Cheng's Random Thoughts on System Management : Setup

SCVMM 2008 R2 downloadable docs are available now!

Cheng Wei — Thu, 01 Oct 2009 03:24:00 GMT

Greetings, folks!

I'm pleased to let you all know that our documentation team has just published the doanloadable version of SCVMM 2008 R2 documents at here: http://go.microsoft.com/fwlink/?LinkId=162764

Available documents for download are:

· Deployment Guide

· Guide to Operations Manager Integration

· Security Guide

· Operations Guide

· Scripting Guide

· Cmdlet Reference

· Building PRO-Enabled Management Packs

Go check them out today, download them onto your favorite device, print them out or just read them wherever / however you want.

Feedback on these? Please send it to: scvmfdbk@microsoft.com.

Cheers!

Cheng

VMM 2008 R2 Upgrade Guide

Cheng Wei — Mon, 24 Aug 2009 17:43:00 GMT

As part of the VMM 2008 R2 launch, I'm inviting my colleague, Kerim, to provide you some information on how you can upgrade your existing VMM 2008 / VMM 2008 R2 RC versions to the VMM 2008 R2 RTM version. Here comes Kerim:

===================

Hi everyone,

My name is Kerim Hanif. I am a program manager here at VMM product team, today I want to explain the paths you can upgrade to VMM 2008 R2 RTM. The purpose of this blog is to give you a general idea on how the upgrade works, for more detailed information please see the VMM 2008 R2 Deployment Guide in VMM TechNet http://go.microsoft.com/fwlink/?LinkID=139191

Upgrading from VMM 2008 RTM to VMM 2008 R2 RTM

This is an in-place upgrade, you don’t need any extra tools, it is build right in the product.

One caveat for this upgrade - You can’t restart any of the prior jobs after the upgrade, after upgrading all jobs that were run prior to the upgrade will appear in the job history; however, those jobs cannot be restarted. It is recommended that you allow all jobs to complete before upgrading the VMM server. Jobs that are canceled during the upgrade cannot be restarted after the upgrade is completed.

Pre-upgrade tasks;

1. Perform a full backup your VMM 2008 RTM database, this way in an unlikely case that something goes wrong you can always reinstall VMM 2008 RTM using this database.

Upgrade tasks;

1. Start the VMM 2008 R2 RTM setup (with elevated privileges) on a machine that contains a VMM 2008 RTM component and select any one of the components from the splash screen that comes up.

2. Setup will detect that you have a VMM 2008 RTM bits installed and will automatically start the “upgrade wizard”

3. In the wizard we will show you which components are installed on the box the setup is currently running and ask you to confirm that we will go ahead and upgrade all of these components. Note: You may ask what happens if I select a component from splash screen that is not installed on the box. Let’s say you have admin console and server installed on this box and you have selected Self-Service Portal. In this case the behavior is that we will first upgrade all the components (admin console and server for this example) and then start the installation of Self-Service portal.

Post upgrade tasks;

1. You will need to perform this procedure above on all computers that has a VMM 2008 RTM component installed (admin console or SSP)

2. Refresh all hosts and library servers from the admin console.

1. Go to hosts view (also Library view), select machines and select refresh from the actions pane. We are doing this manually so that we don’t have to wait for the host refresher to run. By doing this all the agents on these machines will find out that the db version has changes and they will go to “needs attention” state.

3. Now you will need to go to the “managed computers view” in admin console and right click all the agents (both on hosts and library servers) that are in “needs attention” state and select “update agent”. Note: You can multi select here but do these in batches of 10-25.

Upgrading from VMM 2008 R2 RC to VMM 2008 R2 RTM

This upgrade will require the “UpgradeVMMR2RC.exe” tool (this tool is available on the Microsoft Connect site under VMM 2008 R2 connection - http://connect.microsoft.com/Downloads/Downloads.aspx?SiteID=960 );

Pre-upgrade tasks;

1. Perform a full back up your VMM 2008 R2 RC database, this way in an unlikely case that something goes wrong you can always reinstall VMM 2008 R2 RC using this database.

