部署 Windows 混合 Runbook 辅助角色Deploy a Windows Hybrid Runbook Worker

利用 Azure 自动化的混合 Runbook 辅助角色功能,既可以直接在托管角色的计算机上运行 Runbook,也可以对环境中的资源运行 Runbook,从而管理这些本地资源。You can use the Hybrid Runbook Worker feature of Azure Automation to run runbooks directly on the machine that's hosting the role and against resources in the environment to manage those local resources. Azure 自动化将存储并管理 Runbook,然后将其传送到一台或多台指定的计算机。Azure Automation stores and manages runbooks and then delivers them to one or more designated machines. 本文介绍如何在 Windows 计算机上部署混合 Runbook 辅助角色、如何删除辅助角色,以及如何删除混合 Runbook 辅助角色组。This article describes how to deploy a Hybrid Runbook Worker on a Windows machine, how to remove the worker, and how to remove a Hybrid Runbook Worker group.

成功部署 Runbook 辅助角色后,请查看在混合 Runbook 辅助角色上运行 Runbook,了解如何配置 Runbook,使本地数据中心或其他云环境中的过程实现自动化。After you successfully deploy a runbook worker, review Run runbooks on a Hybrid Runbook Worker to learn how to configure your runbooks to automate processes in your on-premises datacenter or other cloud environment.

先决条件Prerequisites

在开始之前,请确保你具备以下内容。Before you start, make sure that you have the following.

Log Analytics 工作区A Log Analytics workspace

混合 Runbook 辅助角色依赖于 Azure Monitor Log Analytics 工作区来安装和配置角色。The Hybrid Runbook Worker role depends on an Azure Monitor Log Analytics workspace to install and configure the role. 你可通过 Azure 资源管理器PowerShell 或在 Azure 门户中创建该工作区。You can create it through Azure Resource Manager, through PowerShell, or in the Azure portal.

如果没有 Azure Monitor Log Analytics 工作区,请在创建工作区前查看 Azure Monitor 日志设计指南If you don't have an Azure Monitor Log Analytics workspace, review the Azure Monitor Log design guidance before you create the workspace.

如果你有工作区,但它没有与你的自动化帐户关联,则启用自动化功能会添加 Azure 自动化的功能,包括对混合 Runbook 辅助角色的支持。If you have a workspace, but it is not linked to your Automation account, enabling an Automation feature adds functionality for Azure Automation, including support for the Hybrid Runbook Worker. 在 Log Analytics 工作区中启用某项 Azure 自动化功能(特别是更新管理)时,辅助角色组件会自动推送到代理计算机。When you enable one of the Azure Automation features in your Log Analytics workspace, specifically Update Management, the worker components are automatically pushed to the agent machine.

若要将更新管理功能添加到工作区,请运行以下 PowerShell cmdlet:To add the Update Management feature to your workspace, run the following PowerShell cmdlet:

   Set-AzOperationalInsightsIntelligencePack -ResourceGroupName <logAnalyticsResourceGroup> -WorkspaceName <logAnalyticsWorkspaceName> -IntelligencePackName "Updates" -Enabled $true

Log Analytics 代理Log Analytics agent

混合 Runbook 辅助角色要求在受支持的 Windows 操作系统上使用 Log Analytics 代理The Hybrid Runbook Worker role requires the Log Analytics agent for the supported Windows operating system.

支持的 Windows 操作系统Supported Windows operating system

Windows 混合 Runbook 辅助角色官方支持以下版本的 Windows 操作系统:The following versions of the Windows operating system are officially supported for a Windows Hybrid Runbook Worker:

  • Windows Server 2019Windows Server 2019
  • Windows Server 2016、版本 1709 和 1803Windows Server 2016, version 1709 and 1803
  • Windows Server 2012、2012 R2Windows Server 2012, 2012 R2
  • Windows Server 2008 SP2 (x64)、2008 R2Windows Server 2008 SP2 (x64), 2008 R2
  • Windows 10 Enterprise(包括多会话)和 ProWindows 10 Enterprise (including multi-session) and Pro
  • Windows 8 企业版和专业版Windows 8 Enterprise and Pro
  • Windows 7 SP1Windows 7 SP1

最低要求Minimum requirements

Windows 混合 Runbook 辅助角色的最低要求如下:The minimum requirements for a Windows Hybrid Runbook Worker are:

  • Windows PowerShell 5.1 或更高版本(下载 WMF 5.1Windows PowerShell 5.1 or later (download WMF 5.1)
  • .NET Framework 4.6.2 或更高版本.NET Framework 4.6.2 or later
  • 双核Two cores
  • 4 GB RAM4 GB of RAM
  • 端口 443(出站)Port 443 (outbound)

网络配置Network configuration

若要查看混合 Runbook 辅助角色的更多网络要求,请参阅配置网络To get more networking requirements for the Hybrid Runbook Worker, see Configuring your network.

