• Que Nguyen's Microsoft techology blog

    KMS host troubleshooting & monitoring

    • 0 Comments

    * Windows Activation: Troubleshooting and Monitoring the KMS. Source: http://myitforum.com/cs2/blogs/jsandys/archive/2009/04/08/windows-activation-troubleshooting-and-monitoring-the-kms.aspx

    As I've described in the previous two installments, the KMS is a pretty simple and straight-forward service. When you think about, this makes sense because the only thing that it does is activate clients.

    So how do you track what the KMS is doing and identify any issues? The first way is a vbscript located in %systemroot%\system32 named slmgr.vbs. This little script is the main way to interact with the KMS and the activation client. Running this script with –dli as an option will list the activation information for the local system; if the local system is a KMS, then will also list KMS related data including the number of clients that it has activated in total. Remember that this number is important because Vista clients won’t activate unless the KMS has already activated at least 25 clients and Server 2008 clients won’t activate unless 5 other systems have already been activated. The following screenshot shows the output of slmgr –dli on a KMS:

    image

    Of note are the following:

    VOLUME_KMS_C_channel – The type of license key that was used to activate the system. For a KMS, this also indicates what type of clients it can activate, see Windows Activation – The KMS for details.

    License Status – Indicates whether the local system has been activate or not.

    Current Count – The number of client systems already activated.

    DNS publishing enabled – Indicates whether this KMS system is publishing its SRV record in DNS.

    slmgr –dlv displays the same basic information with some extra thrown in. This in shown in the next screenshot:

    image

    The two above commands also work on clients and show the same information minus the KMS specific items.

    Both the KMS server and client add event log entries to track activations and activation requests. For the KMS server, there is a dedicated log view called Key Management Service located under Application and Services LOGs in the Event Viewer:

    image

    The KMS will add an entry to this log every time it receives a request for activation. They will look like the following:

    image

    The first field in the info section (marked by the red arrow), is the success/failure code; 0x0 is success.

    For clients, two events will be placed into the standard Application Event Log with EventIDs of 12288 and 12289 and provider name of Microsoft-Windows-Security-Licensing-SLC. 12288 indicates a client request and which KMS server the request is being sent to (blacked out):

    image

    12289 indicates a reply from the KMS, the success/failure code (marked by the red arrow below) is the first field in the info section and is the same code listed by the event entry on the server side:

    image

    There are a handful of common error codes, the full list is available in the Volume Activation 2.0 Operations Guide in Appendix 2.

    That’s the bulk of it. Like I said at the start, its a simple service that does only one thing: activate clients.

  • Que Nguyen's Microsoft techology blog

    Getting started with SCOM 2012

    • 0 Comments

    * Deploying OpsMgr 2012 – a quick-start guide from Kevin Holman's System Center Blog

    * Install Operations Manager 2012 Beta

  • Que Nguyen's Microsoft techology blog

    Private Cloud lab setup guide 3

    • 1 Comments

    This is the step-by-step guide for adding a free Hyper-V Server 2008 R2 SP1 or a paid Windows Server 2008 R2 Server Core to the Hyper-V cluster.

    - On NODE1, shrink the existing drive so that we have the second partition to host the Hyper-V Server. To differentiate with the future Hyper-V Server on the boot screen, use this command (Run As Admin)

    bcdedit /set {current} description "WS08R2 Full OS"

    Check the new setting with bcdedit or Computer Properties/Advanced/Startup and Recovery

    - Install the Hyper-V Server

    - Change hostname to NODE3, set IP to 192.168.1.13, join domain

    - Enable Remote Desktop

    - Select 4: Configure Remote Management, then select 2: Enable Windows PowerShell, restart

    - Select 4: Configure Remote Management, then select 3: "Allow Server Manager Remote Mgmt"

    - Select 4: Configure Remote Management, then select 1: "Allow MMC Remote Mgmt" (firewall exceptions will be enabled, Virtual Disk Service allowed)

    - Remote Desktop to NODE3

    - Check installed roles/features: oclist --> Hyper-V role is already installed

    - From HN-SRV-01, in Server Manager, Feature/Add Feature: Hyper-V Tools and Failover Clustering Tools (in Remote Server Admin Tools), then connect to NODE3 Hyper-V.

    - From Server Manager (connected to NODE3), go to the Hyper-V node, create a Virtual Network connecting to the physical NIC of the NODE3. Name it ProdLAN.

    - From Server Manager (connected to NODE3), go to Services node, set "Microsoft iSCSI" service to Automatic, and start it

    - From Remote Desktop (connected to NODE3), run iscsicpl from the Command Prompt and connect to the SAN storage at 192.168.1.1.

    - From Remote Desktop (connected to NODE3), select 11 to install Failover Clustering on NODE3

    - From Server Manager (connected to NODE3), go to Disk Management node, after 2 minutes, this error is displayed "The RPC Server is unavailable". Resolution: check on both (managing and managed) servers to make sure all 03 "Remote Volume Management..." rules are enabled. (In my case, it is the managing server, HN-SRV-01) If not, run this in a CMD window: netsh advfirewall firewall set rule group="Remote Volume Management" new enable=yes. Close the Server Manager.

    - From the SCVMM SSP portal, stop all running VMs then delete them. Double-check using the SCVMM console.

