TryCatch.be

[VBS] - Scripting for OCS (AD Parameters)

Benjamin-Pierre — Fri, 03 Sep 2010 12:05:00 GMT

A few month ago I had to create a script to automate the proccess of enabling and configuring users for OCS in Active Directory.

I used VBScript for this. MOst part is conventional... however, I had to change the meeting policy from default to something else, this part was tricky.

Enough talking: here you can enjoy the part to change the policy:

'************************************POLICY CHANGE***************************************

        strMeetingPolicy="CN={5DC1A974-C49C-477C-A3F7-E54EECEBE3A9},CN=Policies,CN=RTC Service,CN=Microsoft,CN=System,DC=yourdomain,DC=local"
        strMeetingPolicyDN1="B:8:01000000:"&strMeetingPolicy
        objUser.put "msRTCSIP-UserPolicy", strMeetingPolicyDN1

        '************************************POLICY CHANGE***************************************

==> Go first in AD and check the values under the Policies (Domain ==> System ==> Microsoft ==> RTC Service ==> Policies)

Pro Memory: here are the most common used parameters for OCS configuration:

' The msRTCSIP-OptionFlags attribute specifies the different options that are enabled For

                ' the user. It's a bit-mask value of type integer. Each option is represented by a bit.
                ' Valid value types are:
                ' 1: Enabled for public IM connectivity
                ' 2: Reserved
                ' 4: Reserved
                ' 8: Reserved
                ' 16: RCC (Remote Call Control) enabled [telephony]
                ' 64: AllowOrganizeMeetingWithAnonymousParticipants
                ' 128: UCEnabled (enable user for unified communications)
                ' 256: EnabledForEnhancedPresence
                ' 512: RemoteCallControlDualMode
                ' 1024: Enable auto-attendant
                ' Example: 449 = 256 (Enhanced presence) + 128 (UC enabled) + 64 (anonym. participants) + 1 (public IM)
                nOptionFlags = 320

                objUser.put "msRTCSIP-PrimaryUserAddress", strPrimaryUserAddress
                objUser.put "msRTCSIP-FederationEnabled", bFederationEnabled
                objUser.put "msRTCSIP-ArchivingEnabled", nArchivingEnabled
                objUser.put "msRTCSIP-InternetAccessEnabled", bInternetAccessEnabled
                objUser.put "msRTCSIP-Line", strLine
                objUser.put "msRTCSIP-OptionFlags", nOptionFlags
                objUser.put "msRTCSIP-PrimaryHomeServer", strPrimaryHomeServer
                objUser.put "msRTCSIP-UserEnabled", True

                'objUser3.put "msRTCSIP-TargetHomeServer"
                'objUser3.put "msRTCSIP-OriginatorSid"
                'objUser3.put "msRTCSIP-LineServer"
                'objUser3.put "msRTCSIP-UserExtension"

And off course don't forget the: objUser.setinfo at the end

[BATCH] - Get modified date with FOR /F

Benjamin-Pierre — Fri, 03 Sep 2010 12:05:00 GMT

I had to write a batch script for a client, to automate a proccess.

I was required to check the modification date of a file and compare it to the current date...
This seemed quite easy, but took me some time as the date would not let me to "trim" her...

Now here is the working code I wrote for it

@echo OFF
SETLOCAL EnableDelayedExpansion

set directory="C:\The_Directory_you_whish_to_check"
set file=%%a
set size=%%~Za
set mydate=%date%
set lastmod=%%~Ta

for /f "tokens=* delims=" %%a in ('dir /b "%directory%*.txt"') do (

echo %lastmod% > %directory%Autoreport\temp.txt
set /p var=<%directory%Autoreport\temp.txt
set myvar=!var:~0,10!
echo !myvar!
)

ENDLOCAL

Strange that I had to export the parameter to an textfile and reimport it to make it work.
But I guess, ends good all good

[VBS] MOVE EMPTY FOLDERS

Benjamin-Pierre — Fri, 03 Sep 2010 12:04:00 GMT

It's very annoying to have a lot of empty folders hanging around....

I've written a smal VBS script to check one location (user input) for empty folders.

If it finds empty folders it will move them to C:\EMPTYFOLDERS (you can edit the destination in the code.)

Here is the full code:

On Error Resume Next

   rootfolder = Inputbox("Enter directory/foldername: " & _
                         chr(10) & chr(10) & "(i.e. C:\Program Files or " & _
                         "\\Servername\C$\Folder)" & chr(10) & chr(10), _
                         "Getfoldersize", "C:\Folder")

   Set fso = CreateObject("scripting.filesystemobject")

'Run checkfolder

If (FSO.FolderExists(rootfolder)) Then
   CheckFolder (FSO.getfolder(rootfolder))
End If

Sub CheckFolder(objCurrentFolder)

If (FSO.FolderExists(objCurrentFolder)) Then

For Each objFolder In objCurrentFolder.SubFolders

If (FSO.FolderExists(objFolder)) Then

FolderEmpty(objFolder)

End If
Next
End If

End Sub

Function FolderEmpty(path)
WScript.Echo(Path)
    ' Check for an empty folder.
    Dim fso, oFolder, oFiles         ' Object variables
    Dim i, flag

    Set fso = CreateObject("Scripting.FileSystemObject")
    Set oFolder = fso.GetFolder(path)   ' Get folder.
    Set colSubfolders = oFolder.Subfolders
    Set oFiles = oFolder.Files          ' Get Files collection.

    flag = True                         ' No files
    For Each i in oFiles                ' A file has been found if
        flag = false                    ' the loop is processed.
        Exit For
    Next

    For Each objSubfolder in colSubfolders        ' No Subfolder
         flag = false                    ' the loop is processed.
            Exit For
    Next

    FolderEmpty = flag                  ' Return result.

