Find Azure VMs that are “Shut Down” but not “Deallocated”

As you likely know, if you shut down an azure VM from the operating system, Azure does not deallocate resources to that VM, and therefor you are still being charged for those resources. In order to get the VM to stop billing, it has to be in the ‘deallocated’ state. In order to deallocate, Azure…


No Extensions! Getting Basic Azure VM Metric Data

If you need to grab some basic performance metrics on an Azure Virtual Machine that doesn’t have either the OMS or Azure Monitor extensions, it can still be done with the metrics here: You can then use the GUI to create alerts (which this blog won’t cover) or if you have 100’s of VMs to…


Customizing, Exporting and Importing Azure VM Diagnostic Settings

Azure VM Diagnostics on Windows VMs can track more than just the basic performance counters. Through the Azure portal UI as in the image below you can add performance counters that are available to the operating system. Inside of windows run “Typeperf -q > counters.txt” at a command prompt to get a txt file of…


Using Azure Automation, OMS and Storage Tables to capture Configuration Data of Azure VMs Part One.

Many customers have legacy configuration management database (CMDB) systems that they’d like to update with Azure Virtual Machine configuration data like hostname, IP address, subscription, etc. Part one of this blog will review how to capture this information to an Azure Storage table each time a virtual machine is created. Subsequent parts will cover virtual…


Pass-the-Hash Lab

If you haven’t seen how a PtH attack works first hand, I highly recommend this lab. It walks through using mimikatz to use an NTLM hash to authenticate to a domain controller, then uses the PtH mitigations in Server 2016 like credential guard to defend. Credential Guard lab companion


Using Azure Automation with Multiple Subscriptions

Azure Automation is very useful for almost every Azure administrator, but it can be challenging to figure out how to run a process across multiple subscriptions. Below we’ll walk through the steps to run a PowerShell run book across multiple subscriptions with the assumption that the automation account already exists in one subscription. For information…


RDP not working over Azure S2S VPN with Palo Alto

I ran into an interesting issue with a customer this week. We were deploying a route based VPN from Azure Resource Manager to the customer’s Palo Alto PA-5020 running PANOS 7.1.8. We were able to stand up the VPN tunnel easily enough but we could not RDP to VMs running in Azure using the VPN…


Greenfield Test Environments in Azure

Most IT pros will use and re-use environments for testing anything and everything as well as learning new technologies. Often, building a lab from scratch with AD, Exchange, maybe some other forests, etc can be a very time consuming task. Azure gives us the ability to build a lab once with all the components we generally…