部署 Windows 混合 Runbook 辅助角色Deploy a Windows Hybrid Runbook Worker

可以使用 Azure 自动化的混合 Runbook 辅助角色功能,直接在 Azure 或非 Azure 计算机上运行 runbook。You can use the user Hybrid Runbook Worker feature of Azure Automation to run runbooks directly on the Azure or non-Azure machine. 在托管角色的计算机或服务器中,可以直接运行 runbook,并对环境中的资源运行 runbook,从而管理这些本地资源。From the machine or server that's hosting the role, you can run runbooks directly it and against resources in the environment to manage those local resources.

Azure 自动化将存储并管理 Runbook,然后将其传送到一台或多台指定的计算机。Azure Automation stores and manages runbooks and then delivers them to one or more designated machines. 本文介绍如何在 Windows 计算机上部署用户混合 Runbook 辅助角色、如何删除辅助角色,以及如何删除混合 Runbook 辅助角色组。This article describes how to deploy a user Hybrid Runbook Worker on a Windows machine, how to remove the worker, and how to remove a Hybrid Runbook Worker group.

成功部署 Runbook 辅助角色后,请查看在混合 Runbook 辅助角色上运行 Runbook,了解如何配置 Runbook,使本地数据中心或其他云环境中的过程实现自动化。After you successfully deploy a runbook worker, review Run runbooks on a Hybrid Runbook Worker to learn how to configure your runbooks to automate processes in your on-premises datacenter or other cloud environment.

先决条件Prerequisites

在开始之前,请确保你具备以下内容。Before you start, make sure that you have the following.

Log Analytics 工作区A Log Analytics workspace

混合 Runbook 辅助角色依赖于 Azure Monitor Log Analytics 工作区来安装和配置角色。The Hybrid Runbook Worker role depends on an Azure Monitor Log Analytics workspace to install and configure the role. 你可通过 Azure 资源管理器PowerShell 或在 Azure 门户中创建该工作区。You can create it through Azure Resource Manager, through PowerShell, or in the Azure portal.

如果没有 Azure Monitor Log Analytics 工作区,请在创建工作区前查看 Azure Monitor 日志设计指南If you don't have an Azure Monitor Log Analytics workspace, review the Azure Monitor Log design guidance before you create the workspace.

Log Analytics 代理Log Analytics agent

混合 Runbook 辅助角色要求在受支持的 Windows 操作系统上使用 Log Analytics 代理The Hybrid Runbook Worker role requires the Log Analytics agent for the supported Windows operating system.

支持的 Windows 操作系统Supported Windows operating system

混合 Runbook 辅助角色功能支持以下操作系统:The Hybrid Runbook Worker feature supports the following operating systems:

  • Windows Server 2019Windows Server 2019
  • Windows Server 2016、版本 1709 和 1803Windows Server 2016, version 1709 and 1803
  • Windows Server 2012、2012 R2Windows Server 2012, 2012 R2
  • Windows Server 2008 SP2 (x64)、2008 R2Windows Server 2008 SP2 (x64), 2008 R2
  • Windows 10 Enterprise(包括多会话)和 ProWindows 10 Enterprise (including multi-session) and Pro
  • Windows 8 企业版和专业版Windows 8 Enterprise and Pro
  • Windows 7 SP1Windows 7 SP1

最低要求Minimum requirements

Windows 系统和用户混合 Runbook 辅助角色的最低要求如下:The minimum requirements for a Windows system and user Hybrid Runbook Worker are:

  • Windows PowerShell 5.1(下载 WMF 5.1)。Windows PowerShell 5.1 (download WMF 5.1). 不支持 PowerShell Core。PowerShell Core is not supported.
  • .NET Framework 4.6.2 或更高版本.NET Framework 4.6.2 or later
  • 双核Two cores
  • 4 GB RAM4 GB of RAM
  • 端口 443(出站)Port 443 (outbound)

网络配置Network configuration

有关混合 Runbook 辅助角色的网络要求,请参阅配置网络For networking requirements for the Hybrid Runbook Worker, see Configuring your network.