将计算机添加到混合 Runbook 辅助角色组Adding a machine to a Hybrid Runbook Worker group

你可将辅助角色计算机添加到自动化帐户中的混合 Runbook 辅助角色组。You can add the worker machine to a Hybrid Runbook Worker group in your Automation account. 请注意,只要对 Azure 自动化功能和混合 Runbook 辅助角色组成员身份使用同一帐户,就必须支持自动化 Runbook。Note that you must support Automation runbooks as long as you're using the same account for both the Azure Automation feature and the Hybrid Runbook Worker group membership. 此功能已添加到 7.2.12024.0 版本的混合 Runbook 辅助角色。This functionality has been added to version 7.2.12024.0 of the Hybrid Runbook Worker.

备注

如果启用 Azure 自动化更新管理,会将所有连接到 Log Analytics 工作区的 Windows 计算机自动配置为混合 Runbook 辅助角色,从而支持管理其操作系统更新。Enabling Azure Automation Update Management automatically configures any Windows machine that's connected to your Log Analytics workspace as a Hybrid Runbook Worker to support managing its operating system updates. 但是,此辅助角色未注册到任何已在自动化帐户中定义的混合 Runbook 辅助角色组。However, this worker is not registered with any Hybrid Runbook Worker groups already defined in your Automation account.

使计算机通过 Azure Automation State Configuration 进行管理Enabling machines for management with Azure Automation State Configuration

若要了解如何让计算机能够通过 Azure Automation State Configuration 进行管理,请参阅使计算机通过 Azure Automation State Configuration 进行管理For information about enabling machines for management with Azure Automation State Configuration, see Enable machines for management by Azure Automation State Configuration.

备注

对于支持将混合 Runbook 辅助角色用于 Desired State Configuration (DSC) 的计算机,必须将计算机添加为 DSC 节点才能管理计算机的配置。To manage the configuration of machines that support the Hybrid Runbook Worker role with Desired State Configuration (DSC), you must add the machines as DSC nodes.

Windows 混合 Runbook 辅助角色的安装选项Windows Hybrid Runbook Worker installation options

若要安装和配置 Windows 混合 Runbook 辅助角色,可以使用以下方法之一。To install and configure a Windows Hybrid Runbook Worker, you can use one of the following methods.

  • 对于 Azure VM,使用适用于 Windows 的虚拟机扩展安装适用于 Windows 的 Log Analytics 代理。For Azure VMs, install the Log Analytics agent for Windows using the virtual machine extension for Windows. 该扩展使用 Azure 资源管理器模板或 PowerShell 在 Azure 虚拟机上安装 Log Analytics 代理,并将虚拟机注册到现有的 Log Analytics 工作区中。The extension installs the Log Analytics agent on Azure virtual machines, and enrolls virtual machines into an existing Log Analytics workspace using an Azure Resource Manager template or PowerShell. 安装代理后,可以将 VM 添加到自动化帐户中的混合 Runbook 辅助角色组。Once the agent is installed, the VM can be added to a Hybrid Runbook Worker group in your Automation account.

  • 对于非 Azure VM,请使用将 Windows 计算机连接到 Azure Monitor 一文中所述的部署选项安装适用于 Windows 的 Log Analytics 代理。For non-Azure VMs, install the Log Analytics agent for Windows using the deployment options described in the Connect Windows computers to Azure Monitor article. 可对多台计算机重复此过程,将多个辅助角色添加到你的环境。You can repeat this process for multiple machine to add multiple workers to your environment. 安装代理后,可将 VM 添加到自动化帐户中的混合 Runbook 辅助角色组。Once the agent is installed, the VMs can be added to a Hybrid Runbook Worker group in your Automation account.

  • 请使用提供的 PowerShell 脚本将一台或多台 Windows 计算机的配置过程完全自动化Use a provided PowerShell script to completely automate the process of configuring one or more Windows machines. 对于数据中心或其他云环境中的计算机,建议使用此方法。This is the recommended method for machines in your datacenter or another cloud environment.

