microsoft / azstackhcisandbox

Welcome to the easiest deployment of Azure Stack HCI, full stack of your life! With this ARM Template you will be able to deploy a working, nested Azure Stack HCI cluster with Hyper-V, Storage Spaces Direct and Software Defined Networking, all managed by Windows Admin Center. It's so simple!

Breaking News

Newly announced at Microsoft Ignite 2022 is a new partnership with the Arc Jumpstart team. Now you can build out the next generation of HCI-Sandbox in the newly announced Public Preview of Jumpstart HCIBox.

This new solution builds upon HCI-Sandbox but offers a few additonal features like:

• Automated Deployment of Azure Stack HCI Environment
• Automated Registration of Azure Stack HCI Cluster
• Automated Deployment of Azure Kubernetes Service
• Automated Deployment of Azure Arc Connected Resource Bridge for Virtual Machine Deployment via Azure

Welcome to the easiest deployment of Azure Stack HCI, full stack of your life!

With this ARM Template you will be able to deploy a working, nested Azure Stack HCI cluster with Hyper-V, Storage Spaces Direct and Software Defined Networking, all manged by Windows Admin Center. It's so simple!

The Azure Stack HCI Operator's Sandbox is a series of scripts that creates a HyperConverged environment using four nested Hyper-V Virtual Machines. The purpose of the Azure Stack HCI Operator's Sandbox is to provide operational training on Microsoft Azure Stack HCI as well as provide a development environment for DevOPs to assist in the creation and validation of some Azure Stack HCI features without the time consuming process of setting up physical servers and network routers\switches.

Azure Stack HCI Operator's Sandbox is not a production solution! The Azure Stack HCI Operator's Sandbox's scripts have been modified to work in a limited resource environment as well as in a Microsoft Azure virtual machine. Because of this, it is not fault tolerant, is not designed to be highly available, and lacks the nimble speed and resilience of a real Microsoft Azure Stack HCI deployment.

Want a deeper understanding of Deploying Azure Stack HCI, and ready to learn quickly about the components?

Deploying Azure Stack HCI

What is Azure Stack HCI?

If you've landed on this page, and you're still wondering what Azure Stack HCI 21H2 is, Azure Stack HCI 21H2 is a hyperconverged cluster solution that runs virtualized Windows and Linux workloads in a hybrid on-premises environment. Azure hybrid services enhance the cluster with capabilities such as cloud-based monitoring, site recovery, and backup, as well as a central view of all of your Azure Stack HCI 21H2 deployments in the Azure portal. You can manage the cluster with your existing tools including Windows Admin Center, System Center, and PowerShell.

Initially based on Windows Server 2019, Azure Stack HCI 21H2 is now a specialized OS, running on your hardware, delivered as an Azure service with a subscription-based licensing model and hybrid capabilities built-in. Although Azure Stack HCI 21H2 is based on the same core operating system components as Windows Server, it's an entirely new product line focused on being the best virtualization host.

If you're interested in learning more about what Azure Stack HCI 21H2 is, make sure you check out the official documentation, before coming back to continue your evaluation experience. We'll refer to the docs in various places in the guide, to help you build your knowledge of Azure Stack HCI 21H2.

Why follow this guide?

This evaluation guide will walk you through standing up a sandboxed, isolated Azure Stack HCI 21H2 environment using nested virtualization in a single Azure VM. The important takeaway here is, by following this guide, you'll lay down a solid foundation on to which you can explore additional Azure Stack HCI 21H2 scenarios in the future, so keep checking back for additional scenarios over time.

Interested in AKS on Azure Stack HCI?

If you're interested in evaluating AKS on Azure Stack HCI (AKS-HCI), and you're planning to evaluate all the solutions using nested virtualization in Azure, it's certainly tempting to run AKS-HCI on top of an Azure Stack HCI 21H2 nested cluster in an Azure VM, however we strongly discourage this approach due to the performance impact of multiple layers of nested virtualization. The recommended approach to test AKS-HCI in an Azure VM using the official AKS on Azure Stack HCI eval guide.

Evaluating in Azure

As with any infrastructure technology, in order to test, validate and evaluate the technology, there's typically a requirement for hardware. If you're fortunate enough to have multiple server-class pieces of hardware going spare (ideally hardware validated for Azure Stack HCI 21H2, found on our Azure Stack HCI 21H2 Catalog), you can certainly perform a more real-world evaluation of Azure Stack HCI 21H2.

For the purpose of this evaluation guide however, we'll be relying on nested virtualization to allow us to consolidate a full lab infrastructure, down onto a single Hyper-V host inside an Azure VM.

---

Important Note - Production Deployments

The use of nested virtualization in this evaluation guide is aimed at providing flexibility for evaluating Azure Stack HCI 21H2. For production use, Azure Stack HCI 21H2 should be deployed on validated physical hardware, of which you can find a vast array of choices on the Azure Stack HCI 21H2 Catalog.

---

Nested Virtualization

If you're not familiar with Nested Virtualization, at a high level, it allows a virtualization platform, such as Hyper-V, or VMware ESXi, to run virtual machines that, within those virtual machines, run a virtualization platform. It may be easier to think about this in an architectural view.

