www.ballblog.net

Wyse zero clients, XenApp, and local printers

2012-01-21T15:50:00.006-05:00

If you are deploying Wyse Xenith zero clients to support a XenApp shared desktop infrastructure, you may run into a situation in which a locally attached USB printer is not mapped inside the XenApp session. I doubt this is real news to anyone as this may happen on any device, but the odd thing I witnessed last week is that I had, in this case, a Lexmark E250d attached to a Xenith zero client and when connecting to a XenApp session, not only did it not map, but there was no event log 1106 or 1107 "MetaFrameEvents" entry in the Application Log on the XenApp server. It was like the printer was not plugged in at all, though it was detected by the Wyse device itself.

One thing I did not know, is that the Xenith zero clients, do not support the Citrix Universal Print driver. I received the following from a Wyse engineer:

In the meantime you should realize that there is no support for the Universal Print driver on the Xenith. The only printing options through a Xenith/ThinOS device are by using a network printer, having printer drivers installed on the Citrix server or by using a 3rd party print utility such as ThinPrint which does support Wyse devices. In order for the Universal Print driver to work from Citrix, you would need to have a Windows OS installed on the local device.

Server 2008 R2 has a built-in driver for the Lexmark E250d called "Lexmark E250d (MS)". However, even with these drivers installed, the printer was not mapped, and still, there were no Event Viewer logs/errors. The printer worked fine when attached to a computer or laptop.

Returning to the Xenith zero client, I tried enabling some additional options in the xen.ini file and added the following option to my "SessionConfig" line:

VUSB_PRINTER=Yes

But the problem persisted. I then opened Admin Mode on the device and looked at the printer settings, the defaults of which are shown below:

I was hoping for a "USB" printer option but there was none to be found, but while the port was LPT1, I clicked the Test Print button to see what would happen and to my surprise, a test page came out of the printer. Seeing that, I changed the print properties of the thin client to the following:

After making these changes, I logged back into my XenApp desktop and was able to print to the printer. Looking back at what I had done, I basically had changed:

a. The xen.ini to include the VUSB_Printer=Yes option
-I know that this change, by itself, did not result in any change

b. Set the Printer Identification variable on the print properties to match the driver installed on the XenApp server.

c. Enabled the printer on the print properties of the zero client.

I should have tested B and C individually to determine if one of these settings resulted in a successful print mapping but I didn't. Should you run across this problem and test each option, let me know what you find.

Citrix NetScaler - Creating a Web Interface site to integrate with the Access Gateway

2012-01-09T17:08:00.004-05:00

You can use the Web Interface wizard on the NetScaler to provide access to local LAN or remote access users. To integrate the Access Gateway with the web interface running on the NetScaler, follow the steps below:

1. In the navigation pane, expand System, and then click Web Interface.

2. In the details pane, click Web Interface Wizard.

3. On the Introduction page, click Next.

4. On the Configure Web Interface Site page, specify the values for the following parameters, which correspond to parameters described in Parameters for configuring Web interface sites:

• Site Path (You cannot change the name of an existing Web interface site.)
• Site Type
• Published Resource Type
• Kiosk Mode

Select Gateway Direct Mode and specify values for the following parameters, which correspond to the following parameters:

• Authentication Point
• Access Gateway URL
• Add DNS Entry
• Trust SSL Certificate
• STA Server URL
• STA Server URL (2)
• Session Reliability

5. Click Settings to the right of the Access Gateway virtual server and specify values for the following parameters:

• ICA Proxy - ON
• Web Interface Address - http://127.0.0.1:8080/
The address above is used because we are running the web interface on the NetScaler and it uses port 8080.
• Web Interface Portal Mode - NORMAL
• Single Sign-on Domain - DOMAINNAME
• Enable the SSO to Web Applications option

Click OK on the Settings window.

6. When returned to the Configure Web Interface Site screen, click Next.

7. On the Configure XenApp/XenDesktop Farm screen, click Add to add an existing XenApp or XenDesktop farm.

8. In the Create XenApp/XenDesktop Farm or Configure XenApp/XenDesktop Farm dialog box, specify values for the following parameters:

• Name
• XML Service Addresses
• XML Service Port
• Transport
• Load Balance

After the appropriate values have been entered, click Create.

9. When returned to the Configure XenApp/XenDesktop Farm screen, click Next, and then click Finish.

The wizard creates an Access Gateway Session Policy based on the settings specified. Make sure that the appropriate session policies are set on the Access Gateway virtual server and then test remote connectivity.

Citrix Access Gateway - Creating an Access Gateway Virtual Server

2012-01-09T14:23:00.001-05:00

The Access Gateway works with the Web Interface and Secure Ticket Authority (STA) to provide authentication, authorization, and redirection to published applications hosted on a computer running Citrix XenApp or published desktops provided by Citrix XenDesktop. The Access Gateway virtual server serves as the access point through which clients access these services. The Access Gateway wizard helps you quickly create an Access Gateway virtual server for accessing resources using the SSL VPN functionality of the NetScaler. The settings that configure how users connect to the Access Gateway are as follows:

• Virtual servers
• Certificates
• Name service providers
• Authentication
• Authorization
• Port redirection
• Clientless access
• Clientless access for SharePoint

To create the Access Gateway virtual server, perform the following steps:

1. In the NetScaler management console, click Access Gateway and then on the right-hand pane, click Access Gateway wizard.

2. On the Access Gateway Wizard Introduction screen, click Next.

3. On the Create or choose a virtual server screen, select New and specify an IP Address, Port, and Virtual Server Name then click Next.

4. On the Specify a server certificate screen, select the appropriate certificate and click Next to continue. In this example, I am using a test certificate which points to the name access.cps.demo.

5. On the Name Service Providers screen, specify the Configured DNS Server and click Next.

6. On the Configure authentication screen, specify the LDAP server information and click Next.

7. On the Configure additional settings screen, under Configure Authentication, click Allow and under Redirect Requests for Port 80, enable Redirect to secure web address and click Next to continue.

8. On the Configure clientless access screen, accept the defaults (shown below) and click Next.

9. On the Summary screen, click Finish to create the new Access Gateway virtual server.

10. When the Access Gateway has been successfully configured, click Exit. Remember to save the configuration.

With the Access Gateway virtual server now created, we can create a web interface site and then integrate it with the Access Gateway virtual server.

Citrix NetScaler - Installing the Integrated Web Interface

2012-01-09T10:28:00.006-05:00

The Citrix Web Interface can now be installed on NetScaler appliances, thus eliminating the need for a separate server to provide Citrix web services. The Web Interface on NetScaler provides user access to published resources (applications, content, or desktops) through a standard Web browser or by using the Citrix Receiver or XenApp plug-in.

The Web Interface installation includes installing the Web Interface tar file and JRE tar file on a NetScaler appliance. Consider the following when installing the web interface onto the NetScaler:

• The Web Interface on NetScaler is based on Java Server Pages (JSP) technology
• The Web Interface runs as a service on port 8080 on the appliance. It is important to remember this.
• The Web Interface is supported only on nCore version of the NetScaler software releases
• Minimum of two CPUs and 2 GB of memory are required to install Web Interface on a virtual appliance
• Pass through authentication is not supported at this point of time
• Web Interface on NetScaler uses NSIP to contact the XML services. Ensure that the firewall allows the NSIP
• If you would like to use MIP or SNIP, configure load balancing virtual server for each of the XML services and provide load balancing virtual server IP address in the Web Interface farm configuration.

1. The first thing you need to do is download the NetScaler web interface components from the MyCitrix web site. After logging into the site, click Downloads and then specify NetScaler ADC as the product. Under the NetScaler 9.3 Product Heading, you will see Web Interface on NetScaler, click it.

2. You will be redirected to the Web Interface on NetScaler download page. Remember, you must have an nCore software release installed on your NetScaler. If you do not, you'll need to download an nCore release and upgrade the NetScaler prior to installing the Web Interface components. Assuming your release supports the web interface, browse to the bottom of the page and download each package under the Components heading.

3. Use WinSCP or another file transfer utility to copy the tar files to the /var/tmp directory on the NetScaler.

4. Logon to the NetScaler management console and click Web Interface.

5. On the right-hand pane, click Install Web Interface under Getting Started.

6. On the Install Web Interface window, click Browse to the right of Web Interface Tar File Path, select the web interface TGZ file and click Select.

7. When returned to the Install Web Interface window, click Browse to the right of JRE Tar File Path, select the JRE TAR file and click Select. When returned to the Install Web Interface window, click Install.

8. Click OK when the installation successfully completes and then Save the configuration.

That's it as far as the installation of the web interface on NetScaler is concerned. Now it's just a matter of creating and configuring the web interface site. In the next post or two, I'll cover the steps to configure the web interface to work with the Access Gateway.

Access Gateway - Gateway Authentication Failed when connecting from an Android

2012-01-03T16:30:00.006-05:00

At this time, I do not have an Android device. :-( Honestly, I haven't had an iPhone too terribly long but whatever. I wanted an Android device to test my Access Gateway last week and found that there is an Android emulator that will run on Windows 7 64-bit edition. It worked great and you can find out more using the links below:

http://buildcontext.com/blog/2011/android-browser-emulator-windows-7-nexus-s-xoom-tablet

http://www.howtogeek.com/howto/21831/how-to-test-drive-google-android-on-your-pc-without-buying-a-phone/

http://www.nishantverma.com/2011/06/installing-android-emulator-on-windows.html

Be patient when booting it up, it may take a few minutes but beyond that, I was pleased with its performance.

The first time I tried to connect, I received a "Gateway Authentication Failed" error message:

After a bit of troubleshooting, I changed the Citrix Receiver configuration as shown below. So even though I was connecting to a Standard Edition Access Gateway, I had to set the Citrix Receiver to Enterprise Edition in order to connect and launch applications.

Incorrect Credentials when signing into the Access Gateway

2012-01-03T15:40:00.003-05:00

Do you restrict which workstations your AD domain users can log on to? This can be determined if you open Active Directory Users and Computers and in the properties of a given user account, click the Account tab and then the Log On To button. In the example here, the user is only allowed to login to three machines, ballfield-pc01, xenapp01, and xenapp02.

If you do restrict which workstations a user can login to, you may inadvertently deny them access to the Citrix Access Gateway, assuming you are using an LDAP authentication policy pointing to an internal domain controller. Even though the user may be in the proper AD security groups, restricting which workstations they can login to may result in an "incorrect credentials" message as shown below:

Assume my LDAP configuration on the NetScaler is setup as shown:

Also assume that the domain controller at 10.29.0.20 is named ChicagoDC01.

You can correct the issue in one of two ways, you can set the workstation log on to setting back to All Computers or if you want to continue to restrict workstation access, you will need to add the LDAP authentication server, in this example, ChicagoDC01, to the users list of allowable workstations:

Once this is completed, the user should be able to login to the Access Gateway with no further problems.

Citrix Access Gateway - "Blank" agesso.jsp page

2012-01-02T23:09:00.006-05:00

Yes, more NetScaler....please remember that this blog serves as a memory dump and repository for myself. Things which I believe I may forget soon are placed here so that when I do forget them, I can come back here and find them...assuming I've placed them here before I have indeed forgotten them. I had almost forgotten this issue until I saw a screenshot that reminded me of it and I've got to put it down quick.

We were implementing a NetScaler for several reasons, one of which was to replace the old (and dying) computer which hosted the Citrix Secure Gateway. There are two methods of completing this switch:

a. Migration
This method (the method Citrix prefers/recommends) you build the NetScaler alongside the Secure Gateway but assign it a new FQDN, obtain a new SSL certificate with that name, and then direct users to the new FQDN once testing is complete. This method makes it easy to test the NetScaler without hosts file manipulation and since it will have a new IP and new name, you can add those into DNS at the beginning of the project and by the time you are ready to switchover, the DNS replication has taken place. You can maintain both devices for a time and then easily decommission the Secure Gateway with no service interruption.

b. In-Place
Using this method, the NetScaler replaces the Secure Gateway using the same certificate, same name, and same IP. When performing an in-place migration, the NetScaler is assigned a "test" IP and an existing certificate is imported on the NetScaler and used for the Access Gateway virtual server. This method requires that testing be performed using the externally accessible test IP, which will result in a certificate error, or by manipulating name resolution using a HOSTS file. When testing is completed and the NetScaler is ready to be placed in production, there is downtime as the Secure Gateway must be powered off or its network cable unplugged so that the test IP can be changed to the production IP and any HOSTS files which have been changed must be changed back. Additional troubleshooting may be required unless testing uncovered all potential connectivity issues and could affect uptime further as there is no Secure Gateway to fallback on as is the case with the Migration method.

In this case, in-place was the method chosen to move from the Secure Gateway to the NetScaler/Access Gateway.

Once testing was completed, the Secure Gateway was powered off and the Access Gateway's VIP (Virtual IP) was changed from the test to the production IP. Changing the VIP was easy enough. Once the VIP was changed to the production IP and the configuration saved, the Access Gateway logon page came up instantly and I could login without issue, however, the browser than displayed a "blank" page as shown below:

Naturally, there are a couple things to be mindful of when changing the VIP of an Access Gateway virtual server.

1. Routes

If you open the NetScaler GUI and expand Network and then click Routes, you'll see the route table of the appliance. Turns out, there was a route pointing to my test IP. I removed this entry.

2. DNS Address Records

In the NetScaler GUI, expand DNS, then Records, and click on the Address Records selection. In this list, I saw a host record for my FQDN still pointed to my test IP address. I changed this record to point to the production IP address.

After making these changes, the configuration was saved and the problem of the "blank" page was resolved.

Citrix Access Gateway - SSL Error 70

2012-01-02T22:22:00.002-05:00

As you may be able to determine from the previous post, I had some excitement while working with a NetScaler last week. Before I experienced SSL Error 38, I had to fix an SSL 70 Error when launching a published application from the Access Gateway site.

In this case, the error had nothing to do with the NetScaler but the resolution required a change to the computer on which I was connecting from. In this example, I was attempting to run an application while connected with an IE 8 browser. I opened IE properties and when to the Content tab and then clicked on Certificates.

Sure enough, there were several Verisign certificates that had expired on 1/7/2004, but the fix was easy enough. I had to install the Update for Root Certificates that can be downloaded as part of Windows Updates or downloaded and installed manually.

If you have any additional problems after applying the root certificate update, it may be necessary to click on the Clear SSL state button found within IE properties on the Content tab.

Citrix Access Gateway - SSL Error 38

2012-01-02T18:23:00.007-05:00

Last week, I was working on my first NetScaler in a while, replacing a Citrix Secure Gateway with an Access Gateway site. I had just completed the setup, had test users connecting and everything working great...until the 6th user tried to login and just as I was about to bite into a Chic-fil-a sandwich, I got an email saying that users were receiving the following error message when they attempted to access published applications:

Cannot connect to Citrix metaframe server, ssl error 38

There were a couple problems contributing to my dilemma which I'll go over here.

1. Licensing setup

Whether or not its technically correct to say this, the NetScaler came with two licenses. One was a license for the appliance itself and the other was the Citrix Access Gateway Platform License. Turns out, I allocated both licenses using the MAC or HostID of the appliance. What I should have done, based on conversations with Citrix support engineers is license the appliance using the MAC and then licensed the Access Gateway Platform license using the Hostname of the appliance.

The first clue that something was wrong, a clue that I looked over, was the Maximum ICA Users Allowed option in the Licenses pane of the NetScaler GUI read 0 as shown below:

The first thing I had to do was return the Citrix Access Gateway Platform license and reallocate it based on the appliance's hostname "netscaler":

Once I had reallocated the license based on the hostname and uploaded it to the NetScaler, the Maximum ICA Users Allowed option in the Licenses pane of the NetScaler GUI read 10000, which means the Citrix Access Gateway Platform license is applied successfully.

2. Change the Access Mode of the Access Gateway Virtual Server

I had one additional problem on my Access Gateway virtual server, it's access mode was set to SmartAccess Mode and needed to be set to Basic Mode to use my "10000" connections.

Once these changes were made, the users could login and I went back to eating my Chic-Fil-A sandwich.

Happy New Year!!

Using the Office 2010 Customization Tool

2011-11-09T13:27:00.012-05:00

A few years into my career, I wanted nothing more than to be out of desktop support. When I started in computers, I didn't know much of anything so I started with the basics, simply building "white boxes", then I moved to troubleshooting home PCs, then to a warranty repair center where I got to take apart computers, printers, and laptops to replace defective parts and then I moved to a desktop support position at a major call center with approximately 3000 computers and got my first taste of business IT support. I worked on imaging new PCs, installing more apps, trouble tickets, help desk, etc, etc, the basics really and it was fun for about 18 months when I thought "Servers, that's what I want to do next...those folks make the big bucks". So, about 10 years ago, I was fortunate enough to be placed in a position supporting servers and have been doing so ever since. But here lately, it seems I've been working more with applications and desktops again but it's been fun returning to my "roots" so to speak.

This past week, I was working on customizing an upgrade of Office from 2003 to 2010 using the Office 2010 Customization Tool (OCT). The OCT is part of the Office Setup program and is the recommended tool should Office customizations be required as it allows you to control or customize seemingly every aspect of an Office installation/upgrade.

To launch the Microsoft Office Customization Tool, execute the command setup.exe /admin from the "root" of the Office 2010 CD. This can be done in VMs using ISOs, network paths, or mapped drives.

As you explore the Modify User Settings section, you'll see there are hundreds of configuration changes you can make. I wanted to have Outlook 2010 open right to the users mailbox so I configured the following Outlook settings:

Select the cached mode option applicable to your environment. In this case, I was upgrading Office on XenApp servers and did not want to enable it.

Once you are done with your customizations, click File | Save As and save your MSP file. If you have your Office 2010 installation files on the network, I would copy the MSP file to that location. I read that if you copy the MSP file to the Updates folder in the Office 2010 root directory, that setup will use it automatically but I did not test that functionality.

Anyway, to run setup with the new OST file manually, enter the command: setup.exe /adminfile \\server\share\FileName.msp. I copied my MSP to the Office 2010 root directory so all I had to do was enter setup.exe /adminfile Office2010.msp.

Depending on how the options are setup in the MSP, you can make the install completely hidden, or somewhat interactive. At least initially, I like to see that it's working so I had it pop-up the Choose the installation you want and the Complete your office experience dialogs boxes come up. It removed Office 2003 as expected and asked me to reboot to complete the install. Once back up, Office 2010 was there, Outlook opened to my mailbox, and I did not see the Office 2010 introductory pop-ups, however, it did prompt me to activate office. I didn't want that to happen either and to get around that, I followed the instructions found here:

http://www.migee.com/2010/12/08/office-2010-completely-silent-install-a-really-really-quick-rundown/

After overwrote my existing MSP file and on subsequent installations, I was not prompted to activate when I launched Outlook.

Finally, you can apply an new MSP to an existing installation by running the command: msiexec /p \\server\share\Office2010.msp, but that this must be executed directly from the machine you wish to update.

