Need advice on creating password-enabled Windows templates.

[SviridoffA]

Hello everyone! I’d be grateful for any help from the community. So far, I’ve been creating Windows templates using tools like WAIK and CloudInstanceManager - https://sourceforge.net/projects/cloudstack/files/Password%20Management%20Scripts/ . CloudInstanceManager was used for managing passwords in the guest OS. It seems this simple utility is no longer supported and was last updated in 2011. Still, everything worked great until now. However, I’ve noticed an issue when using Redundant Virtual Routers. Unlike regular routers where port 8080 is accessible and everything works fine, this port is unavailable on redundant routers. It appears that this port is hardcoded in the utility. Linux templates works fine with these routers via cloudinit. Please share best practices for managing passwords in Windows templates or possible solutions to this issue. I’ve heard about Cloudbase Init, but there’s some info suggesting password management doesn’t work there either—I haven’t tested it myself. Any help would be greatly appreciated!

[TadiosAbebe]

Hello @SviridoffA , My windows images are built with cloudbase-init and i just tested password injection with Redundant VR and it works just fine. So maybe test cloudbase-init and if it doesn't work for you, I'll share you my configurations

[SviridoffA]

Thanks for your reply, @TadiosAbebe ! I will give Cloudbase a try. I'm not closing this discussion for now, in case I have further questions about it. Btw, does anyone have a good guide for Cloudbase-Init and CloudStack maybe?

[TadiosAbebe]

Here is a guide on how i prepare my windows templates

• I download windows server vhd file from microsoft's website.(personal preference, instead of installing it from ISO)
• I convert the vhd file to qcow2 using qemu-img utility

qemu-img convert -p -f vpc -O qcow2 windows_server_2019.vhd windows_server_2019.qcow2

• Upload the qcow2 file to cloudstack
• Launch an instance from the uploaded template and make some customizations
• install virtio drivers and qemu-guest-agent
• enable remote desktop
• update the system
• Install cloudbase-init, and at the last steps of syspreping and sutting down the system before continuing
• I edit the contents of C:\Program Files\Cloudbase Solutions\Cloudbase-Init\conf\cloudbase-init.conf

[DEFAULT]
username=Administrator
groups=Administrators
inject_user_password=true
first_logon_behaviour=no
rdp_set_keepalive=true
bsdtar_path=C:\Program Files\Cloudbase Solutions\Cloudbase-Init\bin\bsdtar.exe
mtools_path=C:\Program Files\Cloudbase Solutions\Cloudbase-Init\bin\
verbose=true
debug=true
log_dir=C:\Program Files\Cloudbase Solutions\Cloudbase-Init\log\
log_file=cloudbase-init-unattend.log
default_log_levels=comtypes=INFO,suds=INFO,iso8601=WARN,requests=WARN
logging_serial_port_settings=COM1,115200,N,8
mtu_use_dhcp_config=true
ntp_use_dhcp_config=true
local_scripts_path=C:\Program Files\Cloudbase Solutions\Cloudbase-Init\LocalScripts\
allow_reboot=false
check_latest_version=false
stop_service_on_exit=false
netbios_host_name_compatibility=true
metadata_services=cloudbaseinit.metadata.services.cloudstack.CloudStack,cloudbaseinit.metadata.services.configdrive.ConfigDriveService
plugins = cloudbaseinit.plugins.common.mtu.MTUPlugin,cloudbaseinit.plugins.windows.ntpclient.NTPClientPlugin,cloudbaseinit.plugins.common.sethostname.SetHostNamePlugin,cloudbaseinit.plugins.windows.createuser.CreateUserPlugin,cloudbaseinit.plugins.common.networkconfig.NetworkConfigPlugin,cloudbaseinit.plugins.windows.licensing.WindowsLicensingPlugin,cloudbaseinit.plugins.common.sshpublickeys.SetUserSSHPublicKeysPlugin,cloudbaseinit.plugins.windows.extendvolumes.ExtendVolumesPlugin,cloudbaseinit.plugins.common.userdata.UserDataPlugin,cloudbaseinit.plugins.common.setuserpassword.SetUserPasswordPlugin,cloudbaseinit.plugins.windows.winrmlistener.ConfigWinRMListenerPlugin,cloudbaseinit.plugins.windows.winrmcertificateauth.ConfigWinRMCertificateAuthPlugin,cloudbaseinit.plugins.common.localscripts.LocalScriptsPlugin
[cloudstack]
metadata_base_url=http://192.168.1.1/

• you might need to change the metadata_base_url value
• then i edit the contents of C:\Program Files\Cloudbase Solutions\Cloudbase-Init\conf\cloudbase-init-unattend.conf

[DEFAULT]
username=Administrator
groups=Administrators
inject_user_password=true
first_logon_behaviour=no
rdp_set_keepalive=true
bsdtar_path=C:\Program Files\Cloudbase Solutions\Cloudbase-Init\bin\bsdtar.exe
mtools_path=C:\Program Files\Cloudbase Solutions\Cloudbase-Init\bin\
verbose=true
debug=true
log_dir=C:\Program Files\Cloudbase Solutions\Cloudbase-Init\log\
log_file=cloudbase-init-unattend.log
default_log_levels=comtypes=INFO,suds=INFO,iso8601=WARN,requests=WARN
logging_serial_port_settings=COM1,115200,N,8
mtu_use_dhcp_config=true
ntp_use_dhcp_config=true
local_scripts_path=C:\Program Files\Cloudbase Solutions\Cloudbase-Init\LocalScripts\
allow_reboot=false
check_latest_version=false
stop_service_on_exit=false
netbios_host_name_compatibility=true
metadata_services=cloudbaseinit.metadata.services.cloudstack.CloudStack,cloudbaseinit.metadata.services.configdrive.ConfigDriveService
plugins = cloudbaseinit.plugins.common.mtu.MTUPlugin,cloudbaseinit.plugins.common.sethostname.SetHostNamePlugin
[cloudstack]
metadata_base_url=http://192.168.1.1/

• then I complete the cloudbase-init installation by syspreping and shutting down
• then I convert the instance root volume to template.

If password injection is not working or any cloudbase-init issue in general it is help full to detach the root volume of the not working instance and try to look for why cloudbase-init failed with in the logs

[SviridoffA]

Wow, thanks a ton for this awesome guide, it’s super helpful!
I'll give it a try in the next few days.

[SviridoffA]

@TadiosAbebe
Thanks once again for your help!! All works fine!