• Fix bug that kept Virtual Distributed Switches data from being in the report
• When using -Import and -Full, handle making sure the vCenter name is given
• When using -Import and -Full, handle making sure the vCenter is disconnected when the script completes
• Updated the help text
• Updated the ReadMe file

You can always find the most current script by going to https://www.carlwebster.com/where-to-get-copies-of-the-documentation-scripts/

Thanks

Webster

On May 24, 2021, I published the Building Webster’s Lab V2 article series that used vSphere/vCenter 7.0 original release and XenServer 8.2.0.

This is a follow-up on building the lab with vSphere/vCenter 7.0U3L and XenServer 8.2.1.

Why didn’t I use vSphere/vCenter 8? Neither my hardware nor Synology units support vSphere 8. There is a change I can make to an install file to bypass the hardware compatibility check, but I would rather not risk it. It took Synology a long time to add vSphere 7 support, so I have no idea how long before they add support for vSphere 8.

I need to rebuild the lab because something terrible happened after powering down the lab for an extended weekend. When I powered on the lab after returning to the lab the following Monday, the vSphere servers would not connect to local storage and NFS storage, nor connect to any switches or networking.

Read the rest in the PDF…

You can always find the most current PDF by going to https://www.carlwebster.com/where-to-get-copies-of-the-documentation-scripts/

Thanks

Webster

• Allow multiple output formats. You can now select any combination of HTML,  MSWord, PDF, or Text
• Changed some Write-Error to Write-Warning and changed some Write-Warning to Write-Host
• Changed the default output to HTML
• Fixed remaining $Null comparisons where $null was on the right instead of the  left of the comparison
• Fixed some text formatting issues
• If you select PDF for Output and Microsoft Word is not installed, update the  error message to state that PDF uses Word’s SaveAs PDF function
• In Function BuildDRSGroupsRules, fixed variable $DRSGroupsRules not  defined error
• In Function OutputClusters, added explanations from VMware for each  counter
• In Function OutputResourcePools, fixed invalid property name Name
• In Function OutputVirtualMachines, added explanations from VMware for  each counter and fixed one wrong counter name
• In Function OutputVMHost made changes to the VMware performance  counters put in Charts by separating the counters instead of grouping
  • If one counter was not available, then no chart was created for any of the  counters grouped together
  • Added explanations from VMware for each counter
• Made minor changes to Function AddStatsChart
• Reformatted most Write-Error messages to show better in the console
• Removed all comments referencing versions before 2.00
• Removed existing Script ParameterSets and left only one for “WordPDF”
• Thanks to T.E.R. for testing with vCenter 8
• Updated the following functions to the latest versions:
  • AddHTMLTable
  • AddWordTable
  • CheckWordPrereq
  • FormatHTMLTable
  • GetCulture
  • Line
  • ProcessDocumentOutput
  • SaveandCloseDocumentandShutdownWord
  • SaveandCloseHTMLDocument
  • SaveandCloseTextDocument
  • SetupHTML
  • SetupText
  • SetupWord
  • SetWordCellFormat
  • SetWordHashTable
  • ValidateCoverPage
  • WriteHTMLLine
  • WriteWordLine
• Updated the help text
• Updated the ReadMe file

You can always find the most current script by going to https://www.carlwebster.com/where-to-get-copies-of-the-documentation-scripts/

Thanks

Webster

• Fixed a $Null comparison where null was on the right instead of the left of the comparison
• Fixed a missing variable $tempPWD
• Test for variable $global:DefaultVIServer before using
• Tested with PowerCLI 13.1

You can always find the most current script by going to https://www.carlwebster.com/where-to-get-copies-of-the-documentation-scripts/

Thanks

Webster

Script Bug Fix Updates 7-Feb-2022

• Changed the date format for the transcript and error log files from yyyy-MM-dd_HHmm format to the FileDateTime format
  • The format is yyyyMMddTHHmmssffff (case-sensitive, using a 4-digit year, 2-digit month, 2-digit day, the letter T as a time separator, 2-digit hour, 2-digit minute, 2-digit second, and 4-digit millisecond).
  • For example: 20221225T0840107271.
• Fixed the German Table of Contents (Thanks to Rene Bigler)
  • From
    • ‘de-‘ { ‘Automatische Tabelle 2’; Break }
  • To
    • ‘de-‘ { ‘Automatisches Verzeichnis 2’; Break }
• In Function AbortScript, add test for the winword process and terminate it if it is running
  • Added stopping the transcript log if the log was enabled and started
• In Functions AbortScript and SaveandCloseDocumentandShutdownWord, add code from Guy Leech to test for the “Id” property before using it
• Replaced most script Exit calls with AbortScript to stop the transcript log if the log was enabled and started
• Updated the help text
• Updated the ReadMe file

Active Directory 3.09 7-Feb-2022

• • Added to Domain Information the data for ms-DS-MachineAccountQuota

Active Directory Health Check 3.09 7-Feb-2022

• • Add missing variable $Script:ThisScriptPath
  • Changed all Write-Verbose statements from Get-Date to Get-Date -Format G as requested by Guy Leech
  • Removed Function Stop-Winword
  • Updated Functions CheckWordPrereq and SetupWord with the versions used in the other documentation scripts

Citrix Federated Authentication Services 1.14 7-Feb-2022

Citrix Provisioning Services (PVS) New 6.03 8-Feb-2022

Citrix Provisioning Services (PVS) Old 4.32 10-Feb-2022

Citrix XenApp/XenDesktop 7.0 through 7.7 1.51 13-Feb-2022

• • Since the Citrix.GroupPolicy.Commands.psm1 module file was removed in  1.50,  removed the block for Elevation if $Policies is True

Citrix XenApp/XenDesktop 7.8 through CVAD 2006 2.46 15-Feb-2022

Citrix Virtual Apps and Desktops V3.32 15-Feb-2022

Microsoft Configuration Manager 2012R2 V2.40 17-Feb-2022

Microsoft DHCP V2.05 17-Feb-2022

Microsoft DNS V2.03 18-Feb-2022

Citrix NetScaler Old (uses ns.conf file) V2.62 18-Feb-2022

• • Fixed $Null comparisons that were on the wrong side
  • Updated Functions CheckWordPrereq and SendEmail to the latest version

Parallels RAS V17 V1.02 18-Feb-2022

• • Added Function OutputReportFooter
  • Added Parameter ReportFooter
    • Outputs a footer section at the end of the report.
    • Report Footer
      • Report information:
        • Created with: <Script Name> – Release Date: <Script Release Date>
        • Script version: <Script Version>
        • Started on <Date Time in Local Format>
        • Elapsed time: nn days, nn hours, nn minutes, nn.nn seconds
        • Ran from domain <Domain Name> by user <Username>
        • Ran from the folder <Folder Name>
  • Updated Functions SaveandCloseTextDocument and  SaveandCloseHTMLDocument to add a “Report Complete” line
  • Updated Functions ShowScriptOptions and ProcessScriptEnd to add  $ReportFooter

Parallels RAS V18 V2.11 18-Feb-2022

• • Added Function OutputReportFooter
  • Added Parameter ReportFooter
    • Outputs a footer section at the end of the report.
    • Report Footer
      • Report information:
        • Created with: <Script Name> – Release Date: <Script Release Date>
        • Script version: <Script Version>
        • Started on <Date Time in Local Format>
        • Elapsed time: nn days, nn hours, nn minutes, nn.nn seconds
        • Ran from domain <Domain Name> by user <Username>
        • Ran from the folder <Folder Name>
  • Updated Functions SaveandCloseTextDocument and  SaveandCloseHTMLDocument to add a “Report Complete” line
  • Updated Functions ShowScriptOptions and ProcessScriptEnd to add  $ReportFooter

VMware vSphere 1.93 23-Feb-2022

Citrix XenApp 6.5 5.06 23-Feb-2022

If you have questions or issues, please email me. webster at carlwebster dot com.

You can always find the most current script by going to https://www.carlwebster.com/where-to-get-copies-of-the-documentation-scripts/

Thanks

Webster

• Added a message at the end of the script stating if the disconnection from the vCenter server was successful or not
• Added array error checking for non-empty arrays before attempting to create the Word table for most Word tables
• Added color $wdColorWhite for Function SetWordCellFormat
• Added Function OutputReportFooter
• Added in missing function BuildMultiColumnTable
• Added Parameter ReportFooter
  • Outputs a footer section at the end of the report.
  • Report Footer
    • Report information:
      • Created with: <Script Name> – Release Date: <Script Release Date>
      • Script version: <Script Version>
      • Started on <Date Time in Local Format>
      • Elapsed time: nn days, nn hours, nn minutes, nn.nn seconds
      • Ran from domain <Domain Name> by user <Username>
      • Ran from the folder <Folder Name>
• Changed all Write-Verbose $(Get-Date) to add -Format G to put the dates in the user’s locale – recommended by Guy Leech
• Fixed incorrect host variable name in Function OutputVirtualMachines
• Fixed issues with Functions ProcessOpticalIssues and OutputOpticalIssues
  • These functions now work and report accurate data
  • Fixed to allow handling multiple CD/DVD drives per VM
• General code cleanup
• In Function OutputDatastores
  • Fixed handling of NFS datastores
  • Fixed handling of NFS datastores with multiple NFS Servers
  • If the SIOC Threshold is null, don’t output a blank line with only ” ms”
• In Function OutputVirtualMachines
  • Removed Description
  • Always output Notes
  • Update variable name for VM Hardware Version
  • Fixed Network Adapters to use the new cmdlet Get-NetworkAdapter
  • Fixed Hard Disk to use the new cmdlet Get-HardDisk
  • Fixed VM has Snapshots to use the new cmdlet Get-Snapshot
  • Fixed text output
• In Function OutputVMPortGroups fixed several variable name typos
• In Functions OutputVMPortGroups and OutputVMKPorts fixed the handling of the property VLanId when it didn’t exist
• Reordered the parameters in an order recommended by Guy Leech
• Tested with vCenter 7.0 U2 and PowerCLI 12.3 and 12.4
• Updated Function SetWordCellFormat to latest version
• Updated Functions SaveandCloseTextDocument and SaveandCloseHTMLDocument to add a “Report Complete” line
• Updated Functions ShowScriptOptions and ProcessScriptEnd to add $ReportFooter
• Updated the help text
• Updated the ReadMe file
• When using Export, the Export folder honors the path specified if you use the Folder parameter
• When using Export, the script no longer processes building output at the end of the script for output formats since they were all set to False

Thanks to fellow CTP Thomas Krampe for the push to add the report footer.

Thanks to David McSpadden, David Prows, and fellow CTP Bart Jacobs for all the testing.

If you have questions or issues, please email me. webster at carlwebster dot com.

You can always find the most current script by going to https://www.carlwebster.com/where-to-get-copies-of-the-documentation-scripts/

Thanks

Webster

From the  Introduction article, these are the VMs we are building.

VMware

Note: All my Windows infrastructure servers run in XenServer 8.2. As of 28-Aug-2021, XenServer 8.2 does not officially support Windows Server 2022. I am walking you through the process of creating a VM from the VMware Server 2022 template. The VMs created in this article series still use Windows Server 2019 because XenServer 8.2 doesn’t support Server 2022. I plan to use the Server 2022 Template to create the Remote Desktop Services Hosts for the Learning the Basics of VMware Horizon 8 2106 article series.

In vCenter, right-click the Server 2022 Template and click on New VM from This Template…, as shown in Figure 1.

Enter a Virtual machine name and click Next, as shown in Figure 2.

Click Next, as shown in Figure 3.

Select the NFS shared datastore created earlier in this series and click Next, as shown in Figure 4.

Select Power on virtual machine after creation and click Next, as shown in Figure 5.

Verify that the configuration data for the new VM is correct and click Finish, as shown in Figure 6. If any item is incorrect, click Back, correct the item(s), and continue.

It took about 3.5 minutes to create the VM from the template in my lab.

Wait for the creation of the VM to complete, as shown in Figure 7.

Connect to the VM using Remote Console.

We need to complete the Out of Box Experience.

Select the appropriate settings and click Next, as shown in Figure 8.

Click on Do this later when asked for a product key, as shown in Figure 09.

Click Accept to accept the license terms, as shown in Figure 10.

Enter the credentials for the local Administrator account and click Finish, as shown in Figure 11.

Since we enabled Remote Desktop in the Template, the new VM has it enabled.

In vCenter, select the new template VM, and in the right pane, look at the IP address, as shown in Figure 12.

As shown in Figure 13, click Start, Run, and type in mstsc /v:ipaddress /admin, and press Enter [where IP Address is the IP address shown in Figure 12].

Using Remote Desktop at this point makes it easier for me to get screenshots.

Enter the local Administrator credentials, and click OK, as shown in Figure 14.

Click Yes, as shown in Figure 15.

Click Local Server in the left pane of Server Manager, as shown in Figure 16.

I made the settings in bold to this VM.

• Computer name: LabDC1
  • Note: Some software and licensing products use the CasE sEnsiTivE name. The Citrix License Server is one of those.
• Ethernet0: As shown in Figures 17 and 18.
  • Click the link IPv4 address assigned by DHCP
  • Right-click the vmxnet3 Ethernet Adapter
  • Click Properties
  • Click the Configure button
  • In the Power Management tab, deselect all three items, and click OK to save the changes
  • Right-click the vmxnet3 Ethernet Adapter
  • Click Properties
  • Click Internet Protocol Version 4 (TCP/IPv4)
  • Click Properties
  • Select Use the following IP address
    • Because this is a server, assign it a static IP address
    • Enter the appropriate Subnet mask
    • Enter the appropriate Default gateway
  • Select Use the following DNS server addresses
    • Enter at least the Preferred DNS server (for most labs, this is usually the same as the Default gateway)
  • Note: Once your click OK, the Remote Desktop connection is lost. Use mstsc again to connect using the assigned static IP address.
• Product ID: I used a license key from my Microsoft Action Pack Subscription, as shown in Figure 19.

Feel free to make any other configuration changes you wish to this VM.

Repeat this process to create any additional VM required.

XenServer

As of 28-Aug-2021, XenServer 8.2 does not officially support Windows Server 2022.

You can download Server 2022 from MSDN/Visual Studio or the Microsoft Evaluation Center. I downloaded the ISO and uploaded it to my vCenter ISO data store. As of 28-Aug-2021, only vCenter 7.02 U2 supports Server 2022. Citrix XenServer 8.2, at this time, does not offer support for Server 2022.

For this article, I used Windows Server 2022 Standard Edition.

This article covers creating a template in VMware vCenter.

VMware

In vCenter, right-click the cluster and click on New Virtual Machine…, as shown in Figure 1.

Select Create a new virtual machine and click Next, as shown in Figure 2.

Enter a Virtual machine name and click Next, as shown in Figure 3.

Click Next, as shown in Figure 4.

Select the NFS shared datastore created earlier in this series and click Next, as shown in Figure 5.

Keep the default Compatible with the value of ESXi 7.0 U2 and later and click Next, as shown in Figure 6.

Verify that the Guest OS Family is Windows and that the Guest OS Version is Microsoft Windows Server 2022 (64-bit) and click Next, as shown in Figure 7.

For CPU and Memory, use what works for your environment. For me, as shown in Figure 8, I used the following values:

• CPU: 4
• Memory: 8 GB
• New Hard disk: 90GB with Disk Provisioning type Thin Provision
• New SCSI controller: LSI Logic SAS
• New Network: VM Traffic vDS 10Gb (or whatever VM traffic vDS you created) and Adapter Type must be vmxnet3
• New CD/DVD Drive: Select the Windows Server 2022 ISO file from the ISO Datastore. Make sure to also select Connect At Power On

Use default values for the remaining options and click Next, as shown in Figure 8.

