App-V Real World Experience</h1> <article> <h1>App-V Real World Experience</h1> <p>daniel.nerenberg — Mon, 22 Feb 2010 23:00:00 GMT</p> <P>This article has been translated into Chinese thanks to Tommy Huang. Check it out <A title="Chinese translation of this article" href="http://virtualtom.blog.51cto.com/1203850/282618">here on his blog</A> </P> <P>As we jump head long into a new year of exciting advances for App-V I have been taking some time to reflect on the activities in the past year.</P> <P>I have spent much of the past year working with customers who are starting out with App-V for the first time.</P> <P>Worldwide there are over 22 million MDOP licenses that have been purchased. I had the opportunity to work with a wide range of customers who purchased some of those licenses.</P> <P>I worked with customers in government and private industry. The customers ranged from mid-size telecom and cable companies with over 5000 employees and over 2 million customers to governments both at the city and state level. The common thread that all applications managers had was how to make managing application easier. The challenges that they face include supporting</P> <P>In my Experience, Application Management starts long before we double click a setup.exe, or install.msi. The first thing we need to understand with a new application is how do we install it? That includes questions like what are the dependencies. Are there custom configuration files that need to be created/modified, how much space will the application take? Will users need additional training? Will help desk support technicians need additional training? What is the life time of the application? How will the application maintained and upgraded? Once the application is no longer required how will it be retired? With Virtual Applications we still need to ask these questions.</P> <P>All these questions should be answered before an application is deployed into an environment. I saw customers answer these questions in different ways. Some had Change Approval Boards or CABS. Some would simply fill in a document template that documented the application before installing it. Depending on the level of process and the complexity of the application it could be very challenging to get an application out to users. What’s more when users have trouble with a new application it usually took time for the help desk to get up to speed.</P> <P>App-V provides a consistent set of answers for these questions. Let’s dive in a take a look at how those headaches are solved and how customers approach solving them.</P> <P><B>THE COMPLEXITY SHIFT</B></P> <P>What I tell my customer whenever I’m explaining the value of App-V is that we are shifting complexity. Microsoft has done a terrific job of building a reliable installer executive with MSIEXEC. However there are still many applications that choose to, either use highly customizes routines stringing together multiple MSIs along with various custom configurations step, or a customer install all together. For example many line of business applications have configuration steps that must be completed after the application has been installed. Sometimes this involves editing configuration files or connecting the application to a back end database.</P> <P>The next complexity is once applications are installed troubleshooting these applications requires specific knowledge of the application so that help desk and administrators can quickly trouble shoot the application. A simple way to look at this is count the number of applications that need to be supported then look at the number of setting and configuration steps required to install them, finally look the troubleshooting steps for those applications. The combination and knowledge required to support a large number of applications increases exponentially. With App-V the sequence engineers packages once and the installation is same regardless of who deletes or refreshes the app. The helpdesk no longer has to worry about how to reinstall if app breaks or which settings to choose. All settings are the same so troubleshooting is the same. Before we can ensure that we get that streamlined complexity shift we need to also think of a few more things.</P> <P><B>IDENTIFY YOUR SUBJECT MATTER EXPERTS</B></P> <P>Customers found that because they had to get the application working up front when they sequenced the application it required testing that assured a working application on delivery to the end user. Since Virtual Applications are usually installed ready to run it’s important that someone who knows the application very well tests the application to make sure that it behaves as expected. To accomplish this I worked with my customers to identify subject matter experts for the applications we were sequencing. This includes those that are knowledgeable about installing the application and using the application. The last thing you want is for a user to get an error on some feature that is buried under the surface of the application. It’s frustrating and it means having to remediate your App-V package. This leads into the next tip nicely.</P> <P><B>USER ACCEPTANCE TESTING</B></P> <P>Like any development project, you should try to run a user acceptance test on applications that get sequenced. Since we are in a sense altering how the application is deployed to computers we are changing how the original developer intended for the application to be installed. This isn’t usually a problem so long as the developer followed best practices, but there are always exceptions. By having your expert users validate the packages and sign off that the package works you ensure that your package has met a level of acceptance so that users can be productive with the application. </P> <P><B>HOMOGENEOUS HELP DESK PROCEDURES</B></P> <P>Unfortunately as careful as we are at some point users might have trouble with applications. This usually means a call to help desk. With traditional applications we needed to provide detailed troubleshooting steps that were often different from one application to the next for example, make sure the application was properly installed and DLL’s were registered. Check .INI files, make sure file extensions were properly associated. This list could go on. With App-V the first steps of troubleshooting can be streamlined to be the same for all applications. Here is an example troubleshooting list:</P> <P>1. Ensure the application is loaded into the client cache</P> <P>2. If the application is deployed via SCCM make sure that the App-V client is properly configured for HTTP streaming or to communicate with the SCCM client.</P> <P>3. If the application continues to have issues reload the application into the <BR>App-V Cache. </P> <P>4. Clear user PKG file</P> <P>5. Re-stream all app-v applications</P> <P>This list is by no means conclusive, or complete. It will be different for many different environments. What remains the same is for applications that are deployed using App-V the steps are always the same. This allows your help desk technicians to deliver fast, consistent and remote application support.</P> <P><B>PREPARING THE SEQUENCING ENVIRONMENT</B></P> <P>After talking about processes that will be impacted and the various key players that should be implicated with App-V, I then start helping customer prepare a sequencing environment. This environment is key to successfully and efficiently packaging application. </P> <P>App-V sequencing is very IO bound. You can end up losing a lot of time watching progress bars if you sequence applications on a computer with a slow hard drive. Another consideration that contradicts the first point to some degree is that sequencing should be done on a virtual machine so that the sequencing environment can be quickly reset to clean state. While I have seen many customers work directly on hardware, the time they save using hardware is quickly lost while waiting for the PC to be re-imaged. My own solution for this is to keep a 10k eSATA hard drive in an external enclosure. Whether using a virtual machine or using a physical machines the 10k server class hard drive really boosts performance.</P> <P>Many customers ultimately locate their sequencing clients on a backend server virtualization technology such as Hyper-V. This allows for 64bit and 32bit VMs and since the hard drive technology is usually based across SAN Disk arrays IO performance is optimal.</P> <P><B>TIPS AND TRICKS WHEN SEQUENCING</B></P> <P>There are even more great tips such as adding dummy printer drivers and ODBC connections, and in some cases adjusting the registry both on the sequencer and in the virtual package to hide the “q” drive. (This is virtual drive that provides a mount point for app-v virtual packages). </P> <P>For anyone setting up a sequencing environment I would strongly recommend reading the sequencing best practices guide <A href="http://technet.microsoft.com/en-us/appvirtualization/cc843994.aspx">Link to Guide</A></P> <P><B>COMMUNICATIONS IS KEY</B></P> <P>The final point that I always recommend to customers once they are committed to deploying applications using App-V is communicate! Apps may behave a little different than users are used to, make sure users have a high level understanding of why that is. Make sure application owners understand that they way applications will be “packaged” has changed. They should understand that sequencing has a bit more cost up front in terms time and effort to prepare, however they payoff will be streamlined deployment and support. The support staff will need to understand what is different about virtual apps, and why that difference matters to them. </P> <P>As with any change large or small it’s easy to meet resistance. A good communications plan outlining the value of using App-V will go a long way to smoothing out pockets of resistance across the organization.</P> <P>This concludes my observations from the field for now. I have more to write up so stay tuned over the next few weeks. With the release of App-V 4.6 we are entering an exciting period where customers will be able to start deploying virtual apps across their entire infrastructure. Some key features to watch out for are x64 client support and enhanced integration with Windows 7.</P> </article> <article> <h1>Powershell – Converting a Script into a Module – Part 3</h1> <p>rodney.buike — Fri, 12 Feb 2010 17:10:00 GMT</p> <p>Last time we played with having a script become a module and passing through variables from the command line. Which is nice. VERY nice. “Life is good” Nice. And a lot of the time, the system will just “let it run” if you forget to type in variables. It might not do anything actually USEFUL but it will run. But we’re going to take take last module we made and give it some “fallbacks”. Plug in information INCASE you forget. Or the next admin. Having Defaults is a good thing you know. :-)</p> <p>So here’s our last module.