I'm not sure how many times I'll have to install Office 2010, but I'll be using the OCT whenever I do.

VMware View - Setup Kiosk Mode

2011-11-03T22:55:00.003-04:00

VMware View supports Kiosk Mode which transparently connects a locked-down endpoint, typically a thin or zero client directly to a virtual desktop session. When using Kiosk Mode, users are not required to manually launch a VMware View Client and enter credentials as all configuration and provisioning is executed in background when the endpoint is powered on and the user is presented with a familiar interface; a dedicated kiosk virtual desktop session or application.

Configuring Kiosk Mode does require some additional configuration steps on the View Connection Server. Specifically, the command-line utility vdmadmin must be used to enable kiosk mode and to create AD accounts. You can create kiosk accounts based on the MAC address of the endpoint but in this example, I have chosen not to do so. VMware View requires that all AD accounts to be used for kiosk mode authentication begin with "custom-".

1. To enable kiosk mode authentication of clients for the View Connection Server VCS01, allowing clients with automatically generated passwords to authenticate themselves without providing a password, execute the following command from a View Connection Server:

vdmadmin –Q –enable –s VCS01

2. To create an Active Directory "custom" account, execute the following command:

vdmadmin –Q –clientauth –add –domain MYDOMAINNAME –clientid "custom-public" –password "SomePassword"

3. You can get a list of those kiosk mode accounts already created by running the command:

vdmadmin –Q –clientauth -list

You get an output similar to the following:

4. Finally, you'll likely have some configuration to do on your endpoint device. Newer VMware View zero clients like the Samsung NC190 have the capability to configure Kiosk Mode in their device configuration screens as shown below:

VMware View - Composer fails to join Windows XP VMs to the domain

2011-11-03T08:50:00.004-04:00

This information is out there all over the place, but I still forget it even though I've bookmarked it, put it in OneNote, etc...so this post is another one of those that's primarily serving as a reminder to myself.

When using VMware View and Composer to create VMs, the Customization process will result in an error stating that Composer could not join the VMs to the domain, even though it looks like everything is fine, computer objects are created, I can connect to the console of one of these VMs and login to the domain, etc. If you click the Error button in View Administrator, you'll see the following

To correct the problem, install Microsoft update KB944043 onto the Windows XP parent VM.

http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=7707

Now, maybe I'll remember...hopefully before I deploy the first desktop pool. :-)

Part 2 - Connecting a Wyse Xenith Client to a Citrix Shared Desktop - MIME Types

2011-08-24T10:14:00.006-04:00

In Part 1, I went over setting DHCP options, in this post, we'll look at the MIME type/IIS configuration. In order for the Xenith clients to use the xen.ini configuration file, two MIME Types (.ini and .) must be registered within IIS.

1. On the IIS server (in Part 1, the IIS server was the Citrix web interface server), open the Internet Information Services Manager MMC.

2. Select the Default Web Site and on the right-hand pane, select MIME Types under the IIS heading.

3. Under the Actions pane, click Add.

4. On the Add MIME Type window, enter .ini for the File name extension and text\plain for the MIME type. Click OK.

5. Under the Actions pane, click Add.

6. On the Add MIME Type window, enter . for the File name extension and text\plain for the MIME type. Click OK.

7. Once again, verify that the xen.ini configuration file is stored in the C:\inetpub\wwwroot\wyse\wnos directory as shown below:

8. Reboot the Xenith client(s) and verify a successful boot to the XenDesktop/XenApp start page and enter valid user credentials. Once the user has been authenticated, the shared desktop should launch automatically.

Part 1 - Connecting a Wyse Xenith Client to a Citrix Shared Desktop - DHCP

2011-08-24T08:45:00.016-04:00

I have increasingly seen customers turn to zero clients when deploying Citrix XenApp, XenDesktop, or VMware View. Personally, I have used the Samsung NC190 on VMware View deployments and the Wyse Xenith C00x zero clients on Citrix deployments and both have been easy to setup and manage. I like the Teridici Management Console for the PCoIP clients and Citrix XenDesktop includes a Wyse Xenith Manager but I have not worked with it much so I can't offer an opinion. However, much, if not all, of the configuration of the Wyse Xenith can be done through DHCP and when combined with a customization file (xen.ini) stored on a web server, all that's involved in delivering a Citrix desktop is to connect it the network and power it on.

In this post, I'll go over the steps to configure the DHCP options to allow for an "instant-on" experience. In part 2, I'll go over registering the IIS extensions.

Configuring the DHCP Server

The first step is configuring the DHCP server as the Xenith clients make use of DHCP options 161, 162, and 181. DHCP options 161 and 162 to implement the xen.ini file which enables you to automatically set the default configuration of all Wyse Xenith thin clients in your environment.

DHCP option 181 is used to specify the Citrix Web Interface URL which allows a network connected Wyse Xenith to automatically detect the location of the XenDesktop/XenApp server where a user can log on and access their desktop. Without an automatic detection set-up, an administrator must enter the address locally on the thin client using the Remote Connections dialog box.

1. Open the DHCP admin MMC, then right-click your DHCP server and select Set Predefined Options

2. On the Predefined Options and Values window, set the Option class to DHCP Standard Options and then click Add.

3. In the Option Type dialog box, enter the Name, Data Type (String), Code (181), and Description. Click OK.

4. When returned to the Predefined Options and Values screen, enter http://YOURCTXWEBINTERFACE for the String value and click OK.

5. Before adding options 161 and 162, copy the xen.ini file to a central location which the Wyse thin client have access. I have copied the file to my Citrix Web Interface server after creating a Wyse virtual directory with the path C:\inetpub\wwwroot\wyse. However, the xen.ini file was copied to C:\Inetpub\wwwroot\wyse\wnos as I believe, if memory serves, this is the default path for the Xenith clients.

6. Return to the Predefined Options and Values window, and verify the Option class to DHCP Standard Options and then click Add. In the Option Type dialog box, enter the Name, Data Type (String), Code (161), and Description. Click OK.

7. When returned to the Predefined Options and Values screen, enter http://YOURCTXWEBINTERFACE for the String value and click OK.

8. Create another option for 162. In the Option Type dialog box, enter the Name, Data Type (String), Code (162), and Description. Click OK.

9. When returned to the Predefined Options and Values screen, enter / for the String value and click OK.

10. Finally, enable these new options on a Scope or Server level as shown below:

That's all for the DHCP Configuration, in the next post will look at setting the required MIME types on the default web site to ensure the Xenith clients can access the xen.ini file.

Restoring an Individual File using the VMware Data Recovery Appliance

2011-08-22T14:45:00.003-04:00

VMware Data Recovery is a disk-based backup and recovery solution that enables quick, simple and complete data protection for your virtual machines. VMware Data Recovery is fully integrated with VMware vCenter Server to enable centralized and efficient management of backup jobs and also includes data de-duplication to save on disk storage for your backups.

VMware Data Recovery protects against data loss in your virtual environment by enabling fast backups to disk and, more importantly, fast and complete recovery utilizing disk-based backup and recovery for your VMs and it provides the ability to restore individual files.

In this post, we'll be looking at the process to restore an individual file on a Windows VM:

1. Copy the VMwareRestoreClient.exe file from the VDR CD/ISO. For a Windows server, the file is in the WinFLR directory.

2. On the Windows VM, double-click VMwareRestoreClient.exe to begin the restoration process.

3. When prompted, enter the VDR appliance name and click Login.

4. Select the appropriate Restore Point and then click Mount.

5. Once the restore point has Mounted, click Browse to open Windows Explorer and access the mount point.

6. Navigate the mount point to find the needed file(s) and copy them into the appropriate destination folder.

7. When the restoration has completed, close the VMware Data Recovery Restore Client by clicking the X in the upper right-hand corner. If any restore points are mounted, you will be prompted to unmount them when closing the application. Click OK and the restore points will be unmounted.

Some links you may find useful:

To download VDR: http://downloads.vmware.com/d/details/datarecovery121/ZHcqYnR0anRiZEBlZQ==

Background and Install:
http://blogs.vmware.com/kb/2010/10/got-vcb-time-to-switch-to-vdr.html
http://www.vmwareinfo.com/2009/08/how-to-install-vmware-data-recovery.html

Adding HP NC365T drivers to ESXi

2011-08-22T14:09:00.004-04:00

I installed ESXi on a couple HP servers recently and was surprised to see that my quad port NIC was nowhere to be found. Honestly, I don't recall seeing this before so I was caught a little off guard. The NIC was an HP NC365T and a quick search turns up the following:

http://www.corypratt.com/technology/vmware/adding-hp-nc365t-drivers-to-vmware-esxi/

Basically, install and download the vSphere CLI onto your computer, and download the Intel 82576 and 82580 drivers from:

http://downloads.vmware.com/d/details/esx40_intel_82580_v4002198_dt/ZHcqYmRwakBiZCVodw==

1. Burn the ISO to a CD in order to see the .zip file.
2. Put the ESX host in maintenance mode
3. On the workstation that has the vSphere CLI, execute the command

vihostupdate.pl --server 192.168.10.11 --username root --install --bundle g:\offline-bundle\INT-intel-lad-ddk-igb-2.1.10.2-offline_bundle-268793.zip

4. Enter the root password and press

5. Reboot the ESX host and exit maintenance mode. All NICs should be displayed.

Creating an Office 2010 ThinApp package

2011-07-01T14:01:00.016-04:00

Recently, I had the pleasure of packaging Office 2010 using ThinApp 4.6.1. I used a 32-bit Windows XP Service Pack 3 VM to package Office 2010 to deploy to 64-bit Windows 7 virtual desktop using VMware View 4.6.

A great VMware knowledge base article on ThinApp and Office 2010 can be found here.

In this example, a KMS server was used for Office activation and Outlook 2010 was not a part of this package. My virtual machines were hosted on ESXi 4.1 Update 1 servers.

When creating an Office 2010 package, it is important to remember the following:

• Microsoft Office 2010 cannot be virtualized with ThinApp 4.5 or earlier
• The use of ThinApp 4.6 is not recommended. Use ThinApp 4.6.1!!
• Capturing Office 2010 on a 64-bit operating system is unsupported. When capturing Office 2010, you must use a 32-bit operating system.
• When capturing Office 2010, ensure that it is not activated. If using a KMS license, disconnect the capture machine from the network.
• It is recommended that you stop the Office Software Protection Platform service prior to the Postscan process.

1. Since the capture machine must be disconnected from the network, copy the Microsoft Office 2010 installation files to the ThinApp packager VM.

2. Disconnect the capture machine from the network to keep KMS from activating Office during the capture process by unchecking the NICs Connected status in the VM properties. Ensure the network is disconnected by performing a ping test.

3. If using KMS to activate Office, browse to the location in which the Office 2010 installation files were copied, edit the config.xml information to include KMS server data to enable auto-activation.

4. If necessary, revert your capture machine to the Clean State snapshot. Login locally and start the ThinApp Setup Capture build process. On the Setup Capture – Welcome screen, click Next.

5. On the Setup Capture – Ready to Prescan screen, click Next.

6. Minimize the Setup Capture – Install Application screen when it appears and install the application you wish to package.

7. To use the customized config.xml file, enter the following in the command prompt:

8. Accept the Microsoft Office 2010 license agreement and click Continue.

9. Though an answer file has been used, you can further customize Office 2010 should that be required. Click the Customize button to view the Office 2010 installation options.

10. On the Installation Options screen, change any installation options deemed appropriate. Click Install Now to begin the installation of Office 2010.

11. When the installation completes, click Close and stop the Office Software Protection Platform service.

12. Once done with configuring and updating Microsoft Office you need to run the ThinApp Post-Setup Capture. Maximize the ThinApp Setup Capture window and click Postscan.

13. On the Setup Capture - Entry Points screen, select the application entry points and click Next. The executables selected here are initially loaded by the package when launched.

14. On the Setup Capture – Groups screen, select the Groups authorized to use this package. Add Active Directory groups to limit the number of users capable of launching the package and click Next.

15. On the Setup Capture – Isolation screen, select the preferred isolation mode and click Next.

16. On the Setup Capture – Sandbox screen, specify the location of the sandbox and click Next. The Sandbox contains any runtime modifications made by applications while they run.

17. On the Setup Capture – Quality Assurance Statistics screen, select No – Do not send any information to VMware and click Next.

18. On the Setup Capture – Project Settings screen, enter an Inventory name for use in tracking and package identification, a Project location and click Next.

20. On the Setup Capture – Package Settings screen, select the Primary data container, and enable the option Generate MSI package. Click Save to continue.

The primary data container is the main virtual application file that includes the ThinApp runtime, the read-only virtual file system, and the virtual registry.

I usually create an MSI file as it may be preferred in certain situations. For example, MSI files can be used to deliver application packages to desktop groups through View Administrator.

21. On the Setup Capture – Ready to Build screen, click Open Project Folder as Office 2010 requires a couple tweaks to work properly.

22. In the project directory, move the folder OfficeSoftwareProtectionPlatform from %Drive_C%\Documents and Settings\All Users\Microsoft to %Common AppData%\Microsoft

23. Add the following to the bottom of the HKEY_CURRENT_USER.txt file:

Isolation_writecopy HKEY_CURRENT_USER\Environment
Value=ALLUSERSPROFILE
REG_SZ~%Common AppData%

24. Close the explorer window to return to the Setup Capture – Ready to Build screen. Click Build to build the application package.

25. When the setup capture wizard completes, click Finish to complete the build process.

26. Copy the contents of the Capture folder to the network ThinApp repository/share

27. Test on a virtual desktop:

View Composer rolls back and does not install

2011-06-27T17:05:00.004-04:00

If you ever need to re-install View Composer, you may believe you have it uninstalled completely because you have no reason to believe otherwise, however, I ran into an issue where everything looked ok, yet whenever we attempted to install View Composer, the install would start, but would end with a roll back action quickly thereafter. In the VMINST log file stored in C:\Users\\AppData\Local\Temp, the only "error" I saw was:

C:UsersADMINI~1AppDataLocalTemp2{E5551EC5-436E-4A9D-AB4E-81DCA7403FB5};C:Program Files (x86)VMwareVMware View Composer
svm: 03/12/11 13:11:11 ERROR: SviCfgHelper_UnbindCertificate() returned value: 8
svm: 03/12/11 13:11:12 Certificate can not be found

What the heck is that? Honestly, I don't know; but the first thing I did was delete any existing VMware Composer certificates, but that didn't help. I came across a VMware support article dealing with a similar (but not exact) issue and it was stated that deleting any registry keys containing 18443 solved the issue. So, I tried it on my server as well and sure enough, I was able to complete the re-install of View Composer.

Launching a published application shuts down a XenApp 6 server?

2011-04-28T17:47:00.003-04:00

Earlier today, I was working on building a new XenApp 6 server. All I had really gotten to was installing XenApp 6, then I published WordPad to verify basic access, I hadn't gotten to into things yet. I logged into the Web Interface page, worked beautifully, it displayed my application and even when I launched it, everything appeared to be working fine but the program never launched and I realized I lost my RDP session to the XenApp server when I launched the app. I could still ping the IP, but I could not communicate with the server otherwise. I looked at the server console in vCenter, and saw that it was shutting down! I do not recall ever seeing a Citrix server shutdown from trying to launch WordPad and I thought "great", what kind of crazy problem am I dealing with here, why isn't this just working.

So as I went outside to call my wife and pace around a little, the engineer I was working with decided to do a little investigating and by the time I got back inside, he had traced down the issue to the following:

http://support.citrix.com/article/CTX126711

The article itself is entitled Microsoft Windows Server 2008 R2 Service Pack 1 - Known Issues and honestly, I hadn't even realized the server we were building had 2008 R2 Service Pack 1. Two of the issues listed are:

1. You cannot connect to Citrix sessions when Microsoft Windows Server 2008 R2 SP1 is present.

2. Svchost.exe crashes in TermService

I can assure you that these two are real issues. The tech article references that to fix the issue you should apply Citrix Hotfix XA600W2K8R2X64001, but according to CTX128043, Citrix Hotfix XA600W2K8R2X64001 has been replaced with XA600W2K8R2X64040.

However, the release notes for Citrix Hotfix XA600W2K8R2X64040 state that, "Installing this hotfix can inadvertently remove the Citrix Licensing component, if present, from the system. To prevent this issue, make sure to install Hotfix XA600W2K8R2X64002, available as Knowledge Center article CTX126123." Be sure to install the XA600W2K8R2X64002 hotfix prior to installing XA600W2K8R2X64040!

Once these updates were applied and the server rebooted, published applications worked as they should.

Error 31203 when launching a published application from the Web Interface server

2011-03-16T10:08:00.004-04:00

I built a new Citrix Web Interface server recently and configured it connect to a XenApp 6 and a Presentation Server 4.0 server farm. The applications hosted on the Presentation Server farm displayed correctly, but when you tried to launch an application hosted on the 4.0 server farm, a 31203 error would appear.

Looking in the Windows Event Log, the following is seen:

The farm OLDFARMNAME has been configured to use launch references, but a launch reference was not received from the Citrix XML Service. Check that the farm supports launch references or disable launch reference requests. [Unique Log ID: 7394119b]

I found a Citrix error message PDF of some sort and for the 31203 error it stated:

The farm has been configured to use launch references, but a launch reference was not received from the Citrix XML Service. Check that the farm supports launch references or disable launch reference requests.

The solution this PDF describes is as follows:

To use launch references, all the servers in the specified farm must run XenDesktop or Presentation Server 4.5 or later. Citrix recommends that all servers in a farm run the same product and version. If the farm is running XenApp 4.0, with Feature Pack 1, for UNIX or Presentation Server 4.0 and earlier, ensure that the RequireLaunchReference parameter is set to Off and that OverrideIcaClientname is set to On in the XenApp Web site configuration file, WebInterface.conf.

To resolve the issue, I changed the RequireLaunchReference parameter on the XenApp 6 servers webinterface.conf file.

1. On the Web Interface server, locate the WebInterface.conf file and open it with NotePad.

2. Locate the following entry around line# 169:

RequireLaunchReference=On
Replace it with the following entry:
RequireLaunchReference=Off

3. Save the WebInterface.conf file and test.

VMware View Ready Zero Clients

2011-01-01T19:53:00.004-05:00

Zero clients are an increasingly popular technology trend, especially in VDI deployments, that contain no local operating system, so they provide instant-on, little endpoint administration, and no vulnerability to viruses or malware. Much like a thin client, a zero client moves the computing power back to the data center, leaving little more than a keyboard and monitor at a users' desk.

The following graphic, found here on the Teradici support site, displays the VMware View ready zero clients:

If you are experiencing audio lag or latency when watching streaming internet video, download firmware update 3.2.1 for your zero client. I have found that the necessary firmware can be downloaded from the Wyse support site regardless of the VMware View ready zero client used. In my most recent experience, I was able to apply the Wyse P20 firmware update to a Samsung NC240. Though the audio latency was not completely removed, the performance was "fairly acceptable".

http://www.wyse.com/serviceandsupport/support/dlOraFW.asp?which=114&model=P20(Wyse

If you do not already have it, you will need to download the Teradici PCoIP management console which is also downloaded from the link above. The Teradici PCoIP management console is a virtual machine which can be hosted within vSphere of VMware Workstation.

