War Room - notes from the field

Copy VHD / data files into a CSV Disk -w2k8 r2

Hugofe — Wed, 09 Jan 2013 10:07:27 GMT

Copy VHD / data files into a CSV Disk

We need to use the Coordinator Node

Remember that CSV is optimized for running VM's, so using other tools and mechanisms... such as doing local copies to and from CSV disks from the partent partition is a very poor way to evaluate the performance.

This is expected behavior. Understanding read-writes and what happens when you copy between non-owner nodes will help you out.

What I do is if I need to copy data between CSV's is move the CSV resources to the same node and then copy,

With Cluster Shared Volumes (CSV) one of the nodes in the cluster is responsible for synchronization of access to files on a shared volume. This is the node which currently owns the cluster ‘Physical Disk’ resource associated with that LUN, which is referred to as the Coordinator node. Each LUN can have its own coordinator and all nodes are equal and could be a coordinator, so it could be any node. When a VM is deployed and running on a CSV volume almost all of Hyper-V’s access to VHD files associated with a VM go directly to the disk and the coordinator node is not involved. This enables VMs to have fast direct access and give great performance for the VM and the applications running within the VM. So it really doesn’t matter which node is the coordinator or where VM’s are running.

With Windows Server 2008 R2 one exception to that happens when you are copying VHD files to CSV volumes as you create and deploy your VMs. As you copy/create the VHD files to a CSV volume, those writes to the disk are extending write operations, and, as a result, they are redirected over the network to the coordinator node. This can result in it taking longer to copy the file. The moral of the story is that when you are going to do a file copy to a CSV volume, to get the greatest performance it is best to do the copy on the coordinator node if you are doing a local copy. If you are doing a remote copy over the network, it’s best to have the coordinator node be the target of the copy. You can view the current owner or even move ownership of Physical Disk resources from one node to another with the Failover Cluster manager snap-in (CluAdmin.msc) or PowerShell. So you can make whatever node you are on the coordinator.

Note: With Windows Server 2012 an extending write operation will be done with direct I/O, and these considerations do not apply.

On that node, the writes are all local writes because it is the coordinator itself.

From the other node, the writes are actually redirected over the network to Node1 (because they are extending writes to the file).

So, what does that really mean?

The bottom line here is that if you’re trying to make copies of files to CSV and you want to get this copy to complete in the fastest possible time, make sure you do the copy on the coordinator node.

Best practices for migration of cluster windows 2008 R2 / 2012 - As melhores Praticas para migrar um Cluster de Windows 2008 para Windows 2012

Hugofe — Thu, 06 Dec 2012 09:13:50 GMT

This one is based on a collection of several information available,

Windows Svr 2012 - best practices for migration of cluster win2008 R2 with the role of HyperV available to win 2012 with the role of HyperV

Currently, has a cluster of 4 nodes with win 2008 R2 and the role of HyperV available and needs to know steps to migrate this cluster to win2012 with HyperV.

From a OS perspective we can migrate from w2k8 r2 to w2k12,

however from a feature perspective there is not a migration of the cluster from one version to the other,

So based on this the best option would be to around moving the resources to a group of 2 nodes (w2k8r2) and then build a separated cluster with w2k12,

After this we can migrate from w2k8 to w2k12

After the migration ends we can add the remaining w2k8 r2 nodes to the w2k12 cluster and therefore continue to have a 4 node cluster

· Is there a way to migrate a cluster partially.?

1. evict two of the nodes from the old Cluster.

2. Rebuild them from scratch along with the new machine with Server 2012.

3. Add Hyper-V and Cluster roles and create a new Cluster to the new ones.

4. Run the Cluster Migration Wizard to migrate all the VMs from the old to the new.

5. Destroy the old Cluster.

6. Rebuild the old nodes with Server 2012 and join them to the new Cluster.

How to Move Highly Available (Clustered) VMs to Windows Server 2012 with the Cluster Migration Wizard

The Windows Server 2012 Cluster Migration Wizard is a powerful and time-saving tool that copies cluster roles from a source cluster to a target cluster.

Although the Cluster Migration Wizard can move almost any clustered workload to Windows Server 2012, we get many questions about migrating highly available virtual machines (HA VMs).

There are two ways that you will be able to move HA VMs to a Windows Server 2012 Failover Cluster:

1. Windows Server 2012 Cluster Migration Wizard integrated into the Failover Clustering feature

2. System Center Virtual Machine Manager 2012 (SCVMM 2012) with Service Pack 1

Depending on what operating system version you are running today, there are some considerations:

Tool	Migrate Clustered VMs	Migrate Clustered VMs from Windows Server 2008 R2 SP1 to Window Server 2012	Move Clustered VMs from Windows Server 2008 SP2 to Windows Server 2012
Windows Server 2012 Failover Clustering Cluster Migration Wizard	Yes	Yes	Yes
System Center Virtual Machine Manager 2012 (SCVMM 2012)	Yes	Yes	No

Note: Live Migration of virtual machines (VMs) from Windows Server 2008 R2 to Windows Server 2012 is not supported.

As a result, migrating VMs to Windows Server 2012 can be fast, but it is not a zero-downtime event - a brief maintenance window is required to cut over to the new cluster roles.

Fortunately, cluster migration can be tested with no impact to a running cluster, so that issues can be identified prior to actual migration.

Windows Server 2012 Cluster Migration Wizard Source and Target OS Versions

The Windows Server 2012 Cluster Migration Wizard will move VMs from the following Windows Server OS versions:

Source Cluster Node OS	Target Cluster Node OS
Windows Server 2008 SP2	Windows Server 2012
Windows Server 2008 R2 SP1	Windows Server 2012
Windows Server 2012	Windows Server 2012

Note: The Windows Server 2012 Cluster Migration Wizard requires that the latest service packs be installed on the source clusters. Windows Server 2008 clusters are required to be upgraded to Service Pack 2 prior to migration. Windows Server 2008 R2 clusters are required to be upgraded to Service Pack 1 prior to migration.

Migration for Highly Available (Clustered) Hyper-V VMs

The following steps are required to prepare a new (target) cluster for the Cluster Migration Wizard – it may typically take approximately two hours to prepare a new Windows Server 2012 cluster with a small number of nodes. Here is an overview of the process:

1. The new (target) cluster nodes need to be physically configured (network, storage) – or in the case of cluster virtualization, the virtual network and storage settings of the VMs need to be configured. Ideally, both the old (source) cluster and the new (target) cluster will see common shared storage– storage can be reused and this will allow for the smoothest migration

2. Windows Server 2012 needs to be installed on all of the nodes in the cluster target cluster, and the Hyper-V Server Role and Failover Clustering feature should be installed on all nodes as well.

3. Create the new Windows Server 2012 target cluster using the Failover Cluster Manager or the New-Cluster PowerShell cmdlet.

4. Launch the Cluster Migration Wizard from the Failover Cluster Manager, select the source cluster, and then select the cluster roles on the source cluster that you’d like to migrate to the new cluster.

5. The Pre-Migration Report will identify issues that can impact migration of the selected cluster roles. After migrating, a Post-Migration Report will identify any manual steps that are needed to bring the cluster online.

6. The new cluster roles are always created offline - when VMs and users are ready, the following steps should be used during a maintenance window:

i. The source VMs should be shut down and turned off.

ii. The source cluster CSV volumes that have been migrated should be off-lined.

iii. The storage that is common to both clusters (LUNS) should be masked (hidden) from the source cluster, to prevent accidental usage by both clusters.

iv. The storage that is common to both clusters (LUNS) should be presented to the new cluster.

v. The CSV volumes on the target cluster should be on-lined.

vi. The VMs on the target cluster should be on-lined.

vii. VMs are migrated and ready for use!

Note: If one VM on a CSV disk is selected for migration, the Cluster Migration Wizard will require all VMs (and auto-select them for you) on that CSV to be migrated too.

Walk Through: Migrating a HA VM from Windows Server 2008 R2 to Windows Server 2012

A. Let’s assume that we’ve completed the planning steps 1-3 above, and that we have a Highly Available VM running on a Windows Server 2008 R2 cluster – the source cluster - notice that the VM is running, and that it depends on a CSV disk resource:

B. On the Windows Server 2012 cluster – the target cluster - from the Failover Cluster Manger, select a cluster and then use the More Actions | Migrate Roles… menu to launch the Cluster Migration Wizard:

C. The Cluster Migration Wizard (Migrate a Cluster Wizard) will appear – press Next:

D. Specify the name of the source cluster – press Next:

E. The source cluster (Windows Server 2008 R2) will be scanned, and the resources that can be moved will be identified – here I have selected the VM called “VHD_CSV”:

F. After pressing Next, we see that the Migration Wizard will prompt us for the Virtual Network Switch that the VM should use on the new (target) cluster – here I use the drop-down menu and select “Destination Lab Private”:

G. Pressing View Report will display the Pre-Migration Report – this will show you the Cluster Migration Wizard’s analysis of the cluster roles that can be migrated. Note that the Cluster Group and Available Storage are never migrated:

H. When you are ready to migrate the resources, press Next:

I. After migrating resources, the Post-Migration Report is displayed in the dialog:

J. By pressing View Report, the full report will be displayed in the default browser:

K. Note that there are two new resources on the target cluster – identical to the source cluster. Under Roles, you will see the VHD_CSV VM – note that it is Off. Migrated VMs are always initially set to off on the Target clusters, this allows you to pre-stage the new cluster, but to control when to make the cut over:

L. Under Storage then Disks, you will see the VHD_CSV-disk Physical Disk resource that was copied to the target cluster:

M. Now that the target cluster has been pre-staged, use the following steps during a maintenance window to cut over to the new Windows Server 2012 cluster:

1. Shutdown all VMs on the source Windows Server 2008 R2 cluster that have been migrated.

2. Configure the storage:

a. Unmask the common shared storage (LUNs) so that they are not presented to the Windows Server 2008 R2source cluster

Note: Data could become corrupt if they are presented to multiple clusters at the same time.

b. Mask the common shared storage (LUNs) to the Windows Server 2012 target cluster.

3. Start all VMs on the target Windows Server 2012 cluster.

Summary

In Windows Server 2012, the Cluster Migration Wizard is a powerful tool that provides agility and flexibility to customers using highly available VMs on Failover Clusters.

http://technet.microsoft.com/en-us/library/jj592687.aspx

http://technet.microsoft.com/en-us/library/jj574226.aspx

WINDOWS 2008 / 2008 R2 SAN Migration

Hugofe — Wed, 04 Jul 2012 13:09:14 GMT

Some of the Cluster Recovery functionality is built into Windows 2008 Failover Clustering.

Say I have 4 disks in the Cluster (1 witness and 3 data) and I want to replace them with new ones.

Quorum Type,

Here are the steps I would take. Please ensure all nodes are up and functioning in the Cluster.
1. Change the Quorum Setting from Witness to Node Majority.
a. Right Mouse Click the name of the Cluster on left and choose PROPERTIES
b. Choose MORE ACTIONS
c. Choose CONFIGURE CLUSTER QUORUM SETTINGS
d. Select NODE MAJORITY
e. FINISH

Disk Resources

“How do I replace a disk?”

I’ll walkthrough the process of replacing a 1GB disk with a 2GB disk.

This process is similar to how you could go about doing a SAN migration where you are replacing all of your shared disks with storage from a new SAN.

The preferred way of getting a larger cluster disk is to use the built in capability of most SANs to dynamically expand a LUN then use an OS utility like DiskPart or Disk Manager to extend the size of the disk.

If that’s not feasible or you simply want to replace a LUN with a larger one or as I mentioned, as part of a SAN migration, this process works well.

2.1:

The first thing we need to do is present your new disk to the cluster.

The nuts and bolts of how to do that are outside the scope of this post so just ask your SAN administrator for a new LUN and present it to all nodes of the cluster.

Since by default in Server 2008, we leave new LUNs offline, there’s no risk in presenting a new LUN to all nodes at the same time.

In the below figure is what Disk Manager would look like after my new disk had been presented.

Figure 1.

Note how the new disk ‘Disk 9’ is in an ‘Offline’ state. In order to prepare it to be the replacement disk for an existing disk, we need to do the following.

Online the disk
Initialize the disk (MBR or GPT)
Create a new volume
Format as either FAT32 or NTFS

Figure 2.

Figure 2 now shows ‘Disk 9’ as Online and formatted with an NTFS partition.

Add the NEW disk to the Available Storage Group

Take all the resources OFFLINE except the NEW and the OLD Disks,

Copy the Data:

robocopy G: B: /MIR /SEC /R:5 /W:1 /LOG:C:\copia_log.txt /TEE /ETA /COPYALL

robocopy H: E: /MIR /SEC /R:5 /W:1 /LOG:C:\copia_log.txt /TEE /ETA /COPYALL

robocopy I: F: /MIR /SEC /R:5 /W:1 /LOG:C:\copia_log.txt /TEE /ETA /COPYALL

robocopy J: S: /MIR /SEC /R:5 /W:1 /LOG:C:\copia_log.txt /TEE /ETA /COPYALL

robocopy K: T: /MIR /SEC /R:5 /W:1 /LOG:C:\copia_log.txt /TEE /ETA /COPYALL

robocopy M: U: /MIR /SEC /R:5 /W:1 /LOG:C:\copia_log.txt /TEE /ETA /COPYALL

robocopy N: V: /MIR /SEC /R:5 /W:1 /LOG:C:\copia_log.txt /TEE /ETA /COPYALL

robocopy L: W: /MIR /SEC /R:5 /W:1 /LOG:C:\copia_log.txt /TEE /ETA /COPYALL

robocopy P: X: /MIR /SEC /R:5 /W:1 /LOG:C:\copia_log.txt /TEE /ETA /COPYALL

robocopy R: Y: /MIR /SEC /R:5 /W:1 /LOG:C:\copia_log.txt /TEE /ETA /COPYALL

robocopy O: Z: /MIR /SEC /R:5 /W:1 /LOG:C:\copia_log.txt /TEE /ETA /COPYALL…

At this point, we can now go into Failover Cluster Manager to complete the rest of the replacement.

The screenshot below shows a File Server group with ‘Cluster Disk X:’ of size 1GB. This is the disk that I am going to replace with the new 2GB disk from above.

Figure 3.

Failover Cluster Manager has a built in ‘repair’ functionality that allows replacing a failed disk with a new disk.

Since we’re not really replacing a failed disk but a working one, we need to ‘trick’ the cluster into putting that disk into a failed state so that the ‘repair’ function will be enabled.

First we need to change the properties of ‘Cluster Disk X:’ to not restart or failover when I simulate a failure of the disk. Right-click the disk resource, [Properties], [Policies Tab]. Set the ‘Response to resource failure’ to ‘If resources fails, do not restart’.

Figure 4.

Now right-click ‘Cluster Disk X:’, ‘More Actions’, ‘Simulate failure of this resource’

Figure 5.

