Ken Schaefer : Vista / Windows Server 2008

Windows 7 / Windows Server 2008 R2 released

Ken — Thu, 23 Jul 2009 06:14:00 GMT

Windows 7 and Windows Server 2008 R2 have RTMed. Some new features include (of course) IIS 7.5, new Active Directory functionality (recycle bin), the Live Migration for Hyper-V virtual machines, and direct access/branch cache (for clients)

Dell Latitude E6400, STOP 0x101 and Windows Server 2008 R2 Hyper-V

Ken — Mon, 06 Apr 2009 11:55:00 GMT

My work recently gave me a new Latitude E6400 (the E6500 was just a bit too heavy) which is a great machine for running virtual machines out of the office. It has an internal 7200 RPM drive, a modular drive (120GB 1.8" 5400 RPM) and I can connect an external 2.5" 7200 RPM drive via the eSata port. It also supports up to 8GB of RAM, and has a C2D 2.8GHz CPU. Considering where we were only 4-5 years ago with laptops, it's an amazing advance.

I installed Windows Server 2008 R2 Build 7000 (Beta 1) and the Hyper-V v2 role and almost immediately started getting STOP 0x00000101 BSODs (CLOCK_WATCHDOG_TIMEOUT). Ben Armstrong reports this is a known issue in Beta 1. Mike Kolitz suggested, based on dump files, that this might have been fixed in build 7006. Luckily my work's TAP program has access to various interim builds. I pulled down Build 7068, and no more BSODs. Unfortunately the Intel WLAN drivers seem to crash my WAP. One step forward...one step back :-)

Home Data Centre Upgrade #3

Ken — Thu, 26 Mar 2009 09:32:00 GMT

After adding extra disks to the home "data centre" and then getting a new backup device (Dell RD1000), today I took a punt on upgrading the RAM. When I originally bought my Dell PE SC1430 it was rated at a maximum of 8GB RAM. The latest models offer a maximum of 16GB of RAM, and after finding nothing on the interwebs that might indicate that my particular model couldn't cope with more than 8GB, I tentatively splashed out on an extra 2x4GB FBDIMMS. It seems all PE SC1430s (with the latest BIOS) support more than 8GB of RAM (well, at least 12GB, and I suppose 16GB if you populate 4x4GB).

Currently my production VMs consume around 7GB of RAM (Exchange and Ops Manager 2007 around 2GB each, plus Windows Home Server takes another 1GB), so testing new OSes (like Windows Server 2008 R2) is difficult. With the extra unallocated RAM, it'll be easier to test beta server OSes :-)

Converting from VMWare Server to Hyper-V RC0

Ken — Mon, 24 Mar 2008 06:06:00 GMT

This Easter weekend, having a bit of downtime, I decided to convert my virtual infrastructure at home from VMWare Server to Hyper-V. The major blocking issue was a lack of RAID controller drivers from 3Ware for their 9650SE-series cards, but thanks to Justin Ho it seemed like I was good to go. The timely release of Hyper-V RC0 meant that I could use an updated version of Hyper-V, and also install my Windows Server 2008 machine using my local en-au settings rather than en-us.

The servers that I had running where:

Server1 - Windows Home Server
Server2 - Exchange 2007 (Windows Server 2003 x64)
Server3 - Operations Manager 2007 + WSUS (Windows Server 2003 x86)
Server4 - ISA Server 2006 (Windows Server 2003)
Server5 - Domain Controller 1 (Windows Server 2003)
Server6 - Domain Controller 2 (Windows Server 2003 x64)

To speed up the conversion time, I removed DC2 from the domain (and recreated it as a brand new VM at the end of the process. It is now my first Windows Server 2008 DC). I also removed the Operations Manager 2007 machine (and recreated this on Windows Server 2008)

The steps I used to convert these VMs:

Made a backup of all my virtual machines before I started!
DCPromo DC2, and remove it from the domain
Uninstall Operations Manager clients from all managed servers, then remove Server3 from the domain
Uninstall the VMWare Tools from each remaining virtual machine
Shutdown all remaining machines and make a backup of the VMDK files (again)
Convert the VDMK files to VHD files. You can use System Center Virtual Machine Manager (SCVMM) to do this. Alternatively I used the free VDMKtoVHD tool from VMToolKit. Note that if your VMDK files are pre-allocated fixed sized disks, they will become dynamically expanding VHD disks after the conversion (empty space isn't converted)
Configure my 3Ware 9650SE RAID controller BIOS per Justin Ho's instructions (see earlier)
Format my arrays, and install a brand new copy of Windows Server 2008 x64
Install the Hyper-V RC0 update
Install the Hyper-V role, as well as desired features (Backup and PowerShell)
Create the necessary virtual networks in Hyper-V
Create new virtual machines using the newly converted VHD files and boot the machines

Some issues that I discovered:

My VMWare machines were using SCSI disks connected to a SCSI controller. Unfortunately booting Hyper-V machines requires IDE disks at the moment. Since the IDE mass storage controller wasn’t set to start in my VMs, they Blue Screened with STOP 0x7B (Inaccessible_Boot_Device). I fixed this issue by inserting the OS setup CD and doing a repair on the OS.
EDIT: Steen has a great tip below for how to get around this issue. It requires you to add a dummy IDE disk to your VMWare VM prior to do the conversion (to get the IDE mass storage controller into a started state)
There appears to be an issue with guest OSes talking to a virtualised ISA Server when all the machines are using the new VMBus NICs and the NICs are connected to a Private or Internal Hyper-V network (the issue doesn't appear to manifest if the NICs are bridged to a physical NIC). Networking doesn't work to well, and when running ISA's monitoring tools, packets are missing. To fix this issue, I changed the NICs on my ISA Server that were connected to Private or Internal networks to using the Legacy (Intel 21140) NIC. Since ISA Server 2006 only runs on Windows Server x86, there are supplied Intel 21140 drivers on the Hyper-V Integration Services disc.

So this was the picture beforehand:

and this is the picture aftewards:

Performance appears to be much snappier under Hyper-V compared to VMWare Server, especially with respect to Disk I/O. Additionally, I can now backup my virtual machines when running (well, I hope I can) using my new RD1000 device.

Media bit rate throttling module released for IIS 7.0

Ken — Sat, 15 Mar 2008 03:56:00 GMT

Here's a useful little module I didn't know even existed, but it appears to have been added to the Microsoft download site in the past couple of days. It allows for bit rate throttling of common, supported, media files when served by IIS 7.0. IIS first sends the first twenty or so seconds of data at the fastest possible rate, and then streams the rest slowly.

Full information on configuring this module is available on the http://learn.iis.net/ website. You can download the module from the Microsoft download site for x86 and x64.

WebDAV module released for IIS 7.0

Ken — Thu, 13 Mar 2008 08:02:00 GMT

Today Microsoft released to the Microsoft download site WebDAV modules for Windows Server 2008 / IIS 7.0 in both x86 and x64 versions. These are also available from the www.iis.net website.

Robert McMurray has written a page explaining how to configure the new WebDAV module.

Professional IIS 7.0 released

Ken — Fri, 07 Mar 2008 05:37:00 GMT

Well, the book is finally a reality. I received my copies today - yay!

You can buy a copy from Amazon.com or your favourite bookstore now.

New in IIS 7 - Kernel Mode Authentication

Ken — Wed, 13 Feb 2008 00:34:00 GMT

Windows Server 2003 SP1 introduces kernel mode SSL. Windows Server 2008 takes this one step further and introduces kernel mode authentication. This can be utilised by IIS 7.0 applications to improve performance. It also has implications for Kerberos authentication and management of SPNs.

Consider the following scenario:

Ensuring Kerberos AuthN for App1 wouldn’t be possible in IIS 6/5 (earlier versions were pre-Windows 2000 so didn’t support Kerberos). This was because SPNs are based on a FQDN and the SPN for http/website1.domain.com could only be registered under a single account (and not under the two different accounts that App Pool 1 and App Pool 2 are using).