Inconsistent Host ID when importing a XenApp 6 License

2010-12-17T16:22:00.002-05:00

This error will occur if the XenApp 6 license you are importing is different from the configured product version of a given XenApp 6 server. For example, if XenApp was installed as "Advanced" edition, you will get this error when trying to import a license file for the "Platinum" edition.

The product editions of XenApp support different features. To activate the features available with a particular edition installed on each server, set the product edition on each server through Citrix policies.

The product edition also determines which type of license a server requests from the license server. Make sure the edition you set match the licenses you installed.

1.Locate the Citrix policies for Server Settings, and configure the XenApp product edition setting.
2.Create a filter to apply the policy to specific worker groups.
3.To apply the change, you must restart each server affected by the policy.

Do you virtualize all of your domain controllers?

2010-12-15T18:03:00.004-05:00

This is a fine question and one that generates a bit of good natured discussion. Several have answered immediately with a resounding, "Yes!" and though no one that I have talked to has come out and said "No!" with the same vigor and intensity as those in the "Yes!" crowd, you can see the struggle within, how hard it is to say "No" even sheepishly to this question no matter how strongly they may feel.

When dealing with virtual server infrastructure, I spend the majority of my time working with VMware but also work with Citrix XenServer a decent amount. I worked with that Microsoft hypervisor thing once, will only do so again if forced to, and even then, I may decide to switch to another line of work altogether to avoid it. I wouldn't virtualize anything on the MS Hypervisor, much less my domain controllers!

But we're talking about VMware here, so what do you do? It's tough to say "No" because the product is so dependable and reliable, it's almost of if you're insulting VMware and who wants to do that? The good news is that neither "Yes" or "No" is the right answer 100% of the time. You can certainly virtualize all your domain controllers and you can certainly choose not to as both are valid options.

I believe the biggest concern with virtual domain controllers has to do with time, and keeping it synchronized. As we all know, keeping time synchronized in an Active Directory domain is of vital importance.

In a virtual environment, clock drift can be significant in a relatively short time. If a domain controller and a "chatty" VM are hosted on the same ESX server, it is possible that all CPU cycles will go toward this chatty VM. In that case, the domain controller will queue up its "timer ticks" and time drift will occur for this VM, this is very bad for DCs. In test performed by VMware, a DC drifted by 1700 seconds (28minutes) when hosted on ESX server with resource intensive VMs.

Typically there are two options when dealing with VM time synchronization and the method chosen determines how many DCs can be virtualized. It's important to pick one option or the other when virtualizing DCs, do not use both! If the methods are mixed, the likelihood of time synchronization issues only increases, especially if DCs are vMotioned among ESX hosts.

1. Use the Windows time service
2. Use VMware Tools

Use the Windows Time Service

If you will rely on the Windows Time Service, then it is recommended that the PDC Emulator of the forest root domain be a physical machine and its time service registry entries be modified to ensure that it synchronizes with an external time source. Details on all of the possible time service registry settings can be found here. To summarize, change the following on your forest root PDC Emulator:

a. Open the registry and go to HLKM\SYSTEM\CurrentControlSet\Services\w32Time
b. On the Config key, change AnnounceFlags REG_DWORD from 10 to 5
c. On the Parameters key, change Type value from NT5DS to NTP
NT5DS is used for time synchronization within the domain hierarchy whereas NTP is used to synchronize with an external time source. So you need to set your PDC emulator to use NTP and point it to a reliable internal time source such as a core switch, or an internet time source. If the PDC emulator is pointed to an internal time source, please ensure that that device is pointed to an external time source.
d. Change NtpServer value to an external time source
e. Restart time service
f. Force sync with w32tm /resync /rediscover

Once these changes are made on the physical PDC emulator, any additional DCs can be virtual machines and they will synchronize time with the PDC emulator.

Use VMware Tools

If you want to virtualize all your domain controllers, you will use VMware Tools, in essence the ESX servers themselves, as the time source. In this case, what you will do is:

a. Change the Type value in the registry from NT5DS to NoSync.
b. Have ESX host check an external time source
c. Configure VMware Tools on DCs to synchronize with the ESX host - this forces the machine to request CPU cycles, thus making sure the "timer ticks" to occur, preventing the clock drift problem. Not that VMware tools will play catch-up on time, but will not slow down if its gets ahead.

Other Points
Again, pick one method or the other, mixing them could result in unreliable time synchronization as virtual DCs are vMotioned amongst ESX hosts.

-Keep a watch on your replication topology using Replmon, Repadmin, DCDiag, etc.
-Make sure you have system state backups and perform all Active Directory restorations in accordance with Microsoft best practices.
-Do not recover a domain controller from a backup copy of an old virtual disk as the database revision level is not reset if restoring from an old clone.
-Do not use snapshots as this could cause corruption and performance degradation within Active Directory, plus, I read that Microsoft will not support a DC with a snapshot though I have not verified that recently.
-Set the Restart Priority of your virtual DCs to High and set Isolation response to "Leave power on"
-Use DRS Anti-Affinity rules to ensure DCs are running on different ESX hosts. With vSphere 4.1, DRS Anti-Affinity rules will recognize more than 2 VMs. Prior to 4.1, you could add many servers into a given DRS rule, but it would only work with the first two.

Finally
Once again, there is no right or wrong answer to virtualizing your domain controllers though you may find it interesting, as I did, that VMware has a 48 DCs, 47 are virtual and 1 is physical. The physical domain controller is the Forest PDC emulator.

XenServer 5.6 Feature Pack 1

2010-12-15T17:06:00.002-05:00

Citrix recently released XenServer 5.6 Feature Pack 1. XenServer keeps getting better as this is the best version yet. The free version is still very much the same but depending on the edition you purchase, you can get some pretty cool features such as:

• Distributed Virtual Switching - Provides distributed, fine-grained networking configuration and control policies, which increase visibility into XenServer virtual networks. Support for the vSwitch has been added as a post-install option on XenServer hosts, as well as a Controller for administration of multiple vSwitches and cross-server internal networks.
• Jumbo Frames are now supported for storage networks when the vSwitch is used.
• VM Protection and Recovery - Configure scheduled snapshots and (optional) archive of virtual machines.
• Web Self-Service - Provides browser-based access to selected virtual machines by delegated administrators.
• HA Restart Priority - Configure HA policies to restart specific VM(s) first.
• Snapshot improvements - Improved reclamation of space after VM snapshots are deleted, even if the VM is running.
• Enhanced guest OS support for Windows 7 SP1, Windows Server 2008 R2 SP1, and Suse Linux Enterprise Server (SLES) 11 SP1.
• Generic Red Hat Enterprise Linux (RHEL) 5.x support. RHEL / CentOS / Oracle Enterprise Linux versions 5.0 to 5.5 support with a generic .RHEL 5. template.
• Brocade HBA drivers and command-line tools are included in XenServer.
• Provisioning Services improvements to Windows volume license (MAK and KMS) support.
• XenDesktop platform enhancements. Provides local host caching of VM images to reduce storage TCO for XenDesktop VDI deployments.

I was hoping the distributed switch technology was going to be in the free version but no such luck. The features available in each version, taken from here, can be found below:

If installing the Novell client on a XenDesktop VM....

2010-12-10T00:42:00.003-05:00

If you need to install the Novell client on your XenDesktop virtual machines, I suggest you read the following:

http://blog.lewan.com/2010/09/13/xendesktop-and-the-novell-client/

After installing the Virtual Desktop Agent, the GINA defaults back to the Microsoft GINA (msgina.dll). If you want to change the GINA back to the Novell client you can by changing the following in the registry.

Browse to HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon and change the CTXGinaDLL (REG_SZ) value to nwgina.dll and reboot the virtual machine.

Once rebooted, the Novell GINA will be seen. The author mentions that this configuration is not supported but I have not experienced any problems to date.

More information can be found here:

http://community.citrix.com/display/ocb/2009/05/07/XenDesktop+and+Novell+eDirectory

Citrix Xnapshot

2010-12-09T20:21:00.009-05:00

Toward the end of November, Citrix released the XenDesktop support utility Xnapshot.

To summarize the Citrix release notes, Xnapshot can be used to "collect a wealth of information about the XenDesktop system and its configuration, such as BIOS information, Registry information, Device Drivers, Windows Services, Installed Hotfixes, Citrix Binaries, and Citrix XenDesktop Farm information. The data collected is organized in such a way to make it easy for various Xnapshot collections to be compared against each other to quickly highlight any changes in the environment. The Xnapshot application itself provides the facility for viewing and comparing these reports."

Xnapshot also includes the following utilities:

XMLMon - a health monitoring component which monitors the Citrix XenDesktop XML Brokers and can send an email alert if a problem is detected.

CDFControl - An event tracking, real-time trace viewing, and performance data collection tool.

CtxPrtChk - a command-line utility to test connectivity to a host on a specified port, primarily used to test basic ICA connectivity against Citrix XenApp and XenDesktop machines

XdPing - a command-line utility which automates the process of checking for the causes of common configuration issues (to verify configuration settings of the DDCs and the Virtual Desktop Agents) in a XenDesktop environment.

To successfully launch Xnapshot, you must have the following components installed on the machine from which you are running Xnapshot:

1. .NET 3.5
2. Citrix Desktop Delivery Controller SDK
3. Microsoft Powershell 1.0

If these components are not installed, Xnapshot will not launch and it will not display an error message indicating what the problem may be. It simply "disappears".

I installed (or more accurately extracted) and executed Xnapshot from a DDC within my XenDesktop farm.

1. Open Xnapshot and click Capture | Start | Capture All

2. On this 2-DDC server farm, the capture process took approximately two minutes to complete.

That's it. Once the capture process completed, I was indeed presented with a wealth of information in an easy to use/view interface, the Hotfix Information screen is shown below:

By default, Xnapshot will save its reports to the C:\work\svn.archive\.... folder. The Farm Info folder is shown below:

I was hoping that all of the data captured by Xnapshot could be easily exported/imported into my XenDesktop documentation. There are many CSVs dispersed throughout the report folder and perhaps there is a way to compile them all into a merged CSV, but I will likely wait until somebody else figures that out.

However, the best feature of this tool may be that it can compare Xnapshot reports against one another to track changes and differences over time. This tool can be used to create a baseline report at the end of a given XenDesktop implementation in order to track changes going forward. Should a problem arise in the future, I can perform another Xnapshot capture to compare the differences between the baseline configuration and the configuration that exists "today" to assist in the troubleshooting process.

Differences between two Xnapshot reports are highlighted in yellow as shown below:

Check out Jeff's Blog

2010-11-19T16:43:00.002-05:00

I'm so pleased that Jeff Dixon has recently started his own blog and look forward to reading his contributions. Jeff wears many hats at his workplace and I believe we will all benefit from his experiences.

http://j3ffdixon.blogspot.com/

View Composer - Technical Deep Dive

2010-09-01T22:24:00.005-04:00

As the title implies, the View Composer was the focus of this session.

VMware View Composer uses linked clones to rapidly deploy virtual desktop images from a parent virtual machine. View Composer is installed on the vCenter Server and allows View Manager to clone and deploy multiple desktops from the parent virtual machine. After the virtual desktops have been created, linked clones do not have any link with the parent virtual machine. Parent virtual machines are required for new linked clones, but are not required for existing linked clones.

It is used in order to provide significant storage savings over "non-linked clone" View images, as much as 50-70%, to ease the management of the image(s) as an update can be applied once to a parent VM and then applied to all linked clones, and to allow for the rapid deployment of new View VMs.

If using View Composer, the vSphere cluster hosting your virtual desktops is limited to 8 hosts because VMFS will not allow more than 8 ESX hosts to access the same read only file simultaneously as this would lead to file corruption.

View Composer is installed on the vCenter server and runs as a service and requires its own database. Once built, the connection broker must be "connected" to that vCenter/View Composer server. There is a port change in View 4.5, in that the port to connect to has changed from 443 to 18443.

The first thing that must be done in regards to linked clones, is building the parent VM, the base image, the golden image so to speak. It is HIGHLY recommended that you do not P2V a physical system to serve as the base VM as the speakers stated they have had nothing but problems when trying to use a P2Ved computer as the Parent VM. Also, keep the base image as minimal as possible and disable any unneeded services. However, if a particular application is needed by all the users in your organization, it may be easier to add that application into the parent VM/golden image. The VMware preferred method is to use ThinApp as much as possible...

There's plenty more from this session, specifically about using SSD storage for replicas as a means to maximize performance and reduce the effects of "boot and login storms" but I want to research this a little further before posting more.

There is a new disk created in View 4.5, the "disposable" disk in which the Pagefile and Temp directories are stored. It is unnecessary to save this data long term so this disk is destroyed when the user logs off.

There was a good discussion on AV scanning, though no definitive stand was taken. There are pros and cons to each I suppose. When using XenDesktop, I like to leave AV off the image if the customer will let me. Certainly you run AV on the file servers and such but the image is read-only.... The speakers leaned toward leaving not running AV on the virtual desktop if at all possible, but again, stopped short of calling this a best practice. They were very excited by the possibilities of the vSphere vShield and the Trend Micro Deep Security product as these may provide the mechanisms to finally take AV off the virtual desktop.

http://us.trendmicro.com/us/products/enterprise/datacenter-security/deep-security/index.html

vSphere 4.1 Overview

2010-09-01T21:51:00.003-04:00

This was the 2nd breakout session that I attended on Monday and it was packed. Remember, the information shared here is coming from my notes and memory. That said, it may be prudent for you to double-check everything I say.... :-)

We learned that vSphere is anything but a "." release, but it has over 150 new features and represents the foundation for cloud computing. Cloud computing was defined as an approach to computing that leverages efficient pooling of on-demand, self-managed, virtual infrastructure, consumed as a service. Hopefully that clears up the concept of cloud computing for you...

vSphere 4.1 delivers dramatic expansion and scale over previous versions of ESX its new capabilities provide the most efficient aggregation of datacenter resources.

vSphere 4.1 is capable of:
-Supporting 3,000 VMs per cluster (2x greater than previous versions)
-Support 1,000 Hosts per vCenter server (3x greater than previous versions)
-Support 10,000 VMs per vCenter server (3x greater than previous versions)

To attain these numbers however, vCenter is now a 64-bit application, needing more RAM and a more powerful server platform for faster performance and eliminating some locking and contention issues on 32-bit versions of vCenter. The vCenter server can certainly be a VM.

Of the many features new to vSphere 4.1, the speaker pointed out the following as the "biggies"

1. vMotion speed and scale
2. More VMs per cluster
3. More Hosts per vCenter server
4. Memory Compression
5. Storage I/O Control
6. Network I/O Control

vMotion speed and scale
-vMotion 5x faster in 4.1
-If using 1GB, you can vMotion up to 4 hosts simultaneously
-If using 10GB, you can vMotion up to 8 hosts simultaneously

Memory Compression
My mind gets a bit hazy on this subject. I guess that's why good bloggers would post right after the session...

-Optimized use of memory (freeing up space as needed), safeguard for using memory overcommit feature. Can use memory compress with confidence!!
-1000x faster than swap-in!

Storage I/O Control
-Set storage quality of service priorities per VM
-Works with block-based storage today (no NFS)
-Need enterprise + to get this
-Not a storage DRS type function - nothing is moved

There are two options, Basic and Advanced. With Basic, all VMs have equal access rights to the storage. WIth Advanced, you can prioritize the use of storage (similar to how compute is prioritized with vSphere) per VM. Business priorities now define low and high priority storage resource areas, allowing you to create "high-speed or High-Occupany lanes" for virtual machines.

Network I/O Control
Like Storage I/O Control allows you to set QoS for storage access, Network I/O Control set network QoS priorites per flow type (iSCSI, NFS, etc). It too has a Basic and Advanced setting. If Basic is used, network access rights are equal between flow types. If Advanced is used, you can prioritize use of the network based on flow type. Again, as with Storage I/O Control, business priorities can now define low and high priority network resource access as needed.

Though not mentioned as a "biggie" feature, vSphere 4.1 now offers AD Integration. You can login to ESX servers using your AD account. If I remember right, you would create an AD global security group called ESX Admins and then add those accounts allowed to access the ESX console.

Also, vMotion is now available on vSphere Standard edition.

Hello from VMworld!

2010-09-01T20:58:00.006-04:00

Hey,

Here it is, Wednesday night, the 3rd day of VMworld 2010 and I'm just getting around to my first blog. Any cool blogger would have done 50-60 by now, but fortunately for me, I'm not a cool blogger. I don't know if I'd be doing this entry now except I'm waiting for my wife to come and pick me up. She took the kids to the Exploratorium and I haven't heard from them since...hopefully they are ok.

Me, I'm sitting in the Borders at the corner of 3rd and King St. Evidently it's closing so come on in to get a good deal on a book. Now that the books are 20-30% off, they are somewhat affordable...

I'm looking over at AT&T Park and wondering if I could go to another game...I went Monday night via a Cisco function and had "VIP" passes to a suite. I have learned that I enjoy watching baseball games from luxury suites with free hot dogs, cookies, and drinks. AT&T Park was a fine place to watch a game.

Last night, we went over to, and across, the Golden Gate Bridge.

We ended up having dinner at Pasta Pomodoro in Mill Valley. Turns out, kids eat free on Tuesdays!! We all enjoyed our food and I'd recommend it, especially on Tuesday if you have kids.

So here I am on Wednesday night, sitting in Borders waiting for my wife to call and writing my first blog entry from VMworld, wondering if I can fit in one more baseball game....

Anyway, this is my first VMworld and it's been fantastic! The sessions and labs have been great. I'll tell you all about them, at least until my wife picks me up....

Change the date and time in the BIOS first....

2010-08-20T13:51:00.005-04:00

This is just a reminder to myself. Set the time and date in the BIOS before you install XenServer, or anything for that matter..

Just today, after installing XenServer, I decided to set the date and time in the BIOS before heading out to lunch. The date set in the BIOS was 5/31/2010 so naturally my XenServer 30 day license expired as soon as I adjusted the date. Upon booting, the VMs wouldn't start because the license had expired as shown below:

Problem P2Ving a Linux box to ESXi 4.1...

2010-08-17T15:59:00.002-04:00

Just FYI:

When attempting to P2V a Linux box to an ESXi 4.1 server using vConverter 4.0.1 build 161434, the conversion "froze" at 1% loading the vConverter helper ISO image. One attempted timed out after 20 minutes, but another attempt from a different workstation timed out almost immediately.