You’ll now see that the disk resource is in a ‘Failed’ state. Don’t worry, data is still intact and disk is fine.

Figure 6.

Now right-click the disk resource, ‘More actions…’, ‘Repair’. This will launch the ‘Repair a Disk Resource’ window.

Figure 7.

Figure 7. shows the disk that we presented and created in Figure 2. Select that disk, click [OK]/

So after this we now have the NEW disk,

Now bring the resource online. You’ll see in Figure 8. that the disk now shows as 2GB. We essentially swapped one disk for another without having to worry about resource dependencies.

If the drive letter needs to be changed to match the old drive letter, do so now.

Figure 8.

Now, we need to set the restart properties of the resource back to their default. Right click on the disk, Properties. Select the ‘If resource fails, attempt restart on current node’. We’re undoing what we did in Figure 4.

Figure 9.

Other Option to copy the DATA is:

So now that we’ve replaced the 1GB disk with the 2GB disk, what happened to the old disk?

When you used the ‘Repair’ function, the old disk got removed from under the control of the cluster.

The final step in the replacement is to bring the old disk back into the cluster so that we can bring it online and move the data from the old disk to the new.

To add the disk back in, from Failover Cluster Manager, go to the ‘Storage’ group. In the right-most column, in the ‘Actions’ pane, click on ‘Add a disk’

Figure 10.

Figure 11 shows the disk we just removed from the cluster. Select this disk, click [OK]

Figure 11.

This disk now shows up in ‘Available Storage’. Figure 12.

Figure 12.

The final steps in the replacement are to assign this disk a drive letter so that it’s exposed to the OS to get your data moved from the old disk to the new.

Figure 13.

Now that ‘Cluster Disk 7’ (the old disk) shows as online and has a drive letter (D:) , you can use your favorite data copy method to move the data from the old disk to the new disk.

If you are no longer going to use the old LUN, you can simply delete this resource from Failover Cluster Manager and unpresent that LUN from all nodes of the cluster.

That finishes up the clean-up process. You can also just leave the disk in ‘Available Storage’, format it, and have it ready for some other ‘Service or application’ cluster group to use in the future.

Hope you find this useful especially for those SAN migrations.

http://technet.microsoft.com/en-us/library/cc756229(v=WS.10).aspx

Recommended hotfixes KBs for SCVMM 2008 R2 / SCVMM 2012:

Hugofe — Thu, 21 Jun 2012 10:00:44 GMT

Recommended hotfixes KBs for SCVMM 2008 R2 / SCVMM 2012

1- for VMM 2012:

2724596 Recommended hotfixes for Microsoft System Center 2012 Virtual Machine Manager

http://support.microsoft.com/kb/2724596/EN-US

VMMCA will be updated to check for the hotfixes mentioned in the KB.

2· Updated the VMM 2008 R2 KB:

2397711 Recommended hotfixes for System Center Virtual Machine Manager 2008 R2

http://support.microsoft.com/kb/2397711/EN-US

Lista proactiva de updates / proactive recommended updates ( Windows Server 2008 R2 RTM / SP1 Cluster ) April 2012

Hugofe — Mon, 02 Apr 2012 11:09:35 GMT

Lista proactiva de updates / proactive recommended updates ( Windows Server 2008 R2 RTM / SP1 Cluster ):

Kernel

2667227 You cannot access an RDX removable disk that you formatted by using NTFS in Windows Server 2003, in Windows Vista, in Windows Server 2008, in Windows 7, or in Windows Server 2008 R2

http://support.microsoft.com/default.aspx?scid=kb;EN-US;2667227

TCPIP

2675785 Data transfer speed is slow in Windows 7 or in Windows Server 2008 R2

http://support.microsoft.com/default.aspx?scid=kb;EN-US;2675785

NDIS

2624668 "STOP: 0x0000003B" error occurs during the shutdown process in Windows Server 2008 R2 or in Windows 7

http://support.microsoft.com/default.aspx?scid=kb;EN-US;2624668

RDBSS

2647452 Paged pool leaks when you map a network drive and then disconnect it frequently in Windows 7 or in Windows Server 2008 R2

http://support.microsoft.com/default.aspx?scid=kb;EN-US;2647452

MPIO

2661794 MPIO does not remove a disk that is on a failed path in Windows Server 2008 R2

http://support.microsoft.com/default.aspx?scid=kb;EN-US;2661794

MSDSM

2460971 MPIO failover fails on a computer that is running Windows Server 2008 R2

http://support.microsoft.com/default.aspx?scid=kb;EN-US;2460971

VOLSNAP

2632149 "fvevol!FveFilterDeviceControl+1d0" Stop error when you create a VSS snapshot backup in Windows Server 2008 R2 SP1

http://support.microsoft.com/default.aspx?scid=kb;EN-US;2632149

CLUSSVC

2674551 Redirected mode is enabled unexpectedly in a Cluster Shared Volume when you are running a third-party application in a Windows Server 2008 R2-based cluster

http://support.microsoft.com/default.aspx?scid=kb;EN-US;2674551

CSVFILTER

2639032 "0x0000003B," "0x00000027," and "0x0000007e" Stop errors when a connection to a CSV is lost on a Windows Server 2008 R2-based failover cluster

http://support.microsoft.com/default.aspx?scid=kb;EN-US;2639032

Clusres.dll

2637197 CSV LUNs fail if you use a VSS hardware provider to back up virtual machines on a Windows Server 2008 R2-based cluster

http://support.microsoft.com/default.aspx?scid=kb;EN-US;2637197

storport.sys

2654363 Computer crashes when you use Driver Verifier to monitor Storport.sys if you disable the HBA in Windows 7 or Windows Server 2008 R2

http://support.microsoft.com/default.aspx?scid=kb;EN-US;2654363

NTFS.SYS

2618914 A hotfix is available that adds the FileFsSectorSizeInformation information class to Windows 7 and to Windows Server 2008 R2

http://support.microsoft.com/default.aspx?scid=kb;EN-US;2618914

WMI

2465990 "0x80041002 (WBEM_E_NOT_FOUND)" error occurs when you try to open a WMI namespace on a computer that is running Windows 7 or Windows Server 2008 R2

http://support.microsoft.com/kb/2465990/en-us

Advisory-Auditing cluster regkey

Hugofe — Tue, 22 Nov 2011 13:49:29 GMT

Audit any changes in the cluster registry (HKEY_LOCAL_MACHINE\Cluster) in a windows 2003 cluster environment.

Purpose:

Advisory-Auditing cluster regkey

Action Plan:

Please be aware that the type of information that the Audit gives in windows 2003 is not so explicit as it is in more recent operating systems like in windows 2008.

Identify type of changes made either manually by editing the resource in the registry or possibly some script or application that run

Those action in terms of the GPO and the Registry need to be applied equally on all the nodes of the cluster.

324739 HOW TO: Use Group Policy to Audit Registry Keys in Windows Server 2003

http://support.microsoft.com/kb/324739

Turn On Auditing on a Computer

1. Click Start, and then click Run.

2. In the Open box, type gpedit.msc, and then click OK.

3. Under Computer Configuration, expand Windows Settings, expand Security Settings, expand Local Policies, and then click Audit Policy.

4. In the right pane, double-click Audit object access.

5. Click to select the Success check box, click to select the Failure check box, and then click OK.
NOTE: The Audit object access policy is enough to turn on auditing for the Windows registry.

6. Quit the Group Policy Object Editor snap-in.

Audit a Registry Key

1. Click Start, and then click Run.

2. In the Open box, type regedit, and then click OK.

3. Locate and click the registry key that you want to audit, for example:

HKEY_LOCAL_MACHINE\Cluster\NetworkInterfaces

HKEY_LOCAL_MACHINE\Cluster\Networks

4. On the Edit menu, click Permissions.

5. Click Advanced, click the Auditing tab, and then click Add.

6. Type the user EVERYONE to this registry key you want to audit, click Check Names to verify the name, and then click OK.

7. In the Apply onto box, click the option that you want.

8. Click to select the Successful and Failed check boxes next to the following access types:

9. Click OK, and then click OK.

10. Quit Registry Editor.

Audit events are displayed in the Security log of Event Viewer

Example:

Those are the events that are generated.

3.1:

3.2:

Detailed events that are reported if we delete or change any key,

3.2:

Detailed events that are reported if we delete or change any key,

Event Type: Success Audit

Event Source: Security

Event Category: Object Access

Event ID: 560

Date: 11/22/2011

Time: 10:38:59 AM

User: VPCLAB\Administrator

Computer: SETPSFIFNO5

Description:

Object Open:

Object Server: Security

Object Type: Key

Object Name: \REGISTRY\MACHINE\CLUSTER\Networks

Handle ID: 312

Operation ID: {0,270998}

Process ID: 2496

Image File Name: C:\WINDOWS\regedit.exe

Primary User Name: Administrator

Primary Domain: VPCLAB

Primary Logon ID: (0x0,0x28D54)

Client User Name: Administrator

Client Domain: VPCLAB

Client Logon ID: (0x0,0x28D54)

Accesses: READ_CONTROL

Query key value

Enumerate sub-keys

Privileges: -

Restricted Sid Count: 0

Access Mask: 0x20009

Event Type: Success Audit

Event Source: Security

Event Category: Object Access

Event ID: 560

Date: 11/22/2011

Time: 10:39:00 AM

User: VPCLAB\Administrator

Computer: SETPSFIFNO5

Description:

Object Open:

Object Server: Security

Object Type: Key

Object Name: \REGISTRY\MACHINE\CLUSTER\Networks\136a7de2-8375-4a19-a57d-242afebaff41

Handle ID: 308

Operation ID: {0,271033}

Process ID: 2496

Image File Name: C:\WINDOWS\regedit.exe

Primary User Name: Administrator

Primary Domain: VPCLAB

Primary Logon ID: (0x0,0x28D54)

Client User Name: Administrator

Client Domain: VPCLAB

Client Logon ID: (0x0,0x28D54)

Accesses: READ_CONTROL

ACCESS_SYS_SEC

Query key value

Enumerate sub-keys

Privileges: SeSecurityPrivilege

Restricted Sid Count: 0

Access Mask: 0x1020009

Event Type: Success Audit

Event Source: Security

Event Category: Object Access

Event ID: 560

Date: 11/22/2011

Time: 10:39:00 AM

User: VPCLAB\Administrator

Computer: SETPSFIFNO5

Description:

Object Open:

Object Server: Security

Object Type: Key

Object Name: \REGISTRY\MACHINE\CLUSTER\Networks\136a7de2-8375-4a19-a57d-242afebaff41

Handle ID: 308

Operation ID: {0,271033}

Process ID: 2496

Image File Name: C:\WINDOWS\regedit.exe

Primary User Name: Administrator

Primary Domain: VPCLAB

Primary Logon ID: (0x0,0x28D54)

Client User Name: Administrator

Client Domain: VPCLAB

Client Logon ID: (0x0,0x28D54)

Accesses: READ_CONTROL

ACCESS_SYS_SEC

Query key value

Enumerate sub-keys

Privileges: SeSecurityPrivilege

Restricted Sid Count: 0

Access Mask: 0x1020009

Event Type: Success Audit

Event Source: Security

Event Category: Object Access

Event ID: 560

Date: 11/22/2011

Time: 10:39:00 AM

User: VPCLAB\Administrator

Computer: SETPSFIFNO5

Description:

Object Open:

Object Server: Security

Object Type: Key

Object Name: \REGISTRY\MACHINE\CLUSTER\Networks\136a7de2-8375-4a19-a57d-242afebaff41

Handle ID: 308

Operation ID: {0,271038}

Process ID: 2496

Image File Name: C:\WINDOWS\regedit.exe

Primary User Name: Administrator

Primary Domain: VPCLAB

Primary Logon ID: (0x0,0x28D54)

Client User Name: Administrator

Client Domain: VPCLAB

Client Logon ID: (0x0,0x28D54)

Accesses: READ_CONTROL

Privileges: -

Restricted Sid Count: 0

Access Mask: 0x20000

Event Type: Success Audit

Event Source: Security

Event Category: Object Access

Event ID: 560

Date: 11/22/2011

Time: 10:39:00 AM

User: VPCLAB\Administrator

Computer: SETPSFIFNO5

Description:

Object Open:

Object Server: Security

Object Type: Key

Object Name: \REGISTRY\MACHINE\CLUSTER\Networks

Handle ID: 308

Operation ID: {0,271039}

Process ID: 2496

Image File Name: C:\WINDOWS\regedit.exe

Primary User Name: Administrator

Primary Domain: VPCLAB

Primary Logon ID: (0x0,0x28D54)

Client User Name: Administrator

Client Domain: VPCLAB

Client Logon ID: (0x0,0x28D54)

Accesses: READ_CONTROL

ACCESS_SYS_SEC

Query key value

Enumerate sub-keys

Privileges: SeSecurityPrivilege

Restricted Sid Count: 0

Access Mask: 0x1020009

Event Type: Success Audit

Event Source: Security

Event Category: Object Access

Event ID: 560

Date: 11/22/2011

Time: 10:39:04 AM

User: VPCLAB\Administrator

Computer: SETPSFIFNO5

Description:

Object Open:

Object Server: Security

Object Type: Key

Object Name: \REGISTRY\MACHINE\CLUSTER\Networks\136a7de2-8375-4a19-a57d-242afebaff41

Handle ID: 256

Operation ID: {0,271122}

Process ID: 2496

Image File Name: C:\WINDOWS\regedit.exe

Primary User Name: Administrator

Primary Domain: VPCLAB

Primary Logon ID: (0x0,0x28D54)

Client User Name: -

Client Domain: -

Client Logon ID: -

Accesses: DELETE

READ_CONTROL

WRITE_DAC

WRITE_OWNER

Query key value

Set key value

Create sub-key

Enumerate sub-keys

Notify about changes to keys

Create Link

Privileges: -

Restricted Sid Count: 0

Access Mask: 0xF003F

Event Type: Success Audit

Event Source: Security

Event Category: Object Access

Event ID: 560

Date: 11/22/2011

Time: 10:39:12 AM

User: VPCLAB\Administrator

Computer: SETPSFIFNO5

Description:

Object Open:

Object Server: Security

Object Type: Key

Object Name: \REGISTRY\MACHINE\CLUSTER\Networks\136a7de2-8375-4a19-a57d-242afebaff41

Handle ID: 304

Operation ID: {0,271256}

Process ID: 2496

Image File Name: C:\WINDOWS\regedit.exe

Primary User Name: Administrator

Primary Domain: VPCLAB

Primary Logon ID: (0x0,0x28D54)