    - From Server Manager (connected to NODE3), go to Disk Management node, after 4 minutes, the Disk Configuration on NODE3 will appear. Change the quorum disk to Q:  and remove drive letter of the Storage01. Note: all these 2 disks are in RAW format.

    - HN-SRV-01: Launch Failover Cluster Manager (from Admin Tools), connect to PRIVATE-CLOUD cluster, right click, Add Node, select NODE3, choose to run All Tests. You may need to restart NODE3 if it cannot be accessed. The test will show that it is not suitable however we choose to go ahead and create the cluster.

    - From Server Manager (connected to NODE3), add svcacct account to the Local Admins of NODE3 for SCOM agent push installation to work. Then go to Services node, set "MSI Installer" service of NODE3 to Automatic and start it (this is used for SCVMM agent installation)

    - From SCVMM console, delete any existing PRIVATE-CLOUD host cluster, and use Add Host menu item again to add NODE2 and NODE3

    - For troubleshooting purpose, you can disable the firewall on NODE3 using the Server Manager (connected to NODE3)

    - Use SCVMM SSP portal, try to provision 2 VMs. Test Live Migration and PRO tips

  • Que Nguyen's Microsoft techology blog

    Private Cloud lab setup guide 2

    • 0 Comments

    This is the version 2 of the Private Cloud lab step-by-step setup guide. Instead of using a single physical machine for DC+Storage+Management roles, the VMs are used instead for easy transfer to another hardware. Note: the guide is to illustrate the concepts only so it may not follow the best practices & guidance.

    * 03 physical machines:

    • One 8GB RAM, install WS08R2 as workgroup, add HyperV role, add ProdLAN network using physical NIC, contains 02 VMs:
      • VM1 named HN-SRV-01: 1.5 GB RAM. DC + Storage roles. A second hard disk will be added to SCSI which is a fixed VHD.
      • VM2 named MGMT: 3 GB RAM. Will install SQL 2008 wSP1 for SCOM, VMM and VMM SSP roles.
    • Two Hyper-V members, named NODE1 & NODE2 (2 GB RAM each), running WS08R2 Enterprise wSP1, joined to the AD domain on the VM1

    * A 4-port gigabit hub.

    Part 0. Precheck

    1. On the physical machines, install display driver (for using with projector)

    2. Make sure to check all physical machines are using 1GB connections. Disable any DHCP server (if any) in the hub.

    Part 1. VM1: DC promotion

    - Win 2008 R2 Std with SP1 installation
    - Activate
    - Rename to HN-SRV-01
    - Set ip (192.168.1.1) and time zone
    - Promote to DC (mycompany.com.vn)
    - Create a Domain User named "svcacct"
    - Prepare CPU-busy.vbs and store it to c:\shared for later use.

    Part 2. VM2: SCOM & VMM installation, SCOM-VMM integration, SSP portal installation on MGMT machine

    1. WS08R2 Std wSP1 installation, rename to MGMT, set IP: 192.168.1.2, join to domain

    2. Install SCOM 2007 R2:

    - Server Manager, Features: Add Dot.Net framework 3.5

    - Install SQL 2008 Std wSP1 with just Database, Analysis and Reporting services. Choose "Use the same account..." and enter "svcacct". Add Current User to DB & Analysis configuration screens.

    - Use Server Manager, add "Web Server" role. The following Web Server Role Services should automatically be selected: Default Document, Directory Browsing, HTTP Errors, Request Filtering, Static Content. Click to select additional Role Services: ASP.NET, .NET extensibility, ISAPI Extensions, ISAPI Filters, Windows Authentication, IIS 6 Metabase Compatibility, IIS 6 WMI Compatibility.

    - Install AJAX Extension 1.0 for ASP.NET 2.0 (or use pre-downloaded file ASP.NET AJAX extensions 1.0)

    - Install Operations Manager 2007 R2: Management Group: MyCompany; SQL DB size: 500 MB; Management Server Action Account: MYCOMPANY\svcacct (the account used for agent push installation), then accept all defaults.

    * Optional: Install Operations Manager 2007 R2 Reporting: Start SQL Reporting service if needed, launch Setup, type MGMT as the Root Management Server, Report DB: 500 MB, Data Warehouse Write Account & Data Reader Account: MYCOMPANY\svcacct

    3. Install SCVMM 2008 R2 wSP1 x64: only VMM server component (not the Admin console yet), choose to "Install SQL 2005 Express Edition SP3", then accept all the defaults (ports 8100, 80, 443)
    (Note: the SQL Express instance for VMM is named MICROSOFT$VMM$)

    4. Install and configure SCOM & SCVMM integration:

    - Open the SCOM console, Admin tab, import the required MPs for SCVMM integration:
    + Download & install these files "Windows Server Base OS System Center Operations Manager 2007 MP.msi", "Internet Information Services MP.msi" & "SQL Server Operations Manager 2007 MP.msi"  (or use pre-downloaded file OpsMgr2007R2_MP.iso)
    + Import the following MPs: "Microsoft.Windows.Server.2003 / 2008.Discovery / 2008.Monitoring/Library; "Microsoft.Windows.Internet Information Services.2003 / 2008 / CommonLibrary"; "Microsoft.SQLServer.2005.Discovery / Monitoring / 2008.Discovery / Monitoring / Library"
    + Optionally install the "Hyper-V Management Pack"
    + Go back to the Monitoring tab on SCOM console. Note: there is no SCVMM folder (only 10 folders).

