Windows Virtualization Team Blog : virtual machine

Visual Studio Lab Management 2010 beta 2

porourke — Fri, 06 Nov 2009 06:20:00 GMT

Hello, this is Bryon Surace again. I’m a senior program manager on the Windows virtualization team at Microsoft.

Recently, the Visual Studio 2010 and .NET Framework 4 beta 2 became available for public download. Part of this release is the Beta 2 version of Visual Studio Team System 2010 Lab Management; an integrated solution to give you all the benefits of virtualization for application lifecycle management. Congratulations to the Visual Studio Lab Management team for reaching this milestone!

Beta 2 Improvements:

§ Simplified Virtual Environment creation

§ Lab Environment Viewer with full-screen capability

§ Manual and automated testing in virtual environment

§ Build-deploy-test workflow for virtual environments

§ Enhanced workflow process parameters UI and report

§ Network isolation with support for domain controller VMs

§ Setup & Config – verification and auto provisioning of accounts

§ Virtual Machine templates

§ “In-Use” support for shared environments

The main features of Lab Management are:

Easily manage more complex test configurations

Lab environment as a first class entity for managing multi-machine test environments
Setup multiple configurations for testing quickly
Consistent, reliable access to test environments
Create multiple copies of test environments for parallel testing

New “clean” environment in minutes

Environment snapshot: lightweight and efficient
Facilitates exploratory testing

Scheduled build/test cycle on steroids

Snapshot to clean environment
Build triggered app deployment
Testing in more realistic environment

Rich bugs with environment snapshot

reduce the number of no-repro bugs

Visual Studio Download Page – you can download all the required components from there. This video can guide you through the download and installation process of TFS. And check out the Lab Management blog.

Thank you,

Bryon Surace

Upcoming Webcasts on Best Practices for Virtualizing MS Server Applications

porourke — Tue, 27 Oct 2009 22:25:00 GMT

We’ve got some great webcasts coming up in the next few weeks to discuss recommendations for virtualizing MS server applications and the benefits of choosing hyper-V + System Center as your virtualization solution. Each technical webcast will focus on a specific server application- Exchange, SQL and SharePoint. Please see below for detailed information.

TechNet Webcast: Microsoft Virtualization Best Practices for SQL Server (Level 300). Thursday, Oct. 29, 2009 at 10am Pacific time

Virtualizing business critical applications will deliver significant customer benefits including cost savings, enhanced business continuity and an agile and efficient management solution. This session will focus on virtualizing SQL Server using Microsoft solutions, the benefits over key competitors such as VMware, and guidance for virtualizing SQL server for Production and Test/Dev scenarios focusing on consolidation, scale, load balancing, dynamic provisioning and high availability. We will go into technical details with best practices. Customer evidence and results from lab deployment tests will also be discussed.

TechNet Webcast: Microsoft Virtualization Best Practices for Exchange Server (Level 300) Wednesday, Nov. 4 at 10am Pacific time

Virtualizing business critical applications will deliver significant customer benefits including cost savings, enhanced business continuity and an agile and efficient management solution. This session will focus on virtualizing Exchange using Microsoft solutions, the benefits over key competitors such as VMware, and guidance for virtualizing Exchange for various Production scenarios. We will go into technical details with best practices. Customer evidence and results from lab deployment tests will also be discussed.

Announcing the availability of the updated Infrastructure Planning and Design Guides for Virtualization and System Center

vtango — Thu, 24 Sep 2009 17:03:00 GMT

Microsoft has a comprehensive portfolio of technologies when it comes to Virtualization ranging from Presentation Virtualization with Remote Desktop Services to Server Virtualization using Hyper-V with many more in between as below.

· Server Hardware Virtualization. Also known as a hypervisor, Server Hardware Virtualization runs a very lightweight core operating system. The hypervisor can host independent virtual machines (VMs). This form of virtualization requires hardware that has embedded virtualization awareness capabilities. Since the hypervisor is very lightweight, there is little overhead in the system, which allows for more scalability in the virtual machines.

· Server Software Virtualization. An operating system, such as Windows Server® 2003 or Windows Server 2008, runs an application that is able to host virtual machines. Each virtual machine runs a completely separate operating system and application set.

· Presentation Virtualization. Centralized systems host multiple user sessions, and all processing is done on those host systems. The user sessions are isolated from each other. Only the presentation information, such as keyboard and mouse inputs, and video updates are sent between the client and the host system. The client can be a full Windows-based workstation or a Windows-based terminal device.

· Application Virtualization. An application is isolated from the underlying operating system by means of wrapper software that encapsulates it. This allows multiple applications that may have conflicting dynamic link libraries (DLLs) or other incompatibilities to run on the same machine without affecting each other.

· Desktop Virtualization. This is similar to Server Software Virtualization, but it runs on client systems such as Windows Vista®. The client operating system runs a virtualization application that hosts virtual machines. This is often used when a specific person needs to run one or a limited number of legacy applications on a legacy operating system.

With the richness and breadth of these technologies, customers should evaluate their needs against the capabilities and solutions that each of the technologies is targeted at. The Solution Accelerators team has been working furiously to create guides for customers and we are really excited to announce the availability of the Infrastructure Planning and Design Guide for Virtualization updated for Windows Server 2008 R2, which can help customers start their planning and deployment process for Virtualization using the Microsoft portfolio. With detailed documentation and simple flowcharts customers now have a powerful tool in their hands as they plan their deployments. Once the decision to go with a particular technology has been made, detailed guides are available for each of the technologies as well giving business decision makers, infrastructure stakeholders, and the organization as a whole a comprehensive tool for designing their virtual deployments.

As Tom Bittman from Gartner had said “Virtualization without good management is more dangerous than not using virtualization in the first place”. Our System Center suite of products provide a full suite of management solutions for this environment and the Infrastructure and Planning Guides for System Center have been updated for System Center Virtual Machine Manager 2008 R2.

