if (ms) blog++;

Exodus

2013-03-14T15:28:22Z

My time at Microsoft has now come to an end, and I start my new job next month – meaning that this TechNet blog will become a read-only resource with no further updates possible (I am not sure about approving comments).

I have set up a new blog and the following URL under my personal domain to point to it:
http://blog.adams-family.me.uk/

My updates were never that frequent, and I have no idea if I will have the time/inclination to continue blogging, but at least there is a place there should I need it.

I hope you have found some of the posts of interest and/or use since I started this blog in October 2008!

//Paul

RDP8 + Ribbons + RemoteApp = Known Issue

2013-02-19T07:24:01Z

If you have Windows 7 SP1 and install the Remote Desktop Protocol 8.0 update (KB2592687) then you may find you encounter an issue with “ribbon” applications running as RemoteApps.

The scenario is this:

A user on a Windows 7 SP1 + KB25292687 launches Wordpad as a RemoteApp on a Windows Server 2008 R2 SP1 RD Session Host server, the application launches as expected.

The user hits the Alt key (not Alt Gr) which displays the tooltips with the shortcut keys over the clickable items on the ribbon - in this example, F for File, H for Home, V for View and Y for Help.

Pressing the F key or clicking on the relevant hotspot makes the File menu flash up but then disappear again immediately (the other 3 items are unaffected, through both keyboard and mouse).

The workaround is to press the Shift, Ctrl and Alt keys simultaneously to reset the state of the modifier keys.

The only solution at present (until the hotfix completes it test cycle and is released) is to roll back to RDP 7.0 – there is a hotfix in the works, but it is currently undergoing testing.

Only certain functions of “ribbon” apps appear to be affected, the majority being Office applications.

SQL Server 2012 may fail to install on Windows Server 2012 under VMWare

2013-02-11T08:23:46Z

I was recently asked if I knew of any reason for SQL Server failing to install if the one of the folders was set to a volume other than C: – the installation logs and Process Monitor traces pointed to “access denied” but it was not clear why this should be failing.

It turns out that the problem is specific to Windows Server 2012 when running under VMWare with the hot-plug capability enabled – under Hyper-V, VirtualBox or on physical hardware the problem does not occur.

There is a public KB article on this from Microsoft, and a shortcut provided to VMWare’s Knowledge Base on how to disable the feature causing the problem.

I don’t know the technical reasoning behind why this VMWare feature interferes with the creation of files on secondary volumes, or what it changes when presenting the volume to the system, but it seems reasonable to assume the problem is not restricted to SQL Server 2012.

What is svchost.exe, and why do I have so many instances of it?

2012-11-09T07:08:10Z

The Description field in the properties of svchost.exe is “Host Process for Windows Services”, and it was created to reduce the number of processes running on the system to have a smaller load on system resources.

On my Windows 8 x64 machine there are 182 services visible through “View Local Services”, 101 of which have their status as “Running”, but as I type there are only 41* processes currently running in session 0, as displayed on the Details tab in Task Manager, which are potentially** background service processes.

* This excludes “System” and “System Idle Process” and “System Interrupts” as they are fake placeholder processes
** I say “potentially” as a single service could spawn child processes, either permanent or temporary

So 101 services running in a maximum of 41 processes, how is this achieved?
By collecting services that require similar privileges/permissions together into a group so they share a security token and virtual address space.

The first process in a group that gets started will create and initialize the svchost.exe process, and all subsequent services in that group will cause modules to be loaded and threads to be created.
Similarly, the process will exist while there is at least 1 service in the running state in that group.

The Group name can be seen by adding the column in the Services tab in Task Manager.

Identification

So we can see the benefit of this, but it introduces a bit of complexity when it comes to diagnosing crashing/hanging/misbehaving services hosted in these svchost.exe instances.

The first challenge is to determine which of the instances a service runs in – this is easier than it used to be thanks to the PID column in the Services tab in Task Manager, it used to be a case of running something like the following at a Command Prompt to locate the service in question and getting the corresponding process ID:
tasklist /svc /fi "imagename eq svchost.exe"

As all of the services in a group share the same process, if any of their threads encounter an unhandled exception, the process will be terminated – affecting all of the hosted services.
This leads to the symptom of the event log reporting many services “terminated unexpectedly” at the same time.

Isolation

Only 1 of the services caused the problem, but how to identify which one it was?
The first step would be to isolate all of the services into their own processes, then see which individual service continues to have a problem – this is done (for service “foo”) through an elevated Command Prompt with the command:
sc config foo type= own

(The space between “=” and “own” is vital – the command does not succeed if this is left out.)

The next time the service starts, it will now create its own svchost.exe instance, even without modifying the command line that starts the service.

