Office Web App 2013 Server Error

I ran into an issue the other day, after deploying a new WAC Farm, where SharePoint stopped displaying documents in the wopi frame.
I ran the same New-OfficeWebAppsFarm script that I have been running for the installation/upgrades for years, so at first I thought it was the latest CU.
After installing the upgrade, I ran the following script to get the new WAC Server Version to make sure I was on the right version:

(Invoke-WebRequest https://wac.domain.com/op/servicebusy.htm).Headers["X-OfficeVersion"]

view raw getWacVersion.ps1 hosted with ❤ by GitHub

However, the version number did not return. From within SharePoint, I received a Server Error message, saying "We're sorry. An error has occurred. We've logged the error for the server administrator" This message was in the wopi frame, but would be seen within the WAC farm by going to https://wac.domain.com/op/servicebusy.htm

Now the interesting part was that I was able to get content back from going to wopi-discovery: (http://wac.domain.com/hosting/discovery).

Looking at the Event Viewer, I was getting Application Error and .NET Runtime errors for the different application Watchdog.exe. At this point, I enabled verbose logging on the server.

	Set-OfficeWebAppsFarm -LogVerbosity "High"
	Restart-Service WACSM

view raw enable-verbose WAC.ps1 hosted with ❤ by GitHub

I once again tried to open up the servicebusy.htm page, then opened up the ULS logs. I was able to find an Unexpected Error:
ServiceInstanceFinderAdapter.FindAllServiceInstances() threw an exception: System.Reflection.TargetInvocationException: Exception has been thrown by the target of an invocation. ---> System.Collections.Generic.KeyNotFoundException: The given key was not present in the dictionary.     at Microsoft.Office.Web.Apps.Environment.WacServer.AFarmTopology.GetMachine(String machineName)     at Microsoft.Office.Web.Apps.Environment.WacServer.WSServiceInstanceFinderAdapter..ctor()     --- End of inner exception stack trace ---     at System.RuntimeTypeHandle.CreateInstance(RuntimeType type, Boolean publicOnly, Boolean noCheck, Boolean& canBeCached, RuntimeMethodHandleInternal& ctor, Boolean& bNeedSecurityCheck)     at System.RuntimeType.CreateInstanceSlow(Boolean publicOnly, Boolean skipCheckThis, Boolean fillCache, StackCrawlMark& stackMark)     at System.RuntimeType.CreateInstanceDefaultCtor(Boolean publicOnly, Boolean skipCheckThis, Boolean fillCache, StackCrawlMark& stackMark)     at System.Activator.CreateInstance(Type type, Boolean nonPublic)  at Microsoft.Office.Web.Common.EnvironmentAdapters.HostEnvironment.LoadAdapterInstance(AdapterLoadInformation adapterInfo, Boolean readAppConfigOnly)     at Microsoft.Office.Web.Common.EnvironmentAdapters.HostEnvironment.AdapterLoadInformation`1.<>c__DisplayClass17.b__16()     at System.Lazy`1.CreateValue()     at System.Lazy`1.LazyInitValue()     at Microsoft.Office.Web.Common.EnvironmentAdapters.HostEnvironment.get_ServiceInstanceFinderAdapter()     at Microsoft.Office.Web.Common.ServiceInstanceFinder.RefreshList(Object state)  
ServiceInstanceFinder has no data because of an adapter exception, throwing exception to terminate process

I did a quick search and found a blog post on OOS which had the same issue (https://social.technet.microsoft.com/Forums/office/en-US/96dd1ac1-1173-47c3-bdc5-29ac0fd9f722/oos-2016-server-error-were-sorry-an-error-has-occurred-weve-logged-the-error-for-the-server?forum=OfficeOnlineServer). Basically, if the server name is not in all capitol letters, it doesn't work. To fix this, I ran a a script to update 3 registry values to update the Computer Name to all CAPS.

	$path1 = "HKLM:\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName"
	$path2 = "HKLM:\SYSTEM\ControlSet001\Control\ComputerName\ComputerName"
	$path3 = "HKLM:\SYSTEM\ControlSet002\Control\ComputerName\ComputerName"
	$paths = @($path1,$path2,$path3)
	foreach ($path in $paths) {
	Set-ItemProperty -Path $path -Name ComputerName -Value $env:COMPUTERNAME.ToUpper()
	(Get-ItemProperty -Path $path -Name ComputerName).ComputerName
	}

view raw allCAPSRegistryUpdate.ps1 hosted with ❤ by GitHub

I opened up the servicebusy.htm page again and the expected error was returned:

I then stop my verbose logging by running the following:

	Set-OfficeWebAppsFarm -LogVerbosity ""
	Restart-Service WACSM

view raw stopVerboseLogging-WAC.ps1 hosted with ❤ by GitHub

Now, when I run the following script:

(Invoke-WebRequest https://wac.domain.com/op/servicebusy.htm).Headers["X-OfficeVersion"]

view raw getWacVersion.ps1 hosted with ❤ by GitHub

I get the expected results:

At least it is an easy fix...

I also tested this on a base image of WAC plus Service Pack 1, and same issue persisted. 

How to Maintain an Azure Site-to-Site (S2S) Connection with a Dynamic IP Address

This post should not be needed for your production environment. This is for those of us who test and build development environments at home and have created hybrid environments into Azure. IF you have a dynamic IP address for your business, please spend the extra bit of money for a static IP...

That being said, I have a dynamic IP address for my house, and when my IP address changes, it used to break my S2S connection with Azure. This post is about how I fixed the problem.

The fist step is to create the service account that is going to be logging in to Azure to check and update the IP Address.  I will be creating an unlicensed user on the .onmicrosoft domain to for this purpose.

As the Microsoft Online Data Service (MSOL) module did not come pre-installed, I ran the following to get started:

	Set-PSRepository -Name "PSGallery" -InstallationPolicy Trusted
	Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force -Confirm:$false
	Install-Module -Name MSOnline -AllowClobber -Confirm:$false

view raw get-msol.ps1 hosted with ❤ by GitHub

Next we are going to login and create the unlicensed service account. You will want to update the UPN and other variables accordingly:

	Param (
	[string]$displayName = "SVC-Nework-Gateway-Updater",
	[string]$firstName = "Network-Gateway",
	[string]$lastName = "Updater-Account",
	[string]$upn = "svc_network-updater@yourDomain.onmicrosoft.com",
	[string]$password = "MyPassword#12345",
	[string]$usageLocation = "US"
	)
	$oCred = Get-Credential -Message "Enter Admin Credentials for O365..."
	Connect-MsolService -Credential $oCred
	$user = New-MsolUser -DisplayName $displayName `
	-FirstName $firstName `
	-LastName $lastName `
	-UserPrincipalName $upn `
	-UsageLocation $usageLocation `
	-ForceChangePassword:$false `
	-PasswordNeverExpires:$true `
	-Password $password

view raw Create MSOL User.ps1 hosted with ❤ by GitHub

Now that we have our service account created (an account that does not have access into our domain, O365, or Azure), it will need to be added to Access Control (IAM) for the Local Network Gateway in Azure.

	Param (
	[string]$subscriptionName = "mySubscription",
	[string]$resourceGroupName = "Networking",
	[string]$localGatewayName = "LocalGateway",
	[string]$userID = "508bb5e1-898e-user-9a71-47de815db2af"
	)
	Login-AzureRmAccount -SubscriptionName $subscriptionName
	$ID = Get-AzureRmResourceGroup $resourceGroup1 | Get-AzureRmLocalNetworkGateway -Name $localGatewayName | select Id
	New-AzureRmRoleAssignment -Scope $ID.Id -ObjectId $userID -RoleDefinitionName "Contributor"
	<# Remove User from EVERYWHERE!
	Get-AzureRmRoleAssignment | Where-Object {$_.ObjectId -eq $userID} | Remove-AzureRmRoleAssignment
	#>

view raw update RBAC.ps1 hosted with ❤ by GitHub

With permissions set for Local Network Gateway, it is time to look at the current IP address of the gateway endpoint and compare it to the current local IP address endpoint. If the two IP addresses do not match, it is time to update your Local Network Gateway (in Azure).

	Param (
	[string]$resourceGroup = "Networking-US-East-2",
	[string]$localGatewayName = "LocalGateway-HQ",
	[string]$location = "East US 2",
	[string]$lgwSubnetPrefix = "192.168.0.0/21"
	)
	function Get-LocalIP {
	$wc = New-Object net.webclient
	$localIP = $wc.downloadstring("http://checkip.dyndns.com") -replace "[^\d\.]"
	return $localIP
	}
	function Get-LocalGatewayIP ($resourceGroup, $localGatewayName) {
	$lng = Get-AzureRmLocalNetworkGateway -Name $localGatewayName -ResourceGroupName $resourceGroup
	return $lng.GatewayIpAddress
	}
	function Update-LocalGateway ($resourceGroup, $localGatewayName, $localIP, $location, $addressPrefix) {
	$localGateway = New-AzureRmLocalNetworkGateway -Name $localGatewayName `
	-ResourceGroupName $resourceGroup `
	-Location $location `
	-GatewayIpAddress $localIP `
	-AddressPrefix $addressPrefix `
	-Force `
	-Confirm:$false
	Write-Output("$localGatewayName Local Gateway updated...")
	}
	$localIP = Get-LocalIP
	$gatewayIP = Get-LocalGatewayIP -resourceGroup $resourceGroup -localGatewayName $localGatewayName
	If ($gatewayIP -ne $localIP) {
	Update-LocalGateway -resourceGroup $resourceGroup `
	-localGatewayName $localGatewayName `
	-localIP $localIP `
	-location $location `
	-addressPrefix $lgwSubnetPrefix
	}

view raw updateAzureLocalNetworkGateway.ps1 hosted with ❤ by GitHub

Next we create some logging and logging clean-up:

	function Update-Logs ($content) {
	$logPath = 'C:\S2S Logs'
	if (-not (Test-Path -Path $logPath)) {New-Item -Path $logPath -ItemType Directory}
	$date = Get-Date
	$lastMonth = $date.AddMonths(-1)
	$fileName = $date.ToString("yyyy-MM-dd") + "- S2S Log.txt"
	$filePath = ($logPath + "\" + $fileName)
	$exists = Test-Path $filePath
	if ($exists) {
	$string = (Get-Date).ToShortTimeString().ToString() + " $content"
	$string | Out-File -FilePath $filePath -Append
	}
	if (-not $exists) {
	$string | Out-File -FilePath $filePath
	}
	# Clean Up Logs Older than 1 month
	$items = Get-ChildItem -Path $logPath -Recurse -Filter *.txt | Where-Object {$_.CreationTime.Date -lt $lastMonth}
	$items | Remove-Item -Force
	}

view raw updateLogs.ps1 hosted with ❤ by GitHub

And to finish off, we will connect all of our RRAS VpnS2SInterface connections.