Verify that the configuration data for the new VM is correct and click Finish, as shown in Figure 9. If any item is incorrect, click Back, correct the item(s), and continue.

Wait for the creation of the VM to complete, as shown in Figure 10.

In vCenter, select the new template VM, and in the right pane, click LAUNCH REMOTE CONSOLE, as shown in Figure 11.

Note: From Abdullah Abdullah. You can use the Web Console instead of the Remote Console, but the VM must be powered on first to make the option available.

If you receive a popup stating You’ll need a new app to open this vrmc link, as shown in Figure 12, press Esc.

In vCenter, click the circled lower case I, as shown in Figure 13.

In the popup that appears, click Download Remote Console, as shown in Figure 14.

Follow the steps to install the VMware Remote Console, as shown in Figure 15.

Once you install the console, in vCenter, select the new template VM, and in the right pane, click LAUNCH REMOTE CONSOLE, as shown in Figure 11.

Depending on the speed of your ESXi hosts, you need to be quick in the following steps.

1. Click the Green start button, as shown in Figure 16,
2. Click inside the console window,
3. Press a key, for example, the spacebar when prompted, as shown in Figure 17.

The installation of Windows Server 2022 begins.

Select the options appropriate for you and click Next, as shown in Figure 18.

Click Install now, as shown in Figure 19.

The Microsoft Action Pack Subscription has licenses for Windows Server 2022 Standard. I selected Windows Server 2022 Standard (Desktop Experience). Select either Standard or Datacenter, depending on the license you have.

Click Next, as shown in Figure 20.

Select I accept the Microsoft Software License Terms and click Next, as shown in Figure 21.

Select Custom: Install Microsoft Server Operating System only (advanced), as shown in Figure 22.

Click Next, as shown in Figure 23.

The Server 2022 installation begins, as shown in Figure 24.

After the VM restarts, enter a password for the local Administrator account and click Finish, as shown in Figure 25.

Press Ctrl-Alt-Insert, enter the password for the Administrator account, and press Enter, as shown in Figures 26 and 27.

Note: If you press Ctrl-Alt-Delete, your local computer processes that key combination. Ctrl-Alt-Insert is what most virtualization and remote consoles accept as Ctrl-Alt-Delete.

Note: Unlike with Windows Server 2019, Server 2022 appears to have some VMware network capability built-in. I checked the VM, and there were no VMware Tools installed, yet the network icon in the lower right corner does not have a red slash as Server 2019 did at this point in the installation and configuration.

You may receive a Networks popup message. Decide whether you want this VM discoverable on your network and click either Yes or No, as shown in Figure 28.

Close the popup shown in Figure 29 for Windows Admin Center. If you don’t want to see this popup again, select Don’t show this message again.

We need to install the VMware tools. Please see Overview of VMware Tools for a complete description.

Overview of VMware Tools

VMware Tools is a suite of utilities that enhances the performance of the virtual machine’s guest operating system and improves the management of the virtual machine. Without VMware Tools installed in your guest operating system, guest performance lacks important functionality. Installing VMware Tools eliminates or improves these issues:

• Low video resolution
• Inadequate color depth
• Incorrect display of network speed
• Restricted movement of the mouse
• Inability to copy and paste and drag-and-drop files
• Missing sound
• Provides the ability to take quiesced snapshots of the guest OS
• Synchronizes the time in the guest operating system with the time on the host

In vCenter, right-click the VM, click Guest OS, and click Install VMware Tools…, as shown in Figure 30.

Click Mount, as shown in Figure 31.

In the VM, you see a popup in the lower right corner, as shown in Figure 32.

Click that popup and then click Run setup64.exe in the popup that appears in the upper right corner, as shown in Figure 33.

Click Next, as shown in Figure 34.

Select Typical and click Next, as shown in Figure 35.

Click Install, as shown in Figure 36.

Click Finish, as shown in Figure 37.

Click Yes, as shown in Figure 38.

After the VM restarts, log back in and click Local Server in the left pane of Server Manager, as shown in Figure 39.

We use a template to create additional VMs. These additional VMs, when first powered on, go through what Microsoft calls the Out of Box Experience or OOBE.

When customers turn on their Windows PCs for the first time, they see the Windows Out of Box Experience (OOBE). OOBE consists of a series of screens that require customers to accept the license agreement, connect to the internet, log in with or sign up for a Microsoft Account, and share information with the OEM.

The following items are available to customize. Some make no sense to customize as the OOBE resets them to default values.

Note: I made the settings in bold to my template VM.

• Computer name: Don’t change
• Workgroup: Changeable
• Windows Defender Firewall: Changeable
• Remote management: Changeable
• Remote Desktop: Changeable
  • Allow remote connections to this computer
• NIC Teaming: No need to change as there is only one network card at this time
• Ethernet0: Don’t change
• Last installed updates: Keeps date from Template VM
• Windows Update: Changeable
• Last checked for updates: Keeps date from Template VM
• Windows Defender Antivirus: Changeable
• Feedback & Diagnostics: Changeable
  • Feedback frequency: Never
• IE Enhanced Security Configuration: Changeable
  • Admin: Off
  • User: Off
• Time zone: Changeable
  • Change time zone: Central Time
  • Deselect Notify me when the clock changes
• Product ID: Don’t change

If you wish, you can install all Windows Updates, as I always do.

After you install all Windows Updates, reboot the server to clear any pending restart required flags.

After the VM restarts, log back in.

Right-click the Start button, click Run, as shown in Figure 40.

Type in c:\windows\system32\sysprep\sysprep.exe, and press Enter, as shown in Figure 41.

Select Generalize, select Shutdown from the Shutdown Options dropdown list, and click OK, as shown in Figure 42.

When the server is at the login screen, shut down the server.

After the VM completes the shutdown process, right-click the VM, click Edit Settings…, as shown in Figure 43.

Change CD/DVD drive 1 to Client Device and click OK, as shown in Figure 44.

Right-click the VM, click Template, and click Convert to Template, as shown in Figure 45.

Click Yes, as shown in Figure 46.

The VM is now a template, as shown in Figure 47.

I updated the PDF last on 22-Sep-2021.

You can always find the most current PDF by going to https://www.carlwebster.com/where-to-get-copies-of-the-documentation-scripts/

Thanks

Webster

The next step is to create a management computer from the Windows 10 template with the additional servers built and configured. We use the VM built in this article for PowerShell scripting running consoles from Citrix, Microsoft, Parallels, and VMware. My lab’s infrastructure VMs reside in my XenServer pool, as explained in the Introduction article. I consider the management computer an infrastructure computer as it is permanent.

Note: What I call a Management Computer goes by different names.

• Jump Server
• Jump Machine
• Jump Host
• Bastion Machine
• Bastion Host
• And I am sure other locations around the world use other names

Whatever you want to call it, this is a centralized computer for managing and accessing servers, network equipment, storage devices, and other management activities. Some people use a server operating system (OS), and some use a desktop OS. It depends on the licensing restrictions of the software used on the computer.

From the introduction article, this is the VM we are building.

VMware

In vCenter, right-click the Windows 10 Template and click on New VM from This Template…, as shown in Figure 1.

Enter a Virtual machine name and click Next, as shown in Figure 2.

Click Next, as shown in Figure 3.

Select the NFS shared datastore created earlier in this series and click Next, as shown in Figure 4.

Select Power on virtual machine after creation and click Next, as shown in Figure 5.

Verify that the configuration data for the new VM is correct and click Finish, as shown in Figure 6. If any item is incorrect, click Back, correct the item(s), and continue.

It took about 2 minutes to create the VM from the template in my lab.

Wait for the creation of the VM to complete, as shown in Figure 7.

Since we enabled Remote Desktop in the Template, the new VM has it enabled.

In vCenter, select the new Windows 10 VM, and in the right pane, look at the IP address, as shown in Figure 8.

As shown in Figure 9, click Start, Run, and type in mstsc /v:ipaddress /admin, and press Enter [where IP Address is the IP address shown in Figure 8].

Using Remote Desktop at this point makes it easier for me to get screenshots.

Enter the credentials for the local account created during the Windows 10 template build and press Enter, as shown in Figure 10.

Click Yes, as shown in Figure 11.

Select your region and click Yes, as shown in Figure 12.

Select your keyboard layout and click Yes, as shown in Figure 13.

Click Skip, as shown in Figure 14.

Click Accept, as shown in Figure 15.

Click Domain join instead, as shown in Figure 16.

Type in a local user account name and click Next, as shown in Figure 17.

Enter a password and click Next, as shown in Figure 18.

Confirm the password and click Next, as shown in Figure 19.

Select three security questions, enter the answer, and click Next, as shown in Figures 20 through 22.

Select your privacy settings and click Accept, as shown in Figure 23. I set them all to No.

Make a selection for Cortana, as shown in Figure 24. I selected Not now, plus one of the settings in my Lab Defaults Group Policy to disable the use of Cortana.

If you receive the following popup, click Yes, as shown in Figure 25. I only received this popup for VMware, not XenServer.

Right-click the network icon in the systray and click Open Network & Internet settings, as shown in Figure 26.

Click Change adapter options, as shown in Figure 27.

Right-click the adapter and click Properties, as shown in Figure 28.

Click Configure…, as shown in Figure 29.

Click the Power Management tab, deselect every option, and click OK, as shown in Figure 30.

Right-click the Adapter and click Properties, as shown in Figure 28.

Click Internet Protocol Version 4 (TCP/IPv4) and click Properties, as shown in Figure 31.

Select Use the following IP address, enter the IP information for your network, and click OK, as shown in Figure 32. For the DNS server addresses, use the IP addresses of your domain controllers.

How many DNS servers should you configure on the network adapter? Not as many as you think. I recommend on DCs, a total of three where the third is always 127.0.0.1. For all other computers, also no more than three. I have seen places with 15 DCs, and every computer had all 15 DCs in the list of DNS servers. If you understand Windows DNS client resolution timeouts, limit the number of DNS entries.

Click Close, as shown in Figure 33.

After clicking Close,  you lose the connection to the RDP session. Reconnect using the new static IP address.

Close Network Connections.

Click Home, then System, then About, and finally Rename this PC (Advanced), as shown in Figure 34.

Click Change, as shown in Figure 35.

Enter a Computer name, Domain, and click OK, as shown in Figure 36.

Enter the domain’s Administrator name and password and click OK, as shown in Figure 37.

Click OK, as shown in Figure 38.

Click OK, as shown in Figure 39.

Click Close, as shown in Figure 40.

Click Restart Now, as shown in Figure 41.

When the VM restarts, log in using the domain’s Administrator account.

Make any customizations you require to the VM before we start installing consoles. I upgraded my Windows 10 20H2 VM to Windows 10 21H1.

XenServer

In XenCenter, right-click the Windows 10 Template and click on New VM wizard…, as shown in Figure 42.

Select the Windows 10 Template template and click Next, as shown in Figure 43.

Enter a Name, an optional Description, and click Next, as shown in Figure 44.

Since the operating system is installed in the template VM, Click Next, as shown in Figure 45.

Select Don’t assign this VM a home server and click Next, as shown in Figure 46.

You may change the Number of vCPUs, Topology, and Memory if you wish. I left everything the same as the template VM. Click Next, as shown in Figure 47.

As my hosts do not have a GPU card, I clicked Next, as shown in Figure 48.

Click Edit, as shown in Figure 49.

I recommend changing both the Name and Description. Doing so makes it easier later if you ever delete a VM and its attached hard disks. If all the hard disks have the same name and description, it is challenging to determine which disks go with which VM.

Enter a Name and Description and click OK, as shown in Figure 50.

Click Next, as shown in Figure 51.

If multiple Virtual network interfaces are available, select the appropriate interface and click Next, as shown in Figure 52.

Verify all the configuration options are correct and click Create Now, as shown in Figure 53. If an option is not correct, click Previous, correct the option and then continue.

I deselected the option Start the new VM automatically since it doesn’t work.

Wait for the creation of the VM to complete, as shown in Figure 54. It took about 2 seconds in my lab to create the VM from the template.

In XenCenter, right-click the new VM and click Start, as shown in Figure 55.

Expand the XenServer host on which you started the VM, click the VM, and click the Networking tab, as shown in Figure 56. You see the IP address assigned to the VM.

As shown in Figure 57, click Start, Run, and type in mstsc /v:ipaddress /admin, and press Enter [where IP Address is the IP address shown in Figure 56].

Using Remote Desktop at this point makes it easier for me to get screenshots.

Enter the credentials for the local account created during the Windows 10 template build and press Enter, as shown in Figure 58.

Click Yes, as shown in Figure 59.

Select your region and click Yes, as shown in Figure 60.

Select your keyboard layout and click Yes, as shown in Figure 61.

Click Skip, as shown in Figure 62.

Click Accept, as shown in Figure 63.

Click Domain join instead, as shown in Figure 64.

Type in a local user account name and click Next, as shown in Figure 65.

Enter a password and click Next, as shown in Figure 66.

Confirm the password and click Next, as shown in Figure 67.

Select three security questions, enter the answer, and click Next, as shown in Figures 68 through 70.

Select your privacy settings and click Accept, as shown in Figure 71. I set them all to No.

Make a selection for Cortana, as shown in Figure 72. I selected Not now, plus one of the settings in my Lab Defaults Group Policy to disable the use of Cortana.

If you receive the following popup, click Yes, as shown in Figure 73. I only received this popup for VMware, not XenServer.

Right-click the network icon in the systray and click Open Network & Internet settings, as shown in Figure 74.

Click Change adapter options, as shown in Figure 75.

Right-click the adapter and click Properties, as shown in Figure 76.

Click Internet Protocol Version 4 (TCP/IPv4) and click Properties, as shown in Figure 77.

Select Use the following IP address, enter the IP information for your network, and click OK, as shown in Figure 78. For the DNS server addresses, use the IP addresses of your domain controllers.

How many DNS servers should you configure on the network adapter? Not as many as you think. I recommend on DCs, a total of three where the third is always 127.0.0.1. For all other computers, also no more than three. I have seen places with 15 DCs, and every computer had all 15 DCs in the list of DNS servers. If you understand Windows DNS client resolution timeouts, limit the number of DNS entries.

Click Close, as shown in Figure 79.

After clicking Close,  you lose the connection to the RDP session. Reconnect using the new static IP address.

Close Network Connections.

Click Home, then System, then About, and finally Rename this PC (Advanced), as shown in Figure 80.

Click Change, as shown in Figure 81.

Enter a Computer name, Domain, and click OK, as shown in Figure 82.

Enter the domain’s Administrator name and password and click OK, as shown in Figure 83.

Click OK, as shown in Figure 84.

Click OK, as shown in Figure 85.

Click Close, as shown in Figure 86.

Click Restart Now, as shown in Figure 87.

When the VM restarts, log in using the domain’s Administrator account.

Make any customizations you require to the VM before we start installing consoles. I upgraded my Windows 10 20H2 VM to Windows 10 21H1.

Install Active Directory Consoles

There are no Citrix Virtual Apps and Desktops or Parallels Remote Application Server or VMware Horizon environments at this point in the lab’s building process. The only consoles to install at this point are for the Microsoft products in the lab.