</p> <blockquote> <p>---------------------------------------------</p> <p>New-Module -scriptblock {</p> <p>function ListUsers ($startdate, $enddate, $ou)</p> <p>{ </p> <p>connect-qadservice -service ‘contoso.local’</p> <p>get-qaduser –searchroot “contoso.local/$ou” | where { ($_.Creationdate -ge $startdate) -and ($_.Creationdate -le $enddate) } | select-Object Name</p> <p>} </p> <p>Export-ModuleMember -function ListUsers</p> <p>}</p> <p>--------------------------------------------</p> </blockquote> <p>Now “What if” I forgot to type in either date? The end result is a big load of nothing, unless you had a user created on the EXACT DATE you ran this on. So pretty useless. </p> <p>Now there are very fancy ways to do this, but the point of any of my posts is for new Admins to get a FEEL for Powershell and learn from there. And honestly? I’m not that good. So I go the lazy way.</p> <p>So for my first check and balance, I want to make sure the End date, if it’s not supplied, is assumed to be at LEAST today.</p> <p>And with a little “IF statement” that’s fixed.</p> <blockquote> <p>IF ( $enddate –eq $NULL) { $enddate=get-date; write-host ‘Ending Date not supplied, Today Assumed’ )</p> </blockquote> <p>And of course, it would make sense to have the Startdate in this particular module to be something BEFORE the End Date, again otherwise, useless results. But I want to make sure that information is supplied. If it isn’t, I’m going to tell the silly Administrator and stop the module there and then.</p> <blockquote> <p>IF ( $startdate –gt $enddate) { write-host ‘The Starting Date MUST be BEFORE the Ending Date’} </p> </blockquote> <p>In fact with this in mind, I’m going to make sure the module never runs if this information is not supplied by dropping in an “ELSE” that incorporates the rest of the script.</p> <p>Now there is one REALLY important details I almost forgot. You see, unless you TELL powershell that the information you’re passing in is a DATE? It’s going to take that nice little ‘4/20/2009’ and figure it out like math! *oops*. So you’re “date” will end up being I think some stupid amount like ‘9.95520159283226E-05’</p> <p>So to fix that, we’re going to tell the module that certain variables are going to be ASSUMED as a date/time. And that is done by prefixing the variable with <strong>[datetime]</strong></p> <p>Yes, so if you just “skipped off” after Post # 2? Your ummmm module? Not working no good :)</p> <p>So there’s a lot more we can do here but we now have a script that looks like this.</p> <blockquote> <p>---------------------------------------------</p> <p>New-Module -scriptblock {</p> <p>function ListUsers ([datetime]$startdate, [datetime]$enddate, $ou)</p> <p>{ </p> <p>IF ( $enddate –eq $NULL) { $enddate=get-date; write-host ‘Ending Date not supplied, Today Assumed’ } <br />IF ( $ou –eq $NULL) { $ou=’Users’; write-host ‘Organization Unit not supplied, Assuming default Users container’ } <br />IF ( $startdate –eq $NULL) { $startdate=$enddate; write-host ‘Starting Date not supplied, Today Assumed’ }</p> <p>IF ( $startdate –gt $enddate) { write-host ‘The Starting Date MUST be BEFORE the Ending Date’} <br />ELSE <br />{</p> <p>connect-qadservice -service ‘contoso.local’</p> <p>get-qaduser –searchroot “contoso.local/$ou” | where { ($_.Creationdate -ge $startdate) -and ($_.Creationdate -le $enddate) } | select-Object Name</p> <p>} <br />}</p> <p>Export-ModuleMember -function ListUsers</p> <p>}</p> <p>--------------------------------------------</p></blockquote> </article> <article> <h1>Powershell – Converting a Script into a Module – Part 2</h1> <p>rodney.buike — Wed, 10 Feb 2010 17:07:00 GMT</p> <p>We’re going a little more into turning a script into a module. And again, don’t scare yourself off! They are easy to deal with! So here today, I’ll go the other way around. I’m going to take a simple script with a few built in Variables and modify it into a module that I can type IN those variables every time. Here’s one I use on a regular basis. It’s a simple thing that uses the Quest Active Roles and pulls up a list of users created in a specific date range under a particular OU.</p> <blockquote> <p>-----------------------------------------------</p> <p>$startdate='8/1/2009' <br />$enddate='10/31/2009' </p> <p>connect-qadservice -service 'contoso.local' </p> <p>get-qaduser -searchroot 'contoso.local/Users' | where { ($_.Creationdate -ge $startdate) -and ($_.Creationdate -le $enddate) } | select-Object Name <br /></p> <p>------------------------------------------------- <br /></p> </blockquote> <p>Not a very fancy script, but one I find handy. It users in a particular OU in Active Directory, and lists those created within a particular date range. Now rather than going in to the script EACH and EVERY time, wouldn’t it make more since to just turn it into a useful command and TYPE in what you wanted? <em><strong>That’s</strong></em> a module.</p> <p>So all we have to do is specify the variables that will PASS THRU from the command line. Last time it was the Variable called ‘$Name’ that was sent to be echoed to the screen. Yes, it was a lame but simple example. This time we’re going to pass THREE variables to the module. <strong>$startdate</strong>, <strong>$enddate, </strong>and <strong>$ou</strong> so that we can simply call up our module now and have as a useful regular command in the Shell environment.</p> <p>So this script as a module looks like *THIS*</p> <blockquote> <p>---------------------------------------------</p> <p>New-Module -scriptblock {</p> <p>function ListUsers ($startdate, $enddate, $ou)</p> <p>{ </p> <p>connect-qadservice -service ‘contoso.local’</p> <p>get-qaduser –searchroot “contoso.local/$ou” | where { ($_.Creationdate -ge $startdate) -and ($_.Creationdate -le $enddate) } | select-Object Name</p> <p>} </p> <p>Export-ModuleMember -function ListUsers</p> <p>}</p> <p>--------------------------------------------</p> </blockquote> <p>As you can see all we’ve done is take the variables we want to pass through from the command line and put them into a function and then Export that function at the end. That’s it.</p> <p>Once you execute this script you will now have a new command call “LISTUSERS” you can from the Powershell environment. Note, that unlike a Shell script you do NOT have to specify a path to the filename to make it execute. And you can easily add in the required parameters. And just like a Shell script, you can check for the input values and compare that they meet Syntax or whatever you choose.</p> <p>Note the “ModuleName ‘LISTUSERS’ is derived directly from the original function name. Because we “exported” that function.</p> <p>Next time we’ll play a little deeper like showing how to have the variables default and EVEN how to have you module check for dependencies (like it’s needed snapins) before running.</p> </article> <article> <h1>Converting a Script into a PowerShell Module – Part 1</h1> <p>rodney.buike — Mon, 08 Feb 2010 17:04:00 GMT</p> <p>Ok let’s take a crack at this feature in Powershell V2 called Modules.</p> <p>Modules really aren’t all that difficult when you get down to it. It’s very much like taking a script and loading it into memory. </p> <p>Well maybe not exactly like that but the cool part is when you turn that script into a module (as long as it’s loaded) you don’t have to keep specifying the path to the script, and you could even pop it into your Profile file (since it’s just text) and add functions that make YOUR admin life better without trying.</p> <p>So how hard is it?</p> <p>Would you like the fact that the Powershell team GIVES you a simple sample module in the Help file?</p> <p>In Example 3 (I like this one the best) under the “New-Module” help they give you this example</p> <blockquote> <p>------------------ Sample from Microsoft Powershell ISE Help System – Example 3 – New-Module -------------------------------</p> <p>C:\PS>New-Module -scriptblock {$SayHelloHelp="Type 'SayHello', a space, and a name."; function SayHello ($name) { "Hello, $name" }; Export-ModuleMember -function SayHello -Variable SayHelloHelp} </p> <p>C:\PS> $SayHelloHelp Type 'SayHello', a space, and a name. </p> <p>C:\PS> SayHello Jeffrey Hello, Jeffrey </p> <p>Description <br />----------- </p> <p>This command uses the Export-ModuleMember cmdlet to export a variable into the current session. Without the Export-ModuleMember command, only the function is exported. The output shows that both the variable and the function were exported into the session.</p> <p>------------------ Sample from Microsoft Powershell ISE Help System – Example 3 – New-Module -------------------------------</p> </blockquote> <p>The nice thing about this example is I can EASILY break it down so it looks like a script and you can VERY easily see how to reverse the process.</p> <p>The same module can also look like this and is the EXACT same code. I just haven’t left it as one line. Remember, a Semicolon ‘;’ is used to TIE the lines together. You DON’T have to have all the code on ONE line just to make the module work. And Honestly, If I’m writing it, I like it broken up. It makes more sense to my eyes and SOMEBODY ELSES eyes too!</p> <blockquote> <p>--------------------------------------------------------------------------------</p> <p># BEFORE <br /># <br /># New-Module -scriptblock {$SayHelloHelp="Type 'SayHello', a space, and a name."; function SayHello ($name) { "Hello, $name" }; Export-ModuleMember -function SayHello -Variable SayHelloHelp} <br />#</p> <p># AFTER <br />#</p> <p>New-Module -scriptblock {</p> <p>$SayHelloHelp="Type 'SayHello', a space, and a name." </p> <p>function SayHello ($name)</p> <p>{ <br />"Hello, $name" <br />} </p> <p>Export-ModuleMember -function SayHello -Variable SayHelloHelp</p> <p>}</p> <p>---------------------------------</p> </blockquote> <p>And this module if it was just a script would look like THIS</p> <blockquote> <p>---------------------------------</p> <p># This is a function</p> <p>function SayHello ($name)</p> <p>{ <br />"Hello, $name" <br />} </p> <p># this is the script part that will use the function</p> <p>$somename=’EnergizedTech’</p> <p>SayHello $somename</p> <p>SayHello ‘EnergizedTech’</p> <p>-----------------------------------</p> </blockquote> <p>So really all you’re doing is taking a script and where you want to send variables on a regular basis, instead of assigning them IN the script or typing in literals, you’re just typing them on the command line.</p> <p>We’ll take a slightly deeper look at how you can take this and customize this to your own needs next time.</p> </article> <article> <h1>Powershell – Auto disabling and Deleting of Active Directory Accounts</h1> <p>rodney.buike — Fri, 05 Feb 2010 17:00:00 GMT</p> <p>A very good friend I’ve been in contact with on Twitter who is a die hard Mac/Linux guy that works in Windows sent me a message.</p> <p>“Need a vBscript to Query Active Directory for old accounts and disable them”</p> <p>At which point I immediately pointed out “Powershell” as the quicker and more direct solution. </p> <p>He in return sent back the specs to what he needed.</p> <ul> <li>Go through and disable accounts over XXX days </li> <li>Go through and delete accounts older than yyy days </li> <li>Accounts which are flagged with key words in the “Description” field should NOT be deleted </li> </ul> <p>This, in Powershell with the Quest Active roles commandlets is like a walk in the park. Really it IS!