    - Insert SCVMM 2008 R2 media, select "Configure Operations Manager" option. Type MGMT for VMM server. This will install the SCVMM console and configure SCOM (the SCVMM MP is added to SCOM, and a folder named "Virtual Machine Manager 2008 R2" is added to the Monitoring tab of the SCOM console).

    - Launch the SCVMM console (use localhost), go to the Administration tab, System Center, Operations Manager Server, right click, Modify, and type MGMT for the SCOM server name. Click the Diagram button (right below the Menu bar) --> the corresponding SCOM Diagram View of the whole Private Cloud will be shown (once all setup steps are done, you will see Node1, Node2, VM1, VM2, etc...). You may need to click the SCOM icon on the Taskbar to show the Diagram.

    5. To install Self-Service Portal (SSP) 2.0 on the MGMT

    a. Prerequisites installation:

    a.1. "Message Queuing" installation:
    In Server Manager, Features, install "Message Queuing Server" & "Directory Service Integration". (If MSMQ is installed on a DC, go to AD Users & Computers, View/Advanced Features, select Domain Controller server, prop, Security, Advanced, Add, (type) NETWORK SERVICE (Check Names), and tick Allow box for "Create MSMQ Configuration object")

    a.2. Note: IIS 7 role, ASP.NET, Win Auth and IIS 6 MetaCompat items are already installed

    b. SSP installation:
    - Download SSP 2.0 (or use pre-downloaded file "VMM SSP 2.0.iso") and run SETUPVMMSSP.EXE.
    - Choose to install both VMMSSP server and website components.

    - Database server: type MGMT, click the "Get Instances" button to display "Default" in "SQL Server Instance" box.
    - Account for server component: type svcacct, click "Test account" (on a DC, username/pwd incorrect error message may appear, configure that account to be a member of Local Admin group)
    - List of data center admins: mycompany\administrator
    - Application pool's identity: svcacct

    c. Always check the Services snap-in to make sure 02 services "Virtual Machine Manager Self-Service Portal 2.0 / Helper" are started before proceeding. See the troubleshooting steps below (for "Settings/ Configure VM Templates" task for more information"

    d. To open SSP portal: http://MGMT, and add this site to Trusted Zone and Favorite Bar.

    e. SSP intial config:
    - Settings/Configure DataCenter mgmt, Configure Data Center resources, VMMServer: MGMT.mycompany.com.vn; click Add Network, enter ProdLAN in both “Network Name” and “Hyper-V Network Name” boxes, click Submit; AD domain: mycompany.com.vn; click "Add an Environment" and type "My Demo Environment", click "Save and Close"
    - Settings/ Configure VM Templates, click "Import template" (under Other Tasks). This error will be displayed "Could not contact the VMMSSP server. Please verify if the Virtual Machine Manager Self-Service Portal 2.0 service is running and try again". Solution: on the MGMT server, just add "mycompany\svcacct" to the Local Admin group, go to the Services snap-in, refresh and start the service "Virtual Machine Manager Self-Service Portal 2.0" and retry. The error disappears but you will not see any VMM library server to select. Solution: in VMM 2008 R2 console, Administration tab, User Roles, Administrator, properties, Members: add svcacct to that role then try again. You will now see MGMT.mycompany.com.vn in the library server drop-down list. Further SSP config will be done later.

    f. Configure to allow "Domain Users" to connect to MGMT using Remote Desktop. Test RDP using mycompany\staff1. Open IE. Add http://MGMT, and add this site to Trusted Zone and Favorite Bar.

    g. Optionally connect SCVMM to a standalone Hyper-V host to create a VM template.

    h. Export HN-SRV-01 and MGMT VMs to a folder for easy transfer to other hardware. Create copies of "Virtual Machines" folder and config.xml file in these two VMs.


    Part 3. Virtual storage preparation
    - Using Hyper-V Manager, create a new fixed-size VHD of 21 GB (consuming 5 min), and store it into HN-SRV-01 folder, and attach it to the SCSI controller.
    - Format the fixed disk as drive E:
    - install MS iSCSI Software Target 3.3.16554 (freely downloaded from http://www.microsoft.com/download/en/details.aspx?id=19867, or use pre-downloaded file "MS iSCSITarget 3.3 for WS08R2.iso")
    - right click iSCSI Targets, Create iSCSI Target, name PRIVATE-CLOUD. In iSCSI Initiators Identifiers screen, click Advanced, Add, choose IP Address, enter 192.168.1.11 then 192.168.1.12 and say Yes when asked to allow multiple initiators.
    - right click Devices, Create Virtual Disk, File: e:\VHD\quorum.vhd, size 1,000 MB (1G), desc: Quorum, Access: PRIVATE-CLOUD.
    - repeat for storage01.vhd size 20,400 MB (19.9G). Create storage02.vhd if free storage is available (for future Storage Quick Migration tests)

    Part 4. Node1 & Node2 installation

    1. Install WS08R2 Enterprise wSP1

    - Activate, set time zone, configure IE ESC to Off (Enhanced Security Config)
    - Rename network card name to NIC, set IP ( 192.168.1.11 & 12 and default gateway: 192.168.1.10)
    - Rename to NODE1, NODE2 while joining to the AD domain, restart and remember to logon as Domain Administrator.