Before the October 2018 update to Windows 10, a download was available for the Remote Server Administrative Tools (RSAT). The old approach to RSAT was that the Windows 10 upgrade removed the RSAT from the computer. The new approach allows the RSAT to persist between Windows 10 upgrades.

Click the Start button and click Settings, as shown in Figure 88.

Click Apps, as shown in Figure 89.

Click Optional features, as shown in Figure 90.

Click Add a feature, as shown in Figure 91.

Select the following items and click Install, as shown in Figure 92.

• RSAT: Active Directory Certificate Services Tools
• RSAT: Active Directory Domain Services and Lightweight Directory Services Tools
• RSAT: DHCP Server Tools
• RSAT: DNS Server Tools
• RSAT: Group Policy Management Tools

The tools install, as shown in Figure 93.

You can find the tools by clicking Start, scrolling down to, and expanding Windows Administrative Tools, as shown in Figure 94.

Installing RSAT installed several PowerShell modules. To ensure that we have current help text for every PowerShell module, start an elevated PowerShell session.

Click Start, scroll down to and expand Windows Powershell, right-click Windows PowerShell, click More, and click Run as administrator, as shown in Figure 95.

Type in the following in the PowerShell window, as shown in Figure 96.

update-help -force

The help text updates, as shown in Figure 96. You can safely ignore any warnings or errors.

To verify that PowerShell Remoting is enabled, type the following in the PowerShell window, as shown in Figure 97.

enable-psremoting

You can access each of the RSAT consoles from the start menu or build an MMC console containing all the snap-ins you use often.

Type mmc and press Enter in the PowerShell window and then exit PowerShell.

The mmc console opens, as shown in Figure 98.

Click File, click Add/Remove Snap-in…, or press Ctrl+M (my preference), as shown in Figure 99.

Double-click the following items, as shown in Figure 100.

• Active Directory Do…
• Active Directory Site…
• Active Directory Use…
• ADSI Edit

Double-click Certification Authority, and on the popup, type in the name of your Certification Authority server and click Finish, as shown in Figure 101.

Scroll down, double-click the following and click OK, as shown in Figure 102.

• DHCP
• DNS
• Group Policy Manag…

Click on and expand each node. Connect to the appropriate server when requested.

Figure 103 shows my console.

I always recommend using these consoles installed on a management computer to avoid logging in on a production server (i.e., domain controller or certificate authority). While our lab servers may not be “production” level servers, we learn a valuable habit: stay off production servers when possible.

Save the mmc console to the location and name of your choice, as shown in Figure 104.

Install SQL Server Management Studio

We install the SQL Server Management Studio (SSMS) in the management computer to avoid logging in to a production SQL Server. While our lab servers may not be “production” level servers, we learn a valuable habit: stay off production servers when possible.

In your internet browser, browse to https://docs.microsoft.com/en-us/sql/ssms/download-sql-server-management-studio-ssms?view=sql-server-ver15, and click the link to Download SQL Server Management Studio (SSMS), as shown in Figure 105.

Note: The version number may change.

Click the link your browser provides to open the downloaded file, as shown in Figure 106.

Click Run on the popup, as shown in Figure 107.

You can exit your browser at this point.

Click Install, as shown in Figure 108.

SSMS begins installing, as shown in Figure 109. The installation takes a few minutes.

Click Close, as shown in Figure 110.

Click Start, scroll to and expand Microsoft SQL Server Tools 18, click Microsoft SQL Server Management…, as shown in Figure 111.

Enter the name of your SQL Server and click Connect, as shown in Figure 112.

As shown in Figure 113, we made a connection to the SQL Server.

If you get the error shown in Figure 114, did you remember to create the Inbound TCP Port 1433 firewall rule on the SQL Server?

Exit SSMS.

Install Microsoft Office

I only need Microsoft Excel and Word on my management PC for use with scripting. Unfortunately, if you tell the Office 365 site to install Office or select the Install option from the Office ISO, you get every Office component installed. To restrict what you download, install, and configure, you must use an XML file.

Microsoft makes the Office Customization Tool if you do not know how to create the required XML file.

Open a command prompt.

Make a folder named O365 on the C drive by typing md c:\O365 followed by cd c:\O365, as shown in Figure 115.

In your internet browser, browse to https://config.office.com/ and click Create, as shown in Figure 116.

Select the following, as shown in Figure 117:

Architecture: 64-bit

Office Suites: Microsoft 365 Apps for business

Viso: None (shows as Select Visio product)

Project: None (shows as Select Project product)

Additional products: None (shows as Select Additional product)

Select the update channel and Select the version you prefer, as shown in Figure 118.

Deselect the apps you do NOT want to be installed and click Next, as shown in Figure 119.

Select primary language and any additional languages or proofing tools required and click Next, as shown in Figure 120.

Select Office Content Delivery Network (CDN), leave the other two options at the default settings, and click Next, as shown in Figure 121.

Deselect Uninstall any MSI versions of Office, including Visio and Project, leave the other options at their default settings, and click Next, as shown in Figure 122.

Select Automatically accept the EULA and click Next, as shown in Figure 123.

Enter your organization’s name, an optional description, and click Next, as shown in Figure 124.

Microsoft offers numerous settings for configuring Office applications. If you wish, you can review the options and make any configuration changes required. After reviewing the Application preferences, click Finish, as shown in Figure 125.

Click Export, as shown in Figure 126.

Select your desired Default File Format and click OK. As shown in Figure 127, I prefer using Office Open XML formats.

Select I accept the terms in the license agreement, enter a File Name for the XML file, and click Export, as shown in Figure 128.

Using Windows File Explorer, browse to the location your internet browser save the XML file, typically your user account’s Downloads folder, as shown in Figure 129.

Right-click the XML file and click Copy, as shown in Figure 130.

In Windows File Explorer, browse to C:\O365, right-click in the empty space and click Paste, as shown in Figure 131.

Exit Windows File Explorer.

Now we need to download the Office Deployment Toolkit.

In your internet browser, browse to https://www.microsoft.com/en-us/download/details.aspx?id=49117, and click Download, as shown in Figure 132.

Click the link your browser provides to open the file, as shown in Figure 133.

Click Run, as shown in Figure 134.

Select Click here to accept the Microsoft Software License Terms and click Continue, as shown in Figure 135.

Browse to C:\O365 and click OK, as shown in Figure 136.

Click OK, as shown in Figure 137.

Exit your internet browser.

In the command prompt, type in setup.exe /configure configuration.xml (use your XML file name) and press Enter, as shown in Figure 138.

Office starts installing, as shown in Figures 139 and 140.

When the installation and configuration are complete, click Close, as shown in Figure 141.

Exit the command prompt.

Click Start and verify that only the Office applications you installed are there. I installed only Microsoft Excel and Word, as shown in Figures 142 and 143.

Start any installed Office product to start the licensing and activation process, as shown in Figure 144.

After the activation process completes, click Done, as shown in Figure 145.

Additional Applications

There are many other applications you can install. Feel free to install and configure any software you require.

Here is some of the software I use.

• Citrix PVS Console (Can’t install yet)
• Citrix Studio Console (Can’t install yet)
• Google Chrome
• Notepad++
• Parallels Remote Application Server Console and PowerShell (Can’t install yet)
• PuTTY
• VMware Horizon Dynamic Environment Manager Management Console (Can’t install yet)
• WinSCP

Many management consoles are web-based—for example, vCenter, Citrix Director, VMware Horizon Connection Server, and others. I manage my Netgear switches and WiFi router and my two Synology units using a browser.

Install vCenter Root Certificate

The vCenter root certificate requires installing to manage vCenter from this computer. Citrix Studio also requires it to create a hosting connection to vCenter.

In Part 6, we downloaded the root certificate from vCenter.

Browse to the certs\win folder, as shown in Figure 146.

Double-click the file with the extension “crt”.

Click Open if you receive a file security warning, as shown in Figure 147.

Click Install Certificate…, as shown in Figure 148.

Click Local machine and Next, as shown in Figure 149.

Select Place all certificates in the following store and click Browse…, as shown in Figure 150.

Click on Trusted Root Certification Authorities and click OK, as shown in Figure 151.

Click Next, as shown in Figure 152.

Click Finish, as shown in Figure 153.

Click OK, as shown in Figure 154.

Click OK, as shown in Figure 155.

Using your browser, go to the link for the vCenter Getting Started Page. For me, that is https://vcenter.labaddomain.com, as shown in Figure 156.

Click the padlock symbol, as shown in Figure 157.

Activate Windows 10

If you have a MAPS or similar subscription service, you can activate your copy of Windows 10.

Click Start, Settings, as shown in Figure 158.

Click Windows isn’t activated. Activate Windows now., as shown in Figure 159.

Click Change product key, as shown in Figure 160.

Enter your Windows 10 Product key and click Next, as shown in Figure 161.

Click Activate, as shown in Figure 162.

If your copy of Windows 10 activated successfully, click Close, as shown in Figure 163.  If activation was not successful, resolve the issue and attempt the activation again.

Windows 10 now shows as activated.

Exit all open windows.

Up next: Create a 10ZiG Management Server

Landing page for the article series

With the base of the Vmware infrastructure, Active Directory (AD), Certification Authority (CA), and Group Policy (GPO) built, the next step is to create additional server VMs from the Server 2019 template. We use the VMs built in this article for additional Microsoft infrastructure servers. My lab’s infrastructure VMs reside in my XenServer pool, as explained in the Introduction article. Building a server VM from the Server 2019 template was covered earlier.

From the introduction article, these are the VMs we are building.

Follow the earlier process to build the two servers above, but do not power on the servers. Before we power on the new servers, we need an additional hard drive on each server. For LabFS, that drive is for shared files and folders and LabSQL, SQL databases.

Follow these steps to add the second drive.

VMware

In vCenter, right-click a VM and click Edit Settings…, as shown in Figure 1.

Click ADD NEW DEVICE and click Hard Disk, as shown in Figure 2.

For New Hard disk*, enter 100 for the size in GB and click OK, as shown in Figure 3.

Expand VM Hardware and see both hard disks, as shown in Figure 4.

Repeat for the other server.

Power on both VMs.

XenServer

In XenCenter, select a VM in the left pane and click the Storage tab in the right pane, as shown in Figure 5.

Click Add, as shown in Figure 6.

Enter a Name, Description, type 100 for the Size, and click Add, as shown in Figure 7.

XenCenter shows both hard disks, as shown in Figure 8.

Repeat for the other server.

Power on both VMs.

File Server (LabFS)

The first thing we need to do is join our File Server to the domain.

If you remember, when we created Active Directory in Part 14, I placed all my Microsoft infrastructure servers in a specific OU.

Lab

Infrastructure

Microsoft

Open a PowerShell session and type in the following from one of the domain controllers, as shown in Figure 9.

Get-ADOrganizationalUnit -filter {Name -eq "Microsoft"}

Copy the DistinguishedName property to the clipboard.

We use PowerShell to install and configure the File Server.

Use mstsc to remote into the VM that is our File Server.

Exit Server Manager and start an elevated PowerShell session, as shown in Figure 10.

Copy and paste the following into the elevated PowerShell session and press Enter. The process took less than the blink of an eye to happen, which is why there is no screenshot.

Remember to set the values you need.

Note: Lines may wrap

#Join the computer to the domain</strong>

add-computer -Credential LabADDomain\Administrator `
-DomainName "LabADDomain.com" `
-OUPath "OU=Microsoft,OU=Infrastructure,OU=Lab,DC=LabADDomain,DC=com" `
-Force `
-Restart

#server reboots

After the VM restarts, log in using the domain’s Administrator account and password.

Right-click the Start menu and click Disk Management, as shown in Figure 11.

Select MBR (Master Boot Record) and click OK, as shown in Figure 12.

Right-click the 100GB Unallocated drive and click New Simple Volume…, as shown in Figure 13.

Click Next, as shown in Figure 14.

Click Next, as shown in Figure 15.

Select the drive letter to use and click Next, as shown in Figure 16.

Type in a meaningful Volume label and click Next, as shown in Figure 17.

Click Finish, as shown in Figure 18.

In a few seconds, Disk Management shows the new drive, as shown in Figure 19.

Now to install the server certificate from the CA.

Save the following to a file name c:\CertFiles\computer-request.inf.

I want to thank Michael B. Smith for creating this INF file for me.

Use the data needed for your environment.

LabFS                     = the name of your File Server 
LabADDomain.com           = your domain name 
"LabCA\LabDomain CA Root" = the name of your CA server and the name of your CA.

;----------------- computer-request.inf -----------------
; LabFS.LabADDomain.com
;
; certreq -new computer-request.inf computer-request.req
; certreq -submit -config "LabCA\LabDomain CA Root" computer-request.req computer-request.cer
; certreq -accept -config "LabCA\LabDomain CA Root" computer-request.cer
;

[Version]
Signature = "$Windows NT$"

[NewRequest]
Subject = "CN=LabFS.LabADDomain.com" ; replace with the FQDN of the File Server
FriendlyName = "Computer (Machine) for LabFS.LabADDomain.com"
KeyLength = 2048
; Can be 1024, 2048, 4096, 8192, or 16384.
; Larger key sizes are more secure but have a greater impact on performance.
KeySpec = 1                     ; AT_KEYEXCHANGE
Exportable = TRUE               ; private-key is exportable
MachineKeySet = TRUE            ; goes in machine store instead of user's personal store
SMIME = False                   ; cannot be used for signing S/MIME messages
PrivateKeyArchive = FALSE
HashAlgorithm = sha256          ; "certutil -oid 1 | findstr pwszName" -- gives a list (including sha1)
UserProtected = FALSE
UseExistingKeySet = FALSE       ; we are not renewing a key that already exists
ProviderName = "Microsoft RSA SChannel Cryptographic Provider"
ProviderType = 12               ; for ProviderName and ProviderType, see "certutil -csplist"
RequestType = PKCS10            ; if empty or set to "CERT" then a self-signed cert is created
KeyUsage = 0xa0                 ; 0xa0 - CERT_DIGITAL_SIGNATURE_KEY_USAGE + CERT_KEY_ENCIPHERMENT_KEY_USAGE

[EnhancedKeyUsageExtension]
OID=1.3.6.1.5.5.7.3.1 ; this is for Server Authentication - PKIX_KP_SERVER_AUTH

[Extensions]
; Note: 2.5.29.17 is the OID for a SAN extension.

2.5.29.17 = "{text}"
_continue_ = "dns=LabFS.LabADDomain.com"

[RequestAttributes]
CertificateTemplate = "Server Template"

;-----------------------------------------------

Open an elevated command prompt.

Type in cd c:\CertFiles and press Enter.

The three commands we need to run are at the top of the computer-request.inf file.

Type in notepad computer-request.inf and press Enter.

Copy the line certreq -new computer-request.inf computer-request.req, paste it in the elevated command prompt, and press Enter.

Copy the line certreq -submit -config “LabCA\LabDomain CA Root” computer-request.req computer-request.cer, paste it in the elevated command prompt, and press Enter.

Note: If you get a warning similar to the following, you can ignore the warning. The warning tells you that the certificate request validity period is past the lifetime of the CA’s root certificate lifespan.

Certificate retrieved(Issued)Issued The certificate validity period will be shorter than the Server Template Certificate Template specifies because the template validity period is longer than the maximum certificate validity period allowed by the CA.  Consider renewing the CA certificate, reducing the template validity period, or increasing the registry validity period.

Copy the line certreq -accept -config “LabCA\LabDomain CA Root” computer-request.cer, paste it in the elevated command prompt, and press Enter.