自动化部署Automated deployment

在目标计算机上执行以下步骤,使用 PowerShell 脚本 New-OnPremiseHybridWorker.ps1 实现 Windows 混合辅助角色安装和配置的自动化。On the target machine, perform the following steps to automate the installation and configuration of the Windows Hybrid Worker role using the PowerShell script New-OnPremiseHybridWorker.ps1. 此脚本会执行以下步骤:The script performs the following steps:

  • 安装所需的模块Installs the necessary modules
  • 使用 Azure 帐户登录Signs in with your Azure account
  • 验证是否存在指定的资源组和自动化帐户Verifies the existence of specified resource group and Automation account
  • 创建对自动化帐户属性的引用Creates references to Automation account attributes
  • 如果未指定,请创建 Azure Monitor Log Analytics 工作区Creates an Azure Monitor Log Analytics workspace if not specified
  • 在工作区中启用 Azure 自动化解决方案Enable the Azure Automation solution in the workspace
  • 下载并安装适用于 Windows 的 Log Analytics 代理Download and install the Log Analytics agent for Windows
  • 将计算机注册为混合 Runbook 辅助角色Register the machine as Hybrid Runbook Worker

步骤 1 - 下载 PowerShell 脚本Step 1 - Download the PowerShell script

PowerShell 库下载 New-OnPremiseHybridWorker.ps1 脚本。Download the New-OnPremiseHybridWorker.ps1 script from the PowerShell Gallery. 下载该脚本后,在目标计算机上复制或运行它。After you have downloaded the script, copy or run it on the target machine. 在执行期间,New-OnPremiseHybridWorker.ps1 脚本使用以下参数。The New-OnPremiseHybridWorker.ps1 script uses the parameters described below during execution.

参数Parameter 状态Status 说明Description
AAResourceGroupName 必需Mandatory 与自动化帐户关联的资源组的名称。The name of the resource group that's associated with your Automation account.
AutomationAccountName 必需Mandatory 自动化帐户的名称。The name of your Automation account.
Credential 可选Optional 登录到 Azure 环境时要使用的凭据。The credentials to use when logging in to the Azure environment.
HybridGroupName 必需Mandatory 混合 Runbook 辅助角色组的名称,可将其指定为支持此方案的 runbook 的目标。The name of a Hybrid Runbook Worker group that you specify as a target for the runbooks that support this scenario.
OMSResourceGroupName 可选Optional Log Analytics 工作区的资源组的名称。The name of the resource group for the Log Analytics workspace. 如果未指定此资源组,则使用 AAResourceGroupName 的值。If this resource group is not specified, the value of AAResourceGroupName is used.
SubscriptionID 必需Mandatory 与自动化帐户关联的 Azure 订阅的标识符。The identifier of the Azure subscription associated with your Automation account.
TenantID 可选Optional 与自动化帐户关联的租户组织的标识符。The identifier of the tenant organization associated with your Automation account.
WorkspaceName 可选Optional Log Analytics 工作区名称。The Log Analytics workspace name. 如果没有 Log Analytics 工作区,该脚本会创建并配置一个。If you don't have a Log Analytics workspace, the script creates and configures one.

步骤 2 - 打开 Windows PowerShell 命令行 shellStep 2 - Open Windows PowerShell command line shell

在开始菜单中单击“启动”,键入 PowerShell,右键单击“Windows PowerShell”,然后单击“以管理员身份运行” 。From the Start Menu click Start, type PowerShell, right-click Windows PowerShell, and then click Run as administrator.

步骤 3 - 运行 PowerShell 脚本Step 3 - Run the PowerShell script

在 PowerShell 命令行 shell 中,浏览到包含已下载脚本的文件夹。In the PowerShell command line shell, browse to the folder that contains the script that you have downloaded. 更改参数 AutomationAccountNameAAResourceGroupNameOMSResourceGroupNameHybridGroupNameSubscriptionIDWorkspaceName 的值。Change the values for the parameters AutomationAccountName, AAResourceGroupName, OMSResourceGroupName, HybridGroupName, SubscriptionID, and WorkspaceName. 然后运行脚本。Then run the script.

运行脚本后,系统会提示在 Azure 上进行身份验证。You're prompted to authenticate with Azure after you run the script. 必须以订阅管理员角色成员和订阅共同管理员的帐户登录。You must sign in with an account that's a member of the Subscription Admins role and co-administrator of the subscription.

$NewOnPremiseHybridWorkerParameters = @{
  AutomationAccountName = <nameOfAutomationAccount>
  AAResourceGroupName   = <nameOfResourceGroup>
  OMSResourceGroupName  = <nameOfResourceGroup>
  HybridGroupName       = <nameOfHRWGroup>
  SubscriptionID        = <subscriptionId>
  WorkspaceName         = <nameOfLogAnalyticsWorkspace>
}
.\New-OnPremiseHybridWorker.ps1 @NewOnPremiseHybridWorkerParameters

步骤 4 - 安装 NuGetStep 4 - Install NuGet

系统会提示用户同意安装 NuGet 并使用 Azure 凭据进行身份验证。You're prompted to agree to install NuGet, and to authenticate with your Azure credentials. 如果没有最新的 NuGet 版本,可从可用的 NuGet 发行版下载。If you don't have the latest NuGet version, you can download it from Available NuGet Distribution Versions.