Vijay Tewari

Principal Program Manager, Windows Server Virtualization

Hyper-V, your journey starts here!

vtango — Thu, 03 Sep 2009 19:59:00 GMT

I have been inundated by people here at VMworld 2009 with tons of questions on Hyper-V and who want to see demos of Hyper-V. This blog post attempts to put together a list material for folks. Given the large amount of material this list is only a snapshot but one which will provide you enough to get started.

First off there is a huge amount of technical articles, documentation, whitepapers, case studies, API documentation that’s available. Your start point should be the Virtualization page here. That site provides links to numerous case studies about customers who are using Hyper-V and Microsoft Virtualization solutions. Next I suggest looking at the solutions site that provides information on the customer focused scenarios. Following this I encourage you to delve into the products that are used to build these solutions.

For the geeks like me who are really looking to understand how to get started and the technical details you should start your journey at the Virtualization TechCenter. For those of you who wanted to just get to the nuts and bolts go straight to the Hyper-V Getting Started Guide. For folks wanting to understand the architecture in some depth you want to start here. Developers can jump straight to the WMI API’s.

Finally for folks who want to see a collection of videos with great demos of the products I’d like to point to Tony Sopers blog which contains a huge collection of these.

Enjoy.

Vijay Tewari

Principal Program Manager, Windows Server Virtualization

Strong end to end management required for Virtualization to be successful (VMworld day 2)

vtango — Wed, 02 Sep 2009 16:39:00 GMT

I am pleased that it is being acknowledged by VMware (evidenced by their keynote announcements yesterday on the vCenter additions) that for a strong virtualization platform a complete end-to-end solution is required. We agree completely!! We at Microsoft provide solutions for configuration/change management, operational/health monitoring, virtual machine management and data protection and have been doing so for a while now. Just to get some perspective I dug up the release dates for our management software (I have trimmed the list a bit for readabilityJ). From the table below its clear that our management lifecycle experience goes back many many years. It is great to see VMware finally acknowledge this and is attempting to now build a solution that spans some aspects of this end-to-end management. We welcome this.

Products	Date
Operations Manager 2000 Enterprise Edition	3/1/2001
Operations Manager (MOM) 2005	11/24/2004
System Center Operations Manager 2007	6/23/2007
System Center Virtual Machine Manager 2007	11/29/2007
System Center Virtual Machine Manager 2008	1/29/2009
System Center Virtual Machine Manager 2008 R2	8/2009
System Center Data Protection Manager	10/22/2005
System Center Data Protection Manager 2006	10/22/2005
System Center Data Protection Manager 2007	12/15/2007
System Center Data Protection Manager 2007 Service Pack 1	12/19/2008
Systems Management Server 1.2 Standard Edition	10/23/1996
Systems Management Server 2.0 Service Pack 3	2/13/2001
Systems Management Server 2.0 Standard Edition	4/1/1999
Systems Management Server 2003	1/20/2004
Systems Management Server 2003 R2	8/25/2006
Systems Management Server 2003 Service Pack 3	4/27/2007
System Center Configuration Manager 2007	11/29/2007
System Center Configuration Manager 2007 R2	11/29/2008
System Center Configuration Manager 2007 Service Pack 1	5/21/2008

Over the past two days I have had the opportunity to interact with large number of customers and partners (so much so that I could barely make it to one of my sessions yesterday). Universally, I have heard that customers are looking to have a solution that provides them end-to-end visibility/monitoring and control over their infrastructure spanning all layers from the hardware, virtualization, OS and applications. The depth and breadth of our experience and products provided by us and our partners provides customers with the tools that they need for a responsive and effective IT infrastructure.

Vijay Tewari

Principal Program Manager, Windows Server Virtualization

The Virtualization platform vs. the Operating System

vtango — Tue, 01 Sep 2009 16:01:00 GMT

Day 1 at VMworld was mostly about Labs and content which builds up to the main event starting with the keynote on Tuesday morning. Looking forward to today.

In the meanwhile I have been hearing about a concept being put forth that the virtualization platform is it and the OS is but relegated to the consigns of history. That’s an interesting argument, one that in my opinion is built around the myth that somehow the interface exposed by the virtualization platform is what applications are written to. The fact of the matter is that the “Virtual Machine” as exposed by the virtualization platform mimics the underlying hardware with all its diversity. An entity is still required to manage the hardware resources and provide the software abstractions to interact with incredibly diverse hardware. That is the operating system and that’s what applications are developed for.

Back in time such as of the Manchester Mark 1 application programs were self-contained which were loaded into the memory of the machine and then executed from there. Overtime developers realized the value of re-use and rather than build in everything into the application program, re-use and common abstractions became prevalent. As the diversity of hardware and peripherals increased in complexity, the operating system is what provided the abstractions which provided a common mechanism for all applications to interact with and utilize the machine effectively. That is what gave rise to the operating system. What befuddles me is the argument that somehow the emergence of the virtualization platform minimizes the tasks as performed by the operating system. There are some who will argue that the emergence of application frameworks such as .net and Java take on this role, but in the end below them they still require the abstractions offered by an OSJ. What do people think?

An interesting debate but mostly put out to confuse our customers who are fundamentally interested in running an efficient IT infrastructure that provides them the flexibility and ability to meet the business goals and be a strategic asset to their organizations. Customers are running a multitude of applications such as SQL, Sharepoint, Exchange, CRM, home grown line of business applications etc. Our partners and us are committed and focused to make sure that it happens.

By the way talking of partners, it was great to our partner Leostream announce their connection broker for Windows Server 2008 R2 and System Center Virtual machine Manager 2008 R2. In talking to our partner here at VMworld, it’s been wonderful to see the incredible innovation on their part based on the Microsoft platform. Thanks, this is what the Microsoft platform the best for our customers with its breadth and partner solutions.

Vijay Tewari

Principal Program Manager, Windows Server Virtualization

Follow us on Twitter and get a chance to win a Zune HD

vtango — Mon, 31 Aug 2009 16:09:00 GMT

I now have the final list of sessions that I will be attending at VMworld. As I noted last time I had a lot of waitlists which it now appears I have not made the cut for most of the sessions. That means I will be at our booth (#2422) almost all of today (Aug 31, 2009) and at the times when I am not attending a session.

