Windows Virtualization Team Blog : Windows Server 2008

Upcoming Webcasts on Best Practices for Virtualizing MS Server Applications

porourke — Tue, 27 Oct 2009 22:25:00 GMT

We’ve got some great webcasts coming up in the next few weeks to discuss recommendations for virtualizing MS server applications and the benefits of choosing hyper-V + System Center as your virtualization solution. Each technical webcast will focus on a specific server application- Exchange, SQL and SharePoint. Please see below for detailed information.

TechNet Webcast: Microsoft Virtualization Best Practices for SQL Server (Level 300). Thursday, Oct. 29, 2009 at 10am Pacific time

Virtualizing business critical applications will deliver significant customer benefits including cost savings, enhanced business continuity and an agile and efficient management solution. This session will focus on virtualizing SQL Server using Microsoft solutions, the benefits over key competitors such as VMware, and guidance for virtualizing SQL server for Production and Test/Dev scenarios focusing on consolidation, scale, load balancing, dynamic provisioning and high availability. We will go into technical details with best practices. Customer evidence and results from lab deployment tests will also be discussed.

TechNet Webcast: Microsoft Virtualization Best Practices for Exchange Server (Level 300) Wednesday, Nov. 4 at 10am Pacific time

Virtualizing business critical applications will deliver significant customer benefits including cost savings, enhanced business continuity and an agile and efficient management solution. This session will focus on virtualizing Exchange using Microsoft solutions, the benefits over key competitors such as VMware, and guidance for virtualizing Exchange for various Production scenarios. We will go into technical details with best practices. Customer evidence and results from lab deployment tests will also be discussed.

Announcing the availability of the updated Infrastructure Planning and Design Guides for Virtualization and System Center

vtango — Thu, 24 Sep 2009 17:03:00 GMT

Microsoft has a comprehensive portfolio of technologies when it comes to Virtualization ranging from Presentation Virtualization with Remote Desktop Services to Server Virtualization using Hyper-V with many more in between as below.

· Server Hardware Virtualization. Also known as a hypervisor, Server Hardware Virtualization runs a very lightweight core operating system. The hypervisor can host independent virtual machines (VMs). This form of virtualization requires hardware that has embedded virtualization awareness capabilities. Since the hypervisor is very lightweight, there is little overhead in the system, which allows for more scalability in the virtual machines.

· Server Software Virtualization. An operating system, such as Windows Server® 2003 or Windows Server 2008, runs an application that is able to host virtual machines. Each virtual machine runs a completely separate operating system and application set.

· Presentation Virtualization. Centralized systems host multiple user sessions, and all processing is done on those host systems. The user sessions are isolated from each other. Only the presentation information, such as keyboard and mouse inputs, and video updates are sent between the client and the host system. The client can be a full Windows-based workstation or a Windows-based terminal device.

· Application Virtualization. An application is isolated from the underlying operating system by means of wrapper software that encapsulates it. This allows multiple applications that may have conflicting dynamic link libraries (DLLs) or other incompatibilities to run on the same machine without affecting each other.

· Desktop Virtualization. This is similar to Server Software Virtualization, but it runs on client systems such as Windows Vista®. The client operating system runs a virtualization application that hosts virtual machines. This is often used when a specific person needs to run one or a limited number of legacy applications on a legacy operating system.

With the richness and breadth of these technologies, customers should evaluate their needs against the capabilities and solutions that each of the technologies is targeted at. The Solution Accelerators team has been working furiously to create guides for customers and we are really excited to announce the availability of the Infrastructure Planning and Design Guide for Virtualization updated for Windows Server 2008 R2, which can help customers start their planning and deployment process for Virtualization using the Microsoft portfolio. With detailed documentation and simple flowcharts customers now have a powerful tool in their hands as they plan their deployments. Once the decision to go with a particular technology has been made, detailed guides are available for each of the technologies as well giving business decision makers, infrastructure stakeholders, and the organization as a whole a comprehensive tool for designing their virtual deployments.

As Tom Bittman from Gartner had said “Virtualization without good management is more dangerous than not using virtualization in the first place”. Our System Center suite of products provide a full suite of management solutions for this environment and the Infrastructure and Planning Guides for System Center have been updated for System Center Virtual Machine Manager 2008 R2.

Vijay Tewari

Principal Program Manager, Windows Server Virtualization

The Virtualization platform vs. the Operating System

vtango — Tue, 01 Sep 2009 16:01:00 GMT

Day 1 at VMworld was mostly about Labs and content which builds up to the main event starting with the keynote on Tuesday morning. Looking forward to today.

In the meanwhile I have been hearing about a concept being put forth that the virtualization platform is it and the OS is but relegated to the consigns of history. That’s an interesting argument, one that in my opinion is built around the myth that somehow the interface exposed by the virtualization platform is what applications are written to. The fact of the matter is that the “Virtual Machine” as exposed by the virtualization platform mimics the underlying hardware with all its diversity. An entity is still required to manage the hardware resources and provide the software abstractions to interact with incredibly diverse hardware. That is the operating system and that’s what applications are developed for.

Back in time such as of the Manchester Mark 1 application programs were self-contained which were loaded into the memory of the machine and then executed from there. Overtime developers realized the value of re-use and rather than build in everything into the application program, re-use and common abstractions became prevalent. As the diversity of hardware and peripherals increased in complexity, the operating system is what provided the abstractions which provided a common mechanism for all applications to interact with and utilize the machine effectively. That is what gave rise to the operating system. What befuddles me is the argument that somehow the emergence of the virtualization platform minimizes the tasks as performed by the operating system. There are some who will argue that the emergence of application frameworks such as .net and Java take on this role, but in the end below them they still require the abstractions offered by an OSJ. What do people think?

An interesting debate but mostly put out to confuse our customers who are fundamentally interested in running an efficient IT infrastructure that provides them the flexibility and ability to meet the business goals and be a strategic asset to their organizations. Customers are running a multitude of applications such as SQL, Sharepoint, Exchange, CRM, home grown line of business applications etc. Our partners and us are committed and focused to make sure that it happens.

By the way talking of partners, it was great to our partner Leostream announce their connection broker for Windows Server 2008 R2 and System Center Virtual machine Manager 2008 R2. In talking to our partner here at VMworld, it’s been wonderful to see the incredible innovation on their part based on the Microsoft platform. Thanks, this is what the Microsoft platform the best for our customers with its breadth and partner solutions.

Vijay Tewari

Principal Program Manager, Windows Server Virtualization

Partner Resources: Windows Error Reporting & More

WSV_GUY — Tue, 18 Aug 2009 17:20:00 GMT

Virtualization Nation,

In my last blog, I discussed the importance of a Security Development Lifecycle and how we're making resources available to our customers and partners. Today, I want to discuss a more resources Microsoft provides our partners to develop and refine their products running on Windows and point out opportunities for integration with Hyper-V. There are a number of ways we work with partners to improve code quality and security starting with Windows Error Reporting.

Windows Error Reporting (WER)

Windows Error Reporting is a set of Windows technologies that capture software crash data and support end-user reporting of crash information. Through Windows Quality Online Services (Winqual), software and hardware vendors can access reports in order to analyze and respond to these problems. WER technologies are implemented in Windows XP, Vista, Windows 7, Windows Server 2003/2003 R2 and Windows Server 2008/2008 R2.

Vendors can use WER to view error reports at no charge. This service is available for all products, even those that do not qualify for the "Designed for Windows" logo-although we strongly recommend that you submit your products to the Windows Logo Program.

With data from Microsoft Windows Error Reporting (WER), you can identify the most common real-world customer problems and quickly provide a solution to your customers. While customer support calls provide information about common issues, they do not always provide enough detail to debug the actual code. Further, support records indicate only those problems which prompted calls. Because it is much easier for users to submit an error report than to contact customer support, WER can provide a more comprehensive picture of the problems your customers are having. And because WER collects data at the point of failure, you can get a more detailed picture of what is going wrong.

In the end, this is a win-win situation. PARTNERS WIN because they can diagnose and produce better code (and lower support costs) and CUSTOMERS WIN with higher quality solutions. If your company develops software and aren't using WER, you need to take advantage of this resource. Here's the link to the WER site:

http://www.microsoft.com/whdc/winlogo/maintain/StartWER.mspx

While WER can be a boon to developers by providing critical information to triage issues, we didn't stop there. We also released a new tool, called the !exploitable Crash Analyzer, on CodePlex March 20 at the CanSecWest conference in Vancouver, British Columbia. A Windows debugger extension, this heuristics-based tool is aimed at not only helping developers assess what is causing crashes, but also ranking the seriousness of a bug.

Introducing !exploitable Crash Analyzer: What does it do?

The program works by examining crash data-information gathered when an application stops performing its expected function-to identify the unique issues that caused the crash. From there, the program provides guidance on how exploitable the crash is, and can be used by third-party developers to then prioritize the problem.

"As a tool, it can save developers time and effort," said Roger Kay, president of tech industry analyst group Endpoint Technologies Associates. "A number of apparently different crashes can actually be caused by the same code. The analyzer isolates the offending block and essentially says, 'Here, all these different crashes are actually the same failure, and it's an important one that you ought to fix right away because it presents an open attack surface.'"

If you're interested in this tool, go to the Microsoft Security Engineering Center where you can download the tool from CodePlex (CodePlex is Microsoft's open source project hosting web site) and find how this can help in your development.

