Azure

Firstly the final scripts of all the content discussed are available here. A video walkthrough is available at https://youtu.be/7bobbg91cQc and included below.

In this post I want to document the results of a POC (proof of concept) I was engaged in for a very large customer. The customer wanted to create single/multi VM environments in Azure for dev/test/QA purposes. The goal was a single command execution that would create the VM and in this case make it a domain controller, install SQL Server 2012 then install SharePoint 2010. For this scenario I decided to use PowerShell rather than JSON just to demonstrate the PowerShell approach since there are already many JSON templates in the gallery around SharePoint deployment.

To enable this solution the high level workflow would be:

Create a new resource group and in that create a new storage account and virtual network (since each environment was to be isolated and by placing in their own resource group the lifecycle management, i.e. deletion, would be simple)
Create a new VM using the created resources
Execute PowerShell inside the VM via the Azure VM Agent to promote the VM to a domain controller then reboot it
After the reboot execute additional PowerShell to create accounts, open firewall exceptions, install SQL Server 2012 then install SharePoint 2010

The unattended installation of a domain controller via PowerShell is very simple. Below is an example that creates a pocdom.local domain.

Import-Module "Servermanager" #For Add-WindowsFeature
Add-WindowsFeature AD-Domain-Services, DNS -IncludeManagementTools

$netbiosname = 'POCDom'
$fqdomname = 'pocdom.local'
$NTDSPath = 'e:ntds'
$NTDSLogPath = 'e:ntdslogs'
$SYSVOLPath = 'e:sysvol'

$SafePassPlain = 'Pa55word'
$SafePass = ConvertTo-SecureString -string $SafePassPlain `
    -AsPlainText -force
  
Install-ADDSForest -DomainName $fqdomname -DomainNetBIOSName $netbiosname `
	-SafemodeAdministratorPassword $SafePass -SkipPreChecks `
	-InstallDNS:$true -SYSVOLPath $SysvolPath -DatabasePath $NTDSPath -LogPath $NTDSLogpath `
	-Force

Import-Module "Servermanager" #For Add-WindowsFeature

Add-WindowsFeature AD-Domain-Services, DNS -IncludeManagementTools

$netbiosname = 'POCDom'

$fqdomname = 'pocdom.local'

$NTDSPath = 'e:ntds'

$NTDSLogPath = 'e:ntdslogs'

$SYSVOLPath = 'e:sysvol'

$SafePassPlain = 'Pa55word'

$SafePass = ConvertTo-SecureString -string $SafePassPlain `

-AsPlainText -force

Install-ADDSForest -DomainName $fqdomname -DomainNetBIOSName $netbiosname `

-SafemodeAdministratorPassword $SafePass -SkipPreChecks `

-InstallDNS:$true -SYSVOLPath $SysvolPath -DatabasePath $NTDSPath -LogPath $NTDSLogpath `

-Force

You will notice in the code I write the AD to the E: drive. This is because in Azure the OS disk by default is read/write cache enabled which is not desirable for databases. Therefore for the VM I add two data disks with no caching; one for AD and one for SQL and SharePoint. The code below is what I use to change the drive letter of the DVD device then initialize and format the two data disks.

#Bring data disks online and initialize them
Get-Disk | Where-Object PartitionStyle –Eq "RAW"| Initialize-Disk -PartitionStyle GPT   
#Change CD drive letter
$drv = Get-WmiObject win32_volume -filter 'DriveLetter = "E:"'
$drv.DriveLetter = "L:"
$drv.Put() | out-null
                    
Get-Disk -Number 2 | New-Partition -UseMaximumSize -DriveLetter E | Format-Volume -FileSystem NTFS -NewFileSystemLabel "Data1" -Confirm:$False      
Get-Disk -Number 3 | New-Partition -UseMaximumSize -DriveLetter F | Format-Volume -FileSystem NTFS -NewFileSystemLabel "Data2" -Confirm:$False

#Bring data disks online and initialize them

Get-Disk | Where-Object PartitionStyle –Eq "RAW"| Initialize-Disk -PartitionStyle GPT