There is a great opportunity to win a 32GB Zune HD. All you have to do is to follow the Microsoft Virtualization experts on Twitter. By the way this is open to folks who are not attending VMworld as well. So follow along with us!! You can follow me here.

I am heading over to the Moscone Center to register and see if I can get into some of the labs being offered today.

Vijay Tewari

Principal Program Manager, Windows Server Virtualization

Microsoft Hyper-V Server 2008 R2 (Free live migration anyone!) available for download

vtango — Sat, 29 Aug 2009 01:05:00 GMT

We are really excited to announce that Microsoft Hyper-V Server 2008 R2 is available for download here. It’s been a long an exciting journey bringing this product to our customers.

The chart below tells it all, we have listened to our customers and have designed the product to meet their needs. This is a robust virtualization platform with live migration built in at no extra charge.

Comparing Hyper-V Server V1 vs. V2

	Microsoft Hyper-V Server 2008	Microsoft Hyper-V Server 2008 R2
Physical processor support	Up to 4 processors	Up to 8 processors
Logical processor support	Up to 16	Up to 64
Physical memory support	Up to 32 GB	Up to 1 TB
Live migration	No	Yes
High availability	No	Yes
Management options	Hyper-V MMC, Windows Server 2008, Windows Server 2008 R2, System Center Virtual Machine Manager 2008/R2	Remote Server Administration Tool (Free), Windows Server 2008 R2, System Center Virtual Machine Manager 2008 R2

And don’t forget that Microsoft Hyper-V Server 2008 R2 also supports boot from flash for our OEM partners.

Just to recap this release has the following features

(a) High availability and live migration for managing a dynamic IT infrastructure

(b) Support for 64 logical processors future proofing our customers to scale up with the hardware

(d) Processor compatibility mode for live migration across different processor SKU’s from the same vendor

(e) Hot add/remove virtual storage

(f) Networking enhancements (VMQ, Chimney, support for Jumbo Frames)

(g) Simplified management using sconfig

(h) Boot from flash

We will be at VMworld to meet customers and share this news with them. Stop by our booth (#2422) and follow us as we blog and tweet.

Vijay Tewari

Principal Program Manager, Windows Virtualization Team

VMworld 2009 an oppurtunity to meet our customers

vtango — Wed, 26 Aug 2009 19:09:00 GMT

Hi, I am Vijay Tewari a program manager with the Virtualization team here at Microsoft. Having spent the last 15 months or so deeply involved in the development of Hyper-V I am really looking forward to meeting customers and partners at VMworld 2009.

Much is being made about the fact that we are not showing Hyper-V and System Center Virtual Machine Manager at this event due to the show policies. I will stay away from that debate although coming on the heels of our RTM I would have loved to show the product. However, a lot of us will be there at the event and are really looking forward to interacting with customers. At the end of the day the product is only useful if it meets our customers’ demands and there is nothing like having a face to face interaction with our customers to hear firsthand what they like and hate about the product.

Below is my tentative schedule for VMworld. As you can see a lot of wait lists, but I am hoping that I can squeeze in. Would like your feedback if there are sessions you would like to see covered.

We will be tweeting (follow vtango on Twitter) and blogging all through the event, so follow along.

Looking forward to seeing you!!

Vijay

Vijay Tewari, Principal Program Manager, Virtualization

Personal Schedule for Vijay Tewari

Monday


7:30 AM-9:30 AM (Waiting List)	LAB01	VMware vSphere™ 4 - New Features, Best of, Advanced Topics

10:00 AM-11:00 AM (Waiting List)	V13100	The VMware Competitive Advantage - A Comparison of Server Virtualization Offerings

11:30 AM-12:30 PM (Waiting List)	V13229	Introduction to VMware vSphere

1:30 PM-2:30 PM (Waiting List)	V11721	Best Practices for Successful VI Design

2:30 PM-3:30 PM (Waiting List)	V13478	Executing Enterprise Virtualization - Continuing Case Study with USMC

4:00 PM-5:00 PM	V12226	Building a High Availability and Disaster Recovery Solution with VMware

Tuesday


9:30 AM-10:30 AM	SS5160	Stop Virtualizing Servers, Start Virtualizing Infrastructure

11:30 AM-12:30 PM	VM3142	Large Scale Virtualization

1:00 PM-2:00 PM	VM3235	Introducing VMware vCenter Product Family: Managing Service Levels Across Dynamic IT Infrastructure

2:30 PM-3:30 PM (Waiting List)	VM1960	Datacenter Consolidation and Migration with VMware Site Recovery Manager

4:30 PM-5:30 PM (Waiting List)	BC2761	ESX Networking for High Availability and Disaster Recovery

5:30 PM-7:00 PM	TA2544	A Comprehensive Look at the Security and Compliance of vSphere 4

Wednesday


9:00 AM-10:00 AM (Waiting List)	BOF105	Technology and Architecture -- Virtual Networking

10:00 AM-11:00 AM	TA3220	VMware vStorage VMFS-3: Architectural Advances since ESX 3.0

11:00 AM-12:00 PM (Waiting List)	BOF104	Cloud Computing

12:00 PM-1:30 PM (Waiting List)	VM1700	vApps and advanced VM templates in vSphere 4

2:00 PM-3:30 PM	TA3880	Head-To-Head Comparison: VMware vSphere and ESX vs. Hyper-V and XenServer

4:30 PM-6:00 PM	BC3301	DR Architecture Design Workshop with SRM

Thursday


9:30 AM-10:30 AM (Waiting List)	BC2961	VMware Fault Tolerance Architecture and Performance

11:00 AM-12:00 PM	BC3387	Advanced Data Protection for Microsoft SQL and Exchange Server in a VMware Environment

12:30 PM-2:30 PM	LAB07	VMware vCenter Lab Manager 4

2:30 PM-3:30 PM (Waiting List)	BC3421	SRM Architecture & Features: The Road Ahead

4:00 PM-5:30 PM	TA2525	VMware vSphere 4 Networking Deep Dive

What you won't see at VMworld 2009 - a demo of SCVMM 2008 R2

porourke — Tue, 25 Aug 2009 03:32:00 GMT

Ordinarily it'd be great news that we RTM'd System Center Virtual Machine Manager 2008 R2 ahead of schedule, so close to the RTM of WS08 R2 Hyper-V and one week before VMworld conference. You can't beat the timing of it all. And the ~10,000 beta testers of SCVMM08 R2 are a big part of why we were able to deliver a high-quality release in the time we did. Some of the early adopters included Continental Airlines, Lionbridge Techologies, Sporton, Indiana University Auxilary IT and MaximumASP. Thanks to all!