The link is here: http://www.microsoft.com/security/msec/default.mspx

Cheers,

Jeff Woolsey

Principal Group Program Manager

Windows Server, Hyper-V

Hypervisor Footprint Debate Part 3: Windows Server 2008 Hyper-V & VMware ESXi 3.5

WSV_GUY — Mon, 17 Aug 2009 16:01:00 GMT

In my last two blog posts (Part 1 & Part 2), I started an in depth analysis tackling VMware's claims head on that because their disk footprint is smaller and ESX/ESXi are single purpose hypervisors, they are therefore more secure. If that's the case, then it stands to reason that ESX/ESXi:

should have fewer patches (they have less code to patch)
patches should be smaller in disk footprint (they have a smaller codebase and you want to keep code churn to a minimum; otherwise one could ship a 1k stub file and claim to be smaller)
should offer higher availability, reliability and uptime

Using VMware's own metrics:

In part 3, lets take a look at VMware's favorite comparison Windows Server 2008 Hyper-V to ESXi 3.5. Let's have a look.

Stacking The Deck In VMware's Favor

In this last comparison, I will freely admit that this isn't an apples to apples comparison. In this comparison, I gave ESXi 3.5 a 6 month advantage. Here's what I mean. Specifically, I compare:

VMware ESXi 3.5 from June 30th 2008 to June 30th 2009 (a 12 month period)
Windows Server 2008 Hyper-V January 1 2008 to June 30th 2009 (an 18 month period)

Using an 18 month sample set for Windows Server 2008 covers the majority of its time in market and goes to the heart VMware's fundamental claim that because their disk footprint is smaller and ESX/ESXi are single purpose hypervisors, they are therefore more secure. This tilts the scale in VMware's favor.

Windows Server 2008 Hyper-V to VMware ESXi 3.5

Disk Footprint & Patch Count. Here's what we found:

Windows Server 2008 Full Installation: 32 patches totaling 408 MB of patches
Windows Server 2008 Core Installation: 26 patches totaling 82 MB of patches or (~20% fewer than a Windows Server 2008 full installation)
VMware ESXi 3.5: 13 patches, totaling over 2.7 GB.

Yes, I said over 2.7 GB. To put it another way,

VMware ESXi 3.5 had a 6.6x greater patch footprint than Windows Server 2008 (Full)
VMware ESXi 3.5 had a 33x greater patch footprint than Windows Server 2008 (Core)

So much for the disk footprint argument. Again, how can the ESXi footprint be so huge?

Because VMware releases a whole new ESXi image every time they release a patch. Furthermore, because VMware releases a whole new ESXi image every time they release a patch it also means that every ESXi 3.5 server requires a reboot. At this point, a VMware salesman may actually concede that every ESXi server has to be rebooted for every patch, but they will then state that they have VMotion (Live Migration) so it doesn't affect their uptime.

Except when their own patches cause days of downtime and render VMotion impotent.

Reliability/Availability. With VMware ESXi 3.5 Update 2, it included a serious flaw which resulted in two days of downtime for their customers including the loss of VMotion:

"Starting this morning, we could not power on nor VMotion any of our virtual machines," said someone identified as "mattjk" on a VMware support forum. "The VI Client threw the error 'A general system error occurred: Internal Error.'"

It was so bad, VMware's CEO had to apologize on numerous occasions. (HERE, HERE, HERE, HERE, HERE, & HERE). VMware then rushed out the VMware ESXi 3.5 Update 3 which introduced instability to VMware High Availability and could cause virtual machines to spontaneously reboot. (HERE & HERE)

Virtual machines that spontaneously reboot due to bugs in VMware high availability.

Now consider the fact that there were two significant quality and reliability issues with two major updates in a row (ESX/ESXi Update 2 & Update 3). While the initial Windows Server 2008 Hyper-V release didn't provide Live Migration (Windows Server 2008 Hyper-V R1 had Quick Migration and Windows Server 2008 Hyper-V R2 includes Live Migration for free), it didn't include two days of potential downtime and virtual machines unexpectedly rebooting either. For those that track availability in terms of nines (five nines is 5.26 minutes of downtime a year) VMware Update 3.5 Update 2 dropped customers to "two nines" of availability.

Using VMware's own metrics, Windows Server 2008 Hyper-V is clearly the winner over ESXi 3.5.

The Facts Contradict VMware's Claims

As stated at the beginning of this series, VMware's overarching point is because their disk footprint is smaller and ESX/ESXi is a single purpose hypervisor, they are therefore more secure. While VMware heavily touts this claim (it's in numerous location on their website for starters), the facts from this analysis directly contradict their claims. Specifically:

The platform with the largest number of patches was VMware ESX 3.5 with 85 Security & Critical Patches averaging over a patch per week.
The platform with the largest patch footprint was VMware ESX 3.5 totaling over 3 GB worth of patches followed by VMware ESXi 3.5 with over 2.7 GB. That's right, VMware's single purpose virtualization platforms that claims to have the smallest footprint had the two largest patch footprints by about a mile. (Graph below)
Both VMware ESX & ESXi had a recent case of the most severe virtualization flaw with guest code able to break out of the virtual machine and could potentially:
- Provides administrator access, Allows complete confidentiality, integrity, and availability violation; Allows unauthorized disclosure of information; Allows disruption of service.
VMotion/Live Migration is not a panacea to patching. It can help, but in the case of VMware's own self-inflicted faulty patch, it rendered their advantage impotent.
VMware had not just one, but two significant updates with serious quality and reliability issues with both ESX and ESXi. Specifically, ESX/ESXi Update 2 Issues: HERE, HERE, HERE, HERE, HERE, & HERE & ESX/ESXi Update 3 Issues: HERE & HERE.

The Point Of This Series

Say it with me:

> Security is more than just disk footprint. <

Quoting disk footprint size alone is a nice pithy, superficial phrase, but it's also a boat load of bollocks. The next time some VMware representative throws out that argument, point them to this blog and tell them Jeff sent you. If you've ever spent anytime with a security expert, one of the first things they will tell you is that security is not a one time exercise. Security is an ongoing process that should be embedded throughout the entire development lifecycle. It's that belief that drove us to develop the Microsoft Secure Development Lifecycle (SDL) and is publicly available.

Microsoft Secure Development Lifecycle (SDL)

The concepts that make up the Microsoft SDL were formed with the Trustworthy Computing (TwC) directive of January 2002. At that time, many software development groups at Microsoft instigated "security pushes" to find ways to improve the security of existing code.

Becoming a mandatory policy in 2004, the SDL represents a major cultural evolution at Microsoft with regards to software security and privacy and has matured into a well defined methodology. A "security process by a software company," the SDL was designed as an integral part of the development process. The development, implementation and constant improvement of the SDL represents a strategic investment for Microsoft, and an evolution in the way that software is designed, developed, and tested.

From a high level, the Microsoft SDL looks like this:

The Microsoft Security Development Lifecycle

Benefits of the Microsoft SDL:

Reducing the number of software vulnerabilities
The SDL has played a critical role in embedding security and privacy into Microsoft software and culture, leading to measurable and widely recognized security improvements in flagship products such as Windows and SQL Server and the proof is real. How about:
- Windows XP to Vista a 45% decrease
- SQL Server 2000 to 2005 91% decrease

Windows Server 2008 Full vs Server Core
- Reduction in patches by ~50%

Reducing the total cost of development
The SDL reduces the "total cost of development" by finding and eliminating vulnerabilities early. According to the National Institute of Standards and Technology (NIST), eliminating vulnerabilities in the design stage can cost 30 times less than fixing them post release.

Read that last sentence again.

Thirty times.

I also want to point out that the Microsoft Security Development Lifecycle doesn't end once the bits are released. It also means having a well-established response mechanism including:

responding to potential security threats
root cause analysis to understand why the issue occurred and ensure that issue isn't repeated
issuing security patches

The importance of a security development lifecycle cannot be understated. No matter how well you execute, there is no such thing as perfect code. Whether it's Microsoft, VMware, <insert software vendor here>, having a rigorous security development practices in place is imperative. And, in case you think I'm satisfied with our patch numbers above, you'd be wrong. I don't ever want to get complacent and think for a moment that "security is done." Security is never done.

Let he who has written perfect code throw the first stone.

Let's Have A Look At The VMware's Security Development Lifecycle

So, where's the VMware Security Development Lifecycle?

You're guess is as good as mine.

I went to VMware's site and searched for their security development lifecycle. I found their Security Center which lists their patches, but that's just one small aspect to a security development lifecycle. I Bing searched "VMware security development lifecycle" and was returned a sales pitch from VMware to buy something at $1500 per processor.

No, I'm not kidding.

Making The SDL Available To Our Partners

After a significant investment in time, money, manpower we've developed and want to give back to our partners. A great place to start is the Microsoft SDL Homepage. Here you will find whitepapers, best practices, threat modeling tools, process guidance and much more. In addition, we recently released the Microsoft SDL Process Template for Visual Studio Team Systems. This template helps ease the adoption of the SDL, demonstrates security return on investment and provides auditable security requirements and status.

I'd be remiss if I didn't point out an excellent book aptly titled, Writing Secure Code Vol. 2 and point to the blog of one of the authors, Michael Howard. More links below.

Microsoft SDL Homepage: http://msdn.microsoft.com/en-us/security/cc448177.aspx

Microsoft SDL Process Template for Visual Studio Team System: http://msdn.microsoft.com/en-us/security/dd670265.aspx

Writing Secure Code Volume 2: http://www.amazon.com/Writing-Secure-Second-Michael-Howard/dp/0735617228

Michael Howard's Blog: http://blogs.msdn.com/michael_howard/

In my next blog, we'll discuss more free tools and programs available our partners.