The following was found in the vConverter log file:

[#16] [2010-08-17 12:28:05.772 02472 verbose 'wizardController'] Created data connection HelperVMNetworkDataConnection
[#16] [2010-08-17 12:28:05.772 02472 verbose 'App'] Getting VIM connection to 10.10.10.10...
[#16] [2010-08-17 12:28:05.772 02472 info 'App'] Connecting to host 10.10.10.10 on port 443
[#16] [2010-08-17 12:28:05.787 02472 verbose 'App'] [VimApi] Remote version not found. Assuming it's a newer version so try using local version vim.version.version5

I tried another P2V using an ESXi 4.0 server as the destination host and the P2V worked perfectly.

XenApp Nodes are AWOL in the Delivery Services Console

2010-07-09T01:22:00.003-04:00

An associate of mine recently installed a new XenApp 5 server and was shocked to see that he could not manage the server, or the farm, using the Citrix Access Management Console or the Delivery Services Console.

Everything looked right. I was a bit confused as well, as we could see the server and farm if we opened the XenApp Advanced Configuration utility...

We found the following Citrix support article, CTX125827, and Resolution 2, copied below, resolved the problem for us.

From CTX125827:

Caution! This procedure requires you to edit the registry. Using Registry Editor incorrectly can cause serious problems that might require you to reinstall your operating system. Citrix cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. Back up the registry before you edit it.

Verify missing CLSIDs. Export and Delete CLSIDs if they are present.
a. Open Regedit.exe.
b. Navigate to HKEY_CLASSES_ROOT\CLSID\...
c. Look for the appropriate CLSID Keys (See below).
d. Export the CLSIDs if they present.
e. Delete the CLSIDs.
f. If the Keys are missing, move on to step 2.
Reregister the codebase for each DLL (see below).
Launch the Access Management Console.
Reregistering the Codebase

Command: %windir%\microsoft.net\framework\v2.0.50727\regasm /codebase [appropriate DLL, see below]

Registry Keys & Locations of the DLL's

All Files are found in subdirectories under \Program Files\Common Files\Citrix.

(\Program Files (x86)\ if you are running 64-bit systems)

FORMAT:

[Extension Name]
[Registry location of Key 1]
[Registry location of Key 2]
[Directory location]\[DLLName.dll]

Presentation Server - Administration Snap-in:
HKCR\CLSID\{88A3...
HKCR\CLSID\{CEEF9A90...
Presentation Server - Administration Snap-in\pse.core.dll

Dashboard:
HKCR\CLSID\{E32017F9-...
HKCR\CLSID\{825FC1E4-...
Access Management Console - Dashboard Watcher\DWExtension.dll

Diagnostic Facility:
HKCR\CLSID\{E82B228F-...
HKCR\CLSID\{C6574881-...
Access Management Console - Diagnostics\CdfExtension.dll

My Knowledge:
HKCR\CLSID\{BF29D8E6-...
HKCR\CLSID\{D84A00D6-...
Access Management Console - Knowledge Base\KnowledgeBaseExtension.dll

Hotfix:
HKCR\CLSID\{915F6175-...
HKCR\CLSID\{4BA6F3AE-...
Access Management Console - Hotfix Management\HotfixExtension.dll

Presentation Server Console:
HKCR\CLSID\{47147579-...
HKCR\CLSID\{AF34B0C0-...
Access Management Console - Legacy Tools\MMCPlugins\LegacyToolsExt\CMCLaunchExtension.dll

Report Center:
HKCR\CLSID\{5783C6A8-...
HKCR\CLSID\{6BAF479E-...
Access Management Console - Report Center\ReportCentreExtension.dll

XenApp6 Servers are Busy??

2010-07-02T15:40:00.006-04:00

I recently had XenApp 6 servers telling me they were "too busy" when I tried to launch applications. I thought to myself that these servers are crazy as I was the only one trying to launch a published application, but I ran qfarm /load and saw the following surprising results:

I read, and confirmed with Citrix support, that a Server Load of 20000 indicates a licensing problem. Initially, I was told that the Citrix Licensing Server needed to be upgraded to version 11.6.1, build 10007 with the License Administration Console to support XenApp6. The license server was upgraded but the problem persisted.

I had noticed a few licensing "alerts" and "warnings" concerning expired SA's but not yet cleared them out. Those license files were removed and once the Alerts and Warnings were removed/resolved, the Server Load value on the XenApp 6 servers decreased to normal values and I could launch published applications.

VM Stuck in "Pending" State on XenServer

2010-06-17T14:32:00.003-04:00

On a rare occassion, you may encounter a XenServer-based VM that is stuck in a "Pending" state. Recently I came across a VM that was stuck with a pending "Shutdown" task. Within XenCenter, the VM was "unresponsive" and the Shutdown and Reboot buttons were greyed out.

A couple of potential causes for this condition include:

1. Taken from the comments of the following post

"I've since found that the most common reason my VM's won't shut down is that they're using a storage repository (such as an ISO library) that is offline.

In other words, if the virtual cd of a VM is pointing at an ISO that's on an offline storage repository, then that VM can't be shut down! (bug)"

2. From Citrix:

Windows being Windows. At times, when a server executes shutdown, it hangs, spinning it's wheels. XenServer waits for a confirmation from XenTools that the shutdown is proceeding before it completes the task. If there are problems during the Shutdown, XenServer does not consider the task completed leading to a loss of connectivity to the XenServer tools. If connectivity between XenServer and XenTools is lost during the shutdown process meaning XenServer never receives a proper signal from Xentools about the state of the shutdown, you get that "stuck" symptom and the only thing you can do is force-kill the task and down a Force Reboot.

In this case, I had to force-kill the task from the XenServer console CLI using the following commands:

1. xe task-list to view the Pending tasks
2. xe task-cancel force=true uuid=<UUID> to cancel a specific task

Attempting a shutdown or a reboot using the xe vm-reboot or xe vm-shutdown commands did nothing but create another pending task. xe-toolstack-restart and xe task-cancel uuid=<UUID> (without the force=true) had no effect.

Once I cancelled the Pending task affecting the VM, the VM rebooted and worked normally; I did not have to run xe-toolstack-restart after cancelling the task(s), but this instance may be the exception and not the rule.

Gmail Account Hacked?

2010-06-07T19:54:00.004-04:00

I was asked recently, "What do I do if my gmail account is hacked?" Came across the following links when doing some research and thought I'd pass them on and save them for the next time I'm asked.

http://www.friedbeef.com/how-to-check-if-your-gmail-account-has-been-hacked/

http://sciencenotes.wordpress.com/2010/05/06/what-to-do-if-your-gmail-account-is-hacked/

I enjoyed reading this one (not that I hated the other two...)

http://www.hmtweb.com/blog/2009/04/hacked-gmail-accounts-what-to-do-if.html

Happy Birthday!!

2010-06-04T10:22:00.002-04:00

King Solomon said many years ago: "A wife of noble character who can find? She is worth far more than rubies." Who can argue with such wisdom?

Well, today is Susan's birthday and I'm so thankful that she is my wife.

Below is a recent picture, taken during our trip to Colombia. Happy Birthday Susan!

Error 0x80092013 When Starting an Enterprise Subordinate CA

2010-06-03T19:13:00.004-04:00

Working on a Windows 2008 two-tier Certificate Infrastructure implementation, the installation of the Root CA went without a hitch, but when trying to start the certificate server service on the Enterprise Subordinate CAs, I received the error (in summary): "0x80092013 certificate revocation server is offline".

Whether its right or wrong, what I had attempted first when building the Root CA, is to specify a UNC path the the Root's CRL in the Extensions tab of its properties. I had past success using UNC paths when working with Windows 2003 certificate servers and figured that Windows 2008 would work more or less the same, and I guess it does, but in this particular case it was less.

Opening PKIView on the Enterprise Subordinate CA after the service failure, I saw a screen similar to the one below, taken from this blog post: http://www.cupfighter.net/index.php/tag/0x80092013/

I won't bore you with all the details, but to resolve the issue, I used an HTTP path for the Root CRL extension pointing to an IIS virtual directory on the Enterprise Subordinate CAs. Once the CRL was copied to the Subordinate CAs, the certificate services started without a problem.

Another option would have been to disable/ignore the CRL check as found below:
http://khurramullah.wordpress.com/2008/08/07/certificate-services-unable-to-start/

I have not figured out why the file/UNC path to the CRL did not work. Perhaps there will be time to explore it further.

How to Force a DC to Attempt Certificate Autoenrollment

2010-05-20T10:50:00.002-04:00

After installing a new Microsoft Certificate Server, the Event Logs on the Server 2003 domain controllers displayed an Autoenrollment error, Event ID 13 (Access is Denied) while on the 2008 domain controllers, an Event ID 13 error with the Source CertificateServicesClient-Request....or something close.

The fix for the Autoenrollment problem was the following found on an MS Support Forum:

The event 13 from Autoenrollment message may be related to the new DCOM security enhancement of Windows Server 2003 SP1. Windows Server 2003 Certificate Services provides enrollment and administration services by using the DCOM protocol. Certificate Services provides several DCOM interfaces to make these services available. For correct access and usage of these services, Certificate Services assumes that its DCOM interfaces are set to allow remote activation and access permissions.

However, Windows Server 2003 SP1 introduces enhanced default security settings for the DCOM protocol. Specifically, SP1 introduces more precise rights that give an administrator independent control over local and remote permissions for launching, activating, and accessing COM servers. Therefore, because of the enhanced default security settings for DCOM that are introduced by SP1, you may have to update these security settings to make sure of the continued availability of these services after you install SP1.

Suggestions:

1. Please check to ensure that a new security group, CERTSVC_DCOM_ACCESS, has been created after applied the SP1.
2. Please add the "Domain Users", "Domain Computers", "Domain Controllers" groups to the new CERTSVC_DCOM_ACCESS security group.
3. Then, we can have Certificate Services update the DCOM security settings by running the following commands:

certutil -setreg SetupStatus -SETUP_DCOM_SECURITY_UPDATED_FLAG
net stop certsvc
net start certsvc.

Thinking I had my problem fixed, I wanted the DCs to attempt an autoenrollment once again, however, in my impatience, I didn't want to wait for this to happen.

Performing the steps listed below (they worked for 2003 and 2008) forced a certificate autoenrollment on the DCs:

1. Backup/Export the registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\AutoEnrollment\AEDirectoryCache

2. Delete the AEDirectoryCache registry key

3. From the Command line, execute GPUPDATE /FORCE

Shortly thereafter, I reviewed the Event Logs on the DCs and they stated certificate autoenrollment was successful at which point I opened the Certificate Authority MMC on the CA and saw that certificates had indeed been issued.

Virtual Floppy Disk for Windows 7

2010-05-20T09:29:00.001-04:00

I was wondering if you could use a virtual floppy disk as virtual media through, in this case, the Dell Remote Access Controller (HP calls it iLO). I downloaded the virtual floppy utility found below and used the virtual floppy as virtual media to upgrade the BIOS on a Dell PowerEdge 2950 server.

http://www.worthytips.com/virtual-floppy-drive-windows-7/

Don't know if anybody cares, I don't even know if I care, but if you ever need a virtual floppy disk for Windows, it's there.

An "Oh-No" moment with Exchange 2010, demoted DCs, and the EMC Cache File

2010-05-20T09:16:00.002-04:00

This week I demoted an older domain controller, one which originally hosted the FSMO roles, though they had been moved off. The demotion went just as expected, server was rebooted, everything appeared to be fine.

As a side note, Exchange 2010 had been installed and all Exchange services and mailboxes migrated a few weeks prior to this demotion...

Shortly after demoting this server, an Exchange Administrator tried to open the Exchange Management Console to create a new mailbox and "discovered" that they couldn't see anything. Mail was flowing, the Exchange services were started, OWA worked, etc, but the system could not be managed. For example, when expanding the Server Configuration menu, if we clicked Mailbox, we were told there were not mailbox servers in the organization. If we clicked Client Access, we were told there were no client access servers in the organization, etc, etc.

When opening the properties of a mailbox user, clicking on any tab displayed an error message stating that Exchange could not read from a domain controller. This was not looking very good....

Reviewing the Application Event Log revealed many "MSExchange Configuration Cmdlet - Remote Management" errors with Event ID's 4 and 5. Event ID 4 displayed the following text on the General information tab:

(PID 10132, Thread 24) Task Get-UserPrincipalNamesSuffix writing error when processing record of index 0. Error: Microsoft.Exchange.Data.Directory.SuitabilityDirectoryException: An Active Directory error 0x51 occurred when trying to check the suitability of server 'DEMOTED DOMAIN CONTROLLER'. Error: 'Active directory response: The LDAP server is unavailable.' ---> System.DirectoryServices.Protocols.LdapException: The LDAP server is unavailable.

Fortunately for us, the answer to our problem was found pretty quickly with the Microsoft KB article:

http://support.microsoft.com/default.aspx?scid=kb;en-us;2019500&sd=rss&spid=13965

Basically it says, “It is correct that the DC, mentioned in the application log is not available. The server may have been demoted, nevertheless Exchange still tries to connect to the unavailable DC. This obsolete Information is cached in an EMC file in the Windows profile with whom user has logged into the server.”

Sure enough, a cached EMC file was found within the Windows profile for the Exchange Administrators.

Once deleted, we were able to administer the Exchange 2010 system without the Domain Controller read errors. One more thing to keep in mind....when I originally deleted the EMC cache file for one administrator, I was unaware that he had a disconnected remote session with the EMC open. The errors continued until we closed the EMC and deleted the cache file once again. So if you deleted the EMC cache file and the error still continues, it may be because an RDP session was disconnected with the EMC open.

Upside Down Display on Dell Computers

2010-04-14T18:11:00.000-04:00

As some of you may know, you can use the keyboard combination CTRL+ALT+ to scroll down internet sites. Well, I was working at a Community College not too long ago when one of the IT technicians was working on a lab machine in which the display was "upside down". On some of the newer Dell models, this key combination will in fact, turn the display upside down. I can only imagine the horror of the lab student as the key combination which had worked so many times at home, reversed the display on the lab machine. I can see him/her looking over their shoulder, hoping nobody saw, and sneaking away as if nothing happened. Luckily, the problem can be resolved by the keyboard combination CTRL+ALT+. Rest easy computer lab student....

Anxious to Try...

2010-03-19T16:59:00.000-04:00

Have any of you tried to publish App-V application packages to virtual desktops through Citrix XenApp? To be truthful, my experience has been somewhat frustrating simply because of file type associations. Perhaps you know what I'm talking about, perhaps you don't but you can find out more here:

http://blogs.technet.com/appv/archive/2008/09/09/softgrid-cannot-create-citrix-file-type-associations-ftas-for-softgrid-applications.aspx

I have tried following the steps listed detailed on the link above and though I can see the FTA within the Citrix Access Managment Console / Content Redirection, my documents and spreadsheets on the virtual desktop appear as "unknown" icons.

I've was reading Citrix XenApp 6 Sets New Standard in On-Demand App Delivery for Physical and Virtual Desktops and to quote the article, XenApp 6 includes "enhanced enterprise scalability and seamless integration with Microsoft technologies like App-V and Windows Server 2008 R2."

I'm looking forward to testing this out. Do any of you out there have any suggestions in regards to working with App-V and Citrix XenApp as it exists today?

Redirecting XenDesktop XenApp Web sites to the Default Logon Page

2010-03-12T15:25:00.002-05:00

Depending on how your Session Preferences are set on the XenDesktop XenApp Web services site, your users may encounter the following page when they log off their virtual desktop.

However, this can be a problem. All a person would need do to have access to your environment is simply click the "click to connect" button to reattach to a virtual desktop before the session timeout limit is reached. You may be required to configure the XenDesktop XenApp Web site to be redirect back to the default logon screen to avoid this situation.

I have implemented the following procedure to workaround the issue. In this example, my end users connect to their virtual desktops using the web address http://citrixweb.domain.com.

1. Open the Citrix Web Interface Management console, right-click the XenApp Web Service Site that represents the XenDesktop Farm and select Session Preferences.

2. Under General, click Web Sessions. Change the Session Timeout to 1 Minute and click OK. 1 minute is the smallest value that can be set and a virtual desktop will continue to run even though the session timeout value has been reached.

3. On the Citrix web interface server, open IIS Manager and expand the virtual directories Default Web Site | Citrix | DesktopWeb | Auth

4. Right-click loggedout.aspx and choose Properties.

5. Change the content for this resource to A redirection to a URL and then in the Redirect to box, specify the web address for the XenDesktop XenApp web site, in this example http://citrixweb.domain.com and click OK.

As soon as the user logs into their virtual desktop, a 60 second session timeout commences on the browser in the background. When the session timeout value is reached, the browser running "behind" the virtual desktop so to speak is automatically redirected to the XenDesktop default logon page as shown below:

WFCRUN32 Error when launching a virtual desktop

2010-02-23T18:27:00.000-05:00

Recently, when logging into virtual desktop with the latest Citrix Online Web Plugin installed, I received the following error: wfcrun32 ERROR Failed to set Event Logging

The following Citrix support article explains why the message is displayed but to ultimately resolve the issue on the virtual desktop vDisk image, I had to delete the ICAClient folder from the Default User profile.

Quick Hits

2010-02-22T17:24:00.006-05:00

Just a few tidbits from the field...

1. Open File - Security Warning

Had this annoying error when trying to open .ADP files from a network share. Read many posts but found the solution to be the following:

Using a GPO:
a. Go to User Configuration | Administrative Templates | Windows Components | Attachment Manager
b. Edit the setting Inclusion list for low file types
c. Set it to Enabled and then enter the file types you don't want to be warned about.

2. I was working with a XenServer support engineer who, when not quite sure of a command he had entered earlier, entered the "history" command and it displayed a list of all commands previously executed. Being that I spend most of my time on Windows servers, I found this little command to be pretty neat. I've already used it several times since.

3. If you get an Invalid Login with code 0000C801 when logging into an App-V Management Server running on Windows Server 2008, enable the IIS Windows Authentication role service as pointed out here:

http://social.technet.microsoft.com/Forums/en/appvbeta/thread/7ee7d9de-a82f-4e2d-9673-01f4ffd9de85

Upgrading SQL 2000 to 2005.....I know

2010-01-27T01:45:00.003-05:00

Believe it or not, this night, I upgraded a SQL Server from 2000 to 2005. During the upgrade, the following error was presented, luckily before any files were written:

Turns out, J-F Tourigny (thanks very much!) had the same problem when trying to upgrade from MSDE 2000 to SQL Express 2005.

"When trying to upgrade MSDE 2000 to SQL Express 2005, the installation would fail during the upgrade advisor with error -1. In Application log, Event 5000 was generated for process "bpacmd.exe". A quick search on the Internet revealed that the process is looking for BPAClient.dll in the wrong directory. Creating folder %ProgramFiles%\Microsoft SQL Server\90\Setup Bootstrap\BPA\BPAClient and moving the DLL into this folder solved the issue"

The same solution worked for me when upgrading SQL from 2000 to 2005.

