Merge pull request #109751 from nicolehaugen/SettingWindowsPolicies

How-to article on controlling Windows shutdown behavior

Author: GitHubber17

articles/lab-services/classroom-labs/TOC.yml

@@ -102,6 +102,8 @@
         href: how-to-enable-nested-virtualization-template-vm-using-script.md
     - name: Prepare a Windows template VM
       href: how-to-prepare-windows-template.md
+    - name: Control Windows shutdown behavior
+      href: how-to-windows-shutdown.md
     - name: View support information (instructor)
       href: lab-creator-support-information.md      
   - name: Connect to VMs in classroom labs (student)

articles/lab-services/classroom-labs/how-to-prepare-windows-template.md

@@ -14,10 +14,10 @@ ms.author: enewman
 ---
 # Guide to setting up a Windows template machine in Azure Lab Services
 
-If you’re setting up a Windows 10 template machine for Azure Lab Services, here are some best practices and tips to consider. The configuration steps below are all optional.  However, these preparatory steps could help make your students be more productive, minimize class time interruptions, and ensure that they're using the latest technologies.
+If you're setting up a Windows 10 template machine for Azure Lab Services, here are some best practices and tips to consider. The configuration steps below are all optional.  However, these preparatory steps could help make your students be more productive, minimize class time interruptions, and ensure that they're using the latest technologies.
 
 >[!IMPORTANT]
->This article contains PowerShell snippets to streamline the machine template modification process.  For all the PowerShell scripts shown, you’ll want to run them in Windows PowerShell with administrator privileges. In Windows 10, a quick way of doing that is to right-click the Start Menu and choose the "Windows PowerShell (Admin)".
+>This article contains PowerShell snippets to streamline the machine template modification process.  For all the PowerShell scripts shown, you'll want to run them in Windows PowerShell with administrator privileges. In Windows 10, a quick way of doing that is to right-click the Start Menu and choose the "Windows PowerShell (Admin)".
 
 ## Install and configure OneDrive
 
@@ -61,7 +61,7 @@ If you are on a machine that is not using Active Directory, users can manually m
 
 If your virtual machine is connected to Active Directory, you can set the template machine to automatically prompt your students to move the known folders to OneDrive.  
 
-You’ll need to retrieve your Office Tenant ID first.  For further instructions, see [find your Office 365 Tenant ID](https://docs.microsoft.com/onedrive/find-your-office-365-tenant-id).  You can also get the Office 365 Tenant ID by using the following PowerShell.
+You'll need to retrieve your Office Tenant ID first.  For further instructions, see [find your Office 365 Tenant ID](https://docs.microsoft.com/onedrive/find-your-office-365-tenant-id).  You can also get the Office 365 Tenant ID by using the following PowerShell.
 
 ```powershell
 Install-Module MSOnline -Confirm
@@ -128,7 +128,7 @@ New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\OneDrive\DiskSpaceChec
 
 ### Install Microsoft Office 365
 
-If your template machine needs Office, we recommend installation of Office through the [Office Deployment Tool (ODT)](https://www.microsoft.com/download/details.aspx?id=49117 ). You will need to create a reusable configuration file using the [Office 365 Client Configuration Service](https://config.office.com/) to choose which architecture, what features you’ll need from Office, and how often it updates.
+If your template machine needs Office, we recommend installation of Office through the [Office Deployment Tool (ODT)](https://www.microsoft.com/download/details.aspx?id=49117 ). You will need to create a reusable configuration file using the [Office 365 Client Configuration Service](https://config.office.com/) to choose which architecture, what features you'll need from Office, and how often it updates.
 
 1. Go to [Office 365 Client Configuration Service](https://config.office.com/) and download your own configuration file.
 2. Download [Office Deployment Tool](https://www.microsoft.com/download/details.aspx?id=49117).  Downloaded file will be `setup.exe`.
@@ -180,7 +180,7 @@ We recommend having all Microsoft Store apps be updated to their latest versions
 3. Select **Download** and updates from the drop-down menu.
 4. Click **Get update** button.
 
-You can also use Powershell to update Microsoft Store applications that are already installed.
+You can also use PowerShell to update Microsoft Store applications that are already installed.
 
