Steps to recover the OS Corrupted VM in Azure

1. Stop the machine – wait until it’s stopped (deallocated)
2. Save the XML configuration file of the VM
1. If Azure Powershell is not installed, please install it from Microsoft Azure Powershell.
2. Open an elevated Azure Powershell session and run the following commands to setup the environment to setup queries to your subscription
3. Set the variables

$SubscriptionID = "<Suscription ID>"​

$StorageAccount = "<Storage Account>"

$vm = "<VM Name>"

$CloudService = "<Cloud Service>"

$VNET = "<Virtual Network>"

4. Log in to the subscription​

Add-AzureAccount

Set-AzureSubscription -SubscriptionId $SubscriptionId -CurrentStorageAccountName $StorageAccount

Select-AzureSubscription -SubscriptionId $SubscriptionId 

5. Stop the VM

​Get-AzureVM -Servicename $CloudService -name $vm | stop-azureVM -force

6. Export the configuration file and once you have it, validate that the file exist and has content.

Export-AzureVM -ServiceName $CloudService -Name $vm -Path C:\Temp\VM.xml

3. Delete the VM keeping the attached disks.

Remove-AzureVM -ServiceName $CloudService -Name $vm

4. Waits for around 5mins for Azure to release these disks so you can dispose of them freely
5. Using Storage Explorer, make a copy of the VM’s OS disk.
6. Attach the OS disk of AffectedServer to TSVM.
7. Once the OS disk is attached on a working machine, open up the disk manager and ensure it is ONLINE and take note which is the drive letter assign to the partition holding the \windows folder

8. If the disk is set to OFFLINE, then set it to ONLINE

9. Browse up to the location of the binary that was shown on the screenshot and document on this case the version of the file that was found (righ-click\properties\Details tab)

10. Rename it as <BINARY.SYS>.OLD. For the example, if the binary on the screenshot is \windows\system32\drivers\amdxata.sys this will be renamed as \windows\system32\drivers\amdxata.sys.old
11. RESTORATION
1. You can restore this file from its internal repository.

                                          i.    Launch a CMD session and locate the volume holding your Windows directory. Browse to \windows\winsxs and search for the binary displayed on your screenshot.

dir <<binary from the screenshot with extension>> /s

                                         ii.    This command will list all the different versions of that very same file the machine has, pretty much it will give you the path history of that component. You could then choose the latest of the list and proceed to copy that one on the windows\system32 folder path described on the screenshot.

copy <<drive>>:\Windows\WinSxS\<<directory_where_file_is>>\<<binary_with_extension>> <<drive>>:\Windows\System32\Drivers\

Example:

1.      The binary that we need to look for is cmimcext.sys.

2.     On the same way if the latest binary didn't work, then you can always try one version before that one like going back in time for the patch level on that component

3.     On the image below, the query is listed on C but this letter will be instead the one of the faulty drive (the OS disk attached as a data disk on the troubleshooting VM)

2. You may use as well a working machine from this environment with the same OS and if possible the same patch level you can take the binary from a working machine and replace the corrupt binary on the affected machine however be aware that following this way may ended up on a reboot loop later on if you don't copy the correct file version the machine is waiting for:
   

12. Remove the disk from the troubleshooting VM and wait till azure update the disk lease (3 mins tops)
13. Reassemble the VM 

Proceed to create the VM from the configuration file.
Import-AzureVM -Path C:\Temp\VM.xml | New-AzureVM -ServiceName $CloudService -VNetName $vnet -ReservedIPName <STATIC IP>

Note: Recreating a VM thru its configuration file, will take attach all the disks on a VM plus its configuration on Endpoint Load Balancer, IP configuration and so on. In case of VMs with striping disks, this is the correct way to recreate it.

CLEANUP

Proceed to remove the OS Disk backup we created at the beginning of the case

Creating a Image from existing Server in Azure ARM

Azure Image and configuring server with this image

1. Copy the OS disk of the server which you want to take image into a new container of a storage account and in the same container copy other disks of the server which you are taking image through Microsoft Storage Explorer.

2. Copy the URL of the OS disk and data disks into a notepad.

3. Run the following Script in PowerShell, before running the script change the parameter to the required values
Azure PowerShell Script

Login-AzureRmAccount

$subscription = (Get-AzureRmSubscription).SubscriptionName | Out-GridView -Title "Select Azure Subscription" -PassThru

Select-AzureRmSubscription -SubscriptionId "******************************"

$name = "VMName"
$nam = "PIPname"
$vmSize="Standard_F8"
$adminUsername=""
$adminPassword="********"
$sourceImageUri = 'https://sprabstor1.blob.core.windows.net/vhds/sprab007.vhd'
$diskName= $name + "OS-Disk"


$rgName="RGName"
$locName=""
$saName="StorageAccount"
$vnetName="VnetName"
$subnetIndex= '0'
$cred = New-Object PSCredential $adminUsername, ($adminPassword | ConvertTo-SecureString -AsPlainText -Force)


