ENIAC KB

Hyper-V R2: Live Migration common problems

2009-12-10T16:22:00.000-08:00

Recently the ASKCORE Team wrote an excellent article about the most common problems that they receive from their clients regarding to Hyper-V R2 Live Migration.

According to them, the most common problems are related with some bad habits and bad decisions regarding to network configurations. The article also explain some techniques to increase the speed of the process (they’ve called it – Bonus Material :)).

Read more at “The devil may be in the networking details.”

Offline Virtual Machine Servicing Tool V2.1

2009-12-10T16:05:00.000-08:00

Microsoft released their new Offline Virtual Machine Servicing Tool; the new version of this tool includes support for Windows Server 2008 R2 and VMM 2008 R2.

What this tool can do for you?

Basically allows you to perform updates in your offline VM's that are in your VMM library. A scheduled job runs, deploys the VM, updates it and stores it back in the library during this process.

Offline Virtual Machine Servicing Tool 2.1 now supports the following products:

Hyper-V-R2
VMM 2008 R2
SCCM 2007 SP2
WSUS 3.0 SP2
Updates to Windows 7 and Windows Server 2008 R2 virtual machines.

Download it Here

Disk2vhd v1.4 available for download

2009-12-02T07:38:00.000-08:00

New update for Disk2vhd, now we can use the 1.4 version of the product.

Back In October SysInternals gave us the Disk2vhd v1.1 the announcement was made here at ENIACK, the v1.3 was released in November, now SysInternals is back with the new version of the same tool “v1.4”.

To download, click HERE

Read more about the new version at Sysinternals

Core Configurator 2.0 available for download

2009-12-02T06:57:00.000-08:00

Core Configurator 2.0 is now available for download at CODEPLEX.

It is completely open source so it can be ammended and change to fit your requirements, this version has been a year in the making and has been written in powershell with a reference to Winforms so that a GUI format is displayed.

The primary focus of this project is to try and get feedback and contributions back from the community to make this a tool the best/ free tool everyone will want in there toolkit, so if you have some code or features that you might want included then please leave a comment and we will get in touch.

Core Configuration tasks include:
-Product Licencing
-Networking Features
-DCPromo Tool
-ISCSI Settings
-Server Roles and Features
-User and Group Permissions
-Share Creation and Deletion
-Dynamic Firewall settings
-Display
-Screensaver Settings
-Add & Remove Drivers
-Proxy settings
-Windows Updates (Including WSUS)
-Multipath I/O
-Hyper-V including virtual machine thumbnails
-JoinDomain and Computer rename
-Add/remove programs
-Services
-WinRM
-Complete logging of all commands executed

Windows 7 Application Compatibility Tool

2009-11-23T15:41:00.000-08:00

In this webcast, Chris Jackson, demonstrates how you can use the Windows 7 Application Compatibility Toolkit 5.5 to get your application portfolio ready to migrate from a Windows XP to a Windows 7 environment. He shows how to gather an application inventory and mitigate application compatibility issues.

Hyper-V: How to Shrink and change the partition Size for a vhd file

2009-11-19T14:34:00.000-08:00

Recently Tonyso posted an interesting article about how to shrink and change a partition size for a vhd file.

There’re a lot of reasons why should be interested in doing something like this, for instance, you may need to reduce the size of a vhd file that was created during a P2V migration, or you may need to reduce the maximum size of a given partition for an old miss configured vhd file with extra unused space, or perhaps you need to consolidate your available storage and for that you need to readjust the existing vhd files to the correct size…

Check it out how to do it with ISO Linux distro that includes NTFSRESIZE and FDISK

PS:
In the future posts, I’ll show you different ways to do the same thing with different tools.

Office 2010 Beta available for download

2009-11-19T14:05:00.000-08:00

Try the new Office 2010 you can get it at
OFFICE BETA

Also available at TechNet and MSDN for subscribers

Hyper-V Cluster Error: An error occurred while creating the cluster. An error occurred creating cluster 'clustername'. The service has not been started.

2009-11-19T13:08:00.000-08:00

Here’s an interesting one that I already run a couple of times. You try to create a cluster at Hyper-V, the cluster pass all validation tests, then, at the final phase of the cluster creation, the process fails with the following error:
An error occurred while creating the cluster. An error occurred creating cluster 'clustername'. The service has not been started.

After this, the cluster computer account is removed from Active Directory!!!

After a closest check, I notice that the problem is related with the “Microsoft Failover Cluster Virtual Adapter” - “This device cannot start. (Code 10)”.

Hum…
After a reboot I saw the following errors at the event log:
EventID 4872:
The failover cluster virtual adapter failed to generate a unique MAC address. Either it was unable to find a physical Ethernet adapter from which to generate a unique address or the generated address conflicts with another adapter on this machine. Please run the Validate a Configuration wizard to check your network configuration.
and
EventID 4871:
The cluster service failed to start. This was because the failover cluster virtual adapter failed to initialize the miniport adapter. The error code was '2147483674'. Verify that other network adapters are functioning properly and check the device manager for errors. If the configuration was changed, it may be necessary to reinstall the failover clustering feature on this computer.

Okay, something is wrong with the MAC Address creation for the Microsoft Failover Cluster Virtual Adapter. What can we do about that?

Solution:
(Before proceeding, make sure that you backup of your registry)

- Open registry, and navigate to the following registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}

- Under this subkey, find the subkey that holds a DriverDesc string value entry whose value is "Microsoft Failover Cluster Virtual Adapter." (NOTE: 007 was the key designated were the Microsoft Failover Cluster Virtual Adapter was in my server, but this number may vary on different servers.)

- Under the subkey (in my scenario "007"), add the following string value registry entry:
Name: DatalinkAddress
Value data: 02-AA-BB-CC-DD-01
String Value (REG_SZ)

Restart the computer.

DONE!!!

Repeat these steps for computers were you're having this problem. When you do this on other computers, replace the value data of the registry with different values in order to set a unique value for each node. For example, set the value on the second node to 02-AA-BB-CC-DD-02, and set value on the third node to 02-AA-BB-CC-DD-03. If you notice this behavior on distinct clusters, make sure that you use an address for each node that is unique across all clusters.

Recently, Microsoft has released the KB973838 that describes the same issue.

Have Fun!!!

Forefront Threat Management Gateway (TMG) 2010 available for Download

2009-11-18T13:36:00.000-08:00

Forefront Threat Management Gateway 2010 allows employees to safely and productively use the Internet without worrying about malware and other threats. It provides multiple protection capabilities including URL filtering*, antimalware inspection*, intrusion prevention, application- and network-layer firewall, and HTTP/HTTPS inspection – that are integrated into a unified, easy to manage gateway, reducing the cost and complexity of Web security. Forefront Threat Management Gateway 2010 is available for download in both Standard Edition and Enterprise Edition.

Supported Operating Systems: Windows Server 2008

Minimum system requirements:

Supported Operating Systems: Windows Server 2008 SP2 or Windows Server 2008 R2
A computer with 2 core (1 CPU x dual core) 64-bit processor
2 gigabytes (GB) or more of memory
2.5 GB of available hard disk space. This is exclusive of hard disk space that you want to use for caching or for temporarily storing files during malware inspection
One local hard disk partition that is formatted with the NTFS file system
One network adapter that is compatible with the computer's operating system, for communication with the Internal network
An additional network adapter for each network connected to the Forefront TMG server

Recommended system requirements:

Supported Operating Systems: Windows Server 2008 SP2 or Windows Server 2008 R2
A computer with 4 core (2 CPU x dual core or 1 CPU x quad core) 64-bit processor
4 gigabytes (GB) or more of memory
2.5 GB of available hard disk space. This is exclusive of hard disk space that you want to use for caching or for temporarily storing files during malware inspection
Two disk for system and TMG logging, and one for caching and malware inspection
One network adapter that is compatible with the computer's operating system, for communication with the Internal network
An additional network adapter for each network connected to the Forefront TMG server

Additionally check the Forefront TMG RTM Overview Interview with David Cross

Have Fun!!!

SCVMM 2008 New KB Articles

2009-11-09T15:21:00.000-08:00

How to troubleshoot the "Not Responding" host status in VMM 2008

The Virtual Machine Manager Service crashes when you add a virtual machine host that has more than 16 logical processors in VMM 2008 R2

Exchange Server 2010 available to TechNet subscribers

2009-11-09T15:04:00.000-08:00

If you have a TechNet Plus subscriptions, you’ll notice that Exchange Server 2010 is already available to download.

What's New in Exchange 2010
Top Reasons to Try Microsoft Exchange Server 2010Reduced deployment cost

Exchange Server 2010 helps you reduce costs by addressing common infrastructure requirements such as backup, e-mail archiving, mobile e-mail access, and voice mail with no need for third-party tools.
Simplified high availability and disaster recovery
Exchange Server 2010 introduces a simplified approach to high availability and disaster recovery to help you achieve new levels of reliability and reduce the complexity of delivering business continuity.
Easier administration and decreased dependence on the help desk
Exchange Server 2010 provides new self-service capabilities to help users perform common tasks without calling the help desk.
Greater mobility and flexible access
Exchange Server 2010 offers an enhanced universal inbox experience, which provides your users with access to all of their business communications from a single location.
Decreased inbox overload and increased productivity
Exchange Server 2010 adds new productivity features which help your users organize and prioritize the communications in their inboxes efficiently.
Transformed voice mail
With Exchange Server 2010, users can receive their voice mail messages in their inbox with text preview.
Simplified compliance
Exchange Server 2010 delivers new integrated archiving functionality to help simplify compliance and discovery.
Safeguards for sensitive information
With centrally managed and enforced information protection and control capabilities, Exchange Server 2010 makes it easy to encrypt, control, and moderate your company's communications.
Reduced risk of malware and spam
Exchange Server 2010 actively helps protect your communications through built-in defenses against junk e-mail and support for an array of third party security products.

Watch Exchange 2010 demos from the Exchange Product Team
Exchange 2010 System Requirements

More information at:
http://www.microsoft.com/exchange/2010/en/us/default.aspx
and
http://technet.microsoft.com/en-us/exchange/2010/default.aspx

MS release of Virtual Machine Migration Test Wizard

2009-11-04T16:21:00.000-08:00

In Windows Server 2008 R2 Hyper-V R2, when a running or a saved state virtual machine is migrated to another server, the destination server may have a processor with a different set of features. An operating system or application that attempts to execute CPU features discovered when the virtual machine was started on a "source" machine, but not present on the destination (called "destination") machine, will cause a virtual machine migration failure.

The Hyper-V R2 virtualization platform prevents the migration of a virtual machine that will fail in this way because the processors of the "source" and "destination" servers are not compatible. However, this check for compatibility only happens at the time of virtual machine migration, not when the server joins a cluster.

Windows Server 2008 R2 includes a capability called “Processor compatibility mode” so that you can avoid the situation where virtual machines cannot be migrated due to processor incompatibilities. However, if you do not want to turn this capability on for each of your virtual machines, you can use this wizard to identify which machines in your environment are compatible.

READ AND DOWNLOAD IT HERE!!!

Guide for migrating from Windows XP to Windows 7

2009-11-04T16:12:00.000-08:00

Do you need help with migrations from Windows XP to Windows 7?

Check Part 1 of 5 blogged by the Windows Team at:
Migrating from Windows XP to Windows 7 - Guidance for IT pros

Every day this week long-time Springboard technical contributor and Windows deployment insider, Jeremy Chapman, will post a blog about how to think about Windows 7 deployment projects. We debated on making this a whitepaper or a feature article, but to keep things less formal, we went with a multimedia blog series. This series won't just cover steps to publish images in your Windows Deployment Services environments, instead it goes much broader into the major steps of deployment all-up; from figuring out what applications and hardware you have to migrating files, managing applications, building images, incorporating drivers and automating stuff end-to-end. Jeremy has been a veteran member of the Microsoft Deployment Toolkit team and while he won't be posting the classic "1500 pages" of how-to content, he will stay on his quest for the elusive and often escalated-for "one-page paper" to migrate enterprise customers from Windows XP to Windows 7. Let's see if he can do it!

Server Core Remote Management How to...

2009-11-04T16:07:00.000-08:00

Sander Berkouwer announced a free eBook that was written by himself and Joachim Nässlander, this book will help you with some basics about possible configurations for remote management in Server Core.

GET IT NOW HERE!!!

Sysinternals retired NewSID

2009-11-04T15:47:00.000-08:00

Check it out the reasons why the Sysinternals NewSID tool has been retired from sysinternals in Mark’s latest blog which debunks the myth that having duplicate machine SIDs causes problems.

Read more HERE.

Sysinternals Updated Disk2vhd Disk2vhd v1.1 to Disk2vhd v1.3

2009-11-04T15:42:00.000-08:00

Back In October SysInternals gave us the Disk2vhd v1.1 (and I already used some times with excellent results) the announcement was made here at ENIACK, now SysInternals is back with the new version of the same tool “v1.3”.

The difference between Disk2vhd and other physical-to-virtual tools is that you can run Disk2vhd on a system that’s online. Disk2vhd uses Windows’ Volume Snapshot capability, introduced in Windows XP, to create consistent point-in-time snapshots of the volumes you want to include in a conversion. You can even have Disk2vhd create the VHDs on local volumes, even ones being converted (though performance is better when the VHD is on a disk different than ones being converted).
DOWNLOAD IT NOW HERE!!!

Exchange 2007 on Windows Server 2008 R2

2009-11-04T15:31:00.000-08:00

According with MS Exchange Team Blog, Exchange 2007 will be supported on Windows Server 2008 R2.

“We always talk about listening to customers and sometimes this is written off by many as 'marketing speak'. In fact, we do take feedback seriously and no input is more important to our engineering processes than your voice.”
“Earlier this year we made a decision in one direction, and due to the feedback we have received on this blog and elsewhere, we have reconsidered. In the coming calendar year we will issue an update for Exchange 2007 enabling full support of Windows Server 2008 R2. We heard from many customers that this was important for streamlining their operations and reducing administrative challenges, so we have changed course and will add R2 support. We are still working through the specifics and will let you know once we have more to share on the timing of this update.“

Introducing Windows Server 2008 R2 eBook Free Download

2009-11-04T15:27:00.000-08:00

TRUE, Microsoft Learning and MS Press folks have this eBOOK available for download here.

Introducing Windows Server 2008 R2 will help you to understand the new R2's features, capabilities including the improvements in Hyper-V, RDS virtualization, IIS the Web application platform and other interesting stuff.

GET IT NOW!!!

Active Directory Services KB Articles

2009-11-04T15:19:00.000-08:00

Active Directory Services KB Articles

975830
The memory usage of the Dns.exe process keeps increasing after you install hotfix 941672 on a computer that is running Windows Server 2003 SP2 and that has the DNS server role installed
972622
The Active Directory Application Mode index may become corrupted if you search the instance by using the LDAP virtual list view control
975792
Numeric host names cannot be resolved on a computer that is running Windows Vista or Windows Server 2008
969371
Error message when you run a command at the Command Prompt window in Windows Server 2008 Server Core: "The specified service does not exist as an installed Service"
975943
Error code when an application uses the CredSSP if the authenticated user account is a member of many security groups on a computer that is running Windows Vista or Windows Server 2008: "0x80090329"
976921
A DFSR propagation report logs the following error on a Windows Server 2008 domain controller: "Cannot open test file on the member The network path was not found."
976922
The "Run only allowed Windows applications" Group Policy setting displays no entries on a computer that is running Windows Vista, Windows Server 2008, or Windows 7
968929
Description of the Windows Management Framework on Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008
974522
A LDAP simple bind action fails on a domain controller that is running Windows Server 2008 if the distinguished name of the user account exceeds 256 characters
976427
Computers that are running Windows 7 or Windows Server 2008 R2 stop responding at a black screen if a screen saver is enabled
977110
How to select time zone for countries or regions that are not listed in Windows time zone list

Mark Russinovich: Inside Windows 7 Redux

2009-10-23T16:09:00.000-07:00

Check out Mark’s latest Channel 9 interview on Windows 7 and Windows Server 2008 R2 kernel changes, released today to coincide with Windows 7’s general availability. He talks about memory management, process reflection and more, and shows a couple of demos on a 256-processor system.

"Windows 7 is here, available to all for purchase and ships today with new PCs! To celebrate this momentous occasion for Windows and Microsoft, Technical Fellow Mark Russinovich joins me in a discussion that extends the great conversation we had last year on Windows 7 internals. In his previous C9 interview, Mark told us about many of the new additions to the Windows kernel which enable Windows 7 (and Windows Server R2) to scale to large numbers of processors. Well, removing the kernel dispatcher lock is not all that the great Arun Kishan did. He also developed a new scheduling mechanism known as Distributed Fair Share Scheduling (DFSS). Mark describes what this is and how it works."

Check it here:
Mark Russinovich: Inside Windows 7 Redux

Remote Desktop Load Simulation Tools

2009-10-16T13:39:00.000-07:00

After several customer requests, Microsoft has released the Remote Desktop Load Simulation tools to help you size your VDI deployments. Use Connect and give genuine feedback to the responsible teams.

The Remote Desktop Load Simulation toolset is used for server capacity planning and performance/scalability analysis.

In a server-based computing environment, all application execution and data processing occur on the server. Therefore it is extremely interesting to test the scalability and capacity of servers to determine how many client sessions a server can typically support under a variety of different scenarios. One of the most reliable ways to find out the number or users a server can support for a particular scenario is to log on a large number of users on the server simultaneously. The Remote Desktop Load Simulation tools provide the functionality which makes it possible to generate the required user load on the server.

Enjoy!!!

Boot From VHD and run Hyper-V in your Windows 7 box

2009-10-16T13:34:00.000-07:00

Keith Combs wrote an excellent article about the How to boot from vhd in windows 7 and run Windows 2008 R2 with Hyper-v.