#Change CD drive letter

$drv = Get-WmiObject win32_volume -filter 'DriveLetter = "E:"'

$drv.DriveLetter = "L:"

$drv.Put() | out-null

Get-Disk -Number 2 | New-Partition -UseMaximumSize -DriveLetter E | Format-Volume -FileSystem NTFS -NewFileSystemLabel "Data1" -Confirm:$False

Get-Disk -Number 3 | New-Partition -UseMaximumSize -DriveLetter F | Format-Volume -FileSystem NTFS -NewFileSystemLabel "Data2" -Confirm:$False

The two pieces of code above would be combined into the first boot PowerShell code (with the disk initialization block before the DC promotion code). Once the reboot has completed firewall exceptions for SQL and SharePoint need to be enabled.

New-NetFirewallRule -DisplayName "MSSQL ENGINE TCP" -Direction Inbound -LocalPort 1433 -Protocol TCP -Action Allow
New-NetFirewallRule -DisplayName "SharePoint TCP 2013" -Direction Inbound -LocalPort 2013 -Protocol TCP -Action Allow

1 2	New-NetFirewallRule -DisplayName "MSSQL ENGINE TCP" -Direction Inbound -LocalPort 1433 -Protocol TCP -Action Allow New-NetFirewallRule -DisplayName "SharePoint TCP 2013" -Direction Inbound -LocalPort 2013 -Protocol TCP -Action Allow

Next I need the SQL Server and SharePoint media along with unattended commands to install. I decided to use Azure Files as the store for the installation media. Azure Files presents an SMB file share to the VMs with only the storage account key and name required to access. In my example I place this in the PowerShell script however it could also be injected in at runtime or stored more securely if required. Create a storage account then create an Azure Files share through the portal and take a note of the access key and storage account name.

Into this share I will copy the SQL Server and SharePoint installation files. The easiest way to upload content is using the free Azure Storage Explorer tool from http://storageexplorer.com/.

Now the details of performing unattended installations of SQL and SharePoint are outside the scope of this write-up as the goal for this is more how to install applications through Azure IaaS PowerShell however at a very high level:

To install SQL Server unattended simply requires a configuration file which can be generated by running through the graphical SQL Server setup and on the last page it will show you the location of the configuration file it will use for installation. Simply copy this file and cancel the installation. Copy the SQL Setup structure and the configuration file to the Azure Files share. I place the ConfigurationFile.ini in a separate Assets folder on the share. Then use that setup file with the SQL setup.exe, for example

.'X:SQLServer2012SP3Setup.exe' /ConfigurationFile="C:AssetsConfigurationFile.ini"

1

.'X:SQLServer2012SP3Setup.exe' /ConfigurationFile="C:AssetsConfigurationFile.ini"
For the SharePoint unattended installation I used the autospinstaller solution which is fully documented at https://autospinstaller.com/ and includes a web based site to create the unattended answer file used by the program. Follow the instructions on the site and copy the resulting structure to the Azure Files share.

My resulting Azure Files share consists therefore of 3 folders:

AutoSPInstaller – The SharePoint installation media and AutoSPInstaller solution
POCAzureScripts – The SQL configuration script
SQLServer2012SP3 – SQL Server installation media

To map to the share, copy the content, trigger the SQL Server installation from the share, dismount the share then trigger the SharePoint installation I use the following (which also adds an account named Administrator as that was a requirement). I would add the firewall exception creation to this code as the secondboot PowerShell file. You will notice I wait for 40 minutes at the end for the SharePoint installation to complete. I run the SharePoint install as a separate, asynchronous job as at the end it asks for key presses to continue so this avoids trying to handle that and after a reboot that will all get cleared up.

