Windows Server Essentials 2016 Access Anywhere Certificate renewal script

[SergeCaron]

I see various complaints regarding WSE 2016 and certificate renewals.

I have been using the script below for years without issues. You have to be patient it takes at least two minutes for everything to restart but it does work.

Regards,

Enable certificate for RDP Gateway

param($result)

Import-Module RemoteDesktopServices

Apply certificate

Set-Item -Path RDS:\GatewayServer\SSLCertificate\Thumbprint -Value $result.ManagedItem.CertificateThumbprintHash -ErrorAction Stop

Restart Network Policy Server, TSGateway, and SSTP Protocol

Restart-Service IAS -Force -ErrorAction Stop
Restart-Service TSGateway -Force -ErrorAction Stop
Restart-Service SSTPSvc -Force -ErrorAction Stop
Write-Host "Done!"

[webprofusion-chrisc]

Thanks is there a complaint somewhere we should be addressing?

We also have a built in Deployment Task for this but it currently only does this, are the other service restarts essential?:

param($result, [switch] $restartServices = $false)

Import-Module RemoteDesktopServices

# Apply certificate
Set-Item -Path RDS:\GatewayServer\SSLCertificate\Thumbprint -Value $result.ManagedItem.CertificateThumbprintHash -ErrorAction Stop

# Optionally restart TSGateway

if ($restartServices -eq $true)
{
	Restart-Service TSGateway -Force -ErrorAction Stop
}

[webprofusion-chrisc]

As an aside you can also now use our built in Deployment Task to stop/start/restart services, so scripting isn't the only way to do it.

[SergeCaron]

Hello Christopher, On Windows Server 2016 Essentials, if you don’t restart Network Policy Server, VPNs do connect but here is no traffic allowed on the network. For people using the SSTP protocol, you must restart the SSTVSvc service AFTER restarting the TSGateway. Note that there is a significant delay during these restarts: on a lightly loaded server, expect a two minutes delay. Regards, Serge Caron

[SergeCaron]

Hello Christopher, I am not certain how to control the exact restart sequence using separate tasks. Regards, Serge Caron

[webprofusion-chrisc]

Thanks Serge. Regarding Tasks, they are executed in the order that they appear on the list and you can drag/drop them to re-order.

[SergeCaron]

Hello Christopher, Yesterday was too hectic to reply. The task “Deploy to RAS (Direct Access, …” does not document which services are restarted and in what order. Over the years, I have not seen a recommendation to restart IAS, the now “Network Policy Server”, in he various forums concerned with Windows Server 2016 Essentials. The same goes for SSTPSvc. So, does your “Deploy to RAS …” task restart these services, in which order, and does it do anything else ? Kind regards, Serge Caron

[webprofusion-chrisc]

Hi Serge, no currently it only runs the following, but I'm happy to update it. Ideally the script would work for everyone and could be combined with other actions for users who need to to do more:

Restart-Service TSGateway -Force -ErrorAction Stop

[SergeCaron]

Hello Christopher, This does not work for WS2016 Essentials. Working backwards so you have a better understanding: 3. SSTPSvc relies on the certificate in use by TSGateway to accept SSTP VPN connections. If this service is not restarted following a TSGateway update, incoming VPN connections will succeed but will dropout almost immediately because of the lack of SSL/TLS support resulting from a certificate mismatch. 2. TSGateway will honor incoming connections but the remote end will not pass traffic: you can’t even ping the WS2016 server even if you have a valid IP provided by the TSGateway/SSTPSvc pair. 1. Internet Authentication Service (IAS) was renamed Network Policy Server (NPS) with the introduction of Windows Server 2008. This is the service responsible for allowing VPN traffic on the local network. Please note that restarting IAS is a long process and you will find many lines in your log. On a less powerful machine, you are looking at two minutes overall delay. I am presently testing a replacement server and I will gladly use your new functionality if it does the above. Again, please note that I had added a <Write-Host “Done!” > at the end of my script in the hope that it would be part of the log ;-) Perhaps your version could add this simple safeguard. Kind regards, Serge Caron

[SergeCaron]

