PFE Ireland : Windows Server 2008

How to P2V Windows 2000 server using SCVMM 2008

DavidMcCormick — Mon, 06 Apr 2009 14:16:57 GMT

With the economic down turn and the green agenda Virtualisation has become a hot topic with my customer. These days its all about getting the best value for money as possible with your IT budget, so when my customer had a number of servers out...(read more)

Windows Server 2008 Terminal Services: Single Sign On and Windows XP clients

gmcshera — Fri, 05 Sep 2008 18:55:00 GMT

Single Sign On for Windows XP Clients

Single Sign On (SSO) to Windows Server 2008 (W2K8) Terminal Services uses the Credential Security Service Provider (CredSSP). CredSSP delegates credentials to defined target servers and is native to Windows Vista. Windows XP SP3 includes CredSSP but it is not enabled by default. Windows XP SP2 clients can still connect to W2K8 Terminal Services but users will be prompted for credentials upon establishing the first session. Having to enter your username and password ruins the RemoteAPP experience. So what do you need to get your Windows XP client seamlessly connecting to a W2K8 Terminal Server?

Windows XP SP3
Remote Desktop Connection (RDC) 6.1 (Part of SP3)

KB951608 explains the CredSSP for Windows XP SP3 in detail.

Once you have SP3 installed you need to make the following changes:

Client side:

Enable CredSSP
Configure Single Sign On for credential delegation
Define target servers

Server side:

Modify RDP protocol settings

Enable CredSSP

The CredSSP settings have to be APPENDED to the existing parameters. See KB951608. Appending to existing keys could prove time consuming if you have a lot of clients. Here is a script written in VBS that may make automating the task a little easier.

Disclaimer: Do not blindly run these scripts without testing first. Make sure you take a backup of the registry!

Const HKEY_LOCAL_MACHINE = &H80000002

strComputer = "."

Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\default:StdRegProv")

‘strKeyPath = "SYSTEM\CurrentControlSet\Control\Lsa"

strValueName = "Security Packages"

oReg.GetMultiStringValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,arrSecurityPackages

For Each strValue In arrSecurityPackages

if lcase(strValue) = "tspkg" then intTSPKG = 1 ‘ Set a flag to say that value already exists

Next

if intTSPKG <> 1 then ‘Value doesn’t exist so lets create it

intNewArraySize = Ubound(arrSecurityPackages) + 1

reDim Preserve arrSecurityPackages(intNewArraySize) ‘Resize the array for new value and keep existing values

arrSecurityPackages(intNewArraySize) = "tspkg" ‘ Add the new value

oReg.SetMultiStringValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,arrSecurityPackages

End if

strKeyPath = "SYSTEM\CurrentControlSet\Control\SecurityProviders"

strValueName = "SecurityProviders"

oReg.GetStringValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,strValue

intResult = InStr(strValue, "credssp.dll") ‘Will return position found in string

if intResult = 0 then ‘Position of 0 means string not found

strValue=strValue & ",credssp.dll"

oReg.SetStringValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,strValue

End if

Configure Single Sign On and define target servers

The following registry changes enable CredSSP for the default credentials.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation]

"AllowDefaultCredentials"=dword:00000001

"ConcatenateDefaults_AllowDefault"=dword:00000001

The following registry changes define the target servers.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation\AllowDefaultCredentials]
"1"="TERMSRV/*"

You can explicitly name your terminal servers e.g. :

TERMSRV/myserver.mydomain.com : A specific server
TERMSRV/*.mydomain.com : All servers in mydomain.com
TERMSRV/* : All servers

RDP Protocol changes

You have to make some changes to the default RDP protocol settings on your server in order to allow Windows XP SP3 clients connect.

Open Terminal Server Configuration snap-in and modify the RDP connection properties as follows:

Note that the tick has been removed from the "Allow connections only from computers running Remote Desktop with Network Level Authentication". I have the Encryption level set of Client Compatible but there is no reason why you cannot use High.

Make sure that the Use client-provided log on information radial button is selected.

You should now be in a position to make use of the SSO functionality from your Windows XP clients. However, there is a KB titled When you enable SSO for a terminal server from a Windows XP SP3-based client computer, you are still prompted for user credentials when you log on to the terminal server which comes with a patch. During my testing I did not come across this problem ... but I figured it was worth noting.

