Blog du Tristank : IT Pro / Sysadmin

Vista Black Edition comments from the MMPC

tristank — Wed, 21 Oct 2009 04:06:22 GMT

Matt McCormack, MMPC Melbourne (that is the most awesomely alliterative signature block I’ve seen for a while) comments on an amusingly ironic infection detection we’ve seen from MSE:

http://blogs.technet.com/mmpc/archive/2009/10/20/vista-32-bit-black-hat-edition-2009-iso.aspx

ISA Server 2006 TCP Retransmits

tristank — Wed, 14 Oct 2009 04:24:20 GMT

Health Checks

I perform ISA Server Health Checks for Premier Support (via Premier Field Engineering) as part of my role.

I’ve seen something a few times recently that I thought it might be helpful to call out, while poking around in the Performance Monitor TCPv4 counter area.

The Problem

In short: Lots of TCP retransmissions per second.

Like, lots. More than 1% is annoying; any more than 5% and you pretty surely have a problem.

Recently, I’ve been seeing 20%.

That’s right, kids, according to Perfmon’s statistics, one in five TCP packets requires retransmission.

If your ISA Server seems like it might be a bit slow, and you haven’t looked yet, go look. I’ll wait. You’re interested in the TCPv4 object, specifically the Segments/sec and Segments Retransmitted/sec counters.

What I’ve seen looks like this:

The green area is TCPv4\Segments/sec. The red area is TCPv4\Segments Retransmitted/sec. They’re using the same scale.

Notice that the retransmission figures track with the overall volume.

This 20% figure has been seen across Intel and Broadcom server NICs, so I don’t think it’s specific to either vendor.

Fixing It

In at least one of the places I found this, a simple driver upgrade to the latest version available looked like it fixed the problem.

Otherwise, it could indicate a NIC issue, or a hardware issue with the switch.

If you find yourself in this situation, and do resolve it, please do post details in the comments section below.

PL15W2SP.DLL vs Firewall Client

tristank — Wed, 19 Aug 2009 14:37:00 GMT

As I possibly misspelled or misremembered it, the PL15ws2p.dll (possible sic) file was installed as a Winsock Layered Service Provider on a couple of boxes at a customer site.

Coincidentally, these machines were Windows Server 2008 machines where we couldn’t get the Firewall Client to work properly.

We found that there was a third party LSP using:

NETSH WINSOCK SH CA > catalog.txt

And then opening catalog.txt in notepad. The properties of the Pl15ws2p.dll indicated that it was a signed DLL from American Power Corporation or similar (APC or ACP; one of those no-notes half-hours), and that it was used in some sort of management capacity.

But only one of the machines had this APC software installed on it, and the other didn’t… perhaps it got left behind when it was being uninstalled? The search engines didn’t seem to know much about it.

Either way, next step was clear:

NETSH WINSOCK RESET

To return the Windows Sockets provider list to its shiny defaults, and reboot the computer.

After that, the Firewall Client wasn’t working (which we expected).

A Repair from Not-Called-Add-Remove-Programs-Any-More-Now-It’s-Programs-And-Features-Silly fixed that up.

Cool, huh? Remember: when nothing makes sense and the configuration looks good, perhaps LSPs are to blame?

Now if only I could get my stupid Huawei 3G modem working on my Win7 laptop again (“Device attached to the system is not functioning”… thaaanks).

Improve Hyper-V Performance With Standard VGA!

tristank — Wed, 05 Aug 2009 06:36:27 GMT

Yes, kids, if you’re finding that the Hyper-V performance ain’t what it used to be since installing that whizbang graphics card driver on your shiny new seven core hyperthread-and-a-halved megaturboserver thing, you might be suffering from flushes.

Read all about it here:

Video performance may decrease when a Windows Server 2008-based computer has the Hyper-V role enabled and an accelerated display adapter installed
http://support.microsoft.com/default.aspx/kb/961661

KB titles are getting ever more catchy, I think you’ll agree. So many words, and we still couldn’t find space for “is”. Ah well.

