It's not hard. It's just boring. And repeatable tedium is exactly what scripting is for.

So I built WorkStation Builder which is a PowerShell tool that takes a fresh Windows install from "nothing" to "fully loaded" with one command and a GUI. I've been using it for my own machines for a while, cleaned it up, and it now lives at wsb.chrisbmn.com.

What it actually does

Drop this into an elevated PowerShell window:

irm "https://cbmn.link/wsb" | iex

That command pulls the script, bootstraps Chocolatey and winget (if they're not already there), installs a baseline for your machine, patches, reboots, then picks up where it left off and then opens a WPF GUI where you pick what you want to install. Nothing is pre-selected - you're in control of every checkbox. When you're done, it installs everything in order, routing each tool to the right package manager automatically.

If you already have a machine set up and just want to add a few tools, there's a shortcut for that too:

irm "https://cbmn.link/launchgui" | iex

That skips the bootstrap step and goes straight to the menu. Useful when a colleague asks you to "just grab a few things" and you don't want to run the whole setup process on their already-configured machine.

The catalog

Right now WSB has 98 tools across 13 categories. Here's the breakdown:

• Shell & Terminal: Windows Terminal, PowerShell 7, Oh My Posh, Scoop
• Browsers: Arc, Brave, Chrome, Firefox, Firefox Developer Edition, LibreWolf, Vivaldi
• Dev Tools: VS Code, Git, GitHub Desktop, WinMerge, Node, Python, Terraform, kubectl, Helm, lazygit, jq, yq, Zed, bat, ripgrep, and a handful of other CLI utilities I reached for constantly
• Productivity: 1Password, Notepad++, 7-Zip, PowerToys, Snipaste, Kleopatra, Thunderbird, and a few others
• Media & Graphics: VLC, Paint.NET, GIMP, Inkscape, K-Lite Codec Pack
• File Management: WinSCP, FileZilla, WizTree
• Admin & Security Tools: SysInternals, IIS Crypto, OpenSSL, LockHunter, Rufus, LGPO, Windows Admin Center
• Network Tools: MobaXterm, PuTTY, Nmap, Wireshark, PortQryUI
• Azure & Cloud Tools: Azure CLI, Azure Storage Explorer, Azure Data Studio
• Virtualization & Remote: RVTools
• AI Tools: ChatGPT, Claude
• PowerShell Modules: Az, Microsoft.Graph, Exchange Online Management, Posh-SSH, PSWindowsUpdate
• Windows Features: 22 individual RSAT tools (Active Directory, DNS, DHCP, Group Policy, Failover Clustering, WSUS, and more), plus a bulk "Install All RSAT" option if you just want everything

The full catalog with descriptions is on the WSB page - each tool shows which package manager installs it and any relevant notes.

Package managers are handled for you

One of the things that used to drive me insane about manual setup was jumping between package managers. Some tools are on winget, some are better from Chocolatey, CLI utilities belong in Scoop, PowerShell modules come from PSGallery, and RSAT tools are Windows Features. WSB handles all of that behind the scenes. You pick the tool, it figures out how to get it.

• winget: Microsoft's official package manager. Does the heavy lifting for most apps.
• Chocolatey: Bootstrapped automatically. Used when winget doesn't have a package or Chocolatey has a more reliable version.
• Scoop: Opt-in from the GUI. No admin required, no registry clutter. It's perfect for CLI tools like jq and yq.
• PSGallery: PowerShell modules straight from Microsoft's official gallery.
• Windows Features: DISM/Add-WindowsCapability for the RSAT tools. No third-party involved.

Still a work in progress

WSB does what it says on the tin right now - install. That's it. No uninstall, no upgrade, no "what's out of date." Those are on the list. 

The two things I want to add next are removal (pick tools to uninstall, same GUI experience) and upgrades (run WSB against an existing machine, see what's out of date, update what you want). The plumbing for both is pretty straightforward - the hard part is making the UI not terrible for those flows, which is its own project.

So if you run it today and think "wait, where's the uninstall button" - that's intentional, not an oversight. It's just not there yet. (It's also not something I'm going to rush and ship half-finished. I've learned that lesson enough times.)

It's open source

The whole thing is on GitHub at chrisbmin/wsb-base. The tool catalog lives in config/tools.ps1 — adding or removing a tool is literally one line. If your toolkit looks different than mine (and it probably does), fork it and make it yours. That was kind of the point.

I built this to solve my own problem, but it's been useful enough that I figured it was worth sharing. If a fresh install is in your future — new machine, rebuild after a bad update, whatever the occasion — give it a shot.

Elevated PowerShell. One command. Come out the other side with a real workstation.

That's intentional. The site changes what it says when it thinks you're not looking. Switch away, switch back. It has a few things it might say. None of them are alarming. A couple of them are a little nerdy.

I've been rebuilding this site from the ground up over the past several months. Somewhere along the way it stopped being just a website and started being a bit of a addiction. When you're writing all the code yourself or with Claude's help, and with no ticket queue and no product manager, it's hard not to have a little fun.

