Compute Engine provides public images with Windows Server that you can use to create instances. For instructions on how to create a Windows Server instance with SQL Server preinstalled, see Creating SQL Server instances.
For more general information about Windows Server instances and Windows applications that you can run on Compute Engine, see Windows on Compute Engine.
Pricing
Windows Server images are premium images, and using them results in additional charges.
Windows Server VMs are not included with the Free Trial.
Before you begin
- Enabling billing for your project.
-
If you haven't already, then set up authentication.
Authentication is
the process by which your identity is verified for access to Google Cloud services and APIs.
To run code or samples from a local development environment, you can authenticate to
Compute Engine by selecting one of the following options:
Select the tab for how you plan to use the samples on this page:
Console
When you use the Google Cloud console to access Google Cloud services and APIs, you don't need to set up authentication.
gcloud
-
Install the Google Cloud CLI, then initialize it by running the following command:
gcloud init
- Set a default region and zone.
Go
To use the Go samples on this page in a local development environment, install and initialize the gcloud CLI, and then set up Application Default Credentials with your user credentials.
- Install the Google Cloud CLI.
-
To initialize the gcloud CLI, run the following command:
gcloud init
-
If you're using a local shell, then create local authentication credentials for your user account:
gcloud auth application-default login
You don't need to do this if you're using Cloud Shell.
For more information, see Set up authentication for a local development environment.
Java
To use the Java samples on this page in a local development environment, install and initialize the gcloud CLI, and then set up Application Default Credentials with your user credentials.
- Install the Google Cloud CLI.
-
To initialize the gcloud CLI, run the following command:
gcloud init
-
If you're using a local shell, then create local authentication credentials for your user account:
gcloud auth application-default login
You don't need to do this if you're using Cloud Shell.
For more information, see Set up authentication for a local development environment.
Node.js
To use the Node.js samples on this page in a local development environment, install and initialize the gcloud CLI, and then set up Application Default Credentials with your user credentials.
- Install the Google Cloud CLI.
-
To initialize the gcloud CLI, run the following command:
gcloud init
-
If you're using a local shell, then create local authentication credentials for your user account:
gcloud auth application-default login
You don't need to do this if you're using Cloud Shell.
For more information, see Set up authentication for a local development environment.
Python
To use the Python samples on this page in a local development environment, install and initialize the gcloud CLI, and then set up Application Default Credentials with your user credentials.
- Install the Google Cloud CLI.
-
To initialize the gcloud CLI, run the following command:
gcloud init
-
If you're using a local shell, then create local authentication credentials for your user account:
gcloud auth application-default login
You don't need to do this if you're using Cloud Shell.
For more information, see Set up authentication for a local development environment.
REST
To use the REST API samples on this page in a local development environment, you use the credentials you provide to the gcloud CLI.
Install the Google Cloud CLI, then initialize it by running the following command:
gcloud init
For more information, see Authenticate for using REST in the Google Cloud authentication documentation.
-
Create a Windows Server instance
To create an instance with Windows Server, specify the image family for the specific version of Windows that you need. Compute Engine offers several versions of Windows Server, most of which are available as Shielded VM images. Shielded VM images offer security features like UEFI-compliant firmware, Secure Boot, and vTPM-protected Measured Boot. For a list of the available image families, see public images.
If you need more than two concurrent remote desktop sessions, you will need to purchase Remote Desktop Session (RDS) Client Access Licenses (CALs). For more information, see License your RDS deployment with client access licenses (CALs).
Work with Microsoft Active Directory
If you plan on using Microsoft Active Directory (AD) with your new instance, make sure the instance name is no longer than 15 characters, to meet the stated maximum name length restrictions of the system.
AD uses the NetBIOS names of machines, which are generated as the instance name
truncated to 15 characters. As a result, you might encounter the following error
when trying to sign in as a domain user:
The Security Database on the Server does not have a Computer Account for this Workstation Trust Relationship
.