To later restore the service to its original state, i.e. once troubleshooting is concluded, the command is:
sc config foo type= shared

Mitigation & Investigation

So by isolating all of the services in a group which is having a problem then restarting the machine, we can now observe the individual services and have the chance to attach a debugger or get a crash dump which does not have any other process’ modules or threads confusing matters.

Even if the service with the problem continues to crash, the impact at least is hopefully mitigated as the other services in the group continue to run – so long as they are not dependent on the crashing service.

As soon as the individual service has been identified, the others in the group can be put back into the shared state, leaving only the 1 isolated until its problem is resolved.

Occasionally, and rather annoyingly, the service stops encountering problems once it is isolated – then the decision has to be made if it is simpler to leave it in that configuration as it works, or to continue spending (potentially a lot of) time trying different combinations/numbers of hosted services to see if the trigger can be identified.

Support phases ending in the next 2 years

2012-08-06T06:25:51Z

April 8th 2014 (2014-04-08)

Windows XP
- end of support
- no more updates for this product
- includes XP x64 Edition
- last service pack for x86 was SP3
- last service pack for x64 was SP2
- ref: Microsoft Product Lifecycle Search
- ref: End of Support

Office 2003
- end of support
- no more updates for this product
- ref: End of Support

Edit:
Windows Server 2008 and Windows Server 2008 R2 no longer enter extended support on July 13th 2013, both of these products have had their mainstream phase extended to January 13th 2015.
The Microsoft Product Lifecycle Search page indicated this some time ago, but only recently has it been announced/confirmed.

Windows 8 RTM 2012-08-01

2012-08-02T04:54:53Z

OEMs now have the gold image for Windows 8, and there are some key dates in the coming month of which to be aware:
http://windowsteamblog.com/windows/b/bloggingwindows/archive/2012/08/01/windows-8-has-reached-the-rtm-milestone.aspx

August 15th: Developers will be able to download the final version of Windows 8 via your MSDN subscriptions.

August 15th: IT professionals testing Windows 8 in organizations will be able to access the final version of Windows 8 through your TechNet subscriptions.

August 16th: Customers with existing Microsoft Software Assurance for Windows will be able to download Windows 8 Enterprise edition through the Volume License Service Center (VLSC), allowing you to test, pilot and begin adopting Windows 8 Enterprise within your organization.

August 16th: Microsoft Partner Network members will have access to Windows 8.

August 20th: Microsoft Action Pack Providers (MAPS) receive access to Windows 8.

September 1st: Volume License customers without Software Assurance will be able to purchase Windows 8 through Microsoft Volume License Resellers.

On August 15^th, developers will be able to visit the Windows Dev Center to get access to all the tools and resources they need including the final build of Visual Studio 2012 to design, build, and sell apps in the Windows Store.

Windows 8 / Server 2012 release dates announced

2012-07-10T15:54:47Z

Over at the Windows Team Blog it was announced yesterday that RTM will be the first week in August, with general availability slated for the end of October:

“For the first time, we provided details on Windows 8 availability. Tami confirmed that Windows 8 is on track to Release to Manufacturing (RTM) the first week of August. For enterprise customers with Software Assurance benefits, they will have full access to Windows 8 bits as early as August. Additionally, she noted that RTM is when we’ll be turning on the commerce platform so that developers can start earning money for their apps – we'll have more to share on the Windows Store for developers blog soon. Of course, right now with the Windows 8 Release Preview, all apps are still free for people to try.

Tami went on to say that Windows 8 will reach general availability by the end of October! This means that new Windows 8 and Windows RT PCs will be available to buy and upgrades will be available starting in October. She also mentioned that that Windows 8 will be available in 109 languages across 231 markets worldwide.”

Windows 8 Release Preview, Windows Server 2012 Release Candidate available for download

2012-06-01T06:21:39Z

Windows 8 Release Preview is here.
x86 and x64 ISO images available for download.

Windows Server 2012 Release Candidate is here.
ISO image (product only ships as x64) and pre-installed VHD available for download.

Both are based on build 8400 of common source code.

The last set of scale/support figures for Hyper-V on Server 2012 are very interesting reading:
- Up to 320 virtual processors per host (increased from 64)
- Up to 64 virtual processors per VM (increased from 4)
- Up to 4TB memory per host (increased from 1TB)
- Up to 64TB per virtual disk (new VHDX format, VHD limitation is 2TB)
- Up to 64 nodes in a cluster (increased from 16)
- Up to 4,000 VMs in a cluster (increased from 1,000)

As with the previous Consumer Preview & Beta releases, these will be functional until January 2013.

Windows Server 2012 (codename “8”) Beta Resources

2012-05-25T09:06:58Z

Last month the official name of Windows Server “8” was confirmed as being Windows Server 2012, so with beta documentation and guides you can expect the terms to be used interchangeably.

