Robert Larson

Dealing with VMs, Snapshots and the dreaded broken security channel

RobLarso — Wed, 11 Nov 2009 04:49:41 GMT

I build a lot of scenarios for testing using Hyper-V. During that testing I use snapshots all the time to protect myself from stupid mistakes and failed changes. It is a terrific capability, but can sometimes get you in trouble.

In a perfect world, when you are working on a testing scenario that includes a DC and multiple members of the domain, when you need to snapshot one of the machines in the test scenario, you would snapshot all of the VMs in the test scenario and you would do it at the exact same instant in time. This means that all the VMs would be saved in an ideal configuration.

The problem with that perfect world is that you might want to snapshot a single machine to perform a what-if test and then be able to roll back if the idea is a bust. But if you do not snapshot all the VMs at the same instance, you run the risk of one of the machines changing it’s secure channel password during the what-if period. When you revert the changes during that session and you attempt to login, you will get an error message saying that the trust relationship with the domain controller is broken. You only option is to remove and re-add the machine to the domain.

There is a solution to this problem. You can disable the computer account from changing its secure channel password or you can change the password change window to something longer than the default 30 days. Doing so will eliminate the issue of not being able to login. Now would you want to do this in a production environment, not without fully understanding the changes and the security risks.

To make the change, open up your favorite GPO editor and go to

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\

Enable the Domain Member: Disable machine account password changes option

Edit the Domain Member: Maximum machine account password age option and increase the value from the default of 30 days to a new larger value (up to a maximum of 999 days)

Doing either of these options should keep you from getting the dreadful message that the secure channel is broken.

Hope this helps you some day…..Robert

Cool New Gateway Netbook

RobLarso — Sat, 25 Jul 2009 19:58:21 GMT

Since Windows 7 RTMd, I figured I needed a new toy to play with. I run Windows Server 2008 R2 on my high end notebook, but wanted to run Windows 7 so I could get some of the great new features.

I have been researching netbooks for a few weeks and had decided that I wanted something with at least a 11” screen. I looked at all the usual suspects Acer, Lenovo, Dell, etc… and then I cam across one that struck my eye, a Gateway LT3114U netbook from BestBuy.

(Note that if you want the Cherry Red model you can only seem to buy it online, but you can walk into a BestBuy and buy the black model….I found this out the hard way and had to wait two extra days for my machine while a coworker rubbed it in with his.)

For those who do not know, Acer bought Gateway. This netbook is a slightly redesigned version of the Acer Aspire One 11.6” model. The Gateway version comes with an 11.6” screen 2GB RAM, 250 GB 5400 RPM hard drive, 6 Cell battery, and Vista Basic. This version if the netbook is based on a AMD Athlon 64-bit processor for netbooks. So you can actually install a 64-bit OS.

I have been playing with the configuration and have done the following:

- swapped the 5400 RPM drive for a 7200 RPM drive

- swapped the 2GB RAM module for a 4GB RAM module (Yes it will take a 4GB module)

- swapped the Vista Basic for Windows 7 Ultimate x64

The cool and completely unexpected swap was the RAM upgrade. The specs said it only takes a 2GB module, but I had heard rumors at work that it would support a 4GB module, so I thought I would try it. In this configuration I get 3.75 GB of usable RAM (256 GB is for the shared video HyperMemory.

The 7200 RPM makes it run a little hotter, mainly because I took and older 100GB drive I had lying around to do the test. So one of the new generation 7200 RPM drive would probably solve that issue.

The Video performance is decent. I can watch hulu videos as normal resolution. At full screen they are slightly jumpy.

So far I have been pretty impressed by the performance under Windows 7. I am currently running under 2GB while I wait for an additional 4GB module.

Go check one out yourself…..

Q&A on AMD Rapid Virtualization Indexing (RVI)

RobLarso — Tue, 21 Jul 2009 01:58:56 GMT

My Hyper-V Resource Kit co-author, Janique Carbone, and Tim Mueting - AMD Product Manager have gotten together to produce a Q&A on AMD’s Rapid Virtualization Indexing (RVI) technology in the latest AMD Opteron processor line. Hyper-V R2 uses this technology to enable Second Level Address Translation (SLAT) to offload work from the hypervisor to hardware.

The entry also has links to additional information on RVI and other AMD technology. It is good reference and read.

Windows Server 2008 Hyper-V Resource Kit on the shelves June 10th

RobLarso — Tue, 02 Jun 2009 05:18:31 GMT

Well Janique and I finished another Resource Kit book, this time on Hyper-V…..700 plus pages of Hyper-V resources (including a chapter on Hyper-V R2 coming in Windows Server 2008 R2) is done and on the way to the book store near you!

