times on one node an 2 times on the other) which gives you ~ 25% of usable space and Nested mirror accelerated parity where you combine nested mirror with parity so you are able to achieve around 40-45% of usable space – but yes – party tier is more compute intensive as redundancy must be calculated – so it reduces performance (test so far do not show dramatic impact).

You can read more about this two options that were released with Windows server 2019 on a Microsoft website – official documentation.

I was playing a bit with configuration of some volumes by using this two new options and I decided to create a mirror accelerated parity which can be done by using Powershell (for not that is the only option).

I created tier templates as described in MS documentation (mentioned earlier). So I finished with the result that looks like:

Get-Volume -FriendlyName NestedMirrorAcceleratedParity | ftps2

Underneath you can see that there are two tiers that are fundamental parts of this volume.

Get-StorageTier | ft FriendlyName,TierClass,ResiliencySettingName,FaultDomainREdundancy,Size,FootprintOnPool
ps1

So if you want to extend your volume you must extend first of all every tier (or only one of them) – so in this case: NestedMirrorAcceleratedParity-NestedParity and/or NestedMirrorAcceleratedParity-NestedMirror.

You can do it just by using commandlet – for example for party tier:

Resize-StorageTier -FriendlyName NestedMirrorAcceleratedParity-NestedParity -Size 6TB

*System will not allow you to go over size of total pool capacity – for example my pool has 24 TB of space – my nested mirror and resiliency have a pretty nice footprint on pool so what I did was a volume that was created from 1 TB of nested mirror (for speed) and 7 TB of parity (for capacity) – S2D / ReFS will take care of dynamic hot/cold data placement.
s2dsize

As you can see the sum of FootprintOnPool in TB is under my total capacity and system does not allow me to make a bigger tiers. You can also see storage efficiency that I get from physical disks after using this two resiliency mechanisms.

tier1

After resizing one or both tiers than you can query your virtual disk for supported size that it can be extended to.

Get-VirtualDisk -FriendlyName NestedMirrorAcceleratedParity | Get-Disk | Get-Partition | Where Type -eq Basic | Get-PartitionSupportedSize

After receiving the maxsize parameter you can expand your virtual disks partition (in my case from 6 TB to 8 TB (of which 1 TB nested mirror and 7 TB nested parity):

Get-VirtualDisk -FriendlyName NestedMirrorAcceleratedParity | Get-Disk | Get-Partition | ? Type -eq Basic | Resize-Partition -Size 8796076224512

As a result you can see that disk that was resized from 6TB to 8TB in Admin center which I encourage you to try and to start using if you are jumping in Microsoft software defined storage / network journey!

admin center

Running MikroTik router on Azure

Yes, it is possible to do it – you just need to:

1. Download pre-prepared vhdx image from MikroTik downloads site,
2. Run it for the first time on your on-prem Hyper-V (accept licence agreement and just check the basic configuration (username / password, interface(s)).
3. Convert (in Hyper-V manager) disk from VHDX to VHD and from Dynamic to Fixed size VHD (you can do it in a single operation)
4. Go to Azure portal and upload your VHD file to Blob storage
5. Prepare a disk image and vm image (that you will later deploy).
6. And finally – deploy. 🙂

What can you do with MikroTik router on Azure network? A lot of things:
1. You can use other VPN solutions to get connected to Azure network
2. You can (by using EoIP) make L2 connection to Azure network (so you can run VMs without changing IP addresses (and DNS records) which might be cool for DR solution? Unfortunately you can not do that as Azure VNet gateway captures and replies to all ARP requests so everything passes via VNet gateway (x.y.z.1) so it is not possible to extend the network as far as I was able to test.
3. You can “bring” IPv6 network (from on-prem location) to Azure
4….

running mikrotik on azure

 

Get e-mail alert for failed logon attempt on Outlook Web Access (OWA)

Just for fun I tried to establish a mechanism that will allow me to get information for failed logon attempt on Outlook Web Access (OWA).

If you open event viewer on your CAS server (where OWA is located) you can find out that failed requests are logged with Event ID 4625.
003

001
In general information you can find interesting things like – username which was used and IPv4 or IPv6 address from where the attempt was made.
002
All you need to do is to Attach task to this event
004
As all other actions are deprecated you should use the option to Start a program – here we will run a Powershell script to do the job.
005
We need to create a PS1 (powershell script) with content:

