Well hello, Cloud Gurus, and welcome back.
You've made it to the end of another section.
Congrats on making it this far.
Let's take a bit of a look at some of the key takeaways
from this section and the gotchas that are most
likely to trip people up on the exam.
At the start of this section
we took a look at PowerShell Remoting,
which enables you to execute PowerShell commands
against remote computers, using WinRM and WSman.
And there are a bunch of PowerShell cmdlets to remember
that are related to PowerShell remoting
and please do try them out
if you haven't had a chance to try them out already.
You can enable PowerShell remoting
with the Enabled-PSRemoting cmdlet
and you can enter an interactive remote PowerShell session
using the Enter-PSSession cmdlet
and you can create a persistent remote PowerShell session
with the New-PSSession cmdlet.
And you use Invoke-Command to execute commands
against remote computers
with or without a persistent session.
We also took a look at how you can provide
additional security for your remote PowerShell sessions
and implement the principle
of least privilege using Just Enough Administration.
The key components of Just Enough Administration
are the session configuration file,
which is a .PSSC file,
and a role capability file, which is a .PSRC file.
And remember that the JEA configuration is all completed
on the target server,
not from the client that you're connecting from.
And if you haven't stepped through the process
of configuring JEA, I highly recommend doing it
before you sit the exam.
Then we talk a look at the second hop.
And that's when you're connected to a server
using PowerShell remoting
and you want to access resources on an additional server.
By default, the intermediate server
does not have credentials to send to the resource server.
You can provide those credentials
by caging them with CredSSP.
Or you can use Kerberos delegation.
Of these 2 options,
Kerberos delegation is recommended and ideally,
you should use resource based Kerberos delegation.
When you're configuring CredSSP
you need to configure the client and the intermediate server
with the Enabled-WSMan CredSSP cmdlet.
And when you're configuring resource based
constrained Kerberos delegation,
you need to configure the computer object
for the resource server in active directory.
And this can be done using the Set-ADComputer commandlet
and use the principles allowed to delegate
to account parameter
to specify which AD objects,
be it users or computers,
can delegate credentials to that computer.
We also took a look at Windows Admin Center
and there were a few things to remember here
nothing too serious though.
You'll remember that Windows Admin Center
can be used to manage individual Windows Servers
by installing Windows Admin Center directly on the server.
But more importantly, you can manage multiple targets,
both in Azure and on-premises,
from a single install of Windows Admin Center.
The first important point to remember is
that you should never install Windows Admin Center
on a domain controller.
And the default port for Windows Admin Center
on Windows 10, is 6516.
And to replace the certificate on Windows Admin Center
you can rerun the installer.
It's also important to remember
that trusted hosts is used to manage work group computers
using PowerShell Remoting.
We also took a look at the wonderful Azure Arc,
which extends the management capabilities of Azure
to servers outside of Azure, like your on-premises servers.
It's important to remember
that there is a special role that grants
only the access required to onboard servers into Azure Arc.
And that is the Azure Connected Machine Onboarding role.
And you can assign this role to your team members,
but importantly,
you can also assign this role to a service principle
in Azure ID to onboard multiple servers.
And once onboarded, you can install extensions
to improve the functionality provided by Azure.
Including monitoring agents,
which allow you to use other Azure services
like Azure Monitor, Sentinel, and Defender.
All right, that wraps up this conclusion.
Congratulations on making it to the end of this section
and I look forward to seeing you in the next section.