Figure 20 shows the results of running the certificate request commands.

There is nothing else to do with the File Server VM at this point in this article series.

SQL Server (LabSQL)

Follow the same steps as the File Server to join the domain and provision the 100GB hard disk.

There are several pieces of information needed before installing Microsoft SQL Server.

1. Applications used in the lab
2. What versions of Microsoft SQL Server do the applications support?
3. Do the applications require any unique configuration in SQL Server?

In my lab, the products that use Microsoft SQL Server are Citrix Virtual Apps and Desktops (CVAD), Citrix Provisioning Services (PVS), and VMware Horizon. Both vendors provide documentation on the supported version of SQL Server.

Note: Parallels uses SQL Server for Parallels RAS Reporting, which I don’t use in the lab.

Supported Databases for Citrix Virtual Apps and Desktops and Provisioning Services

VMware Product Interoperability Matrix

In my lab, I run the latest version of each product.

• CVAD 2103
• PVS 2012
• VMware Horizon 8 2106

Using the links above, we can see that the current version of SQL Server supported is 2019.

Note: Starting with CVAD 2003, Citrix removed support for versions of SQL Server before SQL Server 2016. That leaves three versions of SQL Server supported: 2016, 2017, and 2019.

Figure 21 shows CVAD and PVS.

Figure 22 shows VMware Horizon 8 2106. Unfortunately, the VMware Product Interoperability Matrix does not allow you to select “Microsoft SQL Server”, nor does it allow you to sort the results. Yes, I left feedback on these shortcomings. Since I initially published this article, VMware added the capability to select a specific database version. I selected SQL Server 2019 Standard.

From both images, all the products support SQL Server 2019. Now, are there any particular configuration options required?

CVAD from https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/technical-overview/databases.html:

Windows authentication is required for connections between the Controller and the SQL Server site database.

Each database must have the following characteristics:

• Use a collation that ends with _CI_AS_KS. Citrix recommends using a collation that ends with _100_CI_AS_KS.
• For optimum performance, enable the SQL Server Read-Committed Snapshot. For details, see CTX 137161.

PVS from https://docs.citrix.com/en-us/provisioning/current-release/system-requirements.html:

When configuring databases for provisioning, consider that no preference exists for any specific SQL collation. Collation supports the standard method recommended by Citrix Virtual Apps and Desktops when using the configuration wizard. The administrator creates the database with a collation that ends with _CI_AS_KS. Citrix recommends using a collation that ends with _100_CI_AS_KS.

VMware Horizon from https://docs.vmware.com/en/VMware-Horizon/2103/horizon-installation.pdf:

Prepare an SQL Server Database for Event Reporting in Horizon Console

Before you can use Horizon Console to configure an event database on Microsoft SQL Server, you must configure the correct TCP/IP properties and verify that the server uses SQL Server Authentication.

Prerequisites

• Create an SQL Server database for event reporting. See Add a Database and Database User for VMware Horizon Events in Horizon Console.
• Verify that you have the required database privileges to configure the database.
• Verify that the database server uses the SQL Server Authentication method of authentication. Do not use Windows Authentication.

From these requirements, we know the following.

1. SQL Server must use both SQL Server and Windows Authentication
2. Enable SQL Server Read-Committed Snapshots
3. When creating a database for CVAD or PVS, make sure the database uses a collation that ends with _100_CI_AS_KS

Install Microsoft SQL Server 2019

Evaluation SQL Server 2019

You can download a 180-day evaluation copy of Microsoft SQL Server 2019 from the Microsoft Evaluation Center.

Copy the SQL2019-SSEI-Eval.exe file to the LabSQL server in C:\SQL2019.

Right-click SQL2019-SSEI-Eval.exe and click Run as administrator, as shown in Figure 23.

Click Download Media, as shown in Figure 24.

Select ISO, type in C:\SQL2019 for SELECT DOWNLOAD LOCATION, and click Download, as shown in Figure 25.

After the download completes, click Open folder, as shown in Figure 26.

Right-click the ISO file and click Mount, as shown in Figure 27.

Right-click setup.exe and click Run as administrator, as shown in Figure 28.

In the left pane, click Installation and in the right pane, click New SQL Server stand-alone installation or add features to an existing installation, as shown in Figure 29.

Click Next, as shown in Figure 30.

Select I accept the license terms and and click Next, as shown in Figure 31.

Select Use Microsoft Update to check for updates (recommended) and click Next, as shown in Figure 32.

Ignore the Windows Firewall warning and click Next, as shown in Figure 33.

Select Database Engine Services, as shown in Figure 34.

Scroll down and select Client Tools Connectivity and click Next, as shown in Figure 35.

Click Next, as shown in Figure 36.

Click the Collation tab and click Customize…, as shown in Figure 37.

Citrix requires a particular collation. Select Windows collation designator and sort order, and scroll down to select Latin1_General_100, as shown in Figure 38.

Select Accent-sensitive and Kana-sensitive, and click OK, as shown in Figure 39.

Notice the Collation is Latin1_General_100_CI_AS_KS, as recommended by Citrix.

“Citrix recommends using a collation that ends with _100_CI_AS_KS”

Click Next, as shown in Figure 40.

Because VMware requires SQL authentication and Citrix requires Windows authentication, select Mixed Mode (SQL Server authentication and Windows authentication), enter a password for the SQL Server’s sa account, and click Add Current User, as shown in Figure 41.

Clicking the Add Current User adds the domain’s administrator account as a SQL Server administrator.

Click Add, as shown in Figure 42.

We created two service accounts earlier—one for Citrix and one for VMware. Add the two service accounts and other required accounts or groups and click OK, as shown in Figure 43.

Click the Data Directories tab, change the Data root directory to the drive letter assigned to the second hard disk on the SQL server, and click Next, as shown in Figure 44.

Verify all the information is correct and click Install, as shown in Figure 45. If any information is not correct, click Back, correct the information, and then continue.

As shown in Figure 46, the SQL Server installation begins.

Once the installation completes, click Close, as shown in Figure 47.

Close all windows.

Full SQL Server 2019

Mount the SQL Server 2019 ISO to the VM.

Change to the D drive (or the CD/DVD drive where the ISO is mounted), right-click setup.exe, and click Run as administrator, as shown in Figure 48.

In the left pane, click Installation and in the right pane, click New SQL Server stand-alone installation or add features to an existing installation, as shown in Figure 49.

Click Next, as shown in Figure 50.

Select I accept the license terms and and click Next, as shown in Figure 51.

Follow the process as shown in Figures 32 through 47.

Now to install the server certificate from the CA.

Save the following to a file name c:\CertFiles\computer-request.inf.

I want to thank Michael B. Smith for creating this INF file for me.

Use the data needed for your environment.

LabSQL                    = the name of your SQL Server
LabADDomain.com           = your domain name
"LabCA\LabDomain CA Root" = the name of your CA server and the name of your CA.

;----------------- computer-request.inf -----------------
; LabSQL.LabADDomain.com
;
; certreq -new computer-request.inf computer-request.req
; certreq -submit -config "LabCA\LabDomain CA Root" computer-request.req computer-request.cer
; certreq -accept -config "LabCA\LabDomain CA Root" computer-request.cer
;

[Version]
Signature="$Windows NT$"

[NewRequest]
Subject = "CN=LabSQL.LabADDomain.com" ; replace with the FQDN of the SQL Server
FriendlyName = "Computer (Machine) for LabSQL.LabADDomain.com"
KeyLength = 2048
; Can be 1024, 2048, 4096, 8192, or 16384.
; Larger key sizes are more secure but have a greater impact on performance.
KeySpec = 1                     ; AT_KEYEXCHANGE
Exportable = TRUE               ; private-key is exportable
MachineKeySet = TRUE            ; goes in machine store instead of user's personal store
SMIME = False                   ; cannot be used for signing S/MIME messages
PrivateKeyArchive = FALSE
HashAlgorithm = sha256          ; "certutil -oid 1 | findstr pwszName" -- gives a list (including sha1)
UserProtected = FALSE
UseExistingKeySet = FALSE       ; we are not renewing a key that already exists
ProviderName = "Microsoft RSA SChannel Cryptographic Provider"
ProviderType = 12               ; for ProviderName and ProviderType, see "certutil -csplist"
RequestType = PKCS10            ; if empty or set to "CERT" then a self-signed cert is created
KeyUsage = 0xa0                 ; 0xa0 - CERT_DIGITAL_SIGNATURE_KEY_USAGE + CERT_KEY_ENCIPHERMENT_KEY_USAGE

[EnhancedKeyUsageExtension]
OID=1.3.6.1.5.5.7.3.1 ; this is for Server Authentication - PKIX_KP_SERVER_AUTH

[Extensions]
; Note: 2.5.29.17 is the OID for a SAN extension.

2.5.29.17 = "{text}"
_continue_ = "dns=LabSQL.LabADDomain.com"

[RequestAttributes]
CertificateTemplate = "Server Template"

;-----------------------------------------------

Open an elevated command prompt.

Type in cd c:\CertFiles and press Enter.

The three commands we need to run are at the top of the computer-request.inf file.

Type in notepad computer-request.inf and press Enter.

Copy the line certreq -new computer-request.inf computer-request.req, paste it in the elevated command prompt, and press Enter.

Copy the line certreq -submit -config “LabCA\LabDomain CA Root” computer-request.req computer-request.cer, paste it in the elevated command prompt, and press Enter.

Note: If you get a warning similar to the following, you can ignore the warning. The warning tells you that the certificate request validity period is past the lifetime of the CA’s root certificate lifespan.

Certificate retrieved(Issued)Issued The certificate validity period will be shorter than the Server Template Certificate Template specifies because the template validity period is longer than the maximum certificate validity period allowed by the CA.  Consider renewing the CA certificate, reducing the template validity period, or increasing the registry validity period.

Copy the line certreq -accept -config “LabCA\LabDomain CA Root” computer-request.cer, paste it in the elevated command prompt, and press Enter.

Figure 52 shows the results of running the certificate request commands.

We need to configure a firewall rule to allow TCP port 1433 Inbound. If we don’t, when we create the management computer and install the SQL Server Management Studio, we can’t connect from the management computer to the SQL Server.

Please see Configure the Windows Firewall to Allow SQL Server Access.

Copy the following into the elevated command prompt and press Enter, as shown in Figure 53.

netsh advfirewall firewall add rule name = "SQL Server TCP Port 1433 Inbound" dir = in protocol = tcp action = allow localport = 1433 remoteip = localsubnet profile = Any

In the elevated command prompt, type in wf.msc, and press Enter to start Windows Defender Firewall with Advanced Security, as shown in Figure 54.

In the left pane, click Inbound Rules, and you see the new SQL Server firewall rule in the middle pane, as shown in Figure 55.

License Server

I use the second domain controller (DC), LabDC2, as my lab’s Citrix and Remote Desktop license server. Both components are lightweight and place no processing or security burden on the DC.

Remote Desktop Licensing

If you do not have a Microsoft Action Pack Subscription (MAPS) for Remote Desktop licenses, never fear as there is a 120-day grace period for clients that connect to a Remote Desktop Session Host server (RDSH).

License your RDS deployment with client access licenses (CALs)

There is a licensing grace period of 120 days, during which no license server is required. Once the grace period ends, clients must have a valid RDS CAL issued by a license server before they can log on to an RD Session Host server.

Until Citrix develops a community license program as Microsoft and VMware have, you have a 30-day grace period (provided you can find a CVAD product ISO to download).

To install Remote Desktop Licensing on LabDC2, start an elevated PowerShell session and enter the following command, as shown in Figure 56.

Install-WindowsFeature RDS-Licensing –IncludeAllSubFeature -IncludeManagementTools

Leave the PowerShell session open.

Click the Start Menu, expand Windows Administrative Tools, and click Remote Desktop Licensing Manager, as shown in Figure 57.

Expand All servers, right-click LabDC2, and click Activate Server, as shown in Figure 58.

Click Next, as shown in Figure 59.

Verify that the Connection method is Automatic connection and click Next, as shown in Figure 60.

Enter the required information and click Next, as shown in Figure 61.

If you wish, enter the optional information and click Next, as shown in Figure 62.

Leave Start Install License Wizard now selected and click Next, as shown in Figure 63.

Click Next, as shown in Figure 64.

For MAPS RDS CALs, verify the License program is License Pack (Retail Purchase) and click Next, as shown in Figure 65.

Enter your MAPS RDS CALs, click Add, and click Next, as shown in Figure 66.

After the license is installed, click Finish, as shown in Figure 67.

If your license did not install, either retry the installation or call the Microsoft Clearinghouse. The most frequent error I see is when someone moves RDS CALs to another server without deactivating the original server first.

Still in the RD Licensing Manager console, right-click LabDC2 and click Review Configuration, as shown in Figure 68.

Click Add to Group, as shown in Figure 69.

Click Continue, as shown in Figure 70.

Click OK, as shown in Figure 71.

We get a notice that the Remote Desktop Licensing service requires a restart, as shown in Figure 72.

In the elevated PowerShell session, type in the following commands, as shown in Figure 73.

Stop-Service TermServLicensing
Start-Service TermServLicensing

Exit the PowerShell session.

Click OK, as shown in Figure 74.

If you compare Figure 68 to Figure 75, you see a green checkmark next to the server name.

If you follow the steps for Figures 68 and 69, you see both items have green checkmarks now, as shown in Figure 76.

Exit the RD Licensing Manager console.

Citrix Licensing

Citrix Licensing documentation

Note: NEVER browse the internet or download files from a domain controller. That is a bad habit that can have dire consequences.

There are multiple ways to get Citrix Licensing.

1) From the internet browser on LabFS, browse to https://www.citrix.com/downloads/licensing/ and download the latest License Server for Windows to E:\CitrixLicense, as shown in Figures 77 and 78.

2) Mount the latest CVAD ISO to the LabDC2 VM, browse to x:\x64\Licensing (where x is the drive letter for the CD/DVD drive), as shown in Figure 79.

Right-click CitrixLicensing.exe and click Run as administrator, as shown in Figure 80.

Select I have read, understand, and accept the terms of the license agreement and click Next, as shown in Figure 81.

Click Next, as shown in Figure 82.

Leave all options at their default settings and click Next, as shown in Figure 83.

At this time, Citrix does not have a community license program available, so I am using the license provided to me courtesy of the CTP program. I must manually renew the license file every year.

Select Manually check for Customer Success Services renewal licenses and click Install, as shown in Figure 84.

When the installation completes, click Finish, as shown in Figure 85.

Citrix license files are associated with the CaSe senSiTivE name of the server. Start a command prompt and type in hostname to verify the correct hostname, as shown in Figure 86.

When allocating Citrix licenses, you get to enjoy the painful license return and reallocate process if you get the hostname wrong. Get it right the first time.

Keep the command prompt open.

My preferred way of getting Citrix license files onto a Citrix license server is to copy the .lic files to C:\Program Files (x86)\Citrix\Licensing\MyFiles and restart the Citrix Licensing service.

Once you copy your license files to C:\Program Files (x86)\Citrix\Licensing\MyFiles, enter the following commands from the command prompt, as shown in Figure 87.

net stop "Citrix Licensing" && net start "Citrix Licensing"

You can verify that the Citrix license file is valid by looking in the Application event log for Event ID 20736 from source Citrix_Licensing, as shown in Figure 88.

Following the steps used in Citrix XenServer Host and Pool ConfigurationI applied the new license file to my two XenServer pools, as shown in Figure 89.