If (FolderEmpty = "True" and Path<>"C:\EMPTYFOLDERS") Then
WScript.Echo(FolderEmpty)

fso.MoveFolder oFolder,"C:\EMPTYFOLDERS\"&oFolder.Name

End If

End Function

Enjoy

UAG RAW book “Chapter 3: UAG Building Blocks”

Tom Decaluwé — Mon, 23 Aug 2010 22:04:20 GMT

I finished reading chapter 3 and managed to get my UAG up and running all be it I hit another unexpected issue as you will be able to read in just a bit.

- What I loved:

Overall if found this chapter great and finally started to give me an insight into how UAG works.

- After reading this chapter Trunk, application and group will make sense and it’s explained and associated in such a way that you start to wonder why you didn’t work out earlier what they where in UAG.

- The detailed breakdown of trunks gave a great insight into what types there are and where to position it into web servicing. I also especially liked the fact that even though ADFS trunks will not be explained in detail in the book a nice link was provided for those of us that might need this information more down the line. I have always found that books like this should reference more official documentation links when parts are not explained in detail. It shows real dedication to getting as much information out as possible.

- It’s all about applications in UAG and this clearly shows in this chapter. A summary of top-level and sublevel applications show just how versatile UAG is out of the box and you get a good view on more than just web app publishing done by client/server publishing,…

- I loved the fact that for the first time a book talks about the new way Win2k8 selects it’s primary ip address. For those of you that haven’t noticed yet and yes we TMG guys have run into this a lot, this is totally different than win2k3. The primary ip in the TCP stack basically doesn’t count for anything more than any other ip does. Don’t know what I’m talking about? click this link

- Good first glance of the Authentication dialog. I expect we will be seeing more of this later down the line but it does help in getting that first UAG app up and running.

- At the end of the chapter the writers explain in detail what kicks in and what’s changed when you press the apply/activate a new configuration and create a trunk. Even though there is probably much more behind the scene it give you the confidence that you have control and you not just in a black box situation.

- What I missed:

- There is a little paragraph about URL signing, and how it works. As I’m reading this if first very shortly read about how this is the enabler for multi server publishing on one ip and port. And then a few lines down it’s all about adding unique strings to published URL’s for enhanced security. I had to read this paragraph twice to figure out what it was all about. I believe URL signing is a key security feature for UAG and a concept you need to understand well. The paragraph is just to short and confusing for me and could do with splitting it up more clearly and adding some extra example / scenario. I don’t know how to explain it better but I’m guessing the experts will.

- Certificates are key for UAG and almost any other TMG, IIS or other web based deployment. However spending 6 pages on certificates to me seems out of scope for a book on UAG and we would use this page realastate to explain core UAG tech in more detail like URL signing and just reference a good MS technet post or other MS press book on this subject. However my finding is based on the fact that I have extensive knowledge of certificates so this might be a great requirement for novice users and is essential for any UAG deployment. What i would have liked is a reference / link or explanation towards these novices on how to use MS PKI to quickly generate a home made Cert for you to use on a lab deployment. People with PKI knowledge hardly need these 6 pages and those that do need these 6 pages will not know how to quickly and at no cost get a Cert to continue the book. It might be worth even putting some kind of self generated contoso certificate on the publishers website and reference that url later in the book for people just playing with the product in a lab.

- My problem:

As always you can’t expect all to go well for me on my first deploy can you. After configuring my first trunk by the book and checking everything I was still presented by a nasty IIS page instead of the hoped for UAG logon page. The page got was:

After doing a quick bing around the world it turned out I needed to restart the IIS and that would fix my issue. Sure enough it did, however there was nothing in the book about this potential hiccup but looking at the bing results I’m surely not the only one that ran into this.

Well that’s all for now, this covers all three published chapters of the RAW book up until now. I’m really looking forward to continuing our journey down UAG lane as soon as the next chapters are published and I have heard we can expect them sooner than later ;-)

Do you know “Remote Desktop Connection Manager”

Tom Decaluwé — Fri, 13 Aug 2010 21:23:24 GMT

Getting swampped by the amount of RDP connections you open every day? Want to keep them manageble and in a clear overview?

Don’t want to buy 3de party tools like visionapp’s,…

MS heeft een freetool om dit voor u te doen: http://www.microsoft.com/downloads/details.aspx?FamilyID=4603c621-6de7-4ccb-9f51-d53dc7e48047&displaylang=en

MSDN & TechNet summer campaign WAVE 3

Tom Decaluwé — Wed, 11 Aug 2010 20:37:00 GMT

Yep, the summer is hot down in Moskou and MS know’s we need something here in Belgium to heat things up for us so the launched wave 3 of the summer campaign yesterday.

Check it out what’s hot:

- MSDN: Windows Phone 7:

NL: http://msdn.microsoft.com/nl-be/ff872142.aspx

FR: http://msdn.microsoft.com/fr-be/ff872142.aspx

- TechNet: Deployment:

NL: http://technet.microsoft.com/nl-be/ff898349.aspx

FR: http://technet.microsoft.com/fr-be/ff898349.aspx

- Architects: Cloud Patterns:

NL: http://msdn.microsoft.com/nl-be/ff877815.aspx

FR: http://msdn.microsoft.com/fr-be/ff877815.aspx

UAG RAW book “Chapter 2: Installing UAG

Tom Decaluwé — Wed, 11 Aug 2010 20:06:58 GMT

I found some spare time this week to work my way through chapter two and get my UAG up and running in the lab. Even though the install most of UAG’s install is a next > next > next > finish type install it’s important to understand what the screens say and know what you are doing so don’t skip it.

