Merge pull request #15745 from MicrosoftDocs/main

8/27/2024 PM Publish

Author: Taojunshen

azure-stack/hci/concepts/firewall-requirements.md

@@ -4,7 +4,7 @@ description: This topic provides guidance on firewall requirements for the Azure
 author: alkohli
 ms.author: alkohli
 ms.topic: how-to
-ms.date: 07/09/2024
+ms.date: 08/15/2024
 ---
 
 # Firewall requirements for Azure Stack HCI
@@ -95,6 +95,15 @@ Ensure that the following firewall rules are configured in your on-premises fire
 >[!NOTE]
 > While installing Windows Admin Center, if you select the **Use WinRM over HTTPS only** setting, then port 5986 is required.
 
+
+### Active Directory
+
+Ensure that the following firewall rules are configured in your on-premises firewall for Active Directory (local security authority).
+
+| Rule | Action | Source | Destination | Service | Ports |
+|:--|:--|:--|:--|:--|:--|
+| Allow inbound/outbound connectivity to the Active Directory Web services (ADWS) and Active Directory Management Gateway Service | Allow | Active Directory Services | Azure Stack HCI | TCP | 9389 |
+
 ### Failover Clustering
 
 Ensure that the following firewall rules are configured in your on-premises firewall for Failover Clustering.

azure-stack/hci/deploy/deployment-prep-active-directory.md

@@ -3,7 +3,7 @@ title: Prepare Active Directory for new Azure Stack HCI, version 23H2 deployment
 description: Learn how to prepare Active Directory before you deploy Azure Stack HCI, version 23H2.
 author: alkohli
 ms.topic: how-to
-ms.date: 08/05/2024
+ms.date: 08/15/2024
 ms.author: alkohli
 ms.reviewer: alkohli
 ms.subservice: azure-stack-hci
@@ -42,7 +42,7 @@ Before you begin, make sure you've done the following:
 
 - You have obtained permissions to create an OU. If you don't have permissions, contact your Active Directory administrator.
 
-- If you have a firewall between your Azure Stack HCI system and Active Directory, ensure that the proper firewall rules are configured. For specific guidance, see [How to configure a firewall for Active Directory domains and trusts](/troubleshoot/windows-server/active-directory/config-firewall-for-ad-domains-and-trusts#windows-server-2008-and-later-versions).
+- If you have a firewall between your Azure Stack HCI system and Active Directory, ensure that the proper firewall rules are configured. For specific guidance, see [Firewall requirements for Active Directory Web Services and Active Directory Gateway Management Service](../concepts/firewall-requirements.md). See also [How to configure a firewall for Active Directory domains and trusts](/troubleshoot/windows-server/active-directory/config-firewall-for-ad-domains-and-trusts#windows-server-2008-and-later-versions).
 
 ## Active Directory preparation module
 

azure-stack/hci/upgrade/media/upgrade-22h2-to-23h2-windows-admin-center/add-cau-role.png

@@ -3,7 +3,7 @@ title: Upgrade Azure Stack HCI, version 22H2 OS to version 23H2 via Windows Admi
 description: Learn how to upgrade from Azure Stack HCI, version 22H2 OS to Azure Stack HCI, version 23H2 using Windows Admin Center.
 author: alkohli
 ms.topic: how-to
-ms.date: 08/13/2024
+ms.date: 08/23/2024
 ms.author: alkohli
 ms.reviewer: alkohli
 ms.subservice: azure-stack-hci
@@ -13,7 +13,7 @@ ms.subservice: azure-stack-hci
 
 [!INCLUDE [applies-to](../../includes/hci-applies-to-23h2-22h2.md)]
 
-This article describes how to upgrade the Azure Stack HCI, version 22H2 Operating System (OS) to version 23H2, which is the latest generally available software via Windows Admin Center.
+This article describes how to upgrade the Azure Stack HCI, version 22H2 operating system (OS) to version 23H2, which is the latest generally available software via Windows Admin Center.
 
 While the recommended method to [Upgrade the OS is via PowerShell](./upgrade-22h2-to-23h2-powershell.md), you can also upgrade via Windows Admin Center or other methods.
 
@@ -45,7 +45,7 @@ Before you begin, make sure that:
 - You have access to a client that can connect to your Azure Stack HCI cluster. This client should have Windows Admin Center installed on it. For more information, see [Install Windows Admin Center](/windows-server/manage/windows-admin-center/deploy/install).
 
