DHCP Guest Range on a Single Subnet

At my new job, we needed to deny unregistered devices access to the internet by default. Normally this should be done via NAC, but all I had available was a Windows DHCP Server, a single subnet (and VLAN), and a perimeter firewall. Upgrading to NAC wasn’t an option at the time.

I wanted to configure the DHCP server so that whitelisted clients would get a DHCP IP Address lease in a different range than guest clients. This way, I can block all traffic to/from the guest client IP range at the firewall. This isn’t at all a robust security solution, but it was good enough for the specific application.

Here’s how you can configure Windows DHCP Server to put whitelisted machines in a specific IP range, and guest machines in a separate IP range.

  1. Create a ‘DHCP Scope’ in DHCP that constitutes the entire IP address range you’d like to use for DHCP. The scope should include both whitelisted PC’s and guests.
  2. Create an ‘exclusion range’ in the main scope created in the previous step. The exclusion range will be the ‘guest’ range.
  3. Create a ‘DHCP Policy’ in the main scope.
    Policy Name: “Guest Devices Get Blocked Pool”
  4. Edit the new policy.
  5. On the ‘Conditions’ tab, add a new condition.
    Criteria: MAC Address
    Operator: Not Equals
  6. Populate the policy’s new condition “Values” with your MAC address whitelist.
  7. Back on the Policy Properties window (conditions tab), make sure that the ‘AND’ radio button is selected.

An important note is that each condition can only hold about 20 MAC addresses. When you want to whitelist more devices past the limit, just create another ‘condition’ in the same policy. As long as ‘AND’ is the operator on the ‘Conditions’ tab, it’ll work great.

Another important note is that when running a DHCP fail-over partner, create the policy on a source member, and then replicate it to the partner. Every time you whitelist a new machine, you need to initiate a replication.

Here’s some PowerShell to help.

#Get all current reservation mac addresses:
Get-DhcpServerV4Lease -ScopeID 192.168.1.0 | Select ClientId

#Get all whitelisted machines:
(Get-DhcpServerV4Policy -ScopeID 192.168.1.0 -Name “Guest Devices Get Blocked Pool”).MacAddress

Thanks for reading :).

Advertisements

Getting Started with DFSN and PowerShell

DFS is a really cool feature. There are two parts to DFS: Namespace and Replication. They do different jobs, and can be thought of as different roles. DFS Namespace is designed to create a unified UNC path, where subfolders can be links to different serves and shares. The servers linked-to can be assigned costs and placed into sites.

Example

Here’s an example:

Let’s say I have 5 file servers and shares:

  • OH-FS1
    • \\oh-fs1\hr
    • \\oh-fs1\finances
  • OH-FS2
    • \\oh-fs2\software
  • OH-FS3
    • \\oh-fs3\public
  • CA-FS1
    • \\ca-fs1\hr
    • \\ca-fs1\finances

It can be confusing for a user to remember what file server they need to go to. DFS Namespaces can help us unify the structure into this:

  • \\mycorp.com\
    • files\
      • software
      • public
      • finances
      • hr

Then, we can configure DFS Namespaces so that if you’re at the CA site, accessing \\mycorp.com\hr will redirect you to \\ca-fs1\hr. Conversely, we can configure this namespace so that accessing \\mycorp.com\hr from the OH site will redirect the user to the share \\oh-fs1\hr. This is incredibly cool.

You might be wondering, what good is it to redirect people to servers in different sites if they won’t see the same data? For example, what if the HR folk at the OH and CA site want to collaborate via the ‘hr’ share? This is what DFS Replication is for. It will be covered in a different post.

Getting Started

Let’s walk through the creation of a DFS Namespace.

Our final namespace will look like this:

  • \\contoso.com\files\
    • hr
    • software
    • finances
    • public

The following shares will be on a server named fs1: hr, finances, software. The share ‘public’ will be on a server named fs2.

  1. Install two file servers: fs1 ans fs2.
  2. Configure the file servers normally and join them to the domain.
  3. Run the following PowerShell code on both file servers to install the DFS Namespace feature:
    Install-WindowsFeature FS-DFS-Namespace -IncludeManagementTools
  4. Run the following PowerShell code on fs1 to create a 1-server namespace.
    #Create the SMB share folders:
    $folders = @("C:\DFSRoots\Files","C:\shares\hr","C:\shares\finances","C:\shares\software")
    $folders | mkdir
    
    #Create the shares
    $folders | %{sharename = (GC $_).name; New-SMBShare -Name $shareName -Path $_ -FullAccess "contoso\administrator"}
    