#Add domain admin called Administrator
New-ADUser -Name 'administrator' -GivenName 'admin' -Surname 'istrator' `
    -SamAccountName 'administrator' -UserPrincipalName 'administrator@pocdom.local' `
    -AccountPassword (ConvertTo-SecureString -AsPlainText 'Pa55word' -Force) `
    -Enabled $true

Add-ADGroupMember 'Domain Admins' administrator

$storkey = '<storage key>'
New-SmbMapping -LocalPath X: -RemotePath \<storage account name>.file.core.windows.netpocassets -username 'sascuspocstdstor' -Password $storkey

#SharePoint Setup files
Copy-Item -Recurse -Path X:AutoSPInstaller -Destination C:Assets
#Configuration files that make up SQL and SharePoint install including the SharePoint backup
Copy-Item -Recurse -Path X:POCAzureScripts* -Destination C:Assets

#SQL Install
.'X:SQLServer2012SP3Setup.exe' /ConfigurationFile="C:AssetsConfigurationFile.ini"

Remove-SmbMapping -LocalPath X: -Force

#SharePoint Install
$AccountsToCreate = @("SP_CacheSuperUser","SP_CacheSuperReader","SP_Services","SP_PortalAppPool","SP_ProfilesAppPool","SP_SearchService","SP_SearchContent","SP_ProfileSync")

foreach($account in $AccountsToCreate)
{
  New-ADUser -Name $account -GivenName $account -Surname $account `
    -SamAccountName $account -UserPrincipalName $account@pocdom.local `
    -AccountPassword (ConvertTo-SecureString -AsPlainText 'Pa55word' -Force) `
    -Enabled $true
}

#Perform the actual install
$SPInstallJob = Start-Job -ScriptBlock {C:AssetsSPAutoSPInstallerAutoSPInstallerLaunch.bat}
Start-Sleep -Seconds 2400 #wait for 40 minutes for above to complete

#Add domain admin called Administrator

New-ADUser -Name 'administrator' -GivenName 'admin' -Surname 'istrator' `

-SamAccountName 'administrator' -UserPrincipalName 'administrator@pocdom.local' `

-AccountPassword (ConvertTo-SecureString -AsPlainText 'Pa55word' -Force) `

-Enabled $true

Add-ADGroupMember 'Domain Admins' administrator

$storkey = '<storage key>'

New-SmbMapping -LocalPath X: -RemotePath \<storage account name>.file.core.windows.netpocassets -username 'sascuspocstdstor' -Password $storkey

#SharePoint Setup files

Copy-Item -Recurse -Path X:AutoSPInstaller -Destination C:Assets

#Configuration files that make up SQL and SharePoint install including the SharePoint backup

Copy-Item -Recurse -Path X:POCAzureScripts* -Destination C:Assets

#SQL Install

.'X:SQLServer2012SP3Setup.exe' /ConfigurationFile="C:AssetsConfigurationFile.ini"

Remove-SmbMapping -LocalPath X: -Force

#SharePoint Install

$AccountsToCreate = @("SP_CacheSuperUser","SP_CacheSuperReader","SP_Services","SP_PortalAppPool","SP_ProfilesAppPool","SP_SearchService","SP_SearchContent","SP_ProfileSync")

foreach($account in $AccountsToCreate)

{

New-ADUser -Name $account -GivenName $account -Surname $account `

-SamAccountName $account -UserPrincipalName $account@pocdom.local `

-AccountPassword (ConvertTo-SecureString -AsPlainText 'Pa55word' -Force) `

-Enabled $true

}

#Perform the actual install

$SPInstallJob = Start-Job -ScriptBlock {C:AssetsSPAutoSPInstallerAutoSPInstallerLaunch.bat}

Start-Sleep -Seconds 2400 #wait for 40 minutes for above to complete

At this point I have a firstboot.ps1 and a secondboot.ps1 file. Upload those files into blobs in a container named scripts in the same storage account as the Azure Files. These files will be used as part of the total VM provisioning process.

The final part is to create the VM and use the PowerShell created. In the example code below I create all the resources and use premium storage accounts to maximum performance however any of these parameters can be changed to meet requirements. In the code replace the <storage account name for assets> with the storage account created holding the Azure Files and blob content along with its key. Also change the VM name to something unique since a public IP name will be generated based on this name. If you will deploy this many times add some logic to include some random sequence or perhaps the requesting username. Also include that as part of the resource group, storage account etc name.