Create a Windows Server instance that uses an external IP to activate
This section describes how to create a Windows Server instance that has an
external IP address. Your VPC network must be configured to
allow access to kms.windows.googlecloud.com
.
Console
To create a basic Windows VM:
In the Google Cloud console, go to the Create an instance page.
For Boot disk, select Change, and do the following:
- On the Public images tab, choose a Windows Server operating system.
- Click Select.
To create the VM, click Create.
To create a Shielded VM Windows instance, do the following:
In the Google Cloud console, go to the Create an instance page.
For Boot disk, select Change, and do the following:
- On the Public images tab, choose a Windows Server operating system.
- To save your boot disk configuration, click Select.
Optionally, to change the VM's Shielded VM settings, expand the the Advanced options section. Then, do the following:
- Expand the Security section.
- If you want to turn off Secure Boot, clear the Turn on Secure Boot checkbox. Secure Boot helps protect your VM instances against boot-level and kernel-level malware and rootkits. For more information, see Secure Boot.
If you want to turn off the virtual trusted platform module (vTPM), clear the Turn on vTPM checkbox. The vTPM enables Measured Boot, which validates the VM pre-boot and boot integrity. For more information, see Virtual Trusted Platform Module (vTPM).
If you want to turn off integrity monitoring, clear the Turn on Integrity Monitoring checkbox. Integrity monitoring lets you monitor the boot integrity of your Shielded VM VMs using Cloud Monitoring. For more information, see Integrity monitoring.
To create the VM, click Create.
gcloud
Use the
compute images list
command to see a list of available Windows Server
images:
gcloud compute images list --project windows-cloud --no-standard-images
To determine whether an image supports Shielded VM features, run
the following command, and check for UEFI_COMPATIBLE
in the output:
gcloud compute images describe [IMAGE_NAME] --project windows-cloud
where [IMAGE_NAME]
is the name of the image to check for support of
Shielded VM features.
Use the
compute instances create
command to create a new instance and specify the image family for one of
the Windows Server public images.
gcloud compute instances create [INSTANCE_NAME] \ --image-project windows-cloud \ --image-family [IMAGE_FAMILY] \ --machine-type [MACHINE_TYPE] \ --boot-disk-size [BOOT_DISK_SIZE] \ --boot-disk-type [BOOT_DISK_TYPE]
where:
[INSTANCE_NAME]
is the name for the new instance.[IMAGE_FAMILY]
is one of the public image families for Windows Server images.[MACHINE_TYPE]
is one of the available machine types.[BOOT_DISK_SIZE]
is the size of the boot disk in GB. Larger persistent disks have higher throughput.[BOOT_DISK_TYPE]
is the type of the boot disk for your instance. For example,pd-ssd
.
If you chose an image that supports Shielded VM, you can optionally change the instance's Shielded VM settings using one of the following flags:
--no-shielded-secure-boot
: Disable Secure Boot. Secure Boot helps protect your VM instances against boot-level and kernel-level malware and rootkits. For more information, see Secure Boot.--no-shielded-vtpm
: Disable the virtual trusted platform module (vTPM). The vTPM enables Measured Boot, which validates the VM pre-boot and boot integrity. For more information, see Virtual Trusted Platform Module (vTPM).--no-shielded-integrity-monitoring
: Disable integrity monitoring. Integrity monitoring lets you monitor the boot integrity of your Shielded VM instances using Cloud Monitoring. For more information, see Integrity monitoring.
