OR:

“Virtualized” Windows 2012 R2 Core LAB Server Management Caveats and Fixes, after a fresh install

From what I can tell, time always ticks forward and I love to learn. In 2015, I (still) want to keep learning Windows 2012 and also keep up with my PowerShell administration – so I’m setting up a virtual *LAB* on a single Hyper-V server. This setup is planned not to be fast, because I am not worried about speed or capacity – this LAB setup is only for learning.

After I begun planning, I noticed the Windows 2012 R2 installer say “Windows 2012 R2 Standard Core – without GUI” and I was totally stopped in my mind. In the past, I really wanted to learn server core and figure out what was the big deal behind it. I have always been a command line junky and I feel like I’ve become *too* complacent with the windows 2012 Server manager, so I’m shaking things up and keep-in’ it fresh by proceeding with the setup option: without GUI.

I ran into a couple obstacles that many people may have troubles getting past without step by step instructions. At the time I began this project I was not able to find a quick tutorial online, so I took a few minutes to go through Microsoft’s online docs. I did not have any troubles finding solutions on the MSDN and TechNet sites, so I compiled the following problems and fixing procedures during my setup.

Installing…Installed!…

Thus began my travels through the installation Wizard. There is nothing to talk about during the installation wizard because it is fast, self-explanatory, and ultra-intuitive. After the Wizard, I found myself at a Windows Command Prompt stating “C:\Users\Administrator>”…

The Windows 2012 R2 Standard Core Command Prompt, after logging in to a fresh install.

Staring at a command prompt might freak out most people, but I was intrigued and in love. No bloatware or curtains to pull back, just a singular lovely textual context screen with responsive keyboard commands.

Virtual LAB Prerequisites:

• Server Class computer with enough RAM to run the desired amount of guest operating systems.
• Windows 2012 R2 Standard Hyper-V Host
• Windows 2012 R2 Standard Core Hyper-V Guest

Software Used during this article:

• Windows 2012 R2 Standard with Hyper-V Feature Role
• Windows 2012 R2 Standard Core Hyper-V Guest
• PowerShell
• WinRM

Note: This article is focused primarily on the administrative application usage, after the operating system has been installed.

Problem Summary:

• My network is not trusted, I need more security:
  Set Hyper-v Switch networking to “Internal” or “External” in the Hypervisor
• I cannot remotely access my brand new host via IP Address over the network:
  Disable the VM guest-os firewall with PowerShell
• Server Manager is saying “Authentication error”:
  Add the VM guest-os to the Hyper-visor’s TrustedHosts with PowerShell

…Welcome to your new beginning.

When you first use Hyper-V and Windows Server 2012 Standard R2 Core without a GUI, you will be in a barren, blank, graphical wasteland. This minimalistic command line paradise feels straight forward and absolute, when you’re issuing commands.

All of the following “problems” can be solved independently, you run into them during your setup processes.

Problem #1 – My network is not trusted, I need more security:

Since this is a lab setup within an existing environment, my Hyper-visor host PC is already on another Active Directory domain. If you’re on a domain to begin with (like me), your hyper-v host will have authentication issues with any fresh installs of Windows 2012 R2 Standard, on any VM guest operating systems and I will cover this issue later in the post. Having this entire LAB within a single host make a few steps quite easy. To keep my security tight, I will be using all VM guest-os systems within an internal network. I really don’t want my systems to see the Internet, unless absolutely necessary. If any systems will need internet access after I have my lab setup, they will get access through a specific guest-os within the internal network that can firewall and route data for specific scenarios.