So, in short, get back to your standard VGA driver (just uninstalling the whizbang one is typically enough for that) and you’ll be sweet.

ISA Server 2006 on Windows Server 2008: Nup

tristank — Thu, 04 Jun 2009 18:52:46 GMT

Yuri’s blog explains some of the detail. But there’s slightly more subtlety to it, which I’ll try to snake-oil in front of you here:

Can I install ISA 2006 on 32-bit Windows Server 2008 ?

No, it only runs on Windows Server 2003. Okay, so technically, it also runs on Windows 2000, but if you’re installing it like that now, you should check the calendar. Windows 2000 is old, man.

Why not ISA Server 2006 on Windows 2008?

Whenever I asked that, people mumbled about TCP/IP stack changes. Sounds plausible, so I let it slide.

Well can I install ISA 2006 on 64-bit Windows Server 2008 ?

No. Wait – sort of, not really. Do you count virtualization?

What do you mean?

Hyper-V or an SVVP-validated platform. (Details on security. And the inimitable “Jim Harris” apparently pretending to be Jim Harrison. Giggle.)

Er, if I do count virtual machines?

Yes. You run it in a 32-bit Windows Server 2003 guest.

Isn’t that cheating?!

No. Well, maybe. Sorry, did you have a point there?

What about Windows Server 2003, x64 Edition?

Installing ISA on it? No. It’s 32-bit only and uses kernel-mode software; you can’t mix and match 32-bit with 64-bit k-mode drivers. Hint: I just helped you study for 070-351.

What about Service Pack 2?

X64 Edition?

Yes!

No.

You’re not being helpful.

Oh really? Your eyes are the wrong shape.

The next version of ISA Server, called Forefront Threat Management Gateway (TMG, or, I guess, Timmy to his friends (yep, I’m betting the G ends up semi-silent)), is available in its initial release in the Windows 2008 Essential Business Server thingo, which is 64-bit only.

The next standalone (i.e. non-EBS-integrated) release is currently available in Beta form, and runs exclusively on Windows Server 2008, x64 edition.

That was more helpful.

You still look funny.

Hey, why don’t your links open in new windows?

Because I think it’s nice for the reader to be able to choose whether an informational link should appear in the current frame or a new tab (or a new window).

Sometimes (probably quite often on this blog), you’ll be done with the content at the current page you’re reading, and just want to replace it with something else. Forcing a new window isn’t polite in the age of tabbed browsing.

Let the user choose.

I agree, that’s so wise. You’re like, amazing.

I know.

IIS WebDAV Security Advisory

tristank — Tue, 19 May 2009 09:49:20 GMT

Today, an IIS 5.0 to 6.0 security advisory was released:

Vulnerability in Internet Information Services Could Allow Elevation of Privilege

http://www.microsoft.com/technet/security/advisory/971492.mspx

If you’re using WebDAV on any version prior to 7.0 (where it was completely rewritten, and released as an add-on module after ), you’ll want to read the advisory, and take appropriate action.

Mitigating factors are listed in the advisory.

Old MPSReports

tristank — Tue, 12 May 2009 05:14:21 GMT

There’s a new MPS Reports version in town, with new features : new 64-bit friendliness, various forms of wizard-driven hotness for all the products the individual old tools used to support, etc, etc.

Call me old school if you want, but I typically prefer the convenience of “run this and send me the CAB file”, rather than “grab this, install the prerequisites, and choose the following options in the wizard, then send me the CAB file”. For newer OSs, that’s a non-issue as the pre-reqs (.Net 2.0 and Powershell) are built in; for older OSes, not so much.

A colleague sent me a set of direct download links to the old set, so I’m going to publish them here.