XenDesktop PVS vDisk - NTLDR is Missing

2010-01-19T13:00:00.004-05:00

Recently ran across a situation where a Windows XP vDisk streamed from a 5.1 Provisioning Server stated that "NTLDR is Missing". According to all parties, there were no errors during the creation of the image from the creation of the vDisk on the PVS, to the OS load, all the way through the XenConvert process to convert the VM to a vDisk. After XenConvert completed successfully and attempting to boot from the vDisk, you would see the following:

The Windows XP VM was built using the XenServer Windows XP SP3 template. I'm not exactly sure how it happened, but the C: drive was formatted using the FAT32 file system. The vDisk was formatted on the Provisioning Server using NTFS. Thus, the formatting mismatch lead to the vDisk boot problem.

The Windows XP file system was converted to NTFS and XenConvert was used once again to convert the VM to a vDisk. Once completed, VMs could boot from the vDisk.

Exchange 2010 Move Mailbox Error

2010-01-06T15:54:00.006-05:00

We have been working on our first Exchange 2003 to 2010 migration and have seen the following message when attempting to move a mailbox from Exchange 2003 to Exchange 2010:

Error:

Active Directory operation failed on . This error is not retriable. Additional information: Insufficient access rights to perform the operation.

Active directory response: 00002098: SecErr: DSID-03150A45, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0

The user has insufficient access rights.

Turned out to be the fairly common issue of inheritance being disabled on this users Advanced Security Settings.

Once enabled, several "Exchange Trusted Subsystems" rights were applied and the mailbox moved successfully shortly thereafter.

Install "Virtual CPU Cores" for ESX VMs

2010-01-06T14:40:00.004-05:00

While troubleshooting a CPU performance issue on a workstation class VM, I wondered if there were a way to assign virtual CPU cores to a VM. Check out the following links, the processes documented on them worked great. In this case, after performing the steps therein, my workstation VM believed it had 2-Quad Core Processors.

http://www.vcritical.com/2009/09/use-coreinfo-to-view-vm-core-and-socket-count/

http://www.yellow-bricks.com/2009/06/04/per-processor-licenses-for-your-application/

Outlook 2007 Out of Office Assistant not working over VPN

2010-01-06T14:08:00.002-05:00

Had a client pass on some information that may or may not come in handy for you. They had a problem with the Outlook 2007 Out of Office assistant when connected through the VPN. Out of Office worked fine when running Outlook while in the office. They checked name resolution, pinging all relevant servers using their FQDN with success. Their troubleshooting lead them to the patch below and after applying on their client workstations, the problem with the Out of Office assistant was resolved.

http://support.microsoft.com/kb/968858/en-us

Updating XenTools on the Citrix Merchandising Server Appliance

2010-01-06T10:47:00.005-05:00

After installing the Citrix Merchandising Server (v1.1) appliance onto a XenServer 5.5, the XenCenter displayed a warning that XenTools on the CMS was out of date. Looks like XenTools 5.0 is installed on the CMS by default.

I had tried using the CMS command console but personally, had no luck with that whatsoever. When I entered "y", I was immediately returned to the CMS Diagnostics menu.

At this point, I decided to manually update the XenTools on the CMS using the following steps:

1. View the CMS Server Console and on the Diagnostics menu, type 4 to launch the Appliance Terminal.

2. At the appliance terminal prompt, enter the following commands:
cd /mnt
ls
mkdir xs-tools
mount /dev/xvdd /mnt/xs-tools
bash install.sh

3. You will see a message stating that the kernel-xen and xe-guest-utilities packages will be upgraded. Type y to continue.

4. When XenTools has been upgraded, you will be prompted to restart the virtual machine. Enter the command shutdown -r now to reboot the VM immediately, or schedule the reboot to occur at your convenience.

Installing the XenServer Linux Pack after XenServer has been deployed

2010-01-06T10:12:00.006-05:00

This post is more of an FYI for myself as much as anything, but I installed a XenServer a while back, and at the time, I didn't have the Linux Guest Support CD and I continued the XenServer install without it. Well, just a few days ago, I needed to install the Linux Guest Support tools on this XenServer.

The process wasn't hard by any means and I'm sure there are many ways to do this. Here are the steps I took and I'm posting them here so I won't forget, and maybe they'll be helpful to somebody else.

1. I used WinSCP to connect to the XenServer and I copied the Linux Guest Support CD ISO to an ISOs directory that I had created.

2. I connected to the XenServer console using Putty.

3. Change to the ISOs directory and enter the following commands:
mkdir -p /mnt/iso
mount -o loop XS-linuxcd.iso /mnt/iso
cd /mnt/iso

4. Enter the command ./install.sh to install Linux Guest Support. If you have XenCenter open, you will lose the connection as XAPI will be restarted to complete the installation process.

Windows Vista/7 with Outlook 2007 and Riverbed Optimizations

2009-12-07T11:14:00.007-05:00

Just passing along as FYI, but I ran into a situation last week when running Outlook 2007 on Windows Vista or 7. Using the default security settings shown below, a user could not create a new mail profile. It did not matter if you tried to create the profile using Exchange 2007 Autodiscover or Manually. When creating the mail profile, a domain authentication pop-up kept appearing and even thought the machine was joined to the domain and valid user credentials were entered, the authentication pop-up persisted. Ultimately, the user account would be locked out.

If we unchecked Encrypt data between Microsoft Office Outlook and Microsoft Exchange, you could successfully create a new mail profile. After the mailbox was opened for the first time, we checked the box once again, and the domain authentication pop-ups returned.

We also noticed that if changed Logon Network Security to Kerberos Password Authentication, you could leave the "Encrypt" option enabled.

So, to successfully create a new mail profile, launch Outlook, and use Outlook encryption successfully, we had to:
a. Disable the encryption option (when creating the profile, you could click More Settings and then the Security tab to disable)
b. Launch Outlook and let it build the mailbox
c. Close Outlook
d. Re-enable the Encryption option, remembering to also set logon network security to Kerberos Password Authentication.
e. Open Outlook

But really, who wants to go through all this to create a mail profile?

We had a test lab, duplicating our production environment (almost) and we could not duplicate the issue within the lab. Now, in production, the Exchange servers and the end users are in different physical locations. The Exchange servers run on ESX servers located in the "Co-Lo" datacenter. The lab existed within our office building, thus nothing was going over the WAN.

We went over to the datacenter with a Windows 7 machine to verify if our problem lied somewhere with the network setup/gear, and sure enough, our test machines worked just fine with Outlook's default Encryption and logon network security settings.

The network traffic between the datacenter and office building is optimized with Riverbed appliances. In speaking Microsoft on this issue, it turns out that, when running Outlook 2007 on Windows Vista or 7, the optimization Enable MAPI Exchange 2007 Acceleration needs to be disabled to use Outlook 2007's default security settings.

At this time, I personally cannot verify that the issue is resolved by disabling this optimization, I only have Microsoft's "word" as the network team wants to open a case with Riverbed to discuss the issue further. However, as soon as I hear any additional information concerning this issue, I'll pass it along. Again, I just wanted to pass along the information. If you have additional information, please leave a comment, I'd love to hear them.

Two-Factor Authentication for Outlook Anywhere

2009-11-20T19:19:00.004-05:00

Many companies use RSA SecurID to support two-factor authentication and have implemented with Microsoft ISA to support two-factor authentication for OWA and ActiveSync with fantastic results. I've been asked lately if it is possible to support two-factor authentication with Outlook Anywhere. Using RSA products, it does not appear possible. I have read a couple blogs about creating a custom website that could be used as an RSA "front-end" to Outlook Anywhere but I prefer not to overcomplicate matters.

When researching for RSA solutions, I came across Deepnet Unified Authentication for Outlook that looks like a promising solution for enabling two-factor authentication for Outlook Anywhere.

http://www.deepnetsecurity.com/solutions2/outlook.asp

I spoke to a Deepnet sales manager today and the Deepnet product suite addresses the following security concerns shared by most security administrators:

1. Weak Authentication
Deepnet allows you to enable two-factor authentication for Outlook Anywhere

2. Unmanaged devices
Only those client PCs with the Deepnet agent installed can access Outlook Anywhere. The client software we discussed was DevicePass, which is used to create a machine fingerprint. The "fingerprint" information can include the machine's serial number, motherboard ID, CPU ID, BIOS, MAC Address, etc, etc. This ensures that only those machines approved by the company can connect to the email system using Outlook Anywhere.

3. Insecure Local Data
Deepnet can be used to enforce a disk encryption policy thereby protecting local data should a laptop be stolen.

They sent me a small PowerPoint file which provided a high-level overview of the Deepnet architecture and I hope they don't mind me sharing it here:

Basically, 3 items are going to be required. A Deepnet Authentication Server (which can be a VM), the Deepnet Agent for IIS (installed on the Exchange 2007 CAS), and the Deepnet Agent on the client machines. Deepnet stated that the installation of these components is very easy as no consulting time is needed, in fact, they said the solution could be up and active within a day. Also, it can work with RSA so there's no cutover required. Deepnet can replace RSA, but it can be a migration.

I'm very excited about the possibilities and hope to have more posts very soon as we should receive a fully functional 30-day evaluation license on Monday.

Windows Server Virtualization Validation Program

2009-11-19T17:11:00.007-05:00

Microsoft launched the Server Virtualization Validation Program (SVVP), "To improve customers' support experiences when running Windows Server on virtualization technologies other than Hyper-V™ and Virtual Server."

Use the Support Policy Wizard at web site below to determine if your particular virtualization platform will support a chosen Microsoft application. In this quick example, we'll determine if Windows 2008 x64 running Exchange 2007 SP1 is supported on vSphere.

http://www.windowsservercatalog.com/svvp.aspx?svvppage=svvp.htm

1. On Step 1, select the Microsoft Product and version then click Next. Again, in this case Microsoft Exchange 2007 SP1.

2. On Step 2, select the virtualization platform and guest OS then click Next.

3. On the final screen, you'll see if your combination of virtualization platform, operating system, and application are supported.

Accessing OWA thru ISA using RSA

2009-11-16T21:42:00.009-05:00

Have you ever wondered how to properly setup access to OWA 2007 thru ISA 2006 using RSA authentication? Quite honestly, this is not a subject I have spent much time thinking about, but the current work project has required that I do so. Fortunately, there are many articles out there on how to set it up. After completing the initial setup, my personal favorite is this one: http://smtp25.blogspot.com/2009/09/rsa-securid-ready-implementation-guide.html

However, I didn't find this one at the start, so I got to have some fun and mess around a bit with these 3 components. If you follow Oz's steps, you shouldn't see any of these things, but I thought it may be fun to share what can happen if you don't follow his steps.

1. 106: The Web server is busy. Try again later.

I got the 106: The Web server is busy message because I did not copy the sdconf.rec to the Program Files\Microsoft ISA Server\sdconfig directory.

2. YES! I finally got to my login prompt, but upon entering my username and SecurID passcode and PIN, I saw this: 100: Access denied. RSA ACE/Server rejected the passcode that you supplied. Try again with a valid passcode.

In this case, I received this because I had not copied the SecurID file to the Program Files\Microsoft ISA Server\sdconfig directory.

3. Awesome! Now I see Authentication Success, I'm getting somewhere:

But now I get the following: Error Code: 500 Internal Server Error. The parameter is incorrect. (87)

Looking at the Publishing Rule on ISA, specifically the Web Farm tab, the Requests appear to come from the: option was not set to ISA Server Computer. Upon changing, and applying the ISA configuration, I could access my mailbox using OWA.

Though I am able to get in to OWA, it looks like my rules could use a little tweaking to improve the user experience. Once those are hashed out, I'll post them.

SnapDrive 6.1, Windows Server 2008, and vSphere - A Serious Inconvenience!!

2009-11-11T15:15:00.005-05:00

I can't help but smile upon reflection of the last couple days at work. I guess I'm still in the midst of it, but I believe the information below will be relevant to others.

For a little background, I'm building Windows Server 2008 / Exchange 2007 clusters hosted on vSphere with NetApp storage. Thus, I have installed SnapDrive 6.1 onto my Windows VMs. Also important to note, is that vSphere installed the LSI SAS SCSI Controller for my 2008 Servers....

Using SnapDrive to create the iSCSI LUNs was very easy, it was great! This was my first time using it and I was delighted to see that it created the disks, formatted them, created cluster resources, etc, etc. However, the quorum had to reside on a Fibre Channel LUN and SnapDrive, seeing that it can recognize that it is installed into a VM, can create LUNs of Fibre storage because it can use the FC "Initiators" on the ESX server. I was told the quorum had to be on Fibre Channel storage in order to be supported by NetApp, VMware, and Microsoft. Granted, I'm not sure the verbage is right but hopefully you get my point.

Anyway, when creating the FC LUNs using SnapDrive, I received the following message when it attempted to create the LUN:

Failed to create disk in virtual machine, Failed to Map virtual disk: There are no available SCSI controllers..

After a bit of troubleshooting, we decided to contact NetApp. We ran through a couple basics, they were going to review the logs, etc. When speaking with support today, I was told the following "bug" update (366239) had just been released.

http://now.netapp.com/NOW/cgi-bin/bol?Type=Detail&Display=366239

366239
Error "There are no available SCSI controllers" is thrown up by SnapDrive running in win2k8 VM.

Bug Severity: 3 - Serious inconvenience
Bug Status: Fixed
SnapDrive running in Win2k8 VM (configured with virtual LSI SAS controller) and being hosted by ESX Server 4.0 throws up an error "Failed to create disk in virtual machine, Failed to Map virtual disk: There are no available SCSI controllers" during LUN create, connect or mount operations.

Configure VM with LSI parallel controller and do not use LSI SAS controller.

Of course my VMs were using LSI SAS controllers! Anyway, I can confirm that this bug is indeed a serious inconvenience as you typically cannot simply change your controllers "on the fly" so to speak. Doing so tends to render Windows unbootable; but you can step through a process to convert your SCSI controller from LSI SAS to LSI Parallel (and vice versa). I used the steps found here: http://blog.tpv.dk/?p=53 though I may post what I did as well for my own memory....

After converting my SCSI controllers to LSI Parallel, SnapDrive was able to map a Fibre Channel RDM to my Exchange virtual servers and I could proceed with my Exchange 2007 cluster build.

Hub Transport Service fails to start after installing Exchange 2007 SP2

2009-11-10T11:29:00.003-05:00

Each time I have installed Service Pack 2 on an Exchange 2007 server running Hub Transport role, I find the Transport Service does not start when the server is rebooted. I think its just a timing issue though I'm not certain, but the following Microsoft "fix" has resolved my problems.

Configure the Service Control Manager (SCM) time-out value

Increase the default time-out value for the SCM in the registry. To do this, follow these steps:

1. Start Registry Editor.

2. Change the value data for the ServicesPipeTimeout DWORD value to 60000 in the Control subkey. To do this, follow these steps:

a. Click the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet
b. Click the Control registry subkey.
c. Right-click the ServicesPipeTimeout DWORD value, and then click Modify.
d. Click Decimal.
e. Type 60000, and then click OK.

If the ServicesPipeTimeout value is not available, add the new DWORD value, and then set its value data to 60000 in the Control registry subkey. To do this, follow these steps:

a. Click the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet.
b. Click the Control registry subkey.
c. On the Edit menu, point to New, and then click DWORD Value.
d. Type ServicesPipeTimeout, and then press ENTER.
e. Right-click the ServicesPipeTimeout DWORD value, and then click Modify.
f. Click Decimal.
g. Type 60000, and then click OK.

Part 7 - Creating a Windows Server 2008 R2 Hyper-V Failover Cluster: Cluster Shared Volumes

2009-10-31T10:43:00.011-04:00

In previous steps, we have completed the following:

-2 Windows 2008 R2 Hyper-V servers (LAB-HVCORE-01 and LAB-HVCORE-02)
-Attached to a couple of 300GB iSCSI LUNs hosted on EMC Storage.
-Created the initial External virtual network on each Hyper-V host using Hyper-V Manager.
-Run the cluster configuration validation wizard
-Created the Windows Failover Cluster
-Created the Failover Cluster Quorum

Here are the links to the previous posts:

Part 1 - Creating a Windows Server 2008 R2 Hyper-V Failover Cluster: Install Hyper-V and Failover Clustering
Part 2 - Creating a Windows Server 2008 R2 Hyper-V Failover Cluster: Configuring iSCSI Connectivity
Part 3 - Creating a Windows Server 2008 R2 Hyper-V Failover Cluster: Hyper-V Virtual Networking
Part 4 - Creating a Windows Server 2008 R2 Hyper-V Failover Cluster: Cluster Validation Wizard
Part 5 - Creating a Windows Server 2008 R2 Hyper-V Failover Cluster: Build the Windows Failover Cluster
Part 6 - Creating a Windows Server 2008 R2 Hyper-V Failover Cluster: Creating the Cluster Quorum

In this step, we will enable and configure Cluster Shared Volumes. CSVs represent a vast improvement in the way storage and virtual machines are managed, the benefits (as seen on Microsoft TechNet) page are shown below:

• Provide support for Live Migration, moving VMs between Hyper-V hosts with no server interruption. (Similar to VMware VMotion)

• You can reduce the number of LUNs (disks) required for your virtual machines, instead of having to manage one LUN per virtual machine, which was previously the recommended configuration (because the LUN was the unit of failover). Many virtual machines can use a single LUN and can fail over without causing the other virtual machines on the same LUN to also fail over.

I have seen cases where one LUN per virtual disk had been used.

• You can make better use of disk space, because you do not need to place each Virtual Hard Disk (VHD) file on a separate disk with extra free space set aside just for that VHD file. Instead, the free space on a Cluster Shared Volume can be used by any VHD file on that volume.

• You can more easily track the paths to VHD files and other files used by virtual machines. You can specify the path names, instead of identifying disks by drive letters (limited to the number of letters in the alphabet) or identifiers called GUIDs (which are hard to use and remember). With Cluster Shared Volumes, the path appears to be on the system drive of the node, under the \ClusterStorage folder. However, this path is the same when viewed from any node in the cluster.

Cluster Shared Volumes do not need to be assigned a drive letter!

• If you use a few Cluster Shared Volumes to create a configuration that supports many clustered virtual machines, you can perform validation more quickly than you could with a configuration that uses many LUNs to support many clustered virtual machines. With fewer LUNs, validation runs more quickly. (You perform validation by running the Validate a Configuration Wizard in the snap-in for failover clusters.)

• There are no special hardware requirements beyond what is already required for storage in a failover cluster (although Cluster Shared Volumes require NTFS).

• Resiliency is increased, because the cluster can respond correctly even if connectivity between one node and the SAN is interrupted, or part of a network is down. The cluster will re-route the Cluster Shared Volumes communication through an intact part of the SAN or network.

Enabling Cluster Shared Volumes is as simple as launching the Failover Cluster Manager and clicking Enable Cluster Shared Volumes as shown below:

Use the Failover Cluster Manager to add CSV storage:

1. Within the FCM MMC, click Cluster Shared Volumes on the left-hand pane and on the far right-hand pane, under Actions, click Add Storage.