Client User Name: -

Client Domain: -

Client Logon ID: -

Accesses: Query key value

Enumerate sub-keys

Privileges: -

Restricted Sid Count: 0

Access Mask: 0x9

Event Type: Success Audit

Event Source: Security

Event Category: Object Access

Event ID: 560

Date: 11/22/2011

Time: 10:39:12 AM

User: VPCLAB\Administrator

Computer: SETPSFIFNO5

Description:

Object Open:

Object Server: Security

Object Type: Key

Object Name: \REGISTRY\MACHINE\CLUSTER\Networks\136a7de2-8375-4a19-a57d-242afebaff41

Handle ID: 256

Operation ID: {0,271259}

Process ID: 2496

Image File Name: C:\WINDOWS\regedit.exe

Primary User Name: Administrator

Primary Domain: VPCLAB

Primary Logon ID: (0x0,0x28D54)

Client User Name: -

Client Domain: -

Client Logon ID: -

Accesses: Query key value

Enumerate sub-keys

Privileges: -

Restricted Sid Count: 0

Access Mask: 0x9

Event Type: Success Audit

Event Source: Security

Event Category: Object Access

Event ID: 560

Date: 11/22/2011

Time: 10:39:12 AM

User: VPCLAB\Administrator

Computer: SETPSFIFNO5

Description:

Object Open:

Object Server: Security

Object Type: Key

Object Name: \REGISTRY\MACHINE\CLUSTER\Networks\136a7de2-8375-4a19-a57d-242afebaff41

Handle ID: 256

Operation ID: {0,271260}

Process ID: 2496

Image File Name: C:\WINDOWS\regedit.exe

Primary User Name: Administrator

Primary Domain: VPCLAB

Primary Logon ID: (0x0,0x28D54)

Client User Name: -

Client Domain: -

Client Logon ID: -

Accesses: DELETE

Privileges: -

Restricted Sid Count: 0

Access Mask: 0x10000

Event Type: Success Audit

Event Source: Security

Event Category: Object Access

Event ID: 560

Date: 11/22/2011

Time: 10:49:40 AM

User: VPCLAB\Administrator

Computer: SETPSFIFNO5

Description:

Object Open:

Object Server: Security

Object Type: Key

Object Name: \REGISTRY\MACHINE\CLUSTER\Networks\teste

Handle ID: 308

Operation ID: {0,294077}

Process ID: 2496

Image File Name: C:\WINDOWS\regedit.exe

Primary User Name: Administrator

Primary Domain: VPCLAB

Primary Logon ID: (0x0,0x28D54)

Client User Name: -

Client Domain: -

Client Logon ID: -

Accesses: DELETE

Privileges: -

Restricted Sid Count: 0

Access Mask: 0x10000

New in Windows 2008/2008 R2

Configuring Auditing for a Windows Server 2008 Failover Cluster

http://blogs.technet.com/askcore/archive/2009/01/19/configuring-auditing-for-a-windows-server-2008-failover-cluster.aspx

The Windows Server 2008 Failover Clustering auditing feature has been requested by customers and provides the capability to monitor, or audit, cluster access. The cluster auditing feature can be enabled to audit accesses (Success and\or Failure) of an object. The object, in this case, will be the Microsoft Failover Cluster. This is accomplished by auditing client accesses to a cluster using Cluster APIs. This basically means that a client trying to access a cluster using either the Failover Cluster Management snap-in (Cluadmin.msc), the cluster.exe command line or any custom application that calls cluster APIs, will be subjected to auditing events if configured.

Extend system partition and Disk Cleanup in Windows 2000/2003/XP/2008/2008 R2 /7:

Hugofe — Mon, 17 Oct 2011 11:02:43 GMT

1 - Extend system partition:

1.1:

Windows PE

This article discusses the support boundaries that Microsoft Customer Support Services (CSS) provides for use of Microsoft Windows Preinstallation Environment (Windows PE) to extend the drive that contains the Microsoft Windows operating system. Windows PE can be used to extend both the system and boot partitions if they are separate.

To use Windows PE to extend the drive that contains the Windows operating system, the customer must meet the following requirements:

The version of Windows PE must be Microsoft Windows PE 2005 or a later version. Windows PE 2005 is based on Windows Server 2003 Service Pack 1 (SP1).
The hard disk partition that is being extended must be running Windows Server 2003 or a later version.
The kind of disk that is being extended must be basic and not dynamic.
The hard disk partition that is being extended must have free space directly next to the partition that is being extended.
The file system on the hard disk partition that is being extended must be a NTFS file system.

To use Windows PE to extend the drive that contains the Windows operating system, follow these steps:

1. Perform a full backup on the hard disk partition that is being extended.
Note If you back up the data on this hard disk partition, the data will not be lost in case there is a problem or corruption occurs.

2. Make sure that unallocated space is available on the hard disk next to the hard disk partition that is being extended. You can use the software utility that is provided by the hardware vendor to physically create unallocated space on the hard disk.

3. Restart the computer by using the Windows PE CD.

4. Open a command prompt.

5. At the command prompt, type Diskpart.exe, and then press ENTER.

6. Type List volume, and then press ENTER to display the existing volumes.

7. Type Select volume volume number. volume number is the number of the volume that you want to extend.

8. Type Extend, and then press ENTER to extend the hard disk partition into the free space.
Note You can use the size=N option to specify how much space in megabytes (MB) to add to the current partition. If no size is specified, the disk is extended to use all the contiguous unallocated space. For example, type extend size=2000 to add 2,000 MB of free space to the current hard disk partition.
For more information, click the following article number to view the article in the Microsoft Knowledge Base:

325590 (http://support.microsoft.com/kb/325590/ ) How to use Diskpart.exe to extend a data volume in Windows Server 2003, in Windows XP, and in Windows 2000

9. To exit the command prompt, type exit, and then press ENTER.

10. Restart the computer, and then log on to Windows.

11. Verify that the hard disk partition that contains the operating system is now extended to include the available free space.

Support boundaries for using Windows PE to extend the drive that contains the Windows operating system

http://support.microsoft.com/kb/911896

1.2:

Data Volumes on any OS or System Partition in windows 2008:

This article describes the following:

· How to use the Diskpart.exe command prompt utility to extend a data volume into unallocated space in Windows Server 2003, in Windows XP, and in Microsoft Windows 2000.

· How to extend the boot partition in Windows Server 2008.

How to use Diskpart.exe to extend a data volume in Windows Server 2003, in Windows XP, and in Windows 2000

You can use the Diskpart.exe utility to manage disks, partitions, and volumes from a command-line interface. You can use Diskpart.exe on both Basic disks and Dynamic disks. If an NTFS volume resides on a hardware RAID 5 container that can add space to the container, you can extend the NTFS Volume with Diskpart.exe while the disk remains a Basic disk.
Use the extend command to incorporate unallocated space into an existing volume while preserving the data.
The following are the requirements for the extend command:

· The volume must be formatted with the NTFS file system.

· For Basic volumes, the unallocated space for the extension must be the next contiguous space on the same disk.

· For Dynamic Volumes, the unallocated space can be any empty area on any Dynamic disk on the system.

· Only the extension of data volumes is supported. System or boot volumes may be blocked from being extended, and you may receive the following error:

Diskpart failed to extend the volume. Please make sure the volume is valid for extending

· You cannot extend the partition if the system page file is located on the partition. Move the page file to a partition that you do not want to extend.

To extend a partition or volume, you must first select the volume to give it the focus, and then you can specify how large to make the extension. To extend a volume, follow these steps:

1. At a command prompt, type diskpart.exe.

2. Type list volume to display the existing volumes on the computer.

3. Type Select volume volume number where volume number is number of the volume that you want to extend.

4. Type extend [size=n] [disk=n] [noerr]. The following describes the parameters:

size=n
The space, in megabytes (MB), to add to the current partition. If you do not specify a size, the disk is extended to use all the next contiguous unallocated space.
disk=n
The dynamic disk on which to extend the volume. Space equal to size=n is allocated on the disk. If no disk is specified, the volume is extended on the current disk.
noerr
For scripting only. When an error is thrown, this parameter specifies that Diskpart continue to process commands as if the error did not occur. Without the noerr parameter, an error causes Diskpart to exit with an error code.

5. Type exit to exit Diskpart.exe.

How to extend the boot partition in Windows Server 2008

To extend the boot partition in Windows Server 2008, follow these steps:

1. Click Start, and then click Server Manager.

2. In the navigation pane, expand Storage, and then click Disk Management.

3. In the details pane, right-click the volume that you want, and then click Extend Volume.

4. Follow the instructions in the Extend Volume Wizard to extend the boot partition.

Note You can only extend the boot partition in contiguous unallocated disk space.

How to extend a data volume in Windows Server 2003, in Windows XP, in Windows 2000, and in Windows Server 2008

http://support.microsoft.com/kb/325590

1.3:

Not supported but might work, System Partition in windows 2003:

The Diskpart.exe utility that is included in Microsoft Windows Server 2003 and in Microsoft Windows XP does not let you extend the Windows boot and system partitions into unallocated space.
The Diskpart.exe utility supports only the extension of data partitions. System or boot partitions may be blocked from being extended. You may receive the following error after you try to extend a system or boot partition:

Diskpart failed to extend the volume. Please make sure the volume is valid for extending.

The Diskpart.exe utility that is included with the Microsoft Windows 2000 Resource Kit may let you extend Windows 2000 boot and system partitions into unallocated space. However, the file system may not be extended, and when you try to extend boot or system partitions, your computer may stop responding.
Caution You may find that Microsoft Windows XP Service Pack 1 (SP1) lets you use the Diskpart.exe utility to extend Windows boot and system partitions. The boot and system partitions may be extended, but the file system may not be extended. Therefore, your computer may stop responding if you try to extend the boot and system partitions. The Diskpart.exe utility was not intended for extending Windows boot and system partitions.
Windows XP and Windows Server 2003 include the Diskpart.exe utility as part of the base operating system.
To download the Diskpart.exe utility for Windows 2000, visit the following Microsoft Web site:

http://www.microsoft.com/downloads/details.aspx?FamilyID=0fd9788a-5d64-4f57-949f-ef62de7ab1ae&displaylang=en

886986 Functionality restrictions of the Diskpart.exe utility to extend system and boot partitions in Windows Server 2003 and in Windows XP

http://support.microsoft.com/default.aspx?scid=kb;EN-US;886986

2 - Disk Cleanup:

2.1:

The Disk Cleanup tool helps you free up space on your hard disk by searching your disk for files that you can safely delete. You can choose to delete some or all of the files. Use Disk Cleanup to perform any of the following tasks to free up space on your hard disk:

· Remove temporary Internet files.

· Remove downloaded program files. For example, ActiveX controls and Java applets that are downloaded from the Internet.

· Empty the Recycle Bin.

· Remove Windows temporary files.

· Remove optional Windows components that you are not using.

· Remove installed programs that you no longer use.

2.2:

While Windows is running , you may receive a "low disk space" message in the notification area. This may prevent the ability to download and install Windows updates.

This article describes how to reclaim disk space on a Windows XP and Windows Server 2003 based systems.

You may have to reclaim disk space on your computer so that you can install additional Windows updates, service packs, and programs. Or, you may have to do this in order to save additional personal files.

Run the Disk Cleanup tool

The Disk Cleanup tool searches your hard disk for files that you can safely delete. You can choose to delete some of or all these files.
For more information about the Disk Cleanup tool, click the following article number to view the article in the Microsoft Knowledge Base:

310312 (http://support.microsoft.com/kb/310312/ ) Description of the Disk Cleanup Tool in Windows XP

To start the Disk Cleanup tool, use one of the following methods:

Click Start, click Run, type cleanmgr in the Open box, and then press ENTER.
Click Start, point to All Programs, point to Accessories, point to System Tools, and then click Disk Cleanup.
In Windows Explorer or in My Computer, right-click the drive on which you want to reclaim disk space, and then click Properties. In the Properties dialog box, click the General tab, and then click Disk Cleanup.

To reclaim space on your hard disk, click the Disk Cleanup tab, select one or more files to be deleted, and then click OK.
Note By default, some files are automatically selected. You can accept the default setting by clicking OK.
The listed files can include items from the following:

Temporary Setup Files
These are files that were created by a Setup program that is no longer running.
Downloaded Program Files
Downloaded program files are ActiveX controls and Java programs that are downloaded automatically from the Internet when you view certain Web pages. These files are temporarily stored in the Downloaded Program Files folder on the hard disk. When you click the Temporary Setup Files item, you see a View Files button that lets you review the files before Disk Cleanup deletes them. This button opens the C:\Winnt\Downloaded Program Files folder.
Note Downloaded program files are selected by default.
Temporary Internet Files
This folder contains Web pages that are stored on your hard disk for quick viewing. Disk Cleanup deletes these pages but leaves your personalized settings for Web pages intact. When you click the Temporary Internet Files item, you see a View Files button. This button opens the C:\Documents and Settings\ Username \Local Settings\Temporary Internet Files\Content.IE5 folder.
Offline Webpages
Offline pages are webpages that are stored on your computer so you can view them without being connected to the Internet. If you delete these pages now, you can still view your favorites offline later by synchronizing them. Your personalized settings for webpages will be left intact.
Old Chkdsk Files
When the Chkdsk tool checks a disk for errors, it might save lost file fragments as files in the root folder on the disk. These files are unnecessary.
Recycle Bin
The Recycle Bin contains files that you have deleted from the system. These files are not permanently removed until you empty the Recycle Bin. When you click the Recycle Bin item, you see a View Files button that opens the Recycle Bin.
Setup Log Files
Files created by Windows.
Temporary Files
Programs sometimes store temporary information in a Temp folder. Before a program exits, it typically deletes this information. You can safely delete temporary files that have not been modified within the last week.
WebClient/Publisher Temporary Files
The WebClient/Publisher service maintains a cache of accessed files on this disk. These files are kept locally for performance reasons only, and can be deleted safely.
Temporary Offline Files
Temporary offline files are local copies of recently used network files. These files are automatically cached so that you can use them after you disconnect from the network. When you click the Temporary Offline Files item, you see a View Files button that opens the Offline Files folder.
Offline Files
Offline files are local copies of network files that you specifically want to have available offline so that you can use them after you disconnect from the network. When you click the Offline Files item, you see a View Files button that opens the Offline Files folder.
Compress Old Files
Windows can compress files that you have not used recently. When you compress old files, you save disk space. However, you can still use these files, and no files are deleted. Because files are compressed at different rates, the displayed amount of disk space that you will gain is approximate. You can use the Options button to specify the number of days to wait before Disk Cleanup compresses an unused file.
Catalog Files for the Content Indexer
The Indexing service speeds up and improves file searches by maintaining an index of the files that are on the disk. These Catalog files remain from earlier indexing operations, and they can be safely deleted.