Up next: Create a Management Computer

Landing page for the article series

Before getting to work adding Citrix Virtual Apps and Desktops (CVAD), and VMware Horizon to the lab, there are a few additional items on the vCenter to-do list.

1. Join vCenter to the lab’s Active Directory (AD) domain
2. Add the lab’s AD to the SSO
3. Create a Citrix related service account with minimum vCenter permissions for the hosting connection in Citrix Studio and with Citrix App Layering
4. Create a VMware related service account with minimum vCenter permissions for VMware Horizon
5. Create a Read-only account for use with monitoring software, like ControlUp and Goliath Technologies

Log in to vCenter.

Active Directory

From the Menu dropdown, select Administration, as shown in Figure 1.

Click Configuration, Active Directory Domain, and click Join AD, as shown in Figure 2.

Enter the Domain, a Username, a Password, and click JOIN, as shown in Figure 3.

If you want the vCenter computer account in a specific Organizational Unit (OU), as I do, enter the Organization Unit.

The vCenter appliance is now a domain member but needs a restart.

From the Menu dropdown, select VMs and Templates, as shown in Figure 4.

Expand the cluster, right-click the vCenter VM, click Power, and click Restart Guest OS, as shown in Figure 5.

Click Yes to confirm the restart, as shown in Figure 6.

Wait about 10 minutes before trying to log in to vCenter.

If you specified an OU to place the vCenter computer account while waiting for the vCenter appliance to restart, go to one of the domain controllers and open the Active Directory Users and Computers console. Browse to the OU specified and verify the vCenter computer account exists, as shown in Figure 7.

At this point, you must use the administrator vCenter account to log in. Even though we joined vCenter to the AD domain, the AD domain isn’t a Single Sign-On domain yet.

Once logged on to vCenter, go back to Administration/Single Sign On/Configuration, as shown in Figure 8.

Click Identity Sources and click ADD IDENTITY SOURCE, as shown in Figure 9.

Select Active Directory (Windows Integrated Authentication) from the Identity source type dropdown. If it is not already populated, enter the Domain name, select Use machine account, and click ADD, as shown in Figure 10.

The AD domain now shows as an Identity Source, as shown in Figure 11.

We are not yet ready to log in to vCenter with AD credentials. First, we must add users and groups from the AD domain to a vCenter security role.

Click Global Permissions, as shown in Figure 12.

Click + (Plus sign) as shown in Figure 13.

Select the AD domain name from the Domain dropdown, type Domain Admins in the User/Group field, for Role, select Administrator, select Propagate to children, and click OK, as shown in Figure 14.

Now we can log in to vCenter with an AD domain account.

Log off vCenter and log in with an AD domain account granted permission, as shown in Figures 15 and 16.

Figure 17 shows a successful login with AD domain credentials.

Next, we need permissions for service accounts for Citrix Virtual Apps and Desktops (CVAD) and VMware Horizon. First up, CVAD.

Citrix Virtual Apps and Desktops and App Layering vCenter Permissions

I need a vCenter account for my lab to use with both the CVAD Hosting Connection in Citrix Studio and Citrix App Layering.

Citrix details the required permissions at  CVAD VMware virtualization environments and Citrix App Layering VMware vSphere.

To save time, here are the combined permissions with all the duplicates removed. I put an “(AL)” by the permissions that apply only to Citrix App Layering. If you do not use App Layering, you can safely ignore those permissions. I took these permissions from the CVAD 2103 and App Layering 2104 documentation. I also fixed the names of the permissions that Citrix has wrong in their documentation.

Table 1 vCenter Permissions for CVAD and App Layering

We created the svc_CtxVMware account previously.

In the vCenter console, go to Menu -> Administration, as shown in Figure 18.

Expand Access Control, click Roles, and click the + (Plus sign), as shown in Figure 19.

The hard part is going through all the settings in Table 1 and selecting the required permissions, as shown in Figure 20.

Hey VMware, it would be nice if this dialog box were resizable.

Continue selecting the required permissions. When all permissions are selected, click Next, as shown in Figure 21.

Enter a Role name and an optional Description, click Finish, as shown in Figure 22.

Click Global Permissions and click the + (Plus sign), as shown in Figure 23.

Select your AD domain in the Domain dropdown, then enter the service account name, select the just created Role, you must select Propagate to children, and click OK, as shown in Figure 24.

If you are following this article series, there is no CVAD infrastructure to test the account.

VMware Horizon vCenter Permissions

VMware lists their required permissions for Horizon 8 2106 at Privileges Required for the vCenter Server User.

Figures 25 and 26 show the required permissions for the VMware Horizon 8 2106 service account.

Hey VMware, it would be better to list the Privilege Group on vCenter Server and Privileges to Enable in the same order they appear in the vCenter New Role wizard.

Table 2 vCenter Permissions for Horizon – Ordered List

We created the svc_VMwareHorizon AD account previously.

Expand Access Control, click Roles, and click the + (Plus sign), as shown in Figure 27.

The hard part is going through all the settings and selecting the required permissions, as shown in Figure 28.

Continue selecting the required permissions. When all permissions are selected, click Next, as shown in Figure 29.

Enter a Role name and an optional Description, click Finish, as shown in Figure 30.

Click Global Permissions and click the + (Plus sign), as shown in Figure 31.

Select your AD domain in the Domain dropdown, enter the service account name, select the just created Role, select Propagate to children, and click OK, as shown in Figure 32.

If you are following this article series, there is no Horizon infrastructure to test the account.

Leave the vCenter console open to Global Permissions.

Create a Read-only Account

In my lab, I use monitoring software from vendors like ControlUp and Goliath Technologies. To provide for Least Privilege Access, use a Read-only account.

First, we need to create an AD service account to assign the vCenter Read-only Role.

On the first DC, open an elevated PowerShell session.

Copy and paste the following into the elevated PowerShell session and press Enter, as shown in Figure 33.

Remember to set the values you need.

Note: Lines may wrap

#Create the service account svc_VMwareReadOnly for Read-only vCenter permissions

$ADDomain = "LabADDomain"
$TLD = "com"
$Protect = $False

$UserPwd = Read-Host -AsSecureString -Prompt "Enter password"

New-ADUser -AccountPassword $UserPwd `
-CannotChangePassword $True `
-ChangePasswordAtLogon $False `
-Description "DO NOT CHANGE THE PASSWORD OR DELETE/DISABLE ACCOUNT" `
-DisplayName "svc_VMwareReadOnly" `
-Enabled $True `
-GivenName "svc_VMwareReadOnly" `
-Name "svc_VMwareReadOnly" `
-PasswordNeverExpires $True `
-PasswordNotRequired $False `
-Path "OU=Service,OU=Accounts,OU=Lab,DC=$ADDomain,DC=$TLD" `
-SamAccountName "svc_VMwareReadOnly" `
-UserPrincipalName "svc_VMwareReadOnly@LabADDomain.com"

In Global Permissions, click the “+“, as shown in Figure 34.

Change the Domain to the AD domain, select the new Read-only account for User/Group, select the Read-only Role, select Propagate to children, and click OK, as shown in Figure 35.

The new Read-only account is added to the list, as shown in Figure 36.

Next up: Additional XenCenter Configuration

Landing page for the article series

With the Server 2019 template created, the next step is to create VMs from the template. We use the VMs built in this article for the first three Microsoft infrastructure servers: two domain controllers and a certificate authority. This article covers creating the VMs from a template in both VMware vCenter and Citrix XenCenter. My lab’s infrastructure VMs reside in my XenServer pool, as explained in the Introduction article.

From the introduction article, these are the VMs we are building.

VMware

In vCenter, right-click the Server 2019 Template and click on New VM from This Template…, as shown in Figure 1.

Enter a Virtual machine name and click Next, as shown in Figure 2.

Click Next, as shown in Figure 3.

Select the NFS shared datastore created earlier in this series and click Next, as shown in Figure 4.

Select Power on virtual machine after creation and click Next, as shown in Figure 5.

Verify that the configuration data for the new VM is correct and click Finish, as shown in Figure 6. If any item is incorrect, click Back, correct the item(s), and continue.

It took about 3.5 minutes to create the VM from the template in my lab.

Wait for the creation of the VM to complete, as shown in Figure 7.

Since we enabled Remote Desktop in the Template, the new VM has it enabled.

In vCenter, select the new template VM, and in the right pane, look at the IP address, as shown in Figure 8.

As shown in Figure 9, click Start, Run, and type in mstsc /v:ipaddress /admin, and press Enter [where IP Address is the IP address shown in Figure 8].

Using Remote Desktop at this point makes it easier for me to get screenshots.

Enter the credentials for the local Administrator account and press Enter, as shown in Figure 10.

Click Yes, as shown in Figure 11.

Click Local Server in the left pane of Server Manager, as shown in Figure 12.

I made the settings in bold to this VM.

• Computer name: LabDC1
  • Note: Some software and licensing products use the CasE sEnsiTivE name. The Citrix License Server is one of those.
• Ethernet0: As shown in Figures 13 and 14.
  • Click the link IPv4 address assigned by DHCP
  • Right-click the vmxnet3 Ethernet Adapter
  • Click Properties
  • Click the Configure button
  • In the Power Management tab, deselect all three items, and click OK to save the changes
  • Right-click the vmxnet3 Ethernet Adapter
  • Click Properties
  • Click Internet Protocol Version 4 (TCP/IPv4)
  • Click Properties
  • Select Use the following IP address
    • Because this is a server, assign it a static IP address
    • Enter the appropriate Subnet mask
    • Enter the appropriate Default gateway
  • Select Use the following DNS server addresses
    • Enter at least the Preferred DNS server (for most labs, this is usually the same as the Default gateway)
  • Note: Once your click OK, the Remote Desktop connection is lost. Use mstsc again to connect using the assigned static IP address.
• Product ID: I used a license key from my Microsoft Action Pack Subscription, as shown in Figure 15.

Feel free to make any other configuration changes you wish to this VM.

Repeat this process to create any additional VM required.

XenServer

In XenCenter, right-click the Server 2019 Template and click on New VM wizard…, as shown in Figure 16.

Select the Server 2019 Template template and click Next, as shown in Figure 17.

Enter a Name, an optional Description, and click Next, as shown in Figure 18.

Since the operating system is installed in the template VM, Click Next, as shown in Figure 19.

Select Don’t assign this VM a home server and click Next, as shown in Figure 20.

You may change the Number of vCPUs, Topology, and Memory if you wish. I left everything the same as the template VM. Click Next, as shown in Figure 21.

As my hosts do not have a GPU card, I clicked Next, as shown in Figure 22.

Click Edit, as shown in Figure 23.

I recommend changing both the Name and Description. Doing so makes it easier later if you ever delete a VM and its attached hard disks. If all the hard disks have the same name and description, it is challenging to determine which disks go with which VM.

Enter a Name and Description and click OK, as shown in Figure 24.

Click Next, as shown in Figure 25.

If multiple Virtual network interfaces are available, select the appropriate interface and click Next, as shown in Figure 26.

Verify that all the configuration options are correct and click Create Now, as shown in Figure 27. If an option is not correct, click Previous, correct the option and then continue.

I deselected the option Start the new VM automatically since it doesn’t work.

Wait for the creation of the VM to complete, as shown in Figure 28. It took about 2 seconds in my lab to create the VM from the template.

In XenCenter, right-click the new VM, click Start on Server, select a host to start the VM, as shown in Figure 29.

Expand the XenServer host on which you started the VM, click the VM, and click the Networking tab, as shown in Figure 30. You see the IP address assigned to the VM.

As shown in Figure 31, click Start, Run, and type in mstsc /v:ipaddress /admin, and press Enter [where IP Address is the IP address shown in Figure 30].

Using Remote Desktop at this point makes it easier for me to get screenshots.

Enter the credentials for the local Administrator account and press Enter, as shown in Figure 32.

Click Yes, as shown in Figure 33.

Click Local Server in the left pane of Server Manager, as shown in Figure 34.

I made the settings in bold to this VM.

• Computer name: LabDC1
  • Note: Some software and licensing products use the CasE sEnsiTivE name. The Citrix License Server is one of those.
• Ethernet0: As shown in Figure 35.
  • Click the link IPv4 address assigned by DHCP
  • Right-click the vmxnet3 Ethernet Adapter
  • Click Properties
  • Click Internet Protocol Version 4 (TCP/IPv4)
  • Click Properties
  • Select Use the following IP address
    • Because this is a server, assign it a static IP address
    • Enter the appropriate Subnet mask
    • Enter the appropriate Default gateway
  • Select Use the following DNS server addresses
    • Enter at least the Preferred DNS server (for most labs, this is usually the same as the Default gateway)
  • Note: Once your click OK, the Remote Desktop connection is lost. Use mstsc again to connect using the assigned static IP address.
• Product ID: I used a license key from my Microsoft Action Pack Subscription, as shown in Figure 36.

Feel free to make any other configuration changes you wish to this VM.

Repeat this process to create any additional VM(s) required.

Up next: Create Active Directory

Landing page for the article series

With both VMware vSphere and vCenter and Citrix XenServer and XenCenter installed and basic configuration completed, the next step is to create a Windows Server 2019 master image. After we build the Server 2019 master, we can start building the Microsoft infrastructure servers. For this article, I used Windows Server 2019 Standard Edition.

This article covers creating a template in both VMware vCenter and Citrix XenCenter.

VMware

In vCenter, right-click the cluster and click on New Virtual Machine…, as shown in Figure 1.

Select Create a new virtual machine and click Next, as shown in Figure 2.

Enter a Virtual machine name and click Next, as shown in Figure 3.

Click Next, as shown in Figure 4.

Select the NFS shared datastore created earlier in this series and click Next, as shown in Figure 5.

Keep the default Compatible with the value of ESXi 7.0 U2 and later and click Next, as shown in Figure 6.

Verify that the Guest OS Family is Windows and that the Guest OS Version is Microsoft Windows Server 2019 (64-bit) and click Next, as shown in Figure 7.

For CPU and Memory, use what works for your environment. For me, as shown in Figure 8, I used the following values:

• CPU: 4
• Memory: 8 GB
• New Hard disk: 90GB with Disk Provisioning type Thin Provision
• New SCSI controller: LSI Logic SAS
• New Network: VM Traffic vDS 10Gb (or whatever VM traffic vDS you created) and Adapter Type must be vmxnet3
• New CD/DVD Drive: Select the Windows Server 2019 ISO file from the ISO Datastore. Make sure to also select Connect At Power On

Use default values for the remaining options and click Next, as shown in Figure 8.

Verify that the configuration data for the new VM is correct and click Finish, as shown in Figure 9. If any item is incorrect, click Back, correct the item(s), and continue.

Wait for the creation of the VM to complete, as shown in Figure 10.

In vCenter, select the new template VM, and in the right pane, click LAUNCH REMOTE CONSOLE, as shown in Figure 11.

Note: From Abdullah Abdullah. You can use the Web Console instead of the Remote Console, but the VM must be powered on first to make the option available.

If you receive a popup stating You’ll need a new app to open this vrmc link, as shown in Figure 12, press Esc.

In vCenter, click the circled lower case I, as shown in Figure 13.

In the popup that appears, click Download Remote Console, as shown in Figure 14.

Follow the steps to install the VMware Remote Console, as shown in Figure 15.

Once you install the console, in vCenter, select the new template VM, and in the right pane, click LAUNCH REMOTE CONSOLE, as shown in Figure 11.