Keith wrote:
If you are running Windows 7 today, there’s no reason to tear down your machine, re-partition your drive, and reinstall your world. Instead, you can simply install Windows Server 2008 R2 into a .VHD file and make it bootable. After that is accomplished you can choose the OS you want when you power up your machine. The following steps are the simplest way (currently) to do this. It really doesn’t get any simpler.

Read more here.

Disc imaging can be a BAD THING in Windows World.

2009-10-16T13:26:00.000-07:00

Why disc imaging can be a BAD THING in Windows World.

Many issues in Windows are caused by unsupported methods to Backup/Restore/Deploy procedures, Microsoft provides several methods to perform a correct deployment of the Windows operating system, but unfortunately some IT Professionals still don't understand why this is a BAD thing, to explain the details, MS has a KB that was updated today and that everyone should read before starting to deploy Imaging in their networks.

Remember, the use of a supported method is very important to make sure that the security of the systems that are running Windows is not compromised and that you don't run into issues that are caused by this technique.

Check KB162001

:)

Open Source PowerShell Cmdlet and Help Designer

2009-10-16T12:59:00.000-07:00

PowerShell Cmdlet and Help Designer now available for download at CODEPLEX.

The Cmdlet Designer makes it much easier for teams to concentrate on the design, naming, and consistency of their cmdlets, while also guaranteeing name registration and collision avoidance across a project.

To sweeten the deal, it offers:
-Integrated help authoring
-Efficient bulk operations (parameter and cmdlet cloning)
-Generation of cmdlet code
-Full scripting support
-Automatic code-spec comparison and testing
-Role-based security, history logging, and more.

Architecturally, the Cmdlet Designer offers a reference implementation to benefit developers as well:
UI on top of Cmdlets
UI extensibility through scripting
Cmdlet / Webservice interaction
Role-based security, with a trusted subsystem implementation

Enjoy!

Technet - Live Migration Networks

2009-10-14T15:13:00.000-07:00

Confused about which network does what with live migration? Problems determining how many networks you need for cluster shared volumes? This screencasts discusses how networks are used when live migration is configured with cluster shared volumes and shows which parameters you can configure to control traffic.$0 You can find more details on Giovanni's blog.

Cluster Validation Error due duplicate GUID information

2009-10-14T15:03:00.000-07:00

The ASK Core Team recently blogged about an error that may occur in clusters if you use imaging to deploy servers without using sysprep.

The error:

Failover Cluster Validation Firewall Error in Windows Server 2008 R2

“An error occurred while executing the test. There was an error verifying the firewall configuration. An item with the same key has already been added”

Lesson learned, always use supported methods (Like Sysprep) to deploy the servers, especially when using imaging or disk rollback procedures

Windows 2008 R2 problems with HP Drivers

2009-10-14T14:29:00.000-07:00

I decided to share with you some issues that I experienced with HP servers when upgrading to Windows 2008 R2. I discover that some settings that were working perfectly in Windows 2008 didn’t worked any more after I introduce the recent Windows 2008 R2, no matter if I did a upgrade or a clean install. These problems were common to Full and Core installations. The most common errors were:

Hyper-V servers (when adding new switches):
Error Applying New Virtual Network Changes

Setup switch failed.
Information is no longer available about this task because the object that monitors the process no longer exists. This may occur when many tasks are being processed.

After the process failure and consequent retry to get the vswitch on the correct NIC I got:

(Note:You also have some solutions in this POST to clear this error)

Error Applying New Virtual Network Changes

Binding to the external Ethernet
Cannot bind to the external Ethernet < NIC description> because it is already bound to another virtual network.

Hyper-V servers (when removing switches):

You might not have permissions to perform this task

Upgrading Servers (When running the NCU update):

The NCU setup sometimes fail to install/or upgrade and in some servers I had to stop some services in order to get the NCU installed (action that I would later regret).

Cluster Errors:
The operation has failed.

Error in Validation. (Note: Some possible issues are also described in this POST)

Clusters creation Errors:

In Clusters, although the validation process ended ok, the process to create the cluster fails with the error:
Validating installation of the Network FT Driver on node .
Unable to successfully cleanup.

*************************************************

When I started to debug these problems I notice that they all had one thing in common, they were all network related problems.

Hum…

Ok, let’s start from the beginning, I checked the latest Firmware and Software (HP supported versions for Windows 2008 R2) and everything was fine, I was using the Smart Start 8.30 (18 Aug 2009) and I also did the upgrade for the latest Firmware version 8.60 (10 Aug 2009). Although everything seemed OK, the fact was that I still had those issues.

So, what to do next?

After several tests I come up with several conclusions to make this work, I’m not going to explain all of them nor am I going to explain in detail about the details of the processes. Instead I’m going to give you the easier way to implement and to get things done until HP solves this problem and hopefully give us an UPDATED version of some drivers and other software.

After several tests I concluded that these Network problems are ALL related with the drivers that are included in the Smart Start CD 8.30 (yep, the version that HP says that is supported to Windows 2008 R2). Most of these drivers and software have the date of August 2009, but it seems that they were not tested carefully enough to guarantee the minimum quality in order to function correctly in Windows 2008 R2. Yes I know, it’s October 2009 and things haven’t change.

That said, let’s start:

1- Before anything else, use the Firmware CD 8.60 or later and boot from the CD. In order to get HP support you need to update ALL existing hardware to the most recent firmware version.

2- After that, use the Smart Start CD 8.30 or later (hopefully when you read this HP already has an update version and you probably don’t need to follow this procedure) to start the server and installation process. After boot process the Smart Start CD stats a wizard and you’ll get a number of questions regarding to server name, organization, etc… when you get the option to choose the Installation mode, choose “CUSTOM”, this will allow you to choose what components you want to install at the end of Windows installation.

3- When the installation finishes a wizard is presented that will allow you to install the components available in the PSP, this will allow you to choose exactly what components you wish to install. In that Screen exclude the NCU (Network Configuration tool) from the driver/software installation process (you may also exclude the NICs if you want). If you don’t exclude the NCU at this step of the process you will probably have problems with network communications depending of the roles that you plan to install on that server.

4- The next step is to get the most recent version of the NICs drivers available online. DO NOT USE THE SMARTSTART CD 8.30 drivers or the DRIVERS that ARE ONLINE AT HP WEBSITE for the same version of the Smart Start CD 8.30; instead get the DRIVERS directly from the hardware provider (In my servers – Broadcom and Intel).

Note: I couldn’t get a version from Broadcom that specifically said that the driver was for Windows 2008 R2, instead I got the 12.26.02 version that has the date of 08/28/09 and according with Broadcom website this driver is for Windows 2008 x64. Intel already has drivers for Windows 2008 R2 for some NICs; you’ll need to check if your NIC is already on that list.

5- Be careful and take note of the date and driver version, I already had some servers that after the driver setup, the driver wasn’t properly updated as it should and I had to remove the driver, reboot the server and re-install it again. I also had scenarios (especially in server core) were I wasn’t able to perform the update because after driver removal, the NICs were lost and the only way to get them back (assuming Windows Full installs) was through the device manager. I had to use device manger to manually remove the NICs and them re-add them again using the option “Scan for hardware changes”, as you may know the device manger for server core installs can only be accessed remotely and is READ-ONLY, and the biggest problem in Server Core installs for this problem is that you don’t have a process that allows you to remove hardware in Cerver Core as you would in Full installs, so if that happens in you’re stuck, and you probably need to re-format the drive re-install the SO, the HP drivers and then perform the upgrade once again.

6- If server is going to be a Hyper-V server, remember that NCU should be only installed AFTER Hyper-V role is activated

(Note: NCU will also give you headaches and weird behaviors when used with wrong drivers, including those that ship with Windows and those that come in the Smart Start CD, multiple NICs, inability to change or remove them, communications issues, Hyper-V virtual switch errors, crashes, etc… are just some of the problems that you may experience with NCU and the wrong drivers).

7- Now that you’ve the correct version of the drivers and if you’re going to use that server with Hyper-V, it’s time to install the Hyper-V role, reboot and test. Assuming that you’re able to create/delete vswitchs without errors and your VMs can communicate through the interfaces you should be ready for NCU installation.

8- Use the latest version of NCU (at the moment I have the Ver.9.70). Install the NCU, reboot the server, and you should be ready to configure your first Team for the NICs. After creating the first NIC Team, try to create a vswitch on top of that new Team vInterface, after that make sure that a new NIC was created to the vswitch, test communications and finally test the removal of that vswitch, after removal recheck if the NIC that was created for the vswitch was also removed, if these tests were all OK, then you should ready to rock.

9- At this moment your problem should already be correct (at least temporarily until get the new versions of HP drivers/software, they know what is happening and I was told that they’re working on it).

10- If your server is going to be a cluster, my advice for you is this: “DO NOT INSTALL NCU – WAIT FOR THE NEW VERSION of NCU and NIC drivers that work with that new NCU”, if you do, and you start to get weird messages or problems when mounting new nodes like those explained at the beginning of this post, then you can say "Thank you" to the NCU.

Note: Sometimes even if you uninstall NCU the problems will NOT GO AWAY, the only way to get things working is to do a clean install or perform a manual removal of the tool, which can be very useful especially in Core installations. I also tried other technics like disable RSS, TCP Chimney, etc... I can tell you, in some scenarios I was able to solve the problem, in others not so well (again, this will depend of the role that the ser performs).

11- To finish this blog entry I wanted to say that when you decide that is time to move to Windows 2008 R2, do NOT go through the UPGRADE PATH (this will save you a lot of headaches), instead, and if possible, do a clean installation and them move the apps, Roles, etc.. to that server, I’m warning you, if go to the upgrade path, you may SORRY again and again like I did. If clean install is not an option, you should perform the upgrade in lab using an IDENTICAL SERVER (forget virtual servers especially if you need to perform hardware tests, use IDENTICAL HARDWARE), and them when possible, plan the move to a Windows 2008 R2.

Hopefully this will help you to understand and to recover from these errors.

Enjoy.

Hyper-V Error: Error Applying New Virtual Network Changes - Cannot bind to because it is already bound to another virtual network.

2009-10-11T11:02:00.000-07:00

Error Applying New Virtual Network Changes

Cannot bind to because it is already bound to another virtual network.

What is this error? What solutions do we have to solve this error in Windows 2008 R2 FULL installation and Core edition?

This error generally means that the “Microsoft Virtual Network Switch Adapter” is selected/in use by the physical NIC that you’re trying to use to configure your new Hyper-V virtual switch (vswitch). There’re many different reasons why this protocol may be selected, the most common are:

Because in fact you do have and vswitch assigned to that physical card, and before you use that NIC to add a new vswitch you need to unbound it from the existing vswitch to add the new one.
You manually selected the “Microsoft Virtual Network Switch Adapter” under your NIC properties (Note: do not try to select Microsoft Virtual Network Switch Adapter as an attempt to bind that NIC to a existent vswitch or to create a new one, instead always use the hyper-v management console or the System Center Virtual Machine to create new vswitch, the same is true for existing vswitchs, DO NOT select this protocol on NICs that REPRESENT the VSwitch, remember only the physical NIC that HAS A VSWITCH bound should have this protocol selected).
You installed software to manage your NICs or Teams and now you’re having weird errors (as described in another post for HP servers) and when you attempt to repeat the process you get this error.

These are the most common ones.

How to solve this problem:

Note: Before proceed I suggest that you do a full backup of the system that you’re trying to repair, some procedures explained here will change configurations and some registry settings that may break other functionalities. Before removing any vswitch, make sure that you don’t have virtual machines assigned to it, if so, you’ll need to reconfigure those VMs to a new vswitch before those VMS be able to get network communications again, also be careful when unbinding the “Microsoft Virtual Network Switch Adapter” from a given physical NIC, if that physical NIC is associated with a vswitch and you remove the “Microsoft Virtual Network Switch Adapter” from it, the vswitch will not be able to function properly.

That said, let’s begin.

Identify if an existing vswitch is bound to the NIC that you’re trying use, if you already have a vswitch assigned to that physical NIC you need to use a different physical NIC to configure the new vswitch or unbound the existing vswitch before configuring the new one.

1 - First let’s identify the NIC GUID that is having problems. Open command prompt and type:

WMIC NICCONFIG GET Description,SettingID

The result will be something similar to this

In my scenario the GUID for the NIC is {F9A4CE20-59D1-4C64-BA39-6487862361A4}.

Note: The GUID will differ in your server.

2 - Using the Hyper-V Manager console (in core editions use the Hyper-V manager console to remotely connect to the physical host): Connect to the host that you’re trying to create the new vswitch, then in the right pane select the option “Virtual Network Manager”, after that a new window appears and will allow you to identify if the physical NIC is already in use by an existing vswitch.

3 - I don’t have any vswitch configured to use the physical NIC but I still get the error: In this scenario check if the “Microsoft Virtual Network Switch Adapter” is selected in the NIC that you’re using to configure your new Hyper-V virtual switch, from cmd type “ncpa.cpl”, this will open the network connections folder, right click in the NIC and check if the “Microsoft Virtual Network Switch Adapter” is selected, if it’s then unselect it and try again.

3.a - Unfortunately this is not an option in Core Installations, in Core installations you’ll need to use a tool called “nvspbind”. Download the tool to “c:\windows\system32” directory and from cmd type

“nvspbind.exe -n”

This will display NIC information, identify the NIC GUID (check step 1) and to remove the Microsoft Virtual Network Switch Adapter from it type “nvspbind.exe –u {GUID}” in this case would be:

“nvspbind.exe -u {F9A4CE20-59D1-4C64-BA39-6487862361A4}”

Ok ENIAC, nice tips but I still have the problem, what to do next??!!!

In some scenarios things can get pretty ugly and the previous tips may not be enough to solve this error, if that is your case take a deep breath and let’s continue…

Let’s try some global cleanup process. (Did you read the Note that I wrote at the beginning of solution process in this post? NO!!!! Now is a good time to go there and read it, it talks about backups and other things that you may want to be aware of).

The first one is to use a tool called “nvspscrub.js”. Download nvspscrub.js then from cmd run: “cscript nvspscrub.js”, this will delete all vswitches, virtual NICs in the parent partition and will unbind the switch protocol from all physical NICs.

Run the tool, reboot the server and try again…

If the “nvspscrub.js” didn't work for you then you can try the last resource tool. The netcfg tool (use this procedure as last resource only). You can use this tool to install/uninstall Network Protocols, services and clients. From cmd type:

netcfg -u vms_pp

This will uninstall switch protocol and will remove it from all your NICs as well.
Reboot the server then from cmd type:

netcfg -l c:\windows\winsxs\amd64_wvms_pp.inf_31bf3856ad364e35_6.1.7600.16385_none_beda85050b13680c\wvms_pp.inf -c p -i vms_pp

This will install the protocol again and make it available to use on the NICs but by default will disabled in all NICs.

Reboot the server and try again…

To end this blog entry, and especially because this can be useful in core installations, I will show you some registry entries that may help you to identify where the NICs are their configuration, vswitches and NICs associated, etc... I suggest that DO NOT use the registry to remove or change any configuration mentioned before, instead use the tools or the cmds provided in the previous steps.

The first one is the:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}

Under this path you can find all your existing NIC adapters, the Microsoft Virtual Network Switch Adapter (vms_mp), etc… Scrolling down to the numbers listed under this path you’ll find the interfaces that exist in your server and some properties associated with it. You can also find some configuration definitions, like bounded protocols, GUIDs, file driver path, etc (Note: these numbers will differ from server to server).

Under 007\ you can find some interesting information about the physical NIC that I repaired in previous steps. Here I can identify some useful information like DriverDescription, Version, InfoPath, GUID, etc…

Under 007\Linkage, I can find what protocols are bound to this interface:

If the physical NIC had a vswitch associated with it, only “VMSP” would be listed like this.

The next registry path that you may want to know about it is the:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VMSMP
and
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VMSP

Here you’ll find information about listed physical NICs in use, Virtual Switches and some properties. For example, when you are using a given physical NIC with vswitch, the physical NIC GUID should be listed under:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VMSP\Linkage\

“Bind” & “Export” & “Route” as the picture shows, additionally that same NIC GUID will also appear in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VMSMP\Parameters\NicList\/DEVICE/{GUID}

Also note the difference between how a physical NIC (starts with /DEVICE/{GUID}) is listed under NicList and how a vswitch (starts with GUID) is listed in the same path.

Hopefully this blog entry will help you to resolve the error “Cannot bind to because it is already bound to another virtual network.” and also help you to identify where some connections properties and vswitches definitions are stored using the registry which can useful when using windows core installations.

nvspbind can be found here
nvspscrub can be found here

Have Fun!!!

Exchange 2010 RTM!

2009-10-09T06:04:00.000-07:00

The big news today is that Exchange 2010 is now code complete. The senior leadership team has signed off on the final code, and it has been sent to early adopters for a final look before its public release.

