Red Cloud Windows Instances

Windows Instances can be created and maintained on Red Cloud using the OpenStack Web Interface. This documentation assumes a basic understanding of OpenStack, so please review that page as needed.

Creating A New Windows Instance

Currently Red Cloud offers VM images running the following versions of Windows:

  • Windows Server 2022
  • Windows Server 2019
  • Windows Server 2016

Steps

  1. Log in to the OpenStack Web Interface (check out how to log in if you need to)
  2. If you have not already, create a key pair
  3. If you have not already, create a security group. Note that your security group should include the inbound RDP port (3389) rule from at least your current IP address so you can connect to it.
  4. Optional: Set Up a Private Network
  5. Select Launch Instance from the Instances page
  6. Follow the instructions about launching a new instance, and select one of the Windows images under the Source tab
  7. Optional: Create and attach a Volume
  8. Optional: Associate a Floating IP address

NOTE:

Now that you have created and launched an instance, your next steps will be to connect to it and set up a new user account. See the To Do On First Login section for more information on how to set up a new user, update, and other useful information. Also, consult the Working with Windows Instances section.

Accessing Instances

  • Windows instances are accessible via the Remote Desktop Protocol. You can then log in to the Windows instance using Microsoft's Remote Desktop program for Windows or Mac, or with rdesktop for Linux. The name of the computer in Red Cloud is simply the public IP address of the instance (e.g., 128.84.8.42).
  • Make sure your security group allows access to RDP port (3389) from your current IP address.
  • Connect to Windows - This page details how to connect to Windows Instances using remote desktop.

Initial access for new instance setup

The first time you start a Windows instance it may take 5 minutes or more from pushing the start button until you can connect to it. The dashboard may say that your instance is in the Running state, but it may not yet be accepting connections. You can click the instance name in the instances list and look at the Console tab to monitor the graphical dashboard as Windows is initialized.

To log in to a Windows instance that is not based on a CCSS image:

  • In the Red Cloud dashboard, use the instance's dropdown menu to select Retrieve Password.

  • Follow the additional steps to convert Private Key File to PEM format.

  • Select your Private Key File in PEM format (that you created when you created a Key Pair) and select Decrypt Password. The password for the user named "Administrator" will be displayed. You can save this password somewhere secure so that you do not need to retrieve it again for this instance.

  • Use the username "Administrator" and this password when connecting via Remote Desktop.
  • Once logged in as Administrator, you can create additional local accounts. For more information, see the Create New Users section below.

To log in to a Windows instance that is based on a CCSS image:

  • Use your CCSS login credentials when connecting via Remote Desktop.
  • It is not recommended that you create local user accounts when the instance is based on a CCSS image.

After user accounts are setup

  • You will probably need to be connected to the Cornell VPN in order to connect to the instance unless it was specifically configured to allow non-Cornell access.
  • The username and password to connect via Remote Desktop will correspond to the user accounts created on the Windows Server during or after the initial connection and server setup. Though your netID may be used for both your CAC and Windows server account name, these accounts are distinct --- the Windows account will not use your CAC password.

To Do On First Login

After you have launched a Windows Instance, there are a few recommended steps you take when you first log in, which are included in the below sections: Create New Users, Windows Activation, and Security and Updates. The For Convenience section should also be considered as helpful suggestions, but not essential.

Create New Users

If desired, create one or more new local accounts on the instance. Doing this will allow different users to have their own home directories and settings on the instance and provide a friendlier login experience. You can create accounts for users and administrators on a Red Cloud-hosted Windows Server instance using the account management tools in the Windows Server OS. In general, only accounts for those users who will install software and manage the instance should have administrative privileges. Even project personnel with administrative access should consider creating and using a separate non-administrator user account for non-administrator tasks.

Create user accounts

  1. Go to Control Panel and follow this sequence of links: User Accounts, User Accounts, Manage another account.
    • The heading will show Control Panel > User Accounts > User Accounts > Manage Accounts.
  2. Create accounts for all desired users using Cornell NetIDs as the username.
    • Click "Add a user account"
    • Assign a temporary password, such as "ur2.Change.Me" and securely communicate this password to the user.
    • The password complexity requirements stipulate that passwords must contain capital and lowercase letters, numerals and special characters.

Promote user to administrator (most users should not be administrators)

  1. Only if this account should have administrator privileges:
    • Click the newly created account in the Control Panel > User Accounts > User Accounts > Manage Accounts
    • Click "Change the account type"
    • Click the radio button for "Administrator"

Allow Remote Desktop access for users without administrator privileges

  1. Only if you have users without administrator privileges:
    • Go to Control Panel, click on System and Security, and click on System.
    • In the new window, find and click on Remote Desktop to the left.
    • On this page, find and click on "Select users that can remotely access this PC".
    • A new window called Remote Desktop Users should appear. Click on the button that reads "Add...".
    • A new window called Select Users now appears. In the text box under "Enter the object names to select:", type in "Local account" and hit enter. In a new window called Multiple Names Found, double-click on "Local account".
    • You should now see the window titled Remote Desktop Users. The white box should have a line that reads "NY AUTHORITY\Local account". Your users without administrator privileges can now connect with Remote Desktop.