	$connections = (Get-VpnS2SInterface).Name
	foreach ($connection in $connections) {
	Connect-VpnS2SInterface -Name $connection
	}

view raw S2SConnection.ps1 hosted with ❤ by GitHub

Now let's put the whole thing together. First we create the service account and add their permissions:

	Param (
	[string]$msolDisplayName = "SVC-Nework-Gateway-Updater",
	[string]$msolFirstName = "Network-Gateway",
	[string]$msolLastName = "Updater-Account",
	[string]$msolUpn = "svc_network-updater@yourDomain.onmicrosoft.com",
	[string]$msolPassword = "MyPassword#12345",
	[string]$msolUsageLocation = "US",
	[string]$azureSubscriptionName = "mySubscription",
	[string]$azureResourceGroupName = "Networking",
	[string]$azureLocalGatewayName = "LocalGateway"
	)
	#region Login to O365 and Create User
	$cred = Get-Credential -Message "Enter Admin Credentials for O365..."
	Connect-MsolService -Credential $cred
	$user = New-MsolUser -DisplayName $msolDisplayName `
	-FirstName $msolFirstName `
	-LastName $msolLastName `
	-UserPrincipalName $msolUpn `
	-UsageLocation $msolUsageLocation `
	-ForceChangePassword:$false `
	-PasswordNeverExpires:$true `
	-Password $msolPassword
	#endregion
	#region Login to Azure and Add User to Local Network Gateway RBAC
	Login-AzureRmAccount -SubscriptionName $azureSubscriptionName
	$ID = Get-AzureRmResourceGroup $azureResourceGroupName | Get-AzureRmLocalNetworkGateway -Name $azureLocalGatewayName | select Id
	New-AzureRmRoleAssignment -Scope $ID.Id -ObjectId $user.ObjectId -RoleDefinitionName "Contributor"
	<# Remove User from EVERYWHERE!
	Get-AzureRmRoleAssignment | Where-Object {$_.ObjectId -eq $userID} | Remove-AzureRmRoleAssignment
	#>
	#endregion

view raw Create MSOL User and Add to Service.ps1 hosted with ❤ by GitHub

Next we create the Update S2S file, and save the file to: 'C:\Scripts\Update S2S and RRAS.ps1'

	Param (
	[string]$userName = "svc_network-updater@yourDomain.onmicrosoft.com",
	[string]$password = "MyPassword#12345",
	[string]$subscriptionName = "mySubscription",
	[string]$resourceGroup = "Networking-US-East-2",
	[string]$localGatewayName = "LocalGateway-HQ",
	[string]$location = "East US 2",
	[string]$lgwSubnetPrefix = "192.168.0.0/21"
	)
	#region Login to Azure
	$securePassword = ConvertTo-SecureString -String $password -AsPlainText -Force
	$cred = New-Object System.Management.Automation.PSCredential($userName, $securePassword)
	Login-AzureRmAccount -Credential $cred -SubscriptionName $subscriptionName
	$subscription = (Get-AzureRmSubscription | Where-Object {$_.SubscriptionName -eq $subscriptionName}).SubscriptionId
	Select-AzureRmSubscription -Subscriptionid $subscription
	#endregion
	function Update-Logs ($content) {
	$logPath = 'C:\S2S Logs'
	if (-not (Test-Path -Path $logPath)) {New-Item -Path $logPath -ItemType Directory}
	$date = Get-Date
	$lastMonth = $date.AddMonths(-1)
	$fileName = $date.ToString("yyyy-MM-dd") + "- S2S Log.txt"
	$filePath = ($logPath + "\" + $fileName)
	$exists = Test-Path $filePath
	if ($exists) {
	$string = (Get-Date).ToShortTimeString().ToString() + " $content"
	$string | Out-File -FilePath $filePath -Append
	}
	if (-not $exists) {
	$string | Out-File -FilePath $filePath
	}
	# Clean Up Logs Older than 1 month
	$items = Get-ChildItem -Path $logPath -Recurse -Filter *.txt | Where-Object {$_.CreationTime.Date -lt $lastMonth}
	$items | Remove-Item -Force
	}
	function Get-LocalIP {
	$wc = New-Object net.webclient
	$localIP = $wc.downloadstring("http://checkip.dyndns.com") -replace "[^\d\.]"
	return $localIP
	}
	function Get-LocalGatewayIP ($resourceGroup, $localGatewayName) {
	$lng = Get-AzureRmLocalNetworkGateway -Name $localGatewayName -ResourceGroupName $resourceGroup
	return $lng.GatewayIpAddress
	}
	function Update-LocalGateway ($resourceGroup, $localGatewayName, $localIP, $location, $addressPrefix) {
	$localGateway = New-AzureRmLocalNetworkGateway -Name $localGatewayName `
	-ResourceGroupName $resourceGroup `
	-Location $location `
	-GatewayIpAddress $localIP `
	-AddressPrefix $addressPrefix `
	-Force `
	-Confirm:$false
	Write-Output("$localGatewayName Local Gateway updated...")
	}
	function Connect-LocalGateway {
	$connections = (Get-VpnS2SInterface).Name
	foreach ($connection in $connections) {
	Connect-VpnS2SInterface -Name $connection
	}
	Update-Logs -content ((Get-VpnS2SInterface).Name.toString() + "-" + (Get-VpnS2SInterface).ConnectionState.toString())
	}
	#region Execute
	# Get Local IP Address Endpoint
	$localIP = Get-LocalIP
	# Get Azure Local Gateway IP Address
	$gatewayIP = Get-LocalGatewayIP -resourceGroup $resourceGroup -localGatewayName $localGatewayName
	# Update Log File
	Update-Logs -content ("Gateway IP = $gatewayIP and Local IP = $localIP")
	# If IP Addresses don't match update Azure Local Gateway IP Address
	If ($gatewayIP -ne $localIP) {
	Update-LocalGateway -resourceGroup $resourceGroup `
	-localGatewayName $localGatewayName `
	-localIP $localIP `
	-location $location `
	-addressPrefix $lgwSubnetPrefix
	Update-Logs -content ("Azure Local Gateway Updated")
	}
	# Make sure all RRAS connections are connected.
	Connect-LocalGateway
	#endregion

view raw updateS2S.ps1 hosted with ❤ by GitHub

Now that we are checking and updating our Local Network Gateway Connection IP address, we need to create a timer job that will check and update on a regular basis. Below is a script that will check every hour on the hour. Make sure that the Update S2S file path is set correctly.

	#region Create Scheduled Task as User
	$jobName = "Azure S2S IP Checker"
	$filePath = 'C:\Scripts\Update S2S and RRAS.ps1'
	$cred = Get-Credential -Message "Enter Run As Credentials..."
	$sj = Get-ScheduledJob -Name $jobName -ErrorAction SilentlyContinue
	if ($sj.count -gt 0) {
	Write-Host "$jobName scheduled job already exists..."
	}
	else {
	Write-Host "Creating $jobName scheduled Job..."
	$sj = Register-ScheduledJob –Name $jobName `
	-Credential $cred `
	-FilePath $filePath `
	-ScheduledJobOption (New-ScheduledJobOption -ContinueIfGoingOnBattery:$true -StartIfOnBattery:$true) `
	-Trigger (New-JobTrigger -Once -At "12/12/2017 01:00:00" -RepetitionInterval (New-TimeSpan -Hours 1) -RepeatIndefinitely)
	}
	#endregion

view raw createScheduledTask.ps1 hosted with ❤ by GitHub

Creating File Shares in Azure using PowerShell

The other day I was helping migrate a client from one cloud provider into Azure, when they ran into a problem with their file share server. It made me think about the Azure File Service that is available, and how to implement this from a corporate perspective, and then my mind wandered and I wanted to see how to create a file share just for my Surface Pro. There is an excellent post called Get started with Azure File storage on Windows that go me started, but I was not too happy with the implementation, as I would like my file share available to me after I reboot my Surface Pro, plus I do not want anyone logged into my Surface to have access to MY file share.
The beginning of the script is basic creating the Resource Group and Storage Account, as it is a file share, I am using global redundant storage, on HDDs not SSDs.

	#region Create Resource Group
	$rg = Get-AzureRmResourceGroup -Name $resourceGroup -Location $location -ErrorAction SilentlyContinue
	if ($rg) {
	Write-Host "$resourceGroup resource group already exists..."
	}
	else {
	Write-Host "Creating $resourceGroup Resource Group..."
	$rg = New-AzureRmResourceGroup -Name $resourceGroup -Location $location -Force
	}
	#endregion
	#region Create Storage Account
	$sa = $rg | Get-AzureRMStorageAccount -StorageAccountName $storageAccountName -ErrorAction SilentlyContinue
	if ($sa) {
	Write-Host "$storageAccountName storage account already exists..."
	}
	else {
	Write-Host "Checking to see if $storageAccountName is valid..."
	$valid = Get-AzureRmStorageAccountNameAvailability -Name $storageAccountName.ToLower()
	if ($valid.NameAvailable) {
	Write-Host "$storageAccountName is valid..."
	Write-Host "Creating $storageAccountName Storage Account..."
	$sa = $rg | New-AzureRMStorageAccount -StorageAccountName $storageAccountName.ToLower() -Location $location -Type "Standard_GRS" -EnableEncryptionService File
	}
	else {
	Write-Host $valid.Message
	Exit
	}
	}
	#endregion

view raw Create Resource Group and Storage Account.ps1 hosted with ❤ by GitHub

Storage within Azure is Context based, so to create the Azure File Share, we will need to create a context. Once we create the context, we can create the File Share.