    - Allow Remote Desktop

    - Install display driver (for using with projector)

    - install Hyper-V role, restart, logon as Domain Admin to finish Hyper-V role installation.

    - In Hyper-V Manager, create a Virtual Network named “ProdLAN”, connect to External (a physical NIC), and remember to check “Allow management OS to share this NIC” (On production servers with multiple NICs, this box does not need to be checked). Make sure to use the same name (ProdLAN) on both NODE1 & NODE2.
    - In “Network Connections”, switch to Detailed View, and rename the newly-created-connection to ProdLAN. Check the NIC properties (only Microsoft Virtual Network Switch is checked, and IPv4 is not checked). Check the ProdLAN properties (now IPv4 is 192.168.1.11 & 12)

    2. Connect to the shared storage on HN-SRV-01.

    - In NODE1, Control Panel/iSCSI initator, choose service auto start, Target: 192.168.1.1, click Quick Connect, status should be Connected. Click “Volume and Devices” tab, click “Auto Configure”, there should be 3 volumes listed.

    - In NODE1, Server Manager, Storage, Disk Mgmt: bring online and initialize 03 new disks. Create and format volume named Quorum for the quorum disk and assign Q: dive letter. Create and format Storage01 and Storage02 but choose “Do not assign a driver letter…” option (new support in WS08R2)

    - In NODE2, iSCSI initiator as above, bring Online, and Change to Q: drive letter for quorum device

    3. Cluster installation

    - NODE1 & NODE2: add Failover Clustering feature

    - NODE1: in Failover Cluster Manager, Validate a Configuration, Browse, select NODE1;NODE2, then choose Run All Tests, takes 5 min, click View Report. There is a Warning sign in Network (IPConfig warning: no Default gateway info & Network Comm: Nodes are reached by only one pair of interfaces due to only a single network card is used) 

    - NODE1: Create a Cluster, Name: PRIVATE-CLOUD, IP: 192.168.1.51, takes 1 min, View Report, should be no warning/error. Quorum type should be: Node and Disk Majority (Cluster Disk 1). (The Quorum device is auto selected as Cluster Disk 1 )

    - NODE1: Enable Cluster Shared Volumes, the c:\ClusterStorage will be auto created on both nodes. Click CSV node, Add storage, add Storage01 (and 02). The Volume1 (and Volume2) subfolders will be auto created in c:\ClusterStorage of both NODE1 & NODE2.

    Part 5. VM Live Migration testing, creating a VM template in SCVMM and proposing VMs using SCVMM SSP portal

    1. Create a VM template in SCVMM libary

    - MGMT: in SCVMM console: Add Host to add NODE1 & NODE2 as well as PRIVATE-CLOUD cluster to SCVMM console. At "Host Properties" screen, enter "C:\ClusterStorage\Volume1" as the path, click Add, then Next. The SCVMM agents will be installed on NODE1 & NODE2.

    - NODE1: create or import a reference VM in the folder C:\ClusterStorage\Volume1, for example use "Base-WS08R2 Std Fixed-09-400", memory is set to 400 MB, 1 processor, set Processor compatibility, set Network Adapter to ProdLAN, etc... You can test the Live Migration if needed.

    IMPORTANT: that reference VM (installed with WS08R2 Std) must use a fixed virtual disk of 9 GB. If the default dynamically expanding virtual disk (default size is 127 GB) was used, the portal would not be able to Create the VM due to the insufficient storage error.

    - MGMT: in SCVMM console: Virtual Machines tab, right click the reference VM (must be in the Stopped state), choose “New template” command (the source VM will be generalized (sysprep’ed) and deleted), enter "Base WS08R2 WEB" as the template name, accept all defaults for Hardware screen; for Guest OS screen: set workgroup to CLOUD-WKG, browse to select “\\MGMT.mycompany.com.vn\MSSCVMMLibrary” as the Path. This will take 13 min.

    - MGMT: in SSP portal, Settings, Configurate VM templates, Import templates, select MGMT as Library server, MSSCVMMLibrary, then click Search, select the listed VM template, “Add Selected”, Next and click “Submit Request”, then click "Save and Close"

    2. Create BusinessUnitUser:

    - MGMT, in SSP portal, click User Roles tab, select BUITAdmin, click View/Edit Member (both administrator and staff1 are included);
    - Click "User Roles" again, select BusinessUnitUser, View/Edit Members, select Business Unit, Infra, Service…, click Add Members, enter mycompany\staff2 (previously created), Save and Close

    3. Create infrastructure in SSP portal:

    - Requests/ Register business unit (sample data: "Core Banking Unit 01", CBU01, staff1@mycompany.com.vn, Administrators: mycompany\administrator, mycompany\staff1. Click Submit. Click Requests again, and Approve.

    - Requests/Create Infrastructure Request: enter "Core Banking Infra", enter some Expected Decommision Date, Memory: 1G, Storage: 18.2G, click Next to “Service and Service Roles” page, enter "Internet Banking Service", select "My Demo Environment", Memory: 1G, Storage 18.2G, select ProdLAN and click Add, click “Add Service Roles”, enter "Internet Banking Web Role", add ProdLAN, click Save and Close, click Next to “VM template” tab, select available VM template (9G/400MB), click Next, click "Submit Request"

    - Requests, select the Infra Request, click "Internet Banking Service", in Template Library section, click “Assign Library”, select MGMT as Library Server and MSSCVMMLibrary as Share, Submit, enter the same info for “Stored Virtual Machine Location” section, click Save and Close. Click "Internet Banking Web Role", click Save and Close. Click the selected VM template, click Save and Close, then click Approve.