</p> <p>In Active Directory, there is a field for “LogonTime” which is the last time you successfully logged in. And we can very easily compare that with the CurrentDate. </p> <p>Quest has a command let built right into disable users. It’s just </p> <blockquote> <p>DISABLE-QADUSER <em>identity</em></p> </blockquote> <p>Where identity is the name you’re disabling in Active Directory</p> <p>You can also EASILY remove Objects in Active Directory with the Quest Cmdlets too. Remember, everything (OU’s, computers, users) is just an Object in A/D so to pull that little miracle off just run a </p> <blockquote> <p>REMOVE-QADOBJECT <em>identity</em></p> </blockquote> <p>Where identity is the name of the object you are removing. Careful with this CmdLet. I ALWAYS run it (and any other destructive ones) with a –WHATIF parameter to make sure it’s going to do what I want. If you mistype, you can delete a LOT of things easily.</p> <p>In the Active Directory Notes field (Typically under the “Telephones” tab) We’re going to put in the word <strong>***OVERRIDE***</strong> to indicate the account <strong>NEVER</strong> gets deleted automatically (unless we remove those words from the Notes Field)</p> <p>Also in Active Directory under the Description we’re adding the words “<strong>On Leave Until</strong>" to indicate the user is gone for a specified period of time. This will allow us to have a script that can look and shut things down without us doing anything. </p> <p>In this rendition I’ve left in the <strong>–WHATIF</strong> parameter to cover the bases of “Murphy”</p> <p>It also echoes to the screen the status of Each account that is potentially going to be deleted or not. Accounts to be disabled are just disabled without notice</p> <p>Let me know how this works and be VERY VERY VERY VERY careful using it. I highly recommend practicing this on a TEST domain or TEST OU at the VERY minimal before going production.</p> <p>A special shout out goes to my buddy @moldor in Australia for which this script would NOT have existed. He created the need and the requirements. If you’re looking for a great Mac/Linux guy who’ll even work with Windows in Australia? Give him a shout!</p> <p> </p> <p>----------------------------------------------- AutoCleanADUsers-Stale.PS1 -------------------------------------</p> <p># Uses Quest Active Roles <br /># Free to download <a href="http://www.quest.com/powershell/activeroles-server.aspx">http://www.quest.com/powershell/activeroles-server.aspx</a> <br /># <br /># Get all users in that have not logged on within <br /># XXX days in "Active Directory" and Disable them <br /># <br /># Get the Current Date <br /># <br />$COMPAREDATE=GET-DATE <br /># <br /># Number of Days to check back. 90 days <br /># <br />$NumberDays=90 <br /># <br /># Number of Days to check for REALLY Stale accounts <br /># Our sample here is taking "OldAccounts" and pumping up <br /># 30 more days. Therefore 120 days old accounts that haven't <br /># logged in should be purged <br /># <br />$DeleteDate=$NumberDays+30 <br /># <br /># We have certain "Override fields" that bypass a delete <br /># happening. If the "Notes" field in A/D contains the <br /># EXACT Override phrase ANYWHERE (in this case it is the <br /># word ***OVERRIDE*** and it IS case sensitive <br /># The account will NEVER be deleted (unless of course you remove <br /># Word from the Notes field <br /># <br />#$OverRide='***OVERRIDE***' <br /># <br /># The other override field is if <br /># the OnLeave details are in the Description <br /># Field in A/D. this allows for a User who is <br /># Not gone (IE: Contractor / Student) but may <br /># Return to have the account disabled and <br /># Left alone until they return. The words here are <br /># simple On Leave Until and can be ANYWHERE in the <br /># Description Field in A/D <br /># <br />$OnLeave='On Leave Until' <br /># <br /># Organizational Unit to search – This is in the fictional domain of <br /># ‘Contoso.local’ in the OU of Users under the Business OU on the Root <br /># of the Contoso A/D <br /># <br />$OU='Contoso.local/Business/Users' <br /># <br /># Get all users not active within the specified range and disable the accounts in Active Directory <br /># <br /># We store them away as a variable since we're going to examine the list a few times. <br /># <br />$LISTOFACCOUNTS=GET-QADUSER -SearchRoot $OU | where { $_.LastLogon.AddDays($NumberDays) -gt $CURRENTDATE } <br /># <br /># Any account not logged in within the short range gets Disabled in AD <br /># <br />$LISTOFACCOUNTS | DISABLE-QADUSER -whatif <br /># <br /># Pull up a new list. Really old accounts <br /># <br />$LISTOFPOTENTIALDELETES=$LISTOFACCOUNTS | where { $_.LastLogon.AddDays($DeleteDate) –gt $CURRENTDATE } <br /># <br /># Secondary compare is more interesting. If the accounts are VERY stale, they get deleted UNLESS special keywords <br /># are in place <br /># <br /># <br /># <br />FOREACH ($USER in $LISTOFPOTENTIALDELETES) <br />{ <br /> IF (($USER.Notes -notlike '*'+$OVERRIDE+'*') -and ($USER.Description -notlike '*'+$OnLeave+'*')) <br /> { <br /> REMOVE-QADOBJECT $USER.Name -whatif <br /> WRITE-HOST $USER.Name 'Deleted' <br /> } <br /> ELSEIF ($USER.Notes -like '*'+$OVERRIDE+'*') <br /> { <br /> WRITE-HOST $USER.Name 'Not removed due to Administrative Override' <br /> } <br /> ELSE <br /> { <br /> WRITE-HOST $USER.Name 'Not removed - Presently on Leave' <br /> } <br />} </p> <p>----------------------------------------------- AutoCleanADUsers-Stale.PS1 -------------------------------------</p> </article> <article> <h1>Managing Multiple Domains with PowerShell</h1> <p>rodney.buike — Thu, 04 Feb 2010 23:56:36 GMT</p> <p>One of the most IRRITATING and FRUSTATING things I had working in the field was dealing with multiple Domains. </p> <p>You’d have so many clients with their own Active Directory setups and each time you’d have to go directly to the Small Business Server to manage it, or try to have a machine dedicated to that purpose. Plus you might have tools you’d want to copy to the server to help in that process.</p> <p>A real pain in the you know what. But Along came Powershell and <a href="http://www.quest.com/powershell/activeroles-server.aspx" target="_blank">Quest ActiveRoles Management Shell</a>; and My life changed for the better. You see Powershell can connect to a Domain Controller on it’s own terms, you just need to validate against it once before you do so. Which makes things far far easier.</p> <p>For example here he have a small simple script that let’s you connect to a Domain Controller called ‘dc.contoso.local’ and unlock a user account called John.Smith</p> <p>------------------------------------------------------</p> <blockquote> <p># Note uncomment line below if you need to add in the Snapin for Quest ActiveRoles </p> <p># (Software is installed but not part of default Powershell Profile)</p> <p>#</p> <p># ADD-PSSNAPIN Quest.ActiveRoles.ADManagement</p> <p>#</p> <p># Popup and get Credentials for Domain</p> <p>#</p> <p>$CREDS=GET-CREDENTIAL</p> <p>#</p> <p># Connect to Domain Controller dc.contoso.local with</p> <p># Provided Credentials</p> <p>#</p> <p>Connect-QADSERVICE ‘dc.contoso.local:389’ –credential $CREDS</p> <p>#</p> <p># Now that you are in the domain, unlock the User</p> <p>#</p> <p>UNLOCK-QADUSER john.smith</p> </blockquote> <p>------------------------------------------------------------</p> <p>In truth this is a VERY simple script but the point you need to understand that it takes nothing to edit the name of the DC to be an IP address of a different domain on different site. </p> <p>The “GET-CREDENTIAL” commandlet does not know or even CARE about the name of the other domain. All it does it ask you to provide the credentials. These credentials take the standard format of a UPN or the traditional DOMAIN\Username. It will generate the keys. </p> <p>Once the CONNECT-QADSERVICE Commandlet talks to the other domain controller it provides those credentials through the –credential parameter.</p> <p>Active Directory on THAT Domain takes that information, processes it and accepts it (because ID and password and provided Domain are valid) or not. There is no magic to it!</p> <p>Once you have done this process you (as long as that shell is open) are managing THAT domain. Or at least you are as far as the Quest Active Roles are concerned.</p> <p>Even if your computer is a member of DOMAIN “ABC.FABRIKAM.COM” and you’re trying to manage the “CONTOSO.LOCAL” domain, it doesn’t matter! You can create, delete, unlock or Query the Active Directory for whatever information you need. Isn’t it nice when life is simpler?</p> </article> <article> <h1>Going Hyper-V R2 – Part 2</h1> <p>rodney.buike — Tue, 26 Jan 2010 16:39:00 GMT</p> <p>I was chatting with Brian Bourne from <a href="http://www.cms.ca" target="_blank">CMS Consulting</a> in Toronto about some Hyper-V R2 work that they have done recently. In the conversation Brian shared a ton of learning's from the field on some of the Hyper-V R2 upgrades, deployments and V2V/P2V migrations. I asked him to write up a post and he did, so much so that I had to split it into two posts. <a href="http://thelazyadmin.com/blogs/thelazyadmin/archive/2010/01/25/going-hyper-v-r2-part-1.aspx" target="_blank">You can find Part 1 here</a>!</p> <p>-------------------------</p> <p>The release of R2 has been a major step forward for Microsoft’s virtualization strategy. It has also meant a rise in customer interest and willingness to move their data center and production servers on to the platform. Here at CMS Consulting, we’ve been offering both <a href="http://www.cmstraining.ca/">training</a> and <a href="http://www.cms.ca/">consulting</a> services to help customers through the process. Here are some of the things we’ve learned along the way.</p> <p><b>Virtual to Virtual (V2V) Migrations</b></p> <p>In theory, this should be easy as pie right? The machine is already virtualized. How hard can a conversion be? Once again think about cloning to new hardware. For Virtual Server or VMWare to Hyper-V migrations, it truly appears as a completely new hardware platform to the operating system. This leads us to a few tips I’d like to add to the standard documentation.</p> <p>- Cleanly shutdown the virtual machine, merge snapshots if they exist.</p> <p>- After migration, logon to ensure the Hyper-V integration components are installed and working. VMM may think its ok, but it may not be. More tips on this below.</p> <p>- If you are migrating offline or inactive virtual machines, remember they do get started as part of the migration process. This means you better think about the consequences of having that machine come online and what network its virtually “plugged in to” when it does.</p> <p>Overall V2V migrations from Virtual Server and Hyper-V do go smoothly, but realize that the machine will be stopped and offline for the duration of the migration. Online migration is not a listed option. Data copy and fix-up time will determine the outage duration. Also, plan additional outage time so you can manually clean up and test the server. You may wish to have a strategy to block user access to services until you’re confident you want to introduce the server back into the environment.</p> <p>If you want to do a migration “online” you will need to treat the VM as if it was a physical machine and follow the steps for P2V online migration. In fact, my team has used this strategy a number of times for migrating difficult VMWare virtual machines. Success when migrating a VMWare source varies widely based on ESX version, complexity of “hardware” configuration under ESX and other environmental factors. Sometimes treating the source as a P2V really is the best option.