The following example creates a Windows 2022 Shielded VM instance with Secure Boot disabled:
gcloud compute instances create my-instance \ --image-family windows-2022 --image-project windows-cloud \ --no-shielded-secure-boot
Go
Java
Node.js
Python
REST
To create an instance with the API, include the
initializeParams
property in your instance creation request and specify a Windows image. For
example, your request body might look like the following:
instance = { "name": "[INSTANCE_NAME]", "machineType": "zones/[ZONE]/machineTypes/[MACHINE_TYPE]", "disks": [{ "boot": "true", "type": "PERSISTENT", "initializeParams": { "diskName": "[DISK_NAME]", "sourceImage": "https://www.googleapis.com/compute/v1/projects/windows-cloud/global/images/family/[IMAGE_FAMILY]", "diskSizeGb": "[BOOT_DISK_SIZE]", "diskType": "[BOOT_DISK_TYPE]", } }], "networkInterfaces": [{ "accessConfigs": [{ "type": "ONE_TO_ONE_NAT", "name": "External NAT" }], "network": "global/networks/default" }], "serviceAccounts": [{ "email": DEFAULT_SERVICE_EMAIL, "scopes": DEFAULT_SCOPES }] }
where:
[INSTANCE_NAME]
is the name for the new instance.[IMAGE_FAMILY]
is one of the public image families for Windows Server or SQL Server images.[ZONE]
is the zone for this instance.[MACHINE_TYPE]
is one of the available machine types.[BOOT_DISK_SIZE]
is the size of the boot disk in GB. Larger persistent disks have higher throughput.[BOOT_DISK_TYPE]
is the type of the boot disk for your instance. For example,pd-ssd
.
If you chose an image that supports Shielded VM, you can optionally change the instance's Shielded VM settings by using the following boolean request body items:
enableSecureBoot
: Enable or disable Secure Boot. Secure Boot helps protect your VM instances against boot-level and kernel-level malware and rootkits. For more information, see Secure Boot.enableVtpm
: Enable or disable the virtual trusted platform module (vTPM). The vTPM enables Measured Boot, which validates the VM pre-boot and boot integrity. For more information, see Virtual Trusted Platform Module (vTPM).enableIntegrityMonitoring
: Enable or disable integrity monitoring. Integrity monitoring lets you monitor and verify the runtime boot integrity of your Shielded VM instances using Cloud Monitoring reports. For more information, see Integrity monitoring.
For more information about creating an instance, read the
instances.insert()
documentation.
After you create your Windows or SQL Server instance, set the initial password for the instance so that you can connect to the instance through RDP.
Additionally, you can join the VM to a Managed Microsoft AD domain either while creating the VM or after creating the VM. For more information, see Join a Windows VM automatically to a domain.
Create a Windows Server instance that uses an internal IP address to activate
Before you can create a Windows Server instance that has only an internal IP
address, you must verify or configure routes and firewall rules in your
VPC network to allow access to
kms.windows.googlecloud.com
. Additionally, you must
enable
Private Google Access
for subnets in your VPC network that contain Windows instances
with only internal IP addresses.
gcloud
When you create a new instance by using the gcloud CLI, you can use
the --no-address
flag to ensure that it is not assigned an external IP
address:
gcloud compute instances create [INSTANCE_NAME] --network [NETWORK_NAME] \ --subnet [SUBNET_NAME] \ --no-address \ --zone [ZONE] \ --image-project windows-cloud \ --image-family [IMAGE_FAMILY] \ --machine-type [MACHINE_TYPE] \ --boot-disk-size [BOOT_DISK_SIZE] \ --boot-disk-type [BOOT_DISK_TYPE]
Replace the following placeholders with valid values:
[INSTANCE_NAME]
is the name for the new instance.[SUBNET_NAME]
is the name of the subnet in the VPC network that the instance will use. The subnet must be in the same region as the zone you choose for the instance.[IMAGE_FAMILY]
is one of the public image families for Windows Server images.[MACHINE_TYPE]
is one of the available machine types.[BOOT_DISK_SIZE]
is the size of the boot disk in GB. Larger persistent disks have higher throughput.[BOOT_DISK_TYPE]
is the type of the boot disk for your instance. For example,pd-ssd
.