    4. VM Provisioning:

    - Close the SSP portal

    - Shift + Right click IE, Run as different user (or use RDP), mycompany\staff1 (as BUIT admin), add http://MGMT to Favorite Bar. Notice that the Settings tab is missing (expected).
    - Click Virtual Machines tab, click Create virtual machine, enter 2 as the number of VM, enter “WebServer” as Computer Name and 001 as Index suffix, then Under Template, choose the desired template, click “View Properties” to make sure the Storage is under the 21G limit, then click Create

    - In NODE1 HyperV Manager, WebServer001 will be created. In Node 2 HyperV Manager, CloudDemo002 will be created, and in Failover Cluster Manager/PRIVATE-CLOUD/Services and Apps node: "SCVMM WebServer001 Resources" and "SCVMM WebServer002 Resources" will be created.

    Part 6. PRO Tips implemetation

    - MGMT: IMPORTANT: Install the SCOM Agent on NODE1, and NODE2 (note: add mycompany\svcacct to either Domain Admins or Local Admin on NODE1/2 for Agent Push Installation to work)

    - MGMT: In SCVMM console, right click Private-Cloud host, click PRO tab, deselect Inherit PRO settings... box, select "Enable PRO..." and "Automatically implement PRO tips"

    - MGMT: Open Admin Tools/Performance Monitor, delete all existing counters. Click Add, browse to select NODE1, press the Enter key, then choose "Hyper-V Hypervisor Logical Processor - % Guest Run Time", click OK. Do the same for NODE2. Make the line thicker and of different colors.

    - In WebServer001 & 002, copy CPU-busy.vbs from c:\shared to the Desktop. Right click, Open with Command Prompt to execute. In the Hyper-V Manager of the Guest, CPU Usage will be around 48%, but in Task Manager of the Host, it is still 0%. In the Performance Monitor, the Guest Run Time lines will be around 50%.

    - Use Live Migration to move all WebServer001 & 002 to a single host such as NODE2 --> NODE2 HyperV will show 2 VMs, with CPU usage of each VM is 48% (Task Manager: still 0%), and Performance Monitor counter for NODE2 will be around 99%, and counter for NODE1 will be around 1%.

    - MGMT: Wait a little and a PRO Tip will be displayed in SC VMM console as well as SCOM alert view. The PRO Tip will be also executed to automatically balance the VM load.

    Appendix. CPU-busy.vbs file content:

    Dim goal
    Dim before
    Dim x
    Dim y
    Dim i
    goal = 2181818
    Do While True
      before = Timer
        For i = 0 to goal
          x = 0.000001
          y = sin(x)
          y = y + 0.00001
        Next
      y = y + 0.01
      WScript.Echo "I did three million sines in " & Int(Timer - before + 0.5) & " seconds!"
    Loop

    Part 7. SCVMM SSP Dashboard installation

    - server name: DASHBOARD

    - install DotNet Framework 3.5.1

    - install ms.com Windows SharePoint Services 3.0 x64 wSP2, using the Advanced option, then Stand-alone, once Finished choose to run the ... Configuration Wizard.

    - setup sql 2008 w sp1, only Database engine, use svcacct as the service account

    - dashboard setup process

    + VMM SSP Dashboard screen
    . app pool identity mycompany\svcacct
    . DB server name: MGMT (which is SSP server name)
    . VMM SSP dbname: DITSC (fixed)

    + WSS 30 info screen
    . site owner: mycompany\administrator
    . SharePoint DB server name: DASHBOARD ("Session Database Name" will be auto created)

    . accept the default URL which is http://dashboard:12345/

    References

    - How to Integrate Operations Manager with VMM 2008 R2 http://technet.microsoft.com/en-us/library/ee236428.aspx

    - Measure guest operating system processor utilization using Performance Monitor http://technet.microsoft.com/en-us/library/cc768535(BTS.10).aspx

    - Guide to Setting up a 2 node Server 2008 failover cluster under HyperV 

  • Que Nguyen's Microsoft techology blog

    Hyper-V Architecture and Feature Overview

    • 0 Comments

    Hyper-VArchitecture diagram

    Hyper-V architecture overview

    Full article: http://msdn.microsoft.com/en-us/library/dd722833(v=BTS.10).aspx

    * Hyper-V non-Windows OS support: Linux Distributions (VMs configured with 1, 2 or  4 virtual processor). Source: http://www.microsoft.com/windowsserver2008/en/us/hyperv-supported-guest-os.aspx

    -- SUSE Linux Enterprise Server 10 with Service Pack 3 (x86 Edition or x64 Edition)
    -- SUSE Linux Enterprise Server 11 (x86 Edition or x64 Edition)
    -- Red Hat Enterprise Linux (RHEL) 5.2, 5.3 , 5.4 and 5.5 (x86 Edition or x64 Edition)

    * Dynamic Memory with SQL Server: part 1, part 2, part 3

    * Licensing for Virtual Environments article

     

     

  • Que Nguyen's Microsoft techology blog

    COOL: "Windows Server 8” sneak preview

    • 0 Comments

    Windows Server 8 virtual machines will help you build private clouds of greater scale by supporting (at least…) 16 virtual processors fully loaded with business critical workloads like SQL Server.  Then we show you how you can deliver improved fault tolerance and flexibility, without the added tax or complexity of additional hardware, tools and software licenses, by using the new built-in Hyper-V Replica feature.  All it takes is a few clicks, a network connection and Windows Server 8.