Upgrade tasks;

1. Uninstall VMM 2008 R2 RC with “retain db” option

2. Open a command prompt with elevated privileges and run “UpgradeVMMR2RC.exe” tool against the “retained” db in the previous process.

a. Command usage: UpgradeVMMR2RC.exe –server <computername[\instancename]> -database <database>

i. E.g. UpgradeVMMR2RC.exe –server VMMDB01\MICROSOFT$VMM$ -database VirtualManagerDB

3. Install VMM 2008 R2 RTM using this upgraded db above.

Post upgrade tasks;

1. You will need to uninstall all components with RC code and install new components with RTM code (admin console, SSP)

2. Refresh all hosts and library servers from the admin console.

a. Go to hosts view (also Library view), select machines and select refresh from the actions pane. We are doing this manually so that we don’t have to wait for the host refresher to run. By doing this all the agents on these machines will find out that the db version has changes and they will go to “needs attention” state.

a. If you have machines that are in ‘access denied’ state, you will need to ‘reassociate’ these first before upgrading the agents; so right click those machines, select reaccociate then when it is complete right click again and select “update agent”

You may also have clustered hosts, you may still be on VMM 2007, created PRO configuration (OM integration) with VMM 2008 RTM and wondering how to migrate, for these topics please see VMM 2008 R2 Deployment Guide in VMM TechNet http://go.microsoft.com/fwlink/?LinkID=139191 there are great step-by-step guidance provided in that document.

Thank you and I hope this information helps you in your migration.

Kerim Hanif

When should I consider running my VMM Service by using a domain account?

Cheng Wei — Fri, 20 Feb 2009 05:19:00 GMT

Greetings folks!

Hope you all had a good Valentine weekend last week!

If you noticed, during your VMM Server installation, there is an option of allowing you to select a different account to run VMM Server service (VMMService) from the default computer account.

“When should I consider using this non-default option?”, you may ask.

You may have other reasons / policies to run VMMService by using a domain account. However, based on some of our recent CSS reports, choosing your own domain account to run VMMService should be a preferred option for customers who are running a more restrictive AD environment. Here is why:

· With default install option, VMMService is run under the VMM Server local system / computer account.

· When adding trusted domain-joined VM hosts (whose domain has two-way trusts with the domain VMM Server is in), VMM Server adds its computer account (the account it uses to run VMMService) into the local administrator group of the target VM hosts, as part of the Add-VMHost process.

· In a more restrictive AD environment, we find it common for customers to have a “Restricted Groups” group policy that disallows machine accounts to be part of the local administrators group. Hence, when the GP is in effect, the machine account will be removed by this GP.

· And when this happens, the affected VM Hosts will show up in VMM console as “Needs Attention” (and the agent status will be “Not Responding”), since the VMM Server will no longer be able to authenticate with the hosts. Here is error message that you will see from the failed host refresher job (BTW, we’ll be updating this error message in our vNext):

Error (2927)

A Hardware Management error has occurred trying to contact server servername.domainname.com.

(Unknown error (0x80338104))

Recommended Action

Check that WinRM is installed and running on server servername.domainname.com. For more information use the command "winrm helpmsg hresult".

When users get into this situation, there are a few options they can do to fix this issue:

1. Check with your IT security group and see if it’s possible to disable the “Restricted Groups” group policy in your Active Directory environment; or

2. Check with your IT security group and see if it’s possible to modify the group policy to allow the VMM machine account in the Local Administrators group; or

3. Check to see if it’s possible to move the VMM Server machine account to its own organizational unit (OU) and block the group policy from being applied to that OU; or

4. If making changes to your group policy (or negotiating with your IT security group J) is next-to-impossible, the only option left is to reinstall the VMM server and choose the option to run the VMM service by using a domain account with admin privilege on your VMM Server computer (in this case, you will need to remove and re-add all your VM hosts, or choose to reinstall your VMM Server without retaining data).

Hence, I highly recommend users to evaluate your IT security (AD) policies before deploying your VMM server into production environment, as those factors do directly affect how VMM performs operations within that environment. And, if you do have a more restrictive AD environment, I suggest you to use a domain account to run VMM Server service. Also, if you have a disjoint namespace environment, it's also recommended to use a domain account to run your VMM Server service.

Before I close on this subject, there is one restriction that I think folks should be aware when using a domain account to run your VMM Server service:

· Users cannot use the same domain user account to add or remove hosts.

o Say, you configured VMM Server to use account “foo\bar” to run VMM Server service.

o And it also happens to be part of the local admin group for a host “MyNewHost” that you want to add to VMM.

o When we go through AddHost wizard (or through our cmdlet), you will be asked about a credential with admin privilege for us to install agent.

o At this point, it’s disallowed to use the same user account “foo\bar” to add the host. And yes, we actually block you from doing such operation.

o The same is true for host removal, it’s disallowed to use the same account “foo\bar” to remove the host.

