Creating a Windows Agent Image

Preparing an ECS

Prepare an ECS that runs Windows Server 2019 Standard 64bit English and has a 40-GB system disk. Windows Server 2019 is used as an example, and you can select another version. Specify a valid password when creating the ECS and name the ECS SMS. The official Microsoft image is recommended.

Ensure that the ECS can access the Internet, so that the required tools can be downloaded.

Installing the Required Software

Transfer the smsWindowesAgent folder created in Creating Scripts in Agent Images to the C:\directory of the ECS. The folder stores the agent image scripts you prepared.
Install Python 3.7.6 to C:\smsWindowesAgent\Python. You can select another version as required.
Run where python to check whether Python has been installed in the specified directory.

Installing requests and ConfigParser

Run the following commands on the ECS to install requests and ConfigParser.

pip install requests
pip install configparser

Modifying the ECS

Set the program to automatically start upon system startup.
1. Open the CMD window and run gpedit. In the displayed window, choose Computer Configuration > Windows Settings > Scripts (Startup/Shutdown) > Startup.
2. Click Add and enter C:\smsWindowesAgent\bin\runPython.bat for Script Name. You can change the script as required.
Install OpenSSH.
1. Right-click the Start icon or press Win and X keys. In the displayed menu, choose Windows PowerShell (Administrator). In the displayed window, run the following command:
```
Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
```
2. After the installation is complete, restart the OS for the installation to take effect. Start the sshd and ssh-agent services and set them to automatically run at startup.
  Start sshd.
```
Start-Service sshd
```
  Enable sshd to automatically run at startup.
```
Set-Service sshd  Automatic
```
  Start ssh-agent.
```
Start-Service ssh-agent
```
  Enable ssh-agent to automatically run at startup.
```
Set-Service ssh-agent -StartupType Automatic
```
3. Go to the C:\ProgramData directory and add the following content to the sshd_config file:
  PasswordAuthentication no
Install OpenStack.

Download the VMTools drivers required by SMS.

Decompress the downloaded package, double-click the extracted file, and find the required drivers in ./vmtools-windows/upgrade/windowsXX/drivers.

Copy all driver files to the specified directory.

Windows Server 2016_64bit is used here as an example.

Copy all files in upgrade\windows 2016_64\drivers\viostor to C:\smsWindowsAgent\bin\peAgent\OpenStack\windows_device_driver\windows2016_64.

Copy files in the rest of folders under upgrade\windows 2016_64\drivers to C:\smsWindowsAgent\bin\peAgent\OpenStack\windows_device_driver\windows2016_64.

The figure below shows the files that should appear in the C:\smsWindowsAgent\bin\peAgent\OpenStack\windows_device_driver\windows2016_64 directory.

Copy files required by other Windows versions, such as Windows Server 2008 and Windows Server 2016, to the corresponding directories.

Open the CMD window and run the following commands to enable ports 8899 and 8900.

netsh advfirewall firewall add rule name=peagent dir=in action=allow protocol=TCP localport=8899
netsh advfirewall firewall add rule name=ntcldst dir=in action=allow protocol=TCP localport=8900

(Optional) Install the password reset plug-in if this ECS is created from a non-public image.
1. Download the plug-in at https://cn-south-1-cloud-reset-pwd.obs.cn-south-1.myhuaweicloud.com/windows/reset_pwd_agent/CloudResetPwdAgent.zip.
2. Double-click setup.bat in the CloudResetPwdAgent.Windows or CloudResetPwdUpdateAgent.Windows directory.
3. In the Task Manager, search for cloudResetPwdAgent and cloudResetPwdUpdateAgent.
  - If they are found, the installation is successful.
  - If they are not found, the installation fails.

(Optional) Hardening Security

Disable remote login.

Control Panel -->System and Security -->System --> Allow remote access
Disable the WinRM service.
1. Open the CMD window or PowerShell as an administrator.
2. Stop the WinRM service.
  net stop winrm
3. Disable the WinRM service.
  sc config winrm start= disabled
Set a password login policy to prevent unauthorized access through brute-force methods.
1. Open the CMD window or PowerShell as an administrator.
2. Run the gpedit.msc command to start Local Group Policy Editor.
3. In the displayed window, choose Computer Configuration > Windows settings > Security Settings > Account Policy > Account Lockout Policy. Set the account locking policy shown in the following figure. This policy indicates that if there are 6 consecutive unsuccessful login attempts, the account will be blocked for 3 minutes.

Disable listening ports on the Windows firewall.

Open the CMD window and run the netstat -ano command to check all listening ports.

Disable all dynamic listening ports (49152-65535) and port 135.

netsh advfirewall firewall add rule name=Tcp_disable dir=in action=block protocol=TCP localport=135,3389,5985,5986,49152-65535

Disable all UDP ports.

netsh advfirewall firewall add rule name=Tcp_disable dir=in action=block protocol=UDP localport=any

Creating an Image

Sign in to the Huawei Cloud console, search for IMS, and access the IMS console.
Click Create Image.
Create a system disk image from the ECS as prompted.
Obtain the ID of the created image.