But unfortunately, next week at VMworld 2009 we can't show SCVMM 2008 R2, or any other products, in our booth. You've probably read about it. In short, it's their show, it's not an industry show, and they set the rules. So we'll make the best of it; always lots of Microsoft customers and partners on the floor. Stop by the booth to meet some of the best/brightest minds at Microsoft.

As for the RTM of SCVMM 2008 R2, Zane summarizes his thoughts here. Kerim blogged about upgrade path to R2 from SCVMM 2008. See here. And on May 11, Vishhwa provided some details on features of SCVMM 2008 R2 here.

As Cheng wrote in his blog (I can't say it any better)

Go download a trial and give it a try, go get it now, and unleash the virtualization power that Microsoft brings to you.

Patrick

Hypervisor Footprint Debate Part 3: Windows Server 2008 Hyper-V & VMware ESXi 3.5

WSV_GUY — Mon, 17 Aug 2009 16:01:00 GMT

In my last two blog posts (Part 1 & Part 2), I started an in depth analysis tackling VMware's claims head on that because their disk footprint is smaller and ESX/ESXi are single purpose hypervisors, they are therefore more secure. If that's the case, then it stands to reason that ESX/ESXi:

should have fewer patches (they have less code to patch)
patches should be smaller in disk footprint (they have a smaller codebase and you want to keep code churn to a minimum; otherwise one could ship a 1k stub file and claim to be smaller)
should offer higher availability, reliability and uptime

Using VMware's own metrics:

In part 3, lets take a look at VMware's favorite comparison Windows Server 2008 Hyper-V to ESXi 3.5. Let's have a look.

Stacking The Deck In VMware's Favor

In this last comparison, I will freely admit that this isn't an apples to apples comparison. In this comparison, I gave ESXi 3.5 a 6 month advantage. Here's what I mean. Specifically, I compare:

VMware ESXi 3.5 from June 30th 2008 to June 30th 2009 (a 12 month period)
Windows Server 2008 Hyper-V January 1 2008 to June 30th 2009 (an 18 month period)

Using an 18 month sample set for Windows Server 2008 covers the majority of its time in market and goes to the heart VMware's fundamental claim that because their disk footprint is smaller and ESX/ESXi are single purpose hypervisors, they are therefore more secure. This tilts the scale in VMware's favor.

Windows Server 2008 Hyper-V to VMware ESXi 3.5

Disk Footprint & Patch Count. Here's what we found:

Windows Server 2008 Full Installation: 32 patches totaling 408 MB of patches
Windows Server 2008 Core Installation: 26 patches totaling 82 MB of patches or (~20% fewer than a Windows Server 2008 full installation)
VMware ESXi 3.5: 13 patches, totaling over 2.7 GB.

Yes, I said over 2.7 GB. To put it another way,

VMware ESXi 3.5 had a 6.6x greater patch footprint than Windows Server 2008 (Full)
VMware ESXi 3.5 had a 33x greater patch footprint than Windows Server 2008 (Core)

So much for the disk footprint argument. Again, how can the ESXi footprint be so huge?

Because VMware releases a whole new ESXi image every time they release a patch. Furthermore, because VMware releases a whole new ESXi image every time they release a patch it also means that every ESXi 3.5 server requires a reboot. At this point, a VMware salesman may actually concede that every ESXi server has to be rebooted for every patch, but they will then state that they have VMotion (Live Migration) so it doesn't affect their uptime.

Except when their own patches cause days of downtime and render VMotion impotent.

Reliability/Availability. With VMware ESXi 3.5 Update 2, it included a serious flaw which resulted in two days of downtime for their customers including the loss of VMotion:

"Starting this morning, we could not power on nor VMotion any of our virtual machines," said someone identified as "mattjk" on a VMware support forum. "The VI Client threw the error 'A general system error occurred: Internal Error.'"

It was so bad, VMware's CEO had to apologize on numerous occasions. (HERE, HERE, HERE, HERE, HERE, & HERE). VMware then rushed out the VMware ESXi 3.5 Update 3 which introduced instability to VMware High Availability and could cause virtual machines to spontaneously reboot. (HERE & HERE)

Virtual machines that spontaneously reboot due to bugs in VMware high availability.

Now consider the fact that there were two significant quality and reliability issues with two major updates in a row (ESX/ESXi Update 2 & Update 3). While the initial Windows Server 2008 Hyper-V release didn't provide Live Migration (Windows Server 2008 Hyper-V R1 had Quick Migration and Windows Server 2008 Hyper-V R2 includes Live Migration for free), it didn't include two days of potential downtime and virtual machines unexpectedly rebooting either. For those that track availability in terms of nines (five nines is 5.26 minutes of downtime a year) VMware Update 3.5 Update 2 dropped customers to "two nines" of availability.

Using VMware's own metrics, Windows Server 2008 Hyper-V is clearly the winner over ESXi 3.5.