	#region Create File Share
	# Get Storage Key
	$key = ($sa | Get-AzureRmStorageAccountKey).Value | Select -First 1
	# Create Context
	$ctx = New-AzureStorageContext -StorageAccountName $storageAccountName.ToLower() -StorageAccountKey $key
	$csa = Set-AzureRmCurrentStorageAccount -Context $ctx
	# Create File Share
	$ss = Get-AzureRmStorageAccount | Get-AzureStorageShare | Where-Object {$_.Name -eq $fileShareName.ToLower()}
	if ($ss.count -gt 0) {
	Write-Host("$fileShareName file share already exists...")
	}
	else {
	Write-Host("Creating $fileShareName file share...")
	$ss = New-AzureStorageShare -Name $fileShareName.ToLower() -Context $ctx
	}
	#endregion

view raw Create Storage Context and File Share.ps1 hosted with ❤ by GitHub

Now that we have created the Azure File Share, we want to store the login credentials locally to make mounting the drive easier.

	#region Store Credentials
	Write-Host "Storing file share credentials..."
	$add = "$storageAccountName.file.core.windows.net"
	cmdkey /add:$add /user:AZURE\$storageAccountName /pass:$key
	#endregion

view raw Store File Share Credentials.ps1 hosted with ❤ by GitHub

The next step is to mount the file share as a local drive (X:\ drive in this example). I tried using the New-PSDrive cmdlet, but could not get it to work consistently, so ended with the script below. One thing to notice is that in line 9 I am creating a Script Block from a string variable, instead of creating a script block with parameters and passing in values. I found this to be a very nice and easy way to deal with passing variables into a script block. Plus I need the script block in a later part of the script, so it was win-win.

	#region Mount File Share
	$root = "\\" + $storageAccountName + ".file.core.windows.net\" + $fileShareName
	$psd = Get-PSDrive | Where-Object {$_.DisplayRoot -eq $root}
	if ($psd.Count -gt 0) {
	Write-Host "File share already exists as drive $psd..."
	}
	else {
	$command = "net use " + $driveLetter + ": " + $root
	$sb = [scriptblock]::Create($command)
	$sb.Invoke()
	}
	#endregion

view raw Mount File Share.ps1 hosted with ❤ by GitHub

Now at this point, I have a mounted X Drive to my Azure File Share, but it is not persisted. To allow my drive to return after reboot, I have to create a Scheduled Job that will run on logon for the person running this script.

	#region Create Log In Task
	$user = whoami
	$sj = Get-ScheduledJob -Name $jobName -ErrorAction SilentlyContinue
	if ($sj.count -gt 0) {
	Write-Host "$jobName scheduled job already exists..."
	}
	else {
	Write-Host "Creating $jobName scheduled Job..."
	$sj = Register-ScheduledJob –Name $jobName `
	-ScriptBlock $sb `
	-ScheduledJobOption (New-ScheduledJobOption -ContinueIfGoingOnBattery:$true -StartIfOnBattery:$true) `
	-Trigger (New-JobTrigger -AtLogOn -User $user)
	}
	Write-Host "Updating $jobName scheduled task..."
	$path = (Get-ScheduledTask $jobName).TaskPath
	$principal = New-ScheduledTaskPrincipal -UserId $user
	$st = Set-ScheduledTask -TaskName $jobName -Principal $principal -TaskPath $path
	#endregion

view raw Create Log In Task.ps1 hosted with ❤ by GitHub

Notice in line 15, I grab the Scheduled Job's Path so that I can grab and update the Scheduled Task to update the Task's principal user.
All in all a very cool, and quick way to add 5TB of storage to my Surface Pro.

I could not think of any other reasons why an Enterprise would want a file share in Azure (from a corporate perspective) with the availability of SharePoint Online or OneDrive for Business, but then a client asked me how to send me their bloated SQL Database... You would send your client something like this:

net use x: \\storagefileshare.file.core.windows.net\file-service-01 /u:storagefileshare OYP63u3CiAD5QmySY+67notmyStorageKeySxQWJ56zK5eHWiPQdhIlGp0n8aIiDaqvkThRrWwZqmefXrgqYRq4ZVvw==

view raw Create File Share with Key.ps1 hosted with ❤ by GitHub

Once they upload the file, you would then create a new key for the storage account.
How would/are you using Azure File Service?
Here is the code in its entirety:

	<#
	Add-AzureRmAccount
	#>
	$subscriptionName = "Visual Studio Enterprise"
	$resourceGroup = "storage-pcFileShare"
	$location = "east us 2"
	$storageAccountName = "pcFileShare"
	$fileShareName = "pcFiles"
	$driveLetter = "X"
	$jobName = "Mount $driveLetter Drive"
	Select-AzureRmSubscription -SubscriptionName $subscriptionName
	#region Create Resource Group
	$rg = Get-AzureRmResourceGroup -Name $resourceGroup -Location $location -ErrorAction SilentlyContinue
	if ($rg) {
	Write-Host "$resourceGroup resource group already exists..."
	}
	else {
	Write-Host "Creating $resourceGroup Resource Group..."
	$rg = New-AzureRmResourceGroup -Name $resourceGroup -Location $location -Force
	}
	#endregion
	#region Create Storage Account
	$sa = $rg | Get-AzureRMStorageAccount -StorageAccountName $storageAccountName -ErrorAction SilentlyContinue
	if ($sa) {
	Write-Host "$storageAccountName storage account already exists..."
	}
	else {
	Write-Host "Checking to see if $storageAccountName is valid..."
	$valid = Get-AzureRmStorageAccountNameAvailability -Name $storageAccountName.ToLower()
	if ($valid.NameAvailable) {
	Write-Host "$storageAccountName is valid..."
	Write-Host "Creating $storageAccountName Storage Account..."
	$sa = $rg | New-AzureRMStorageAccount -StorageAccountName $storageAccountName.ToLower() -Location $location -Type "Standard_GRS" -EnableEncryptionService File
	}
	else {
	Write-Host $valid.Message
	Exit
	}
	}
	#endregion
	#region Create File Share
	# Get Storage Key
	$key = ($sa | Get-AzureRmStorageAccountKey).Value | Select -First 1
	# Create Context
	$ctx = New-AzureStorageContext -StorageAccountName $storageAccountName.ToLower() -StorageAccountKey $key
	$csa = Set-AzureRmCurrentStorageAccount -Context $ctx
	# Create File Share
	$ss = Get-AzureRmStorageAccount | Get-AzureStorageShare | Where-Object {$_.Name -eq $fileShareName.ToLower()}
	if ($ss.count -gt 0) {
	Write-Host("$fileShareName file share already exists...")
	}
	else {
	Write-Host("Creating $fileShareName file share...")
	$ss = New-AzureStorageShare -Name $fileShareName.ToLower() -Context $ctx
	}
	#endregion
	#region Store Credentials
	Write-Host "Storing file share credentials..."
	$add = "$storageAccountName.file.core.windows.net"
	cmdkey /add:$add /user:AZURE\$storageAccountName /pass:$key
	#endregion
	#region Mount File Share
	$root = "\\" + $storageAccountName + ".file.core.windows.net\" + $fileShareName
	$psd = Get-PSDrive | Where-Object {$_.DisplayRoot -eq $root}
	if ($psd.Count -gt 0) {
	Write-Host "File share already exists as drive $psd..."
	}
	else {
	$command = "net use " + $driveLetter + ": " + $root
	$sb = [scriptblock]::Create($command)
	$sb.Invoke()
	}
	#endregion
	#region Create Log In Task
	$user = whoami
	$sj = Get-ScheduledJob -Name $jobName -ErrorAction SilentlyContinue
	if ($sj.count -gt 0) {
	Write-Host "$jobName scheduled job already exists..."
	}
	else {
	Write-Host "Creating $jobName scheduled Job..."
	$sj = Register-ScheduledJob –Name $jobName `
	-ScriptBlock $sb `
	-ScheduledJobOption (New-ScheduledJobOption -ContinueIfGoingOnBattery:$true -StartIfOnBattery:$true) `
	-Trigger (New-JobTrigger -AtLogOn -User $user)
	}
	Write-Host "Updating $jobName scheduled task..."
	$path = (Get-ScheduledTask $jobName).TaskPath
	$principal = New-ScheduledTaskPrincipal -UserId $user
	$st = Set-ScheduledTask -TaskName $jobName -Principal $principal -TaskPath $path
	#endregion

view raw Create and Mount Azure File Share.ps1 hosted with ❤ by GitHub

Download All Files in a Yammer Group!

I was lucky enough to take a week long Azure Cloud Solution Architect training class hosted by Microsoft. Unluckily, they uploaded all the documents for the class into Yammer, apporoximately 80 files. Now, I could just go to each file and individually download each file, but where is the fun with that? So, I decided to do a quick search and found a couple of blog posts.
I found a GitHub post Download all files in a Yammer.com group and a blog post from Sahil Malik (https://twitter.com/sahilmalik) Download Multiple Files from Yammer - easily.
The first problem that I ran into was that neither code worked any longer due to the url structure change, as Sahil predicted. The second problem was that the code opened up a new tab for each file downloaded. I figured there had to be a better way.
Now, I am fortunate enough to be able to reach out to someone I consider to be one of the best JavaScript developers around, Matthew Bramer (https://twitter.com/iOnline247) for a bit of help.
In this post, I am going to show you a couple of ways to download your files. First is the full length developer version, while the other is a quick and easily repeatable version.
We decided to test this in Chrome only. The developer version should work in Edge, but was only tested in Chrome. If you want to complain that you cannot get it to work, TRY CHROME FIRST!

Do This First
1) Within Chrome, open up Settings, and select Show advanced settings...
2) Under Downloads, set a download location and make sure that the Ask where to save each file before downloading check box is NOT selected.