Virtualisation : Support statements and Licensing

gmcshera — Thu, 21 Aug 2008 00:38:00 GMT

Over the past week or so Microsoft have clarified the support statement for server products running in virtual environments. The most significant announcement was the Server Virtualisation Validation Program (SVVP). To quote "The Server Virtualization Validation Program (SVVP) is open to any vendor who delivers a virtualization machine solution that hosts Windows Server 2008, Windows 2000 Server Service Pack 4 and Windows Server 2003 Service Pack 2 and subsequent service packs. The virtualization solution can either be hypervisor-based or a hosted solution. The program enables vendors to validate various configurations so that customers of Windows Server can receive technical support in virtualized environments. Customers with validated solutions will benefit from the support provided by Microsoft as a part of the regular Windows Server technical support framework."

The participating vendors (at time of writing are):

Cisco Systems, Inc.
Citrix Systems, Inc.
Novell, Inc.
Sun Microsystems
Unisys Corp.
Virtual Iron Software
VMware, Inc.

The SVVP does not mean that Microsoft support the products from the vendors listed above. The SVVP means the validated third party product provides a suitable environment upon which the Microsoft operating system can run. If you think about it, the SVVP is very similar to the hardware certification for Microsoft operating systems.

Now that you know the supportability of your Microsoft operating systems turn your eyes to the support statements for Microsoft server software. Microsoft server software and supported virtualization environments.

You'll find statements for :

Microsoft Application Virtualization (App-V)
Microsoft BizTalk Server
Microsoft Commerce Server
Microsoft Dynamics AX
Microsoft Dynamics CRM
Microsoft Dynamics NAV
Microsoft Exchange Server
Microsoft Forefront Client Security
Microsoft Intelligent Application Gateway (IAG)
Microsoft Forefront Security for Exchange (FSE)
Microsoft Forefront Security for SharePoint (FSP)
Microsoft Host Integration Server
Microsoft Internet Security and Acceleration (ISA) Server
Microsoft Office Groove Server
Microsoft Office PerformancePoint Server
Microsoft Office Project Server
Microsoft Office SharePoint Server and Windows SharePoint Services
Microsoft Operations Manager (MOM) 2005
Microsoft Search Server
Microsoft SQL Server 2008
Microsoft System Center Configuration Manager
Microsoft System Center Data Protection Manager
Microsoft System Center Essentials
Microsoft System Center Operations Manager
Microsoft System Center Virtual Machine Manager
Microsoft Systems Management Server (SMS)
Microsoft Visual Studio Team System
Microsoft Windows HPC Server 2008
Windows Server 2003 Web Edition
Microsoft Windows Server Update Services (WSUS)
Windows Web Server 2008

Licensing changes:

New Licensing Flexibility : check out the press release http://www.microsoft.com/presspass/press/2008/aug08/08-19EasyPathPR.mspx

Scripting: Hyper-V - Mount VHDs by right clicking

gmcshera — Fri, 25 Jul 2008 18:20:00 GMT

There are plenty of posts on the interweb that show you how to mount and unmount vhds via powershell. I downloaded the Hyper-V PowerShell management library from CodePlex.com here as created by James O'Neil. In it he kindly provides two scripts (mount-VHD.ps1 and Unmount-VHD.ps1) along with a REG file. Assuming you have PowerShell 1.0 installed (available feature in Windows Server 2008) these scripts and registry settings work fine.

I ran into problems once I downloaded and installed the Windows PowerShell 2.0 Community Technology Preview (CTP). Powershells execution policy wouldnt let the scripts run anymore.

You can change the executionPolicy a number of ways:

Registry:

HKLM\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell

Change the key: REG_SZ ExecutionPolicy to Unrestricted

PowerShell:

set-executionpolicy unrestricted

Note: By changing the execution policy you are technically opening your system up to remote execution of PowerShell scripts from unsigned/untrusted sources. I want to be able to mount vhds easily coz Im a lazy kinda guy. Im running Hyper-V on my laptop so Im not too concerned about security in this instance. You should think carefully about making this change in a production environment.