The More Options tab in the Disk Cleanup dialog box contains options for cleaning up Windows components or installed programs. By using these options, you can reclaim additional space on the computer:

The Windows Components option creates free space by removing optional Windows components that you do not use. By clicking Clean Up, you start the Windows Components Wizard.
The Installed Programs option reclaims more disk space by removing programs that you do not use. By clicking Clean Up, you start the Change or Remove Programs option in the Add or Remove Programs tool.
The System Restore option creates free space by removing all restore points except for the most recent one.

Delete memory dump files, and modify the Startup and Recovery options

Memory dump files are created when system failures occur, and they can be used to determine the cause of a failure. These files can be safely deleted if they are no longer required.
To delete memory dump files, follow these steps:

1. Delete the files in the %AllUsersProfile%\Application Data\Microsoft\Dr Watson folder. These log and memory dump files are created when applications stop working.

2. Delete the files in the %Windir%\minidump folder. These minidump files are created when Windows stops responding or crashes.

3. Delete the %SystemRoot%\MEMORY.dmp file. This is the complete memory dump file that is created when Windows stops responding or crashes.

You may also want to prevent your system from creating a complete memory dump file in the future. Complete memory dump files record the contents of system memory when the computer stops responding or crashes. These complete memory dump files can be very large. To save space, you can modify your Startup and Recovery options to create only a small memory dump file.
To configure the system to create a small memory dump file instead of a complete dump file when failures occur, follow these steps:

1. Right-click My Computer, and then click Properties.

2. Click the Advanced tab, and then click Settings under Startup and Recovery.

3. Under Write Debugging Information, select the kind of information that you want Windows to record in a memory dump file if the computer stops responding. To record the smallest volume of information for use in troubleshooting the problem, select the Small Memory Dump option. This option requires a paging file of at least 2 megabytes (MB) on the boot volume of the computer, and it specifies that Windows will create a new file every time that the system stops responding or crashes.

4. Click OK.

Delete the remote desktop connection cache files

If you delete the cache files, the screen may not update very quickly while you are running Remote Desktop Connection.
To delete the Remote Desktop Connection cache files, delete all the bitmap cache files (files that use the .bmc extension) in the %Userprofile%\Local Settings\Application Data\Microsoft\Terminal Server Client\cache folder.

Disable other Windows features

Warning Although disabling certain Windows features can save disk space, this may affect the performance and functionality of the computer. Consider the effect that this option will have on the computer before you disable Windows features.
You have the following options:

Disable hibernation, and delete the hibernation file.

1. Disable the hibernation file. For more information about how to disable the hibernation file, click the following article number to view the article in the Microsoft Knowledge Base:

920730 (http://support.microsoft.com/kb/920730/ ) How to disable and re-enable hibernation on a computer that is running Windows Vista

2. Delete the %SystemDrive%\hiberfil.sys file.

Move the paging file to another volume, disable it, or delete it.

Disable or move the paging file. To do this, see the "Change the size of the virtual memory paging file" article in Microsoft TechNet. To do this, visit the following Microsoft Web site:

http://technet.microsoft.com/en-us/library/cc772755.aspx (http://technet.microsoft.com/en-us/library/cc772755.aspx)

Delete the %SystemDrive%\Pagefile.sys file.

Delete Windows update files

Warning If you delete the folder for each update, the corresponding Windows update cannot be uninstalled. Consider the effect that this will have on the computer before you delete the Windows update files.
To delete Windows update files, follow these steps:

1. Delete only those %Windir%/$NtUninstallKB number$ folders that were created more than a month ago as backup files for Windows updates. Do not delete those that were created within the last 30 days.

2. To delete the download cache for Windows updates, delete all the folders in the %Windir%\SoftwareDistribution\download folder that were created more than 10 days ago.

3. Delete the following log files in the %Windir% folder:

o kb*.log

o setup*.log

o setup*.old

o setuplog.txt

o winnt32.log

o set*.tmp

Delete Windows service pack files

Warning If you delete the backup folders for each Windows service pack, you will be unable to uninstall Windows service packs.
If you delete the folder for the installation files and the cache for the Windows service pack, you will be unable to restore corrupted Windows service pack files or to install additional Windows features that are not installed by default. You may want to keep a copy of these files in another location. For more information about how to keep a copy of these files, click the following article number to view the article in the Microsoft Knowledge Base:

271484 (http://support.microsoft.com/kb/271484/ ) Files and folders are added to your system after service pack is installed

Consider the effect that this will have on your computer before you delete these files.
To delete Windows service pack files, follow these steps:

1. Delete the %Windir%\$NtServicePackUninstall$ folder to delete the backup folders for the Windows XP service packs.

2. Delete the %Windir%\ServicePackFiles folder to delete installation files and cache folders for the Windows XP service packs.

956324 How to reclaim disk space on Windows XP and Windows Server 2008-based computers

http://support.microsoft.com/default.aspx?scid=kb;EN-US;956324

Best Regards

Hugo Ferreira

Configuring a Certificate for Virtual Machine Connection in Hyper-V or thru SCVMM:

Hugofe — Tue, 04 Oct 2011 10:31:49 GMT

Configuring a Certificate for Virtual Machine Connection in Hyper-V or thru SCVMM:

Replacing the self-signed certificate used by HYPER-V /SCVMM, with a certificate issued using an Internal Enterprise Certificate Authority.

Windows Server 2008, Windows Server 2008 R2

Tip

These procedures are intended for advanced users; required steps include editing the registry. You should perform these steps only if the default behavior of Hyper-V does not meet the needs or policies of your environment.

One security issue that Hyper-V was designed to address is better protection against “man in the middle” attacks (sometimes referred to as MITM). Use of trusted certificates can help protect against MITM attacks. When you use the Virtual Machine Connection tool or a custom application that uses Remote Desktop Protocol (RDP) ActiveX controls, Hyper-V uses a single-port listener that utilizes trusted certificates for server authentication. (This does not occur when you use the Remote Desktop Connection client, because it does not use the single port listener.) As explained later in this topic, under certain circumstances Hyper-V issues a self-signed certificate that is then used for server authentication. As an alternative to this approach, you can configure Hyper-V to use a different certificate, such as one issued by a certification authority (CA).

Tip

During a MITM attack, a malicious party listens and intercepts communication between two parties, then injects information into the communication stream, without the knowledge of the two communicating parties. This information triggers some action that amounts to a security breach.

Certificate requirements and selection

Hyper-V Virtual Machine Management Service (VMMS) requires that a certificate meet all of the following criteria to be considered a valid certificate. The certificate must have:

A valid certificate chain, which is connected to a trusted root certificate
A “Subject Name” that matches the FQDN of the machine
A purpose of “Server Authentication”
The certificate has to have a Specific Extention else it will not be used by the Hyper–v service.

[Extensions]
1.3.6.1.4.1.311.62.1.1.1 = AgEE

A private key file that includes ‘read’ access for the Virtual Machine group security ID (SID).

When VMMS starts, Hyper-V searches for an existing, valid certificate to prepare for future communication requests. If one is not found, Hyper-V generates a self-signed certificate in the VMMS certificate store. The search for a certificate occurs as follows:

1. First, Hyper-V checks the registry for the thumbprint value of a certificate, under \HKLM\Software\Microsoft\Windows NT\CurrentVersion\Virtualization\AuthCertificateHash. Hyper-V uses this value to try to locate a matching certificate.

2. If no matching, valid certificate is found, Hyper-V checks the certificate store of the computer.

3. If no valid certificate is found in the certificate store of the computer, Hyper-V checks the VMMS certificate store, under Hyper-V Virtual Machine Management Service (VMMS).

4. If the VMMS certificate store does not contain a certificate that is valid for use with Hyper-V, VMMS generates a self-signed certificate in its service certificate store.

Configuring your CA server and obtaining a valid certificate for use with SCVMM.

Note: The VMMS service requires two critical certificates Extension Fields These are:

Field= “Key Usage” Value = “Key Encipherment, Data Encipherment (30)”

Field= “1.3.6.1.4.1.311.62.1.1.1 Value = “02 01 04”

Make sure the usage of the certs contain Key Encipherment and Data Encipherment (30)

Here is how we can get the said “Field” (1.3.6.1.4.1.311.62.1.1.1) in the certificate with the value 02 01 04 using certreq.

Note: We assume you have an Enterprise CA.

· Create a duplicate v2 template (Windows Server 2003) based on “WebServer”, e.g. Web Server 2003 Export.

Execute below set of commands on the certificate server to allow for the Extensions needed.

· Certutil -setreg policy\EnableRequestExtensionList +1.3.6.1.4.1.311.62.1.1.1

· Net stop certsvc

· Net start certsvc.

· On the duplicated v2 certificate template based on “WebServer”, that we were using please make sure the Subject name tab is set to “Supply in the Request”.

Increase the "Validity Period" from General tab and ensure that you have the Allow exporting of the Private key is enabled.

· The please copy the below test to a Request.inf file changing the subject name from test to the name of the server:

[Version]

Signature="$Windows NT$

[NewRequest]

Subject = "CN=test"

KeySpec = 1

KeyLength = 1024

Exportable = TRUE

MachineKeySet = TRUE

KeyUsage = "CERT_KEY_ENCIPHERMENT_KEY_USAGE | CERT_DATA_ENCIPHERMENT_KEY_USAGE"

[Strings]

szOID_ENHANCED_KEY_USAGE = "2.5.29.37"

szOID_PKIX_KP_SERVER_AUTH = "1.3.6.1.5.5.7.3.1"

szOID_CUSTOM = "1.3.6.1.4.1.311.62.1.1.1"

[Extensions]

%szOID_ENHANCED_KEY_USAGE% = "{text}%szOID_PKIX_KP_SERVER_AUTH%"

%szOID_CUSTOM% = "{hex} 02 01 04"

· Once you save the Request.inf execute below command. (from the same directory you copied the file to)

o Certreq –new request.inf request.req ( this will convert the certificate to the correct format )

o Then please copy the content of the request.req file to the certificate request page and submit the certificate to be issued.

o Launch the Certificate in Machine context – select the installed Cert and export with the private key,

o Launch the Certificate in hyper-V service context – import the private key we exported above.

More information http://technet.microsoft.com/en-us/library/cc740063(WS.10).aspx

Then please proceed with the rest of the actions to ensure that you disable self-signing VMMS certificate and set the certificate to be used.

Deploying a certificate issued by a CA

If you do not want to use a self-signed certificate, you can obtain a certificate issued by a certification authority (CA) and then deploy that certificate to use with Hyper-V. The following steps assume that you have obtained a certificate from a CA and stored it in the certificate store of the computer account of the server running Hyper-V.

To deploy a certificate issued by a CA

1. Prevent Hyper-V from generating a self-signed certificate by adding a registry key.

a. Open Windows PowerShell.

b. Run the following command:
reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Virtualization" /v "DisableSelfSignedCertificateGeneration" /f /t REG_QWORD /d 1

Warning

Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer.

2. Check the VMMS certificate store for a self-signed certificate and delete it if it exists.

a. Open the Certificates snap-in.

i. Open Microsoft Management Console. Click Start, click Run, type mmc, and then click OK.

ii. Under the File menu, click Add/Remove Snap-in.

iii. Under Available snap-ins, click Certificates.

iv. Click Service account, and then click Next.

v. Click Local computer and then click Next.

vi. In the Service account list, select Hyper-V Virtual Machine Management and then click Finish.

b. In the navigation pane, expand Certificates. Expand vmms\Personal and then click the Certificates folder.

c. In the details pane (center pane), right-click the certificate and click Delete.

d. Expand vmms\Trusted Root Certification Authorities and click Certificates. Find the copy of the certificate that you deleted in the previous step and delete it from this folder.

e. Close the Certificates snap-in.

3. Find the thumbprint value of new certificate that you want to deploy.

a. Open the Certificates snap-in again to load the certificate store of the computer. Select Computer account, and then complete the wizard to load the certificate store.

b. In the Details pane, double-click the certificate and then click the Details tab.

c. Select Thumbprint. If it does not appear in the list, set Show to <All>.

d. In the text box below the list, copy the hexadecimal value.

e. Paste the string into a text file for use later in this procedure.

4. Open or switch back to Windows PowerShell.

5. Find the private key file of the certificate.

a. Copy the following string and replace thumbprint_value with the string value you copied in the previous step.

the correct command is $certs = dir cert:\ -recurse | ? { $_.Thumbprint -eq "thumbprint_value" }.

b. Run the command.

c. Run the following command to obtain a certificate object:
$cert = @($certs)[0]

d. Run the following command to obtain the private key file name of the certificate:
$location = $cert.PrivateKey.CspKeyContainerInfo.UniqueKeyContainerName

6. Run the following commands in the order shown to modify the access control list (ACL) so that the Virtual Machine group security identifier has read access. Text in quotes in the following commands represents literal values, not placeholder text, and should be included as shown in the command strings.

$folderlocation = gc env:ALLUSERSPROFILE

$folderlocation = $folderlocation + "\Microsoft\Crypto\RSA\MachineKeys\"

$filelocation = $folderlocation + $location

icacls $filelocation /grant "*S-1-5-83-0:(R)"

7. Verify that the Virtual Machine group has read access to the certificate.

a. Switch back to the Certificates snap-in to view the certificate store of the computer account.

b. In the Details pane, right-click the certificate, click All Tasks, and then click Manage Private Keys.

c. Under Group or user names, select Virtual Machines.

d. Under Permissions for Virtual Machines, verify that Read is set to Allow.

8. Run the following commands to set the registry key to the hash value of the certificate:

$thumbprint = $cert.Thumbprint

reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Virtualization" /v "AuthCertificateHash" /f /t REG_BINARY /d $thumbprint

9. If the version of Hyper-V is earlier than the one included in Windows Server 2008 R2, perform the following steps:

a. Run the following commands:
Net stop vmms
Net start vmms

b. Switch to or open Hyper-V Manager. Save the state of each running virtual machine and then restore each one.

Some notes about Hyper-V

1) The Hyper-V management service (VMMS) will automatically create its own local-host based Security Certificate if one does not exist that is currently valid.

2) VMMS will delete any key that is expired from its local Certificate Store.

Best Regards

Hugo Ferreira

Disk Timeout

Hugofe — Wed, 07 Sep 2011 07:34:52 GMT

Hi All

A very important info regarding Disk Timeout,

Disk timeout value: Less is better

The Windows Disk timeout is stored in the following registry key:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Disk\

For example, most array vendors will set this value to (at least) 60 seconds. This means, for all intents and purposes, that Windows will not report any problems with timeouts until at least 60 seconds have passed.

If for some reason, the Fibre Channel frame in question was dropped ,this is further exaggerated by the fact that after this timeout is hit, Storport.sys will retry the I/O operation 8 times at the interval of the timeout for disk.sys, and during this time, since Windows is waiting for the SAN to return data, the operating system may appear to be frozen, depending on what the data was.

