I ended up starting over from bare metal. Second attempt was A LOT better. Thank you everyone for all of your help.

@stacksofplates said in If all hypervisors were priced the same...:

@storageninja said in If all hypervisors were priced the same...:

@stacksofplates said in If all hypervisors were priced the same...:

Also, decisions are often more nuanced than simple TCO decisions. If you have compliance requirements this often shifts to commercial solutions that have validated FIPS 140-2 modules/solutions. If you need a DISA STIG at a given level paying some money and being able to deploy a single VIB to harden compliance vs. go through checklists and argue with auditors can be a big deal. How do you quantify the cost of applying with NIST for validation with a do it yourself setup vs. a turnkey solution?

RHEL/RHV have a good solution here. Auditors go through OpenSCAP scans with nice HTML reports and we justify any “failures.” It’s a pretty nice system.

That just audits if it was set. What I'm talking about is a single package you deploy that goes ahead and sets the configuration settings up for you.

On ESXi you can use Update Manager to track compliance with the DISA VIB, and use that for tracking it. Just attach as a baseline to your clusters and let Update Manager keep it up to date. Ed Groggin I think has a tool that will do an auto-generation of a report on the hardening guidelines.

Looking online, I'm not seeing Server 2016 in STIG viewer yet. Has Microsoft not gotten a STIG out yet?

Also Redhat Virtulization licensing cost as much (or more) than vSphere Standard. At that point if you don't need/want Redhat support VMware looks a lot more attractive. Oddly the only STIG for Suse I'm seeing is for Z series.

Well yes and no. They have built in remediations with OpenSCAP, so you can have it auto remediate your machine. We ran an auto remediate to get the correct settings and then pushed it all out with Ansible since we can apply specific rules or not based on the type of machine since they are all RHEL based (workstations, servers, hypervisors, etc). We don’t use RHV, but they have a subset of rules for RHV which is why I mentioned it. We use bare KVM for systems and it works out pretty well. Ya I’m not sure about 2016 but I wouldn’t be surprised seeing how slow they are.

The remediations are in Bash, Ansible, and I think Puppet? Anyway I have written a few of the Ansible remediations for them and have had them pulled into the project.

There should be no reason I have to ask, but this supports SSL, correct? Do you have instructions on how we could use this to use Let Encrypt to secure this?

@tim_g said in Everything You Need to Know About Microsoft Windows Hyper-V Server:

Windows is an operating system... that's like saying Microsoft Windows Office 2016, or Microsoft Windows Skype.

It just doesn't make any sense what so ever.

Correct terms:
Windows Server 2016
Microsoft Office 2016
Hyper-V Server 2016
Windows Server 2016 with Hyper-V Server Role Installed
Windows 10 with Hyper-V Feature Installed

Microsoft Windows XBOX One. :face_with_stuck-out_tongue_winking_eye:

Just tried it, and yes, missing integration services.

Long story short: I'll stick with Ubuntu 😉 Yeah, I know, I could easily install them, but I'm more in the Debian corner anyway.

Now as a general recommendation (really never do this), don't install Windows Server onto the bare metal, install your hypervisor to the bare metal. In this case Hyper-V.

Apply your licensing to the 2 VM's that you are allowed to create with Standard (and up licensing) then you'll be allowed to move your VM's around every 90 days or sooner for hardware failures etc.

@tim_g said in question about Hyper-V resource management?:

@wirestyle22 said in question about Hyper-V resource management?:

@tim_g said in question about Hyper-V resource management?:

@wirestyle22 said in question about Hyper-V resource management?:

@tim_g said in question about Hyper-V resource management?:

@wirestyle22 said in question about Hyper-V resource management?:

@dave247 said in question about Hyper-V resource management?:

@dashrender said in question about Hyper-V resource management?:

@net-runner said in question about Hyper-V resource management?:
http://hv-manager.org/.

https://i.imgur.com/zEE4HQh.png

At least you get 5 VMs, but the 5Nines gives you 6..

I'll bring it back around and say that now that I've gotten past the couple of annoying obstacles with Hyper-V and remote management, Hyper-V is freaking awesome. It seems lightning fast.

The annoying thing for me is the versioning needed to manage hyper-v. Example: For Hyper-V 2016 you need a windows 10 machine to manage it.

No you don't.

You can pay for stuff to manage it, but I mean it doesn't automatically allow that

Windows 7+ with RSAT.

I just did that at my last job and it didn't allow it

I used Hyper-V 2016 with Win7 RSAT before I loaded Win10.

