John Howard - Senior Program Manager in the Hyper-V team at Microsoft : Beta Products

Windows Virtual PC Links

jhoward — Fri, 07 Aug 2009 06:45:00 GMT

A quick note to say that Windows Virtual PC has reached RC (release candidate) and is available for download. Ben has lots more information here, and I'm really pleased to see that Prasad has started a WVPC team blog where you can learn more about its features and capabilities.

Cheers,
John.

New in Hyper-V Windows Server 2008 R2 Part 2 – MAC Spoofing

jhoward — Thu, 21 May 2009 21:29:00 GMT

Our Virtual Switch got smarter in Windows Server 2008 R2. In Windows Server 2008, VMs are susceptible to MAC spoofing. MAC spoofing is where a (generally) malicious machine pretends to be another machine on a network (there are legitimate applications which do spoof MAC addresses though – Network Load Balancing being one such example).

A MAC (Media Access Control) address in physical NICs is burnt in, although it can usually be over-ridden. In a virtual machine environment, there’s no physical counterpart, so we have to “make up” our own addresses. In fact, that can sometimes cause other networking issues which I talked about last year.

The virtual switch in Hyper-V is a learning layer 2 switch – in other words, it routes packets based on MAC addresses. Therefore, if a malicious VM starts sending out packets with a MAC address owned by another machine, it causes the switch to re-learn. This in turn can cause DoS (Denial of Service) attacks, and the potential for the malicious virtual machine to see packets which weren’t destined for it. Hence, in our security recommendations, we state that as a security best practice, you should consider (in Hyper-V v1 at least) placing virtual machines of a similar security integrity level on the same virtual switch and not share the switch with virtual machines of a different security integrity level.

In Windows Server 2008 R2, we introduced several changes in the switch to make it smarter. Each virtual switch port has a new property (exposed in our WMI model as AllowMacSpoofing) which is off by default. We also expose this property in the settings page for a virtual machine. Note that to see this setting, you must be using the UI from Windows Server 2008 R2 or RSAT in Windows 7 Client.

When the checkbox is not checked (i.e. the port is in “secure” mode):

The MAC address set in the Virtual NIC settings page (either static or the dynamically assigned on) is the only MAC address a virtual machine can specify for the source MAC address in any packets it sends.
The virtual machine will only receive unicast packets with a destination MAC address matching the address in the virtual NIC settings page, and packets destined for its MAC won’t be flooded to other ports.
As our virtual switch is a learning switch, we maintain various internal structures including a routing table. When the virtual machine starts and we power-on the virtual NIC, we pin the MAC address in the virtual NIC settings page into the routing table to ensure it cannot move to another port. We stop any more learning on that port.
When traffic needs to be flooded by the switch to switch ports, we do not flood traffic to ports running in “secure” mode.
Attempts to override the MAC address inside the virtual machine are ignored.

When the checkbox is ~~not~~ checked (i.e. the port is in “less secure” mode):
(6/15/2009 - fixed typo, removed word "not" above)

The virtual machine can send and receive traffic using any MAC address
The virtual machine receives flooded unicast packets
Learning is enabled on the switch port so that multiple MAC addresses can be learnt on that port. No pre-population of the routing table is performed and MAC addresses for a port are learnt as traffic passes through the switch.
Virtual machines can override their MAC address.

The above applies to virtual NICs used by virtual machines. We treat virtual NICs in the parent partition slightly differently and there is no setting to put that NIC into “secure” or “less secure” mode. The virtual NIC in the parent partition is always pinned in the routing table, but they receive flooded unicast traffic, learning is enabled on the switch port and can send using any MAC address.

Cheers,
John.

And thanks again for Keith Mange for pulling the above information together :)

Using Hyper-V Manager "v1" against Windows Server 2008 R2

jhoward — Thu, 07 May 2009 02:18:00 GMT

I had a couple of emails overnight asking whether it is possible to use Hyper-V Manager "v1" (as in KB952627 for Windows Vista SP1, or part of RSAT in Windows Server 2008) pointing to a machine running Windows Server 2008 R2 RC or Microsoft Hyper-V Server 2008 RC.

The short answer is yes, this works. The slightly longer (and intentionally non-exhaustive answer) is:

Bug fixes in the "v2" UI are not in "v1" UI
You won't have access to new features the "v2" UI exposes
You may see a warning when managing a "dedicated" network

The first two points are somewhat obvious, but it's that last point I wanted to expand a little further on in this post.

If you're not familiar with a "dedicated" network (otherwise known as an External Virtual Network for which the management operating system is not allowed to share the network adapter), take a trip back to my post a couple of days ago. The "v1" UI only knows about External Virtual Networks which have a virtual NIC in the parent partition. When it sees an external switch without the parent virtual NIC, it assumes that manual intervention or scripting has taken place to alter the network in some way. Hence, it blocks you being able to change the network into an Internal or Private network.

Somewhat aside to this (but I only say it as I know I’ll get plenty of email from the diligent readership I have letting me know....), you may notice that when using the v1 UI for managing a dedicated network, the "Enable virtual LAN identification for parent partition checkbox if enabled. Further you can set the VLAN ID, click OK and won't see an error – it will appear to succeed. The operation itself is meaningless as there is no virtual NIC in the parent partition to apply the VLAN ID to - if you subsequently were to re-open Virtual Network Manager using the "v1" UI, you'd note that the change had not been applied. It simply a bug and is fixed in the "v2" UI.

Cheers,
John.

Hyper-V RC Release Download Links

jhoward — Wed, 06 May 2009 05:41:00 GMT

Today, the last of the download links for the Microsoft Hyper-V Server 2008 R2, Windows Server 2008 R2 RC (Release Candidate) release, Windows 7 client and the Remote Server Administration Tools (RSAT) for Windows 7 RC have gone live.

Windows Server 2008 RC Download

If you have an MSDN or Technet subscription, the download has already been live for a few days.

As of today, you can also download directly. Follow this link and choose the "Download the RC now!" link at the top right of the page.

Microsoft Hyper-V Server 2008 RC Download

This is the standalone virtualization solution using the same Hyper-V technology present in Windows Server 2008 R2. It can be downloaded here.

Windows 7 RC Download

Follow this link to the TechNet Evaluation Center.

RSAT RC Download for Windows 7

The RSAT tools are packaged in KB958830 which you can obtain by following this link. Make sure you download the right architecture for your needs. Note that these require Windows 7 Client build 7100 to install successfully and do not install on Windows Vista.

Once you have installed the update, to enable Hyper-V Manager, in the Control Panel, open Programs and Features. From here, choose "Turn Windows features on or off" and navigate down through Remote Server Administration Tools/Role Administration Tools and ensure Hyper-V Tools is selected.

Note that if you have a full installation of Windows Server 2008 RC, the Hyper-V role management tools are available without enabling the Hyper-V role itself.

Cheers,
John.

Hyper-V and in-place upgrade to Windows Server 2008 R2 Release Candidate

jhoward — Wed, 06 May 2009 04:08:00 GMT

A cautionary note for those of you performing an in-place upgrade of a machine running Windows Server 2008 with the Hyper-V role enabled, to Windows Server 2008 R2 Release Candidate.

During the installation, you will see the following compatibility report message stating that you should turn off the Hyper-V role:

This warning is incorrect, and you should not do this as the virtual machines will not be present, and virtual network configuration will be lost once the role is re-enabled.

You will see a similar message if you have virtual machines running at the time of upgrade, but it is a “hard block” (in other words, you cannot proceed further). In the case where you hit the hard block, running VMs should be cleanly shut down prior to upgrade. However, I re-iterate, you should not remove the role itself.

One other point to note is if you have online snapshots or virtual machines in a saved state. Saved states are not compatible between Hyper-V in Windows Server 2008 and Windows Server 2008 R2 RC build, so you should ensure you cleanly shut down VMs and delete online snapshots prior to upgrading to avoid the following message after the upgrade is complete:

Cheers,
John.

New in Hyper-V Windows Server 2008 R2 Part 1 – Dedicated Networks

jhoward — Tue, 05 May 2009 04:43:00 GMT

I thought I’d start a series of posts highlighting some of the smaller changes in Hyper-V in Windows Server 2008 R2. There’ll be plenty of people covering the larger features such as Live Migration, so I figured someone needs to cover the other fun stuff!

Many of the improvements are not visible from an end use perspective – changes such as code cleanup, bug fixes, optimizations for performance and scalability. But many are visible, and this post covers one such change.

I did a post back in June last year covering how networking works in Hyper-V and followed it up with a description of the uses for the different types of networks. That second post left you somewhat dangling, as the “best practice” type of network for virtual machine connectivity is what I called (as there wasn’t an official name back then), a “dedicated” network. This type of network is depicted below. But, there was no way to create such a network in Hyper-V “v1” user interface without scripting.

This type of network has a virtual network switch bound to a physical NIC, but no virtual NIC present in the Parent partition (aka Root partition or “Management Operating System”). In other words, it can only be used by virtual machines, not the parent partition.

Robert did come up with a script to create a dedicated network, but the “v2” UI (present in full installations of Windows Server 2008 R2 and RSAT in Windows 7 client) has a new checkbox to do just this, marked “Allow management operating system to share this network adapter”.

The good news is that using the “v2” UI, you can target both a “v1” and a “v2” server running the Hyper-V role (or Microsoft Hyper-V Server) and this checkbox and functionality is available.

Hence, if you have not so far scripted a way to create a “dedicated” network, or have chosen to simply disable the virtual NIC in the parent partition or even unbound all protocols from that virtual NIC, now’s the time to revisit your configuration.

One thing I should mention is the default when creating a new external virtual network – in particular the (not recommended) case of a single physical NIC machine being remotely managed. The default is that the checkbox is not checked. Hence, you should be sure that if you do not allow the management operating system to share the network adapter, there is an alternate NIC available for management. Obviously in the single physical NIC machine scenario, not checking this box would probably mean a trip to the server room… Hopefully the warning is clear enough!

Cheers,
John.

Does Hardware Assistance make a difference?

jhoward — Thu, 04 May 2006 17:35:00 GMT

The simple answer is a definite yes. However, it's sometimes useful to have a "finger in the air" gauge of how much. I therefore did some very unscientific measurements using my watch to compare timings for some basic functions. Of course, before reading any further, please read and understand the blog disclaimer. This is purely to give you some sort of idea, using beta code.

The experiment involved creating two blank Virtual Machines with 256MB and installing a slipstreamed Windows Server 2003 SP1 from an ISO image using Virtual Server 2005 R2 SP1 Beta 1 64-bit - not production code, hence warning again about the disclaimer. The VMs were default for everything except memory - 127GB Dynamically expanding disk (note the default in VS2005 R2 was 16GB), IDE connected drives, 1 Network adapter, disconnected.

On to physical hardware. Dual core single socket CPU with 2GB RAM and a single SATA disk. The host operating system is Windows Server 2003 x64.

The only difference between the two VMs was that one had hardware assistance disabled, the other had hardware assistance enabled.

I took four measurements for the installation time:

From VM Start to Text Mode installation complete (BIOS screen showing for reboot). During this time, I chose default installation options such as choosing a partition and performing a quick format.
From initial boot GUI following text mode installation to the point at which the "Installing Devices" bar had completed.

[At this point, you're asked to enter product keys, admin passwords. This is manual hence, removed from any timings.]
From the point at which you choose default options for networking during installation to the first full reboot of operating system and logon screen showing.
Full reboot timing once VM Additions have been installed in each guest (excluding BIOS wait time - from point at which GUI appears)

The results were as follows:

Step	With Hardware Assistance (Seconds)	Without Hardware Assistance (Seconds)	Improvement (Seconds/%)
1: Text Mode Install	236	334	98s=29%
2: Initial GUI Install	167	287	120s=42%
3: GUI Install Completion	733	985	252=26%
4: Boot with additions	10	14	4=29%

Similar results to Ben's findings - under 19 minutes for a full OS install. Now I appreciate much of this isn't a typical workload for a VM, but it gives you an idea how much time you can save during an operating system installation alone by enabling hardware virtualization.

I also did some screen-shots which demonstrate the differences in overall CPU utilization within the guest at a couple of points during the installation. The graphs generally speak for themselves, even though the exact point at which the snapshot is taken is guaranteed to be slightly different between the two scenarios.

The first is at the point where Windows is "Registering Components"

No Hardware Assistance

With Hardware Assistance

The second is at an estimated 6 mins remaining for the installation while Windows is "Saving Settings"

No Hardware Assistance

With Hardware Assistance

Hopefully useful information! Remember, your mileage may (and will!) vary.
Cheers,
John.

How to Enable Hardware Assisted Virtualization in VS2005R2 SP1 Beta

jhoward — Fri, 28 Apr 2006 20:35:00 GMT

Once you install Virtual Server 2005 R2 SP1 Beta 1, you'll notice a check box on the properties page for a virtual machine as shown below - it's as simple as checking the box (on by default).

Have fun - and remember, this is Beta code - only install it on your test machines.

Cheers,
John.

Virtual Server 2005 R2 SP1 Beta 1 download link and availability details

jhoward — Fri, 28 Apr 2006 19:59:00 GMT

Although on the Windows virtualization team here, it's heads down working on the next generation of virtual machine support to be built into Windows Longhorn server with a "hypervisor" architecture, we're absolutely not sitting still on the Virtual Server 2005 R2 product which became free a couple of weeks back.

There will be a couple of beta releases of Virtual Server 2005 R2 SP1 - today we are announcing the availabilty of beta 1. You can download it by applying through Microsoft Connect. You'll need a passport account to log on to that site. Scroll down to the bottom and click Apply. It could take up to 24 hours to get an email back with the link for download.

So what's in Beta 1? Functionally, the main change is the support for Intels VT processors which provides hardware assistance for virtualization support. What does that mean? If you're running on a VT enhanced processor, NON-Windows guests will run much faster as we're no longer performing ring compression as part of the emulated environment (note you can choose to turn VT support off). However, Windows guests will run at parity in terms of performance as we already performing optimal tuning through the use of VM Additions. Windows guests will get a significant boost during the install process though, the time before you have an opportunity to install the VM Additions. The host clustering white paper and the associated VB Script I blogged about back in November last year, this is now included in the box.

Moving forward to what's going to be included in Beta 2, we'll add support for hardware assistance in the AMD chipset (aka Pacifica), integration with Active Directory to allow you to identify VM Host machines in a consistent manner, plus one killer feature (IMHO) - VSS support. This will allow you to take a snapshot of a running VM for backup - something I've had so much feedback from people to put into the product. More details to follow on that closer to the time.

Timewise, current schedule dates for Beta2 and released product are last quarter 2006 and first quarter of 2007 respectively.

Once again - the registration link is here.

Any questions, let me know.
Cheers,
John.

Hands-on Windows OS Internals and Advanced Troubleshooting

jhoward — Fri, 21 Apr 2006 18:26:00 GMT

I received an email from David Solomon - author of Windows Internals this morning. By amazing coincidence, I happened to have a copy of it open and reading it just as the email came in. David & his colleage, Mark Russinovich regularly give courses to folks in the Windows Core OS Division here in Redmond as part of a standard "getting up to speed" induction.

David just let me know that on 26th-30th June there will be a course running in London. Registration for that can be found here. From the people on campus I've spoken to who've been on this course, they highly recommend it.

