Azure Stack Hub 操作员访问工作站Azure Stack Hub Operator Access Workstation

• 12/07/2020
• • W

操作员访问工作站 (OAW) 用于在运行版本2005 或更高版本的硬件生命周期主机 (HLH) 上部署 jumpbox 虚拟机 (VM)，以便 Azure Stack Hub 操作员可以访问特权终结点 (PEP) 和管理员门户以了解支持方案。The Operator Access Workstation (OAW) is used to deploy a jump box virtual machine (VM) on a Hardware Lifecycle Host (HLH) that runs version 2005 or later so an Azure Stack Hub operator can access the privileged endpoint (PEP) and the Administrator portal for support scenarios.

当操作员执行新任务时，应创建 OAW VM。The OAW VM should be created when an operator performs a new task. VM 内的必需任务完成之后，应关闭并删除 VM，因为 Azure Stack Hub 不需要始终运行它。After a required task inside the VM is completed, the VM should be shut down and removed as Azure Stack Hub doesn't need to always run it.

OAW 方案OAW scenarios

下表列出了 OAW 的常见方案，但这不是独有的。The following tables lists common scenarios for the OAW, but this is not exclusive. 建议使用远程桌面连接到 OAW。It is recommended to use Remote Desktop to connect to the OAW.

下载文件Download files

若要获取文件以创建 OAW VM，请在此处下载。To get the files to create the OAW VM, download here. 下载之前，请务必查看 Azure 隐私声明和法律条款。Please be sure to review the Azure Privacy Statement and Legal Terms prior to download.

由于解决方案的无状态性质，没有适用于 OAW VM 的更新。Due to the stateless nature of the solution, there are no updates for the OAW VM. 对于每个里程碑，都会发行 VM 映像文件的新版本。For each milestone, a new version of the VM image file will be released. 使用最新版本创建新 OAW VM。Use the latest version to create a new OAW VM. 映像文件基于最新 Windows Server 2019 版本。The image file is based on the latest Windows Server 2019 version. 安装之后，可以使用 Windows 更新来应用更新（包括所有关键更新）。After installation, you can apply updates, including any critical updates, using Windows Update.

验证下载的 OAW.zip 文件的哈希，以确保在使用它创建 OAW VM 之前未对它进行修改。Validate the hash of the downloaded OAW.zip file to make sure it has not been modified before using it to create the OAW VM. 运行下面的 PowerShell 脚本。Run the following PowerShell script. 如果返回值为 True，则可以使用下载的 OAW.zip：If the return value is True, you can use the downloaded OAW.zip:

param(
    [Parameter(Mandatory=$True)]
    [ValidateNotNullOrEmpty()]
    [ValidateScript({Test-Path $_ -PathType Leaf})]
    [string]
    $DownloadedOAWZipFilePath
)

$expectedHash = '459D8BA232E4315372FCE7CDD705057D051C1BD60772FC36E0136C741C27A273'
$actualHash = (Get-FileHash -Path $DownloadedOAWZipFilePath).Hash

Write-Host "Expected hash: $expectedHash"

if ($expectedHash -eq $actualHash)
{
    Write-Host 'SUCCESS: OAW.zip file hash matches.'
}
else
{
    Write-Error 'ERROR: OAW.zip file hash does not match! It is not safe to use it, please download it again.'
    Write-Error "Actual hash: $actualHash"
}

用户帐户策略User account policy

以下用户帐户策略会应用于 OAW VM：The following user account policy is applied to the OAW VM:

• 内置管理员用户名：AdminUserBuilt-in Administrator username: AdminUser
• MinimumPasswordLength = 14MinimumPasswordLength = 14
• PasswordComplexity 已启用PasswordComplexity is enabled
• MinimumPasswordAge = 1（天）MinimumPasswordAge = 1 (day)
• MaximumPasswordAge = 42（天）MaximumPasswordAge = 42 (days)
• NewGuestName = GUser（默认情况下禁用）NewGuestName = GUser (disabled by default)

预安装的软件Pre-installed software

下表列出 OAW VM 上的预安装软件。The following table lists the pre-installed software on the OAW VM.