    #Create the DFS Root
    New-DfsnRoot -Path \\contoso.com\files -TargetPath \\fs1\files -Type DomainV2
    
    #Create the DFS Folders for fs1
    $folders | ?{$_ -like "*shares*"} | % {$name = (gc $_).name; $DfsPath = ("\\contoso.com\files\" + $name); $targetPath = ("\\fs1\" + $name);New-DfsnRootFolder -Path $dfsPath -TargetPath $targetPath}
    
  5. At this point, fs1 is configured. In order to add shares from fs2 into the DFS Namespace, we first need to configure fs2 to host the ‘files’ namespace. Run the following PowerShell code on fs2.
  6. $folders = @("C:\DFSRoots\Files","C:\shares\public")
    $folders | mkdir
    
    #Create the shares
    $folders | %{sharename = (GC $_).name; New-SMBShare -Name $shareName -Path $_ -FullAccess "contoso\administrator"}
    
    #Host the DFS Root
    New-DfsnRootTarget -Path \\contoso.com\files -TargetPath \\fs2\files
    
    #Create the DFS Folders for fs2
    $folders | ?{$_ -like "*shares*"} | % {$name = (gc $_).name; $DfsPath = ("\\contoso.com\files\" + $name); $targetPath = ("\\fs1\" + $name);New-DfsnRootFolder -Path $dfsPath -TargetPath $targetPath}
    

Note that we don’t need to run New-DfsnRootTarget on fs2, but the SMB Shares ‘files’ and ‘public’ must be configured on fs2 before we can add the fs2 shares as targets on the \\contoso.com\files namespace.

And that’s it! You can now browse the tree from a client or the servers, and you’d never know that the folders are on different servers.

Windows Server 2012 – Getting Started With Failover Clustering

Failover clustering is a bit intimidating at first. However, once you get started it’s not too bad (like most things).

Overview

  1. Configure VM’s
  2. Configure Shared Storage
  3. Configure Nodes
  4. Create the Cluster

Configure VM’s

You will need the following VM’s to do this in a lab:

  1. iscsi1. This server will act as the iSCSI target.
  2. clusternode1.
  3. clusternode2.

I’ll leave the names and addressing up to you. For help creating VM’s in Hyper-V, see my previous blog post Getting Started with Hyper-V.

Configure Shared Storage

You’ll need to create the following volumes and connect them to both cluster node’s.

  1. cluster1-quorum, 5GB
  2. cluster1-disk1, 10GB

For help with configuring an iSCSI target server, see my previous blog post Windows Server 2012 – Getting Started With the iSCSI Target Server.

Configure the Nodes

On each node, run the following commands. You’ll need to scan the code and replace variables as needed. For example, “Target-IQN” needs replaced with the correct setting from the iSCSI target server.

#Install Roles
Install-WindowsFeature failover-clustering,multipath-io -includeManagementTools

#Configure iSCSI Service
Start-Service msiscsi
Set-Service msiscsi -startupType "Automatic"

#Connect to the Target
New-iSCSITargetPortal -TargetPortalAddress "iscsi target fqdn"
$nodeAddress = (Get-IscsiTarget).NodeAddress
Connect-iSCSITarget -NodeAddress $nodeAddress -IsPersistent $true

#Configure Multipath Settings
Enable-MSDSMAutomaticClaim -BusType iSCSI #(computer will reboot, possibly bsod)
Restart-Computer

##one the reboot is complete, continue with the code below.

Get-MSDSMAutomaticClaimSettings #visually confirm that iscsi = $true
Set-MSDSMGlobalDefaultLoadBalancePolicy -Policy RR

#Online and Initialize the Disks
Get-Disk | ?{$_.FriendlyName -like "MSFT Virtual HD*" -and ($_.IsReadOnly -eq $true -or $_.isOffline -eq $true)} | % {Set-Disk -Number $_.Number -IsOffline $false}
Get-Disk | ?{$_.FriendlyName -like "MSFT Virtual HD*" -and ($_.IsReadOnly -eq $true -or $_.isOffline -eq $true)} | % {Set-Disk -Number $_.Number -IsReadOnly $false; Initialize-Disk -Number $_.number -partitionStyle GPT}

Now, choose one cluster node to work on. Login and run the following commands:

#Format the disks and assign a drive letter
Get-Disk | ?{$_.FriendlyName -like "MSFT Virtual HD*" -and $_.partitionstyle -eq "RAW"} | % {
  Initialize-Disk -number $_.number -partitionStyle GPT
  New-Partition -disknumber $_.number -useMaximumSize -AssignDriveLetter
  $driveLetter = $null
  $driveLetter = (Get-Partition -DiskNumber $_.number | ?{$_.type -eq "Basic"}).DriveLetter
  Format-Volume -DriveLetter $driveLetter -FileSystem NTFS
}

#Run a test to see if the cluster can be created.
Test-Cluster -node sql1,sql2 -ReportName C:\Install_Files\cluster1.report.html
#stop here and review report. Some warnings are ok.

