Confessions of a Microsoft Consultant : Server 2008

Windows Server 2008 doesn’t have to ignore the MBSA if you don’t want it to

Daniel Oxley — Mon, 20 Apr 2009 10:28:52 GMT

The Microsoft Baseline Security Analyser (MBSA) is an excellent free tool by Microsoft that provides a simple and easy-to-use method of identifying common security misconfigurations for your Microsoft Windows computers. The current version (MBSA 2.1) runs on Windows Server 2008, Windows Vista, Windows Server 2003, Windows XP and Windows 2000 and will scan all systems, most installed Windows components, and applications such as Internet Information Server (IIS) 5.0, 6.0 and 7.0, SQL Server 7.0, 2000 and 2005, Internet Explorer (IE) 5.01 and later, and Office 2000, 2002 and 2003.

A problem you might come up against however is that Windows Server 2008 computers by default have all the security settings turned on. Consequently, when you try to scan them, you see the below error appear in the MBSA console “Could not resolve the computer name: Please specify computername.”:

This is nothing to worry about and can be quickly remedied by enabling (only temporarily if necessary) the file sharing feature. To do this, just open the Network and Sharing Centre and select the radio button as displayed in the image below.

Once enabled, you can restart the scan and all should work correctly. So start checking your security right now by downloading the tool here: http://www.microsoft.com/downloads/details.aspx?familyid=F32921AF-9DBE-4DCE-889E-ECF997EB18E9&displaylang=en

I recommend that you read the Frequently Asked Questions page as there is some important information there, particularly if you wish to scan computers that don’t have internet connections (or connections that are perhaps restricted by a proxy server). The MBSA needs to download the latest security catalogue from Microsoft over the internet, but if the computer does not have internet access then the process will fail. In the FAQ are the instructions required in order to manually download the files from a different machine that does have internet access in order to manually update the catalogue on the computer running the MBSA.

Faster Creation of Virtual Machines

Daniel Oxley — Wed, 08 Apr 2009 09:55:49 GMT

I recently noticed a blog post on TechNet about a new tool that was released on CodePlex. WIM2VHD is a command-line tool allows you to create sysprepped VHD images from any Windows 7 installation source (and I suspect Windows Server 2008 R2 as well) that work with Virtual PC, Virtual Server, Microsoft Hyper-V, and Windows 7's new Native VHD-Boot functionality. Basically, you can create an entire virtual machine VHD file in minutes without have to go through the whole setup process of Windows. It is nice and simple to use, and after a brief moment of confusion I had it working fine :-)

To create my first VHD file, I ran the command: cscript.exe C:\Users\Administrator\Desktop\WIM2VHD.wsf /wim:e:\sources\install.wim /sku:Ultimate /vhd:U:\Hyper-V\Win7.vhd /size:12000 /disktype:Dynamic

However, this failed (as shown below) with the error “Error: 0: No filePath was specified”. After fiddling around with the command line to make sure that I was specifying the relevant paths, I realised that WIM2VHD was failing because it was unable to mount the WIM file from the Windows 7 DVD.

In order to mount WIM files, you first need to have installed the Windows Automated Installation Kit (WAIK), which you can get here: http://www.microsoft.com/downloads/details.aspx?familyid=4AD85860-D1F4-42A1-A46C-E039E3D0DB5D&displaylang=en. One thing to note is that I installed the beta version that was released for Windows 7. I do not actually know if the current 1.1 version will work with WIM2VHD, I imagine so. The 1.1 version can be found here: http://www.microsoft.com/downloads/details.aspx?familyid=94BB6E34-D890-4932-81A5-5B50C657DE08&displaylang=en

Once that was installed, I simply re-ran the previous command and, as you can see, had much more success!

This really is a great tool, as you can create virtual machines extremely quickly. And, the possibilities are endless because you could incorporate WIM2VHD into existing processes so that you could provision new computers easily and quickly on-the-fly using scripts.

Yet Another Core Configurator

Daniel Oxley — Mon, 06 Apr 2009 10:38:34 GMT

In the true spirit of Linux, it seems that everybody is re-inventing the wheel – because they can. So, just as your favourite Linux distro had 9,999 different versions of the same basic calculator tool (but all written by different people), it seems lately that everybody has written a graphical interface for Windows Server Core 2008. Although I may be coming across rather cynical, this tool is actually pretty good. For those of you who don’t want to use the command-line to administer Server Core, this tool might just be what you are looking for. Of course, any die-hard command prompt lovers which sneer at this tool!

By the way, I am not endorsing the tool so if it turns out that it breaks your system completely you might hear me give a ‘Nelson’ laugh in true ‘The Simpsons’ style (see below).

Kicking the tyres

Daniel Oxley — Mon, 30 Mar 2009 19:44:00 GMT

Want to try out Windows Server 2008? Or perhaps Exchange Server 2007? You can download complete virtual machine environments for a whole list of Microsoft products, free of charge. Check out the Test Drive program here: http://technet.microsoft.com/en-us/bb738372.aspx for more information and the download links.

The best thing about it is that you can download an entire virtual machine with the software pre-configured and running correctly – so you don’t need to complete any additional tasks in order to start playing/testing/evaluating the products immediately in your own virtual environment.

Enjoy!

Restarting the Microsoft File Transfer Manager

Daniel Oxley — Thu, 08 Jan 2009 12:58:05 GMT

Unless you have been hiding under a rock this week you’ll no doubt be aware that the beta versions of Windows 7 and Windows Server 2008 R2 both were released on TechNet and MSDN. If you’ve tried downloading them as well then you’ll know that they will take a while as each one requires a download of about 2.8 Gb.

As I am using a rather slow network connection to download them, it is going to take a while to get them both and will also mean that my computer will be switched off and on a couple of times before they finish. So, how do you continue the downloads without having to go back to the TechNet/MSDN page each time? Easy, just open the options on the Microsoft File Transfer Manager application (the one that you can see in the image below) and tick the “Place application shortcut on the desktop” option that is on the “General” tab. This will place an icon on your desktop that allows you to run the download manager application directly whenever you want. You can then move this icon into your Start Menu or Quick Launch bar for instant access.

Another option is to copy the file “C:\Windows\Downloaded Program Files\TransferMgr.exe” to a different location via the command prompt, and then launch this .exe file.

Performance Tuning Guidelines for Windows Server 2008

Daniel Oxley — Mon, 15 Dec 2008 16:51:11 GMT

I came across the following document the other day that contains plenty of useful tuning parameters and settings that you can tweak in order to improve performance in Windows Server 2008. The nice thing is that each setting and its effect (or side-effect) are explained so that you can decide if you want to make the change or not, or whether it is even relevant to your particular system.

The document is especially useful if, like me, you run Windows Server 2008 on a laptop as your main, and only, operating system. I am still going through the document (it is rather large at 78 pages) so it will be a while before I make many changes to my system, but if I do find some gems that really are worth discussing then I’ll post them individually here!

The document can be found at this page: http://www.microsoft.com/whdc/system/sysperf/Perf_tun_srv.mspx

Self-healing NTFS

Daniel Oxley — Wed, 29 Oct 2008 12:29:19 GMT

Windows Vista and Windows Server 2008 contain an often overlooked feature called NTFS Self-Healing. In a nutshell, it is basically an improvement to the NTFS system whereby Windows will detect a file system error and automatically fix it on-the-fly. All this is performed in the background without anyone actually noticing that it happened, unless you have something (such as MOM or SCOM) keeping an eye on the Eventlog for the relevant events as they are logged.

This is a major improvement as before you often had no idea that a file was corrupt until you went to open it, which was normally the moment when you most needed the data! Running Chkdsk.exe on the machine nearly always gives the message:

“Chkdsk cannot run because the volume is in use by another process. Would you like to schedule this volume to be checked the next time the system restarts (Y/N) ?”

Which, although understandable, is never helpful at that specific moment in time, especially if the machine in question is a server in a production environment. The most common method used to try and avoid any possible problems with corrupt files is to schedule regular Chkdsk’s on the machine, but this often requires lengthy downtime while the scan is being run.

By default in Windows Server 2008, the self-healing feature is turned on by default. You can double-check this with the command “fsutil repair query c:”, this command can also be used to enable or disable self-healing. When you run the command, you should see the following:

C:\Windows\system32>fsutil repair query c:
Self healing is enabled for volume c: with flags 0x1.
flags: 0x01 - enable general repair
0x08 - warn about potential data loss
0x10 - disable general repair and bugcheck once on first corruption

The whole process is transparent to the user, and he/she will probably not even realise that anything has taken place, although I have not actually seen any specifications as to if it uses any noticeable CPU cycles or RAM. In fact, as Mark Russinovich explains “If a corruption is detected, an NTFS worker thread is spawned which will go off and perform a localized fix-up of those data structures. The only effect that an application would see is that files would be unavailable for the period of time that it was trying to access, had been corrupted. If it retried later after the corruption was healed, then it would succeed. But the system never has to come down, so there's no reason to have to reboot the system and perform a low-level CHKDSK offline."

HTAMount – Simplifying the mounting of Hyper-V VHD files to your computer

Daniel Oxley — Wed, 24 Sep 2008 12:38:00 GMT

HTAMount is a HTML application that I wrote a while ago that provides a no-nonsense interface allowing you to mount/unmount offline Hyper-V virtual disk images (VHD) to your local file system, in read-only mode. It consists of a HTML Application (HTA) front-end with some VBS script doing the mount/unmounting of the images via a WMI interface. Attached to this post is a zip file that contains the application, hopefully you'll find it useful.

It should be pretty self-explanatory regarding how to use it. To mount a VHD file, just click the ‘Browse…’ button to select the VHD file you wish to mount, select the ‘Mount’ radio option, then press the ‘Mount / Unmount’ button. To unmount a VHD file, just select it from the list of currently mounted VHD files (you might need to refresh this list using the button), choose the ‘Unmount’ radio option and then press the ‘Mount / Unmount’ button. I can’t guarantee that the code is bug-free, although I have been using it for a while and I think I have solved any issues with it. If you do find anything that needs fixing, please comment on this post to let me know!

I got the inspiration for developing this tool from a script that the ‘Virtual PC Guy’ posted back in February 2008. Whilst the script is correct and works great, it had a couple of things that I didn’t like. Namely, the fact that you need to hard-code the path to the VHD file you want to mount, and that you need to extend the script a bit (or create a 2nd separate one) in order to be able to unmount a VHD file. So, HTAMount was born.

One thing that is important is that you run the application elevated (if you have UAC enabled) as it makes use of the Windows executable diskpart.exe which requires the highest security level to run. By default, Windows 2008 does not provide the “Run as Administrator” option when you right-click on a HTA file; however, with a simple change in the registry, you can add this option to the menu for these files.

The option in the context-menu for HTA files that is lacking by default

Included in the attached zip file is a text file that you can rename to a .reg file after extracting it from the zip archive. Double-clicking on this file will import its contents into your registry, instantly adding the item to the context menu.

The VBS code is commented, so feel free to open it up with Notepad to see how it all works. I have also added to the code some comments regarding certain routines, and why I have used them; If you can see any improvements that could be made in the code, I would be interested to know!

This is not an ‘in-development’ tool. I don’t spend time revising the code, unless I experience an error while using it. So don’t expect any updates to it unless either I find a bug, or someone else comments on this page with an error that I then fix. Of course, feel free to suggest new features although I cannot promise anything. Finally, please don’t distribute this code on a different website., link back to my blog post instead. This is important so that people will always have the latest version, and know that the source of the download is from the author.

Bugfix: fixed a bug where the interface remained locked when pressing "Unmount" while no disks were mounted.

Windows Vista, please can you stop changing the view of my folders without asking me?

Daniel Oxley — Mon, 22 Sep 2008 18:57:00 GMT

Something that really bugs me with Windows Vista is that it ‘decides’ all by itself what view you want for your folders in Windows Explorer; and it seems to always get it wrong (as least for me anyway). As you can seen in the the picture below, I have 5 files in a folder but Vista has deduced that I want to view information such as the author of the file and a 5-star rating of it. Why????

I want to define my views in Windows Explorer; me, and no-one else. I would not mind as much if the views were often correct, i.e. seeing MP3 tag information for a folder containing MP3 files, but it doesn’t seem to work that way. Consequently, I get columns appear in Windows Explorer for information that the files could never contain, or for information that I would never be interested in.

If you feel the same, then don’t fret; you can fix this permanently by editing the registry fairly simply. Just follow the steps below:

Open the Registry Editor (regedit.exe)
Navigate to the following registry key: HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell
Right-click on the Bags entry in the left-hand column and delete it.
Right-click on the BagsMRU entry in the left-hand column and delete it.

You have now deleted any existing saved views that Windows Explorer “detected” that you would want to see, but we are not finished yet. Still in the registry, follow these next steps:

Right-click on the Shell entry (the parent of the now deleted Bags entry) and create a new key called Bags.
Right-click on the newly created Bags, and choose New –> Key and name the key AllFolders.
Right-click on AllFolders and choose New –> Key then name this one Shell.
Select the key Shell from the left pane, and then in the right-hand pane right-click and create a new String Value and name it FolderType.
Double-click FolderType and in the value data box enter one of the following items:

Contacts
Documents
Music
Pictures

The items in the list are the default views that you can choose. Enter the one that you want to be used as the default, i.e. Documents. Choosing Documents is probably the best bet as it will give you the ‘normal’ view that you are used to.

OK, almost there! Open Windows Explorer and navigate to your user profile folder (normally at C:\Users\YOUR_USERNAME). For each of the main folders in your profile directory you need to customise the columns as you want them to appear, and also their widths. For example, go into the Downloads folder, and remove any columns you do not want, add those you do, and then adjust all their widths. Repeat this for the other folders you commonly use, i.e. Documents, Pictures etc.

Don’t forget to save your customizations before exiting each folder by clicking Organize –> Folder and Search Options – > ‘View’ tab - ‘Apply to Folders’ button (shown in the picture below). By doing this you will be setting your configured view for that folder, and that all subsequently created sub-folders will inherit that view.

Finally, remember that this is a per user setting so it will not affect any other user profile other than your own. If you wanted to apply it quickly to multiple computers/users, it would not be difficult to script using the tool reg.exe that comes with Windows Vista.

Letting Hyper-V get some sleep

Daniel Oxley — Fri, 05 Sep 2008 14:04:00 GMT

I blogged a few months ago about how activating Hyper-V on a laptop that is running Windows Server 2008 will disable all hibernation and sleep functionality. It seems that most people had not known this because I got quite a few comments on the post about it. The comments varied from simple complaints to the usual boring rants where the author used a dollar sign instead of the letter S when they wrote the word Microsoft.

I still stand by what I said about the reasoning for the decision to disable this functionality as it makes good sense, and frankly hibernation/sleep is something that I can live without because Hyper-V is so good. Basically, the functionality is disabled for 2 reasons:

The percentage of people who run Windows Server 2008 on a laptop compared to those that run it on 'server' hardware is tiny.
Nearly everyone who will be using Hyper-V will be using it on hardware that will never need to be put into hibernation/sleep (when was the last time you wanted to put one of the servers to sleep in your data centre?).

So, to make the best product possible the Hyper-V team devoted their time to getting a great product shipped that had the right features, was stable and reliable; without trying to cater for every possible scenario by cramming in features that a very small percentage of people would use. What we have today is hypervisor technology that is small, fast and rock solid; those facts to most people are more important that anything else.

However, it seems that some people still think that the above reasons are not valid, and that hibernation/sleep should be available. Well there is a way to get that functionality back without having to uninstall Hyper-V, however it is almost certainly not a supported method by Microsoft so you are on your own.

During system boot the file hvboot.sys loads, and it is this file that disables the hibernation/sleep functionality on laptops. So, by changing the following registry keys you can enable/disable the loading of this file. By doing this you'll get back the hibernation/sleep functionality, but at the cost of losing Hyper-V. Also, to make the change requires a system reboot which can be a pain.

Gain hibernation/sleep - lose Hyper-V:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hvboot]

"Start"=dword:00000003

Lose hibernation/sleep - gain Hyper-V:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hvboot]

"Start"=dword:00000000

Having Windows Server 2008 with Hyper-V on a laptop is a great combination, I myself have it on my company laptop. Perhaps the solution offered here can help out those people that have been previously frustrated with Hyper-V because of the lose of hibernation/sleep.

Closing time for the bar

Daniel Oxley — Tue, 08 Jul 2008 17:27:07 GMT

If you run Outlook 2007 on a Windows Server 2008 machine, then you may have noticed that your Outlook persistently shows that little yellow bar saying "Click here to enable Instant Search". Unfortunately, clicking on the bar does not enable Instant Search because the Operating System services are not installed by default in Windows Server 2008.

Now, you could go and install and enable all those services in order to have the Instant Search in Outlook, but if you are like me then you don't really want it because it is not a feature you especially use. I find the 'normal' search functionality to be more than adequate for me, but then I am not an Outlook power user that requires anything more. So, if you don't enable the extra OS services then you are stuck with that annoying bar... Or at least so I thought until I noticed a well-hidden option to remove it.

Just choose Options from the Tools menu, go to the Other tab and press the Advanced Options button. You'll get a new window appear, as the one shown below, which will allow you to uncheck the box next to "Show prompts to enable Instant Search".

Why was this option not included in the message that appears when you click on the yellow bar? Would it not be friendlier to say something like "Click *here* to enable Instant Search, or click *here* to remove this reminder"? That yellow bar used to drive me nuts as it was wasting space on my screen and I knew of no way to get rid of it!

Oh well, at least it is gone now.

Disconnecting Hyper-V

Daniel Oxley — Mon, 07 Jul 2008 11:51:00 GMT

My work laptop runs Windows Server 2008 for one main reason, Hyper-V. I have a 64 bit CPU with 4 Gb of RAM installed, so it seemed the obvious choice to install it! Everything runs very well, especially my virtual machines which as an Infrastructure consultant I could not live without. However, one thing has really bugged me, the lack of wireless support to link VMs directly to the wireless adapter of the host. I barely use wired connections anymore, both my home and the Microsoft office have full wireless coverage, which always gave me problems as it meant that my VMs never had an Internet connection. Sure, I could have used a physical cable (which is what I have been doing) but this not particularly practical, especially at home where I have my wireless router stashed under the sofa!

I had previously unsuccessfully tried this article by the Virtual PC Guy to get the wireless working, albeit in an unsupported configuration. I didn't like this solution for 2 reasons: the first is that it didn't work for me, and the second is that it created a NAT'd solution which I didn't want. However, last week I had a moment of clarity and subsequently kicked myself for not thinking of it before, as it is not particularly complicated. Why not just bridge my Hyper-V network with my wireless one?????

The biggest plus for me with this solution is that the VMs are connected directly to the same network as the host, so will not need any extra network configuration, especially if your host network uses DHCP. Following the simple steps below will give you instant Internet connectivity in the VMs!

Create an internal Hyper-V network, and give it an obvious name.

Open the Network Connections folder via the Network and Sharing Center. Select the wireless adapter and the new Hyper-V internal network you just created, right-click one of them and choose "Bridge Connections". After a few seconds a new item will appear in the list called "Network Bridge".

That's it, you don't need to do anything else. Your VMs should instantly get access to the Internet as long as they are mapped to the new internal network you have created. This can be done by opening the settings for the VM and changing the mapped network in the configuration for the network adapter.

One thing I should mention though is that the use of a wireless card to provide network services to Hyper-V is not a supported configuration by Microsoft, although it does work very well :-)

Dude, where's my GUI?

Daniel Oxley — Thu, 10 Apr 2008 00:24:00 GMT

A colleague of mine, Daniel Matey, recently blogged about the efforts of another Microsoft person who has developed a GUI to help with the administration of Server Core. So for those of you who like the idea of Server Core but don't like the idea of banging out a 10,000 character command string just to create a user, then this may be for you. Below is a quick screenshot, and also a link to the authors page.

More information here: http://blogs.microsoft.co.il/files/folders/guyt/entry68860.aspx

Server Unleashed - "more than meets the eye"

Daniel Oxley — Wed, 05 Mar 2008 20:38:00 GMT

I stumbled across this website today (yes I know, I should have been aware of it since the launch but I've been busy). It is a Silverlight-animated launch site with loads of cool info and stuff about Windows Server 2008; someone in marketing definitely liked Transformers as a kid. Go check it out here: www.serverunleashed.com

Here is a quick screenshot of the main page to whet your appetite.