Despite the simple and straight forward install I still ran into an issue during install not really covered by the book so read-on, you might end-up needing this info.

- What I loved:

In a chapter like this visual referencing is important as an image often says more than 100 words and they really come through on this. The whole install is neatly screenshot in the book and each setting explained.

- The install checklist and post install verify list are great to know what you need to do before and can check after the install.

- A very clear overview is given of all the different components that will be installed by the setup and indicating an ETA of install for each component.

- Very illustrated overview of the second faze of the install, the getting started wizard and again each setting explained to the level you expect and gives confidence you know what you are clicking.

- What I missed:

- We know what’s being installed like the SQL, Ajax,.. and even how long each component on an average takes but a tee bit more insight into the different components and what UAG uses them fore will help when things go wrong so you know what to check. Just knowing a bit of what the ISATGCTRL does could point you in the right direction of checking this service is running if X or Y is not doing what you expect. I don’t know if it’s possible but an addition to the verify overview indicating what breaks if X is not working would be nice.

- Surprising for me to see was the ever old debate of domain vs workgroup where clearly the WG edition is being promoted as more secure. This does conflict a bit with what I read many years ago in the ISA books and what we have been promoting for so long => domain join is better. Of course this will always be a tricky thing to answer and I guess the real answer is chose what best works for you but I definitely don’t believe domain joining is in any way less secure than WG.

- In the trouble shooting section there are some common know issues mentioned and that great, the only thing I was missing here (apart from the below error I had) was a reference to the install log. TMG during install does some very extensive logging through the windows installer interface and outputs it all to the %windir%\temp (click for more info). Of course I don’t know if UAG has this type of log location but if it does i would expect it in this chapter and as TMG is a core UAG component some mention of these files would have been nice. When thing go wrong you need somewhere to find out why and most of all that is done is logged somewhere we just don’t generally know where.

- My install error:

To my surprise however the install did not go as expected despite following the book to the letter. I ended up with an error during the very first step of the install and the book had given no info on this situation or where to look so. I ended up using the Bing to find the answer.

After inserting the ISO into my Virtual system and hitting the install UAG on the splash screen I got the following nasty message on the screen

After reading on the internet it seems this is a know issue and can have a number of different reasons: NIC mis-config , RDP issues,…

I was installing the server through RDP as this method is mentioned throughout the book and should work fine. I had followed all the checklists to the letter so had no idea why this was happening. In any case I logged of the RDP and went in through the remote console and sure enough the error was gone and install ran exactly as in the book.

After the install however I was faced with a second challenge but luckily this hit my trusted TMG field and I knew exactly what was going on: “When you install TMG using RDP an allow RDP system policy is automatically activated, however if you go through the console this rule is not created. End result was a UAG box I could not reach to configure through RDP :-(

As I was told by the book not to change config straight in the TMG interface I explored the UAG interface to find how I could enable RDP without success. To be quite honest I didn’t really expect to find it but had a quick poke just for the sake of it. In the end I went down to the TMG interface and reconfigured the system policy and sure enough, problem solved. And my system was ready for chapter 3 ;-)

Stay tuned for a quick rap-up of the third and currently final published chapter.

Tom

UAG RAW book “Chapter 1: Planning your deployment”

Tom Decaluwé — Sun, 08 Aug 2010 21:46:44 GMT

After contacting Packet Publishing they provided me with a new download for my RAW copy of the UAG book.

I’ll be reading the book chapter by chapter when I get some time and I’m deploying in a test lab to see how I get along. As this is somewhat my first serious contact with UAG and I’m suing the book as my lead I though I would start the concept of RATW (Review as they write).

I’ll start of today and review each chapter as I read them and as they are published. I will not go into detail about the content as you should buy the book for the content but I do want to give you some insight as to what I thought of each chapter why I liked it or what I think it’s lacking. If you too are reading the book feel free to add your comments on each post . I can then bundle all the feedback and provide it to the writes.

Well let’s get started on Chapter1 “Planning your deployment”

- What I loved:

On a whole I really did like this chapter and found it filled in exactly what I should have done. I answered my questions on

- What UAG is and what it does and clearly explains the difference with TMG.

- Clearly explains how and where you can position your UAG on the network and what you need to think about during the deploy.

- In chapter one you will already get a nice insight into the Core of UAG being the ISAPI filter.

- Finally the words Trunk and Application make sense in UAG :-)

- Good first glance into what really happens when you head out to a UAG site, what client are supported and the fact that in the background an ActiveX/Java is installed.

- Explains the fact that you install UAG your self or by a ready made appliance and tell’s you what you will need as hardware and what you need to think about when doing it yourself.

As to the reading I found this chapter light en enjoyable. It gives good technical and design background and add's a pinch of humor to keep you going.

- What I missed:

- I would have loved if they would have taken a bit of page space to illustrate UAG being part of MS’s Forefront technologies and positioning it within these products something like this. It would be great as it can help you know if you are choosing the right product of you need and open new horizons for follow-up projects.

- The chapter explains why UAG is better than a standard firewall but I would have loved to see more on what makes UAG so unique towards competing devices. It’s nice to know that UAG add’s values compared to a standard L4 firewall but most of us will know this already. However when you all know that when you are in the field you need some key things to get UAG to sell towards competing software just a few fact’s that explain why it’s so unique or what makes it really good.

- ISAPI is very important for UAG and you get some background but it would be nice to get a link to extra reading on what ISAPI is and does as it’s so important for UAG and I think the more back ground you have on that technology the better you will understand how it really works.

