How To

Migrating from SBS 2003 to Windows Server 2012 r2 Essentials in Azure

September 3, 2014 by Paulie 16 Comments

I’ve been considering the idea of migrating customer systems from on-premise Windows Server 2003 SBS to Windows Server 2012 r2 Essentials hosted on Azure for a while now. For one reason or another I’ve stuck to on-premises deployments, mainly due to lack of decent internet connectivity at client sites.

I’ve just completed the first full migration to a fully Azure based infrastructure and it is working well. It was a good fit for this customer because:

The old SBS 2003 server was due for replacement anyway.
Despite only having six users they have a huge amount of email which was shifted to Office 365.
They have closed their office premises and will be working from home based offices from now on.
They have a small line of business application which needs a central server to run on.
SSL VPN functionality of Essentials makes connectivity straightforward and cheap.

The main benefits of running Windows Server Essentials Experience in the cloud as I see it

No hardware to purchase or maintain. The customer had a competitive quote from another IT service provider quoting for physical hardware, which was much more expensive. Cheaper for the customer/more competitive for the partner.
Takes a very short time to get up an running, even in a migration scenario. I was able to start the work without waiting for a box to turn up.
The server resources can be easily modified to suit customer requirements.
The Azure edition of Windows Server Essentials Experience does not have any of the locks or limits of the on-premises edition as it is actually Windows Server 2012 r2 Datacenter edition.
The SSL VPN functionality of Essentials Edition enables remote workers to connect and join to the domain without having to be on the same premises as with previous versions.
The installation of Windows Server Essentials Experience from the Azure gallery is pre-customized to suit a cloud based deployment.

The good news is that if you have completed an on-premise migration to Windows Server Essentials, then the process of migrating to Azure is really not all that different.

Because the process is so similar and because there is so much documentation that already covers the migration procedure already this post is really only documenting the process that I went though and my thoughts on it where that process would differ from a regular on-premise migration.

Broadly speaking, I followed the procedure laid out on Technet here:

http://technet.microsoft.com/en-us/library/dn408633.aspx

Create your Windows Server Essentials Virtual Machine, storage and network

Follow the instructions on this technet article to build your virtual resources within Azure.

http://msdn.microsoft.com/en-us/library/azure/dn520828.aspx#BKMK_CreateVM

For this deployment I have started with a “Small” virtual machine just to see how it runs, I may well increase it in the future.

I was really surprised at how good the performance of a Small Azure Virtual Machinee is, honestly I expected it to be diabolical, but actually it is perfectly adequate for a lot of tasks. There were a couple of parts of the setup procedure which could have used more resources though, so I did at one stage increase the virtual machine size temporarily.

In addition to the base disk I also added a 10Gb drive for storage of active directory and a 180Gb drive for data storage.

Linking the Azure virtual network linked to your on-premise LAN

This step is not strictly necessary as there are a number of different approaches you could take to move data from the on-premise network into Azure. But I chose to link the local network with the Azure virtual network using the Azure site-site VPN capability. This makes joining the new essentials server on to the existing domain easy and makes transferring data more simple.

In this case the customer had a Draytek router and I have written a separate post on how to create a site to site link between a Draytek and Microsoft Azure. There are lots of guides on the net that explain how to achieve the same thing with different router vendors.

In this scenario the link back to the local network will be removed when the migration is complete, but clearly this approach would work well for providing access to office based clients. In this instance the server will be accessed by clients using the SSTP VPN provided by Azure.

This is how the virtual network looked after transferring data from on-premise LAN to Azure:

Install the and configure Azure Powershell

You need to install the Azure Powershell in order to be able to assign your new virtual machine a Static Internal IP Address as all IPs in Azure are dynamic.

Follow the instructions here to install Azure Powershell:

http://azure.microsoft.com/en-us/documentation/articles/install-configure-powershell/

Set a Static Internal IP address on your new Essentials VM

Because all VMs in Azure are assigned IP addresses automatically we need to ensure that the essentials server has a static IP address so that we can set that server as a DNS target for the virtual network. In Azure this is referred to as a DIP – I have no idea what the D in DIP stands for, so if anyone knows, please let me know!

This will allow the server itself, clients and other virtual machines to function properly within the AD domain.

Follow the instructions here:

http://msdn.microsoft.com/library/azure/dn630228.aspx

Join the essentials server to the domain and promote to a domain controller.

