A RetroSearch Logo

Home - News ( United States | United Kingdom | Italy | Germany ) - Football scores

Search Query:

Showing content from http://cloud.google.com/compute/docs/instances/windows/creating-managing-windows-instances below:

Create and manage Windows Server VMs | Compute Engine Documentation

Skip to main content Create and manage Windows Server VMs

Stay organized with collections Save and categorize content based on your preferences.

Windows

Compute Engine provides public images with Windows Server that you can use to create instances. For instructions on how to create a Windows Server instance with SQL Server preinstalled, see Creating SQL Server instances.

For more general information about Windows Server instances and Windows applications that you can run on Compute Engine, see Windows on Compute Engine.

Pricing Before you begin Create a Windows Server instance

To create an instance with Windows Server, specify the image family for the specific version of Windows that you need. Compute Engine offers several versions of Windows Server, most of which are available as Shielded VM images. Shielded VM images offer security features like UEFI-compliant firmware, Secure Boot, and vTPM-protected Measured Boot. For a list of the available image families, see public images.

If you need more than two concurrent remote desktop sessions, you will need to purchase Remote Desktop Session (RDS) Client Access Licenses (CALs). For more information, see License your RDS deployment with client access licenses (CALs).

Note: All Windows Server instances must be able to communicate with kms.windows.googlecloud.com (35.190.247.13/32 or 2001:4860:4802:32::86/128) to activate its license. Review configuring access to kms.windows.googlecloud.com to ensure your VPC network allows access to the activation server before you create your first Windows instance. Work with Microsoft Active Directory

If you plan on using Microsoft Active Directory (AD) with your new instance, make sure the instance name is no longer than 15 characters, to meet the stated maximum name length restrictions of the system.

AD uses the NetBIOS names of machines, which are generated as the instance name truncated to 15 characters. As a result, you might encounter the following error when trying to sign in as a domain user: The Security Database on the Server does not have a Computer Account for this Workstation Trust Relationship.

Create a Windows Server instance that uses an external IP to activate

This section describes how to create a Windows Server instance that has an external IP address. Your VPC network must be configured to allow access to kms.windows.googlecloud.com.

Console

To create a basic Windows VM:

  1. In the Google Cloud console, go to the Create an instance page.

    Go to Create an instance

  2. For Boot disk, select Change, and do the following:

    1. On the Public images tab, choose a Windows Server operating system.
    2. Click Select.

  3. To create the VM, click Create.

To create a Shielded VM Windows instance, do the following:

  1. In the Google Cloud console, go to the Create an instance page.

    Go to Create an instance

  2. For Boot disk, select Change, and do the following:

    1. On the Public images tab, choose a Windows Server operating system.
    2. To save your boot disk configuration, click Select.

  3. Optionally, to change the VM's Shielded VM settings, expand the the Advanced options section. Then, do the following:

    1. Expand the Security section.
    2. If you want to turn off Secure Boot, clear the Turn on Secure Boot checkbox. Secure Boot helps protect your VM instances against boot-level and kernel-level malware and rootkits. For more information, see Secure Boot.

    3. If you want to turn off the virtual trusted platform module (vTPM), clear the Turn on vTPM checkbox. The vTPM enables Measured Boot, which validates the VM pre-boot and boot integrity. For more information, see Virtual Trusted Platform Module (vTPM).

      Important: Disabling the vTPM also disables integrity monitoring, because integrity monitoring relies on data gathered by Measured Boot.

    4. If you want to turn off integrity monitoring, clear the Turn on Integrity Monitoring checkbox. Integrity monitoring lets you monitor the boot integrity of your Shielded VM VMs using Cloud Monitoring. For more information, see Integrity monitoring.

  4. To create the VM, click Create.

gcloud

Use the compute images list command to see a list of available Windows Server images:

gcloud compute images list --project windows-cloud --no-standard-images

To determine whether an image supports Shielded VM features, run the following command, and check for UEFI_COMPATIBLE in the output:

gcloud compute images describe IMAGE_NAME --project windows-cloud

Replace IMAGE_NAME with the name of the image to check for support of Shielded VM features.

Use the compute instances create command to create a new instance and specify the image family for one of the Windows Server public images.

gcloud compute instances create INSTANCE_NAME \
    --image-project windows-cloud \
    --image-family IMAGE_FAMILY \
    --machine-type MACHINE_TYPE \
    --boot-disk-size BOOT_DISK_SIZE \
    --boot-disk-type BOOT_DISK_TYPE

Replace the following:

If you chose an image that supports Shielded VM, you can optionally change the instance's Shielded VM settings using one of the following flags:

The following example creates a Windows 2022 Shielded VM instance with Secure Boot disabled:

gcloud compute instances create my-instance \
    --image-family windows-2022 --image-project windows-cloud \
    --no-shielded-secure-boot
Go Java Node.js Python REST