Windows Activation

The Windows instance is not activated by default, but it can be done for free through Cornell. Cornell provides Windows license keys to members of its community via a server. You must tell Windows which server to use and then ask it to go get a license. If you attempt to activate Windows without using a Cornell license, you will most likely receive the following error: Activation Error: Code 0x8007232b. To avoid this, follow these steps (which are also documented at the CIT website:

  • On the Windows instance, open a command prompt (cmd) as Administrator and switch to the system32 folder:
    cd \Windows\system32
  • Enter the following command to specify the server you will use for activation:
    cscript slmgr.vbs /skms kms02.cit.cornell.edu
  • Enter the following command to activate Windows:
    cscript slmgr.vbs /ato

After you have activated Windows, it does stay activated through stops and starts of an instance.

Note: Please refer to Microsoft support for more information on activating Windows.

Security and Updates

These steps help to keep your system up-to-date and secure, and are strongly recommended.

On Windows Server 2016

  • Turn on Automatic Updates in Settings > Updates & security and Check Updates
  • Turn on Real-time protection in Settings > Updates & security > Windows Defender
  • Open Windows Defender and Update definitions under the Update tab to get the latest virus definitions

On Windows Server 2019/2022

  • Turn on Automatic Updates in Settings > Updates & security and Check Updates
  • Turn on Real-time protection in Settings > Updates & security > Windows Security
  • Open Windows Security and choose "Check for updates" under the "Virus & threat protection"

For Convenience

  • Select "Work Network" when prompted by the network dialog
  • Turn off messages about not having performed a backup in Control Panel > System and Security > Action Center

Working with Windows Instances

Note: Anything installed or stored on the C: drive will be retained. If you want data other than the C: drive kept then use a storage volume.

Creating a Windows instance with a larger C: drive

If you're running Windows, you probably know the C: drive can fill up quickly with Windows security patches, etc. so you may want your Windows instance to have a larger C: drive than the default, which is 30GB. Before proceeding to do this, be sure to check the Red Cloud storage limit for your project.

This may be done in the OpenStack web portal when launching a new instance on the Source tab by setting the Volume size to a larger amount.

OR

If the instance has already been created and is currently running, this may be done by creating a new volume and attaching it to the instance.

Instance Maintenance

All self-managed desktops, laptops, servers, and Red Cloud instances, both Windows and Linux, should be updated with Operating System and Adobe Acrobat Reader critical and security updates on a monthly basis.

  • Open Settings and search for "Check for updates". Click "Check for updates" and verify that you are up to date.
  • If Adobe Reader is installed, open it and click the Help menu bar item. Choose "Check for Updates...".
  • Run updater applications or checks for other third-party software you may have installed on your instance (e.g. Java).

Before rebooting make sure to save all active work. Rebooting will disconnect you from the instance. Wait a minute or two to allow the instance to restart before reconnecting. When you reconnect, you should verify that the updates were applied by repeating step 1.

Initialize and Mount a Volume

WARNING: FILE SYSTEM INITIALIZATION OVERWRITES AND DESTROYS PREVIOUS DATA.

The instructions here are for formatting and mounting attached volumes, though steps like these can only be performed if you have allocated and attached the volume through OpenStack, which can be done while the instance is running.

First, logon to your instance, then follow the steps below for using either a GUI or PowerShell depending on your preference.

GUI

  1. Open command prompt (run as administrator)
  2. Type diskmgmt and press Enter
  3. Right-click on Unknown Disk and select Online
    • Your Unknown Disk may already be Online
  4. Right-click again on Unknown Disk and select Initialize Disk
    • Check Disk you want to add, Check GPT select Next
  5. Right-click on Unallocated Disk (area has a black strip over it), select New Simple Volume
  6. Take all defaults unless you want to change drive letter and/or add volume label
  7. Select Finish
  8. Open File Explorer and verify that the new drive is there

PowerShell

  1. Open PowerShell (run as administrator)
  2. Type the following:
    get-disk #write down number of the offline disk you will need it
Initialize-Disk -Number 1
New-Partition -DiskNumber 1 -UseMaximumSize -AssignDriveLetter #write down the number of the partition number will be using this for formatting
Get-Partition -DiskNumber 1 -PartitionNumber 2 | Format-Volume -FileSystem NTFS -NewFileSystemLabel temp #For New label you can name it whatever you want or you don’t need to add it if you don’t want disk label.

    `

Migrate an Instance to a New Project

Occasionally, you may have an instance in one Red Cloud project that you would like to migrate to a different project. If you have been working in an exploratory project and are transitioning to using a permanent project, you may want to bring along the instances you have created. Or, you may want to share an instance with someone who is working in another project. The steps to perform such migrations are not difficult and can be performed through the Red Cloud (Horizon) web interface.