You should now have everything in place to allow you to move forward and install Active Directory services and promote your new Windows Server Essentials virtual machine to a domain controller. Depending on the speed of your link this may take a while. For me it took around 20 minutes while AD was upgraded on the existing server and the Windows Essentials machine was rebooted.

At this stage you can continue with the migration just as if it were an on-premise deployment, you may need to plan well ahead if you have lots of data to transfer and do not have access to a fast internet connection to do it with.

For copying the data from the source system I just used Robocopy and was able to maintain at least 5Mb upload most of the time.

Allow anywhere access

Anywhere access is one of the things in Essentials that makes it work so well in Azure. The SSL-VPN means that you need only open ports 80 and 443, which I think is really neat..

A word of warning though, if you are migrating from SBS 2003, some of the existing group polices made it difficult for me to run the anywhere access wizard. If you get problems with the VPN wizard failing, see this post.

After you have successfully run the VPN wizard, you need to assign a static address pool in RRAS administrator. See this document for more details:

http://technet.microsoft.com/en-us/library/dd469667.aspx

Add an additional UPN suffix to local domain(Optional)

I always like to add an additional UPN suffix the the local AD so that users can use the same sign-in information on 365 as their regular resources. See here…

http://support.microsoft.com/kb/243629

Conclusion

Migrating from SBS 2003 to Office 365 and Azure hosted essentials is mostly straightforward. If I was migrating a system with so few users again then I would just fresh install and lose the existing AD, but this was a good opportunity to prove the concept as I will be moving some customer resouces with more sophisticated requirements and greater number of users in the near future and the process will be much the same.

I do have a confession to make though….

I am running Storagecraft Shadowprotect on the VM and sending the data out of Azure back to our own storage running in a co-lo facility near our offices. Why? This is the first real infrastructure that I have run in the cloud that is not on our own hardware where we have complete control over it, having the system backed up to our own servers makes me sleep well at night. Because the upload capacity of Azure is so good it hardly takes any time to run a Storagecraft Backup so I feel OK about it

How to create a site-to-site VPN link between a Draytek router and Microsoft Azure

August 22, 2014 by Paulie 6 Comments

I’m currently in the process of Migrating a customer from an on-premise Windows Server 2003 Small Business Server to an Azure based Windows Server 2012 r2 Datacenter with Windows Server Essentials experience installed.

Part of that migration process is clearly going to involve moving all of the shared data from the current server into Azure. This customer has a Draytek 2860, which although not an officially support Azure device has no problems connecting to Azure.

The main frustration I found when building the site-to-site connectivity between Azure and the Draytek firewall is that neither end has any useful log files that you can look at to aid in troubleshooting, it either works or it doesn’t. Having been through the same exercise recently using a SonicWALL firewall which has extensive logging the process is much easier.

Anyway, here is how to do it. Because I am somewhat new to Azure, and I am assuming that others reading this will be to, I am going to go through the steps required to build the virtual network from scratch and eventually join the Draytek router on.

Create the Azure Virtual Network

I’ve chose to create my network in the “North Europe” data center location as I am based in the UK and I believe that North Europe is in Dublin, Ireland.

Next I ticked the box to “Configure a site-to-site VPN”, but here is an important note, do NOT tick the box that says “Configure a point-to-site VPN”. If you do this then the Azure network will use dynamic routing instead of static routing and you will not be able to get your Draytek to connect. (If you do manage to, please let me know how you did as I spent a while trying to get it to work!).

On the next screen you will have to name your local network and specify the public IP address of your Draytek router. In addition you will need to tell Azure the details of your local subnet.

In my case the existing local network is a 192.168.250.0/24.

Moving on to the next screen you will define the parameters of the virtual network:

After you have defined a subnet for use in Azure you will need to click on “Add gateway subnet”.

Once you are all done click on the tick to finish the virtual network creation process.

Wait a short time and you should see when the virtual network has been created. Once the network has been created you can go into the network dashboard and finish off the remaining steps.

Your virtual network dashboard will probably look something like this:

Click on the “Create Gateway” button to make an external interface to your Azure Virtual Network. Again making sure to select “Static Routing” in order for it to work with your Draytek router.