MPSRPT_Alliance.exe	MPSRPT_Alliance_Readme.txt
MPSRPT_Cluster.exe	MPSRPT_Cluster_Readme.txt
MPSRPT_DirSvc.exe	MPSRPT_DirSvc_Readme.txt
MPSRPT_Network.exe	MPSRPT_Network_Readme.txt
MPSRPT_SETUPPerf.exe	MPSRPT_SetupPerf_Readme.txt
MPSRPT_SUS.exe	MPSRPT_SUS_Readme.txt

For whatever reason, the download pages to these editions were removed when the new version was published; personally, I’d have suggested that the new was added alongside the old – the old, for all their limitations, are well-understood and widely used.

But the files are still there, at least for the time being.

Update: Looks like the PFE edition is still available in a not-through-the-back-door way (thanks, PFE, you rock! Hey, *I* work for that organization! Yay!), and it’s the core old-school goodness you’ve come to know and love from MPS Reporting.

http://www.microsoft.com/downloads/details.aspx?familyid=00AD0EAC-720F-4441-9EF6-EA9F657B5C2F&displaylang=en

On the ISA Server Security Update

tristank — Wed, 15 Apr 2009 03:57:59 GMT

Rambling my way to a point

One of my most favourite “Favorites” (read: “he snarled”) in recent weeks has been the ISA Server Product Team’s Build Numbers post.

They helpfully list the version numbers of each ISA Server, um, version, along with a link to the most recent hotfix for that version. That’s so helpful.

But: In most cases, you had to use the self-service hotfix feature to get that hotfix. Which is better than calling someone, but still not quite one-click conweenyence.

And there was some useful stuff fixed in each – you can do the research (hint: research is typically along the lines of “isa server hotfix site:support.microsoft.com” in whatever search engine you use).

Back to the security update: if you look at the file list for the security updates, they look a lot like the file lists for the recent hotfixes.

(Aside from a little while ago: nice that we’re again using KB articles for file information and not just “you should read the bulletin” placeholders. Makes it easier to reliably find file version information in the one place. No idea who changed it in the first place, but my blunt message to you: that was suboptimal.)

I know you love short versions, Glenda

So, long story short, by applying the security update, you’re getting the most recent build of those binaries for your ISA Server.

Just one caveat: remember that with this patch, you’ll need to reapply it if you make any significant installation-level changes to ISA later (see the bulletin for that).

Antivirus software on ISA Server

tristank — Thu, 09 Apr 2009 02:44:00 GMT

There are two major classes of Anti Virus software (yes, I know I used one word above, it’s called SEO, okay?) that can be used on an ISA Server computer:

ISA-integrated antivirus scanning products
Regular desktop/server antivirus products

The first category is the cooler of the two, and typically involves a Web Filter and/or an Application Filter. It’s been designed to work with ISA Server, and will likely scan HTTP streams while ISA is processing them.

The second category is more common – a desktop or server antivirus product is installed on the ISA Server. That’s probably a good idea from a Defense In Depth perspective.

But if you’re using the second category (or it’s just part of your server build), did you know that there are a set of exclusions we recommend you should use?

The ISA Server product team did some great work in pulling together a set of recommendations for when Antivirus is used on ISA Server. Have a read, have a think, and then check whether yours is implemented correctly. If it isn’t, outages, poor performance and other issues might arise.

And (sorta getting into the ramble here) have you ever noticed that Support people tend to make uncomfortable noises about Antivirus products when you mention they’re installed (if not outright suggesting that you disable and/or uninstall them straight-off)? Well, that’s because when they’re not configured in a way that doesn’t interfere with the operation of other software, they really have, statistically, experientially, and commonly, been known to cause problems.

It’s almost a cliche to be asked to remove AV software while troubleshooting a problem – but the cliche came from somewhere to begin with. Configuring the AV as recommended is an excellent way of minimizing that risk.

SMB/CIFS support for File:// URLs in CRL Distribution Points: Nup

tristank — Tue, 24 Mar 2009 02:45:00 GMT

According to Brian Komar, CDP and AIA extensions won’t work any more with file://\\server\share URLs as of Windows Vista SP1 / Windows Server 2008.