In Windows Server 2008 there is support for a new kernel mode authentication. I am supposing that this is implemented in ksecdd.sys, but it may be implemented elsewhere. When using kernel mode authentication, the service ticket is decrypted by the server (aka machine account), not by the user account that the web app pool is running under.

Because of this, it’s possible to:

Register every SPN for each application hosted webserver under the machine account in Active Directory, regardless of the identity of the web app pool that the application is being hosted in
Run multiple web applications hosted at the same FQDN under web app pools that are, in turn, running under multiple Windows identities.

Edit: Anil from the IIS Product Group pointed out an error in my advice below (it's not necessary to actually disable Kernel Mode Authentication). I have updated the section below:

There is a caveat. This is because the service ticket decryption takes place using the server’s AD machine account. If you are using a web farm, then the KDC doesn’t know in advance which individual server will be servicing the request. In that case, it's impossible to deterministically register the SPN under a single machine account. Instead, you will need to:

~~Disable kernel mode authentication~~ Configure IIS to use the web application pool's identity for Kerberos service ticket decryption
Run the web app pool under a common domain user account
Be restricted to running all web application accessible at that FQDN under web app pools that are using the same domain user account above

If you are in this situation, then you can ~~disable kernel mode authentication~~ enable the use of the web app pool's identity for Kerberos service ticket decryption by setting the property useAppPoolCredentials to true for the web application or web site in question. An example would be:

<system.webServer>
   <security>
      <authentication>
         <windowsAuthentication enabled="true" useAppPoolCredentials="true" />
      </authentication>
   </security>
</system.webServer>

If you're not sure how SPNs and Keberos work, then check out the earlier posts

New in IIS 7 - App Pool Isolation

Ken — Wed, 30 Jan 2008 11:47:00 GMT

In previous versions of IIS, it has sometimes been difficult to isolate web application pools from each other. If multiple web application pools are configured to run as the same identity (e.g. Network Service) then code running inside one web application pool would be able to use File System objects to access configuration files, web pages and similar resources belonging to another web application pool. This was because it was impossible to allow one process running as Network Services access to a file, but prevent another process also running as Network Service access to the same file.

In IIS 7.0 it is possible, with some work, to prevent this from occurring. As part of IIS 7.0 inbuilt functionality, each web application pool has an application pool configuration file generated on-the-fly when that application pool is started. These are stored, by default, in the %systemdrive%\inetpub\temp\appPools folder. Each web application pool has an additional SID (Security Identifier) generated for it, and this in injected into the relevant w3wp.exe process. The application pool's configuration file is ACLed to allow only that SID access. Since each w3wp.exe process has it's own SID, each application pool's configuration file is ACLed to a different SID:

Using the icacls.exe tool it is possible to determine the SID applied to any given application pool's configuration file. This can be done by using the command:

icacls.exe %systemdrive%\inetpub\temp\appPools\appPool.config /save output.txt

The actual SID always starts with the well-known identity prefix: S-1-5-8-82 followed by a hash of the Application Pool's name.

The retrieved SID can now be used to secure web site content in the same way. To do this:
Edit: Thomas Deml (from the IIS Product Group) has shown me an easier way to perform Step 4 below

Configure each website (or web application) to run in its own web application pool
Configure anonymous authentication to use the application pool identity rather than the IUSR account (this can be done by editing the Anonymous Authentication properties for the website in question)
Remove NTFS permissions for the IUSRS group and the IUSR account from the website's files and folders.
Use the icacls.exe tool to permit the App Pool's individual SID Read (and optionally Execute and Write) access to the web site's files and folders. You don't need to initially retrieve the SID using iCacls. Instead simply use: IIS APPPOOL\ApplicationPoolName as the user to grant read permissions to (see screenshot below for an example for the Default App Pool)

After configuring these NTFS permissions, only the SID that has been injected into a particular w3wp.exe process will be able to read the contents of the website in question. All code running in other w3wp.exe processes, even though the process identity may also be Network Service, will be unable to read this particular website's content. This technique may be most useful to web hosters or similar administrators, that need to accept content from various external or untrusted parties.