You will see the gateway being created, it took about five minutes to complete for me:

When the creation is done you will see the gateway details displayed like this:

You need to make a note of the gateway IP address and the virtual network preshared key. Click on the “Manage Key” button on the bottom of the dashboard and the gateway key will be displayed, make a note of it as you need to enter this into your Draytek Router:

Now you have completed all the steps required at the Azure end, time to head over to your local Draytek.

Define a VPN profile on your Draytek router to create a site-to-site link to Microsoft Azure

Once logged in to your Draytek head to “VPN and Remote Access” and then “LAN to LAN”. Choose an empty profile to begin the configuration.

Give your VPN Profile a name, and set the call direction to “Dial-Out”. Tick the “Always on” check-box.

In the 2nd section enter the gateway IP address, enter the preshared key by clicking on the “IKE Pre-Shared Key” button and set the IPSec Security Method to “High(ESP)” and “AES with Authentication”

Ignore sections three and four and move on to the bottom section 5.

Set the correct details network addresses for your remote Azure virtual network and your local network:

Save the profile by clicking on OK and then go to “VPN and Remote Access” again and then to “Connection Management”.

All being well you should now see that your Draytek router has a connection to Azure:

Draytek 2860 site-to-site VPN to Azure Performance

As you can see, the latency from my connection to the Azure network is pretty low. This is a ping to a Windows Server 2012 VM running inside the newly created Virtual Network:

I also uploaded a file to a drive on the Azure virtual machine and downloaded it again to test transfer speeds. Clearly there is nothing scientific about this and it is totally dependent on your on broadband connection speed, but merely for my own curiosity:

I consistently got around 1.75MB/second upload, which is pretty much the entire upload capacity of my broadband line.

I downloaded the same file from Azure and got these speeds:

The speed downloading from Azure was faster than the upload, but not all that fast really. I have an 80mb connection and would expect Azure to push data out quicker than that, so I checked the CPU usage on the Draytek.

Without utilizing the Azure site-to-site link my Draytek shows around 7% CPU usage:

When downloading a file from Azure the CPU usage shoots up to around 80%, so I am suspect the CPU in the Draytek is a limiting factor when communicating with Azure:

SonicWALL TZ210 site-to-site VPN to Azure Performance

I had an old SonicWALL TZ210 sitting around so I configured that to connect to Azure instead and did the same tests and saw the following speeds performing the same operation:

As you can see the SonicWALL is significantly faster than the Draytek despite being an old model. I also plan to try out a SonicWALL NSA 220, the quoted VPN throughput figures are:

Draytek 2860 – 50Mbps
SonicWALL TZ210 – 75Mbps
SonicWALL NSA 220 – 150Mbps

The VPN performance is a really important factor to consider when choosing what device to use to connect to Azure, with internet connections becoming increasing fast you might be surprised to find that your existing device may not have enough muscle to handle your full bandwidth.

How to enable Flash Player on Windows Server 2012 r2

July 17, 2014 by Paulie 39 Comments

If you are trying to view web pages that contain flash content on Windows Server 2012 r2 then you may find that it does not work. You are then led to a page on the Adobe website tells you that Flash player is already installed on Windows 8 and that you do not need to install it. This post explains how to enable Flash Player on Windows Server 2012.

The page then goes on to provide instructions as to how to enable Flash, this basically consists of:

Ensuring that the flash player add-on is enabled.
Checking that Active-X filtering is disabled.

You will probably find that these instructions do not work for you as flash player is not listed in the Internet Explorer Add-ons.

How to install Flash Player on Windows Server 2012 r2

In order to install Flash Player on Windows Server 2012 you need to install the Desktop Experience Feature. To do this, do the following:

Go into server manager.
Click add roles and features:
Press next until you reach the “Features” page.
Tick the box “Desktop Experience” which is hidden under the “User Interfaces and Infrastructure” feature:
You will then have to accept the installation of some other features to support the installation of desktop experience
The features are installed and the server is rebooted:

Or if you prefer, you can install with the simple but so effective Windows Powershell command:

Install-WindowsFeature Desktop-Experience

The reason I wanted to have access to Flash Player on this particular server was so that I could access the vSphere Web client, which uses flash. Hope this helps someone.

If you are looking for instructions on how to Install Flash Player on Windows Server 2016 – please follow this updated guide.

