Hyper V manager Remote?

[Danny11717]

Hi all exeperienced network engineers and managers,

 

I have recently started my new job in a Google private school with loads of servers where the last network manager went wild creating loads of servers for the sake of it. My newest adventure would be having to manage these all and possibly moving/ merging some servers if this is possible and then putting in a contract with a company to help me in terms of dealing with patching and securing the whole infrastrucutre so I can sleep peacefully at night.

 

My question is would it be possible to actually have Hyper V be remote so I can connect to it on my mac at home so that if any changes need to be done or if I need to restart a server then I can do this at home rather than having to come in during my free time or on a weekend where I personally would rather be at home. In context I work from 8am - 5pm and I feel that I work enough hours during the week.

[3s-gtech]

It's possible - but you'd access them through some sort of RDP portal, not directly. I can remote in via a browser and manage our Hyper-V hosts (if I'm staggeringly bored). Obviously I can boot myself out while doing this, if I take down a host which is hosting the RDP portal.

 

Accessing them directly would be a bad plan.

[PrimaryNetMan]

Could be done with a 3rd party solution for unattended access, for example, Zoho Assist. This has a free tier that allows for 5 unattended devices. Will also SSO via your Google Workspace account. For patching and securing endpoints, Action1 is free for 100 endpoints.

[gszech]

Hi all exeperienced network engineers and managers,

 

I have recently started my new job in a Google private school with loads of servers where the last network manager went wild creating loads of servers for the sake of it. My newest adventure would be having to manage these all and possibly moving/ merging some servers if this is possible and then putting in a contract with a company to help me in terms of dealing with patching and securing the whole infrastrucutre so I can sleep peacefully at night.

 

My question is would it be possible to actually have Hyper V be remote so I can connect to it on my mac at home so that if any changes need to be done or if I need to restart a server then I can do this at home rather than having to come in during my free time or on a weekend where I personally would rather be at home. In context I work from 8am - 5pm and I feel that I work enough hours during the week.

 

Since you are working with Google why not to use this: https://remotedesktop.google.com/access/

[TheHyperTechie]

Before I removed our on-prem servers, I used Action1 for remote monitoring and patching. I still use it for our desktops, laptops etc. Free for up to 100 endpoints.

[DrCheese]

You need a VPN - Or you can set up Windows Admin Centre & hide it behind an Azure App proxy. Don't do any of this unless you have 2factor setup.

[jthompson]

Have a look at running Windows Admin Center on-prem, and then using Azure Application Proxy to make that site browsable remotely. By using Azure Application Proxy, you can have the WAC site secured behind your M365 login (with MFA!).

You'd use WAC to manage the Hyper-V host, and then the Virtual Machines section of that would allow you to manage the clients.

If the clients are Windows member servers, then you could connect to those directly with WAC also.

That can all be done without any paid licenses.

Edited November 11, 2024 by jthompson

[Jaan]

Just VPN into the site. that would be best.

 

We use Sophos here. And have a VPN just for the NM and senior Tech.

[Tefters]

Have a look at running Windows Admin Center on-prem, and then using Azure Application Proxy to make that site browsable remotely. By using Azure Application Proxy, you can have the WAC site secured behind your M365 login (with MFA!).

You'd use WAC to manage the Hyper-V host, and then the Virtual Machines section of that would allow you to manage the clients.

If the clients are Windows member servers, then you could connect to those directly with WAC also.

That can all be done without any paid licenses.

 

This ^^^ although I am a little concerned that you say previous network manager. Are you the new network manager or are they getting one because you sound a little out of your depth (no offense).

 

Unless you know exactly what your doing I would not be setting up remote access or at least confident enough to know the surrounding technologies/methods and just have to read up on the finer details of the specific remote service you choose.

Edited November 11, 2024 by Tefters

[Danny11717]

HI @gszech,

 

This is such a great idea and didn't know that this existed until now. I will give this a try tonight to see if this will work as this will be a simple solution to my problem.