#create the new cluster
New-Cluster -name cluster1 -node clusternode1,clusternode2 -staticAddress 10.10.10.20 -NoStorage -AdministrativeAccessPoint ActiveDirectoryAndDns

#add the volumes to the cluster
Get-ClusterAvailableDisk -cluster cluster1 | Add-ClusterDisk

#run this to find the cluster disks. Choose one to be the quorum.
Get-ClusterResource

#configure quorum settings. change "cluster disk 1" to whatever disk you want to be the quorum.
Set-ClusterQuorum -Cluster Cluster1 -NodeAndDiskMajority "Cluster Disk 1"

And, that’s it. You should now have a green cluster to play with.

Windows Server 2012 – Getting Started With the iSCSI Target Server

It’s really great that Windows Server 2012 can now act as an iSCSI target. Here’s what I’ve learned.

An important note is that Windows Server will not share out a raw disk. It will only share virtual disks (VHDX files) sitting on a file server. If you’re used to iSCSI via other vendors, this will freak you out a little bit. Don’t worry — it’s different but it works well.

Overview:

  1. Install the Role
  2. Create a virtual disk.
  3. Create a new iSCSI target, and map the virtual disks to the target.
  4. Map initiator IQN’s to targets.

Install the Role

It’s easy:

Install-WindowsFeature FS-FileServer,FS-VSS-Agent,FS-iSCSITarget-Server,iSCSITarget-VSS-VDS,Storage-Services -includeManagementTools

Create a virtual disk

mkdir C:\iscsimount
New-IscsiVirtualDisk -path C:\iscsimount\test-disk-1.vhdx -sizebytes 10GB

Create a Target and Mapping

New-iSCSIServerTarget TestTarget1
Add-iSCSIVirtualDiskTargetMapping TestTarget1 C:\iscsimount\test-disk-1.vhdx

Map Initiator IQN’s

On each initiator, run the following command to retrieve the IQN.

(Get-InitiatorPort).NodeAddress

Now, back on the target server, do the following:

Set-IscsiServerTarget -Target TestTarget1 -InitiatorIDs @("IQN://initator1IQN","IQN://initiator2IQN")

You’re good to go. On the initiators, you should now be able to connect to the iSCSI Target and see the disks. Congrats!

Getting Started with Hyper-V

As part of studying for the MS 70-410 exam, I recently began playing with Hyper-V. At first, I scoffed at the idea that anyone except VMWare could build a reliable hypervisor. Now that I’ve actually seen Hyper-V, I’m impressed!

Here’s something neat: Hyper-V is actually a Type-1 ‘bare-metal’ hypervisor. The hypervisor is actually loaded before the management OS. After installing the role, the windows server OS that you see and interact with is actually a virtualized ‘parent partition’ on the hypervisor.

Overview

  1. Install the Role
  2. Configure a Virtual Switch
  3. Create Your First VM
  4. Turn your First VM Into a Template
  5. Create Multiple Subsequent VMs

Install The Role

This part’s easy.

Install-WindowsFeature Hyper-V -IncludeManagementTools

Configure a Virtual Switch

There are three types of virtual switches:

  1. Internal. This switch is connected to the parent partition and can be connected to VM’s.
  2. Private. This switch is not connected to the parent partition. It can only be connected to VM’s.
  3. External. This switch acts like a physical switch that’s connected to the same uplink that the parent partition is connected to. It’s equivalent to having both the parent partition and the VM’s connected to the same switch. This type of switch is the most common, as it allows your VM’s to access the internet.

We are going to create an ‘external’ switch so that our VM’s can access the internet.