How to whitelist domains in Office 365 using Powershell from a text file

May 21, 2014 by Paulie 7 Comments

How to whitelist domains in Office 365

There are plenty of blog posts out there that explain how to add a mail flow rule in Office 365 to allow you to white list a sender domain, bypassing the 365 spam filtering completely. There is a nice guide on how to achieve that on this blog post by Robert Crane:

White listing a domain in Office 365

I was working with a customer today that had a long list of domains that they wanted to white-list but the Office 365 admin interface does not provide an elegant way to enter the domain list in bulk.

As all of the mail flow functionality presented in the Office 365 web interface is also available in Powershell I wrote a script that would do the job of creating a transport rule based on a simple list from a text file containing email domains.

Creating a Mail Flow rule to handle many trusted domains.

The first step in this process is to create a plain text file with a domain on each line that you would like to white-list. If you enter a full email address the script will strip the part in front of the @symbol and white-list the entire domain.

So your list might look something like:

nicedomain.com trusteddomain.com tachytelic.net accendo.co.uk [email protected]

The final line in this example of “[email protected]” will be stripped down to “somedomain.com”, I added this because the list I was supplied with contained some full email addresses which the transport rule cannot accept. Each line is also trimmed of white-space to ensure the rule creation is successful.

Once you have your file in place you need to connect to Exchange Online using Remote Powershell. Instructions on how to do that here:

http://technet.microsoft.com/en-us/library/jj984289(v=exchg.150).aspx

Running Add365SafeDomains.ps1 to create or update a Mail Flow rule using Powershell in Office 365

Once you are connected to Exchange online you can run Add365SafeDomains.ps1. The script expects two parameters, which can be supplied on the command line or omitted and you will be prompted to supply them. An example command might look like this:

.\Add365SafeDomains.ps1 -ruleName "Safe Domain List" -domainListFilePath "c:\domainlist.txt"

or simply

.\Add365SafeDomains.ps1

and you will be prompted for the values as per the below:

Specifying a meaningful rule name will allow you to segregate different groups of domains easily.

If you specify a rule name that already exists, the contents of the “SenderDomainIs” property will be loaded into an array and combined with the new list that you have supplied, duplicates are automatically removed and the list is sorted into alphabetical order for easier readability when using the 365 web portal to review the rule.

If you specify a rule name that does not already exist, then a new rule will be created instead.

The script works by creating an array of domains and supplying that array to the set-TransportRule cmdlet.

So if you have lots of domains that you would like to white-list (or black list with easy modification) then this could be for you.

Here is the code for the script:

Param( [Parameter(Mandatory=$True,Position=1)] [string]$ruleName,

[Parameter(Mandatory=$True)]
[string]$domainListFilePath
)

#Read the contents of the text file into an array
$safeDomainList = Get-Content $domainListFilePath

#Create a new array and remove all text for each line up to and including the @ symbol, also remove whitespace
$newSafeDomainList = @()
$newSafeDomainList += foreach ($domain in $safeDomainList)
{
$tmpdomain = $domain -replace “.*@”
$tmpdomain.trim()
}

#If the rule already exists update the existing allowed sender domains, else create a new rule.
if (Get-TransportRule $ruleName -EA SilentlyContinue)
{
“Updating existing rule…”
$safeDomainList = Get-TransportRule $ruleName |select -ExpandProperty SenderDomainIs
$completeList = $safeDomainList + $newSafeDomainList
$completeList = $completeList | select -uniq | sort
set-TransportRule $ruleName -SenderDomainIs $completeList
}
else
{
“Creating new rule…”
$newSafeDomainList = $newSafeDomainList | sort
New-TransportRule $ruleName -SenderDomainIs $newSafeDomainList -SetSCL “-1”
}

You can copy and paste the above into your own Powershell script or download the script here:

Add365SafeDomains.ps1

Enjoy!

High Memory usage in SBS 2011 caused by SQL Server Databases (DataCollectorSvc.exe)

May 12, 2014 by Paulie 16 Comments

SBS 2011 in it’s default configuration will experience very high memory usage caused by the three SQL databases that are running and in my experience will eventually cause poor performance where physical memory is being consumed by these databases. In particular I have noticed extremely High memory usage in SBS 2011 by the DataCollectorSvc.exe process, it was using around 12 GB!

There are three databases:

SBSMONITORING
SHAREPOINT
WINDOWS INTERNAL DATABASE (MICROSOFT##SSEE)

All three of them have the potential to consume a great deal of memory and by default the memory limit on these instances is set to 2147483647 MB – which is 2048 Terabytes. Given that SBS 2011 supports a maximum of 32Gb of memory, restricting the memory usage on the databases can give you some of your memory back and improve the performance of the machine.