#Setup a filter to timestamp logs
filter timestamp {"$(Get-Date -Format G): $_"}

#Create Resources for new deployment
Write-Output "Setting up VM resources and variables" | timestamp
$RGName = 'RGUSSCPOC1'
$SAName = 'saussclrspremstor1'
$SASKU = 'Premium_LRS'
$Location = 'southcentralus'

$VirtNetName = 'VNUSSCVNPOC1'

$VMName = '<something unique>'
$VMSize ="Standard_DS2"
#Get latest image
$AzureImageSku = Get-AzureRmVMImage -Location $Location -PublisherName "MicrosoftWindowsServer" -Offer "WindowsServer" -Skus "2012-R2-Datacenter"
$AzureImageSku = $AzureImageSku | Sort-Object Version -Descending #put the newest first which is the highest patched version
$AzureImage = $AzureImageSku[0] #Newest


#Create Resource Group
New-AzureRmResourceGroup -Name $RGName -Location $Location

#Create Storage Account
New-AzureRmStorageAccount -ResourceGroupName $RGName -StorageAccountName $SAName -Location $Location -Type $SASKU

#Create a Virtual Network
$subnet = New-AzureRmVirtualNetworkSubnetConfig -Name 'StaticSub' -AddressPrefix "10.10.1.0/24"
$vnet = New-AzureRmVirtualNetwork -Force -Name $VirtNetName -ResourceGroupName $RGName `
    -Location $Location -AddressPrefix "10.10.0.0/16" -Subnet $subnet # -DnsServer "10.10.1.10" don't set yet
#If VM points to itself and not offering DNS yet the agents will hang during install

#Create VM
$vm = New-AzureRmVMConfig -VMName $VMName -VMSize $VMSize
#Create NIC
#For demo for easy access give a public IP
$pip = New-AzureRmPublicIpAddress -ResourceGroupName $RGName -Name ('PubIP' + $VMName) `
    -Location $Location -AllocationMethod Dynamic -DomainNameLabel $vmname.ToLower()
$nic = New-AzureRmNetworkInterface -Force -Name ('nic' + $VMName) -ResourceGroupName $RGName `
    -Location $Location -SubnetId $vnet.Subnets[0].Id -PrivateIpAddress 10.10.1.10 `
    -PublicIpAddressId $pip.Id
$vm = Add-AzureRmVMNetworkInterface -VM $vm -Id $nic.Id

$osDiskName = $VMName+'-OSDisk'
$osDiskCaching = 'ReadWrite'
$osDiskVhdUri = "https://$SAName.blob.core.windows.net/vhds/"+$VMName+"-OS.vhd"

# Setup OS & Image
$user = "localadmin"
$password = 'Pa55word'
$securePassword = ConvertTo-SecureString $password -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential ($user, $securePassword)  
$vm = Set-AzureRmVMOperatingSystem -VM $vm -Windows -ComputerName $VMName -Credential $cred
$vm = Set-AzureRmVMSourceImage -VM $vm -PublisherName $AzureImage.PublisherName -Offer $AzureImage.Offer -Skus $AzureImage.Skus -Version $AzureImage.Version
$vm = Set-AzureRmVMOSDisk -VM $vm -VhdUri $osDiskVhdUri -name $osDiskName -CreateOption fromImage -Caching $osDiskCaching

$vm = Set-AzureRmVMBootDiagnostics -VM $vm -Disable

#Add two data disks
$dataDisk1VhdUri = "https://$SAName.blob.core.windows.net/vhds/"+$VMName+"-Data1.vhd"
$dataDisk1Name = $VMName+'-data1Disk'
$vm = Add-AzureRmVMDataDisk -VM $vm -Name $dataDisk1Name -Caching None -CreateOption Empty -DiskSizeInGB 127 -VhdUri $dataDisk1VhdUri -Lun 1
$dataDisk2VhdUri = "https://$SAName.blob.core.windows.net/vhds/"+$VMName+"-Data2.vhd"
$dataDisk2Name = $VMName+'-data2Disk'
$vm = Add-AzureRmVMDataDisk -VM $vm -Name $dataDisk2Name -Caching None -CreateOption Empty -DiskSizeInGB 512 -VhdUri $dataDisk2VhdUri -Lun 2