This means that with the value of 60 seconds, the effective impact to the user is the following:

· I/O Timeouts will not be exposed in the Windows Event log until after 60 seconds AND the timeouts have expired, so effectively, this translates to an 8 minute delay before the I/O is retried.

While there is not any single rule which will apply equally to everyone in this case, I think most people would agree that waiting 8 minutes is far too long.

Going forward, Microsoft is recommending that the Disk timeout value be set as low as possible, and no greater than 20 to 30 seconds at a maximum. In this way, you can decrease the time to recovery on dropped I/O packets.

Why not just set it to 1 second? I don’t want to wait that long:

Keep in mind that the disk.sys timeout value is a global setting. If you were to set it to 1 second, this would mean that it would also have the effect of allowing only 1 second to spin up a drive which is asleep before reporting a timeout on the device.

It’s also important that this value be set high enough when using systems which are not only using SAN storage. For example, if you were to set the timeout value to 5 seconds on Windows Client operating systems where a SAN is not connected, you would likely see timeout errors which were not actually a problem, such as when a DVD or local disk are spinning up after being asleep. A good starting point to consider using is a value between 10 and 30 seconds.

Clearly, the need for a reasonable value is key, however we would strongly recommend that this be no more than 30 seconds going forward. As with any other change, this is something that should be evaluated for impact in a test environment prior to implementing this in a production environment.

What are the key things to consider when setting the disk timeout value?

The greater this value, the longer it will be before any timeout errors are surfaced by Windows. We would in general recommend setting this value low enough to meet any required SLA’s on the storage, rather than setting it too high.

To drive this point a little further, let’s review a potential scenario:

o Let’s say that I have a SQL Server deployment, and my primary concern is fast I/O to the SQL database. SQL in general requires very short delays on I/O responses, and delays can translate to a delay in client applications built on top of SQL.
In fact SQL Server will generate an Application event any time an I/O takes longer than 15 seconds.

The problem with this approach, is that using the default value of 60 (or more) seconds employed by most array vendors, would prevent you from seeing any System events related to I/O timeouts unless the timeouts are for longer than 60 seconds.
This can make troubleshooting extremely difficult, because on one hand you would have a SQL client application acting slow, and SQL reporting slow I/O, at the same time that there are no events from Windows.
To ensure that these additional system events required for troubleshooting are not lost you would likely want to find a timeout closer to a maximum of 15 seconds that still works well under production workloads without generating excessive event log noise.

If you are using Fibre Channel-based storage, any occurrence of a dropped FC frame will cause all I/O to halt until recovery occurs, or until Storport has exceeded its 8 retry attempts at intervals of the Disk timeout.

So as I mentioned previously, 60 seconds will likely be far too long in this case, as it would translate to a 8 minute outage on a dropped frame.

More Information

Even if you are not using Fibre Channel storage, in most cases, a disk timeout value of 60 seconds would be too long, as it would mask timeout errors far beyond the point where a user could perceive slow access to data.

When troubleshooting issues with storage performance, it may be beneficial to set this slightly lower than normal to increase the chances of catching timeout errors.

Best Regards

Hugo Ferreira

Lista proactiva de updates / proactive recommended updates:

Hugofe — Mon, 05 Sep 2011 15:04:04 GMT

Windows Server 2003 SP2 Cluster

1.1: P1 – CLUSTER SERVER ( BASE & STORAGE & FILE SYSTEM )

Kernel

2393802 MS11-011: Vulnerabilities in Windows Kernel could allow elevation of privilege

http://support.microsoft.com/default.aspx?scid=kb;en-US;2393802

Win32k,gdi32

2506223 MS11-034: Vulnerabilities in Windows Kernel-Mode drivers could allow elevation of privilege: April 12, 2011

http://support.microsoft.com/default.aspx?scid=kb;en-US;2506223

Ntfs

981166 Some data is corrupted when cached and noncached I/O operations occur by using the same NTFS file handle

http://support.microsoft.com/default.aspx?scid=kb;EN-US;981166

Storport

Storport : check with SAN provider OEM in order to use the latest storport validated by the OEM

957910 A Windows Server 2003 SP2-based iSCSI boot server cannot generate dump files if the server uses a Storport virtual miniport as the LUN controller

http://support.microsoft.com/default.aspx?scid=kb;EN-US;957910

On HP ProLiant Server platform please check for:

· latest hpcisss2 .sys (=> version 6.14.0.32/64 from 7-Jan-2009)

· latest E200/E200i firmware (=> rev. 1.82, from 17-Apr-2009)

HP Server http://support.microsoft.com/kb/940015

hpcisss2.sys You receive a Stop error message after you install update 932755 or 941276 on an HP ProLiant server that is running Storport in Windows Server 2003

Ref HP: hpcisss2.sys, build date 7-Jan-2009, version 6.14.0.32/64

HP Server http://support.microsoft.com/kb/969550

E200/E200i Stop error messages after Memory Corruption on several HP ProLiant servers, firmware due to a problem with firmware of E200/E200i (HP Smart Array SAS/SATA Controller)

Ref HP : E200/E200i firmware rev. 1.82, 17-Apr-2009

Mountmgr.sys

940307 A Microsoft Windows Server 2003-based computer may stop responding if an application frequently uses the mount manager to query volume information

http://support.microsoft.com/default.aspx?scid=kb;EN-US;940307

Disk.sys

929161 You receive a Stop error message on a Windows Server 2003 SP1 or Windows Server 2003 SP2-based computer when a device is suddenly disconnected from a host bus adapter

http://support.microsoft.com/default.aspx?scid=kb;EN-US;929161

ScsiPort.sys

934848 If you load the Intel iSCSI Setup driver for an iSCSI disk during Windows Server 2003 installation, the installation program reports that no disk is detected, and the installation process fails

http://support.microsoft.com/default.aspx?scid=kb;EN-US;934848

Dmadmin.exe

957271 The Logical Disk Manager Administrative Service process may stop unexpectedly on a Windows Server 2003-based computer

http://support.microsoft.com/kb/957271

Vds.exe

960831 Drivers or hardware providers that use the Virtual Disk Service to manage hardware LUN IDs encounter exceptions after a disk is physically removed from a computer that is running Windows Server 2003

http://support.microsoft.com/kb/960831

Clusdisk.sys / Clusres.dll

Rollup Cluster

919117 A hotfix is available that adds support for GUID partition table (GPT) volumes that are larger than 2 terabytes on a Windows Server 2003-based server cluster

http://support.microsoft.com/kb/919117

982438 You cannot install AD DS in Windows Server 2008 in a Windows Server 2003-based domain if another computer that is in the same domain has MSCS installed

http://support.microsoft.com/default.aspx?scid=kb;EN-US;982438

Resrcmon.exe

948701 The Resource Monitor may crash on a Windows Server 2003-based cluster node that has Windows Server 2003 SP2 or hotfix 921181 installed

http://support.microsoft.com/default.aspx?scid=kb;EN-US;948701

SNP

948496 (http://support.microsoft.com/kb/948496/ ) An update to turn off default SNP features is available for Windows Server 2003-based and Small Business Server 2003-based computers

http://support.microsoft.com/kb/948496

1.2: P2 – CLUSTER SERVER ( BASE & STORAGE & FILE SYSTEM )

Dfssvc.exe

945050 The private bytes that the DFS service consumes continue to increase on a Windows Server 2003-based domain controller that hosts the PDC emulator role

http://support.microsoft.com/kb/945050

Dfs.sys

938666 Event ID 2019 is logged in the System log when a DFS domain root server stops responding on a Windows Server 2003-based server

http://support.microsoft.com/kb/938666

Localspl.dll

955455 The print process crashes under heavy stress on a computer that is running Windows Server 2003 or Windows XP Professional x64 Edition if the computer uses hyper-threading technology

http://support.microsoft.com/kb/955455

Local security policy

902069 You may receive a "Stop 0x0000000A" error message when you shut down or restart a computer that is running Windows Server 2003

http://support.microsoft.com/kb/902069

COM+

934016 (http://support.microsoft.com/kb/934016/ ) Availability of Windows Server 2003 Post-Service Pack 2 COM+ 1.5 Hotfix Rollup Package 12

http://support.microsoft.com/kb/934016

All the previous mentioned updates include the latest versions of the 935640,

Recommended hotfixes for Windows Server 2003 Service Pack 2- based server clusters

http://support.microsoft.com/kb/935640

2 - Windows Server 2008 SP1 / SP2 Cluster

2.1 : P1 – CLUSTER SERVER ( BASE & STORAGE & FILE SYSTEM )

KERNEL

2295810 The shutdown process may stop responding in Windows Server 2008 SP2 or in Windows Vista SP2 after you enable the "Shutdown: Clear virtual memory page file" Group Policy setting

http://support.microsoft.com/default.aspx?scid=kb;en-US;2295810

FLTMGR

975759 An application or service that uses a file system filter driver may experience function failure on a computer that is running Windows Vista, Windows Server 2003, or Windows Server 2008

http://support.microsoft.com/default.aspx?scid=kb;EN-US;975759

NTFS

2525064 Ntfs.sys driver takes a long time to mount a large volume in Windows Vista or in Windows Server 2008

http://support.microsoft.com/default.aspx?scid=kb;en-US;2525064

STORPORT

983554 "0x000000BE" Stop error message when you use the Storport.sys driver to manage some storage devices in Windows Server 2008, in Windows Vista, in Windows 7 or in Windows Server 2008 R2

http://support.microsoft.com/default.aspx?scid=kb;EN-US;983554

Storport: check with SAN provider OEM in order to use the latest storport validated by the OEM

HP ProLiant servers:

check for latest E200/E200i firmware (=> rev. 1.82, 17-Apr-2009, or higher)

check for latest hpcisss2 .sys (=> version 6.14.0.32/64 from 7-Jan-2009 or higher)

A Stop error occurs on an HP ProLiant server that has the firmware from an E200/E200i HP Smart Array SAS/SATA controller installed on any Windows Server platform

Ref HP: E200/E200i firmware rev. 1.82, 17-Apr-2009

http://support.microsoft.com/kb/969550/en-us

MPIO

2406705 Some I/O requests to a storage device fail on a fault-tolerant system that is running Windows Server 2008 or Windows Server 2008 R2 when you perform a surprise removal of one path to the storage device

http://support.microsoft.com/default.aspx?scid=kb;en-US;2406705

check with DSM/SAN provider OEM in order to use the latest mpio validated by the OEM

MSDSM

2277440 Stop error message “0x000000D1” occurs in MSDSM.sys on a computer that is running Windows Server 2008

http://support.microsoft.com/default.aspx?scid=kb;en-US;2277440

MOUNTMGR

977153 Error message: When you unmount volumes, delete snapshots or try to fail over disks on which snapshots are saved: "0x00000D6 DRIVER_PAGE_FAULT_BEYOND_END_OF_ALLOCATION"

http://support.microsoft.com/default.aspx?scid=kb;EN-US;977153

VOLSNAP

2279787 Event ID 82 may be recorded in the System log after you extend the protected dynamic volume on a computer that is running Windows Vista or Windows Server 2008

http://support.microsoft.com/kb/2279787/en-us

VSS

955928 A parallel backup operation may fail when the operation is performed by Volume Shadow Copy Service (VSS)

http://support.microsoft.com/kb/975928/en-us

VSSVC

983425 The System State backup operation fails together with the "0x800423f3" error in Windows Server 2008 and in Windows Vista

http://support.microsoft.com/kb/983425/en-us

NETSH

979101 The command "netsh interface ipv4 dump" does not export the subnet mask setting in Windows 7, in Windows Server 2008 R2, in Windows Server 2008, and in Windows Vista

http://support.microsoft.com/kb/979101/en-us

TCPIP

2469100 Manually added route table entries are deleted unexpectedly when you delete an additional IP address in Windows Vista or in Windows Server 2008

http://support.microsoft.com/kb/2469100/en-us

TCPIP

MS10-058: Vulnerabilities in TCP/IP could allow elevation of privilege http://support.microsoft.com/kb/978886/en-us

NDIS

Stop error message on a computer that is running Windows Vista or Windows Server 2008: "STOP: 0x0000007F"

http://support.microsoft.com/kb/972907/en-us

AFD

A memory leak occurs when a Winsock API function is called together with the TF_REUSE_SOCKET flag in Windows Server 2008 and in Windows Vista

http://support.microsoft.com/kb/977332/en-us

MRXSMB

You cannot access shared files or shared printers that are hosted on a remote server in Windows Server 2008 or in Windows Vista

http://support.microsoft.com/kb/2251180/en-us

RDBSS

A deadlock in Rdbss.sys occurs while a Windows Server 2008 SP2-based or Windows Vista-based computer is performing a FastWrite

http://support.microsoft.com/kb/2488754/en-us

SRVNET /SRV2 /SRV

A Windows Vista-based, Windows Server 2008-based, Windows 7-based or Windows Server 2008 R2-based computer that shares some files and some folders may not respond to file share requests

http://support.microsoft.com/kb/2492806/en-us

SRVNET / SRV2 /SRV

MS10-054: Vulnerabilities in SMB Server could allow remote code execution

http://support.microsoft.com/kb/982214/en-us

RPCRT4

An access violation exception occurs in the "NdrClientCall2" function in Windows Vista or in Windows Server

2008

http://support.microsoft.com/kb/2023170/en-us

RPCRT4

MS09-026: Vulnerability in RPC could allow elevation of privilege

http://support.microsoft.com/kb/970238/en-us

WMI

The WMI repository is corrupted on a computer that is running Windows Server 2008 or Windows Vista

http://support.microsoft.com/kb/2464876/en-us

CLASPNP / PARTMGR

PhysicalDisk counters contain invalid and duplicate entries when you use Microsoft Multipath I/O (MPIO) to control one or more storage devices

http://support.microsoft.com/kb/974878/en-us

CLUSSVC

Failback does not occur within the set time period in a Windows Server 2008-based failover cluster

http://support.microsoft.com/kb/982636/en-us

CLUSRES

Authentication requests between nodes in the same cluster may be unable to use the Kerberos protocol if the Negotiate SSP is specified

http://support.microsoft.com/kb/982549/en-us

CLUSRES / VOLSNAP

The failover operation takes a long time to fail over a shared disk resource that is located on a cluster node of a Windows Server 2008-based failover cluster if many snapshots are saved on the shared disk http://support.microsoft.com/kb/973763/en-us

We recommend that you install the following Windows Server 2008 hotfixes, depending on your environment:

952247 (http://support.microsoft.com/kb/952247/ ) The Cluster network name resource and the File Share Witness resource may not come

951308 (http://support.microsoft.com/kb/951308/ ) Increased functionality and virtual machine control in the Windows Server 2008 Failover Cluster Management console for the Hyper-V role

950179 (http://support.microsoft.com/kb/950179/ ) When you run the Validate a Configuration Wizard on a Windows Server 2008-based computer or on a Windows Vista-based computer, the validation does not pass

969550 (http://support.microsoft.com/kb/969550/ ) A Stop error occurs on an HP ProLiant server that has the firmware from an E200/E200i HP Smart Array SAS/SATA controller installed on any Windows Server platform

970529 (http://support.microsoft.com/kb/970529/ ) The volume GUID may unexpectedly change after a volume is extended on a Windows Server 2008 failover cluster node

953652 (http://support.microsoft.com/kb/953652/ ) A physical disk resource may unexpectedly fail or go offline when the IsAlive function is executed on a Windows Server 2008 cluster node

Recommended hotfixes for Windows Server 2008-based server clusters

http://support.microsoft.com/kb/957311

3 - Windows Server 2008 R2 RTM / SP1 Cluster

3.1 : P1 – CLUSTER SERVER ( BASE & STORAGE & FILE SYSTEM )

Kernel

2417038 A child process cannot be created by calling a CreateProcess function that uses the PROC_THREAD_ATTRIBUTE_PREFERSec_NODE parameter in Windows 7 or in Windows Server 2008 R2

http://support.microsoft.com/kb/2417038/en-us

w2k8 / w2k8r2 :Cluster Disk May Fail and Run ChkDsk when a Backslash ‘\’ or Forwardslash ‘/’ is used in the Resource Name

Hugofe — Thu, 01 Sep 2011 15:11:45 GMT

Hi All

In rare circumstances with 2008 R2 clusters where a ‘Physical Disk’ resource may fail to come online with no events logged in the system event log.

