John Howard - Senior Program Manager in the Hyper-V team at Microsoft : Misc Factoids & Rambling

Connection Manager Administration Kit for Vista

jhoward — Sat, 09 Aug 2008 20:34:48 GMT

Curiosity got the better of me. When I was analyzing why Hyper-V Remote Management didn't always work over a VPN connection due to DNS the other day, I mentioned that I wasn't familiar with the replacement technology for CMAK in Windows Server 2003.

Well, I found it (but it was surprisingly well hidden) - the replacement is.... CMAK, in Windows Server 2008. The details of it are squirreled away in the depths of the Technet Library under Windows\Windows Server\Windows Server 2008\Networking.

It turns out, CMAK is a feature built into Windows Server 2008 - dead easy to install using Server Manager, and it can create profiles for Windows Vista and older operating systems.

But I had to give it a try to see if it was possible to set the DNS suffix for a connection and ensure it was registered on the internal DNS servers when a VPN connection was established, thus ensuring Hyper-V Remote Management works correctly when on a VPN.

Sure enough, then you get to the "Create or Modify a VPN Entry", there is an advanced tab where the three fields needed are present.

Never having used CMAK before, I found it very easy to use, at least for a basic VPN configuration - no custom actions and so forth - those would have been a bit of overkill for a home setup. And did it work? Yup, perfectly :)

Cheers,
John.

Do I have the latest BIOS installed? (And a cheap laptop repair)

jhoward — Sun, 03 Aug 2008 21:45:12 GMT

For Hyper-V to operate correctly, it is strongly advised, and in many cases, required, to install the latest BIOS onto your hardware for hardware virtualization features to operate correctly.

While some OEMs provide fantastic information, my experience is that all too often, you get frustratingly minimal information about BIOS updates:

A release date
A version number
Verbiage like “This improves stuff”. (Thanks. Really helpful!)

What they don’t generally tell you is what you really wanted to know:

Do I need it?
What will it mend or break?
How do I tell whether I already have this version?

While most folks would need psychic powers to answer the first of those two, this off-topic post focuses on the last question.

Why is this relevant? As it happens, I was rummaging through drawers a couple of days back as we're moving offices at work, and stumbled across a very old laptop of mine. I figured it was worth trying to revive – it had a few problems with overheating and a noisy fan which was why it had been ignored for so long. I stripped it down (there’s frighteningly useful information on the Internet for this), removed the CPU cooler and found the fan blades had been scraping the casing (in fact, it had worn a groove in the metal).

The choice was around $70+ for a replacement, or a bit of packing material and a clean with the Hoover. That was a really tough decision when the laptop is worth little more than $70 and was already on its way out to pasture. So a bit of thermal grease before re-installing the cooler and reassembly to see whether things had improved. (Amazingly, without a single screw left over! Way ahead of my track record or expectations.)

Sure, the laptop ran. In fact, I’m typing this post on it now. The fan was much quieter due to not scraping any more, but it was still permanently running, even when idle. It was still was on the noisy side, but that’s cheap mechanics for you. Next stop then was the BIOS, the whole point of this post.

Off to the Internet to find a new BIOS was released a year or so back. I knew that this laptop hadn’t been turned on in way over a year, so it was out of date for sure. But how would most users would know what version of the BIOS they currently have? I came up with four ways – I’m sure there’s plenty more.

1) msinfo32

2) The registry

3) Query WMI either through a script, scriptomatic, or a built in tool called wbemtest. Hit connect and select root\cimv2. Hit the query button and enter “select *from win32_bios” and apply. Double click the returned result and hit “Show MOF”

4) Reboot the machine, and examine the BIOS splash screen (some computers), or enter BIOS setup and it will be in there somewhere usually.

(Which then got me sidetracked and I found one computer which didn’t tell me anywhere what version was installed. But fair enough, I think the way to update it is to rip out an EPROM and shove it in a burner. A sticker told me the version instead though. Classic computing!).

But back to the plot… Alas, on the laptop, the BIOS updater didn’t run under Vista. Uuuuurgh.

Problem solved with a separate disk and a temporary XP installation, but why on earth this particular OEM requires a separately downloaded program be installed to flash the BIOS, I’ll never know…

And did the BIOS update fix the fan running permanently? Sadly, not that I could notice except when first turned on. But the CPU temperature at idle was around 3 degrees cooler, so the new thermal paste probably helped. But as always, it was “fun” finding these things out …. Now to get rid of Java JRE 7 on it. Uuuuurgh (again).

Cheers,
John.

Enable Remote Desktop Connection through Windows Firewall Remotely

jhoward — Thu, 11 May 2006 06:29:00 GMT

Yesterday evening, I was at home and attempting to remotely connect to my XP desktop machine in the office to access an application which was installed there, but not installed on my laptop. This was over VPN. Now I’ve only had both machines for a few weeks since moving over here and was positive that one of the first things I did on my work machine was to allow remote desktop. However, once on VPN, I was unable to connect to that machine remotely.

My first thought was that I’d forgotten to tick that checkbox as shown above (it wasn’t, but I didn’t know better then). So my thought process was simple – it’s no problem – there’s a way round changing that setting as I had already gone through the simple checks – ping worked, net use to c$ worked. Even better, I had remote access to the registry and the event viewer to there was a relatively easy solution.

That checkbox at the end of the day is just a registry setting. So how do you find out what the registry setting is? One way would be to change the setting locally while running sysinternals RegMon utility, see what was changed and update it remotely. Not the simplest way (maybe), but it would work. As it happened, being at home with my domain in place, I’d previously created a Group Policy to ensure that all clients at home were remotely accessible.

From GPMC, the details tab will give you a GUID for that policy.

You can then go to \windows\sysvol\sysvol\<domain>\policies\GUID\Machine and type out the registry.pol file to see the setting it’s applying. You could also take a look at the associated ADM file – both work easily as well

As you can see, the registry setting is under HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services and the setting is fDenyTSConnections. What isn’t clear from a binary dump here is what the value of that setting is being set to, or what the type is. However, a quick regedit on a client tells you that information – it’s a DWORD with value 0.

If you then use regedit, connect to the machine remotely, it’s trivial to change that setting. However, remote connections were still failing. Hmmm. What about a remote reboot – easy enough using the shutdown command. Still no connection. Anyway, I’m up to the challenge here.

What about forcing a refresh of policy remotely. That’s fairly straightforward using psexec from sysinternals. Start a remote command prompt and run gpupdate /force. Unfortunately, still not able to get a connection. Next thing to look at turns towards the Windows Firewall. Fortunately, through running netstat –an –P TCP via psexec, you can see what ports are listening.

So at this point, I’m pretty sure (assuming the policy had been applied correctly), it’s the Windows Firewall blocking port 3389 (RDP). Next thing to do is to use psexec again to get a dump of the Windows Firewall domain policy (this was a domain joined machine). netsh has an option “dump” which you would think would be the right option to select, but that’s not it. What you actually need to run is show config as in netsh firewall show config. This confirmed there is no port opening for Remote Desktop in the configuration

Again, you can use netsh remotely through psexec to allow that exception. The command is netsh firewall set portopening protocol=TCP port=3389 name=<arbitrary> mode=ENABLE profile=DOMAIN

And that was it. Remote connectivity enabled.
Hope this helps someone!
Cheers,
John.

Internet Explorer Tip - Open new window

jhoward — Tue, 09 May 2006 16:18:00 GMT

Here's a tip I learnt a couple of months ago and meant to post up before - totally forgot. Maybe it's force of habit, but rather than opening a new instance Internet Explorer, going to the address bar and typing in a web page, it's quicker to do start/run (ie Windows+R) www.microsoft.com instead. No, that's not the tip (but useful if you're doing it the long way now!).

The problem with the start/run way is probably due to my messy desktop - I already have the start bar expanded to allow for two rows of window icons and can't get used to the grouping of icons on the start bar - it's not uncommon to have 18 windows simultaneously (I just counted). Several of them are usually IE instances (and most of those with multiple tabs). Start/run will "hijack" the first started IE instance and lose your current page (which I usually want). Worse, the instance it hijacked may be a "pop-up" style window, either not re-sizeable or without toolbars. Not the end of the world as you can still click Alt-Left and go back, but it then means you have to do things the long way again.

The answer is to rather than start/run www.microsoft.com you do start/run explorer http://www.microsoft.com. OK, so the astute may be thinking here this isn't much of a shortcut - thats 16 extra keystrokes ("explorer http://") - yes, you must include the http:// prefix :(. However, you can get that down to 2 extra characters by creating e.cmd somewhere in your path (eg \windows\system32) containing 2 lines:

explorer http://%1
exit

Then you can do just start/run e www.microsoft.com. Of course, you can take this much further by parsing %1 parameter in the batch file (or using a VBScript). How about looking to see if theres a www prefix missing and adding it - similarly, the .com. Now there's a thought - start/run e microsoft. Only just crossed my mind as I'm typing this. Hmmmm! Definitely on my list of things to do.

Now, if I can only find a way of doing this in a way which finds a suitable IE Windows (ie resizeable with toolbars and address bar), adds a tab to it and navigates that tab to the URL, I'll be even happier...

Hope that helps someone.
Cheers,
John.

ISA 2004 Web Publishing HTTP Filter stops default website page URL redirection

jhoward — Tue, 25 Apr 2006 19:35:00 GMT

Quick questions: In a firewall, if you're presented with a checkbox asking if you want to block requests with ambigious extensions, what would you do? I'm guessing the answer from 99% of you would be "of course, I want to be as secure as I can be". Well, read on. Maybe you won't want to check that box after all.

Here's a real annoyance I found last night (I must be in rant mode, sorry!). What's more annoying is I couldn't find a solution on microsoft.com or newsgroups to solve it. As I explained yesterday, over the weekend I setup a web-server for photo hosting running at home.

To do this, I simply used the web-publishing wizard in ISA 2004 to publish my IIS server out on the internet, filtering the accessible paths. However, I didn't set any HTTP filtering on the web publishing rule. Being a consciensious (ha ha) administrator and as good practice, it's best to ensure only the methods and extensions you are actually using on the web-site are allowed through the rule, and to block unwanted signatures.

The first part of the ISA rule HTTP filtering lockdown is on the methods tab. As this web-site is serving static content only, the only method I need is GET.

Then it's on to the Extensions tab. As this is a photos web-site, jpg and gif are in there. Similarly htm and html for obvious reasons. The skinning for the site uses CSS (cascading style sheets). The ico is an interesting one and I certainly learnt something last hight. You may have noticed on certain web-sites, a seperate icon appears on the tab if you're using Internet Explorer tabbed browsing through MSN desktop search (and other browsers of course), which also is stored in your favourites if you bookmark the site. I'd been curious for a while how that was done - well, not that curious, but on the list of things to find out at some point in the dim distant future. It turns out that the browser (if you do a network trace) sends a request for favicon.ico. Although I don't have a custom icon yet, it made sense to allow requests for icons to go through.

Now here's the real gripe. If you leave the rule as-is shown above, everything works. Let's say I go to http://www.mysite.com, I have a default.html in that directory on the IIS server and I get a redirection request (HTTP 304 IIRC - I'm at work typing this) to http://www.mysite.com/default.html. This makes it much easier for people not to have to type in the full URL. BUT, I want to block requests containing ambiguous extensions - the ISA property page tells me I can, it sounds like a good thing to do, so I checked it and re-applied the rule.

Once you do this, the redirect is blocked by the ISA server HTTP filtering. I found a few articles, mainly relating to people griping about exactly the same thing but no answers. I'm going to track down someone internally from the ISA team who may be able to help here, but this struck me as a very strange thing to do. A redirect doesn't really have an extension as such, so what can you put into the list to allow the redirection to take place?

Rant over. Hopefully I'll find the answer soon. There's some info on configuring HTTP Filtering here, including a baseline Mail Server Pubishing HTTP policy - guess what I'm going to be doing this evening....

Cheers
John.

Website Photo Album Generating Software

jhoward — Tue, 25 Apr 2006 00:04:00 GMT

Hopefully this will help someone who's not necessarily adept at creating photo web-sites using FrontPage for example. Since moving to Seattle nearly a month ago now, I've been meaning to find a decent way of building a flexible web-site for sharing photos taken here with friends and family.

As much as I'm an advocate of Microsoft Software, I have to say that both FrontPage and Publisher somewhat badly let me down this time. Sorry if any of the product group are reading, but I have to be honest.

The ideal situation was to have a reasonably good looking website which takes photo images held on my central server, automatically scales them for web-viewing and auto-generates the web-site directly.

Other really important features that I wanted were:

When adding photos to the server, publishing them is a 2 minute job (no template/file copying and manual editing)
Ability to easily choose which folders/photos are published
No un-necessary copying of the original images. ie Fine, make a scaled down copy, but no need to copy 1.2MB for each photo.
Easy to change thumbnail sizes/scaled image sizes
Easy to "re-skin" the look at feel
Easy to customise skins
Ability to add watermarks to images
Easy to change thumbnail layout eg 4 rows, 2 columns one day, 5x3 the next etc depending how I feel
Annotation of folders and files
Virtual Folder support. In other words, some web-pages appears to be sourced from a single folder, but in reality it's pulling in the view from multiple folders
Limit public access to only those people I want

While the last one on this list is unlikely to be directly out of the box functionality, I've pretty much got that covered by a combination of ISA Server as my front-end firewall and hosting the web-site on an locked-down IIS server as part of my home domain, running on a Windows Server 2003 Virtual Machine under Virtual Server. As an aside, once a bit of fat is trimmed off, a simple web-server under a VM on a pretty lowly spec host responds to HTTP requests astonishly fast with only 100MB of memory allocated to it and 10% max CPU limit of available host resource - next weekends mission is to trim that to 64MB or less and still get similar performance.

With a bit of Internet Searching, I stumbled across one of the best bits of free software I think I have ever found, JAlbum (currently version 6.4). There's loads of skins available, simple to use and customise (assuming you understand the basics of editing HTT's) and does everything on my list apart from the last one.

The only thing I couldn't get JAlbum to do was to pick up meta-tags directly in the original JPEG files - I had to perform manual annotation. Maybe there's a way and I just haven't found it yet.

Obviously your mileage may vary and maybe I'll come across an even better product somewhere else, but I'm exceptionally impressed. IMHO, this is one great piece of totally free, extensible and mature software. Dare I say I'm "Super-Excited" to have found it now I'm in America? Nah, maybe not quite yet :)

Cheers,
John.

Register & Unregister a DLL from Windows Explorer

jhoward — Thu, 20 Apr 2006 17:20:00 GMT

Back in my developer days when I was building DLLs and OCXs, I was constantly registering and unregistering DLLs using the command line (find me a dev who isn't a command line junkie - I still have two prompts open as I type this). As time's gone on, I submitted to using Windows Explorer more and more to do things and (this is going back many years), someone told me how to setup a shell extension to DLLs to allow you to register and unregister them directly. I guess I kept that file around all these years and it's useful to find it again now I'm installing test builds regularly. Hopefully, it's obvious how this works when you see the registry file below. Simply save as xyzzy.reg and merge it into the registry.

REGEDIT4
[HKEY_CLASSES_ROOT\.dll]
@="dllfile"
[HKEY_CLASSES_ROOT\dllfile\shell]
@="WIN_SYS"
[HKEY_CLASSES_ROOT\dllfile\shell\REG_32]
@="Register"
[HKEY_CLASSES_ROOT\dllfile\shell\REG_32\command]
@="regsvr32.exe %1"
[HKEY_CLASSES_ROOT\dllfile\shell\Unregister]
@=""
[HKEY_CLASSES_ROOT\dllfile\shell\Unregister\command]
@="regsvr32.exe /u %1"
[HKEY_CLASSES_ROOT\.ocx]
@="dllfile"

Once you click on a DLL in Windows Explorer, you'll see two new options to Register and Unregister DLLs. Normal disclaimer applys about messing up your registry if you choose to use this etc.

The switch is on but no-one's home

jhoward — Fri, 07 Apr 2006 16:19:00 GMT

You'd think this was an easy question to answer - how do you turn the lights on? During the day, it's easy in my new office - turn on the (upside-down) switch on the wall. I've worked in offices before where lights are controlled by dialling numbers on phones, even by remote control. I couldn't sleep last night so came into the office early to catch up with a few bits yet office lights don't come on anywhere - kitchen, office, restroom.... So if anyone knows the trick to turning lights on out of hours on Microsoft main campus, please let me know. At least I found the switch to turn on the water heater to make a cup of tea :)

Thanks!
John.

And time time sponsored by ......urist is 01:02:03 04/05/06

jhoward — Wed, 05 Apr 2006 11:02:00 GMT

(Sponsor removed to keep legal happy - brits will understand exactly what the subject means!) So it's 29 days early for me (being a Brit who do dates the "correct" way - ie dd/mm/yy, and boy is that still confusing me being over here), but tonight at three seconds after two minutes past one o'clock in the morning, on the 5th of April 2006, in US time format, it makes it 01:02:03 04/05/06. I was trying to come up the word for something like that but all I could think of was a palindrome. I know that's not right, but if you know the right word, please let me know..... I can always blog about it again on the 4th of May :)

Cheers,
John.

Keyboard remapping

jhoward — Fri, 31 Mar 2006 02:56:00 GMT

So now I'm a little more settled into the office complete with the dual monitors, speakers and a few other creature comforts I didn't have in Microsoft UK, I need to progress onto more practical issues - apart from figuring out why US light switches are all upside down (you lift to turn on - wierd), it's learning to cope with a US keyboard. (Oh, and don't get me started on the mm/dd vs dd/mm debacle - that's just doing my head in).

For the most part, the keyboard is not a huge problem, but why they decided you need a double-sized delete key on this particular keyboard (maybe American's like to erase lots of words?) and not have an "Ins" key, I'll never figure. I'm one of those people who find Shift-Insert as natural to use as Control-V and it's only today I've figured out quite how often I did use Shift-Insert rather than Control-V for paste.

The big bug-bear I have is lots of things being in the @wrong@ place for example - point in case @ and " are swapped. And where's the pound key? All I've got is # on Shift-3. Not easy to remember Alt-0163 on the numeric keyboard for a £. So my mission when I get a chance is to find some tippex, relabel Shift-2 to be a " and Shift-' to be a @, then figure out how to remap the keyboard. Probably a weekend job, although that'll be largely taken up by finding just the right-sized beer fridge for the office :)

WinTarget software incorporated into Windows Storage Server

jhoward — Wed, 08 Mar 2006 07:45:00 GMT

Definitely worth looking at as I've been using the WinTarget iSCSI target software on trial for a while now. Microsoft has just acquired the WinTarget software product and will be incorporating it into future versions of Windows Storage Server 2003. A Microsoft native iSCSI target solution has been sorely needed for a long time (IMHO)! Press release information gcan be found here.

TechNet and Languages in Internet Explorer

jhoward — Tue, 28 Feb 2006 06:13:00 GMT

I'm sure this isn't going to teach a lot of people anything new, but given I just noticed it myself, I think it's worth mentioning just in case. Due to my recent change of laptop, and the fact that my new laptop doesn't run Windows Server 2003 (actually it does, just not very well - the power settings are a nightmare), I'm back to a default install of XP still at the defaults for many settings. One such setting shows itself up in Internet Explorer. There's been a few sites over the past few days I've visited and noticed that I was getting US English settings (dates for example) rather than UK English, even though I set the language and keyboard input settings to UK English at XP install time. Fine - I could just wait a month and it wouldn't make a lot of difference. However, I double checked the Internet Explorer settings and found that even with the selected install options, for some reason the language was still set to "en-us" (US English). You can see this in action on numerous sites, for example http://support.microsoft.com which shows up as Microsoft US Support. More obviously an example is the newly designed TechNet site at http://www.microsoft.com/technet which, if you're set for UK English will redirect to http://technet.microsoft.com/en-gb/default.aspx. <shameless plug>Well worth a look.</shameless plug>

To check or change your language settings in IE6, select Tools/Options. On the general tab, click Languages near the bottom and add/remove the appropriate languages.

I'm leaving Microsoft UK, but joining...

jhoward — Wed, 22 Feb 2006 18:07:00 GMT

In many ways, yesterday was a sad day as I resigned from Microsoft UK after 18 months or so, having decided to take a change in career direction. I'll still be around Microsoft UK for about a month though. However, it certainly wasn't just a sad day, it was one very happy day too.

Many of you know my passion and interest in Virtualisation and it's this making me move on. Early this year, I accepted a job in Microsoft Corporate over in Seattle, WA. As you can imagine, sorting out the visa and relocation isn't trivial and it's taken weeks to finalise everything. So the good news is, I'm not leaving Microsoft entirely, just transferring subsidiaries. My blog will still be active, but simply not as active as it has been over the past year as I'm going to be focusing very much on a single technology (at work at least - the home IT overkill is very much there to stay!)

The new role is Program Manager, working alongside many very talented people including, most visibly externally, the likes of Ben, in the Windows Virtualisation team - part of the Windows Core Operating System Division, working on virtualisation support within Windows Server Codename "Longhorn" and beyond. This is such a great time to be involved right in the heart of a hugely significant technology and a challenge I'm immensely looking forward to. I'll provide more details on the areas I'm going to be working on in a few weeks.

I think along the way, for myself, my wife and my children, there'll be some challenges when we're moving 5,000 miles to another continent. Obviously, there's driving on the other side, the petrol (gas) thing seems a little wierd, spellings (Virtualisation vs. Virtualization being a prime example even if I still don't get why Hypervisor isn't spelt Hypervizor state-side), the fact that it's nigh on impossible to get my staple weekend diet - a decent "British-hot" Vindaloo curry complete with a decent Belgian beer brewed in Brentford or where-ever it is in the UK, remembering to press "1" in the lift (sorry, elevator) if you want to get to the ground floor (sorry lobby) of a hotel. I guess I'm going to miss lots of things too - British TV, roundabouts, lollypop men (people to be PC), a decent cup of tea and plugs with fuses, just for starters. However, my favourite (doh, favorite) difference has to be one which tickled my youngest - the fact that you wear your pants on the outside in America. And I though that was the preserve of superheros! (For the benefits of anyone state-side reading this who aren't aware, pants=underwear and trousers=pants in England.) There lots more useful info to translate between en-us and en-gb here.

You have a nice day now!
Cheers,
John.

Cool emerging web technologies

jhoward — Thu, 16 Feb 2006 12:10:00 GMT

I saw this on Eileens blog a week or so back and thought it was a pretty cool idea. Obviously I have no affiliation with ClustrMaps but thought it was a great way of visualising who in the world is reading my blog and example of (IMHO) what could be considered a "Web 2.0" application. Now that I've had the tags on my blog for just over a week, the map is starting to take shape - this mornings view is below and you can see the latest here. It'll be interesting to watch it grow over the next few weeks, particularly to see if any polar bears are tuning in :)

Domain joined Windows Vista with Media Centre is coming to town (maybe)

jhoward — Tue, 14 Feb 2006 12:49:00 GMT

OK, so it's early days yet and anything can change, so this is absolutely not the final word, but several months ago when playing with early Windows Vista builds, I was encouraged that fast user switching on domain-joined Windows Vista machines with Media Centre (center) was possibly on it's way. It looks like that reality is getting one step closer with the marketing folks acknowledging this as a possible offering following a series of discussions I had yesterday. Keep watching and hopefully you'll see more as the next CTP build is released, hopefully very soon.