Windows Server VMs on Azure

The first mistake stops you before anything is built. The second shows up days later as a warning on every login, unless you know where to look.

1Break it: a password the CLI won’t accept

Run this:

az vm create --resource-group rg-saat-vms --name win99 --image MicrosoftWindowsServer:WindowsServer:2025-datacenter-azure-edition-core-smalldisk:latest --size Standard_B2ats_v2 --subnet $v.'snet-mgmt' --public-ip-address '""' --nsg '""' --admin-username azureuser --admin-password 'Winter2026'

You’ll get this error:

The password length must be between 12 and 123. Password must have the 3 of the following: 1 lower case character, 1 upper case character, 1 number and 1 special character.

The CLI checked it on your laptop, so nothing was sent to Azure. Winter2026 is 10 characters with no symbol: exactly the kind of password that password-spray attacks try first. Generate passwords instead, as in step 2.

2Break it: activate Windows from a private subnet

Ask Windows to activate now:

az vm run-command invoke --resource-group rg-saat-vms --name win01 --command-id RunPowerShellScript --scripts 'cscript //nologo C:\Windows\System32\slmgr.vbs /ato; Test-NetConnection azkms.core.windows.net -Port 1688 | Select-Object ComputerName, TcpTestSucceeded' --query "value[0].message" -o tsv

You’ll get output like this:

Activating Windows(R), ServerDatacenterAzureEdition edition (...) ...
Error: 0xC004F074 The Software Licensing Service reported that the computer could not be activated. No Key Management Service (KMS) could be contacted. Please see the Application Event Log for additional information.

ComputerName           TcpTestSucceeded
------------           ----------------
azkms.core.windows.net False

Port 1688 to Azure KMS can’t be reached, because snet-mgmt is a private subnet with no outbound method. Older VNets had default outbound access, so this used to “just work”. In new networks, unactivated servers show a watermark and remind users to activate, and some features are limited.

Fix it: give the subnet a way out for a moment, as in Lesson 13, and activate:

az group create --name rg-saat-l16 --tags course=saatvedha-azure lesson=16 -o none
az network public-ip create --resource-group rg-saat-l16 --name pip-saat-l16 --sku Standard --allocation-method Static --tags course=saatvedha-azure lesson=16 -o none
az network nat gateway create --resource-group rg-saat-l16 --name nat-saat-l16 --public-ip-addresses pip-saat-l16 --tags course=saatvedha-azure lesson=16 -o none
$nat = az network nat gateway show --resource-group rg-saat-l16 --name nat-saat-l16 --query id -o tsv
az network vnet subnet update --ids $v.'snet-mgmt' --nat-gateway $nat -o none
Start-Sleep -Seconds 60
az vm run-command invoke --resource-group rg-saat-vms --name win01 --command-id RunPowerShellScript --scripts 'cscript //nologo C:\Windows\System32\slmgr.vbs /ato; cscript //nologo C:\Windows\System32\slmgr.vbs /dli | Select-String License' --query "value[0].message" -o tsv

You should see something like this:

Activating Windows(R), ServerDatacenterAzureEdition edition (...) ...
Product activated successfully.

License Status: Licensed

KMS activation lasts 180 days and renews itself every 7 days when the server can reach KMS. Later lessons give snet-mgmt a permanent outbound path; for now, remove the temporary NAT Gateway.

Clean up and deallocate win01:

az network vnet subnet update --ids $v.'snet-mgmt' --remove natGateway -o none
az group delete --name rg-saat-l16 --yes
az vm deallocate --resource-group rg-saat-vms --name win01
C:\azure-lab\Find-LabResources.ps1 -Lesson 16

You should see this at the end (win01 and its disk and NIC stay, tagged lesson=16 and keep=true):

Resources:

name                          type                                     group       lesson
----                          ----                                     -----       ------
win01                         Microsoft.Compute/virtualMachines        rg-saat-vms 16
win01_OsDisk_1_...            Microsoft.Compute/disks                  RG-SAAT-VMS 16
win01VMNic                    Microsoft.Network/networkInterfaces      rg-saat-vms 16
shutdown-computevm-win01      microsoft.devtestlab/schedules           rg-saat-vms 16

✅ Checkpoint: win01 shows “Product activated successfully”, the temporary NAT Gateway is gone, and win01 is deallocated.