Cluster Disk May Fail to Online and Run ChkDsk when a Backslash ‘\’ or Forwardslash ‘/’ is used in the Resource Name

Issue

They symptoms of this issue is that the disk will show in a ‘failed’ state in Failover Cluster Manager but there are no events in the system event log to correlate to the failure.

To see if you are running into this issue, you need to generate a cluster log on the node the disk fails.

From a command prompt:

‘cluster log /gen’

From the cluster log file located in \Windows\Cluster\Reports\cluster.log

ERR [RES] Physical Disk <Cluster Disk X:\>: VerifyFS: Failed to open file \\?\GLOBALROOT\Device\Harddisk52\Partition1\Logfile.ldf Error: 5.

The problem occurs if and only if the following 2 conditions are present.

1. ‘Local System’ cannot open a handle to a file at root of drive (whether because it’s in use or permissions).

In my example, you can see from the cluster log snippet that the file the cluster is trying to open is Logfile.ldf and getting an access denied ‘Error: 5’

AND

2. The name of the ‘Physical Disk’ resource has an backslash or forward slash character in the resource name. In my example, my disk name was ‘Cluster Disk X:\’

Generally, we don’t recommend storing files at the root of a disk as the cluster needs to open handles to files and folders as part of the health detection mechanism used to determine possible access issues to storage. Since the cluster service runs in the context of the ‘Local System’ account, if that account does not have permission to files at the root of a drive, the health check may fail.

Workaround

The simplest resolution is to remove the invalid character(s) in resource names for ‘Physical Disk’ resource types.

Verify that the ‘Local System’ account has at least ‘Read’ permissions to files at the root of the drive.

In the above example, I renamed my resource from ‘Cluster Disk X:\’ to ‘Cluster Disk X:’. I could have also granted the ‘Local System’ account ‘Read’ permissions on the Logfile.ldf file

This does not indicate actual corruption on the disk. What happened is that cluster set the dirty bit on the disk so chkdsk is run to verify an intact file system.

Best Regards

Hugo Ferreira

Backup Hyper-V virtual machines on Windows Server 2008 by using Windows Server Backup

Hugofe — Thu, 01 Sep 2011 14:59:51 GMT

Hi All

I have recently come upon some settings that we can add to allow us to perform the backups of our virtual machines in windows 2008,

How to backup Hyper-V virtual machines from the parent partition on a Windows Server 2008-based computer by using Windows Server Backup

This article describes how to back up Hyper-V virtual machines from the parent partition on a Windows Server 2008-based computer by using Windows Server Backup.
To back up Hyper-V virtual machines from the parent partition on Windows Server 2008 by using Windows Server Backup, you must register the Microsoft Hyper-V VSS writer with Windows Server Backup.

To register the Microsoft Hyper-V VSS writer with Windows Server Backup automatically, click the Fix it button or link. Click Run in the File Download dialog box, and then follow the steps in the Fix it wizard.

Fix this problem
Microsoft Fix it 50211

To register the Hyper-V VSS writer with Windows Server Backup, follow these steps:

1. Click Start, click Run, type regedit, and then click OK.

2. Locate the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion

3. Right-click CurrentVersion, point to New, and then click Key.

4. Type WindowsServerBackup, and then press ENTER.

5. Right-click WindowsServerBackup, point to New, and then click Key.

6. Type Application Support, and then press ENTER.

7. Right-click Application Support, point to New, and then click Key.

8. Type {66841CD4-6DED-4F4B-8F17-FD23F8DDC3DE}, and then press ENTER.

9. Right-click {66841CD4-6DED-4F4B-8F17-FD23F8DDC3DE}, point to New, and then click String Value.

10. Type Application Identifier, and then press ENTER.

11. Right-click Application Identifier, and then click Modify.

12. In the Value data box, type Hyper-V, and then click OK.

13. On the File menu, click Exit.

Back up the virtual machines by using Windows Server Backup

When you perform a backup of the virtual machines, you must back up all volumes that host files for the virtual machine, including the InitialStore.xml file (in C:\ProgramData\Microsoft\Windows\Hyper-V, by default) and the volume(s) containing the VHD(s) and configuration XML files. For example, if the virtual machine configuration files are stored on the D: volume, and the virtual machine virtual hard disk (VHD) files are stored on the E: volume, and InitialStore.xml file is stored on the C: volume, you must back up the C:, D: and E: volumes.
Virtual machines that do not have Integration Services installed will be put in a saved state while the VSS snapshot is created.
Virtual machines that are running operating systems that do not support VSS, such as Microsoft Windows 2000 or Windows XP, will be put in a saved state while the VSS snapshot is created.
Virtual machines that contain dynamic disks must be backed up offline.

Note: Windows Server Backup does not support backing up Hyper-V virtual machines on Cluster Shared Volumes (CSV volumes).

Restore virtual machines by using Windows Server Backup

To restore the virtual machines, follow these steps:

1. Start Windows Server Backup in Administrative Tools.

2. On the Actions menu, click Recover.

3. Select the server that you want to recover data from, and then click Next.

4. Select the date and time that you want to restore from, and then click Next.

5. Select the Applications recovery type, and then click Next.

6. Select Hyper-V, and then click Next.

7. Select the restore location, and then click Next.

8. Click Recover to start the restore process.

Note All volumes that host files for the virtual machine will be restored. Individual virtual machines cannot be restored by using Windows Server Backup.
Virtual machines that contain two or more snapshots will not be restored. To work around this issue, follow these steps:

1. Start Hyper-V Manager in Administrative Tools.

2. Delete the virtual machine that was not restored.

3. Start Windows Server Backup in Administrative Tools.

4. On the Actions menu, click Recover.

5. Select the server that you want to recover data from, and then click Next.

6. Select the date and time that you want to restore from, and then click Next.

7. Select the Files and folders recovery type, and then click Next.

8. Select the directory where the snapshots are stored, and then click Next.
Note By default, the snapshots are located in the following directory:

C:\ProgramData\Microsoft\Windows\Hyper-V\Snapshots

9. Select the location where the snapshots should be restored, and then click Next.

10. Click Recover to start the restore process.

11. After the restore has finished, perform another restore. However, use the Applications recovery type, and select Hyper-V to correctly restore the virtual machines.

Best Regards

Hugo Ferreira

Properly Enable the Dynamic memory in Hyper

Hugofe — Tue, 05 Jul 2011 09:07:25 GMT

Hi All

If We are often having Memory issues in Hyper-V,

here is a Step by Step to maximize the current HW and Properly Enable the Dynamic memory in Hyper, this will allow us to Run much more VM´s then we where before

I have seen many people have the Dynamic Memory feature enable but not being properly configured/used,

How to Properly Use Dynamic Memory J

Example:

W2k8r2 DC - NOK

DFS is OK, Do you see the difference?

Install Windows Server 2008 R2 SP 1 in the HOST operating system.

Configure Dynamic Memory, Startup Value

Windows Server 2008 R2 Enterprise Edition	512 MB
Windows Server 2008 R2 Datacenter Edition	512 MB
Windows 7 Ultimate Edition	512 MB
Windows 7 Enterprise Edition	512 MB
Windows Server 2008 Enterprise Edition	512 MB
Windows Server 2008 Datacenter Edition	512 MB
Windows Vista Ultimate Edition	512 MB
Windows Vista Enterprise Edition	512 MB
Windows Server 2003 R2 Enterprise Edition	128 MB
Windows Server 2003 R2 Datacenter Edition	128 MB
Windows Server 2003 Enterprise Edition	128 MB
Windows Server 2003 Datacenter Edition	128 MB

1. Shut down each virtual machine that you want to enable Dynamic Memory on.

2. Open the settings window for each virtual machine. From Hyper-V Manager, right-click the virtual machine and click Settings.

3. In the left pane, under Hardware, click Memory.

4. On the Memory page, under Memory Management, click Dynamic.

5. Set the amount of memory for Startup RAM and Maximum RAM. For Startup RAM, refer to the table in the Table,

For Maximum RAM, use a value that allows for additional memory (4096 More than OK Normally )as needed but not more than what you would want the virtual machine to consume.

6. If you want to adjust the memory buffer for the virtual machine, use the slider to set the percentage of memory.

7. If you want to give this virtual machine a higher or lower priority for memory allocation compared to other virtual machines running on this server, use the slider to set the relative weight.

8. Turn on the virtual machine.

Upgrading the integration services inside the virtual machine

1. Boot the virtual machine

2. Connect using the Virtual Machine Connection window from the Hyper-V manager

3. Log in with an account that has local administrator rights on the virtual machine

4. Open the Action menu and select Insert Integration Services Setup Disk

6. Depending on the guest operating system you are running – you may need to select to start the integration services installer (or it may run automatically)

When prompted to upgrade the Hyper-V integration services – click OK

8. When the installation is completed and you are prompted to reboot – click No

9. Now RESTART the virtual machine

EXTRA:

Hyper-V Manager.

Assigned Memory shows how much physical memory is allocated to the virtual machine at this time.
The Memory Demand column shows how much memory the virtual machine needs at this time to meet the requirements of the active processes running in the virtual machine. This amount represented the total committed memory based on data obtained from performance counters.
Memory Status shows how much of the buffer amount specified for the virtual machine is available to the virtual machine at this time. Status is reported as one of the following:

· OK indicates that there is enough physical memory available to give the virtual machine the full amount of memory buffer.

· Low indicates that the current amount of memory assigned to the virtual machine as a buffer is lower than amount that Hyper-V determines should be available as a buffer.

· Warning indicates that there is not enough physical memory available to assign any memory buffer to the virtual machine.

Best Regards

Hugo Ferreira

Bitlocker without TPM:

Hugofe — Fri, 29 Oct 2010 09:39:37 GMT

Bitlocker without TPM:

BitLocker provides the most protection when used with a Trusted Platform Module (TPM) version 1.2. The TPM is a hardware component installed in many newer computers by the computer manufacturers. It works with BitLocker to help protect user data and to ensure that a computer has not been tampered with while the system was offline.

On computers that do not have a TPM version 1.2, you can still use BitLocker to encrypt the Windows operating system drive. However, this implementation will require the user to insert a USB startup key to start the computer or resume from hibernation, and it does not provide the pre-startup system integrity verification offered by BitLocker with a TPM.

In addition to the TPM, BitLocker offers the option to lock the normal startup process until the user supplies a personal identification number (PIN) or inserts a removable device, such as a USB flash drive, that contains a startup key. These additional security measures provide multifactor authentication and assurance that the computer will not start or resume from hibernation until the correct PIN or startup key is presented.

Hardware, firmware, and software requirements

To use BitLocker, a computer must satisfy certain requirements:

For BitLocker to use the system integrity check provided by a TPM, the computer must have a TPM version 1.2. If your computer does not have a TPM, enabling BitLocker will require you to save a startup key on a removable device such as a USB flash drive.
A computer with a TPM must also have a Trusted Computing Group (TCG)-compliant BIOS. The BIOS establishes a chain of trust for pre-operating system startup and must include support for TCG-specified Static Root of Trust Measurement. A computer without a TPM does not require a TCG-compliant BIOS.
The system BIOS (for TPM and non-TPM computers) must support the USB mass storage device class, including reading small files on a USB flash drive in the pre-operating system environment. For more information about USB, see the USB Mass Storage Bulk-Only and the Mass Storage UFI Command specifications on the USB Web site (http://go.microsoft.com/fwlink/?LinkId=83120).
The hard disk must be partitioned with at least two drives:

· The operating system drive (or boot drive) contains the operating system and its support files; it must be formatted with the NTFS file system.

· The system drive contains the files that are needed to load Windows after the BIOS has prepared the system hardware. BitLocker is not enabled on this drive. For BitLocker to work, the system drive must not be encrypted, must differ from the operating system drive, and must be formatted with the NTFS file system. The system drive should be at least 1.5 gigabytes (GBs).

Installation and initialization:

· By default, the BitLocker setup wizard is configured to work seamlessly with the TPM. An administrator can use Group Policy or a script to enable additional features and options.

For enhanced security, you can combine the use of a TPM with either a PIN entered by the user or a startup key stored on a USB flash drive.

On computers without a compatible TPM, BitLocker can provide encryption, but not the added security of locking keys with the TPM.

In this case, the user is required to create a startup key that is stored on a USB flash drive.

Hence without a Flash Drive, you cannot get even the recovery screen as Flash drive is mandatory to even get the screen to enter the key.

To enable BitLocker on a computer without a TPM, you must enable the Require additional authentication at setup Group Policy setting, which is located in Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives.

You must select the Allow BitLocker without a compatible TPM check box. After this setting is applied to the local computer, the non-TPM settings appear in the BitLocker setup wizard.

Try to uncheck the option under gpedit, then reboot, then check again if you can use a usb flash as crypt key

I would suggest you to disable the settings and then re-apply it. Follow the directions in the link given below.

Step 1: What Group Policy settings are used with BitLocker?

http://windows.microsoft.com/en-US/windows7/What-Group-Policy-settings-are-used-with-BitLocker

Step 2: BitLocker Drive Encryption in Windows 7: Frequently Asked Questions

http://technet.microsoft.com/en-us/library/ee449438(WS.10).aspx#BKMK_HSRequirements

You may have to change few settings in Group Editor Policy on your computer in order to enable Bitlocker, follow the steps below:

1. Click on Start>> type in gpedit.msc in the Start Search.

2. Click on Computer Configuration>>click Administrative Templates>>click Windows Components>>click on Bitlocker Drive Configuration

3. Now right click on Control Panel: Enable advanced Startup Options and select Properties.

4. Put a check for “Allow Bitlocker without compatible TPM chip”.

Now reboot the computer and check if you are able to use

How To Use BitLocker on Drives without TPM

BitLocker is an encryption feature available in Ultimate and Enterprise versions of Windows 7 and Vista, but requires a Trusted Platform Module (TPM) on the system. Not all systems include TPM and today we take a look at how to bypass it so you can use BitLocker.