As you can see from the graphic, at the base layer, you have your physical hardware, onto which you install a hypervisor. In this case, for our example, we're using Windows Server 2019 with the Hyper-V role enabled. The hypervisor on the lowest level is considered L0 or the level 0 hypervisor. On that physical host, you create a virtual machine, and into that virtual machine, you deploy an OS that itself, has a hypervisor enabled. In this example, that 1st Virtualized Layer is running a nested Azure Stack HCI 21H2 operating system. This would be an L1 or level 1 hypervisor. Finally, in our example, inside the Azure Stack HCI 21H2 OS, you create a virtual machine to run a workload. This could in fact also contain a hypervisor, which would be known as the L2 or level 2 hypervisor, and so the process continues, with multiple levels of nested virtualization possible.

The use of nested virtualization opens up amazing opportunities for building complex scenarios on significantly reduced hardware footprints, however it shouldn't be seen as a substitute for real-world deployments, performance and scale testing etc.

Deployment of Azure Stack HCI 21H2 nested in Azure

For those of you who don't have multiple server-class pieces of hardware to test a full hyperconverged solution, this evaluation guide will detail using nested virtualization in Azure to evaluate Azure Stack HCI.

In this configuration, you'll take advantage of the nested virtualization support provided within certain Azure VM sizes. You'll deploy a single Azure VM running Windows Server 2019 to act as your main Hyper-V host - and through PowerShell DSC, this will be automatically configured with the relevant roles and features needed for this guide. It will also download all required binaries, and deploy 2 Azure Stack HCI 21H2 nodes, ready for clustering.

To reiterate, the whole configuration will run inside the single Azure VM.

Deploy to Azure

Prefer a video, no problem! Watch this Getting Started video to well...Get Started with the Azure Stack HCI Sandbox, and within about 2 hours you will be ready to test out Azure Stack HCI

Custom Deployment- Azure Portal

For your first step, you will want to click "Edit Parameters"

You will need to supply the Resource Group and the Admin Password still, but this is a fairly easy process.

Hit Review+Create and jump to the "After Deployment Section"

Custom Deployment - AZ PowerShell

If you are more familiar with PowerShell and would rather do the deployment in Command Line, well Awesome, that is how you should be doing this. The instructions are below:

First, you will need to login to your Azure Account in your Terminal Session.

Connect-AZAccount

Then you will need to select your Subscription

Select-AZSubscription -Subscription $subscriptionid

Following that, you will want to create a Resource Group Name Variable, something like:

$rgname="ASHCI-Sandbox"
$resourcegroup=Get-AZResourceGroup -ResourceGroupName $rgname

then you need a password, stored as a variable, don't forget it, you will need it to login to the VM we create.

$securepw=ConvertTo-SecureString -String "Password01" -AsPlainText -Force

Now store the template files as variables. Try something like

$template=".\json\azuredeploy.json"
$param=".\json\azuredeploy.parameters.json"

Phew, we are ready to deploy. Ready, here we go.

New-AzResourceGroupDeployment -ResourceGroupName $rgname -Name "ASHCISandbox-Deploy" -TemplateFile $template -TemplateParameterFile $param -AdminPassword $securepw

Give this a couple of minutes, and you will see your new VM, ASHCIHost001 if you kept the default name, in your Resource group. You can RDP to the Public IP address and then begin the deployment of the cluster, this first step was only to deploy the Host, the real fun begins next but don't worry it really is very easy.

Warning

The deployment may error out, with a warning about the DSC extension not completing due to a system shutdown. Don't worry though. That's the beauty of DSC, the configuration will run every 15 minutes.

Go grab a coffee or lunch, the components need a few minutes to download, but once you see the shortcut on the desktop, named New-AZSHCI-Sandbox, you are ready to go.

Deployment-Post Azure

Now that the Azure Resource is completed, you are ready to begin deploying the HCI cluster. The Azure VM that you just deployed is only a Nested Host, to contain all the components neccesary for this 2 node HCI cluster.

It is important to understand that by default RDP is disabled on the Public IP that is created for this Azure Virtual Machine. This is to protect the VM and your Azure Subscription, but this will prevent you from connecting to the Azure VM without using the Private IP address, and for that you will need a VPN or Peered VNet conneciton. You can alternatvily use on of the following options to connect to the VM:

Easiest Method to Connect-Enable RDP on the Network Security Group.

In the Azure Portal, naviage to the Resource Group that you created in the Deployment. Select the Network Security Group; named AzSHCILabNSG.

In the Inbound Security Rules you will see a rule labeled RDP and with a Priority of 1000. That rule has a default setting for "Action" to be Denied. The fasteds way to enable RDP to your Azure VM is to change this setting to "Allow."

Enable Just in Time Access

The most secure method is to enable Just in Time Access to the VM. This will allow the "gates of RDP" to be opened for a time-limited access for a specified range or specific IP address. This method is the most prefered option, and you will need to enable this in the Azure Portal.

Open the Virtual Machine Blade in the Azure Portal

Select Configuration

Click and Enable just-in-time access.

Enable JIT on your VMs from Microsoft Defender for Cloud

From Defender for Cloud, you can enable and configure the JIT VM access.