You can find the official announcement from Microsoft Press here

Sample chapters are available on Janique’s web site using the links here:

Table of Contents

Chapter 2 (Hyper-V Overview)

Chapter 8 (Moving from Virtual Server 2005 R2 to Hyper-V)

Index

We hope you find the book informative and full of guidance and best practices to help you plan, deploy, and manage a single Hyper-V server to a large farm of Hyper-V servers.

Thanks to all of the Microsoft team that helped us write, review, edit, and publish this book.

Installing Windows Server 2008 R2 on a notebook and getting all those required drivers.

RobLarso — Sun, 03 May 2009 07:18:45 GMT

If you are like me, you use Windows Server 2008 R2 as your standard desktop/notebook OS. If you have installed Windows Server 2008 R2 on your notebook, you might notice that you ended up with a series of yellow bangs for missing device drivers. I found a workaround to get those drivers without have to manually go find them all from Windows Catalog. Try this….

1) Install Windows Server 2008 R2 on your notebook (I am using a Lenovo T61P), but leave about 20GB of free space available.

2) Install all the roles and features on your machine….here is what I have

- Hyper-V role
- Desktop Experience feature
- Wireless LAN
- Windows Server Backup

3) Run Windows update to get any driver updates….you will end up with multiple missing device drivers in Device Manager.

4) On that additional 20 GB partition, install Windows 7 x64 Enterprise or Ultimate

5) Run Windows update on the Windows 7 installation until all yellow bangs are resolved (this might take a couple of reboots)

6) Now reboot into the Windows Server 2008 R2 installation, open Device Manager

7) For each yellow bang, right click it and say Update Driver Software, when you get the dialog, select Browse my computer for driver software

8) In the dropdown box at the top of the screen, browse to the drive that has Windows 7 installed and go to Drive:\Windows\System32\DriverStore\FileRepository, Click Next

9) The new driver should be found and automatically installed.

10) Repeat for all other drivers.

When you are done, you should have Windows 7 x64 drivers installed (except for the Bluetooth driver probably)

Hope that helps you fellow Windows Server 2008 R2 users….

Hyper-V Resource Kit

RobLarso — Mon, 20 Apr 2009 17:41:17 GMT

Well we have finally finished all the chapters of the Hyper-V Resource Kit. We are in final editing stage, but there is light at the end of the tunnel. Be looking for it on the shelves within the next 60 days.

Here is a preview of the TOC.

Introduction to Virtualization
Overview
Architecture
Installation and Deployment
Advanced Features
Security
Best Practices and Optimization
Moving from Virtual Server 2005 R2 to Hyper-V
Hyper-V R2
Management Overview
Single Server Management
Server Farm Management Using SCVMM
Backup and Recovery
Server Migration using SCVMM
Server Monitoring using SCOM
Management using PowerShell
Server Virtualization Scenarios
Virtualization Project – Envisioning
Virtualization Project – Discovery
Virtualization Project – Assessment
Virtualization Project – Planning and Design
Virtualization Project - Pilot

It is over 700 pages long…

For more information visit http://www.microsoft.com/learning/en/us/Books/11842.aspx

Beware of Integrated eSATA ports

RobLarso — Mon, 02 Mar 2009 06:28:32 GMT

For you demo warriors out there who try to get the maximum performance for your Hyper-V based demos, eSATA has been your path to maximum performance. If you only use a single drive attached to an eSATA port, you can quit reading, but if you are like me and want the best performance possible, you have probably invested in a 2.5” or 3.5” external portable cabinet that can take two or more drives.

These cabinets from makers like StarTech and AMS, have built in hardware RAID functionality that allow you to configure the dual drives in a RAID configuration without requiring a RAID card in your machine. Typically RAID 1 (mirroring) and RAID 0 (striping) are the two most common approaches in a dual drive case.

BUT, these external cases rely on a technology called Port Multiplication to see all the drives. You can go read the detailed description at your favorite web site, but basically port multiplication allows you to have multiple drives accessible through a single eSATA port. The catch is that the eSATA interface must support Port Multiplication.

This is where the issue is with integrated eSATA ports in laptops and desktop motherboards. They do not all support port multiplication…actually very few do.

I found this out the hard way recently. I purchased a new high end workstation class notebook that has an integrated eSATA port. the port I found out does not support port multiplication. If you attempt to connect an external case to the eSATA port and the drives are in RAID mode, the port will not be able to understand which drive it is talking to and the entire machine will slow to a crawl. Even if you attempt to configure the dual drives as JBOD, the ports will only see the 1st drive.

How do you deal with this issue? You use an ExpressCard with port multiplication support or use only a single drive case connected to the internal eSATA port.