# Create Virtual Machine
Write-Output "Creating the VM" | timestamp
$NewVM = New-AzureRmVM -ResourceGroupName $RGName -Location $Location -VM $vm 
Write-Output "VM creation complete" | timestamp

#Now make a DC by running the first boot script
$ScriptBlobAccount = "<storage account name for assets>"
$ScriptBlobKey = "<storage key>"
$ScriptBlobURL = "https://<storage account name for assets>.blob.core.windows.net/scripts/"
&nbsp;
$ScriptName = "FirstBoot.ps1"
$ExtensionName = 'FirstBootScript'
$ExtensionType = 'CustomScriptExtension' 
$Publisher = 'Microsoft.Compute'&nbsp;&nbsp;
$Version = '1.8'
$timestamp = (Get-Date).Ticks
&nbsp;
$ScriptLocation = $ScriptBlobURL + $ScriptName
$ScriptExe = ".$ScriptName"
&nbsp;
$PrivateConfiguration = @{"storageAccountName" = "$ScriptBlobAccount";"storageAccountKey" = "$ScriptBlobKey"} 
$PublicConfiguration = @{"fileUris" = [Object[]]"$ScriptLocation";"timestamp" = "$timestamp";"commandToExecute" = "powershell.exe -ExecutionPolicy Unrestricted -Command $ScriptExe"}
&nbsp;
Write-Output "Injecting First Boot PowerShell" | timestamp
Set-AzureRmVMExtension -ResourceGroupName $RGName -VMName $VMName -Location $Location `
 -Name $ExtensionName -Publisher $Publisher -ExtensionType $ExtensionType -TypeHandlerVersion $Version `
 -Settings $PublicConfiguration -ProtectedSettings $PrivateConfiguration
&nbsp;
((Get-AzureRmVM -Name $VMName -ResourceGroupName $RGName -Status).Extensions | Where-Object {$_.Name -eq $ExtensionName}).Substatuses

Write-Output "Waiting 5 minutes for reboot to complete" | timestamp
Start-Sleep -Seconds 300 #Wait 5 minutes

#Have to remove the previous before creating a new one
Remove-AzureRmVMExtension -ResourceGroupName $RGName -VMName $VMName -Name FirstBootScript -Force

#Now run the second boot script to install SQL and SharePoint
$ScriptName = "SecondBoot.ps1"
$ExtensionName = 'SecondBootScript'
$timestamp = (Get-Date).Ticks
&nbsp;
$ScriptLocation = $ScriptBlobURL + $ScriptName
$ScriptExe = ".$ScriptName"
&nbsp;
$PrivateConfiguration = @{"storageAccountName" = "$ScriptBlobAccount";"storageAccountKey" = "$ScriptBlobKey"} 
$PublicConfiguration = @{"fileUris" = [Object[]]"$ScriptLocation";"timestamp" = "$timestamp";"commandToExecute" = "powershell.exe -ExecutionPolicy Unrestricted -Command $ScriptExe"}
&nbsp;
Write-Output "Injecting Second Boot PowerShell" | timestamp
Set-AzureRmVMExtension -ResourceGroupName $RGName -VMName $VMName -Location $Location `
 -Name $ExtensionName -Publisher $Publisher -ExtensionType $ExtensionType -TypeHandlerVersion $Version `
 -Settings $PublicConfiguration -ProtectedSettings $PrivateConfiguration
&nbsp;
((Get-AzureRmVM -Name $VMName -ResourceGroupName $RGName -Status).Extensions | Where-Object {$_.Name -eq $ExtensionName}).Substatuses

Remove-AzureRmVMExtension -ResourceGroupName $RGName -VMName $VMName -Name SecondBootScript -Force

Write-Output "Installation complete" | timestamp

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

#Setup a filter to timestamp logs

filter timestamp {"$(Get-Date -Format G): $_"}

#Create Resources for new deployment

Write-Output "Setting up VM resources and variables" | timestamp

$RGName = 'RGUSSCPOC1'

$SAName = 'saussclrspremstor1'

$SASKU = 'Premium_LRS'

$Location = 'southcentralus'

$VirtNetName = 'VNUSSCVNPOC1'

$VMName = '<something unique>'