Depending on the speed of your ESXi hosts, you need to be quick in the following steps.

1. Click the Green start button, as shown in Figure 16,
2. Click inside the console window,
3. Press a key, for example, the spacebar when prompted, as shown in Figure 17.

The installation of Windows Server 2019 begins.

Select the options appropriate for you and click Next, as shown in Figure 18.

Click Install now, as shown in Figure 19.

The Microsoft Action Pack Subscription has licenses for Windows Server 2019 Standard. I selected Windows Server 2019 Standard (Desktop Experience). Select either Standard or Datacenter, depending on the license you have.

Click Next, as shown in Figure 20.

Select I accept the license terms and click Next, as shown in Figure 21.

Select Custom: Install Windows only (advanced), as shown in Figure 22.

Click Next, as shown in Figure 23.

The Server 2019 installation begins, as shown in Figure 24.

After the VM restarts, enter a password for the local Administrator account and click Finish, as shown in Figure 25.

Press Ctrl-Alt-Insert, enter the password for the Administrator account, and press Enter, as shown in Figures 26 and 27.

Note: If you press Ctrl-Alt-Delete, your local computer processes that key combination. Ctrl-Alt-Insert is what most virtualization and remote consoles accept as Ctrl-Alt-Delete.

Close the popup shown in Figure 28 for Windows Admin Center. If you don’t want to see this popup again, select Don’t show this message again.

We need to install the VMware tools. Please see Overview of VMware Tools for a complete description.

Overview of VMware Tools

VMware Tools is a suite of utilities that enhances the performance of the virtual machine’s guest operating system and improves the management of the virtual machine. Without VMware Tools installed in your guest operating system, guest performance lacks important functionality. Installing VMware Tools eliminates or improves these issues:

• Low video resolution
• Inadequate color depth
• Incorrect display of network speed
• Restricted movement of the mouse
• Inability to copy and paste and drag-and-drop files
• Missing sound
• Provides the ability to take quiesced snapshots of the guest OS
• Synchronizes the time in the guest operating system with the time on the host

In vCenter, click Install VMware Tools, as shown in Figure 29.

Click Mount, as shown in Figure 30.

In the VM, you see a popup in the lower right corner, as shown in Figure 31.

Click that popup and then click Run setup64.exe in the popup in the upper right corner, as shown in Figure 32.

Click Next, as shown in Figure 33.

Select Typical and click Next, as shown in Figure 34.

Click Install, as shown in Figure 35.

You may receive a Networks popup message. Decide whether you want this VM discoverable on your network and click either Yes or No, as shown in Figure 36.

Click Finish, as shown in Figure 37.

Click Yes, as shown in Figure 38.

After the VM restarts, log back in and click Local Server in the left pane of Server Manager, as shown in Figure 39.

We use a template to create additional VMs. These additional VMs, when first powered on, go through what Microsoft calls the Out of Box Experience or OOBE.

When customers turn on their Windows PCs for the first time, they see the Windows Out of Box Experience (OOBE). OOBE consists of a series of screens that require customers to accept the license agreement, connect to the internet, log in with or sign up for a Microsoft Account, and share information with the OEM.

The following items are available to customize. Some make no sense to customize as the OOBE resets them to default values.

Note: I made the settings in bold to my template VM.

• Computer name: Don’t change
• Workgroup: Changeable
• Windows Defender Firewall: Changeable
• Remote management: Changeable
• Remote Desktop: Changeable
  • Allow remote connections to this computer
• NIC Teaming: No need to change as there is only one network card at this time
• Ethernet0: Don’t change
• Last installed updates: Keeps date from Template VM
• Windows Update: Changeable
• Last checked for updates: Keeps date from Template VM
• Windows Defender Antivirus: Changeable
• Feedback & Diagnostics: Changeable
  • Diagnostic data: Full
  • Improve inking and typing: Off
  • Feedback frequency: Never
• IE Enhanced Security Configuration: Changeable
  • Admin: Off
  • User: Off
• Time zone: Changeable
  • Change time zone: Central Time
  • Deselect Notify me when the clock changes
• Product ID: Don’t change

If you wish, you can install all Windows Updates, as I always do.

After you install all Windows Updates, reboot the server to clear any pending restart required flags.

After the VM restarts, log back in.

Right-click the Start button, click Run, as shown in Figure 40.

Type in c:\windows\system32\sysprep\sysprep.exe, and press Enter, as shown in Figure 41.

Select Generalize, select Shutdown from the Shutdown Options dropdown list, and click OK, as shown in Figure 42.

When the server is at the login screen, shut down the server.

In vCenter, in the left pane, right-click the VM, click Power, and click Shut Down Guest OS, as shown in Figure 43.

Click Yes, as shown in Figure 44.

After the VM completes the shutdown process, right-click the VM, click Edit Settings…, as shown in Figure 45.

Change CD/DVD drive 1 to Client Device and click OK, as shown in Figure 46.

Right-click the VM, click Template, and click Convert to Template, as shown in Figure 47.

Click Yes, as shown in Figure 48.

The VM is now a template.

XenServer

In XenCenter, right-click the pool and click on New VM…, as shown in Figure 49.

Select the Windows Server 2019 (64-bit) template and click Next, as shown in Figure 50.

Enter a Virtual machine name, an optional Description, and click Next, as shown in Figure 51.

Select the Windows Server 2019 ISO, select your preferred Boot Mode, and click Next, as shown in Figure 52.

Select Don’t assign this VM a home server and click Next, as shown in Figure 53.

I selected 4 for the Number of vCPUs and 8 for Memory. I left the Topology at the value selected by XenCenter. Feel free to change the selection. Click Next, as shown in Figure 54.

As my hosts do not have a GPU card, I clicked Next, as shown in Figure 55.

Click Edit, as shown in Figure 56.

I prefer the hard disk Size of 90 GB used by VMware. I also recommend changing both the Name and Description. Doing so makes it easier later if you ever delete a VM and its attached hard disks. If all the hard disks have the same name and description, it is challenging to determine which disks go with which VM.

Enter a Name, Description, a hard disk Size, and select the shared storage repository created earlier. Click OK, as shown in Figure 57.

If multiple Virtual network interfaces are available, select the appropriate interface and click Next, as shown in Figure 58.

Verify all the configuration options are correct and click Create Now, as shown in Figure 59. If an option is not correct, click Previous, correct the option and then continue.

I deselected the option Start the new VM automatically since it doesn’t work.

Wait for the creation of the VM to complete, as shown in Figure 60.

In XenCenter, right-click the new template VM, click Start on Server, select a host to start the VM, as shown in Figure 61.

Note: I started on a specific server to make getting screenshots easier.

Click on the Console tab in the right pane, as shown in Figure 62.

Depending on the speed of your XenServer hosts, you need to be quick in the following steps.

1. Click the Green start button, as shown in Figure 63,
2. Click inside the console window,
3. Press a key, for example, the spacebar when prompted, as shown in Figure 64.

The installation of Windows Server 2019 begins.

The installation and initial configuration processes are the same, as shown in Figures 18 through 28.

After the initial login to the server, we need to install the Citrix VM Tools.

Citrix VM Tools for Windows provides high-performance I/O services without the overhead of traditional device emulation. Citrix VM Tools for Windows consists of I/O drivers (also known as paravirtualized drivers or PV drivers) and the Management Agent. Citrix VM Tools for Windows must be installed on each Windows VM for the VM to have a fully supported configuration. A VM functions without them, but performance is significantly hampered.

From the new Server 2019 VM, browse to the Citrix VM Tools downloaded earlier and double-click managementagentx64.msi.

Click Next, as shown in Figure 65.

Select I accept the terms in the License Agreement and click Next, as shown in Figure 66.

Click Next, as shown in Figure 67.

Decide whether to Send anonymous usage information to Citrix and click Next, as shown in Figure 68.

Click Install, as shown in Figure 69.

You may receive a Networks popup message. Decide whether you want this VM discoverable on your network and click either Yes or No, as shown in Figure 70.

Click Finish, as shown in Figure 71.

Click Yes, as shown in Figure 72.

After the VM restarts, log back in and click OK, as shown in Figure 73.

Click Local Server in the left pane of Server Manager, as shown in Figure 74.

Eject the Windows Server 2019 ISO file, as shown in Figure 75.

We use a template to create additional VMs. These additional VMs, when first powered on, go through what Microsoft calls the Out of Box Experience or OOBE.

When customers turn on their Windows PCs for the first time, they see the Windows Out of Box Experience (OOBE). OOBE consists of a series of screens that require customers to accept the license agreement, connect to the internet, log in with or sign up for a Microsoft Account, and share information with the OEM.

The following items are available to customize. Some make no sense to customize as the OOBE resets them to default values.

Note: I made the settings in bold to my template VM.

• Computer name: Don’t change
• Workgroup: Changeable
• Windows Defender Firewall: Changeable
• Remote management: Changeable
• Remote Desktop: Changeable
  • Allow remote connections to this computer
• NIC Teaming: No need to change as there is only one network card at this time
• Ethernet0: Don’t change
• Last installed updates: Keeps date from Template VM
• Windows Update: Changeable
• Last checked for updates: Keeps date from Template VM
• Windows Defender Antivirus: Changeable
• Feedback & Diagnostics: Changeable
  • Diagnostic data: Full
  • Improve inking and typing: Off
  • Feedback frequency: Never
• IE Enhanced Security Configuration: Changeable
  • Admin: Off
  • User: Off
• Time zone: Changeable
  • Change time zone: Central Time
  • Deselect Notify me when the clock changes
• Product ID: Don’t change

If you wish, you can install all Windows Updates, as I always do. I never install any Preview updates.

After you install all Windows Updates, reboot the server to clear any pending restart required flags.

After the VM restarts, log back in.

Right-click the Start button, click Run, as shown in Figure 76.

Type in c:\windows\system32\sysprep\sysprep.exe, and press Enter, as shown in Figure 77.

Select Generalize, select Shutdown from the Shutdown Options dropdown list, and click OK, as shown in Figure 78.

After the VM completes the shutdown process, right-click the VM, and click Convert to Template, as shown in Figure 79.

Click Convert, as shown in Figure 80.

The VM is now a template.

You can follow the same general process to create a Windows 10 template. I created one based on Windows 10 20H2, as shown in Figures 81 and 82.

Notes:

• Don’t forget to enable Remote Desktop access, as shown in Figure 83.
  • Settings, System, Remote Desktop, Enable Remote Desktop
• Don’t make many changes to VM or the configuration options, as the OOBE resets most changes when creating a VM from the template.
• I don’t install any Preview updates offered by Windows Updates.

We use the Server 2019 Template to build two domain controllers and a Microsoft Certificate Authority server in the next Part.

Up next: Create VMs from the Server 2019 Template.

Landing page for the article series

The vCenter Server Appliance (VCSA), like all software, receives updates. The VCSA makes it drop-dead simple to update. Before you start:

1. Clear your browser’s cookies and cache. I recommend this to keep from getting the spinning wheel of nothing after the VCSA update.
2. Backup the VCSA.
3. Take a snapshot of the vCenter VM.

Note: From Abdullah Abdullah. When doing upgrades, it is always good to consult with VMware’s Interoperability Matrix and verify the upgrade path BEFORE attempting the upgrade.

To take a snapshot of the vCenter VM from the vSphere client, in the left pane, click VMs and Templates, right-click the vCenter VM, click Snapshots, and click Take Snapshot…, as shown in Figure 1.

Enter a Name, an optional Description, and click Create, as shown in Figure 2.

In my lab, creating the snapshot took about four minutes.

Now that we have a backup and a snapshot of the VCSA, let’s perform the update.

In your web browser, go to the VCSA management interface, https://VCSA-ip-address-or-fqdn:5480, as shown in Figure 14.

Log in to the VMware vCenter Server Management console as root using the password created during the install of the VCSA, as shown in Figures 4 and 5.

The first thing we need to do is verify there are no health issues with the VCSA. In the left pane, click Summary, and in the right pane, view the Health Status, as shown in Figure 6. Verify that all items show as Good. If any item is not Good, determine the cause of the health issue, remediate the issue, and restart the update process.

In the left pane, click Update, as shown in Figure 7.

If there is more than one update available, the Update screen states that VCSA updates are cumulative.

Select the most recent update available and click STAGE AND INSTALL, as shown in Figure 8.

Select I accept the terms of the license agreement and click Next, as shown in Figure 9.

Enter the password for the vCenter’s administrator account and click Next, as shown in Figure 10.

Select I have backed up vCenter Server and its associated databases and click Finish, as shown in Figure 11. I know you are not going to lie. You did a backup first, right?

The Staging and Installation begin, as shown in Figure 12.

The Installation shows success, as shown in Figure 13. Click Close, and exit the browser.

Log in to the VCSA appliance management interface and click on Update in the left pane. You see the VCSA’s current version and no Available updates on the Update screen, as shown in Figure 14.

Note: If you log in to the VCSA appliance management interface and the console never shows, clear your browser’s cookies and cache, exit your browser, and try again.

You can configure the VCSA to check for updates automatically.

Click SETTINGS, as shown in Figure 15.

Select Check for updates automatically, enter the update check frequency, and click Save, as shown in Figure 16.

The only way to see the automatic check for updates schedule is to go back into SETTINGS.

Exit the VCSA management console.

With the update completed, there is no need to keep the snapshot made of the vCenter VM.

To delete the snapshot of the vCenter VM from the vSphere client, in the left pane, click VMs and Templates, right-click the vCenter VM, click Snapshots, and click Manage Snapshots, as shown in Figure 17.

Click Delete, as shown in Figure 18.

Click Delete, as shown in Figure 19.

vCenter deletes the snapshot, as shown in Figure 20.

Up next: Install Citrix XenServer 8.2

Landing page for the article series

It is essential to have a backup of all critical data, servers, and Virtual Machines, whether in a lab or production environment. Before making significant changes to the vCenter Server Appliance (VCSA), it is vital to make a backup first. This article covers backing up the VCSA using NFS.

I use my Synology 1817+ Storage Unit for vCenter backups.

First, log in to the NAS by opening an internet browser, browsing to the Synology device’s IP address, entering the username and password for the device, and then clicking Sign In. For me, that is https://192.168.1.253:5001, as shown in Figure 1.

Next, on the main page, click the Control Panel, as shown in Figure 2.

Click Shared Folder, as shown in Figure 3.

Click Create, as shown in Figure 4.

Do the following steps, as shown in Figure 5:

• Enter a Name and Description.
• If you have more than one Volume configured, select the appropriate Volume for the Location.
• Select Hide this shared folder in “My Network Places” and Hide sub-folders and files from users without permissions.
• Deselect Enable Recycle Bin
• Click Next

Verify that nothing is selected and click Next, as shown in Figure 6.

Verify that nothing is selected and click Next, as shown in Figure 7.

Verify that all the information is correct, as seen in Figure 8. If it is, click Apply. If the information is not correct, click Back, correct the information, and then continue.

On the Permissions tab, select Read/Write for the admin accounts and No Access for the guest account, as shown in Figure 9. Do not click OK yet.

Click the NFS Permissions tab and then click Create, as shown in Figure 10.

Enter the Hostname or IP address of the ESXi host and click OK, as shown in Figure 11. Because I have six  ESXi hosts in VMware vCenter, I entered an * for the IP address to allow all IP addresses in Webster’s Lab access.

Note: Synology Diskstation Manager grants NFS permissions on a per-host basis instead of a per-user basis because virtualization hosts access the NFS shares, not users.