 > [!NOTE]
-> The offline ISO upgrade method is not available when using Windows Admin Center.  For these steps, see [Upgrade Azure Stack HCI operating system via PowerShell](./upgrade-22h2-to-23h2-powershell.md)
+> The offline ISO upgrade method is not available when using Windows Admin Center. For these steps, see [Upgrade Azure Stack HCI operating system via PowerShell](./upgrade-22h2-to-23h2-powershell.md)
 
 ## Step 1: Connect to Azure Stack HCI cluster via Windows Admin Center
 
@@ -59,42 +59,44 @@ Follow these steps to add and connect to an Azure Stack HCI server via Windows A
 
 ## Step 2: Install operating system and hardware updates using Windows Admin Center
 
-Windows Admin Center makes it easy to update a cluster and apply quality updates using a simple user interface. If you purchased an integrated system from a Microsoft hardware partner, it's easy to get the latest drivers, firmware, and other updates directly from Windows Admin Center by installing the appropriate partner update extension(s). ​If your hardware wasn't purchased as an integrated system, firmware and driver updates would need to be performed separately, following the hardware vendor's recommendations.
+Windows Admin Center makes it easy to update a cluster and apply quality updates using a simple user interface. If you purchased an integrated system from a Microsoft hardware partner, it's easy to get the latest drivers, firmware, and other updates directly from Windows Admin Center by installing the appropriate partner update extensions. ​If your hardware wasn't purchased as an integrated system, firmware and driver updates would need to be performed separately, following the hardware vendor's recommendations.
 
    > [!WARNING]
-   > If you begin the update process using Windows Admin Center, continue using the wizard until updates complete. Do not attempt to use the Cluster-Aware Updating tool or update a cluster with PowerShell after partially completing the update process in Windows Admin Center. If you wish to use PowerShell to perform the updates instead of Windows Admin Center, see [Update a cluster using PowerShell](./upgrade-22h2-to-23h2-powershell.md).
+   > If you begin the update process using Windows Admin Center, continue using the wizard until updates complete. Don't attempt to use the Cluster-Aware Updating (CAU) tool or update a cluster with PowerShell after partially completing the update process in Windows Admin Center. If you wish to use PowerShell to perform the updates instead of Windows Admin Center, see [Update a cluster using PowerShell](./upgrade-22h2-to-23h2-powershell.md).
 
 Follow these steps to install updates:
 
 > [!NOTE]
-> The steps below use Windows Admin Center version 2311.  If you are using a different version, your screens may vary slightly.
+> The following steps use Windows Admin Center version 2311. If you are using a different version, your screens may vary slightly.
 
 1. When you connect to a cluster, the Windows Admin Center dashboard alerts you if one or more servers have updates ready to be installed and provide a link to update now. Alternatively, select **Updates** from the **Operations** menu at the left.
 
-1. If you're updating your cluster for the first time, Windows Admin Center checks if the cluster is properly configured to run Cluster-Aware Updating and, if needed, asks if you would like Windows Admin Center to configure CAU for you, including installing the CAU cluster role and enabling the required firewall rules. To begin the update process, select **Add Cluster-Aware-Updating role**.
+1. If you're updating your cluster for the first time, Windows Admin Center checks if the cluster is properly configured to run CAU. If not, it prompts you to allow Windows Admin Center to configure CAU, which includes installing the CAU cluster role and enabling the required firewall rules. To begin the update process, select **Add Cluster-Aware-Updating role**.
 
    :::image type="content" source="media/upgrade-22h2-to-23h2-windows-admin-center/add-cau-role.png" alt-text="Screenshot of Windows Admin Center automatically configuring the cluster to run Cluster-Aware Updating." lightbox="media/upgrade-22h2-to-23h2-windows-admin-center/add-cau-role.png":::
 
    > [!NOTE]
-   > To use the Cluster-Aware updating tool in Windows Admin Center, you must enable Credential Security Service Provider (CredSSP) and provide explicit credentials. If you are asked if CredSSP should be enabled, select **Yes**. Specify your username and password, and select **Continue**.
+   > To use the CAU tool in Windows Admin Center, you must enable Credential Security Service Provider (CredSSP) and provide explicit credentials. If you are asked if CredSSP should be enabled, select **Yes**. Specify your username and password, and select **Continue**.
 
-1. With the role installed, Windows Admin Center will automatically check for updates applicable to your cluster. Ensure the radio button for **Feature update (Recommended)** is selected and the **Feature update for Azure Stack HCI, version 23H2** is **Available** for the cluster nodes.  If the feature update is not showing, ensure your cluster is running the Azure Stack HCI OS and that the nodes have direct access to Windows Update, then click **Check for updates**.
+1. After the role is installed, Windows Admin Center automatically checks for updates applicable to your cluster. Ensure the radio button for **Feature update (Recommended)** is selected and the **Feature update for Azure Stack HCI, version 23H2** is **Available** for the cluster nodes. If the feature update isn't displayed, ensure your cluster is running the Azure Stack HCI OS and that the nodes have direct access to Windows Update, then select **Check for updates**.
 
