Access Azure Virtual Machines Using the Serial Console Recovery Tool

In this Ask the Admin, I’ll show you how to access an Azure Windows Server virtual machine using the serial console, independently of the OS and network.

 

 

One of the disadvantages of using virtual machines (VMs) in the Azure cloud has been that if something goes wrong, for instance, a Windows Firewall rule is configured that blocks RDP access or the Remote Desktop service is stopped, it might be impossible to regain access to the VM. Unlike an on-premises Hyper-V Server, you don’t have physical access to the Azure cloud fabric.

Microsoft recently launched a preview of the Serial Console Recovery Tool, which provides text-based console access to Linux and Windows Server VMs via the COM1 serial port. A connection to the COM port can be established regardless of the operating system state or if the VM loses network connectivity.

Using Serial Console Access

There are a couple of prerequisites that must be fulfilled before you can connect to a VM’s COM port. The VM must have boot diagnostics enabled and the account using the serial console must have Contributor role for the VM and the boot diagnostics storage account. Linux VMs have support for serial console access (SAC) enabled by default but Windows Server is a more complex story.

SAC has been included in all versions of Windows since Windows Server 2003 but it is disabled by default. Serial console access is enabled by default in new Windows Server VMs that are deployed using the Azure marketplace. If you want to use SAC with Windows Server VMs that were deployed before the SAC preview launched, you must manually enable SAC in Windows. To do this, log in to the server using RDP, open a command prompt with administrative privileges, and run the following two commands to modify the Boot Configuration Data (BCD).

bcdedit /ems {current} on 
bcdedit /emssettings EMSPORT:1 EMSBAUDRATE:115200

Once SAC is enabled in the VM, open the VM’s panel in the Azure management portal and select Serial console (Preview) under SUPPORT + TROUBLESHOOTING.

Before you can do anything with SAC, you’ll need to open a new command prompt channel. Type cmd at the SAC prompt to open a new channel to the command line. Make a note of the channel name. The first channel is usually called Cmd0001. Once the new channel is open, switch to it using the ch command:

ch -sn Cmd0001

Now provide a username and password that has local administrator access on the VM.

SAC gives the same access as you would get if you opened a command prompt in a Remote Desktop session. You can also launch PowerShell from the command line. Once you have access to the command line, just type powershell at the prompt and press ENTER.

Using the serial console to access Linux VMs doesn’t involve jumping through as many hoops. You just click Serial console (Preview) in the VM’s panel, wait a few seconds for the connection to be established, and then enter a root username and password.

Regardless of the server operating system you need to access, the serial console is a useful tool in the absence of physical access to the Hyper-V cluster. It can be painfully slow and while it does support copy and paste, the results of pasting text can be messy. But then SAC isn’t intended for regular use and it might just save your bacon if emergency access to a VM is required

For a complete guide to using SAC, see the documentation at Microsoft’s website here.

Follow Russell on Twitter @smithrussell.