1. Open the Workload protections dashboard and from the advanced protection area, select Just-in-time VM access.

   The Just-in-time VM access page opens with your VMs grouped into the following tabs:

   • Configured - VMs that have been already been configured to support just-in-time VM access. For each VM, the configured tab shows:
     • the number of approved JIT requests in the last seven days
     • the last access date and time
     • the connection details configured
     • the last user
   • Not configured - VMs without JIT enabled, but that can support JIT. We recommend that you enable JIT for these VMs.
   • Unsupported - VMs without JIT enabled and which don't support the feature. Your VM might be in this tab for the following reasons:
     • Missing network security group (NSG) or Azure Firewall - JIT requires an NSG to be configured or a Firewall configuration (or both)
     • Classic VM - JIT supports VMs that are deployed through Azure Resource Manager, not 'classic deployment'. Learn more about classic vs Azure Resource Manager deployment models.
     • Other - Your VM might be in this tab if the JIT solution is disabled in the security policy of the subscription or the resource group.

2. From the Not configured tab, mark the VMs to protect with JIT and select Enable JIT on VMs.

   The JIT VM access page opens listing the ports that Defender for Cloud recommends protecting:

   • 22 - SSH
   • 3389 - RDP
   • 5985 - WinRM
   • 5986 - WinRM

   To accept the default settings, select Save.

3. To customize the JIT options:

   • Add custom ports with the Add button.
   • Modify one of the default ports, by selecting it from the list.

   For each port (custom and default) the Add port configuration pane offers the following options:

   • Protocol- The protocol that is allowed on this port when a request is approved
   • Allowed source IPs- The IP ranges that are allowed on this port when a request is approved
   • Maximum request time- The maximum time window during which a specific port can be opened

   1. Set the port security to your needs.

   2. Select OK.

4. Select Save.

Edit the JIT configuration on a JIT-enabled VM using Defender for Cloud

You can modify a VM's just-in-time configuration by adding and configuring a new port to protect for that VM, or by changing any other setting related to an already protected port.

To edit the existing JIT rules for a VM:

1. Open the Workload protections dashboard and from the advanced protection area, select Just-in-time VM access.

2. From the Configured tab, right-click on the VM to which you want to add a port, and select edit.

   

3. Under JIT VM access configuration, you can either edit the existing settings of an already protected port or add a new custom port.

4. When you've finished editing the ports, select Save.

Azure virtual machines

Enable JIT on your VMs from Azure virtual machines

You can enable JIT on a VM from the Azure virtual machines pages of the Azure portal.

Tip

If a VM already has just-in-time enabled, when you go to its configuration page you'll see that just-in-time is enabled and you can use the link to open the just-in-time VM access page in Defender for Cloud, and view and change the settings.

1. From the Azure portal, search for and select Virtual machines.

2. Select the virtual machine you want to protect with JIT.

3. In the menu, select Configuration.

4. Under Just-in-time access, select Enable just-in-time.

   This enables just-in-time access for the VM using the following default settings:

   • Windows machines:
     • RDP port 3389
     • Three hours of maximum allowed access
     • Allowed source IP addresses is set to Any
   • Linux machines:
     • SSH port 22
     • Three hours of maximum allowed access
     • Allowed source IP addresses is set to Any

5. To edit any of these values, or add more ports to your JIT configuration, use Microsoft Defender for Cloud's just-in-time page:

   1. From Defender for Cloud's menu, select Just-in-time VM access.

   2. From the Configured tab, right-click on the VM to which you want to add a port, and select edit.

      

   3. Under JIT VM access configuration, you can either edit the existing settings of an already protected port or add a new custom port.

   4. When you've finished editing the ports, select Save.

Important

The HCI Sandbox was meant to help you understand Software Defined Networking in Azure Stack HCI, but if you DO NOT want to deploy SDN or you WANT to DEPLOY AKS on HCI, you will need to EDIT the Config file BEFORE deployment. This can be done by using notepad or ISE to edit line 47 of the Config file. You will need to UPDATE the line ProvisionNC = $true to ProvisionNC = $false

This is the neccesary step to be able to Install AKS on the HCI Sandbox.

You have 2 main options for deploying the HCI cluster:

1. Build Script located on the Desktop of the Azure Virtual Machine- simply run this script and 1-2 hours later cluster should be deployed.

2. Run the script from powershell and monitor the progress. The code is available here:

   & C:\AzHCI_Sandbox\AzSHCISandbox-main\New-AzSHCISandbox.ps1

Important

If you find during the installation that something went wrong, please run the Installation Script in a PowerShell window, as this is the only way to understand the issue. If you have an issue during installation, file an Issue in GitHub for this Repo, and provide the Error Details from this process.

Once the build is complete, you will see the shortcut to RDP the Admin Center Server. You can use this to RDP your Windows 10 Workstation and begin using the HCI Sandbox.

Post Deployment - HCI Cluster Registration

One of the first steps when deploying Azure Stack HCI is registraiton of the Cluster to your Azure Subscription. You can register the cluster in a number of ways including with Windows Admin Center, instructions are available here.

For your convience a script has been added to automate that registration process. Run the code below in Powershell, you will be prompted for three additional items:

1. Login for the Contoso Domain Admin Account ( Default is "Password01)
2. Login to Azure with Device Credentials, you will see this in yellow text with a code to input to "Microsoft.com/devicelogin.
3. If you have multiple subscriptions, you will be prompted to select the subscription to register the cluster.
4. Select an Azure Region to deploy the cluster into from the list.