[mavhc]

Use tailscale

[Danny11717]

This ^^^ although I am a little concerned that you say previous network manager. Are you the new network manager or are they getting one because you sound a little out of your depth (no offense).

 

Unless you know exactly what your doing I would not be setting up remote access or at least confident enough to know the surrounding technologies/methods and just have to read up on the finer details of the specific remote service you choose.

 

Well I am the Senior Network Engineer, I have always used cloud solutions and RDP previsouly to connect to remote infrastrucutre for when I am at home I can make changes and fix problems on the network but when I moved to this place I foudn out that this is run compeltely different due to the network manager being heavy on network security and disabling pretty much everything that could be useful to not needing to come into the office. For what I am trying to do is make my life a little more easier stepping into network management for the first time without any guidance so that I can at least try to be successful with what I have. That is the problem with leaving what you have learnt and moving onto a completely different environment and just being told to get on with it as there is noone else I could really turn to.

[Danny11717]

Before I removed our on-prem servers, I used Action1 for remote monitoring and patching. I still use it for our desktops, laptops etc. Free for up to 100 endpoints.

 

Thanks for this. I will look into this for sure and see what they can do in terms for support.

[Tefters]

Well I am the Senior Network Engineer, I have always used cloud solutions and RDP previsouly to connect to remote infrastrucutre for when I am at home I can make changes and fix problems on the network but when I moved to this place I foudn out that this is run compeltely different due to the network manager being heavy on network security and disabling pretty much everything that could be useful to not needing to come into the office. For what I am trying to do is make my life a little more easier stepping into network management for the first time without any guidance so that I can at least try to be successful with what I have. That is the problem with leaving what you have learnt and moving onto a completely different environment and just being told to get on with it as there is noone else I could really turn to.

 

Whatever solution you choice that bests suits your needs make sure it has 2FA. Even if its a basic remote tool connecting to your PC in the office.

[Davit2005]

There are some good legitimate reasons to separate services. Personally I'd always have no 3rd party software on Domain Controllers. And if any 3rd party software needed (really needed) to be installed on a DC I'd consider a building a RODC.

 

Whatever you do use 2FA and don't open RDP directly.

Edited November 11, 2024 by Davit2005

[jthompson]

There are some good legitimate reasons to separate services. Personally I'd always have no 3rd party software on Domain Controllers. And if any 3rd party software needed (really needed) to be installed on a DC I'd consider a building a RODC.

 

Whatever you do use 2FA and don't open RDP directly.

 

And perhaps no RDP at all to DCs (hypervisor console access only).

 

To the OP, you mentioned it being a Google Workspace school. Just a thought: if any of those on-prem servers/computers happen to have a GAM installation on them, move that into Google Cloud Shell and remove it from on-prem systems. That'll be more secure whilst also giving you remote access to GAM.

[DalekSec]

Create Hyper-V Cluster,

Create VM outside of said cluster for management

Setup RDP to the VM but with ACLs in place so only accessable via your home IP. + all the 2FA etc goodness

Profit

[Davit2005]

Security should be above convenience when it comes to accessing sensitive services. So before you remove any in place security think of the implications.

 

You only need to look at some high profile cases where access has been compromised even to dev environments containing sensitive production data. These were not hacked by some techno wizkid in many instances but by social engineering or other infiltration, etc.

Edited November 12, 2024 by Davit2005

[mavhc]

Surely you just want to vpn to the host ip and then run hyper-v manager and connect it to that vpn'd IP, using tailscale as that's the best vpn

[GeneMoody-Action1]

Thanks there, yes we are completely free for the first 100, no feature or time limit.

 

As for accessing the manager, I ssh to mine, I would never dream of putting it on a public IP, but with ngrok and an internal SSH server, I can port forward to anything I need to in a pinch.

I use Yubikey to MFA (PW + Cert + Key) but the Google authenticator PAM module works great as well to get (PW + Cert + OTP)

 

I experimented with a power automate workflow to send an email to up ngrok on command from an email, but in the end never really needed it, properly set up and patched SSH servers are pretty solid.