2. On the Add Storage window, specify the Cluster Disks/LUNs to be used a Cluster Shared Volumes and click OK.

**I'm sure you'll notice these disks have drive letters assigned to them. That is due to the fact that, when I built this lab, I was unaware that the drive letters were unnecessary.**

3. The Add Storage wizard finishes and the new CSVs are displayed:

CSV volumes are stored as directories and subdirectories beneath the ClusterStorage root folder, which typically exists on the root of C: to provide a consistent file namespace to all Hyper-V cluster nodes. This ensures any VMs stored on a CSV have the same name and path from any cluster node. In this example, the CSV volumes (Volume1 and Volume2) are stored in the ClusterStorage folder on the root of C:, thus, the fully qualified path to each of the CSV volumes will be:

• C:\ClusterStorage\Volume1\
• C:\ClusterStorage\Volume2\

When you build a virtual machine, install into a CSV (in this case, I made a subdirectory called XD-DDC to hold a XenDesktop Delivery Delivery Controller) and make it highly available in order to support Live Migration.

Well, I think we've reached the conclusion of this series. Windows 2008 R2 Hyper-V is certainly a step up from Windows 2008 and can be an attractive server virtualization alternative, in my opinion for smaller businesses that may never support or require more than a couple dozen servers. However, Hyper-V's feature set still falls short when compared with VMware vSphere, the standard for server virtualization.

Troubleshooting Flex Profile Errors

2009-10-29T02:10:00.008-04:00

I use the Flex Profile Kit whenever I'm involved in a Terminal Services/Citrix project. I enjoy the fact that I can use a base mandatory terminal server profile and yet allow the user to personalize their profile based on registry settings I specify within an INI file. I find I spend less time troubleshooting corrupt profile issues, but on occassion, a bit of troubleshooting is required to correct an issue with the base mandatory profile or the logon/logoff process.

Today was one such occassion. On this particular case, the following error occured when a user logged off of their Citrix session:

WOW! What in the world is going on? To date, the hardest task we've had is to enter additional registry keys into the INI file to keep up with new software or save Outlook signatures, etc, you know, basic day-to-day admin stuff, we've not had what I would call any serious issues.

After checking the basics, I decided to enable "advanced PROFLWIZ logging" in the Framework.ini configuration file. To enable error messages from ProflWiz, use the DISPLAY_PROFLWIZ_ERROR setting. The potential values for DISPLAY_PROFLWIZ_ERROR are shown below, I used DISPLAY_PROFLWIZ_ERROR=2 to see both the progress indicators and any error messages.

DISPLAY_PROFLWIZ_ERROR=0: Run in quiet mode; do not display progress indicators or error messages. This setting is recommended for normal operation.

DISPLAY_PROFLWIZ_ERROR=1: Display error messages; suppress progress indicators.

DISPLAY_PROFLWIZ_ERROR=2: Display error messages and progress indicators. Use this setting only for troublshooting, the Profile Wizard will run much slower.

DISPLAY_PROFLWIZ_ERROR=3: Display progress indicators; suppress error messages. The Profile Wizard will run much slower.

After setting the preferred value, login with a user account experiencing the problem. When using the FPK, Proflwiz runs at logon and logoff. When DISPLAY_PROFLWIZ_ERROR has been enabled, you will see a little Microsoft Office Profile Wizard window which tells you exactly what Proflwiz is doing. In this case, at least initially, Proflwiz was experiencing problems when saving the TileWallpaper setting as shown below:

Like most companies, the Citrix servers were in their own OU, with their own restrictive policy. For ease of troubleshooting, I set the "Hide Specified Drives" and "Prevent access to the Command Prompt" GPOs to Not Configured. This way, I could manually execute the FlexLogoff.bat file without logging off.

After removing the key HKCU\Control Panel\Desktop\TileWallpaper from the settings INI file, Proflwiz was able to get past TileWallpaper, but then failed at Wallpaper... Anyway there were several spots at which Proflwiz failed, those points and their fixes are listed here:

Fix TileWallpaper: Remove HKCU\Control Panel\Desktop\TileWallpaper
Fix Wallpaper: Remove HKCU\Control Panel\Desktop\Wallpaper
Fix BorderWidth: Remove HKCU\Control Panel\Desktop\WindowMetrics
Fix ActiveBorder: Remove HKCU\Control Panel\Colors
Fix NoUpdateCheck: Move HKCU\Printers under [IncludeRegistryTrees] section

I hope this helps should you have to troubleshoot issues with the Flex Profile Kit. Remember to set the DISPLAY_PROFLWIZ_ERROR value back to 0, and reenable any GPOs that were set to Not Configured to ease the troubleshooting.

Part 6 - Creating a Windows Server 2008 R2 Hyper-V Failover Cluster: Create the Cluster Quorum

2009-10-19T17:30:00.005-04:00

Part 5 - Creating a Windows Server 2008 R2 Hyper-V Failover Cluster: Build the Windows Failover Cluster

2009-09-28T15:54:00.010-04:00

Part 4 - Creating a Windows Server 2008 R2 Hyper-V Failover Cluster: Cluster Validation Wizard

2009-09-28T15:17:00.007-04:00

Memory Utilization mismatch between vCenter and Task Manager

2009-09-18T22:32:00.002-04:00

It is possible that there could be a memory utilization display "mismatch" between vCenter and Task Manager on a given VM if large pages are enabled on an ESX host(s). Just this week, vCenter (working with vSphere hosts) was displaying that the memory utilization of a particular VM was consistently between 95-100%. Looking at the VM itself, it showed less than 37% memory utilization.

I tried removing and reinstall VMware Tools and this seemed to correct the problem for a little while, however, the display mismatch returned. Though performance of the VM was normal, VMware support was contacted to get an official answer on why this situation may occur and if they were aware of this happening on other vSphere servers.

That's when support suggested disabling the large pages on the ESX host. Below are the steps.

1. Power off the VM which is reporting a high memory usage

2. Turn off large page on the ESX host
a) Select the ESX host from the VI Client
b) Select the configuration tab
c) Under Software select Advanced Settings
d) Select Mem and scroll down till you see "Mem.AllocGuestLargePage"
e) Set the value to 0. By default it is set to 1.

3. Restart the VM and monitor the memory usage

After performing these steps, the memory mismatch problem has not reoccured.

Part 3 - Creating a Windows Server 2008 R2 Hyper-V Failover Cluster: Hyper-V Virtual Networking

2009-09-18T21:48:00.006-04:00

Here it is, September 18th and I'm just now getting around to my first post of the month! It's been very busy lately, I've taken some time off, and to be honest, a little lazy in regards to spending time blogging. With everything else going on, the blog has suffered a bit, I had thought the information may be getting "stale", but I think I've had more hits once I stopped creating new posts, go figure. Anyway, I have a bit of energy and feel like I need to get the 2008 R2 Hyper-V series done with, so here you have it, the much anticipated resumption of the 2008 R2 Hyper-V series!! I'm just kidding.....

Here are the links to the previous posts:

Part 1 - Creating a Windows Server 2008 R2 Hyper-V Failover Cluster: Install Hyper-V and Failover Clustering
Part 2 - Creating a Windows Server 2008 R2 Hyper-V Failover Cluster: Configuring iSCSI Connectivity

To this point, we have 2 Windows 2008 R2 Hyper-V servers (LAB-HVCORE-01 and LAB-HVCORE-02) and we have attached to a couple of 300GB iSCSI LUNs hosted on EMC Storage. In this step, we're going to create the initial External virtual network on each Hyper-V host using Hyper-V Manager.

1. Launch Hyper-V Manager and connect to one of the Hyper-V servers. Remember that you cannot connect to a Windows Server 2008 R2 Hyper-V server if you launch Hyper-V Manager (or the Failover Cluster MMC for that matter) from Windows Server 2008, the connection will fail. Thus, you must open Hyper-V Manager from another 2008 R2 server, or you can load the Remote Server Administration Tools (RSAT) on your desktop. The RSAT for Windows 7 can be found here:

http://www.microsoft.com/downloads/details.aspx?FamilyID=7d2f6ad7-656b-4313-a005-4e344e43997d&displaylang=en

Anyway, after launching Hyper-V Manager, under Actions, click Virtual Network Manager

2. Under Create virtual network, select External and then click Add

3. Enter a network name (the name must be the same on each HyperV Server), select the appropriate network adapter, and click OK.

4. When prompted to apply network changes, click Yes.

5. Repeat steps 1-4 on each Hyper-V server.

On Step 4, we will Validate the failover cluster configuration...stay tuned!

Office 2007 Quick Access Toolbar on XenApp 5

2009-08-28T01:53:00.002-04:00

When installing Office 2007 on a XenApp 5.0 server using the Flex Profile Kit, I had assumed all Office customization settings were stored in the HKCU\Software\Microsoft\Office registry key. Turns out I was wrong, in fact, a default installation of Office 2007 does not allow Quick Access Toolbar customizations to work with roaming user profiles.

In a default configuration, any Quick Access Toolbar (QAT) customizations are lost when a user logs out of one computer and into another. You can however, configure the QAT to support roaming profiles by enabling the following registry key:

HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\Toolbars

a. Add a new REG_DWORD value called QuickAccessToolbarRoaming
b. Set the value to 1

Personally, I used regedit and loaded as a hive, the mandatory profile NTUSER.MAN file and added the QuickAccessToolbarRoaming value in order to affect all users. Once the value was added and the hive unloaded, users QAT settings were saved and loaded regardless of which Citrix server on which they launched published applications.

Enabling the vSphere Client on Windows 7

2009-08-21T15:52:00.002-04:00

Today was the first time I had tried to launch the vSphere client on Windows 7, which failed of course, stating there was an "Error parsing the ESX server"

A google search turned up the following blog:

http://www.virtualni-svet.com/2009/06/how-to-run-vsphere-client-in-windows-7.html

This worked for me, the only "gotcha" was the location to which the system.dll file is saved in Step 2, needs to match the DEVPATH variable specified in Step 3.

How to determine the version of HyperV Integrated Guest Services

2009-08-12T13:41:00.005-04:00

Ran across this yesterday, thought it may be of interest...

To figure out the installed version of Integrated Guest Services my Hyper-V VMs:

1. Open Device Manager and expand System Devices

2. Right-click Hyper-V Volume Shadow Copy and choose Properties

3. Click the Driver tab and review the Driver Version number. This represents the version number of the Hyper-V Integrated Guest Services.

As I understand it, the Hyper-V Integrated Guest Services base version is 6.0.6001.18000. I am working on a DPM 2007 SP1 project which requires version 6.0.6001.22334. I used this process to check the version installed on the VMs in order to determine if an upgrade was required.

If Microsoft KB959962 has been installed onto the Hyper-V host(s), when you install/upgrade the Integrated Guest Services on the VMs, it will be brought up to version 6.0.6001.22334.

Windows Keyboard Shortcuts

2009-07-29T13:39:00.003-04:00

This post may be for my benefit only, but I needed to use keyboard shortcuts to remove software and drivers in order for Hyper-V Virtual Guest Services to install successfully on a server that was P2Ved using SCVMM. Figure it may happen again...

The following keyboard shortcuts, taken from MS KB126449, provided the greatest benefits:

General keyboard-only commands

* F1: Starts Windows Help
* F10: Activates menu bar options
* SHIFT+F10: Opens a shortcut menu for the selected item (this is the same as right-clicking an object
* CTRL+ESC: Opens the Start menu (use the ARROW keys to select an item)
* CTRL+ESC or ESC: Selects the Start button (press TAB to select the taskbar, or press SHIFT+F10 for a context menu)
* CTRL+SHIFT+ESC: Opens Windows Task Manager
* ALT+DOWN ARROW: Opens a drop-down list box
* ALT+TAB: Switch to another running program (hold down the ALT key and then press the TAB key to view the task-switching window)
* SHIFT: Press and hold down the SHIFT key while you insert a CD-ROM to bypass the automatic-run feature
* ALT+SPACE: Displays the main window's System menu (from the System menu, you can restore, move, resize, minimize, maximize, or close the window)
* ALT+- (ALT+hyphen): Displays the Multiple Document Interface (MDI) child window's System menu (from the MDI child window's System menu, you can restore, move, resize, minimize, maximize, or close the child window)
* CTRL+TAB: Switch to the next child window of a Multiple Document Interface (MDI) program
* ALT+underlined letter in menu: Opens the menu
* ALT+F4: Closes the current window
* CTRL+F4: Closes the current Multiple Document Interface (MDI) window
* ALT+F6: Switch between multiple windows in the same program (for example, when the Notepad Find dialog box is displayed, ALT+F6 switches between the Find dialog box and the main Notepad window)

Migrate IAS from Windows 2003 to Windows 2008

2009-07-29T09:59:00.003-04:00

I recently had to migrate IAS running on a Windows Server 2003 to 2008 and was fortunate enough to run across this post: http://blogs.technet.com/nap/archive/2009/01/15/tool-for-migrating-ias-configuration-settings-to-nps-is-now-available.aspx

In a nutshell, using netsh aaa show config to export the IAS settings from 2003 does not put it into the proper import format for Server 2008, thus the import will fail. The link above leads you to Microsoft Hotfix 955995 providing you with the utility IASMigReader.exe which is used to create a properly formatted IAS import file for Server 2008.

Basic steps are to:
1. Install the Network Policy Server Role on the 2008 Server
2. Install the 955995 Hotfix on the 2008 Server and reboot
3. Copy the IASMigReader.exe file from the 2008 to the 2003 Server
4. On the 2003 server, open a command prompt and execute IASMigReader
5. Copy the resulting ias.txt file from the 2003 to the 2008 Server
6. From the 2008 NPS, open a command prompt and execute netsh nps import path\ias.txt
7. Launch the Network Policy Server MMC and verify the settings have been imported and test the new configuration

UPDATE: managementObject error when enabling HA for Hyper-V VM

2009-07-16T16:18:00.005-04:00

Just an update to the previous post:

I installed the KB951308 hotfix onto another server and this time a reboot was required. Go figure....

managementObject error when enabling HA for Hyper-V VM

2009-07-14T11:30:00.004-04:00

To start a Hyper-V project, I installed an virtual SCVMM server to local storage until I could get the SAN configured. After doing so, I shutdown the SCVMM server and copied it to an iSCSI LUN. When trying to use the Failover Cluster Management MMC on another server to make it "highly available", I received the following managementObject error:

Turns out, all I had to do was install the following hotfix on the server from which I was running the Failover Cluster Management MMC. Once it was installed, I was able to run the HA Wizard and add the SCVMM server to the failover cluster.

This hotfix did not require a reboot.

P2V to Hyper-V - Winload.exe Error

2009-07-09T11:24:00.007-04:00

After P2Ving a 2008 Server to Hyper-V, I received the following Winload.exe error (shown below) upon boot. It is Winload.exe's job to load the OS Kernel...

To resolve, I used the steps found here, but since I love screenshots, I thought I'd share them so you can see the process/commands.

1. Boot the VM from the Server 2008 DVD and on the Install Now screen, select Repair your computer

2. On the Systems Recovery Options window, highlight the OS install to repair and then select Next.

3. When prompted to choose a recovery tool, select the Command Prompt.

4. Enter the commands below and reboot the server:

c:
cd windows\system32
bcdedit /set {bootmgr} device boot
bcdedit /set {default} device boot
bcdedit /set {default} osdevice boot

Part 2 - Creating a Windows Server 2008 R2 Hyper-V Failover Cluster: Configuring iSCSI Connectivity

2009-07-03T18:43:00.013-04:00

In this post, we'll configure the iSCSI connectivity to the back-end storage on the EMC SAN. I'm sure there are several, and potentially better, methods to configure iSCSI on Server Core 2008 R2, but these are the steps I took and I have not had any problems with back-end storage connectivity. If the process can be improved, please let me know.

Here is the link to the previous post:

Part 1 - Creating a Windows Server 2008 R2 Hyper-V Failover Cluster: Install Hyper-V and Failover Clustering

Configuring connectivity to iSCSI LUNs on Server 2008 R2:

1. Login to the server and configure an IP Address on the NIC attached to the iSCSI network and ping the iSCSI target.

2. Execute the command iscsicpl.exe. When prompted to start the iSCSI Service, click Yes.

3. When the iSCSI Initiator Properties window appears, click the Target tab, and within the Quick Connect section, enter the IP address of this iSCSI target and click Quick Connect.

4. On the Quick Connect window, the discovered iSCSI target will be displayed, click Done.

5. When returned to the iSCSI Initiator Properties window, click the Discovery tab. Ensure all iSCSI targets are listed.

6. Click the Volumes and Devices tab and then click Auto Configure. Any iSCSI LUNs to which the Hyper-V hosts have access should be displayed.

Next, we need to use diskpart to bring the disks online and create partitions. On the back-end storage, I created two 300GB LUNs for my Cluster Shared Volumes.

7. At the command prompt,execute the command diskpart and then list disks.

8. To bring a disk online, enter the commands:
select disk <disk number>
online disk
Repeat for each disk

9. To ensure the disks are not in a "read-only" state, execute the command attributes disk clear readonly. Enter the following commands to create and format an NTFS partition:

create partition primary align=64
format fs=ntfs quick

10. Verify the disks can be accessed by the remaining Hyper-V hosts.

Part 1 - Creating a Windows Server 2008 R2 Hyper-V Failover Cluster: Install Hyper-V and Failover Clustering

2009-06-25T22:47:00.012-04:00

While I had an ESX 3.5 to vSphere going in one lab, I was installing a Windows 2008 R2 (Server Core Edition) Hyper-V cluster in another. The benefits of Hyper-V on 2008 R2 can be found pretty easily so I won't go into them in great detail, but a brief list of its improvements are as follows:

-Clustered Shared Volumes, which allows multiple Hyper-V hosts simultaneous access to storage, thereby supporting "Live Motion"
-Support for 32 physical CPUs
-CPU Core Parking will put unneeded processors to "sleep"
-You can hot add/remove hard disks
-Support for Second Level Address Translation to increase CPU performance

I used two HP Proliant DL360 G5 servers with 32GB RAM (LAB-HVCORE-01 and LAB-HVCORE-02) connected, with iSCSI, to an EMC NS20 for the back-end storage. These are the basic, high-level steps I followed to complete the lab:

1. Install Windows Server 2008 R2 - Core on each server
2. Install the Hyper-V and Failover Clustering roles on each server
3. Configure the iSCSI connections to the back-end storage
4. Create the initial virtual network in Hyper-V Manager
5. Validate the cluster configuration
6. Create the failover cluster
7. Create a VM and make it highly available
8. Test failover

I'm going to assume you can install Windows Server 2008 Core and start at Step #2 (which is easy, but a good starting point). If you need more information on installing Server Core, click here and watch the videos posted by Netometer.