** Important **

Make sure your Azure AD account has the proper permissions to register the Azure Stack HCI Cluster, you can check the requirments here.

Run this from the Azure VM

& C:\AzHCI_Sandbox\AzSHCISandbox-main\Register-Cluster.ps1

After Azure Deployment

Connecting to Admin Center to Manage the Cluster

Using RDP, log into the 'Admincenter' virtual machine with your creds: User: Contoso\Administrator Password: Password01

Launch the link to Windows Admin Center

Add the Hyper-Converged Cluster AzStackCluster to Windows Admin Center with Network Controller: https://nc01.contoso.com and you're off and ready to go!

Validating the Cluster

You may follow the steps in the Microsoft documentation here, however you will not need to go through the Validate Networking part, as that validation is only necessary in a physical deployment of HCI. Since we've set up HCI in a nested virtualized environment, that validation doesn't apply to us here.

Azure Stack HCI Sandbox (2/7/2021)

The Azure Stack HCI Sandbox is a series of scripts that creates a HyperConverged environment using four nested Hyper-V Virtual Machines. The purpose of the SDN Sandbox is to provide operational training on Microsoft SDN as well as provide a development environment for DevOPs to assist in the creation and validation of SDN features without the time consuming process of setting up physical servers and network routers\switches.

SDN Sandbox is not a production solution! SDN Sandbox's scripts have been modified to work in a limited resource environment. Because of this, it is not fault tolerant, is not designed to be highly available, and lacks the nimble speed of a real Microsoft SDN deployment.

History

SDN Sandbox is a really fast refactoring of scripts that I wrote for myself to rapidly create online labs for SDN. The scripts have been stream-lined to a version that uses Windows Admin Center for the management of Microsoft SDN.

Scenarios

The SCRIPTS\Scenarios folder in this solution will be updated quite frequently with full solutions\examples of popular SDN scenarios. Please keep checking for updates!

Removing HCI Sandbox

Not that you would ever want to do this, but if you want to start over with the HCI Sandbox deployment at anytime, the Delete Command has been built into the Installation Script. Simply run the following command on your Azure VM to restore the Azure VM to pre-deployment:

  & C:\AzHCI_Sandbox\AzSHCISandbox-main\New-AzSHCISandbox.ps1 -Delet $True

Contributing

This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit https://cla.opensource.microsoft.com.

When you submit a pull request, a CLA bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., status check, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact [email protected] with any additional questions or comments.

Trademarks

This project may contain trademarks or logos for projects, products, or services. Authorized use of Microsoft trademarks or logos is subject to and must follow Microsoft's Trademark & Brand Guidelines. Use of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship. Any use of third-party trademarks or logos are subject to those third-party's policies.

Contributions & Legal Contributing This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit https://cla.opensource.microsoft.com.

When you submit a pull request, a CLA bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., status check, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact [email protected] with any additional questions or comments.

Legal Notices Microsoft and any contributors grant you a license to the Microsoft documentation and other content in this repository under the Creative Commons Attribution 4.0 International Public License, see the LICENSE file, and grant you a license to any code in the repository under the MIT License, see the LICENSE-CODE file.

Microsoft, Windows, Microsoft Azure and/or other Microsoft products and services referenced in the documentation may be either trademarks or registered trademarks of Microsoft in the United States and/or other countries. The licenses for this project do not grant you rights to use any Microsoft names, logos, or trademarks. Microsoft's general trademark guidelines can be found at http://go.microsoft.com/fwlink/?LinkID=254653.

Privacy information can be found at https://privacy.microsoft.com/en-us/

Microsoft and any contributors reserve all other rights, whether under their respective copyrights, patents, or trademarks, whether by implication, estoppel or otherwise.

azstackhcisandbox's Issues

azshci.vhdx download link doesn't work in AKS-DSC

The following URL doesn't work.

AzStackHCISandbox/AKS-DSC/ashcihost/ashcihost.ps1

Line 11 in df88a24

[String]$ashci_uri="https://ashcinested.blob.core.windows.net/vhd/AzStackHCI-21H2.vhdx?sp=r&st=2021-07-01T14:18:35Z&se=2021-07-30T22:18:35Z&spr=https&sv=2020-02-10&sr=b&sig=KV30E8YxRjS1co0bZWwmwjIEbD4aSCXsNlukLvLdack%3D",

Cannot Register the Stack HCI Cluster

Hi,
the HCI cluster was implemented successfuly and the WAC was registered successfuly, but when I tried to register the HCI cluster I face the following error:

Couldn't register Azure Stack HCI. Review the error and then try again. Name: azstackcluster.contoso.com Error: Error: RemoteException: Failed to register. Couldn't generate self-signed certificate on node(s) . Couldn't set and verify registration certificate on node(s) AzSHOST1,AzSHOST2. Make sure every clustered node is up and has Internet connectivity (at least outbound to Azure).

I confirm that internet is allowed and both HCI nodes can reach internet without any issues.

New-AzSHCISandbox.ps1 is using Test-Connection to a public IP which is blocked by Azure

I just tried to deploy a new AzSHCISandbox via New-AzSHCISandbox.ps1.