</p> <p><b>Physical to Virtual</b></p> <p>What I find odd about the VMM wizard for physical machine migrations is that it assumes you want to do an online migration and actually hides the tab for offline options from plain sight. Sure, I trust VSS enough for backups – but if I’m going to take a production server and virtualize it, I’d like the data to be as stable and consistent as possible. So for my money, I do an offline P2V if at all feasible. There are a few scenarios where you might forego an offline migration. Here are some scenarios where I would do an online P2V:</p> <p>- You just want a copy of the server for testing or giggles, so data consistency doesn’t matter</p> <p>- You truly can’t afford the server outage while data copies</p> <p>- You have a source server with less than 512MB. (I recently had to migrate an old server with 448MB - online worked but offline won’t even start.)</p> <p>- Finding drivers for WinPE to boot on some old hardware appears to be more effort than it’s worth.</p> <p>I’d like to also suggest than when you’re looking at doing a P2V you also consider the “build fresh” strategy. This could be your opportunity to upgrade to Server 2008 R2 as the operating system and consolidated roles and services. There are two reasons to do this. First is to take advantage of the new features and increased performance of R2. Perhaps more importantly is to reduce the number of overall machines in your environment. I don’t mean physical machines here. I mean machines you have to license, patch, monitor and otherwise manage. If you can consolidate roles and services to a single VM then now is a good time to do it. Let’s not forget that fewer VM’s also means a reduction in hardware requirements and those ever-important spindle counts.</p> <p>I also want to talk about P2V of non-domain machines. If you read the documentation on <a href="http://technet.microsoft.com/en-us/library/bb963740.aspx">Technet</a>, it very clearly states that the source machine needs to be either a member of the domain or there must be a domain trust. I have found this to be categorically untrue. I’ve had no issue doing P2V with both workgroup and isolated domain machines (including the DC of an “isolated” domain). The trick was to make sure the source machine had connectivity with both the VMM server and the target Hyper-V host. Once that was sorted out, I simply entered the appropriate machine credentials in VMM and everything worked fine. In theory you could also use the SysInternals <a href="http://technet.microsoft.com/en-us/sysinternals/ee656415.aspx">Disk2VHD</a> utility. This tool is designed for online use only. Although I previously recommended against online migrations, I started thinking about using Disk2VHD while booted to an alternate OS. We did some basic testing and found it won’t run under WinPE. In theory you could cobble together a full Win7 boot from USB and make it work. If we ever get around to that, we’ll post the results. In all cases so far, it’s easier to move everything on to a temporary network switch, P2V and then move back to the appropriate networks.</p> <p>Before attempting a P2V, try to get the source machine “as clean as possible”. Ensure the source meets the requirements for free space and service pack levels, run a checkdisk and defrag on all partitions and remove unused programs and drivers. You will also want to remove hardware-vendor specific management tools. If you are doing a P2V migration against a virtual machine, be sure to remove VMWare tools, or the Microsoft Integration components. Stop all non essential services and applications. If you find that the P2V task is failing in the SCVMM scan, then start by looking at what security products you have installed. The P2V agent is installed at the time you click “scan system”. I have had it hang with no errors on either the SCVMM server or the source physical machine. In my case, the VMMInstallDetector service was hanging, and the culprit turned out to be the anti-virus product on the server. You can try to manually run the agent installation from “<a>\\vmmservername\c$\Program</a> Files\Microsoft System Center Virtual Machine Manager 2008 R2\agents\p2v\” if you’d like a closer look at what’s happening.</p> <p>Here’s one last thought on P2V. I always choose the option to shutdown the physical machine after conversion. I don’t want the machine restarted. As soon as it restarts, I know my virtual machine and physical machine are no longer the same and who knows what might change, update or replicate when the physical machine starts. So I want to make sure it stays offline and the machine continues its new life as a virtual machine. There’s one catch. This strategy will result in the overall conversion job ending in a warning state with error 458. The warning essentially tells you that because the machine shutdown, the VMM agent didn’t get removed. If for some reason you decide to bring the machine back online – remember to manually remove it. </p> <p><b></b></p> <p><b>Some Hints for All Migration Scenarios.</b></p> <p>There are a few things that SCVMM “fix up” doesn’t consider that you will need to.</p> <p>- Windows will need activation again. Just like when you clone a machine and there’s a substantial hardware change – a VM migrate will trigger re-activation.</p> <p>- Personally, I’m fussy about my machines looking for hardware that doesn’t exist. It just slows down boot time and I believe, overall machine stability. If you follow the instructions in <a href="http://support.microsoft.com/kb/241257">KB241257</a> you’ll be able to see all the phantom devices in device manager on all versions of Windows (not just 2000 as the KB suggests). Delete these non-present devices.</p> <p>- Near every physical machine I’ve ever converted starts with an ominous “Service Failed to Start” message. A quick look at the event viewer shows EventID 700 –The Parallel port driver service failed to start due to the following error”… the quickest way to make this problem go away is to change HKLM\SYSTEM\CurrentControlSet\Services\Parport\Start from a value of 3 to a value of 4.</p> <p>- Various other products might complain, thinking they’ve been moved, so you should test everything. A perfect example is a terminal services licensing server will need activation again. If you don’t think to look at this, then 90 days from now you can expect user calls.</p> <p>- On the odd occasion, when migrating 2008 servers the HAL may not get switched when it is supposed to be. The symptom isn’t obvious. Integration components will appear to be fine. You’ll run and re-run integration services setup and it will install successful but simply not work. This means no mouse control in the virtual machine which will add to your frustration if you are using remote desktop to connect to the VMM server or Hyper-V Manager. Here’s the trick. On the VM open the system configuration utility (MSConfig.exe). Click the Boot tab, and then click Advanced options. Select the Detect HAL check box, click OK, and then restart the virtual machine. You’ll find that your integration services will now magically start working.</p> <p>- Time synchronization is a funny thing. It’s ok to have VM’s sync time with the host, if the host syncs with a domain controller (PDC emulator) but if you’ve gone and virtualized your PDC emulator you’ll be in for an entertaining circle of lost time. Don’t have your PDC emulator syncing time with the host. (See reference links below).</p> <p><b>Conclusion</b></p> <p>I’d suggest that if you were hoping to point a wizard at your server VLAN, cross your fingers and click “Next, Next, Finish” – then you’re probably going to be disappointed. The migration to Hyper-V needs to be approached with the same planning and consideration you would give to any server refresh or move. With a cautious approach and a maintenance window that will allow for testing and troubleshooting time, you will be ensured success.</p> <p><a name="_GoBack"></a></p> <p>Additional Resources:</p> <p><a href="http://technet.microsoft.com/en-us/library/dd348449(WS.10).aspx">Deployment Considerations for Virtualized Domain Controllers</a></p> <p><a href="http://support.microsoft.com/kb/888794">Considerations when hosting Active Directory domain controller in virtual hosting environments</a></p> <p><a href="http://technet.microsoft.com/en-us/solutionaccelerators/cc197910.aspx">Microsoft Virtualization Solution Accelerators</a></p> <p><a href="http://technet.microsoft.com/en-us/library/bb977556.aspx">Microsoft Assessment and Planning Toolkit</a></p> <p><a href="http://blogs.technet.com/virtualization">Microsoft Virtualization Team Blog</a></p> <p><a href="http://blogs.technet.com/scvmm">The System Center Virtual Machine Manager Team Blog</a></p> </article> <article> <h1>Going Hyper-V R2 – Part 1</h1> <p>rodney.buike — Mon, 25 Jan 2010 16:37:00 GMT</p> <p></p> <p><a href="http://blogs.technet.com/scvmm"></a></p> I was chatting with Brian Bourne from <a href="http://www.cms.ca" target="_blank">CMS Consulting</a> in Toronto about some Hyper-V R2 work that they have done recently. In the conversation Brian shared a ton of learning's from the field on some of the Hyper-V R2 upgrades, deployments and V2V/P2V migrations. I asked him to write up a post and he did, so much so that I had to split it into two posts. <p></p> <p>-------------------------</p> <p>The release of R2 has been a major step forward for Microsoft’s virtualization strategy. It has also meant a rise in customer interest and willingness to move their data center and production servers on to the platform. Here at CMS Consulting, we’ve been offering both <a href="http://www.cmstraining.ca/">training</a> and <a href="http://www.cms.ca/">consulting</a> services to help customers through the process. Here are some of the things we’ve learned along the way.</p> <p><b></b></p> <p><b>General Planning</b></p> <p>When you plan to move to Hyper-V, the source machine is going to be one of the following:</p> <p>· Virtual machine running on VMWare</p> <p>· Virtual machine running on Virtual Server</p> <p>· Virtual machine running on Hyper-V 2008 (R1)</p> <p>· Physical machine on domain</p> <p>· Physical machine off domain</p> <p>If you are unsure where to start, then I strongly recommend you start by running the <a href="http://technet.microsoft.com/en-us/library/bb977556.aspx">MAP tool</a> and using the Virtualization Candidates Assessment for Hyper-V Server Consolidation. A key part of your migration success will be ensuring that the virtual machines perform as well or better than their physical source machines. This exercise in performance counter gathering and capacity planning is where the MAP tool can really assist you. </p> <p>This entire article assumes you will be using System Center Virtual Machine Manager (SCVMM) to do your migration. Ideally you would own both SCVMM and System Center Operations Manager so that you can take advantage of advanced performance and resource optimization (<a href="http://technet.microsoft.com/en-us/library/cc917965.aspx">PRO</a>) and reporting. But here’s a tip. You can download a 180-day <a href="http://technet.microsoft.com/en-ca/evalcenter/cc793138.aspx">evaluation copy</a> of SCVMM (the last one I downloaded showed 365 days left in the eval). The evaluation copy doesn’t appear to be crippled in any way and can be used for your migration.