Start-up Sequence for VM’s in a Hyper-V Environment

I’ve had customers phone me several times with regards to powering up their servers after an outage.  If not done properly you can run into a situation whereby you cannot log onto a host to start a VM, because the virtualised DC is still down.  Not good.

So, if me or my clients are recovering from a shutdown I usually do the following:

1. Power on the Hyper-V server hosting the VM that holds the PDC emulator FSMO role.  The VM should preferably also be a GC and DNS server and refer to itself for either primary or secondary DNS
2. Sign on to the Hyper-V host using a Local Administrative Account.
3. Start the VM.
4. Log out of the Hyper-V host once the VM has booted successfully.
5. Log into the Hyper-V host using a “proper” Domain Account.
6. Start any other virtualised DC’s / GC’s you might have.
7. Ensure you have at least one DC / GC running in each AD site.
8. Boot up the rest of your environment

Another option (pointed out to me in the comments section), is to set startup delays on your VM’s so that your DC’s starts up before your other servers.  This seems very basic, but it’s amazing how quickly common sense goes out of the window when the pressure is on to get an environment up and running. 

Another way of dealing with this (my preferred way) is to have the PDC FSMO role on a physical machine.  If you go this route also ensure that your physical machine is a GC.

Publishing Remote Desktop Gateway (RDG) with TMG 2010

I recently had the pleasure of creating an Remote Desktop Services (RDS), Remote Desktop Gateway (RDG) and RemoteApp environment for a client.  This was a bit more technical and involved than I originally envisioned, no thanks to the scant documentation that exists.  I will detail all that in a later blog post, for now I will focus on publishing your RDG, RDS and RA environment through a Microsoft TMG 2010 Firewall.

First we have to create an SSL Listener

1. Specify an IP address for the Listener
2. Enable both HTTP and SSL connections
3. For HTTP to HTTPS redirection select redirect all traffic from HTTP to HTTPS
4. On the Certificates tab select “Use a single certificate for this web listener” and select an appropriate certificate
5. Authentication should be set to “No Authentication”

Now we create the actual publishing rule:

1. Allow
2. From Anywhere
3. To – Your RDSG IP or Host – Forward original host header – request appears to come from TMG
4. Traffic HTTPS
5. Listener – Select the one we created earlier
6. Public name – This is the Public DNS name
7. Paths should be /rdsweb/* and /rpc/*
8. Authentication delegation – “No Delegation, client may authenticate directly”

These were the steps I had to take to successfully and securely publish the client's RDSG to the internet.  Once again I found the existing documentation to be lacking in the extreme.  Hope this helps someone out there.

How to Prepare an Offsite replica with DPM 2010

Sometimes the need will arise to backup your DPM replicas to removable storage for whatever reason.  It might be so that you can recover your DPM server in case of a disaster or you might even want to use the replicas to seed another DPM server in a DPM 2 DPM 4 DR scenario.  Here is an extremely simple and effective way to accomplish that:

1. On your DPM Server open an Admin Command Prompt
2. Navigate to the DPM bin folder (usually C:\
   Program Files\Microsoft DPM\DPM\bin\)
3. Execute dpmbackup -db
4. Execute dpmbackup -replicas
5. I prefer using robocopy to copy the data to USB (or any alternate) Storage like so: robocopy C:\Program Files\Microsoft DPM\DPM\Volumes\ShadowCopy\ %destination% /e /b

What the above does is creates snapshots of the replica volumes and then mounts those read-only snapshots under the \Program Files\Microsoft DPM\DPM\Volumes\ShadowCopy folder.  It is therefore a point in time replica which you can copy wherever you wish, be it disk or tape.  You can, of course, also use your favorite backup software to backup your replicas, just be sure to configure it to traverse mount points.

Installing Windows 7 / 2008 R2 from a USB Stick

Too much of my life is spent staring at install screens - no more I say!  That time is better spent looking at the blinkenlights, drinking coffee or browsing slashdot.  One way of significantly speeding up install time is using a USB device instead of CD/DVD media.  Here is how to create bootable USB Installation media for Windows 7 and Server 2008 R2.

• Launch the DiskPart utility by typing diskpart at the Start Menu.  If your system does not have diskpart you can download it from here
• Run the list disk command to, surprisingly, list the disks in your system
• Now run select disk % where the "%" is actually the number of your USB drive (obtained above).
• Run clean.
• Now run create partition primary.
• Let's set the partition to active by entering active
• Now we format the drive with the FAT32 filesystem via the format fs=fat32 quick command
• Run the assign command to assign a drive letter to our USB device
• Copy the entire contents of the installation DVD to your USB device (a simple drag and drop will do)
• Plug the USB drive into the target system and proceed with the (hopefully faster) installation.

Configuring the relevant BIOS options is left as an exercise to the reader. 