Go
Java
Node.js
Python
Because this instance does not have an external IP address, you cannot connect to it directly over the Internet. You can connect from another network connected to your VPC network by using Cloud Interconnect or Cloud VPN, or you can first connect to a bastion instance over RDP and then connect to the instance that has only an internal IP address.
Additionally, you can join the VM to a Managed Microsoft AD domain either while creating the VM or after creating the VM. For more information, see Join a Windows VM automatically to a domain.
Configure access to kms.windows.googlecloud.com
For Windows activation and renewal, your VPC network must meet the following routing and firewall rule requirements.
Routing requirements
Your Windows instances must be able to reach kms.windows.googlecloud.com
(35.190.247.13
or 2001:4860:4802:32::86
) through a route whose next hop is the default Internet
gateway. You cannot activate Windows instances using an instance based NAT
gateway or Cloud NAT because kms.windows.googlecloud.com
rejects
activation requests from IP addresses that are not confirmed to be
Compute Engine instances.
You can use the default route in your
VPC network to route traffic directly to
kms.windows.googlecloud.com
. If you remove this route, or if you plan to do so
in the future, create a custom static
route with destination 35.190.247.13
or 2001:4860:4802:32::86
, and
next hop set to default Internet gateway, as follows:
IPv4 only
gcloud compute routes create mskms-ipv4-route-ipv4-network \ --destination-range=35.190.247.13/32 \ --network=ipv4-network \ --next-hop-gateway=default-internet-gateway
Dual stack
gcloud compute routes create mskms-ipv4-route-ipv4-network \ --destination-range=35.190.247.13/32 \ --network=ipv4-network \ --next-hop-gateway=default-internet-gateway
gcloud compute routes create mskms-ipv6-route-ipv6-network \ --destination-range=2001:4860:4802:32::86/128 \ --network=ipv6-network \ --next-hop-gateway=default-internet-gateway
IPv6 only
gcloud compute routes create mskms-ipv6-route-ipv6-network \ --destination-range=2001:4860:4802:32::86/128 \ --network=ipv6-network \ --next-hop-gateway=default-internet-gateway
Replace ipv4-network
or ipv6-network
with the name
of your VPC network.
Either the default route or a custom static route as described above will permit
instances with external IP addresses to reach kms.windows.googlecloud.com
. If
you have Windows instances without external IP addresses or using
Cloud NAT, you must also enable
Private Google Access
so that instances with only internal IP addresses can send traffic to the
external IP address for kms.windows.googlecloud.com
(35.190.247.13
or 2001:4860:4802:32::86
).
Firewall rule requirements
The implied allow egress firewall
rule allows instances to make requests and receive established responses. Unless
you have created custom firewall rules that deny egress, your Windows instances
can communicate with kms.windows.googlecloud.com
.
If you customize firewall rules, it's a good practice to create a high priority
egress allow rule that explicitly permits communication with 35.190.247.13
or 2001:4860:4802:32::86
.
This way, as you modify your firewall rules, you won't accidentally disable
Windows activation.
The following gcloud
examples creates the recommended allow egress rule with
the highest priority:
IPv4 only
gcloud compute firewall-rules create mskms-ipv4-firewall-rule-ipv4-network \ --direction=EGRESS \ --network=ipv4-network \ --action=ALLOW \ --rules=tcp:1688 \ --destination-ranges=35.190.247.13/32 \ --priority=0
Dual stack
gcloud compute firewall-rules create mskms-ipv4-firewall-rule-ipv4-network \ --direction=EGRESS \ --network=ipv4-network \ --action=ALLOW \ --rules=tcp:1688 \ --destination-ranges=35.190.247.13/32 \ --priority=0
gcloud compute firewall-rules create mskms-ipv6-firewall-rule-ipv6-network \ --direction=EGRESS \ --network=ipv6-network \ --action=ALLOW \ --rules=tcp:1688 \ --destination-ranges=2001:4860:4802:32::86/128 \ --priority=0
IPv6 only
gcloud compute firewall-rules create mskms-ipv6-firewall-rule-ipv6-network \ --direction=EGRESS \ --network=ipv6-network \ --action=ALLOW \ --rules=tcp:1688 \ --destination-ranges=2001:4860:4802:32::86/128 \ --priority=0
Replace ipv4-network
or ipv6-network
with the name
of your VPC network.