    Watch this Online video presentation and demo.

    Source: http://blogs.technet.com/b/virtualization/archive/2011/07/18/windows-server-8-sneak-preview.aspx

  • Que Nguyen's Microsoft techology blog

    Hyper-V performance in Windows Server 2008 R2 SP1

    • 1 Comments

    * Lab Reports: Microsoft Exchange 2010 and Hyper-V R2 SP1 Performance Analysis: can support 20,000 simulated Exchange 2010 users

    * Lab Reports: Microsoft SQL Server 2008 R2 and Hyper-V R2 SP1 Performance Analysis: can support 80,000 brokerage customers

    * Lab Reports: Microsoft SharePoint 2010 and Hyper-V R2 SP1 Performance Analysis : can support more than 450,000 simulated users on a single server

     

  • Que Nguyen's Microsoft techology blog

    Monitoring non-domain servers using SCOM

    • 2 Comments

    The below article is obtained from: http://pkjayan.wordpress.com/2010/05/17/agent-managed-non-trusted-servers-without-gateway/. The text in green color is my own comment. The scenario is not using any gateway server.

    Preparation:

    - make sure the wkg-srv has the domain suffix, that means FQDN is wkg-srv.mycompany.com.vn. also a DNS entry for wkg-srv is needed

    Monitoring non-trusted servers using SCOM-Step by step

    In this scenario, monitoring of a remote, untrusted workgroup or environment isolated from any Active Directory domain is desired. Certificate authentication will be required between the management server and agent-managed workgroup servers, which will authenticate and communicate directly to the management server.

    Five steps to complete

    1. Open TCP ports 5723 and 5724 both ways from the target server to the MS server.
    2. Prepare certificates need to be installed
    3. Run the momcertimport on all management servers after the certs have been installed.
    4. Manual install of agents and run the momcertimport on servers to be monitored
    5. Approve agents in SCOM console

    Testing Ports

    To test if the required ports are open:

    Log on to the target serverFrom a command prompt typeTelnet <Management Server> 5723 If you get a cursor at the top left corner then the port is openAny other errors indicate that the port is still closed.

    Do the same from the management server back to the non-trusted server

    Certificates need to be installed

    Retrieve and install the Root CA certificate

    Download root certificate from the Root Certificate Authority server:

    Logon on the Management ServerOpen a web Brower and navigate to http://<certificateserver>/certsrv Click on Download a CA certificate, certificate chain, Download CA Certificate chainClick on save.Save to a location of your choice. The default file name is certnew.p7b.

    Import root certificate to Management Server certificate store

    Open run and type MMC Click on file, add/remove snap-inClick on Add and select Certificates, and click on add again.Select computer account and say finishClose the window and say okto the add remove window.

    Expand certificates and right click on “Trusted Root Certification

    Authorities

    Click on all tasks, Import

    When the wizard opens navigate to the downloaded cert is

    certnew.p7b . (change the file type to PKCS #7 to select the cert file)

    Accept the defaults and finish

    Perform the above steps on all Management Servers.

    Copy the downloaded root certificate to non-trusted servers and import the same using above steps.

    Create and Export Custom OpsMgr Certificate

    Do this on the certificate server (at least on Windows Server 2008 Enterprise, or Windows 2008 R2 Standard) Create certificate template for custom OpsMgr Certificate:

    Click Start, click Run, type mmc, and then press Enter.On the File menu, click Add/Remove Snap-in.Click Add.Under Add Standalone Snap-in, click Certificate templates, and then click Add.Click Certification Authority, and then click Add.


    In my case, the certificate server is running Windows Server 2008 Enterprise (not R2!)

    In the Certification Authority snap-in, select the Local computer (the computer this console is running on) option.

    Click Finish.

    Click Close, and then click OK.

    In the Certification Authority snap-in, verify that the Certificate Templates snap-in and the Certification Authority snap-in appear.

    Click Certificate Templates.

    In the details pane, right-click Computer, and then click Duplicate Template. You will be presented with 2 options, just choose Windows 2003 Server, Enterprise Edition

    On the General tab, change the template name to OpsMgr2007.

    Verify that the validity period meets your organization’s requirements.

    Click the Request Handling tab, and then click Allow private key to be exported.

    Click the Subject name tab, and then click Supply in the Request option.

    Click the Security tab.

    Grant Enroll and Auto enroll permissions for the following groups in all domains:

    Authenticated users

    Domain Admins

    Domain Computers

    Enterprise Admins

    Click Apply, and then click OK.

    To verify the settings, expand Certificate Templates.

    In the details pane, right-click the template that you configured, click Properties, verify your settings, and then click OK.

    Expand Certification Authority (local), and then expand your certification authority.

    In the console tree, right-click Certificate Templates, point to New, and then click Certificate Template to Issue.

    Select the new template, and then click OK.

    Verify that the new template appears in the details pane, and then verify that the Server Authentication entry and the Client Authentication entry appear under Intended Purpose.

    Close the snap-in.

    Click Start, click Run, type gpupdate /force and then press Enter.