</p> <p>Here are a few high level tips on migrating to a Hyper-V based virtual environment. Actually, it all really boils down to one thought that you have to stick in the front of your brain. “I’m cloning to new hardware”. If you think about cloning to new hardware and the various challenges that brings, you’ll be able to predict most of the failures and gotchya’s.</p> <p><b>Upgrading from Hyper-V 2008 to 2008 R2</b></p> <p>Skip to the next paragraph if you don’t already have Hyper-V. If you have an existing Hyper-V environment, then you’ll likely want to upgrade it in-place. Performance benefits alone should compel you. The in-place upgrade generally goes smoothly. During the compatibility check portion of the installation you’ll be warned to remove the Hyper-V role from the server and directed to <a href="http://support.microsoft.com/kb/957256">KB957256</a>. Here’s the deal. Just make sure all the VM’s are cleanly shut down and that no snapshots are left behind before you start the upgrade. If you do this, you can safely ignore the warning and proceed with an in-place upgrade. For the most part, the process is then fairly obvious with one exception. The network adapters often end up mucked up. This could mean IP addresses missing or assigned to the wrong adapter. Be sure to be physically present for the upgrade. In my experience, this seems to happen consistently when you have allowed the management operating system to share the adapter. Be careful when you “fix” this since it can be a little confusing as to which adapters are real and which ones are virtual on the host machine.</p> <p>The next blog post will cover the migration aspects and look at some best practices for virtual to virtual (V2V) and physical to virtual (P2V) migrations.</p> <p><a href="http://technet.microsoft.com/en-us/library/dd348449(WS.10).aspx">Deployment Considerations for Virtualized Domain Controllers</a> </p> <p><a href="http://support.microsoft.com/kb/888794">Considerations when hosting Active Directory domain controller in virtual hosting environments</a> </p> <p><a href="http://technet.microsoft.com/en-us/solutionaccelerators/cc197910.aspx">Microsoft Virtualization Solution Accelerators</a> </p> <p><a href="http://technet.microsoft.com/en-us/library/bb977556.aspx">Microsoft Assessment and Planning Toolkit</a> </p> <p><a href="http://blogs.technet.com/virtualization">Microsoft Virtualization Team Blog</a> </p> <p><a href="http://blogs.technet.com/scvmm">The System Center Virtual Machine Manager Team Blog</a></p> </article> <article> <h1>Exchange 2010 Gotchas</h1> <p>rodney.buike — Fri, 22 Jan 2010 22:33:09 GMT</p> <p>Exchange 2010 has been released and available for a few weeks now and a lot of people are looking to deploy. I was chatting with Rick Shire, Senior Messaging Consultant at <a href="http://www.cms.ca/">CMS Consulting</a>, who has compiled a list of gotchas, things to look out for, as well as resources for you to be aware of when planning and Exchange 2010 deployment and/or upgrade.</p> <p>------------------------------</p> <div style="margin:0px;"><font size="2" face="Calibri,sans-serif"><span style="font-size:11pt;">Microsoft Exchange Server 2010 was released in early November of this year with a lot of positive reviews. One of the biggest deployment blockers for some customers has been RIM’s lack of a compatible and supported version of BES for Exchange 2010. Thankfully, RIM recently announced a new version of its popular BES software that has full support for Exchange 2010. While this is fantastic news from RIM, there are some other deployment “Gotchas” to consider. </span></font></div> <div style="margin:0px;"><font size="2" face="Calibri,sans-serif"><span style="font-size:11pt;"></span></font> </div> <div style="margin:0px;"><font size="2" face="Calibri,sans-serif"><span style="font-size:11pt;"><b>Client Support</b></span></font></div> <div style="margin:0px;"><font size="2" face="Calibri,sans-serif"><span style="font-size:11pt;">Outlook XP is no longer a supported version with Exchange 2010. Customers will need to factor in an Office refresh into their deployment plans. Another interesting twist is that Microsoft has deprecated the WEBDav API from Exchange 2010. While this may not seem that important at first glance, Microsoft’s client for the MAC, “Entourage”<font color="#1f497d">,</font> has leveraged this API over MAPI for several years. Developers have been urged to rewrite WEBDav applications using Microsoft’s latest Exchange API - Exchange Web Services – for some time. And that is exactly what Microsoft has done for the Entourage client. Entourage 2008, Web Services Edition was released in August of this year.</span></font></div> <div style="margin:0px;"><font size="2" face="Calibri,sans-serif"><span style="font-size:11pt;"></span></font> </div> <div style="margin:0px;"><font size="2" face="Calibri,sans-serif"><span style="font-size:11pt;">Another important note from the client perspective, is that Exchange 2010 requires RPC encryption to be enabled in Outlook. RPC encryption in Outlook 2007 is enabled by default. But what about Outlook 2003? As you guessed, it is disabled by default. If you migrate mailboxes to Exchange 2010 and RPC encryption is disabled in Outlook, Outlook simply will not be able to connect. Fortunately there are a couple of simple fixes. Firstly, you can disable the requirement for RPC encryption on the Exchange server, or simply deploy a GPO that enforces this setting in Outlook. My recommendation is to deploy a GPO and enjoy the benefits of secure messaging.</span></font></div> <div style="margin:0px;"><font size="2" face="Calibri,sans-serif"><span style="font-size:11pt;"></span></font> </div> <div style="margin:0px;"><font size="2" face="Calibri,sans-serif"><span style="font-size:11pt;"><b>Backup Support</b></span></font></div> <div style="margin:0px;"><font size="2" face="Calibri,sans-serif"><span style="font-size:11pt;">The streaming backup API in Exchange 2010 has been deprecated. The only backup API available for Exchange 2010 is VSS (Volume Shadow Copy Service). What this means is that customers will need to upgrade to a VSS aware backup application. That is not the only requirement though. The backup application must also be Exchange 2010 aware and should have full support from your backup vendor. Microsoft DPM 2007 (Data Protection Manager) is a VSS based backup application, but DPM 2007 does not support Exchange 2010. DPM 2010 (currently in Beta) has support for Exchange 2010, but the question becomes, do you want to back up your critical messaging data with Beta software?<font color="#1f497d"> </font>There are backup vendors that have support for Exchange 2010 today. <span>Symantec Backup Exec System Recovery 2010 is one notable example. Check with your current backup vendor to ensure support and compatibility.</span></span></font></div> <div style="margin:0px;"><font size="2" face="Calibri,sans-serif"><span style="font-size:11pt;"></span></font> </div> <div style="margin:0px;"><font size="2" face="Calibri,sans-serif"><span style="font-size:11pt;"><b>Fax Support</b></span></font></div> <div style="margin:0px;"><font size="2" face="Calibri,sans-serif"><span style="font-size:11pt;">Inbound FAX capability is available in Exchange 2007 if you have the Unified Messaging role deployed. If you are using this capability in Exchange 2007, you must look for a 3<font size="-1"><sup>rd</sup></font> party solution for Exchange 2010. Inbound FAX has been deprecated from Exchange 2010. Exchange 2010 will still detect a fax tone and will simply hand off the call to the 3<font size="-1"><sup>rd</sup></font> party fax application. </span></font></div> <div style="margin:0px;"><font size="2" face="Calibri,sans-serif"><span style="font-size:11pt;"><b></b></span></font> </div> <div style="margin:0px;"><font size="2" face="Calibri,sans-serif"><span style="font-size:11pt;"><b>Other 3</b><font size="-1"><b><sup>rd</sup></b></font><b> Party Applications</b></span></font></div> <div style="margin:0px;"><font size="2" face="Calibri,sans-serif"><span style="font-size:11pt;">3<font size="-1"><sup>rd</sup></font> party applications (or custom in-house applications) that integrate with Exchange should be tested for compatibility and have full support by the application vendor. Take an inventory of these applications and consult with the appropriate application vendors. There have been several APIs deprecated from Exchange 2010, so this step is critically important. Any application written to one of these APIs will simply break in Exchange 2010.<font color="#1f497d"> </font>The list of deprecated APIs includes a) ExOLEDB, b) WebDAV, c) CDOEx and d) Store Events</span></font></div> <div style="margin:0px;"><font size="2" face="Calibri,sans-serif"><span style="font-size:11pt;"></span></font> </div> <div style="margin:0px;"><font size="2" face="Calibri,sans-serif"><span style="font-size:11pt;">Some 3<font size="-1"><sup>rd</sup></font> party vendors are ahead of the curve and have support for Exchange 2010 today. Mimosa, a 3<font size="-1"><sup>rd</sup></font> party archiving vendor, has support for Exchange 2010 with its NearPoint product. NetApp has updated its SnapManager for Exchange to support Exchange 2010. The list of products goes on, but check with your vendors to ensure there are no other deployment blockers. </span></font></div> <div style="margin:0px;"><font size="2" face="Calibri,sans-serif"><span style="font-size:11pt;"></span></font> </div> <div style="margin:0px;"><font size="2" face="Calibri,sans-serif"><span style="font-size:11pt;"><b>References</b></span></font></div> <div style="margin:0px;"><font size="2" face="Calibri,sans-serif"><span style="font-size:11pt;">Proper planning is vital to a successful Exchange 2010 deployment. Please reference the following links for helpful planning guidance. </span></font></div> <div style="margin:0px;"><font size="2" face="Calibri,sans-serif"><span style="font-size:11pt;"></span></font> </div> <div style="margin:0px;"><font size="2" face="Calibri,sans-serif"><span style="font-size:11pt;">General Planning Guidance</span></font></div> <div style="margin:0px;"><font color="#0066cc" size="2" face="Calibri,sans-serif"><span style="font-size:11pt;"><u><a href="http://technet.microsoft.com/en-ca/library/bb125239.aspx">http://technet.microsoft.com/en-ca/library/bb125239.aspx</a></u><a href="http://blogs.technet.com/redir.aspx?C=5cd5abfbe79a469cad61009e1ba446b3&URL=http%3a%2f%2ftechnet.microsoft.com%2fen-us%2flibrary%2fbb125239(EXCHG.140).aspx" target="_blank"></a></span></font></div> <div style="margin:0px;"><font size="2" face="Calibri,sans-serif"><span style="font-size:11pt;"><font color="#1f497d"></font></span></font> </div> <div style="margin:0px;"><font size="2" face="Calibri,sans-serif"><span style="font-size:11pt;">Exchange 2010 Backup</span></font></div> <div style="margin:0px;"><font color="#0066cc" size="2" face="Calibri,sans-serif"><span style="font-size:11pt;"><u><a href="http://www.microsoft.com/systemcenter/dataprotectionmanager/en/us/protect-exchange.aspx">http://www.microsoft.com/systemcenter/dataprotectionmanager/en/us/protect-exchange.aspx</a></u><a href="http://blogs.technet.com/redir.aspx?C=5cd5abfbe79a469cad61009e1ba446b3&URL=http%3a%2f%2fwww.microsoft.com%2fsystemcenter%2fdataprotectionmanager%2fen%2fus%2fprotect-exchange.aspx" target="_blank"></a></span></font></div> <div style="margin:0px;"><font size="2" face="Calibri,sans-serif"><span style="font-size:11pt;"></span></font> </div> <div style="margin:0px;"><font size="2" face="Calibri,sans-serif"><span style="font-size:11pt;">RIM Announcement</span></font></div> <div style="margin:0px;"><font color="#0066cc" size="2" face="Calibri,sans-serif"><span style="font-size:11pt;"><a href="http://na.blackberry.com/eng/support/software/server_compatibility.jsp#tab_tab_news">http://na.blackberry.com/eng/support/software/server_compatibility.jsp#tab_tab_news</a></span></font></div> </article> <article> <h1>Shift Right Click to access additional explorer file and folder options</h1> <p>daniel.nerenberg — Thu, 10 Sep 2009 15:30:00 GMT</p> <P>Windows 7 has been RTMd for a few weeks now, and the general availability is quickly approaching. I wanted to share a few cool new features that have yet to be widely talked about, (at least I haven’t seen them blogged anywhere yet.)