$EventMessage = get-winevent -FilterHashtable @{Logname=’Security’;ID=4625} -MaxEvents 1 | fl TimeCreated, Message
$eventmessagetstring = $EventMessage | Out-String
$EventMessageAccountNameText3array = $EventMessagetstring | Select-String -Pattern “Account Name:\s+\S+” -AllMatches | Select -ExpandProperty matches | Select -ExpandProperty value
$EventMessageAccountNameText3 = $EventMessageAccountNameText3array[-1]
$EventMessageAccountNameText = $EventMessagetstring | Select-String -Pattern “Failure Reason:\s+\S+\s+\S+\s+\S+\s+\S+\s+\S+\s+\S+” -AllMatches | Select -ExpandProperty matches | Select -ExpandProperty value
$EventMessageAccountNameText2 = $EventMessagetstring | Select-String -Pattern “Source Network Address:\s+\S+” -AllMatches | Select -ExpandProperty matches | Select -ExpandProperty value

$EmailTo = “admin@domain.com”
$EmailFrom = “alert@domain.com”
$Subject = “OWA attack from $EventMessageAccountNameText2”
$Body = “Owa attack from: `n $EventMessageAccountNameText2 `n $EventMessageAccountNameText3 `n $EventMessageAccountNameText”
$SMTPServer = “IPOfYourSMTPServer”
$SMTPMessage = New-Object System.Net.Mail.MailMessage($EmailFrom,$EmailTo,$Subject,$Body)
$SMTPClient = New-Object Net.Mail.SmtpClient($SmtpServer, 25)
$SMTPClient.Send($SMTPMessage)

So in task properties we should choose:
007
In Add arguments (optional) field we should add:

-ExecutionPolicy ByPass -File X:\PathToScript\OwaAttack.ps1

So if everything is correct – next time someone fail to enter correct password or an attack on OWA is performed you will get an e-mail like this:

006

How to monitor “unmonitorable” stuff on Windows server with PRTG Network Monitor

I really love PRTG Network Monitor, simple and efficient monitoring solution I have been using for many years… It has a lot of sensors that you can use to monitor various stuff – from network devices to storage devices, to some predefined WMI sensors for disk monitoring on Windows …
But there are some things that are not that simple to monitor… For example DNS server cache entries… Or, DHCP server leases in use? There is no predefined sensor in PRTG to do that – but there is something very nice and useful – it is called: HTTP content sensor

http-content

This sensor can “read” the numeric value from HTTP page (even more than one (so you can have multiple channels = multiple lines in single graph for similar stuff))…

So… The challenge to get from this list:
show-dnsservercache
to:
graph

Let’s do it:
1. Let’s somehow get from that list (Show-DnsServerCache) to numeric value in PowerShell
2. Publish result on some web server (could be IIS on the same server)
3. Schedule PowerShell script to run (every 1 minute) to get the value
4. Collect result with PRTG HTTP Content sensor

1 (and 2). Create PS1 script (by using PowerShell ISE or maybe Visual Studio Code or just by using Notepad :)):

$dnsservercache = Show-DnsServerCache
$dnsservercache = $dnsservercache.Count
$dnsservercache = “[” + $dnsservercache + “]”
$dnsservercache = $dnsservercache.Replace(” “,””)
$dnsservercache | out-file -Encoding utf8 C:\inetpub\wwwroot\dnsservercache.txt

In that (dnsservercache.txt) TXT file you should find something like (number may be different): [13863]

In this case I am “publishing” TXT file on IIS server on the same server – you should write file somewhere else if web server is not running locally.

3. Schedule Powershell script to run every 1 minute to get value
Just create basic task in Task Scheduler, choose Start a program and fill the form:
Program/script: PowerShell.exe
Add arguments: -ExecutionPolicy Bypass C:\ps\Stats.ps1
Start in: C:\ps

When you finish creating task you should modify it to run every one minute here:

schedule

4. Collect value from website / txt file

In PRTG you can now create new sensor by choosing HTTP Content and just fill the form like this:
http content2

In a couple of minutes you should get this beautiful graph:

graph2

graf day 2

Implementing LAPS (local administrator password solution) in few simple steps…

I would like to help you setting up LAPS in your environment – just follow this simple guide how to do it and say “bye bye” to not-secure fixed local administrators passwords.

First you need to download x64 (and if you need x86) LAPS from Microsoft website:
https://www.microsoft.com/en-us/download/details.aspx?id=46899

Download LAPS.x64.msi on your Active Directory domain controller and install it – add also Management Tools that are not selected by default:
Install LAPS

After installing it open Powershell on your DC, import Powershell module for LAPS, update AD Schema for LAPS (you need to be schema admin!), define OU where computers / servers that will be under LAPS management are, define user or group that will have privilege to read and reset password for client or server:

Import-Module AdmPwd.PS
Update-AdmPwdADSchema
Set-AdmPwdComputerSelfPermission -OrgUnit Clients
Set-AdmPwdResetPasswordPermission -Identity Clients -AllowedPrincipals “demo\domain admins”
Set-AdmPwdReadPasswordPermission -Identity Clients -AllowedPrincipals “demo\domain admins”

update schem

laps delegate control

Create group policy object on clients / servers OU (in my case with name LAPS) in which you will configure settings and deploy client on machines (yes, the MSI package that was installed on DC needs to be installed on workstations and servers too – the simplest way to do it is by using software deployment in group policy.

laps settings

LAPS deployment

Laps Deployment 2

Reboot your clients or use gpupdate /force to apply group policy settings and installation of the package.

