Windows Guest Initialization &
Database Migration

Manual Setup vs. Endrias Bridge Automated Init

Architecture Diagram

Prerequisites

Required Firewall / Security Group Ports

First-Boot Trigger Methods

<powershell>
# Option A: run the script directly from S3
$url = "https://your-bucket.s3.amazonaws.com/Endrias Bridge_FirstBoot_Setup.ps1"
Invoke-WebRequest -Uri $url -OutFile "C:\Endrias Bridge_FirstBoot_Setup.ps1"
powershell.exe -ExecutionPolicy Bypass -File "C:\Endrias Bridge_FirstBoot_Setup.ps1"
</powershell>

{
  "type": "Microsoft.Compute/virtualMachines/extensions",
  "name": "Endrias BridgeInit",
  "properties": {
    "publisher": "Microsoft.Compute",
    "type": "CustomScriptExtension",
    "typeHandlerVersion": "1.10",
    "settings": {
      "fileUris": ["https://yourstorage.blob.core.windows.net/scripts/Endrias Bridge_FirstBoot_Setup.ps1"],
      "commandToExecute": "powershell.exe -ExecutionPolicy Bypass -File Endrias Bridge_FirstBoot_Setup.ps1"
    }
  }
}

:: SetupComplete.cmd
powershell.exe -ExecutionPolicy Bypass -File "C:\Endrias Bridge\Endrias Bridge_FirstBoot_Setup.ps1" -HeadlessMode $true

$action  = New-ScheduledTaskAction -Execute "powershell.exe" `
    -Argument "-ExecutionPolicy Bypass -File C:\Endrias Bridge\Endrias Bridge_FirstBoot_Setup.ps1"
$trigger = New-ScheduledTaskTrigger -AtStartup
$settings = New-ScheduledTaskSettingsSet -RunOnlyIfNetworkAvailable
Register-ScheduledTask -TaskName "Endrias BridgeInit" -Action $action `
    -Trigger $trigger -Settings $settings -RunLevel Highest -User "SYSTEM"

10 Plugin Phases — Detail

Migration Config Reference

{
  "source": {
    "db_type":   "SQL Server 2019",
    "host":      "sqlserver01.corp.yourcompany.com",
    "port":      1433,
    "database":  "Enterprise_Prod",
    "username":  "migration_reader",
    "password":  "READ_FROM_SECRETS_MANAGER"
  },
  "target": {
    "db_type":   "Azure SQL Database",
    "host":      "prod.database.windows.net",
    "port":      1433,
    "database":  "Enterprise_Migrated",
    "username":  "migration_writer",
    "password":  "READ_FROM_SECRETS_MANAGER"
  },
  "tables":          [],
  "sync_mode":       "full",
  "do_schema":       true,
  "do_data":         true,
  "migration_path":  "SQL Server 2019 → Azure SQL Database"
}

Example: SQL Server 2019 → AWS RDS for PostgreSQL

{
  "source": { "db_type": "SQL Server 2019", "host": "10.0.1.50", "port": 1433,
              "database": "SalesDB", "username": "sa_readonly", "password": "..." },
  "target": { "db_type": "AWS RDS for PostgreSQL", "host": "sales.abc123.us-east-1.rds.amazonaws.com",
              "port": 5432, "database": "salesdb_pg", "username": "pgadmin", "password": "..." },
  "tables": [], "sync_mode": "full", "do_schema": true, "do_data": true
}

Example: Azure SQL Database → AWS RDS for SQL Server (Reverse)

{
  "source": { "db_type": "Azure SQL Database", "host": "he-source.database.windows.net", "port": 1433,
              "database": "HE_Azure", "username": "reader", "password": "..." },
  "target": { "db_type": "AWS RDS for SQL Server", "host": "he-rds.xyz.us-west-2.rds.amazonaws.com",
              "port": 1433, "database": "HE_RDS", "username": "admin", "password": "..." },
  "sync_mode": "full", "do_schema": true, "do_data": true
}