# Get the existing virtual network
$vnet=Get-AzureRMvirtualNetwork -Name $vnetName -ResourceGroupName $rgName

# Create the NIC
$nicName="NICname"
$pipName= $nam + "_pip"
$domName= $name
$pip=New-AzureRmPublicIpAddress -Name $pipName -ResourceGroupName $rgName -DomainNameLabel $domName -Location $locName -AllocationMethod Dynamic
$nic=New-AzureRmNetworkInterface -Name $nicName -ResourceGroupName $rgName -Location $locName -SubnetId $vnet.Subnets[$subnetIndex].Id -PublicIpAddressId $pip.Id

# Specify the name, size
$vmName= $name
$vm=New-AzureRmVMConfig -VMName $vmName -VMSize $vmSize

# Specify the local administrator account, and then add the NIC
# Note : here you have to choose between creating a Linux or a Windows machine (see command bellow)
$vm=Add-AzureRMVMNetworkInterface -VM $vm -Id $nic.Id
$vm=Set-AzureRmVMOperatingSystem -VM $vm -Windows -ComputerName $vmName -Credential $cred


# Specify the OS disk name
$storageAcc=Get-AzureRMStorageAccount -ResourceGroupName sprabrg -Name $saName
$osDiskUri=$storageAcc.PrimaryEndpoints.Blob.ToString() + "vhds/" + $diskName  + ".vhd"

# Create the VM from the captured image
# Note : here you have to choose between creating a Linux or a Windows machine (see command bellow)
$vm=Set-AzureRMVMOSDisk -VM $vm -Name $diskName -VhdUri $osDiskUri -CreateOption fromImage -SourceImageUri $sourceImageUri -Windows
New-AzureRmVM -ResourceGroupName $rgName -Location $locName -VM $vm



It will take some time for the server to get deployed after deploying attach the copied data disk of the imaged server to the new server.

Migrate MSAzure VM Image from Classic to ARM portal

Migrate the Classic Image to ARM

First get the VM disks storage path.

OS disk : https://xxxx.blob.core.windows.net/vhds/PublicServer-os-2017-03-06-BC0F1E4.vhd
Disk 1 :-
https://xxxx.blob.core.windows.net/vhds/PublicServer-datadisk-0-2017-03-06-BC0F1E4.vhd

Disk 2 :
https://xxxx.blob.core.windows.net/vhds/PublicServer-datadisk-1-2017-03-06-BC0F1E4.vhd

In another ARM, Create a Storage & Container

New ARM Stroage account Name : magnatemplate


Container Name : https://template.blob.core.windows.net/temcon

Download & Install the Microsoft Azure Storage Explorer tool and add both the accounts in that tool and found the source disks & copy in to the destination disk


Create a VM from a specialized VHD disk using this https://azure.microsoft.com/en-us/resources/templates/201-vm-specialized-vhd/

and Click Deploy to Azure in ARM portal

Once VM has deployed, We need to create the image from that VM

using below link to make the sysprep and create a VM

https://docs.microsoft.com/en-us/azure/virtual-machines/virtual-machines-windows-generalize-vhd?toc=%2fazure%2fvirtual-machines%2fwindows%2ftoc.json

Prerequisites to take the Image :

Log in to Azure PowerShell
Open Azure PowerShell and sign in to your Azure account.

Copy
PowerShell
 Login-AzureRmAccount
A pop-up window opens for you to enter your Azure account credentials.

Get the subscription IDs for your available subscriptions.

Copy
PowerShell
 Get-AzureRmSubscription
Set the correct subscription using the subscription ID.

Copy
PowerShell
 Select-AzureRmSubscription -SubscriptionId "<subscriptionID>"
Deallocate the VM and set the state to generalized
Deallocate the VM resources.

Copy
PowerShell
 Stop-AzureRmVM -ResourceGroupName <resourceGroup> -Name <vmName>
The Status for the VM in the Azure portal changes from Stopped to Stopped (deallocated).

Set the status of the virtual machine to Generalized.

Copy
PowerShell
 Set-AzureRmVm -ResourceGroupName <resourceGroup> -Name <vmName> -Generalized
Check the status of the VM. The OSState/generalized section for the VM should have the DisplayStatus set to VM generalized.

Copy
PowerShell
 $vm = Get-AzureRmVM -ResourceGroupName <resourceGroup> -Name <vmName> -Status
 $vm.Statuses

Command to create the image

 Save-AzureRmVMImage -ResourceGroupName -Singapore-ARM  -Name magnapritemplate -DestinationContainerName magnatemcon -VHDNamePrefix cis1 -Path C:\Users\xxx\Desktop\New folder\Filename.json

You can get the output :

OperationId :
Status : Succeeded

Once created the image, go back to ARM portal again and more services -> templates-> add template-> General information->mention some name there, then ARM template-> (Open Filename.json file which is copied in local drive and copy & paste) in to the arm template

click add..

Deploy a VM :

More Services -> templates -> click the template which we created and there click deploy options and start to deploy
..............