Note: Save the Mount path information shown in Figure 12. It would help if you had the mount path when setting up the VCSA backup. If you need the Mount path information later, click the Edit tab displayed in Figure 13 and go to the NFS Permissions tab as shown previously in Figure 10.

Now, to configure the VCSA backup.

In your web browser, go to the VCSA management interface, https://VCSA-ip-address-or-fqdn:5480, as shown in Figure 14.

Log in to the VMware vCenter Server Management console as root using the password created during the install of the VCSA, as shown in Figures 15 and 16.

Click Backup, as shown in Figure 17.

Click BACKUP NOW, as shown in Figure 18.

Enter the following information:

1. The Backup location (From the NFS share created earlier in Figures 5 through 12)
2. The credentials to access the Backup location
3. Optional credentials to encrypt the backup
4. Optional, enter a description
5. Click Start to start the backup process, as shown in Figure 19

Figure 20 shows the completed backup.

If you would like, you can also set up a backup Schedule.

Click Configure, as shown in Figure 21.

Enter the following information:

1. The Backup location (From the NFS share created earlier)
2. The credentials to access the Backup location
3. The backup Schedule
4. Optional credentials to encrypt the backup
5. The Number of backups to retain
6. Click Create to create the backup schedule, as shown in Figure 22

Figure 23 shows the created scheduled backup job.

Figure 24 shows the backup activity after the scheduled backups run for six days.

On the NAS, the NFS storage shows there are four scheduled backup files. One for today and three retained backups. This means that with a Number of backups to retain value of 3, the actual number of backup files stored is the retention value plus one. In my case, four. Figure 25 shows the four retained backups on the NAS VCSABackup share created earlier in this article.

The Backup Schedule removed the scheduled backups created on 2021-04-28 and 2021-04-30.

Figure 24 shows a total of seven backups. The seventh backup is the original manual backup created earlier, as shown in Figures 19 and 20. That backup was removed by the Backup Schedule retention cleanup process as the file from 2021-04-28 no longer exists. Is that a bug? I would have thought a manual backup would have a special flag, and the retention policy cleanup process would leave manual backups alone.

Up next: Updating the vCenter Server Appliance

Landing page for the article series

Before creating a vSphere Distributed Switch (vDS), we need to create a Datacenter.

Verify you are connected and logged in to the vCenter console.

Click Menu and click VMs and Templates, as shown in Figure 1.

Right-click the vCenter VM and click New Datacenter…, as shown in Figure 2.

Enter a Name for the Datacenter and click OK, as shown in Figure 3.

The new Datacenter is shown in the vCenter console, as shown in Figure 4.

Now the hosts are added to vCenter.

Click the Hosts and Clusters node in vCenter, as shown in Figure 5.

Expand the Hosts and Clusters node, right-click the Datacenter and click Add Host…, as shown in Figure 6.

Enter the Hostname or IP address or the host to add and click Next, as shown in Figure 7.

Enter a User name and Password to connect to the ESXi host and click Next, as shown in Figure 8.

Because of the host’s self-signed certificate, click Yes on the Security Alert popup, as shown in Figure 9.

Click Next, as shown in Figure 10.

Select the license to assign the host and click Next, as shown in Figure 11.

Selected the preferred Lockdown mode and click Next, as shown in Figure 12.

Click Next, as shown in Figure 13.

If all the information is correct, click Finish, as shown in Figure 14. If the information is not correct, click Back, correct the information, and then continue.

Repeat the steps outlined in Figures 6 through 14 to add additional hosts to vCenter.

Next is creating a Cluster.

Once you add all hosts to vCenter, right-click the Datacenter and click New Cluster…, as shown in Figure 15.

Enter a Name for the cluster and click OK, as shown in Figure 16.

Note: For my lab, at this time, I do not use the “single image” host and cluster lifecycle. Please read About Managing Host and Cluster Lifecycle if you want more information on this new vCenter 7 feature.

Click Finish, as shown in Figure 17.

In the left pane, click the new cluster as shown in Figure 18.

In Cluster quickstart, in the right pane, click the Edit button in the Cluster basics box, as shown in Figure 19.

Enable vSphere DRS (to allow the automatic creation of vMotion later) and click OK, as shown in Figure 20.

In Cluster quickstart, click the Add button in the Add hosts box in the right pane, as shown in Figure 21.

Select Existing hosts, select the hosts to add and click Next, as shown in Figure 22.

Click Next, as shown in Figure 23.

If all the information is correct, click Finish, as shown in Figure 24. If the information is not correct, click Back, correct the information, and then continue.

In the vCenter console, you can see the hosts added to the cluster, as shown in Figure 25.

Now on to the fun stuff: Networking.

I tried to come up with my explanation of port groups, virtual switches, physical NICs, VMkernel NICs, TCP/IP stacks, uplinks, and other items but found VMware already had something even I could understand.

I found the following information in the vSphere Networking Concepts Overview documentation, Copyright VMware, Inc., available at https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.networking.doc/GUID-2B11DBB8-CB3C-4AFF-8885-EFEA0FC562F4.html.

Networking Concepts Overview

A few concepts are essential for a thorough understanding of virtual networking. If you are new to ESXi, it is helpful to review these concepts.

Physical Network

A network of physical machines that are connected so that they can send data to and receive data from each other. VMware ESXi runs on a physical machine.

Virtual Network

A network of virtual machines running on a physical machine that are connected logically to each other so that they can send data to and receive data from each other. Virtual machines can be connected to the virtual networks that you create when you add a network.

Opaque Network

An opaque network is a network created and managed by a separate entity outside of vSphere. For example, logical networks that are created and managed by VMware NSX ^® appear in vCenter Server as opaque networks of the type nsx.LogicalSwitch. You can choose an opaque network as the backing for a VM network adapter. To manage an opaque network, use the management tools associated with the opaque network, such as VMware NSX ^® Manager or the VMware NSX API management tools.

 Note: With NSX-T 3.0, it is now possible to run NSX-T directly on vSphere Distributed Switch (vDS) version 7.0 or later. Such networks are not opaque and are identified as NSX logical segments running on vDS 7.0. For more information, see Knowledge Base article KB #79872.

Physical Ethernet Switch

A physical ethernet switch manages network traffic between machines on the physical network. A switch has multiple ports, each of which can be connected to a single machine or another switch on the network. Each port can be configured to behave in certain ways depending on the needs of the machine connected to it. The switch learns which hosts are connected to which of its ports and uses that information to forward traffic to the correct physical machines. Switches are the core of a physical network. Multiple switches can be connected together to form larger networks.

vSphere Standard Switch

It works much like a physical Ethernet switch. It detects which virtual machines are logically connected to each of its virtual ports and uses that information to forward traffic to the correct virtual machines. A vSphere standard switch can be connected to physical switches by using physical Ethernet adapters, also referred to as uplink adapters, to join virtual networks with physical networks. This type of connection is similar to connecting physical switches together to create a larger network. Even though a vSphere standard switch works much like a physical switch, it does not have some of the advanced functionality of a physical switch.

vSphere Distributed Switch

A vSphere distributed switch acts as a single switch across all associated hosts in a data center to provide centralized provisioning, administration, and monitoring of virtual networks. You configure a vSphere distributed switch on the vCenter Server system and the configuration is propagated to all hosts that are associated with the switch. This lets virtual machines maintain consistent network configuration as they migrate across multiple hosts.

Host Proxy Switch

A hidden standard switch that resides on every host that is associated with a vSphere distributed switch. The host proxy switch replicates the networking configuration set on the vSphere distributed switch to the particular host.

Standard Port Group

Network services connect to standard switches through port groups. Port groups define how a connection is made through the switch to the network. Typically, a single standard switch is associated with one or more port groups. A port group specifies port configuration options such as bandwidth limitations and VLAN tagging policies for each member port.

Distributed Port

A port on a vSphere distributed switch that connects to a host’s VMkernel or to a virtual machine’s network adapter.

Distributed Port Group

A port group associated with a vSphere distributed switch that specifies port configuration options for each member port. Distributed port groups define how a connection is made through the vSphere distributed switch to the network.

NSX Distributed Port Group

A port group associated with a vSphere distributed switch that specifies port configuration options for each member port. To distinguish between vSphere distributed port groups and NSX port groups, in the vSphere Client the NSX virtual distributed switch, and its associated port group is identified with the icon. NSX appears as an opaque network in vCenter Server, and you cannot configure NSX settings in vCenter Server. The NSX settings displayed are read-only. You configure NSX distributed port groups using VMware NSX ^® Manager or the VMware NSX API management tools.

NIC Teaming

NIC teaming occurs when multiple uplink adapters are associated with a single switch to form a team. A team can either share a load of traffic between physical and virtual networks among some or all of its members or provide passive failover in the event of a hardware failure or a network outage.

VLAN

VLAN enables a single physical LAN segment to be further segmented so that groups of ports are isolated from one another as if they were on physically different segments. The standard is 802.1Q.

VMkernel TCP/IP Networking Layer

The VMkernel networking layer provides connectivity to hosts and handles the standard infrastructure traffic of vSphere vMotion, IP storage, Fault Tolerance, and vSAN.

IP Storage

Any form of storage that uses TCP/IP network communication as its foundation. iSCSI and NFS can be used as virtual machine datastores and for direct mounting of .ISO files, which are presented as CD-ROMs to virtual machines.

TCP Segmentation Offload

TCP Segmentation Offload, TSO, allows a TCP/IP stack to emit large frames (up to 64KB) even though the maximum transmission unit (MTU) of the interface is smaller. The network adapter then separates the large frame into MTU-sized frames and prepends an adjusted copy of the initial TCP/IP headers.

My TinkerTry server has two 1Gb NICs and two 10Gb NICs. I want to use all four NICs. Two vDSes are required; one for the two 1Gb NICs and one for the two 10Gb NICs.

In Cluster quickstart, click the Configure button in the Configure cluster box as shown in Figure 26.

I want to create a vDS for each pair of  NICs and name them to associate them with the NIC port speed.

Using the scrollbar, scroll down so you can see the Distributed switches and Physical adapters on one screen.

As shown in Figures 27 and 28:

1. From the Number of distributed switches dropdown, select 2
2. Give each distributed switch a Name
3. Select which Port group to use for vMotion
4. Select the Physical adapters to match to each distributed switch
5. When complete, click

Change the IP Type to Static IPs, enter the IP information for vMotion as shown in Figure 29, and click Next.

Select the appropriate options and click Next, as shown in Figure 30.

If all the information is correct, click Finish, as shown in Figure 31. If the information is not correct, click Back, correct the settings, and then continue.

Click the Networking icon, expand the cluster, and each vDS, as shown in Figure 32.

Verify that the vDS 10Gb switch has an MTU of 9000.

Right-click vDS 10Gb, click Settings and click Edit Settings…, as shown in Figure 33.

Click Advanced and verify that MTU (Bytes) equals 9000. If the value is not 9000, change it to 9000 and click OK, as shown in Figure 34.

I plan to use the vDS 10Gb switch for VM, vMotion, and Storage traffic. To accomplish that, two different Port Groups are required. We created the vMotion Port Group earlier in Figure 29.

Right-click the vDS 10Gb switch, select Distributed Port Group, select New Distributed Port Group…, as shown in Figure 35.

The Name for this port group is VM Traffic vDS 10Gb. Click Next, as shown in Figure 36.

For my lab, the default general properties are suitable. Click Next, as shown in Figure 37.

If all the information is correct, click Finish, as shown in Figure 38. If the information is not correct, click Back, correct the information, and then continue.

Repeat these steps to create a different port group with the Name: NFS vDS 10Gb.

When complete, the Distributed Port Groups should look like Figure 39.

vMotion and NFS storage require VMkernel NICs. The vMotion VMkernel NIC was created earlier as part of the vDS creation wizard (Figure 29).

Right-click the NFS vDS 10Gb distributed port group and click Add VMkernel Adapters…, as shown in Figure 40.

Click Attached hosts…, as shown in Figure 41.

Select all hosts and click OK, as shown in Figure 42.

Click Next, as shown in Figure 43.

Enter the following information:

• MTU: Enter the MTU for your 10G switch (typically 9000)
• TCP/IP stack: select Default from the dropdown list
• Available services -> Leave all unselected

Click Next, as shown in Figure 44.

Select Use static IPv4 settings. For each host, enter the IP address and subnet for the NFS VMkernel and click Next, as shown in Figure 45.

If all the information is correct, click Finish, as shown in Figure 46. If the information is not correct, click Back, correct the information, and then continue.

Now that our networking is complete let’s move on to configuring NFS Storage.

Click Storage, as shown in Figure 47.

First up is an NFS datastore to hold VMs.

Right-click the cluster, click Storage, click New Datastore…, as shown in Figure 48.

Select NFS and click Next, as shown in Figure 49.

Select NFS 4.1 and click Next, as shown in Figure 50.

Note: VMware has an article to show the differences in the capabilities of NFS 3 and NFS 4.1. Please see NFS Protocols and ESXi.

Enter a Datastore Name, the Folder on the NFS server, the NFS Server name or IP address, and click Add, as shown in Figure 51.

Click Next, as shown in Figure 52.

Select the Kerberos authentication option required for your NAS and click Next, as shown in Figure 53.

Select all hosts in the cluster and click Next, as shown in Figure 54.

If all the information is correct, click Finish, as shown in Figure 55. If the information is not correct, click Back, correct the information, and then continue.

Next, let’s verify the VAAI configuration for the datastore. Click the VM datastore, click Configure and click Hardware Acceleration, as shown in Figure 56.

Repeat the steps outlined in Figures 48 through 55 to create an NFS datastore to contain ISOs.

After creating all datastores, they appear in vCenter, as shown in Figure 57.

To verify the NFS ISO datastore, upload an ISO to the datastore.

Right-click the ISOs datastore and click Browse Files, as shown in Figure 58.

Click Upload Files as shown in Figure 59.

Browse to an ISO file, select it, and click Open, as shown in Figure 60. I am uploading a Windows Server 2019 ISO.

Note: You can download a 180-day evaluation copy of Windows Server 2019 (among other Microsoft products) from the Microsoft Evaluation Center.

The ISO file starts uploading to the ISOs datastore, as shown in Figure 61.

The ISOs show in the datastore once the ISO file upload is complete, as shown in Figures 62 and 63.

Now that we have created shared datastores, we need to move the vCenter storage from the local datastore to the shared VMs datastore. Moving datastores eliminates the storage warning on the local datastore shown in Figure 64.

In the left pane, click VMs and Templates, right-click the vCenter VM, and click Migrate…, as shown in Figure 65.

Select Change storage only and click Next, as shown in Figure 66.

Select the datastore created for VM storage and click Next, as shown in Figure 67.

If all the information is correct, click Finish, as shown in Figure 68. If the information is not correct, click Back, correct the information, and then continue.

As shown in Figure 69, the storage migration starts.

Note: In my lab, the storage migration took just over one hour.

Up next: Backup the vCenter Server Appliance using NFS

Landing page for the article series

Now that the host has local storage for a Virtual Machine (VM), we can install the vCenter Server Appliance (VCSA).

I downloaded the VCSA 7.0 U2 ISO, mounted it, and extracted all the files to a VCSA70U2 folder to make the installation more manageable, as shown in Figure 1.

I am installing the VCSA from my Windows 10 computer. Since I use a Fully Qualified Domain Name (FQDN) of vcenter.labaddomain.com for the VCSA, I added a host file entry, shown in Figure 2, since my computer is not domain-joined.