Verifying that an instance has successfully started
Windows instances experience a longer startup time because of the sysprep process. The Google Cloud console might show that the instance is running even if the sysprep process is not yet complete. To check if your instance has successfully started and is ready to be used, check the serial port output with the following command:
gcloud compute instances get-serial-port-output [INSTANCE_NAME]
where [INSTANCE_NAME]
is the name of the instance you want to verify.
...[snip]... Running schtasks with arguments /run /tn GCEStartup --> SUCCESS: Attempted to run the scheduled task "GCEStartup". ------------------------------------------------------------- Instance setup finished. [INSTANCE_NAME] is ready to use. -------------------------------------------------------------
Enabling and disabling Windows instance features
If you have Windows instances with image versions v20170509
and later or
with agent version 4.1.0
and later, you can set instance configuration
in a config file or in
project or instance custom metadata. The config file is in
INI format,
and is located at the following path:
C:\Program Files\Google\Compute Engine\instance_configs.cfg
The system overrides configuration settings in the following order of priority from the highest priority to the lowest priority:
- Configuration parameters that you set in the config file
- Configuration parameters set in instance-level custom metadata
- Configuration parameters set in project-level custom metadata
For example, if you can enable the accountManager
feature in a config file,
your instance ignores parameters that you set in custom metadata to disable
that feature.
One benefit of setting these parameters in the config file is that those settings persist when you create a custom image for a Windows Server instance. Instance-level custom metadata does not persist beyond the life of the instance.
You can disable different Windows instance features using the following examples.
Disable the account manager
Disabling the account manager also disables resetting passwords with the Google Cloud CLI or the Google Cloud console:
Config file:
[accountManager] disable=true
In custom metadata, set
disable-account-manager
totrue
in metadata.
Disable the address manager
Config file entry:
[addressManager] disable=true
In custom metadata, set
disable-address-manager
totrue
in metadata.
Windows Server Failover Clustering
Enable the Windows Server Failover Clustering agent:
Config file entry:
[wsfc] enable=true
In custom metadata, set
enable-wsfc
totrue
in metadata.
Using multiple internal load balancers
Specify the IP address of the internal load balancing instance for failover clustering. This is an advanced configuration that you don't need to set for a dedicated failover cluster.
Normally you use an instance of internal load balancing to direct
network traffic to one VM instance at a time. If you add
a second instance of internal load balancing that uses the failover
clustering VM instances as part of a load-balanced website backend,
you would have two internal load balancing IP addresses. If failover clustering
uses 10.0.0.10
and the website's load balancer uses 10.0.0.11
,
you must specify the IP address of the load balancer that you use for failover
clustering. This disambiguates which address is in use for the cluster.
Config file entry:
[wsfc] addresses=10.0.0.10
In custom metadata, set
wsfc-addrs
to a10.0.0.10
.
Changing the clustering agent port
Set the failover clustering agent port. The default port is 59998
.
You need to specify a port only when you want to use a different port:
Config file entry:
[wsfc] port=12345
In custom metadata, set
wsfc-agent-port
to the port number.
Image version notes
Older images do not use a config file and only have a subset of features.
Image versions between version v20160112
and version v20170509
, or
Windows agent version between 3.2.1.0
and 4.0.0
require you to use the
following custom metadata values:
- Set
disable-account-manager
totrue
in instance metadata to disable the account manager. - Set
disable-address-manager
totrue
in instance metadata to disable the address manager.
What's next
- Generate credentials for Windows VMs
- Add a persistent disk
- Connect to Windows VMs using RDP
- Connect to Windows VMs using SSH
- Connect to Windows VMs using PowerShell