-  > [!IMPORTANT]
-  > Feature updates are not available in Windows Server Update Services (WSUS).
+   :::image type="content" source="media/upgrade-22h2-to-23h2-windows-admin-center/check-for-updates.png" alt-text="Screenshot of the Updates page in Windows Admin Center showing the available updates." lightbox="media/upgrade-22h2-to-23h2-windows-admin-center/check-for-updates.png":::
+
+   > [!IMPORTANT]
+   > Feature updates aren't available in Windows Server Update Services (WSUS).
 
    If you navigate away from the Updates screen while an update is in progress, there could be unexpected behavior, such as the history section of the Updates page not populating correctly until the current run is finished. We recommend opening Windows Admin Center in a new browser tab or window if you wish to continue using the application while the updates are in progress.
 
-1. Select **Install**.  Windows Admin Center will automatically perform a series of readiness checks looking for issues that could prevent CAU from successfully completing.  If any issues are found, select the **Details** link next to the issue and perform the appropriate steps to mediate the issue, then select **Check again** to run the readiness checks again.
+1. Select **Install**. Windows Admin Center automatically performs a series of readiness checks to identify issues that could prevent CAU from completing successfully. If any issues are found, select the **Details** link next to the issue, address the issue, and then select **Check again** to run the readiness checks again.
 
-   :::image type="content" source="media/upgrade-22h2-to-23h2-windows-admin-center/operating-system-updates.png" alt-text="Screenshot of selecting Next: Install to proceed to installing operating system updates, or select Skip to exclude them." lightbox="media/upgrade-22h2-to-23h2-windows-admin-center/operating-system-updates.png":::
+   :::image type="content" source="media/upgrade-22h2-to-23h2-windows-admin-center/readiness-checks.png" alt-text="Screenshot of the readiness check during the installation of updates." lightbox="media/upgrade-22h2-to-23h2-windows-admin-center/readiness-checks.png":::
 
    > [!NOTE]
    > If you're installing updates on a cluster that has [Kernel Soft Reboot](../manage/kernel-soft-reboot.md) enabled, select **Disable Kernel Soft Reboot for this run** checkbox. This selection disables Kernel Soft Reboot as the upgrade requires a full reboot.
 
-1. Select **Next: Install** to review the list of updates to be installed to each cluster node.  Select **Install** to proceed with installing the operating system updates. One by one, each server downloads and applies the updates. The update status changes to **Installing updates**. If the updates require a restart, servers are restarted one at a time, moving cluster roles such as virtual machines between servers to prevent downtime. Depending on the updates being installed, the entire update run can take anywhere from a few minutes to several hours. You would need to sign into Windows Admin Center multiple times.
+1. Select **Next: Install** to review the list of updates to be installed to each cluster node. Then, select **Install** to begin installing the operating system updates. One by one, each server downloads and applies the updates. The update status changes to **Installing updates**. If the updates require a restart, servers are restarted one at a time, moving cluster roles such as virtual machines between servers to prevent downtime. Depending on the updates being installed, the entire update run can take anywhere from a few minutes to several hours. You would need to sign in to Windows Admin Center multiple times.
 
-   :::image type="content" source="media/upgrade-22h2-to-23h2-windows-admin-center/install-os-updates.png" alt-text="Screenshot of selecting Install to install operating system updates on each server in the cluster." lightbox="media/upgrade-22h2-to-23h2-windows-admin-center/install-os-updates.png":::
+   :::image type="content" source="media/upgrade-22h2-to-23h2-windows-admin-center/final-confirmation.png" alt-text="Screenshot of selecting Install to install operating system updates on each server in the cluster." lightbox="media/upgrade-22h2-to-23h2-windows-admin-center/final-confirmation.png":::
 
    > [!NOTE]
    > If the updates fail with a **Couldn't install updates** or **Couldn't check for updates** warning or if one or more servers indicate **couldn't get status** during the run, wait a few minutes, and refresh your browser. You can also use `Get-CauRun` to [check the status of the update run with PowerShell](./upgrade-22h2-to-23h2-powershell.md#step-3-check-the-status-of-an-update).
@@ -105,7 +107,7 @@ Follow these steps to install updates:
    > After applying operating system updates, you may see a message that "storage isn't complete or up-to-date, so we need to sync it with data from other servers in the cluster." This is normal after a server restarts. **Don't remove any drives or restart any servers in the cluster until you see a confirmation that the sync is complete.**
    
    > [!NOTE]
-   > Hardware updates are only available on clusters that have the vendor's hardware extension installed.  If your Windows Admin Center does not have this extension, there will not be an option to install hardware updates. 
+   > Hardware updates are only available on clusters that have the vendor's hardware extension installed. If your Windows Admin Center does not have this extension, there will not be an option to install hardware updates. 
 
 1. Windows Admin Center checks the cluster for installed extensions that support your specific server hardware. Select **Next: Install** to install the hardware updates on each server in the cluster. If no extensions or updates are found, select **Exit**.