It failed with the error "test-internetConnect : Unable to connect to Internet. An Internet connection is required."

I looked at that function and noticed it is trying to do Test-Connection -ComputerName 1.1.1.1
This command is failing because Azure is blocking outbound ICMP.

As a workaround, I commented the test-internetConnect on line 3377 in New-AzSHCISandbox.ps1 and now it does work.

Couldn't load network while creating VM

When I try to create new VM on Admin Center, I got the following error.

Type
Error

Message
Couldn't load networks. Error (1) RemoteException: The specified module 'NetworkController' was not loaded because no valid module file was found in any module directory. (2) RemoteException: The specified module 'NetworkController' was not loaded because no valid module file was found in any module directory. (3) RemoteException: The term 'Get-NetworkControllerAccessControlList' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.

I cannot select created Virtual Network because of this issue.

Region selection in Register-Cluster.ps1

Is the following code correct? If so, why we need Microsoft.DesktopVirtualization resource provider?

AzStackHCISandbox/Sandbox/Register-Cluster.ps1

Lines 35 to 36 in 526fee1

	#location (all locations where HostPool can be created)
	$region=(Get-AzLocation | Where-Object Providers -Contains "Microsoft.DesktopVirtualization" | Out-GridView -OutputMode Single -Title "Please select Location for AVD Host Pool metadata").Location

I'm guessing Microsoft.AzureStackHCI is the correct resource provider.

Azure Arc Resource Bridge deployment

Would it be possible to deploy Azure Arc resource bridge in Sandbox environment to manage VMs using Azure Portal as documented at https://docs.microsoft.com/en-us/azure-stack/hci/manage/azure-arc-enabled-virtual-machines.

Azure Arc resource bridge requires certain version of PowerShell modules as per the documentation and not preconfigured as part of the sandbox deployment.

New-AzSHCISandbox errors out due to empty MountedDrive variable

Line 552: [string]$MountedDrive = (Mount-VHD -Path $path -Passthru | Get-Disk | Get-Partition | Get-Volume).DriveLetter does not return anything, resulting in $MountedDrive being empty.

This leads to Line 661: $PantherDir = Get-ChildItem -Path ($MountedDrive + ":\Windows") -Filter "Panther" throwing an error and stopping the script.

Full error message:

Get-ChildItem : Cannot find path 'C:\AzHCI_Sandbox\AzSHCISandbox-main\:\Windows' because it does not exist.
At C:\AzHCI_Sandbox\AzSHCISandbox-main\New-AzSHCISandbox.ps1:661 char:23
+ ... antherDir = Get-ChildItem -Path ($MountedDrive + ":\Windows")  -Filte ...
+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (C:\AzHCI_Sandbo...-main\:\Windows:String) [Get-ChildItem], ItemNotFoundException
    + FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.GetChildItemCommand

Getting value of $MountedDrive when at line 661 returns nothing:

[DBG]: PS C:\AzHCI_Sandbox\AzSHCISandbox-main>> $MountedDrive

The VHD shows up in Disk Manager, just does not have a drive letter assigned to it

Script ends before setup is complete - no error messages

Hi,

After successfully deploying the host using the Azure Portal method, as per instructions I ran the shortcut on the host desktop 'New-AzSHCI-Sandbox using PowerShell.

The scripts get executed, after almost 2 hours, I can see Admincenter configuration scripts running , the script window then closes without any errors.
However the expected shortcut for the Admincenter VM does not get created on the host desktop and when I log on to the Admincenter VM, I can see that it hasn't been joined to the domain.
Does a log file get created and stored somewhere so that I can check if there were any errors or do you know what the issue could be?

Any assistance would be appreciated, I've tried twice so far and I'm seeing the same issue both times.

Regards

blob where VHDX files are stored not accessible

Seems that both URI's to the two VHDX files are unavailable.
https://aka.ms/AAbbhkn
https://aka.ms/AAbclsv

Azure Jumpstart HCIBOX Bicep Post-deployment template is failing and its is a loop after restart

@dkirby-ms
@mtodd
@sebassem
@radical
@sverrejoh
@alloy

Is your issue related to a Jumpstart scenario, ArcBox, HCIBox, or Agora?

https://github.com/microsoft/azure_arc/tree/main/azure_jumpstart_hcibox/bicep

Describe the bug

The Azure Jumpstart HCIBOX Bicep Post-deployment template is failing after # - Registering Providers

I have confirmed the Prerequisite as per - https://azurearcjumpstart.io/azure_jumpstart_hcibox/#prerequisites

To Reproduce

After 3-4 hours the deployment should complete with the nested VM resources.