The Facts Contradict VMware's Claims

As stated at the beginning of this series, VMware's overarching point is because their disk footprint is smaller and ESX/ESXi is a single purpose hypervisor, they are therefore more secure. While VMware heavily touts this claim (it's in numerous location on their website for starters), the facts from this analysis directly contradict their claims. Specifically:

The platform with the largest number of patches was VMware ESX 3.5 with 85 Security & Critical Patches averaging over a patch per week.
The platform with the largest patch footprint was VMware ESX 3.5 totaling over 3 GB worth of patches followed by VMware ESXi 3.5 with over 2.7 GB. That's right, VMware's single purpose virtualization platforms that claims to have the smallest footprint had the two largest patch footprints by about a mile. (Graph below)
Both VMware ESX & ESXi had a recent case of the most severe virtualization flaw with guest code able to break out of the virtual machine and could potentially:
- Provides administrator access, Allows complete confidentiality, integrity, and availability violation; Allows unauthorized disclosure of information; Allows disruption of service.
VMotion/Live Migration is not a panacea to patching. It can help, but in the case of VMware's own self-inflicted faulty patch, it rendered their advantage impotent.
VMware had not just one, but two significant updates with serious quality and reliability issues with both ESX and ESXi. Specifically, ESX/ESXi Update 2 Issues: HERE, HERE, HERE, HERE, HERE, & HERE & ESX/ESXi Update 3 Issues: HERE & HERE.

The Point Of This Series

Say it with me:

> Security is more than just disk footprint. <

Quoting disk footprint size alone is a nice pithy, superficial phrase, but it's also a boat load of bollocks. The next time some VMware representative throws out that argument, point them to this blog and tell them Jeff sent you. If you've ever spent anytime with a security expert, one of the first things they will tell you is that security is not a one time exercise. Security is an ongoing process that should be embedded throughout the entire development lifecycle. It's that belief that drove us to develop the Microsoft Secure Development Lifecycle (SDL) and is publicly available.

Microsoft Secure Development Lifecycle (SDL)

The concepts that make up the Microsoft SDL were formed with the Trustworthy Computing (TwC) directive of January 2002. At that time, many software development groups at Microsoft instigated "security pushes" to find ways to improve the security of existing code.

Becoming a mandatory policy in 2004, the SDL represents a major cultural evolution at Microsoft with regards to software security and privacy and has matured into a well defined methodology. A "security process by a software company," the SDL was designed as an integral part of the development process. The development, implementation and constant improvement of the SDL represents a strategic investment for Microsoft, and an evolution in the way that software is designed, developed, and tested.

From a high level, the Microsoft SDL looks like this:

The Microsoft Security Development Lifecycle

Benefits of the Microsoft SDL:

Reducing the number of software vulnerabilities
The SDL has played a critical role in embedding security and privacy into Microsoft software and culture, leading to measurable and widely recognized security improvements in flagship products such as Windows and SQL Server and the proof is real. How about:
- Windows XP to Vista a 45% decrease
- SQL Server 2000 to 2005 91% decrease

Windows Server 2008 Full vs Server Core
- Reduction in patches by ~50%

Reducing the total cost of development
The SDL reduces the "total cost of development" by finding and eliminating vulnerabilities early. According to the National Institute of Standards and Technology (NIST), eliminating vulnerabilities in the design stage can cost 30 times less than fixing them post release.

Read that last sentence again.

Thirty times.

I also want to point out that the Microsoft Security Development Lifecycle doesn't end once the bits are released. It also means having a well-established response mechanism including:

responding to potential security threats
root cause analysis to understand why the issue occurred and ensure that issue isn't repeated
issuing security patches

The importance of a security development lifecycle cannot be understated. No matter how well you execute, there is no such thing as perfect code. Whether it's Microsoft, VMware, <insert software vendor here>, having a rigorous security development practices in place is imperative. And, in case you think I'm satisfied with our patch numbers above, you'd be wrong. I don't ever want to get complacent and think for a moment that "security is done." Security is never done.

Let he who has written perfect code throw the first stone.

Let's Have A Look At The VMware's Security Development Lifecycle

So, where's the VMware Security Development Lifecycle?

You're guess is as good as mine.

I went to VMware's site and searched for their security development lifecycle. I found their Security Center which lists their patches, but that's just one small aspect to a security development lifecycle. I Bing searched "VMware security development lifecycle" and was returned a sales pitch from VMware to buy something at $1500 per processor.

No, I'm not kidding.

Making The SDL Available To Our Partners

After a significant investment in time, money, manpower we've developed and want to give back to our partners. A great place to start is the Microsoft SDL Homepage. Here you will find whitepapers, best practices, threat modeling tools, process guidance and much more. In addition, we recently released the Microsoft SDL Process Template for Visual Studio Team Systems. This template helps ease the adoption of the SDL, demonstrates security return on investment and provides auditable security requirements and status.

I'd be remiss if I didn't point out an excellent book aptly titled, Writing Secure Code Vol. 2 and point to the blog of one of the authors, Michael Howard. More links below.

Microsoft SDL Homepage: http://msdn.microsoft.com/en-us/security/cc448177.aspx

Microsoft SDL Process Template for Visual Studio Team System: http://msdn.microsoft.com/en-us/security/dd670265.aspx

Writing Secure Code Volume 2: http://www.amazon.com/Writing-Secure-Second-Michael-Howard/dp/0735617228

Michael Howard's Blog: http://blogs.msdn.com/michael_howard/

In my next blog, we'll discuss more free tools and programs available our partners.

Cheers,

Jeff Woolsey

Principal Group Program Manager

Windows Server, Hyper-V

Windows 7: Windows XP Mode Release Candidate Now Available

WSV_GUY — Thu, 06 Aug 2009 18:59:34 GMT

Virtualization Nation,

Just a quick blog in case you missed the big news for Windows 7. Windows XP Mode has hit Release Candidate. Here are some highlights of the new Release Candidate:

New Features in Windows XP Mode RC

Based on feedback from the Windows XP Mode beta, we've made several improvements to the usability of Windows XP Mode for small and medium-sized business users:

You can now attach USB devices to Windows XP Mode applications directly from the Windows 7 task-bar. This means your USB devices, such as printers and flash drives, are available to applications running in Windows XP Mode, without the need to go into full screen mode.
You can now access Windows XP Mode applications with a "jump-list". Right click on the Windows XP Mode applications from the Windows 7 task bar to select and open most recently used files.
You now have the flexibility of customizing where Windows XP Mode differencing disk files are stored.
You can now disable drive sharing between Windows XP Mode and Windows 7 if you do not need that feature.
The initial setup now includes a new user tutorial about how to use Windows XP Mode.

