Cheng's Random Thoughts on System Management : VMM

SCVMM 2008 R2 downloadable docs are available now!

Cheng Wei — Thu, 01 Oct 2009 03:24:00 GMT

Greetings, folks!

I'm pleased to let you all know that our documentation team has just published the doanloadable version of SCVMM 2008 R2 documents at here: http://go.microsoft.com/fwlink/?LinkId=162764

Available documents for download are:

· Deployment Guide

· Guide to Operations Manager Integration

· Security Guide

· Operations Guide

· Scripting Guide

· Cmdlet Reference

· Building PRO-Enabled Management Packs

Go check them out today, download them onto your favorite device, print them out or just read them wherever / however you want.

Feedback on these? Please send it to: scvmfdbk@microsoft.com.

Cheers!

Cheng

It's here - SCVMM 2008 R2 RTM'ed.

Cheng Wei — Mon, 24 Aug 2009 20:28:00 GMT

Greetings folks!

This is one of the very exciting mements that I have to drop whatever I'm doing and tell you about this. :-)

I've been busy on a few things. So sorry for not able to post much information lately. And I'll tell you about what I was working on in a few months. We're baking something big. :-)

Unlike last time when we released VMM 2008 (which was a few months after Hyper-V RTM), we're tying our VMM 2008 R2 release schedule right together with Windows Server 2008 R2. And it comes with a big load of goodies (Live Migration support, CSV support;Storage Migration; Rapid Provisioning; Host Compatibility Check; Support for 3rd party CSF; Support for Veritas Volume Manager; Integration with Visual Studio Lab Manager; etc.).

Go download a trial and give it a try, go get it now, and unleash the virtualization power that Microsoft brings to you.

Here are more information on this exciting RTM announcement:

http://blogs.technet.com/systemcenter/archive/2009/08/24/system-center-virtual-machine-manager-vmm-2008-r2-rtms.aspx

Cheers!

Cheng

Got a "Bad Gateway"?

Cheng Wei — Tue, 14 Apr 2009 19:41:00 GMT

Greetings, folks!

Hope you had a great Easter on last Sunday, if you celebrate that holiday! My kids certainly enjoyed hunting eggs in a typical Seattle drizzling Saturday morning. J

This blog entry is for folks who use or plan to use VMM to manage VMware ESX hosts.

If this is your first time adding your ESX host to VMM, and your ESX hosts are added into VMM by using DNS name (instead of IP address), and your network environment with Internet proxy is not made aware of VMware host DNS names, you may see error similar to below:

Error (2891)

VMM cannot complete the …. action on the vmm-esx1.scvmm.contoso.com server because of the error: The remote server returned an error: (502) Bad Gateway.

(Unknown error (0x194))

This issue may occur when:

· To turn your ESX host from “OK(Limited)” state to “OK” state (to get your ESX host in full management mode), you are providing root user credentials and attempting to retrieve the certificate and SSH key from the ESX host to approve.

· You may also run into the same error when attempting to perform a live migration (VMotion) for a VM hosted by an ESX host from VMM admin console.

The cause of this issue is due to the DNS resolution (or proxy configuration) on your VMM server:

· VMM uses web services to communicate to VMware Virtual Center and ESX hosts.

· Proxies are generally configured to permit pass-through of local DNS names.

· In some cases, when the proxy is not configured for a DNS name, the web service connection may fail.

Following are some simple options to resolve this issue:

· SOLUTION 1: Include VMWare host DNS names in the internet proxy configuration.

· SOLUTION 2: Add dns hosts to the proxy configuration of Internet Explorer

· SOLUTION 3: Create a file "vmmservice.exe.config" in the same location as vmmservice.exe (by default, it’s installed under this directory: %ProgramFiles%\Program Files\Microsoft System Center Virtual Machine Manager 2008\bin\) with contents similar to the following. Note: you will need to bounce the VMM server service (restart “Virtual Machine Manager” service from services.mcs) for it to pick up the new proxy configuration).

<system.net>

</bypasslist>

</defaultProxy>

</system.net>

</configuration>

On the extreme side, you could also completely turn off the proxy on your VMM server by applying the following config file:

<system.net>

</defaultProxy>

</system.net>

</configuration>

Hope this helps and thanks for reading!

Cheers,

Cheng

VMM Security content is posted on Technet.

Cheng Wei — Fri, 06 Mar 2009 04:59:00 GMT

Greeting folks!

Hot off press – Our content team has worked hard to produce a set of documents around how to secure your VMM 2008 environment, which includes interesting topics:

· Basics of VMM security

· Hardening VMM components (from VMM Server to the VM hosts, from your DB server to your library server)

· Security around PRO (OpsMgr integration)

· We even offer you the security guidance on how to configure a more secure VMware environment by using VMM

This set of documents offer both security guidelines as well as some best practices in tightening up the security in your VMM environment. Some of the documents extend their ways into explaining how VMM works “under the hood”, so that the readers understand what and why they should decide to implement. I hope you’ll find it as useful, refreshing and informative as I did.