</P> <P>The first feature is actually hidden away, and I discovered while right clicking on a folder at the same time as I held down SHIFT. Normally if you just right click you get the following menu:</P> <P><A href="http://thelazyadmin.com/images/ShiftRightClicktoaccessadditionalfeature_E3A8/image.png"></A> </P> <P>If you SHIFT right click here is the menu you’ll see: notice you now have several new and very useful commands:</P> <P>Open in new process</P> <P>Open in new window</P> <P>and my favourite Open command windows here</P> <P><A href="http://thelazyadmin.com/images/ShiftRightClicktoaccessadditionalfeature_E3A8/image_3.png"></A></P> <P>Hope this helps you be that much more productive while using Windows 7!</P> </article> <article> <h1>Federated Search Updated for Windows 7 RTM</h1> <p>daniel.nerenberg — Thu, 10 Sep 2009 07:35:00 GMT</p> <P>One of the features that we talked about a few months ago during the Beta and RC of <A href="http://thelazyadmin.com/blogs/thelazyadmin/archive/2009/02/03/federated-search-on-windows-7.aspx">Windows 7 was the new federated search features</A>. It came to our attention that the TLA federated search OSDX file was not compatible with Windows 7 RTM. </P> <P>So our first announcement is to say that we have fixed that and posted an updated version of the file available <A href="http://thelazyadmin.com/TLAFederatedSearch.zip">here</A>. The original article will also download the newest file.</P> <P>Second as TheLazyAdmin is also now on Twitter we also built a Federated search provider to search Twitter. While this is a pretty basic Search provider we thought you might like it. After you add it you can search Twitter from you Windows Explorer search bar!</P> <P><A href="http://thelazyadmin.com/TLATwitterFederatedSearch.zip">Download the Windows 7 Twitter Federated Search Provider</A></P> <P>Have Fun, and let us know if you build any other cool Federated Search providers.</P> </article> <article> <h1>Virtual PC in Windows 7</h1> <p>daniel.nerenberg — Fri, 22 May 2009 15:33:00 GMT</p> <p>A few weeks ago Rodney wrote a great post about the new XP mode in Windows XP. This is based on a new version of Virtual PC. I wanted to take a moment to talk about the new version which was released in beta along with the Windows 7 RC.</p> <p>First this version of Virtual PC will only work with Windows 7, so earlier versions of Windows will have to stick with Virtual PC 2007.</p> <p>Second, you can run Windows Vista and windows 7 in a virtual PC, what is really cool is that you can get full Aero glass compatibility in a virtual PC environment after you install the integration features. (notice that in Virtual PC it’s integration features not integration components as it is in Hyper-V) Notice the transparency effect in the screenshot below.</p> <p><a href="http://thelazyadmin.com/images/VirtualPCinWindows7_7D2/image.png"></a> </p> <p>Another change is the integration of the virtual machine interface into Windows Explorer</p> <p><a href="http://thelazyadmin.com/images/VirtualPCinWindows7_7D2/image_3.png"></a> </p> <p>Some additional things to keep in mind, in order to run Virtual PC for Windows 7 your CPU, chipset and BIOS need to support hardware virtualization.</p> <p>Here is the link to <a href="http://www.microsoft.com/windows/virtual-pc/download.aspx">download virtual PC</a></p> </article> <article> <h1>Windows 7 App Locker</h1> <p>daniel.nerenberg — Thu, 21 May 2009 15:31:00 GMT</p> <P>Window 7 RC has been out for a few weeks now the TLA team has been busy learning and testing all the great new features. Your tip for today is on Windows 7 App Locker. Many of you know about Software Restriction Policies. They allow you to block the execution of a program by file name or hash calculation. Many of you probably also know how it was a race to block applications in our network with these methods. Users could change the name of the file, or applications updates so frequently that you would constantly need to generate new hash files.</P> <P>Windows 7 introduces a great new feature called App Locker. App locker works under the premise that it’s easier to allow the applications you want and block the rest. If you’re running a Windows 7 machine you can see App Locker by typing gpedit.msc into your search bar and pressing enter.</P> <P><A href="http://thelazyadmin.com/images/Windows7AppLocker_12CF5/image.png"></A> </P> <P>You can define policies based on Executables, Windows Installers, and scripts. Creating a new policy is really simple. right click on any of the 3 categories and click new.</P> <P><A href="http://thelazyadmin.com/images/Windows7AppLocker_12CF5/image_3.png"></A> </P> <P>You can create a policy to allow or deny an executable. You can also select witch groups the rule will apply to.</P> <P><A href="http://thelazyadmin.com/images/Windows7AppLocker_12CF5/image_4.png"></A> </P> <P>You can choose to create a rule based on a publisher (the program needs to be signed) or a program path, or a file hash (usually a good choice if the program isn’t signed)</P> <P><A href="http://thelazyadmin.com/images/Windows7AppLocker_12CF5/image_5.png"></A> </P> <P>For this example I chose publisher. the Rule wizard uses the information stores application signing certificate to learn about the application. You can adjust what level of information you’ll allow for an application.</P> <P><A href="http://thelazyadmin.com/images/Windows7AppLocker_12CF5/image_6.png"></A> <BR>In the above example I set the level to allow any version of Internet Explorer. (regardless of the file name used or the version)</P> <P>You can use the same steps to create exceptions for specific applications. One of the best features is the ability to automatically generate rules.</P> <P><A href="http://thelazyadmin.com/images/Windows7AppLocker_12CF5/image_7.png"></A> </P> <P>This scans your applications in the program files directory and creates permissions for those programs to run. Perfect for quickly creating a baseline set of rules for a gold image.</P> </article> <article> <h1>Using XP Mode in Windows 7</h1> <p>rodney.buike — Fri, 01 May 2009 03:36:29 GMT</p> <p>One of the major challenges with moving to a new OS is dealing with older applications. This was an issue with the release of Windows Vista and in order to mitigate that with Windows 7, Microsoft has released a feature called XP Mode, which runs a Windows XP SP3 virtual machine in the background that can be used to run legacy applications. What is really interesting is that as a user, you only see a shortcut on the desktop or start menu and interact with the application as you would any other application. Launch an application and the VM wakes up (by default it hibernates when not in use) and presents the application, close the app and the VM hibernates!</p> <p>There are two components that need to be installed, Windows Virtual PC which is the successor to Virtual PC 2007, and the XP Mode VM. Once they are installed there is a simple set up process to turn on Automatic Updates, set a username and password for the XP VM and you are on your way. The VM can be joined to AD and act as any other domain member.</p> <p>There are the typical Virtual PC settings such as memory, disk, networking etc… but the addition of Auto Publish allows applications that reside in the XP VM to appear in the Windows 7 start menu.</p> <p><a href="http://thelazyadmin.com/images/UsingXPModeinWindows7_1210C/XPMode2.png"></a></p> <p>So to the end user they access the applications just like any other. </p> <p> </p> <p></p> <p><a href="http://thelazyadmin.com/images/UsingXPModeinWindows7_1210C/XPMode1.png"></a> </p> <p>Any application that is installed in the XP VM can be published simply by dropping the shortcut to launch it in All Users –> Start Menu As an example I placed the IE6 shortcut in All Users\Start Menu and launched it on Windows 7 next to IE8.</p> <p><a href="http://thelazyadmin.com/images/UsingXPModeinWindows7_1210C/XPModeIE6IE8.png"></a> </p> <p>You can also mount any USB device in the XP VM as Windows Virtual PC now supports USB devices!</p> <p> </p> <p><a href="http://thelazyadmin.com/images/UsingXPModeinWindows7_1210C/XPMode4.png"></a> </p> <p></p> <p></p> <p>If you are looking to use this to solve an enterprise wide app compat issue you can use this same technology with the addition of a management suite with MED-V, or Microsoft Enterprise Desktop Virtualization, which is currently in beta (as is XP Mode and Windows 7 at the time of this writing) or the <a href="http://thelazyadmin.com/blogs/thelazyadmin/archive/2008/10/13/application-compatibility-with-the-standard-user-analyzer.aspx">Application Compatibility Toolkit which we wrote about previously</a>.</p> <p>For more information see:</p> <p><a href="http://www.microsoft.com/windows/enterprise/products/med-v.aspx">Microsoft Enterprise Desktop Virtualization</a></p> <p><a href="https://connect.microsoft.com/site/sitehome.aspx?SiteID=665">Download MED-V Beta 1</a></p> <p><a href="http://www.microsoft.ca/springboard">Microsoft Springboard Portal</a></p> </article> <article> <h1>Windows 7 Password Vault</h1> <p>daniel.nerenberg — Tue, 10 Mar 2009 03:31:00 GMT</p> <P>Oh boy is this a feature designed for lazy admins. When I’m not writing and keeping the site up to date I’m usually onsite working for clients. Often I’m required to have multiple emails accounts active when working with various partners.</P> <P>Now this isn’t usually a problem except as many know you can’t have multiple exchange accounts open in outlook at the same time. This means that you need to create separate profiles for each Exchange account. This also means that you need to type in a password every time you change profiles. Being that retyping passwords can be a drag on productivity, (fat finger errors and typos) wouldn’t it be great if you could have Windows remember your different accounts associated with your already logged on user account?