Read more here

Free Exchange 2010 Learning

2009-10-08T10:11:00.000-07:00

Check it out some free resources for Exchange 2010 Learning posted at Arlindo's blog

Here are the links to all of this free content:

Free Silverlight Learning Snacks:
- Unified Messaging in Exchange 2010
- High Availability and Storage in Exchange 2010
Free PrePress Chapter Downloads:
- Free Chapters from Exchange 2010 Administrator’s Pocket Consultant
o Chapter 1: Exchange Server Administration Overview AND Chapter 6: Mailbox Administration
Free eLearning Clinics:
- Collection 6899: Exploring Features in Exchange 2010 (2-hours)
- Collection 6900: Introduction to Exchange 2010 (1-hour)
- Collection 6901: Exchange Server 2010 in an Enterprise (1-hour)
Microsoft’s Exchange Server 2010 Learning Portal:
- www.microsoft.com/learning/exchange

Windows 7 Guides

2009-10-08T10:02:00.000-07:00

Here's some useful documentation for Windows 7

Building a Standard Image of Windows 7 Step-by-Step Guide
Automated Installation To Upgrade Windows 7 Step-by-Step Guide
Automated Installation of Windows 7 Overview
Upgrading to Windows 7 for Small and Midsize Businesses
Windows XP to Windows 7 Hard-Link Migration of User Files and Settings
BranchCache Deployment Guide for Windows Server 2008 R2 and Windows 7

Sysinternals new Tool Disk2vhd v1.0

2009-10-07T16:41:00.000-07:00

Disk2vhd is a utility that creates VHD (Virtual Hard Disk - Microsoft’s Virtual Machine disk format) versions of physical disks for use in Microsoft Virtual PC or Microsoft Hyper-V virtual machines (VMs). The difference between Disk2vhd and other physical-to-virtual tools is that you can run Disk2vhd on a system that’s online. Disk2vhd uses Windows’ Volume Snapshot capability, introduced in Windows XP, to create consistent point-in-time snapshots of the volumes you want to include in a conversion. You can even have Disk2vhd create the VHDs on local volumes, even ones being converted (though performance is better when the VHD is on a disk different than ones being converted).

Disk2vhd runs Windows XP SP2, Windows Server 2003 SP1, and higher, including x64 systems.
Check more here

Well done Mark :)

RedHat Support for Hyper-V

2009-10-07T16:32:00.000-07:00

Microsoft announced that they have completed a mutual support program with RedHat.

Now we have support for both enterprise Linux platforms on Hyper-V; SUSE being the other one. And both can be monitored from hardware to service using Operations Manager 2007 R2.

Details:
- Red Hat Enterprise Linux 5.2, 5.3, 5.4 have passed cert tests when running on Windows Server 2008 Hyper-V, Microsoft Hyper-V Server 2008, Windows Server 2008 R2 Hyper-V, Microsoft Hyper-V Server 2008 R2. See more at RedHat's certified hardware site.

- Windows Server 2003/ Windows Server 2008 / Windows Server 2008 R2 are validated to run on Red Hat Enterprise Linux 5.4, using their KVM-based hypervisor. See more at Microsoft Server Virtualization Validation Program site.

Windows 2008 R2 Cluster Error: The Argument is null or empty String

2009-10-05T13:10:00.000-07:00

One of these days I got this error when configuring a Hyper-V Cluster (To create a cluster in Windows 2008 R2 check my previous post here).

Error:
The Argument is null or empty String.
Parameter name: Domain Name

What the Heck !!! The cluster validation went without problems, what could be the cause of this error??!!

Try the following:
1 - Make sure that your NIC DNS settings contain the correct IP for your domain DNS servers.
2 - Make sure that the option "Register this connection's address in DNS" is selected in ALL NODES of the CLUSTER. By default this option is selected.
3 - In more complex domain environments, depending of your Domain/and/DNS design you may need to select the option "Append these DNS suffixes (in order)" and then manually enter the FQDN of your domain name and if needed of other existing domains. You may start only with your FQDN and then you can latter add the other ones.
4 - If you have multiple NICs, disable all except the one, review DNS settings and try again, doing this will help you to isolate the root cause of the problem, and if success, review the configurations on these NICs (FW, IPAddress, Routes, etc...).
5 - Reboot the server and check if the server correctly register his DNS IP on your DNS servers.

Hum... Okay ENICKB, but and if I'm in a Windows 2008 R2 Core Edition?
If you're in a Core Edition you need to change the registry accordantly

Register this connection's addresses in DNS is located at:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{Interface GUID}\ RegistrationEnabled
and change the value from "0" to "1".

Note: Your {Interface GUID} will differ from those in the picture. Additionally you may need to configure this setting in one or more NICs.

Append these DNS suffixes (in order)":
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\SearchList

Additional note, when using the cluster wizard to add nodes of the future cluster try adding them using the FQDN of the servers, but remember, even if you add the NetBIOS Name of these servers, when you press enter they should be changed from NetBIOS format to FQDN.

Hopefully this will help you with your cluster creation successfully.

SCVMM 2008 R2 KB 971677

2009-09-28T16:42:00.000-07:00

KB 971677 discusses an issue when a Hyper-V differencing disk that you create in Windows Server 2008 R2 cannot be used in Windows Server 2008.

Note: you need to click in "request hotfix" on top of KB page to request the hotfix for this specific error.

A server error occurred while you try to import the virtual machine. Failed to import the virtual machine from import directory ''. Failed to add device 'Microsoft Virtual Hard Disk'. Cannot open attachment '\Filename.vhd'. Error: 'The file or directory is corrupted and unreadable.'Cannot get information for attachment '\Filename.vhd'.

SCVMM 2008 R2 & Read Only Domain Controller

2009-09-28T16:33:00.000-07:00

Although it is not a best practice, some people insist in having SCVMM hosted in RODCs. Have a look at some issues that you might encounter when doing this.

From SCVMM Team Blog
Using a Read Only Domain Controller as a Host in SCVMM 2008 and R2

A Read Only Domain Controller (RODC) can only be used as a Host if it was already a Host prior to being promoted. If a RODC needs to be used as a Host and was not previously managed by SCVMM, it will have to be demoted to a member server and made a managed Host prior to promotion back to RODC.
IMPORTANT: Although a Read Only Domain Controller can be used as Host in SCVMM, this is not the recommended usage of a Read Only Domain Controller.

KB975113 discusses an issue where a read only domain controller (RODC) can only be used as a Host if it was already a Host prior to being promoted. The link and title is below.

SCVMM 2008 R2 KB 974869

2009-09-28T16:18:00.000-07:00

KB974869 discusses some issues that might occur if the SCVMM 2008 agents from the original version of Virtual Machine Manager 2008 remain after you upgrade to SCVMM 2008 R2.

Solution:
Manually upgrade all remaining agents to Virtual Machine Manager 2008 R2.

Warning (2927)A Hardware Management error has occurred trying to contact server . (Unknown error (0x80338041))

Error 0x80338041: The SOAP XML in the message does not match the corresponding XML schema definition. Change the XML and retry.

Error (2927)A Hardware Management error has occurred trying to contact server . (Unknown error (0x80338001))

Error 0x80338001: The WS-Management service cannot process the request. The WS-Addressing action URI is invalid. Check the documentation for information on how to construct an action URI.

Read more at:
KB974869 - You receive a warning 2927 and an unknown error when you create a virtual machine from a VHD file after you upgrade to System Center Virtual Machine Manager 2008 R2

SCVMM 2008 R2 KB 975426

2009-09-28T16:12:00.000-07:00

KB975426 - Virtual machines cannot migrate from a Windows Server 2008 stand-alone server to a Windows Server 2008 cluster after you upgrade to System Center Virtual Machine Manager 2008 R2

This new KB discusses an issue where SAN migration may fail with error 1600 after upgrading to to System Center Virtual Machine Manager 2008 R2.

Error (1600)
VMM is unable to process one or more of the provided cmdlet parameters.

Recommended Action
Type Get-Help NO_PARAM -full to view a list of defined parameters and complete descriptions. Then try the operation again.

Windows 2008 R2 Blue Screen in HP Servers

2009-09-21T14:16:00.000-07:00

Today I was told about a possible problem when enabling Hyper-V Role on some HP Server models with Windows 2008 R2 installed, appears that the problem is well known in HP internal documents.

The solution:
So far sounds that disabling the disabling Intel Core C3 State option in the BIOS solves the problem.

After little Google search I found this in Minasi Forum

If you’ve this problem, please let me know if that solves your problem.

I already upgrade most of my environment to R2 version of Hyper-V including SCVMM 2008 R2. I waited for the supported version of HP firmware “ver. 8.60”/software/Drivers “ver.8.30” for HP DL380G5 servers, you can find them here, after applying the new firmware and drivers everything worked fine.

Terminals Open Source Connection Manager

2009-09-15T04:55:00.000-07:00

Directly from CODEPLEX this free tool is a secure, multi tab terminal services/remote desktop client that uses Terminal Services ActiveX Client (mstscax.dll).
CODEPLEX started this project from the need of controlling multiple connections simultaneously. It is a complete replacement for the Windows mstsc.exe (Terminal Services) client.

Terminals allows storing multiple remote connections of varying types (RDP, VNC, VMRC, Telnet, SSH1, SSH2, ICA Citrix, RAS and HTTP) you also have the possibility of arranging them by tags or in groups. Using Active Directory or scanning a range of IP addresses allows you to create new connections.

Terminals allow you to import RDP, vRD or MuRD files.

But there's more, check it out the System Requirements and the Download file at CODEPLEX, additionally check the Terminals 1.7 - Vista + 2008 Support.

Have Fun!!!

SCVMM 2008 R2 available for download at TechNet subscribers

2009-09-14T14:19:00.000-07:00

Finally here!
Since this announcement that I’ve been waiting to have System Center Virtual Machine Manager 2008 R2 at TechNet...
For all of you that were waiting for that day the good news arrived... we don’t need to wait anymore, the bits are available at TechNet subscriber download area. Assuming a medium/fast internet access you should have no “Time” problems to download the 3,395.68 (MB) of the ISO for the x64 Bit version of System Center Virtual Machine Manager 2008 R2, if your internet access is slow or if you’re at some place were internet access is not very reliable, remember that you always have the download manager from TechNet that allows you to pause and resume the download whenever necessary.

SCVMM 2008 R2 new features available in my previous post here

If you don’t have a TechNet subscription you still have the evaluation download at Download Center site

But WAIT!!!! There’s more...
Don´t forget to check the new features, upgrade tips, etc.. Check my previous post at:
Useful Virtualization Documentation for MS R2 Products

Last week Microsoft released KB KB974869. According with them after upgrading to Microsoft System Center Virtual Machine Manager 2008 R2, when you try to create a new virtual machine from a VHD file that is stored in either a CSV file or in available storage you may receive Warning 2927 or error 0x80338041:
KB974869 - You receive a warning 2927 and an unknown error when you create a virtual machine from a VHD file after you upgrade to System Center Virtual Machine Manager 2008 R2.

Have Fun!!!

Getting started with vSphere Videos/Demos

2009-09-14T03:30:00.000-07:00

vSphere Videos/Demos:
Check Mike Laverick’s extremely valuable free vSphere videos. If you wish to learn more about vSphere these resources will help you with that. From basic steps to more complex scenarios, Mike does a pretty good job on his demonstrations. So there you go, for free you can get excellent content that you normally would have to pay for.

The book:
The main reason I put these videos together is as free supplement to my soon-to-be-released book on vSphere4, and to give people who by the book - a live on screen demo of the configuration - although you don’t have to buy the book to watch these videos. I find it’s often its easier to quickly show something than it is to do a 100 screen grabs and loads of text - but in the same instance videos don’t allow for long and details discussions of best practises and possible configurations. So if you want detail, get the book - but if you want quick high-level views of things - the videos slot into that…

Check it out here

Have fun!!!

PowerShell V2 new features

2009-09-09T14:24:00.000-07:00

Here it's an interesting video to learn how to start using some of the new features of PS 2.0

Have Fun!!!

Microsoft has released the MDT 2010

2009-09-09T14:02:00.000-07:00

Microsoft Deployment Toolkit 2010 is the newest version of Microsoft Deployment Toolkit, a Solution Accelerator for operating system and application deployment. MDT 2010 supports deployment of Windows 7 and Windows Server 2008 R2 in addition to deployment of Windows Vista, Windows Server 2008, Windows Server 2003, and Windows XP.

Deploy Windows 7 and Windows Server 2008 R2 with the newly released Microsoft Deployment Toolkit 2010. MDT is the recommended process and toolset for automating desktop and server deployment. MDT provides you with the following benefits:

- Unified tools and processes required for desktop and server deployment in a common deployment console and collection of guidance.
- Reduced deployment time and standardized desktop and server images, along with improved security and ongoing configuration management.
- Fully automated Zero Touch Installation deployments by leveraging System Center - Configuration Manager 2007 Service Pack 2 Release Candidate and Windows deployment tools. For those without a System Center Configuration Manager 2007 infrastructure, MDT leverages Windows deployment tools for Lite Touch Installation deployments.

What’s New in MDT 2010
Improvements to the newest version of MDT allow you to:
-Access deployment shares from anywhere on the network and replicate files and settings across organizational boundaries or sites.
-Organize and manage drivers, operating systems, applications, packages, and task sequences with an improved UI.
-Automate UI functionality using the Windows PowerShell command line interface.

The MDT 2010 solution accelerator is a free download You can download it here

Microsoft continues to support the previous version of MDT—Microsoft Deployment Toolkit 2008 Update 1. Customers still using MDT 2008 Update 1 can download the files from here.

If you're searching for script to automate the update process of MDT 2010 boot images in WDS have a look at the latest Michael Niehaus Post

You may also check Michael Niehaus other related posts to MDT.

Hyper-V Server 2008 R2 RTM Available for Download

2009-08-29T05:26:00.000-07:00

The free virtualization platform Hyper-V Server 2008 R2 is now available to download.
MS stand-alone free product has nice improvements regarding to V1 of the same product. Hyper-V Server 2008 R2 allows Live Migration, Hot add/remove virtual storage, support for 64 logical processors, support for running up to 384 virtual machines with up to 512 virtual processors, live migration across different processor SKU’s from the same vendor, Networking enhancements, Boot from flash, etc...

Try it at:
Microsoft® Hyper-V™ Server 2008 R2
Comparing Hyper-V Server V1 vs. V2

Useful Virtualization Documentation for MS R2 Products

2009-08-24T15:18:00.000-07:00

Virtual Machine Manager 2008 R2 is RTM!

2009-08-24T14:18:00.000-07:00

Great news,
40 days after Hyper-V R2 Microsoft released the System Center Virtual Machine Manager 2008 R2 RTM. A 180-day evaluation version is now available at Microsoft Download site. You can access it here. Volume licensing is set for October 1.

Windows Server 2008 R2 Hyper-V Host Management
- VMM 2008 R2 creates and manages virtual machines running on Windows Server 2008 R2 Hyper-V hosts. When you add a host that is running Windows Server 2008 R2 that does not have Hyper-V enabled, VMM 2008 R2 automatically enables the Hyper-V role on the host.

- VMM 2008 R2 supports the following new features of Windows Server 2008 R2:

Live migration between Windows Server 2008 R2 clustered hosts.
Network optimization detection during virtual machine placement. VMM 2008 R2 supports both Virtual Machine Queue (VMQ) and TCP Chimney, which are Windows Server 2008 R2 features that improve network performance for virtual machines.
Network adapters that support the VMQ feature are able to create a unique network queue for each virtual network adapter and then connect that queue directly to the virtual machine’s memory. This connection routes packets directly from the hypervisor to the virtual machine, bypassing much of the processing in the virtualization stack.
Network adapters that support the TCP Chimney feature are able to offload the processing of network traffic from the networking stack. Both of these features increase network performance and reduce CPU utilization.
Hot addition and removal of virtual hard disks (VHDs). In Windows Server 2008 R2, Hyper-V allows users to add and remove VHDs from a virtual machine while it is running.

Feature Bullet Summary:

Live migration
Clustered Shared Volume (CSV) support that enables multiple Highly Available Virtual Machines (HAVM) per LUN.
Hot add of storage
Support for VMware vSphere 4 (VMware VI3 feature parity only)
SAN Migration into and out of clustered hosts
Processor flexibility
Network optimization
Quick storage migration
Maintenance mode for hosts
Support for third party cluster file system, Sanbolic Melio FS
Support for third party storage class resource, Veritas Storage Foundation for Windows
Expanded support for iSCSI SANs
Support for VMware port groups for virtual switches
Support for Virtual Machine permissions assigned in Hyper-V
Dynamic policy based load balancing

SCVMM R2 RC Features in detail here.
TechNet Library on VMM2008 R2
What's New in Virtual Machine Manager 2008 R2

To learn more on the new features and capabilities of VMM2008 R2, please try to attend MS upcoming TechNet session "Technical Overview of System Center Virtual Machine Manager 2008 R2". Presented by Ms Technical Product Manager Kenon Owens, it will be chocked full of new and cool VMM 2008 R2 items. Go here to register for this Wednesday, September 09, 2009 (10:00 AM Pacific) event.

Microsoft Exchange Server 2010 Release Candidate

2009-08-19T16:22:00.000-07:00

Evaluate Microsoft Exchange Server 2010 Release Candidate today
Microsoft Exchange Server 2010 RC helps you achieve new levels of reliability and performance by delivering features that simplify your administration, protect your communications, and delight your users by meeting their demands for greater business mobility. And when you download the latest software, you're automatically registered to access valuable product resources assembled in one convenient location.
Please review the Microsoft Exchange Server 2010 system requirements before you proceed. Actual requirements and product functionality may vary based on your system configuration.

Microsoft Exchange Server 2010 Release Candidate

Overview
Microsoft Exchange Server 2010 Release Candidate helps IT Professionals achieve new levels of reliability with greater flexibility, enhanced user experiences, and increased protection for business communications.

Flexible and reliable - Exchange Server 2010 gives you the flexibility to tailor your deployment based on your company's unique needs and a simplified way to keep e-mail continuously available for your users.

Anywhere access - Exchange Server 2010 helps your users get more done by giving them the freedom to securely access all their communications - e-mail, voice mail, instant messaging, and more - from virtually any platform, Web browser, or device.

Protection and compliance - Exchange Server 2010 delivers integrated information loss prevention, and compliance tools aimed at helping you simplify the process of protecting your company's communications and meeting regulatory requirements.

Windowsn 2008 R2 Certificate Cervices

2009-08-19T16:12:00.000-07:00

Here it's some new Whitepapers from Microsoft regarding to Windows 2008 R2 Certificate Services.

SCEP - Simple Certificate Enrollment Protocol
Microsoft® Active Directory® Certificate Services in Microsoft Windows Server® 2008 R2 includes the Network Device Enrollment Service role service. This role service implements the Simple Certificate Enrollment Protocol. This white paper provides an overview of this role service in the Windows Server 2008 R2.