Here is a collection of useful links for those interested in looking at testing, demo’ing or troubleshooting some of the Server features…

Windows 8 Consumer Preview Site
Build Windows 8 Blog

Test Lab Guides
Base Configuration
Demonstrate DirectAccess Single Server Setup with Mixed IPv4 and IPv6
Demonstrate DirectAccess Simplified Setup in an IPv4-only Test Environment
Deploying RD Licensing
Demonstrating DHCP Failover
Demonstrate Virtualized Domain Controller (VDC)
Demonstrate Print and Document Services
Demonstrate Remote Desktop Services
Demonstrate Remote Desktop Services Desktop Virtualization
Demonstrate IP Address Management (IPAM)
Demonstrate DNS Security Extensions (DNSSEC)
Demonstrate High Availability Printing
Demonstrate ADDS Simplified Administration
Deploying an AD CS Two Tier PKI Hierarchy

Test Lab Optional Mini-Modules
Homenet Subnet
Basic PKI
Second Corpnet Subnet

Understand and Troubleshoot Guides
Activation Technologies
AD DS Simplified Administration
BitLocker
Cluster-Aware Updating (CAU)
DHCP Failover
DNS Security Extensions (DNSSEC)
Dynamic Access Control
High Availability Printing
Hyper-V Replica
IP Address Management (IPAM)
Microsoft Online Backup Service
Printing
Remote Access
Remote Desktop Services Desktop Virtualization
Remote Desktop Services
Scale-Out File Servers
Servicing
Storage Spaces and Pools
Virtualized Domain Controller (VDC)

Microsoft-Windows-GroupPolicy event 1502 not being logged after successful application of GPOs

2012-01-24T08:36:15Z

Recently I encountered a customer who had several Windows 7 clients which initially had the symptom of the group "Offer Remote Assistance Helpers" not being present, but the underlying cause turned out to be something entirely unrelated at first.

The group in question is actually created by an event-triggered task, visible in Task Scheduler here:
Microsoft > Windows > RemoteAssistance > RemoteAssistanceTask

Viewing the Triggers tab for this task, it is fired by the following:
Log: System, Source: Microsoft-Windows-GroupPolicy, Event ID: 1502

Manually launching the task made the group appear immediately, so we knew at this point that the problem lay with the event trigger.

Checking the System event log, there were 0 events matching the given source & ID, yet running GPRESULT /Z made it clear that the policies were applying successfully.

GPUDPATE /FORCE refreshed the policies correctly, but also failed to get the 1502 event logged.

So the first thing we did was to enable gpsvc debug logging, by setting the following registry value:
Path: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Diagnostics
Name: GpSvcDebugLevel
Type: REG_DWORD
Data: 0x30002

The debug logging is written to the following location:
%windir%\debug\usermode\gpsvc.log

After refreshing the policies we saw the following being recorded in gpsvc.log:
GPSVC(xxx.yyy) hh:mm:ss:sss Could not publish event id=1502 as it is disabled

This is logged because the Group Policy service makes a call to EtwEventEnabled and receives FALSE in response.

I stepped through the code for EtwEventEnabled, and there are 3 checks made, and if any of them fail then FALSE is returned.

The first check is that the ETW event is not marked as "disabled" through a dedicated flag (this was okay).

The second check is that the level of the event to log is not outside of the threshold for the provider (this was also okay).

The third check is the the Keyword matches the bitmask for event types to log - it turns out the REGHANDLE passed to this function referred to the ETW provider with bad types for MatchAllKeyword and MatchAnyKeyword values.

From the EtwEnableCallback routine page on MSDN:

MatchAnyKeyword [in]

The bitmask of keywords that the provider uses to determine the category of events that it writes.

This value is passed in the MatchAnyKeyword parameter of the EnableTraceEx function or the EnableFlag parameter of the EnableTrace function. MatchAnyKeyword is a 64-bit value and is basically an extended version of the 32-bit EnableFlag.

MatchAllKeyword [in]

This bitmask additionally restricts the category of events that the provider writes.

This value is passed in the MatchAllKeywords parameter of the EnableTraceEx function.

When we looked at these filter values for the EventLog-System provider on the broken clients, they were present and at a glance contained good data, but they were created as REG_SZ (string) values rather than the expected REG_QWORD (64-bit number, as the clients were x64).

The path to the key holding the values is:
HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System\{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}

After replacing the REG_SZ values with the correct type, the clients started recording event ID 1502 when refreshing group policy.

References:
Userenvlog for Windows Vista/2008/7
EtwEventEnabled function
EtwEnableCallback routine
How To User the Registry API to Save and Retrieve Setting
RegQueryValueEx function
Registry Value Types