Running Headless Migration

python -m migrationbridge.headless `
    --config  "C:\Endrias Bridge\migration_config.json" `
    --log     "C:\Endrias Bridge\Logs\migration_run.log" `
    --tables  "" `
    --mode    full

Exit Codes

Post-Migration Validation

init_summary.json

{
  "timestamp":        "2026-06-13T08:32:11Z",
  "platform":         "AWS",
  "instance_id":      "i-0abc123456789def0",
  "region":           "us-east-1",
  "python_version":   "3.11.9",
  "odbc_driver":      "ODBC Driver 18 for SQL Server",
  "migration_status": "SUCCESS",
  "tables_migrated":  42,
  "rows_copied":      18473921,
  "log_file":         "C:\\Endrias Bridge\\Logs\\migration_run.log"
}

Manual Validation Queries (T-SQL on Target)

-- Row count spot check
SELECT TABLE_SCHEMA, TABLE_NAME,
       SUM(p.rows) AS row_count
FROM   INFORMATION_SCHEMA.TABLES t
JOIN   sys.partitions p ON OBJECT_ID(t.TABLE_SCHEMA+'.'+t.TABLE_NAME) = p.object_id
WHERE  TABLE_TYPE = 'BASE TABLE' AND p.index_id IN (0,1)
GROUP  BY TABLE_SCHEMA, TABLE_NAME
ORDER  BY row_count DESC;

-- Constraint count check
SELECT TABLE_NAME,
       SUM(CASE WHEN CONSTRAINT_TYPE='PRIMARY KEY' THEN 1 ELSE 0 END) AS pk,
       SUM(CASE WHEN CONSTRAINT_TYPE='UNIQUE'      THEN 1 ELSE 0 END) AS uq,
       SUM(CASE WHEN CONSTRAINT_TYPE='FOREIGN KEY' THEN 1 ELSE 0 END) AS fk,
       SUM(CASE WHEN CONSTRAINT_TYPE='CHECK'       THEN 1 ELSE 0 END) AS ck
FROM   INFORMATION_SCHEMA.TABLE_CONSTRAINTS
GROUP  BY TABLE_NAME
ORDER  BY TABLE_NAME;

AWS EC2 — Specific Notes

• Place migration_config.json in S3 and reference it in user-data — never embed DB passwords in user-data
• Use VPC endpoints for S3 and Secrets Manager to avoid internet traversal
• RDS security group must allow inbound TCP 1433/5432/3306 from the EC2 instance security group
• Enable Multi-AZ on RDS before migration — do not migrate to a single-AZ instance in production
• Use IMDSv2 (script already uses token-based IMDS calls)

Azure VM — Specific Notes

• NSG rule: outbound TCP 1433 to Azure SQL Database service tag
• Azure SQL Database firewall: add the VM's public IP or use Private Endpoint + VNet integration
• Custom data field is base64-encoded — the script auto-decodes and parses JSON
• Use az vm run-command invoke to re-run the init script remotely if needed

On-Premises — Specific Notes

• Place Endrias Bridge_FirstBoot_Setup.ps1 and migration_config.json in C:\Endrias Bridge\ before Sysprep
• Windows Firewall: allow outbound 1433 to source SQL Server; allow outbound 5432/3306 if migrating to PostgreSQL/MySQL
• Run Set-ExecutionPolicy RemoteSigned -Force before first boot or pass -ExecutionPolicy Bypass in the trigger command
• For domain-joined machines, ensure the computer account has DNS registration rights post-rename

Security & Least Privilege

Retrieve from AWS Secrets Manager (PowerShell)

$secret = aws secretsmanager get-secret-value --secret-id "prod/migrationbridge/source-db" `
          --query SecretString --output text | ConvertFrom-Json
$sourcePassword = $secret.password

Service Account Minimum Permissions

Troubleshooting

Appendix — Quick Reference

All File Paths Used

Environment Variable Overrides

Official Download URLs