Microsoft SCEP implementation

Computer and User Certificates
The Windows Server® 2008 R2 Core Network Guide provides instructions on how to plan and deploy the components required for a fully functioning network and a new Active Directory® domain in a new forest. This companion guide to the Core Network Guide provides instructions on how to deploy client computer and user certificates with Active Directory Certificate Services (AD CS) and Group Policy. You can use client computer and user certificates to allow Network Policy Server (NPS) and Routing and Remote Access Service (RRAS) to authenticate users and computers when you deploy the following authentication methods for network access authentication: • Extensible Authentication Protocol with Transport Layer Security (EAP-TLS) • Protected EAP with TLS (PEAP-TLS).

Deploying Computer and User Certificates

Additional information from Active Directory Services Team:
Designing and Implementing a PKI

Virtualization WAR Update1...

2009-08-13T14:44:00.000-07:00

What!!! Just about one hour after I posting “Virtualization WAR…” I received some feedback about the fact that the Virtualization Team removed the post!!! and that post no longer existed… WHAT!!! After testing it my-self I found out that in fact the post was removed from Virtualization Team Blog.

What a heck!!! I waited, waited, and here it’s the Post again BUT with a new SOFT version of the facts…

What happened??!!! Perhaps too many strong words…

Nah.... One of the things that change was due the fact that Jeff forgot about Windows SP2... But even after that the results are:

-VMware ESXi 3.5 patch footprint alone (3.7 GB) is still 7% greater than Hyper-V Server 2008 RTM (using the 2.6 GB number VMware quoted), all its patches and Service Pack 2 COMBINED.

But Wait!!! There's more... Read the new version of Virtualization WAR UPDATE 1 (Hopefully we’ll not need to wait until SP1, eheheh…)

UPDATE!!!
PART 2
Hypervisor Footprint Debate Part 2: Windows Server 2008 Hyper-V & VMware ESX 3.5

UPDATE!!!
PART 3
Hypervisor Footprint Debate Part 3: Windows Server 2008 Hyper-V & VMware ESXi 3.5

Operations Manager 2007 R2 - Sizing Helper

2009-08-13T14:22:00.000-07:00

The OpsMgr 2007 R2 Sizing Helper is an interactive document designed to assist you with planning & sizing deployments of Operations Manager 2007 R2. It helps you plan the correct amount of infrastructure needed for a new OpsMgr R2 deployment, removing the uncertainties in making IT hardware purchases and optimizes cost. A typical recommendation will include minimum hardware specification for each server role, topology diagram and storage requirement.

Read More about it

Windows Server 2008 and Windows Server 2008 R2 Automate Metadata Cleanup

2009-08-13T14:07:00.000-07:00

Cool... Now in Windows 2008 and 2008 R2 you can Automate Metadata Cleanup, this is a cool feature that you can take advantage without the need of using the NTDSUTIL. Of course you can still use NTDSUTIL if you want or if you've 2003 systems.

Metadata cleanup is a required procedure after a forced removal of Active Directory Domain Services (AD DS). You perform metadata cleanup on a domain controller in the domain of the domain controller that you forcibly removed. Metadata cleanup removes data from AD DS that identifies a domain controller to the replication system. Metadata cleanup also removes File Replication Service (FRS) and Distributed File System (DFS) Replication connections and attempts to transfer or seize any operations master (also known as flexible single master operations or FSMO) roles that the retired domain controller holds. These additional processes are performed automatically. You can use this procedure to clean up server metadata for a domain controller from which you have forcibly removed AD DS.

On domain controllers that are running Windows Server 2008, you can use Active Directory Users and Computers to clean up server metadata. In this procedure, deleting the computer object in the Domain Controllers organizational unit (OU) initiates the cleanup process, which proceeds automatically.

Read More here

Virtualization WAR...

2009-08-13T10:00:00.000-07:00

AGAIN!!!!
Yep, in this post Jeff Woolsey from Microsoft explains the ESX(i) Footprint argument and other "Myths" as well

Interesting Statements from his post

- I'd like to point out that VMware touts ESXi as a 32 MB hypervisor, yet the download is over 200 MB. So, are we too assume that the other 170+ MB doesn't count?

-If you really want to focus on the disk footprint that matters, the amount of software that could be directly exposed to VM attack, the Hyper-V hypervisor and virtualization stack combined is about 20 MB, ~19.4 MB for the virtualization stack and ~600k for the hypervisor.

In short, VMware has focused on our entire footprint which is made up mostly of stuff that isn't exposed to VM traffic at all or only exposed indirectly, while ignoring the part that matters most and for which VMware doesn't have a strong track record.

- VMware ESXi 3.5 patch footprint alone (3.7 GB) is 42% greater than Hyper-V Server 2008 RTM (using the 2.6 GB number VMware quoted above) and all its patches COMBINED

-Not only did VMware ESXi have a 45x greater patch footprint, but they also had the most serious virtualization security flaws.

-So much for the disk footprint argument. How can the ESXi patch footprint be so huge?
Because VMware releases a whole new ESXi image every time they release a patch. Furthermore, because VMware releases a whole new ESXi image every time they release a patch it also means that every ESXi patch requires a reboot.

AUTCH!!!!

Windows 7 Remote Server Administration Tools

2009-08-13T09:46:00.000-07:00

Microsoft released Remote Server Administration Tools (RSAT) for Windows 7.
Download RSAT additionally check the installation/activation process.

Remote Server Administration Tools for Windows 7 enables IT administrators to manage roles and features that are installed on remote computers that are running Windows Server 2008 R2 (and, for some roles and features, Windows Server 2008 or Windows Server 2003) from a remote computer that is running Windows 7. It includes support for remote management of computers that are running either the Server Core or full installation options of Windows Server 2008 R2, and for some roles and features, Windows Server 2008. Some roles and features on Windows Server 2003 can be managed remotely by using Remote Server Administration Tools for Windows 7, although the Server Core installation option is not available with the Windows Server 2003 operating system.

RSAT features:

Server Administration Tools:
-Server Manager

Role Administration Tools:
-Active Directory Certificate Services (AD CS) Tools
-Active Directory Domain Services (AD DS) Tools
-Active Directory Lightweight Directory Services (AD LDS) Tools
-DHCP Server Tools
-DNS Server Tools
-File Services Tools
-Hyper-V Tools
-Terminal Services Tools

Feature Administration Tools:
-BitLocker Password Recovery Viewer
-Failover Clustering Tools
-Group Policy Management Tools
-Network Load Balancing Tools
-SMTP Server Tools
-Storage Explorer Tools
-Storage Manager for SANs Tools
-Windows System Resource Manager Tools

Supported Operating Systems:
Windows 7; Windows Server 2003; Windows Server 2008; Windows Server 2008 R2
Remote Server Administration Tools for Windows 7 can be installed on computers that are running the Enterprise, Professional, or Ultimate editions of Windows 7.

For detailed information about the tools available in Remote Server Administration Tools for Windows 7, and the supported operating systems at which they can be targeted, see Knowledge Base article 958830.

Windows Virtual PC RC and Windows XP Mode RC

2009-08-04T13:05:00.000-07:00

Microsoft has released Windows Virtual PC RC and Windows XP Mode RC. Windows Virtual PC provides the capability to run multiple Windows environments such as Windows XP Mode from your Windows 7 desktop.

To download Windows Virtual PC and the Windows XP Mode environment
Windows Virtual PC RC and Windows XP Mode RC

Windows Virtual PC: Documentation

Microsoft and Yahoo

2009-07-29T15:06:00.000-07:00

Yahoo! and Microsoft announced an agreement that will improve the Web search experience for users and advertisers, and deliver sustained innovation to the industry. In simple terms, Microsoft will now power Yahoo! search while Yahoo! will become the exclusive worldwide relationship sales force for both companies’ premium search advertisers.

Read more here

SCCM Step-by-Step Guide Operating System Deployment

2009-07-27T13:04:00.000-07:00

Today the Configuration Manager Support Team blog posted a step-by-step guide to perform OSD (operating system deployment) using SCCM 2007.

Check it here

Cluster SQL 2005 in Windows 2008 R2 RC

2009-07-26T15:57:00.000-07:00

In this demo I'll show you how to cluster SQL 2005 in a Windows 2008 R2 RC build.

In the demo I'll show you how to solve most of the common errors during setup process:
"The Virtual Server name you provided is not valid. To proceed, provide a virtual server name".
or
"You do not have privileges to add accounts to the domain groups specified for this failover cluster. Ask your domain administrator for privileges to add new accounts to the domain groups, or log on using an account that does have permission."
and others...

We'll also check how to cluster MSDTC in Windows 2008 R2 and configure the Firewall to allow Transactions.

Check how easy is to cluster SQL 2005 in Windows 2008 R2.

Note: The video doesn't show the configuration for SQL ports. To configure the firewall please check the following links:
Configuring the Windows Firewall to Allow SQL Server Access
For multi-homed SQL servers check:
How to Configure a Multi-Homed Computer for SQL Server Access

Enjoy :D

VMware finally warming up to EMC

2009-07-24T15:24:00.000-07:00

EMC has owned VMware since 2004, but for the most part, the two companies have continued to operate separately. Very separately.

That may be changing.
Read more here

Hyper-V Server 2008 R2: Bare Metal to Live Migration (In about an hour!)

2009-07-24T14:18:00.001-07:00

Check how Matt McSpirit Partner Technology Specialist at Microsoft UK, walks through a bare-metal installation of Hyper-V Server 2008 R2 (RC) on 2 physical nodes, hooks them up to an iSCSI SAN, configures the SAN storage, and then, from a Windows 7 (RC) laptop, validates, and builds a Hyper-V Server 2008 R2 (RC) Cluster. The end result? A Highly Available, Live Migratable, Virtual Machine.

Click here to see it.

Virtual Hard Disk Getting Started Guide

2009-07-24T09:23:00.000-07:00

This guide provides an introduction to virtual hard disks (VHDs) in Windows 7 and Windows Server 2008 R2. It includes an overview of technologies that you use to configure VHDs, as well as procedures to help guide you through deploying VHDs.
Click here

Performance & Tuning

2009-07-23T15:18:00.000-07:00

- Searching for important tuning parameters and settings that can result in improved performance for the Windows Server 2008 and Windows 2008 R2 operating system?
- Not sure how to use Performance Monitor?
- Memory Sizing Guidance for Windows 7?

Here are some docs that may help you to complete that task:
Performance Tuning Guidelines for Windows Server 2008
Performance Tuning Guidelines for Windows Server 2008 R2
Memory Sizing Guidance for Windows 7
Windows Performance Monitor (Applies To: Windows 7, Windows Server 2008 R2, Windows Vista)
Using Hardware Performance Counters on Windows

Have Fun :)

Finally... Windows 7 client and Windows Server 2008 R2, and Windows Server 2008 R2 Hyper-V standalone are RTM

2009-07-22T14:03:00.000-07:00

TRUE!!!
Finally Windows 7 and Windows 2008 R2 are RTM’d...
Congratulations Microsoft.

Read more:
Windows Server 2008 R2 Reaches the RTM Milestone
Windows 7 Has Been Released to Manufacturing
And also the new features of Hyper-V
Windows Server 2008 R2 & Hyper-V Server 2008 R2 RTM!!!!

Check this post to get some official dates.

Windows 2008 R2 & Windows 7 Upgrade Paths

2009-07-22T08:56:00.000-07:00

If you're one of those guys that are planning to upgrade your systems to Windows 7 or 2008 R2, Microsoft has released two documents that may help you about that task. In my opinion you should (when possible) perform migration instead of in-place server upgrades, but we don’t leave in a perfect world and sometimes things can’t be done the way we want. If you've no choice then these docs will help you to do things in the right way.

Check:

Windows 7 Upgrade Paths

Windows Server 2008 R2 Upgrade Paths

Windows 7 RTM? When?!!!

2009-07-21T03:11:00.000-07:00

Although it hasn’t been RTM’d, the Windows blog gave us some dates and sounds that this will happen between today and the first date listed.

Here's a quick Summary:
- OEMs will receive Windows 7 RTM software images 2 days after the official RTM date.
- August 6, 2009: Partners (ISVs and IHVs) can get it from Microsoft Connect or MSDN.
- August 7, 2009: If you are a Volume License (VL) customer with an existing Software Assurance (SA) license you will be able to download Windows 7 RTM in English starting August 7th via the Volume License Service Center (VLSC). Other languages available a couple of weeks after that.
- August 16, 2009: Microsoft Partner Program Gold/Certified Members will be able to download the English version. (Remaining languages available for these folks on October 1, 2009).
- August 23, 2009: Microsoft Action Pack Subscribers – English version of Windows 7 RTM. (Remaining languages available for these folks on October 1, 2009).

Read more here

Microsoft Assessment and Planning Toolkit available for download

2009-07-20T13:01:00.000-07:00

The Microsoft Assessment and Planning (MAP) Toolkit is an agentless toolkit that finds computers on a network and performs a detailed inventory of the computers using Windows Management Instrumentation (WMI) and the Remote Registry Service. This agent less and scalable toolkit has the ability to discover all computers within Active Directory and workgroup environments. It performs key functions that include hardware and device inventory, hardware compatibility analysis, and generation of actionable, environment-specific IT proposals for migration to most major Microsoft technologies.

Download it here

Hyper-V Integration Component drivers for Linux as Open Source

2009-07-20T12:54:00.000-07:00

What!!!
This is the first time that Microsoft has contributed code to the Linux kernel.
The Hyper-V Linux device drivers will be licensed under GPLv2. That's 20,000 lines of code that provide the synthetic device drivers and VM bus implementation needed for a Linux guest OS to run "enlightened" on either Windows Server 2008 Hyper-V or Microsoft Hyper-V Server 2008.

Read more here and here.

Windows 2008 / 2003 Cluster Documentation

2009-07-17T07:20:00.000-07:00

Check some Microsoft useful documentation for Clustering, Storage Manager for SANs , MPIO, etc... for Windows 2008 and 2003

Guide to Creating and Configuring a Server Cluster Under Windows Server 2003
Cluster Configuration Best Practices for Windows Server 2003

Failover Cluster Step-by-Step Guide - Configuring a Two-Node File Server Failover Cluster

Windows Server 2008 Clustering Whitepapers
Storage Manager for SANs Step-by-Step Guide
Windows Server High Availability with Microsoft MPIO

How to Disable IPv6 in Windows 2008 Full and Core editions

2009-07-14T03:32:00.000-07:00

IPv6 is by default enabled in Windows Vista and Windows 2008. Many people argue that they’re having issues because they’re not using it and some apps may fail to work correctly due the fact of miss IPv6 configuration address or because the Apps don't understand IPv6. Before disabling IPv6 be aware that some new features on windows will require IPv6 to work, so be aware of that before starting to make changes to your servers or workstations.

So how to disable IPv6?
Simple, first disable IPv6 under your NIC properties (if you've multiple interfaces do it for each one)

To completely disable IPv6 go to the following registry (Remember to ALWAYS backup the registry keys that you're changing before changing the):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tcpip6\Parameters\

Create the following registry value (DWORD type): DisabledComponents

Note that “DisabledComponents” is case sensitive and should be typed exactly like that.
DisabledComponents is set to 0 by default. To disable IPv6 support on all interfaces, set the value to FFFFFFFF. The registry entry will look like below:

Restart the computer for the changes to the DisabledComponents registry value to take effect.
DONE!!!!

Okay, fine, but... and if I have a Windows Core version?!!!!

In Windows core edition we don’t have GUI to disable the IPv6 under NIC properties, so option is to directly edit the registry.

To start lets try to disable IPv6 only in one adapter as if we were in a FULL installation mode :)
First let's identify the adapter to be disabled, to do that type:

WMIC NICCONFIG WHERE IPENABLED=TRUE GET Description,SettingID,IPADDRESS /FORMAT:LIST

Identify the NICs that you want to disable IPv6.

In this scenario I want to disable the interface that has the ipv4 "1.1.1.3" and IPv6 "fe80::9d2d:fc06:8abd:44ef"

The interface SettingID is "{93145725-C49B-4A42-87F0-415B6335D211}"
(Remember, always backup your registry before making any changes).

Then type regedit to open registry editor and navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Linkage
Open the “Bind”, “Export” and “Route” String Values and remove the Adapter SettingID that corresponds to the listed NIC that you want to unbind IPv6.

(in this scenario is the Adapter ID {93145725-C49B-4A42-87F0-415B6335D211})

Then navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}
Now you need to identify where youre NIC is at... To do that select the subkeys "0000", "0001", "0002" and so on untill you get desired NIC, to identify the NIC, you need to know the Description and SettingID that we get from WMIC cmd, then compare the values, if they match you're on the right place. In this scenario the Description is "HP NC364T PCIe Quad Port Gigabit Server Adapter" and the SettingID is "93145725-C49B-4A42-87F0-415B6335D211"

As you see the correspondent value is "0005"

The next Step is to unbind the Tcpip6 from the adapter, to do that open the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\xxxx\Linkage\UpperBind key and remove the entry for Tcpip6.

After the change:

Reboot the server.
After the reboot, type from cmdline:
WMIC NICCONFIG WHERE IPENABLED=TRUE GET Description,SettingID,IPADDRESS /FORMAT:LIST
Now, as you can see you no longer have the IPv6 bound the that adapter.

DONE!!!!

Q&A
Q: And if I want to do this for more adapters?
A: Repeat the same process for each adapter that you want to disable IPv6.

Q: Can I use the “DisabledComponents” reg key as I did in Windows FULL edition?
A: Yes you can. In that Scenario you need to remove all the values from “Bind”, “Export” and “Route” that are under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Linkage, then, configure the “DisabledComponents” reg key as you did in Windows FULL edition under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tcpip6\Parameters\ .
(No need to disable Tcpip6 under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\xxxx\Linkage\UpperBind )
You must restart the computer for the changes to the DisabledComponents registry value to take effect.