- In the explanation of why and if you should domain member you UAG it’s illustrated 5 functionalities require domain membership. KCD is mentioned and as far as I can think I’m guessing this is Key Distribution Center but I was unfamiliar with this term so I’m guessing if I’m not sure a lot of readers might need some help to know what it is and and mentioning the full name might be handy.

Have fun reading the book yourself and let me know what your thoughts are.

Stay tuned for a quick rap-up of the other chapters.

Tom

UAG book on it’s way

Tom Decaluwé — Wed, 04 Aug 2010 13:11:48 GMT

For those of you that have been following the MS forefront products you will know a lot of emphasis has been placed on UAG lately as THE publishing software and publishing internal systems to the internet has been DE-emphasized for TMG.

The only problem i have heard from everybody is there is no book,… on UAG just the standard MS documentation.

Well, fear no more Ben Ben Ari and Ran Dolev are writing a book on UAG, to be published by PACKT Publishing (planned for early 2011). And the great news is you don’t need to wait until then as its a RAW book (Read as we Write).

You can order the book at: https://www.packtpub.com/microsoft-forefront-uag-2010-administrators-handbook/book

I have ordered my copy but the download link was not working at the time I’ll let you all know when they get it fixed and what I think of the book once i have the first few chapters.

But at least now we have something to work and wait for!

MSDN & TechNet summer campaign

Tom Decaluwé — Tue, 03 Aug 2010 13:45:00 GMT

Microsoft Belgium is running a really nice summer campaign at the moment focusing on some key technologies you can spend your precious free moments on.

The topics being covered this summer are: Visual Studio 2010, Silverlight 4, Windows Phone 7, the Windows Azure Platform, Cloud Computing Strategy, SharePoint 2010, Desktop Deployment and Virtualisation. The Visual Studio 2010, Silverlight 4, Cloud Computing Strategy & SharePoint 2010 summer pages are already live, and the others will be coming in August.

Check out the great content at

MSDN:

Dutch: http://msdn.microsoft.com/nl-be/ff718229.aspx

French: http://msdn.microsoft.com/fr-be/ff718229.aspx

TechNet :

Dutch: http://technet.microsoft.com/nl-be/default.aspx

French: http://technet.microsoft.com/fr-be/default.aspx

Deploying PowerShell 2.0 in your environment

Kurt Roggen — Mon, 26 Jul 2010 12:39:00 GMT

PowerShell 2.0 brings some great new management functionality such as:

Remoting: lets you run commands on one or more remote computers from a single computer that is running Windows PowerShell. PowerShell remoting allows for multiple ways of connecting, including interactive (1:1), fan-out (1:many) and fan-in (many:1 by using the IIS hosting model).
New cmdlets: over 100 built-in cmdlets, enabling you to do computer-related tasks, event log and performance counter management task.

PowerShell version 2.0 is bundled into the Windows Management Framework.

The Windows Management Framework makes some updated management functionality of Windows 7 and Windows Server 2008 R2 available to be installed on Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008.

Windows Management Framework contains 3 components:

Windows Remote Management (WinRM) 2.0
Windows PowerShell 2.0
Background Intelligent Transfer Service (BITS) 4.0.

Using WSUS (part of Windows Server 2008 R2 as a server role), you can import the PowerShell 2.0 package and approve it for installation on your Windows Server 2008, Windows Server 2003, Windows Vista and Windows XP machines.

Import updates directly into WSUS

Add selected updates to download basket

Once the updates are imported into the WSUS infrastructure, you can approve the update on the required computer groups containing your targeted machines.

Approve the imported updates

NOTE: Be aware that the Windows Management Framework is about 30-35 MB in size. If bandwidth is an issue or if you are dealing with a serious amount of clients, you may want to throttle the bandwidth used by the Background Intelligent Transfer Service (BITS) which is used as transport mechanism by the Windows Update engine.

More about that another time…

Related reading:

Windows Management Framework (Windows PowerShell 2.0, WinRM 2.0, and BITS 4.0)

WDS Troubleshooting – Part 2

Kurt Roggen — Tue, 20 Jul 2010 12:40:00 GMT

To be able to troubleshoot the Windows Deployment Services, it is crucial to first understand the overall WDS architecture, since you can activate logging at most levels in the architecture. We did that in previous post.

The second step, is drilling down into these components and their logging/debugging facilities.

Looking at WDS Configuration

To get a quick overview of your current WDS configuration, type the following command:

C:\> wdsutil /get-server /show:config

For more information, read my previous blog post.

Looking at WDS Eventlogs

If the multicast transmission still start automatically too soon, I suggest enabling logging for WDS Events:

1. Open Server Manager
2. Select Diagnostics -> Event Viewer -> Applications and Services Logs
3. Navigate to Microsoft\Deployment-Services-Diagnostics
4. Right-click the Admin log and choose Enable log
5. Right-click the Operational log and choose Enable log

Reproduce the issue and check the event logs.

Looking at WDS Logging

WDS Server-side - %windir%\Tracing\wdsserver.log – Set REG_DWORD EnableFileTracing = 1
WDS Mgmt - %windir%\Tracing\wdsmgmt.log
WDS MMC snapin - %windir%\Tracing\wdsmmc.log
Client-side - X:\Windows\Panther, $Windows.~BT\Sources\Panther, %systemdrive%\Windows\Panther

Related reading:

KB 936625 - How to enable logging in Windows Deployment Services (WDS) in Windows Server 2003 and in Windows Server 2008 (R2)
TechNet TechCenter - Troubleshooting WDS Performance Problems

Exchange 2010 Certified + MCT

Peter De Tender — Thu, 15 Jul 2010 21:53:00 GMT

Hi readers,

First of all, my honest and humble apologies for being away from blogging for such a long time. Although there are several reasons for this (work, work, work, projects, projects, projects, family, family, family,...) I was feeling a bit sad myself, looked myself in the eye and said Peter, you gonna start blogging again on all those nice technical stuff you work with on a day-to-day basis.