检查 HLH 版本Check HLH version

1. 使用凭据登录 HLH。Log onto the HLH with your credentials.

2. 打开 PowerShell ISE 并运行以下脚本：Open PowerShell ISE and run the following script:

   'C:\Version\Get-Version.ps1'
   

   例如：For example:

   

使用脚本创建 OAW VMCreate the OAW VM using a script

以下脚本准备好虚拟机以作为操作员访问工作站 (OAW)，它用于 Azure Stack Hub 以进行管理和诊断。The following script prepares the virtual machine as the Operator Access Workstation (OAW), which is used to access Azure Stack Hub for administration and diagnostics.

1. 使用凭据登录 HLH。Log onto the HLH with your credentials.
2. 下载 OAW.zip 并提取文件。Download OAW.zip and extract the files.
3. 打开提升的 PowerShell 会话。Open an elevated PowerShell session.
4. 导航到 OAW.zip 文件的已提取内容。Navigate to the extracted contents of the OAW.zip file.
5. 运行 New-OAW.ps1 脚本。Run the New-OAW.ps1 script.

例如，若要使用 Azure Stack Hub 版本 2005 或更高版本在 HLH 上创建 OAW VM 而不进行任何自定义，请只使用 -LocalAdministratorPassword 参数运行 New-OAW.ps1 脚本：For example, to create the OAW VM on the HLH without any customization using Azure Stack Hub version 2005 or later, run the New-OAW.ps1 script with only the -LocalAdministratorPassword parameter:

$securePassword = Read-Host -Prompt "Enter password for Azure Stack OAW's local administrator" -AsSecureString
New-OAW.ps1 -LocalAdministratorPassword $securePassword  

若要在具有与 Azure Stack Hub 的网络连接的主机上创建 OAW VM：To create the OAW VM on a host with network connection to Azure Stack Hub:

$securePassword = Read-Host -Prompt "Enter password for Azure Stack OAW's local administrator" -AsSecureString
New-OAW.ps1 -LocalAdministratorPassword $securePassword `
   -IPAddress '192.168.0.20' `
   -SubnetMask '255.255.255.0' `
   -DefaultGateway '192.168.0.1' `
   -DNS '192.168.0.10'

若要从 AzureStackStampInformation.json 文件检索 ERCS VM 的 IP 地址，请执行以下代码：To retrieve the IP address of the ERCS VM from the AzureStackStampInformation.json file:

$securePassword = Read-Host -Prompt "Enter password for Azure Stack OAW's local administrator" -AsSecureString
New-OAW.ps1 -LocalAdministratorPassword $securePassword `
   -AzureStackCertificatePath 'F:\certroot.cer' `
   -DeploymentDataFilePath 'F:\DeploymentData.json' `
   -AzSStampInfoFilePath 'F:\AzureStackStampInformation.json'

若要使用 DeploymentData.json 在 HLH 上创建 OAW VM：To create the OAW VM on the HLH with DeploymentData.json:

$securePassword = Read-Host -Prompt "Enter password for Azure Stack OAW's local administrator" -AsSecureString
New-OAW.ps1 -LocalAdministratorPassword $securePassword `
   -DeploymentDataFilePath 'D:\AzureStack\DeploymentData.json'

如果 DeploymentData.json 文件包含 OAW VM 的命名前缀，则该值将用于 VirtualMachineName 参数。If the DeploymentData.json file includes the Naming Prefix for OAW VM, that value will be used for the VirtualMachineName parameter. 否则，默认名称是 AzSOAW 或用户指定的任何名称。Otherwise, the default name is AzSOAW or whatever name specified is by the user.

New-OAW 可以使用两个参数集。Two parameter sets are available for New-OAW. 可选参数显示在括号中。Optional parameters are shown in brackets.