Q: Do you know any issue when using "DisabledComponents" in Windows Core?
A: Yes. after you configure the DisabledComponents in windows Core and reboot, if you use Computer Management to remotely connect to that server Core you may see a warning for the 6TO4 Adapter - "This device cannot start. (Code 10)".

To solve this problem you need to disable the 6TO4 adapter (since that you're not using it) using the Netsh cmdline:
IMPORTANT:
You must do this before you configure the DisabledComponents reg key!!!
The correct order is:

- Clear the DisabledComponents reg key (if it is configured).
- Reboot the server.
- From cmdline type: <netsh in 6to4 set state disable>

- Configure the DisabledComponents reg key
- Reboot the server.
- Use the Computermanagement to remotely connect to the server core and confirm that everything is ok now.

IF this doesn't solve your problem you've another option:
(Warning: the next procedure is to uninstall the 6TO4 adapter from your system, you may have problems by doing that, and I rather disable than removing it, proceed at your own risk)

Okay let's assume that the previous procedure didn't solved the 6TO4 adapter warning, the additional option is to uninstall it from the system.

- In Windows 2008 FULL edition, you need to open the device manager, then right click in the adapter and choose the option "uninstall". Then reboot the server and the error should be fixed.

- How do I uninstall this device in Windows Core Edition? Simple, from command line type:
netcfg -u *6to4mp
Then reboot the server and the error should be fixed.

Q: After I fix the 6TO4 adapter warning, I decided that I want that adapter back but I can't ...
A: You need to remove the setting for "DisabledComponents" and remove all the values from “Bind”, “Export” and “Route” that are under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Linkage
Then
If you disabled the adapter: you need to enable it again using the following cmd:
Netsh i 6TO4 set state enable, after that Reboot the server

If you uninstalled the adapter: Just reboot the server.

As final note, you may want to reconfigure your Hosts File and disable the Localhost for IPv6 by placing a "#" before ::1 Localhost, then save the file...

Additional Information:
From: http://technet.microsoft.com/en-us/library/bb878057.aspx
The DisabledComponents registry value is a bit mask that controls the following series of flags, starting with the low order bit (Bit 0):

Bit 0 Set to 1 to disable all IPv6 tunnel interfaces, including ISATAP, 6to4, and Teredo tunnels. Default value is 0.
Bit 1 Set to 1 to disable all 6to4-based interfaces. Default value is 0.
Bit 2 Set to 1 to disable all ISATAP-based interfaces. Default value is 0.
Bit 3 Set to 1 to disable all Teredo-based interfaces. Default value is 0.
Bit 4 Set to 1 to disable IPv6 over all non-tunnel interfaces, including LAN interfaces and Point-to-Point Protocol (PPP)-based interfaces. Default value is 0.
Bit 5 Set to 1 to modify the default prefix policy table to prefer IPv4 to IPv6 when attempting connections. Default value is 0.

To determine the value of DisabledComponents for a specific set of bits, construct a binary number consisting of the bits and their values in their correct position and convert the resulting number to hexadecimal. For example, if you want to disable 6to4 interfaces, disable Teredo interfaces, and prefer IPv4 to IPv6, you would construct the following binary number: 101010. When converted to hexadecimal, the value of DisabledComponents is 0x2A.

The following table lists some common configuration combinations and the corresponding value of DisabledComponents.

Configuration DisabledComponents value
Disable all tunnel interfaces 0x1
Disable 6to4 0x2
Disable ISATAP 0x4
Disable Teredo 0x8
Disable Teredo and 6to4 0xA
Disable all LAN and PPP interfaces 0x10
Disable all LAN, PPP, and tunnel interfaces 0x11
Prefer IPv4 over IPv6 0x20
Disable IPv6 over all interfaces and prefer IPv4 to IPv6 0xFF

Have Fun :P

SCVMM 2008 R2 - Quick Storage Migration

2009-07-13T05:51:00.000-07:00

Here's an interesting article about some of the new functionalities in SCVMM 2008 R2.
Quick Storage Migration (QSM) is one of the new cool features included in SCVMM. This feature enables the migration of the storage of VM from one location to another, for example, the migration between different SANs.

But How How QSM Works works?
Edwin Yuen explains that here...

Windows Server 2008 R2 Core SCONFIG

2009-07-13T05:23:00.000-07:00

Are you using Windows Core edition? Are you having trouble configuring it?

Windows 2008 R2 will have the SCONFIG to help you with some of the most common tasks on Server Core.

SCONFIG will help you with:

-Domain join
-Rename Computer
-Configure Remote (Enable management via Server Manager, & PowerShell including properly configuring the firewall.)
-Configuring Windows Update
-Enabling Remote Desktop (in case you want to login remotely.)
-Configuring Networking (static vs. DHCP and for multiple NICs)

All you have to do is type sconfig at the command line.

SCONFIG is also localized in almost 20 languages

Still in Windows 2008?
Don't worry, and check some similar tools:

SCregEdit.wsf - Script Built with server core, all you have to do is type from cmd:

C:\Windows\System32>cscript SCregEdit.wsf
or
C:\Windows\System32>cscript SCregEdit.wsf /CLI

From codeplex you also have the core configurator:
Windows 2008 Server Core Configurator
or
"Another" Core Configurator (although I never used it) GUI version

Have fun :D

Windows Firewall DOCs

2009-07-13T05:11:00.000-07:00

Here's some Microsoft documents for Windows Firewall.

Introduction to Windows Firewall with Advanced Security
Windows 7 Network Location
HomeGroup and Firewall Interaction

Those documents covers Windows Firewall with Advanced Security in Windows 7, Windows Server 2008 R2, Windows Vista, and Windows Server 2008, additionally you have details how HomeGroup interacts with firewalls, using Windows Firewall as an example.

Hyper-V & SCVMM Error: 12700 / (0x8005) Migration Failed

2009-06-24T17:08:00.003-07:00

Today I was testing the migration between my Hyper-V server clusters and the non-clusters Hyper-V.

The first step was to migrate from the cluster to a non-cluster server using SCVMM. The process went very well and the machine was successfully migrated between both hosts...

Then I decide to do the other way around... When the process was at 49% it crashes with the following error:

Error (12700)
VMM cannot complete the Hyper-V operation on the hv01srv.domain.tld server because of the error:
Import failed because the virtual machine must have a new identifier. Select a new identifier and try the import again.
(Unknown error (0x8005))
Recommended Action
Resolve the issue in Hyper-V and then try the operation again.

Additionally you get the EVENTID 18070 on the host where you perform the operation:
Log Name: Microsoft-Windows-Hyper-V-VMMS-Admin
Source: Microsoft-Windows-Hyper-V-VMMS
Date:
Event ID: 18070
Task Category: None
Level: Error
Keywords:
User: SYSTEM
Computer: hv01srv.domain.tld
Description: Import failed because the virtual machine must have a new identifier. Select a new identifier and try the import again.

GREAT!!!!

Before telling you how to solve this, let me tell you that you can always rollback the migration process by right-clicking in the VM and choose repair and then select the Undo option and press OK. So don't panic!!!

This problem occurred because when I did the migration from the HV Cluster to the Non-HV server, the file {GUIG}.xml) that identifies the VM was not deleted from cluster node. The file is in the "C:\ProgramData\Microsoft\Windows\Hyper-V\Virtual Machines\{GUIG}.xml"

Note: By default the ProgramData Folder is hidden, to view this folder you must activate the option "Show hidden folders and files" under folders option menu.

Solution:
To solve this error, delete the duplicated file in the destination server (if you're in a cluster configuration you may need to check all the nodes before retry the migration).

How do I know the file to delete?

Simple, on the source server open the:

"C:\ProgramData\Microsoft\Windows\Hyper-V\Virtual Machines\"

Do the same for the destination server and open:

"C:\ProgramData\Microsoft\Windows\Hyper-V\Virtual Machines\"

Now, find the file that is duplicated in both sides:

After identification of the given xml file, on the destination server, delete the duplicated file and retry the migration again and you should be able to succeed this time.

Finishing the migration process at 99% after the change...

I ran search for a fix or explanation for this behavior, but I did not find anything that explains this, I'll try to update this post latter with a possible MS fix or explanation.

Hyper-V & SCVMM Error: 0x80070057 Import / Export Virtual Machine

2009-06-24T17:08:00.001-07:00

Today I tried to import a VM using the Hyper-V mmc console that I exported some time ago to later use. When I tried to do that I got the error:

Hyper-V Manager
A server error occured while attempting to import the virtual machine.
Failed to import the virtual nachine from directory %directorypath%.
Error: One or more arguments are invalid (0x80070057).

The solution to fix this error is to clear the ScopeOfResidence value and you should be able to import the same machine again with no errors.

To do that, go to the the VM path folder, then open the {GUID}.exp file (generally under "drive:\pathtovm\vmname\Virtual Machines\"). Open the .exp file
In this case clear the value for 9c62b993-f3e9-44fc-80e1-f798f8bbe17f :

Save the file and import the machine again.

DONE!

TIP: Suppose that you sysprep a VM and exported that VM to latter use. Now you duplicated that exported VM into 10 VMs (VM01, 02, 03 ...). When you try to import that VM you get this error, what to do?

2 options:

You can correct the ScopeOfResidence value for the original VM (the exported VM) and then duplicate that VM to 10 VMs as you did.

You can correct the ScopeOfResidence value on the first duplicated VM (VM01) and then copy that *.exp file to all other VMs (VM02, 03 ...). Will this cause trouble with duplicated *.exp file names? No as long as you don't use the option "Reuse old virtual machine IDs", because when you import that VM, Hyper-V will change the value of those files to a different {GUID}.xml file.

After solving this one, I went to internet and did a search for a MS KB about this problem, and I found additional information under KB968968 that states this problem for Hyper-V and System Center Virtual Machine Manager (SCVMM) scenarios.

Additionaly they provide a script to use on a Hyper-V server before you import a virtual machine to the Hyper-V server

*****************************************************

Option Explicit

Dim WMIService
Dim VMList
Dim VM
Dim VMSystemGlobalSettingData
Dim VMManagementService
Dim Result

'Get instance of 'virtualization' WMI service on the local computer
Set WMIService = GetObject("winmgmts:\\.\root\virtualization")

'Get a VMManagementService object
Set VMManagementService = WMIService.ExecQuery("SELECT * FROM Msvm_VirtualSystemManagementService").ItemIndex(0)

'Get all the MSVM_ComputerSystem object
Set VMList = WMIService.ExecQuery("SELECT * FROM Msvm_ComputerSystem")

For Each VM In VMList
if VM.Caption = "Virtual Machine" then
Set VMSystemGlobalSettingData = (VM.Associators_("MSVM_ElementSettingData", "Msvm_VirtualSystemGlobalSettingData")).ItemIndex(0)
VMSystemGlobalSettingData.ScopeOfResidence = ""
Result = VMManagementService.ModifyVirtualSystem(VM.Path_.Path, VMSystemGlobalSettingData.GetText_(1))
end if
Next

*****************************************************

Hyper-V Resources & Documentation

2009-06-23T02:37:00.000-07:00

Check some Microsoft useful documentation for Hyper-V in Windows 2008 and R2.

Hyper-V TechNet

Hyper-V Server 2008 Getting Started Guide

Microsoft Hyper-V Server 2008 Configuration Guide

Hyper-V Planning and Deployment Guide

Hypervisor Functional Specification

Virtualization with Windows Server 2008 Hyper-V

Overview & Architecture

Understanding Networking with Hyper-V

Hyper-V Security Guide

Microsoft Hyper-V Server 2008 - English

Microsoft® Hyper-V™ Server 2008 R2 RC

Windows Server 2008 R2 RC Evaluation Virtual Hard Drive Images (for Hyper-V)

Step-by-Step Guide for Testing Hyper-V and Failover Clustering

Windows Server High Availability with Microsoft MPIO

Windows Server Hyper-V Management Pack for System Center Operations Manager 2007

2009-06-22T12:58:00.000-07:00

Last Friday Microsoft released the Windows Server Hyper-V Management Pack for System Center Operations Manager 2007.

Overview

This management pack supports monitoring of Windows Server Hyper-V systems. This includes monitoring coverage of Hyper-V host servers, including critical services and disks, and Hyper-V virtual machines, including virtual components and virtual hardware.
Feature Summary
- Management of critical Hyper-V services that affect virtual machines and host server functionality

- Management of host server logical disks that affect virtual machine health

- Full representation of virtualization in a single Hyper-V host server, including virtual networks, virtual machines, and guest computers

- Monitoring of virtual machine hardware components that affect availability.

Download it here

SQL Server Management Studio Slow Startup

2009-06-22T03:05:00.000-07:00

This is an old one, but time to time I get the question
"Do you know how to speed up the SQL Server Management Studio?"
Normally I redirect the user to Microsoft KB555686. Today I decided to blog this and in the future I will redirect the users to this one :).

The problem is when you click the SSMS it performs several validations. For example the .Net runtime tries to contact "crl.microsoft.com" in order to ensure that the Certificate is valid. This can represent a problem if your internet connection is not available or if your firewall is blocking it.

How to solve this:
- If the server is allowed to access the internet, make sure that your firewall rules allows the access to the crl.microsoft.com website, additionally you may want to check if your firewall is not too busy to respond the server which may cause some delay as well.

- If your server doesn't have IE connectivity or you don't want to allow that access or perform the validation at crl.microsoft.com, you can configure the IE Advanced Options (Clear the "Check for Publishers certificate revocation list"

- Additionally, you may remove the splash option using the SSMS shortcut. Add the flag "/nosplash" at the end of the path to the SSMS.

- As described in the KB555686, also check the additional configurations:

1 Go to "Start" -> "Programs" -> "Microsoft SQL Server 2005".
2 Open "SQL Server Management Studio".
3 Navigate to "Tools" -> "Options" -> "Help" -> "Online".
4 Mark the checkbox "Try local first, not online".
5 Press on "Ok" button.6. Restart SQL Server Management Studio".

1 Go to "Start" -> "Programs" -> "Microsoft SQL Server 2005".
2 Open "SQL Server Error and Usage Reporting"
3 Uncheck the following checkboxes:
a."Send error reports for all components and instances of SQL 2005 to Microsoft or your corporate error reporting server."
Note: Using local "corporate error reporting server", may require to enable this feather.
b. "Send feather usage reports for all components and instances of SQL 2005 to Microsoft."
4 Press on "Ok" button.

Have fun :)

Two-Node Failover Cluster in Windows Server 2008 r2

2009-06-20T10:36:00.000-07:00

Introduction:
In this blog entry I decided to create a demo to help you to get starting with Microsoft Cluster Services. I'm not going into much detail on every aspect of clustering but you should be aware that clustering has some special requirements for apps and hardware, make sure you follow them before starting to build or think to create one.

Description:
A failover cluster is a group of independent computers that work together to increase the availability of applications and services. The clustered servers (called nodes) are connected by physical cables and by software. If one of the cluster nodes fails, the other node begins to provide the service that fail in the first one (this process is known as failover). By doing this the users experience a minimum of disruptions in service and the business doesn't stop because of the failed node.

Clusters are used to provide high availability to mission-critical applications. Failover clustering can help you build redundancy into your network and eliminate single points of failure for apps, services that are critical to your business. In the network infrastructure that connects your cluster nodes, avoid having single points of failure. You can connect your cluster nodes by multiple, distinct networks. Alternatively, you can connect your cluster nodes with one network that is constructed with teamed network adapters, redundant switches, redundant routers, or similar hardware that removes single points of failure.

Cool!!! Well... yes it's nice to have a group of servers to provide availability but nothing comes for free, and clusters can be expensive.

In today’s world there're many apps that are mission-critical for business needs, and without those apps running your company may lose lots of money because of that. Mail Servers, Database Servers, Virtualization Servers, Print Servers are just few examples in many other possible scenarios where clusters are used.

Two Node Cluster:

- Before starting, check Failover Cluster Requirements here.

- In this demo we'll use 2 servers with identical hardware and OS (Windows 2008 r2) and the same SP level.

- Both nodes are part of Active Directory Domain as member servers.

- The account that I'll use to configure the Cluster does not need to be a Domain Admins account, but needs to be a Domain Users account that is in the Administrators group on each clustered server (or the group that the account is a member of). In addition, if the account is not a Domain Admins account, the account (or the group that the account is a member of) must be given the Create Computer Objects permission in the domain. If your Domain Admin don't want to give you that privilege you must request or pre-create the Computer Object in a Disabled state. After creating the Computer Account you must give 'Full Control' permission to the user (or to the group that the account is a member of) for that Computer account prior to creating the cluster.

- The cluster should have in both nodes 2 NICs, one for Public communications (the clients use this interface to communicate with the cluster), and other for Private communications (only between both nodes "Heartbeat").

- For this two-node cluster, the quorum configuration will be Node and Disk Majority. Node and Disk Majority means that the nodes and the witness disk each contain copies of the cluster configuration, and the cluster has quorum as long as a majority (two out of three) of these copies are available that provides the specific permissions and privileges that are necessary for the service (similar to the local system context, but with reduced privileges).

- Remember that you must use shared storage that is compatible with Windows Server 2008. If you are using Serial Attached SCSI or Fiber Channel, in all clustered servers, the mass-storage device controllers that are dedicated to the cluster storage should be identical. They should also use the same firmware version (With Windows Server 2008, you cannot use parallel SCSI to connect the storage to the clustered servers.).

Heve Fun :)

System Center Operations Manager 2007 R2 Documentation

2009-06-18T08:20:00.000-07:00

System Center Operations Manager 2007 R2 Documentation available for download at:
MS Download Center

or

For information about the specific guides available in the library, check:
Technet Web Site

The Story Ends Bad for Scott/VMware FUD Fiasco Final

2009-06-13T13:34:00.003-07:00

For those who don't known recently some videos were anonymously posted at YouTube “trying” to demonstrate how Hyper-V was unstable and a bad option for costumers.