To create an instance with the API, include the initializeParams property in your instance creation request and specify a Windows image. For example, your request body might look like the following:

instance = {
  "name": "INSTANCE_NAME",
  "machineType": "zones/ZONE/machineTypes/MACHINE_TYPE",
  "disks": [{
      "boot": "true",
      "type": "PERSISTENT",
      "initializeParams": {
         "diskName": "DISK_NAME",
         "sourceImage": "https://www.googleapis.com/compute/v1/projects/windows-cloud/global/images/family/IMAGE_FAMILY",
         "diskSizeGb": "BOOT_DISK_SIZE",
         "diskType": "BOOT_DISK_TYPE",
       }
    }],
  "networkInterfaces": [{
    "accessConfigs": [{
      "type": "ONE_TO_ONE_NAT",
      "name": "External NAT"
     }],
    "network": "global/networks/default"
  }],
  "serviceAccounts": [{
       "email": DEFAULT_SERVICE_EMAIL,
       "scopes": DEFAULT_SCOPES
  }]
}

Replace the following placeholders with valid values:

If you chose an image that supports Shielded VM, you can optionally change the instance's Shielded VM settings by using the following boolean request body items:

For more information about creating an instance, read the instances.insert() method documentation.

After you create your Windows or SQL Server instance, set the initial password for the instance so that you can connect to the instance through RDP.

Additionally, you can join the VM to a Managed Microsoft AD domain either while creating the VM or after creating the VM. For more information, see Join a Windows VM automatically to a domain).

Create a Windows Server instance that uses an internal IP address to activate

Before you can create a Windows Server instance that has only an internal IP address, you must verify or configure routes and firewall rules in your VPC network to allow access to kms.windows.googlecloud.com. Additionally, you must enable Private Google Access for subnets in your VPC network that contain Windows instances with only internal IP addresses.

gcloud

When you create a new instance by using the gcloud CLI, you can use the --no-address flag to ensure that it is not assigned an external IP address:

gcloud compute instances create INSTANCE_NAME --network NETWORK_NAME \
 --subnet SUBNET_NAME \
 --no-address \
 --zone ZONE \
 --image-project windows-cloud \
 --image-family IMAGE_FAMILY \
 --machine-type MACHINE_TYPE \
 --boot-disk-size BOOT_DISK_SIZE \
 --boot-disk-type BOOT_DISK_TYPE

Replace the following placeholders with valid values:

Go Java Node.js Python

Because this instance does not have an external IP address, you cannot connect to it directly over the Internet. You can connect from another network connected to your VPC network by using Cloud Interconnect or Cloud VPN, or you can first connect to a bastion instance over RDP and then connect to the instance that has only an internal IP address.

Additionally, you can join the VM to a Managed Microsoft AD domain either while creating the VM or after creating the VM. For more information, see Join a Windows VM automatically to a domain.

Configure access to kms.windows.googlecloud.com

For Windows activation and renewal, your VPC network must meet the following routing and firewall rule requirements.

Routing requirements

Your Windows instances must be able to reach kms.windows.googlecloud.com (35.190.247.13 or 2001:4860:4802:32::86) through a route whose next hop is the default Internet gateway. You cannot activate Windows instances using an instance based NAT gateway or Cloud NAT because kms.windows.googlecloud.com rejects activation requests from IP addresses that are not confirmed to be Compute Engine instances.

You can use the default route in your VPC network to route traffic directly to kms.windows.googlecloud.com. If you remove this route, or if you plan to do so in the future, create a custom static route with destination 35.190.247.13 or 2001:4860:4802:32::86, and next hop set to default Internet gateway, as follows:

IPv4 only 
gcloud compute routes create mskms-ipv4-route-ipv4-network \
    --destination-range=35.190.247.13/32 \
    --network=ipv4-network \
    --next-hop-gateway=default-internet-gateway
Dual stack 
gcloud compute routes create mskms-ipv4-route-ipv4-network \
    --destination-range=35.190.247.13/32 \
    --network=ipv4-network \
    --next-hop-gateway=default-internet-gateway

gcloud compute routes create mskms-ipv6-route-ipv6-network \
    --destination-range=2001:4860:4802:32::86/128 \
    --network=ipv6-network \
    --next-hop-gateway=default-internet-gateway
IPv6 only 
gcloud compute routes create mskms-ipv6-route-ipv6-network \
    --destination-range=2001:4860:4802:32::86/128 \
    --network=ipv6-network \
    --next-hop-gateway=default-internet-gateway

Replace ipv4-network or ipv6-network with the name of your VPC network.

Either the default route or a custom static route permit instances with external IP addresses to reach kms.windows.googlecloud.com. If you have Windows instances without external IP addresses or using Cloud NAT, you must also enable Private Google Access so that instances with only internal IP addresses can send traffic to the external IP address for kms.windows.googlecloud.com (35.190.247.13 or 2001:4860:4802:32::86).

Firewall rule requirements

The implied allow egress firewall rule allows instances to make requests and receive established responses. Unless you have created custom firewall rules that deny egress, your Windows instances can communicate with kms.windows.googlecloud.com.

If you customize firewall rules, it's a good practice to create a high priority egress allow rule that explicitly permits communication with 35.190.247.13 or 2001:4860:4802:32::86. This way, as you modify your firewall rules, you won't accidentally disable Windows activation.

