John Howard - Senior Program Manager in the Hyper-V team at Microsoft : Misc Factoids & Rambling

Hyper-V floppy trivia

jhoward — Sun, 22 Mar 2009 07:35:00 GMT

"When I were a lad" (you have to say that in a northern British accent for authenticity), I used to catch the “Number 64” bus outside Fairfield Halls in Central Croydon as a leg of my journey to Junior school.

The busses never arrived as scheduled some six or seven minutes apart during rush hour – instead, three of them nearly always arrived together. 1970’s London transport at it’s very best :). (Ask me about the “233 bus episode sometime – it has a different route these days, but ask only in person, and with a case of beer in hand…..”).

What has this to do with Hyper-V? Bad 1970’s bus scheduling came to mind when the floppy disk controller in Hyper-V came up in three conversations in one week – I don’t recall it being mentioned for months beforehand. So I figured it was time to explain a little about the floppy disk controller in Hyper-V.

The first thing to note is that it cannot be connected to a physical floppy disk drive (does anyone, apart from me, still have, and use, one....?). The floppy disk controller in Hyper-V can only hold virtual media in the form of .VFD files, otherwise known as Virtual Floppy Disks.

The next thing to address is the media types the controller supports. It supports 1.44KB and 720KB floppies. (Which also reminds me of "when I were a lad" cutting out a fake tab on 5 1/4" disks to write to them upside down for use on PETs and 380Z's, doubling the available space to (IIRC) 720KB - saved me a fortune at the time, being a somewhat prolific collector and developer of PET programs ). I guess I'm not quite old enough to remember 8" floppies too well though....

Next, the question which cropped up twice. Why is there a file called "blank.vfd" in the “\Users\Public\Documents\Hyper-V\Blank floppy disk” directory when you enable the Hyper-V role? And further, when you try and insert the media into a VM, you get an error "Inserting the disk failed... The file blank.vfd does not have the required security settings. Error: 'General access denied error'".

To answer these questions requires cranking back the time machine to June 2006, a few months after I joined the Hyper-V team. Remember June 2006 was two years before we shipped Hyper-V “v1” RTM, so code was in flux and in full-scale development. We didn't plan back then to ship UI to create new floppy disk media. So it made sense to include a blank floppy disk image in the installation (and yes, I was responsible – in fact, I created blank.vfd using Virtual Server IIRC – could have been Virtual PC though). That’s why we laid the file down during installation. (Note: The UI can only create 1.44KB .VFDs, but you can still use Virtual PC to create 720KB .VFDs).

We didn't want people deleting blank.vfd accidentally, or writing to it (as it otherwise wouldn’t be blank), so we set security on the file so that users and administrators didn’t have write permission. That’s why you get the ‘General access denied error’ inserting the media.

Wind forward a few months more (I don’t recall exactly when), plans changed, and the Hyper-V UI was extended to include the ability to create a new floppy disk from the MMC (or the “browser” as it was called then – the name “Hyper-V” was still way off in the future).

Things being what they can be, it was an oversight that the UI now provided the ability to create a blank VFD file, and we installed one. On to June 2008 when we RTM’d, blank.vfd was still being installed. I guess in retrospect we didn’t do a lot of testing using blank.vfd – our test automation for floppies created a new file as part of the test.

The last question which cropped up was “Why does Hyper-V even have a floppy controller?”. There’s a couple of reasons. For compatibility with unsupported older operating systems, it’s often necessary to boot from a floppy to install the OS. There’s clearly no business case for this though. The main reason for including support for floppies is Windows Server 2003 full system backup which uses a floppy disk as part of a full system backup.

Do please let me know if you have alternate reasons for using the floppy disk controller in Hyper-V, or even still use physical floppy disks (somewhat) regularly. I’d hate to be the only one (but suspect I might)….

Cheers,
John.

Hyper-V energy drink

jhoward — Sat, 14 Feb 2009 02:33:33 GMT

Just thought I'd add a quick blog entry - cool thing at the office today. Cans of Hyper-V ‘Pure Consolidated Energy for your Server’ turned up at our office this afternoon for the development team. Thank you marketing team! More info at www.serverunleashed.com

Cheers (literally!),
John.

Hyper-V Resolving Event ID 4096

jhoward — Sun, 28 Dec 2008 22:25:00 GMT

Over the break I’ve been taking over Christmas, one of my goals was to move the remainder of my Virtual Server “production” VMs across to Hyper-V. But when nearing completion, I noticed that Server Manager was reporting a role error:

Looking at the detail of the event logs, it was Event ID 4096 from Hyper-V-Config saying that The Virtual Machines Configuration {GUID} at ‘{Directory}’ is no longer accessible: The system cannot find the path specified. (0x80070003)

This is a pretty common error many people hit, and in my case it was due to some rearranging of directories and moving virtual machines around until I had it “just right” in terms of how I like to set my own servers up. By personal preference (nothing more), I like to keep the configurations, snapshots and VHDs for my virtual machines under a single directory on a per VM basis – in my case v:\virtual machines. However, when playing earlier with my new server, I’d been using the v:\vms directory (hence the specific error in the screenshot below).

So in Hyper-V Manager, under Hyper-V Settings, I enter V:\Virtual Machines in the text boxes for both Virtual Hard Disks and Virtual Machine Configuration files.

Then, when using the New Virtual Machine wizard, I check “Store the virtual machine in a different location” but keep the default directory set above, and get to the Connect Virtual Hard Disk step, the wizard populates the default directory for a new VHD in a sub-directory under V:\Virtual Machines named the same as the Virtual Machine.

If you examine the directory structure of V:\Virtual Machines\Test after completing the wizard, you end up with this (if you also take a snapshot)

Your VHD is in the main directory, and the configuration and snapshot data-root are under the Virtual Machines and Snapshots subdirectories under “Test” (or whatever you name your virtual machine). In other words, everything for that virtual machine is in a single location which was the primary intent.

Anyway, (as I frequently do in my blog posts), I somewhat digress. Back to the Event ID 4096 which indicated there was a problem with V:\VMs, the original location I was using when moving virtual machines across from Virtual Server.

If you navigate to \ProgramData\Microsoft\Windows\Hyper-V\Virtual Machines on your system drive (note that ProgramData is a hidden directory), you’ll notice that there are a number of symbolic links to configuration files. There are two in the screenshot below (one being highlighted) which points to the V:\VMs\… directory.

So it’s a simple case of very carefully deleting that or those links (just use the “del” command) which refer to the old directory, and cycling the VMMS service (net stop vmms, then, net start vmms). After this, the error will no longer be logged. Please be extremely mindful not to delete links referring to VMs you want to keep! Onwards with the rest of the migration now…

Cheers,
John.

How to detect UAC elevation from VBScript

jhoward — Wed, 19 Nov 2008 23:32:00 GMT

While working on the next version of HVRemote yesterday evening, one of the things I wanted to address based on feedback from various people was to have the tool (written in VBScript) detect whether it is being run from an elevated command prompt. While this is relatively easy to determine using low-level languages from the GetTokenInformation API, this is not callable from VBScript without a helper. I couldn't find a pre-existing COM object in Windows Vista or Windows Server 2008 which indirectly exposed this API, or anything built in to the Windows Scripting Host. As I didn't want to ship HVRemote with a separate helper binary, I had to go digging for an alternate solution.....).

The one thing I didn't want to do was to have the script try to do something active which might (or might not) work, returning some form of permission denied in the failure case. I wanted something passive. I discovered the whoami command displays the System Manadatory Label. So, if you can see where this is heading, although this can be classified as a "glorious hack", it's straight-forward to passively determine elevation through examining the output of whoami /all (or whoami /groups which is a little more terse and still gives the information we need). All you need to know is the SID strings for integrity levels.

I also discovered an interesting thing about the Exec method of the Windows Scripting Host along the way, which certainly bemused me for a while. I drew a blank on it from Internet searching too. It appears that if the command being "Exec"'d has a lot of output (such as whoami /all), unless StdOut is drained, Exec blocks indefinitely. You learn something new every day :)

Here's the sample script - save it as elevated.vbs and run as "cscript elevated.vbs". I've stripped the sample code down to a bare minimum to just demonstrate the logic - you should add the appropriate error handling if you take advantage of it in your own scripts. (Or download here and rename to a .vbs extension)

Dim oShell, oExec, szStdOut

szStdOut = ""

Set oShell = CreateObject("WScript.Shell")

Set oExec = oShell.Exec("whoami /groups")

Do While (oExec.Status = cnWshRunning)

   WScript.Sleep 100

   if not oExec.StdOut.AtEndOfStream then

       szStdOut = szStdOut & oExec.StdOut.ReadAll

   end if

Loop

select case oExec.ExitCode

   case 0

       if not oExec.StdOut.AtEndOfStream then

           szStdOut = szStdOut & oExec.StdOut.ReadAll

       end if

       if instr(szStdOut,"S-1-16-12288") Then

           wscript.echo "Elevated"

       else

           if instr(szStdOut,"S-1-16-8192")  Then

               wscript.echo "Not Elevated"

           else

               wscript.echo "Unknown!"

           end if

       end if

   case else

       if not oExec.StdErr.AtEndOfStream then

           wscript.echo oExec.StdErr.ReadAll

       end if

end select

Hope someone finds this snippet useful, but as always, see my blog disclaimer.

Cheers,
John.

Configure Hyper-V Remote Management in seconds

jhoward — Sat, 15 Nov 2008 03:02:00 GMT

Update 19th Nov - v0.3 now released!

It has been a little quiet on the blog front, but sometimes, at least in this case, I hope I've come up with something worth waiting for. Announcing "HVRemote"...., a tool to "automagically" configure Hyper-V Remote Management. (Amazing what can be done with a few days vacation to kill before you lose them at the end of the year....).

I'm not going into the gory detail here as I've created a PDF containing the documentation, and a site on http://code.msdn.microsoft.com/HVRemote where you can download the tool and the documentation. All I ask, is that if you find the tool useful, drop me an email or a comment. Thanks!

What does the tool do: It reduces the manual configuration steps needed for Hyper-V Remote Management that I blogged about back in March this year 1, 2, 3, 4 and 5 down to one or two commands.

It can configure Full installations and Server Core Installations of Windows Server 2008 with the Hyper-V role enabled, plus configure Microsoft Hyper-V Server. It runs across all locales (I've tested English and Japanese) and it doesn't matter if the server is domain or workgroup joined.
It can configure Vista SP1 and Server 2008 configured with the Hyper-V Remote Management tools. Again, doesn't matter if the client is domain or workgroup joined.

Quick how-to:

1. Server: To give or remove a user access permissions:

hvremote /add:domain\user or
hvremote /remove:domain\user

2. Server & Client: Display current settings (server or client): (Screenshot is client side)

hvremote /show

The other useful options are:

3. Find out all the command line options: hvremote /help or hvremote /?

and a couple of client side options:

4. Client: Add firewall exception for MMC: hvremote /mmc:enable
5. Client: Allow anonymous access to Distributed COM: hvremote /AnonDCOM:grant

I've tried this out with a a lot of test "guinea pigs" internally at Microsoft, and using the script literally dropped their remote configuration time down to seconds. Hopefully it will do the same for you.

But I must also point you to the disclaimer on my blog, the disclaimer in the documentation, and the license conditions at http://code.msdn.microsoft.com/HVRemote before use:

HVRemote and the associated documentation are provided "as-is". You bear the risk of using it. No express warranties, guarantees or conditions are provided. It is not supported or endorsed by Microsoft Corporation and should be used at your own risk.

Cheers,
John.

Hyper-V: Why does Hyper-V Manager not always work over VPN connection? Access Denied or RPC server unavailable errors.

jhoward — Fri, 08 Aug 2008 07:55:51 GMT

This post examines a problem several people have reported when running Hyper-V Remote Management tools over a VPN connection - specifically hitting an error “Access denied. Unable to establish communication between ‘SERVER’ and ‘CLIENT’”. In some variations, I’ve seen RPC errors such as “RPC server unavailable. Unable to establish communication between ‘SERVER’ and ‘CLIENT’.”

And an example of an RPC error case:

To be explicit up front, I am talking about this only occurring over a VPN/RAS connection – when connected using a wired or wireless connection without VPN, everything works normally. If things are not working on wired/wireless, follow my series of remote management posts to configure everything first.

Diagnosing the issue took a bit of sleuthing. So let’s dive in. A big clue is in the first message – it implies there is some form of communication between the Hyper-V enabled server and the Remote Management client. Indeed, that is correct – there is a DCOM callback. So let’s start by looking at the IP configuration on the laptop machine I’m using for this walkthrough after the VPN connection has been established.

Note that the DHCP assigned address for the VPN connection is 192.168.200.6, and the DHCP assigned address for the Internet connection is 192.168.1.119.

Let’s run a network trace network trace on the Hyper-V enabled server to see what’s going on. I’m running the network trace while starting Hyper-V Manager on the laptop:

The two highlighted lines show that the Hyper-V enabled server is making an attempt to connect to my local wireless IP address on my broadband connection, 192.168.1.119, rather than the DHCP assigned IP address for my machine on the internal network, 192.168.200.6.

What’s also interesting in the trace are ARP packets from the Hyper-V enabled server at 192.168.200.218 to “HPCRAPTOP”:

Notice that the server is asking where 192.168.200.14 is, and netmon is resolving 192.168.200.14 to the IP address of the laptop. So that indicates all is not well with DNS since we know above that the DHCP assigned address on the VPN connection is 192.168.200.6. Let’s do an nslookup to examine the DNS entry for the laptop.

Indeed, the laptop from a DNS perspective is incorrect and explains why netmon is resolving 192.168.200.14 to my laptop. (Although I didn’t mention it, I happen to know that this DNS entry, 192.168.200.14, was the IP address assigned to the laptop when it was last connected directly to the internal network.)

So as an experiment and first workaround, let’s edit \windows\system32\drivers\etc on the Hyper-V enabled server to add an entry for my laptop as 192.168.200.6, the current IPv4 address for VPN and see what happens.

Yes, that works. But it’s hardly what I could describe as a desirable or every-day-workable solution. If you’re walking through with me, remember to remove that entry hosts to see if there are any other workarounds.

Well there is one interesting workaround which I mentioned in my remote management configuration series. However, I absolutely do NOT recommend this one unless you really need to as you are lowering the security of your machine. Changing this setting is NOT necessary for remote management in a domain environment, but it is in a workgroup environment (my home environment I’m using for this is domain based). Here are the settings to change in dcomcnfg on the management client:

Why this works is related to WMI/DCOM fallback, but I’m far from claiming to be an expert here and will walk swiftly away from any further explanation. However, I re-iterate, I absolutely do not recommend you change this setting unless you need to.
So let’s step back a bit now and try and understand a bit more about the DNS issue. The obvious thing to think may be to run “ipconfig /registerdns” from an elevated command prompt on the remote management machine to correct the DNS registration. Let’s see what happens, while at the same time running a network trace on the ISA server with a filter for just the DNS protocol.

If you’re ahead of the game, you may notice this is a very interesting capture! Maybe not if you’re aware of my home setup, so let me explain why. 192.168.15.2 is the external internet address of my ISA server (in turn connected to a VOIP router). The destination being resolved to a host with name starting ‘ns’ is my ISP’s DNS server. Looking at the frame details, you can see the packet is a DNS update request for the laptop. Unsurprisingly, if you look at the response from the ISP in packet 3949, the response is “NotAuth”. Afterall, they’re not authoritative for DNS of my domain. I am!

This routing to the external network through ISA is normal expected behaviour. So I’m still yet to find a good solution. But all is not lost (of course). Let’s take a different tactic and look a little closer at the Vista SP1 inbox VPN client configuration (as in one which hasn’t been created by what-ever the equivalent of CMAK, or Connection Manager Administration Kit, for Vista – and no, I’ve no idea what the replacement technology is. But it does remind me to do some research for another day....).

I’m assuming you’re already familiar with configuring a PPTP or L2TP VPN connection in Vista – that’s a little outside of the scope of this post. But here’s the IPv4/Properties/Advanced/DNS dialog tab of the VPN connection I’ve created to connect back to my home network. Look at the bottom three items relating to DNS registration:

Hmmmm. These look extremely promising . Logically, it sounds like I want all three: I want to specify a DNS suffix for this connection which is that of my internal domain; Yes, I want to register the connection’s address in DNS; and I’d like to use the DNS suffix in the DNS registration. So I changed it to look like this:

After saving the changes, let’s run that DNS-filtered network trace on the ISA server again while re-establishing the VPN connection:

Looks good as a DNS update was sent to the internal DNS servers, not to the external ISP. It shows the update for the IPv4 address of the remote management client as 192.168.200.4 with a success response in the following packet. And ipconfig on the client?

This confirms the trace above – the remote management client has IP address 192.168.200.4. What about an nslookup of the laptop?

Excellent. Everything is looking rosey – the DHCP assigned IP address of the laptop acquired from the VPN connection is in DNS on the internal servers. Therefore, the Hyper-V enabled server should be able to locate the laptop when making it’s DCOM callback, so let’s fire up Hyper-V manager and see what happens:

Voila! Hope you found that useful.

Cheers,
John.

Do I have the latest BIOS installed? (And a cheap laptop repair)

jhoward — Sun, 03 Aug 2008 21:45:12 GMT

For Hyper-V to operate correctly, it is strongly advised, and in many cases, required, to install the latest BIOS onto your hardware for hardware virtualization features to operate correctly.

While some OEMs provide fantastic information, my experience is that all too often, you get frustratingly minimal information about BIOS updates:

A release date
A version number
Verbiage like “This improves stuff”. (Thanks. Really helpful!)

What they don’t generally tell you is what you really wanted to know:

Do I need it?
What will it mend or break?
How do I tell whether I already have this version?

While most folks would need psychic powers to answer the first of those two, this off-topic post focuses on the last question.

Why is this relevant? As it happens, I was rummaging through drawers a couple of days back as we're moving offices at work, and stumbled across a very old laptop of mine. I figured it was worth trying to revive – it had a few problems with overheating and a noisy fan which was why it had been ignored for so long. I stripped it down (there’s frighteningly useful information on the Internet for this), removed the CPU cooler and found the fan blades had been scraping the casing (in fact, it had worn a groove in the metal).

The choice was around $70+ for a replacement, or a bit of packing material and a clean with the Hoover. That was a really tough decision when the laptop is worth little more than $70 and was already on its way out to pasture. So a bit of thermal grease before re-installing the cooler and reassembly to see whether things had improved. (Amazingly, without a single screw left over! Way ahead of my track record or expectations.)

Sure, the laptop ran. In fact, I’m typing this post on it now. The fan was much quieter due to not scraping any more, but it was still permanently running, even when idle. It was still was on the noisy side, but that’s cheap mechanics for you. Next stop then was the BIOS, the whole point of this post.

Off to the Internet to find a new BIOS was released a year or so back. I knew that this laptop hadn’t been turned on in way over a year, so it was out of date for sure. But how would most users would know what version of the BIOS they currently have? I came up with four ways – I’m sure there’s plenty more.

1) msinfo32

2) The registry

3) Query WMI either through a script, scriptomatic, or a built in tool called wbemtest. Hit connect and select root\cimv2. Hit the query button and enter “select *from win32_bios” and apply. Double click the returned result and hit “Show MOF”

4) Reboot the machine, and examine the BIOS splash screen (some computers), or enter BIOS setup and it will be in there somewhere usually.

(Which then got me sidetracked and I found one computer which didn’t tell me anywhere what version was installed. But fair enough, I think the way to update it is to rip out an EPROM and shove it in a burner. A sticker told me the version instead though. Classic computing!).

But back to the plot… Alas, on the laptop, the BIOS updater didn’t run under Vista. Uuuuurgh.

Problem solved with a separate disk and a temporary XP installation, but why on earth this particular OEM requires a separately downloaded program be installed to flash the BIOS, I’ll never know…

And did the BIOS update fix the fan running permanently? Sadly, not that I could notice except when first turned on. But the CPU temperature at idle was around 3 degrees cooler, so the new thermal paste probably helped. But as always, it was “fun” finding these things out …. Now to get rid of Java JRE 7 on it. Uuuuurgh (again).

Cheers,
John.

How to remove a failed server from DFS in Windows Server 2003 R2

jhoward — Sat, 20 May 2006 18:12:00 GMT

This week has been a little strained, hence quiet on the blogging front. Apart from a hectic week at work (more to follow on that shortly), the reason was a "disaster" which happened late last Sunday evening - everything was working at home one moment, and dead the next.

Since the move over from the UK, I'm still in temporary accomodation. To save space, although my servers were couriered over, I didn't bring a monitor as all the monitors I owned only ran on 240v. The servers arrived a little shaken, but not too stirred - a few cards were loose, but no failed disks. Just a little prodding into place and they came back perfectly. Humming away for 6 weeks or so without fault.

If you've ever tried to figure out why a machine won't boot without a monitor attached, I know where you're coming from. Short answer is, it's next to impossible. It also happened that this machine was not just any machine, but a Domain Controller. And not just any domain controller, the domain controller holding all the FSMO roles for my home domain. Of course, it will probably come as no surprise to you it's also running a further 5 virtual machines including my website hosting, ISA and Exchange. So yes, it was somewhat of a disaster.

On Monday morning, I took the machine into the office and with a monitor attached, it was obvious it was continually rebooting (off both plexes in the boot mirror) before the GUI portion of the boot came up. Safe mode, last known good gave same symptoms. Similarly, boot logging didn't help as the boot log doesn't get written to disk until the GUI part of the boot comes up.

I borrowed another disk from Ben, plugged it in and installed XP SP2 (only 32 bit OS immediately to hand). However, during the first boot, it blue-screened. Sure enough, there was a problem with the hardware - either motherboard or memory.

Running a memory tester showed something wrong with one or more of the (expensive!) ECC memory slots. I saw a big bill coming :(. It was a tedious process of elimination by swapping DIMMs around until the failed chip or chips was identified. That at least got to the point of XP booting. Attempting to boot back with the failed DIMM removed (actually a pair as the system needs matched pairs), same symptoms as before. At this point, going back to XP, I discovered XP didn't have drivers for the RAID SCSI Controller for the system boot disk and worse, none were available. Onto plan B for recovery.

I re-installed a Windows Server 2003 on the loan disk with the recovery console enabled to attempt to see what was going on. Chkdsk showed the SCSI disks being corrupt and the mirror needing repair. Fixing those still wasn't getting past the text mode part of the boot.

Not being one to give up, I took the machine home on Monday night. During the day, my wife had bought a second hand 17" monitor for $20.00 - given it's in next to perfect condition, I thought that was pretty good value.

From the recovery console of Windows Server installed on the loan disk, I spent two very long and tedious evenings going through disabling drivers one-by-one in the hope I'd find the driver failing to load - every time the same 0x0000007b with 0xc000007b in the parameter list - inaccessible_boot_disk.

Well, two days later I did give up. In some ways I'm glad I did - when I took the decision to blow away the machine for real, I discovered the disks were also corrupt in some way - both of them. Blue screens on reinstall. Possibly the RAID controller? Nope, tried a spare one too :( Anyway, I've more disks on order and more memory on order - at least they're much cheaper in the US than in the UK.

In the meantime, with reduced RAM, on the loan disk I at least got the ISA server and the Exchange server back running. Cleaning up AD to seize the FSMO roles which were held by the previous installation is easy enough (http://support.microsoft.com/?id=255504). They're now safely on a Virtual domain controller running on another server.

However, there was one interesting side effect relating to DFS in Windows Server 2003 R2. Yes, the machine also was a file server replicating to another server using RDC using domain based DFS. Some of the DFS roots had the now decommissioned server as the preferred target. What this unfortunately means is that when you go into the DFS console from another machine (either another server or from an XP machine with the console installed), when examining the DFS Root, you get the error below: \\domain.com\share: The namespace cannot be queried. The RPC server is unavailable.

This only happens on roots which were configured to have the failed server as the preferred target. Clients were still OK accessing the still working server as they failed over automatically

So, from the File Server Management Console, you're stuck - you can't remove the failed server. However, you can use the command line utility, dfsutil to forceably remove it.

First, run dfsutil /root:\\domain.com\share /export:share.txt

Share.txt will look something like

<?xml version="1.0"?>
<Root Name="\\DOMAIN\Share" State="1" Timeout="300" >
<Target Server="FAILEDSERVER" Folder="Share" State="2"/>
<Target Server="GOODSERVER" Folder="Share" State="2"/>
</Root>

To delete the failedserver, and remember this is a last ditch thing, run (on one line)

dfsutil /unmapftroot /root:\\domain\share
/server:failedserver /share:share

You're now close. To make this work, you must have access to the share on a good server. You must also bounce (at least I had to) the DFS Replication service on the good server AND restart the File Server Management Console. However, once done, everything will be good again. Just need to re-introduce the new server once the new disks arrive.

So now you know one reason why it's been a quiet week of blogging!
Cheers,
John.

Improved Generic Exchange Backup Script

jhoward — Sat, 05 Nov 2005 04:36:00 GMT

So after numerous emails about this, and some comments on my previous blog post back in June, I spent a couple of hours this afternoon improving the backup script (which although was written as a generic Exchange backup script, is suitable for file system, system state and more - it just depends entirely what you set the selection criteria as). I've got it running now at home great, so it's worth sharing to the bigger audience now.

The biggest request I had was for email notification if an error occurs. Sending an email is simple (honestly). However, I didn't just want to send any old boring email, I wanted to utilise some of the more advanced features capable in Outlook, and show you how you can use the extended version of CDO for Exchange (CDOEx) rather than CDO. That having been said, to keep it generic and so that this script would run on any Windows Server, I ended up using CDO and SMTP rather than the more advanced capabilities of CDOEx. I've left the CDOEx code in there if you want to go that route, and I have tested it and it does work, so is a good example if you need it. The advanced features are so that the message flag is set to highlight some action is required. It is complicated due to timezone issues, but I think they're pretty well sust, so it should work all the way from Seattle to Sydney.

Here's an example of what I mean by "advanced" - notice that the email is red, and flagged with a follow-up action

Here's the revised script. I have a question though for someone really techy which I just can't find the answer to. I'll post a followup entry shortly. Cut/Paste and save as backup.vbs. Generate your Windows Backup selection file as before, and change the series of constants at the top of the file according to your needs - recipients for error emails, SMTP servers etc. Note that I haven't tested anything except anonymous SMTP drop.

' ************************************************************************************
' * Weekly Backup Script for Exchange
' * John Howard, Microsoft UK. Created 25th June 2005
' * History:
' * 04 Nov 2005 - Added Email Sending on Failure (see inline comments)
' *
' * Feel free to use/modify for your own needs.
' * No guarantees though although it works for me :-)
' * However, if you can do better, contact me through http://blogs.technet.com/jhoward
' ************************************************************************************

Option Explicit
On error resume next
Const NO_ERROR = 0
Const BACKUP_PROGRAM   = "c:\windows\system32\ntbackup.exe "
Const cdoImportance    = "urn:schemas:httpmail:importance"
Const cdoHigh          = 2 ' Importance
Const cdoAnonymous     = 0
Const cdoBasic         = 1
Const cdoNTLM          = 2
Dim   SMTP_AUTH

' TAILOR THESE NEXT CONSTANTS TO YOUR REQUIREMENTS
Const DEFAULT_SENDER   = "Backup Job <servername@contoso.com>"
Const DEFAULT_RECIP    = "user@contoso.com"
Const DEFAULT_SUBJECT = "Backup Failure on Exchange!"
Const SMTP_SERVER      = "exchange.contoso.com"
Const SMTP_PORT        = 25
      SMTP_AUTH        = cdoAnonymous ' Choose one of the above
Const SMTP_TIMEOUT     = 60 ' Seconds to wait for SMTP Server
Const MESSAGE_FLAG     = "URGENT: Backup Job has failed"
Const BACKUP_SHARE     = "\\RemoteServer\ExchangeBackups"
Const BACKUP_SELECTION = "Exchange Backup Selection.bks"

Dim szYYWW                    ' Date in YYYY-WW format (Week of year)
Dim szYYMMDD                  ' Date in YYYY-MM-DD format
Dim szFlagsSelection          ' The backup selection script, prepopulated
Dim szSetDescription          ' The description of the backup set
Dim szDestinationFile         ' The destination file in the destination directory
Dim szFlagsJobName            ' Flags for the name of the job [/j "jobname")
Dim szFlagsVerify             ' Flags for verify the backup    [yes|no]
Dim szFlagsRemoteStorage      ' Flags for remote storage       [/rs:no|yes]
Dim szFlagsHardwareCompress   ' Flags for hardware compression [/hc:off|on]
Dim szFlagsLogging            ' Flags for logging in ntbackup [/l:f|s|n] Full SUmmary None
Dim szFlagsAppend             ' Flags for appending data       [/a] or nothing
Dim szFlagsRestrict           ' Flags for restricting access   [/r:yes|no]
Dim szFlagsType               ' Flags for backup type          [/m normal|Incremental|Differential...]
Dim szFlagsTapeName           ' Flags for name of tape
Dim oFSO                      ' File System Object to see if file already exists
Dim owShell                   ' To execute a shell command
Dim rc                        ' Return code
Dim szError                   ' If we have an error, record it in here
Dim szCommandLine             ' What we are going to run as a backup
Dim szUTC                     ' UTC Date/Time for SMTP Reply-By field

Set oFSO        = Nothing
set owShell     = Nothing
rc              = NO_ERROR ' OK So far
szCommandLine   = ""        ' Not sure what we're running yet
szError         = ""        ' Not had an error yet

' Setup our variables
if (NO_ERROR = rc) Then
    szYYWW                   = year(now()) & " w" & formatNumber(DatePart("WW",now()))
    szYYMMDD                 = year(now()) & "-" & formatNumber(month(now())) & "-" & formatNumber(day(now()))
    szFlagsSelection         = chr(34) & "@" & BACKUP_SHARE & "\" & BACKUP_SELECTION & chr(34)
    szFlagsJobName           = "/j " & chr(34) & "Exchange Backup" & chr(34)
    szFlagsVerify            = "/v:yes"        ' Verify YES|NO
    szFlagsRemoteStorage     = "/rs:no"
    szFlagsHardwareCompress = "/hc:off"       ' Hardware compression off - this is to disk
    szFlagsLogging           = "/l:f"          ' f=full s=summary n=none
    szFlagsAppend            = "/a"            ' /a for Append or leave blank to overwrite
    szFlagsRestrict          = "/r:no"         ' no|yes Restrict access to administrators
    szFlagsTapeName          = "/t:Exchange " & szYYWW
    szDestinationFile        = "Exchange " & szYYWW & ".bkf"
    szSetDescription         = "/d " & chr(34) & "Created " & szYYMMDD & chr(34)
    szUTC                    = GetUTCSMTPDateString()
end if

' Instantiate File System Object
if (NO_ERROR = rc) Then
    err.clear
    Set oFSO = CreateObject("Scripting.FileSystemObject")
    if (err.number) or (oFSO is nothing) Then
        rc = -1
        szError = "Failed Creating FSO: " & err.description & " -0x" & hex(err.number)
    end if
end if

' Look to see if the file exists to determine the backup type
if (NO_ERROR = rc) Then
    if not oFSO.FileExists(BACKUP_SHARE & "\" & szDestinationFile) then
        ' Normal | Copy | Differential | Incremental Backup Type
        szFlagsType       = "/m normal "
        szFlagsAppend     = "" ' Don't Append if does not exist
    else
        ' File exists, so incremental backup. We are already in Append mode
        szFlagsType       = "/m incremental "
        szSetDescription = "/d " & chr(34) & "Inc " & szYYMMDD & chr(34)
    end if

' Release File SYstem Object
set oFSO = Nothing
end if

' Create a Shell Object to be able to run the backup executable
if (NO_ERROR = rc) Then
    err.clear
    Set owShell = wscript.createobject("wscript.shell")
    if (err.number) or (owShell is nothing) Then
        rc = -2
        szError = "Failed Creating wscript.shell: " & err.description & " -0x" & hex(err.number)
    end if
end if

' Build the backup command and run it
if (NO_ERROR = rc) Then
    szCommandLine = BACKUP_PROGRAM         & _
                     "backup"         & " " & _
                     szFlagsSelection      & " " & _
                     szSetDescription & " " & _
                     "/f " & chr(34) & BACKUP_SHARE & "\" & szDestinationFile & chr(34) & " " & _
                     szFlagsAppend           & " " & _
                     szFlagsLogging          & " " & _
                     szFlagsVerify           & " " & _
                     szFlagsRestrict         & " " & _
                     szFlagsRemoteStorage    & " " & _
                     szFlagsHardwareCompress & " " & _
                     szFlagsType             & " " & _
                     szFlagsJobName          & " "

rc=owshell.run(szCommandLine,,True)
end if

set owShell = Nothing
if (rc) Then SendErrorEmail
wscript.quit(rc)

Function FormatNumber(szIn)
FormatNumber = szIn
if len(szIn) = 1 then FormatNumber = "0" & szIn
End Function

'-----------------------------------------------------------------------------------
' Function Added: JJH 04 Nov 2005
'-----------------------------------------------------------------------------------
' For Sending an Email. We have the option to use send using exchange, but
' this can only be done on the Exchange server itself and requires CDOEx which
' is only installed on an Exchange Server. However CDO (CDOSys in old speak) is
' also installed on any Windows 2003 Server, and is a subset of CDOEx, we can
' use SMTP to send from any server pointing towards our Exchange Server.
' HOWEVER: It is nice to be able to get a reminder in Outlook to say that
' we need to do something rather than just an email. This requires an additional
' message header Reply-By which is in the Format (eg) Fri, 4 Nov 2005 15:23:08 -0000.
' Now, rather than mess around with timezones etc, I just use UTC. Seems to work,
' but it probably also helps that I'm in the UK so don't have to worry too much
' about timezones generally :-) However, appreciate many people may use this
' who are outside of UK, so best to make an effort!
'
' Note: We also fail safe to assume no time bias if we can't read registry
'-----------------------------------------------------------------------------------
Function GetUTCSMTPDateString()
    Dim dtUTC        ' UTC Date
    Dim szUTC          ' UTC Date string in SMTP RFC Format
    Dim oShell         ' To read registry
    Dim szATBRegKey    ' Registry key for Active Time Bias
    Dim lMinutesOffset ' From UTC
    Dim rc             ' Function return

    On error resume next
    rc = 0
    szATBRegKey = "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\TimeZoneInformation\ActiveTimeBias"
    lMinutesOffset = 0
    err.clear

    if (NO_ERROR = rc) Then
        err.clear
        set oShell = CreateObject("WScript.Shell")
        if (err.number) or (oShell = Nothing) Then rc = -1
    end if

    if (NO_ERROR = rc) Then
        lMinutesOffset = oShell.RegRead(szATBRegKey)
        if (err.number) then
     rc = -1
            lMinutesOffset = 0
        end if
    end if

    ' Regardless of error, we do the formatting (default to zero offset)
    dtUTC = dateadd("n", lMinutesOffset, now())
    szUTC = WeekdayName(Weekday(dtUTC),True) & ", " & _
            Day(dtUTC) & " " & _
            MonthName(Month(dtUTC),True) & " " & _
            Year(dtUTC) & " " & _
            FormatNumber(Hour(dtUTC)) & ":" & _
            FormatNumber(Minute(dtUTC)) & ":" & _
            FormatNumber(Second(dtUTC)) & " " & _
            "-0000"

    set oShell = Nothing
    err.clear ' Don't pass any error back as we will have _something_
    GetUTCSMTPDateString = szUTC

End Function

'-----------------------------------------------------------------------------------
' Function Added: JJH 04 Nov 2005
'-----------------------------------------------------------------------------------
' There are several solutions to sending email. We _could_ use CDOEx, but we need
' to be running on an Exchange Server to do this. While you might say "But this is
' a generic Exchange backup program, so of course it's running on an Exchange Server",
' remember although I built it for Exchange backups, it's still pretty generic and
' can be used for file system backups or system state etc.
'
' CDOEx is not "remoteable" - it can only be instantiated on the Exchange Server
' itself. Hence, not very generic.
'
' BUT - CDOEx has advantages. You can use "SendUsingExchange" rather than SMTP
' which allows you to relatively easily set a reminder on the message itself.
' You would unfortunately also be limited to not just running on an Exchange
' Server, but who you are sending it _from_ must have their mailbox on that
' local server.
'
' Plan B: Use CDO which is present on all Windows Servers. However, to do this
' has its own problems if you also want the message to flag up if you're using
' a rich Outlook client to read the message.
'
' Plan B and a half is to incorporate elements of both solution (see inline comments,
' with some code commented out) but using SMTP.
'
' Note: I could have done this, but it just would have been _too_ easy :-)
'
'Dim oMsg
'set oMsg = CreateObject("CDO.Message")
'oMsg.To = "user@contoso.com"
'oMsg.From = "Exchange@contoso.com"
'oMsg.Subject = "Backup Status"
'oMsg.TextBody = "Whatever you want"
'oMsg.Send
'set oMsg = Nothing

'-----------------------------------------------------------------------------------
Function SendErrorEmail()

    Dim oMsg       ' Message we send if failure occurs
    Dim szFrom        ' String
    Dim szBaseFolder ' Base folder for the current users mailbox
    Dim rc

    szFrom = ""
    rc = NO_ERROR
    set oMsg = Nothing

' COMMENTED OUT - COULD USE IF WE KNOW THIS IS RUNNING ON AN EXCHANGE SERVER
' REASON BEING: CDO.Person and IMailbox Interface are only implemented in CDOEx, not CDO
' Following block is to generate a full from email address so that we
' use a better display name if we are sending the email externally from
' the Exchange organisation. Not strictly necessary, but nicer.
' Also, no error checking implemented
'    Dim IMailbox      ' Mailbox Interface to CDO.Person object
'    Dim oADSInfo      ' ActiveDS.ADSystemInfo
'    Dim oPerson       ' CDO.Person
'    set oADSInfo = CreateObject("ADSystemInfo")
'    set oPerson = CreateObject("CDO.Person")
'    oPerson.DataSource.Open("LDAP://" & oADSInfo.DomainDNSName & "/" & oADSInfo.UserName)
'    szFrom = oPerson.FileAs ' May be blank if no description in AD
'    if 0 = len(szFrom) then szFrom = "Exchange Backup Script"
'    szFrom = szFrom & " <" & oPerson.Email & ">"

    ' Need to have a default sender
    if (NO_ERROR = rc) Then
        if 0 = len(szFrom) Then szFrom = DEFAULT_SENDER
    end if

' COMMENTED OUT - AGAIN CDOEX SPECIFIC. Assuming we use code block commented
' above, we need to make sure that the users mailbox we are sending FROM (which
' is the currently logged on user) is homed on the current Exchange Server.
' The base folder will be something like file://./backofficestorage/<domain>/MBX/<User>/
'    set IMailbox = oPerson.GetInterface("IMailbox")
'    szBaseFolder = IMailbox.BaseFolder
'    if (0=len(szBaseFolder)) Then <TRAP ERROR HERE>

    ' Create a message object. Not a lot we can do if we can't - could put further
    ' checking maybe to write to event log. Exercise for the reader though.
    if (NO_ERROR = rc) Then
        err.clear
        set oMsg = CreateObject("CDO.Message")
        if (err.number) or (oMsg is nothing) Then rc = -1
    end if

' Configure the outbound email
if (NO_ERROR = rc) Then

With oMsg.Configuration
'.Fields(cdoSaveSentItems) = False

            ' CDOEX Specific next line
            '.Fields("http://schemas.microsoft.com/cdo/configuration/sendusing") = cdoSendUsingExchange

            ' SMTP Specific lines instead of above commented out line
            .Fields("http://schemas.microsoft.com/cdo/configuration/sendusing") = 2 ' SMTP By Port
            .Fields("http://schemas.microsoft.com/cdo/configuration/smtpserver") = SMTP_SERVER
            .Fields("http://schemas.microsoft.com/cdo/configuration/smtpserverport") = SMTP_PORT
            .Fields("http://schemas.microsoft.com/cdo/configuration/smtpauthenticate") = SMTP_AUTH
            .Fields("http://schemas.microsoft.com/cdo/configuration/smtpconnectiontimeout") = SMTP_TIMEOUT
            ' If using BASIC, need to set cdo/configuration/sendusername and sendpassword accordingly

            ' Update fields from the configuration
            .Fields.Update
        end With

        oMsg.To = DEFAULT_RECIP
        oMsg.From = szFrom
        oMsg.Subject = DEFAULT_SUBJECT

        oMsg.TextBody = "Backup Job has failed" & vbcrlf
        oMsg.TextBody = oMsg.TextBody & "Error: " & szError & vbcrlf & vbcrlf
        oMsg.TextBody = oMsg.TextBody & "Backup Job: " & szCommandLine

        ' CDOEX/SendUsingExchange Specific to set the message flag
        'oMsg.Fields("http://schemas.microsoft.com/mapi/proptag/0x10900003")=2
        'oMsg.Fields("urn:schemas:httpmail:messageflag")= MESSAGE_FLAG

        ' SMTP Way of doing this
        oMsg.Fields("urn:schemas:mailheader:Reply-By") = szUTC
        oMsg.Fields("urn:schemas:mailheader:X-Message-Flag") = MESSAGE_FLAG

       oMsg.Fields(cdoImportance) = cdoHigh
       oMsg.Fields.Update
       oMsg.Send
    end if

set oMsg = Nothing

    ' If using CDOEx
    'set oPerson = Nothing
    'set oADSInfo = Nothing

End Function

Someone smart may wonder what's oMsg.Fields("http://schemas.microsoft.com/mapi/proptag/0x10900003")=2 about. If you want to know, and how I went about finding out, it's a long story. Post a comment and I'll put up the details when I get a spare day (it's that long). <GRIPE>Previous to working at Microsoft, obtaining info like this was my day job - I had plenty of support cases lined up at MS and got pretty up tight about some of the decisions made by the Exchange Dev team, and specifically those working on the SDK tools. Seems like even since my gripes a few years ago, the same lack of documentation (or deliberate hiding of this info more specifically is still there)</GRIPE>

(Nov 2008) Updated as I discovered the formatting of the above script was awful in the new blog template. Also adding a link to a direct download of the script (save as a .vbs file rather than .txt). It's here.