</P> <P>In the control panel choose <EM>Users Accounts and Family Safety</EM></P> <P><A href="http://thelazyadmin.com/images/Windows7PasswordVault_13E93/image.png"></A> </P> <P>Then click on <EM>Credentials Manager</EM></P> <P> </P> <P> </P> <P><A href="http://thelazyadmin.com/images/Windows7PasswordVault_13E93/image_3.png"></A> </P> <P>You can now see credentials that you have already entered in for various sites. If you check “Save Username and Password” in the checkbox the information will be stored here.</P> <P><A href="http://thelazyadmin.com/images/Windows7PasswordVault_13E93/image_4.png"></A> </P> <P>Once a credential has been added and stored here it will automatically be supplied when you next access the resource in question. In my case each time I open Outlook and choose a different profile I will skip having to re-enter the password for the specific Exchange account.</P> <P><STRONG><FONT color=#ff0000>IMPORTANT NOTE:</FONT></STRONG> Your default Windows account should be secured with a strong password, and ideally it should also be secured with multifactor authentication. </P> </article> <article> <h1>Sync DSRM and Domain Admin Passwords</h1> <p>rodney.buike — Fri, 27 Feb 2009 17:00:00 GMT</p> <p>Setting a password for Directory Services Restore Mode is something that is done during the setup of Active Directory. As a best practice it has always been recommended to change that password on a regular basis, as you would with any other password. The challenge was the process to do this was complicated and required you to use NTDS in <a href="http://thelazyadmin.com/blogs/thelazyadmin/archive/2006/03/24/Reset-Disaster-Recovery-Mode-Password.aspx">Windows 2003</a>.</p> <p>This has been addressed in Windows Server 2008 where we can now sync the DSRM password with a Domain Administrator account. There is a <a href="http://support.microsoft.com/hotfix/KBHotfix.aspx?kbnum=961320&kbln=en-us">hotfix that needs to be installed which you can download here</a>. (Note: You do need to request the hotfix and it should be included in SP2) After it is installed and the server is rebooted, you can run the following command to sync the passwords.</p> <blockquote> <p><span class="userInput"><em>ntdsutil "set dsrm password" "sync from domain account <DomainAdminAccountName>" q q</em></span></p></blockquote> </article> <article> <h1>Recovering Deleted AD Objects in Server 2008 R2</h1> <p>rodney.buike — Tue, 24 Feb 2009 17:00:00 GMT</p> <p><a href="http://thelazyadmin.com/blogs/thelazyadmin/archive/2009/02/23/what-s-new-in-2008-r2-active-directory-recycle-bin.aspx">In a previous entry,</a> guest blogger Sean Kearney shared a new feature in Windows Server 2008 R2 directory services called the <a href="http://thelazyadmin.com/blogs/thelazyadmin/archive/2009/02/23/what-s-new-in-2008-r2-active-directory-recycle-bin.aspx">Active Directory Recycle Bin</a>. Sean is back to show us how to recover those deleted objects.</p> <p>-------------------------</p> <p>So you’ve done it. We all have. Deleted a user, group, OU by accident but thankfully you have 2008 R2 in place and the AD Recycle Bin enabled. To recover now is a breeze! Start by launching Powershell V2 on Server 2008 R2 and run the following command </p> <blockquote> <p><em>GET-ADOBJECT –filter {name –like “missingitem*”} –includedeletedobjects | RESTORE-ADOBJECT</em> </p> </blockquote> <p>That’s it. Nothing harder than that. Was that so hard? The great thing, is as long as it’s an object in Active Directory, it’s protected by this new feature for 180 days. Also, this just does restore the object. It’s restores <em>the object, its security, its trusts</em>! </p> <p>If you’d like to learn more about the Active Directory Recycle Bin, Check out these great resources on Technet.com </p> <p><a href="http://edge.technet.com/Media/Active-Directory-Recycle-Bin/">Active Directory Recycle Bin - Instructional Video on </a>Technet<a href="http://edge.technet.com/Media/Active-Directory-Recycle-Bin/"> Edge</a></p> </article> <article> <h1>What’s New in 2008 R2 – Active Directory Recycle Bin</h1> <p>rodney.buike — Mon, 23 Feb 2009 18:33:41 GMT</p> <p>I’ve done it, I know people who have done it, and I bet you have done it before as well. Right-click an object in Active Directory Users and Computers and instead of clicking the properties link you accidentally hit delete. Boom, gone and the only way to get it back is via a restore from backup. Restart the DC, boots into Directory Services Restore Mode (DSRM), restore the system state backup and apply either a authoritative or non-authoritative restore.</p> <p>Guest author, Sean Kearney, covers this new feature in Windows Server 2008 R2.</p> <p>-------------------------</p> <p>One of the fantastic features provided in Server 2008 R2 is the new Recycle Bin for Active Directory.</p> <p>I recognize that nobody here is going to intentionally mess up their own Active Directory. But problems can happen. A Junior technician misheard the phrase “Disable” with “Delete”, a malicious Administrator leaving the company, dumb luck. Any number of problems can occur and this feature will save the day.</p> <p>There are a few caveats to using this</p> <ul> <li>You must have the Domain functional level in Server 2008 R2 mode.</li> <li>You must enable the feature by using LDP.EXE or Powershell.</li> <li>It is managed and used 100% by Powershell. There is no GUI version presently.</li> <li>Once enabled, you cannot disable it. This is a one way trip folks</li> <li>The enabled Recycle Bin has a 180 day retention policy.</li> </ul> <p>That’s it. In Server 2008 R2, select the new Active Directory Powershell under Administrative Tools and type in the following command</p> <blockquote> <p><em>GET-ADOPTIONALFEATURE –filter {name –like “*”}</em></p> </blockquote> <p>You will be presented with a screen showing you </p> <blockquote> <p>FeatureScope : {Forest} <br />Name : Recycle Bin Feature <br />RequiredForestMode : Windows2008R2Forest <br />IsDisableable : False <br />ObjectGUID : 0599c1a6-6f8f-42d4-b9a0-ab2791d4719e <br />ObjectClass : msDS-OptionalFeature <br />FeatureGUID : 766ddcd8-acd0-445e-f3b9-a7f9b6744f2a <br /><strong>EnabledScopes</strong> : <br />RequiredDomainMode : <br />DistinguishedName : CN=Recycle Bin Feature,CN=Optional Features,CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=energized,DC=energizedtech,DC=com</p> </blockquote> <p>Looking at the information above, there are no enabled scopes which confirms that the AD Recycle Bin is presently disabled. So to make all this useful, I guess we should turn it on. So in the same Powershell Window key in this command</p> <blockquote> <p><em>ENABLE-ADOPTIONALFEATURE ‘Recycle Bin Feature’ –score forest –target ‘domainfqdn’</em> </p> </blockquote> <p>You will get a prompt warning you that it will make the change. Choose “Yes” if you wish to enable this feature or CTRL-C to abort. Once you’re done, it’s active. To confirm, run the following command again</p> <blockquote> <p><em>GET-ADOPTIONALFEATURE –filter {name –like “*”}</em></p> </blockquote> <p>And you’ll get a similar response but note</p> <blockquote> <p>FeatureScope : {Forest} <br />Name : Recycle Bin Feature <br />RequiredForestMode : Windows2008R2Forest <br />IsDisableable : False <br />ObjectGUID : 0599c1a6-6f8f-42d4-b9a0-ab2791d4719e <br />ObjectClass : msDS-OptionalFeature <br />FeatureGUID : 766ddcd8-acd0-445e-f3b9-a7f9b6744f2a <br /><strong>EnabledScopes : {CN=Partitions,CN=Configuration,DC=energized,DC=energizedtech,DC=com}</strong> <br />RequiredDomainMode : <br />DistinguishedName : CN=Recycle Bin Feature,CN=Optional Features,CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=energized,DC=energizedtech,DC=com</p> </blockquote> <p>You’ll see the “Enabled Scopes” is now covering the domain.</p> <p>For more information see:</p> <p> <p><a href="http://edge.technet.com/Media/Active-Directory-Recycle-Bin/"></a></p> <a href="http://technet.microsoft.com/en-us/library/dd392261.aspx">Active Directory Recycle Bin Step-by-Step Guide</a></p> </article> <article> <h1>Virtual Server to Hyper-V Migration</h1> <p>rodney.buike — Tue, 17 Feb 2009 18:25:31 GMT</p> <p>A lot of people are making the switch from Virtual Server to Hyper-V lately. I’ve done it on my home network and Thelazyadmin.com servers are in progress of moving to Hyper-V as well. While you can simply copy over the VHD and create a new VM in Hyper-V and mounting that VHD there is a tool that can help you with this task. VMC2HV is a free tool that can be used to import a Virtual Server (or VirtualPC) based VM into Hyper-V. It is a pretty simple tool to use, specify the name and credentials for your Hyper-V server, choose the VMC file of the machine you want to import and click Create Virtual Machine.</p> <p><a href="http://thelazyadmin.com/images/VirtualServertoHyperVMigration_9290/VMC2HV1.jpg"></a> </p> <p>A few things to note when using this tool…</p> <ul> <li>Once the migration is complete you will have to uninstall the VMAdditions and install the Integration Components.</li> <li>Installing the Integration Components will update the HAL so going back to Virtual Server/PC will be difficult</li> <li>Hyper-V will not boot from virtual SCSI so you will have to move the VMs boot drive to the virtual IDE bus</li> <li>You can run this tool on X86 and x64 installs of Windows Vista and Server 2008, locally or remotely from the Hyper-V server.</li> </ul> <p>You can <a href="http://download.microsoft.com/download/f/d/0/fd05def7-68a1-4f71-8546-25c359cc0842/TenSeldamUtility2009_03.exe">download VMC2HV here</a>!</p> </article> <article> <h1>Powercfg and Power Efficiency Diagnostics Reports</h1> <p>daniel.nerenberg — Mon, 16 Feb 2009 17:00:00 GMT</p> <P>One of the new command tools introduced in Windows Vista was powercfg. Essentially it’s a command line tool that enables users to control power settings. There are a lot of very granular setting that can be configured. To get an idea of what you can do with it just run the following command from the command line:</P> <P><EM>powercfg –Help | more</EM></P> <P>You’ll need to pipe that help output to a “more” because the standard command prompt settings won’t buffer the entire help output!</P> <P>A really cool new feature for Windows 7 is the Power Efficiency Diagnostic Reports. This will allow power users and administrators understand and optimize their systems for maximum power efficiency and by virtue maximum battery life for laptops. In large environments the cumulative effect of optimizing power usage over thousands of computers can result in tangible power and money savings!</P> <P>To generate the power Power Efficiency Diagnostics Report open an administrative command prompt and run:</P> <P><EM>powercfg -energy</EM></P> <P><A href="http://thelazyadmin.com/images/PowercfgandPowerEfficiencyDiagnosticsRep_9CF1/image.png"></A> </P> <P>The system will observe the behaviour of your devices and settings for 60 seconds. Once complete the following output will be generated:</P> <P><A href="http://thelazyadmin.com/images/PowercfgandPowerEfficiencyDiagnosticsRep_9CF1/image_3.png"></A> </P> <P>The output file is dropped into the current working directory. Open the report in IE to get a detailed list of the information. Also keep in mind that the PowerProfile you’re using will have an impact on the report. </P> <P><A href="http://thelazyadmin.com/images/PowercfgandPowerEfficiencyDiagnosticsRep_9CF1/image_4.png"></A> </P> <P>Notice that the errors in the above screenshot are all related to the fact that I have set High Performance enable while on battery. Some may not agree that it is an “error” but the thing to keep in mind is that this is in the context of creating maximum power efficiency. When I change my power profile to one that uses speed step and lowers the performance on my laptop this error will resolve and go if I run the report again.