And as time goes by, why not mention another reason for being absent the last couple of weeks... I invested most of my (little) free-time in studying and preparing for my Exchange 2010 certification. And the investment was awarded with a PASS on both exam 70_662 and 70_663, after which I'm recognized now as a MCITP : Enterprise Messaging Administrator

More information on this certification can be found here:

http://www.microsoft.com/learning/en/us/certification/cert-exchange-server.aspx#tab3

Besides becoming Exchange 2010 certified, I also received credit for becoming Microsoft Certified Trainer - MCT, as I passed both the technical and 'trainer-skills' requirements.

I don't put this information on the internet to talk only about myself how wonderfull this is, blablabla,... but I want to encourage all my blog readers to continue investing time and money in themselves to become as professional on MS technologies as you want yourselves to be, and if I can help you with this one, feel free to drop me a note or leave a comment on this topic. Stay tuned for some up-coming postings on Exchange 2010, Forefront TMG,... as those are the products I'm still focussing on.

Thanks again for following my blog. Cheers, /Peter

WDS Troubleshooting – Part 1

Kurt Roggen — Thu, 15 Jul 2010 12:40:00 GMT

The other day, I got asked about WDS (Windows Deployment Services) troubleshooting…
To be able to troubleshoot the Windows Deployment Services, it is crucial to first understand the overall WDS architecture, since you can activate logging at most levels in the architecture.

Understanding the WDS Architecture

WDS Server Service
The WDSServer service is the main server-side service for Windows Deployment Services. It provides basic service functions such as memory management, thread pooling, and network interface binding in an effort to support its hosted subcomponents, known as providers. The providers provide the true functionality associated with WDSServer. There are five providers included with the default (Deployment Server) installation:

PXE provider
PXE server
Image server
Multicast server
TFTP server

WDS PXE Server
The Pre-Boot Execution Environment (PXE) server is used by Windows Deployment Services to provide network boot programs to client computers. PXE technology is a standard created by Intel that establishes a common and consistent set of pre-boot services within the boot firmware. The end goal is to enable a client to perform a network boot and receive a network boot program (NBP) from a network boot server.

WDS PXE Provider
The Pre-Boot Execution Environment (PXE) provider for Windows Deployment Services provides client boot services over the network. It registers itself with the WDSServer service (the main server-side service of the Windows Deployment Services solution) and requests a remote procedure call (RPC) endpoint.

PXE technology is a standard created by Intel that establishes a common and consistent set of pre-boot services within the boot firmware. The end goal is to enable a client to perform a network boot and receive a network boot program (NBP) from a network boot server.

WDS Image Server
The Windows Deployment Services image server stores and maintains the installation and boot images. The image server is the module used by the Windows Deployment Services client when it is communicating with the server. The server registers a remote procedure call (RPC) endpoint for communication between the client and the server.

WDS Multicast Server
The multicast server deploys an image to a large number of client computers concurrently without overburdening the network. When you create a multicast transmission for an image, the data is sent over the network only once, which can drastically reduce the network bandwidth that is used.

WDS Multicast Content Provider
The multicast server uses a content provider to transmit the data from the server to the client. The Windows Deployment Services content provider can transfer any file over a multicast transmission. This content provider connects the multicast transmission or namespace to the data that has been requested by clients.

WDS TFTP Server
You use the Windows Deployment Services Trivial File Transfer Protocol (TFTP) server to download the files that are needed to do a network boot using the Pre-Boot Execution Environment (PXE). PXE technology is a standard created by Intel that establishes a common and consistent set of pre-boot services within the boot firmware. The end goal is to enable a client to do a network boot and receive a network boot program (NBP) from a network boot server.

The TFTP server downloads boot files such as Pxeboot.com, Wdsnbp.com, Bootmgr.exe, and Default.bcd, as well as the boot image that contains Windows Preinstallation Environment (Windows PE).

Related reading:

Technet - Windows Deployment Services Server Components

MVP AWARD: MVP MANAGEMENT INFRASTRUCTURE 2010

Kurt Roggen — Wed, 14 Jul 2010 21:45:36 GMT

I’m proud to announce and pleased to see that Microsoft has recognized all my contributions made in the past, by awarding me with the MVP title in “Management Infrastructure” for the 3rd year in a row.

In the end, nothing really changes… I will keep doing what I have been doing so far: sharing knowledge and information.

Hope you enjoy it, too!!
Kurt

Tips & Tricks #3 - PowerShell window from here

Kurt Roggen — Wed, 14 Jul 2010 12:35:00 GMT

I've been using PowerShell for a while now but it still hasn't replaced the command prompt for me yet, even though it is extremely powerful!! I have been using the Command Prompt From Here a lot to make it easier to open up a command prompt at a specific folder location from the Explorer. So now I added some settings to the registry that will do the same but with PowerShell instead.

Here is the registry file for making the entry in Explorer:

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\Directory\shell\PowerShell]
@="Open PowerShell window here"

[HKEY_CLASSES_ROOT\Directory\shell\PowerShell\Command]
@="\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoExit -Command [Environment]::CurrentDirectory=(Set-Location -LiteralPath:'%L' -PassThru).ProviderPath\""

Related reading:

SCVMM & P2V using BlockList.xml – Undocumented

Kurt Roggen — Tue, 06 Jul 2010 12:37:00 GMT

When doing a P2V (Physical To Virtual) by moving a workload from the physical world into the virtual world, you actually don’t want those specific IHV’s network, storage and other drivers/services starting up at next boot time, because it will cause a long delay to fail all these drivers/services. They no longer make sense in your virtual environment, where synthetic or legacy drivers take over…

There are tools out there, that assist you in removing these drivers and services (once you are on the other side) such as the HP Proliant Support Pack Cleaner tool.