The tab title thing is the one you're most likely to find by accident. There are others. Some are easy to easy to find, others are not.  Some require knowing a very specific sequence of inputs that had its cultural peak sometime around 1986. One only shows up on a particular day each May, though I might have left a back door in case you don't want to wait.

A couple of them live on pages that aren't in the navigation and aren't linked from anywhere. They're just there, if you know where to point your browser. One of them is very aware that you weren't supposed to find it. The other one knows exactly what stardate it is.

I'm not going to spell them all out. That's the whole point. But if you're the kind of person who reads source code, checks robots.txt out of habit, or just types random paths into address bars to see what happens - you'll find them. The 404 page might have opinions and may or may not offer a nudge if you wander in the right direction.

Personal sites are one of the last places on the web where this kind of thing still makes sense. No security scans or page test is going to flag it.  It's just something that's there for the people who look.

May the syntax be with you.

/usr/local/bin> cd /i/am/a/banana
/i/am/a/banana> cd -
/usr/local/bin>

Powershell

if (-NOT ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")) {
    $scriptPath = $myinvocation.mycommand.path
    Start-Process pwsh -Verb runAs -ArgumentList "-File $scriptPath"
    exit
}

PHP 

<?php
    $images = require 'images_array.php';
    echo $images[array_rand($images)];
?>

TypeScript

export const shuffle = <T>(arr: T[]): T[] =>
  arr
    .map((a) => ({ sort: Math.random(), value: a }))
    .sort((a, b) => a.sort - b.sort)
    .map((a) => a.value);

Python

found = False
for x in sequence:
    if pred(x.n):
        found = True
if found:

SQL

SELECT @randomString = CONVERT(varchar(255), NEWID())
   

YAML

person:
  name: "Alice"
  age: 30
  hobbies:
    - "reading"
    - "coding"
  address:
    city: "Tech City"
    zip: "12345"

HTML

<!DOCTYPE html>
<html>
<body>

<h2>Random Number Generator</h2>
<p>Click the button to generate a random number between 0 and 9.</p>

<button onclick="generateRandom()">Generate Random Number</button>
<p id="demo"></p>

<script>
function generateRandom() {
    document.getElementById("demo").innerHTML = Math.floor(Math.random() * 10);
}
</script>

</body>
</html>

CSS

:root {
  --primary-color: #007bff;
  --font-size: 16px;
}

.button {
  background-color: var(--primary-color);
  font-size: var(--font-size);
}

Plain Text

A common example of a small, plain text code snippet for generating dummy text is using the RAND function in Microsoft Word. This feature allows users to quickly generate random paragraphs of filler text (like Lorem Ipsum) for layout testing or formatting practice without needing to type manually.

It usually starts the same way — I need to check a DNS record, IP Address or a subnet, or verify that a redirect chain is actually doing what I think it's doing. I end up bouncing between five different sketchy websites, half of which are covered in ads and the other half of which I don't fully trust with whatever I just pasted in. So I build my own. And then I build another one. And then suddenly it's a whole site.

That's basically how webtools.chrisbmn.com happened.

What's on it

Right now there are 30+ tools spread across six categories:

• Network — IP lookup, DNS lookup, reverse DNS, port checker, HTTP headers, redirect chain tracer, subnet calculator, ASN lookup, CDN cache tester, and a "what's my IP" page for when you just need to know fast.
• Domain — WHOIS, SSL certificate checker, email deliverability (MX, SPF, DKIM, DMARC), and a full DMARC report analyzer that parses the XML aggregate reports your mail provider sends you.
• Security — Password generator, hash generator (MD5 through SHA-512), JWT decoder, and an SMTP TLS report analyzer for parsing those RFC 8460 JSON reports.
• Developer — Base64, JSON formatter/validator, URL encode/decode, regex tester, UUID generator, text diff, and a Paste tool for sharing snippets.
• Utilities — Unix timestamp converter, CIDR/IP range builder, cron expression builder, and a website screenshot tool.
• Reference — User agent parser and a full HTTP status code reference.

A few I actually use regularly

The password generator gets more use than I expected — turns out having a solid one a tab away beats fumbling for a separate app every time. The WHOIS lookup is another one I keep coming back to more than I thought I would, usually when I'm poking at an unfamiliar domain and want the registration details without leaving the browser. And the DMARC report analyzer came out of personal frustration — those aggregate XML files are not fun to read raw.

The most recent addition is an SMTP TLS Report analyzer for the RFC 8460 JSON reports that providers like Google send when you've got MTA-STS set up. Paste the JSON in, get a clean breakdown of session success/failure counts, failure types with plain-English explanations, and actionable recommendations. Because nobody wants to manually parse that.

Why not just use existing tools

Honestly? A mix of reasons. Some tools I use frequently enough that I want them fast and without ads. Some I wanted to work a specific way. Some I built because I wanted to understand the underlying protocol better — there's no faster way to learn how DMARC reports are structured than to write a parser for them. And some I just built for fun.

Everything runs server-side in PHP. No tracking, no third-party analytics on the tool pages, nothing getting logged. What you paste in stays between you and the server.

It's still growing

I add tools when something annoys me enough. If there's something missing that you'd find useful, let me know in the comments — no promises, but I'm always looking for an excuse to build something.

