Way too much debate out in Twitterville and through other folks that are just flat out wrong. Why wrong? Well in a test lab environment I have no problem with this but folks tend to get lazy and that is where you run risks in your production environment.

Now im not going lament on the whys as this was finely detailed by Spence Harbar and let me quote from his post

"What is the issue?
Windows Server 2003 SP1 introduced a loopback security check. This feature is obviously also present in Windows Server 2008. The feature prevents access to a web application using a fully qualified domain name (FQDN) if an attempt to access it takes place from a machine that hosts that application. The end result is a 401.1 Access Denied from the web server and a logon failure in the event log.

Unfortunately 401.1 is not really helpful as this error code means there is a problem with the user credentials. Of course, the HTTP spec doesn't know about security features in a vendor's implementation so there can't be a HTTP error code for such a feature. This can lead to much banging of the head on the desk. It's one of numerous causes of the 401.1 which are nothing to do with invalid credentials (e.g. attempting to use Kernel Mode Authentication with domain account in IIS7).

What this means is that when you browse a SharePoint Web Application which uses a fully qualified domain name from a WFE in the farm you will get a 401.1. This is very annoying on a development box, or when testing locally, or in other SharePoint specific scenario "

Ok so we have some background info the one thing my buddy doesn't do is show us how. Now the crux is that in http://support.microsoft.com/kb/896861 Microsoft details two such fixes for this. I am going to screenshot the right way to do this.

First off we need to add the following registry key to kick this off

In the screenshot above under HKEY_LM\system\CCS\Services\Lanmanserver\param we will create a dword DisableStrictNameChecking.  Add a value of 1 to this new entry,

Exit Registry and reboot your box

Reopen Registry and nav to HKEY_LM\System\CCS\Control\LSA\MSV1.0 and create the following key as shown below

Once there simply open this Multi-String Value and enter the sites you want included… ie your SharePoint sites J

No need for URLs here.. simply type in (for this example) connect.contoso.com on a separate line your next site and on and on down the line.

The beauty of this method is that once you add this key you wont have to reboot your box after adding these entries.

So hope this post along with Spences stops the silly questions and even more so… wrong answers folks are following

So as most of you know im a pretty big advocate on Virtualizing SharePoint and do a lot of talks on lab setups and such. Way back when Server Core came out I gave it a spin but found a lot of the toolsets to be lacking and frustrating. Windows Server 2008 R2 has made me jump back into this and in this post I will detail how I am now setting up my SharePoint 2010 Demo Labs.

For starters this article is not really going to talk about SharePoint 2010 but what I do want to talk about is the underlying architecture that makes SharePoint tick. One of these necessities is Active Directory. I am fully aware that you can install your test farms using local accounts. If that is how your building your labs out you can refer to Neil Hodgkinson's post on how to accomplish this. It is definitely an option to use but for my purposes I like to have AD available to be able to pull the areas that you can only get with an AD / SharePoint instance… one classic case would be UPS (User Profile Service) which in turn has tie ins to Social Computing aspects. Ok enough rubbish lets get on with it.

So the real beauty of running a Core Server with Active Directory is that you can do the following:

1.     Run your AD instance with very minimal memory ( 256MB… how's that for minimal)

2.     If you spin up multiple labs this DC is completely reusable. Once you set it up you can spin up as many labs as you want pointing back to that Directory Server.

Ok so some of you are thinking well hell Fox…. Its just as easy to spin up a normal box and run DCPROMO… why do I need this? Well you don't…. This is simply a personal preference of mine and one benefit I see is that you don't have that OS overhead you get with a full blown box. Oh… and might I add that it takes less than 5 min to build a box from start to finish? When I say build I am talking installing the CORE OS. The next steps take a little longer but hopefully some of the information I provide here will quicken the process.

Before we go further I mentioned earlier that the box will run pretty light with memory. What I recommend is to give it a bit of memory ( 800 – 1GB) while your doing the build out process. Once all is done you can throttle back the machine.

Steps to Install Active Directory

Im not going to detail how to build out Windows 2008 R2 Core as its pretty simple… point to your ISO file and start the box. When you have the option to choose your OS you will go with Core and off you go.