To install the Hyper-V and Failover Clustering Roles:

1. After logging into a Server Core system, enter the command start /w ocsetup Microsoft-Hyper-V to install the Hyper-V role.

2. Reboot the server and log back in when you are able.

3. To install the Failover Cluster role, enter the command start /w ocsetup FailoverCluster-Core

4. Reboot the server once again...

5. Login and run the command oclist > c:\servicelist.txt. OCLIST will display a list of the available and installed services on a Server Core system. I export it to a text file so I can use Notepad to view the results. Open servicelist.txt and verify the Hyper-V and Failover Cluster roles are installed as shown below:

6. Repeat for each server

Windows Server 2008 - Windows Setup Rollback

2009-06-23T13:46:00.008-04:00

I just wanted to share a situation I ran into this week when trying to upgrade a server (a physical server) to Windows Server 2008. From what I have seen and read, the problem I was having was not an all to uncommon one, but nonetheless I wanted to share my own experience as those who have encountered the issue, may be able to expand on what I am writing here.

I was to upgrade a few older servers this week from Server 2003 to 2008. Thought it would be easy enough, and to be honest, the upgrade process itself was fine. The compatibility check did not find any compatibility problems with any hardware components so I thought I would be ok. Well, the upgrade finished to completion and on the first reboot, the server became unresponsive and would not boot. It was stuck with the Windows Server "load" bar scrolling across the bottom of the screen, and when looking at the server itself, the hard drive lights were solid green and nothing appeared to be happening.

I waited for a few minutes and rebooted, same problem. I then tried to launch Safe Mode, at which point the hard drives "froze" when the driver crcdisk.sys was displayed on the Safe Mode load screen.

When I rebooted the server, I saw I had the ability to perform a Windows Setup Rollback.

After selecting that option, the server booted to a screen such as the following:

Then, once this process was done, it indeed booted Windows Server 2003 as if I had never attempted to perform the upgrade in the first place. Now, the upgrade process did leave a couple of directories (get to those in a second), but other than that, my "down" server was fully restored to its original OS/Configuration. Quite honestly, I thought it was pretty cool!!

Anyway, I've been trying to figure out how this process works and though the information may be out there, I haven't found exactly what I've wanted. The information, to date, that has been most helpful to me personally can be found here: http://edge.technet.com/Media/Application-Considerations-When-Upgrading-to-Windows-Server-2008/

Summarizing what it posted above, Windows Server 2008 is installed "side-by-side" with Server 2003. During the upgrade process, the data and settings from Server 2003 are migrated to Server 2008, and upon successful completion of the upgrade process, the Server 2003 source information is deleted. The data and settings from the existing Server 2003 installation are, as it seems, placed within a quarantine directory, or directories...

When performing the upgrade, the following folders were created:

$windows.~bt
$windows.~ls
$upgrade.~os

What I'm assuming right now, is that these directories are the Server 2003 "quarantine" and that they allow the Setup Rollback feature to work.

Anyway, just wanted to pass along the Windows Setup Rollback feature of Windows Server 2008 upgrades worked perfectly. If anybody has anything to add in regards to how the upgrade process works, or have a better explanation on the purpose of the three directories listed above, I'd love to hear what you have to say.

Part 4 - Upgrading from ESX 3.5 to vSphere - Upgrading an ESX Server

2009-06-12T17:20:00.015-04:00

Here we are at Part 4, upgrading an ESX host from 3.5 to vSphere using the Host Upgrade Utility. I believe this is a good topic for post #100!

So, let's get started!

To upgrade an ESX host from 3.5 to vSphere:

1. Launch vCenter, open the Hosts and Clusters view, and put the ESX server you are going to upgrade into Maintenance Mode. If the host is not in Maintenance Mode, the upgrade will terminate, telling you the host must be in MM for the upgrade to proceed.

2. With the host in Maintenance Mode, reboot the ESX server and make sure the necessary BIOS settings are enabled. In this case, I needed to make sure No-Execute Memory Protection and Intel(R) Virtualization Technology options were enabled.

3. On the vCenter server, click Start | All Programs | VMware | vSphere Host Update Utility 4.0

4. When the vSphere Host Update Utility (vHUU) launches for the first time, you'll be prompted to download patches from the VMware patch repository.

5. On the Host List window, select the ESX Host you wish to upgrade and click Upgrade Host.

6. On the Image Location screen, click Browse and specify the location/folder containing the vSphere installation ISO. Click Next to continue.

7. Accept the license agreement and click Next.

8. On the Host Credentials window, specify an account with administrative access to the ESX server and click Next.

9. Next a Host Compatibility Check is run, click Next when you see "The host is compatible with this upgrade"

10. On the Console OS Settings window, specify the datastore to store the Service Console VMDK. The service console VMDK requires at least 8.4GB of available space and VMware recommends that you select a local datastore on the ESX host. I'll probably expand on the Service Console VMDK in another post....

11. On the Post-Upgrade Options window, specify how you would like the upgrade wizard to handle any failed upgrade attempts and a post-install script should you desire. Click Next to continue.

12. Click Finish on the Ready to Complete screen to being the upgrade.

13. Within the vHUU, you can easily determine the status of the upgrade as shown below:

14. When the upgrade successfully completes, the vHUU will display as shown below. Click OK.

15. If you look at the server console, it should display that it is running ESX 4.0.0 build-164009. At this point, launch vCenter, right-click the upgraded ESX host, and Exit Maintenance Mode. Repeat the process to upgrade remaining ESX hosts.

Part 3 - Upgrading from ESX 3.5 to vSphere - Install the vSphere Client

2009-06-10T11:58:00.006-04:00

The next step in upgrading from ESX 3.5 to vSphere is to install the vSphere client. Luckily, this task is pretty straightforward and we'll be done soon.

1. On the vCenter Server AutoRun screen, click vSphere Client.

2. Click Next on the Welcome to the vSphere Client install window.

3. Accept the License Agreement and click Next.

4. On the Custom Setup screen, select the option to Install vSphere Host Update Utility 4.0 and click Next. This utility will be used later to upgrade the ESX servers to vSphere.

5. On the Ready to Install the Program screen, click Install.

6. Click Finish when the installation completes.

7. Launch and login to the vSphere client

8. The initial vCenter configuration screen is shown below:

9. Click Hosts and Clusters to verify you can indeed manage your ESX environment.

Part 2 - Upgrading from ESX 3.5 to vSphere - Upgrading VirtualCenter

2009-06-08T09:59:00.010-04:00

Now that the VirtualCenter Server has been demoted from a domain controller to a member server and the SQL Server has been upgraded from SQL 2000 to 2005, we are able to push ahead with our vSphere upgrade by upgrading VirtualCenter to 4.0.

As you'll see later, the individual VirtualCenter components, such as Update Manager and vConverter, have to be upgraded one at a time as a "unified installer" is no longer supported.

To upgrade to vCenter 4.0:

1. Insert the vCenter CD, mount the ISO, whatever you prefer, and click vCenter Server.

2. Choose the Setup Language

3. On the Welcome screen, you'll see an information prompt stating that an earlier version of vCenter is already installed and will be upgraded. Click Next.

4. Accept the license agreement and click Next.

5. On the Customer Information screen, enter the User Name, Organization, and License Key. Click Next.

6. On the Database Options screen, enter the appropriate SQL authentication information. If you are using NT Authentication, the information can be left blank. Click Next.

7. At this point, setup points out the other vCenter components installed on the system as a reminder that they will need to be upgraded manually. Click OK to continue.

8. On the Database Upgrade Warning screen, select Upgrade Existing vCenter Server Database and check the box stating you have created a backup (be sure to have a backup!!). Click Next.

9. On the vCenter Server Service screen, specify the account which will run the vCenter services and click Next.

10. On the Configure Ports screen, you will see the Ports numbers assigned to the various vCenter services. The HTTP Port is set to 808 because I did not remove IIS from the vCenter server. Click Next.

11. Click Install to begin the upgrade.

12. During the upgrade, you will see a screen similar to the following:

13. Click Finish when the upgrade completes.

Next post, we'll look at installing the vCenter client and upgrade the other vCenter components.

Part 1 - Upgrading from ESX 3.5 to vSphere - vCenter Prerequisites

2009-06-05T23:02:00.006-04:00

I had the pleasure of working with a couple teammates today upgrading our ESX lab from 3.5 to vSphere. I enjoy the times we are able to get together and share our knowledge with one another...anyway, the basic upgrade process is as follows:

1. Upgrade to vCenter 4.0
2. Install the vSphere Client
3. Upgrade vCenter Converter
4. If in use, upgrade to the latest version of vCenter Guided Consolidation
5. Upgrade vCenter Update Manager
6. Upgrade the ESX Hosts (we used the vCenter Host Update Utility)
7. Upgrade the VMware Tools on the VMs
8. Upgrade the licenses

Before upgrading to vCenter 4.0, you must ensure that Virtual Center and its database are in order. I've abbreviated the prerequistes list a little, but the full list can be seen in the vSphere Upgrade Guide, found here. The prereqs in bold represent those we needed to resolve in our lab upgrade.

vCenter Server Prerequisites

- VirtualCenter Server 2.x installed on a machine that supports vCenter Server 4.0.

- VMware vCenter Server 4.0 installation media.

- The installation path of the previous version of VirtualCenter must be compatible with the installation requirements for Microsoft Active Directory Application Mode (ADAM/AD LDS). For example the installation path cannot have commas (,) or periods (.). If your previous version of VirtualCenter does not meet this requirement, you must perform a clean installation of vCenter Server 4.0.

- Make sure the system on which you are installing vCenter Server is not an Active Directory domain controller, primary or backup.

- Make sure that the computer name has no more than 15 characters.

- vCenter Server 4.0 uses TCP/IP Ports 80 and 443 for the VMware vSphere Web client. You cannot run vCenter Server on the same machine as a Web server using TCP/IP port 80 (HTTP) or port 443 (HTTPS) because doing so causes port conflicts.

- If you use vCenter Guided Consolidation Service in the VirtualCenter 2.x environment, complete the consolidation plan before you upgrade to vCenter Server 4.0. The upgrade to vCenter Server 4.0 does not preserve or migrate any data gathered by the vCenter Guided Consolidation Service. After the upgrade, all of the data is cleared, and you cannot restore it.

- Back up the SSL certificates that are on the VirtualCenter 2.x system before you upgrade to vCenter Server 4.0.

Database Prerequisites

- If your database server is not supported by vCenter Server, perform a database upgrade to a supported version or import your database into a supported version.

- You must perform a complete backup of your VirtualCenter 2.x database before you begin the vCenter Server upgrade. The VirtualCenter 2.x database schema is not compatible with vCenter Server 4.0. The vCenter Server 4.0 installer upgrades your existing VirtualCenter Server database schema with extra fields, thus making the database unusable by VirtualCenter 2.x.

- You must have login credentials, the database name, and the database server name that will be used by the vCenter Server database. The database server name is typically the ODBC System data store name (DSN) connection name for the vCenter Server database.

- To use a newly supported SQL database, such as Microsoft SQL 2008, you do not need to perform a clean installation of vCenter Server if your existing database is also Microsoft SQL Server. For example, you can upgrade a Microsoft SQL Server 2000 database to Microsoft SQL Server 2005 or Microsoft SQL Server 2008 and then upgrade VirtualCenter 2.x to vCenter Server 4.0.

- If you are upgrading from VirtualCenter 2.0.x and you are using the previously bundled demonstration MSDE database, you must perform a clean installation of vCenter Server. VirtualCenter 2.0.x with the demonstration MSDE database has no supported upgrade path to vCenter Server 4.0.

- If you have a Microsoft SQL database and you are upgrading from VirtualCenter 2.0.x, make sure that bulk logging is enabled. You can disable it after the upgrade is complete.

- If you have a Microsoft SQL database, your system DSN must be using the SQL Native Client driver.

Limited Lab Resources

At the time the lab was originally built, our resources we a bit scarce, thus we had to maximize the responsibilities of each server we had. Unfortunately, this means our current VirtualCenter server was also our lab domain controller, IIS Server, and SQL 2000 Database server. I'm sure you can see where this is headed. The first two steps in our upgrade were:

1. Run "dcpromo" to demote vCenter to a member server
2. Upgrade SQL 2000 (for no particular reason, we upgraded to SQL 2005)

vSphere's supported databases include:

○ Supported Microsoft SQL Server Databases:
Microsoft SQL Server 2005 Express (limit its use to 5 ESX Hosts and/or 50 VMs)
Microsoft SQL Server 2005 Standard edition (SP2)
Microsoft SQL Server 2005 Enterprise edition (SP2)
Microsoft SQL Server 2005 Enterprise edition (SP2) x64
Microsoft SQL Server 2008 Standard Edition
Microsoft SQL Server 2008 Enterprise Edition
Microsoft SQL Server 2008 Enterprise Edition (x64)

○ Oracle Database Support:
Oracle 10g Standard edition (Release 1 [10.1.0.3.0])
Oracle 10g Enterprise edition (Release 1 [10.1.0.3.0])
Oracle 10g Standard edition (Release 2 [10.2.0.1.0])
Oracle 10g Enterprise edition (Release 2 [10.2.0.1.0])
Oracle 10g Enterprise edition (Release 2 [10.2.0.1.0]) x64
Oracle 11g Standard edition
Oracle 11g Enterprise edition

Well, I think that's enough on the prerequisities, we'll jump into the vCenter install on the next post.

A couple of links

2009-06-02T22:01:00.002-04:00

A good friend of mine shared these with me today, thought I'd share.

First, he introduced me to the Citrix Fast Launch Tool which can be used to "speed up" the application launch experience for XenApp users. According to the author, "The resulting benefit is a near instantaneous availability of the application when the user launches the application in XenApp." I can verify that it does indeed do so.

http://community.citrix.com/display/xa/Citrix+Fast+Launch+Tool

Second, he sent me an application virtualization chart created by Virtual Future. It compares the features of the various application virtualization software packages in a nice, easy to follow format.

http://virtualfuture.info/2008/09/updated-application-virtualization-comparison-chart/

When running Word Viewer 97 on XenApp.....

2009-05-27T18:14:00.004-04:00

Watch out when installing Word Viewer 97 on your XenApp servers. Recently, Word Viewer 97 needed to be installed on a few XenApp servers to support the viewing of orders within Meditech. After doing so, the Citrix Access Management Console would not launch.

When launching the CMC, an MMC critical error was displayed basically stating:

"AppName: mmc.exe AppVer: 5.2.3790.3959 ModName: kernel32.dll"

Checked with the "research department" and found http://support.citrix.com/article/CTX115399

Turns out Word Viewer 97 changes the Tahoma(TrueType) font value in the registry to tahoma.FOT. Change the value back to tahoma.TTF and the problem with the CMC launching is resolved.

Can your computer run Windows 7?

2009-05-21T11:13:00.004-04:00

If you want to check and see if your computer (and favorite USB devices) can run Windows 7, go to the following site and run the Windows 7 Upgrade Advisor.

http://www.microsoft.com/windows/windows-7/upgrade-advisor.aspx

After it's been downloaded and installed, click the Windows 7 Upgrade Advisor icon on the desktop. Be sure to plug in ALL devices that may be used in Windows 7. I ran a check with 2 USB drives (one 320gb WD and the other a 1GB drive my dad got from work) and my camera attached.

Click Start Check

The Windows 7 Compatibility Check is launched and will run for a few minutes...

Once the compatibility check is completed, a report is generated detailing any information or issues concerning an upgrade to Windows 7.

Exchange 2007 installs as a Provisioned Role

2009-05-18T09:03:00.002-04:00

Exchange 2007 allows you to delegate installation permissions to an account, thereby allowing a user the ability to install Exchange 2007 without the user being a member of the Exchange Organization Administrators group. After the installation, the role of the server as displayed in the Exchange Management Console is "Provisioned".

More on provisioning/delegating Exchange 2007 installs can be found on these links:

http://msmvps.com/blogs/andersonpatricio/archive/2008/03/20/how-to-delegate-an-exchange-server-2007-installation.aspx

http://technet.microsoft.com/en-us/library/bb201741.aspx

Personally, I have yet to use this functionality but a colleague ran into an issue where an Exchange 2007 CCR's role was "Provisioned". In this case, my colleague did not use the /nprs: switch necessary for a delegated install, nor had he used a different account, nor had he done anything differently from the previous installs at this particular site.

Ultimately, he was led to this site where the answer to the Provisioned role mystery was resolved.

In his post, the author states:

"...I found out that this issue is caused by the Clustered Exchange Instance Name for the Exchange Server is created on a Domain Controller which is either not local to the Exchange install (for example on another site) or a domain controller that was not being used by Setup."

He then goes on to describe how the issue is resolved:

"Forced a domain replication via Active Directory sites and services – and then went to the Exchange Binaries installation directory via a Windows command prompt where I ran the following command syntax:

setup.com /newcms /cmsName: /cip:

Therefore the command looked like the following:

E:\ExchangeMedia\ExchangeServerServicePack1>setup.com /newcms /cmsname:crp-exccrev-01 /cip:100.2.66.21"

When setup completed, the correct role for the Exchange 2007 server was displayed.

XenServer Resource Kit

2009-05-15T18:33:00.002-04:00

Citrix has created the XenServer Resource Kit page as a means to assist with the installation and management of XenServer. The latest tools and utilities can be found here:

http://community.citrix.com/display/xs/XenServer+Resource+Kit

So when do you stream an image to a desktop as opposed to a VM?

2009-05-08T02:50:00.003-04:00

That was the last question I heard at Citrix Synergy, to which the presenter said "That's a good question!"

Initially, my answer to that question is you should stream the OS to a desktop whenever possible because I like to manage as few things as possible. If I can stream an image to a desktop, I only need to manage the image, not the desktops individually in regards to Windows updates, application installations and updates, anti-virus, etc, etc.

During his first Synergy Keynote, Mark Templeton discussed the "Mathematics of Complexity". Speaking on an internship with Chrysler (if I remember correctly) in the 1970s, top executives with Chrysler determined Japanese cars were gaining in popularity and achieving higher reliability than American cars because they had fewer parts. Mr. Templeton then stated that if a car is built with 100,000 parts that are each 99.9% reliable, then total system reliability would be right at 80%. If a car is built with 50,000 parts, and each part is 99.9% reliable, then total system reliability would be over 90% reliable.

That's the reason I like streaming to desktops, I'm eliminating parts and decreasing complexity.

So, when do you stream to virtual desktops? The most obvious reason may be to allow remote connectivity to your corporate image through an Access Gateway.

Second, the ultimate goal is to minimize the number of images to manage. If your environment, has many different desktop hardware platforms, then streaming to the desktop may force you to create more images than you wish to manage. In that case, stream to virtual machines hosted on your virtual infrastructure and direct end users to your XenDesktop Web Interface. During subsequent desktop refreshes, consider using thin clients with built-in support for XenDesktop or identical (or close to identical) desktops and create a common image.