The second thing I noticed was that the registry settings provided by James no longer worked. So I came up with a slight modification as follows:

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\Virtual.Machine.HD]

[HKEY_CLASSES_ROOT\Virtual.Machine.HD\DefaultIcon]
@="%SystemRoot%\\system32\\imageres.dll,26"

[HKEY_CLASSES_ROOT\Virtual.Machine.HD\shell]
@="Mount"

[HKEY_CLASSES_ROOT\Virtual.Machine.HD\shell\Mount]

[HKEY_CLASSES_ROOT\Virtual.Machine.HD\shell\Mount\command]
@="cmd /k \"powershell -NoProfile -Command \"& 'c:\\Program Files\\Hyper-V\\Mount-VHD.ps1' '%1'\"\""

[HKEY_CLASSES_ROOT\Virtual.Machine.HD\shell\Unmount]

[HKEY_CLASSES_ROOT\Virtual.Machine.HD\shell\Unmount\command]
@="cmd /k \"powershell -NoProfile -Command \"& 'c:\\Program Files\\Hyper-V\\Unmount-VHD.ps1' '%1'\"\""

[HKEY_CLASSES_ROOT\.vhd]
@="Virtual.Machine.HD"

I've used cmd/k instead of cmd/c so I can see what the PowerShell script reports when its finished along with a couple of changes to get PowerShell to accept the string after the -Command.

Now all is great in the land of Hyper-V on my laptop.

Windows 2008 Clustering & the Cluster Log

DavidMcCormick — Fri, 04 Jul 2008 12:40:38 GMT

Where is the cluster log in Windows 2008 ?

This short answer is its no longer there. On our Windows 2008 cluster node if we navigate to %systemroot%\system32\LogFiles\Cluster your wont find the cluster.log file anymore.

Why ? Its been replaced by a much more sophisticated event based tracing system.

The Vista\Windows Server 2008 Event Model is the next generation of Windows Event Logging and replaces the current version of the Event Log shipped in Microsoft® Windows® 2003 Server, Microsoft® Windows® XP, Windows 2000, and previous versions of Microsoft® Windows NT®.

The new model is a major update to the NT Event Log service. It maintains 100% backwards compatibility with the existing APIs and functionality and fully leverages the existing NT Event Log instrumentation in the applications and services. At the same time, it eliminates some of the limitations of the NT Event Log and provides additional features to better support monitoring and diagnostics of Windows applications, services, components, and drivers.

In a future post I will go through the new Logging and tracing features for clusters in Windows 2008 but for now lets look at how to get access to the old familiar cluster.log file.

Here's how to go about it.

1. Go to a command prompt

2. Type "Cluster /Cluster:yourclustername log /gen /copy "C:\temp". You should get output as follows

3. Navigate to the c:\temp directory and there you will find the .log files for each node of your cluster.

The cluster log can now be opened in Notepad.

Please note that you need to run this command after each change as its not dynamically updated like the old .log file.

Hyper-V : Link madness

gmcshera — Fri, 20 Jun 2008 13:15:01 GMT

Need some light reading for the weekend? Have a look at the links below. All part of the growing body of knowledge around Hyper-V.

Websites

Microsoft Virtualization Home Page

http://www.microsoft.com/virtualization/default.mspx

Virtualization Case Studies

http://www.microsoft.com/virtualization/case-studies.mspx

Virtualization Solution Accelerators

http://technet.microsoft.com/en-us/solutionaccelerators/cc197910.aspx

Windows Server 2008 Virtualization & Consolidation: http://www.microsoft.com/windowsserver2008/en/us/virtualization-consolidation.aspx

Hyper-V FAQ

http://www.microsoft.com/windowsserver2008/en/us/hyperv-faq.aspx

Optimized Desktop Infrastructure (VDI and much more): http://www.microsoft.com/windows/products/windowsvista/enterprise/default.mspx

Virtualization TechCenter:

http://technet.microsoft.com/en-us/virtualization/default.aspx

How to Install Windows Server 2008 Hyper-V RC

http://www.microsoft.com/windowsserver2008/en/us/hyperv-install.aspx

Windows Server 2008 Hyper-V Performance Tuning Guide

http://www.microsoft.com/whdc/system/sysperf/Perf_tun_srv.mspx

MSDN & TechNet Powered by Hyper-V

http://blogs.technet.com/virtualization/archive/2008/05/20/msdn-and-technet-powered-by-hyper-v.aspx

MSDN & TechNet Powered by Hyper-V Whitepaper

http://download.microsoft.com/download/6/C/5/6C559B56-8556-4097-8C81-2D4E762CD48E/MSCOM_Virtualizes_MSDN_TechNet_on_Hyper-V.docx

