Prepare a Windows VHD or VHDX to upload to Azure

• 12/13/2018
• 16 minutes to read
• Contributors
  • 
  • 
  • 
  • 
  • 
  • all

Before you upload a Windows virtual machines (VM) from on-premises to Microsoft Azure, you must prepare the virtual hard disk (VHD or VHDX). Azure supports only generation 1 VMs that are in the VHD file format and have a fixed sized disk. The maximum size allowed for the VHD is 1,023 GB. You can convert a generation 1 VM from the VHDX file system to VHD and from a dynamically expanding disk to fixed-sized. But you can't change a VM's generation. For more information, see Should I create a generation 1 or 2 VM in Hyper-V.

For more information about the support policy for Azure VM, see Microsoft server software support for Microsoft Azure VMs.

Convert the virtual disk to VHD and fixed size disk

If you need to convert your virtual disk to the required format for Azure, use one of the methods in this section. Back up the VM before you run the virtual disk conversion process and make sure that the Windows VHD works correctly on the local server. Resolve any errors within the VM itself before you try to convert or upload it to Azure.

After you convert the disk, create a VM that uses the converted disk. Start and sign in to the VM to finish preparing the VM for upload.

Convert disk using Hyper-V Manager

1. Open Hyper-V Manager and select your local computer on the left. In the menu above the computer list, click Action > Edit Disk.
2. On the Locate Virtual Hard Disk screen, locate and select your virtual disk.
3. On the Choose Action screen, and then select Convert and Next.
4. If you need to convert from VHDX, select VHD and then click Next.
5. If you need to convert from a dynamically expanding disk, select Fixed size and then click Next.
6. Locate and select a path to save the new VHD file to.
7. Click Finish.

Convert disk by using PowerShell

You can convert a virtual disk by using the Convert-VHD command in Windows PowerShell. Select Run as administrator when you start PowerShell.

The following example command converts from VHDX to VHD, and from a dynamically expanding disk to fixed-size:

Convert-VHD –Path c:\test\MY-VM.vhdx –DestinationPath c:\test\MY-NEW-VM.vhd -VHDType Fixed

In this command, replace the value for "-Path" with the path to the virtual hard disk that you want to convert and the value for "-DestinationPath" with the new path and name of the converted disk.

Convert from VMware VMDK disk format

If you have a Windows VM image in the VMDK file format, convert it to a VHD by using the Microsoft VM Converter. For more information, see the blog article How to Convert a VMware VMDK to Hyper-V VHD.

Set Windows configurations for Azure

On the VM that you plan to upload to Azure, run all commands in the following steps from an elevated Command Prompt window:

1. Remove any static persistent route on the routing table:

   • To view the route table, run route print at the command prompt.
   • Check the Persistence Routes sections. If there is a persistent route, use the route delete command to remove it.

2. Remove the WinHTTP proxy:

   netsh winhttp reset proxy
   

   If the VM need to work with any specific proxy, you must add a proxy exception to the Azure IP address (168.63.129.16), so the VM has connectivity to the Azure:

   $proxyAddress="<your proxy server>"
   $proxyBypassList="<your list of bypasses>;168.63.129.16"
   
   netsh winhttp set proxy $proxyAddress $proxyBypassList
   

3. Set the disk SAN policy to Onlineall:

   diskpart 
   

   In the open Command Prompt window, type the following commands:

   san policy=onlineall
   exit   
   

4. Set Coordinated Universal Time (UTC) time for Windows and the startup type of the Windows Time (w32time) service to Automatically:

   Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\TimeZoneInformation' -name "RealTimeIsUniversal" -Value 1 -Type DWord -force
   
   Set-Service -Name w32time -StartupType Automatic
   

5. Set the power profile to the High Performance:

   powercfg /setactive SCHEME_MIN
   

6. Make sure that the environmental variables TEMP and TMP are set to their default values:

   Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment' -name "TEMP" -Value "%SystemRoot%\TEMP" -Type ExpandString -force
   
   Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment' -name "TMP" -Value "%SystemRoot%\TEMP" -Type ExpandString -force
   