Hello Christopher, Yesterday, I came across a client configuration where the static script did not work. Our friends at Microsoft are somewhat creative… Below is a script that will recursively walk the dependencies for the “Network Policy Server” and the “Secure Socket Tunneling Protocol (SSTP) service” : note that these two are not directly or indirectly related, one more of Microsoft’s idiosyncrasies. Kind regards, Serge Caron PS: this is a preliminary version with little or no validation. param($result) Import-Module RemoteDesktopServices # Apply certificate Set-Item -Path RDS:\GatewayServer\SSLCertificate\Thumbprint -Value $result.ManagedItem.CertificateThumbprintHash -ErrorAction Stop # Restart services required for "Access Anywhere" $global:ServicesToStart = @() Function CollectDependent($TargetService) { $wmidependents = (get-service $TargetService).dependentservices $wmidependentservices = Get-WmiObject Win32_Service | Select-object name,state,startmode | where {$wmidependents.name -contains $_.name} # Write-Host $TargetService foreach ($service in $wmidependentservices){ if($service.startmode -eq "auto" -or $service.status -eq "Running"){ # Write-Host "-> $($service.name)" # Caution: no effort done to prevent circular definitions CollectDependent($service.name) } else{ Write-Host "Omitting $($service.name) : service is $($service.state) with the startmode: $($service.startmode)" } } stop-service $TargetService -ErrorAction SilentlyContinue $global:ServicesToStart += $TargetService } CollectDependent("IAS") CollectDependent("SSTPSvc") #Write-Host "----" [array]::Reverse($global:ServicesToStart) foreach($service in $global:ServicesToStart ) { start-service $service -ErrorAction SilentlyContinue } Write-Host "Done!"

[webprofusion-chrisc]

Thanks Serge, this is quite extensive, I think I'd be tempted to leave the exercise of stopping and starting related services to the user (i.e they would specify tasks to restart the correct services) as clearly it depends on their environment to some extent.

[SergeCaron]

Hello Christopher, Indeed, it is quite extensive. The issue is that you don’t know for sure which services are running (i.e. some services start-up are set to “Manual” and have dependencies of their own) AND you don’t know the VPN configuration in use. Some dependent services are not in use in every installation. So the user must research the exact sequence of services they need to stop and start : a simple restart of TSGateway will not do. And this depends on the “configuration du jour” ;-). As you can see in the code, TSGateway is not explicitly named: it is a dependent service of the Network Policy Server. I am going to add a little protection against circular dependencies and I will live with this for a while. Kind regards, Serge Caron De : Christopher Cook <notifications@github.com> Envoyé : 18 août 2020 23:43 À : webprofusion/certify <certify@noreply.github.com> Cc : Serge Caron <SCaron@pcevolution.com>; Author <author@noreply.github.com> Objet : Re: [webprofusion/certify] Windows Server Essentials 2016 Access Anywhere Certificate renewal script (#519) Thanks Serge, this is quite extensive, I think I'd be tempted to leave the exercise of stopping and starting related services to the user (i.e they would specify tasks to restart the correct services) as clearly it depends on their environment to some extent. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub<#519 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AQROU4AOXQ6IDZ4FDEIBQBDSBNC5FANCNFSM4PYY2OMQ>.

[SergeCaron]