Trend Micro OfficeScan Uninstallation

If you, like me, have ever been faced with having to uninstall Trend OfficeScan, only for it to ask for a long-lost password, you were pretty much out of luck.  Trend does have a KB article with manual un-installation steps, but that is an exercise in frustration.

Fortunately I recently happened across a "hidden" command that will take care of business.  You need to do the following:

1. Open a command prompt and navigate to the folder where your Trend AV client is installed, usually c:\Program Files\Trend Micro\*****
2. Execute the following command: NTRMV.exe -331

This takes care of all the nitty-gritty stuff, stopping the services, removing files and folders and removing all the relevant bits from the registry.

Another great thing about this approach is that it's much easier to script and / or deploy with your favourite management app.

Repurposing an old Cisco PIX to provide secure public WiFi on a corporate LAN

I am in the planning stages of a fun little project, whereby the clients goal is to provide secure wireless access to guests over a ADSL link dedicated to this purpose.  Simple enough, but this traffic will travel over the same edge to core switches that carry business traffic, so we will have to set up some VLAN’s.

This client recently retired their ageing PIX firewall and replaced it with new Cisco ASA’s.  So instead of chucking the PIX we will press it into service as the secure gateway / firewall for the public ADSL Internet breakout.

The PIX in this case has two physical interfaces named ethernet0 and ethernet1.  ethernet0 will be connected to the ADSL and ethernet1 to the LAN.  ethernet1 will be configured in a VLAN, and the switch ports to which the guest AP’s connect will be configured to do the appropriate VLAN tagging.

Here is how to configure the PIX

1. interface ethernet0 auto
2. interface ethernet1 auto
3. interface ethernet1 vlan1 physical
4. interface ethernet1 vlan10 logical
5. nameif ethernet0 outside security0
6. nameif ethernet1 inside security100
7. nameif vlan10 guest_wifi security10

Most client devices nowadays expect DHCP and since they don’t logically touch the corporate network we’ll have to make do with running DHCP off the PIX:

1. dhcpd address 192.168.202.100-192.168.202.200 guest_wifi
2. dhcpd dns 192.168.0.1 (substitute this with your ISP’s DNS Server)
3. dhcpd lease 3600
4. dhcpd ping_timeout 50
5. dhcpd enable guest_wifi
6. ip address wifi 192.168.202.1 255.255.255.0

And that should work rather brilliantly – I will know for sure in about a weeks time when I implement.

Creating a Hyper-V Cluster after the fact, or, how to preserve and add existing VMs to a Cluster.

I was faced with an interesting challenge recently. a Client was running two standalone Hyper-V hosts with about 4 VMs each running on a Storage Area Network(SAN).  I installed the SAN previously to provide increased IO performance for their SCADA (Citect, for those taking notes) system. 

This was essentially a very effective proof of concept as far as the client was concerned and they wished to take advantage of the more advanced features offered by Clustered Hyper-V (stuff like live migration etc.).

This posed a challenge, because we needed to convert the LUNs occupied by the VM’s to highly available Cluster Shared Volumes (CSV’s).  In Hyper-V, a VM needs to be hosted on a CSV in order to be made highly-available.  So off I went trying to figure out a non disruptive way to convert all my LUNs to CSV, without losing any data.  This is what I came up with.

1. Shut down your VM(s)
2. Open Disk Management on your Hyper-V host and remove drive letter from LUN hosting the VM
3. Open Failover Cluster Manager (FCM) –> Storage –> Add Disk –> Select Disk from Step 2 –> Click OK
4. Still in FCM - Go to Cluster Shared Volume - Add Storage – select the disk you added in Step 3
5. Open up Hyper-V Manager on the same host (notice the VM status is critical because you removed the drive letter).  Remove the VM
6. Create a new VM, opt to store it under the %systemdrive%\ClusterStorage folder which was created automatically when you performed Step 4.  VERY IMPORTANT – Do not add any disks to the VM!
7. Right click the VM you created in Step 6 and choose Edit Settings.  Add the original VM’s disks (boot drive to be added to IDE controller 0).  The existing VHD’s will be found in %systemdrive%\ClusterStorage
8. Open FCM – Go to Services and Applications – in the Action pane select Configure a Service or Application –> select Virtual Machine –> Check the VM created in Step 6 –> Complete Wizard
9. Ensure that the VM is connected to the correct network in Hyper-V Manager
10. Because we are connecting a new NIC to the VM you will have to re-specify the IP address inside the VM once the VM has started up

Rinse and repeat for all existing VMs you want to make highly available.  The Microsoft way would be to export the VM’s and import it again.  Nothing wrong with that, apart from the fact that it takes a lot of time and storage to do, depending on the size of the VM.  My way is quick and easy and it works!