Enable BitLocker

You can use BitLocker to encrypt an entire fixed drive, such as the local drive Windows is installed on or an internal data drive. For removable flash or external USB drives you can use its younger brother, BitLocker To Go. First let’s take a look at how to enable BitLocker on a local hard drive.

To encrypt an entire drive, simply right-click on the drive and select Turn on BitLocker from the context menu.

Next you’ll need to choose a secure password that will be used to access the drive.

You’re prompted to store the recovery key which is used in the event you lose your password or smartcard. If you store it as a file make sure that it’s not on the same drive that you’re encrypting.

Confirm you want the drive to be encrypted then wait until the process is complete. The amount of time it takes will vary based on the size and amount of data on the drive.

To access the encrypted drive you’ll need to enter in the password to unlock it.

The drive icon will change to show it’s encrypted with BitLocker, where the gold lock indicates it’s locked up and the gray lock is displayed after you have unlocked it.

Use BitLocker on a Drive Without TPM

If you have a drive that doesn’t have a compatible TMP then you’ll need to use the following steps and have a flash drive.

Enter in gpedit.msc in the search box of the Start menu and hit Enter.

Under Local Computer Policy navigate to:

Computer Configuration \ Administrative Templates \ Windows Components \ Bit Locker Drive Encryption \ Operating System Drives and double click on Require additional authentication at startup.

Enable the feature and check the box next to Allow BitLocker without a compatible TPM, click Apply and Ok, and close out of Local Group Policy Editor.

Go back to the hard drive you want to encrypt and turn on BitLocker.

A restart will be required to prepare the disk, and at this point make sure the flash drive is plugged in.

After the restart you’re prompted to use the startup key on the flash drive every time you start the computer.

Select the drive you want to use to store the key.

Hope this helps

Look forward to hearing from you.

Hugofe

October List of VMM / Failover Cluster / Hyper-V Updates:

Hugofe — Thu, 28 Oct 2010 12:26:33 GMT

October List of VMM / Failover Cluster / Hyper-V Updates:

This article includes a list of System Center Virtual Machine Manager (VMM) updates that the VMM 2008 and 2008 R2 Configuration Analyzer (VMMCA) checks for, and a list of recent VMM-related updates that are not verified by the VMMCA tool.

Updates that the VMMCA already verifies

VMMCA checks to see whether the following updates are installed on the VMM server:

VMMCA checks to see whether the following updates are installed on VMM hosts:

VMMCA checks to see whether the following Hyper-V updates are installed on Hyper-V hosts that are managed by VMM:

VMMCA checks to see whether the following Failover Cluster Management updates are installed on clustered hosts that are managed by VMM:

Updates that are not verified by the VMMCA

The following list includes recent updates that are not verified by the VMMCA. The list is organized into updates that apply to specific versions of VMM and updates that apply to specific operating system versions.

System Center Virtual Machine Manager 2008 R2

VMM Server
- 2308590 - Description of the System Center Virtual Machine Manager 2008 R2 hotfix rollup package: September 14, 2010 (supersedes 982522)
VMM Admin Console
- 982523 - Description of the System Center Virtual Machine Manager 2008 R2 Admin Console hotfix rollup package: June 8, 2010 (supersedes 976246)

System Center Virtual Machine Manager 2008

Windows Server 2008 R2

Windows Server 2008

Area: WMI/Failover Cluster
Applies to: Windows Server 2008, Windows Server 2008 with SP2
968936 - A rollup hotfix package for Windows Server 2008 Failover Clustering WMI provider
Area: WMI/Failover Cluster
Applies to: Windows Server 2008, Windows Server 2008 with SP2
971403 - The "Win32_share" WMI class cannot enumerate file shares or create file shares on a node in a Windows Server 2008 failover cluster
Area: WMI
Applies to: Windows Server 2008
954563 - Memory corruption may occur with the Windows Management Instrumentation (WMI) service on a computer that is running Windows Server 2008 or Windows Vista Service Pack 1
Area: WMI
Applies to: Windows Server 2008, Windows Server 2008 with SP2
970520 - The Wmiprvse.exe process creates a memory leak on a computer that is running Windows Server 2008 if you remotely monitor this process by using the WMI interface on a computer that is running Windows Server 2003 or Windows XP
Area: WinRM
Applies to: Windows Server 2008, Windows Server 2008 with SP2
971244 - Windows Remote Management (WinRM) does not accept HTTP authorization requests that are larger than 16 KB on a computer that is running Windows Server 2008 or Windows Vista
Area: Cluster
Applies to: Windows Server 2008, Windows Server 2008 with SP2
951308 - Increased functionality and virtual machine control in the Windows Server 2008 Failover Cluster Management console for the Hyper-V role
Area: Cluster
Applies to: Windows Server 2008, Windows Server 2008 with SP2
970529 - The volume GUID may unexpectedly change after a volume is extended on a Windows Server 2008 failover cluster node
Area: WMI
Applies to: Windows Server 2008
958124 - A wmiprvse.exe process may leak memory when a WMI notification query is used heavily on a Windows Server 2008-based or Windows Vista-based computer
Area: WMI
Applies to: Windows Server 2008
955805 - Certain applications become very slow on a Windows Server 2008-based or Windows Vista SP1-based computer when a certificate with the SIA extension is installed
Area: WMI
Applies to: Windows Server 2008
954563 - Memory corruption may occur with the Windows Management Instrumentation (WMI) service on a computer that is running Windows Server 2008 or Windows Vista Service Pack 1
Area: WMI
Applies to: Windows Server 2008
968936 - A rollup hotfix package for Windows Server 2008 Failover Clustering WMI provider
Area: WMI
Applies to: Windows Server 2008
971403 - The "Win32_share" WMI class cannot enumerate file shares or create file shares on a node in a Windows Server 2008 failover cluster
Area: WMI
Applies to: Windows Server 2008
970520 - The Wmiprvse.exe process creates a memory leak on a computer that is running Windows Server 2008 if you remotely monitor this process by using the WMI interface on a computer that is running Windows Server 2003 or Windows XP

Windows Server 2003

Area: Windows Remote Management (WinRM)
Applies to: Windows Server 2003 with SP1, Windows Server 2003 with SP2
936059 - An update is available for the Windows Remote Management feature in Windows Server 2003 and in Windows XP

Additional resources

For a list of recent Knowledge Base articles related to virtualization, see the Wiki article List of Microsoft Support Knowledge Base Articles related to Microsoft Virtualization Technologies for 2010.
For a list of Hyper-V updates in Windows Server 2008 R2, see the TechNet article Hyper-V Update List for Windows Server 2008 R2.

HugoFe

Erro ao adicionar driver x86 em servidor x64:

Hugofe — Mon, 25 Oct 2010 12:52:40 GMT

Erro ao adicionar driver x86 num servidor x64:

Qual é o problema?

Ao tentar instalar drivers adicionais (x86) no servidor de impressão Windows 2008 R2 x68 ele apresenta a seguinte mensagem de erro: "The folder you specified doesn't contain a compatible software driver for your device. If the folder contains a driver, make sure it is designed to work with Windows for x64-based systems." essa mensagem aparece para qualquer driver x86 que se tenta adicionar no servidor.

Windows Server 2008 /2008 R2,

- Logon to an x86 Windows XP/… machine with an account which is an admin.

- Connect to the print server using the UNC path \\PrintServer

- You will see the printers and faxes folder among others

- Open the Printers and Faxes folder

- Go to File--> server properties -> Drivers tab and do an Add driver

- Select Have Disk and point it to the driver location to install the driver on the x64 bit print server.

HugoFe

New SCVMM VMM 2008 R2 rollup September 2010

Hugofe — Thu, 16 Sep 2010 12:08:55 GMT

Hi All,

A new VMM 2008 R2 rollup is now published and available thru Microsoft Update.

Description of the System Center Virtual Machine Manager 2008 R2 hotfix rollup package: September 14, 2010

http://support.microsoft.com/kb/2308590

in this rollup:

Missing VM caused by a crash of a Hyper-V node and out-of-band failover

Cannot create VM on cluster shared volume if the host is configured to boot from VHD

Changing PRO Settings on a HostGroup with External MP imported causes VMMserver to crash

List of issues that are resolved

Issue 1

Duplicate virtual machines (VMs) may appear in the SCVMM Administrator Console window after a Hyper-V VM in a cluster fails over to another cluster node. Additionally, the status for one of the duplicate VMs is set to Missing. If you try to remove the missing VM from the SCVMM Administrator Console window, the VM is not removed.

Issue 2

Consider the following scenario:

You install the Hyper-V role on a computer that is running Windows Server 2008 R2.
You configure the computer to start from a virtual hard disk.
The computer is part of a Hyper-V failover cluster. The cluster is configured to use cluster shared volumes.
You try to create a VM on a cluster shared volume by using SCVMM 2008 R2.

In this scenario, the operation fails together with the 2912 (0x8004232C) error code.

Issue 3

The Virtual Machine Manager service (Vmmservice.exe) crashes if the following conditions are true:

System Center Operations Manager 2007 integration is enabled.
A Performance and Resource Optimization (PRO) feature-enabled management pack is imported into Operations Manager.
The PRO settings for a host group are changed on the SCVMM server.

This hotfix rollup package includes also the hotfixes that are documented in the following SCVMM 2008 R2 hotfix rollup packages:

982522 (http://support.microsoft.com/kb/982522/ ) Description of the System Center Virtual Machine Manager 2008 R2 hotfix rollup package: June 8, 2010

978560 (http://support.microsoft.com/kb/978560/ ) Description of the System Center Virtual Machine Manager 2008 R2 hotfix rollup package: February 9, 2010

976244 (http://support.microsoft.com/kb/976244/ ) Description of the System Center Virtual Machine Manager 2008 R2 hotfix rollup package: November 10, 2009

How to obtain this SCVMM 2008 R2 hotfix rollup package

This hotfix rollup package is available on Microsoft Update.
To obtain this update from Microsoft Update, follow these steps on the SCVMM server:

1. Click Start, and then select Control Panel.

2. In Control Panel, double-click Windows Update.

3. In the Windows Update window, click Check Online for updates from Microsoft Update.

4. Click important updates are available.

5. Select Update for System Center Virtual Machine Manager 2008 R2 (KB2308590), and then click OK.

6. Click Install updates.

Note If the Virtual Machine Manager or Virtual Machine Manager Agent service is running when this hotfix rollup package is installed on the SCVMM server, you have to restart the computer.

How to update the SCVMM agent on the Hyper-V and Virtual Server host

This update requires updating the VMM agent on the Hyper-V and Virtual Server hosts. The hosts will have a status of Needs Attention if the agent has not been updated.
To update the SCVMM agent on multiple hosts, follow these steps:

1. Open the SCVMM Administrator Console window.

2. Click Administration, and then click Managed Computers.

3. Select the hosts, and then click Update Agent.

4. Enter your user account credentials, and then click OK.

Thanks

Hugo

Unable to perform P2V actions in Hyper-V VMM 2008 R2 - 2901 / 0x80070057

Hugofe — Fri, 09 Jul 2010 08:05:29 GMT

In case you see this one:

Physical to Virtual Conversion with Hyper-V VMM 2008 R2,

Succeeded in P2V conversions of the same server a number of times already, but now I repeatedly get the following error at x% of the conversion:

Error (2901)

The operation did not complete successfully because of a parameter or call sequence that is not valid.

(The parameter is incorrect (0x80070057))

I tried a reboot of VMM, but this did not help.

Based on this description here are the best steps to address this issue:

P2V Hyper-V VMM 2008 R2

Error (2901)

The operation did not complete successfully because of a parameter or call sequence that is not valid.

(The parameter is incorrect (0x80070057))

Are you using a template from vmm to perform this action?

Might be a P2V migration test failed at step (Deploy file using LAN) with error message?

Error 2901

The operation did not complete successfully because of a parameter or a call sequence that is not valid. (The parameter is incorrect (0x80070057))

Do you see audit failures in the security log (unknown user or password for the computer account of the VMM server)?

Is the VMM server running with local system account?

screenshot of the error on the vmm console?

Can you please Repro and collect traces on the VMM server?

http://blogs.technet.com/chengw/archive/2008/05/08/how-to-collect-scvmm-traces.aspx

Are you doing the P2V with multiple disks or only one?

We can try to select only one Disk for testing purposes,

Are we deploying the new VM in the same Hyper-v Server?

HostAgentInvalidArg 2901 0x80070057

Do you have any Multipath software installed with "Storage Manager for SANs" feature running on the Physical server?

Do you have Nic Teaming?

Can you run the VMMCA (Virtual Machine Manager Configuration Analyzer) on both the VMM server and in this case, the P2V Source computer?

SCVMM Comprehensive Updates June 2010

Description of the System Center Virtual Machine Manager 2008 R2 hotfix rollup package: June 8, 2010

http://support.microsoft.com/kb/982522

Description of the System Center Virtual Machine Manager 2008 R2 Admin Console hotfix rollup package: June 8, 2010

http://support.microsoft.com/kb/982523

Have you already installed and run the VMMCA available from this link:

http://www.microsoft.com/downloads/details.aspx?FamilyID=02d83950-c03d-454e-803b-96d1c1d5be24&displaylang=en?

The VMMCA It only checks to see it that optional integration component is configured and provides a “Warning” if it is not found.

2901 0x80070057

Error (2901)

The operation did not complete successfully because of a parameter or call sequence that is not valid.

(The parameter is incorrect (0x80070057))

Can you check the Hyper-V host and make sure it does not have any mounted VHDs already for this VM?

Apply also those on the Physical Server:

For more information about WinRM 2.0, click the following article number to view the article in the Microsoft Knowledge Base:

968929 Description of the Windows Management Framework on Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008

winrm quickconfig

2:
An update package for Background Intelligent Transfer Service (BITS) is now
available for Windows Server 2003 and for Windows XP
http://support.microsoft.com/kb/923845/en-us

Can you try the following:

1. Uninstall the p2v agent from the source machine.
2. Go to Regedit->HKLM\Software\Microsoft\Microsoft System Center Virtual Machine Manager Server\Settings on the VMM server
3. Create a new DWORD reg entry named “P2VBITSTcpPort” and give it a decimal value between 16000-32000 . Say 30443 decimal..
4. Go to system services (services.msc) and restart Virtual Machine Manager service
Then try to p2v the machine again.