Check the Windows services

Make sure that each of the following Windows services is set to the Windows default values. These are the minimum numbers of services that must be set up to make sure that the VM has connectivity. To reset the startup settings, run the following commands:

Set-Service -Name bfe -StartupType Automatic
Set-Service -Name dhcp -StartupType Automatic
Set-Service -Name dnscache -StartupType Automatic
Set-Service -Name IKEEXT -StartupType Automatic
Set-Service -Name iphlpsvc -StartupType Automatic
Set-Service -Name netlogon -StartupType Manual
Set-Service -Name netman -StartupType Manual
Set-Service -Name nsi -StartupType Automatic
Set-Service -Name termService -StartupType Manual
Set-Service -Name MpsSvc -StartupType Automatic
Set-Service -Name RemoteRegistry -StartupType Automatic

Update Remote Desktop registry settings

Make sure that the following settings are configured correctly for remote desktop connection:

1. Remote Desktop Protocol (RDP) is enabled:

   Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -name "fDenyTSConnections" -Value 0 -Type DWord -force
   
   Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services' -name "fDenyTSConnections" -Value 0 -Type DWord -force
   

2. The RDP port is set up correctly (Default port 3389):

   Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\Winstations\RDP-Tcp' -name "PortNumber" -Value 3389 -Type DWord -force
   

   When you deploy a VM, the default rules are created against port 3389. If you want to change the port number, do that after the VM is deployed in Azure.

3. The listener is listening in every network interface:

   Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\Winstations\RDP-Tcp' -name "LanAdapter" -Value 0 -Type DWord -force
   

4. Configure the Network Level Authentication mode for the RDP connections:

   Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -name "UserAuthentication" -Value 1 -Type DWord -force
   
   Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -name "SecurityLayer" -Value 1 -Type DWord -force
   
   Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -name "fAllowSecProtocolNegotiation" -Value 1 -Type DWord -force
   

5. Set the keep-alive value:

   Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services' -name "KeepAliveEnable" -Value 1  -Type DWord -force
   Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services' -name "KeepAliveInterval" -Value 1  -Type DWord -force
   Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\Winstations\RDP-Tcp' -name "KeepAliveTimeout" -Value 1 -Type DWord -force
   

6. Reconnect:

   Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services' -name "fDisableAutoReconnect" -Value 0 -Type DWord -force
   Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\Winstations\RDP-Tcp' -name "fInheritReconnectSame" -Value 1 -Type DWord -force
   Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\Winstations\RDP-Tcp' -name "fReconnectSame" -Value 0 -Type DWord -force
   

7. Limit the number of concurrent connections:

   Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\Winstations\RDP-Tcp' -name "MaxInstanceCount" -Value 4294967295 -Type DWord -force
   

8. If there are any self-signed certificates tied to the RDP listener, remove them:

   Remove-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -name "SSLCertificateSHA1Hash" -force
   

   This is to make sure that you can connect at the beginning when you deploy the VM. You can also review this on a later stage after the VM is deployed in Azure if needed.

9. If the VM will be part of a Domain, check all the following settings to make sure that the former settings are not reverted. The policies that must be checked are the following:

   Goal	Policy	Value
   RDP is enabled	Computer Configuration\Policies\Windows Settings\Administrative Templates\Components\Remote Desktop Services\Remote Desktop Session Host\Connections	Allow users to connect remotely by using Remote Desktop
   NLA group policy	Settings\Administrative Templates\Components\Remote Desktop Services\Remote Desktop Session Host\Security	Require user Authentication for remote connections by using Network Level Authentication
   Keep Alive settings	Computer Configuration\Policies\Windows Settings\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections	Configure keep-alive connection interval
   Reconnect settings	Computer Configuration\Policies\Windows Settings\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections	Automatic reconnection
   Limit the number of connections settings	Computer Configuration\Policies\Windows Settings\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections	Limit number of connections

Configure Windows Firewall rules

1. Turn on Windows Firewall on the three profiles (Domain, Standard, and Public):

    Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True
   

2. Run the following command in PowerShell to allow WinRM through the three firewall profiles (Domain, Private, and Public) and enable the PowerShell Remote service:

    Enable-PSRemoting -force
   
    Set-NetFirewallRule -DisplayName "Windows Remote Management (HTTP-In)" -Enabled True
   

3. Enable the following firewall rules to allow the RDP traffic:

    Set-NetFirewallRule -DisplayGroup "Remote Desktop" -Enabled True
   

4. Enable the File and Printer Sharing rule so that the VM can respond to a ping command inside the Virtual Network:

   Set-NetFirewallRule -DisplayName "File and Printer Sharing (Echo Request - ICMPv4-In)" -Enabled True
   

5. If the VM will be part of a Domain, check the following settings to make sure that the former settings are not reverted. The AD policies that must be checked are the following:

   Goal	Policy	Value
   Enable the Windows Firewall profiles	Computer Configuration\Policies\Windows Settings\Administrative Templates\Network\Network Connection\Windows Firewall\Domain Profile\Windows Firewall	Protect all network connections
   Enable RDP	Computer Configuration\Policies\Windows Settings\Administrative Templates\Network\Network Connection\Windows Firewall\Domain Profile\Windows Firewall	Allow inbound Remote Desktop exceptions
   	Computer Configuration\Policies\Windows Settings\Administrative Templates\Network\Network Connection\Windows Firewall\Standard Profile\Windows Firewall	Allow inbound Remote Desktop exceptions
   Enable ICMP-V4	Computer Configuration\Policies\Windows Settings\Administrative Templates\Network\Network Connection\Windows Firewall\Domain Profile\Windows Firewall	Allow ICMP exceptions
   	Computer Configuration\Policies\Windows Settings\Administrative Templates\Network\Network Connection\Windows Firewall\Standard Profile\Windows Firewall	Allow ICMP exceptions

Verify VM is healthy, secure, and accessible with RDP

1. To make sure the disk is healthy and consistent, run a check disk operation at the next VM restart:

   Chkdsk /f
   

   Make sure that the report shows a clean and healthy disk.

2. Set the Boot Configuration Data (BCD) settings.

   Note

   Make sure you run these commands on an elevated PowerShell window.

    cmd
   
    bcdedit /set {bootmgr} integrityservices enable
    bcdedit /set {default} device partition=C:
    bcdedit /set {default} integrityservices enable
    bcdedit /set {default} recoveryenabled Off
    bcdedit /set {default} osdevice partition=C:
    bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
   
    #Enable Serial Console Feature
    bcdedit /set {bootmgr} displaybootmenu yes
    bcdedit /set {bootmgr} timeout 5
    bcdedit /set {bootmgr} bootems yes
    bcdedit /ems {current} ON
    bcdedit /emssettings EMSPORT:1 EMSBAUDRATE:115200
   
    exit
   

3. The Dump log can be helpful in troubleshooting Windows crash issues. Enable the Dump log collection:

   # Setup the Guest OS to collect a kernel dump on an OS crash event
   Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\CrashControl' -name CrashDumpEnabled -Type DWord -force -Value 2
   Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\CrashControl' -name DumpFile -Type ExpandString -force -Value "%SystemRoot%\MEMORY.DMP"
   Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\CrashControl' -name NMICrashDump -Type DWord -force -Value 1
   
   #Setup the Guest OS to collect user mode dumps on a service crash event
   $key = 'HKLM:\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps'
   if ((Test-Path -Path $key) -eq $false) {(New-Item -Path 'HKLM:\SOFTWARE\Microsoft\Windows\Windows Error Reporting' -Name LocalDumps)}
   New-ItemProperty -Path $key -name DumpFolder -Type ExpandString -force -Value "c:\CrashDumps"
   New-ItemProperty -Path $key -name CrashCount -Type DWord -force -Value 10
   New-ItemProperty -Path $key -name DumpType -Type DWord -force -Value 2
   Set-Service -Name WerSvc -StartupType Manual
   

4. Verify that the Windows Management Instrumentations repository is consistent. To perform this, run the following command:

   winmgmt /verifyrepository
   

   If the repository is corrupted, see WMI: Repository Corruption, or Not.