Note: With the release of Windows Vista Service Pack 1, support for Common Internet File System (CIFS) or Server Message Blocks (SMBs) through a File URL was dropped for AIA and CDP retrieval.

From Windows Server 2008 PKI and Certificate Security, page 245.

Why post it here? Because I couldn’t find this information on the interwebs, only in a book. I spent 20+ minutes looking!

A book. In this day and age!?

Aha! Here's the KB article describing the change! http://support.microsoft.com/kb/946401

(if like me you got hung up on SMB or CIFS being a keyword for the change, well, there ya go. I guess that file:// just implies whatever you've got going on in your redirector, so while SMB/CIFS might be most common in Windows networks, it could have been NCP/NFS/Whatever here.)

Hope that saves you some searching, future-Tristan.

IAG – now available for Hyper-V

tristank — Thu, 29 Jan 2009 12:47:03 GMT

Of all the things I could be doing right now, blogging is the one that won. Feel special? Procrastination, but with a helpful bent.

IAG SP2 is now a VHD for Hyper-V

Your mission, Jim, is to make that into a song.

The most interesting “wow” moment I had today was reading that IAG (Intelligent Application Gateway - that’s that Whale SSL thingo) is now available without accompanying hardware.

Previously (as I understand it) IAG 2007 was only available on a hardware appliance of sorts.

Now, at least as far as the Technet Deity is concerned, IAG 2007 SP2 is licensable as a Hyper-V Virtual Machine, if you don’t want to go for the hardware.

The VHD includes IAG 2007 SP2 (I’m downloading the trial now, to get up to Mischief) and ISA Server 2006 (for the firewalling capabilities), running on Windows Server 2003.

I’m something of a noob to IAG, so, um, if you want to ask something, go hit them up instead.

But yay, can’t wait to try it out.

Vista-Stylez File Management in Windows 7 Beta

tristank — Sun, 18 Jan 2009 16:07:24 GMT

If you’re finding file management frustrating because the folder pane seems strangely inactive in the Windows 7 beta, it’s probably because it is. It’s perfect for light filing use, but not so good for folder-stuffing and navigational acrobatics. Which I seem to do.

I filed a bug using Send Feedback on that just now, complaining it was harder to organize files en masse with the new system, especially with an extensive folder hierarchy, cos I had to use two windows, and while I love the Snap Left and Snap Right feature to a point, blah, blah blah, whine. (Hey, does anyone know how to tile vertically?)

Of course, seconds after filing the bug, I experimentally right-clicked in the folder area of the Win7 Explorer interface, and there are precisely the options to restore Vista-like behaviour:

It’s also in Folder Options. (oops). The trick to finding it in the Explorer pane is to right-click a blank area, not one of the items.

My bad. Sorry, Win7 team. I take it all back, and I’ll pay for any damage*.

Home Hyper-V Networking Gotchas

tristank — Tue, 13 Jan 2009 15:12:56 GMT

Before the holidays, I bought myself an early present: a new quad-core box with 4GB RAM, which I was going to use for a home Hyper-V lab, so that I could run a bunch of 64-bit VMs as well as the 32-bit staples I’ve been using for years (SBS 2003, and a separate ISA Server box).

I’d had Windows Server 2008 installed on my Virtual Server host for a while, and use it with Routing and Remote Access (RRAS)’ NAT to provide a simple internet gateway for a segment of my internal network.

Lesson #1: Core Quad Q8200s don’t support VT (that’s Hyper-V, kids)

There was a 1300Mhz FSB Q8200 available for the same price as a Q6600, and I figured that I couldn’t go wrong with that. Surely, I thought, all Intel CPUs since the Core2 Duos support Hyper-V?

Well, no, said Intel, and thanks for your money (stupidty tax, I seem to pay a lot of it). The one Quad core chip that doesn’t support Hyper-V is the one I bought. Q8200 is being phased out (I read somewhere), so this mistake should be easily avoidable in the future. Or now, by how-you-say smarter people.