→ webtools.chrisbmn.com

The site got a full refresh. And I'm genuinely pretty happy with it.

The visual overhaul was the obvious starting point. Everything got cleaned up, tightened up, and given a look that actually feels like me — not just whatever the default theme happened to be. Colors, layout, the whole deal. It's sharper, it's more intentional, and it loads without making you question your internet connection.

Speaking of loading — the old WordPress setup had gotten rough. Like, "go make a sandwich while the page thinks about it" rough. That's gone. The new site is fast. Genuinely, actually fast. I don't even have caching fully enabled yet, and it's that fast!  Turns out when you're not dragging along seventeen plugins and a theme built in 2014, things tend to move a little quicker.

But the speed wasn't even the most exciting part.

The bigger news is the blog — which, yes, you are currently reading, so clearly that part is working. Writing has always been something I've wanted to do more of, and now I kinda feel a little more inspired to do it. I mean, not a lot, but its more then it was..  Tech stuff, gaming, random thoughts, life in Minnesota — if it's on my mind, it'll probably end up here at some point.

Oh, and dark mode. Obviously. Because it's the right thing to do and I will not be taking questions. Light mode is there too, for those of you who apparently enjoy staring into the sun. No judgment. Much judgment. Ya bunch of maniacs!

There are also some new features baked in that I think people will actually find useful. Nothing I need to over-explain right now — half the fun is poking around and finding them yourself. Let's just say the site does a little more than it used to.  I mean a little, like maybe one or two tops.. I swear.

Is it perfect? Not yet. It probably never will be — that's kind of the nature of a personal site. But it's alive, it's functional, and it's a place I'm actually excited to send people to now.

So, if you're new - welcome. If you're revisiting, welcome back!  Poke around. And if you've got thoughts, the feedback is always welcome. 

— Chris

In this post, we'll cover the steps needed to install the MS Graph PowerShell module, verify it works, and perform a couple examples of its use.

Prerequisites

To install the module, you need a couple things. You likely already have these if your running a later version of Windows 10, or Windows 11, but lets just throw them here as a reminder.

• PowerShell 5.1 or newer
•  
• .NTE Framework 4.7.2 or newer
•  
• Latest version of PowerShellGet

I am going to start with installing PowerShell 7. The easiest way to do this with with winget.

winget install --id Microsoft.Powershell --source winget

The install from winget will look similar to below:

Or download it from the official GitHub releases.

iex “& { $(irm https://aka.ms/install-powershell.ps1) } -UseMSI”

If you install via the msi - Just leave all of the options as their defaults.

Once the installation completes, close your existing PowerShell window and search for PowerShell 7 in your start menu.

With that out of the way, we can install Microsoft Graph

Install Microsoft Graph PowerShell Module

Use the following examples to install the latest (stable) version of the Microsoft Graph PowerShell module from the PowerShell Gallery.

To install the module for the current user scope:

Install-Module Microsoft.Graph -Scope CurrentUser

Or to install for all users on your system: (you will need local admin rights on your system):

Install-Module Microsoft.Graph -Scope AllUsers

Both commands can both be run in PowerShell 5.1 or PowerShell 7; however, installing one does not install it for the other.

Below is an example of the command being used to install for all users.

At this point, you may want to verify that everything looks good, so you can run for following command to confirm which version has been installed on your system.

Get-InstalledModule | Where-Object {$_.Name -match "microsoft.graph"}

You should see something similar to the following:

We're now set to connect to graph and perform some magic! Yay!

Connect to Microsoft Graph with PowerShell

Depending on your needs, to interact with Graph you need to outline the parameter's of whether you just need to read data, or if you need to write it as well.

If you want ‘read’ and ‘write’ access to all user accounts in your tenant:

Connect-MgGraph -Scopes "User.ReadWrite.All"

Or if you only need to read the data you can use:

Connect-MgGraph -Scopes "User.Read.All"

This could also be applied to groups:

Connect-MgGraph -Scopes "Group.ReadWrite.All"

For a full breakdown of all the available permissions you can specify when connecting to Graph, refer to the permissions reference sheet from Microsoft: https://learn.microsoft.com/en-us/graph/permissions-reference

What can we do?

So now that we have PowerShell installed, the MS Graph module loaded, and we are connected, below are a few real life uses for the Graph Module.

Setting Azure User account passwords to expire / not expire:

Connect-MgGraph -Scopes "User.ReadWrite.All"

# Set password to never expire

Update-MgUser -UserId "user@domain.com" -PasswordPolicies "DisablePasswordExpiration"

Connect-MgGraph -Scopes "User.ReadWrite.All"

# Set password to expire

Update-MgUser -UserId "user@domain.com" -PasswordPolicies "EnablePasswordExpiration"

Verify what password policy is in effect:

Connect-MgGraph -Scopes "User.ReadWrite.All"

Get-MgUser -UserId "user@domain.com" -Property UserPrincipalName,PasswordPolicies |
Select-Object UserPrincipalName, @{Name="PasswordNeverExpires";Expression={$_.PasswordPolicies -contains "DisablePasswordExpiration"}}