I have the below file in the folders

C:\HCIBox\agentScript
C:\HCIBox\Deploy-AKS.ps1
C:\HCIBox\Deploy-ArcResourceBridge.ps1
C:\HCIBox\Deploy-GitOps.ps1
C:\HCIBox\Deploy-SQLMI.ps1
C:\HCIBox\GetServiceAccountBearerToken.ps1
C:\HCIBox\HCIBox-Config.psd1
C:\HCIBox\HCIBoxLogonScript.ps1
C:\HCIBox\Icons
C:\HCIBox\jumpstart-user-secret.yaml
C:\HCIBox\KeyVault
C:\HCIBox\Logs
C:\HCIBox\New-HCIBoxCluster.ps1
C:\HCIBox\Register-AzSHCI.ps1
C:\HCIBox\SDN
C:\HCIBox\Uninstall-AKS.ps1
C:\HCIBox\Uninstall-ResourceBridge.ps1
C:\HCIBox\VHD
C:\HCIBox\Virtual Machines
C:\HCIBox\wallpaper.png
C:\HCIBox\Windows Admin Center
C:\HCIBox\Logs\Bootstrap.log
C:\HCIBox\Logs\HCIBoxLogonScript.log
C:\HCIBox\Logs\LogInstructions.txt
C:\HCIBox\Logs\LogsBundle-wvdadmintf.zip
C:\HCIBox\Logs\New-HCIBoxCluster.log
C:\HCIBox\SDN\CertHelpers.ps1
C:\HCIBox\SDN\HCIBox-Config.psd1
C:\HCIBox\SDN\NetworkControllerRESTWrappers.ps1
C:\HCIBox\SDN\NetworkControllerWorkloadHelpers.psm1
C:\HCIBox\SDN\SDNExplorer.ps1
C:\HCIBox\SDN\SDNExpress.ps1
C:\HCIBox\SDN\SDNExpressModule.psm1
C:\HCIBox\SDN\SDNExpressUI.psm1
C:\HCIBox\SDN\Single-NC.psd1
C:\HCIBox\VHD\AZSHCI.vhdx
C:\HCIBox\VHD\GUI.vhdx
C:\HCIBox\VHD\livecd.ubuntu-desktop-hyperv.vhdx
C:\HCIBox\VHD\Ubuntu.vhdx
C:\HCIBox\VHD\Ubuntu.vhdx.zip
C:\HCIBox\Windows Admin Center\WindowsAdminCenter.msi

Environment summary

The Environment is as per the template, no customization.

Have you looked at the Troubleshooting and Logs section?

Screenshots

Additional context
New-HCIBoxCluster.log
Bootstrap.log
HCIBoxLogonScript.log

Please advice

Stack HCI SandBox deployment fails

Hello. thank you always.
When I tried to create a Stack HCI verification environment on Azure using the code provided here, it fails when running PowerShell after VM deployment.

I got the following error message, is there any way to fix it?

PS C:\AzHCI_Sandbox\AzSHCISandbox-main> & C:\AzHCI_Sandbox\AzSHCISandbox-main\New-AzSHCISandbox.ps1 VERBOSE: Enabling PS Remoting on client... VERBOSE: Performing simple validation of Product Keys VERBOSE: No Multiple Hyper-V Hosts defined. Using Single Hyper-V Host Installation VERBOSE: Testing VHDX Path VERBOSE: Generating Single Host Placement
VERBOSE: Creating Internal Switch
VERBOSE: Creating NAT Switch
VERBOSE: Creating Internal NAT Switch: Internal NAT
VERBOSE: Applying IP Address to NAT Switch: Internal NAT
VERBOSE: Creating new NET NAT
VERBOSE: Getting local Parent VHDX Path
VERBOSE: Configuring Hyper-V Settings on localhost
VERBOSE: Copying VHDX Files to Host
VERBOSE: Copying C:\AzHCIVHDs\gui.vhdx to V:\VMs\GUI.VHDX
VERBOSE: Copying C:\AzHCIVHDs\azshci.vhdx to V:\VMs\AzSHCI.VHDX
VERBOSE: Generating the VM: @{AzSHOST=AzSMGMT; VMHost=ASHCIHost001}
VERBOSE: Virtual Machine FABRIC NIC MAC is = xx-xx-xx-xx-xx-xx
VERBOSE: Returned VMMac is xx-xx-xx-xx-xx-xx
VERBOSE: Generating the VM: @{AzSHOST=AzSHOST1; VMHost=ASHCIHost001}
VERBOSE: Virtual Machine FABRIC NIC MAC is = xx-xx-xx-xx-xx-yy
VERBOSE: Returned VMMac is xx-xx-xx-xx-xx-yy
VERBOSE: Generating the VM: @{AzSHOST=AzSHOST2; VMHost=ASHCIHost001}
VERBOSE: Virtual Machine FABRIC NIC MAC is = xx-xx-xx-xx-xx-zz
VERBOSE: Returned VMMac is xx-xx-xx-xx-xx-zz
VERBOSE: Performing offline installation of Hyper-V to path \ASHCIHost001\V$\VMs\AzSMGMT.vhdx
VERBOSE: Installation started...
Install-WindowsFeature : The request to list features available on the specified server failed.
The image could not be mounted.
The I/O operation has been aborted because of either a thread exit or an application request. Error: 0x800703e3
At C:\AzHCI_Sandbox\AzSHCISandbox-main\New-AzSHCISandbox.ps1:545 char:9

• Install-WindowsFeature -Vhd $path -Name Hyper-V, RSAT-Hyper-V ...