$VMSize ="Standard_DS2"

#Get latest image

$AzureImageSku = Get-AzureRmVMImage -Location $Location -PublisherName "MicrosoftWindowsServer" -Offer "WindowsServer" -Skus "2012-R2-Datacenter"

$AzureImageSku = $AzureImageSku | Sort-Object Version -Descending #put the newest first which is the highest patched version

$AzureImage = $AzureImageSku[0] #Newest

#Create Resource Group

New-AzureRmResourceGroup -Name $RGName -Location $Location

#Create Storage Account

New-AzureRmStorageAccount -ResourceGroupName $RGName -StorageAccountName $SAName -Location $Location -Type $SASKU

#Create a Virtual Network

$subnet = New-AzureRmVirtualNetworkSubnetConfig -Name 'StaticSub' -AddressPrefix "10.10.1.0/24"

$vnet = New-AzureRmVirtualNetwork -Force -Name $VirtNetName -ResourceGroupName $RGName `

-Location $Location -AddressPrefix "10.10.0.0/16" -Subnet $subnet # -DnsServer "10.10.1.10" don't set yet

#If VM points to itself and not offering DNS yet the agents will hang during install

#Create VM

$vm = New-AzureRmVMConfig -VMName $VMName -VMSize $VMSize

#Create NIC

#For demo for easy access give a public IP

$pip = New-AzureRmPublicIpAddress -ResourceGroupName $RGName -Name ('PubIP' + $VMName) `

-Location $Location -AllocationMethod Dynamic -DomainNameLabel $vmname.ToLower()

$nic = New-AzureRmNetworkInterface -Force -Name ('nic' + $VMName) -ResourceGroupName $RGName `

-Location $Location -SubnetId $vnet.Subnets[0].Id -PrivateIpAddress 10.10.1.10 `

-PublicIpAddressId $pip.Id

$vm = Add-AzureRmVMNetworkInterface -VM $vm -Id $nic.Id

$osDiskName = $VMName+'-OSDisk'

$osDiskCaching = 'ReadWrite'

$osDiskVhdUri = "https://$SAName.blob.core.windows.net/vhds/"+$VMName+"-OS.vhd"

# Setup OS & Image

$user = "localadmin"

$password = 'Pa55word'

$securePassword = ConvertTo-SecureString $password -AsPlainText -Force

$cred = New-Object System.Management.Automation.PSCredential ($user, $securePassword)

$vm = Set-AzureRmVMOperatingSystem -VM $vm -Windows -ComputerName $VMName -Credential $cred

$vm = Set-AzureRmVMSourceImage -VM $vm -PublisherName $AzureImage.PublisherName -Offer $AzureImage.Offer -Skus $AzureImage.Skus -Version $AzureImage.Version

$vm = Set-AzureRmVMOSDisk -VM $vm -VhdUri $osDiskVhdUri -name $osDiskName -CreateOption fromImage -Caching $osDiskCaching

$vm = Set-AzureRmVMBootDiagnostics -VM $vm -Disable

#Add two data disks

$dataDisk1VhdUri = "https://$SAName.blob.core.windows.net/vhds/"+$VMName+"-Data1.vhd"

$dataDisk1Name = $VMName+'-data1Disk'

$vm = Add-AzureRmVMDataDisk -VM $vm -Name $dataDisk1Name -Caching None -CreateOption Empty -DiskSizeInGB 127 -VhdUri $dataDisk1VhdUri -Lun 1

$dataDisk2VhdUri = "https://$SAName.blob.core.windows.net/vhds/"+$VMName+"-Data2.vhd"

$dataDisk2Name = $VMName+'-data2Disk'

$vm = Add-AzureRmVMDataDisk -VM $vm -Name $dataDisk2Name -Caching None -CreateOption Empty -DiskSizeInGB 512 -VhdUri $dataDisk2VhdUri -Lun 2

# Create Virtual Machine

Write-Output "Creating the VM" | timestamp

$NewVM = New-AzureRmVM -ResourceGroupName $RGName -Location $Location -VM $vm

Write-Output "VM creation complete" | timestamp

#Now make a DC by running the first boot script

$ScriptBlobAccount = "<storage account name for assets>"

