Month: May 2019

Sometimes we need to import rules to NSG from an Excell file. I had to do it to allow communication with Salesforce – so I had to implement IP whitelist according to this: https://help.salesforce.com/articleView?id=000003652&type=1. So the script to do it is here: $importFile = ‘Salesforce-nsg.csv’$nsgname = ‘acobybylonsg-nsg’$nsgrg = ‘acobybylonsg’$subscription=’a3eaae72-4091-4bb6-8e79-ad91f956ac87′$rulesArray = @()##############Login-AzureRmAccountSelect-AzureRmSubscription -SubscriptionId $subscription##############$nsg = Get-AzureRmNetworkSecurityGroup -Name $nsgname -ResourceGroupName $nsgrgforeach ($rule in import-csv $importFile){$nsg|Add-AzureRmNetworkSecurityRuleConfig `-Name $rule.Name `-Description $rule.Description `-Protocol $rule.Protocol `-SourcePortRange ($rule.SourcePortRange -split ‘,’) `-DestinationPortRange ($rule.DestinationPortRange -split ‘,’) `-SourceAddressPrefix ($rule.SourceAddressPrefix -split ‘,’) `-DestinationAddressPrefix ($rule.DestinationAddressPrefix -split ‘,’) `-Access $rule.Access `-Priority $rule.Priority `-Direction $rule.Direction}$nsg|Set-AzureRmNetworkSecurityGroup CSV file is here. Before doing it could be helpful to export NSG using this script: $exportPath = ‘C:temp’$nsgname = ‘acobybylonsg-nsg’$nsgrg = ‘acobybylonsg’$subscription=’a3eaae72-4091-4bb6-8e79-ad91f956ac87′##############Login-AzureRmAccountSelect-AzureRmSubscription -SubscriptionId $subscription##############$nsgs = Get-AzureRmNetworkSecurityGroup -Name $nsgname -ResourceGroupName $nsgrg#backup nsgs to csvForeach ($nsg in $nsgs) {New-Item -ItemType file -Path “$exportPath$($nsg.Name).csv” -Force$nsgRules = $nsg.SecurityRulesforeach ($nsgRule in $nsgRules) {$nsgRule | Select-Object Name,Description,Priority,@{Name=’SourceAddressPrefix’;Expression={[string]::join(“,”, ($_.SourceAddressPrefix))}},@{Name=’SourcePortRange’;Expression={[string]::join(“,”, ($_.SourcePortRange))}},@{Name=’DestinationAddressPrefix’;Expression={[string]::join(“,”, ($_.DestinationAddressPrefix))}},@{Name=’DestinationPortRange’;Expression={[string]::join(“,”, ($_.DestinationPortRange))}},Protocol,Access,Direction `| Export-Csv “$exportPath$($nsg.Name).csv” -NoTypeInformation -Encoding ASCII -Append}}

Old version Azure Disk Encryption with Azure AD app uses Extension AzureDiskEncryption version 1.*. New Azure Disk Encryption uses Extension AzureDiskEncryption version 2.*. Switching from AAD application Encryption for this encrypted VM isn’t supported yet. Here is unofficial, not-supported way: On VM using PowerShell as an Admin – disable Encryption, first: manage-bde -status #write recovery password Suspend-BitLocker -MountPoint “C:” -RebootCount 0 manage-bde -off c: manage-bde -status Using regedit delete the following: HKEY_LOCAL_MACHINESoftwareMicrosoftWindows AzureBitlockerExtension HKEY_LOCAL_MACHINESoftwareMicrosoftWindows AzureHandlerStateMicrosoft.Azure.Security.AzureDiskEncryption_1.1.0.4 Delete directory: C:PackagesPluginsMicrosoft.Azure.Security.AzureDiskEncryption After that you must shut down VM, not reboot (!) just because Azure Agent install Extension just again. After switching off you have to follow this: https://rzetelnekursyold.dev/azure-disk-encryption-troubleshooting/

Sometimes we need to know what application is doing in our operating system. Some scenario when we need it: We run installer to install application and track what installer trying to launch. I used it to find all components during containerization third party application. I would like to know what exactly is doing during enabling Azure Disk Encryption. How to do it? Download – https://download.sysinternals.com/files/Sysmon.zip Unzip it Install using: sysmon.exe -accepteula –i –h md5,sha256 –n Sysmon register all network connection and processes that launch in Applications and Services Logs/Microsoft/Widows/Sysmon Alternatively we can do it without installing any application – just run gpedit.msc and configure Audit Process Creation: But it is not all add Include command line in process creation events After that issue gpupdate /force Process Creation Events will go to the Security log. Clear in Event Viewer Security log and Sysmon log – you can also delete all logs issuing: wevtutil el | Foreach-Object {wevtutil cl “$_”} Install application that you can minotor Export Security and Sysmon log to csv Using Notepad++ search for “Process Command Line”. It returns all commands that was issued by the installator. You can also view 5 last events in every log issuing: Get-WinEvent … Audit what Operating System is trying to runRead more

Azure Disk Encryption technology basis on Windows BitLocker technology– of course only for Windows VMs. Key for BitLocker is stored in Key Vault. Encryption Agent is responsible for transfer key from Key Vault to VM. We have two version old one that use Azure Active Directory (https://docs.microsoft.com/pl-pl/azure/security/azure-security-disk-encryption-prerequisites-aad) and new one without this (https://docs.microsoft.com/pl-pl/azure/security/azure-security-disk-encryption-windows). AAD version – AzureDiskEncryption version 1.*, without AAD extension 2.* When to use this manual: When we use Azure Disc Encryption, before we move VM form one subscription to another we need to suspend BitLocker. Even if we do it and we would like to enable encryption again we need to do it use this procedure When we enable Azure Disk Encryption (old AAD version) and we receive something like this: Provisioning state Provisioning failed. The Key Vault https:… is located in location EastUS2, which is different from the location of the VM, eastus.. KeyVaultAndVMInDifferentRegions During updating Azure Disk Encryption AAD version to Key Vault only (AzureDiskEncryption 1.* to 2.*) – unsupported In some scenario after restoring from backup. To disable Azure Encryption Disk functionality. AzureDiskEncryption Extension – Provisioning failed If we see this error: What we need to do after checking logs C:WindowsAzureLogsPluginsMicrosoft.Azure.Security.AzureDiskEncryption with no-idea what to … Azure Disk Encryption – TroubleshootingRead more