# Azure Golden Images Deep Dive

Build two patched Windows Server 2025 golden images with Azure VM Image Builder, publish exact versions through Azure Compute Gallery to two regions, deploy a private Trusted Launch validation VM, roll forward to `2.0.0`, and perform an immutable rollback to `1.0.0`.

## Requirements

- PowerShell 7
- Azure CLI with the `az image builder` command group
- An Azure subscription where you can create resources, register providers, and create scoped role assignments
- At least four available regional vCPUs and `Standard_D2s_v5` availability in West Europe
- Allow 2.5–4 hours for two Windows Update image builds and replication

The tested defaults use West Europe for building and validation, North Europe for the replica, and three fixed workshop resource groups. Run `Preflight` first. It is read-only and refuses an unexpected existing workshop resource group.

## Quick start

```powershell
$subscriptionId = az account show --query id --output tsv

./Start-AzureGoldenImageWorkshop.ps1 `
  -SubscriptionId $subscriptionId `
  -Location westeurope `
  -ReplicaLocation northeurope `
  -Stage Preflight

./Start-AzureGoldenImageWorkshop.ps1 `
  -SubscriptionId $subscriptionId `
  -Stage All

./Get-AzureGoldenImageEvidence.ps1 `
  -SubscriptionId $subscriptionId
```

For workshops and screenshot capture, run each stage separately:

```text
Preflight → Foundation → Gallery → BuildV1 → DeployV1
          → BuildV2 → RolloutV2 → RollbackV1 → Validate
```

`BuildV1` and `BuildV2` can each take 45–90 minutes. The build timeout defaults to 180 minutes and gallery replication polling defaults to 90 minutes.

## What the lab creates

- `rg-golden-images-deepdive-we`
- `rg-golden-images-staging-v1-we`
- `rg-golden-images-staging-v2-we`
- one user-assigned Image Builder identity with Contributor scoped only to those groups
- gallery `galWorkshopzGoldenWe`
- image definition `win2025Golden`, Gen2 and `TrustedLaunchSupported`
- image templates for releases `1.0.0` and `2.0.0`
- one Standard_ZRS replica of each release in West Europe and North Europe
- a private VNet, private subnet, NSG, NIC, and private validation VM

The validation VM has no public IP and no inbound RDP rule. Run Command verifies the release marker, IIS health page, patch manifest, Trusted Launch, Secure Boot, and vTPM.

## Private and public data

Passwords, principal IDs, resource IDs, raw Image Builder output, and raw Run Command responses are stored only under:

```text
work/azure-golden-images-deep-dive
```

The downloadable bundle contains only sanitized evidence. Never add the runtime directory to the ZIP.

## Cleanup

After publication verification:

```powershell
./Remove-AzureGoldenImageWorkshop.ps1 `
  -SubscriptionId $subscriptionId `
  -Force
```

Cleanup verifies both workshop ownership tags, deletes only the three fixed workshop resource groups, and removes private runtime state. `Microsoft.VirtualMachineImages` is unregistered only when it was absent at preflight and no non-workshop image templates remain.

## Microsoft documentation

- [Azure VM Image Builder overview](https://learn.microsoft.com/en-us/azure/virtual-machines/image-builder-overview)
- [Azure Compute Gallery](https://learn.microsoft.com/en-us/azure/virtual-machines/azure-compute-gallery)
- [Trusted Launch for Azure VMs](https://learn.microsoft.com/en-us/azure/virtual-machines/trusted-launch)
- [VM Image Builder best practices](https://learn.microsoft.com/en-us/azure/virtual-machines/image-builder-best-practices)