$ScriptBlobKey = "<storage key>"

$ScriptBlobURL = "https://<storage account name for assets>.blob.core.windows.net/scripts/"

$ScriptName = "FirstBoot.ps1"

$ExtensionName = 'FirstBootScript'

$ExtensionType = 'CustomScriptExtension'

$Publisher = 'Microsoft.Compute'  

$Version = '1.8'

$timestamp = (Get-Date).Ticks

$ScriptLocation = $ScriptBlobURL + $ScriptName

$ScriptExe = ".$ScriptName"

$PrivateConfiguration = @{"storageAccountName" = "$ScriptBlobAccount";"storageAccountKey" = "$ScriptBlobKey"}

$PublicConfiguration = @{"fileUris" = [Object[]]"$ScriptLocation";"timestamp" = "$timestamp";"commandToExecute" = "powershell.exe -ExecutionPolicy Unrestricted -Command $ScriptExe"}

Write-Output "Injecting First Boot PowerShell" | timestamp

Set-AzureRmVMExtension -ResourceGroupName $RGName -VMName $VMName -Location $Location `

-Name $ExtensionName -Publisher $Publisher -ExtensionType $ExtensionType -TypeHandlerVersion $Version `

-Settings $PublicConfiguration -ProtectedSettings $PrivateConfiguration

((Get-AzureRmVM -Name $VMName -ResourceGroupName $RGName -Status).Extensions | Where-Object {$_.Name -eq $ExtensionName}).Substatuses

Write-Output "Waiting 5 minutes for reboot to complete" | timestamp

Start-Sleep -Seconds 300 #Wait 5 minutes

#Have to remove the previous before creating a new one

Remove-AzureRmVMExtension -ResourceGroupName $RGName -VMName $VMName -Name FirstBootScript -Force

#Now run the second boot script to install SQL and SharePoint

$ScriptName = "SecondBoot.ps1"

$ExtensionName = 'SecondBootScript'

$timestamp = (Get-Date).Ticks

$ScriptLocation = $ScriptBlobURL + $ScriptName

$ScriptExe = ".$ScriptName"

$PrivateConfiguration = @{"storageAccountName" = "$ScriptBlobAccount";"storageAccountKey" = "$ScriptBlobKey"}

$PublicConfiguration = @{"fileUris" = [Object[]]"$ScriptLocation";"timestamp" = "$timestamp";"commandToExecute" = "powershell.exe -ExecutionPolicy Unrestricted -Command $ScriptExe"}

Write-Output "Injecting Second Boot PowerShell" | timestamp

Set-AzureRmVMExtension -ResourceGroupName $RGName -VMName $VMName -Location $Location `

-Name $ExtensionName -Publisher $Publisher -ExtensionType $ExtensionType -TypeHandlerVersion $Version `

-Settings $PublicConfiguration -ProtectedSettings $PrivateConfiguration

((Get-AzureRmVM -Name $VMName -ResourceGroupName $RGName -Status).Extensions | Where-Object {$_.Name -eq $ExtensionName}).Substatuses

Remove-AzureRmVMExtension -ResourceGroupName $RGName -VMName $VMName -Name SecondBootScript -Force

Write-Output "Installation complete" | timestamp

In this example I give the VM a public IP so it can be accessed externally and has no NSG to lock down traffic. In reality you may not want the public IP and may add the environment to existing networks with connectivity to on-premises so would connect via private IP but I added public IP to handle worst case connectivity. If you do add a public IP like this example don’t use administrator account and don’t set simple passwords and make sure you configure NSGs to at least lock down traffic. I talk about NSGs at http://windowsitpro.com/azure/network-security-groups-defined and below is example ARM PowerShell to create and add an NSG to a NIC.