· Why do we not allow this?

o During host addition, we add the service account to the local admin group on the host. When removing the host, we need to remove the account from the local admin group.

§ If we remove the account first, we won't be able to talk to the agent.

§ If we remove the agent first, we leave the account behind.

§ Thus, users need to use a different account for host removal.

o During host addition, we add the service account to the local admin group on the host.

§ In case of failure during the agent install process as part of the AddHost task, we need to be able to roll back and successfully remove the agent.

§ To do that, we need the same requirement.

· So, the proper process is that if you use “foo\bar” to run your VMM Server service, you will need to use a different account with admin privilege to add or remove your host.

Hope this helps and thanks for reading!

Thanks,

Cheng

Managing Hosts in Windows 2000 AD Forest By Using VMM 2008

Cheng Wei — Thu, 05 Jun 2008 08:26:00 GMT

As you know when you install VMM 2008 server, the computer where you want to install VMM 2008 Server must be joined in a Windows 2003 or Windows 2008 AD domain. That's a hard requirement and the install will be blocked if it is not met.

We hope all our customers have migrated their AD infrastructure from Windows 2000 AD to Windows 2008 or, at least, Windows 2003 version. There is just a little over two years before Windows 2000 server is complete out of support (7/13/2010).

However, in case you are one of the few customers who have not fully migrated, or are still in process of migrating your Windows 2000 AD infrastructure to a recent version, here is what you could try to temporarily workaround this limitation before or during your AD migration:

If you have not done forest-prep, perform forest-prep in the Windows 2000 AD forest and get the schema updated to Windows 2003 or 2008 AD schema.

Note: There will be result in short-term replication traffic overhead in your network, since Windows 2000 AD cannot replicate deltas of the PAS.

Introduce a separate Windows 2003 or Windows 2008 AD site in your Windows 2000 AD forest that will contain the VMM Server and Hyper-V host servers.
Configure two-way trust between the Windows 2003 or Windows 2008 AD domain controller and the Windows 2000 AD forest domain controllers.
Through AD site topology and DNS enforcement, ensure that VMM Server only authenticate with the Windows 2003 or the Windows 2008 domain controller.

After above configuration, you should be able to add hosts that live in a Windows 2000 AD forest into the VMM server that is in a Windows 2003 or Windows 2008 AD site.

Here is a reference document on how to set up a separate AD site for Exchange:Microsoft IT Showcase: Creating an Active Directory Site for Exchange Server

Thanks for reading!

Cheng

Installing SCVMM 2008 Beta

Cheng Wei — Wed, 30 Apr 2008 06:24:00 GMT

Now that you got the beta release, the first order is to set it up.

Before you start, I'd highly recommend you to spend a few minutes to read through the FAQ document (published on the connect site). There, we provide answers to some frequently asked questions that should help you quickly get started with our product, we also documented a few known issues along with workarounds so that you are aware of some of the limitations in the beta release.

In terms of the setup process, we made it real easy for you. Similar to SCVMM 2007 setup, you have options of installing VMM server, admin console, self-service portal and local agent, right from our neatly designed setup splash screen. All the install wizards provide prerequisite checks for software dependencies and hardware dependencies. After making sure your system matches all the prerequisites, your VMM server will be up and running in just a few clicks.

For VMM server install, in VMM 2008, we now allow you to use a remote SQL server instance as your data source, on top of the light-weight SQL express edition option, giving you more flexibility to better control and manage your data.

Before closing it out for setup, I'd like to point out a couple important notes for VMM 2008 beta (BTW, all of these are covered in the FAQ):

VMM 2008 Server can only be installed on a 64-bit Windows 2008 server.

Windows Server 2003 or a 32-bit system will be blocked from installing SCVMM 2008 Server.
In addition, VMM Server, admin console and self-service portal installations are not supported on Windows Server 2008 Core Editions.

Upgrading from VMM 2007 to VMM 2008 Beta is not supported.

Upgrading hosts and library servers from VMM 2007 to VMM 2008 is not supported in VMM 2008 Beta.
To use your current hosts and library servers with VMM 2008 Beta, remove the VMM 2007 agents and then add the host and library servers to VMM 2008 Beta.

Thanks for reading,

Cheng