Creating and Managing Windows Server Instances

This guide shows you how to create Windows Server instances on Google Compute Engine. For instructions on how to create an instance with SQL Server preinstalled, see Creating SQL Server Instances.

For more general information about Windows Server instances and Windows applications that you can run on Compute Engine, see Windows on Compute Engine.

Before you begin

Creating a Windows Server instance

To create an instance with Windows Server, specify the image family for the specific version of Windows that you need. Compute Engine offers several versions of Windows Server, most of which are available as both regular and Shielded VMBETA images. Shielded VM images offer security features like UEFI-compliant firmware, Secure Boot, and vTPM-protected Measured Boot. If you choose SSD storage for your instance, you cannot use the integrity monitoring features of Shielded VM, and you cannot use the vTPM for shielding data. For a list of the available image families, see public images.

Console


To create a basic Windows instance:

  1. In the GCP Console, go to the VM Instances page.

    Go to the VM Instances page

  2. Click Create instance.
  3. In the Boot disk section, click Change to begin configuring your boot disk.
  4. In the OS images tab, choose a Windows image.

    Select Show images with Shielded VM features to see only Shielded VM images.

  5. Click Select.
  6. Click Create to create the instance.

To create a Shielded VM Windows instance:

  1. Go to the VM instances page.

    Go to the VM instances page

  2. Click Create instance.
  3. In the Boot disk section, click Change to begin configuring your boot disk.
  4. In the OS images tab, choose a Windows image.
    Select Show images with Shielded VM features to see only Shielded VM images.

  5. Click Select.

  6. Optionally, change the instance's Shielded VM settings:

    1. Click on the Security tab in the Management Security Disks Networking section.
    2. If you want to disable Secure Boot, uncheck Turn on Secure Boot. Secure Boot helps protect your VM instances against boot-level and kernel-level malware and rootkits. For more information, see Secure Boot.
    3. If you want to disable the virtual trusted platform module (vTPM), uncheck Turn on vTPM. The vTPM enables Measured Boot, which validates the VM pre-boot and boot integrity. For more information, see Virtual Trusted Platform Module (vTPM).

    4. If you want to disable integrity monitoring, uncheck Turn on Integrity Monitoring. Integrity monitoring lets you monitor the boot integrity of your Shielded VM instances using Stackdriver. For more information, see Integrity monitoring.

  7. Click Create to create the instance.

gcloud


Use the compute images list command to see a list of available Windows Server images.

Use the following command to see available non-Shielded VM Windows Server images:

gcloud compute images list --project windows-cloud --no-standard-images

Use the following command to see a list of available Shielded VM images, including Windows images:

gcloud compute images list --project gce-uefi-images --no-standard-images

Use the compute instances create command to create a new instance and specify the image family for one of the Windows Server public images.

gcloud compute instances create [INSTANCE_NAME] \
    --image-project windows-cloud \
    --image-family [IMAGE_FAMILY] \
    --machine-type MACHINE_TYPE] \
    --boot-disk-size [BOOT_DISK_SIZE] \
    --boot-disk-type [BOOT_DISK_TYPE]

where:

  • [INSTANCE_NAME] is the name for the new instance.
  • [IMAGE_FAMILY] is one of the public image families for Windows Server images.
  • [MACHINE_TYPE] is one of the available machine types.
  • [BOOT_DISK_SIZE] is the size of the boot disk in GB. Larger persistent disks have higher throughput.
  • [BOOT_DISK_TYPE] is the type of the boot disk for your instance. Specify pd-ssd to use a faster SSD persistent disk or pd-standard to use a standard HDD persistent disk.

If you chose an image that supports Shielded VM, you can optionally change the instance's Shielded VM settings using one of the following flags:

  • --no-shielded-vm-secure-boot: Disable Secure Boot. Secure Boot helps protect your VM instances against boot-level and kernel-level malware and rootkits. For more information, see Secure Boot.
  • --no-shielded-vm-vtpm: Disable the virtual trusted platform module (vTPM). The vTPM enables Measured Boot, which validates the VM pre-boot and boot integrity. For more information, see Virtual Trusted Platform Module (vTPM).

  • --no-shielded-vm-integrity-monitoring: Disable integrity monitoring. Integrity monitoring lets you monitor the boot integrity of your Shielded VM instances using Stackdriver. For more information, see Integrity monitoring.

The following example creates a Windows 2012 Shielded VM instance with Secure Boot disabled:

 gcloud beta compute instances create my-instance \
 --image-family windows-2012-r2 --image-project gce-uefi-images \
 --no-shielded-vm-secure-boot

API


To create an instance with the API, include the initializeParams property in your instance creation request and specify a Windows image. For example, your request body might look like the following:

 instance = {
   "name": "[INSTANCE_NAME]",
   "machineType": "zones/[ZONE]/machineTypes/[MACHINE_TYPE]",
   "disks": [{
       "boot": "true",
       "type": "PERSISTENT",
       "initializeParams": {
          "diskName": "[DISK_NAME]",
          "sourceImage": "https://www.googleapis.com/compute/v1/projects/windows-cloud/global/images/family/[IMAGE_FAMILY]",
          "diskSizeGb": "[BOOT_DISK_SIZE]",
          "diskType": "[BOOT_DISK_TYPE]",
        }
     }],
   "networkInterfaces": [{
     "accessConfigs": [{
       "type": "ONE_TO_ONE_NAT",
       "name": "External NAT"
      }],
     "network": "global/networks/default"
   }],
   "serviceAccounts": [{
        "email": DEFAULT_SERVICE_EMAIL,
        "scopes": DEFAULT_SCOPES
   }]
 }

where:

  • [INSTANCE_NAME] is the name for the new instance.
  • [IMAGE_FAMILY] is one of the public image families for Windows Server or SQL Server images.
  • [ZONE] is the zone for this instance.
  • [MACHINE_TYPE] is one of the available machine types.
  • [BOOT_DISK_SIZE] is the size of the boot disk in GB. Larger persistent disks have higher throughput.
  • [BOOT_DISK_TYPE] is the type of the boot disk for your instance. Specify pd-ssd to use a faster SSD persistent disk or pd-standard to use a standard HDD persistent disk.