5. Make sure that any other application is not using the port 3389. This port is used for the RDP service in Azure. You can run netstat -anob to see which ports are in used on the VM:

   netstat -anob
   

6. If the Windows VHD that you want to upload is a domain controller, then follow these steps:

   1. Follow these extra steps to prepare the disk.

   2. Make sure that you know the DSRM password in case you have to start the VM in DSRM at some point. You may want to refer to this link to set the DSRM password.

7. Make sure that the Built-in Administrator account and password are known to you. You may want to reset the current local administrator password and make sure that you can use this account to sign in to Windows through the RDP connection. This access permission is controlled by the "Allow log on through Remote Desktop Services" Group Policy object. You can view this object in the Local Group Policy Editor under:

   Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

8. Check the following AD polices to make sure that you are not blocking your RDP access through RDP nor from the network:

   • Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Deny access to this computer from the network

   • Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Deny log on through Remote Desktop Services

9. Check the following AD policy to make sure that you are not removing any of the following the required access accounts:

   • Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Access this compute from the network

     The following groups should be listed on this policy:

   • Administrators

   • Backup Operators

   • Everyone

   • Users

10. Restart the VM to make sure that Windows is still healthy can be reached by using the RDP connection. At this point, you may want to create a VM in your local Hyper-V to make sure the VM is starting completely and then test whether it is RDP reachable.

11. Remove any extra Transport Driver Interface filters, such as software that analyzes TCP packets or extra firewalls. You can also review this on a later stage after the VM is deployed in Azure if needed.

12. Uninstall any other third-party software and driver that is related to physical components or any other virtualization technology.

Install Windows Updates

The ideal configuration is to have the patch level of the machine at the latest. If this is not possible, make sure that the following updates are installed:

When to use sysprep

Sysprep is a process that you could run into a windows installation that will reset the installation of the system and will provide an “out of the box experience” by removing all personal data and resetting several components. You typically do this if you want to create a template from which you can deploy several other VMs that have a specific configuration. This is called a generalized image.

If, instead, you want only to create one VM from one disk, you don’t have to use sysprep. In this situation, you can just create the VM from what is known as a specialized image.

For more information about how to create a VM from a specialized disk, see:

• Create a VM from a specialized disk
• Create a VM from a specialized VHD disk

If you want to create a generalized image, you need to run sysprep. For more information about Sysprep, see How to Use Sysprep: An Introduction.

Not every role or application that’s installed on a Windows-based computer supports this generalization. So before you run this procedure, refer to the following article to make sure that the role of that computer is supported by sysprep. For more information, Sysprep Support for Server Roles.

Steps to generalize a VHD

1. Sign in to the Windows VM.

2. Run Command Prompt as an administrator.

3. Change the directory to: %windir%\system32\sysprep, and then run sysprep.exe.

4. In the System Preparation Tool dialog box, select Enter System Out-of-Box Experience (OOBE), and make sure that the Generalize check box is selected.

   

5. In Shutdown Options, select Shutdown.

6. Click OK.

7. When Sysprep completes, shut down the VM. Do not use Restart to shut down the VM.

8. Now the VHD is ready to be uploaded. For more information about how to create a VM from a generalized disk, see Upload a generalized VHD and use it to create a new VMs in Azure.

Complete recommended configurations

The following settings do not affect VHD uploading. However, we strongly recommend that you configured them.

• Install the Azure VMs Agent. Then you can enable VM extensions. The VM extensions implement most of the critical functionality that you might want to use with your VMs such as resetting passwords, configuring RDP, and so on. For more information, see Azure Virtual Machine Agent overview.

• After the VM is created in Azure, we recommend that you put the pagefile on the ”Temporal drive” volume to improve performance. You can set up this as follows:

  Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management' -name "PagingFiles" -Value "D:\pagefile.sys" -Type MultiString -force
  

  If there’s any data disk that is attached to the VM, the Temporal drive volume's drive letter is typically "D." This designation could be different, depending on the number of available drives and the settings that you make.

Next steps

• Upload a Windows VM image to Azure for Resource Manager deployments
• Troubleshoot Azure Windows virtual machine activation problems