New-VMSwitch -name "internet" -switchtype external

Create Your First VM

  1. Get a copy of the Windows Server 2012 R2 or Windows 8.1 media in ISO format. Copy it to C:\VM\ISO or an alternate location of your choosing.
  2. Create the first VM’s VHD with the following command:
    New-VHD C:\VM\VHD\Windows-Server-2012-R2-Template.vhdx -sizeBytes 40GB -Dynamic
  3. Create the first VM with the following command:
    New-VM -Name Server2012Template -VHDPath C:\VM\VHD\Windows-Server-2012-R2-Template.vhdx -Generation 2 -MemoryStartupBytes 1024MB -SwitchName "internet"
    #enable dynamic memory
    Set-VMMemory -VMName Server2012Template -DynamicMemoryEnabled $true
  4. Configure a DVD drive and mount your OS install media.
    Add-VMDVDDrive -VMName Server2012Template
    Set-VMDVDDrive -Path C:\VM\ISO\Server-2012-R2.iso
  5. Start your VM, then connect to it and follow through with the install.
    Start-VM Server2012Template

Turn your First VM Into a Template

Great! But what if we need more VM’s? Hyper-V lets you sysprep a machine and use ‘differencing’ virtual disks to easily create new VM’s. A differencing disk is a VHDX image that’s based on a read-only parent image. Changes are written to the differencing disk instead of the parent. This allows for a lot of deduplication for creating VM’s based off of an initial VHDX file. Very cool stuff.

  1. Install all Microsoft Updates on the template VM.
  2. Install any common applications you want on the template — 7zip, office, RSAT, etc.
  3. When your template is configured, run the following command from inside the template VM’s OS:
    C:\windows\system32\sysprep\sysprep.exe
  4. A window will appear titled “System Preparation Tool 3.14”. Use the following parameters:
    System Cleanup Action: Enter System Out-Of-Box Experience
    Generalize: check this box
    Shutdown Options: Shutdown
  5. Click OK and allow the VM to shut itself down.
  6. Find the VM’s VHDX file in windows explorer, then right-click it and choose ‘properties’, then check the ‘read only’ box.
  7. It is now safe to delete the template VM if desired, but do not delete the template VHDX file.

Alright! You now have a template VMDX that can be used for the basis of new VM’s.

Create Multiple Subsequent VMs

Here’s the process:

  1. Create a new VHDX based on the parent template.
    New-VHDX -ParentPath C:\VM\VHD\Server-2012-R2-Template.vhdx -path C:\VM\VHD\MyNewServer1.vhdx -differencing
  2. Create a new VM.
    New-VM -Name MyNewServer1 -VHDPath C:\VM\VHD\MyNewServer1.vhdx -memoryStartupBytes 1024MB -SwitchName Internet -Generation 2
    Set-VMMemory -VMName MyNewServer1 -DynamicMemoryEnabled $true
    Start-VM MyNewServer1

Bam! That’s it. Your new VM will be based on the template. Check out the disk size on the parent partition via windows explorer. You’ll be amazed at how little space the new VM will use, even after a decent amount of use.

Happy Hunting.

Getting Started with Server Core 2012 R2

I finally did it. I deployed my first production Server Core 2012 R2 VM. Here’s what I learned along the way.

Overview:

  • Installing Server Core
  • Configuring the IP Address, Name, Domain, etc.
  • Switching from Core to Desktop mode and back.
  • Installing .Net 3.5.
  • Removing unneeded features to reduce the server footprint (Features on Demand).
  • Windows Updates

Installing Server Core

There’s nothing special to write here. Install windows from the media as usual, but select the ‘Server Core’ option when presented with the edition selection page.

Configuration

First, get the interface name that you’d like to work on:

PS C:\Users\Administrator> Get-NetAdapter | Select Name,MacAddress
Name, MacAddress
Ethernet, 00-15-5D-1D-C1-1C

In our case, we want the interface named ‘Ethernet’. Next, let’s set an IP and DNS server.

New-NetIPAddress -IPAddress x.x.x.x -InterfaceAlias "Ethernet" -DefaultGateway x.x.x.x -PrefixLength yy
#example: New-NetIPAddress -IPAddress 192.168.2.50 -InterfaceAlias "Ethernet" -DefaultGateway 192.168.2.1 -PrefixLength 24

Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses ("x.x.x.x","y.y.y.y")
#example: Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses ("192.168.2.3","192.168.2.4")
 

Now, let’s join a domain. This is easy also.

Add-Computer -DomainName "contoso.com" -DomainCredential (Get-Credential) -NewName "ComputerName"
Restart-Computer

Great. Now we have basic connectivity. Onwards.

Switching between Core and Desktop

Everyone pretends that this is the simplest thing ever. That’s not quite true. If you install Windows Server in desktop mode, it’s easy to remove the GUI. However, if you install Windows Server in server core mode, it’s a little tricky to get the GUI back because the source files for the GUI are not installed.