Blogs:

http://blogs.technet.com/virtualization/default.aspx

http://blogs.msdn.com/virtual_pc_guy/

http://blogs.technet.com/jhoward/

http://blogs.technet.com/roblarson/

http://blogs.technet.com/virtualworld/

http://blogs.technet.com/windowsserver/

http://blogs.technet.com/mapblog/

http://blogs.technet.com/stbnewsbytes/

Webcasts:

http://msevents.microsoft.com/CUI/WebCastEventDetails.aspx?culture=en-US&EventID=1032368894&CountryCode=US

http://msevents.microsoft.com/CUI/WebCastEventDetails.aspx?culture=en-US&EventID=1032372420&CountryCode=US

Network Access Protection (NAP) and my switches

gmcshera — Fri, 30 May 2008 01:47:02 GMT

I recently gave an overview of NAP at a Windows Server 2008 event. For the purposes of the event I focused and demo’d DHCP enforcement. From some customers DHCP enforcement was not enough. What about 802.1x enforcement ? Our pals on the NAP team have already blogged this (quite sometime back) as an introduction to what the real world options are. Check it out : NAP 802.1x enforcement. I’d also point you in the direction of the Step by Step lab guide.

For a real world view of NAP in action with Cisco switches check out Michael Kleefs blog here. When I asked about real world implementations Michael's demos where recommended.

While on the topic of NAP…. I was also asked about how much traffic does it generate. Yet again Michael Kleef had the answers.

Update: No sooner had I posted this (7 minutes after to be exact) Jeff Sigman (NAP guru) commented that he setup a rack with 10+ switches. Check out his posting http://blogs.technet.com/nap/archive/2008/04/15/video-nap-world-tour-rsa-2008-san-francisco.aspx. How is that for fast information update! :)

MSDN and TechNet now run on Hyper-V

gmcshera — Tue, 27 May 2008 17:22:00 GMT

I’ve had a lot of interest in Hyper-V from customers and quite a few questions too. One of the most common being, “Who is using it in a production environment?”. Up until now I didn't have an answer. … but now I do.

Microsoft are now running the MSDN and TechNet sites on Hyper-V. So, putting that in context, that’s over 4 million hits a day (1 million for TechNet and 3 million for MSDN). This implementation also puts in context what sort of work loads Hyper-V can support. Granted there was a performance overhead for running in a virtual environment when compared with the loads the physical boxes could handle but that’s part of parcel of virtualisation.

More info can be found on Virtualization.info or indeed on our Virtualisation blog here.

Hyper-V RC1 is out!!!

gmcshera — Tue, 20 May 2008 23:48:00 GMT

Check out the posting on the Windows Virtualization Team blog here for more details.

As usual its a one way upgrade process. Once you go forward there is no coming back! :)

Hyper-V RC0 to RC1 Upgrade Considerations
*Saved-state files are not supported between RC0 and RC1 releases of Hyper-V. All virtual machine saved states should be discarded before upgrading to RC1, or prior to resuming virtual machines after upgrading to Hyper-V RC1.

*Online snapshots contain virtual machine save-states and thus online snapshots taken with Hyper-V RC0 are not supported after updating to Hyper-V to RC1. Either apply any online snapshots and shut down the VM or discard the virtual machine save state associated with the snapshot before or after the update to Hyper-V RC1.

*System Center Virtual Machine Manager 2008 Beta does not support Hyper-V RC1.

*New Integration Components (ICs) must be installed for your supported guest operating systems. Integration Components are specific to the build of Hyper-V. RC1 Integration Components for all supported Windows Operating Systems are provided using the ‘Action’ -> ‘Insert Integration Services Setup Disk’ action.

RC1 Integration Components for all supported Windows Operating Systems are now part of the IC Setup Disk. This now includes Windows Server 2008! Simply install the Hyper-V RC1 Integration Components for Windows Server 2008 the same way you do all other Windows ICs (‘Action’ -> ‘Insert Integration Services Setup Disk’).
Note You need to close the found new hardware wizard before setup will begin on all Windows Operating Systems.

Improvements Over Hyper-V RC0
In addition to bug fixes and stability improvements we also made some additional changes largely based on feedback from customers, I might have missed a few I’ll add to this list if so…
   *Integration Components For Windows Server 2008 guest’s included in Integration Services Setup Disk
   *New Graphics for Hyper-V Manager and Virtual Machine Connection – including a “Now” icon in the snapshot pane
   *IPv4 Address Migration - when creating a new Virtual Network bound to an adapter with a static IPv4 address the IPv4 settings are migrated to the new virtual adapter

I'm just about to update my own Hyper-V installation so fingers crossed.