    Click Start, click Run, type http://<certificateserver>/certsrv in the Open field, and then press ENTER.

    If you are prompted, enter the domain administrator account name and the password.

    On the Certificate Services Web page, click Request a certificate under Select a task.

    Click Advanced certificate request.

    Click Create and submit a request to this CA.

    In the Certificate template list, verify that your new certificate template appears. In my case, I have to restart the certificate server for that new template to appear.


    On the management server, use the Certificates MMC (not the web UI) to request 02 certificates of the newly duplicate template for FQDN of the management server as well as the non-domain server, then export to 2 files named RMS.cfx and WKG-SRV.pfx to be used with MOMImport utility later.

    Submit the certificate request to the certification authority server:

    Click Start, click Run, type http://<certificateserver>/certsrv in the Open field, and then press ENTER. .On the Certificate Services Web page, click Request a certificate under Select a task. Click Advanced certificate requestClick Create and submit a request to this CAIn the Certificate Template field, select OpsMgr2007

    In the Name field, type the FQDN of the Root Management Server

    Select the Mark key as exportable check box. When you are using the Web certificate request UI, you must also check the Store the certificate in the local computer certificate store box  (In my Web certificate enrollment UI, there is no such checkbox, so I have to use Certificate MMC: navigate to Local Computer/Personal and choose to Request a Certificate, then fill the FQDN in the Common Name and Display Name fields, that means the Web UI cannot be used)
    Click Submit to submit your request to the certification authority server, and then follow the instructions that appear on the screen

    Depending on the security configuration on the CA, you have to wait for an administrator to manually approve the request. It is not guaranteed that the CA can be downloaded immediately

    Once the certificate is issued, Export the certificate for further configuration

    Click Start, click Run, type mmc, and then press Enter

    On the File menu, click Add/Remove Snap-in

    Click Add

    Click Certificates, and then click Add

    Select Computer account, and then click Finish

    Select Local computer, click Finish, click Close to close the snap-in list, and then click OK to close the Add/remove snap-in window

    Expand Certificates (local computer), expand Personal, expand Certificates, and then select a suitable certificate

    Right-click the certificate, point to All tasks, and then click Export

    Click Next

    Select Yes, export private key, and then click Next

    Use the default setting for the file format

    Type a password for the file

    Type a file name, and then click Next. For example, type C:RMS.pfx

    Click Finish


    Also on the management server, export the certificate of the non-domain server to a file named WKG-SRV.pfx then copy to the non-domain server.

    Repeat the above step on all the non-trusted servers. Since the non-trusted servers are not part of the same domain as the CA, create the certificate on a different server and export it to a USB drive or other storage device. Then manually copy it to the gateway server and import it.

    The below import step on the management server may not be needed since we are using two separate certificates for the management server and non-domain server???.

    Install and configure the Custom OpsMgr Certificate on Management server

    Import the custom certificate to local store:

    Click Start, click Run, type mmc, and then press EnterOn the File menu, click Add/Remove Snap-inClick AddClick Certificates, and then click AddSelect Computer account, and then click Finish

    Select Local computer, click Finish, click Close to close the snap-in list, and then click OK to close the Add/remove snap-in window

    Expand Certificates (local computer), expand Personal, expand Certificates

    Right-click the certificate, point to All tasks, and then click Import

    Click Next

    Browse and Select the copied certificate, and then click Next

    Use the default setting for the file format

    Type a password for the file

    Check off Mark this key as exportable

    Click next, make sure the certificate store is personal, click next and finish


    On the management server, use MOMCertImport utility to import the RMS.cfx (a password is needed)

    Import the custom certificate to Operations Manager on Management server:

    Run the momcertimport utilityUse the same pfx certificate (the custom OpsMgr certificate) that created in previous step. This tool writes the certificate serial number to the registry. This also helps OpsMgr components find the proper certificate for authenticating easily.The momcertimport utility is on the install cd under supporttoolsi386Copy momcertimport.exe and the pfs certificate into the same folderOpen a command prompt, navigate to the folder with both files and type the following command

    C:>MOMCertImport.exe certfilename.pfx

    Do this on all SCOM management servers. Root Management Server, Management Servers.

    Repeat the following step on the workgroup (non-trusted) computers

    Install and configure the Custom OpsMgr Certificate issued by CA for non-trusterd server

    Install the agent on the workgroup computer:

    Run the MOMAgent.msi file.On the Welcome screen, click Next.When you are prompted for a folder destination for the software, accept the default location, click Next.When you are prompted to configure the management group information, Type the management group name, the management server name, and the port, and then click Next.Accept the default settings, and then click Next.

    Verify that all information that you have entered is correct, and then click Install to start the installation.

    When the installation is complete, click Finish.

    On the non-domain server, use MOMCertImport utility to import the WKG-SRV.cfx (a password is needed)

    After agent installation, Import the custom certificate to Operations Manager:

    Run the momcertimport utility

    Use the same pfx certificate (the custom OpsMgr certificate) that created in previous step. This tool writes the certificate serial number to the registry. This also helps OpsMgr components find the proper certificate for authenticating easily.