New-OAW 
-LocalAdministratorPassword <Security.SecureString> `
[-AzureStackCertificatePath <String>] `
[-AzSStampInfoFilePath <String>] `
[-CertificatePassword <Security.SecureString>] `
[-ERCSVMIP <String[]>] `
[-DNS <String[]>] `
[-DeploymentDataFilePath <String>] `
[-SkipNetworkConfiguration] `
[-ImageFilePath <String>] `
[-VirtualMachineName <String>] `
[-VirtualMachineMemory <int64>] `
[-VirtualProcessorCount <int>] `
[-VirtualMachineDiffDiskPath <String>] `
[-PhysicalAdapterMACAddress <String>] `
[-VirtualSwitchName <String>] `
[-ReCreate] `
[-AsJob] `
[-Passthru] `
[-WhatIf] `
[-Confirm] `
[<CommonParameters>]

New-OAW
-LocalAdministratorPassword <Security.SecureString> `
-IPAddress <String> `
-SubnetMask <String> `
-DefaultGateway <String> `
-DNS <String[]> `
[-AzureStackCertificatePath <String>] `
[-AzSStampInfoFilePath <String>] `
[-CertificatePassword <Security.SecureString>] `
[-ERCSVMIP <String[]>] `
[-ImageFilePath <String>] `
[-VirtualMachineName <String>] `
[-VirtualMachineMemory <int64>] `
[-VirtualProcessorCount <int>] `
[-VirtualMachineDiffDiskPath <String>] `
[-PhysicalAdapterMACAddress <String>] `
[-VirtualSwitchName <String>] `
[-ReCreate] `
[-AsJob] `
[-Passthru] `
[-WhatIf] `
[-Confirm] `
[<CommonParameters>]

下表列出了每个参数的定义。The following table lists the definition for each parameter.

检查 OAW VM 版本Check the OAW VM version

1. 使用凭据登录 OAW VM。Log onto the OAW VM with your credentials.

2. 打开 PowerShell ISE 并运行以下脚本：Open PowerShell ISE and run the following script:

   'C:\Version\Get-Version.ps1'
   

   例如：For example:

   

在 HLH 与 OAW 之间传输文件Transfer files between the HLH and OAW

如果需要在 HLH 与 OAW 之间传输文件，请使用 New-SmbShare cmdlet 创建 SMB 共享。If you need to transfer files between the HLH and the OAW, create an SMB share by using the New-SmbShare cmdlet. New-SmbShare 会将文件系统文件夹作为服务器消息块 (SMB) 共享公开给远程客户端。New-SmbShare exposes a file system folder to remote clients as a Server Message Block (SMB) share. 例如：For example:

若要删除通过此 cmdlet 创建的共享，请使用 Remove-SmbShare cmdlet。To delete a share that was created by this cmdlet, use the Remove-SmbShare cmdlet. 例如：For example:

删除 OAW VMRemove the OAW VM

以下脚本会删除用于访问 Azure Stack Hub 以进行管理和诊断的 OAW VM。The following script removes the OAW VM, which is used to access Azure Stack Hub for administration and diagnostics. 此脚本还会删除与 VM 关联的磁盘文件和保护者。This script also removes the disk files and the guardian associated with the VM.

1. 使用凭据登录 HLH。Log onto the HLH with your credentials.

2. 打开提升的 PowerShell 会话。Open an elevated PowerShell session.

3. 导航到已安装 OAW.zip 文件的已提取内容。Navigate to the extracted contents of the installed OAW.zip file.

4. 通过运行 Remove-OAW.ps1 脚本来删除 VM：Remove the VM by running the Remove-OAW.ps1 script:

   Remove-OAW.ps1 -VirtualMachineName <name>
   

   其中 <name> 是要删除的虚拟机的名称。Where <name> is the name of the virtual machine to be removed. 默认情况下，名称是 AzSOAW。By default, the name is AzSOAW.

   例如：For example:

   Remove-OAW.ps1 -VirtualMachineName AzSOAW
   

后续步骤Next steps

Azure Stack 管理任务Azure Stack Management Tasks