步骤 5 - 验证部署Step 5 - Verify the deployment

脚本完成后,自动化帐户中的“混合辅助角色组”页面会显示新组和成员数。After the script is finished, the Hybrid Worker Groups page in your Automation account shows the new group and the number of members. 如果这是现有的组,则成员数会递增。If it's an existing group, the number of members is incremented. 可以从“混合辅助角色组”页上的列表中选择组,并选择“混合辅助角色”磁贴。You can select the group from the list on the Hybrid Worker Groups page and choose the Hybrid Workers tile. 在“混合辅助角色”页上,会列出组的每个成员。On the Hybrid Workers page, you can see each member of the group listed.

手动部署Manual deployment

若要安装和配置 Windows 混合 Runbook 辅助角色,请执行以下步骤。To install and configure a Windows Hybrid Runbook Worker, perform the following steps.

步骤 1 - 验证代理是否向工作区报告Step 1 - Verify agent is reporting to workspace

适用于 Windows 的 Log Analytics 代理会将计算机连接到 Azure Monitor Log Analytics 工作区。The Log Analytics agent for Windows connects machines to an Azure Monitor Log Analytics workspace. 在计算机上安装代理并将其连接到工作区时,代理会自动下载混合 Runbook 辅助角色所需的组件。When you install the agent on your machine and connect it to your workspace, it automatically downloads the components that are required for the Hybrid Runbook Worker.

几分钟后,如果代理已成功连接到 Log Analytics 工作区,则可以运行以下查询,验证是否正在向工作区发送检测信号数据。When the agent has successfully connected to your Log Analytics workspace after a few minutes, you can run the following query to verify that it is sending heartbeat data to the workspace.

Heartbeat 
| where Category == "Direct Agent"
| where TimeGenerated > ago(30m)

在搜索结果中,应会看到计算机的检测信号记录,它们指示计算机已连接到服务并将该结果报告给服务。In the search results, you should see heartbeat records for the machine, indicating that it is connected and reporting to the service. 默认情况下,每个代理都会将检测信号记录转发到其分配的工作区。By default, every agent forwards a heartbeat record to its assigned workspace. 按照以下步骤可完成代理安装和设置。Use the following steps to complete the agent installation and setup.

  1. 启用该功能以添加代理计算机。Enable the feature to add the agent machine. 对于更新管理和 Azure VM,请参阅从自动化帐户启用更新管理从 Azure VM 启用更新管理For Update Management and Azure VMs, see Enable Update Management from an Automation account, or Enable Update Management from an Azure VM.

  2. 要确认混合 Runbook 辅助角色的版本,请浏览到 C:\Program Files\Microsoft Monitoring Agent\Agent\AzureAutomation\ 并注意 version 子文件夹。To confirm the version of the Hybrid Runbook Worker, browse to C:\Program Files\Microsoft Monitoring Agent\Agent\AzureAutomation\ and note the version subfolder.

步骤 2 - 安装 Runbook 环境并连接到 Azure 自动化Step 2 - Install the runbook environment and connect to Azure Automation

将代理配置为向 Log Analytics 工作区报告时,Azure 自动化功能会向下推送 HybridRegistration PowerShell 模块,其中包含 Add-HybridRunbookWorker cmdlet。When you configure an agent to report to a Log Analytics workspace, the Azure Automation feature pushes down the HybridRegistration PowerShell module, which contains the Add-HybridRunbookWorker cmdlet. 使用此 cmdlet 将 Runbook 环境安装到计算机上,并将其注册到 Azure 自动化。Use this cmdlet to install the runbook environment on the machine and register it with Azure Automation.

在管理员模式下打开 PowerShell 会话,并运行以下命令以导入模块。Open a PowerShell session in Administrator mode and run the following commands to import the module.

cd "C:\Program Files\Microsoft Monitoring Agent\Agent\AzureAutomation\<version>\HybridRegistration"
Import-Module .\HybridRegistration.psd1

现在,使用以下语法运行 Add-HybridRunbookWorker cmdlet。Now run the Add-HybridRunbookWorker cmdlet using the following syntax.