Disable the "Force change password at next sign-in" setting for an Azure AD user:

Connect-MgGraph -Scopes "User.ReadWrite.All"

Update-MgUser -UserId "user@domain.com" -PasswordProfile @{ ForceChangePasswordNextSignIn = $false }

This assumes the user already has a password set. If you're also resetting the password, you can include it like this:

Connect-MgGraph -Scopes "User.ReadWrite.All"

Update-MgUser -UserId "user@domain.com" -PasswordProfile @{
    Password = "NewSecureP@ssw0rd!"
    ForceChangePasswordNextSignIn = $false
}

Finally, enable the "Force change password at next sign-in" setting for an Azure AD user:

Connect-MgGraph -Scopes "User.ReadWrite.All"

Update-MgUser -UserId "user@domain.com" -PasswordProfile @{ ForceChangePasswordNextSignIn = $true}

These are all real life use cases that I have used the MS Graph PowerShell module for. I'd love to see some of your uses - feel free to share them in the comments below.

In this blog post, I will outline the steps I used to set this setting for the big-three browsers - Edge, Chrome and Firefox.

The settings to apply are pretty self-explanatory after you get them in place, however following each vendors documentation can be a little confusing, so my hope in this post is to simplify the steps into 1-easy-to-understand tutorial.

Lets get started:

MS Edge

MS Edge is the easiest to implement.

• Login on Microsoft Intune Admin Center
• Click on Devices > Configuration
• Click on + Create Profile
• Select Platform as Windows 10 and later
• Select Policy type as Settings catalog

• Provide a Name and Description (optional) of the Policy.

• From the Configuration settings tab, select + Add settings
• In the Settings picker blade, Search for "Edge". Then use the image below.

• After the setting is selected, configure the setting to Enabled, and add the URL

• Select Next and configure any Scope tags if applicable.
• Assign the profile to your group of users.
• On the Review + Create tab, review all the settings and confirm everything looks good, then select the blue Create button at the bottom of the page.

Yay! 1 down, 2 more to go.

Google Chrome

Google Chrome is nearly identical to MS Edge to implement.

• Login on Microsoft Intune Admin Center
• Click on Devices > Configuration
• Click on + Create Profile
• Select Platform as Windows 10 and later
• Select Policy type as Settings catalog, Select the blue Create button.

• Provide a Name and Description (optional) of the Policy. Select the blue Next button at the bottom of the screen.

• From the Configuration settings tab, select + Add settings
• In the Settings picker blade, Search for "Google". Then use the image below.

• After the setting is selected, configure the setting to Enabled, and add the URL

• Select Next and configure any Scope tags if applicable.
• Assign the profile to your group of users.
• On the Review + Create tab, review all the settings and confirm everything looks good, then select the blue Create button at the bottom of the page.

That's two out of the way - now it's time for the tough one.

Unfortunately, Firefox doesn't have settings catalog parameters available in Intune as of the time of this tutorial. Here's the 50-thousand-foot-summary - We download template files from their Github, upload them into Intune, and then use those templates to assign some parameters to FireFox.

Okay, Last one best one!

Mozilla Firefox

• First we need the ADMX, and ADML files from their GitHub page here and unzip the file.
• Login on Microsoft Intune Admin Center
• Click on Devices > Configuration
• Click on Import ADMX tab at the top of the page.

• Select + Import
• Import the mozilla.admx and mozilla.adml files. Make sure the status shows Available.
• Import the firefox.admx and firefox.adml files.

NOTE - If you upload firefox.admx before mozilla.adml, the import will fail.

• Head back to : Devices > Manage devices > Configuration > Create > New policy.
• Select Platform as Windows 10 and later
• Select Policy type as Templates, then Imported Administrative templates (Preview) Select the blue Create button.

• Provide a Name and Description (optional) of the Policy. Select the blue Next button at the bottom of the screen.

• From the Configuration settings tab, navigate to the tree to "User Configuration > Mozilla > Firefox > Home page".

• Select both "URL for Home page" and "Start Page" settings.

• Select Next and configure any Scope tags if applicable.
• Assign the profile to your group of users.
• On the Review + Create tab, review all the settings and confirm everything looks good, then select the blue Create button at the bottom of the page.

This should do it. After the next sync cycle, when you open a new browser window or a new tab in any of these browsers, the default URL should be the initial web page to be displayed/loaded.

A couple followup notes in terms of expectations:

• This list isn't locked down. People will be able to navigate away from this page.
• If you open a new tab, the default page will open in the new tab
• On edge, the URL is hidden. That doesn't stop you from navigating away or opening any additional browser tabs.

Tested on :

• Windows 11 - 24H2
• OS Build : 26100.3775

• Chrome version 135.0.7049.115
• Microsoft Edge Version 135.0.3179.98
• Firefox version 137.0.2

Troubleshooting Issues

• If any settings aren't applying even if the profile appears to have deployed correctly : Confirm that you aren't attempting to apply Computer settings on Users or vice-versa. The settings I used above are all "User" targetted. Its also best practice to NOT mix deployments comprised of both.

