Tag Archive: Veeam


Scrap my last post… Today I found I could no longer login to sharepoint and other federated services were acting strangely. I tried to troubleshoot but ultimately gave up.

Finally came the time to see if my weekly VM backups (and nightly incrementals) were actually any good… 15 minutes later and everything’s back to how it was 2 night’s ago!

Screen Shot 2015-04-21 at 15.48.06

Thankfully Veeam worked a treat and ADFS was back working perfectly BUT we still have our expiring SSL warning.

Screen Shot 2015-04-21 at 21.00.32

My theory as to what went wrong before… Whilst I had updated my SSL certificates on my on-premise ADFS server (including the token signing certificate), I think the Office365 hosted servers also need this same matching certificate. So, let’s try a different approach.

This time I followed a different link http://www.kraak.com/?p=190. I started the same way as before, replacing the SSL certificate in IIS. However, I didn’t update the token-signing or token-decrypting certificates in ADFS. Instead I issued the following commands;

Connect-MsolService
Get-MsolFederationProperty -DomainName tickett.net

At this stage, I can essentially see that both the ADFS Server (on-premise) and Microsoft Office 365 (hosted) certificates match;

Screen Shot 2015-04-21 at 21.16.46

At this point I noticed that, not only did they (obviously) bare the old dates, but they also bare the internal server name (and not the FQDN of either my old or new SSL certificates for IIS). This further backs up my theory that using the same certificate for IIS and ADFS yesterday was wrong. And in fact, it appears ADFS generates it’s own certificates when instructed to do so;

Update-ADFSCertificate -CertificateType: Token-Signing -Urgent:$true
Get-MsolFederationProperty -DomainName tickett.net

Screen Shot 2015-04-21 at 21.24.05

Right, we’re part way there. The ADFS Server certificate has now been renewed, but the Microsoft Office 365 certificate now needs to be updated;

Update-MsolFederatedDomain -DomainName tickett.net
Get-MsolFederationProperty -DomainName tickett.net

Bingo, now they both match! Exactly the same sequence of commands now needs to be executed for the token-decrypting certificate;

Update-ADFSCertificate -CertificateType: Token-Decrypting -Urgent:$true
Update-MsolFederatedDomain -DomainName tickett.net

And voila! I can now login perfectly to all my federated/SSO application/sites and Office365 webmail no longer warns me about a certificate approaching expiry.

Advertisements

I provisioned a new Windows Server 2012 R2 VM to be used as a Domain Controller and another to be used for VMWare Update Manager and Veeam (Backup and Replication).

Assign a static IP address, and install all windows updates (this takes considerable time and numerous reboots).

Domain Controller

Follow the “wizard”. The main thing to note (as previously mentioned)- follow best practice when choosing a domain name; I’ve always gone with something.local or something.home in the past, but suffered as a result. I did a little research and found some articles suggesting best practice is to use a subdomain of an internet facing domain you own http://www.mdmarra.com/2012/11/why-you-shouldnt-use-local-in-your.html. So, say you own microsoft.com, your internal domain name may be ad.microsoft.com. You configure the NETBIOS name to be whatever you like, this will be used when you logon using NETBIOS\User rather than user@ad.microsoft.com.

Now you can join the other Windows Server to the domain and configure the identity source in vCenter. This took me a little longer than anticipated; You must login as administrator@vsphere.local (not root).

Update Manager

  • Install update manager (follow the “wizard”)
  • Login to vCenter (using vSphere)
  • Ensure all virtual machines off of host
  • Scan
  • Attach (patch and upgrade baselines)
  • Remediate (check both baselines and check all patches)
  • Repeat for each host

Veeam

  • Install Veeam
  • Connect to vCenter
  • Setup Backup Repository
  • Configure Backups (I stick roughly to the default… Weekly full backup with daily incrementals, retaining 14 restore points). *I added the entire datacenter to the job, so as I add new VMs they will automatically be included in the backup job. I can then create a new datacenter to store development machines and/or anything I don’t want included in the nightly backups*
%d bloggers like this: