[MUSIC]
>> Hi, my name is Rathish Ravikumar.
In this video, we're going to see how do
we use the Azure Stack privileged endpoint.
As an Azure Stack operator,
to stack using the portal,
PowerShell, or Azure Resource Manager
APIs from most day-to-day management task.
However, for some less common operations,
you need what we call as privileged endpoint or PEP.
The PEP is a pre-configure remote PowerShell console
that provides you with
just enough capabilities you
are required to perform a particular task.
The endpoint uses PowerShell [inaudible] which is
a Windows Server feature to
expose only a restricted set of cmdlets.
To access the PEP,
invoke the restricted set of cmdlets,
a real privileged account is used,
no administrator accounts are created.
For additional security, scripting is not allowed.
You can use the PEP for tasks such as collecting diagnostic logs,
performing some of
the post-deployment datacenter integration tasks,
such as adding DNS Forwarders,
setting graph integration, Active Directory Federation,
integration certificate tradition, etc.
Every time the PEP is used,
there are logs generated on the actions
that are performed and they're all recorded.
At the end of a PEP session,
these logs are copied to
a network share which need to
be outside of the Azure Stack system,
and then deleted from the PEP itself.
Now, let's look at how do we access the PEP.
In an ASDK our Azure Stack Dev Kit,
there is a VM that is created as an infrastructure VM,
which is known as AzS-ERCS01.
ERCS simply stands for Emergency Recovery Console System,
which is another name for PEP.
If I were to open Hyper-V in an ASDK system,
I could see this machine,
and I could also locate its IP address,
which is then used to make
a connection to the privileged endpoint.
Now, in an integrated system,
there are multiple instances of the ERCS machine that are
created for resiliency that are spread across different nodes.
Your OEM vendor is responsible to
handout a file after
the installation which is known as Azure Stack Stamp Information.
This file will contain all the IP addresses of
the ERCS machines that was
created as part of Azure Stack installation.
An Azure Stack operator must refer to this file to be able
to get the IP address of
the privileged endpoint and to make a connection.
Now, connecting to the privileged endpoint itself can be done from
any device as long as it has access to the IP address.
It is able to connect to that particular IP address.
Now, let's see this in action.
A bit for an ASDK system,
like I said, it go to the Hyper-V,
I locate my infrastructure VM.
In this case it's called AzS-ERCS01,
go to the "Networking" tab and I get the IP address.
In this case, the IP address is 192.168.200.224.
Now, I'm locked into the host itself,
and I have a simple PowerShell command
to be able to connect to PEP.
Let me go ahead and run this.
The moment I run this,
I am prompted to be able to enter
the cloud admin password that was used.
So let me go ahead and enter the credentials here.
In a moment, if the credentials I entered are correct,
you would see the privileged endpoint prompt. There you go.
So as you can see,
the prompt has changed from my local C
drive to my privileged endpoint.
At this point, we confirm that we have made
a successful connection to the Azure Stack privileged endpoint.
Now, let's look at the release commands that are
available for an operator to be able to run.
So I do a Get command and you can see
various cmdlets that are available to me that I
would hope to use less frequently and would
require some privileged to be able to run these cmdlets.
One among them like I mentioned is
called the Get-AzureStack StampInformation cmdlet.
The Get-AzureStackStampInformation cmdlet will be
run also by your OEM at the end of the deployment phase.
Let's go ahead and run this command and
see what the output would look like.
You can also export the results of this cmdlet to adjacent
file or a text file or any other file of
your choice to be able to be used later.
Now this command's finished running,
let's see what are the different information that we
get out of this command
when it's running from the privileged endpoint.
As you can see, it gives me my stamp information,
it also gives me the update that I've applied and release
other hardware and networking information
pertaining to my particular stamp.
This file is really useful for you as an administrator.
While the other cmdlets that is most
used in case of
a support session is to be able to generate a token.
Now this token generation must be run from a privileged endpoint.
Like you could see on screen right here,
the last two cmdlets are Get-SupportSessionToken.
Let me go ahead and run this for you.
As you can see, as soon as I run the Get-SupportSessionToken,
I am presented with a token that I need to pass onto
a Microsoft support personnel who would then give me
a return token for my token generated,
which I would apply using
the Unlock-SupportSession cmdlet that you see on screen here.
This would further open my system or
Azure Stack Integrated System or ASDK for
some of the [inaudible] operations that I need to
perform at the fabric level
to be able to troubleshoot a certain issue.
I hope this session was
informative and I will talk to you in the next video.
[MUSIC]