Edit #2: Here's a screenshot of the dynamic SID injection in action for the Default App Pool (using the excellent Process Explorer tool). The username highlighted can be used with icacls.exe to ACL your web content.

OT: You can get certification for Home Server, Media Center and other sundry topics - awesome!

Ken — Sat, 26 Jan 2008 05:34:00 GMT

Well, I'm writing a blog post on IIS application sandboxing, and this item crosses my inbox. It appears that all the time spent mucking about with Windows Home Server, and Windows Media Centre might now actually result in MCTS certification. So, I can justify the endless hours spent mucking with drivers and backups as a work-related endeavour! Yay

Windows Hyper-V and Wireless adapters - using RRAS (Routing and Remote Access Service)

Ken — Fri, 18 Jan 2008 09:33:00 GMT

I see that Ben Armstrong has posted instructions on how to use Windows Internet Connection Sharing (ICS) to give your Hyper-V virtual machines access to networks via a wireless adapter.

However ICS does not appear to work if the network that your wireless adapter is connected to uses the 192.168.0/24 subnet (as this is used on the internal side of ICS).

If you are in this situation, then instead of using ICS, the inbuilt Routing and Remote Access (RRAS) service can be used instead. The benefit of RRAS is that any arbitrary subnet(s) can be used on the internal interface (and you can have as many as you want).

To install RRAS use the Server Manager to install the Network Policy And Access Role. RRAS now exists as a sub-feature of this role. You can add this role using Server Manager.

Then open the RRAS MMC Administrative console, and use the wizard that runs at first use to choose NAT routing, and then configure your external (WLAN) interface and internal interface (an internal network created by Hyper-V Management MMC).

Edit: You should give the internal adapter an IP address before running the wizard - so that the NAT routing wizard knows what IP addresses your internal LAN is going to be using, and can configure routing appropriately.

It is possible to have the RRAS service provide DHCP addresses to your Hyper-V machines. However since most of these are probably servers (and thus have static addresses), you can configure a static address pool in RRAS.

If you wish to have your Hyper-V machines able to contact your host PC on the internal interface, configure exceptions (or disable) in th Windows Firewall on the individual adapter configured by Hyper-V (this can be done on the Advanced tab in the Windows Firewall control panel on the host).

Edit: If you haven't using RRAS before, then John Paul Cook has an excellent step-by-step guide on configuring this entire configuration (with screenshots) on his blog.

Moving a Windows Server 2008 Hyper-V virtual machine

Ken — Tue, 15 Jan 2008 10:32:00 GMT

Windows Server 2008 Hyper-V stores a list of virtual machines in %systemroot%\ProgramData\Microsoft\Windows\virtualisation\Virtual Machines. In that folder are a set of symbolic links, that are linked to the actual config files for each virtual machine.

To move a virtual machine:

Shut down or suspend the virtual machine
Delete the symbolic link in the folder mentioned above. The VM will disappear from the Windows Virtualisation Management MMC console (if you have it open). To delete a symbolic link, you can use the del command in a command window
Move the virtual machines files (VHD virtual hard disk file, configuration files and so on) to the new location
Open the virtual machine's configuration file (e.g. using Notepad.exe) and update any references to physical paths. Typically you'll need to update the location of the virtual hard disk and saved state location. The configuration file is a GUID with an XML extension, such as 0A8D4907-82C6-11DC-8061-02004C4F4F50.xml
Create a new symbolic link to the virtual machine's XML configuration file. This can be done using the mklink.exe file (mklink.exe /? for how to create a link to a file)

To make it easier to create the links, you can output the contents of the virtual machines folder using dir and then piping it to a text file (e.g. dir > VMs.txt). Open the text file in notepad.exe, and for each machine will you have an entry like:

14/01/2008 12:22 PM <SYMLINK> 0A8D4907-82C6-11DC-8061-02004C4F4F50.xml [D:\WSVs\SVR03-ISA06-1\Virtual Machines\0A8D4907-82C6-11DC-8061-02004C4F4F50.xml]

It's a simple matter of editing to turn this into:

mklink 0A8D4907-82C6-11DC-8061-02004C4F4F50.xml e:\newLocation\SVR03-ISA06-1\Virtual Machines\0A8D4907-82C6-11DC-8061-02004C4F4F50.xml

Save this as a batch file (.bat) and just doubleclick to create the new link. The VM should then show up in Windows Virtualisation Management MMC console.