Reference Links

• Manage Firefox with Microsoft Endpoint Manager (Intune) | Firefox for Enterprise Help
• Import custom and third-party partner ADMX templates in Microsoft Intune | Microsoft Learn

Never Fear, Microsoft has got your back. Microsoft Quick Assist to the rescue!

This is a very simple article about how to use Quick Assist.

What is it?

Quick Assist is a Microsoft Windows feature that allows a user to view or control a remote Windows computer over a network or the Internet to resolve issues without directly touching the system. It is based on the Remote Desktop Protocol (RDP). Quick Assist is installed by default on Windows clients.

Helpers and users agree to assistance by sending/accepting assistance invitations from helpers.  Quick Assist requests a code in order to match users to a session. This will allow the giver to access the computer of the receiver in Administrator mode while allowing the receiver to see the choices the giver made.

How do I use it then?

Simple! and I'm glad you asked. The following is a quick overview of starting, connecting and using Quick Assist.

Left click on the start button

With the start menu open, type "quick" in the search field, quick assist should show up as an App

The main window for Quick Assist will open. You are presented 2 options. 1 to receive help, and the other to give it.

The top part of the screen is for those who are "needing" help.

The bottom part is for those that are "giving" help.

The Helper clicks the button "Help someone" and will be presented with a time sensitive code, that they then exchange with the receiver of the help whom will enter the code in the top box.

The receiver of help will input that code into their quick assist field

After the code is entered and "Submit" is selected the two systems will begin connecting. The person requesting help, will need to allow screensharing by checking the below checkbox and then selecting allow.

The two systems will connect

After the two systems are connected the helper will see a screen similar to this

The helper can request control of the other computer by selecting the button in the admin bar

The receiver of help will see the following at the top of the screen and will need to allow the control request.

The receiver of help can cancel access, or disconnect at any time by selecting any of the options in their respective bar

And that's a quick overview of using Microsoft Quick Assist!

For this reason, I wanted to put together a way to be able to walk-up to any of my Windows devices, re-install the Windows OS, then simply kick-off a script (of any type), and have the machine back in a semi-to-fully functioning state with all of the applications and files available and ready to use.

I came up with the following bullet list of simple requirements:

• Be able to wipe a device at any time and not have a fear of data-loss.
• Easily reinstall most (if not all) the applications I use as an IT guy.
• Install the latest versions of the above applications.
• Install applications which may not always come from the choco repo.
• Install updates, configure firewall, or enable any windows tweaks, etc.
• Keep this process easy, consistent, and repeatable.

for this reason, I looked to to github for a few choco developer machines projects, and low-and-behold fell onto a project from Microsoft called Windows-Dev-Box-Setup. This project had nearly 90% of the work already done, so after a quick fork, I had a starting point.

So with that said, allow me to introduce Windows 10 SysAdmin/Engineer workstation builder.

What does it do?

Quite simply, it takes your baseline'd Windows 10 desktop, and installs a standard set of Admin tools, that I use in my day-to-day as a Server Engineer.

Requirements

NOTE - This is NOT a bare-metal script. You have to first install Windows 10. Then proceed with running this script afterwards.

This script is meant to be very simple, and requires NO interaction from the user. I simply use boxstarter web launcher to start the installation process and call the proper build script.

Unfortunately some of Boxstarter's functionality does require administrative privileges to run, and it will prompt to elevate to administrator if not already elevated. While this may pose an issue directly using my script if you don't have admin access, you can fork my repo, and make any necessary changes to get a workable solution for you. Take a look at Chocolately's documentation on Non-Admin Install to find resources and examples of scripts to get a quick setup that doesn't require admin access.

All of the instructions are available on my github.

This tutorial will directly reference the Red Hat Satellite with AHV Integration Guide provided from Nutanix Portal. A link to the guide has been provided below.

So to begin this tutorial, I'm going to make the following assumptions about your environment. Before you dig into this guide, please review these assumtions, and make sure you are in a state that matches the below.

Assumptions

1. You have a fully functioning and configured Red Hat Satellite 6.
2. You have the following details regarding your Satellite server
   1. Org Name as it was registered in Satellite
   2. FQDN of the Satellite Server
   3. Username/Password of a user in Satellite (Preferably a service account)
3. Credentials to Prism Central or Prism Element
4. Finally - You have a subscription setup and allocated to the Satellite server.

To begin, we need to install the Nutanix virt-who agent on Satellite. (or any RHEL VM that is registered to either the Satellite server or to the Red Hat Portal.)