Full Length Developer Version
1) Open up Yammer, and go to the files location.
     a) Make sure that you scroll down and click the More button to show all of the files.
2) Hit F12 to open the Developer Tools
3) Under Sources, select Snippets.
4) Insert the following code into the Script snippet window:

	function getDownloadLink(el, i) {
	'use strict';
	var rlastForwardSlash = /.+\//,
	fileId = (el.href) ? el.href.replace(rlastForwardSlash, '') : '',
	downloadPath = 'https://www.yammer.com/api/v1/uploaded_files/' + fileId + '/download'
	;
	return downloadPath;
	}
	function downloadFile(dataUrl) {
	'use strict';
	// Construct the a element
	var link = document.createElement('a');
	link.download = 'filename';
	link.target = '_blank';
	// Construct the uri
	link.href = dataUrl;
	document.body.appendChild(link);
	link.click();
	// Cleanup the DOM
	document.body.removeChild(link);
	}
	var fileNodes = Array.from(document.querySelectorAll('.page-content .yj-tabular-data-name'));
	fileNodes.map(getDownloadLink).forEach(downloadFile);

view raw downloadAllYammerFiles.js hosted with ❤ by GitHub

5) Click the run snippet button (Ctrl + Enter) to start your downloads

Easily Repeatable Version
1) Within Chrome, open the Bookmark Manager (Ctrl + Shift + O)
2) Under Folders, select (or create) the appropriate folder
3) Under Organize, click the Organize drop-down and select Add page...
4) Give the Page an appropriate name like, Download All Yammer Files on Page
5) For the URL, paste the following code.

javascript:!function(e){function a(e,a){var n=/.+\//,o=e.href&&e.href.replace(n,"")||"",r="https://www.yammer.com/api/v1/uploaded_files/"+o+"/download";return r}function n(e){var a=document.createElement("a");a.download="filename",a.target="_blank",a.href=e,document.body.appendChild(a),a.click(),document.body.removeChild(a),delete a}var o=Array.from(e.querySelectorAll(".page-content .yj-tabular-data-name"));o.map(a).forEach(n)}(document);

view raw downloadAllYammerFiles.js.min hosted with ❤ by GitHub

6) Open up Yammer, and go to the files location.
     a) Make sure that you scroll down and click the More button to show all of the files.
7) Open the bookmark that you just created to start downloading all the files.

Thank you Matthew for helping me get this up and running in time for Ignite...

Backup and Restore SQL User Databases Using PowerShell

There are several ways how to backup and restore SQL databases. Over time, the way I back up and restore databases has changed.
Originally my backup database code looked like this:

	$bkdir = "\\SQL2012B\Shared\Temp" # Set Backup Path!
	# SSMS needed to be installed to load the SQL Assemblies
	[System.Reflection.Assembly]::LoadWithPartialName("Microsoft.SqlServer.SMO") | out-null
	[System.Reflection.Assembly]::LoadWithPartialName("Microsoft.SqlServer.SmoExtended") | out-null
	$s = new-object ("Microsoft.SqlServer.Management.Smo.Server") $instance
	# Grabs ALL of the databases
	$dbs = $s.Databases
	foreach ($db in $dbs)
	{
	if(($db.Name -ne "tempdb") -and ($db.Name -ne "master") -and ($db.Name -ne "model") -and ($db.Name -ne "msdb"))
	{
	$dbname = $db.Name
	$dbBackup = new-object ("Microsoft.SqlServer.Management.Smo.Backup")
	$dbBackup.Action = "Database"
	$dbBackup.Database = $dbname
	$dbBackup.Devices.AddDevice($bkdir + "\" + $dbname + ".bak", "File")
	$dbBackup.SqlBackup($s)
	write-host($db.name + " has been backed up.")
	}
	}

view raw backupDatabases_Orig.ps1 hosted with ❤ by GitHub

The problem is that you needed to have SQL Server Management Studio (SSMS) installed for the code to run correctly. Having SSMS installed on a production server is not the best of ideas, so luckily PowerShell gives us the ability to backup all user databases very easily:

	Import-Module SQLPS -DisableNameChecking -EA 0
	# Get the current date
	$date = Get-Date -Format yyyyMMdd
	# Set location of backup files
	$backupPath = "J:\Backups"
	$sqlInstance = $env:COMPUTERNAME
	# Grab the Databases
	$dbNames = Get-ChildItem "SQLSERVER:\SQL\$sqlInstance\DEFAULT\Databases" | Select Name
	# Backup the Databases
	foreach ($dbName in $dbNames) {
	$db = $dbName.Name.ToString()
	$bakfile = $backupPath + "\" + $db + "_" + $date + ".bak"
	Write-Verbose("Backing up Database: $db") -Verbose
	$query1 = "BACKUP DATABASE $db TO DISK=N'$bakfile' WITH INIT"
	Invoke-Sqlcmd -SuppressProviderContextWarning -Query $query1 -QueryTimeout 600
	}

view raw backupUserDatabases.ps1 hosted with ❤ by GitHub

Now that we have our databases backed up, let's take a look at the old way that I use to restore databases:

	$restoreDir = "J:\Backups"
	# Get files in backup directory
	$files = get-childitem $restoreDir -recurse
	foreach ($file in $files)
	{
	$query = "RESTORE DATABASE [" + $file.basename + "]
	FROM DISK = N'" + $restoreDir + $file + "' WITH FILE = 1,
	MOVE N'" + $file.basename + "' TO N'" + $dataLocation + $file.basename + ".mdf',
	MOVE N'" + $file.basename + "_log' TO N'" + $logLocation + $file.basename + "_log.LDF',
	NOUNLOAD,
	STATS = 5"
	invoke-sqlcmd -query $query -Database "Master" -ServerInstance $serverInstance -Username "SA" -Password "Password1"
	write-host ("$query")
	}

view raw restoreDatabases_Orig.ps1 hosted with ❤ by GitHub

Below is the newer, strictly using PowerShell way that I use to restore the just backed up databases:

	Import-Module SQLPS -DisableNameChecking -EA 0
	$backupPath = "J:\Backups" # location of all the .bak files
	$sqlInstance = $env:COMPUTERNAME
	$files = Get-ChildItem -Path $backupPath -Filter *.bak
	foreach ($file in $files) {
	$fileName = $file.Name
	$dbName = $fileName.Substring(0,($fileName.Length - 13)) # length based off suffix of "_yyyyMMdd.bak" eg: "_20161901.bak"
	Write-Verbose ("Restoring $dbName...") -Verbose
	Restore-SqlDatabase -ServerInstance $sqlInstance -Database $dbName -BackupFile $file.FullName -RestoreAction Database -ReplaceDatabase
	}

view raw restoreUserDatabases.ps1 hosted with ❤ by GitHub

Hopefully this will give you a couple of good solutions for backing up and restoring your SQL Server Databases through PowerShell.
-PC

Moving User SQL Databases Using PowerShell

I grew tired of manually moving databases around using a combination of SQL and "Copy / Paste" so wrote out a bit of PowerShell to save me some time and effort.
Notice that I am using the copy-item then deleting the object, not just moving the item. This is because of how permissions on objects are handled with copy vs move, plus I am paranoid about not having my original database handy if the move fails, or the moved database gets corrupted in transit.

Let's take a look at the code

In the first section we will be setting the variables.

	Import-Module SQLPS -DisableNameChecking -EA 0
	$dbName = "deleteme" # Database Name
	$mdfNewLocation = "G:\Data" # Where the .mdf file will be moved to
	$ldfNewLocation = "H:\Logs" # Where the .ldf file will be moved to
	$sqlSA = "sqlSA" # The SQL SA Account username
	$domain = $env:USERDOMAIN
	$sqlSA = $domain + "\" + $sqlSA # Converts the SA account from username to Account Name (domain\username)
	$location = Get-Location # Gets current location to return at the end

view raw Module Import and Variables.ps1 hosted with ❤ by GitHub

The next step is to get the database information:

	#region Get Database Info
	$query1 = "SELECT name, physical_name AS CurrentLocation, state_desc
	FROM sys.master_files
	WHERE database_id = DB_ID(N'" + $dbName + "');"
	Write-Verbose "Getting [$dbName] information..." -Verbose
	$items = Invoke-Sqlcmd -Query $query1
	Write-Output $items
	#endregion

view raw Get Database Information.ps1 hosted with ❤ by GitHub

Once we have the database information, the database will need to be taken OFFLINE:

	#region Take DB Offline
	# Set DB OFFLINE (Rollback is set to IMMEDIATE)
	$query2 = "ALTER DATABASE [" + $dbName + "] SET OFFLINE WITH ROLLBACK IMMEDIATE;"
	Write-Verbose "Taking [$dbName] Offline..." -Verbose
	Invoke-Sqlcmd -Query $query2
	# Get DB Status
	function getDBStatus ($dbName) {
	$query3 = "SELECT DATABASEPROPERTYEX('" + $dbName + "', 'Status') AS dbStatus"
	$dbStatus = Invoke-Sqlcmd -Query $query3
	return $dbStatus
	}
	# Wait until DB goes OFFLINE (which shouldn't be needed since ROLLBACK is set to IMMEDIATE)
	Write-Verbose "Getting [$dbName] status..." -Verbose
	$status = getDBStatus -dbName $dbName
	Write-Output $status
	$time = 0
	while(-not ($status.dbStatus -eq "OFFLINE")){
	sleep 2;
	$time = $time + 2
	Write-Verbose "Still waiting on DB to go OFFLINE... ($time seconds elapsed)" -Verbose
	$status = getDBStatus -dbName $dbname
	if ($time -gt 28) {
	break
	}
	}
	#endregion

view raw Take DB Offline.ps1 hosted with ❤ by GitHub

Once the database is offline, we can copy the file, set ACLs, and update the database with the new .mdf and .ldf file locations:

	#region Copy Files, Set ACLs, and Alter Database
	foreach ($item in $items) {
	function copyItem ($newLocation, $file, $currentItem) { # copyItem Function to copy file
	$destination = $newLocation + "\" + $file # Set destination of file
	Write-Verbose "Moving $file to $destination..." -Verbose
	Copy-Item -Path $currentItem -Destination $destination # Copy the file to the destination
	return $destination # Returns the new file location
	}
	$currentItem = $item.CurrentLocation # Gets the location of either the .mdf or .ldf file
	$itemExtension = [System.IO.Path]::GetExtension($currentItem) # Grabs file extension
	$file = [System.IO.Path]::GetFileName($currentItem) # Grabs full file name
	$name = $item.name
	switch ($itemExtension) { # Instead of using IF Statement
	".mdf" { # Is $itemExtension = ".mdf"
	$destination = copyItem -newLocation $mdfNewLocation -file $file -currentItem $currentItem
	$folderLocation = $mdfNewLocation # Set $folderLocation
	}
	".ldf" { # Is $itemExtension = ".ldf"
	$destination = copyItem -newLocation $ldfNewLocation -file $file -currentItem $currentItem
	$folderLocation = $ldfNewLocation # Set $folderLocation
	}
	default { # if $itemExtension is neither ".mdf" or ".ldf"
	Write-Verbose "The file extension is not supported..." -Verbose
	break # Stop if file extension is not ".mdf" or ".ldf"
	}
	}
	# Set ACLs
	# Change to UTC Path Format # Change from path based to UTC based format
	$destDrive = Split-Path -qualifier $destination # Get drive letter
	$utcPath = "\\$env:computername\" + $destDrive.Replace(":","$") # Start creating UTC Path
	$destination = $destination.Replace($destDrive, $utcPath) # Update $destination to correct path format
	Set-Location $destDrive # Set location just in case it moved to SQLSERVER:
	Write-Verbose "Setting ACL on $destination..." -Verbose
	# Set db to Inherit Permissions
	$acl = Get-Acl $destination # Get the file's current ACL settings
	Write-Verbose "Setting to Inherit Permissions..." -Verbose
	$acl.SetAccessRuleProtection($false,$false) # Enable inheritance and remove non-inherited roles
	# Set Owner of DB to SA Account
	$owner = New-Object System.Security.Principal.NTAccount($sqlSA) # Get the security object for the SQL SA Account
	Write-Verbose "Updating Item Owner to $owner..." -Verbose
	$acl.SetOwner($owner) # Set item owner
	$acl | Set-Acl # Update the file with ACL updates
	# Update Database
	$query4 = "ALTER DATABASE [" + $dbName + "] MODIFY FILE ( NAME = " + $name + ", FILENAME = '" + $destination + "' );"
	Write-Verbose "Updating Database with new file location..." -Verbose
	Invoke-Sqlcmd -Query $query4 # Update database with new file location
	}
	Set-Location $location # Set location back to original location
	#endregion

view raw Copy Set Alter DB Files.ps1 hosted with ❤ by GitHub

Then we can bring the DB back ONLINE

	#region Bring DBs Online
	$query5 = "ALTER DATABASE [" + $dbName + "] SET ONLINE;"
	Write-Output "Bring $dbName ONLINE..."
	Invoke-Sqlcmd -Query $query5
	#endregion

view raw Bring DB Back Online.ps1 hosted with ❤ by GitHub

Once the DB is back ONLINE, wait for 10 seconds and delete the original database:

	#region wait for 10 then Delete Old Files
	# wait for 10
	for ($i = 10; $i -gt 0; $i--) {
	Write-Host("Deleting old files in $i seconds")
	Start-Sleep -Seconds 1
	}
	# delete old files
	foreach ($item in $items) {
	Remove-Item -Path $item.CurrentLocation -Force
	}
	#endregion

view raw Wait 10 Seconds and Delete Old File.ps1 hosted with ❤ by GitHub

Here is a look at the code once it is all put together:

	Import-Module SQLPS -DisableNameChecking -EA 0
	$dbName = "deleteme"
	$mdfNewLocation = "G:\Data"
	$ldfNewLocation = "H:\Logs"
	$sqlSA = "sqlSA"
	$domain = $env:USERDOMAIN
	$sqlSA = $domain + "\" + $sqlSA
	$location = Get-Location
	#region Get Database Info
	$query1 = "SELECT name, physical_name AS CurrentLocation, state_desc
	FROM sys.master_files
	WHERE database_id = DB_ID(N'" + $dbName + "');"
	Write-Verbose "Getting [$dbName] information..." -Verbose
	$items = Invoke-Sqlcmd -Query $query1
	Write-Output $items
	#endregion
	#region Take DB Offline
	# Set DB OFFLINE
	$query2 = "ALTER DATABASE [" + $dbName + "] SET OFFLINE WITH ROLLBACK IMMEDIATE;"
	Write-Verbose "Taking [$dbName] Offline..." -Verbose
	Invoke-Sqlcmd -Query $query2
	# Get DB Status
	function getDBStatus ($dbName) {
	$query3 = "SELECT DATABASEPROPERTYEX('" + $dbName + "', 'Status') AS dbStatus"
	$dbStatus = Invoke-Sqlcmd -Query $query3
	return $dbStatus
	}
	# Wait until DB goes OFFLINE
	Write-Verbose "Getting [$dbName] status..." -Verbose
	$status = getDBStatus -dbName $dbName
	Write-Output $status
	$time = 0
	while(-not ($status.dbStatus -eq "OFFLINE")){
	sleep 2;
	$time = $time + 2
	Write-Verbose "Still waiting on DB to go OFFLINE... ($time seconds elapsed)" -Verbose
	$status = getDBStatus -dbName $dbname
	if ($time -gt 28) {
	break
	}
	}
	#endregion
	#region Copy Files, Set ACLs, and Alter Database
	foreach ($item in $items) {
	function copyItem ($newLocation, $file, $currentItem) {
	$destination = $newLocation + "\" + $file
	Write-Verbose "Moving $file to $destination..." -Verbose
	Copy-Item -Path $currentItem -Destination $destination
	return $destination
	}
	$currentItem = $item.CurrentLocation
	$itemExtension = [System.IO.Path]::GetExtension($currentItem)
	$file = [System.IO.Path]::GetFileName($currentItem)
	$name = $item.name
	switch ($itemExtension) {
	".mdf" {
	$destination = copyItem -newLocation $mdfNewLocation -file $file -currentItem $currentItem
	$folderLocation = $mdfNewLocation
	}
	".ldf" {
	$destination = copyItem -newLocation $ldfNewLocation -file $file -currentItem $currentItem
	$folderLocation = $ldfNewLocation
	}
	default {
	Write-Verbose "The file extension is not supported..." -Verbose
	break
	}
	}
	# Set ACLs
	# Change to UTC Path Format
	$destDrive = Split-Path -qualifier $destination
	$utcPath = "\\$env:computername\" + $destDrive.Replace(":","$")
	$destination = $destination.Replace($destDrive, $utcPath)
	Set-Location $destDrive
	Write-Verbose "Setting ACL on $destination..." -Verbose
	# Set db to Inherit Permissions
	$acl = Get-Acl $destination
	Write-Verbose "Setting to Inherit Permissions..." -Verbose
	$acl.SetAccessRuleProtection($false,$false)
	# Set Owner of DB to SA Account
	$owner = New-Object System.Security.Principal.NTAccount($sqlSA)
	Write-Verbose "Updating Item Owner to $owner..." -Verbose
	$acl.SetOwner($owner)
	$acl | Set-Acl
	# Update Database
	$query4 = "ALTER DATABASE [" + $dbName + "] MODIFY FILE ( NAME = " + $name + ", FILENAME = '" + $destination + "' );"
	Write-Verbose "Updating Database with new file location..." -Verbose
	Invoke-Sqlcmd -Query $query4
	}
	Set-Location $location
	#endregion
	#region Bring DBs Online
	$query5 = "ALTER DATABASE [" + $dbName + "] SET ONLINE;"
	Write-Output "Bring $dbName ONLINE..."
	Invoke-Sqlcmd -Query $query5
	#endregion
	#region wait for 10 then Delete Old Files
	# wait for 10
	for ($i = 10; $i -gt 0; $i--) {
	Write-Host("Deleting old files in $i seconds")
	Start-Sleep -Seconds 1
	}
	# delete old files
	foreach ($item in $items) {
	Remove-Item -Path $item.CurrentLocation -Force
	}
	#endregion

view raw moveUserDatabases.ps1 hosted with ❤ by GitHub

Updates
01/01/2016: Fixed issues with ACL for moved files by converting file location to UTC based path format.
01/02/2016: Updated to include snippets and comments
01/05/2016: Major update to fix $destination to UTC path, added copyItem function, item extension switch, updated outputs with write-output and write-verbose.

Manually Download and Install the Prerequisites for SharePoint 2016

At some point within your career of deploying SharePoint, you will hopefully come across a scenario where your SharePoint servers are not allowed internet access. Most of the server farms that I work on are not allowed access to the Internet or are fire-walled/ruled out of the ability to surf the web or the ability to download items directly. This brings me to the need to be able to download the required files to a specific location and use that location for SharePoint's PrerequisiteInstaller.exe to complete its installation.
If you need to do an offline installation of SharePoint 2016, you will need to have the prerequisite files downloaded ahead of time. You will also need the SharePoint 2016 .iso (download here). These scripts are based off of the scripts provided by Craig Lussier (@craiglussier).
These scripts will work for SharePoint 2016 on Windows Server 2012R2 or on Windows Server 2016.
The only change that needs to be made is the location of the SharePoint prerequisiteinstaller.exe file in script #3 line #3. So, update the $sp2016Location variable before running. If the SP2016 .iso is mounted to the "D:\" drive, you have nothing to change and, in theory, this should just work for you out of the box.
The first thing that I like to do is to add the windows features:

	#region Create Server 2012R2 Features Array
	function getServer2012R2Features {
	$windows2012R2Features = @(
	"Application-Server",
	"AS-NET-Framework",
	"AS-Web-Support",
	"FileAndStorage-Services",
	"Storage-Services",
	"Web-Server",
	"Web-WebServer",
	"Web-Common-Http",
	"Web-Default-Doc",
	"Web-Dir-Browsing",
	"Web-Http-Errors",
	"Web-Static-Content",
	"Web-Http-Redirect",
	"Web-Health",
	"Web-Http-Logging",
	"Web-Log-Libraries",
	"Web-Request-Monitor",
	"Web-Performance",
	"Web-Stat-Compression",
	"Web-Dyn-Compression",
	"Web-Security",
	"Web-Filtering",
	"Web-Basic-Auth",
	"Web-Client-Auth",
	"Web-Digest-Auth",
	"Web-Cert-Auth",
	"Web-IP-Security",
	"Web-Url-Auth",
	"Web-Windows-Auth",
	"Web-App-Dev",
	"Web-Net-Ext",
	"Web-Net-Ext45",
	"Web-Asp-Net45",
	"Web-ISAPI-Ext",
	"Web-ISAPI-Filter",
	"Web-Mgmt-Tools",
	"Web-Mgmt-Console",
	"Web-Mgmt-Compat",
	"Web-Metabase",
	"Web-Lgcy-Mgmt-Console",
	"Web-Lgcy-Scripting",
	"Web-WMI",
	"Web-Scripting-Tools",
	"NET-Framework-Features",
	"NET-Framework-Core",
	"NET-HTTP-Activation",
	"NET-Non-HTTP-Activ",
	"NET-Framework-45-Features",
	"NET-Framework-45-Core",
	"NET-Framework-45-ASPNET",
	"NET-WCF-Services45",
	"NET-WCF-HTTP-Activation45",
	"NET-WCF-TCP-PortSharing45",
	"FS-SMB1",
	"User-Interfaces-Infra",
	"Server-Gui-Mgmt-Infra",
	"Server-Gui-Shell",
	"Windows-Identity-Foundation",
	"PowerShellRoot",
	"PowerShell",
	"PowerShell-V2",
	"PowerShell-ISE",
	"WAS",
	"WAS-Process-Model",
	"WAS-NET-Environment",
	"WAS-Config-APIs",
	"WoW64-Support"
	)
	return $windows2012R2Features
	}
	#endregion
	#region Create Server 2016 Features Array
	function getServer2016Features ($sku) {
	$windows2016Features = @(
	"FileAndStorage-Services"
	"Storage-Services",
	"Web-Server",
	"Web-WebServer",
	"Web-Common-Http",
	"Web-Default-Doc",
	"Web-Dir-Browsing",
	"Web-Http-Errors",
	"Web-Static-Content",
	"Web-Health",
	"Web-Http-Logging",
	"Web-Log-Libraries",
	"Web-Request-Monitor",
	"Web-Http-Tracing",
	"Web-Performance",
	"Web-Stat-Compression",
	"Web-Dyn-Compression",
	"Web-Security",
	"Web-Filtering",
	"Web-Basic-Auth",
	"Web-Client-Auth",
	"Web-Digest-Auth",
	"Web-Cert-Auth",
	"Web-IP-Security",
	"Web-Url-Auth",
	"Web-Windows-Auth",
	"Web-App-Dev",
	"Web-Net-Ext",
	"Web-Net-Ext45",
	"Web-Asp-Net",
	"Web-Asp-Net45",
	"Web-ISAPI-Ext",
	"Web-ISAPI-Filter",
	"Web-Mgmt-Tools",
	"Web-Mgmt-Console",
	"Web-Mgmt-Compat",
	"Web-Metabase",
	"Web-Lgcy-Scripting",
	"Web-WMI",
	"NET-Framework-Features",
	"NET-Framework-Core",
	"NET-HTTP-Activation",
	"NET-Non-HTTP-Activ",
	"NET-Framework-45-Features",
	"NET-Framework-45-Core",
	"NET-Framework-45-ASPNET",
	"NET-WCF-Services45",
	"NET-WCF-HTTP-Activation45",
	"NET-WCF-Pipe-Activation45",
	"NET-WCF-TCP-PortSharing45",
	"Server-Media-Foundation",
	"FS-SMB1",
	"Windows-Identity-Foundation",
	"PowerShellRoot",
	"PowerShell",
	"PowerShell-V2",
	"PowerShell-ISE",
	"WAS",
	"WAS-Process-Model",
	"WAS-NET-Environment",
	"WAS-Config-APIs",
	"WoW64-Support",
	"XPS-Viewer"
	)
	# if OS is Enterprise
	if ($sku -eq 10) {
	$windows2016Features += ("InkAndHandwritingServices",
	"User-Interfaces-Infra",
	"Server-Gui-Mgmt-Infra",
	"Desktop-Experience",
	"Server-Gui-Shell",
	"Windows-Server-Antimalware-Features",
	"Windows-Server-Antimalware"
	)
	}
	return $windows2016Features
	}
	#endregion
	#region Get Server OS Information
	function setEnvironment {
	# Get OS Version Information
	$serverOS = ([environment]::OSVersion.Version)
	# Enterprise or Standard
	$OS = (Get-WmiObject -ComputerName $env:COMPUTERNAME -Class Win32_OperatingSystem)
	$sku = $OS.OperatingSystemSKU
	# Server 2016
	if ($serverOS.Major -eq "10") {
	$windowsFeatures = @()
	$windowsFeatures = getServer2016Features -sku $sku
	$OS = $OS.Caption
	Write-Host("Adding features for $OS...")
	}
	# Server 2012R2
	if ($serverOS.Major -eq "6") {
	$windowsFeatures = @()
	$windowsFeatures = getServer2012R2Features
	$OS = (Get-WmiObject -ComputerName $env:COMPUTERNAME -Class Win32_OperatingSystem).Caption
	Write-Host("Adding features for $OS...")
	}
	# Add Windows Features
	$restart = Add-WindowsFeature (ForEach-Object{$windowsFeatures})
	if ($restart.RestartNeeded -ne "No") {
	#if reboot required...
	restartComputer
	}
	}
	#endregion
	#region Reboot Server
	function restartComputer {
	for ($i = 10; $i -gt 0; $i--) {
	Write-Host("$env:COMPUTERNAME will reboot in $i seconds")
	Start-Sleep -Seconds 1
	}
	Restart-Computer -Force
	}
	#endregion
	#region Call Functions
	setEnvironment
	#endregion

view raw 01- sp2016 Enable Windows Features.ps1 hosted with ❤ by GitHub

The second step is to download the items required for the prerequisite installer:

	Import-Module BitsTransfer
	$destPath = "C:\tempDownloads" # Change this to desired download destination path
	$destPath = $destPath.TrimEnd('\')
	#region validate download path
	function validatePath($destFolder){
	## Check that the path entered is valid
	If (!(Test-Path $destFolder -Verbose)) {
	New-Item -Path $destFolder -ItemType Directory
	}
	}
	#endregion
	#region start downloading files
	function downloadFiles($urlList, $location) {
	# Downloads files based off of $urlList array and saves them to the location based off $location
	# This sets the $destFolder variable based off $location
	if ($location -eq "SPPR") {$destFolder = $destPath + "\SharePoint\downloads\prerequisiteinstallerfiles"}
	# Validate if path exists
	validatePath -destFolder $destFolder
	# Out-File path for later use...
	$destFolder | Out-File "$destPath\sp2016preReqPath.txt" -Force
	ForEach ($url in $urlList) {
	## Get the file name based on the portion of the url after the last slash
	$destFileName = $url.Split('/')[-1]
	$destination = "$destFolder\$destFileName"
	Try {
	## Check if destination file already exists
	If (!(Test-Path $destination)) {
	## Begin download
	Write-Host("Downloading " + $url)
	Start-BitsTransfer -Source $url -Destination $destination -DisplayName "Downloading `'$destFileName`' to $destFolder" -Priority High -Description "From $url..." -ErrorVariable err
	If ($err) {Throw ""}
	}
	Else {
	# If file does exist is it WCF 5.6?
	Write-Host " - File $destFileName already exists, skipping..."
	}
	}
	Catch {
	Write-Warning " - An error occurred downloading `'$destFileName`'" | Out-Null
	$counter = 0
	if ($counter -lt 3) {
	$counter ++
	Write-Warning("Retrying Download in 3 seconds...")
	Start-Sleep -Seconds 3
	downloadFiles -urlList $urlList -location $location
	}
	Else {
	$counter = 0
	break
	}
	}
	}
	return $destFolder
	}
	#endregion
	#region create array of URLs for download
	function getSPPRurls() {
	## Download SharePoint 2016 Prerequisite Installer files
	$SPPRList = ("https://download.microsoft.com/download/4/B/1/4B1E9B0E-A4F3-4715-B417-31C82302A70A/ENU/x64/sqlncli.msi", # Microsoft SQL Server 2012 SP1 Native Client
	"https://download.microsoft.com/download/B/9/D/B9D6E014-C949-4A1E-BA6B-2E0DEBA23E54/SyncSetup_en.x64.zip", # Microsoft Sync Framework Runtime v1.0 SP1 (x64)
	"https://download.microsoft.com/download/A/6/7/A678AB47-496B-4907-B3D4-0A2D280A13C0/WindowsServerAppFabricSetup_x64.exe", # Windows Server AppFabric 1.1
	"https://download.microsoft.com/download/0/1/D/01D06854-CA0C-46F1-ADBA-EBF86010DCC6/rtm/MicrosoftIdentityExtensions-64.msi", # Microsoft Identity Extensions (Windows Identity Foundation v1.1)
	"https://download.microsoft.com/download/3/C/F/3CF781F5-7D29-4035-9265-C34FF2369FA2/setup_msipc_x64.exe", # Microsoft Information Protection and Control Client
	"https://download.microsoft.com/download/F/1/0/F1093AF6-E797-4CA8-A9F6-FC50024B385C/AppFabric-KB3092423-x64-ENU.exe", # Cumulative Update 7 (KB3092423) for Microsoft AppFabric 1.1 for Windows Server
	"https://download.microsoft.com/download/1/C/A/1CAA41C7-88B9-42D6-9E11-3C655656DAB1/WcfDataServices.exe", # Microsoft WCF Data Services 5.6
	"https://download.microsoft.com/download/5/7/2/57249A3A-19D6-4901-ACCE-80924ABEB267/ENU/x64/msodbcsql.msi", # Microsoft ODBC Driver 11 for SQL Server
	"https://download.microsoft.com/download/C/3/A/C3A5200B-D33C-47E9-9D70-2F7C65DAAD94/NDP46-KB3045557-x86-x64-AllOS-ENU.exe", # Microsoft .NET Framework 4.6
	"https://download.microsoft.com/download/3/C/F/3CF781F5-7D29-4035-9265-C34FF2369FA2/setup_msipc_x64.exe", # Microsoft Information Protection and Control Client
	"https://download.microsoft.com/download/1/6/B/16B06F60-3B20-4FF2-B699-5E9B7962F9AE/VSU_4/vcredist_x64.exe", # Visual C++ Redistributable Package for Visual Studio 2012
	"https://download.microsoft.com/download/9/3/F/93FCF1E7-E6A4-478B-96E7-D4B285925B00/vc_redist.x64.exe" # Visual C++ Redistributable for Visual Studio 2015
	)
	$destURL = downloadFiles -urlList $SPPRList -location "SPPR"
	$bustedPOSH = !($destURL -is [string])
	if ($bustedPOSH) {
	Write-Host(" - Implementing PowerShell Bug Workaround...")
	$destURL = $destURL.FullName
	}
	unzipSyncFiles -desturl $destURL
	}
	#endregion
	#region unzip files
	function unzipSyncFiles($destURL) {
	$destURL = $destURL.Trim()
	Add-Type -assembly "system.io.compression.filesystem"
	$zipBackUpPath = $destURL + "\SyncSetup_en.x64.zip"
	$zipDestination = $destURL + "\SyncSetup_en.x64"
	$path = $zipDestination + "\Microsoft Sync Framework\Synchronization.msi"
	$destination = $destURL + "\Synchronization.msi"
	if (Test-Path $destination) {
	Write-Host(" - Synchronization.msi is already extracted...")
	}
	if (!(Test-Path $destination)) {
	Write-Host(" - Extracting SyncSetup_en.x64.zip to: $zipDestination")
	if (Test-Path $zipDestination) {
	Write-Host("Removing Unzipped Folder from: $zipDestination")
	Remove-Item $zipDestination -Recurse -Force
	}
	[io.compression.zipfile]::ExtractToDirectory($zipBackUpPath, $zipDestination)
	Copy-Item -Path $path -Destination $destination
	Write-Host(" - Synchronization.msi unzipped and moved to prerequisiteinstallerfiles folder")
	}
	}
	#endregion
	#region Call Functions
	validatePath -destFolder $destPath
	getSPPRurls
	#endregion