Lesson #2: When you Hyper-V-ify a Parent Partition, It’s Sort Of A Client Too (aka “You may need to set stuff like RRAS up again with the new virtualized network adapters”)

What I mean by this is that when I got the Right CPU and installed Hyper-V, I was without Internets.

To cut a long and boring troubleshooting story short: the physical network adapters I’d configured in RRAS were no longer the Right Network Adapters.

I set up new virtual networks for each physical adapter (one Internet, one Local), and then had to set up RRAS again, because it didn’t think there were any new interfaces to set up – it was quite happy only seeing the old ones, thank you very much.

After checking both virtual adapters were visible in the Network Connections interface, and that they had the right IPs assigned, I rechecked my Windows Firewall settings and ran a port probe to confirm only ports I knew I wanted open were open (RRAS Basic Firewall doesn’t exist any more in 2008, so be careful with dual-homing where the Internet is attached to one of your adapters).

The disconnect here was that I was assuming the parent partition would see the physical hardware – it does, it just doesn’t use it directly any more, it looks like it uses the virtualized setup instead, at least to some extent.

Lesson #3: Hyper-V and DHCP didn’t like each other when the physical host became the parent partition

My RRAS server had (to this point) been my DHCP server for the internal network. This was all fine, and seemed to be working okay (or had my lease durations just not expired yet?), except for the new virtual hosts I created today.

There’s some lore floating around on the forums that worked for me – the bit that worked was manually adding a REG_MULTI_SZ called IPAddress to the likeliest-looking adapter interface in the registry, because Hyper-V setup for whatever reason doesn’t do that.

The DHCP server wouldn’t bind to the physical adapters (or even show them in the Bindings interface), presumably because IPv4 and IPv6 was unbound from them (interesting, hey?) and also wouldn’t show me either of the virtual adapters, which I guess is due to the lack of a static IP address on either of them.

Now, though, my setup’s working nicely, everything more or less as it was before, only virtualized. And thus, you know, more sexy.

.HDMP and .MDMP files

tristank — Tue, 23 Sep 2008 11:12:27 GMT

Just a quickie – the rule is blog what you know, but I figure my speculation might be good enough here.

A friend gave me an HDMP file and asked what I could make of it. After the usual “I could make a hat! Or a brooch! Or a dinosaur!” type stuff, I realized it wouldn’t open anyway.

In my experience, most .HDMPs come with matching .MDMP files. I think of these as Minidumps (in the “real” mini sense – just information about threads and thread stacks), and Heap dumps (everything else the process knew or cared about in User mode).

This HDMP wasn’t openable in the debugger directly, but if its corresponding MDMP was present in the same folder at the same time, I reckon it woulda.

The feared WER-wolf produces these files in pairs (that’s Windows Error Reporting, kids, don’t be too scared, except that it invalidates everything we used to know about AEDebug registry keys and similar, but that’s another story for another time), and that’s how I’ve analyzed them in the past. I remember hearing of some sort of merge operation that needed to happen between M and H dumps, but I’m reasonably certain I haven’t bothered with that (I assume I’m lazy by default), so I think the debugger just does it for ya.

Now I’ve written that, I’m going to go look for references to support my assertions!

949180 How to create a user-mode process dump file in Windows Server 2008
http://support.microsoft.com/default.aspx?scid=kb;EN-US;949180

(At the bottom – mini and heap dumps - yay me!). Think that’s enough for today. Hugs!

That Memory Leak Revisited

tristank — Wed, 25 Jun 2008 08:59:22 GMT

While searching for memory leaking troubleshooting techniques that could be applied to 64-bit Windows (for the DHCP Server memory leak I found I had the other day), I stumbled across the answer to my problem in an internal tool (weird that I missed it from a web search the first time, but c'est la vie).

A Windows Server 2008-based DHCP server that is configured in a workgroup environment may consume too much memory

http://support.microsoft.com/default.aspx/kb/949530

And that's my problem! One REG command (and one restart of the DHCPServer service) later, I'm waiting to see how it went, but it all looks promising, based on that article. Neat-o.