• Download the Nutanix virt-who agent from the Nutanix Support Portal here.
• Log into the system in which you are using.. (I used our Satellite server.)
• Upload the .rpm that you downloaded from the Nutanix Portal
• Install the Nutanix virt-who agent by running:

$ yum install rpm-file

• Next we need to create a Nutanix virt-who configuration file that included the details about the AHV cluster.
• Change directory to the /etc/virt-who.d/ directory
• Create a new file. This file can be named any way you like, however it needs to end with a .conf extension.
• Below is an example configuration file:

[ahv]
type=ahv
hypervisor_id=hostname
owner=RedHatAHVOrg01
#env=Library
server=ip.addr.of.prism
prism_central=true
update_interval=1800
username=satellitesvcaccount
encrypted_password=
rhsm_hostname=satellite.domain.net
rhsm_username=virt_whosvc
rhsm_encrypted_password=
rhsm_prefix=/rhsm
#internal_debug=true

• After saving this file, you should now be able to test your configuration to make sure everything is working.
• The agent can be run in on of the following modes:
  • One shot mode to report the VM-to-host mapping to Satellite one time only.
    • $ virt-who -o
  • Continuous mode
    • $ virt-who

At this point everything should be working. You may see some warnings. Some may require some additional configuration to resolve, others may be benign. You'll have to sort through any warnings and decide if they need additional remediation or not.

In this article, I intend to walk through the basics of setting up an initial test controller node on CentOS 7, as well as a simple configuration of a Windows Server 2016 node using a basic Ansible playbook. (perhaps building multiple playbooks for different tasks)

This is my first dive into learning Ansible, and my intent here is to share my experience, and hopefully help you start a simple Ansible environment which you can build and grow from.

Windows and Ansible documentation is located in the official Ansible documentation website.

By following the instructions in this series, you will be able to manage a Windows Server 2016 systems using Ansible as easily as managing any Linux environment.

I intend this article to be a gateway to multiple in a series which possibly will progress into a fully functional production environment. However for just this one instance, I'm simply going to focus on building a sandbox/development environment to learn some basics, then use this as a spring board to expand off of.

Lab Environment

The examples in this article will reference the following configuration:

• One Ansible controller node running CentOS 7
  • For my dev environment, I'm simply using a spare desktop PC I have.
• One Windows 2016 Server to be managed by Ansible
  • I'm using our lab environment, with a virtual machine on vmware esxi 5.5. ( I know, I know.. this is lab... sheesh.)
• One Active Directory Server providing DNS (This can be a standalone just for this environment, or an existing one, as long as you have admin access)

NOTE - You can configure these however you want. however they should be accessible to each other, and you may need to validate firewall settings allow access.

Configure Network Prerequisites

We'll need to create some Forward and Reverse lookup records in DNS for Kerberos to resolve correctly, so make sure you created an "A" record for your linux system, (you can also leverage an "alias" record if you'd like) - as well as a reverse DNS pointer. You decide what fits best in your environement.

Build and configure the Ansible System

NOTE - For the sake of brevity, I will not be coving the build of the Operating System and I am assuming that you have built a base CentOS 7 with a minimum configuration, set the IP address details, and enabled SSH access.

Install Prerequisite Packages

Update the following files. Be sure to modify as appropriate for your own environment.

1. Install GCC required for Kerberos

yum -y group install “Development Tools”

2. Install EPEL Repository

yum -y install epel-release

3. Install Ansible

yum -y install ansible

4. Install Kerberos

yum -y install python-devel krb5-devel krb5-libs krb5-workstation

5. Install Pythos PIP

yum -y install python-pip

6. Update all the system packages to insure everything is at the latest version.

yum -y update

After an full system update, I always find it a good idea to reboot the system, so go ahead and do that now.

reboot

Check that Ansible and Python is Installed and working

ansible --version | head -n 1
python --version

Configure Kerberos

While there are other options to authenticate with Windows guests, Kerberos is generally the best option to utilize in an Active Directory domain.

1. Install the Kerberos PIP Package.

pip install pywinrm[Kerberos]

2. Edit the /etc/krb5.conf file and add the following:

NOTE - Make sure to adjust these to your specific environment. Also make note that I am specifying the domain name is all UPPER CASE LETTERS. This is due to kerberos naming standards. Make sure this is all upper case, as well, when testing, pass the domain name as all upper case or you may get errors.

These following articles explain in greater detail.

• https://www.centos.org/forums/viewtopic.php?f=31&t=36729&p=165954&hilit=kinit%3A+KDC+reply+did+not+match+expectations+while+getting+initial#p165954
• https://access.redhat.com/solutions/871613

Add:

[realms]
DOMAIN.LOCAL = {
  kdc = DC1.DOMAIN.LOCAL
}

Add:

[domain_realm]
.domain.local = DOMAIN.LOCAL
domain.local = DOMAIN.LOCAL

Your completed /etc/krb5.conf file should look similar to this:

Test Kerberos

Run the follow to test kerberos:

kinit <username>@DOMAIN.LOCAL

Enter the password for the user you entered above.

You should see a kerberos KEYRING record similar to below:

At this point, our Ansible machine is now ready for us to start creating some playbooks to run against our windows server.