Personally, all the apps I use work just fine with Windows 7 (zero app compatibility issues), but I've found one killer reason for Windows XP Mode. At home, we have an HP Photosmart printer that prints great photos. It's really a great printer, but unfortunately, HP never updated the drivers for this printer beyond XP. I haven't had the heart to recycle it just yet and now I don't need to. I setup Windows XP Mode on my system at home, hooked up this USB device to my Windows XP Mode virtual machine, setup printer sharing within XP, and voila we can use this printer again. Very cool. :-)

For more on Windows XP Mode and download location, check out this blog post from the Windows Client Team.

Cheers,

Jeff Woolsey

Principal Group Program Manager

Windows Server, Hyper-V

Promotion of Brad Anderson to Corporate Vice President, Management and Services Division

larrygrothaus — Tue, 28 Jul 2009 23:16:00 GMT

It comes as no surprise to the regular readers of this blog, that a key tenant of Microsoft’s virtualization strategy is that customers should be able to manage their physical and virtual IT resources from the same set of easy to use tools. It seems that customers agree, as demonstrated through the growth of the Microsoft Management and Services Division (30% growth year over year) offerings during some challenging economic times.

Today we’ve announced that Brad Anderson, one of the key drivers behind Microsoft’s management offerings, including the System Center suite and products such as VMM, has been promoted to corporate vice president. We wanted to share the news with those of you that have worked with or met him over the years through events such as the annual Microsoft Management Summit conference. Congratulations Brad!

R2 Veeam Too

porourke — Fri, 24 Jul 2009 01:36:00 GMT

Hello, I’m Doug Hazelman and I’m the director of the Global Systems Engineers Group at Veeam Software. I’ve been with Veeam for almost two years, and prior to that I was with Aelita Software (which was acquired by Quest Software) where I worked with the same management team now behind Veeam Software. I’d like to thank Microsoft for this opportunity to guest blog on Veeam’s direction around Hyper-V.

Veeam’s tagline is “listening to you, building the tools you need.” We’ve heard your requests and we’d like to announce now that Veeam is committed to fully supporting Microsoft Windows Server 2008 R2 Hyper-V and Microsoft Hyper-V Server 2008 R2. While Veeam has continued to build some of the best software for data protection and management of VMware infrastructures, we realize that customers are now faced with more virtualization choices. By fully supporting Microsoft Hyper-V and VMware vSphere, Veeam can help you manage heterogeneous hypervisor deployments and clouds with the innovative solutions you’ve come to expect from Veeam. The management and R&D teams at Veeam have a long history of working with Microsoft going back to the Aelita days, and we’re all excited to be working with Microsoft again.

The Veeam engineers are currently focusing a lot of time and energy on how we can provide the best support for Hyper-V. Look for more information in the coming weeks as we disclose more about Veeam’s plans for Hyper-V. And congratulations to Microsoft for releasing R2.

Thanks,

-doug

Blog: http://www.VeeamMeUp.com

Twitter: @VMDoug or @Veeam

Windows Server 2008 R2 & Hyper-V Server 2008 R2 RTM!!!!

WSV_GUY — Wed, 22 Jul 2009 23:40:00 GMT

Virtualization Nation,

Today is a really big day at Microsoft and more importantly for our customers. Both Windows Server 2008 R2 and Microsoft Hyper-V Server 2008 R2 (our FREE standalone Hyper-V Server) have both been Released To Manufacturing (RTM)!! If you haven't seen the announcement on the main Windows Server blog, be sure to check it out. In this blog, I'm going to focus on the Windows Server 2008 R2 Hyper-V release, I will follow-up with a blog on the standalone Microsoft Hyper-V Server 2008 R2 soon.

These R2 releases continue to highlight one of our core goals for Hyper-V. Simply:

We believe everyone should have access to high performance hypervisor based virtualization. Period.

Virtualization shouldn't only be available to the largest enterprises with the largest budgets and we're delivering on that goal. We're pleased and humbled to announce that in the first 12 months of Hyper-V R1 availability with Windows Server 2008, there have been over 1+ million downloads of Hyper-V R1 Gold (RTM) software, making Hyper-V the fastest growing bare metal hypervisor in x86 history.

To our customers: Our deepest and sincerest thanks. We appreciate your support and are pleased to present Hyper-V R2 based on your input.

Hyper-V R2: Customer Focus

After the initial Hyper-V R1 release, we went back to our valued customers and asked them quite simply, "We have a very long list of potential features, help us prioritize. What are the features you want most?" Here's what our customers told us.

"Keep Reducing Costs"

Server consolidation continues to be the driving force behind virtualization and the fundamental reason is to reduce costs. In this economy, customers need to maximize their investments. Green IT has been important the past few years, but we've seen an even greater focus in the last year. In addition, it doesn't matter how small or how large your business is, everyone pays a power bill, it's a constant cost, so anything we can do to reduce power use has an impact on everyone's bottom line.

With Hyper-V R1, we already help customers reduce their cost for power, here are a few examples:

"With virtualization, we will save about 50 percent of our annual energy budget for cooling and electricity." -Lukoil CEEB

"The work that Microsoft has done in these areas-particularly the ability to shift workloads across CPUs-is doing wonders for reducing our energy consumption." Secure Endpoints

"89% Energy Savings with Microsoft Virtualization" -Kroll Factual Data

With Hyper-V R2, we continue to drive down power usage when servers are idle (usually nights and weekends) AND now we drive down server power usage even under load throughout the day through new enhancements like Core Parking, Timer Coalescing and more.