Hm. I should try it again I guess at home

@dustinb3403 said in Cross-Post Hyper-V and Backup recommendations:

My question is, should I also run backup agents (I use Veeam), on the Hyper-V environments and back them up as if they were physical boxes? Or is the daily backup fine.

General practice is to not back up the host itself. You should have a process to rebuild the host and, in theory, this should be incredibly fast and simple. Since restoring bare metal is always a pain because you have to get the restore going without an agent, rebuilding a nearly stateless host is generally faster and simpler and doesn't require storage and management.

@tim_g said in Hyper-V Network card setup?:

@dave247 said in Hyper-V Network card setup?:

Thanks. And this isn't for testing. I actually want to use this server for some production servers.

Sorry, didn't know. I mistakenly assumed testing and lab because of the time frame.

But you can't go wrong with doing it that way.

If you have no need for an extra NIC you could do a 3-NIC team. If you are fine with no management NIC, do a 4-port team and share it with your management OS if for some reason you need that many NICs in a team. Though you probably don't.

Yeah well it is for some low-risk servers, so, kinda almost testing, but not really, if that makes sense. lol

I don't believe a GUI played a role in my issue, but I won't completely dismiss the possibility either.

@JaredBusch said in KVM VM Replication:

@scottalanmiller said in KVM VM Replication:

Just using the search is best

Tags.

yeah, having tags on the topics makes them better than pinning.

Right, NIC Teaming is not a Hyper-V feature. There is almost no reason to do it that way.

Also, you don't want to use "Hyper-V" load balancing after Windows Server 2012. Starting with 2012 R2, Dynamic is the preferred algorithm. Only in super rare cases would you use any other algorithm.

IMHO, dispersing the storage between the hosts and configuring data replication between them would be the best option.

Creating several tiers for the migration of your VMs is always nice to have - downtime strikes unexpectedly.

good article thanks and handy script

@nerdydad said in Hyper-V Host - Member of the domain or not:

@jaredbusch said in Hyper-V Host - Member of the domain or not:

@tim_g said in Hyper-V Host - Member of the domain or not:

@jaredbusch said in Hyper-V Host - Member of the domain or not:

@jmoore said in Hyper-V Host - Member of the domain or not:

I enable the local admin and set a secure password for everything here as sometimes machines quit responding to the Windows domain controller and I have to have a way to reset things.

By stating that you enable local admin, I want to know how it was disabled in the first place.

I don't know what the issue is here.

When you install Hyper-V Server, you can't log in any way other than local admin. Maybe after you join it to the domain you can disable the local admin account, which is weird to do...

That is entirely my point.

This was supposed to be more of a "Best Practices" question. I really don't have a problem situation in front of me, but wanted to better understand best practices when setting up a Hyper-V host.

I have setup a number of Windows 10 client devices and noticed that the local admin is disabled. I assumed (though never experienced) that the situation would be the same for a Hyper-V host.

Local Administrator account in Windows Servers and Hyper-V is enabled by default. Windows desktops has the local administrator account disabled by default.

@scottalanmiller said in MS Licensing - 3rd:

Just search "Windows 7 vdi licensing" and the MS PDF is the first hit.

So that's where they hide it... in the EULA of a separate product or whatever you want to call it.

But yeah, it's pretty clear in there.

@matteo-nunziati said

this is the list of things provided by the full agent

I wish that chart broke it down by

@tim_g said in Port - Storage Spaces Direct (S2D): SCSI Enclosure Services (SES) needed only on HBA?:

@dashrender

RAID would be provided by SS.

He would need a controller that is pass-through.

Technically S2D is designed to be used by DAS systems (or JBODs if you like to make Scott facepalm), and not internal server storage... even though it works just fine.

There's no problem to use RAID controller instead of a basic HBA as long as you a) patch the registry (see my link below) or use special "filter" driver to report "RAID" bus (sic!) as SATA or SAS, and b) disable write-back cache on BOTH controller and disk itself, so all writes become atomic.

Storage Spaces Direct: Enabling S2D work with unsupported device types (BusType = NVMe, RAID, Fibre Channel). Part 1: Registry hack

https://www.starwindsoftware.com/blog/resolving-enable-clusters2d-bus-type-support-issue-on-some-storage-controllers

P.S. It's a BAD idea to use anything like that in production because as long as Microsoft support will discover your S2D configuration isn't supported they will pull out and walk away with a grin face.