EDIT: this technique was tested with Windows Server 2008 RTM and Hyper-V Beta 1. It may not work with subsequent builds of Hyper-V. I will update this post when Hyper-V goes RTM

Windows Server 2008 Hyper-V backup (Dell RD1000 review)

Ken — Mon, 14 Jan 2008 10:24:00 GMT

Meta: IIS and Kerberos Part 6 is coming (for anyone interested in IIS still reading this blog)

The Windows Server 2008 backup feature no longer supports direct backup to disk (you'll need third party backup software to do that). You can backup to disk though - either to a SAN (or network share). Or to disk based backup media like the Dell RD1000.

Previously I've been backing up my server to an external enclosure via eSATA - which works, but doesn't provide the scalability of tape. The RD1000 gives you catridges similar to tape, but they appear as removable disk media to Windows Server 2008.

The RD1000 - next to two stacked 3.5" hard disks.

The RD1000 (also available from Imation in their RDX series) is available both internally (as 3.5" or 5.25" connected via SATA) or externally (connected via USB 2.0). The actual enclosure isn't much bigger than two 3.5" hard disks.

RD1000 seen from the front

The power supply is pretty small as well:

and catridges are about the same size as LTO / Ultrium tapes:

RD1000 catridge -vs- LTO tape

Internally, the RD1000 catridges appear to contain 2.5" 7200 RPM SATA disks. The SATA connector is visible by peering into the catridge.

The backup performance of the external USB-connected RD1000 is approximately 1GB/minute. The following screenshot shows a test run backing up both the system partition (with Windows Server 2008 running) as well as a second partition hosting Hyper-V virtual machines. At the time of the backup, two Hyper-V machines were running (an Active Directory domain controller, and second machine running SQL Server 2005).

Note: I paid for my RD1000 and backup disks. I didn't receive this from Dell - i.e. no conflict of interest etc.

In Australia the internal RD1000 device costs approximately A$400 (external A$700), and a 300GB cartridge costs approximately A$550 (at time of writing)

IIS 7.0 WebDAV module (beta) released

Ken — Mon, 07 Jan 2008 04:45:00 GMT

Well it seems that the IIS product is just sneaking in the final bits and pieces missing from IIS 7.0 at this very late stage of the Windows Server 2008 release cycle. Spotted on Robert McMurray's blog is a GoLive Beta release of the IIS 7.0 WebDAV module. This will be included inbox with the final Windows Server 2008 release, but wasn't included in RC1.

Features of this WebDAV module include:

Full integration into the IIS 7.0 Manager MMC Console
Per site enabling/disabling of WebDAV functionality (in IIS 6.0, you could only disable/enable WebDAV per server, then needed to ensure your permissions were set correctly on sites where you didn't want authoring to occur)
Per URL security (this was doable in IIS 6.0, but it was pretty slow if you did it through the GUI)

Additionally, other modules (such as the Request Filtering module) can be configured to not apply rules to WebDAV requests, allowing authenticated authoring to occur, but disallowing other non-permitted anonymous requests.

Download locations for the x86 and x64 bits.

IIS 7.0 Health Model published, and MOM 2005 MP for IIS 7.0 (beta) released

Ken — Sun, 06 Jan 2008 10:51:00 GMT

I hope everyone had a great Christmas and New Year.

Spotted on Mike Volodarsky's blog is an announcement that the Health Model for IIS 7.0 has been published on Microsoft TechNet. This describes the various error conditions that IIS 7.0 (and related services, like the Worker Process Activation Service) might encounter.

If you are familiar with Microsoft Operations Manager, then you'll know that these health models form the basis for developing a management pack for that particular service. And right on cue, a beta of the Management Pack for IIS 7.0 (MOM 2005) has been released on Microsoft Connect.