</P> <P><A href="http://thelazyadmin.com/images/PowercfgandPowerEfficiencyDiagnosticsRep_9CF1/image_5.png"></A> </P> <P>Some other errors that can be generated relate to drivers or peripherals that won’t enter a low power mode. If you ever dealt with a laptop that won’t sleep a bad driver that doesn’t support advanced power management can often be the problem. This report can help isolate these issues.</P> <P><A href="http://thelazyadmin.com/images/PowercfgandPowerEfficiencyDiagnosticsRep_9CF1/image_6.png"></A> </P> <P>Near the bottom of the report is information about CPU utilization, processes, and this little gem (screen shot above) This report can help troubleshoot battery usage and charge capacity. This gives admin’s a great way to decide when a battery should be replaced. If the last full charge is consistently dropping from the design capacity it may be time to replace the battery.</P> <P>With this report Admins can tweak power profiles to realize the maximum benefits of new power efficient computer platforms. Happy efficient computing!</P> </article> <article> <h1>PowerShell Integrated Scripting Environment</h1> <p>rodney.buike — Fri, 13 Feb 2009 17:00:00 GMT</p> <p> PowerShell 2.0, included in Windows 7 and Server 2008 R2, includes a new Integrated Scripting Environment (ISE) which provides you with a GUI based tool to write your scripts and learn PowerShell. To launch PowerShell 2.0 ISE simply drill down to Start –> All Programs –> Accessories –> Windows PowerShell.</p> <p><a href="http://thelazyadmin.com/images/PowerShellIntegratedScriptingEnvironment_FB8B/PowerShellISE1.png"></a></p> <p>Once that is launched you’ll see the ISE load and you are ready to begin.</p> <p><a href="http://thelazyadmin.com/images/PowerShellIntegratedScriptingEnvironment_FB8B/PowerShellISE.jpg"></a> </p> <p>The top portion, aka the Script Pane, is your scripting environment which allows you to write PS scripts. The play and stop buttons are used to start and stop the running of a script. The middle portion, aka the Output Pane, is where the script is executed and the results displayed. Finally at the bottom is the Command Pane, where you can run individual Cmdlets and “one-liners”. So besides a nice GUI editor why do I like the PowerShell ISE? </p> <ul> <li>· ISE Features - Tab completion, line numbering, indenting and the always useful search and replace. </li> <li>· Customizable ISE - You can change the color, location and size of the various panes to suit your style.</li> <li>· Colored Syntax – Like other scripting environments different colors are used to highlight variables, strings, objects and Cmdlets. </li> <li>· Support for Unicode - The PowerShell ISE supports Unicode.</li> <li>· Debugging. I always make mistakes and the ability to set breakpoints, walk through the script step by step really helps find those errors.</li> </ul> <p>If you are using Windows 7 or Server 2008 R2 give the ISE a try! Compared to Notepad it is a dream to work with :)</p> </article> <article> <h1>Create a “Bootable” Windows 7 VHD</h1> <p>rodney.buike — Wed, 11 Feb 2009 03:48:00 GMT</p> <P>A few weeks back we posted an entry on <A href="http://thelazyadmin.com/blogs/thelazyadmin/archive/2009/01/12/windows-7-boot-from-vhd.aspx">how to boot from a Windows 7 or Server 2008 R2 VHD</A>. Booting from VHD is new to Windows 7 and Server 2008 R2 but one of the caveats was you needed a “clean” VHD to boot from. There is a very simple way to create this VHD using an open source tool available on the <A href="http://code.msdn.microsoft.com/">MSDN Code Gallery</A> called <A href="http://code.msdn.microsoft.com/wim2vhd">WIM2VHD</A>.</P> <P>WIM2VHD is a command line tool that converts the WIM image into a VHD you can use to boot off. It does have a few requirements…</P> <UL> <LI>The prep machine has to be running Windows 7, Server 2008 R2, either of which could be running in a Hyper-V VM </LI> <LI>A Windows 7 or Server 2008 R2 installation media </LI> <LI>The <A href="http://www.microsoft.com/downloads/details.aspx?familyid=4AD85860-D1F4-42A1-A46C-E039E3D0DB5D&displaylang=en">Windows 7 Automated Install Kit Beta</A> </LI></UL> <P>There are a number of switches you will need to know as well in order to create the VHD file…</P> <UL> <LI>/wim: specifies the path to the WIM file </LI> <LI>/sku: which version (ServerStandard, Ultimate etc…) You can also use the SkuIndex if you retrieved that with the ImageX tool </LI> <LI>/vhd: specifies the path and the name of the VHD to be created </LI> <LI>/size: specifies the size of the VHD in MB </LI> <LI>/disktype: specifies the type of disk, Dynamic or Fixed </LI></UL> <P>There are some additional switches which you can find on the WIM2VHD documentation that allow you to further customize the VHD to be created.</P> <P>So let’s say we wanted to create a Windows 7 Ultimate VHD on a 40GB fixed disk; we’d use the following command:</P> <BLOCKQUOTE> <P><EM>cscript wim2vhd.wsf /wim:X:\sources\install.wim /sku:ULTIMATE /vhd:C:\Win7Ultimate.vhd /size:40960 /disktype:Fixed</EM></P></BLOCKQUOTE> <P>Or if we wanted to create a Windows Server 2008 R2 Standard VHD on a 40GB dynamically expanding disk we’d use the following command:</P> <BLOCKQUOTE> <P><EM>cscript wim2vhd.wsf /wim:X:\sources\install.wim /sku:SERVERSTANDARD /vhd:C:\ServerStandardR2.vhd /size:40960 /disktype:Dynamic</EM></P></BLOCKQUOTE> <P>You can <A href="http://code.msdn.microsoft.com/wim2vhd/Release/ProjectReleases.aspx?ReleaseId=2213">download WIM2VHD and the release documents here</A>.</P> </article> <article> <h1>What’s New in 2008 R2 – Offline Domain Join</h1> <p>rodney.buike — Mon, 09 Feb 2009 17:00:00 GMT</p> <P>For as long as we have had Active Directory domains, we have been required to to join client to the domain while they were online and connected to AD. Without that the join would fail. Now you always had the ability to join with a script using the NETDOM command but with Windows Server 2008 R2 we can now join a client to our AD domain while offline. The real benefit hear is that there is no need to supply or enter domain admin credentials. As you’ll see below a TXT file is created but just for fun open it up with notepad and see what you can make out :)</P> <P>It is a simple three step process that requires you to run a new utility called DJOIN from an already joined Server 2008 R2 computer.</P> <OL> <LI>Create a text file with DJOIN that contains the required information for a computer to join AD</LI> <LI>Import the text file using DJOIN on the target computer you wish to join AD</LI> <LI>Once connected to the domain, reboot the computer and it will join AD</LI></OL> <P>For joining a computer to the domain using DJOIN there are some switches you need to know about first.</P> <UL> <LI>/provision – used when there is no existing AD account for the computer </LI> <LI>/reuse – if you already created a computer account in AD and would like to use it</LI> <LI>/domain – specifies the domain to join</LI> <LI>/machine – specifies the name of the machine, if the computer has a different name it will be renamed</LI> <LI>/machineou – specifies the OU to join, if you omit this it will automatically be placed in the default computers OU</LI> <LI>/savefile – saves the file to be imported.</LI></UL> <P>A typical command would be…</P> <BLOCKQUOTE> <P><EM>djoin.exe /provision /domain thelazyadmin.com /machine client01 /machineou Desktops /savefile client01.txt</EM></P></BLOCKQUOTE> <P>To join client01 to the domain we would next import client01.txt with the following command run with administrative privileges…</P> <BLOCKQUOTE> <P><EM>djoin /requestODJ /loadfile client01.txt /windowspath %systemroot% /localos</EM></P></BLOCKQUOTE> <P>Reboot once the client is connected to the domain and the join will be made.</P> </article> <article> <h1>What’s New in 2008 R2 – .NET and PS in Core</h1> <p>rodney.buike — Fri, 06 Feb 2009 17:00:00 GMT</p> <P>The one thing I missed with Server Core was PowerShell. While you can run PowerShell cmdlets and scripts remotely, at times it would have been nice to run it locally. The reason PowerShell was not included was due to the lack of .NET in Server Core. That changes in R2.</P> <P>Windows Server Core 2008 R2 includes a subset of .NET which allows PowerShell, as well as other components like ASP.NET. Specifically Server Core R2 includes:</P> <UL> <LI>.NET 2.0</LI> <LI>.NET 3.0 and 3.5</LI> <UL> <LI>Windows Workflow Foundation (WF)</LI> <LI>Windows Communication Foundation (WCF)</LI> <LI>Language Integrated Query (LINQ)</LI></UL> <LI>Support for WoW64 if you are running 32 bit applications</LI></UL> <P>Windows Presentation Foundation (WPF) isn’t included but then with no GUI in Server Core it doesn’t really matter much. There are a few commands you need to know to get it working in R2.</P> <P>Install .NET 3.0 and 3.5</FONT></P> <BLOCKQUOTE> <P><EM>Start /w ocsetup NetFx3-ServerCore</EM></P></BLOCKQUOTE> <P>Enable 32 bit support, run the above, then</P> <BLOCKQUOTE> <P><EM>Start /w ocsetup ServerCore-WOW64</EM></P> <P><EM>Start /w ocsetup NetFx3-ServerCore-WOW64</EM></P></BLOCKQUOTE> <P>Enable PowerShell</P> <BLOCKQUOTE> <P><EM>Start /w ocsetup MicrosoftWindowsPowerShell</EM></P></BLOCKQUOTE> <P>Launch PowerShell</P> <BLOCKQUOTE> <P><EM>Start c:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe</EM></P></BLOCKQUOTE> <P> </P> </article> <article> <h1>What’s New in 2008 R2 – Core Parking</h1> <p>rodney.buike — Thu, 05 Feb 2009 17:00:00 GMT</p> <p>Green IT, Green IT, everywhere you turn there is something about Green IT. With increased power and cooling costs a lot of people are using virtualization to reduce these costs but Windows Server 2008 R2 brings a new feature called Core Parking which helps as well. It does this by moving all processing to a core (or cores) and putting the other cores to “sleep”.</p> <p><a href="http://thelazyadmin.com/images/WhatsNewin2008R2CoreParking_FE46/corepark1.png"></a> </p> <p><em>Image courtesy of Microsoft Corporation</em></p> <p>As processing power increases more cores “wake up” and take on the additional processing. Considering Windows Server 2008 R2 supports up to 256 cores this feature can really provide some savings while not impacting performance.</p> <p>Further to Core Parking, Windows Server 2008 R2 can also adjust the <a href="http://en.wikipedia.org/wiki/ACPI#Processor_states">“P-State”</a> to reduce the power consumption of a core. In a nutshell this is like Intel SpeedStep which can “slow” down the CPU on your notebook to conserve power when you run on battery.</p> <p> </p> <p><a href="http://thelazyadmin.com/images/WhatsNewin2008R2CoreParking_FE46/corepark2.png"></a> </p> <p><em>Image courtesy of Microsoft Corporation</em></p> <p>All of this can be controlled via Group Policy in an AD domain or via the Local Policy on a standalone server.</p> </article> </main></body></html>