After looking at the Videos Microsof Guys decided to reproduce the scenario in their lab.

The Video: No Facts Just FUD.
Not much.
Where are the details?
There are no facts provided.
What Hyper-V build was this? The beta? What was the configuration being tested? Who posted this? Why didn't they contact Microsoft support? I mean there's literally no data other than a defamatory statement at the beginning of the video implying that Hyper-V had something to do with some downtime at TechNet/MSDN.

In short, Hyper-V had nothing to do with the outage.
So, why would someone create such a video? Let's dig a little deeper.
The Poster.
The poster, who doesn't appear on the video, doesn't state what company he works for or provide any context. Gee, I wonder where he works?

Introducing Scott Drummonds, VMware Product Marketing.
Gosh, I wonder why Scott didn't mention he works for VMware?
Very professional Scott.
No signs of desperation there at all.

VMware has admitted their mistake, apologized and removed the video.

At the end it they discover that the Lab didn’t meet the minimum requirements for running windows Server 2008 and the patch to solve the issue was release in April 2008.

I wonder why VMware guys are afraid of...
Hyper-V is in the right track. Congratulations Microsoft.

Hyper-V & SCVMM Error: Host status of 'Not Responding'

2009-06-13T13:29:00.000-07:00

Host status of 'Not Responding'

This is a very common issue,
Although can be very hard to troubleshoot, where's a nice article that describes step-by-step how to troubleshoot this error.

Important Updates:
· 958124 A wmiprvse.exe process may leak memory when a WMI notification query is used heavily on a Windows Server 2008-based or Windows Vista-based computer

· 954563 Memory corruption may occur with the Windows Management Instrumentation (WMI) service on a computer that is running Windows Server 2008 or Windows Vista Service Pack 1

· 955805 Certain applications become very slow on a Windows Server 2008-based or Windows Vista S955805-based computer when a certificate with SIA extension is installed

· 961983 Description of the hotfix rollup package for System Center Virtual Machine Manager 2008: April 14th, 2009

Nice job :)

Anti-Virus Settings for Microsoft OS

2009-06-08T13:18:00.000-07:00

Here's a nice document from Microsoft that you should read before configuring your Anti-virus settings.

This document has recommendations that may help you protect a computer that is running Windows Server 2008, Windows Server 2003, Microsoft Windows 2000, Windows XP, or Windows Vista from viruses. This article also contains information to help you minimize the effect of antivirus software on system and network performance.

Click KB822158

Updated Read-Only Domain Controller (RODC) Branch Office Guide

2009-06-03T03:23:00.000-07:00

Planning for RODC?
Before any implementation have a look at this updated guide at:

RODC) Branch Office Guide
or using
Technet

This guide describes new features in Windows Server 2008 that can provide benefits for Active Directory deployments that include branch offices. It explains how to assess an existing deployment of domain controllers in branch offices to determine whether deploying read-only domain controllers (RODCs) in existing or future branch offices is appropriate for your organization. For more general information about how to install and configure an RODC, see Planning and Deploying Read-Only Domain Controllers. For more information about deploying an RODC in a perimeter network (also known as DMZ), see Active Directory Domain Services in the Perimeter Network (Windows Server 2008).

Windows 7 and Windows Server 2008 R2 RTM dates

2009-06-03T01:39:00.000-07:00

It's official, finally Microsoft gave us a date for Windows 7 and Windows 2008 R2 RTM
According with MS Press:
Windows 7 is On The Way – Oct. 22 Announced as Release Date

Microsoft will deliver Release to Manufacturing (RTM) Windows 7 and Windows Server 2008 R2 code to partners in the second half of July, additionally Windows 7 will become generally available on Oct. 22, 2009, and Windows Server 2008 R2 will be broadly available at the same time.

Read more at:
MS Press

Active Directory Database Corruption/Recovery

2009-06-02T15:12:00.001-07:00

Active Directory Database corruption and you don't know what to do?

Did you got stuck with a domain controller that at startup is showing a message "Directory is Rebuilding Indices" and after a long time it fails?

Did you found corruption messages in event log:
NTDS ISAM Event ID: 467 database corruption Error,
NTDS Replication Event ID: 1084 Replication Error
NTDS Replication Event ID: 2108 Replication Error
NTDS General Internal Event ID: 1173 Processing Warning
………………………………………………….and others...

What about descriptions:
- 8451 The replication operation encountered a database error.
-1414 JET_errSecondaryIndexCorrupted, Secondary index is corrupt. The database must be defragmented

Yep, these are some of the corruption errors that you may find if your Active Directory (AD) Database (DB) is "dead"

1 - Before proceed, let me tell you that in scenarios like this one, you should always try to get the best help possible. Best help means calling to Microsoft PSS. They have the necessary experience and documentation to help you with those problems.

2 - The recovery solutions posted bellow does not guarantee that your problem will be fixed. The posted solutions are general recommendations that you may decide to follow or not. Use the information on this post at your own RISK!!! And remember to ALWAYS test in lab environments before going to production.

That said what options do I have when this happens?

Note: You should always try to find the root cause for these types of problems. The root problems are normally related with hardware problems, antivirus configurations, Virus, Power outages, etc... If you don't identify the root cause, there's a good probability that you may end up where you started.

Now it's time to recover...

******************************************************************
Scenario 1: Recover From Backup *******************************
******************************************************************
1. Get your DC backup and try to restore the DC using the latest backup. At minimum you need the system state backup to recover the AD DB. To restore the System State data on a domain controller, you must first start your computer in Directory Services Restore Mode (ADRM). This will allow you to restore the SYSVOL directory and Active Directory service database.

2. To access Directory Services Restore Mode, reboot the server press F8 during startup and select it from the list of startup options. If you're using a third party backup solution please consult the vendor documentation for Domain Controllers backup/recover scenarios, if you’re using NTBackup from Microsoft Windows check the basics here and here.

Note: Your DC backup is only valid if it’s within the forest tombstone lifetime.

3. After system restore, reboot the server and if everything is ok, find the root cause of the problem and fix it.

******************************************************************
Scenario 2: Rebuild the Domain controller **********************
******************************************************************
If you've more than one Domain controller you may try to rebuild the DC that is having problems and then re-promote it again.

1. Remove active directory from the DC. You can do that formatting the hard drive, replacing the drive with a new one (backup the files that you need before formatting the drive). Normally this is done by using the dcpromo /forceremoval, but in corruption scenarios that shouldn't work. Just MAKE SURE that the DC and related Active Directory configuration IS OUT of the DC and is NEVER AGAIN related or CONNECTED to the same network where the ORIGINAL HEALTHY DCs are. Is very important to guarantee this step or you may end up in a complete forest corruption scenario. Perhaps formatting the drive is the best option here... Just in case :)

2. The second step relates to seizing process. No, it's NOT "Transfer", it's SEIZE ROLES, transfers are only possible when the DCs that have FSMO roles are online, but that’s not the case because we formatted the drive, right?

If your "formatted" DC held any FSMO roles, you must seize them to another online DC. To identify if your “formatted” DC had any FSMO roles in it go to command prompt and type (first install support tools from your windows cd\Support directory):

netdom query fsmo

This command will return the FSMO owners for the forest and the domain were you're performing the query. In a forest, there are at least five FSMO roles that are assigned to one or more domain controllers, 2 are Forest wide and 3 exist in each domain in the forest.

The five FSMO roles are:
Schema Master (Forest)
Domain naming master (Forest)
Infrastructure Master (Domain)
Relative ID (RID) Master (Domain)
PDC Emulator (Domain)
To know more about these roles click here:

If the command returns the "formatted" DC as owner of any of these FSMO roles, you need to Seize them to a different, online domain controller to know more about that process check:
Using Ntdsutil.exe to transfer or seize FSMO roles to a domain controller

3. The next step is to perform metadata cleanup. You need to manually remove all remnant entries of the corrupted DC from AD database. To do that follow:
How to remove data in Active Directory after an unsuccessful domain controller demotion
You should also remove any DNS related entry to that DC.

4. Okay, take a deep breath... Wait or force replication so every DC knows about the changes that you made.

5. After knowing that changes were successfully replicated to all existing DCs it should be safe to promote the server back to domain controller. But wait!!! Did you already determine the root cause of the problem? No!!! Fix that first. You don't want to end up in the initial scenario right?!

******************************************************************
Scenario 3: Manually FIX AD Database ************************** ******************************************************************

This option should be used as last resource. As I said at the beginning of this post, follow it or not at your own RISK!!! Remember to ALWAYS test in lab environments before going to production.

To manually fix the AD DB check ALL STEPS

1. Reboot the server and press F8. Choose Directory Services Restore Mode from the Menu.
2. Check the physical location of the NTDS folder (Normally at %WINDIR%\NTDS\).
3. Perform a backup of the NTDS folder (copy the folder to a different drive or to the same drive with a different name eg: NTDSBK). If something goes wrong you can always replace the original files with this copy/backup.

4. Check the permissions for the "NTDS" folder.

Windows Server 2003
Default permissions are:
System Full Control This folder, subfolders and files
Administrators Full Control This folder, subfolders and files
Creator Owner Full Control Subfolders and Files only
Local Service Create Folders / Append Data This folder and subfolders

5. Check the %WINDIR%\Sysvol\Sysvol folder to make sure it is shared.

6. Check the permissions on the %WINDIR%\Sysvol\Sysvol share. Compare them with other online DC.

Note: You may not be able to change the permissions on these folders if the Active Directory database is unavailable because it is damaged, however it is best to know if the permissions are set correctly before you start the recovery process, as it may not be the database that is the problem.

7. Make sure there is a folder in the Sysvol share labeled with the correct name for the domain.

8. Open a command prompt and run NTDSUTIL to verify the paths for the NTDS.dit file. They should match the physical structure from Step 2
From command prompt type:

ntdsutil files info

Output that is similar to the following appears:
C:\ NTFS (Fixed Drive) free(850.4 Mb) total(10.2Gb)
DS Path Information:
Database : C:\WINDOWS\NTDS\ntds.dit - 10.1 Mb
Backup dir : C:\WINDOWS\NTDS\dsadata.bak
Working dir: C:\WINDOWS\NTDS
Log dir : C:\WINDOWS\NTDS - 20.2 Mb total
temp.edb - 1.1 Mb
res2.log - 10.0 Mb
res1.log - 10.0 Mb
edb00001.log - 10.0 Mb
edb.log - 10.0 Mb

This information is pulled directly from the registry subkey: "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters". Wrong paths can lead to incorrect start up of Active Directory. If this is your case check KB240362.
Type Quit to end the NTDSUTIL session.

9. Rename the edb.chk file and try to boot to Normal mode. If that fails, proceed with the next steps.

10. Reboot the server and press F8. Choose Directory Services Restore Mode from the Menu. From command prompt use the ESENTUTL to check the integrity of the database. You can use NTDSUTIL to check the integrity however ESENTUTL is usually more reliable.

To perform the integrity check, start the command prompt, type the following command:

esentutl /g "path\ntds.dit" /!10240 /8 /o

The output will tell you if the database is inconsistent and may produce a jet_error 1206 stating that the database is corrupt. If the database is inconsistent or corrupt it will need to be recovered or repaired. To recover the database type the following at the command prompt:
NTDSUTIL
Files
Recover

If this fails with an error, type quit back at the command prompt and repair the database using ESENTUTL. Type the following command:

esentutl /p "path\ntds.dit" /!10240 /8 /o

Note: If you do not put the switches at the end of the command you will most likely get a Jet_error 1213 "Page size mismatch" error.

11. Delete the log files inside NTDS directory, but do not delete or move the ntds.dit file.

12. The NTDSUTIL tool needs to be run again to check the Integrity of the database and to perform Semantic Database analysis. To check the integrity, at the command prompt type:

NTDSUTIL
Files
Integrity

The output should tell you that the integrity check completed successfully and prompt that you should perform a Semantic Database Analysis.
Type quit.

To perform the Semantic Database Analysis type the following at the NTDSUTIL Prompt type:
Semantic Database Analysis
Go

The output will tell you that the Analysis completed successfully.
Type quit and close the command prompt.

NOTE: If you get errors running the Analysis then type the following at the semantic checker prompt:
semantic checker: go fix

This puts the checker in Fixup mode, which should fix whatever errors there were.

13. Okay, take a deep breath... Review all steps...

14. Reboot the server to Normal Mode.

Hopefully one of these options will fix your problem :)

Additional Information:
Complete a Semantic Database Analysis for the Active Directory
Error Message: Lsass.exe - System Error : Security Accounts Manager
Windows 2000 DCs Unable to Boot into Active Directory
Use Ntdsutil to Manage Active Directory Files from the Command

This posting is provided "AS IS" with no warranties, and confers no rights.

SCVMM 2008 Error Codes List

2009-05-27T14:07:00.001-07:00

Now you can consult VMM errors and review the recommended actions for them. Technet published SCVMM 2008 Errors table to help you with the task of performing the recommended action for a given error code.

VMM 2008 Error Codes

User Interface Error Messages
Command-Line Interface Error Messages

Troubleshooting VMM 2007 Error Codes

Nice Job :)

How to recover Hyper-V Virtual Machine manually (unsupported ways...)

2009-05-27T14:06:00.001-07:00

One of these days I was testing one of my Hyper-Vs and because of a mistake of mine I removed all the VM associations to Hyper-V mmc console and SCVMM…

Now what!!!! I knew that the supported way to add those machines back to the Hyper-V and SCVMM was through backup/Restore or I could import them using an “previous” export, but those machines were new VMs created only for the test propose, I had no backup or export of them.

How to import them back? Ok, no panic, first thing to check is the files, are the VM files still in place? Yes!!! Ok, that means not all is lost…

Note: The GUIDs mentioned here belong to my virtual machine, in your network the GUIDs will differ.

How to recover Hyper-V Virtual Machine manually (unsupported ways...)

1 Option:
Easy enough, you create a new VM choose the option “attach a virtual hard disk latter” or “Use an existing virtual hard disk” and then map the VM to the disk used before by the other “missing” VM, of course, you can copy the disk to the new VM folder to keep all files together.

Nah….. I need the VM configuration, those configurations were critical to my tests and I don’t have the configuration paper with me. Let's try Option 2

**************************************************************

2 Option:

First go to the “missing VM folder\virtual Machines\” and take note of the file {GUID}.xml (In this scenario is the 71DB1869-534A-4B0B-B2B8-B89170FC0EF0.xml).

Now open the Hyper-V mmc and create a new VM with the same name, and point the new VM to the same drive/folder where the “missing VM” is at.

Choose the option “attach a virtual hard disk latter” and do a next, next, thing until you finish the VM creation process.

Now go to the VM folder and under “Virtual Machines” folder you have 2 GUIds.xml, the original 71DB1869-534A-4B0B-B2B8-B89170FC0EF0.xml (that you take note in the first step) and the new (in this scenario) E5D8FBFC-4E01-4D48-AE95-1CF1630E2C24.xml that refers to the new VM (Note: The GUIDs that you have, will differ from these).

The next step is to copy everything that is inside of the old 71DB1869-534A-4B0B-B2B8-B89170FC0EF0.xml to the new E5D8FBFC-4E01-4D48-AE95-1CF1630E2C24.xml, yes, everything… Basically you’re replacing the contents of the new {GUID}.xml with data from the old one. Save the file with the same name in the same place replacing the existing one.

Next step, open the E5D8FBFC-4E01-4D48-AE95-1CF1630E2C24.xml, and the replace everything that has the 71DB1869-534A-4B0B-B2B8-B89170FC0EF0 with E5D8FBFC-4E01-4D48-AE95-1CF1630E2C24. Save the file replacing the existing one.

Next step, copy the files that are inside the “F:\VM01\Virtual Machines\71DB1869-534A-4B0B-B2B8-B89170FC0EF0” to “F:\VM01\Virtual Machines\E5D8FBFC-4E01-4D48-AE95-1CF1630E2C24”, you must also rename the files (.bin and .vsv) that are inside that folder to match the new GUID.

If you have snapshots, then you also need to rename some files and folders inside Snapshots folder. Open “VM01\Snapshots” folder. Rename the folder “VM01\Snapshots \71DB1869-534A-4B0B-B2B8-B89170FC0EF0” to “VM01\Snapshots\E5D8FBFC-4E01-4D48-AE95-1CF1630E2C24”. Then open the “VM01\Snapshots\{GUIDofTheSnapshot}” and rename the files inside that folder (.bin and .vsv) to match the GUID of the new VM (If you have multiple snapshots, you have to repeat the same process to each one).

Now, open “VM01\Snapshots\{GUIDofTheSnapshot}.xml” and replace the values with “71DB1869-534A-4B0B-B2B8-B89170FC0EF0” with the new VM GUID “E5D8FBFC-4E01-4D48-AE95-1CF1630E2C24”.
(If you have multiple snapshots, you have to repeat the same process to each one).

Now is time to allow access to the Service SID access to all files in VM01, from cmdline type:

Icacls F:\VM01\ /T /grant "NT VIRTUAL MACHINE\E5D8FBFC-4E01-4D48-AE95-1CF1630E2C24":(F)

The last step is to manually create a symbolic link and grant the proper permissions to each individual snapshot that has a {GUID}.xml inside the VM01\snapshots folder (in this case there’re 2 snapshots).

Mklink "C:\ProgramData\Microsoft\Windows\Hyper-V\Snapshots\324E6E76-77EC-4671-9E25-3D4B5D3133BA.xml" "F:\VM01\Snapshots\324E6E76-77EC-4671-9E25-3D4B5D3133BA.xml"

Mklink "C:\ProgramData\Microsoft\Windows\Hyper-V\Snapshots\D6EC4773-75A6-49E7-84D2-3B619D1D450C.xml" "F:\VM01\Snapshots\D6EC4773-75A6-49E7-84D2-3B619D1D450C.xml"

Now give access permissions to the new VM Service SID access.