•    + CategoryInfo : InvalidOperation: (@{Vhd=\\ASHCIHo...Name=localhost}:PSObject) [Install-WindowsFeature],
     DeploymentProviderException
     + FullyQualifiedErrorId : DISMAPI_Error__Failed_To_Mount_Image,Microsoft.Windows.ServerManager.Commands.AddWindows
    Feature Command
  

---

Thank you.
Sayo

Unable to Deploy Azure Arc Resource Bridge

Hi,

I am deploying Azure HCIStack using a Bicep file. I've connected Azure HCIBox-Client VM using RDP. Once I logged into the HCIBox-Client VM, a PowerShell script opened and started running, but it stopped and showed an error - Waiting on Arc Resource Bridge Deployment to Complete .

DSC URI points to non-existent branch

DSC URI "https://github.com/microsoft/AzStackHCISandbox/blob/Server2022Update/DSC/ashcihost.zip?raw=true" refers to branch 'Server2022Update" that does not exist. This leads to the deployment failing in Azure.

New-AzSHCISandbox shortcut's target incorrect

The New-AzSHCISandbox shortcut on Desktop has incorrect target. And the working directory may be incorrect also.

Current (incorrect): C:\AzHCI_Sandbox\AzSHCISandbox-main\New-AzSHCISandbox.ps1
Actual script location (correct): C:\AzHCI_Sandbox\New-AzSHCISandbox.ps1

AzStackHCISandbox/AKS-DSC/ashcihost/ashcihost.ps1

Line 106 in df88a24

Target="C:\AzHCI_Sandbox\AzSHCISandbox-main\New-AzSHCISandbox.ps1"

Cannot create a file when that file already exists. Error: 0x800700b7

Hello,
I'm running this script as instructed and getting below error while trying to initiate offline installation.
Having issue on code line 545.

Write-Verbose "Performing offline installation of Hyper-V to path $path"
Install-WindowsFeature -Vhd $path -Name Hyper-V, RSAT-Hyper-V-Tools, Hyper-V-Powershell -Confirm:$false | Out-Null
Start-Sleep -Seconds 20

---

Install-WindowsFeature : The request to list features available on the specified server failed.
The image could not be mounted.
Cannot create a file when that file already exists. Error: 0x800700b7
At C:\AzHCI_Sandbox\AzSHCISandbox-main\New-AzSHCISandbox.ps1:545 char:9

•     Install-WindowsFeature -Vhd $path -Name Hyper-V, RSAT-Hyper-V ...
  

•     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : InvalidOperation: (@{Vhd=\AzSHCIH...Name=localhost}:PSObject) [Install-WindowsFeature],
    DeploymentProviderException
  • FullyQualifiedErrorId : DISMAPI_Error__Failed_To_Mount_Image,Microsoft.Windows.ServerManager.Commands.AddWindows
    FeatureCommand

Failed to restart the AZHOST2

I have found the new issue about rebooting the AZHOST2.
This is related New-AzSHCISandbox.ps1:2718
Restart-Computer $AzSHOST -Force -Confirm:$false -Credential $using:domainCred

VERBOSE: Rebooting SDN Host AzSHOST2
Failed to restart the computer AzSHOST2 with the following error message: Illegal operation attempted on a registry key that has been
marked for deletion. (Exception from HRESULT: 0x800703FA).
At C:\AzHCI_Sandbox\AzSHCISandbox-main\New-AzSHCISandbox.ps1:2588 char:5

• Invoke-Command -ComputerName Admincenter -Credential $domainCred  ...
  

• ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : OperationStopped: (AzSHOST2:String) [Restart-Computer], InvalidOperationException
  • FullyQualifiedErrorId : RestartcomputerFailed,Microsoft.PowerShell.Commands.RestartComputerCommand
  • PSComputerName : Admincenter #

Simulate RRAS and BGP on hardware

Hi,

I have inquiry regarding SDN sandbox.
May i know this script can be tailored and use on on prem hardware for testing purpose?
currently i'm wondering how i can simulate BGP and RRAS on real hardware

Validate Network Step Is Unnecessary

This guide helps us with Step 1, 2, and 4 in the Microsoft docs HCI Deploy guide here. So naturally, users will fill in the gaps by following Step 3 & 5 afterward in those docs after following this AzStackHCISandbox guide. The problem is, part of Step 5 (Validate an Azure Stack HCI cluster) is not relevant to this Sandbox environment, and users will run into many issues attempting this when using the Validate-DCB tool.

I've reached out to Azure Support and they've confirmed that the Validate Network part of Step 5 in not necessary in a nested virtualized environment, rather only relevant in a physical one. I'd like to make that clear in this guide so others don't fall into the same trap.

Shortcut on the Desktop is missing and alos cluster is not configured.

Hi,

After successfully deploying the host using the Azure Portal method, as per instructions I ran the shortcut on the host desktop 'New-AzSHCI-Sandbox using PowerShell.The scripts get executed, without any errors.
However, the expected shortcut for the Admincenter VM does not get created on the host desktop and when I log on to the Admincenter VM

Any assistance would be appreciated, I've tried multiple time so far and I'm seeing the same issue both times.

Template deployment failing - failed to execute Set-TargetResource functionality with error message: The term 'Get-MSCatalogUpdate' is not recognized as the name of a cmdlet, function, script file, or operable program.