Cheers,

Jeff Woolsey

Principal Group Program Manager

Windows Server, Hyper-V

Hypervisor Footprint Debate Part 1 UPDATE: Microsoft Hyper-V Server 2008 & VMware ESXi 3.5

WSV_GUY — Fri, 14 Aug 2009 00:56:00 GMT

Virtualization Nation,

In my last blog post, I started an in depth analysis tackling VMware’s claims head on that because their disk footprint is smaller and ESX/ESXi are single purpose hypervisors, they are therefore more secure. I read some posts on the blogosphere that had questions about the methodology. Let’s dive in.

Didn’t Compare The Number Of Reboots

You’re right I didn’t. I didn’t think comparing the number of reboots was needed after:

establishing that VMware’s own patches caused customers two days of downtime without the use of VMotion to mitigate that downtime
referring to VMware’s own updates that caused VMs to spontaneously reboot due to bugs in VMware HA
pointing out that every ESXi patch requires a reboot

Even if every Microsoft Hyper-V Server 2008 patch came out on a different day (that wasn’t the case most of the patches came out in groups) and required a reboot at the time, there’s no way on earth that the cumulative time would be in the ball park of two days per server.

Service Pack 2

You’re right I didn’t include Service Pack 2. Service Pack 2 is an optional download. You can test this out very easily. Go to any server running Microsoft Hyper-V Server 2008 or Windows Server 2008 and run Windows Update.

Here’s what I included:

Both Microsoft and VMware also have optional patches, but I didn't include this type because they are optional, so we could focus on the most acute patches. Finally, let me very clear about the Microsoft patches. These counts include ALL critical and recommended patches, meaning if there was a critical patch for IE or some other Windows component I counted it. Had I ignored these types of patches, that wouldn’t be a fair comparison.

However, for the sake of comparison and transparency, I added Service Pack 2 to the count and here’s what we found:

Microsoft Hyper-V Server 2008: 27 patches, totaling 845 MB.
VMware ESXi 3.5: 13 patches, totaling over 2.7 GB.

To put it another way,

VMware ESXi 3.5 still had a 4.3x greater patch footprint

Microsoft Hyper-V Server 2008 RTM’d Later Than Windows Server 2008

That’s a great point and my mistake. I apologize for that error and have corrected it. (BTW: It doesn’t take me a month to apologize and make corrections, but I digress..)

Let me tell you how this happened.

In doing the patch comparison, I started with VMware’s favorite example, VMware ESXi 3.5 and Windows Server 2008 which RTM’d in Q4 2007. I wanted to take a reasonable, historical sample size of both platforms. Going back 18 months ensures the sample set covers the majority of Windows Server 2008 time in market and tackles VMware’s fundamental claim that because their disk footprint is smaller and ESX/ESXi are single purpose hypervisors, they are therefore more secure. If anything this should work in VMware’s favor.

As I pored through data I realized I wanted to do the full matrix and include:

VMware ESXi
VMware ESX
Windows Server 2008 (Full)
Windows Server 2008 (Core)
and finally Microsoft Hyper-V Server 2008

This way, customers get the most comprehensive data and can make an informed decision. As you can see, MS Hyper-V Server 2008 was at the end of the analysis and this mistake crept because it slipped my mind that MS Hyper-V Server 2008 shipped after Windows Server 2008. (For example, MS Hyper-V Server 2008 R2 and Windows Server 2008 R2 are sim shipping this time around…)

The Notion Of Truth

This is an ideal time to make an important and fundamental point about competitive comparisons. The reason we’re able to perform this analysis and debate this topic openly is because the facts are freely available in the public domain without restriction. I’m happy to discuss the methodology used and make corrections as needed, but the point is we can have these discussions.

This point may sound obvious, reasonable and rational, but it’s not what VMware believes when it comes to competitive benchmarking. VMware has decided that they want to tightly control the concept of truth and only want the public to hear the VMware version of the truth. This is an unfortunate situation for customers who value open debate and basic fairness.

That’s another blog for another time.

Cheers, -Jeff

Hypervisor Footprint Debate Part 1: Microsoft Hyper-V Server 2008 & VMware ESXi 3.5

WSV_GUY — Wed, 12 Aug 2009 18:13:00 GMT

Virtualization Nation,

After my recent blog discussing the release of Microsoft Hyper-V Server 2008 R2, we received overwhelmingly positive feedback. At the same time, there's still some skepticism about free Live Migration and almost daily we keep hearing, "This is too good to be true, is Live Migration really free? Is High Availability also free? What's the catch?" Yes, both Live Migration and HA are free. Check out this earlier blog for details.

At the same time, we've also received questions about Windows Server 2008 Hyper-V, Microsoft Hyper-V Server 2008 and VMware ESX/ESXi in terms of disk footprint. The disk footprint argument is a favorite bit of FUD by VMware which appears to making the rounds again in the blogosphere. In the past couple of weeks, I've seen a few articles reprinting this pabulum almost verbatim. So today, I thought we'd analyze the whole disk footprint argument and, as usual, let's analyze the facts.

The Thin Hypervisor Debate In A Nutshell

Rather than attempt to restate VMware's argument, let's just use their exact verbiage. From VMware's website:

It's interesting to point out that VMware uses ESX & ESXi 3.5 in the column title, but then only uses ESXi for comparison in the right hand column and then rushes to compares ESXi to Windows Server 2008 Hyper-V.

Gosh, I wonder why ESX 3.5 isn't included? We'll cover that too.

Pay special attention to the last paragraph:

"VMware ESXi is a fully functional hypervisor in a 32 MB disk footprint, which reduces the risk of down time and increases reliability."

There are three metrics to VMware's argument:

Disk footprint. Disk footprint. Disk footprint. They're quite fixated on that.
Reduce the risk of downtime due to fewer patches (i.e. fewer patches is good)
Increase reliability (and, in turn, availability)

VMware's overarching point is because their disk footprint is smaller and ESX/ESXi is a single purpose hypervisor, they are therefore more secure. If that's the case, then it stands to reason that ESX/ESXi:

should have fewer patches (they have less code to patch)
patches should be smaller in disk footprint (they have a smaller codebase and you want to keep code churn to a minimum; otherwise one could ship a 1k stub file and claim to be smaller)
should offer higher availability, reliability and uptime

We're going to put that to the test.

Before We Get Started

Before we delve into the analysis, I'd like to point out that VMware touts ESXi as a 32 MB hypervisor, yet the download is over 200 MB. So, are we too assume that the other 170+ MB doesn't count? I point this out because both Windows Server 2008 Hyper-V and Microsoft Hyper-V Server 2008 do have larger disk footprints, but also provide incredible value and capabilities that our customers desire such as driver compatibility with a vast catalog of hardware, widely used management interfaces, scripting capability (PowerShell anyone?), MPIO, High Availability, etc.

If you really want to focus on the disk footprint that matters, the amount of software that could be directly exposed to VM attack, the Hyper-V hypervisor and virtualization stack combined is about 20 MB, ~19.4 MB for the virtualization stack and ~600k for the hypervisor.

In short, VMware has focused on our entire footprint which is made up mostly of stuff that isn't exposed to VM traffic at all or only exposed indirectly, while ignoring the part that matters most and for which VMware doesn't have a strong track record.

Time For Some Analysis

With VMware's own metrics in mind, I decided we should perform an apples to apples comparison. Specifically, over a 12 month period from June 30th 2008 to June 30th 2009, comparing: Microsoft Hyper-V Server 2008 (R1) and VMware ESXi 3.5 in terms of numbers of patches, size of patches and availability. I specifically chose these versions because I wanted to take a reasonable, historical sample size (12 months) of both platforms. Both Hyper-V R2 and VSphere have RTM'd within the last 90 days and that wouldn't be statistically relevant.

What did we compare? Wanting to keep the comparisons as close as possible, here's what we analyzed:

VMware: Security and Critical Patches
Microsoft: Critical and Important Patches

Both Microsoft and VMware also have optional patches, but I didn't include this type because they are optional, so we could focus on the most acute patches.. Finally, let me very clear about the Microsoft patches. These counts include ALL critical and recommended patches, meaning if there was a critical patch for IE or some other Windows component I counted it. Had I ignored these types of patches, that wouldn’t be a fair comparison.

Comparison #1: Microsoft Hyper-V Server 2008 & VMware ESXi 3.5

Disk Footprint & Patch Count. Here's what we found:

Microsoft Hyper-V Server 2008: 26 patches, totaling 82 MB.
VMware ESXi 3.5: 13 patches, totaling over 2.7 GB.

Yes, I said over 2.7 GB. To put it another way,

VMware ESXi 3.5 had a 33x greater patch footprint

So much for the disk footprint argument. How can the ESXi patch footprint be so huge?

Because VMware releases a whole new ESXi image every time they release a patch. Furthermore, because VMware releases a whole new ESXi image every time they release a patch it also means that every ESXi patch requires a reboot. At this point, a VMware salesman, may concede the point that every ESXi server has to be rebooted for every patch, but they will then state that they have VMotion (Live Migration), so it doesn't affect their uptime.

Except when their own patches cause days of downtime and render VMotion impotent.