But know that when doing a P2V with SCVMM, there is this undocumented manifest (BlockList.xml) that disables Services and/or Drivers during the P2V process.

On the SCVMM server, in the following location C:\Program Files\Microsoft System Center Virtual Machine Manager 2008 R2\VMMData, you can find BlockList.xml.
In this file, you can list all services and drivers to disable in a virtual machine during the P2V process.
The syntax of this file is simple and uses the short name for services and drivers.

However editing this file is not supported by Microsoft…

<?xml version="1.0" encoding="utf-8" ?>
<BlockList>
   <!-- services to disable –>
   <Service>
      <Name> </Name>
   </Service>
   <!-- drivers to disable –>
   <Driver>
      <Name> </Name>
   </Driver>
   <!-- programs to disable –>
   <Program>
      <Name> </Name>
   </Program>
</BlockList>

When dealing with HP hardware, you may want to exclude following drivers, services and programs:

For use with HP hardware/software

Driver(s)	Service(s)	Program(s)
CpqArray CpqArry2 CpqAsm2 CpqCiDrv CpqCISSE HpCISSs2 CpqCISSM CpqTeamMP SysMgmt q57w2k N1000	CpqNicMgmt CpqRcmc CpqVCagent CqMgHost CqMgServ CqMgStor CpqWebMgmt SysDown SysMgmtHP	CPQTeam

For use with Dell hardware/software

Still in progress…

For use with IBM hardware/software

Still in progress…

As you seen I’m still in the process of completing the lists for both Dell and IBM hardware, so fee free to sent me your feedback on drivers and services to disable.

Anyhow, it would definitely avoid messing around with the CLI using sc.exe

sc [\\server] query type= driver
sc [\\server] query type= service

sc [\\server] config start= disabled

Related reading:

Looking at your WDS (Windows Deployment Services) configuration parameters

Kurt Roggen — Fri, 02 Jul 2010 06:30:00 GMT

To get a quick overview of your current WDS configuration, use the WDS CLI and type the following command:

C:\> wdsutil /get-server /show:config [/server:yourRemoteServer]

To get a more detailed overview of your current WDS configuration, type the following command:

C:\> wdsutil /get-server /show:all /detailed

Here’s a quick output of such a configuration listing:

C:/> WDSUTIL /get-Server /server:SEA-WDS /show:Config

SETUP INFORMATION FOR SERVER BXL-WDS
[-----------------------------------------------------------------------------]

Server State:
OS version: 6.0
WDS operational mode: Native

Installation State:
     REMINST location: W:\Images
     REMINST share up-to-date: Yes
     Boot files installed:
         x86 - Yes
         x64 - No
         ia64 - No

[-----------------------------------------------------------------------------]

CONFIGURATION INFORMATION FOR SERVER BXL-WDS
[-----------------------------------------------------------------------------]

Server Authorization:
Authorization state: Not Authorized

Answer Policy:
     Answer clients: Yes
     Answer only known clients: No
     Response delay: 0 seconds

Directory Services Use Policy:
     Preferred DC:
     Preferred GC:
     Prestage devices using MAC: No
     New machine naming policy: %61Username%#
     Domain search order: Global Catalog Only
     New machines join domain: Yes

New Machine OU:
OU type: Server Domain
OU: CN=Computers,DC=contoso,DC=com

DHCP Configuration:
DHCP service status: Not Installed
DHCP option 60 configured: <Not Applicable>

Pxe Bind Policy:
     Use DHCP ports: Yes
     Rogue detection: Disabled
     RPC port: 5040

Interface Bind Policy:
Policy: Exclude Registered
Registered interfaces:

Boot Program Policy:
     Allow N12 for new clients: No
     Architecture discovery: Enabled
     Reset boot program: No
     Default boot programs:
         x86 - boot\x86\pxeboot.com
         x64 - boot\x64\pxeboot.com
         ia64 - boot\ia64\bootmgfw.efi
     Default N12 boot programs:
         x86 - boot\x86\pxeboot.n12
         x64 - boot\x64\pxeboot.n12
         ia64 - boot\ia64\bootmgfw.efi

Banned GUIDs List:

Boot Image Policy:
     Default image type for x64 clients: Both
     Default boot images:
         x86 -
         x64 -
         ia64 -

WDS Client Policy:
     Logging policy:
         Enabled: No
         Logging level: Info

     Unattend policy:
         Enabled: No
         Command-line precedence: No
         WDS unattend files:
             x86 -
             x64 -
             ia64 -

OSChooser Policy:
Menu name:

Server Auto-Refresh Policy:
Refresh period: 900 seconds

BCD Refresh Policy:
Enabled: No
Refresh period: 60 minutes

Auto-Add Policy:
     Policy: Disabled
     Poll interval: 10 seconds
     Max retry count: 2160 times
     Message:
     Retention period:
         Approved devices: 30 days
         Other devices: 1 days
     Defaults for x86:
         Referral server:
         Boot program path:
         WDS client unattend file path:
         Boot image path:
         User: Domain Admins
         Join rights: Full
         Join domain: Yes
     Defaults for x64:
         Referral server:
         Boot program path:
         WDS client unattend file path:
         Boot image path:
         User: Domain Admins
         Join rights: Full
         Join domain: Yes
     Defaults for ia64:
         Referral server:
         Boot program path:
         WDS client unattend file path:
         Boot image path:
         User: Domain Admins
         Join rights: Full
         Join domain: Yes

WDS PXE Providers:
     Name: BINLSVC
     Path: C:\Windows\system32\binlsvc.dll
     Order: 1
     Critical: Yes

WDS Transport Server Policy:
     IPv4 Source: Range
         Start IP: 239.0.0.1
         End IP: 239.0.0.254
     Start Port: 64001
     End Port: 65000
     Network Profile: 100Mbps

[-----------------------------------------------------------------------------]

The command completed successfully.