Try the P2V with only a disk, for example c:\

If that works,

So we can try some additional actions:

on that server

msconfig and disable all 3 party stuff,

Or we can also try this tool to convert just the d: driver to a vhd file

disk2vhd

http://technet.microsoft.com/en-us/sysinternals/ee656415.aspx

The only thing I am seeing is that this specific server or disk has something different running that is affecting the P2V.

That is why as a best practice if we found issues, disabling all the 3 party services/applications should help.

Hope this helps

A physical disk resource may not come online on a cluster node in Win2003/2008/2008R2 , KB981475

Hugofe — Wed, 23 Jun 2010 13:45:45 GMT

Hi All

FYI, I just had this issue and in case you start seeing strange disk issues with cluster in any OS,

This problem is known to occur after you install or migrate to Symantec Endpoint Protection 11.0 Release Update 5 (RU5) on the cluster nodes.

On a cluster node that is running Windows Server 2003, a physical disk resource may enter the Failed state when you try to move a group that contains the physical disk resource. If you restart the cluster node that has the physical disk resource that did not come online, the problem is temporarily resolved.
When this problem occurs, the following entries are logged in the Cluster log for the physical disk resource that entered the failed state:

When this problem occurs, the following entries are logged in the Cluster log for the physical disk resource that entered the failed state:

000020cc.000014d0::2010/01/23-19:40:39.929 ERR Physical Disk <Disk Q:>:
DiskspCheckPath: GetFileAttrs(Q:) returned status of 87.
000020cc.000014d0::2010/01/23-19:40:39.929 WARN Physical Disk <Disk Q:>:
DiskspCheckDriveLetter: Checking drive name (Q:) returns 87

Additionally, the following events are logged in the System log:

Event Type: Error
Event Source: ClusSvc
Event Category: Physical Disk Resource
Event ID: 1066
Date: 1/24/2010
Time: 1:03:53 AM
User: N/A
Computer: NODE2
Description:
Cluster disk resource "Disk Q:" is corrupt. Run 'ChkDsk /F' to repair problems. The
volume name for this resource is
"<\\?\Volume{4323d41e-1379-11dd-9538-001e0b20dfe6}\>".
If available, ChkDsk output will be in the file "C:\WINDOWS\Cluster\ChkDsk_Disk2_SigB05E593B.log". ChkDsk may write information to the Application Event Log with Event ID 26180.
For more information, see Help and Support Center at
<http://go.microsoft.com/fwlink/events.asp>.
Event Type: Error
Event Source: ClusSvc
Event Category: Physical Disk Resource
Event ID: 1035
Date: 1/24/2010
Time: 1:03:53 AM
User: N/A
Computer: NODE2
Description:
Cluster disk resource 'Disk Q:' could not be mounted.
For more information, see Help and Support Center at
<http://go.microsoft.com/fwlink/events.asp>.

This problem is known to occur after you install or migrate to Symantec Endpoint Protection 11.0 Release Update 5 (RU5) on the cluster nodes.
For more information about this problem, visit the following Symantec Web site:

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2009102815324448 (http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2009102815324448)

To resolve this problem, follow these steps:

1. Verify that this problem is caused by Symantec Endpoint Protection (SEP) 11.0 Release Update 5 (RU5). To do this, run the Handle.exe utility immediately after the issue occurs on the cluster node where the physical disk resource did not come online.
At an elevated command prompt, type the following command, and then press ENTER:

Handle.exe -a -u drive_letter

Note The drive_letter placeholder is the drive designation for the cluster drive that did not come online.
For example, assume that the drive designation for the cluster drive that did not come online is drive Q. To run the Handle.exe utility in this scenario, type the following command, and then press ENTER:

Handle.exe -a -u Q:

The problem is caused by the Symantec application if you receive the following message that identifies the Smc.exe process as the process that owns the handle:

Handle v3.42
Copyright (C) 1997-2008 Mark Russinovich
Sysinternals - www.sysinternals.com
Smc.exe pid: 856 NT AUTHORITY\SYSTEM 66C: Q:

2. If the problem is caused by the Symantec application, contact Symantec to obtain Symantec Endpoint Protection 11 Release Update 6 (RU6), which was released to resolve this issue. For more information, visit the following Symantec website:

http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/2c62c4ee0e697aae882573b000034ded?OpenDocument (http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/2c62c4ee0e697aae882573b000034ded?OpenDocument)

A physical disk resource may not come online on a cluster node in Win2003

http://support.microsoft.com/default.aspx?scid=kb;EN-US;981475

Windows 2008: Access Based Enumeration (ABE)

Hugofe — Mon, 21 Jun 2010 16:28:19 GMT

Windows Server 2008: Access Based Enumeration

Before we start talking about ABE in Windows Server 2008 I would like to explain briefly what ABE does.

ABE filters shared folders visible to a user based on that individual user’s access rights, preventing the display of folders or other shared resources that the user does not have rights to access.

End users see only what files and folders they need for their responsibilities rather than spending time looking through lists of inaccessible folders and files. Administrators can be more productive because they do not have to help less-skilled users navigate through dense shared folders. Administrative inefficiencies can consume resources as surely as technical problems, and minimizing time-consuming problems help make any IT organization more productive.

ABE was introduced in Windows Server 2003 SP1 as an additional install, once installed you could manage ABE through a GUI, cmd-line tool or using the API's.

Check out the details for Windows Server 2003 ABE: http://www.microsoft.com/windowsserver2003/techinfo/overview/abe.mspx

Now the good news is yes we still have ABE in Windows Server 2008 and we have a GUI where you can enable this. Let me explain to you how you do it:

1. Open the "Share and Storage Management" MMC and Provision a new share.

2. Follow all steps to create a share and when are at the SMB Settings window, which is shown below, click on the Advanced button.

3. In the Advanced window you are able to Enable or Disable ABE, by default it's enabled.

So basically you don't have to do anything to enable ABE on you shares. The screenshots above show you how you can create/provision a new share using the GUI. The ABE is also enabled if you create the share through the folder directly by right clicking onto the folder and select share. However if you create a share through the command prompt using the "net share" command it won't be enabled by default.

You can always enable / disable the ABE after you created the share by using the "Share and Storage Management" MMC just right click onto a share and hit the advanced button. So far I didn't found any cmd-line tool to enable or disable ABE.

New SCVMM KB Article: You cannot delete a missing VM in SCVMM 2008 or in SCVMM 2008 R2 / Attempting a System Center Virtual Machine Manager 2008 P2V conversion of Windows Server 2003 R2 fails with Error 13257

Hugofe — Mon, 21 Jun 2010 11:08:33 GMT

New SCVMM KB Article: You cannot delete a missing VM in SCVMM 2008 or in SCVMM 2008 R2

The issue is one where on System Center Virtual Machine Manager (SCVMM) 2008 or SCVMM 2008 R2, duplicate virtual machines (VMs) may appear in the SCVMM Administrator Console. In this scenario, one of the duplicate VMs has a Missing status, and the other VM has a different status. If you try to delete the missing virtual machine, you may receive the following error message:

Error (802)
The VM file vmname.domain is already being used by another VM

For all the details including how to resolve this issue see the Knowledge Base article below:

KB983839 - You cannot delete a missing VM in SCVMM 2008 or in SCVMM 2008 R2

Attempting a System Center Virtual Machine Manager 2008 P2V conversion of Windows Server 2003 R2 fails with Error 13257

The solution describes an issue where when using system Center Virtual Machine Manager 2008 (SCVMM), a P2V conversion of Windows Server 2003 R2 may fail with Error 13257 trying to patch the source prior to the conversion. This error actually occurs on the "Conversion Information" dialog during the P2V wizard before actually starting the conversion. You may also see errors similar to the following during the P2V conversion:

Error (13257):

Virtual Machine Manager server is unable to convert <machineName> because required files are missing.

Recommended Action:

Copy the file SP2.CAB to "D:\Program Files\Microsoft System Center Virtual Machine Manager 2008 R2\Patch Import" on the Virtual Machine Manager server, run the Add-Patch cmdlet to add the required files to the Virtual Machine Manager patch cache, and then try the operation again. The file SP2.CAB is located either at %WINDIR%\Driver Cache\i386 on <machineName>, or on the Windows Server 2003 Service Pack 2 (ENU, i386) installation media.n/ If SP2.CAB is not available, locate dc21x4.sys (Version: 5.5.5.0) on the installation media, copy the file to "D:\Program Files\Microsoft System Center Virtual Machine Manager 2008 R2\Patch Import", and then run the Add-Patch cmdlet to add the required files to the Virtual Machine Manager patch cache.

and

Error (13257):

Virtual Machine Manager server is unable to convert <machineName> because required files are missing.

Recommended Action:

Copy the file SP2.CAB to "D:\Program Files\Microsoft System Center Virtual Machine Manager 2008 R2\Patch Import" on the Virtual Machine Manager server, run the Add-Patch cmdlet to add the required files to the Virtual Machine Manager patch cache, and then try the operation again. The file SP2.CAB is located either at %WINDIR%\Driver Cache\i386 on <machineName>, or on the Windows Server 2003 Service Pack 2 (ENU, i386) installation media.n/ If SP2.CAB is not available, locate intelide.sys (Version: 5.2.3790.3959) on the installation media, copy the file to "D:\Program Files\Microsoft System Center Virtual Machine Manager 2008 R2\Patch Import", and then run the Add-Patch cmdlet to add the required files to the Virtual Machine Manager patch cache.

If you happen to run into this issue then the resolution can be found here:

KB2131553 - Attempting a System Center Virtual Machine Manager 2008 P2V conversion of Windows Server 2003 R2 fails with Error 13257

Windows 2008 Hyper-V R2 Update for DPM 2010

Hugofe — Fri, 18 Jun 2010 12:04:22 GMT

Hyper-V R2 Update for DPM 2010

Install those two Updates on Hyper-V R2 server:

KB975354 A Hyper-V rollup package dealing with parallel backups on same cluster shared volumes and VM’s hosted by different servers; Avoiding data truncation as a result of simultaneous backup of VM from host and from within virtual machine; properly restoring a VM with snapshots to another location

KB975921 You may be unable to perform certain disk-related operations after an exception when a hardware provider tries to create a snapshot in Windows Server 2008 R2 or Win 7.

HP DSM support with CSV

Hugofe — Fri, 18 Jun 2010 11:21:23 GMT

HP DSM now supports CSV

If you see Clusters with CSV on EVA Devices that sporadically loose disks, you might want to look at the DSM that until the June did not support CSV.

From HP:

On 4rth June, 2010, we released HP MPIO FF DSM v 4.01 which supports CSV with Windows Server 2008 R2. Attached is the release notes and the link for download is the following:

http://h20000.www2.hp.com/bizsupport/TechSupport/DocumentIndex.jsp?lang=en&cc=us&taskId=101&prodClassId=-1&contentType=SupportManual&docIndexId=64180&prodTypeId=18964&prodSeriesId=421492

I’m attaching this release note and install guide below is the link for download

http://h20000.www2.hp.com/bizsupport/TechSupport/CoreRedirect.jsp?redirectReason=DocIndexPDF&prodSeriesId=421492&targetPage=http%3A%2F%2Fbizsupport2.austin.hp.com%2Fbc%2Fdocs%2Fsupport%2FSupportManual%2Fc02221077%2Fc02221077.pdf

Update for Hyper-V R2 and CPU Issue KB981791

Hugofe — Fri, 18 Jun 2010 11:17:49 GMT

Update for Hyper-V R2 and CPU Issue KB981791

Assume that you have a computer that is running Windows Server 2008 or Windows Server 2008 R2 together with the Hyper-V role installed. In this scenario, you receive an error message that resembles the following:

STOP: 0x0000001a ( Parameter , Parameter , Parameter , Parameter ) MEMORY_MANAGEMENT

This issue occurs because Intel Westmere processors have a new Virtual Machine Control Block (VMCB) caching feature. This feature is added to provide a virtualization assistance to increase the hypervisor performance. Because this feature was introduced after Windows 2008 SP2 and Windows 2008 R2 were released, the hypervisor does not handle the VMCB caching correctly. Therefore, the system memory may be corrupted. This behavior can cause the stop error 0x0000001a.

"STOP: 0x0000001a" error message on a computer that has an Intel Westmere processor together with the Hyper-V role installed on Windows Server 2008 or on Windows Server 2008 R2

http://support.microsoft.com/kb/981791

Update to Hyper-V R2 to solve backup/ VSS issues,

Hugofe — Fri, 18 Jun 2010 11:13:50 GMT

Update to Hyper-V R2 to solve backup/ VSS issues,

Recently I have come across an issue with long Boot times due to VSS and Backups causing the registry to grow up incorrectly,

Here is the solution:

The startup time increases every time after you back up the data on all the disks of the computer in Windows Server 2008 R2 if the computer runs some virtual machines

http://support.microsoft.com/kb/982210

On a computer that is running Windows Server 2008 R2 and that has the Hyper-V role installed, the startup time of the computer keeps increasing. After a while, the computer stops responding when the computer is in the startup process.
Note If the computer runs some virtual machines, this issue usually occurs when you frequently back up all the disks on the computer.
Additionally, many of the following PlugPlayManager events that have Event ID 12 are logged in the System log:

Log Name: System
Source: PlugPlayManager
Date: date time
Event ID: 12
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: computer name
Description:
The device 'MSFT Virtual HD SCSI Disk Device' (SCSI\Disk&Ven_MSFT&Prod_Virtual_HD\ GUID ) disappeared from the system without first being prepared for removal.

Note

· The size of the %SystemRoot%\system32\confg\system system registry hive increases after every backup operation..

· If you view the registry hive by using Registry Editor, the following registry entries are logged repeatedly. For example, the following registry entries are logged repeatedly 10000 times or more.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\SCSI\Disk&Ven_Msft&Prod_Virtual_Disk

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\STORAGE\Volume\{f1030a29-1024-11df-b7a9-001b214f4bef}#0000000006500000

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\##?#STORAGE#VOLUME#{E717314D-23B5-11DF-AA86-001B214F4BEF}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"DeviceInstance"="STORAGE\\Volume\\{e717314d-23b5-11df-aa86-001b214f4bef}#0000000000100000"

This issue occurs because there are a large amount of orphaned registry keys.
The Volume Shadow Copy Service (VSS) snapshots create many registry keys. However, they are not deleted after the VSS snapshot operations are completed.

Hotfix and workaround:

work around this issue, perform one of the following operations:

· At a command prompt, type the following command, and then press ENTER:

devnodeclean

Note This command cleans up all the orphaned registry key entries.

· Schedule the devnodeclean command to run one time every week.

The startup time increases every time after you back up the data on all the disks of the computer in Windows Server 2008 R2 if the computer runs some virtual machines

http://support.microsoft.com/kb/982210