For my next article, I'll build the Windows Client to manage, and we'll setup some simple playbooks to experiment with. Additionally in the future, I'd like to delve into the Ansible AWX project, and see where that can fit in too! C

• “As a best practice, you should configure the Default Domain Policy GPO only to manage the default Account Policies settings, Password Policy, Account Lockout Policy, and Kerberos Policy“.
• “As a best practice, you should configure the Default Domain Controllers Policy GPO only to set user rights and audit policies.”
• “Do not modify the default domain policy or default domain controller policy unless necessary. Instead, create a new GPO at the domain level and set it to override the default settings in the default policies.”

dcgpofix /ignoreschema /target:Domain

dcgpofix /ignoreschema /target:DC

1. You have already built your physical/virtual machine
2. You have setup apache and the service is running without issue
3. You have iptables entries created to allow traffic for both http and https

   # iptables -I INPUT -p tcp -m tcp --dport 80 -j ACCEPT
   # iptables -I INPUT -p tcp -m tcp --dport 443 -j ACCEPT

4. You have installed mod_ssl and openssl by running :

   yum install mod_ssl openssl

1. After you receive the certificate from the CA, double-click on the certificate to open it. When you open the certificate, it appears as shown in the following screen shot:
2. Locate the path of the certificate on your computer and double-click on the certificate again to open it.
3. Select the Details tab.
4. Click Copy to File.
5. Click Next in the Certificate Export Wizard window.
6. Select the Base-64 encoded x.509 (.CER) option. This converts the certificate to PEM format.
7. Click Next.
8. Click Browse and select a location to store the converted PEM
9. Click Next.
10. Click Finish. After converting the certificate to PEM format, the certificate has an extension .cer.
11. To verify if the certificate is in PEM format, change the extension to .txt or .doc. The file must start with the line “ BEGIN CERTIFICATE”, as shown in the following screen shot:
12. Using WinSCP, copy the converted .pem certs to:

    /etc/pki/ca-trust/source/anchors

13. Run the following commands to import the root certs into the certificate store.

    # update-ca-trust enable

    followed by:

    # update-ca-trust extract

14. Verify the root CAs are OK

    # openssl verify LegacyIssuing.cer
    LegacyIssuing.cer: OK
    

1. # cd /tmp
   # openssl req -nodes -newkey rsa:2048 -keyout service.something.key -out service.something.csr

2. Copy the csr and key out to your windows machine via winscp.
3. Open the CA website, and request a certificate
4. Based on your specific implementation, you may need to submit an "advanced certificate request"
5. Paste the contents from the CSR file into the box
6. Retrieve the certificates from the site.

1. Copy to the following paths:

   cp service.something.cer /etc/pki/tls/certs
   cp ca.key /etc/pki/tls/private/service.something.key
   cp ca.csr /etc/pki/tls/private/service.something.csr
   

2. Update the Apache SSL configuration file :

   vi +/SSLCertificateFile /etc/httpd/conf.d/ssl.conf
   

   • Change the paths to match where the Key file is stored. If you've used the method above it will be

     SSLCertificateFile /etc/pki/tls/certs/service.something.cer

   • Then set the correct path for the Certificate Key File a few lines below. If you've followed the instructions above it is:

     SSLCertificateKeyFile /etc/pki/tls/private/service.something.key
     

3. Finally, Quit and save the file and then restart apache

   service httpd restart

• What's new and upcoming in AD FS to securely sign-in your users to Office 365 and other applications
  • This session discusses incorporating new features from AD FS (Active Directory Federation Services) to be able to login from any location and any type of device.
    • Of interest was the discussion on supporting Windows Hello through ADFS.
  • https://youtu.be/set0NwKRW7c
  • Slide Deck
• Accelerate your digital transformation with SharePoint and OneDrive
  • This session is a high level road map on Sharepoint and Onedrive for business. Also discussed are new features coming to both products in the near future.
  • https://youtu.be/fuo8ufWE_IQ
  • Slide Deck
• Automate all things! Microsoft Azure continuous deployment
  • This session discussed and provided an example of setting up a release pipeline workflow to develop in Visual Studio, and promote to Azure leveraging Microsoft Visual Studio Team Services.
    • Great demo of using Team Services to setup CI, which shows a build process, and all of the features available within Team Services.
  • https://youtu.be/QgkiK961t5w
  • Slide Deck
• Manage hybrid cloud and transform your workplace with PowerShell and Azure Automation
  • In-depth discussions on how to use Azure PowerShell on Windows, macOS, Linux, or from your browser with the Azure Cloud Shell.
    • Automation is essential for DevOps
  • https://youtu.be/oOiwcN6DAwQ
  • Slide Deck
• Defense against the dark (cloud) arts: Azure security deep dive
  • Session covers the Microsoft Azure Cloud Security Platform.
    • Fantastic demos of a hack in progress, and how its mitigated.
    • Shows how to use Azure security center to create security policy for patching and protection
    • Shows how to leverage Office 365 Security and Compliance Center
  • https://youtu.be/avW67hLSOEQ
  • Slide Deck
• Deploying and Managing Skype Room Systems and Microsoft certified devices
  • This in-depth session also walks through the details of how to properly set up your overall environment.
    • Also discussed specifics on tuning the room, and sizing the proper solution
  • https://youtu.be/yJln8gSbNvo
  • Slide Deck
• Build your personalized and social intranet with SharePoint, Yammer, Delve, OneDrive and Teams
  • Hear how other companies built their intelligent intranets and learn how to use capabilities of SharePoint, OneDrive, Office Delve, Yammer, Microsoft Teams to create cohesive experiences.
    • Hub sites, themes and site design
    • Biz Apps, Flow integration to pipe data into pages
    • Story from Rick Garcia, United Airlines - Building 2016 on-prem farm, upgrading from SP 2010.
    • Story from Brian Duke, Thermo Fisher - Building new intranet
    • Story from Greg Nemeth, EY - Business transformation, vision for 2020 and beyond
  • https://youtu.be/N2V8L4U5cCs
  • Slide Deck
• Case of the unexplained: Windows troubleshooting with Mark Russinovich
  • Finally, always a favorite of mine. In this session, see case studies on how to resolve system and application issues using the Systernals tools.
    • Uses the following tools: Process Explorer, Process Monitor, and Windows Debugger.
  • https://youtu.be/qouxznNC2XU
  • Slide Deck