If everything was installed and applied correctly you should see the installed package in programs on client workstation or server:

client install

On your AD server you can now check password by using Powershell or by using LAPS GUI:

Get-AdmPwdPassword -ComputerName w10 -Verbose

password - powershell

laps gu

password - ui

LAPS is great, simple and adds some more security in your environment.

 

 

Enable IPSec between Windows 10 client and Windows server 2016 – simple video tutorial

Today I tried to implement IPsec for certain protocols (in my example for TCP port 80 from Windows 10 client to Windows server 2016 running IIS and ICMP just to show it is possible to enable IPSec on per-protocol basis).

In my environment I have setup a simple domain with 2 servers, 1 DC and 1 member server with IIS, 1 Windows 10 domain joined client and one Windows 10 with Wireshark just to sniff the traffic (by using Hyper-V port mirroring).

You can check a 6 minutes video tutorial here.

ipsec

So steps to enable IPSec by using Windows Firewall with Advanced Security (introduced in Windows Vista) are the following:

1. First thing you need to do is to create a security group where you put servers and clients you want to have IPSec policies enabled.

2. Then you need to create a group policy object on top of computers / servers OU (in my case I have created GPO on a domain level – in a production environment I suggest that you put it somewhere lower on top of your computers and servers OUs.
Remove authenticated users from GPO security filtering and insert your IPSec security group

3. Then you need to edit the GPO on the location: Computer configuration / Policies / Windows settings / Security settings / Windows Firewall with Advanced Security / Windows Firewall with Advanced Security / Connection Security Rules
Here you create a new rule:
– I choose Custom rule option
– I left Any IP address selected on both Endpoints (so it will work for all IP addresses)
– I configured the second option on next screen so – Require auth for inbound (so all inbound connections will require authentication – Warning! No access from workgroup or not domain joined computers) and reqeust authentication for outbound (www.google.com does not care about your IPSec policy :))
– On the next screen I used Computer (Kerberos V5) authentication method
– On protocols and ports – in my first example I used TCP 80 on Endpoint1 (so “server side” will require authentication for everyone who would like to access web server on port 80)
– I applied policy on all profiles and I gave a name to my policy.
After creation of the policy you should run: gpupdate /force on both – server and client – I did a reboot just to be sure it will do it – but most of the time gpupdate /force will be enough. You can see your policy on server and client if you open Windows Firewall with Advanced Security and you click on Connection Security Rules

I used another Windows 10 machine with Wireshark software just to monitor the functioning of IPSec – I used Hyper-V port mirroring to send copy of all traffic from my domain joined Windows 10 so you can see from captured traffic that policy was applied correctly and that traffic (opening the http://srv1 and later on pinging srv1) is encrypted.

 

Add-VMNetworkAdapterExtendedAcl – allow only specific traffic to a VM and allow all outgoing traffic from a VM on Windows server 2016 – Hyper-V

Block all trafic to a VM:
Add-VMNetworkAdapterExtendedAcl –VMName “vm01” –Action “Deny” –Direction “Inbound” –Weight 10
Allow (for example) TCP 80 (HTTP) and TCP 443 (HTTPS) to a VM:
Add-VMNetworkAdapterExtendedAcl –VMName “vm01” –Action “Allow” –Direction “Inbound” –LocalPort 80 –Protocol “TCP” –Weight 11
Add-VMNetworkAdapterExtendedAcl –VMName “vm01” –Action “Allow” –Direction “Inbound” –LocalPort 443 –Protocol “TCP” –Weight 12
 
Allow any TCP and UDP from VM to ANY port and ANY address:
Add-VMNetworkAdapterExtendedAcl -VMName “vm01” -Action Allow -Direction Outbound -RemotePort Any -Protocol tcp -Weight 100 -IdleSessionTimeout 3600 -Stateful $True
Add-VMNetworkAdapterExtendedAcl -VMName “vm01” -Action Allow -Direction Outbound -RemotePort Any -Protocol udp -Weight 101 -IdleSessionTimeout 3600 -Stateful $True
 
Want to start over? Remove all ACLs:
Get-VMNetworkAdapterExtendedAcl -VMName “vm01” | Remove-VMNetworkAdapterExtendedAcl