将计算机添加到混合 Runbook 辅助角色组Adding a machine to a Hybrid Runbook Worker group

可将辅助角色计算机添加到其中一个自动化帐户中的混合 Runbook 辅助角色组。You can add the worker machine to a Hybrid Runbook Worker group in one of your Automation accounts. 对于托管系统混合 Runbook 辅助角色(由更新管理进行管理)的计算机,可以将其添加到混合 Runbook 辅助角色组。For machines hosting the system Hybrid Runbook worker managed by Update Management, they can be added to a Hybrid Runbook Worker group. 但必须对更新管理和混合 Runbook 辅助角色组成员身份使用同一自动化帐户。But you must use the same Automation account for both Update Management and the Hybrid Runbook Worker group membership.

备注

Azure 自动化更新管理会自动在启用了更新管理的 Azure 或非 Azure 计算机上安装系统混合 Runbook 辅助角色。Azure Automation Update Management automatically installs the system Hybrid Runbook Worker on an Azure or non-Azure machine that's enabled for Update Management. 但是,此辅助角色未注册到自动化帐户中的任何混合 Runbook 辅助角色组。However, this worker is not registered with any Hybrid Runbook Worker groups in your Automation account. 若要在这些计算机上运行 runbook,需将其添加到混合 Runbook 辅助角色组。To run your runbooks on those machines, you need to add them to a Hybrid Runbook Worker group. 按照手动部署部分下的步骤 6 将其添加到组中。Follow step 6 under the section Manual deployment to add it to a group.

允许通过 Azure 自动化 State Configuration 进行管理Enable for management with Azure Automation State Configuration

若要了解如何让计算机能够通过 Azure Automation State Configuration 进行管理,请参阅使计算机通过 Azure Automation State Configuration 进行管理For information about enabling machines for management with Azure Automation State Configuration, see Enable machines for management by Azure Automation State Configuration.

备注

对于支持将混合 Runbook 辅助角色用于 Desired State Configuration (DSC) 的计算机,必须将计算机添加为 DSC 节点才能管理计算机的配置。To manage the configuration of machines that support the Hybrid Runbook Worker role with Desired State Configuration (DSC), you must add the machines as DSC nodes.

安装选项Installation options

若要安装和配置 Windows 用户混合 Runbook 辅助角色,可使用下述方法中的一种。To install and configure a Windows user Hybrid Runbook Worker, you can use one of the following methods.

  • 请使用提供的 PowerShell 脚本将一台或多台 Windows 计算机的配置过程完全自动化Use a provided PowerShell script to completely automate the process of configuring one or more Windows machines. 对于数据中心或其他云环境中的计算机,建议使用此方法。This is the recommended method for machines in your datacenter or another cloud environment.
  • 手动导入自动化解决方案,安装适用于 Windows 的 Log Analytics 代理,并在计算机上配置辅助角色。Manually import the Automation solution, install the Log Analytics agent for Windows, and configure the worker role on the machine.

自动化部署Automated deployment

自动部署方法使用 PowerShell 脚本 New-OnPremiseHybridWorker.ps1 来自动化和配置 Windows 混合 Runbook 辅助角色。The automated deployment method uses the PowerShell script New-OnPremiseHybridWorker.ps1 to automate and configure the Windows Hybrid Runbook Worker role. 它将执行以下任务:It performs the following:

  • 安装所需的模块Installs the necessary modules
  • 使用 Azure 帐户登录Signs in with your Azure account
  • 验证是否存在指定的资源组和自动化帐户Verifies the existence of specified resource group and Automation account
  • 创建对自动化帐户属性的引用Creates references to Automation account attributes
  • 如果未指定,请创建 Azure Monitor Log Analytics 工作区Creates an Azure Monitor Log Analytics workspace if not specified
  • 在工作区中启用 Azure 自动化解决方案Enable the Azure Automation solution in the workspace
  • 下载并安装适用于 Windows 的 Log Analytics 代理Download and install the Log Analytics agent for Windows
  • 将计算机注册为混合 Runbook 辅助角色Register the machine as Hybrid Runbook Worker

执行以下步骤,使用脚本在 Windows 计算机上安装角色。Perform the following steps to install the role on your Windows machine using the script.