Reliability/Availability. With VMware ESXi 3.5 Update 2, it included a serious flaw which resulted in two days of downtime for their customers including the loss of VMotion:

"Starting this morning, we could not power on nor VMotion any of our virtual machines," said someone identified as "mattjk" on a VMware support forum. "The VI Client threw the error 'A general system error occurred: Internal Error.'"

Virtual machines that unexpectedly reboot due to bugs in VMware high availability. Think about that for a minute.

The News Gets Worse

Not only did VMware ESXi have a 31x greater patch footprint, but they also had the most serious virtualization security flaws. Specifically,

Guest code able to break out of VM and into the ESX Hypervisor

For those you who may not know, code running in a guest operating system that is able to break out of a VM and into a hypervisor is THE WORST type of security flaw you can have for a virtualization platform. Period. VMware has had exploits on both their "thin hypervisor (ESXi)" and on their "thick hypervisor (ESX)" as recently as a few months ago.

For example, April 2009 CVE-2009-1244: A critical vulnerability in the virtual machine display function allows a guest operating system users to execute arbitrary code on the host OS.

Impact: Provides administrator access, Allows complete confidentiality, integrity, and availability violation; Allows unauthorized disclosure of information; Allows disruption of service.

Something to consider when VMware wants to host your data in "their cloud."

Now consider the fact that there were two significant quality and reliability issues with two major updates in a row (ESX/ESXi Update 2 & Update 3). While the initial Microsoft Hyper-V Server 2008 release didn't offer Live Migration (MS Hyper-V Server 2008 R2 now includes Live Migration/HA for free), it didn't include two days of potential downtime and virtual machines unexpectedly rebooting either. For those that track availability in terms of nines (five nines is 5.26 minutes of downtime a year) VMware Update ESXi 3.5 Update 2 dropped customers to "two nines" of availability.

Using VMware's own metrics, Microsoft Hyper-V Server 2008 is clearly the winner over ESXi 3.5.

One more interesting observation

After VMware released Update 2, which affected both ESXi & ESX, they rushed to get a fix out the door and did so in a few days. One interesting thing I noticed was that in the span of a few days, the patch grew 17 MB.

17 MB in a few days????

Now, I'm not sure what's in that 17 MB (potentially more than 50% of their hypervisor footprint could have been churned using VMware's 32 MB hypervisor claim, but I digress.), but if I had just released a patch that resulted in multiple days of downtime for my customers let me tell you what I would have done:

Created a highly scoped, well tested, surgical fix with minimal code churn.

To see a 17 MB change in just a few days would be cause for concern and an immediate code review.

Maybe that's just me.

In my next blog, we'll compare Windows Server 2008 Hyper-V and VMware ESX 3.5.

Cheers,

Jeff Woolsey

Principal Group Program Manager

Windows Server, Hyper-V

Windows Server 2008 R2 & Hyper-V Server 2008 R2 RTM!!!!

WSV_GUY — Wed, 22 Jul 2009 23:40:00 GMT

Virtualization Nation,

Today is a really big day at Microsoft and more importantly for our customers. Both Windows Server 2008 R2 and Microsoft Hyper-V Server 2008 R2 (our FREE standalone Hyper-V Server) have both been Released To Manufacturing (RTM)!! If you haven't seen the announcement on the main Windows Server blog, be sure to check it out. In this blog, I'm going to focus on the Windows Server 2008 R2 Hyper-V release, I will follow-up with a blog on the standalone Microsoft Hyper-V Server 2008 R2 soon.

These R2 releases continue to highlight one of our core goals for Hyper-V. Simply:

We believe everyone should have access to high performance hypervisor based virtualization. Period.

Virtualization shouldn't only be available to the largest enterprises with the largest budgets and we're delivering on that goal. We're pleased and humbled to announce that in the first 12 months of Hyper-V R1 availability with Windows Server 2008, there have been over 1+ million downloads of Hyper-V R1 Gold (RTM) software, making Hyper-V the fastest growing bare metal hypervisor in x86 history.

To our customers: Our deepest and sincerest thanks. We appreciate your support and are pleased to present Hyper-V R2 based on your input.

Hyper-V R2: Customer Focus

After the initial Hyper-V R1 release, we went back to our valued customers and asked them quite simply, "We have a very long list of potential features, help us prioritize. What are the features you want most?" Here's what our customers told us.

"Keep Reducing Costs"

Server consolidation continues to be the driving force behind virtualization and the fundamental reason is to reduce costs. In this economy, customers need to maximize their investments. Green IT has been important the past few years, but we've seen an even greater focus in the last year. In addition, it doesn't matter how small or how large your business is, everyone pays a power bill, it's a constant cost, so anything we can do to reduce power use has an impact on everyone's bottom line.

With Hyper-V R1, we already help customers reduce their cost for power, here are a few examples:

"With virtualization, we will save about 50 percent of our annual energy budget for cooling and electricity." -Lukoil CEEB

"The work that Microsoft has done in these areas-particularly the ability to shift workloads across CPUs-is doing wonders for reducing our energy consumption." Secure Endpoints

"89% Energy Savings with Microsoft Virtualization" -Kroll Factual Data

With Hyper-V R2, we continue to drive down power usage when servers are idle (usually nights and weekends) AND now we drive down server power usage even under load throughout the day through new enhancements like Core Parking, Timer Coalescing and more.

Bottom Line: Windows Server 2008 R2 continues to drive down power usage and lower power costs.

"Protect Our Investments"

Today, the majority of servers ship with up to 16 logical processors. However, our customers watch the industry closely and point out that AMD and Intel are continuing to increase core counts quickly. In addition, Intel has reintroduced Symmetric Multi-Threading (SMT) with their Nehalem processors which doubles the thread count. As our customers plan their capital investments over the next 12-24 months, they want to make sure to invest in a virtualization platform today that will take advantage of the latest hardware capabilities tomorrow. Hyper-V R2 is that platform.

CPU. From a compute standpoint, Hyper-V R2 scales to run on systems with up 64 logical processors (up to 384 running virtual machines) and takes advantage of the latest processor enhancements such as AMD's Rapid Virtualization Indexing (RVI) and Intel's Extended Page Tables (EPT). This provides performance improvements across the board when these processor capabilities are present. It also means that when folks decide to move up to larger servers with more counts Hyper-V R2 is ready out of the box. No core tax here. (BTW: Let me point out that Hyper-V R2 works with RVI and EPT, but does not require it. If you have older hardware without those capabilities, Hyper-V R2 will run just fine on those too.)

Networking. From a networking standpoint, Hyper-V includes significant networking improvements. For 1 Gb/E networks, Hyper-V R2 now includes Jumbo Frame Support. For 10 Gb/E networks, Hyper-V R2 adds support for Chimney support and Virtual Machine Queue (VMQ). These two technologies allows Hyper-V R2 to take advantage of network offload technologies so instead of a core on the CPU processing network packets, these packets can be shunted to the offload engine on the 10 Gb NIC which helps free up processor usage and improves performance. Support for these technologies ensures the most efficient use of your server resources. For our customers who haven't made the investment in 10 Gb/E quite yet, no worries. Hyper-V R2 is ready when you are.

Storage. In Hyper-V R1, we focused most of our performance efforts for storage on fixed virtual hard disks (VHDs). We did this primarily because fixed disks pre-allocate their storage upfront when you create the disk and help prevent a situation where you could run out of storage at a later time. Because we focused our performance efforts on fixed virtual hard disks, Hyper-V R1 performance for VMs with fixed VHDs was stellar and we recommended using fixed virtual hard disks in production environments. In fact, Hyper-V R1 can achieve as high as ~94% throughput of native.

Because we focused on fixed VHDs in R1 and knew that would be our recommendation for production environments, we didn't spend as much time focusing on dynamically expanding virtual hard disks in R1. While customers understand our recommendation for using fixed virtual hard disks, many of them told us that they'd like to use dynamically expanding virtual hard disks because they are more efficient in terms of storage, only growing as needed.

You got it.

In Hyper-V R2, we spent time analyzing and optimizing the code path for dynamically expanding VHDs and found areas where we could significantly improve performance. In some cases we achieved a 15x improvement for dynamically expanding virtual hard disks. No, that's not a typo. With dynamically expanding VHDs we can achieve up to about ~87% performance of native throughput. While we were at it, we took another look at the fixed VHD code path and improved it further so that fixed VHD performance is now on par with native performance.

In the end, we still recommend fixed disks for production use with Hyper-V R2 because it pre-allocates disk usage upfront, but if you want to use dynamically expanding virtual hard disks and are willing to take a small performance hit, Hyper-V R2 is a must.

"Help Me Find The Right Hyper-V Hardware." Customers told us that they wanted to make sure that they were investing in "the right hardware" to use with Hyper-V. We made that easy with Hyper-V R1, but it's worth pointing out again. There's no special certification for Hyper-V. Just make sure that the hardware you're investing in (servers, storage, etc) have the Windows Server 2008 Logo and now, the new Windows Server 2008 R2 Logo and you're set. You can find certified hardware online at the Windows Server Catalog and the logos look like this:

"Help Us Obtain Broader Support For Our Applications in Virtual Machines"

One customer pain point we hear in the virtualization world is that "ISV X" doesn't support their application in a virtual machine. This impedes adoption and frustrates customers who see the tremendous benefits virtualization provides. We've heard this repeatedly from our valued customers who are trying to convince our ISV partners that virtualization adoption is only rising. As a company, we've been consistently messaging how important virtualization is to our customers and demonstrating that through our significant investments in all areas of virtualization whether it's Hyper-V, App-V, MED-V, Virtualized Desktops, Remote Desktop Services etc.

