Azure Stack Hub Operator Access Workstation

• 02/17/2021
• 7 minutes to read
• • a
  • J
  • m
  • P
  • S
  • +3

The Operator Access Workstation (OAW) is used to deploy a jump box virtual machine (VM) on a Hardware Lifecycle Host (HLH) that runs version 2005 or later so an Azure Stack Hub operator can access the privileged endpoint (PEP) and the Administrator portal for support scenarios.

The OAW VM should be created when an operator performs a new task. After a required task inside the VM is completed, the VM should be shut down and removed as Azure Stack Hub doesn't need to always run it.

OAW scenarios

The following tables lists common scenarios for the OAW, but this is not exclusive. It is recommended to use Remote Desktop to connect to the OAW.

Download files

To get the files to create the OAW VM, download here. Please be sure to review the Microsoft Privacy Statement and Legal Terms prior to download.

Due to the stateless nature of the solution, there are no updates for the OAW VM. For each milestone, a new version of the VM image file will be released. Use the latest version to create a new OAW VM. The image file is based on the latest Windows Server 2019 version. After installation, you can apply updates, including any critical updates, using Windows Update.

Validate the hash of the downloaded OAW.zip file to make sure it has not been modified before using it to create the OAW VM. Run the following PowerShell script. If the return value is True, you can use the downloaded OAW.zip:

param(
    [Parameter(Mandatory=$True)]
    [ValidateNotNullOrEmpty()]
    [ValidateScript({Test-Path $_ -PathType Leaf})]
    [string]
    $DownloadedOAWZipFilePath
)

$expectedHash = '6E412551C7921A6FA4E9D64812A4D3770EB1B1257E2BE55B8426E5EFBCB2C001'
$actualHash = (Get-FileHash -Path $DownloadedOAWZipFilePath).Hash

Write-Host "Expected hash: $expectedHash"

if ($expectedHash -eq $actualHash)
{
    Write-Host 'SUCCESS: OAW.zip file hash matches.'
}
else
{
    Write-Error 'ERROR: OAW.zip file hash does not match! It is not safe to use it, please download it again.'
    Write-Error "Actual hash: $actualHash"
}

User account policy

The following user account policy is applied to the OAW VM:

• Built-in Administrator username: AdminUser
• MinimumPasswordLength = 14
• PasswordComplexity is enabled
• MinimumPasswordAge = 1 (day)
• MaximumPasswordAge = 42 (days)
• NewGuestName = GUser (disabled by default)

Pre-installed software

The following table lists the pre-installed software on the OAW VM.

Check HLH version

1. Log onto the HLH with your credentials.

2. Open PowerShell ISE and run the following script:

   'C:\Version\Get-Version.ps1'
   

   For example:

   

Create the OAW VM using a script

The following script prepares the virtual machine as the Operator Access Workstation (OAW), which is used to access Microsoft Azure Stack Hub for administration and diagnostics.

1. Log onto the HLH with your credentials.
2. Download OAW.zip and extract the files.
3. Open an elevated PowerShell session.
4. Navigate to the extracted contents of the OAW.zip file.
5. Run the New-OAW.ps1 script.

For example, to create the OAW VM on the HLH without any customization using Azure Stack Hub version 2005 or later, run the New-OAW.ps1 script with only the -LocalAdministratorPassword parameter:

$securePassword = Read-Host -Prompt "Enter password for Azure Stack OAW's local administrator" -AsSecureString
New-OAW.ps1 -LocalAdministratorPassword $securePassword  

To create the OAW VM on a host with network connection to Azure Stack Hub:

$securePassword = Read-Host -Prompt "Enter password for Azure Stack OAW's local administrator" -AsSecureString
New-OAW.ps1 -LocalAdministratorPassword $securePassword `
   -IPAddress '192.168.0.20' `
   -SubnetMask '255.255.255.0' `
   -DefaultGateway '192.168.0.1' `
   -DNS '192.168.0.10'

To retrieve the IP address of the ERCS VM from the AzureStackStampInformation.json file:

$securePassword = Read-Host -Prompt "Enter password for Azure Stack OAW's local administrator" -AsSecureString
New-OAW.ps1 -LocalAdministratorPassword $securePassword `
   -AzureStackCertificatePath 'F:\certroot.cer' `
   -DeploymentDataFilePath 'F:\DeploymentData.json' `
   -AzSStampInfoFilePath 'F:\AzureStackStampInformation.json'

To create the OAW VM on the HLH with DeploymentData.json:

$securePassword = Read-Host -Prompt "Enter password for Azure Stack OAW's local administrator" -AsSecureString
New-OAW.ps1 -LocalAdministratorPassword $securePassword `
   -DeploymentDataFilePath 'D:\AzureStack\DeploymentData.json'

If the DeploymentData.json file includes the Naming Prefix for OAW VM, that value will be used for the VirtualMachineName parameter. Otherwise, the default name is AzSOAW or whatever name specified is by the user.

Two parameter sets are available for New-OAW. Optional parameters are shown in brackets.

New-OAW 
-LocalAdministratorPassword <Security.SecureString> `
[-AzureStackCertificatePath <String>] `
[-AzSStampInfoFilePath <String>] `
[-CertificatePassword <Security.SecureString>] `
[-ERCSVMIP <String[]>] `
[-DNS <String[]>] `
[-DeploymentDataFilePath <String>] `
[-SkipNetworkConfiguration] `
[-ImageFilePath <String>] `
[-VirtualMachineName <String>] `
[-VirtualMachineMemory <int64>] `
[-VirtualProcessorCount <int>] `
[-VirtualMachineDiffDiskPath <String>] `
[-PhysicalAdapterMACAddress <String>] `
[-VirtualSwitchName <String>] `
[-ReCreate] `
[-AsJob] `
[-Passthru] `
[-WhatIf] `
[-Confirm] `
[<CommonParameters>]

New-OAW
-LocalAdministratorPassword <Security.SecureString> `
-IPAddress <String> `
-SubnetMask <String> `
-DefaultGateway <String> `
-DNS <String[]> `
[-AzureStackCertificatePath <String>] `
[-AzSStampInfoFilePath <String>] `
[-CertificatePassword <Security.SecureString>] `
[-ERCSVMIP <String[]>] `
[-ImageFilePath <String>] `
[-VirtualMachineName <String>] `
[-VirtualMachineMemory <int64>] `
[-VirtualProcessorCount <int>] `
[-VirtualMachineDiffDiskPath <String>] `
[-PhysicalAdapterMACAddress <String>] `
[-VirtualSwitchName <String>] `
[-ReCreate] `
[-AsJob] `
[-Passthru] `
[-WhatIf] `
[-Confirm] `
[<CommonParameters>]

The following table lists the definition for each parameter.

Check the OAW VM version

1. Log onto the OAW VM with your credentials.

2. Open PowerShell ISE and run the following script:

   'C:\Version\Get-Version.ps1'
   

   For example:

   

Transfer files between the HLH and OAW

If you need to transfer files between the HLH and the OAW, create an SMB share by using the New-SmbShare cmdlet. New-SmbShare exposes a file system folder to remote clients as a Server Message Block (SMB) share. For example:

To delete a share that was created by this cmdlet, use the Remove-SmbShare cmdlet. For example:

Remove the OAW VM

The following script removes the OAW VM, which is used to access Azure Stack Hub for administration and diagnostics. This script also removes the disk files and the guardian associated with the VM.

1. Log onto the HLH with your credentials.

2. Open an elevated PowerShell session.

3. Navigate to the extracted contents of the installed OAW.zip file.

4. Remove the VM by running the Remove-OAW.ps1 script:

   Remove-OAW.ps1 -VirtualMachineName <name>
   

   Where <name> is the name of the virtual machine to be removed. By default, the name is AzSOAW.

   For example:

   Remove-OAW.ps1 -VirtualMachineName AzSOAW
   

Next steps

Azure Stack Management Tasks