F11 “Server Selection” Feature in WDS (Windows Deployment Services) - Undocumented

Kurt Roggen — Thu, 01 Jul 2010 06:55:00 GMT

There is a little known Server Selection feature in Windows Deployment Services in Windows Server 2008 R2.
Its not documented and it's not supported by Microsoft, but it can be very useful for lab and test scenarios...

How to enable it? Simply go to HKLM\SYSTEM\CurrentControlSet\Services\WDSServer\Providers\WDSPXE\Providers\BINLSVC and set AllowServerSelection to 1.

After restarting the Windows Deployment Service, you get the server selection option by pressing F11 and the PXE client will now discover all PXE Servers which have this registry key set and allow you to select which one you want to use.

Initial PXE Boot Screen

PXE/WDS discovery process

“ProxyDHCP: No reply to request on port 4011” in WDS (Windows Deployment Services)

Kurt Roggen — Mon, 28 Jun 2010 07:15:00 GMT

I came across a WDS problem which seemed familiar at first, but in the end turned out to be something “unexpected”:
“ProxyDHCP: No reply to request on port 4011”

Typically, you would end up looking at articles like KB259670 (PXE clients computers do not start when you configure the Dynamic Host Configuration Protocol server to use options 60, 66, 67)… but this was different some clients/servers worked and some didn’t…

Symptom

When initiating a PXE Boot to the WDS server, the client receives a IP address from the DHCP server, but eventually times out with error “ProxyDHCP: No reply to request on port 4011”
However, other clients/servers have no problem PXE booting to the WDS server and getting boot/installation images.

Cause

There is a database named “Auto-Add Devices database”, used when you are performing the “Pending Devices” actions. It stores the records for machines with a “pending devices” status and/or devices with an “approved” status.

Solution

The computer GUID is marked as rejected in the Auto-Add database. After a computer has been marked as rejected, the computer will not be able to PXE boot.
You can clear the entry in the Auto-Add database by deleting all pending computer records (by running wdsutil /Delete-AutoAddDevices /DeviceType:RejectedDevices) or enabling the record to be purged automatically (as mentioned above).

C:\> wdsutil /Delete-AutoAddDevices /DeviceType:ApprovedDevices
C:\> wdsutil /Delete-AutoAddDevices /DeviceType:RejectedDevices

To delete computers that are pending, rejected or approved from the Auto-Add database, use wdsutil /Delete-AutoAddDevices using the syntex below:

WDSUTIL /Delete-AutoAddDevices [/Server:<Server name>] /DeviceType:{PendingDevices | RejectedDevices |ApprovedDevices}

More Information

The records in the Auto-Add Devices database are purged every 24 hours and the cleanup of any devices with an approved status occurs every 30 days.
You can look at these intervals using the WDS CLI under “Configuration Information - Auto-Add Policy”

C:\> wdsutil /get-server /show:config [/server:yourRemoteServer]

These values can be changed using the WDS CLI

C:\> wdsutil /set-server /AutoAddPolicy /RetentionPeriod /Approved:<Time in days> /Others:<Time in days>

The Auto-Add Devices database (named Binlsvcdb.mdb) can be found in the RemoteInstall\MGMT folder. The database is created by BINLSVC the first time the pending devices policy is enabled.

TMG SP1 released

Tom Decaluwé — Sun, 27 Jun 2010 12:48:05 GMT

Hi everyone, for those of you that are not following TMG’s evolution to the minute, SP1 was released last week Wednesday! One great new feature is custom blocking pages that we will be looking at in detail during one of my upcoming Live meetings together with all the rest SP1 has brought us.

For those of you that can’t wait that long, check out these two posts for a quick overview.

http://blogs.technet.com/b/forefront/archive/2010/06/23/available-now-forefront-threat-management-gateway-2010-service-pack-1.aspx

http://blogs.technet.com/b/isablog/archive/2010/06/24/forefront-tmg-service-pack-1-now-available.aspx

Tom

“Message from Administrator” in WDS (Windows Deployment Services)

Kurt Roggen — Wed, 23 Jun 2010 07:02:00 GMT

Using Windows Deployment Services, we talked about approving pending computers. You might also have noticed on the “pending” screen an empty message from the administrator.

How can you set a message from the administrator?

On the WDS server from a command prompt type:

WDSUtil /set-server /AutoAddPolicy /Message:"To contact your network administrator, please dial 123-4567“

Best Practice Analyzer for Hyper-V – What does it check?

Kurt Roggen — Mon, 21 Jun 2010 07:39:00 GMT

Not so long ago, I wrote about the new Best Practice Analyzer for Hyper-V being available. But what does it check?

It checks 3 areas:

Prerequisites: identify gaps in Hyper-V configuration that should be addressed before administrators run a Best Practices Analyzer scan on Hyper-V for the first time.
Configuration: identify settings that might require modification for Hyper-V to perform optimally. Configuration rules can help prevent setting conflicts that can result in error messages or prevent Hyper-V from carrying out its prescribed duties in an enterprise.
Operations : identify best-practice–related, possible causes of a server role’s failure to carry out its prescribed tasks in an enterprise. An example of a violation of operation rules is the use of snapshots on a virtual machine that runs a server workload in a production environment.