The following gcloud examples creates the recommended allow egress rule with the highest priority:

IPv4 only 
gcloud compute firewall-rules create mskms-ipv4-firewall-rule-ipv4-network \
    --direction=EGRESS \
    --network=ipv4-network \
    --action=ALLOW \
    --rules=tcp:1688 \
    --destination-ranges=35.190.247.13/32 \
    --priority=0
Dual stack 
gcloud compute firewall-rules create mskms-ipv4-firewall-rule-ipv4-network \
    --direction=EGRESS \
    --network=ipv4-network \
    --action=ALLOW \
    --rules=tcp:1688 \
    --destination-ranges=35.190.247.13/32 \
    --priority=0

gcloud compute firewall-rules create mskms-ipv6-firewall-rule-ipv6-network \
    --direction=EGRESS \
    --network=ipv6-network \
    --action=ALLOW \
    --rules=tcp:1688 \
    --destination-ranges=2001:4860:4802:32::86/128 \
    --priority=0
IPv6 only 
gcloud compute firewall-rules create mskms-ipv6-firewall-rule-ipv6-network \
    --direction=EGRESS \
    --network=ipv6-network \
    --action=ALLOW \
    --rules=tcp:1688 \
    --destination-ranges=2001:4860:4802:32::86/128 \
    --priority=0

Replace ipv4-network or ipv6-network with the name of your VPC network.

Verifying that an instance has successfully started

Windows instances experience a longer startup time because of the sysprep process. The Google Cloud console might show that the instance is running even if the sysprep process is not yet complete. To check if your instance has successfully started and is ready to be used, check the serial port output with the following command:

gcloud compute instances get-serial-port-output INSTANCE_NAME

Replace INSTANCE_NAME with the name of the instance that you want to verify.

...[snip]...
Running schtasks with arguments /run /tn GCEStartup
-->  SUCCESS: Attempted to run the scheduled task "GCEStartup".
-------------------------------------------------------------
Instance setup finished. INSTANCE_NAME is ready to use.
-------------------------------------------------------------
Enabling and disabling Windows instance features

If you have Windows instances with image versions v20170509 and later or with agent version 4.1.0 and later, you can set instance configuration in a config file or in project or instance custom metadata. The config file is in INI format, and is located at the following path:

C:\Program Files\Google\Compute Engine\instance_configs.cfg

The system overrides configuration settings in the following order of priority from the highest priority to the lowest priority:

  1. Configuration parameters that you set in the config file
  2. Configuration parameters set in instance-level custom metadata
  3. Configuration parameters set in project-level custom metadata

For example, if you can enable the accountManager feature in a config file, your instance ignores parameters that you set in custom metadata to disable that feature.

One benefit of setting these parameters in the config file is that those settings persist when you create a custom image for a Windows Server instance. Instance-level custom metadata does not persist beyond the life of the instance.

You can disable different Windows instance features using the following examples.

Disable the account manager

Disabling the account manager also disables resetting passwords with the Google Cloud CLI or the Google Cloud console:

Disable the address manager Windows Server Failover Clustering

Enable the Windows Server Failover Clustering agent:

Using multiple internal load balancers

Specify the IP address of the internal load balancing instance for failover clustering. This is an advanced configuration that you don't need to set for a dedicated failover cluster.

Normally you use an instance of internal load balancing to direct network traffic to one VM instance at a time. If you add a second instance of internal load balancing that uses the failover clustering VM instances as part of a load-balanced website backend, you would have two internal load balancing IP addresses. If failover clustering uses 10.0.0.10 and the website's load balancer uses 10.0.0.11, you must specify the IP address of the load balancer that you use for failover clustering. This disambiguates which address is in use for the cluster.

Changing the clustering agent port

Set the failover clustering agent port. The default port is 59998. You need to specify a port only when you want to use a different port:

Image version notes

Older images don't use a config file and only have a subset of features. Image versions between version v20160112 and version v20170509, or Windows agent version between 3.2.1.0 and 4.0.0 require you to use the following custom metadata values:

What's next

Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2025-08-07 UTC.

[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-07 UTC."],[[["Compute Engine offers public images with Windows Server for creating instances, including options for SQL Server preinstallation and more information on Windows applications."],["Windows Server images are premium and incur additional charges, and they are not part of the Google Cloud Free Tier."],["Before starting, ensure billing is enabled for your project and set up authentication using the Google Cloud CLI or the Google Cloud console, and the process can vary depending on whether you are using console, gcloud, or a local development environment with Go, Java, Node.js, Python, or REST."],["Creating a Windows Server instance involves specifying the image family for your desired version, with options for Shielded VM images offering enhanced security, and if more than two remote desktop sessions are needed, Remote Desktop Session (RDS) Client Access Licenses (CALs) must be purchased."],["For Windows activation and renewal, VPC network must have specific routing and firewall rule configurations, and access to `kms.windows.googlecloud.com` is mandatory; additionally, instances with only internal IP addresses require Private Google Access to be enabled."]]],[]]

RetroSearch is an open source project built by @garambo | Open a GitHub Issue

Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo

HTML: 3.2 | Encoding: UTF-8 | Version: 0.7.4