 ```powershell
 (Get-WmiObject -Namespace "root\cimv2\mdm\dmmap" -Class "MDM_EnterpriseModernAppManagement_AppManagement01").UpdateScanMethod()
@@ -203,7 +203,7 @@ New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AU"
 If you need additional languages installed on the virtual machine, you can add them through the Microsoft Store.
 
 1. Launch Microsoft Store
-2. Search for “language pack”
+2. Search for "language pack"
 3. Choose language to install
 
 If you are already logged on to the template VM, use ["Install language pack" shortcut](ms-settings:regionlanguage?activationSource=SMC-IA-4027670) to go directly to the appropriate settings page.
@@ -229,3 +229,6 @@ Install other apps commonly used for teaching through the Windows Store app. Sug
 ## Conclusion
 
 This article has shown you optional steps to prepare your Windows template VM for an effective class.  Steps include installing OneDrive and installing Office 365, installing the updates for Windows and installing updates for Microsoft Store apps.  We also discussed how to set updates to a schedule that works best for your class.  
+
+## Next steps
+See the article on how to control Windows shutdown behavior to help with managing costs: [Guide to controlling Windows shutdown behavior](how-to-windows-shutdown.md)

articles/lab-services/classroom-labs/how-to-windows-shutdown.md

@@ -0,0 +1,108 @@
+---
+title: Guide to controlling Windows shutdown behavior in Azure Lab Services | Microsoft Docs
+description: Steps to automatically shutdown an idle Windows virtual machine and remove the Windows shutdown command.
+services: lab-services
+documentationcenter: na
+author: spelluru
+manager: 
+editor: ''
+
+ms.service: lab-services
+ms.topic: article
+ms.date: 3/30/2020
+ms.author: spelluru
+---
+
+# Guide to controlling Windows shutdown behavior
+
+Azure Lab Services provides several cost controls to ensure that Windows virtual machines (VMs) are not running unexpectedly:
+ - [Set a schedule](https://docs.microsoft.com/azure/lab-services/classroom-labs/tutorial-setup-classroom-lab#set-a-schedule-for-the-lab)
+ - [Set quotas for users](https://docs.microsoft.com/azure/lab-services/classroom-labs/how-to-configure-student-usage#set-quotas-for-users)
+ - [Enable automatic shutdown on disconnect](https://docs.microsoft.com/azure/lab-services/classroom-labs/how-to-enable-shutdown-disconnect)
+
+Even with these cost controls, there are situations where a Windows VM may unexpectedly continue to run; and as a result, deduct from the student's quota:
+
+- **RDP window is left open**
+  
+    When a student connects to their VM using RDP, they may inadvertently leave the RDP window open.  As long as the RDP window remains open, the **automatic shutdown on disconnect** setting will never take effect since it is only triggered after the RDP session is disconnected.
+
+- **Windows shutdown command is used to turn off the VM**
+  
+    A student may use Windows shutdown command, or other shutdown mechanisms provided within Windows, to turn off the VM instead of using [Azure Lab Services' stop button](https://docs.microsoft.com/azure/lab-services/classroom-labs/how-to-use-classroom-lab#start-or-stop-the-vm).  When this happens, from the perspective of Azure Lab Services, the VM is still being used.
+    
+To help you prevent these situations from happening, this guide provides steps to automatically shutdown an idle Windows VM and remove the Windows shutdown command from the **Start** menu.  
+
+> [!NOTE]
+> A VM may also unexpectedly deduct from the quota when the student starts their VM, but never actually connects to it using RDP.  This guide does *not* currently address this scenario.  Instead, students should be reminded to immediately connect to their VM using RDP after they start it; or, they should stop the VM.
+
+## Automatic RDP disconnect and shutdown for idle VM
+
+Windows provides **Local Group Policy** settings that you can use to set a time limit to automatically disconnect an RDP session when it becomes idle.  A session is determined to be idle when there is *not* any mouse\keyboard input.  Any long running activities that don't involve mouse\keyboard input cause the VM to be in an idle state.  This includes executing a long query, streaming video, compiling, etc.  Depending on your class's needs, you can choose to set the idle time limit so that it's long enough to handle these types of activities.  For example, you can set the idle time limit to 1 or more hours if needed.
+
