Windows 10: Creation of AKS cluster is prevented by policy.

Hello Please i need your help on this issue. One of my customer is having an issue with creation of an AKS Azure Kubernetes Service cluster being prevented by a policy. The specific resource 'aks-agentpool-19603827-vmss' was disallowed by the policy. Resource 'aks-agentpool-19603827-vmss' was disallowed by policy. Policy identifiers: '[{\"policyAssignment\":{\"name\":\"Prevent deployment of virtual machines scale sets\",\"id\":\"/subscriptions/18e46390-beb4-40e1-97ed-7b8691a58516/providers/Microsoft.Authorization/policyAssignments/

:)

 

Perform Upgrade of Windows Cluster & SQL Cluster from 2008 R2 to 2012 R2

I am looking to perform Upgrade of Windows cluster on which SQL cluster is running 2008 R2 and i have to upgrade the OS to 2012 R2.

Please can some one suggest or share some step by step guide which i can refer.

Thanks in Advance!!

Kumar

 

Windows Clustering with Bitlocker

Hi,

We are having a problem with Windows cluster with encrypted shared storage as follows:

At the beginning, all shared storage drives mounted in the Windows cluster and the failover between 2 cluster nodes were always successful. Later on, bitlocker encryption was added to the shared storage by the following methods.

1) install BitLocker feature in Windows Server on each cluster server

2) set "AES 256" in "Choose drive encryption method and cipher strength" in group policy ("Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption") on each cluster server

3) turn on maintenance mode on the clustered disk to be encrypted in failover cluster manager

4) disable shadow copies on the clustered disk if it is enabled

5) run powershell

6) type "manage-bde -on <drive:> -recoverypassword

7) type "manage-bde <drive:> -protectors -add -sid <clusternode$>

8) turn on shadow copies of the clustered disk if necessary

9) turn off maintenance mode of the clustered disk in failover cluster manager

The above method worked perfectly fine until today. The cluster failover(for maintenance reason) was unsuccessful and all shared disk failed in the cluster node. We had to unlock the shared drive by encryption key, removed them from the cluster and decrypt
the drives before adding back to the cluster. We also could not perform the same method mentioned above for encryption in the cluster anymore. The clustered disk would go to fail state once we performed the same method above.

My question is:

How could we encrypt the shared storage in the cluster node again and prevent it from happening again?

 

Is there anyway i can prevent tethering on win 7?

I did some digging and came across this:

Use Group Policy to prevent the installation of new network devices.

You'll find an option in Administrative Templates \ System \ Device Installation \ Device Installation Restrictions \ Prevent installation of devices using drivers that match these driver setup classes. From its description:

This policy setting allows you to specify a list of device setup class globally unique identifiers (GUIDs) for device drivers that Windows is prevented from installing. This policy setting takes precedence over any other policy setting that allows Windows to install a device.

If you enable this policy setting, Windows is prevented from installing or updating device drivers whose device setup class GUIDs appear in the list you create. If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server.​
Using policy settings here, you can either create a whitelist or a blacklist, either of individual devices or entire classes of devices (such as network adapters). These take effect when a device is removed and reinserted, so it will not affect the NIC built into the machine, provided you don't apply the setting to devices that are already installed.

You will need to reference the list of device setup classes to find the class for network adapters, which is {4d36e972-e325-11ce-bfc1-08002be10318}. Add this class to the blacklist, and soon afterward, nobody will be able to use USB network adapters.​
Of course, since he has administrator rights on the machine, there's a chance that he might find your Group Policy setting and delete it. Here's another angle of attack:

• Get/set the password for the local Administrator account.

• If he tethers his phone after you've said "no", issue a remote shutdown command to his PC.
  shutdown /s /m \\boneheads_pc

• Keep doing this until it sinks into his thick head that the house rules apply to him, too.

This will set you up with a battle of wills. I prefer Kursah's solution of revoking his admin privileges.