Hello Christopher, Production script below : enjoy ;-) Regards, Serge Caron PS : I have changed “Write-Host” to “Write-Warning” so these actions can be seen in the Certify The Web log file. ##****************************************************************** ## Revision date: 2020.08.19 ## ## Copyright (c) 2020 PC-Évolution enr. ## This code is licensed under the GNU General Public License (GPL). ## ## THIS CODE IS PROVIDED *AS IS* WITHOUT WARRANTY OF ## ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING ANY ## IMPLIED WARRANTIES OF FITNESS FOR A PARTICULAR ## PURPOSE, MERCHANTABILITY, OR NON-INFRINGEMENT. ## ##****************************************************************** # Certify The Web Deployment Script for Windows Server 2016 Essentials (Your Mileage May Vary ;-) # Restart the "Network Policy Server" as well as the SSTP protocol : all dependent services are # stopped and started in the exact reverse order they were stopped. # Note: the Write-Warning is used so that messages will appear in the Certify The Web log file. param($result) Import-Module RemoteDesktopServices # Apply certificate Set-Item -Path RDS:\GatewayServer\SSLCertificate\Thumbprint -Value $result.ManagedItem.CertificateThumbprintHash -ErrorAction Stop # Restart services required for "Access Anywhere" $global:ServicesToStart = @() Function CollectDependent($TargetService) { # Caution: minimal effort done to prevent circular definitions if ($global:ServicesToStart -match "$service.name") { Write-Warning "Caution! Service $service.name is involved in a circular definition." } else { $wmidependents = (get-service $TargetService).dependentservices $wmidependentservices = Get-WmiObject Win32_Service | Select-object name,state,startmode | where {$wmidependents.name -contains $_.name} # Write-Host $TargetService foreach ($service in $wmidependentservices){ if($service.startmode -eq "auto" -or $service.status -eq "Running"){ # Write-Host "-> $($service.name)" CollectDependent($service.name) } else{ Write-Warning "Omitting $($service.name) : service is $($service.state) with the startmode: $($service.startmode)" } } stop-service $TargetService -ErrorAction SilentlyContinue $global:ServicesToStart += $TargetService } } CollectDependent("IAS") CollectDependent("SSTPSvc") #Write-Host "----" [array]::Reverse($global:ServicesToStart) foreach($service in $global:ServicesToStart ) { start-service $service -ErrorAction SilentlyContinue } Write-Warning "Done!" De : Serge Caron Envoyé : 19 août 2020 05:50 À : 'webprofusion/certify' <reply@reply.github.com> Objet : RE: [webprofusion/certify] Windows Server Essentials 2016 Access Anywhere Certificate renewal script (#519) Hello Christopher, Indeed, it is quite extensive. The issue is that you don’t know for sure which services are running (i.e. some services start-up are set to “Manual” and have dependencies of their own) AND you don’t know the VPN configuration in use. Some dependent services are not in use in every installation. So the user must research the exact sequence of services they need to stop and start : a simple restart of TSGateway will not do. And this depends on the “configuration du jour” ;-). As you can see in the code, TSGateway is not explicitly named: it is a dependent service of the Network Policy Server. I am going to add a little protection against circular dependencies and I will live with this for a while. Kind regards, Serge Caron De : Christopher Cook <notifications@github.com<mailto:notifications@github.com>> Envoyé : 18 août 2020 23:43 À : webprofusion/certify <certify@noreply.github.com<mailto:certify@noreply.github.com>> Cc : Serge Caron <SCaron@pcevolution.com<mailto:SCaron@pcevolution.com>>; Author <author@noreply.github.com<mailto:author@noreply.github.com>> Objet : Re: [webprofusion/certify] Windows Server Essentials 2016 Access Anywhere Certificate renewal script (#519) Thanks Serge, this is quite extensive, I think I'd be tempted to leave the exercise of stopping and starting related services to the user (i.e they would specify tasks to restart the correct services) as clearly it depends on their environment to some extent. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub<#519 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AQROU4AOXQ6IDZ4FDEIBQBDSBNC5FANCNFSM4PYY2OMQ>.

[devast8tor]

Just wanted to drop a short note to say a huge thank you for Serge for writing and sharing this script. I've successfully deployed this on my personal WSE 2016 and my Access Anywhere install is now running the current cert (instead of the original one I deployed manually). I'll keep an eye on this thread in case additional improvements to the script are added.

[SergeCaron]

Hello Christopher at al., There are hidden dependencies between the SSTPsvc and IAS services or there is a race condition of some sort between these two on faster servers. This is a small revision where declared dependencies for these two services are enumerated SSTPSvc first, IAS second. The renewal log now shows the exact order in which services are restarted. IAS will now start before SSTPSvc, provided there is no other black magic involved. Regards, Serge Caron 2020-12-20 12:09:18.836 -05:00 [INF] Executing command via PowerShell 2020-12-20 12:09:29.884 -05:00 [INF] Omitting RasMan : service is Stopped with the startmode: Disabled Omitting rqs : service is Stopped with the startmode: Manual Attente de l’arrêt du service « Routage et accès distant (RemoteAccess) »… Omitting rqs : service is Stopped with the startmode: Manual Waiting for powershell to complete..5s Attente de l’arrêt du service « Network Policy Server (IAS) »… Attente de l’arrêt du service « Network Policy Server (IAS) »… Restarting services in the following order: IAS TSGateway SSTPSvc RemoteAccess Waiting for powershell to complete..10s Done! 2020-12-20 12:09:29.884 -05:00 [INF] Run Powershell Script :: Task Completed OK De : devast8tor <notifications@github.com> Envoyé : 24 septembre 2020 01:11 À : webprofusion/certify <certify@noreply.github.com> Cc : Serge Caron <SCaron@pcevolution.com>; Author <author@noreply.github.com> Objet : Re: [webprofusion/certify] Windows Server Essentials 2016 Access Anywhere Certificate renewal script (#519) Just wanted to drop a short note to say a huge thank you for Serge for writing and sharing this script. I've successfully deployed this on my personal WSE 2016 and my Access Anywhere install is now running the current cert (instead of the original one I deployed manually). I'll keep an eye on this thread in case additional improvements to the script are added. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub<#519 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AQROU4EO7TUADCZMYPLVVHDSHLIG5ANCNFSM4PYY2OMQ>.

[devast8tor]

Serge,

Did you post your revised code in this thread or as a commit to the project? Looking to test your updated code as the service dependencies have been causing issues for the Remote Desktop Gateway cert application (it keeps holding on to the prior cert instead of applying the latest renewal).