Managing Hyper-V

StorageNinja

Now we come to my question.

Is there any reason to not put all the Hyper-V Hosts into a single domain to ease management?

For security and stability I've always seen at any real scale you run a Management domain. Also, given cases of Cyrtolocker hitting Hyper-V hosts I'd be damned careful with separate accounts/domains for Hyper-V hosts as someone encrypting your VM's can bypass a LOT of your protections.

StorageNinja

@scottalanmiller said in Managing Hyper-V:

ecosystem

Also dropping Nano from being a supported path sucks for people who were hoping for it to be a true small secure embedded install (Core requires a 32GB DISK!)

StorageNinja

@scottalanmiller said in Managing Hyper-V:

@dbeato said in Managing Hyper-V:

@scottalanmiller You need a Windows 8.1 or Windows 10 computer, and like I said on my post before you can go to the c$ of that HyperV enter the username and password and then connect using the Hyperv console.

Okay, having him try that. What about if you are not on a LAN and not willing to expose SMB over the WAN?

Wouldn't you never put a hypervisor on the public internet directly on any port?

stacksofplates

@John-Nicholson said in Managing Hyper-V:

@scottalanmiller said in Managing Hyper-V:

ecosystem

Also dropping Nano from being a supported path sucks for people who were hoping for it to be a true small secure embedded install (Core requires a 32GB DISK!)

Holy crap. I didn't realize it was that big.

StorageNinja

@Tim_G that you get triple redundant, or more, secure web remote management plus no open port remote assistance all automatic and out of the box and that almost no one else offers that

No open port remote assistance is a commodity (I can throw a rock and hit a vendor who does this). If your talking phone home support The top 3-4 HCI appliance vendors fit the bill here.

StorageNinja

@stacksofplates said in Managing Hyper-V:

@John-Nicholson said in Managing Hyper-V:

@scottalanmiller said in Managing Hyper-V:

ecosystem

Also dropping Nano from being a supported path sucks for people who were hoping for it to be a true small secure embedded install (Core requires a 32GB DISK!)

Holy crap. I didn't realize it was that big.

Hyper-V's dependency on a DOM0 style Windows VM in the IO path means it's impossible to shrink the install that small. Xen isn't quite as bad (You can build a damn small DOM0) KVM is next in size (You can shrink it quite a bit) and then ESXi being the smallest (few hundred MB is all the VMkernel takes up with the rest being log, crash dumps, and VMTools that technically you can redirect).

This is why a Hyper-V environment should require monthly patching while a shrunk and reasonably hardened KVM or ESXi environment can easily go quarterly or farther to maintain compliance requirements.

matteo nunziati

@stacksofplates said in Managing Hyper-V:

@John-Nicholson said in Managing Hyper-V:

@scottalanmiller said in Managing Hyper-V:

ecosystem

Also dropping Nano from being a supported path sucks for people who were hoping for it to be a true small secure embedded install (Core requires a 32GB DISK!)

Holy crap. I didn't realize it was that big.

my hyper-v server 2016 is around 8GB including the altaro agent.

matteo nunziati

@Dashrender ok, this is what I've done accordingly to my notes:

on the hyperv host:

winrm quickconfig (yes to all questions)
net user /add <USERNAMEHERE>
net <USERNAMEHERE> <PASSWORDHERE>
net localgroup Administrators /add <USERNAMEHERE>

on the control machine

winrm quickconfig (yes to all questions)
net user /add <USERNAMEHERE>
net <USERNAMEHERE> <PASSWORDHERE>
winrm set winrm/config/client @{TrustedHosts=”<IP-OR-FQDN-OF_HOST>”}

Do not promote user to admins in the control machine: it is uneeded.

you have then to adjust win firewall rules but you can control any host from the mmc snap-in if you have an adequately recent version of win (win ver >= hyper-v ver)

the trick is to run the snap-in as the dedicated user. I've made a bat with the following contents:

runas /user:<USERNAMEHERE> "%windir%\System32\mmc.exe %windir%\System32\virtmgmt.msc"

Obsolesce

@John-Nicholson said in Managing Hyper-V:

@scottalanmiller said in Managing Hyper-V:

ecosystem

Also dropping Nano from being a supported path sucks for people who were hoping for it to be a true small secure embedded install (Core requires a 32GB DISK!)

Why would anyone use that for a Hyper-V Host? I certainly wouldn't, unless 2016 Full Datacenter edition is needed at the host level for some reason. If you need to use Hyper-V, Hyper-V Server 2016 or Nano Server is the way to go.

Obsolesce

@John-Nicholson said in Managing Hyper-V:

@scottalanmiller said in Managing Hyper-V:

ecosystem

Also dropping Nano from being a supported path sucks for people who were hoping for it to be a true small secure embedded install (Core requires a 32GB DISK!)

Also, dropping Nano support from what?

scottalanmiller

@John-Nicholson said in Managing Hyper-V:

@Dashrender said in Managing Hyper-V:

Now we come to my question.