Hello,

The template deployment is failing with below error, please advice

{"code":"DeploymentFailed","message":"At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details.","details":[{"code":"VMExtensionProvisioningError","message":"VM has reported a failure when processing extension 'ConfigureAzSHCIHost'. Error message: "DSC Configuration 'AzSHCIHost' completed with error(s). Following are the first few: PowerShell DSC resource MSFT_ScriptResource failed to execute Set-TargetResource functionality with error message: The term 'Get-MSCatalogUpdate' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again. PowerShell DSC resource MSFT_ScriptResource failed to execute Set-TargetResource functionality with error message: The term 'Get-MSCatalogUpdate' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again. The SendConfigurationApply function did not succeed."\r\n\r\nMore information on troubleshooting is available at https://aka.ms/VMExtensionDSCWindowsTroubleshoot "}]}

Regards,
WVDAdminTF

Deployment Error in Deployment with PowerShell?

Hi,

When I execute:
New-AzResourceGroupDeployment -ResourceGroupName $rgname -Name "ASHCISandbox-Deploy" -TemplateFile $template -TemplateParameterFile $param -AdminPassword $securepw

I get:
New-AzResourceGroupDeployment: 17:00:15 - Error: Code=InvalidTemplate; Message=Deployment template validation failed: 'The template parameters 'subnetName, dataDisks, networkInterfaceName, addressPrefixes, publicIpAddressName, publicIpAddressType, virtualNetworkName, publicIpAddressSku, subnets, networkSecurityGroupRules, patchMode, virtualMachineComputerName, networkSecurityGroupName, osDiskType, dataDiskResources' in the parameters file are not valid; they are not present in the original template and can therefore not be provided at deployment time. The only supported parameters for this template are 'customRdpPort, virtualMachineName, virtualMachineSize, virtualMachineGeneration, dataDiskType, dataDiskSize, adminUsername, adminPassword, autoShutdownStatus, autoShutdownTime, autoShutdownTimeZone, alreadyHaveAWindowsServerLicense'. Please see https://aka.ms/arm-deploy/#parameter-file for usage details.'.
New-AzResourceGroupDeployment: The deployment validation failed

Any hints what I'm doing wrong?

json.zip

Regards,
Stefan

Issues with the Powershell configuration.

Once the Vm has been deployed into Azure and I have logged in using public IP.

The next stage is using the New-AzSCH Powershell script on the descktop of the server.

I have followed the instructions and run with PowerShell. I left the deployment to run.

After I returned after a few hours as directed the Powershell session window is gone but I have no Windows Admin Center icon on the descktop.

I have redeployed twice and have had this issue twice.

Unable to Register HCI Cluster

Hi there,

I have tried registering using the steps provided in the scenario get started readme.md file.

I am keep running in to this error:

Failed to register with Azure for cluster: azstackcluster.contoso.com. Error: RemoteException: Failed to register. Couldn't generate self-signed certificate on node(s) AzSHOST1,AzSHOST2. Couldn't set and verify registration certificate on node(s) AzSHOST1,AzSHOST2. Make sure every clustered node is up and has Internet connectivity (at least outbound to Azure).

Any idea why this isn't working ?

I have not change the password for any of the servers

Chocolatey

Can’t finish deploying because of chocolaty

Invalid URI when attempting to validate the Network Controller REST URI

Hello,

I am running into a problem when adding the cluster to Windows Admin Center. I am able to add the cluster name "azstackcluster" which is found.
But then when I try to validate the Network Controller REST URI "https://nc01.contoso.com/" it says "Invalid URI".
I did install the RSAT-NetworkController and have followed all other steps of the documentation both here and from the MS docs.

Here is a screenshot of my error from the Windows Admin Center:

Any guidance would be greatly appreciated, thanks!
-Jack

Deployment fails due to required reboot, 100% deployment failure rate

Installing Chocolatey on the local machine
VERBOSE: Loading module from path
'C:\Users\administrator\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateysetup.psm1'.
VERBOSE: Exporting function 'Initialize-Chocolatey'.
VERBOSE: Importing function 'Initialize-Chocolatey'.
VERBOSE: Loading module from path
'C:\Users\administrator\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\chocolateyInstaller.
psm1'.
.NET Framework 4.8 was installed, but a reboot is required.
Please reboot the system and try to install/upgrade Chocolatey again.

At C:\AzHCI_Sandbox\AzSHCISandbox-main\New-AzSHCISandbox.ps1:2028 char:5
+     Invoke-Command -VMName AzSMGMT -Credential $localCred -ScriptBloc ...
+     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : OperationStopped: (.NET Framework ...ocolatey again.:String) [], RuntimeException
    + FullyQualifiedErrorId : .NET Framework 4.8 was installed, but a reboot is required.
 Please reboot the system and try to install/upgrade Chocolatey again.
    + PSComputerName        : AzSMGMT

Error while deploying azure VM - VM has reported a failure when processing extension 'ConfigureAzSHCIHost'. Error message: \"DSC Configuration 'AzSHCIHost' completed with error(s). Following are the first few: PowerShell DSC resource MSFT_ScriptResource failed to execute Set-TargetResource functionality with error message: The term 'Get-MSCatalogUpdate' is not recognized as the name of a cmdlet, function, script file, or operable program.

Deployment failed but I was able to connect to VM through remote desktop by downloading .rdp file .Can anyone please help me out to sort the issue.