In response to rapid customer adoption of Hyper-V and the customer requirement that virtualization be treated as the standard way to deploy workloads, not the exception, the Windows Server 2008 R2 Logo program now reflects that customer requirement.

Specifically, for applications to receive the Windows Server 2008 R2 Logo, all applications must be tested and pass the Logo tests when running within virtual machine running on Microsoft Hyper-V.

(Note: If an application cannot be tested in this configuration ISVs must work with a Microsoft approved testing vendor to learn about alternate test paths. For example, an application needs access to a specific hardware device not present in a virtual machine.)

"Continue to Improve Interoperability"

Today, we currently distribute Linux Integration Components (ICs) for SUSE Linux Enterprise Server (SLES) 10 SP2 x86 & x64 which improves performance when run within a Hyper-V VM. While our customers appreciate SLES support, they have also requested support for Red Hat as a guest OS. So, with the Windows Server 2008 R2 release of the ICs, we're adding support for both SLES 11 and Red Hat Enterprise Linux (RHEL) 5.2 and 5.3 for both x86 and x64.

While SLES and RHEL are the two most requested Linux distros supported within Hyper-V by far, we get requests now and then for other community supported distributions.

We wanted to do more.

Thus, the big Monday announcement. In case you missed it, on Monday, we released 20,000 lines of device driver code to the Linux community under GPLv2. The code, which includes three Linux device drivers, has been submitted to the Linux kernel community for inclusion in the Linux tree. The drivers will be available to the Linux community and customers alike, and will enhance the performance of the Linux operating system when virtualized on Hyper-V R1/Hyper-V R2.

I've read numerous articles and blogs on the Linux IC GPL announcement (most using phrases like "pigs with wings" or "hell experiencing snow flurries") and while there has been some interesting conjecture out there, let me be clear: Microsoft is committed to interoperability and providing our customers the solutions that meet their needs. Releasing these device drivers for Linux is another example of that commitment.

"Increase Flexibility"

Live Migration. Customers appreciate the flexibility that virtualization provides (deploy virtualized workloads in a fraction of the time versus physical) and wanted us to continue to improve in this area. To that end, the number #1 customer requested feature was Live Migration.

Done. Included. Live Migration Built-In.

We weren't done there. One thing that customers would always follow-up with is, "Do the processors have to be exactly the same? Can you ease that restriction a little?"

You got it.

Processor Compatibility Mode. With Hyper-V R2's new processor compatibility mode, we're able to easily LIVE MIGRATE between four different generations of Intel hardware. From an Intel Pentium 4 VT circa 2005 to an Intel Core i7 circa 2009.

Just by checking a checkbox:

That's flexibility. You can also move virtual machines between different generations of AMD processors as well. Just so we're clear: Processor Compatibility still means AMD<->AMD and Intel<->Intel. It does not mean you can Live Migrate between different processor vendors AMD<->Intel or vice versa. For more info about processor compatibility mode, check out my earlier blog post here.

Dynamic Storage. Another request to increase flexibility from our customers was to be able to hot add/remove virtual storage. Think about it, you're running a virtualized SQL server or file server and you need additional storage, but don't want to bring down the VM. No problem, with Hyper-V R2 you can hot add/remove storage while the VM is running without downtime.

"Virtualized Desktops"

One area of interest that's been percolating the last few years is the concept of Virtualized Desktops. At a high level, virtualized desktops is the concept of using a virtualization server to serve virtual machines running client operating systems like Windows XP or Vista. There are a few reasons customers are interested in this model such as to centralize management operations or to securely manage IP for remote developers. This model is very much like using Remote Desktop Services (formerly Terminal Services), except instead of Remote Desktop sessions, users are provisioned virtual machines.

From a Hyper-V standpoint, we've supported Windows XP and Vista as Hyper-V guests since the R1 release and with Hyper-V R2 we've added support for Windows 7 (x86 & x64 with up to 4 virtual processors per VM). However, Hyper-V support for client operating systems is only one piece of the puzzle. To improve this experience for our customers, the Remote Desktop Services team made significant enhancements in Windows Server 2008 R2 such as.

Connection Broker. Windows Server 2008 R2 includes a Connection Broker so that when a user logs in they can be brokered to their appropriate Virtual Machine OR Remote Desktop session on the back end. Yes, that's right. The Windows Server 2008 R2 broker actually brokers both Virtual Machines and Remote Desktops! This provides customers the flexibility to choose the solution based on their business requirements as opposed to being shoehorned into one technology.

RDP Protocol Enhancements. Windows Server 2008 R2 includes major enhancements for the Remote Desktop Protocol (RDP) that greatly improve the user experience such as:

Multi-monitor support
Bi-directional audio support (VoIP anyone?)
Aero Glass Support
Enhanced Bitmap Acceleration

Read that again. That's huge.

One big reason is that in the past, RDP was more focused on lower bandwidth connections. Customers have since told us they're willing to use more network bandwidth to provide a richer, greater fidelity user experience.

How good is the remoting? I recently tested the new RDP enhancements by doing the following. I used my three year old laptop running Windows 7 RTM and the built-in Remote Desktop Connection client. I went to the Experience tab and set Performance for WAN settings.

I then remoted into a virtual machine running Windows 7 (the VM was allocated 1 GB of memory) and then fired up three videos running within the VM simultaneously. Specifically,

a TV show streaming over the Internet using the Hulu desktop application (the show was “The Greatest Generation” by Tom Brokaw. Highly recommended.)
a large resolution QuickTime movie preview also streaming
an online Silverlight demo

Here's a screenshot from my laptop running the Window 7 inbox RDP client and this all just worked using my little old 1 Gb/E switch.

These RDP enhancements are big folks. Really big.

Windows Server 2008 R2 Hyper-V

With our customers input first and foremost, we developed Hyper-V R2 to meet their requirements.

Live Migration

#1 Customer Requested Feature
Processor Compatibility Mode

New Processor Support

Improved Performance
Lower Power Costs

Enhanced Scalability (4x Improvement)

Support for 64 Logical Processors
Support for up to 384 Running VMs or up to 512 virtual processors
Greater VM Density
Lower TCO

Networking Enhancements

Improved Network Performance
10 Gb/E Ready

Dynamic Virtual Machine Capabilities

Live Migration
Hot Add/Remove Virtual Storage

Usability Enhancements

SCONFIG for Server Core

In short, Windows Server 2008 R2 Hyper-V delivers more of everything:

Capabilities
Efficiency
Performance
Scalability
Flexibility
Ease of use

Windows Server 2008 R2: Customers Win

Ultimately, Windows Server 2008 R2 delivers the richest overall platform by offering:

Hyper-V
Remote Desktop Services
Rich RDP enhancements
Powerful Hardware and Scaling Capabilities
Reduced Power Consumption
Connection Broker for a Virtual Desktop Infrastructure (VDI)
Ubiquitous Remote Access
Improved Branch Office Performance and Management
Simplified Management for SMBs
Remote Application and Desktop Access

and its numerous roles such as:

Active Directory
Application Server
DHCP
DNS
Fax
File
Network Policy & Access Services
Print
and many more

In the end, Windows Server 2008 R2 delivers in spades and ultimately, our customers win.

Cheers,

Jeff Woolsey

Principal Group Program Manager

Windows Server, Hyper-V

Correction: I had a comment stating that VMware View only brokered VMs which was not correct and have since removed it. VMware View does, in fact, broker both VMs and Remote Desktop sessions. -JW

Too many Virtual Iron customers in the fire?

porourke — Thu, 16 Jul 2009 08:38:00 GMT

With the recent announcement by Oracle to stop Virtual Iron development and sales, the past few weeks have certainly been eventful for Virtual Iron customers. A related announcement came out from VMware about a program to offer Virtual Iron customers discounts to move over. But a closer look at the VMware offer shows some serious limitations. These include:

· Only Virtual Iron 4.0 or newer customers are eligible

· Only those with active support subscriptions with Virtual Iron are eligible

· Customers must buy a VMware license for every socket on their Virtual Iron contract. This effectively locks in the customer to VMware for size of their Virtual Iron contract.

· The discount is 40% off the list price of the product but only 10% on one-year of support and subscription, 0% for more than one year of support subscription.

· The offer isn’t valid on all SKUs. This means for Virtual Iron customers who want to keep their Live Migration and CPU balancing capability, they need to buy vSphere Enterprise Plus, the most expensive SKU.

Even with the discounts, VMware is still very expensive. For vSphere Advanced, the cost after discount is still $1,347 per processor without support, which has a very small discount. For vSphere Enterprise Plus, which is required for DRS and other features, the cost is still $2,097 per processor without support. With two years of support, it’s $3,722.64 per processor.

As noted above, Virtual Iron customers must convert all their sockets to VMware and this can only be done once.

As an alternative, I would recommend Virtual Iron customers try Microsoft solutions. Our Hyper-V solutions are low cost, easy to use, and work well with Xen-based solutions like Virtual Iron. In fact, many Virtual Iron users are already running their VMs in the VHD format that’s used with Hyper-V.

If Virtual Iron customers are running Windows Server 2008 in their VMs, they can leverage Windows Server 2008 Hyper-V and Windows Server 2008 R2 Hyper-V. For those customers running non-Windows VMs or do not own Windows Server 2008, you can use the new Microsoft Hyper-V Server 2008 R2 hypervisor. This is our free, standalone hypervisor, which now includes both high availability cluster and live migration at no cost. Both are available for download, a trial for Windows Server 2008 Hyper-V and a full download for Microsoft Hyper-V Server 2008 R2.

