Server 2008 Firewall Woes

We have just been working on a niggly problem. We were trying to connect a spare nic in a Server 2008 server to a development network. The development network is currently just a switch with nothing else connected.

As soon as the second nic was plugged in, we lost all connectivity to the server from the main nic, and even lost ability to ping the server.

After a bit of head scratching we realised that although Windows Firewall was turned off, as soon as the second nic was plugged in the Firewall turned itself back on.... thus blocking pings and RDP.

Simple solution was obviously to plug in the connection, and then disable firewall.

VMM2008 SSP - Shared ISOs

We have noticed that when Self Service Portal users are trying to alter the properties of one of their VMs, they have an option to mount an ISO. Down at the bottom of the options is a tick box which says "SHARE" rather than copy.

Normally if you mount an ISO, the ISO file will be copied into a subfolder of the VM before it is mounted. For a 4Gb ISO files (such as SuseLinux) this can take several minutes. So the obvious advantage of using the SHARE option is that it just uses the original ISO rather than creating a copy.

However....there is a catch. The option isnt available if your host if a Hyper-V server. I have logged this with MS via Technet; http://forums.microsoft.com/TechNet/showpost.aspx?postid=4167342&siteid=17

It seems to be a known issue, but as yet they havent given a resolution date.

Dev Con & Dell

We have been having a serious issue with our latest Dell 755s. These PCs come with a built in 4 slot card reader. The A: drive is reserved for a floppy, C: is the local HDD, D: is taken by the DVD drive, leaving E, F, G & H for the card reader. I imagine 90% of network admins have set the users home area to default to H: which obviously causes a major problem when the user tries to log-in to a machine with a card reader. As a short term fix we have used a MS tool called devcon, which can disable devices from the command line. Ill post an update when we find a more long term solution.

VMM2008 Slow Creating VMs


Following on from a previous post on this topic, I have finally (after around 6 weeks of trying) been able to find a resolution to the issue I previous posted about here.

It turns out this this was not actually an issue with VMM being slow installing VM Components. VMM was actually being slow at reading the drives on the host server. thankfully someone from Microsoft jumped onboard (thanks Hector Linares), and was able to confirm that VMM2008 does have this issue if any of the following conditions are met;

VIRTUAL MEDIA: If the host server has any virtual media such as a Dell DRAC or Virtual Floppy.

GPT DISK: If any drives in the host server are using GPT Partition table rather than MBR

UNINITIALIZED DISK: If any of the disks are not initialized.

OTHER MOUNTED VHDs: If a VHD has mounted incorrectly or not dismounted correctly.

In our situation the problem was actually related to GPT. The server has 3 drives, 2 set up as MBR and one set up as GPT. Converting the one GPT disk to MBR instantly fixed the problem, and VMM now creates VMs in under 10 seconds.

As a side note, GPT drives was introduced by MS in Server 2003 SP1, but is really being pushed with server 2008. See this article by MS.

Hopefully MS will have a fix soon, but as of Nov 2008 there is no way of converting an MBR disk to GPT without loosing the data.

Dell's Wonderful Utility Partition

If you have installed and configured a Dell Poweredge Server, you may have noticed a "utility" partition which exists on the system drive....in our our case on the RAID 1 mirror which is our system drive.

For reasons I wont go into, it was suggested that we remove the dell system partition. The Server is a 2008 build, where the partition simply shows up in Storage Management, but you are unable to edit or delete it from there.

Dell's solution was to rebuild the entire server including OS. Great....

I decided there must be a quicker way so had a little expriment with DISKPART. Diskpart is a command line tool which allows you to foricbly remove a partition. As long as you are not trying to force remove a partition within a dynamic disk, this is a fairly straight forward process and is supposed to leave the rest of the drive (or mirror) in tact.

To cut a long store short....dont use DISKPART to force remove a DELL utility partition, it doesnt work, and it will leave you having to rebuild all the data contained on the same drive. Considering the Dell Utility Partition only contains data which is on a normal Dell boot CD, I really cant see the point in it.

DFS Paths For All


We have recently introduced DFS paths onto the network, which offers some significant advantages over standard UNC paths. For those who dont know about DFS;

Click Here

In short.... DFS introduces virtual paths for AD users. Rather than have users going to a path such as "\\ServerName\\volume\file.doc", your users will go to a path such as "\\domain.com\storage\file.doc". The advantage to be gained certainly isnt in path lengths, but in the administration of the paths.

For example, lets say everyones home area points to "\\london\home\userid", and for whatever reason the server "london" is removed from the network. Not only do the files have to be restored to a new location, but everyones paths are going to have to point to the new locations. This includes their home area path, their profile path, and more importantly any links the users has in documents, spreadsheets or databases.