  1. PowerShell 库下载 New-OnPremiseHybridWorker.ps1 脚本。Download the New-OnPremiseHybridWorker.ps1 script from the PowerShell Gallery. 下载该脚本后,在目标计算机上复制或运行它。After you have downloaded the script, copy or run it on the target machine. 在执行期间,New-OnPremiseHybridWorker.ps1 脚本使用以下参数。The New-OnPremiseHybridWorker.ps1 script uses the following parameters during execution.

    参数Parameter 状态Status 说明Description
    AAResourceGroupName 必需Mandatory 与自动化帐户关联的资源组的名称。The name of the resource group that's associated with your Automation account.
    AutomationAccountName 必需Mandatory 自动化帐户的名称。The name of your Automation account.
    Credential 可选Optional 登录到 Azure 环境时要使用的凭据。The credentials to use when logging in to the Azure environment.
    HybridGroupName 必需Mandatory 混合 Runbook 辅助角色组的名称,可将其指定为支持此方案的 runbook 的目标。The name of a Hybrid Runbook Worker group that you specify as a target for the runbooks that support this scenario.
    OMSResourceGroupName 可选Optional Log Analytics 工作区的资源组的名称。The name of the resource group for the Log Analytics workspace. 如果未指定此资源组,则使用 AAResourceGroupName 的值。If this resource group is not specified, the value of AAResourceGroupName is used.
    SubscriptionID 必需Mandatory 与自动化帐户关联的 Azure 订阅的标识符。The identifier of the Azure subscription associated with your Automation account.
    TenantID 可选Optional 与自动化帐户关联的租户组织的标识符。The identifier of the tenant organization associated with your Automation account.
    WorkspaceName 可选Optional Log Analytics 工作区名称。The Log Analytics workspace name. 如果没有 Log Analytics 工作区,该脚本会创建并配置一个。If you don't have a Log Analytics workspace, the script creates and configures one.
  2. 打开权限提升的 64 位 PowerShell 命令提示符。Open an elevated 64-bit PowerShell command prompt.

  3. 从 PowerShell 命令提示符,浏览到包含已下载脚本的文件夹。From the PowerShell command prompt, browse to the folder that contains the script that you downloaded. 更改参数 AutomationAccountNameAAResourceGroupNameOMSResourceGroupNameHybridGroupNameSubscriptionIDWorkspaceName 的值。Change the values for the parameters AutomationAccountName, AAResourceGroupName, OMSResourceGroupName, HybridGroupName, SubscriptionID, and WorkspaceName. 然后运行脚本。Then run the script.

    运行脚本后,系统会提示在 Azure 上进行身份验证。You're prompted to authenticate with Azure after you run the script. 必须以具有“订阅管理员”角色成员身份和订阅共同管理员身份的帐户登录。You must sign in with an account that's a member of the Subscription Admins role and co-administrator of the subscription.

    $NewOnPremiseHybridWorkerParameters = @{
      AutomationAccountName = <nameOfAutomationAccount>
      AAResourceGroupName   = <nameOfResourceGroup>
      OMSResourceGroupName  = <nameOfResourceGroup>
      HybridGroupName       = <nameOfHRWGroup>
      SubscriptionID        = <subscriptionId>
      WorkspaceName         = <nameOfLogAnalyticsWorkspace>
    }
    .\New-OnPremiseHybridWorker.ps1 @NewOnPremiseHybridWorkerParameters
    
  4. 系统会提示用户同意安装 NuGet 并使用 Azure 凭据进行身份验证。You're prompted to agree to install NuGet, and to authenticate with your Azure credentials. 如果没有最新的 NuGet 版本,可从可用的 NuGet 发行版下载。If you don't have the latest NuGet version, you can download it from Available NuGet Distribution Versions.