Add-HybridRunbookWorker –GroupName <String> -Url <Url> -Key <String>

你可从自动化帐户中的“密钥”页面获取参数 UrlKey 所需的信息。You can get the information required for the parameters Url and Key from the Keys page in your Automation account. 从页面左侧的“帐户设置”部分下,选择“密钥” 。Select Keys under the Account settings section from the left-hand side of the page.

“管理密钥”页

  • 对于 Url 参数,复制 URL 的值。For the Url parameter, copy the value for URL.

  • 对于 Key 参数,复制主访问密钥的值。For the Key parameter, copy the value for PRIMARY ACCESS KEY.

  • 对于 GroupName 参数,请使用混合 Runbook 辅助角色组的名称。For the GroupName parameter, use the name of the Hybrid Runbook Worker group. 如果自动化帐户中已存在该组,则会将当前计算机添加到其中。If this group already exists in the Automation account, the current machine is added to it. 如果该组不存在,则将添加该组。If this group doesn't exist, it's added.

  • 如果需要,请设置 Verbose 参数以接收有关安装的详细信息。If required, set the Verbose parameter to receive details about the installation.

步骤 3- 安装 PowerShell 模块Step 3 - Install PowerShell modules

Runbook 可以使用在 Azure 自动化环境中安装的模块中定义的任何活动和 cmdlet。Runbooks can use any of the activities and cmdlets defined in the modules installed in your Azure Automation environment. 这些模块不会自动部署到本地计算机,必须手动安装。As these modules are not automatically deployed to on-premises machines, you must install them manually. 例外情况是 Azure 模块。The exception is the Azure module. 此模块是默认安装的,并可用于访问所有 Azure 服务的 cmdlet 以及 Azure 自动化的活动。This module is installed by default and provides access to cmdlets for all Azure services and activities for Azure Automation.

由于混合 Runbook 辅助角色的主要用途是管理本地资源,很可能需要安装支持这些资源的模块,尤其是 PowerShellGet 模块。Because the primary purpose of the Hybrid Runbook Worker is to manage local resources, you most likely need to install the modules that support these resources, particularly the PowerShellGet module. 有关安装 Windows PowerShell 模块的信息,请参阅 Windows PowerShellFor information on installing Windows PowerShell modules, see Windows PowerShell.

安装的模块必须位于 PSModulePath 环境变量所引用的位置,以便混合辅助角色自动将其导入。Modules that are installed must be in a location referenced by the PSModulePath environment variable so that the hybrid worker can automatically import them. 有关详细信息,请参阅在 PSModulePath 中安装模块For more information, see Install Modules in PSModulePath.

从本地 Windows 计算机中删除混合 Runbook 辅助角色Remove the Hybrid Runbook Worker from an on-premises Windows machine

  1. 在 Azure 门户中,转到自动化帐户。In the Azure portal, go to your Automation account.

  2. 在“帐户设置”下,选择“密钥”并记下“URL”和“主访问密钥”的值 。Under Account Settings, select Keys and note the values for URL and Primary Access Key.

  3. 在管理员模式下打开 PowerShell 会话,并使用 URL 和主访问密钥值运行以下命令。Open a PowerShell session in Administrator mode and run the following command with your URL and primary access key values. 可使用 Verbose 参数获取删除过程的详细日志。Use the Verbose parameter for a detailed log of the removal process. 若要从混合辅助角色组中删除过时的计算机,请使用可选的 machineName 参数。To remove stale machines from your Hybrid Worker group, use the optional machineName parameter.

Remove-HybridRunbookWorker -Url <URL> -Key <primaryAccessKey> -MachineName <computerName>

删除混合辅助角色组Remove a Hybrid Worker group

若要删除混合 Runbook 辅助角色组,首先需要从每台计算机上删除该组中包含的混合 Runbook 辅助角色。To remove a Hybrid Runbook Worker group, you first need to remove the Hybrid Runbook Worker from every machine that is a member of the group. 然后,使用以下步骤删除该组:Then use the following steps to remove the group:

  1. 在 Azure 门户中打开自动化帐户。Open the Automation account in the Azure portal.

  2. 在“流程自动化”下选择“混合辅助角色组”。Select Hybrid worker groups under Process Automation. 选择要删除的组。Select the group that you want to delete. 将显示该组的属性页。The properties page for that group appears.

    “属性”页

  3. 在所选组的属性页中,选择“删除”。On the properties page for the selected group, select Delete. 系统会显示一条消息,要求确认此操作。A message asks you to confirm this action. 如果确定要继续,请选择“是”。Select Yes if you're sure that you want to continue.

    确认消息

    完成此过程可能需要数秒钟的时间。This process can take several seconds to finish. 可以在菜单中的“通知”下面跟踪操作进度。You can track its progress under Notifications from the menu.

后续步骤Next steps