Is there any reason to not put all the Hyper-V Hosts into a single domain to ease management?

For security and stability I've always seen at any real scale you run a Management domain. Also, given cases of Cyrtolocker hitting Hyper-V hosts I'd be damned careful with separate accounts/domains for Hyper-V hosts as someone encrypting your VM's can bypass a LOT of your protections.

This is always how I feel about it. Separate everything for platform.

scottalanmiller

@John-Nicholson said in Managing Hyper-V:

@scottalanmiller said in Managing Hyper-V:

@dbeato said in Managing Hyper-V:

@scottalanmiller You need a Windows 8.1 or Windows 10 computer, and like I said on my post before you can go to the c$ of that HyperV enter the username and password and then connect using the Hyperv console.

Okay, having him try that. What about if you are not on a LAN and not willing to expose SMB over the WAN?

Wouldn't you never put a hypervisor on the public internet directly on any port?

Depends on what you call directly. Any why not? We used to feel this way about servers in general, then cloud came along and now it's the standard. You want your platform pretty tight and locked down. But one way or another all systems need to be managed. Every enterprise cloud's platform management is directly on the Internet (Amazon, Azure, etc.) There is no getting around it. So yes, I would definitely put my platform management on the Internet.

scottalanmiller

@stacksofplates said in Managing Hyper-V:

@John-Nicholson said in Managing Hyper-V:

@scottalanmiller said in Managing Hyper-V:

ecosystem

Also dropping Nano from being a supported path sucks for people who were hoping for it to be a true small secure embedded install (Core requires a 32GB DISK!)

Holy crap. I didn't realize it was that big.

Isn't that only the "role" install, not a proper one?

BRRABill

@JaredBusch said

Are you not paying any attention to what you are reading?? Remote access is not console access.

I rarely pay attention. Makes things too boring.

Oksana

StarWind is currently working on the new product - a flexible and customizable web-based platform which will allow users get the full control over their IT infrastructures from a single HTML5 graphical interface including S2D, Failover Clustering and Hyper-V. More information to be found in a nearby thread: https://mangolassi.it/topic/14114/help-starwind-to-pick-the-name-for-the-upcoming-product

Dashrender

@Oksana said in Managing Hyper-V:

StarWind is currently working on the new product - a flexible and customizable web-based platform which will allow users get the full control over their IT infrastructures from a single HTML5 graphical interface including S2D, Failover Clustering and Hyper-V. More information to be found in a nearby thread: https://mangolassi.it/topic/14114/help-starwind-to-pick-the-name-for-the-upcoming-product

Very cool - but the big question - will it allow the launching of a console connection to a VM?

matteo nunziati

@Tim_G said in Managing Hyper-V:

Also dropping Nano from being a supported path sucks for people who were hoping for it to be a true small secure embedded install (Core requires a 32GB DISK!)

I think he means nano is available only for those with a datacenter licence. maybe he was hoping in an hyper-v server 2016 based on nano rather than on core.
anyway MY core is just around 8GB, small enough. Also microsoft has some issues with "no-gui". you go from core, which is something like linux cmd line + xserver + fluxbox, to something with no local management at all! ASAP nano can be managed only by remote powershell. No local login.

Obsolesce

@matteo-nunziati said in Managing Hyper-V:

@Tim_G said in Managing Hyper-V:

Also dropping Nano from being a supported path sucks for people who were hoping for it to be a true small secure embedded install (Core requires a 32GB DISK!)

I think he means nano is available only for those with a datacenter licence.

Well that makes perfect sense, because Hyper-V Server is free, and does just Hyper-V. Nano Server should not be free, because it can do a LOT of things, in addition to Hyper-V. The list is long, and continues to grow.

Also, there's two versions of Nano Server: Datacenter and Standard

Obsolesce

@matteo-nunziati said in Managing Hyper-V:

nyway MY core is just around 8GB, small enough. Also microsoft has some issues with "no-gui". you go from core, which is something like linux cmd line + xserver + fluxbox, to something with no local management at all! ASAP nano can be managed only by remote powershell. No local login.

They allowed the whole switching from GUI to Core and vice versa in Server 2012 R2. They removed that ability in 2016 for good reason, imo.
But even in 2016 core, you can install apps easily... even in Hyper-V Server if it's licensed.

matteo nunziati

@Tim_G said in Managing Hyper-V:

@matteo-nunziati said in Managing Hyper-V:

nyway MY core is just around 8GB, small enough. Also microsoft has some issues with "no-gui". you go from core, which is something like linux cmd line + xserver + fluxbox, to something with no local management at all! ASAP nano can be managed only by remote powershell. No local login.

They allowed the whole switching from GUI to Core and vice versa in Server 2012 R2. They removed that ability in 2016 for good reason, imo.
But even in 2016 core, you can install apps easily... even in Hyper-V Server if it's licensed.

no my point is: core is not guiless. it still run in a gui env. simply you do not have gui tools. but definitively it has a window manager, or you will land in a huge dos shell. period.