Hope this saves you hours of headache…

Managing MAC Address Pools in Hyper-V R2

RobLarso — Tue, 17 Feb 2009 14:24:05 GMT

Hyper-V automatically creates a MAC address pool for virtual machines usage when it is installed. Hyper-V RTM had no option in the UI for managing the MAC address pool and you had to edit the registry to manage the pool (see a detailed article on that subject here).

Hyper-V R2 has provided the ability to manage the address pool directly in the Virtual Network Manager. To manage the global MAC address pool, open up Virtual Network Manager and select the MAC Address Range option under Global Network Settings. From here you can modify the MAC address pool available on the managed Hyper-V host.

Note that making this change does not fix any existing assigned MAC addresses from the original pool. Therefore if you need to change the MAC address used or modify the range of addresses, you should make this change prior to creating the first virtual machine.

If virtual machines have already been created, then you have two options to change the MAC address.

1) Modify the MAC address assignment to static and assign a static MAC address to the virtual network adapter.

2) Remove and re add the virtual network adapter in the virtual machine and a new dynamic MAC address from the pool will be assigned.

Hyper-V R2 and Management NICs

RobLarso — Wed, 11 Feb 2009 11:41:24 GMT

When you install Hyper-V R2 role now it reserves a single wired NIC in the machine for management of the parent partition. If you have only a single NIC in your server, you will not be able you select a NIC to create an external network when you are installing the role. This is a good thing because the installation is enforcing best practices.

Hyper-V R2 also has a new default when creating an External Virtual Network. By default the new external virtual network is not exposed to the parent partition for it to share. In order to enable the parent partition to share the NIC, there is a new checkbox that you must enable under the physical NIC dropdown box (as you can see in the picture below).

If your machine only has a single NIC, you can create an external virtual network and check this box. This will allow the virtual machines and the parent partition to share the single NIC.

NOTE: Doing this will violate best practices for a Hyper-V install. It is recommended to add an additional NIC to the server instead.

If you are running Hyper-V R2 on a notebook, another option is to use and ExpressCard Ethernet adapter or an USB-to-Ethernet adapter to add an additional NIC that can be seen by Hyper-V. See this previous post for some USB-to-Ethernet adapters that have 64-bit drivers.

Installing Zune 3.1 on Windows Server 2008 x64

RobLarso — Fri, 21 Nov 2008 14:54:56 GMT

Ok you are probably wondering why you would ever need Zune software on your Windows Server 2008 x64 machine….well if you are like me, my primary machine is my notebook and I run Windows Server 2008 x64 so I can have Hyper-V.

Anyway, Microsoft released a new version of the Zune software the other day and I wanted to install the latest version on my machine. Good – there is a native 64-bit version of Zune. Bad - the Zune installer blocks on Windows Server 2008 x64.

So how do you get around this issue? You can extract the installation package and install by hand…..that gets around the installation block on OS version, but there is a catch, you MUST install as the local administrator. No you cannot install with an account that is a member of the local administrators group.

Here is the process

1) Download the Zune 3.1 package from here. It is a 300+ MB package

2) Open a command prompt and launch the downloaded package with the /x option to extract it versus launch the installation.

ZUNEPACKAGE31.exe /x

3) Specify a folder to extract to, I used C:\TEMP\ZUNE31 as the directory

4) Go to C:\TEMP\ZUNE31\x64\PACKAGES

5) Right Click the ZUNE_X64.MSI and select Install

6) Answer the questions and it will install

Now go enjoy the music!

Go to 8GB on your notebook for ~$350

RobLarso — Thu, 09 Oct 2008 06:38:00 GMT

Some vendors have started shipping DDR2-5300 memory that provides 667Mhz 4GB SODIMMs for you notebook. You will need a notebook that has a SantaRosa chipset to be able to access all 8GB and even then the BIOS has to support it.

I personally purchased 8GB G.Skill memory from newegg.com for $170 per chip. I have tested the memory in a Lenovo T61P and a Dell Latitude 830 with no issues. I did have an issue with a Dell Inspiron 1420. It does not recognize both 4GB chips when installed and does not finish the boot process. It does support a 4GB and a 2GB module for 6GB RAM.

So for about $350 you can upgrade your compatible notebook to 8GB RAM.

Hope this helps you run more VMs on your notebook. :-)

Installing Updates on Server Core

RobLarso — Sun, 27 Jul 2008 16:10:26 GMT

I love Windows Server 2008 installed with Server Core. It’s small footprint (although it could be even smaller), simplistic command line UI, and the boot speed. One thing I dislike (until recently) is installing updates on Server Core. Well I found a nice little sample script that works beautifully to check and install all available updates from the command line

http://msdn.microsoft.com/en-us/library/aa387102(VS.85).aspx

This is a VBScript that uses the built in Windows Update Agent (WUA) to check for all available updates, provide you a list, and allow you to select to download and install the updates on your machine.