Finally, and similarly, streaming to virtual machines would be ideal if you switch to a BYOC (Bring Your Own Computer) program. This program, implemented by Citrix, could become a popular model moving forward as it helps an organization cut desktop support costs and gives employees the freedom to choose their own desktop platform. With this model, an employee would be given XX dollars to purchase a laptop with which they would connect to a corporate OS image thru the XenDesktop Web Interface in order to run the applications required to do their job. The company saves because IT is not responsible for the maintenance or support of the desktop, IT is "only" responsible for providing the image, the applications, and the users personal data.

Those are my thoughts on when to stream to physical and virtual machines. I'd love to hear yours.

XenDesktop 3.0 Feature Pack 1

2009-05-07T15:03:00.002-04:00

Citrix has released XenDesktop 3.0 Feature Pack 1. I can't wait to try it on Windows 7! I have a Windows 7 image ready to go and have been eagerly awaiting this release.

Announcement from Citrix is below:

This Feature Pack for XenDesktop 3 is an update the Virtual Desktop Agent (VDA) alone. It enables the following enhancements through an easy in-place upgrade for existing XenDesktop 3 customers:

New Feature Enhancements

Smart card enhancements
Use of smart cards with Linux based desktop appliances
SmoothRoaming across stations with heterogeneous smart card readers
Use smart card authentication with both virtual desktop and XenApp-hosted apps (cascaded ICA scenarios)

New HDX technologies
HDX RealTime enhancements for VoIP
Broad support for softphone VoIP within virtual desktop for LAN-based users
Broad compatibility with headsets and microphones
Audio for Vista

Early Availability of Future Technologies

HDX MediaStream for Flash Trial Release (for evaluation purposes only, not for production deployment)
Optimized delivery of Flash content
Accelerates animations, videos and Flash/Flex-based applications
Enables the delivery of Flash based video conferencing applications
Trial release optimized only for LAN-based users with Windows endpoints (suitable for evals)
After installing the standard VDA, the installer prompts the admin to get the HDX MediaStream for Flash Trial Release

Windows 7 – Alpha Release
Demonstrates early support of the next generation Windows desktop
Offers HDX technologies including USB and multi-media
The installer detects that it is a Win7 desktop and provides the correct VDA

I'm not against XenApp, I'm just saying....

2009-05-04T20:53:00.005-04:00

Greetings from Las Vegas! I'm here attending the Citrix Summit and Synergy events and have learned so much already! It's great to be here!

Thus far, I've attended many XenDesktop/Provisioning Server (PVS) breakout sessions as I really enjoy working on these technologies and I'm very excited about the future of these two products. In fact, I heard yesterday that by the year 2013, there will be 49 million virtual desktop users, generating roughly 65 billion dollars in VDI business. So the word is getting out, there is power in virtual desktop technologies.

I'm so excited by XenDesktop and PVS that I already desire to use it for everything, and this seems to keep getting me in trouble everytime I say it, and I can't really figure out why.

For example, when implementing XenDesktop, its recommended that you segment your workers. Citrix uses three main classifications, Task Workers, Office Workers, and Mobile Workers. Each one of these groups uses their desktops differently.

According to the documentation I'm looking at now, Task Workers "require simple, standardized workspace at the lowest cost" as they only need a limited application set. These workers, again according to the documentation I'm reading, are ideal candidates for a XenApp shared desktop which they access thru their local XP or Vista workstation. Here, I personally wonder "Why?"

Office workers "require a fast, personalized workspace from anywhere." Office workers require a personal workspace, potentially use/access many applications, and require more horsepower from their PC. These workers are ideal candidates for XenDesktop with applications being delivered from XenApp. I couldn't agree more!

Mobile workers "require a flexible and portable workspace online or offline". These workers are ideal candidates for XenApp streamed (streamed to the client for offline access) and/or hosted applications (accessed thru a Web Interface server). I don't think XenDesktop is ready for these users, yet. With Project Independence that may change, but we're speaking about what we can do today.

Back to the task workers, why would I want to use XenDesktop? Simple, because I believe that Provisioning Server (to be renamed Provisioning Services) has the power to transform the way businesses support their desktops.

Say I determine my company has 300 task workers and I decide to give them a desktop with a locally installed OS, that means:

a. Image these machines with our corporate image
b. I have to manage 300 machines, ensuring they are consistent with our corporate policies
c. Ensure they have the latest Windows updates installed. Sure I could use WSUS to help, but can you know, with 100% certainty, that all of the approved updates have been installed to your workstations? How much time do you spend managing WSUS?
d. I need to make sure the Anti-Virus and Malware programs are installed, working, and updating correctly.
e. When Citrix releases a new ICA client, updating when accessing from the Web Interface is easy enough, but I guarantee that there will still be calls to the help desk for assistance.
f. What do you do when the system crashes? Reload your image? How long is that process? Then depending on the age of your image, maybe you spend a bit of time updating the PC to the latest updates, etc.

I could go on, but I hope you see my point. If I use PVS to stream a common image to these 300 task workers, I can effectively eliminate the need to repeat these common tasks up to 299 times, as I would only need to manage my ONE, READ-ONLY, IMAGE FILE! I then use XenApp (See, I don't hate it! I still use it!) to publish the application set to the end users, decoupling the OS from the applications to ensure an optimal running state. Why would I not want that?

Certainly XenDesktop is not a cheap solution and may cause some customers to chringe when they see the cost. However, please consider the following:

*The Gartner Group has estimated that it costs as much as $5,867 per year to maintain a PC and its applications.
*Citrix has stated that XenDesktop with PVS can cut that by 40%, a rough savings of $2,347 per year / per PC.

In our example, multiply that savings by 300 and XenDesktop with PVS can potentially save a company $704,000 per year. Naturally, these savings will vary and we will likely get additional data as more companies roll out XenDesktop and perform their own cost savings evaluations. But what we do know, is that it's certainly more cost effective to perform a set of common functions once, rather than repeat it 300 times.

Well, that's my XenDesktop story and I'm sticking to it! I believe XenDesktop and PVS provides so much power and flexibility as it tells a very compelling story. These two technologies, when used together could allow your users to utilize a single, common image, reduce your maintenance challenges, and effectively separate the applications from the desktop.

Microsoft announces Windows 7 Release Candidate!

2009-04-30T00:12:00.003-04:00

Received the following from Microsoft, thought I'd pass it on:

We’re excited to announce the availability of the Windows 7 Release Candidate! The RC milestone is an important step on our path to final delivery of Windows 7. RC signifies that engineering and testing have made significant progress, and that the code is entering the final phases of testing.

Feedback from our customers was instrumental in shaping Windows 7 RC. We made a number of enhancements between Beta and RC, including the following:

•Easier, more intuitive navigation through JumpLists, desktop enhancements and improved search relevance
•Improved Windows taskbar scaling
•Improved driver support and management, as well as Device Stage to help manage devices
•Windows Touch updates and Touch Zoom
•More Aero themes
•Improved security and enhancements to User Access Control (UAC)
•Reducing the Windows 7 partition drive size (required for Bit Locker and Windows Recovery Environment) from 200 megabytes to 100 megabytes

In moving from Windows 7 Beta to Windows 7 RC, we listened to feedback from you – our customers and partners -- and focused on the improvements you asked for the most. We hope that you will find Windows 7 RC to be a high quality release that makes everyday tasks easier and faster, while making new things possible.

Windows 7 Availability:

MSDN and TechNet subscribers can download Windows 7 RC as of April 30. On May 5, Windows 7 RC will be available to the general public through the Customer Preview Program. Anyone can download the RC build through this program. There will be no limits on the number of keys provided or the number of Windows 7 downloads supported. RC downloads will be available at least through June 2009.

We recommend that you download Windows 7 from the site that best describes you in the table below. Each of these sites contains customized content to support the needs of a particular audience.

Migrate from Windows Beta to RC

For everyone using a Beta version of Windows 7, it is important to migrate to Windows 7 RC to avoid the timebomb that is built into Windows 7 Beta. That timebomb will activate on 7/1/2009. When the timebomb activates, users will experience frequent notifications and forced reboots. (Windows 7 RC also has a built-in timebomb, but this will not activate until 3/1/2010.)

Please visit the Windows 7 TechNet Site for more information.

XenServer 5.5 Beta Released

2009-04-28T20:45:00.002-04:00

Citrix released XenServer 5.5 Beta yesterday. To download, you'll need a MyCitrix login.

Here are some of the benefits according to the release notes:

Improved backup and snapshot support allows you to perform live snapshot and clone operations on all storage types.

This enables better support for backup utilities and practises, and helps to reduce disk space requirements by storing snapshots using only the minimum space required. You can now take snapshots from XenCenter as well as through the xe CLI. For more information on this feature, please refer to the Storage chapter and the 'VM Snapshots' section of the Backup and recovery chapter in the Administrator's Guide.

Active Directory integration to allow credentials to be verified against an AD server.

This allows granting and revocation of access to XenServer pools easily and securely using existing IT infrastructure. For more information on this feature, please refer to the 'XenServer hosts and resource pools' chapter in the Administrator's Guide.

Workload Balancing to optimize VM placement and assist with balancing of workloads within a pool.

This is done using the Workload Balancing server, available as a download alongside XenServer. For more information on this feature, please refer to the 'Workload Balancing' chapter in the Administrator's Guide.

Integration with StorageLink services via the xe CLI enabling advanced storage management capabilities via the Citrix StorageLink service, available as a download alongisde XenServer.

For more information on this feature, please refer to the 'Citrix StorageLink Gateway (CSLG) SRs' section of the Storage chapter in the Administrator's Guide.

Improved operating system support including new support for Red Hat Enterprize Linux 5.3, Novell SLES11, and Debian Lenny.

Remember VECD Licensing when discussing VDI

2009-04-27T16:44:00.005-04:00

Wow! I'm not sure about you, but April has been a busy month! To start the month, I was part of the NWN EMC/Microsoft/XenDesktop road show around North Carolina, and just this part week, I was in Tampa, FL and Redmond, WA. In between, there have been baseball practices, dance lessons, softball games, etc, etc. The only "free" day my family gets now is Saturday and that is spent recovering from the week and doing all the household chores that must be done. With all that going on, my blog has suffered lately. In my younger days I had the ability to stay up until 3am and get by on naps more or less, but as I keep getting older, I find I need more sleep. :)

But that's enough about what I've been doing. Let's move on to a topic you may find just as boring. Microsoft Licensing!! Oh, boy!!

Today, I want to bring up licensing and how it relates to VDI. With VDI becoming increasingly popular, the folks at Microsoft came to the realization they needed a new, more flexible licensing model than the current OEM or retail licensing models. VDI must have the ability to run Windows Client OS's on servers with unrestricted movement of VMs between the hardware systems attached to a virtual infrastructure, so the licensing model needs to support such behavior.

Some limitations of OEM and retail licensing include:

OEM licenses bound to the hardware
Retail licenses can be reassigned once every 90 days
OEM and retail licenses cannot be dynamically assigned
OEM and retail licenses do not include SA benefits

To combat these limitations, Microsoft has introduced the Windows Virtual Enterprise Centralized Desktop (VECD) licensing model. To date, VECD licensing is poorly understood but its a subject that must be discussed with potential VDI customers UP FRONT so as to avoid the awkward and potentially embarrassing "we need more money for licensing" conversation later in the sales cycle.

VECD is a device based annual subscription program designed to help you license virtual instances of an OS. Basically, VECD provides you a license to run a virtual copy of Windows and regardless of the VDI platform you choose (XenDesktop, VMware View, etc), a VECD license is required for each device accessing a VDI image.

Microsoft believes VECD is a better licensing solution for virtual desktops because it provides the following "benefits":

You can install windows on any hardware and storage
Supports unlimited movement between servers and storage
Reassignment rights to another device in event of device failure
Provides access to corporate desktop images from non-corporate Windows PCs
A Single VECD license allows concurrent access up to 4VMs
Work at home rights are included
VECD customers have the option to purchase MDOP and WinFLP

My objective today is not to make you an expert on the VECD licensing model, but simply to make you aware that if you are considering a VDI implementation, you must take into account (preferably during the initial planning/budgeting phases) the VECD licensing cost. Specific pricing can be obtained from your preferred Microsoft Licensing Vendor.

Questions from the road

2009-04-07T19:48:00.004-04:00

I would like to thank everybody who came out to NWN's Road Show last week. For me personally, it was pretty fun talking about XenDesktop and getting to meet those who attended.

We had some great questions so I decided to post some of them here:

1. If a user is logged onto a virtual desktop (hosted on Microsoft Hyper-V), what happens if you try to connect to the virtual machine using the SCVMM Administration Console?

The answer: Not much, you'll either the screen below or a blank one

2. Can the Provisioning Server 5.0 data stream be encrypted?

The short answer: No, not yet anyway...

The longer answer: I heard from Citrix that Ardence made a "Secure Server" in version 4.1 that can be used to encrypt data stream and has been primarily used in the federal space for classified workstations. The ability to encrypt the data stream has not yet been incorporated into PVS. You can however, encrypt the write cache should you choose to place it on a hard disk as shown below.

3. Is the Active Directory schema extended when the XenDesktop Desktop Delivery Controller is installed?

Answer: No, though the installation of the DDC will require on OU, only standard Active Directory objects are created and used by the DDC. The XenDesktop OU will be used to store the Controllers security group, a Service Connection Point (SCP) that contains meta-information about the XenDesktop farm, and a RegistrationServices container which contains one SCP object for each DDC that is created.

Updating a PVS vDisk with a Hyper-V VM....

2009-04-02T22:50:00.004-04:00

Recently, I found myself needing to update a Provisioning Server vDisk and in this particular case, I was using an XP VM hosted within a Hyper-V infrastructure to boot the vDisk. After configuring the desktop to boot using the vDisk in the PVS Console, I was surprised to see:

After the initial surprise, I got to looking at the screen and something looked funny. I started to think that the MAC address was different, but because I can barely remember my PIN number, I didn't think I had the capacity to remember MAC addresses. Regardless, I checked the PVS Console and sure enough, the MAC address for my XP VM had changed!

At this point, I opened up the SCVMM Console and noticed my XP VM had been migrated to another Hyper-V host. Additionally, when checking the properties of the VM, the NIC was set to obtain a MAC address dynamically. Thus, when the VM was migrated to another Hyper-V host, its MAC address changed, and kept the PVS from communicating with the target device. I shut the VM down, and set the MAC address to Static (matching the PVS target device) as shown below:

Once the VMs MAC Address matched that specified in the PVS Console, everything worked as expected.

On a side note, I have NOT seen this same behavior by any Hyper-V based virtual desktops that have been created using the XenDesktop Setup Wizard.

More on Hyper-V MAC Addresses can be found here

XenDesktop Appliance Add-On for Microsoft Windows CE 6.0

2009-03-26T13:57:00.007-04:00

HP provides a XenDesktop Appliance Add-On for their Windows CE Thin Clients to have them boot directly to the XenDesktop web interface page. This is especially helpful if you do not want the end-users interacting with the local Windows CE desktop.

To install the XenDesktop Appliance Add-On:

1. Download the XenDesktop Add-On and extract the .EXE file to a directory on your hard drive.

2. Execute the downloaded file to extract files. By default, the files are extracted to C:\Program Files\Altiris\eXpress\Deployment Server

3. Open XD.ARP (CE_Cabs subdirectory) in a text editor such as Notepad.

4. Search for the term servername. It only occurs once.

5. Replace servername with the server name for the XenServer web access page.

6. Save the file.

7. Copy the xp.arp file to a USB drive.

8. Insert the USB drive into the thin client. The USB drive will show up as \Hard Disk2.

9. Copy the XD.ARP file into the \Hard Disk\ directory.

10. Reboot the thin client to install the XD.ARP file. It should come up in XenDesktop mode.

To get back to the ThinConnect program or the control panel, press Escape when the "Automatic Log On" window is counting down.

Error 25120 when installing the AppV Management Server

2009-03-25T17:04:00.005-04:00

At some point I need to work on an introduction to AppV 4.5 but today is a short post on an error I saw while installing the AppV Management Server.

In order for the installation of the AppV Management Server to succeed, I had to install the IIS 6 Management Compatibility role services.

Introduction to Citrix User Profile Manager

2009-03-24T18:03:00.008-04:00

The Citrix User Profile Manager, included with XenDesktop 3, is similar in nature to the Flex Profile Kit. Citrix is providing User Profile Manager as the tool to easily, and reliably, manage user personalization settings in XenApp and XenDesktop deployments.

By default, UPM will save the entire HKCU registry hive, though it can be configured to save specific keys, and specified files and folders stored within the users profile at logoff to the user store. At logon, the data is copied from the user store and imported into the current user profile.

UPM would need to be installed to all XenApp servers, and if using Provisioning Server, to your base OS image. By default, the installation directory is C:\Program Files\Citrix\User Profile Manager. Like the Flex Profile Kit, UPM provides an INI files (stored in the installation directory) for custom configurations, but it also provides a GPO ADM template which can be imported into the Group Policy Administration console. Personally, I like configuring UPM through group policy, especially in a XenDesktop/Provisioning Server deployment simply because it may keep you from the process of:

a. determining the INI needs to be changed
b. converting the vDisk from Shared to Private
c. booting the private image and making the INI change
d. converting the vDisk back to Shared
e. rebooting desktops to test the INI change
f. repeat if necessary

The installation of UPM is straightforward and is completed in only a few clicks. It does require a reboot of the system however.

Once imported, UPM policies are added to the Computer Configuration Settings as shown below:

Perhaps the most important policy to set is Path to user store. This represents the directory in which all user personalization settings will be saved. For the UPM policies, #cn# is used instead of %username%.

I may be moving beyond a simple introduction so I'm going to stop this post here. I'm sure there will be more to follow, but I encourage you to give UPM a try in your environment.

To download UPM, you'll need a mycitrix login.

DPM Encountered a Retryable VSS Error

2009-03-19T20:29:00.002-04:00

When using DPM 2007 to backup an Exchange 2007 server, you may encounter this:

"DPM encountered a retryable VSS error ID 30112. Details: Unknown Error 0x800423f3"

I have read where this was an issue with Exchange 2007 if the rollup pack is 3 or less. The article looks like it was updated on February 19th, so the problem likely still exists.

Here's the link to the "fix".

http://technet.microsoft.com/en-us/library/bb217320.aspx

Basically, you have to restart the Information Store and Exchange Replication services to workaround it.

Unable to create Network Team on Dell PowerEdge 2950

2009-03-16T16:12:00.003-04:00

When launching the Broadcom Advanced Control Suite 3 in an effort to create a NIC team on a new Dell PowerEdge 2950 server (Windows Server 2008), you may notice you do not have the ability to create to do so as "Team Management" is not an available option. This is likely due to the BACS version, especially if its v.11.3.14.0.

If you upgrade BACS 3 to revision 11.6.10.0, this issue should be corrected.

The latest Broadcom Management Applications Installer can be found here:

http://www.broadcom.com/support/ethernet_nic/netxtremeii.php