$RGName = 'RGUSSCPOC1'
$Location = 'southcentralus'

#Create a new rule to allow traffic from the Internet to port 443
$NSGRule1 = New-AzureRmNetworkSecurityRuleConfig -Name 'WEB' -Direction Inbound -Priority 100 `
    -Access Allow -SourceAddressPrefix 'INTERNET'  -SourcePortRange '*' `
    -DestinationAddressPrefix '*' -DestinationPortRange '443' -Protocol TCP

#Create a new NSG using the Rule created
New-AzureRmNetworkSecurityGroup -Name "NSGFrontEnd" -Location $Location -ResourceGroupName $RGName -SecurityRules $NSGRule1 #could use array of rules or separate by comma, e.g. $Rule1, $Rule2

$NSG = Get-AzureRmNetworkSecurityGroup -Name "NSGFrontEnd" -ResourceGroupName $RGName

#Add rule to existing to allow RDP 
Add-AzureRmNetworkSecurityRuleConfig -NetworkSecurityGroup $NSG -Name 'RDP' -Direction Inbound -Priority 101 `
    -Access Allow -SourceAddressPrefix 'INTERNET'  -SourcePortRange '*' `
    -DestinationAddressPrefix '*' -DestinationPortRange '3389' -Protocol TCP
Set-AzureRmNetworkSecurityGroup -NetworkSecurityGroup $NSG #Apply the change to the in memory object

#Remove a rule
Get-AzurermNetworkSecurityGroup -Name "NSGFrontEnd" -ResourceGroupName $RGName | Remove-AzureRmNetworkSecurityRuleConfig -Name 'RDP' |
    Set-AzureRmNetworkSecurityGroup

#NSG must be same region as the resource
#Associate a NSG to a Virtual machine NIC
$NICName = 'dummyvm292'
$NIC = Get-AzureRmNetworkInterface -Name $NICName -ResourceGroupName $RGname
$NIC.NetworkSecurityGroup = $NSG
Set-AzureRmNetworkInterface -NetworkInterface $NIC

$RGName = 'RGUSSCPOC1'

$Location = 'southcentralus'

#Create a new rule to allow traffic from the Internet to port 443

$NSGRule1 = New-AzureRmNetworkSecurityRuleConfig -Name 'WEB' -Direction Inbound -Priority 100 `

-Access Allow -SourceAddressPrefix 'INTERNET' -SourcePortRange '*' `

-DestinationAddressPrefix '*' -DestinationPortRange '443' -Protocol TCP

#Create a new NSG using the Rule created

New-AzureRmNetworkSecurityGroup -Name "NSGFrontEnd" -Location $Location -ResourceGroupName $RGName -SecurityRules $NSGRule1 #could use array of rules or separate by comma, e.g. $Rule1, $Rule2

$NSG = Get-AzureRmNetworkSecurityGroup -Name "NSGFrontEnd" -ResourceGroupName $RGName

#Add rule to existing to allow RDP

Add-AzureRmNetworkSecurityRuleConfig -NetworkSecurityGroup $NSG -Name 'RDP' -Direction Inbound -Priority 101 `

-Access Allow -SourceAddressPrefix 'INTERNET' -SourcePortRange '*' `

-DestinationAddressPrefix '*' -DestinationPortRange '3389' -Protocol TCP

Set-AzureRmNetworkSecurityGroup -NetworkSecurityGroup $NSG #Apply the change to the in memory object

#Remove a rule

Get-AzurermNetworkSecurityGroup -Name "NSGFrontEnd" -ResourceGroupName $RGName | Remove-AzureRmNetworkSecurityRuleConfig -Name 'RDP' |

Set-AzureRmNetworkSecurityGroup

#NSG must be same region as the resource

#Associate a NSG to a Virtual machine NIC

$NICName = 'dummyvm292'

$NIC = Get-AzureRmNetworkInterface -Name $NICName -ResourceGroupName $RGname

$NIC.NetworkSecurityGroup = $NSG

Set-AzureRmNetworkInterface -NetworkInterface $NIC

Finally if you want to delete the entire environment just run:

Remove-AzureRmResourceGroup -ResourceGroupName $RGName -Force

1	Remove-AzureRmResourceGroup -ResourceGroupName $RGName -Force

John Savill's Corner of the Web

Computer related thoughts from John

Deploying ARM Template to Azure with GitHub Actions

Infrastructure as Code for the IT Admin

Automating deployments to Azure IaaS with custom actions