Solution #1:

1. Within the Hypervisor Host machine, open the Hyper-V Manager application.

2. Select the Hypervisor Host on the left column.

3. Click Action and then click on Virtual Switch Manager...
   

4. Choose "Internal Network" and click "Create Virtual Switch" 
   

5. Choose an appropriate name for your switch and click "OK" 
   

6. Right click on the Windows 2012 R2 Core VM Guest-os and click "Settings"

7. Locate the "Network Adapter" and change it to your new network switch that you created in a previous step.

8. Save your virtual machine settings and restart the VM Guest-os (or renew the IP address).

When working with an external network and an Internal network, you may run into network host resolution issues. To overcome any internal network host resolution issues, you can add static host entries into the Windows HOSTS file on the hyper-v host. The hosts file in Windows 2012 R2 is located under: %WINDIR%\System32\Drivers\etc\

Source: http://blogs.technet.com/b/jhoward/archive/2008/06/17/hyper-v-what-are-the-uses-for-different-types-of-virtual-networks.aspx

Problem #2 – I cannot remotely access my brand new host via IP Address over the network:

After the Windows 2012 R2 Core system is on the network, it has to be unlocked. Being locked means that the firewall is locking out all network access.

Solution #2:

If you’re on an external network as your Hyper-V Virtual Switch, you may want to specifically allow which ports and protocols that are allowed to pass in and out of the network card. For information on how to specifically control port access, refer to the source at the bottom of this solution. I did not follow this pattern because I am using an internal network and I have disabled the firewall completely for the time being.

1. Open PowerShell as an administrator.

2. Run the following command: Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False

3. This is a temporary solution that will reset after the computer restarts, so we need to make it permanent.

To reset the firewall and block traffic as default, run the following commands:

1. Set-NetFirewallProfile -DefaultInboundAction Block -DefaultOutboundAction Allow –NotifyOnListen True -AllowUnicastResponseToMulticast True –LogFileName %SystemRoot%\System32\LogFiles\Firewall\pfirewall.log

2. Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True

Source: https://technet.microsoft.com/library/hh831755.aspx#BKMK_ProfileGlobalDefaults

Problem #3 – Server Manager is saying “Authentication error”:

Server Manager HTTPS Authentication Error

Server Manager Notification Errors

Upon checking Server Manager on the hypervisor, was baffled when I noticed a red bar with new notifications that stated “Configuration refresh failed with the following error: The metadata failed to be retrieved from the server, due to the following error:

The WinRM client cannot process the request.

Default authentication may be used with an IP address under the following conditions: the transport is HTTPS or the desitination in the TrustedHosts list, and explicit credentials are provided. Use

winrm.cmd to configure TrustedHosts. Note that computers in the TrustedHosts list might not be authenticated. For more information on how to set TrustedHosts run the following command: winrm help config”. I decided I would continue the powershell tradition and use the Set-Item cmdlet.

Solution #3:

1. Open a powershell command prompt as an administrator.

2. Run the Set-Item cmdlet to change the a variable within wsman with the following command but, remember to put your own host in the <SERVER_NAME_HERE> portion:

3. Set-Item wsman:\localhost\Client\TrustedHosts <SERVER_NAME_HERE> -Concatenate -Force

4. Open Server Manager within the Hypervisor Host Machine.

5. If already have a server listed under your server manager, skip to step #9 too add the user credentials.

6. Click Manage and then Add Servers.

7. Click on the DNS tab.

8. Enter the Hostname or IP address of the VM Guest-os into the "Search" box and click the magnifying glass to the right.

9. Select the Host on the left hand side and use the right arrow button in the middle to inject the host on the left hand column.

10. Right click on the Hostname of the VM Guest-os and click "Manage As ..."

11. Enter the credentials to authenticate with the VM Guest-os and include the hostname, example: user@host.com, host\user, or user@hostname

Source: https://technet.microsoft.com/en-us/library/hh831453.aspx#BKMK_add

Conclusion:

As of December 2nd, 2015 – Windows 2012 R2 Core is very easy and I like it a lot. The troubles I ran into were not an obstacle to overcome and after understanding how to work with these caveats, I have opened up a deeper understanding of the Windows 2012 R2 Core offering.

Feel free to comment with suggestions, corrections, or errors.

Thanks

… – take care, That is all…

INTERNET!~ I knew it was the SD card, I knew it! The Vodafone bot vector analysis I mentioned earlier this month was correct. It’s over.