  5. 完成脚本后,验证部署。Verify the deployment after the script is finished. 从自动化帐户中的“混合 Runbook 辅助角色组”页面,在“用户混合 runbook 辅助角色组”选项卡下,会显示新组和成员数。 From the Hybrid Runbook Worker Groups page in your Automation account, under the User hybrid runbook workers group tab, it shows the new group and the number of members. 如果这是现有的组,则成员数会递增。If it's an existing group, the number of members is incremented. 可从该页上的列表中选择此组,从左侧菜单中选择“混合辅助角色”。You can select the group from the list on the page, from the left-hand menu choose Hybrid Workers . 在“混合辅助角色”页上,可以查看列出组的每个成员。On the Hybrid Workers page, you can see each member of the group listed.

手动部署Manual deployment

若要安装和配置 Windows 混合 Runbook 辅助角色,请执行以下步骤。To install and configure a Windows Hybrid Runbook Worker, perform the following steps.

  1. 通过在提升的 PowerShell 命令提示符中运行以下命令,在 Log Analytics 工作区中启用 Azure 自动化解决方案。Enable the Azure Automation solution in your Log Analytics workspace by running the following command in an elevated PowerShell command prompt.

    Set-AzOperationalInsightsIntelligencePack -ResourceGroupName <resourceGroupName> -WorkspaceName <workspaceName> -IntelligencePackName "AzureAutomation" -Enabled $true
    
  2. 将 Log Analytics 代理部署到目标计算机。Deploy the Log Analytics agent to the target machine.

    • 对于 Azure VM,使用适用于 Windows 的虚拟机扩展安装适用于 Windows 的 Log Analytics 代理。For Azure VMs, install the Log Analytics agent for Windows using the virtual machine extension for Windows. 该扩展在 Azure 虚拟机上安装 Log Analytics 代理,并将虚拟机注册到现有的 Log Analytics 工作区中。The extension installs the Log Analytics agent on Azure virtual machines, and enrolls virtual machines into an existing Log Analytics workspace. 可以使用 Azure 资源管理器模板、PowerShell 或 Azure Policy 来分配为 Linux 或 Windows VM 部署 Log Analytics 代理内置策略 。You can use an Azure Resource Manager template, PowerShell, or Azure Policy to assign the Deploy Log Analytics agent for Linux or Windows VMs built-in policy. 安装代理后,可将计算机添加到自动化帐户中的混合 Runbook 辅助角色组。Once the agent is installed, the machine can be added to a Hybrid Runbook Worker group in your Automation account.

    • 对于非 Azure VM,请使用将 Windows 计算机连接到 Azure Monitor 一文中所述的部署选项安装适用于 Windows 的 Log Analytics 代理。For non-Azure VMs, install the Log Analytics agent for Windows using the deployment options described in the Connect Windows computers to Azure Monitor article. 可以对多台计算机重复此过程,以将多个辅助角色添加到环境。You can repeat this process for multiple machines to add multiple workers to your environment. 安装代理后,可将 VM 添加到自动化帐户中的混合 Runbook 辅助角色组。Once the agent is installed, the VMs can be added to a Hybrid Runbook Worker group in your Automation account.

  3. 验证代理是否向工作区报告Verify agent is reporting to workspace

    适用于 Windows 的 Log Analytics 代理会将计算机连接到 Azure Monitor Log Analytics 工作区。The Log Analytics agent for Windows connects machines to an Azure Monitor Log Analytics workspace. 在计算机上安装代理并将其连接到工作区时,代理会自动下载混合 Runbook 辅助角色所需的组件。When you install the agent on your machine and connect it to your workspace, it automatically downloads the components that are required for the Hybrid Runbook Worker.

    几分钟后,如果代理已成功连接到 Log Analytics 工作区,则可以运行以下查询,验证是否正在向工作区发送检测信号数据。When the agent has successfully connected to your Log Analytics workspace after a few minutes, you can run the following query to verify that it is sending heartbeat data to the workspace.

