Initialize-Hgs Server

Syntax

Initialize-HgsServer
          [-HgsServiceName] <String>
          [-UseHgsDomain]
          [-LogDirectory <String>]
          [-Http]
          [-Https]
          [-HttpPort <UInt16>]
          [-HttpsPort <UInt16>]
          [-HttpsCertificatePath <String>]
          [-HttpsCertificatePassword <SecureString>]
          [-HttpsCertificateThumbprint <String>]
          [-TrustActiveDirectory]
          [-TrustTpm]
          [-EncryptionCertificateThumbprint <String>]
          [-EncryptionCertificatePath <String>]
          [-EncryptionCertificatePassword <SecureString>]
          [-SigningCertificateThumbprint <String>]
          [-SigningCertificatePath <String>]
          [-SigningCertificatePassword <SecureString>]
          [-HgsVersion <HgsVersion>]
          [-Force]
          [-WhatIf]
          [-Confirm]
          [<CommonParameters>]

Initialize-HgsServer
          [-HgsServiceName] <String>
          [-UseExistingDomain]
          [-LogDirectory <String>]
          -JeaAdministratorsGroup <ADGroup>
          -JeaReviewersGroup <ADGroup>
          -ServiceAccount <ADServiceAccount>
          [-ClusterName <String>]
          [-Http]
          [-Https]
          [-HttpPort <UInt16>]
          [-HttpsPort <UInt16>]
          [-HttpsCertificatePath <String>]
          [-HttpsCertificatePassword <SecureString>]
          [-HttpsCertificateThumbprint <String>]
          [-TrustActiveDirectory]
          [-TrustTpm]
          [-EncryptionCertificateThumbprint <String>]
          [-EncryptionCertificatePath <String>]
          [-EncryptionCertificatePassword <SecureString>]
          [-SigningCertificateThumbprint <String>]
          [-SigningCertificatePath <String>]
          [-SigningCertificatePassword <SecureString>]
          [-HgsVersion <HgsVersion>]
          [-Force]
          [-WhatIf]
          [-Confirm]
          [<CommonParameters>]

Initialize-HgsServer
          [-HgsServerIPAddress] <String>
          [-LogDirectory <String>]
          [-Http]
          [-Https]
          [-HttpPort <UInt16>]
          [-HttpsPort <UInt16>]
          [-HttpsCertificatePath <String>]
          [-HttpsCertificatePassword <SecureString>]
          [-HttpsCertificateThumbprint <String>]
          [-Force]
          [-WhatIf]
          [-Confirm]
          [<CommonParameters>]

Description

The Initialize-HgsServer cmdlet configures the necessary infrastructure components for Host Guardian Service (HGS) after it is rebooted.

This cmdlet performs the following configuration actions on infrastructure components of the first HGS node:

• Creates one-node failover cluster.
• Configures a failover cluster with a distributed network name resource corresponding to the fully qualified domain name of the HGS name: <HgsServerName>.<LocalDomain>.
• Registers and configures the Attestation service web application with the IIS service.
• Registers and configures the Key Protection service web application with the IIS service.
• Configures the Attestation service signer certificate with the Key Protection service.
• Enables Just Enough Administration on the local node.

This cmdlet makes the following configuration changes to components on an additional HGS node:

• Adds the local node to the existing failover cluster on a node specified by the HgsServerIPAddress parameter using the credential specified in the HgsDomainCredential parameter.

• Registers and configures the Attestation service web application with the IIS service.

• Registers and configures the Key Protection service web application with the IIS service.
• Configures the Attestation service signer certificate with the Key Protection service.
• Enables Just Enough Administration on the local node.

For more information about the scenario terms, see Security and Assurance .

Examples

Example 1: Initialize the HGS on the primary node in TPM mode

PS C:\> Initialize-HgsServer -HgsServiceName "SecureFabricHgs" -EncryptionCertificateThumbprint $EncryptionCert.Thumbprint -SigningCertificateThumbprint $SigningCert.Thumbprint

This command initializes the HGS server on the primary node. By default, the server is accessible on HTTP port 80 and the Attestation service is set to TPM mode. The specified certificates are used by the Key Protection service.

Example 2: Initialize the HGS on a secondary node in TPM mode

PS C:\> $Cred = Get-Credential
PS C:\> Initialize-HgsServer -HgsServerIPAddress "100.100.100.1" -HgsDomainCredential $Cred

This command initializes the HGS server on a secondary node. By default, the server is accessible on HTTP port 80 and the Attestation service is set to TPM mode. The Key Protection service uses the encryption and signing certificates set by the primary server.

Example 3: Initialize the HGS on the primary node in Active Directory mode

PS C:\> Initialize-HgsServer -TrustActiveDirectory -HgsServiceName "SecureFabricHgs" -EncryptionCertificateThumbprint $EncryptionCert.Thumbprint -SigningCertificateThumbprint $SigningCert.Thumbprint

This command initializes the HGS server on the primary node and sets the Attestation service to Active Directory (AD) mode. By default, the server is accessible on HTTP port 80. The specified certificates are used by the Key Protection service.

Example 4: Initialize the HGS on the primary node in TPM mode and enable HTTPS

PS C:\> Initialize-HgsServer -HgsServiceName "SecureFabricHgs" -EncryptionCertificateThumbprint $EncryptionCert.Thumbprint -SigningCertificateThumbprint $SigningCert.Thumbprint -http -https -HttpsCertificatePath $PathToPfx -HttpsCertificatePassword $PfxSecureString

This command initializes the HGS server on the primary node. The server is set to be accessible by HTTP and HTTPS on the default ports, and with the specified certificate for HTTPS. By default, the server is accessible on HTTP port 80 and the Attestation service is set to TPM mode. The specified certificates are used by the Key Protection service.

Required Parameters

Optional Parameters

Related Links

• HGS Server Cmdlets