List of the other sessions I had interest in, but couldn't make it.

• Anti-phishing with Office 365 Advanced Threat Protection
• Azure hold'em DevOps
• Azure Networking inside and out
• Build a modern intranet: Real-world planning, information architecture, governance, and adoption
• Build your personalized and social intranet with SharePoint, Yammer, Delve, OneDrive and Teams
• Continuous delivery on Microsoft Azure using Visual Studio Team Services
• Datacenter transformation – a roadmap for platforms, processes, and people
• Deep-dive: Azure Active Directory Authentication and Single-Sign-On
• Empower IT and developer productivity with Microsoft Azure
• Expert-level Windows 10 deployment
• Inside Exchange Online
• Inside Microsoft Azure datacenter hardware and software architecture with Mark Russinovich
• Learn best practices for SharePoint site owners
• Manage SharePoint and OneDrive in Office 365: A field guide for administrators
• Microsoft System Center 2016 in action: Customer use cases to implement today
• Microsoft Azure and Office 365 together: The modern business development platform
• Learn about our vision and upcoming innovations for Microsoft Remote Desktop Services
• Locking down access to the Azure Cloud using SSO, Roles Based Access Control, and Conditional Access
• Implement best practices with Office 365 Groups
• The secrets to getting the best experience out of SharePoint Online
• The Sysinternals tools make you better at your job

What is the session catalog?

1. Open forum Q/A, where the presenter launches the topic, and essentially asks for the participants to ask questions.
2. Presentation style, where the presenter simply talks about the session topic and may or may not take questions
3. A guest panel. A panel is when 2 or more experts on the topic, will round table discuss their experience with the topic, and usually do Q/A with the attendees.

What is the session builder/scheduler?

How do I use the session builder?

So how do I pick the sessions I want to see?

So to summarize:

• The session catalog/builder is located on the MyIgnite website. You can also locate it via the Microsoft Ignite website here.
• Do you have a question about a specific session, reach out to Microsoft via Twitter @MS_Ignite, or use the Microsoft Tech Communities - These locations are really good at getting back to people with questions about the conference. I asked a question via Twitter, when they were making the session catalog available, and they got back to me within the day. yay!
• Watch the twitter feed and tech community for opportunities to meet up, and join into small round table discussions.
• Keep an eye open for opportunities to join focus groups. If you receive an invitation to attend one, I'd highly encourage you to participate! These are great opportunities to ask questions and provide feedback to developers/engineers for a specific product. Its also a great opportunity to network with others.
• Don't worry about scheduling more than one session per time slot! While you obviously can't be in multiple places at once, you may arrive to find a session room is full, or a session earlier in the day may leave you wanting more info on that topic in the afternoon. After the conference is over, you can always watch the sessions you missed on-demand via the myignite website.
• Don't worry about gaps in your schedule. You will want to leave time open to participate in Hands-on-Labs, networking with other attendee's, and perusing the expo. Hands-on Labs are fun, self-paced, training, where you can experiment with different Microsoft tools, software, or solutions. You can work them into your schedule around any sessions on your list.
• Finally - Remember, adding a session or lab to your agenda does not guarantee you a seat in the room. Seating is on a first-come, first-served basis.

Grub

Restaurants Near Microsoft Ignite 2017

1. Anthony's Coal Fired Pizza
2. Fogo De Chao
3. Spencer's
4. Bonefish Grill
5. Yard House

Anthony's Coal Fired Pizza

Fogo De Chao

Spencer's

Bonefish Grill

Yard House

Summary

Purchasing Airline Tickets for Microsoft Ignite 2017

• CLEAR - $179 annually.
• TSA PreCheck - $85 and is good for 5 years.

Transportation

Airport

Convention Center

Summary

Microsoft Ignite 2017 Costs and Opportunities

Full Conference Pass - $2,220

Convenience Pass - $490

Women in Tech Pre-Day Session - $199

Pre-day Training - $500

Discounts

Single-Day Pass - $350 / Sessions and Expo Pass - $500

Accommodations

To Recap

The Purpose of this Series

• Cover the several months of planning and preparations leading up to the Microsoft Ignite 2017 conference
• Inform you of the essentials
• Provide information from the sessions I attended during the conference

/opt/microsoft/scx/bin/tools/scxsslconfig –h server –d domain.com -f –v

/opt/microsoft/scx/bin/tools/scxadmin –restart