    Heartbeat 
    | where Category == "Direct Agent"
    | where TimeGenerated > ago(30m)
    

    在搜索结果中,应会看到计算机的检测信号记录,它们指示计算机已连接到服务并将该结果报告给服务。In the search results, you should see heartbeat records for the machine, indicating that it is connected and reporting to the service. 默认情况下,每个代理都会将一个检测信号记录转发到其分配的工作区。By default, every agent forwards a heartbeat record to its assigned workspace. 按照以下步骤可完成代理安装和设置。Use the following steps to complete the agent installation and setup.

  4. 在托管 Log Analytics 代理的计算机上确认混合 Runbook 辅助角色的版本,浏览到 C:\Program Files\Microsoft Monitoring Agent\Agent\AzureAutomation\ 并注意 version 子文件夹。Confirm the version of the Hybrid Runbook Worker on the machine hosting the Log Analytics agent, browse to C:\Program Files\Microsoft Monitoring Agent\Agent\AzureAutomation\ and note the version subfolder. 在工作区中启用解决方案几分钟后,此文件夹将出现在计算机上。This folder will appear on the machine several minutes after the solution is enabled in the workspace.

  5. 安装 Runbook 环境并连接到 Azure 自动化。Install the runbook environment and connect to Azure Automation. 将代理配置为向 Log Analytics 工作区报告,并导入“自动化”解决方案时,该解决方案会向下推送 HybridRegistration PowerShell 模块。When you configure an agent to report to a Log Analytics workspace and import the Automation solution, the solution pushes down the HybridRegistration PowerShell module. 此模块包含 Add-HybridRunbookWorker cmdlet。This module contains the Add-HybridRunbookWorker cmdlet. 使用此 cmdlet 将 Runbook 环境安装到计算机上,并将其注册到 Azure 自动化。Use this cmdlet to install the runbook environment on the machine and register it with Azure Automation.

    在管理员模式下打开 PowerShell 会话,并运行以下命令以导入模块。Open a PowerShell session in Administrator mode and run the following commands to import the module.

    cd "C:\Program Files\Microsoft Monitoring Agent\Agent\AzureAutomation\<version>\HybridRegistration"
    Import-Module .\HybridRegistration.psd1
    
  6. 运行 Add-HybridRunbookWorker cmdlet,指定参数 UrlKeyGroupName 的值。Run the Add-HybridRunbookWorker cmdlet specifying the values for the parameters Url, Key, and GroupName.

    Add-HybridRunbookWorker –GroupName <String> -Url <Url> -Key <String>
    

    你可从自动化帐户中的“密钥”页面获取参数 UrlKey 所需的信息。You can get the information required for the parameters Url and Key from the Keys page in your Automation account. 从页面左侧的“帐户设置”部分下,选择“密钥” 。Select Keys under the Account settings section from the left-hand side of the page.

    “管理密钥”页

    • 对于 Url 参数,复制 URL 的值。For the Url parameter, copy the value for URL.

    • 对于 Key 参数,复制主访问密钥的值。For the Key parameter, copy the value for PRIMARY ACCESS KEY.

    • 对于 GroupName 参数,请使用混合 Runbook 辅助角色组的名称。For the GroupName parameter, use the name of the Hybrid Runbook Worker group. 如果自动化帐户中已存在该组,则会将当前计算机添加到其中。If this group already exists in the Automation account, the current machine is added to it. 如果该组不存在,则将添加该组。If this group doesn't exist, it's added.

    • 如果需要,请设置 Verbose 参数以接收有关安装的详细信息。If required, set the Verbose parameter to receive details about the installation.