+Here is the student's experience when you configure the **idle session limit** in combination with the [**automatic shutdown on disconnect**](https://docs.microsoft.com/azure/lab-services/classroom-labs/how-to-enable-shutdown-disconnect) setting:
+ 1. The student connects to their Windows VM using RDP.
+ 2. When the student leaves their RDP window open and the VM is idle for the **idle session limit** that you specified (such as 5 minutes), the student will see the following dialog:
+
+    ![Idle time limit expired dialog](../media/how-to-windows-shutdown/idle-time-expired.png)
+
+1. If the student does *not* click **OK**, their RDP session will automatically disconnect after 2 minutes.
+2. After the RDP session disconnects, once the specified time frame for the **automatic shutdown on disconnect** setting is reached, the VM is automatically shutdown by Azure Lab Services.
+
+### Set RDP idle session time limit on the template VM
+
+To set the RDP session idle time limit, you can connect to the template VM and execute the below PowerShell script.
+
+```powershell
+# The MaxIdleTime is in milliseconds; by default, this script sets MaxIdleTime to 15 minutes.
+$maxIdleTime = 15 * 60 * 90
+
+Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" -Name "MaxIdleTime" -Value $maxIdleTime -Force
+```
+Or, you can choose to follow these manual steps using the template VM:
+
+1. Press the Windows key, type **gpedit**, then select **Edit group policy (Control panel)**.
+
+1. Go to **Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Session Time Limits**.  
+
+    ![Local group policy editor](../media/how-to-windows-shutdown/group-policy-idle.png)
+   
+1. Right-click **Set time limit for active but idle Remote Desktop Services sessions**, and click **Edit**.
+
+1. Enter the following settings, and then click **OK**:
+   1. Select **Enabled**.
+   1. Under **Options**, specify the **Idle session limit**.
+
+    ![Idle session limit](../media/how-to-windows-shutdown/edit-idle-time-limit.png)
+
+1. Finally, to combine this behavior with the **automatic shutdown on disconnect** setting, you should follow steps in the how-to article: [Enable automatic shutdown of VMs on disconnect](https://docs.microsoft.com/azure/lab-services/classroom-labs/how-to-enable-shutdown-disconnect).
+
+## Remove Windows shutdown command from Start menu
+
+Windows **Local Group Policy** settings also allow you to remove the shutdown command from the **Start** menu.
+
+To remove the shutdown command, you can connect to the template VM and execute the below PowerShell script.
+
+```powershell
+Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name "HidePowerOptions" -Value 1 -Force
+```
+
+Or, you can choose to follow these manual steps using the template VM:
+
+1. Press the Windows key, type **gpedit**, then select **Edit group policy (Control panel)**.
+
+1. Go to **Computer Configuration > Administrative Templates > Start Menu and Taskbar**.  
+
+    ![Local group policy editor](../media/how-to-windows-shutdown/group-policy-shutdown.png)
+
+1. Right-click **Remove and prevent access to the Shut Down, Restart, Sleep, and Hibernate commands**, and click **Edit**.
+
+1. Select the **Enabled** setting and then click **OK**:
+ 
+   ![Shutdown setting](../media/how-to-windows-shutdown/edit-shutdown.png)
+
+1. Notice that the shutdown command no longer appears under Windows **Start** menu; only the **Disconnect** command appears.
+
+    ![Shutdown command](../media/how-to-windows-shutdown/start-menu.png)
+
+## Next steps
+See the article on how to prepare a Windows template VM: [Guide to setting up a Windows template machine in Azure Lab Services](how-to-prepare-windows-template.md)

articles/lab-services/classroom-labs/setup-guide.md

@@ -76,7 +76,7 @@ Lab Services uses a pay-as-you go pricing model which means that you only pay fo
 Students are each assigned their own VM that is assigned to them for the lifetime of the lab.  They can choose to:
 
 - Save directly to the VM.
-- Save to an external repository, such as OneDrive, GitHub, etc.
+- Save to an external location, such as OneDrive, GitHub, etc.
 
 To use OneDrive, you may choose to configure this automatically for students on their lab VMs.  Additional information on this is provided below.
 
@@ -150,4 +150,4 @@ See the following articles:
 
 - [Track usage of a classroom lab](tutorial-track-usage.md)
 
-- [Access a classroom lab](tutorial-connect-virtual-machine-classroom-lab.md)
+- [Access a classroom lab](tutorial-connect-virtual-machine-classroom-lab.md)