Bottom Line: Windows Server 2008 R2 continues to drive down power usage and lower power costs.

"Protect Our Investments"

Today, the majority of servers ship with up to 16 logical processors. However, our customers watch the industry closely and point out that AMD and Intel are continuing to increase core counts quickly. In addition, Intel has reintroduced Symmetric Multi-Threading (SMT) with their Nehalem processors which doubles the thread count. As our customers plan their capital investments over the next 12-24 months, they want to make sure to invest in a virtualization platform today that will take advantage of the latest hardware capabilities tomorrow. Hyper-V R2 is that platform.

CPU. From a compute standpoint, Hyper-V R2 scales to run on systems with up 64 logical processors (up to 384 running virtual machines) and takes advantage of the latest processor enhancements such as AMD's Rapid Virtualization Indexing (RVI) and Intel's Extended Page Tables (EPT). This provides performance improvements across the board when these processor capabilities are present. It also means that when folks decide to move up to larger servers with more counts Hyper-V R2 is ready out of the box. No core tax here. (BTW: Let me point out that Hyper-V R2 works with RVI and EPT, but does not require it. If you have older hardware without those capabilities, Hyper-V R2 will run just fine on those too.)

Networking. From a networking standpoint, Hyper-V includes significant networking improvements. For 1 Gb/E networks, Hyper-V R2 now includes Jumbo Frame Support. For 10 Gb/E networks, Hyper-V R2 adds support for Chimney support and Virtual Machine Queue (VMQ). These two technologies allows Hyper-V R2 to take advantage of network offload technologies so instead of a core on the CPU processing network packets, these packets can be shunted to the offload engine on the 10 Gb NIC which helps free up processor usage and improves performance. Support for these technologies ensures the most efficient use of your server resources. For our customers who haven't made the investment in 10 Gb/E quite yet, no worries. Hyper-V R2 is ready when you are.

Storage. In Hyper-V R1, we focused most of our performance efforts for storage on fixed virtual hard disks (VHDs). We did this primarily because fixed disks pre-allocate their storage upfront when you create the disk and help prevent a situation where you could run out of storage at a later time. Because we focused our performance efforts on fixed virtual hard disks, Hyper-V R1 performance for VMs with fixed VHDs was stellar and we recommended using fixed virtual hard disks in production environments. In fact, Hyper-V R1 can achieve as high as ~94% throughput of native.

Because we focused on fixed VHDs in R1 and knew that would be our recommendation for production environments, we didn't spend as much time focusing on dynamically expanding virtual hard disks in R1. While customers understand our recommendation for using fixed virtual hard disks, many of them told us that they'd like to use dynamically expanding virtual hard disks because they are more efficient in terms of storage, only growing as needed.

You got it.

In Hyper-V R2, we spent time analyzing and optimizing the code path for dynamically expanding VHDs and found areas where we could significantly improve performance. In some cases we achieved a 15x improvement for dynamically expanding virtual hard disks. No, that's not a typo. With dynamically expanding VHDs we can achieve up to about ~87% performance of native throughput. While we were at it, we took another look at the fixed VHD code path and improved it further so that fixed VHD performance is now on par with native performance.

In the end, we still recommend fixed disks for production use with Hyper-V R2 because it pre-allocates disk usage upfront, but if you want to use dynamically expanding virtual hard disks and are willing to take a small performance hit, Hyper-V R2 is a must.

"Help Me Find The Right Hyper-V Hardware." Customers told us that they wanted to make sure that they were investing in "the right hardware" to use with Hyper-V. We made that easy with Hyper-V R1, but it's worth pointing out again. There's no special certification for Hyper-V. Just make sure that the hardware you're investing in (servers, storage, etc) have the Windows Server 2008 Logo and now, the new Windows Server 2008 R2 Logo and you're set. You can find certified hardware online at the Windows Server Catalog and the logos look like this:

"Help Us Obtain Broader Support For Our Applications in Virtual Machines"

One customer pain point we hear in the virtualization world is that "ISV X" doesn't support their application in a virtual machine. This impedes adoption and frustrates customers who see the tremendous benefits virtualization provides. We've heard this repeatedly from our valued customers who are trying to convince our ISV partners that virtualization adoption is only rising. As a company, we've been consistently messaging how important virtualization is to our customers and demonstrating that through our significant investments in all areas of virtualization whether it's Hyper-V, App-V, MED-V, Virtualized Desktops, Remote Desktop Services etc.

In response to rapid customer adoption of Hyper-V and the customer requirement that virtualization be treated as the standard way to deploy workloads, not the exception, the Windows Server 2008 R2 Logo program now reflects that customer requirement.

Specifically, for applications to receive the Windows Server 2008 R2 Logo, all applications must be tested and pass the Logo tests when running within virtual machine running on Microsoft Hyper-V.

(Note: If an application cannot be tested in this configuration ISVs must work with a Microsoft approved testing vendor to learn about alternate test paths. For example, an application needs access to a specific hardware device not present in a virtual machine.)

"Continue to Improve Interoperability"

Today, we currently distribute Linux Integration Components (ICs) for SUSE Linux Enterprise Server (SLES) 10 SP2 x86 & x64 which improves performance when run within a Hyper-V VM. While our customers appreciate SLES support, they have also requested support for Red Hat as a guest OS. So, with the Windows Server 2008 R2 release of the ICs, we're adding support for both SLES 11 and Red Hat Enterprise Linux (RHEL) 5.2 and 5.3 for both x86 and x64.

While SLES and RHEL are the two most requested Linux distros supported within Hyper-V by far, we get requests now and then for other community supported distributions.

We wanted to do more.

Thus, the big Monday announcement. In case you missed it, on Monday, we released 20,000 lines of device driver code to the Linux community under GPLv2. The code, which includes three Linux device drivers, has been submitted to the Linux kernel community for inclusion in the Linux tree. The drivers will be available to the Linux community and customers alike, and will enhance the performance of the Linux operating system when virtualized on Hyper-V R1/Hyper-V R2.

