Microsoft AZURE Setup


 I created a trial Microsoft AZURE account for testing.
 In that I created a Virtual Machine running Windows 2012 R2 Server as a domain controller.  I have been setting up on-premises File Server boxes only; therefore I am new to this. With that I just have some questions and let me ask one at a time.

 So far:
 - I spun up Windows 2012 VM and installed Active Directory with DNS service.
 - Create three user accounts in AD.

 Here is 1st question:
 (1) In on-premises File Server system, you join Windows 7 workstation to the domain and log in to the domain using your account which runs login script (for drive mapping .. etc). Then the user sees the desktop screen with application icons & printers. So you access files/folders via map drives (F, G .. etc) and print.
  How does this work in AZURE Cloud system?  Windows 7 OS is not an option in when creating a new VM. If I can't create a virtual machine running Windows 7 or 8, how do users log in to the W2012/VM? What is the process?



      How do
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Cliff GaliherCommented:
You can create a VPN tunnel between Azure and your on-premises network. Then you can join local workstations to the domain. This works very much like on-premises AD networks with multiple sites. Just think of azure as another site and define it that way in AD sites and services.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
sgleeAuthor Commented:
"create a VPN tunnel between Azure and your on-premises network" --> Is this a constant VPN between on-premises network and Azure? If this is the case, then I need a new router (at my customer site) that is capable of doing a VPN.
Or can I create MS VPN on each user workstation?
Cliff GaliherCommented:
Since we are talking about Active Directory and the workstation needs to see the DC *before* login, it needs to be a site-to-site VPN, not per workstation. It'll be a constant connection. It also means you have a single point of failure.

There are situations where putting a DC in Azure makes sense. But given that you don't have a router in place, and it sounds like it'll be a single connection, when you take into account the latency issues, the single point of failure, and a few other considerations, I'd recommend rethinking this course of action. I don't think a DC in Azure is a good fit for this situation.
Determine the Perfect Price for Your IT Services

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden with our free interactive tool and use it to determine the right price for your IT services. Download your free eBook now!

sgleeAuthor Commented:
TCPIP on DC in CloudI have set up a VPN router like Linksys/CISCO RV042 which was simple. I could have CISCO 1811 and have it configured for me. But I did not realize MS Azure would require such a setup.

I originally imagined that I would create a multiple VMs (Windows 2012 as DC and several Windows 7 or 8 VMs in Azure. Then each user would log into their respective VM using remote desktop connection program.

 So If I understand Azure correctly, you only create servers like DC or APP Servers. And then users are actually using their own workstation PCs to connect to share folders from DC or App serves that reside in the cloud?
 If that is the case, you are correct. The user network would need constant VPN connection with Microsoft cloud system. I posted IPv4 properties from the DC. So I would need to create a VPN tunnel based on IP information above?
You could do a site to site vpn on your file server and that should allow you to do things as if your active directory is local (also gives ability for the file server to have domain permissions and security on file shared also)

You could do the vpn on clients, but

 if the clients lost their passwords or another user who had not logged on before need to log on to domain, you will have to do a special setup like logon to WiFi before logon, plus allows ras before logon etc..
Cliff GaliherCommented:
"I originally imagined that I would create a multiple VMs (Windows 2012 as DC and several Windows 7 or 8 VMs in Azure. Then each user would log into their respective VM using remote desktop connection program."

That type of setup is called VDI and is not allowed with Azure. In fact, Microsoft does not offer desktops via SPLA so there Is no legal way to have a hosted VM like you describe with any provider. So this limitation is not just Azure.

Regarding creating the VPN tunnel, no, you would not use the information above. You actually need to create the VPN through the Azure portal, not within the VM. This is because of how Azure virtualizes the network. Like I said, setting up Azure for this kind of use is not trivial (and it'll be expensive.)
sgleeAuthor Commented:
I know of a customer who uses remote desktop (on workstation PC) to connect to the terminal server of the "cloud" provider. Once connected, each user sees their desktop where Word/Excel/Outlook/QuickBooks/IE plus any other business apps.
They pay about $600 per month and I thought Microsoft Azure is something like that.

Again I thought that, in Azure, if I can't create Win7 VMs, I can create another Windows 2012 VM and add  Remote Desktop Service/Terminal Service role and let each user log in to that terminal server using remote desktop connection using 3389 or 3390.

If AZURE requires constant VPN connection, what happens if you travel and need to run QuickBooks off the cloud server then?
Cliff GaliherCommented:
No, azure is nothing like a cloud-based VDI solution.

Azure does not require a constant VPN connection, nor have I ever said it does. But if you have a domain controller in azure and you want client machines to be able to log in using that DC, *that* requires a VPN connection. This is not unique to azure. If a company has two offices, one in Seattle, and one in New York, and you only have a DC in Seattle, New York would need a network connection (VPN, etch) to Seattle for machines to access the DC. Azure is no different.

You cannot have win7/8 VMs in azure. But you can set up an RDS server. You'll need RDS CALs and will need to setup up all the RDS stuff to make it work. Multiple VMs. And yes, you can open it up so you can access it from any client on the internet. That isn't very secure, but it is doable.
sgleeAuthor Commented:
 How would you do it if the goal was to move all the data to the cloud so that you have connect to the cloud system to run Word/Excel/Outlook/QuickBooks and other business apps no matter where you are around the world?
 On-premises file server system is NOT an option. This business already has a VPN router where there is a VPN tunnel between two offices.

  VPN as I have experienced is a slow connection. That is the reason I am surprised.
  Based on my experience, Terminal Server solution provides the fastest experience to the users. Maybe I need to look for VDI solution provider.

 I can set up Terminal and App Server in my shop for this customer (they only have 4 users). But I don't have extra power generator or system redundancy, I can't host mission critical data or apps in my shop and that was the reason I was looking to use Microsoft.
Cliff GaliherCommented:
I am not in the habit of providing my consulting services for free. If you have a specific question about azure, I will answer it. But asking me to plan out an entire solution is well beyond what I (or most other experts here) will do.
sgleeAuthor Commented:

Thanks for your help.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Cloud Computing

From novice to tech pro — start learning today.