It’s available for download here:

http://technet.microsoft.com/en-us/library/cc764247.aspx

Enjoy your reading!

Cheng

NIC teaming and VMM

Cheng Wei — Thu, 26 Feb 2009 23:14:00 GMT

Greetings folks,

NIC Teaming, also called “Load Balancing and Fail-Over” (LBFO) or “Link Aggregation” or “IEEE 802.1AX-2008”, groups multiple interfaces to provide fault tolerance and load balancing for Network Interface Cards (NIC) connecting Windows Server to the network. This aggregation combines the individual capacity of multiple interface cards to form a high performance virtual link so the failure of an individual port or adapter does not cause a loss of connectivity. Below is a picture from Wikipedia.org on how a typical NIC teaming looks like:

The Microsoft support position on NIC teaming for Windows Server 2008 (deployed either in a physical environment or virtualized environment with Hyper-V) is that hardware and driver support is provided by the hardware manufacturer as outlined in KB Article 254101.

Alex, one of our test engineers, spent some time researching Broadcom Advanced Control Suite (BACS) version 11.6.10 with Broadcom Advanced Server Program (BASP) NICs, and found out that he could actually make NIC teaming work with his Hyper-V hosts and have VMM manage the BASP NICs.

Here is the blog he posted for what he has experimented and his step-by-step notes on how he made it work for him.

http://blogs.technet.com/apb/archive/2009/02/25/using-vmm-to-manage-you-hyper-v-nic-teams-created-with-bacs.aspx

Hope this is useful information for you!

Enjoy your reading,

Cheng

When should I consider running my VMM Service by using a domain account?

Cheng Wei — Fri, 20 Feb 2009 05:19:00 GMT

Greetings folks!

Hope you all had a good Valentine weekend last week!

If you noticed, during your VMM Server installation, there is an option of allowing you to select a different account to run VMM Server service (VMMService) from the default computer account.

“When should I consider using this non-default option?”, you may ask.

You may have other reasons / policies to run VMMService by using a domain account. However, based on some of our recent CSS reports, choosing your own domain account to run VMMService should be a preferred option for customers who are running a more restrictive AD environment. Here is why:

· With default install option, VMMService is run under the VMM Server local system / computer account.

· When adding trusted domain-joined VM hosts (whose domain has two-way trusts with the domain VMM Server is in), VMM Server adds its computer account (the account it uses to run VMMService) into the local administrator group of the target VM hosts, as part of the Add-VMHost process.

· In a more restrictive AD environment, we find it common for customers to have a “Restricted Groups” group policy that disallows machine accounts to be part of the local administrators group. Hence, when the GP is in effect, the machine account will be removed by this GP.

· And when this happens, the affected VM Hosts will show up in VMM console as “Needs Attention” (and the agent status will be “Not Responding”), since the VMM Server will no longer be able to authenticate with the hosts. Here is error message that you will see from the failed host refresher job (BTW, we’ll be updating this error message in our vNext):

Error (2927)

A Hardware Management error has occurred trying to contact server servername.domainname.com.

(Unknown error (0x80338104))

Recommended Action

Check that WinRM is installed and running on server servername.domainname.com. For more information use the command "winrm helpmsg hresult".

When users get into this situation, there are a few options they can do to fix this issue:

1. Check with your IT security group and see if it’s possible to disable the “Restricted Groups” group policy in your Active Directory environment; or

2. Check with your IT security group and see if it’s possible to modify the group policy to allow the VMM machine account in the Local Administrators group; or

3. Check to see if it’s possible to move the VMM Server machine account to its own organizational unit (OU) and block the group policy from being applied to that OU; or

4. If making changes to your group policy (or negotiating with your IT security group J) is next-to-impossible, the only option left is to reinstall the VMM server and choose the option to run the VMM service by using a domain account with admin privilege on your VMM Server computer (in this case, you will need to remove and re-add all your VM hosts, or choose to reinstall your VMM Server without retaining data).

Hence, I highly recommend users to evaluate your IT security (AD) policies before deploying your VMM server into production environment, as those factors do directly affect how VMM performs operations within that environment. And, if you do have a more restrictive AD environment, I suggest you to use a domain account to run VMM Server service. Also, if you have a disjoint namespace environment, it's also recommended to use a domain account to run your VMM Server service.