This makes updating a Server Core image a breeze.

Enjoy.

Additional NIC for your Laptop and Hyper-V

RobLarso — Thu, 03 Jul 2008 15:44:19 GMT

If you are like me and use Windows Server 2008 and Hyper-V on your laptop, you have possibly found out that Hyper-V does not support wireless adapters. This is an issue with the Wireless spec no Hyper-V. You can use ICS or bridging to get it to work, but having a 2nd wired network adapter can be helpful in some situations.

What you need is a USB NIC that can be quickly added to your machine when you need it. I have been searching an have bought some adapters from local computer stores to find none that have x64 drivers.

Well another MS consultant told me about an adapter that his friend uses with Hyper-V. I bought one and found some drivers that work

These two adapters work with Vista x64 and Windows Server 2008 x64 if you use the Vista x64 drivers from the chipset manufacturer.

http://www.airlink101.com/products/agigausb.php - 1 Gb version (AS88718)

http://www.airlink101.com/products/asohousb.php - 100 Mb version (AS88772)

Use drivers from chipset mfgr http://www.asix.com.tw

TrendNet also makes a 10/100 USB adapter that has x64 Vista drivers.

http://trendnet.com/products/proddetail.asp?prod=150_TU2-ET100&cat=49

Their gigabit adapter might also have drivers, but I have not investigated it to find out.

So if you find yourself in need of another wired NIC on your notebook running x64, then you have options….doesn’t everyone do clustering on their notebooks :-)

BTW, Fry’s carries the 10/100Mb AirLink101 adapter and it is on sale right now for $2.99 in stores.

Getting UNDO functionality with Hyper-V Snapshots

RobLarso — Thu, 15 May 2008 10:54:40 GMT

Snapshots are not the same as UNDO disks in Virtual Server 2005…go here to read a previous post of mine to learn about how they work.

That said, you get UNDO like functionality using snapshots…..with maybe a little more work.

In Virtual Server, when you wanted to use UNDO, you powered down your VM and enabled UNDO on the Virtual hard disk tab. Then after you power on the VM, when you powered it off you will be asked if you want to Save, Commit, or Discard your changes. Selecting Save kept the changes separate, Commit merged them into the original VHD and then started the UNDO process over again, and Discard threw away the changes and started over again. All of this used Differencing disks in the background.

In Hyper-V, UNDO is not an available option on the virtual disk menu anymore, you now have snapshots. If you want the ability to protect your VHD from any changes getting merged you need to do this.

Before you first power on a VM (the same point you would have enabled UNDO in Virtual Server), take a snapshot and call it something like UNDO DISCARD. This just makes your VHD effectively read only and all changes are written to a working AVHD file.

Power on your VM and work away. When you want to effectively “Turn OFF and Discard” all changes, then apply/revert to the UNDO DISCARD snapshot and it is all gone…start a new test scenario. Just remember that if you made any changes to the VM settings, they are also discarded.

By default all changes are saved to the working file, so you need to do nothing to get the SAVE feature.

If you want a COMMIT capability and want it permanent like it is with Virtual Server, then that takes a little more work. Once you create the UNDO DISCARD snapshot, there is no way to merge any changes back to the original VHD through the snapshot UI.

You can do the following though to get the COMMIT functionality

Power down the VM
Find the working avhd file
Copy it to CHILD.VHD
Backup up your original VHD for protection
Use the Edit disk option in Hyper-V MMC to edit the new CHILD.VHD and select Merge for the action in the wizard
Select to Merge to the parent
Wait for the merge to complete
Apply the UNDO DISCARD Snapshot (which throws away all the changes which you just merged from the copy and creates a new working avhd file that is the child of the original VHD)
Power on the VM and work away

Once again remember that if you had made any changes to the VM settings, that applying the UNDO DISCARD snapshot would have thrown them away…..other than that have fun!!

Let me know if you have any issues...

Entering Product Keys into Virtual Machines

RobLarso — Tue, 13 May 2008 00:39:23 GMT

I create virtual machines every day. I have a set of product keys that I use from my MSDN subscription and I hate playing the visual copy typing game (ok I am a lousy typist). It turns out that I had overlooked a nice little feature in VMConnect that makes this VERY easy.

If you open up VMConnect console to a virtual machine, you will see an option on the menu called Clipboard. The first option is Type Clipboard Text. This nice little time saver allows you to highlight a string of text on the host and then have it pasted into the VM at the current cursor position.

To copy a product ID into a setup dialog, copy the product ID and the hyphens from a notepad file or other location on the host, place your cursor within the borders of the VM (or click inside the VM if you do not have integration components loaded), click into the product ID box, and press CTRL-V. The feature types the contents of the clipboard text.

Short, simple, easy to use.