I've read numerous articles and blogs on the Linux IC GPL announcement (most using phrases like "pigs with wings" or "hell experiencing snow flurries") and while there has been some interesting conjecture out there, let me be clear: Microsoft is committed to interoperability and providing our customers the solutions that meet their needs. Releasing these device drivers for Linux is another example of that commitment.

"Increase Flexibility"

Live Migration. Customers appreciate the flexibility that virtualization provides (deploy virtualized workloads in a fraction of the time versus physical) and wanted us to continue to improve in this area. To that end, the number #1 customer requested feature was Live Migration.

Done. Included. Live Migration Built-In.

We weren't done there. One thing that customers would always follow-up with is, "Do the processors have to be exactly the same? Can you ease that restriction a little?"

You got it.

Processor Compatibility Mode. With Hyper-V R2's new processor compatibility mode, we're able to easily LIVE MIGRATE between four different generations of Intel hardware. From an Intel Pentium 4 VT circa 2005 to an Intel Core i7 circa 2009.

Just by checking a checkbox:

That's flexibility. You can also move virtual machines between different generations of AMD processors as well. Just so we're clear: Processor Compatibility still means AMD<->AMD and Intel<->Intel. It does not mean you can Live Migrate between different processor vendors AMD<->Intel or vice versa. For more info about processor compatibility mode, check out my earlier blog post here.

Dynamic Storage. Another request to increase flexibility from our customers was to be able to hot add/remove virtual storage. Think about it, you're running a virtualized SQL server or file server and you need additional storage, but don't want to bring down the VM. No problem, with Hyper-V R2 you can hot add/remove storage while the VM is running without downtime.

"Virtualized Desktops"

One area of interest that's been percolating the last few years is the concept of Virtualized Desktops. At a high level, virtualized desktops is the concept of using a virtualization server to serve virtual machines running client operating systems like Windows XP or Vista. There are a few reasons customers are interested in this model such as to centralize management operations or to securely manage IP for remote developers. This model is very much like using Remote Desktop Services (formerly Terminal Services), except instead of Remote Desktop sessions, users are provisioned virtual machines.

From a Hyper-V standpoint, we've supported Windows XP and Vista as Hyper-V guests since the R1 release and with Hyper-V R2 we've added support for Windows 7 (x86 & x64 with up to 4 virtual processors per VM). However, Hyper-V support for client operating systems is only one piece of the puzzle. To improve this experience for our customers, the Remote Desktop Services team made significant enhancements in Windows Server 2008 R2 such as.

Connection Broker. Windows Server 2008 R2 includes a Connection Broker so that when a user logs in they can be brokered to their appropriate Virtual Machine OR Remote Desktop session on the back end. Yes, that's right. The Windows Server 2008 R2 broker actually brokers both Virtual Machines and Remote Desktops! This provides customers the flexibility to choose the solution based on their business requirements as opposed to being shoehorned into one technology.

RDP Protocol Enhancements. Windows Server 2008 R2 includes major enhancements for the Remote Desktop Protocol (RDP) that greatly improve the user experience such as:

Multi-monitor support
Bi-directional audio support (VoIP anyone?)
Aero Glass Support
Enhanced Bitmap Acceleration

Read that again. That's huge.

One big reason is that in the past, RDP was more focused on lower bandwidth connections. Customers have since told us they're willing to use more network bandwidth to provide a richer, greater fidelity user experience.

How good is the remoting? I recently tested the new RDP enhancements by doing the following. I used my three year old laptop running Windows 7 RTM and the built-in Remote Desktop Connection client. I went to the Experience tab and set Performance for WAN settings.

I then remoted into a virtual machine running Windows 7 (the VM was allocated 1 GB of memory) and then fired up three videos running within the VM simultaneously. Specifically,

a TV show streaming over the Internet using the Hulu desktop application (the show was “The Greatest Generation” by Tom Brokaw. Highly recommended.)
a large resolution QuickTime movie preview also streaming
an online Silverlight demo

Here's a screenshot from my laptop running the Window 7 inbox RDP client and this all just worked using my little old 1 Gb/E switch.

These RDP enhancements are big folks. Really big.

Windows Server 2008 R2 Hyper-V

With our customers input first and foremost, we developed Hyper-V R2 to meet their requirements.

Live Migration

#1 Customer Requested Feature
Processor Compatibility Mode

New Processor Support

Improved Performance
Lower Power Costs

Enhanced Scalability (4x Improvement)

Support for 64 Logical Processors
Support for up to 384 Running VMs or up to 512 virtual processors
Greater VM Density
Lower TCO

Networking Enhancements

Improved Network Performance
10 Gb/E Ready

Dynamic Virtual Machine Capabilities

Live Migration
Hot Add/Remove Virtual Storage

Usability Enhancements

SCONFIG for Server Core

In short, Windows Server 2008 R2 Hyper-V delivers more of everything:

Capabilities
Efficiency
Performance
Scalability
Flexibility
Ease of use

Windows Server 2008 R2: Customers Win

Ultimately, Windows Server 2008 R2 delivers the richest overall platform by offering:

Hyper-V
Remote Desktop Services
Rich RDP enhancements
Powerful Hardware and Scaling Capabilities
Reduced Power Consumption
Connection Broker for a Virtual Desktop Infrastructure (VDI)
Ubiquitous Remote Access
Improved Branch Office Performance and Management
Simplified Management for SMBs
Remote Application and Desktop Access

and its numerous roles such as:

Active Directory
Application Server
DHCP
DNS
Fax
File
Network Policy & Access Services
Print
and many more

In the end, Windows Server 2008 R2 delivers in spades and ultimately, our customers win.

Cheers,

Jeff Woolsey

Principal Group Program Manager

Windows Server, Hyper-V

Correction: I had a comment stating that VMware View only brokered VMs which was not correct and have since removed it. VMware View does, in fact, broker both VMs and Remote Desktop sessions. -JW