Because all three databases are separate instances you need to connect and modify each one separately.

We can use one instance of SQL Server Management Studio to manipulate all three instances, which makes things a bit easier. Open SQL Server 2008 Management studio by doing the following:

Start -> All Programs -> Microsoft SQL Server 2008 R2 -> Right click on “SQL Server Management Studio” and choose, run as administrator:

Reduce memory usage of the SBSMONITORING, SHAREPOINT and Windows Internal Databases

Once SQL Server Management Studio has opened you will be prompted to connect to a server, enter SERVERNAME\SBSMONITORING. In this example the server is simply called SBS:

Once connected to your database, connect to the other two databases at the same time by going to File -> “Connect Object Explorer”. This time in the server name enter:

SERVERNAME\SHAREPOINT

Once again to go File -> “Connect Object Explorer”. Enter:

\\.\pipe\MSSQL$MICROSOFT##SSEE\sql\query

All being well you should now have SQL Management Studio with all three databases listed like this:

Repeat the following procedure for each database:

Right click on the name of the SQL Instance and choose properties:

Click on the “Memory” option on the left hand side and adjust the memory figure as appropriate for your system. The system in this example has 32Gb of physical ram so I have chosen to give each database 2Gb. If you have less memory you will need to adjust according to your own system.

After you have adjusted all three databases you can quit SQL Server Management Studio and then restart the following services for the changes to take effect:

SQL Server (SBS Monitoring)
SQL Server (Sharepoint)
Windows Internal Database (MICROSOFT##SSEE)

Hopefully after doing this SBS 2011 should run a bit smoother, on this system the SQL Databases were using over 16Gb of Ram and it was running very slowly.

Hope this helps.

How to set scan to email on an HP Officejet 8600 with Office 365

April 19, 2014 by Paulie 2 Comments

This post covers how to configure the HP Officejet 8600 to scan to email directly via Office 365.

Generally speaking it is often easier to configure an IIS (or other SMTP) server to act as an internal relay for messaging through Office 365 for office based devices such as scanners and photocopiers, however, sometimes this is not practical, especially in small environments where there is no server.

E-Mailing directly from the Officejet is easy to setup and takes only a couple of minutes to setup.

Setting up scan to email on an HP Officejet 8600 with Office 365

First of all, ensure that your Officejet is connected to your network and has access to the internet. You then need to find out what IP address the printer has, you can do this by doing the following:

From the main menu of the printer touch screen go into “Setup” and then “Network”, then go into “View Network Summary”, choose “View Wired” or “View Wireless” depending on how you have connected the printer to your network and the IP address will be displayed on the screen. Make a note of the IP address.

Browse to to the IP address of your printer from a computer connected to the same network and you will be presented with the Officejet 8600 embedded web server administration system.

From the tabs at the top of the menu choose scan:

From the scan settings page choose “Scan to E-Mail Setup” and then “Outgoing E-mail Profiles”:

From the Outgoing E-Mail profiles page, click new:

Enter the email address of the account that you are going to be sending messages from. This has to be a valid Office 365 user in your tennat. As you can see I have created a dedicated account called “Message.Relay”, but any active account will work.

Enter a display name for the account, I have called mine “Office 365”.

Click Next to move on to step 2.

On Step 2 do the the following:

In SMTP Server put “smtp.office365.com”
In SMTP Port enter “587”
Tick the box that says “Always use secure connections (SSL/TLS)
Tick the box that says “SMTP server requires authentication for outgoing e-mail messages”
Enter the email address of the Office 365 account you are going to use to send messages from the Officejet
Enter the password for the Office 365 account you are going to use.

Click next to move on to step 3 of 5.

This screen offers you the chance to specify a pin to prevent unauthorized access to the email scanning function, I didn’t want or need to set this up so just pressed next.

Step 4 of 5 asks you to specify a maximum message size and default CC options. As the default maximum message size in Office 365 is 25Mb I decided to set this to 20Mb so that there is a little bit of margin.

I chose not to receive an automatic CC of the message.

Click next to move to the step 5 email setup summary screen:

Click on “Save and Test” to ensure that all of your settings are correct. Hopefully you should see the following:

That’s it! You can now scan to email directly from your Officejet Pro 8600 via Office 365.