Step-by-Step Guide for Testing Hyper-V and Failover Clustering

gmcshera — Mon, 19 May 2008 21:40:39 GMT

I blogged recently on “How to create a Windows Server 2008 Cluster within Hyper-V using simulated iSCSI storage”. This is enough to get you familiar with how clusters work in Windows Server 2008. The next logical step is to understand the high availability options available for VMs running in your Hyper-V environment. The good news is that Hyper-V is cluster aware allowing you to use the Quick Migration functionality. Check out the Step-by-Step Guide for Testing Hyper-V and Fail over Clustering. It explains the requirements and takes you, as the name implies, step-by-step through the process.

Hyper-V: Where do I start?

gmcshera — Thu, 15 May 2008 18:49:11 GMT

There are plenty of docs and blogs out there digging deep into Hyper-V. However, a few customers have asked a simple question: “What do I need to think about before I start testing Hyper-V?"

Well, first things first. The product still hasn’t RTM’d so DONT use it for production environments … not even a little one!
Hyper-V only runs on x64 processors with INTEL-VT or AMD-V.
Pick your hardware: While it has not been RTM’d the Certified hardware list is available. Check out Windows Server Catalog site BEFORE you make the decision to purchase hardware. Keep an eye open for the logo below:
Think carefully about your storage options. Badly designed or configured storage can impact the overall performance of your virtual environment.
Understand the licensing model for Virtual operating systems. More information can be found Virtual Machine Technology FAQ. Its important to note that regardless of what vitalization product you decide to run the licensing model is still the same.
Think carefully about disaster recovery. Don’t wait until the last minute to figure out how you will manage and recover your virtual machines. The smallest hardware failure can take down the biggest virtual environment. Plan accordingly.

These are all very high level points so I will flesh them out over time. Any questions, feel free to comment.

Expensive Hypervisors - a bad idea even if you can afford them

gmcshera — Thu, 08 May 2008 17:40:04 GMT

Here is a great post from James O'Neill.

http://blogs.technet.com/jamesone/archive/2008/03/13/expensive-hypervisors-a-bad-idea-even-if-you-can-afford-them.asp

As Microsoft get ready with Hyper-V, VMware are beginingg their marketing blitz in an attempt to justify their pricing. As James points out in his post you can manipulate figures to come to any conclusion you want ... even if its way off base. Microsofts Hyper-V will cost a fraction, per socket, when compared to VMWare. While the VMWare products are slightly more mature Hyper-V is only a small part of the Virtualisation offering from Microsoft. Windows Server 2008 really brings Mircosoft virtual offerings to the forefront as an end-to-end solution. Check out http://www.microsoft.com/virtualization/default.mspx for more details.

Hyper-V : Windows Server 2003 VM - Where is my network card?

gmcshera — Thu, 08 May 2008 17:35:00 GMT

There are plenty of articles out there explaining how to install the Hyper-V and get a Windows Server 2008 VM up and running. One such article is Virtual PC Guy's weblog (Here).

What if you want to get a Windows Server 2003 VM up and running? One thing to bear in mind is that a Windows Server 2003 VM will not have the drivers for the virtual NIC straight out of the bag. To pick up the drivers you need to install the Hyper-V integration components. If you have created your VM with an ISO or CD that is pre SP2 then you are going to run into issues. You'll have no NIC and you will not be able to install the integration components. Why? See the image below.

No network card without the Hyper-V integration components, no Hyper-V integration components without SP2, no network card to download or copy SP2.

So how do you get around this issue? Well, there are a few options but perhaps the easiet way is to create an ISO with SP2 on it.

[Update: You could also mount the VHD offline OR you could use a pass through disk]

Tools for the job:

Windows 2003 SP2 which can be found here
Something to create the ISO with. I used NBXSoft - Free Create-Burn ISO which worked nicely on the x64 Windows Server 2008 host.

What next?

Create your ISO and attach the VMs CD drive to it
Install Windows 2003 SP2 and reboot
Try and install the Integration Services again from the Action menu

If there are any problems detecting hardware try removing it from Device Manager and bouncing the VM.

Note: You wont run into this issue with a Windows Server 2008 VM as the integration components are built in.