    The momcertimport utility is on the install cd under supporttoolsi386

    Copy momcertimport.exe and the pfs certificate into the same folder

    Open a command prompt, navigate to the folder with both files and type the following command

    C:>MOMCertImport.exe certfilename.pfx (Custom OpsMgr Certificate issued by CA for non-trusterd server)

    Restart the OpsMgr Health service. On SCOM 2007 R2, the new names are "System Center Data Access/Management and Management Configuration"

    Wait for the management server to see the manual installation and to request approval. This should take some time (five to ten minutes).

    When you are prompted, approve the agent. The non-trusted server agent can now communicate with the Management server.

     
     
    * How to Obtain a Certificate Using Windows Server 2008 Stand-Alone CA in Operations Manager 2007 http://technet.microsoft.com/en-us/library/dd362655.aspx

    * Step by Step for using Certificates to communicate between agents and the OpsMgr 2007 server It has some extra steps for creating the RunAs account
     
     
    I have given a step by step walkthrough of a windows 2008 Stand-alone CA here. It will take some time to download as the graphics need tuning but it fits in with the documention steps above. The one Alex suggests also covers this. If the agent can't directly access the certificate server then you'll need to add a few steps (which I have tried to highlight in bold below).

    The high-level process to obtain a certificate from a stand-alone certification authority (CA) is as follows:

    1. Download the Trusted Root (CA) certificate – do this from a machine that has access to the certificate server and then copy to the workgroup machine.

    2. Import the Trusted Root (CA) certificate to the workgroup machine.

    -------

    3. Create a setup information file to use with the CertReq command-line utility –do this on the workgroup machine.

    4. Create a request file – do this on the workgroup machine and then copy file to a server that has access to the certificate server

    5. Submit a request to the CA using the request file from a server that has access to the certificate server

    6. Approve the pending certificate request – from the certificate server

    7. Retrieve the certificate from the CA – from a machine that has access to the certificate server and then copy certificate to workgroup computer

    8. Import the certificate into the certificate store on the workgrou computer

    9. Import the certificate into Operations Manager using MOMCertImport – on workgroup computer.

    10. And then install the agent and approve install from opsmgr console

    Cheers/ Graham

    ===========================================================

     

     
  • Que Nguyen's Microsoft techology blog

    AD RMS overview

    • 0 Comments

    AD RMS is a Windows Server feature that can help prevent confidential information (Outlook emails, Word, Excel, PowerPoint, XPS documents) from being distributed illegally to the outside world. We can have the users manually turn on protection before sharing these information internally, or we can have these information automatically protected when sending emails internally or when puting confidential documents into some folders on File Servers or SharePoint Server.

    * AD RMS overview slide download (2M)

    * AD RMS and File Classification Infrastructure (FCI) (using AD RMS Bulk Protection Tool) article

  • Que Nguyen's Microsoft techology blog

    Private Cloud update: Hear what NetApp and Cisco are Saying After Joining the Hyper-V Fast Track Program

    • 0 Comments

    As we announced yesterday we are proud to have NetApp and Cisco participating in the Hyper-V Cloud Fast Track program and delivering pre-validated private cloud solutions for customers.

    The new NetApp Hyper-V Cloud Fast Track with Cisco builds upon the reference architecture and layers on the additional capabilities inherent in the NetApp and Cisco infrastructure. This joint solution exemplifies a key tenet of Fast Track which is the extensible nature of the architecture. Check out what NetApp is saying about this solution as well as Cisco.

    If you happen to be at Tech Ed, Alex Jauch from NetApp, will be demonstrating some of the capabilities of their offering in Bryon Surace’s VIR327 session on Hyper-V Cloud Fast Track on Tuesday morning at 10:15 to 11:30 in Room B211 – hope to see you there.

    Scott Rosenbloom
    Sr. Product Manager
    Server & Cloud Division
    Microsoft Corp.

    Source: http://blogs.technet.com/b/windowsserver/archive/2011/05/17/hear-what-netapp-and-cisco-are-saying-after-joining-the-hyper-v-fast-track-program.aspx

    NetApp Hyper-V Cloud Fast Track with Cisco

    Lee Gates, Director – Microsoft Business Unit

    Today NetApp announced the NetApp Hyper-V Cloud Fast Track with Cisco data center architecture design. This pre-validated configuration is built on research and solution development by the Microsoft Technical Marketing team at NetApp. During early planning for the project, we laid out a few high level NetApp engineering goals to deliver a robust, innovative solution for private clouds:

    1. System Center Opalis integration to enable workflow reuse and composition
    2. Industry leading rapid provisioning performance of Virtual Machines for Cluster Shared Volumes
    3. Maximum PowerShell support for flexibility and customization

    With these goals, Cisco was a natural partner for the solution:

    Checkmark Great System Center integration
    Checkmark PowerShell support for UCS
    Checkmark Large memory advantages in the UCS architecture enable VM density and large applications
    Checkmark Cisco technical teams have worked well with NetApp on many innovative solutions

    There’s a tremendous amount of work behind the solution. It rides on the foundation NetApp made in December 2009 in when our strategic alliance with Microsoft focusing virtualization, cloud computing, and storage & data management was announced. PowerShell support has been incredibly important along with our other System Center integrations. We are particularly proud to use these in the solution and introduce Opalis support.

    The team will be in the NetApp booth #1001 at TechEd. Drop by and see us and the demos we’re running every 30 minutes in the theater.

    Source: http://blogs.netapp.com/msenviro/2011/05/netapp-hyperv-cloud-fast-track-with-cisco.html

Page 2 of 9 (87 items) 12345»