Icacls C:\ProgramData\Microsoft\Windows\Hyper-V\Snapshots\324E6E76-77EC-4671-9E25-3D4B5D3133BA.xml /grant "NT VIRTUAL MACHINE\E5D8FBFC-4E01-4D48-AE95-1CF1630E2C24":(F) /L

Icacls C:\ProgramData\Microsoft\Windows\Hyper-V\Snapshots\D6EC4773-75A6-49E7-84D2-3B619D1D450C.xml /grant "NT VIRTUAL MACHINE\E5D8FBFC-4E01-4D48-AE95-1CF1630E2C24":(F) /L

Go to the settings of the VM01 and assign the proper Network switch.
Start VM01 and you’re DONE!!!!

Are you NUTS!!!! That’s too much work for a VM recovery!!!! And if I had 20 VMs to recover, that process will take the entire month…

**************************************************************

Option3:
This method is simpler, we’ll re-assign the “missing” Symbolic links and give permissions to the Service SID.

Using Mklink, create the Symbolic link under "C:\ProgramData\Microsoft\Windows\Hyper-V\Virtual Machines"

Mklink "C:\ProgramData\Microsoft\Windows\Hyper-V\Virtual Machines\71DB1869-534A-4B0B-B2B8-B89170FC0EF0.xml" "F:\VM01\Virtual Machines\71DB1869-534A-4B0B-B2B8-B89170FC0EF0.xml"

Now give access permissions to the service SID to this Symbolic link.

Icacls "C:\ProgramData\Microsoft\Windows\Hyper-V\Virtual Machines\71DB1869-534A-4B0B-B2B8-B89170FC0EF0.xml" /grant "NT VIRTUAL MACHINE\71DB1869-534A-4B0B-B2B8-B89170FC0EF0":(F) /L

Then you need to give access permissions to the Service SID to all files in VM01

Icacls F:\VM01\ /T /grant "NT VIRTUAL MACHINE\71DB1869-534A-4B0B-B2B8-B89170FC0EF0":(F)

Since VM01 has also Snapshots, we need to create the correspondent symbolic link and give the necessary permissions to the files (This process must be done to each snapshot).

Mklink "C:\ProgramData\Microsoft\Windows\Hyper-V\Snapshots\324E6E76-77EC-4671-9E25-3D4B5D3133BA.xml" "F:\VM01\Snapshots\71DB1869-534A-4B0B-B2B8-B89170FC0EF0.xml"

Mklink "C:\ProgramData\Microsoft\Windows\Hyper-V\Snapshots\D6EC4773-75A6-49E7-84D2-3B619D1D450C.xml" "F:\VM01\Snapshots\71DB1869-534A-4B0B-B2B8-B89170FC0EF0.xml"

Now, assign the permissions:

Icacls C:\ProgramData\Microsoft\Windows\Hyper-V\Snapshots\324E6E76-77EC-4671-9E25-3D4B5D3133BA.xml /grant "NT VIRTUAL MACHINE\71DB1869-534A-4B0B-B2B8-B89170FC0EF0":(F) /L

Icacls C:\ProgramData\Microsoft\Windows\Hyper-V\Snapshots\D6EC4773-75A6-49E7-84D2-3B619D1D450C.xml /grant "NT VIRTUAL MACHINE\71DB1869-534A-4B0B-B2B8-B89170FC0EF0":(F) /L

Go to the settings of the VM01 and assign the proper Network switch.
Start VM01 and you’re DONE!!!!

Enjoy.

Service pack 2 for Windows 2008 and Windows Vista

2009-05-26T07:10:00.001-07:00

Microsoft has the Service pack 2 for Windows 2008 and Windows Vista available for download.

SP2 is an update to Windows Server 2008 and Windows Vista that incorporates improvements discovered through automated feedback, as well as updates that have been delivered since SP1. Service Pack 1 is a prerequisite for installing Service Pack 2. Please make sure that your system is running Service Pack 1 before you install Service Pack 2.

Information about Service Pack 2 for Windows Vista and for Windows Server 2008

Available Downloads:

x86-based systems

x64-based systems

ISO Format

Service Pack 2 for Windows Server 2008 and Windows Vista on Technet

Planning for Active Directory Forest Recovery

2009-05-20T04:28:00.000-07:00

Need help to plan your Active Directory Forest Recovery?
Have a look at this document that might help you in the process...

This guide contains best-practice recommendations for recovering an Active Directory forest, if forest-wide failure has rendered all domain controllers in the forest incapable of functioning normally. The procedure steps in this guide, which you must customize for your particular environment, describe how to recover the entire Active Directory forest to a point in time before the critical malfunction. They also ensure that none of the restored domain controllers replicates from a domain controller with potentially dangerous data. The procedures apply to Active Directory Domain Services (AD DS) in Windows Server 2008 and the Active Directory® directory service in Windows Server 2003.

How do I reset the Windows Update settings

2009-05-19T10:45:00.000-07:00

Automatic Updates (AU) are critical to companies and end users because they keep the systems up-to-date with the most recently security patches, hotfixes, drivers, etc...

Most of the time AU will work without issues but unfortunately this doesn’t apply to 100% of the scenarios. The good news is that you’ll find most of the manual fixes on the web with a little Google search, the bad news is that in some scenarios you may crash your system trying to fix that.

For full AU reset Microsoft has a tool "Microsoft Fix it" that may help you with this task minimizing the risk of mistakes, of course you always have the “old school” method if you want.

Have a look at KB 971058

For AU troubleshooting check KB 906602

Windows 7 RC KB970789

2009-05-19T08:29:00.000-07:00

After installing my W7 RC copy I ran a search for updates to this version of windows, I found this one that sounds interesting.

Acording with Article ID: 970789:

"In the English version of Windows 7 Release Candidate (build 7100) 32-bit Ultimate, the folder that is created as the root folder of the system drive (%SystemDrive%) is missing entries in its security descriptor. One effect of this problem is that standard users such as non-administrators cannot perform all operations to subfolders that are created directly under the root. Therefore, applications that reference folders under the root may not install successfully or may not uninstall successfully. Additionally, operations or applications that reference these folders may fail.

For example, if a folder is created under the root of the system drive from an elevated command prompt, this folder will not correctly inherit permissions from the root of the drive. Therefore, some specific operations, such as deleting the folder, will fail when they are performed from a non-elevated command prompt. Additionally, the following error message appears when the operation fails:"Access is denied."

Exchange 2010

2009-05-14T04:55:00.000-07:00

Excited about the new Exchange 2010?
Well you can get it from MS Web site and test the new beta for this product.
Additionally you may have a look at this nice introduction video by Ilse van Crieking (MVP Exchange) will guide you through some of the new features of the next generation Exchange 2010 server, click here.

Exchange 2010 Microsoft Web site - click here

To Download the Microsoft Exchange Server 2010 Beta click here

Have Fun.

Windows 7 Release Candidate Available for download

2009-05-14T04:33:00.000-07:00

Windows 7 Release Candidate Available for download

Things like, better performance, improved taskbar and full-screen previews, new jump lists, new desktop enhancements, better Windows search capabilities and results, internet explorer 8, better device management, HomeGroup, view available network (VAN), etc… Are cool features that you may want to try and test.

Check the MS website and download your copy.

You may also want to download the RSAT for Windows 7 RC.
RSAT give IT administrators the ability to manage roles and features that are installed on remote computers running Windows Server 2003, 2008 and 2008R2 from a remote computer that is running Windows 7 RC.

Microsoft Remote Server Administration Tools for Windows 7 RC (86Bit)
Microsoft Remote Server Administration Tools for Windows 7 RC (64Bit)

Have Fun.

Windows 2008 Answer file

2009-02-27T10:24:00.000-08:00

Windows 2008 answer file.

You can use this answer file to future Windows 2008 unattended installations. This file includes the new options for Windows 2008 R2 as described here. I have included the possible values and description for those values. ALL options were disable. You can enable each option by removing the semicolon (;) and the forward slash (/) then configure the correct value for that option. ALL options were commented. Hopefully this will help you to configure the correct options according with your needs.

Open your text editor and copy the text that is between the lines “->Begin” and “->End” to a text file. Save the text file with .txt extension and you’re ready to start the configuration of the existing options in this file. After that configuration, you can use the answer file with dcpromo.exe as follows:

dcpromo /unattend: "path to the answer file"

->Begin

[DCINSTALL]

;****************************************************************************************
;----------------------------------------------------------------------------------------
;----------------------------------------------------------------------------------------
;Possible Values - YES NO
;Default Value - NO
;Description - Specifies whether an existing domain is re-created.

;/AllowDomainReinstall
;****************************************************************************************
;----------------------------------------------------------------------------------------
;----------------------------------------------------------------------------------------
;Possible Values - YES NO
;Default Value - NO
;Description - Specifies whether to continue installing this domain controller
; despite the fact that an active domain controller account with
; the same name is detected.
; Specify Yes only if you are sure that the account is no longer
; in use.

;/AllowDomainControllerReinstall
;****************************************************************************************
;----------------------------------------------------------------------------------------
;----------------------------------------------------------------------------------------
;Possible Values- "partition_DN_1 partition_DN_2 ...partition_DN_n"
;Default Value -
;Description - Specifies application partitions to be replicated in the format
; of "partition1" "partition2".
; If * is specified, all application partitions will be replicated.
; Use space-separated (or comma-and-space-separated) distinguished
; names, with the entire string enclosed in quotation marks.

;/ApplicationPartitionsToReplicate
;****************************************************************************************
;----------------------------------------------------------------------------------------
;----------------------------------------------------------------------------------------
;Possible Values - (This parameter has been renamed to /InstallDNS)
; - Yes No
;Default Value - Computed automatically based on the environment.
;Description - Specifies whether Domain Name System (DNS) is configured for a
; new domain if Dcpromo detects that the DNS dynamic update protocol
; is not available or if Dcpromo detects an insufficient number of
; DNS servers for an existing domain.

;/InstallDNS
;/AutoconfigDNS
;****************************************************************************************
;----------------------------------------------------------------------------------------
;----------------------------------------------------------------------------------------
;Possible Values - child_domain_name
;Default Value -
;Description - Specifies the single-label DNS name of the child domain.

;/ChildName
;****************************************************************************************
;----------------------------------------------------------------------------------------
;----------------------------------------------------------------------------------------
;Possible Values - YES NO
;Default Value - Yes, unless you are creating the first domain controller in a
; new child domain or new domain tree.
;Description - Specifies whether the domain controller is a global catalog server.

;/ConfirmGc
;****************************************************************************************
;----------------------------------------------------------------------------------------
;----------------------------------------------------------------------------------------
;Possible Values - YES NO
;Default Value - Computed automatically based on the environment.
;Description - Indicates whether to create a DNS delegation that refers to this
; new DNS server. Valid for Active Directory–integrated DNS only.

;/CreateDNSDelegation
;****************************************************************************************
;----------------------------------------------------------------------------------------
;----------------------------------------------------------------------------------------
;Possible Values - YES NO
;Default Value - NO
;Description - Specifies whether the promotion operation performs only critical
; replication before reboot and then continues, skipping the
; noncritical (and potentially lengthy) portion of replication.
; The noncritical replication happens after the role installation
; finishes and the computer restarts.

;/CriticalReplicationOnly
;****************************************************************************************
;----------------------------------------------------------------------------------------
;----------------------------------------------------------------------------------------
;Possible Values - path_to_database_files
;Default Value - %systemroot%\NTDS
;Description - Specifies the fully qualified, non–Universal Naming Convention
; (UNC) path to a directory on a fixed disk of the local computer
; that contains the domain database, for example, C:\Windows\NTDS.

;/DatabasePath
;****************************************************************************************
;----------------------------------------------------------------------------------------
;----------------------------------------------------------------------------------------
;Possible Values - User or group
;Default Value -
;Description - Specifies the name of the user or group who will install and
; administer the read-only domain controller (RODC). If no value is
; specified, only members of the Domain Admins group or Enterprise
; Admins group can install and administer the RODC.

;/DelegatedAdmin
;****************************************************************************************
;----------------------------------------------------------------------------------------
;----------------------------------------------------------------------------------------
;Possible Values - Password *
;Default Value -
;Description - Specifies the password for the user name (the account credentials)
; that is used to create or remove the DNS delegation. Specify * to
; prompt the user to enter credentials.

;/DNSDelegationPassword
;****************************************************************************************
;----------------------------------------------------------------------------------------
;----------------------------------------------------------------------------------------
;Possible Values - user_name
;Default Value -
;Description - Specifies the user name to be used when the DNS delegation is
; created or removed. If you do not specify a value, the account
; credentials that you specify for the AD DS installation or removal
; are used for the DNS delegation.

;/DNSDelegationUserName
;****************************************************************************************
;----------------------------------------------------------------------------------------
;----------------------------------------------------------------------------------------
;Possible Values - YES NO
;Default Value - YES;Description - Specifies whether the DNS Server service is available on the
; network. This parameter is used only when the network adapter for
; this computer is not configured with the name of a DNS server for
; name resolution. Specifying No indicates that the DNS server will
; be installed on this computer for name resolution. Otherwise, the
; network adapter must be configured with a DNS server name first.

;/DNSOnNetwork
;****************************************************************************************
;----------------------------------------------------------------------------------------
;----------------------------------------------------------------------------------------
;Possible Values - 0 2 3 4
;Default Value - Based on levels existing in the forest.
;Description - Specifies the domain functional level when a new domain is created
; in an existing forest, as follows:
; 0 = Windows 2000 native
; 2 = Windows Server 2003
; 3 = Windows Server 2008
; 4 = Windows Server 2008 R2

;/DomainLevel
;****************************************************************************************
;----------------------------------------------------------------------------------------
;----------------------------------------------------------------------------------------
;Possible Values - domain_NetBIOS_name
;Default Value - Left-most label of the DNS name.
;Description - Assigns a NetBIOS name to the new domain.

;/DomainNetBiosName
;****************************************************************************************
;----------------------------------------------------------------------------------------
;----------------------------------------------------------------------------------------
;Possible Values - 0 2 3 4
;Default Value - 0
;Description - Specifies the forest functional level when a new domain is
; created in a new forest, as follows:
; 0 = Windows 2000
; 2 = Windows Server 2003
; 3 = Windows Server 2008
; 4 = Windows Server 2008 R2
; ForestLevel replaces SetForestVersion in Windows Server 2003.
; Do not use this switch when you are installing a domain controller
; in an existing forest.

;/ForestLevel
;****************************************************************************************
;----------------------------------------------------------------------------------------
;----------------------------------------------------------------------------------------
;Possible Values - (This switch replaces /AutoConfigDNS)
; YES NO
;Default Value - Computed automatically based on the environment.
;Description - Specifies whether DNS is configured for a new domain if Dcpromo
; detects that the DNS dynamic update protocol is not available or
; if Dcpromo detects an insufficient number of DNS servers for an
; existing domain.

;/InstallDNS
;/AutoConfigDNS
;****************************************************************************************
;----------------------------------------------------------------------------------------
;----------------------------------------------------------------------------------------
;Possible Values - Path_to_log_files
;Default Value - %systemroot%\ NTDS
;Description - Specifies the fully qualified, non-UNC path to a directory on a
; fixed disk of the local computer that contains the domain log
; files, for example, C:\Windows\NTDS."

;/LogPath
;****************************************************************************************
;----------------------------------------------------------------------------------------
;----------------------------------------------------------------------------------------
;Possible Values - Forest Tree Child
;Default Value - Forest
;Description - Specifies the type of new domain:
; The root domain of a new forest
; The root domain of a new tree in an existing forest
; A child domain in an existing forest
; The type of new domain must be specified when AD DS is installed
; on a Server Core installation.

;/NewDomain
;****************************************************************************************
;----------------------------------------------------------------------------------------
;----------------------------------------------------------------------------------------
;Possible Values - DNS_domain_name
;Default Value -
;Description - Specifies a fully qualified domain name (FQDN) for the new domain.

;/NewDomainDNSName
;****************************************************************************************
;----------------------------------------------------------------------------------------
;----------------------------------------------------------------------------------------
;Possible Values - DNS_domain_name;Default Value -
;Description - Specifies the FQDN of an existing parent domain when a child
; domain is installed.

;/ParentDomainDNSName
;****************************************************************************************
;----------------------------------------------------------------------------------------
;----------------------------------------------------------------------------------------
;Possible Values - Password *
;Default Value -
;Description - Specifies the password that corresponds to the user name
; (account credentials) that is used to promote the domain
; controller. Specify * to prompt the user to enter credentials.

;/Password
;****************************************************************************************
;----------------------------------------------------------------------------------------
;----------------------------------------------------------------------------------------
;Possible Values - Security_Principal NONE
;Default Value -
;Description - Specifies the names of computer and user accounts whose passwords
; can be replicated to this RODC. Specify "None" if you want to keep
; the value empty. By default, no user credentials will be cached
; on this RODC. To specify more than one security principal, add
; the entry multiple times.

;/PasswordReplicationAllowed
;****************************************************************************************
;----------------------------------------------------------------------------------------
;----------------------------------------------------------------------------------------
;Possible Values - Security_Principal NONE
;Default Value -
;Description - Specifies the names of user, group, and computer accounts whose
; passwords are not to be replicated to this RODC. Specify None if
; you do not want to deny the replication of credentials of any
; users or computers. To specify more than one security principal,
; add the entry multiple times.

;/PasswordReplicationDenied
;****************************************************************************************
;----------------------------------------------------------------------------------------
;----------------------------------------------------------------------------------------
;Possible Values - YES NO
;Default Value - YES
;Description - Specifies whether to restart the computer upon completion,
; regardless of success.