Before I close on this subject, there is one restriction that I think folks should be aware when using a domain account to run your VMM Server service:

· Users cannot use the same domain user account to add or remove hosts.

o Say, you configured VMM Server to use account “foo\bar” to run VMM Server service.

o And it also happens to be part of the local admin group for a host “MyNewHost” that you want to add to VMM.

o When we go through AddHost wizard (or through our cmdlet), you will be asked about a credential with admin privilege for us to install agent.

o At this point, it’s disallowed to use the same user account “foo\bar” to add the host. And yes, we actually block you from doing such operation.

o The same is true for host removal, it’s disallowed to use the same account “foo\bar” to remove the host.

· Why do we not allow this?

o During host addition, we add the service account to the local admin group on the host. When removing the host, we need to remove the account from the local admin group.

§ If we remove the account first, we won't be able to talk to the agent.

§ If we remove the agent first, we leave the account behind.

§ Thus, users need to use a different account for host removal.

o During host addition, we add the service account to the local admin group on the host.

§ In case of failure during the agent install process as part of the AddHost task, we need to be able to roll back and successfully remove the agent.

§ To do that, we need the same requirement.

· So, the proper process is that if you use “foo\bar” to run your VMM Server service, you will need to use a different account with admin privilege to add or remove your host.

Hope this helps and thanks for reading!

Thanks,

Cheng

VMM 2008 MP is available for download!

Cheng Wei — Thu, 05 Feb 2009 04:19:00 GMT

Greetings,

My colleague, Alan Goodman, has published a blog entry about the release of VMM 2008 MP, which consists of the following exciting reports:

· Virtualization Candidates - Helps identify physical computers that are good candidates for conversion to VM.

· VM utilization - Provides information about your virtual machines.

· Host Utilization - Shows the number of virtual machines running per host.

· Host Utilization Growth - Shows the percentage growth of host resources and number of VMs.

· VM Allocation - Useful data for VM chargeback calculation.

For details, visit here.

Thanks for reading!

Cheng

Managing VM hosts in a disjoint namespace environment

Cheng Wei — Wed, 28 Jan 2009 21:43:00 GMT

Greetings folks and Happy Chinese New Year to you if you celebrate that cultural tradition!

Today, I wanted to talk about a topic that many of our TAP customers have requested support for during our VMM 2008 release development phase. We’ve seen customers with distributed and geographically dispersed regional offices or storefronts tend to have a disjoint namespace environment.

In that environment, where the FQDN of a Windows server in AD does not match the FQDN of the same server in DNS, you will not be able to search the host’s DNS FQDN through VMM Add Host wizard, as it searches against your AD. More importantly, even if you selected “Skip AD query” option on the admin console, the regular “Add Host” job would still fail if required AD operation step is not taken. The root cause of the job failure is due to the fact that we need to use the DNS host name to connect to the host via WS-MAN, but the following authentication fails when we try to authenticate the host’s DNS FQDN against AD.

Hence, in order for hosts in this environment to be successfully added and managed by VMM, the instructions below should be followed:

· We recommend users to setup/install their VMM Server by making the VMM service running under a domain account (instead of the default server machine account);

· If you’re adding your host in disjoint namespace from Admin Console, at the 2^nd page of the AddHosts wizard, you will need to check the option “Skip Active Directory name verification”;

· The SPNs of the DNS host FQDNs must be added to AD;

· For clusters, you will need to add the hosts by using the “Add-VMHost” cmdlet (see sample code below).

PS C:\> $Credential = Get-Credential

PS C:\> Get-VMMServer -ComputerName "VMMServer.Contoso.com"

PS C:\> $VMHostGroup = Get-VMHostGroup | where {$_.Path -eq "All Hosts"}

PS C:\> Add-VMHostCluster -Name "VMHostCluster.Contoso.com" -VMHostGroup $VMHostGroup -RemoteConnectEnabled $TRUE -RemoteConnectPort 5900 -Credential $Credential

In VMM 2008 release, we require users to manually add the SPNs (use command “setspn –a” with appropriate AD privilege). Here is a reference Technet article with information on how to create SPNs. For a large environment, you may want to consult with your AD administrator to run a script to add the SPNs.

For VMM vNext, we’re working on a better solution, if the VMM server service account has AD privilege to add SPN, our AddHost logic will attempt to add the host’s DNS FQDN SPN when the authentication fails. With this new feature, if customers configure their AD properly, it will eliminate a lot of manual and tedious AD operations. Here is a KB article that talks about how to create AD permissions to allow a service account to add SPNs.

Hope this helps.

Thanks for reading!

Cheng

Multiple VMs per LUN

Cheng Wei — Thu, 15 Jan 2009 20:00:00 GMT

Hi there,

Rakesh just posted a new blog, through which he explains the ins and outs about the model where users create multiple VMs by using the same LUN. He also points out that, with the new Cluster Shared Volume (CSV) support in Windows Server 2008 R2, in VMM vNext (we're working on right now), users will be able to create and manage multiple VMs on a single LUN.

Enjoy your reading,

Cheng