view raw 02- sp2016 Download Prerequisite Files.ps1 hosted with ❤ by GitHub

The next step is to run the prerequisite installer. There is a requirement to restart the server during the installation and provisioning of settings:

	# set varibles
	$sp2016Location = "D:\" # Change to folder location of SharePoint prerequisiteinstaller.exe file
	$destPath = "C:\tempDownloads"
	$sp2016preReqPath = Get-Content "$destPath\sp2016preReqPath.txt"
	Import-Module Servermanager
	#region Create variable paths and copy files
	$sp2016preReqPath = $sp2016preReqPath.TrimEnd('\')
	$sp2016Location = $sp2016Location.TrimEnd('\')
	$filterLoc = $sp2016Location + "\prerequisiteinstallerfiles\filterpack"
	$filterDest = $sp2016preReqPath + "\prerequisiteinstallerfiles"
	$preLoc = $sp2016Location + "\prerequisiteinstaller.exe"
	# Copy prerequisiteinstaller, Visual C++ dll, and filterpack
	Copy-Item "$sp2016Location\vcruntime140.dll" $sp2016preReqPath -Force
	Copy-Item $preLoc $sp2016preReqPath -Force
	Copy-Item $filterLoc $filterDest -Recurse -Force
	#endregion
	#region Install Prerequisites
	function installSP2016Files($path) {
	$arguments = @(
	"/unattended",
	"/SQLNCli:`"$path\sqlncli.msi`"",
	"/Sync:`"$path\Synchronization.msi`"",
	"/AppFabric:`"$path\WindowsServerAppFabricSetup_x64.exe`"",
	"/IDFX11:`"$path\MicrosoftIdentityExtensions-64.msi`"",
	"/MSIPCClient:`"$path\setup_msipc_x64.exe`"",
	"/KB3092423:`"$path\AppFabric-KB3092423-x64-ENU.exe`"",
	"/WCFDataServices56:`"$path\WcfDataServices.exe`"",
	"/ODBC:`"$path\msodbcsql.msi`"",
	"/DotNetFx:`"$path\NDP46-KB3045557-x86-x64-AllOS-ENU.exe`"",
	"/MSVCRT11:`"$path\vcredist_x64.exe`"",
	"/MSVCRT14:`"$path\vc_redist.x64.exe`""
	)
	$setupFile = "$path\prerequisiteinstaller.exe"
	$cmd = "$setupFile $arguments"
	Start-Process $setupFile -ArgumentList $arguments -Verbose -Wait
	for ($i = 10; $i -gt 0; $i--) {
	Write-Host("$env:COMPUTERNAME will reboot in $i seconds")
	Start-Sleep -Seconds 1
	}
	Restart-Computer -Force
	}
	#endregion
	#region Check if files exist
	function checkPath($path) {
	# Check if destination path exists
	If (!(Get-ChildItem -Path $path -ErrorAction -0).Exists) {
	Write-Host("$path does not exist. Please validate the location and try agian.")
	exit
	}
	}
	#endregion
	#region call functions
	checkPath -path $sp2016preReqPath
	checkPath -path $preLoc
	installSP2016Files -path $sp2016preReqPath
	#endregion

view raw 03- sp2016 Install Prerequisite Files.ps1 hosted with ❤ by GitHub

The final step is to continue the installation of the prerequisites:

	$destPath = "C:\tempDownloads"
	$sp2016preReqPath = Get-Content "$destPath\sp2016preReqPath.txt"
	Start-Process "$sp2016preReqPath\PrerequisiteInstaller.exe" -ArgumentList ("/continue /unattended") -Wait

view raw 04- sp2016 Continue Install Prerequisite Files.ps1 hosted with ❤ by GitHub

I hope that this saves you some time and headaches trying to get SP2016 installed and running correctly.

Updates

08/24/2015 Added ability to install on either Technical Preview for Server 2016 or Server 2012R2
08/25/2015 Added verbiage on updating $sp2016Location variable, and added workaround for PowerShell bug in download script.
11/25/2015 Updated for installation of SharePoint 2016 Beta 2 bits.
11/14/2017 Updated the scripts to install SharePoint 2016 on either Server 2012R2 or Server 2016.
11/29/2017 Updated the scripts to install SharePoint 2016 on Server 2016 Standard or Datacenter.
Thank you Matthew Bramer for fixing this oversight.

Copying BLOBs Between Azure Storage Containers

In the past when I needed to move BLOBs between Azure Containers I would use a script that I put together based off of Michael Washam's blog post Copying VHDs (Blobs) between Storage Accounts. However with my latest project, I actually needed to move several BLOBs from the Azure Commercial Cloud to the Azure Government Cloud.
Right off the bat, the first problem is that the endpoint for the Government Cloud is not the default endpoint when using PowerShell cmdlets. So after spending some time updating my script to work in Commercial or Government Azure, I was still not able to move anything. So after a bit of "this worked before, why are you not working now?" frustration, it was time for plan B.

Plan B

Luckily enough the Windows Azure Storage Team had put together a command line utility called AzCopy. AzCopy is a very powerful tool as it will allow you to copy items from a machine on your local network into Azure. It will also copy items from one Azure tenant to another Azure tenant. The problem that I ran into is that the copy is synchronous, meaning that it copies one item at a time, and you cannot start another copy until the previous operation has finished. I also ran the command line in ISE vs directly in the command line, which was not as nice. In the AzCopy command line utility, a status is displayed letting you know elapsed time and when the copy has completed. In ISE, you know your BLOB is copied when script has completed running. You can read up on and download AzCopy from Getting Started with the AzCopy Command-Line Utility. This is the script that I used to move BLOBs between the Azure Commercial Tenant and the Azure Government Tenant.

$sourceContainer = "https://commercialsharepoint.blob.core.windows.net/images"
$sourceKey = "insert your key here"
$destinationContainer = "https://governmentsharepoint.blob.core.usgovcloudapi.net/images"
$destinationKey = "insert your key here"
$file1 = "Server2012R2-Standard-OWA.vhd"
$file2 = "Server2012R2-Standard-SP2013.vhd"
$file3 = "Server2012R2-Standard-SQL2014-Enterprise.vhd"
$files = @($file1,$file2,$file3)
function copyFiles {
    foreach ($file in $files) {
        & 'C:\Program Files (x86)\Microsoft SDKs\Azure\AzCopy\AzCopy.exe' /Source:$sourceContainer /Dest:$destinationContainer /SourceKey:$sourceKey /DestKey:$destinationKey /Pattern:$file 
    }
}
function copyAllFiles {
    & 'C:\Program Files (x86)\Microsoft SDKs\Azure\AzCopy\AzCopy.exe' /Source:$sourceContainer /Dest:$destinationContainer /SourceKey:$sourceKey /DestKey:$destinationKey /S
}
# copyFiles
# copyAllFiles

While I was waiting for my BLOBs to copy over, I decided to look back at my Plan A,and see if I could figure out my issue(s).

Plan A

After cleaning up my script and taking a bit of a "Type-A personality" look at the script, I noticed that i was grabbing the Azure Container Object, but not grabbing the BLOB Object before copying the item. Once I piped the container to the BLOB before copying, it all worked as expected. Below is my script, but please notice that on the Start-AzureStorageBlobCopy cmdlet, I am using the -Force parameter to overwrite the existing destination BLOB if it exists.