;/RebootOnCompletion
;****************************************************************************************
;----------------------------------------------------------------------------------------
;----------------------------------------------------------------------------------------
;Possible Values - Yes No NoAndNoPromptEither
;Default Value - YES
;Description - Specifies whether to restart the computer upon successful
; completion of an operation.

;/RebootOnSuccess
;****************************************************************************************
;----------------------------------------------------------------------------------------
;----------------------------------------------------------------------------------------
;Possible Values - DNS_domain_name
;Default Value -
;Description - Specifies the FQDN of the domain in which you want to promote an
; additional domain controller.

;/ReplicaDomainDNSName
;****************************************************************************************
;----------------------------------------------------------------------------------------
;----------------------------------------------------------------------------------------
;Possible Values - Replica ReadOnlyReplica Domain
;Default Value - Replica
;Description - Specifies whether to install the domain controller as:
; An additional domain controller in an existing domain
; An RODC in an existing domain
; The first domain controller in a new domain

;/ReplicaOrNewDomain
;****************************************************************************************
;----------------------------------------------------------------------------------------
;----------------------------------------------------------------------------------------
;Possible Values - DNS_name_of_source;Default Value -
;Description - Indicates the FQDN of the partner domain controller from which
; Active Directory data is replicated to create the new
; domain controller.

;/ReplicationSourceDC
;****************************************************************************************
;----------------------------------------------------------------------------------------
;----------------------------------------------------------------------------------------
;Possible Values - path_to_installation_media;Default Value -
;Description - Indicates the location of the installation media that will be
; used to install a new domain controller.

;/ReplicationSourcePath
;****************************************************************************************
;----------------------------------------------------------------------------------------
;----------------------------------------------------------------------------------------
;Possible Values - password NONE
;Default Value -
;Description - The password for the administrator account to use when you start
; the computer in Safe Mode or a variant of Safe Mode, such as
; Directory Service Restore Mode (DSRM). You cannot specify a
; blank password.

;/SafeModeAdminPassword
;****************************************************************************************
;----------------------------------------------------------------------------------------
;----------------------------------------------------------------------------------------
;Possible Values - site_name
;Default Value - (The default value for the /SiteName parameter depends on the
; type of installation. For a new forest, the default is
; Default-First-Site-Name. For all other writable domain controller
; installations, the default is the site that is associated with
; the subnet that includes the IP address of this server.
; If no such site exists, the default is the site of the replication
; source domain controller. For an RODC installation, you must
; specify the site name where the RODC will be installed)
;Description - The name of an existing site where you can place the new
; domain controller.

;/SiteName
;****************************************************************************************
;----------------------------------------------------------------------------------------
;----------------------------------------------------------------------------------------
;Possible Values - No value is required.
;Default Value -
;Description - This switch is for expert users who want to skip automatic
; configuration of client settings, forwarders, and root hints.
; The switch is in effect only if the DNS Server service is already
; installed on the server, in which case you will receive an
; informational message confirming that the automatic configuration
; of DNS was skipped. Otherwise, this switch is ignored. If you
; specify this switch, ensure that zones are created and properly
; configured before you install AD DS or the domain controller will
; not operate correctly. This switch does not skip automatic creation
; of the DNS delegation in the parent DNS zone. To control DNS
; delegation creation, use the /CreateDNSDelegation switch.

;/SkipAutoConfigDNS
;****************************************************************************************
;----------------------------------------------------------------------------------------
;----------------------------------------------------------------------------------------
;Possible Values - NONE system key
;Default Value -
;Description - Specifies the system key for the media from which you
; replicate the data.

;/Syskey
;****************************************************************************************
;----------------------------------------------------------------------------------------
;----------------------------------------------------------------------------------------
;Possible Values - path_to_SYSVOL_folder
;Default Value - %systemroot%\ sysvol
;Description - Specifies the fully qualified, non-UNC path to a directory on a
; fixed disk of the local computer, for example, C:\\Windows\SYSVOL.

;/SysVolPath
;****************************************************************************************
;----------------------------------------------------------------------------------------
;----------------------------------------------------------------------------------------
;Possible Values - YES NO
;Default Value - NO
;Description - Specifies whether to transfer the infrastructure master role to
; this domain controller, in case it is currently hosted on a global
; catalog server and you do not plan to make this domain controller
; a global catalog server. Choose Yes to transfer the infrastructure
; master role to this domain controller in case this is needed.
; If you choose Yes, be sure to specify /ConfirmGC:No.

;/TransferIMRoleIfNeeded
;****************************************************************************************
;----------------------------------------------------------------------------------------
;----------------------------------------------------------------------------------------
;Possible Values - domain_name;Default Value -
;Description - Specifies the domain name for the user name (account credentials)
; that is used for promoting a domain controller.

;/UserDomain
;****************************************************************************************
;----------------------------------------------------------------------------------------
;----------------------------------------------------------------------------------------
;Possible Values - Domain\user_name;Default Value -
;Description - Specifies the user name (account credentials) that is used for
; promoting a domain controller. We recommend that you specify the
; account credentials in the domain\user_name format.

;/UserName
;****************************************************************************************
;----------------------------------------------------------------------------------------
;----------------------------------------------------------------------------------------

->End

How to add the second domain controller in Active Directory (Windows 2008 R2) part 2

2009-02-27T09:46:00.000-08:00

If you miss part one of this article please click here to review it.

The Answer File:

- The following list includes the installation options (including the new options for R2 versions of Windows 2008) to use with dcpromo and an answer file. For more information about each option click here.

- It’s also important to know the meaning of unattended installation return codes. You can check that clicking here. For return codes keep in mind that:
o 1-10 = refer to success return codes
o 11-100 = refer to failure return codes

- Note: The following options are available for the Promotion operation during an unattended installation of Active Directory Domain Services (AD DS) in Windows Server 2008 and Windows Server 2008 R2. Options that are new appear in bold text.

I would like to comment one of the available options mentioned in the answer file. The option is “/TransferIMRoleIfNeeded”. According with the option description, this option is to be used when we want to transfer the Infrastructure Master Role to the server that we’re setting up. The description warns that we should only do this if the DC that you’re setting up is NOT a GC. This does NOT have to be like that.

In fact we can have the Infrastructure master role in a Global Catalog when:
- Only one domain exists in your Forest.
- If you’ve only one domain controller for a given domain within your forest.
- If all DCs in the domain are also Global Catalogs
In scenarios previously mentioned you can place the IM (Infrastructure Master Role) in DC (Domain Controller) that is also a GC (Global Catalog).

The setting description applies when:
- You’ve multiple domains in your forest, and the Domain where the Infrastructure master role is has a mixture of DCs that are GCs and non-GCs. In this scenario the IM role should NOT be placed in a GC, and the option “/ConfirmGc “ should be set “/ConfirmGc:NO”.

Check the following video to see how everything it’s done. The basic steps are:

· Because we are introducing the new Windows 2008 R2 in a Windows 2008 Domain, we need to prepare the forest and the domain for the new windows 2008 R2. We need to run the adprep /forestprep in the schema master, and the adprep /domainprep in the Infrastructure master. In order to accomplish that we need to insert the Windows 2008 R2 DVD in the Schema master and in the Infrastructure master domain controller. Additionally (NOT MANDATORY) we’ll also raise the Forest Functional Level to Windows 2003 to latter introduce the new domain controller available in windows 2008 called Read-Only Domain Controller.

Note: If the FSMO owner is a Windows 2008 DC 32Bit version, you need to use the adprep 32bit version (adprep32.exe) from Windows 2008 R2 DVD.

· After upgrading the Forest and Domain, we are ready to add the Windows 2008 R2 as additional DC.

· In this demonstration, SWDC01 has the IP address:10.0.5.16 and this server (SWDC02) has the IP address:10.0.5.17. Configure the SWDC02 NIC preferred DNS server with the SWDC01 IP address.

· Download and configure the answer file. Click here to access to the answer file. Open your text editor and copy the all the lines between “->Begin” and “->End” to a text file. Save the text file with .txt extension and you’re ready to start the configuration of the existing options in this file. After that configuration, you can use the answer file with dcpromo.exe as follows: dcpromo /unattend: "path to the answer file"

· Run dcpromo with the /unattended option and path to the answer file.

· Reboot.

· After reboot, check that everything is working correctly.

Part 1

Part 2

Have fun :)

You might want to have a look at the next article:
(How to add a RODC in a Windows Core installation with IPSec at DMZ using CLI)

How to add the second domain controller in Active Directory (Windows 2008 R2) part 1

2009-02-27T09:01:00.000-08:00

After the “How to create the first domain controller in Active Directory (Windows 2008)”, it’s time to consider an additional domain controller to your domain.

Why should you to consider that?

- Redundancy: Having more than one DC for a given domain provides better redundancy for users, computers and apps. Apart to active directory redundancy, you may also have additional roles in those DCs that you want to keep available in case of a DC failure or DC overload. The roles that are most commonly used in DCs are DNS server role and the Global Catalog.

- Workload distribution: Depending of the size of your network, load balancing the users, apps, computers, etc… across multiple DCs prevents the overload of of a single DC.

- Domain hierarchy: The first domain that is created is the Root Domain of the forest. If you lose that domain you lose the entire forest. In a scenario where you have multiple domains within a forest, if you have only one DC for that top Root Domain and you lose that DC forever, you may say goodbye to your entire forest. In sub domains (child domains), if you lose the only DC that you have, you’ll lose that domain plus the child domains of that child domain. Hum… that’s not good… As you already guessed domain hierarchy is very important in Active Directory.

- Recovery/Availability: Consider the following scenario. Your DC suffers a hardware failure, and to recover from that hardware failure you’ll have to wait some time. If you have only one DC, you may have a problem, the apps that use that DC will no longer work until that DC is back online again, the users that use that app will also stop working and your company will lose money because of that down time. Anyway, you recover that DC from hardware failure, but then you discover that the DC cannot start (BSoD-More down time), no problem (you think), you start the Backup Recovery process, but you discover that the backup isn’t enough to recover that DC. Now you’ve a big problem, everyone stopped working and the company isn’t making money because that. Everyone will have to wait until you replace the domain controller with a new one. With a second DC, your down time would be zero, and the dead DC could be replaced easily without affecting users or apps that depend on it.

And if I lose both DCs?
It’s true, you can lose both DCs and you’ll be “dead” anyway, but that is another story with a different planning to a different blog post. The point that I’m trying to make clear is with 2 DCs per domain “at the minimum” you will get a good chance to recover from down times (with good percentage of success) plus better redundancy and distributed workload.

I could give you a lot more reasons to have additional DCs, but keep those in mind and hopefully they should be enough to make you think twice before consider only one DC for your Domain.

Ok, back to the beginning, how to create the second domain controller in Active Directory. Actually is pretty simple, we just need to have healthy domain (run dcdiag tools to check if everything is ok), and if everything is working correctly you are ready to add the 2nd DC to your domain.
In this demonstration I’ll use the Beta release of windows 2008 R2. Instead of using the GUI, I’ll use an answer file to install the DC.

Okay, let’s prepare the additional domain controller and build the answer file that we’ll use with dcpromo.exe to promote the server to an additional domain controller in an existing forest.

Before start:
· Plan carefully your FQDN of the domain controller, make sure that follow the rules of your internal company documentation. Although it’s possible to rename DCs that are running Windows 2003 and latter, I would rather do it correctly at first time preventing latter changes. Check the Naming conventions at Microsoft KB909264.

· Configure your NIC with a static IP address. Avoid the use of multiple NICs in DCs, this type of configuration may lead to errors and Active Directory communication might fail on multihomed domain controllers, check MS KB 272294 and 191611 for more information.

· Make sure that the Administrator account has a strong password. If possible, avoid using the Administrator account and use a dedicated account to perform your everyday work in AD. Think in Administrator account as the SOS account, and try to use it only when no other account solves your problem.

· You must have at least one drive formatted with NTFS.

· Install the latest updates from Microsoft website.

· Check your event log for errors and correct them before proceed.

· Plan and test the Backup strategy for your Active directory Forest. After that take a full backup of the existing DC in case that you need to rollback.

· At last check the date and time settings, make sure that are correct, and make sure that the existing DC is in sync with a trusted and valid authoritative time server. By Default the DC that holds the PDCe will be (by default) the authoritative time server for your forest and additional DCs will sync their time with this DC.

Note: Attention to the preferred DNS configuration in DC2, it must point to the existing DC1 that already has AD in it. Because I want to provide redundancy using both servers, I will install AD and DNS server roles in DC2, but first I need to use an existent DC to add DC2 as additional domain controller to the domain, and for that to happen I need to use a valid existent DNS server that “knows” where my AD is.

Now it’s time to prepare the answer file. Let's see in part 2 of this article:
How to add the second domain controller in Active Directory (Windows 2008 R2) part 2.

How to create the first domain controller in Active Directory (Windows 2008) Part2

2009-02-23T19:17:00.000-08:00

Welcome to part 2 of create the first domain controller in Active Directory.

If you miss part one click part 1

In part 2 we'll do some additional configurations to the domain controller. These additional configurations are not mandatory, but I do recommend them.

Basic Steps are:
1- After AD installation and server reboot, go to the NIC, TCP/IP properties and change the preferred DNS value that was set by the wizard to “127.0.0.1”. Change it to the IP address of the server.
2- Create a reverse lookup zone in your DNS server. AD doesn’t need the reverse lookup zone to work, but it’s possible that you might need it for future apps to be installed in your network.
3- Run ipconfig /registerdns to register the PTR records in the new reverse zone.
4- Open DNS snap-in, right-click the DNS server and choose the option “Set Aging/Scavenging for all zones”. This will configure “Aging/Scavenging” for all existing zones at once.
5- Under DNS properties select advanced tab and click the check box “Enable automatic scavenging of stale records”.
6- Additionally you may want to control the interfaces that will respond to DNS queries (remember that is NOT recommended to use multiple NICs in a DC).
7- Under DNS properties select the interfaces tab and select the option “Only the following IP address:”, then select the IP address that server will use to listen for DNS queries.
8- Install latest updates
9- Reboot the server.
10- Run from cmd “dcdiag /e /v /f:c:\dcdiag.log” and check dcdiag.log for output errors that may indicate that your server has problems. Note: It’s normal that you have some warning alerts in the event logs that were generated during dcpromo process or during other actions that you did to configure the server. Dcdiag will also report these errors/warnings during “System Log” test. The reboot that I mentioned before helps you to isolate those errors since last reboot

Have fun :)

You might want to have a look at “How to add the second domain controller in Active Directory (Windows 2008 R2)”.

How to create the first domain controller in Active Directory (Windows 2008) Part1

2009-02-23T19:08:00.000-08:00

Domain controller (DC) is a server role that has the Active Directory service installed. By default a domain controller stores one domain directory partition which has all information about the domain in where that DC is located, it also stores the schema and configuration directory partitions that are common to the entire forest. Depending of the version that you're running, DCs can also store one or more application directory partitions (Windows 2003 and later).

In addition to Active Directory database, DCs can also hold specific roles needed by Active Directory:

-Flexible single master operation (pronounced Fiz-mo). Domain controllers that hold operations master roles are designated to perform specific tasks to ensure consistency and to eliminate the potential for conflicting entries in the Active Directory database. Active Directory defines five operations master roles (2 are Forest wide and the other 3 exist in each domain):

- Forest operation masters:
- Schema master
- Domain naming master

-Domain operation masters:
-Primary domain controller emulator (PDCe)
-Infrastructure master (IM)
-Relative ID master (RID)

-Global Catalog (GC). A global catalog server is a domain controller that, in addition to its full writable domain directory partition replica (does not apply to RODC), also stores a partial, read-only replica of all other domain directory partitions in the forest. The attributes that are replicated to the global catalog are identified in the schema as the partial attribute set (PAS).
GCs are needed when: doing forest wide searches, User logons (when more than one domain exists in that forest), when a user principal name (UPN) is used at logon and the forest has more than one domain, to cache the user membership when is member of a Universal Group (Universal groups are only available when the domain is native mode or later), Exchange Address Book lookups, and exchange clients also use global catalog servers to access the global address list (GAL). These are the most common scenarios, but you can also have specific apps that need to contact the GC to function properly.

-DNS: Although DNS is not a component of Active Directory, Active Directory uses DNS as its domain controller location mechanism and leverages the namespace design of DNS in the design of Active Directory domain names. Is possible to have a non-Microsoft DNS solution to support Active Directory, but the DNS server must support service resource records (RFC 2782) and dynamic update protocol (RFC 2136). Active Directory uses DNS as the location mechanism for domain controllers, enabling computers on the network to obtain IP addresses of domain controllers. During the installation of Active Directory, the service (SRV) and address (A) resource records are dynamically registered in DNS. Both types of records are necessary for the functionality of the domain controller locator (Locator) mechanism among other functions.

That being said, now it’s time to setup of the First Domain Controller.

Before start:
· Plan carefully your FQDN (fully qualify domain name), the NetBIOS name and the Domain controller name, this is very important to avoid changes that may crash your entire forest later. Check the Naming conventions at Microsoft KB909264.
· Configure your NIC with a static IP address. Avoid the use of multiple NICs in DCs, this type of configuration may lead to errors and Active Directory communication might fail on multihomed domain controllers, check MS KB 272294 and 191611 for more information.
· Configure the Administrator account with a strong password.
· Install the latest updates from Microsoft website.
· Have one hard drive with NTFS installed.
· Check your event log for errors and correct them before proceed.
· Consider the use of 2 DCs for each domain that you plan to have in your forest, this will give you better redundancy but also a fastest way to recover from server failures.
· Plan and test the Backup strategy for your Active directory Forest.
· At last check the date and time settings, make sure that are correct, and make sure that the server is in sync with a trusted and valid authoritative time server. By Default this DC will be the authoritative time server for your forest and additional DCs will sync their time with this DC.
Now it’s time to install Active directory in your server, check the video and follow the steps bellow:

Let's do some additional configurations in part 2

Have fun :)