Best of all, Virtual Iron customers can just try out the Microsoft solutions, see if it fits their needs, and migrate on their own schedule, all at a much lower cost than the VMware solution.

Edwin Yuen

Microsoft’s new VDI licensing: VDI Suites

porourke — Tue, 14 Jul 2009 00:48:00 GMT

Hi, my name is Manlio Vecchiet, and I am a director of product management on the Windows Server marketing team. I'm in New Orleans right now attending the Microsoft Worldwide Partner Conference (WPC), and wanted to update you on new licenses we’ll offer for hosted virtual desktops, or virtual desktop infrastructure (VDI).

When deciding whether to implement or even pilot VDI, most customers look for technical integration of the key VDI building blocks:

· the hypervisor,

· management of the virtual machines and the (physical) VDI host,

· a brokering and remoting infrastructure, and

· an application delivery technology for dynamic provisioning of applications to virtual desktops.

But customers also look for a simple and cost-effective way to license this scenario, as they will compare the technical and business benefits of VDI with more traditional desktop deployment options, such as session-based desktops and rich clients. Today we introduced two new licenses for VDI – the Microsoft Virtual Desktop Infrastructure Standard Suite and the Microsoft Virtual Desktop Infrastructure Premium Suite. These licenses make it simple for customers to purchase the comprehensive Microsoft VDI technologies while providing excellent value compared with competing VDI offerings. The new VDI suite licenses will be available via Microsoft volume licensing in calendar Q4.

This is a pretty big deal, so let me explain what we mean by comprehensive, simple and excellent value. First, both new offerings include licenses for all the key technology components mentioned above when used in a VDI scenario: Hyper-V Server, System Center Virtual Machine Manager, System Center Configuration Manager, System Center Operations Manager, Remote Desktop Services (CAL) and MDOP. The Premium VDI Suite even includes additional use rights for Remote Desktop Services (RDS) as well as App-V for RDS, to enable mixed environments with not only VM-based remote desktops, but also session-based desktops and applications. With these two new offerings, the only additional license you will need to correctly license a VDI environment from Microsoft is Virtual Enterprise Centralized Desktop or VECD (you will need VECD even to deploy VDI on a non-Microsoft platform)

By now, you are probably wondering how the licensing of these new VDI Suites will work given their standalone components have very different license schemes. The two new VDI Suites are designed to match the VECD license (which is a device subscription), so the math has become very simple now: As with VECD, the number of VDI Suite licenses equals the total number of client devices that accesses the VDI environment. The subscription-based license will ensure that customers always have access to the latest versions of the software.

But now comes actually the best part. At only $21 per year per device, the VDI Standard Suite is about one-third the cost of a corresponding VMware View edition (the comparison is based on the cost of licenses and software maintenance over a five-year period, which many customers tell me that’s what they base their desktop infrastructure investments on). Similarly, our VDI Premium Suite is about half the price of the premier VMware VDI offering, and it also offers the capability to deploy session-based desktops and applications, in addition to VM-based desktops. And for those customers who are still missing a feature or need an enterprise-ready solution, you can add a 3^rd party connection broker for Hyper-V such as Citrix XenDesktop - and most likely still pay less than if you chose to deploy VMware. In fact, Citrix today announced continued alliance in the area of desktop virtualization.

If you would like to see a demo of Microsoft VDI solution running on Windows Server 2008 R2, please come to the Microsoft booth at WPC if you’re attending the conference. For all others, please post your comments in the section below.

Manlio

UPDATE: to answer morriswj's question. I'm excited, too, about this new single licensing for VDI’s server infrastructure, which will complement VECD for a VDI deployment. Regarding High Availability, it is included in MS Hyper-V Server 2008 R2 (the no-cost, standalone hypervisor) and will therefore be available as part of the VDI Suite offering. No other license other than VDI Suite (Standard or Premium) and VECD will be required for a highly available VDI deployment.

UPDATE 2: I'm responding to the question from cstalhood, and the similar question in Brian Madden's post today. For session virtualization using WS08 R2 Remote Desktop Services (RDS), you don’t need the VECD license. The Premium VDI Suite license includes full rights of the RDS CAL, in addition to the other components for a VDI solution. The Premium VDI Suite license, when available in Q4, will be available as a device subscription, while RDS CAL (the new name for TS CAL) is available as a perpetual user or device license. After all, some customers don’t want to buy on a subscription basis.

Windows Server 2008 R2 Core: Introducing SCONFIG.

WSV_GUY — Tue, 07 Jul 2009 16:27:00 GMT

Virtualization Nation,

It's been very busy in the world of Windows Server. With the launch of Windows Server 2008 R2 Release Candidate, Tech Ed and the announcement of several new Hyper-V R2 capabilities such as 64 logical processor support and processor compatibility, it's been pretty non-stop. In fact, it's been so busy, that we haven't even had a chance to introduce one more really cool new feature in Windows Server 2008 R2, but first, some background.

Windows Server 2008 R1: Core Deployment

In Windows Server 2008, we introduced the ability to deploy Windows Server in a core deployment. Server Core is a minimal server installation option which provides a low-maintenance server environment with limited functionality. Just to be clear, Server Core isn't a SKU. You don't buy "Server Core" it's simply a deployment option presented during Windows Server Setup. For example, here's a screen shot during Windows Server Setup, notice that there are options for Full Installations and Server Core Installations.

The benefits are smaller attack surface, a reduction in patches and reduction of server reboots. If you compare the number of reboots between running a server running Windows Server 2008 core deployment versus Windows Server 2008 a full installation, there's a substantial reduction in the number of reboots which, in turn, helps reduce management costs.

While customers like the idea of core installations, the fact that a server core deployment is a command-line interface (CLI) only (no GUI, no Start Menu, etc) with a very differently deployment mechanism introduces a challenging learning curve for those considering core deployments. For those of you who've never seen a Windows Server 2008 server core deployment it looks like this:

Pretty spartan.

As you can see, there's no Start Menu. It's all command-line all the time. For enterprise customers, this isn't a big deal because very often they deploy Windows Server in an automated fashion. However, for small and mid-sized customers a command-line only interface can make some of the most rudimentary tasks a challenge. For example, here are the commands to rename your computer and then join a domain via a Windows Server 2008 core deployment.

Rename your computer: netdom renamecomputer %computername% /newname:<new_computername>
Domain join: netdom join %computername% /domain:<domain> /userd:<username> /passwordd:*

Not the easiest thing to remember. We knew we could do better.

Improving Usability

While Windows Server 2008 R1 was in development, a few of us were quietly working on the Hyper-V Server 2008 standalone SKU which also uses a CLI. We spent time working on improving the server configuration experience with an easy to use CLI called HVCONFIG. Within hours of our first private releases of Hyper-V Server 2008 to testers, we received email asking/begging/pleading/cajoling/offering bribes for a similar tool for Windows Server as well.

Happy to oblige.

Introducing SCONFIG for Windows Server 2008 R2 Core Deployments

We are pleased to announce that in Windows Server 2008 R2, there's an easy to use CLI, SCONFIG. SCONFIG dramatically eases server configuration for Windows Server 2008 R2 core deployments. With SCONFIG, you can easily set your system up, get it on the network so you can easily manage the server remotely.

Rename your computer? Press 2 and you will be prompted to type in the computer name.
Domain join? Press 1 and you'll be prompted for name & password.

Simple and fast.

With SCONFIG you can easily have a Windows Server 2008 R2 Server Core deployment setup in minutes. I should also mention that SCONFIG is also localized in almost 20 languages.

Tasks include:

Domain join
Rename Computer
Configure Remote (Enable management via Server Manager, & PowerShell including properly configuring the firewall.)
Configuring Windows Update
Enabling Remote Desktop (in case you want to login remotely.)
Configuring Networking (static vs. DHCP and for multiple NICs)

All you have to do is type sconfig at the command line.

Great! Now What?

Remember, the goal with a server core deployment is to get the server on the network so you can manage it remotely. With SCONFIG this is a snap. Now from another system you can enable roles, run PowerShell scripts, manage it using System Center, manage it using Server Manager from another server running Windows Server 2008 R2, or manage it using the free Remote System Administration Tools (RSAT) for Windows 7.

In short, our goal is to provide customers multiple solutions based on their business needs.

Cheers,

Jeff Woolsey

Principal Group Program Manager

Windows Server, Hyper-V

Beware The VMware Core Tax & More

WSV_GUY — Mon, 29 Jun 2009 09:18:00 GMT

Virtualization Nation,

We'd like to again offer congratulations to AMD on the release of their new 6-core Opteron ("Istanbul") processors. As Bryon mentioned, Hyper-V R2 goes hand in hand with these new processors with support for AMD's Rapid Virtualization Indexing, advanced power savings with Core Parking and, of course, more cores means compute resources to run more virtual machines. In fact, two factors that have fueled virtualization have been the rise of 64-bit (x64) computing and the rapid growth of multi-core processors.

