Hello, Cloud Gurus,
and welcome back.
In this lesson, we're going to take a look
at Automating Microsoft Update Management.
Let's take a look at what we're going to cover.
First up, we'll take a look at your options
for managing updates on Windows servers
using Azure technologies.
Then we'll take a look at how Update Management
in Azure Automation works.
And finally, we'll wrap up with a demo
where we will configure Update Management.
Now no one likes spending their days
manually patching servers.
So I'm very much looking forward
to stepping through this with you.
Let's jump in.
One of the key responsibilities
of an Azure Hybrid administrator
is the responsibility of managing updates on their servers
and their virtual machines.
Now you can use traditional methods,
but they struggle to work well in hybrid environments.
I mean, they can work,
but there is just a couple of Azure services
that can assist with Microsoft updates on Windows server
and they might make your job a little bit easier.
Let's take a look at them.
The first to be aware of is automatic VM guest patching,
which currently only works on Azure VMs,
but it can be used alongside
your existing on-premises solution.
You can enable this feature on any virtual machine
running a supported operating system
that is created from an Azure image.
And once enabled,
patches classified as critical or security
are automatically downloaded
and applied to your VMs once per month.
And patches are applied during off peak hours
in the VMs time zone.
Now Microsoft preserves the availability
of your virtual machines
by checking the health of the VMs post-deployment.
They also don't patch VMs
in different availability zones at the same time,
and they also don't patch VMs in paired regions
at the same time.
And this process is referred
to as Azure orchestrated guest OS updates.
Now, if you need a little bit more control
over your patching,
you can use Azure Automation's Update Management capability.
Update Management enables far greater control
over which updates are deployed
and when they are deployed.
You can deploy all types of update classifications
including feature packs and update rollups,
and you can include or exclude specific updates.
And patches are deployed based on schedules
that you configure,
and you can use pre and post-update scripts
to perform pre and post-update tasks
like sending notifications
or checking the availability of a service.
You also have greater control over reboots,
being able to prevent Update Management
from rebuilding a server if required.
Now, I want you to be aware of both of these options
even though I think most organizations,
especially larger ones, will land
on Azure Automation Update Management.
And that's why it's a focus of the AZ-800 exam.
Let's take a closer look
at how Azure Update Management works.
Firstly, you're going to need to have
an Azure Automation account,
and then you need to link your automation account
to a Log Analytics workspace in the same region.
Now, before you deploy your Log Analytics workspace
and your automation account,
check to make sure that your region supports linking
because not all Azure regions do.
And then you need to deploy the Update Management solution,
and as we saw in the previous lessons,
you can link the Log Analytics workspace
and enable the Update Management solution
in one step from the Azure portal.
And then you need to configure your update target servers.
These can be Azure virtual machines,
on-premises servers,
or servers in other clouds.
The modern way to do this
is to deploy the Log Analytics agent
to your servers using an extension.
And the recommended way to do this
for your servers outside of Azure
is to onboard them into Azure Arc.
Then you can go ahead
and deploy the Log Analytics agent to your servers,
and once deployed,
you enable the Update Management solution
in the Log Analytics agent.
Now this might seem confusing.
The Update Management solution exists both
in the Log Analytics workspace
and on the VM,
and they are enabled individually.
This is so you can have VMs reporting
to a Log Analytics workspace
that aren't using Update Management if required.
You also might want to configure
the Update Management settings on your servers
using something like group policy,
and the reason you might want to do this is to prevent
reboots outside of the Update Management reboots
or you might want to pre-download updates
or use a Windows Server Update Services server.
Update Management honors
almost all of the settings configured
in the Windows Update client.
Now you can go ahead
and configure the update deployment
in your automation account.
You can create a schedule,
choose the update classifications,
and configure pre and post-update scripts if required.
Once configured,
your servers will deploy their updates
on the configured schedule
and report the compliance back
to the Log Analytics workspace,
which is visible both in the Log Analytics workspace
and in the automation account.
Now let's take a look at a demo of Azure Update Management.
In this demo, we will configure Update Management
for our servers hosted in Azure
and hosted on-premises.
On-premises, we have 2 domain controllers:
CORP-BNE-DC01 and CORP-BNE-DC02.
And in Azure, we have another 2 domain controllers:
CORP-AUE-DC01 and CORP-AUE-DC02
and we want to configure a basic A/B weekly patching cycle
for these servers.
We want to patch our second servers.
So DC02 on-prem
and DC02 in Azure on a Wednesday evening.
And then we want to patch our 01 servers,
on-prem and in Azure,
on Friday evening.
Patching in groups like this can reduce your downtime
by ensuring you don't encounter any issues
before you go ahead
and deploy the updates to all your remaining servers.
And it also reduces the workload you'll have
if you do encounter any issues with updates.
And also if you target your 02 servers
in the first patch round,
assuming you follow a strict naming convention,
it ensures that you're patching a second server
in a pair of identically configured servers.
In the previous lessons,
we've linked the Log Analytics workspace
to our automation account,
and we enabled the Update Management solution
on our Log Analytics workspace.
And I've also onboarded the on-premises VMs into Azure Arc
and deployed the Log Analytics agent to those servers.
In this demo, we will create two computer groups:
Patch Group A and Patch Group B.
We'll also enable Update Management on all 4 servers
and then we will create deployment schedules
for the servers.
Now, I know this looks like a lot,
but we're building on work that we've previously completed,
and in a well configured corporate environment,
many of these prerequisites will be completed for you too,
ideally at deployment time for these servers.