If you chose an image that supports Shielded VM, you can optionally change the instance's Shielded VM settings by using the following boolean request body items:

  • enableSecureBoot: Enable or disable Secure Boot. Secure Boot helps protect your VM instances against boot-level and kernel-level malware and rootkits. For more information, see Secure Boot.
  • enableVtpm: Enable or disable the virtual trusted platform module (vTPM). The vTPM enables Measured Boot, which validates the VM pre-boot and boot integrity. For more information, see Virtual Trusted Platform Module (vTPM).

  • enableIntegrityMonitoring: Enable or disable integrity monitoring. Integrity monitoring lets you monitor and verify the runtime boot integrity of your Shielded VM instances using Stackdriver reports. For more information, see Integrity monitoring.

For more information on creating an instance, read the instances.insert() documentation.

After you create your Windows or SQL Server instance, set the initial password for the instance so that you can connect to the instance through RDP.

Verifying that an instance has successfully started

Windows instances experience a longer startup time because of the sysprep process. The GCP Console might show that the instance is running even if the sysprep process is not yet complete. To check if your instance has successfully started and is ready to be used, check the serial port output with the following command:

gcloud compute instances get-serial-port-output [INSTANCE_NAME]

where [INSTANCE_NAME] is the name of the instance you want to verify.

...[snip]...
Running schtasks with arguments /run /tn GCEStartup
-->  SUCCESS: Attempted to run the scheduled task "GCEStartup".
-------------------------------------------------------------
Instance setup finished. [INSTANCE_NAME] is ready to use.
-------------------------------------------------------------

Disabling automatic component updates

If you have Windows instances with image versions v20170509 and later or with agent version 4.1.0 and later, Google-provided components such as the agent, metadata, and sysprep scripts are updated automatically using a scheduled task. The scheduled task is set up by the google-compute-engine-auto-updater package.

If you want to manage updates manually or manage updates using an alternative system you can disable these automatic component updates by removing the google-compute-engine-auto-updater package:

  1. On the Windows Server instance, open a PowerShell terminal as an administrator.
  2. Run the googet remove command to remove the package:

    PS C:\> googet remove google-compute-engine-auto-updater
    

Optionally, you can reinstall the package to enable automatic component updates:

  1. On the Windows Server instance, open a PowerShell terminal as an administrator.
  2. Run the googet install command to install the package:

    PS C:\> googet install google-compute-engine-auto-updater
    

Alternatively, you can disable the updates by setting the disable-agent-updates value to true in project or instance custom metadata. The metadata value disables updates without removing the package or the task.

Enabling and disabling Windows instance features

If you have Windows instances with image versions v20170509 and later or with agent version 4.1.0 and later, you can set instance configuration in a config file or in project or instance custom metadata. The config file is in INI format, and is located at the following path:

C:\Program Files\Google\Compute Engine\instance_configs.cfg

The system overrides configuration settings in the following order of priority from the highest priority to the lowest priority:

  1. Configuration parameters that you set in the config file
  2. Configuration parameters set in instance-level custom metadata
  3. Configuration parameters set in project-level custom metadata

For example, if you can enable the accountManager feature in a config file, your instance ignores parameters that you set in custom metadata to disable that feature.

One benefit of setting these parameters in the config file is that those settings persist when you create a custom image for a Windows Server instance. Instance-level custom metadata does not persist beyond the life of the instance.

You can disable different Windows instance features using the following examples.

Disable the account manager:

  • Config file:

    [accountManager]
    disable=true
    
  • In custom metadata, set disable-account-manager to true in metadata.

Disable the address manager:

  • Config file entry:

    [addressManager]
    disable=true
    
  • In custom metadata, set disable-address-manager to true in metadata.

Windows Server Failover Clustering

Enable the Windows Server Failover Clustering agent:

  • Config file entry:

    [wsfc]
    enable=true
    
  • In custom metadata, set enable-wsfc to true in metadata.

Using multiple internal load balancers

Specify the IP address of the internal load balancing instance for failover clustering. This is an advanced configuration that you don't need to set for a dedicated failover cluster.

Normally you use an instance of internal load balancing to direct network traffic to one VM instance at a time. If you add a second instance of internal load balancing that uses the failover clustering VM instances as part of a load-balanced website backend, you would have two internal load balancing IP addresses. If failover clustering uses 10.0.0.10 and the website's load balancer uses 10.0.0.11, you must specify the IP address of the load balancer that you use for failover clustering. This disambiguates which address is in use for the cluster.

  • Config file entry:

    [wsfc]
    addresses=10.0.0.10
    
  • In custom metadata, set wsfc-addrs to a 10.0.0.10.

Changing the clustering agent port

Set the failover clustering agent port. The default port is 59998. You need to specify a port only when you want to use a different port:

  • Config file entry:

    [wsfc]
    port=12345
    
  • In custom metadata, set wsfc-agent-port to the port number.

Image version notes

Older images do not use a config file and only have a subset of features. Image versions between version v20160112 and version v20170509, or Windows agent version between 3.2.1.0 and 4.0.0 require you to use the following custom metadata values:

  • Set disable-account-manager to true in instance metadata to disable the account manager.
  • Set disable-address-manager to true in instance metadata to disable the address manager.

What's next

Was this page helpful? Let us know how we did:

Send feedback about...

Compute Engine Documentation