Bring On The Cores

Even an entry level laptop these days is dual-core. On desktops, the news is even better. I saw an ad in the paper a few days ago for a very powerful HP desktop system with an AMD quad-core processor and 8 GB of memory that runs Hyper-V like a champ for $600. Well, the news is only getting better. Our partners at AMD and Intel are continuing to ratchet up the core counts and if you've been reading any of the popular tech sites around the web you may have read that we'll soon be seeing processors with 8+ cores per processor. That's a tremendous amount of compute power. In fact, with all this compute power, you're going to be more inclined to virtualize than ever. This is great news for our customers who are trying to lower cost.

However, one question that has hit our inboxes recently has been, "Does Hyper-V have a core tax?"

Huh?

Core Tax? What's that?

At Microsoft, we don't license per core, generally, we license per server or per processor. In this case of Windows Server:

Windows Server 2008 Standard is licensed per physical server and supports up to 4 physical processors whether there are 1, 2, 4, 6 or 8+ cores per processor
Windows Server 2008 Enterprise Edition is licensed per physical server up to 8 physical processors whether there are 1, 2, 4, 6 or 8+ cores per processor
Windows Server 2008 Datacenter Edition is licensed per processor whether there are 1, 2, 4, 6 or 8+ cores per processor

This is great for our customers. As they invest in newer hardware with greater capabilities, performance, scalability there's no penalty for moving to the latest cutting edge systems with ever increasing core counts. After being questioned about a "core tax," I looked into why this was being asked.

Now I know.

VMware & The Core Tax

With VSphere, VMware only supports 6 cores per processor for most of their versions. If you want support for more than 6 cores per processor you have to upgrade from:

Standard ($795 per processor) to Advanced ($2245 per processor) a 282% increase (no, that's not a typo) OR
Enterprise ($2875 per processor) to Enterprise Plus ($3495 per processor) a 22% increase

Ouch.

From their website:

What do Analysts Think?

In a recent blog, Scott Lowe (virtualization analyst) wrote:

What's up with Advanced having a 12-core limit, but Enterprise having a 6-core limit? Because existing VI3 Enterprise customers will be grandfathered into vSphere 4 Enterprise if they have an active SnS [VMware Support and Subscription], this strikes me as nothing more than an attempt to extort more licensing fees.

Extort? Ouch.

How The Enterprise Plus SKU Affects Enterprise Customers

With vSphere, VMware created a new, higher end tier, Enterprise Plus, so that Enterprise customers, who used to be the top tier customers and paid for a VMware Support and Subscription (SnS) contract to be eligible for free major and minor version upgrades, are finding that they will have to pay for an upgrade to Enterprise Plus when they decide to move to newer more powerful hardware with more cores. Thus, the Core Tax for VMware users.

What Do VMware Customers Think?

From HERE.

The enforced SnS renewal is particularly galling for companies that just recently renewed their contracts, said Andrew Storrs, and independent consultant in Vancouver, Canada. "It's not so bad if you only have six months left [on SnS], but what if you have 2.5 years left?" To take advantage of the upgrade promotion, IT managers are in the awkward position of having to ask to for more money for their SnS, "just for the privilege of using a normal [VMware] edition next year."
"A lot of people are pretty p@#$%d about it," he added.

What about VMware "Standard" Customers?

In addition, VMware has very quietly removed some features (such hot add virtual disks) that used to be in VMware Standard and pushed those up to Advanced. So, VMware Standard customers are LOSING FUNCTIONALITY "upgrading" to VSphere. If you want those hot add capabilities back, VMware Standard Customers will need to pay for an upgrade from VSphere Standard ($795 per processor) to Advanced ($2245 per processor).

A 282% increase.

Think that's bad? VMware didn't stop there.

The News Gets Worse (Hope You're Sitting Down)

Two things that are interesting:

It's odd that Enterprise Edition supports fewer cores per processor than Advanced. Paying more and getting less isn't exactly customer friendly. To add insult to injury, VMware is dropping the Enterprise SKU altogether this year to force customers to purchase an upgrade to Enterprise Plus. (HERE & HERE) Double ouch.
It's also interesting that VMware caps the number of cores per processor at 12. What happens when a processor comes out that includes more than 12 cores? 16? 24? 32? More? Will that require an upgrade to Enterprise Super Plus?

I'll let you draw your own conclusions, but VMware's track record speaks for itself.

CUSTOMERS: FIRST & FOREMOST

No Core Tax. At Microsoft, we don't license per core, generally, we license per server or per processor. When we do license per processor, it's per processor regardless of how many cores are present. I should also point out that the FREE standalone Microsoft Hyper-V Server 2008 R2 supports up 8 physical processors whether there are 1, 2, 4, 6 or 8+ cores per processor as well.

Read that last sentence again.

Microsoft Enterprise Customers with Software Assurance: For our valued customers that purchased Windows Server 2008 with their Microsoft Enterprise Agreement & Software Assurance, here's just a fraction of the new Hyper-V R2 capabilities you'll be receiving with your upgrade to Windows Server 2008 R2 included as part of your agreement:

Live Migration
Major Scalability Boosts
Green IT Enhancements
10 Gb/E Ready
Cluster Shared Volumes
Hot Add Virtual Disks
and this is just for starters

In addition, I haven't even started discussing the new capabilities in Windows Server 2008 R2 outside of Hyper-V such as:

Powerful Hardware and Scaling Capabilities
Reduced Power Consumption
Connection Broker for a Virtual Desktop Infrastructure (VDI)
Ubiquitous Remote Access
Improved Branch Office Performance and Management
Simplified Management for SMBs
Remote Application and Desktop Access
and much, much more

included as part of your agreement. That's taking care of your customers.

Cheers,

Jeff Woolsey

Principal Group Program Manager

Windows Server, Hyper-V

System Center Virtual Machine Manager 2008 R2 - Quick Storage Migration

WSV_GUY — Thu, 25 Jun 2009 16:30:00 GMT

Hi, I'm Edwin Yuen, a Senior Technical Product Manager at Microsoft's Integrated Virtualization team. In today's blog, I'd like to discuss another type of migration being added to System Center Virtual Machine Manager 2008 R2, Quick Storage Migration.

Quick Storage Migration (QSM) In Brief

As you may have seen, we recently released the Release Candidate for System Center Virtual Machine Manager 2008 R2. One of the most anticipated features of SCVMM 2008 R2 is Quick Storage Migration (QSM) which enables the migration of the storage of VM from one location to another. For example, suppose you have virtual machines on a leased SAN (SAN 1). The lease runs out and you decide to upgrade to a new SAN (SAN 2) with more capacity, better performance and additional capabilities. Quick Storage Migration allows you to move the virtual machine which resides on SAN 1 to SAN 2. I have had a number of request for more details on how this works so we've written this brief guide to QSM. (In addition, we wanted to make this technology broadly available, not just the biggest enterprises. More on that below.)

QSM relies on Windows Server 2008 R2 Hyper-V and Background Intelligent Transfer Service (BITS). QSM can move the virtual disks of a running virtual machine independent of storage protocols (iSCSI, FC) or storage type (local, DAS, SAN), with minimal downtime.

QSM Is One of Many Migration Technologies Supported in Virtual Machine Manager's Portfolio

VM Migration Type	Platforms available on	Technology used for transfer	Expected downtime for VM
Live Migration	Hyper-V (2008 R2) ESX 3.0, 3.5	Windows Server 2008 Failover Cluster Hyper-V vMotion for ESX	None No service interruption while virtual machine is moved
Quick Migration	Hyper-V	Windows Server 2008 Failover Cluster Hyper-V	Under 1 minute in most cases VM is put into save-state while it is moved from one cluster node to another using the cluster failover mechanism
SAN Migration	Virtual Server Hyper-V	Windows Server 2008 Hyper-V and Virtual Disk Service (VDS) Hardware Providers N-Port Identification Virtualization (NPIV) on Emulex and QLogic Fibre Channel HBAs iSCSI on EMC, HP, Hitachi, NetApp, EquiLogic arrays	Under 1 minute in most cases VM is put into save-state while it is moved from one virtual machine host to another using unmasking and masking operations at the SAN level
Network based migration (aka LAN migration)	Virtual Server Hyper-V ESX	BITS for Virtual Server and Hyper-V sFTP for ESX	Minutes to hours (W2K8, W2K3 hosts) VM needs to be stopped or in saved state for the entire duration of transfer Under 1 minute in most cases (W2K8 R2) VM can remain running for the almost entire duration of the transfer of its virtual disks from once storage location to another VM is put into save-state for a brief interval to migrate its memory state and associated differencing disks.

Storage Migration Type

Platforms available on

Technology used for transfer

Expected downtime

Storage vMotion

ESX 3.5

Storage vMotion

None

No perceived service interruption while the virtual disks associated with a virtual machine are moved from storage location to another

Quick Storage Migration

Hyper-V
(2008 R2)

BITS and Hyper-V

Under 1 minute in most cases (W2K8 R2)

VM can remain running for the almost the entire duration of the transfer of its virtual disks from once storage location to another
VM is put into save-state for a brief interval to migrate its memory state and associated differencing disks.

Note on Processor Compatibility Mode:

To increase the mobility of a running virtual machine across hosts with different processor versions (with in the same processor family), Windows Server 2008 R2 Hyper-V offers Processor Compatibility Mode. This feature masks processor feature differences between the source and destination hosts. With this enabled, you can migrate a virtual machine from a host with Pentium 4 VT processors to a host with Nehalem processors. Processor Compatibility Mode does not require advanced processor features like Intel VT Flex Migration or AMD-V Extended Migration. For more on Processor Compatibility Mode, check out Jeff's Blog a few weeks ago where he goes into detail here.