With DFS paths everyones home area can be directed to "\\domain.com\home\userid", and the same with their profile and any Group Policy directed folders. The user is still effecticvely pointing to a serevr, but as this is now being done dynamically if the server goes offline or the data ius migrated, all that needs changing is the DFS pointer. Brilliant.



There are some other advantages such as syncronisation and high-availablity, and I plan to look into these in the near future.

I should also point out another handy tool from Doverstones, which is AD-Find & Replace. This works in the same way as notepad's find & replace for example, but on Active Directory objects. So, if you need to change home area paths for thousands of users, this tool can do it in seconds;

Click Here

Server 2003 -> Server 2008 Schema Upgrade

We recently decided to upgrade our 2003 Schema to support 2008. We already have a number of 2008 Servers in place, but the schema upgrade gives us the obvious advantage of being able to designate the 2008 servers as domain controllers. All our new builds are 2008, so this is starting to be a priority.

"Upgrading The Schema" is slightly worrying, no matter how many back-ups you have, and no matter how well you follow instructions.

We did have issue on our student network, and ended up having to log a call with MS, who were able to fix the problem via some manual changes to Active Directory. This only affected the schema upgrade enabling read only domain controller functionality. I'm not sure we will ever use a read only DC, but perhaps its something to consider for an off campus office.

Anyway, the steps for upgrading your 2003 Schema to 2008 are;

adprep.exe /forestprep Schema Master once per forest
adprep.exe /domainprep Infrastructure Master twice (once per domain)
adprep.exe /domainprep /gpprep Infrastructure Master twice (once per domain)
adprep.exe /rodcprep * Domain Naming Master once per forest


* Optional when you want to deploy Read Only Domain Controllers

The adprep tools are contained on the server 2008 DVD.... I'd suggest copying this to your DC's rather than running from the DVD drive. I'd also suggest checking your schema backups, and making sure that servers are running on a UPS.....you never know.

As a side note, I'll give a small plug for some software we have recently used by Doverstones;

http://www.dovestones.com/

FSMO Role: Ideal for the above situation if you dont know which servers hold roles.

Its simple and free!

VMM 2008 Insists On Installing Components

I appear to have a few people at Microsoft scratching their heads with an issue we are experiencing....and I dont think I'm the only one; When we create VMs (no matter how), VMM insists on a step called "installing VM components". This is when creating a VM on the Hyper-V host. It is my understanding that VMM should not carry out this step, if for example you are creating a machine with a blank HDD, or with a non supported OS such as Linux. However, this step runs every single time a VM is created. I will add that eventually it times out (15 minutes or so), and the VM does function perfectly. This might not seem an issue generally, but in a classroom where students may wish to create a VM from the portal, it becomes a problem. Firstly students tend to be a little inpatient....and secondly they cannot see the job list in the same way an administrator can, and probably give up thinking that it isnt going to work. We have tried creating a VM from a template....same problem, with a blank small HDD, large HDD, a template with "noi customization required".....but every single time VMM does the step and the creation hangs. Interestingly the error log says;

----------------------------- Warning (13226) Virtual hard disk W:\test907am\Blank Disk - Small.vhd cannot be mounted on host trent.students.blackburn.local because it conflicts with other disks. Recommended Action Wait a few moments and then try the operation again. -----------------------------

You can see my full report on Technet here; http://forums.microsoft.com/TechNet/ShowPost.aspx?PostID=4088882&SiteID=17

VMM2008 Released

I now got around to upgrading the Beta of Virtual Machine Manager 2008, to the RTM version. MS have made quite a few changes....improvments.... and introduced one or two bugs (see my next post).

The splash screen for VMM Admin Console has changed significantly, and previous bugs which existed in relation to the storage of ISO's in a VMM Library have been corrected.

The porcess of Physical To Virtual Conversion on Windows 2000 machines has been introduced. More specifically Microsoft have enabled a feature called Offline Conversion. This basically installs a Windows PE images onto the source, boots it up into Windows PE to do the conversion, then creates it as a VM..... works a charm, although in testing we experienced downtime of around 1 hour as it was an old PC.

Another thing MS have fixed significantly is the web portal, which no longer takes 20 minutes to log in to. You can now give users the ability to create their own BLANK VMs, something which wasnt possible in the Beta, but will be ideal in a classroom scenario.

If you are upgrading from VMM2008 Beta to live, a word of warning. The agent on all your hosts will also require upgrading. This was very smooth for our test 2003 host, but became extreamly complex for a server 2008 hyper-v host. To cut a long story short... we had to manually remove the VMM agent from the host, uninstall hyper V, upgrade to the latest version of Hyper-v, then re-install the VMM agent. It worked, but there was a period of panic when we lost control, and ability to control any of the VMs on the HyperV host.

All in all this release is looking really good, and offers the obvious advantage of well supported management of Server 2008 HyperV Hosts. Sadly still no support from USB devices on a host/server (dongles etc), and no support for non domain member servers.....but you cant have it all.