For more information: Microsoft TechNet: Best Practices Analyzer for Hyper-V

Related reading:

Approve pending computer in WDS (Windows Deployment Services): Access Denied

Kurt Roggen — Mon, 21 Jun 2010 07:14:00 GMT

Using Windows Deployment Services, you can boot a new (read: unknown) client and "name and approve" it from the WDS console. A (named) computer object with the right GUID gets created in Active Directory and the machine starts building.

Symptom

When you select “Name and Approve” on a pending device, you might get an “Access Denied”.

Cause

The actual account of an approved pending computer is created by using the server’s authentication token, not using the token of the administrator who is performing the approval.

Solution

Therefore, in ADDS, you must grant rights to the Windows Deployment Services server’s account (WDSSERVER$) to create computer account objects for the containers and OUs where the approved pending computers will be created.

To grant permissions to approve a pending computer

Open Active Directory Users and Computers.
Right-click the OU where you are creating prestaged computer accounts, and then select Delegate Control.
On the first screen of the wizard, click Next.
Change the object type to include computers.
Add the computer object of the Windows Deployment Services server, and then click Next.
Select Create a Custom task to delegate.
Select Only the following objects in the folder. Then select the Computer Objects check box, select Create selected objects in this folder, and click Next.
In the Permissions box, select the Write all Properties check box, and click Finish.

More information

There is also another database named “Auto-Add Devices database”, used when you are performing the “Pending Devices” actions. It stores the records for machines with a “pending devices” status and/or devices with an “approved” status. The records in the Auto-Add Devices database are purged every 24 hours and the cleanup of any devices with an approved status occurs every 30 days.

The Auto-Add Devices database (named Binlsvcdb.mdb) can be found in the RemoteInstall\MGMT folder. The database is created by BINLSVC the first time the pending devices policy is enabled.
Read and write permissions to the C:\RemoteInstall\MGMT folder (containing the Binlsvcdb.mdb) are also required.

Related reading:

Technet: WDS – Required permissions

Virtual Machine Manager (VMM) Q&A – Part 2

Kurt Roggen — Fri, 18 Jun 2010 10:24:35 GMT

Q: What is the option “Enable spoofing of MAC addresses” on a virtual network adapter?
A: A virtual network adapter can send/receive packets containing any MAC address. Equivalent of putting adapter in promiscuous mode.
More information: http://blogs.technet.com/jhoward/archive/2009/05/21/new-in-hyper-v-windows-server-2008-r2-part-2-mac-spoofing.aspx

Q: What is the “Processor Compatibility” feature?
A: Allows more hardware flexibility/mobility between Hyper-V hosts when moving VMs by reducing the CPU instruction set to a common level set. Works only within same CPU family (Intel-to-Intel, AMD-to-AMD). Is a key feature for flexible Live Migration.
More information: http://blogs.msdn.com/b/virtual_pc_guy/archive/2009/06/09/processor-compatibility-in-hyper-v-r2.aspx

Q: What is the “Network Optimizations” feature?
A: With VMM 2008 R2, you can take advantage of network optimization capabilities that are available on hosts that are running Windows Server 2008 R2 Hyper-V. VMM 2008 R2 supports both the Virtual Machine Queue (VMQ) and TCP Chimney features, which improve network performance for virtual machines. Network Optimizations is configurable at the VM level and is visible for capable virtualisation hosts during the virtual machine Intelligent Placement wizard.
More information: http://technet.microsoft.com/en-us/library/ee236499.aspx

Q: What is VMQ (Virtual Machine Queue)?
A: Network adapters that support the VMQ (Virtual Machine Queue) feature can create a unique network queue for each virtual network adapter and then connect that queue directly to the virtual machine’s memory. This connection routes packets directly from the hypervisor to the virtual machine, bypassing much of the processing in the virtualization stack.

Q: Can I use SCVMM to insert my Hyper-V host into a the Hyper-V cluster?
A: No, you still need to complete most cluster related tasks using the Failover Cluster Manager console.

Q: What is Storage Quick Migration (SQM)?
A: Allows the migration of the storage of VM from one location to another with under 1 minute downtime in most cases. The virtual machine can remain running for the almost the entire duration of the transfer of its (read-only) virtual disks from once storage location to another. The virtual machine is put into saved-state for a short period to migrate its memory state and associated differencing disks.
More information: http://blogs.technet.com/b/virtualization/archive/2009/06/25/system-center-virtual-machine-manager-2008-r2-quick-storage-migration.aspx

Q: What are CSV (Clustered Shared Volumes)?
A: Allows for storing multiple Hyper-V VMs, their configuration, snapshots, etc… per LUN by providing coordinated distributed access to a cluster shared volume through a single consistent namespace (C:\ClusterStorage) which is shared among all nodes in the cluster. CSV avoids the “LUN management nightmare”.
More information: http://blogs.msdn.com/b/clustering/archive/2009/03/02/9453288.aspx

Q: Does SCVMM 2008 R2 support CSV?
A: Yes, SCVMM even recognizes the difference between an owner (coordinator) node and non-owner node when deploying VMs to the Hyper-V cluster nodes. When deploying a VM, the VHD is deployed to the Hyper-V CSV owner (coordinator) node first, while the VM is created on the host selected during the VM creation wizard (Intelligent Placement) within SCVMM.

Q: I’m using diskshadow.exe to backup my virtual machines using the Hyper-V VSS Writer. Can I also use it with CSV disks?
A: No, unfortunately DiskShadow is not compatible with CSV in Win2008 R2. You can only do CSV backups from coordinator node safely which is the only node that has access to the (Hyper-V) VSS writer. Windows Server Backup does also not support backing up virtual machines on Cluster Shared Volumes (CSV volumes).