Change to the vcsa-ui-installer\win32 folder, right-click installer.exe and select Run as administrator, as shown in Figure 3.

Select Install, as shown in Figure 4.

Click Next, as shown in Figure 5.

Select I accept the terms of the license agreement and click Next, as shown in Figure 6.

Enter the requested information and click Next, as shown in Figure 7.

Since the ESXi host uses a self-signed certificate, click Yes to accept the warning, as shown in Figure 8.

Enter the VM name for the VCSA VM, enter and confirm the VCSA’s root account password, and click Next, as shown in Figure 9.

For my lab, there are six hosts, I doubt I need 100 VMs, so I went with the default values of a Tiny deployment and Default storage. Select the Deployment size and Storage size required, and click Next, as shown in Figure 10.

Note: As I worked through this article series, I kept receiving memory usage warnings for the vCenter VM. I shut down the vCenter VM and increased the memory from 12 GB to 16 GB.

Select the ESXiHost1 Local VM datastore created in a previous article and click Next, as shown in Figure 11.

Enter the required information and click Next, as shown in Figure 12.

Figure 12

The DNS Servers listed must be able to resolve the FQDN entered. I created a DNS A record on my domain controller, as shown in Figure 13.

If you receive an error after clicking Next, verify name resolution for the FQDN entered in Figure 12 is working.

Verify that all the information is correct. If any information is not correct, click Back, correct the information, and continue.

If all the information is correct and verified that name resolution for the FQDN entered in Figure 12 is working both on the computer installing the VCSA and in your Active Directory, click Finish, as shown in Figure 14.

The VCSA installation begins, as shown in Figure 15.

When the VCSA deployment completes, click Continue to proceed to stage 2 (appliance setup), shown in Figure 16.

Note: If you get an error message about finding the appliance, the name resolution for the VCSA’s FQDN is not working.

To continue to the VCSA setup, click Next, as shown in Figure 17.

For the Time synchronization mode, select Synchronize time with the NTP servers from the dropdown. For the NTP Servers, enter north-america.pool.ntp.org (or the NTP pool servers for your geographic area). Click Next, as shown in Figure 18.

Select Create a new SSO domain and enter vsphere.local for the Single Sign-On domain name. Enter and verify the Single Sign-On password and click Next, as shown in Figure 19.

Decide whether to Join the VMware’s Customer Experience Improvement Program (CEIP) and click Next, as shown in Figure 20.

Verify that the information is correct. If it is not, click Back, correct the information and then continue.

If the information is correct, click Finish, as shown in Figure 21.

Click OK to complete the setup of the VCSA, as shown in Figure 22.

Stage 2 begins, as shown in Figure 23.

Note: Clear your browser’s cookies and cache if you get an error message about finding the appliance.

When Stage 2 completes, click Close, as shown in Figure 24.

Note: Stage 2 took 20 minutes to complete in my lab.

Make a note of the Appliance Getting Started Page link.

Back on the ESXi host, click Virtual Machines, and you can see the just installed VCSA VM, as shown in Figure 25.

Using your browser, go to the link for the vCenter Getting Started Page. For me, that is https://vcenter.labaddomain.com, as shown in Figure 26. Click LAUNCH VSPHERE CLIENT (HTML5).

Note: Because of the VCSA’s self-signed certificate, you can safely proceed to vCenter.

Enter the Single Sign-On Domain credentials created earlier in Figure 19 and click LOGIN, as shown in Figure 27.

Click MANAGE YOUR LICENSES, as shown in Figure 28.

Click Add, as shown in Figure 29.

Enter the licenses. I used the licenses from the VMUG Advantage program. After entering the license information, click Next, as shown in Figure 30.

If you want to, enter a License name for the licenses and click Next, as shown in Figure 31.

Click Finish, as shown in Figure 32.

The licenses are displayed, as shown in Figure 33.

Click the Assets tab, select the vCenter asset, and click Assign License, as shown in Figure 34.

Select the vCenter license and click OK, as shown in Figure 35.

As shown in Figure 36, the VCSA is now licensed.

If you look at the browser connection shown in Figure 26, you see that it is not secure.

Go back to the main vCenter page shown in Figure 26, right-click Download trusted root CA certificates, and click your browser’s Save link, as shown in Figure 37.

Save the file, Download.zip, as shown in Figure 38.

Extract Download.zip, as shown in Figure 39, and browse to the certs\win folder.

Double-click the file with the extension “crt”.

Click Open if you receive a file security warning, as shown in Figure 40.

Click Install Certificate…, as shown in Figure 41.

Click Local machine and Next, as shown in Figure 42.

Select Place all certificates in the following store and click Browse…, as shown in Figure 43.

Click on Trusted Root Certification Authorities and click OK, as shown in Figure 44.

Click Next, as shown in Figure 45.

Click Finish, as shown in Figure 46.

Click OK, as shown in Figure 47.

Click OK, as shown in Figure 48.

Using your browser, go to the link for the vCenter Getting Started Page. For me, that is https://vcenter.labaddomain.com, as shown in Figure 49. Notice how the URL now shows as secure.

Click the padlock symbol, as shown in Figure 50.

Install the “crt” certificate file on any computer that requires access to vCenter.

Up next: Create vSphere Networking and Network Storage.

Landing page for the article series

Now that the host has a static IP address, you can begin more of the host’s configuration. You do the minimal configuration for now. Just enough to allow the installation of the vCenter Server Appliance in the following article.

To continue, start an Internet browser and browse to your host’s IP address. For me, that is either https://192.168.1.53 or https://esxihost1.labaddomain.com (from my local hosts file).

Most browsers should display an SSL certificate warning, as shown in Figure 1.

The warning is because, for now, the host is using a VMware self-signed SSL certificate. It is safe to ignore any warnings and proceed to connect to the host. For a Chromium-based browser, click Advanced and then click Proceed to <ip address> (unsafe) or Proceed to <fqdn> (unsafe), as shown in Figure 2.

Log in using the root credentials you created during the initial ESXi installation and click Log in, as shown in Figure 3.

Decide whether to Join the VMware Customer Experience Improvement Program and click OK, as shown in Figure 4.

Because I am taking screenshots and typing this article, I did turn off the timeout interval for the web console. Click the drop-down next to root@192.168.1.53 (or root@fqdn) and then hover the mouse pointer over Settings -> Application timeout and then click Off as shown in Figure 5.

Click Yes on the Warning popup as shown in Figure 6.

The browser or the browser tab needs closing for the change to apply. Relaunch the browser or open another tab and log back into the host.

The first thing needed is to license our host. Click Manage, as shown in Figure 7.

Note: If you do not have a license key, you can use ESXi 7.0 in evaluation mode for 60 days.

In the top-right frame, click the Licensing tab and click Assign license, as shown in Figure 8.

Enter your License key and click Check license as shown in Figure 9.

If your License key is valid, click Assign license as shown in Figure 10.

If the License key is not valid, as shown in Figure 11, try another License key.

You now see all the licensed features, as shown in Figure 12.

Now on to configuring Storage.

My TinkerTry server has two local SSDs I use for datastores.

In the browser’s left frame, click Storage, as shown in Figure 13.

Click New datastore in the right browser frame on the Datastores tab, as shown in Figure 14.

Click Create new VMFS datastore and click Next, as shown in Figure 15.

This local datastore is for Host Cache. I am selecting my 250GB SSD and entering the Name of ESXiHost1 Host Cache. Click Next, as shown in Figure 16.

For the datastore File System, I am using VMFS 6.

Select VMFS 6 from the drop-down list and click Next, as shown in Figure 17.

Verify the information is correct and click Finish, as shown in Figure 18. If the information is not correct, click Back, correct the information, and then continue.

Click Yes to confirm the erasing of the drive, as shown in Figure 19.

Now for the local datastore for VMs.

Click New datastore, as was shown in Figure 14.

Click Create new VMFS datastore and click Next, as was shown in Figure 15.

This local datastore is for VMs. I am selecting my 500GB SSD and entering the Name of ESXiHost1 Local VM datastore. Click Next, as shown in Figure 20.

Select VMFS 6 from the drop-down list and click Next, as shown in Figure 21.

Verify the information is correct and click Finish, as shown in Figure 22. If the information is not correct, click Back, correct the information, and then continue.

Click Yes to confirm the erasing of the drive, as was shown in Figure 19.

At this point, previous versions of ESXi would show three datastores: the two we created and the one created by the installation of ESXi. As seen in Figure 23, with ESXi 7.0, the Datastores tab only shows the two datastores we created.

Not seeing the local datastore in ESXi 7 is a known issue. Local Datastore not visible in ESXi 7

Since we added a datastore for Host Cache, the Host configuration needs that datastore added.

In the browser’s left frame, under Host, click Manage, as shown in Figure 24.

In the right frame, click the System tab, click Swap, and click Edit settings, as shown in Figure 25.

For the Datastore, Select the host cache datastore created earlier and click Save, as shown in Figure 26.

Figure 27 shows the updated configuration.

While on the System tab, you can set the NTP server.

Click on Time & date and then click Edit NTP Settings, as shown in Figure 28.

Note: A new option is available in ESXi 7, using the Precision Time Protocol or PTP.  This article from VMware explains VMware’s support of PTP. Let’s Be Precise: Enabling and Configuring Precision Time Protocol in vSphere. For a simple lab, there is no need for sub-microsecond time precision.

Select Use Network Time Protocol (enable NTP client), for NTP service startup policy, select Start and stop with host, and for the NTP servers, enter north-america.pool.ntp.org (or the NTP pool servers for your geographic area) and click Save as shown in Figure 29.

In previous versions of ESXi, you could start the NTP service from the Actions menu item. That did not work on any of my ESXi 7.0 hosts. The only way I could start the NTP service was to restart the host.

In the browser’s left frame, click Host, as shown in Figure 30.

Click Actions, and click Enter maintenance mode, as shown in Figure 31.

Note: VMware recommends placing an ESXi host in maintenance mode before shutting down or restarting a host. Please see this VMware documentation page. Reboot or Shut Down an ESXi Host in the VMware Host Client

Always perform the following tasks before you reboot or shut down a host:

• Power off all virtual machines on the host.
• Place the host in maintenance mode.

Click Yes in the Confirm maintenance mode change popup, as shown in Figure 32.

Click Reboot, as shown in Figure 33.

Click Reboot in the Reboot host popup, as shown in Figure 34.

After the host completes the restart, log in to the host and, in the browser’s left frame, click Host, as shown in Figure 30. Click Actions, and click Exit maintenance mode, as shown in Figure 35.

Up next: Install the VMware vCenter Server Appliance

Landing page for the article series

Now that the ESXi 7.0 host installation is complete, it is time for the initial host configuration. In this article, you complete the following steps:

• Give the Host a Static IPv4 address
• Configure DNS
• Give the Host a unique hostname
• Enable SSH
• Enable VMware vSphere Storage APIs Array Integration (VAAI) support for NFS on the Synology NAS

When we completed the ESXi 7.0 installation and the host rebooted, the host was at the screen shown in Figure 1.

Using the Host’s IPMI, press F2, as shown in Figure 2.

Enter the Password for root and press Enter, as shown in Figure 3.

Use the down arrow key, select Configure Management Network, and press Enter, as shown in Figure 4.

Use the down arrow key, select IPv4 Configuration, and press Enter, as shown in Figure 5.

Use the down arrow key, highlight Set static IPv4 address and net configuration and press the spacebar as shown in Figure 6.

Press the down arrow, enter the appropriate IPv4 information, and press Enter, as shown in Figure 7.

Press the down arrow, highlight DNS Configuration, and press Enter, as shown in Figure 8.

Enter your Primary and Alternate DNS Servers, type in a Hostname, and press Enter, as shown in Figure 9. Currently, there is no Active Directory domain, domain controller of DNS. I am using my router’s DNS.

Note: The ESXi installer gives each host the hostname of “localhost”. In Microsoft Windows, localhost has a specific use. Each ESXi host requires a unique Hostname (as does each Microsoft Windows computer account in Active Directory).

Press Esc, then press Y to apply the changes and restart the management network, as shown in Figure 10.

Note: Abdullah Abdullah recommends running Test Management Network before continuing. ESXi then performs the following tests:

• Pings the subnet gateway specified
• Pings the primary DNS server specified
• Pings the alternate DNS server specified
• Resolves the hostname of the ESXi host

Use the down arrow key, select Troubleshooting Options, and press Enter, as shown in Figure 11.

To install the VAAI Plug-in for Synology NFS support, SSH is required to use PuTTY (or your preferred SSH client) to install the necessary drivers and plug-ins.

Note: ESXi 7.0 does not include the VAAI Plug-in for the Synology NAS.

Use the down arrow key, highlight Enable SSH, and press Enter, as shown in Figures 12 and 13.

Press ESC twice to return to the main ESXi host screen, as shown back in Figure 1.

Now, you need to install the VAAI Plug-in for NFS. Go to https://global.download.synology.com/download/Tools/NFSVAAIPlugin/1.2-1008/VMware_ESXi/synology-nfs-vaai-plugin-1.2-1008.vib and download the VIB NFS Plug-in for VMware VAAI for your Synology NAS model.

Note: If the download link has changed, go to https://www.synology.com and search for “nfs vaai plugin”. A user account on synology.com is not required to download the VIB file.

Note: VIB stands for vSphere Installation Bundle. At a conceptual level, a VIB is somewhat similar to a ZIP archive in that it is a collection of files packaged into a single archive to facilitate distribution.

Using your favorite secure upload utility, I used WinSCP, upload the VAAI plug-in to the /tmp directory on the ESXi host.

First, connect to the ESXi host, as shown in Figure 14.

If this is the first time connecting to the host, a key exchange is required. If you want to add the server’s host key to the secure upload utility’s cache, click Yes, as shown in Figure 15.

You can connect without adding the server’s host key to the secure upload utility’s cache. Click No if you do not wish to save the server’s host key in the cache.

In WinSCP, there are three ways to upload the VIB file to the ESXi host.

1. Drag and Drop the VIB file from the left pane to the right pane, as shown in Figure 18.
2. Select the VIB file in the left pane, press F5, and click OK, as shown in Figure 16.
3. Select the VIB file in the left pane, right-click, select Upload, as shown in Figure 17, and click OK, as shown in Figure 16.

Using your preferred upload method, copy the VIB file to the /tmp directory on the ESXi host, as shown in Figure 18.

Exit your favorite secure upload utility.

Using your favorite SSH client, connect to the ESXi host, as shown in Figure 19. I used PuTTY.

Note: I only tested PuTTY. I did not try using the SSH client from Windows 10.

If this is the first time connecting to the host, a key exchange is required. If you want to add the host’s key to the SSH client’s cache, click Yes, as shown in Figure 20.

You can connect without adding the host’s key to the SSH client’s cache. Click No if you do not wish to save the host’s key in the cache.

Log in to the host using your configured credentials. If you just installed ESXi, log in as root and the password used during the ESXi install, as shown in Figure 21.

Run the following command, as shown in Figure 22.

esxcli software vib install -v /tmp/synology-nfs-vaai-plugin-1.2-1008.vib –no-sig-check

Reboot the ESXi host by typing reboot and pressing Enter, as shown in Figure 23.

Once the host is up, use your SSH client to verify the VAAI plug-in installation. Run the following command, as shown in Figure 24.

esxcli software vib list | grep nfs

Now that the host has its initial configuration complete, the rest uses the HTML5 client.

Up next: VMware ESXi Host Configuration.

Landing page for the article series