How QSM Works

QSM uses native Windows platform technologies: Hyper-V and BITS. There are 2 scenarios of interest:

Scenario 1: VM Storage Migration: VM Compute Stays on the Same Server and the VM Storage Migrates from One Storage to Another

1. In the SCVMM console, a new action labeled Storage Migration is now available.

2. When the user right-clicks on a running virtual machine and selects the Migrate Storage action, a wizard is presented. The user provides the path to the new location to be used by the VM. If all the VMs files (configuration and VHD files) are to be placed in a single location the user has only to provide the "Virtual Machine Path". If one or more VHD files for the VM need to be placed at a separate location, the user can explicitly change the location of each VHD by selecting it from the list under "Disks" and clicking the "Browse" button next to it to specify the path for the VHD.

3. SCVMM takes a Hyper-V snapshot of the running virtual machine. This will create a differencing disk for each VHD connected to the VM. All disk write operations from that point forward go into the differencing disk. The original base VHD is no longer changing since it is in a read-only state.

4. With the base VHD in a read-only state, SCVMM starts to transfer the file from the source location to the target location using BITS. This represents the bulk of the data that needs to be transferred and the VM remains running during this transfer. In addition, QSM does not depend on storage types, and the user is free to select any storage destination that is accessible to the Hyper-V host.

5. Once the base VHD is transferred, the virtual machine is put into "Saved State".

6. In "Saved State", SCVMM can transfer the differencing disk created by the snapshot and memory associated with the "Saved State" to the destination location for the VM.

7. Once all the files are transferred, SCVMM exports and then re-imports the virtual machine on the same Hyper-V host with any necessary modifications to the configuration.

8. The snapshot created on step 3 is merged back into the base VHDs

9. Virtual machine is re-started from saved state

10. Job completes

11. The diagram below illustrates the steps performed by QSM on a Hyper-V R2 host.

Scenario 2: VM Migration (Relocation): VM Compute Moves to a News Server AND VM Storage Moves from One Storage to Another

1. In the SCVMM console, the user right-clicks on a running virtual machine and selects the Migrate action, a wizard is presented to help with the migration. The Migrate action initiates the migration of a VM from one host to another host. As part of the VM migration, all of the VMs files are moved to storage that is attached to the destination host. Storage Migration technology enhances the experience by allowing the move for a running virtual machine and limiting the down time of the VM to just the window required to move the save state files (as explained below).

2. The user first selects the destination host based on the desired star rating presented by Intelligent Placement. The user then provides a destination folder for the configuration file and the associated virtual disks. By default, the wizard will put all disks in the same location as the configuration file. After completing the wizard, the migration job is submitted.

3. SCVMM creates a placeholder virtual machine on the destination host. The virtual machine is not powered on so there is no need to reserve CPU or memory resources at this time. Intelligent placement has already accounted for the impact on the destination host of the VM being migrated.

4. SCVMM takes a Hyper-V snapshot of the running virtual machine. This will create a differencing disk for each VHD connected to the VM. All disk write operations from that point forward go into the differencing disk. The original base VHD is no longer changing since it is in a read-only state.

5. With the base VHD in a read-only state, SCVMM starts to transfer the file from the storage location on the source host to a storage location on the target host using BITS. Since QSM does not depend on storage protocols or storage types, the user is free to select any storage destination as long as the Hyper-V can access it.

6. Once the base VHDs are transferred, the virtual machine is put into Saved State.
In Saved State, SCVMM can transfer the differencing disks created by the snapshot and associated memory state.

7. Once all the files are transferred, SCVMM exports the virtual machine and transfers the exported virtual machine configuration to the target host and then imports the virtual machine to Hyper-V host with any necessary modifications to the configuration.

8. The snapshots are merged back into the base VHDs as part of the import process.

9. Virtual machine is started from saved state

10. Job completes

How QSM Compares To VMware Storage VMotion

	VMM 2008 R2 + Windows Server 2008 R2 Hyper-V	VMware (vCenter 2.5 + ESX 3.5)
Migration of virtual machines across two hosts with independent storage	Supported	Not Supported
Migration of virtual machines with snapshots	Supported	Not Supported
Migration of Virtual machine with Virtual Disks	Supported	Supported (persistent mode)
Requires sufficient resources to support two instances of the virtual machines running concurrently	Not Required	Required
Additional Licensed Required	None	VMotion License
Number of concurrent storage Migrations allowed	10	4
Storage Migrations supported in the Administrator Console	Yes (QSM and Storage vMotion)	No
Storage Migrations supported in the CLI	Yes (QSM and Storage vMotion)	Yes
Protocol agnostic	Yes	Yes
Support for migrations of VMs and storage between hosts with different processors versions (same manufacturer)	Yes (use Hyper-V R2 Processor Compatibility Mode to increase the number of compatible hosts )	Not Applicable

Microsoft: Driving Down Costs

One thing our customers have been telling us loud and clear is that they are very, very happy we are offering Live Migration for FREE with Hyper-V R2. With Quick Storage Migration, we knew we had another opportunity to drive down the costs for storage migration capability that has been largely priced out of the reach of most customers. Specifically, VMware Storage VMotion is only available in their Enterprise/Enterprise Plus SKUs ($2875 & $3495 per processor respectively). Contrast this with the fact that Quick Storage Migration is included with System Center Virtual Machine Manager 2008 R2 both the Enterprise Edition and the Workgroup Edition which will be available for starting at about $500.

For a small five node cluster consisting of two and four processors servers, that would cost at a minimum:

	Virtual Machine R2 QSM	VMware
Three Nodes; Two Processor Servers	~$500	$11,500
Five Nodes; Two Processor Servers	~$500	$28,750
Five Nodes Four Processor Servers	~$500	$57,500

That's customer focus.

Cheers,

Edwin Yuen

Sr. Technical Product Manager

Guest post: Hyper-V gives every Windows shop a free pass into “innovation”

porourke — Mon, 22 Jun 2009 21:39:00 GMT

Hi, my name is Matt Lavallee and I am the Director of Technology at MLS Property Information Network, Inc., based in Massachusetts. Although you may not recognize the company name, we are one of the 700+ multiple listing service (MLS) companies that provide data warehousing for the Real Estate industry in the U.S. As my company took the early step to virtualizing our environment on Hyper-V last year, Microsoft asked me to share my opinion on the results of its recent survey on the state of IT infrastructure investments, conducted by Harris Interactive.

One point that stands out on the survey — and should surprise no one — is the shift to belt-tightening in IT: 84% of US respondents cited improving business efficiency (51%) and reducing IT costs (33%) as their priorities in light of the economic downturn. However, I personally disagree that this new mindset is a direct reaction to the economy or that the decreased allocation of IT budget to innovation (29% in the US) are necessarily bad things.

First, let us consider that the IT budget is a relatively fixed value year over year — while it may respond to inflation and some cyclical purchases, the vast majority of budget is spent on payroll, annualized licensing, backups, ISP costs, and the regular refresh of equipment. To me, this eliminates a significant stratum of budget from consideration for “innovation” unless you just built your environment last year on five-year-old technology.

Second, the actual varying allocation of budget goes to “special projects”, which, for lack of a better term, includes “innovation”. Here is where the survey findings drew too many conclusions and where I feel the indication is astray from real trends.

Consider my environment: We recently made the switch to virtualization and the broad deployment of Hyper-V. This included a change in direction for our hardware refresh (bigger servers), incremental SAN purchases, and some new investment in networking (10GbE)… perhaps enough to reflect the 25% investment in “innovation”, per the survey. A balance sheet, however, would not reflect that we redesigned the entire infrastructure and now run up to 60% more efficiently: all you will see is a marked decrease in operational overhead at the end of the year (i.e., improved business efficiency and reduced IT costs, as the survey reflected).

So why is there no correlation between advancing the infrastructure and innovation spending? I believe that the technology ecosystem has afforded smarter IT spending, particularly with the (dramatic) rise in computing density, the problems it has solved and challenges it introduced, and the tools that were created (or improved) to meet those challenges. PUE (Power Usage Effectiveness) and “green” concepts were alien just five years ago, but now dominate most datacenter conversations. Virtualization via Hyper-V gives every Windows shop a free pass into “innovation” and grants us many new opportunities that were previously out of budgetary reach.

Some question whether this change indicates that IT is no longer aligned with business goals and driving success… I offer that our current focus clearly demonstrates that we are doing exactly what the business needs us to do.

Matt

Server & Tools Business Exec to discuss state of IT, answer your questions on June 23

porourke — Thu, 18 Jun 2009 07:27:00 GMT

Do you have questions about Microsoft’s efforts to deliver new server infra (Windows Server, virt, System Center, Forefront security) to customers and partners?

What is Microsoft doing about enterprise security?

Are you interested in hearing how other IT pros are reacting to economic conditions and where they’re investing?

On Tuesday, June 23rd from 10:30am – 11:00am (PDT), you're invited to join a teleconference with Bob Kelly, corporate VP of Infrastructure Server Marketing. Bob will talk about the state of IT within the context of results from a new Harris Interactive study. The study, of 1,200 IT professionals from the U.S., United Kingdom, Japan and Germany, was commissioned by Microsoft’s Server & Tools Business.

There will be time for your questions following the brief presentation. Submit questions over the phone or you can submit them at any time leading up to, or during, the teleconference by tweeting with the Twitter hashtag, #qs4ms. If you are interested in attending, please REGISTER NOW. Once you open the invite box, you can save and close to your calendar.

Patrick