  7. 完成命令后,验证部署。Verify the deployment after the command is completed. 在自动化帐户的“混合 Runbook 辅助角色组”页的“使用混合 Runbook 辅助角色组”选项卡下,会显示新组或现有组以及成员数量 。From the Hybrid Runbook Worker Groups page in your Automation account, under the User hybrid runbook workers group tab, it shows the new or existing group and the number of members. 如果这是现有的组,则成员数会递增。If it's an existing group, the number of members is incremented. 可从该页上的列表中选择此组,从左侧菜单中选择“混合辅助角色”。You can select the group from the list on the page, from the left-hand menu choose Hybrid Workers. 在“混合辅助角色”页上,可以查看列出组的每个成员。On the Hybrid Workers page, you can see each member of the group listed.

安装 PowerShell 模块Install PowerShell modules

Runbook 可以使用在 Azure 自动化环境中安装的模块中定义的任何活动和 cmdlet。Runbooks can use any of the activities and cmdlets defined in the modules installed in your Azure Automation environment. 这些模块不会自动部署到本地计算机,必须手动安装。As these modules are not automatically deployed to on-premises machines, you must install them manually. 例外情况是 Azure 模块。The exception is the Azure module. 此模块是默认安装的,并可用于访问所有 Azure 服务的 cmdlet 以及 Azure 自动化的活动。This module is installed by default and provides access to cmdlets for all Azure services and activities for Azure Automation.

由于混合 Runbook 辅助角色的主要用途是管理本地资源,很可能需要安装支持这些资源的模块,尤其是 PowerShellGet 模块。Because the primary purpose of the Hybrid Runbook Worker is to manage local resources, you most likely need to install the modules that support these resources, particularly the PowerShellGet module. 有关安装 Windows PowerShell 模块的信息,请参阅 Windows PowerShellFor information on installing Windows PowerShell modules, see Windows PowerShell.

安装的模块必须位于 PSModulePath 环境变量所引用的位置,以便混合辅助角色自动将其导入。Modules that are installed must be in a location referenced by the PSModulePath environment variable so that the hybrid worker can automatically import them. 有关详细信息,请参阅在 PSModulePath 中安装模块For more information, see Install Modules in PSModulePath.

删除混合 Runbook 辅助角色Remove the Hybrid Runbook Worker

  1. 在 Azure 门户中,转到自动化帐户。In the Azure portal, go to your Automation account.

  2. 在“帐户设置”下,选择“密钥”并记下“URL”和“主访问密钥”的值 。Under Account Settings, select Keys and note the values for URL and Primary Access Key.

  3. 在管理员模式下打开 PowerShell 会话,并使用 URL 和主访问密钥值运行以下命令。Open a PowerShell session in Administrator mode and run the following command with your URL and primary access key values. 可使用 Verbose 参数获取删除过程的详细日志。Use the Verbose parameter for a detailed log of the removal process. 若要从混合辅助角色组中删除过时的计算机,请使用可选的 machineName 参数。To remove stale machines from your Hybrid Worker group, use the optional machineName parameter.

Remove-HybridRunbookWorker -Url <URL> -Key <primaryAccessKey> -MachineName <computerName>

删除混合辅助角色组Remove a Hybrid Worker group

若要删除混合 Runbook 辅助角色组,首先需要从每台计算机上删除该组中包含的混合 Runbook 辅助角色。To remove a Hybrid Runbook Worker group, you first need to remove the Hybrid Runbook Worker from every machine that is a member of the group. 然后,使用以下步骤删除该组:Then use the following steps to remove the group:

  1. 在 Azure 门户中打开自动化帐户。Open the Automation account in the Azure portal.

  2. 在“流程自动化”下选择“混合辅助角色组”。Select Hybrid worker groups under Process Automation. 选择要删除的组。Select the group that you want to delete. 将显示该组的属性页。The properties page for that group appears.

    “属性”页

  3. 在所选组的属性页中,选择“删除”。On the properties page for the selected group, select Delete. 系统会显示一条消息,要求确认此操作。A message asks you to confirm this action. 如果确定要继续,请选择“是”。Select Yes if you're sure that you want to continue.

    确认消息

    完成此过程可能需要数秒钟的时间。This process can take several seconds to finish. 可以在菜单中的“通知”下面跟踪操作进度。You can track its progress under Notifications from the menu.

后续步骤Next steps