The infection of microSD cards for the HTC Magic with the Mariposa information-stealing client and other strains of malware was first reported after Vodafone Spain supplied a malware-infected Android phone to a Panda worker earlier this month. [From the register]

Users get new microSD cards. Yay, but at what cost did buying the $2 phone really bring? 3,000+ phones infecting every windows machine that they come in contact with, snap. I guess that means more you have to start using Linux or scan your new phones with a Linux machine first. Hey there’s a new service, phone virus removal…

A quick analysis of the malware reveals that it is in fact a Mariposa bot client.

Every android phone *can* be plugged into any PC or Mac via USB. Under windows it works just like any other insert digital medium (CD, DVD, Flash Drive). Upon being plugged in, it opens the folder and executes the file specified in autorun.ini. This would be the vector a bot herder/malware researcher would use to launch it’s “spread” and stay infected. As long as nobody notices the files on the phones, users would just keep getting re-infected every time they plug in their phone to download their photos. One speculation that may be responsible is: “the SD card” since all that someone would need to do is put “files” in the root of the SD card for them to execute. So the question might be instead be: “How would someone slip a file onto a flash card before it’s inserted into a phone?”.

Interestingly enough, the Mariposa bot is not the only malware I found on the Vodafone HTC Magic phone. There’s also a Confiker and a Lineage password stealing malware.

Why did it take so long for a person to notice malware on the phone? The HTC Magic is one of the most popular smart-phones in the UK. In the US, T-mobile branded this product as the “myTouch 3G“, and that phone has a massive pop. Where is the supporting evidence on the phone? The only “proof” we have so far is a few windows screen shots. I’m intrigued by this and it will be interesting to see what comes to light. I’ll keep you updated when I hear more.

In a move to stop CPU waste from processing bloated content, Virgin Airlines has trash-canned all of their FLASH content. I commend them on this move; someone needed to start the movement. Flash is bloated. End of story. There is no standard, there is no open source, and there is no relief. As soon as you start adding flash to a site, you’ve degraded the ability of the browser.

“Apple does not support Flash because it is so buggy… Whenever a Mac crashes more often than not it’s because of Flash. No one will be using Flash…The world is moving to HTML5.” — Wired

(HAHA!). But flash has it’s place, it is the best medium to deliver video on a web page and play web-games.

Hopefully, HTML5 can fix the web game problem.

Adding my own flavor to this post:

Over the technology years, flash has been metaphorically turned into a baseball bat by business owners and web publishers. This proverbial baseball bat has been beaten across every web developer’s face (repeatedly) for the last 11 years and there hasn’t been anything that the developers can do about it. You MUST specialize in flash, to make flash.

New personal hero: Ravi Simhambhatla

He has some sweet open source ideals as well.

So hilarious but; your own hope at remaining off the web…

[thanks SD]

Bioware, the masters of hype, shitty combat systems, and universes that hinge on a single guy have spat out their latest and greatest. This one’s got screen shots! Feel free to check out my opinions of the game. If, you know, you’re in to that sort of thing.

Click here to read the review.

I beat this game about a month ago, and finally decided to toss something up on the site about it. It’s a fairly short review, and since I can’t just hit my print screen button when I’m playing, there’s no screen shots, sorry. Agree or disagree (probably more of the later), give it a read. Hope you enjoy.

Click here to read the review.

Wow Sony post day. Here’s a cute and fun video that disassembles and reassembles a PSP Go in stop motion. This video is all over the blog-o-spheres so I wouldn’t doubt if you have seen it.

Smack! Looks like the PS3 has finally been hacked. The ‘researcher’ supposedly bypassed the hypervisor and gained full read/write access to all the inner workings of the long un-touched gaming console beast machine known as the Playstation 3. Sony, what’s up?

The researcher named George Hotz goes by geohot. We won’t find out soon how he did it because he’s not releasing his information yet, but you can follow the updates on the researcher’s blog or his twitter.

Shouldn’t be long now, ps3. I May have to get one!

[found at hack a day]