Once the box is complete and reboots you will be greeted by a cmd.exe shell. So some of you who are reliant on the GUI (I can be accused of this sometimes) you may find yourself scratching your head…. Hmm dir… hmmm cd…hmmm so on… yep those commands are all still there, but what was missing in Server 2008 Core is a command called "sconfig" Go ahead type that in.

So lets walk through this shell window a bit.

Option 1 Domain/Workgroup will obviously be something to avoid here for a bit as once you run DCPROMO it will automagically assign this role so leave this alone.

Option 2 You definitely want to make a change here. I tend to always go with DC1 for my builds but name it what you want. This will cause a reboot to make this change

Option 3 Add Local Administrator - So when you spin up the box the first time it will already log into the Administrator account. If you wish to add another account this is the section you will make that change.

Option 4 Configure Remote Management - This section needs some screenshot love and explanation

So entering 4 opens the configuration portion. You probably WILL want to enable options 1, 2 and 3… If you're a PowerShell junkie option 2 is a must J

Adding these options will allow for remote management from GUI bases boxes (which we will get into in a bit)

Im going to skip through some of these other options as there pretty self-explanatory but let's look at Network Settings Option 8

To get started you will need to select the Adaptor. Since I only have one assigned to this box I will choose 0

So on first entry here you will have your assigned addresses but we cant have that can we. Options 1 and 2 will allow you to assign proper static addresses.

Ok so there are the basics for configuration… Miss the GUI yet? Well if so there are other ways to manage this server directly from the console.

When hashing this set up over with Spence he turned me over to this site to grab another tool http://coreconfig.codeplex.com/ The owners of this tool did a pretty good job documenting and screen shooting this so I'm not going to spend time here. Have a look for yourself.

Creating your AD Instance

So most of you who have built out an AD server are familiar with running DCPromo.exe. Don't be fooled by typing this in and thinking its going to work… We need a bit more. You will need to provide an answer file to make this work. Below is the answer file I created and you can grab the txt and place it in a file called.. wait for it… wait…. Answerfile.txt

So if you were to create a new domain named Contoso and enjoy using the standard password that Microsoft loves to use all you have to do is copy this file exactly and use it. To implement this we will run the following command

Dcpromo.exe /unattend:c:\answerfile.txt (this is assuming you placed the answerfile at the root of C:… yeah I know im insulting someones intelligence but I do get some odd questions sometimes J )

Once you enter this the box will go through the process of creating an Active Directory instance for your lab.

DNS

This is a big one you don't want to overlook. So this is again something that can be run from the command line using dnscmd.exe.

You will want to define your SharePoint Web Applications that you want to set host headers for. In my example I am setting DNS A Records for the following Web Apps.. Connect and My

dnscmd dc1 /recordAdd contoso.com connect A 192.168.1.61

dnscmd dc1 /recordAdd contoso.com my A 192.168.1.61

So for the IP address this will be pointing to SharePoint.

Note: In my talks I generally mention the fact that you create labs for different scenarios and because memory is going to be an issue to consider you will normally only have one lab scenario running at a time. As long as the other labs are shut down and your using one at a time you can most certainly reuse IP addresses. This way you will not have to go back and modify DNS.

IMPORTANT NOTE/REMINDER: Im talking test labs here folks. Do not do this in Production if you wish to keep your job.. Boss to you… YOU DID WHAT????

Final Stuff

Going forward you will want to add users and service accounts to your domain. You can do this via command line on the server or find a script out on the web to accomplish this if you have a lot of users you want to toss in but you can also log into another server to do this. You will need to add the Domain Services Role to the server but the reason for this is so you can remotely admin the DC. It will fail if you just open it and click Active Directory Users and Computers so make sure you right click that section and select "Change Domain"

I think ya'll can take it from here.

Once done shut down the AD box and throttle back the memory.

In Conclusion

So where do we go from here. SQL Server on Core? Heck yeah… check out Dan Browns post on this.

Again this is just one part of creating a lab environment and it's the one im using consistently. SharePoint 2010 is a huge gobbler of Memory so I want to ensure I have enough on my local box to give to it. Throttling this back and running lean and mean definitely lets me keep my SharePoint box running at more than a snails pace J

Cheers