Let's take a look at the demo.
All right, so here we are on the Azure portal,
and I've gone ahead and navigated through to Azure Arc,
and you can see we've got our
2 on-premises domain controllers connected to Azure Arc.
Now, let's go ahead
and have a look at the automation account.
So we'll just navigate to the automation account.
I'll just go ahead and collapse this left pane.
And now I'm going to navigate down to related resources,
and then I'm going to navigate to linked workspace.
And then I'll navigate
to the Log Analytics workspace that we've linked previously.
And now I'm going to navigate down to settings
and then we'll go to computer groups
and we can see here
that we can create custom computer groups
from a variety of sources
including Active Directory,
and Windows Server Update Service,
and System Center Configuration Manager.
We're going to go ahead
and create them in our Log Analytics workspace.
So we'll go ahead and click Go to Logs.
I'll just close this default queries window that pops up.
Now, all of our servers that are connected
to this Log Analytics workspace are sending a heartbeat
to the Log Analytics workspace.
So we'll go ahead and select LogManagement
and we can see here, we have a Heartbeat table.
Let's use the Heartbeat table
to create a group of computers that we're going to patch.
So we'll go ahead and use that table.
I'm going to go ahead and paste a query in here
that will generate a list of all the servers
that end with the name 02.
So what I'm doing is I'm querying the Heartbeat table.
I'm getting a list of unique computers
and then I'm splitting the computer name
based on the dot
because we're actually getting
a fully qualified domain name.
So it would have computer name dot domain name.
and I'm just getting the start of that computer name.
So everything before the dot.
And then I'm saying if the host name ends with 02,
then give me that computer.
So I'll go ahead and run that to test it.
So we can see here,
we're getting our 2 domain controllers:
DC02 on-prem and DC02 in Azure.
Now let's go ahead and save this query
to create a computer group.
We'll go ahead and click Save,
and we'll go Save as Function.
I'm going to call this PatchGroup_A.
This is not relevant to us
so I'm just going to put in a value there of Patch Groups.
Then I'm going to select the option
to save as a computer group.
Now we can go ahead and click Save.
Now let's go ahead and create Patch Group B
by querying all of the servers that end with 01.
We'll go ahead and run that query to test it
and we can see,
we're getting our DC01 on-prem
and our DC01 in Azure.
Let's go ahead and save this as a computer group.
So I'll select Save,
and we'll name this PatchGroup_B.
We'll just use a legacy category of Patch Groups again,
and we'll select the all important option
to save as a computer group
and then we'll go ahead and click Save.
All right, we've now got our 2 computer groups configured.
Now let's navigate back to the automation account
and we'll configure Update Management.
So we'll navigate back to our automation account
and then we'll navigate to Update Management
and then we'll select Manage Machines
and we're going to enable it
on all of our available machines.
So we can see here,
we've got our 4 domain controllers.
So I'm going to go ahead and select Enable.
And this will deploy the Update Management solution
to those virtual machines.
This will just take a moment to complete.
So we'll come back when this is done.
All right, the update agent has now been deployed
to each of our 4 servers.
Now let's go ahead and schedule update deployment
and we'll just provide a name for our update deployment.
I'm going to call it Patch Group A.
We're deploying our updates to Windows
and we're going to go ahead
and select the group that we configured earlier
and we'll select Non-Azure.
And then we'll select PatchGroup_A.
Go ahead and click OK.
Now we can go ahead and configure
our update classifications.
I'm going to go ahead and just deploy critical
and security updates.
So I'll deselect all
and select Critical and Security Updates
and we can include or exclude specific updates
if we need to.
For example, if you had a bad update
and you needed to exclude it,
you can do that here.
Now we need to configure our schedule.
So we'll go ahead and schedule this
to happen every Wednesday evening.
So it can start now
and we'll make a recurring schedule
and we'll do it once a week
on a Wednesday
and we'll start at 10:00 pm.
No expirations.
We'll go ahead and click OK.
And we'll go ahead and change our maintenance window
to 4 hours.
So I'll change this to 240 minutes
and then I'm going to set these servers to always reboot
and this is completely up to you.
You can only reboot if required or never reboot,
but as a personal preference,
I'm going to always reboot these servers.
We'll go ahead and hit Create.
Now let's go ahead and repeat that process
for Patch Group B.
So we'll schedule update deployment,
provide our name,
select our groups,
provide our update classifications again,
provide our schedule,
and Patch Group B,
we're going to update on a Friday evening at 10:00 pm.
We can go ahead and click OK.
And then we can set these to always reboot as well.
And we'll change our maintenance window to 4 hours.
Then we can go ahead and click Create.
Now we can go ahead
and have a look at our deployment schedules
and we can see we have our Patch Group A configured
and our Patch Group B configured.
That concludes this demo.
Now let's go and wrap up with a bit of a summary
of what we've covered in this lesson.
All right. So what have we covered?
Automatic VM guest patching
can provide a simple update management solution.
Whereas Azure Automation Update Management
provides a greater level of control
over your patch management,
and it also supports hybrid environments.
Azure VMs will require the Log Analytics agent
and Update Management solution to be deployed.
And your on premises servers
will require the Log Analytics agent,
and they should also ideally be onboarded into Azure Arc.
And you can configure deployment schedules
to automatically deploy updates
with settings for classifications,
which computers to target,
and if a restart should be performed
when they deploy the updates.
All right, that concludes this lesson.
Thanks for being with me,
and I hope you found it useful,
and I look forward to seeing you in the next lesson.