Here’s the procedure to install the GUI on a system installed as sever core:

  1. Insert the Windows Server 2012 R2 media.
  2. Run the following commands:
    mkdir C:\mountdir
    dism /get-wiminfo /wimfile:d:\sources\install.wim
    #note the index number the 'GUI' version of the Windows Server edition that you're working with. This will probably be '1' for server standard or '3' for server datacenter.
    dism /mount-wim /wimfile:d:\sources\install.wim /index:3 /mountdir:c:\mountdir /readonly
    Install-WindowsFeature Server-Gui-Mgmt-Infra,Server-Gui-Shell -source c:\mountdir\windows\winsxs
    

In order to remove the GUI:

Uninstall-WindowsFeature Server-Gui-Mgmt-Infra,Server-Gui-Shell

Installing .Net 3.5

The source files for .Net 3.5 are in a different location than the source files for the GUI.

  1. Insert the Windows Server 2012 R2 media.
  2. Run the following command:
Install-WindowsFeature net-framework-core -source D:\sources\sxs

Removing Unneeded Features aka Features on Demand

In server 2012 R2, you can actually remove the source files for unused features from the disk to save space. This is useful for high density VM installs.

The command is:

Uninstall-WindowsFeature FeatureName -Remove

To uninstall all unused features:

Get-WindowsFeature | ?{$_.InstallState -eq "Available"} | Uninstall-WindowsFeature -Remove

Windows Updates

For this, I just used sconfig. Just type ‘sconfig’ into the command prompt, then choose the windows update feature. Sconfig is neat, but I’m generally more interested in scriptable solutions. I’ll revisit command-line windows update searching in the future.

All-in-all, server core is pretty cool!

I wish you the best with your sever core adventures.

Windows Server 2012 DHCP Clustering

Getting Started with Windows DHCP on Server Core

At work, we currently switched from a Linux dhcpd server to a Windows 2012 R2 DHCP cluster. Here’s how I built the cluster.

What to Know:

  • Windows DHCP Clustering does not require Microsoft Failover Clustering (MSCS).
  • Windows DHCP Clustering will synchronize leases, but it will not synchronize scope options or reservations. To do that, you’ll have to use PowerShell.

The Basics

  1. Install and Authorize the DHCP role on two nodes.
  2. Create a scope.
  3. Create a failover partnership.
  4. Synchronize scope options with PowerShell.

Step-By-Step

Install and Authorize the DHCP servers.

Login to each server (preferably with PS Remoting) and run the following command in PowerShell.

Install-WindowsFeature DHCP –IncludeManagementTools
#Authorize
Add-DhcpServerInDC

Configure the DHCP servers.

Login to one of the servers, and run the following code after modifying it for your needs.

#add some scopes!
Add-DhcpServerv4Scope -Name "Network 1" -StartRange 10.10.10.1 -EndRange 10.10.10.254 -SubnetMask 255.255.255.0
Add-DhcpServerv4Scope -Name "Network 2" -StartRange 10.10.20.1 -EndRange 10.10.20.254 -SubnetMask 255.255.255.0

#configure failover for the scopes
Add-DhcpServerv4Failover -ComputerName <dhcpServer1-FQDN> -PartnerServer <dhcpServer2-FQDN> -Name "server1-server2" -ScopeId <Scope – ex: 10.10.10.0,10.10.11.0> -SharedSecret "Password"

#configure some DHCP options on one of the servers (note: does not auto-replicate).
Set-DhcpServerv4OptionValue -DnsDomain <option-15-domain-name> -DnsServer <option-5-dns-servers> [-optionId <ID#> -Value <"IdValue">]
Set-DhcpServerv4OptionValue –ScopeID <10.10.10.0> –Router <10.10.10.1> [-optionId <ID#> -Value <"IdValue">]

References

Sync DHCP Options

You will soon notice that DHCP options are not automatically synchronized. Here’s a microsoft blog article about the issue.

What to know about the Microsoft DHCP Sync Tool:

  • It launches at startup via task manager and then runs in the background.
  • The tool should be installed on one DHCP server only.
  • Any changes to DHCP should be done on the server where the DHCP Sync Tool is installed.
  • The DHCP Sync Tool will not delete scope options.
  • The DHCP Sync Tool will not synchronize server-level options.
  • If new scopes are created after the sync tool is launched, the tool will not synchronize changes to the new scopes until the tool is restarted.

It’s not a perfect tool, but it works well for what it does (scope synchronization). I’m planning on double-checking changes I make anyway.

  1. Download the DHCP Config Automatic Sync Tool from Microsoft.
  2. Extract the zip file to your desired destination folder (ex: C:\scripts\dhcpSync).
  3. Open powershell and navigate to the extracted tool folder.
  4. Run .\install.ps1.
  5. Open Task Manager, navigate to Microsoft -> DHCP Server.
  6. Right-click the newly created task and choose ‘Run’.

You’re now sync’ing. Grats!