Here's the full details:

Hands-on Windows OS Internals & Advanced Troubleshooting w/Russinovich and Solomon

If you like Sysinternals or the book Windows Internals, then you'll want to attend a hands-on (bring your own laptop) Windows internals & advanced troubleshooting class, taught by Mark Russinovich and David Solomon. Topics include: crash dump analysis, advanced process and thread troubleshooting, memory management internals, security internals, boot process and troubleshooting, I/O system. Now updated to cover (Windows) Vista!

Cheers
John.

Windows Vista Webcasts Next Week

jhoward — Fri, 07 Apr 2006 16:29:00 GMT

Just seen the list of webcasts for next week - there's a couple on the list worth mentioning. All times are PST (add 8 hours for UK time)

Top 10 Things You Need to Know About Windows Vista for the Enterprise (Level 200)
Wednesday, April 12, 2006 - 9:30 AM - 10:30 AM Pacific Time
Glenn Fincher, Senior Consultant, Xtreme Consulting Group
For those of you who haven’t had a chance to get a preview of Microsoft Windows Vista, this webcast introduces some of the new features and capabilities. This discussion focuses on features designed with the enterprise in mind.

http://msevents.microsoft.com/CUI/EventDetail.aspx?EventID=1032292988&Culture=en-US

Top 10 Things You Need to Know About Windows Vista for Small and Medium-Sized Businesses (Level 200)
Wednesday, April 12, 2006 - 11:30 AM - 12:30 PM Pacific Time
Tony Richardson, Principal Consultant, Xtreme Consulting Group, Inc

For those of you who haven’t had a chance to get a preview of Microsoft Windows Vista, this webcast introduces some of the new features and capabilities. This webcast focuses on features designed with small and medium-sized businesses in mind.
http://msevents.microsoft.com/CUI/EventDetail.aspx?EventID=1032292994&Culture=en-US

Exchange 12 CTP has arrived

jhoward — Mon, 13 Mar 2006 19:16:00 GMT

So I've been a little light on blogging over the past couple of weeks while I've been over in Redmond for a house-hunting trip before moving over in a couple of weeks, so there was a fair bit of post waiting for me back in the office. The March TechNet Plus subscription was among the pile, complete with the Exchange 12 CTP build (based on the beta 1 codebase). Not that with everything else going on I'll have a great deal of time to install it and have a real look at how far it's progressed :(

I also noticed in the March MSDN shipment, disk 3028.1 is Virtual Server 2005 Enterprise Edition, both x86 and x64. Now I'll have to wait until I get home, but I was sure that I only got Standard edition through MSDN before.

ISA 2006 Beta Available

jhoward — Fri, 03 Mar 2006 19:42:00 GMT

http://www.microsoft.com/isaserver/2006/default.mspx is worth checking out - you can download the beta of ISA Server 2006. I can't download it myself as I'm off-site, but will be sure to install it at home in the next couple of weeks...

Find out more about Exchange 12

jhoward — Thu, 23 Feb 2006 16:08:00 GMT

I have to share this one with you - in around three weeks time, there's a series of webcasts on Exchange 12 running over 4 days. The better news is (I'm guessing for US attendees only though) is that if you attend all four webcasts (can be viewed on demand, not necessarily live) and you submit your evaluations before 31st March, there's a small gift of a Microsoft travel mug, plus a chance to win a TechNet Plus subscription. TechNet Plus will get the Exchange 12 CTP (Community Technology Build) hopefully next month.

Tuesday 14th March: Overview of Exchange 12
Wednesday 15th March: Giving the Administrator More Control in Exchange 12
Thursday 16th March: Client Access and Web Services in Exchange 12
Friday 17th March: Message Security and Active Protection in Exchange 12

Here's the registration link

SMS 2003 R2 Public Beta

jhoward — Wed, 22 Feb 2006 17:12:00 GMT

Just thought it was worth mentioning this - another "R2" joins the fold, hot on the heals of Virtual Server 2005 R2 and Windows Server 2003 R2. This time it's SMS which gets a refresh. SMS isn't really a product I can hold my hand up and say I know well, but I'm installing the R2 beta in a virtual machine as I type. Lots of information is available here where the instructions for beta-programme participation and download links can also be found.