# Source Storage Information
$srcStorageAccount = "commercialsharepoint"
$srcContainer = "images"
$srcStorageKey = "insert your key here"
$srcEndpoint = "core.windows.net"
# Destination Storage Information
$destStorageAccount  = "governmentsharepoint"  
$destContainer = "images"
$destStorageKey = "insert your key here"
$destEndpoint = "core.usgovcloudapi.net" 
# Individual File Names (if required)
$file1 = "Server2012R2-Standard-OWA.vhd"
$file2 = "Server2012R2-Standard-SP2013.vhd"
$file3 = "Server2012R2-Standard-SQL2014-Enterprise.vhd"
# Create file name array
$files = @($file1, $file2, $file3)
# Create blobs array
$blobStatus = @()
### Create the source storage account context ### 
$srcContext = New-AzureStorageContext   -StorageAccountName $srcStorageAccount `
                                        -StorageAccountKey $srcStorageKey `
                                        -Endpoint $srcEndpoint 
### Create the destination storage account context ### 
$destContext = New-AzureStorageContext  -StorageAccountName $destStorageAccount `
                                        -StorageAccountKey $destStorageKey `
                                        -Endpoint $destEndpoint
#region Copy Specific Files in Container
    function copyFiles {
        $i = 0
        foreach ($file in $files) {
            $files[$i] = Get-AzureStorageContainer -Name $srcContainer -Context $srcContext | 
                         Get-AzureStorageBlob -Blob $file | 
                         Start-AzureStorageBlobCopy -DestContainer $destContainer -DestContext $destContext -DestBlob $file -ConcurrentTaskCount 512 -Force 
            $i++ 
        }  
        getBlobStatus -blobs $files     
    }
#endregion
#region Copy All Files in Container
    function copyAllFiles {
        $destBlobName = $blob.Name
        $blobs = Get-AzureStorageContainer -Name $srcContainer -Context $srcContext | Get-AzureStorageBlob
        $i = 0
        foreach ($blob in $blobs) {
            $blobs[$i] =  Get-AzureStorageContainer -Name $srcContainer -Context $srcContext | 
                          Get-AzureStorageBlob -Blob $blob.Name | 
                          Start-AzureStorageBlobCopy -DestContainer $destContainer -DestContext $destContext -DestBlob $destBlobName -ConcurrentTaskCount 512 -Force
            $i ++
        }  
        getBlobStatus -blobs $blobs 
    }
#endregion
#region Get Blob Copy Status
    function getBlobStatus($blobs) {
        $completed = $false
        While($completed -ne $true){
            foreach ($blob in $blobs) {
                $counter = 0
                $status = $blob | Get-AzureStorageBlobCopyState
                Write-Host($blob.Name + " has a status of: "+ $status.status) 
                if ($status.status -ne "Success") {
                    $counter ++
                }
                if ($counter -eq 0) {
                    $completed = $true
                }   
                ELSE {
                    Write-Host("Waiting 30 seconds...")
                    Start-Sleep -Seconds 30
                }                         
            }
        }
    }        
#endregion
# copyFiles
# copyAllFiles

Conclusion

Having more than one way to get something accomplished within Azure if fantastic. There is not a lot of documentation out there on how to work with Azure and PowerShell within the Government Cloud, so hopefully this will make life easier for someone. Remember that these scripts can be used across any tenant, Commercial and Government and On-Premises.

Updates

08/05/2015 Fixed cut and paste variable issues and added $destBlobName for renaming BLOBs at the destination location, and updated BLOB status check wait time.

Provisioning SQL Server Always-On Without Rights

Separation of roles, duties, and responsibilities in a larger corporate/government environment is a good thing. It is a good thing unless you are actually trying to get something accomplished quickly on your own. But this is why there is a separation of roles, so that one person cannot simply go and add objects into Active Directory on a whim, or play with the F5 because they watched a video on YouTube. I recently had designed a solution that was going to take advantage of SQL Server 2012 High Availability and Disaster Recovery Always-On Group Listeners. The problem was that I was not a domain admin, and did not have rights to create a computer object for the Server OS Windows Cluster, or the SQL Group Listener.

Creating the OS Cluster

Creating the OS Cluster was the easy part, I just needed to find an administrator that had the rights to create a computer object in the domain. Once that was accomplished, I made sure that the user had local admin rights on all of the soon-to-be clustered machines, and had them run the following script:

$node1 = "Node-01.contoso.local"
$node2 = "Node-02.contoso.local"
$osClusternName = "THESPSQLCLUSTER"
$osClusterIP = "192.168.1.11"
# $ignoreAddress = "172.20.0.0/21"
$nodes = ($node1, $node2)
Import-Module FailoverClusters
function testCluster {
    # Test Cluster
    $test = Test-Cluster -Node (foreach{$nodes})
    $testPath = $env:HOMEPATH + "\AppData\Local\Temp\" + $test.Name.ToString()
    # View Report
    $IE=new-object -com internetexplorer.application
    $IE.navigate2($testPath)
    $IE.visible=$true
}
function buildCluster {
    # Build Cluster
    $new = New-Cluster -Name $osClusternName -Node (foreach{$nodes}) -StaticAddress $osClusterIP -NoStorage # -IgnoreNetwork $ignoreAddress
    Get-Cluster | Select *
    # View Report
    $newPath = "C:\Windows\cluster\Reports\" + $new.Name.ToString()
    $IE=new-object -com internetexplorer.application
    $IE.navigate2($newPath)
    $IE.visible=$true
}
# un-comment what you what to do...
# testCluster
buildCluster

Creating the Group Listener

Creating the Group Listener was a bit more challenging, but not too bad. Once the OS Cluster computer object was created (thespsqlcluster.contoso.local), the newly created computer object needed to be given rights as well.
- The cluster identity 'thespsqlcluster' needs Create Computer Objects permissions. By default all computer objects are created in the same container as the cluster identity 'thespsqlcluster'.
- If there is an existing computer object, verify the Cluster Identity 'thespsqlcluster' has 'Full Control' permission to that computer object using the Active Directory Users and Computers tool.
You will also want to make sure that the quota for computer objects for 'thespsqlcluster' has not been reached.
The domain administrator was also given Sysadmin rights to all of the SQL Server instances in the cluster.
After all the permissions were set, the Domain admin could run the following script on the Primary SQL Instance to create the Group Listener:

Import-Module ServerManager -EA 0
Import-Module SQLPS -DisableNameChecking -EA 0
$listenerName = "LSN-TheSPDatabases"
$server = $env:COMPUTERNAME
$path = "SQLSERVER:\sql\$server\default\availabilitygroups\"
$groups = Get-ChildItem -Path $path
$groupPath = $path + $groups[0].Name
$groupPath
New-SqlAvailabilityGroupListener `
    -Name $listenerName `
    -StaticIp "192.168.1.12/255.255.255.0" `
    -Port "1433" `
    -Path $groupPath 

Important

After the group listener is created, all the rights that were put in place can once again be removed with the understanding that if you wish to add another listener at another time, the permissions will have to be reinstated temporarily once again. In my case, once all of the computer objects were created successfully, all rights were removed off the cluster computer object and the domain administrator was removed from SQL.

Updates

07/06/2015 Cleaned up diction and grammar, added the Important section.
10/21/2015 Updated computer object permission requirements

SharePoint and FIPS Exceptions

A couple of weeks ago, I started a "Greenfield" implementation of SharePoint 2013 for a client. This organization has SharePoint 2003, 2007, 2010 already existing in their environment, so I ignorantly figured that the installation should go pretty smoothly.
All of the SharePoint and SQL bits installed correctly, however when trying to provision Central Administration, I ran into an issue where I was not able to create the config database:

What is FIPS?

FIPS stands for the Federal Information Processing Standards, and is used for the standardization of information, such as FIPS 10-4 for Country Codes or FIPS 5-2 for State Codes. However my problem is with FIPS 140-2, the Security Requirements for Cryptography which states:

This Federal Information Processing Standard (140-2) specifies the security requirements that will be satisfied by a cryptographic module, providing four increasing, qualitative levels intended to cover a wide range of potential applications and environments. The areas covered, related to the secure design and implementation of a cryptographic module, include specification; ports and interfaces; roles, services, and authentication; finite state model; physical security; operational environment; cryptographic key management; electromagnetic interference/electromagnetic compatibility (EMI/EMC); self-tests; design assurance; and mitigation of other attacks. [Supersedes FIPS 140-1 (January 11, 1994): http://www.nist.gov/manuscript-publication-search.cfm?pub_id=917970]

http://www.nist.gov/manuscript-publication-search.cfm?pub_id=902003

In essence, FIPS 140-2 is a standard that can be tested against and certified so that the server is hardened up to a government standard. Currently, the US is not the only government that uses the FIPS standard for server hardening. The FIPS Local/Group Security Policy Flag can be found here:

FIPS and SharePoint

There are a couple of problems with using SharePoint on a FIPS enabled server. SharePoint Server uses MD5 for computing hash values (not for security purposes) which is an unapproved algorithm. According to Microsoft (https://technet.microsoft.com/en-us/library/cc750357.aspx) Schannel Security Package is forced to negotiate sessions using TLS1.0. And the following supported Cipher Suites are disabled:

• TLS_RSA_WITH_RC4_128_SHA
• TLS_RSA_WITH_RC4_128_MD5
• SSL_CK_RC4_128_WITH_MD5
• SSL_CK_DES_192_EDE3_CBC_WITH_MD5
• TLS_RSA_WITH_NULL_MD5
• TLS_RSA_WITH_NULL_SHA

If you want to read up more, here are some good posts:

• Don’t Even Bother Trying to Enforce FIPSAlgorithmPolicy on SharePoint 2010 Servers
• FIPS 140 Validation
• FIPS PUB 140-2- Security Requirements for Cryptographic Modules
• Why We’re Not Recommending “FIPS Mode” Anymore

What's Next?

Disabling FIPS is easy, however a larger discussion needs to be had. Is FIPS set at the GPO level or is it part of the image that was provisioned and FIPS was enabled by default? Will the security team come after you if you disable it without their knowledge? Why do they have FIPS enabled, and what are they trying to accomplish with FIPS? All of these questions will need to be answered before changing your server settings.

Fixing FIPS with PowerShell

This is how I reset the FIPS Algorithm Policy so that I could get Central Administration provisioned. Remember that FIPS will need to be disabled on all of your SharePoint Servers.

$sets = @("CurrentControlSet","ControlSet001","ControlSet002")
foreach ($set in $sets) {
    $path = "HKLM:\SYSTEM\$set\Control\LSA\FipsAlgorithmPolicy"
    if ((Get-ItemProperty -Path $path).Enabled -ne 0) {
        Set-ItemProperty -Path $path -Name "Enabled" -Value "0"
        Write-Host("Set $path Enabled to 0")
    }
}