This security update resolves a privately reported vulnerability in Windows Server 2008 R2 when used as a shared failover cluster. The vulnerability could allow data tampering on the administrative shares of failover cluster disks. By default, Windows Server 2008 R2 servers are not affected by this vulnerability. This vulnerability only applies to the cluster disks used in a failover cluster.

The security update addresses this vulnerability by changing the way the Microsoft Cluster Service (MSCS) user interface sets permissions on administrative shares when adding or creating new shared cluster disks. For more information about the vulnerability, see the Frequently Asked Questions (FAQ) subsection for the specific vulnerability entry under the next section.

It affects Windows Server 2008 R2.

Related posts:

1. What’s The Maximum Number Of Hyper-V VMs You Can Put In Cluster Shared Volume?
2. KB2673129 – Slow Shutdown Time For A Cluster Node In A Windows 2008R2-based cluster
3. Patching A Windows Server 2012 Failover Cluster, Including Hyper-V

The following topics will be presented by MVPs (including me):

Manageability

• Simplifies configuration processes
• Improved management of multi-server environments
• Role-centric dashboard and integrated console
• Simplifies administration process of multi-server environments with Windows PowerShell 3.0

Virtualization – I’m doing this one   I’m trying to put the final pieces together for a very cool PowerShell demo. Even without this, I have some cool demos ready.

• More secure multi-tenancy
• Flexible infrastructure, when and where you need it
• Scale, performance, and density
• High availability

Storage and Availability

• Reduces planned maintenance downtime
• Addresses the causes of unplanned downtime
• Increases availability for services and applications
• Increases operational efficiency and lower costs

Networking

• Manage private clouds more efficiently
• Link private clouds with public cloud services
• Connect users more easily to IT resources

I think my demos are done.  The slides are nearly there.  Final polish and rehearsals tomorrow and this weekend.  This is a big brain dump that we’ll be dropping on people.  I’d certainly attend if I wanted to get my career ahead of the pack and be ready for the most important Server release since Windows 2000.

Related posts:

1. Mark Your Calendar: Windows 8/Server 2012 RC In The First Week of June
2. Windows Server 2012 Community Events
3. It’s Official: Windows Server 2012

On my client’s site, we had an alert about latency on a HBA in one of the hosts.  I wanted to give the client some useful information to plan VM placement using affinity rules to avoid this from happening again.  One of the cool reports allows you to create a top-bottom chart of VMs based on a specific performance metric.  The below report was created with with the VMGUEST IOPS metric and shows the top 25 disk activity VMs.

As usual with OpsMgr, the report could be scheduled for a time period, and/or saved as a web archive, PDF, word file, etc.  I like this management pack.  Sure, it is pricey (I was told over EUR400/host socket being monitored), but it’s good.  BTW, Veeam did release a 10 socket (enough for 5 hosts with 2 CPUs each) management pack for free, which is available to you under two conditions:

1. Be a new customer to Veeam AND
   2. Be a SCOM 2012 customer (not SCOM 2007)

Related posts:

1. Deployed Veeam nworks Management Pack For vSphere
2. Citrix XenApp Monitoring Management Pack For System Center Operations Manager – Import Fails
3. Veeam ESX Monitoring for SCOM

Do you want the project to succeed?

If the answer is yes, then go get your hands on the free Microsoft Assessment and Planning Toolkit (MAP) 7.0, which just went into beta and will probably RTM when Windows Server 2012 does.

I’ve come to the conclusion that there is a direct correlation between success of a virtualisation project and a pre-design assessment.  Why?  Because every time I’m asked in, and this only happens when things go bad, I ask for the assessment reports and I’m told that there are no reports.  I dig a little further and I find that there were mistakes with design that some due process may have eliminated.

Key features and benefits of MAP 7.0 Beta help you:

• Determine your readiness for Windows Server 2012 Beta and Windows 8
• Virtualize your Linux servers on Hyper-V
• Migrate your VMware-based virtual machines to Hyper-V
• Size your server environment for desktop virtualization
• Simplify migration to SQL Server 2012
• Evaluate your licensing needs for Lync 2010
• Determine active users and devices

It’s free folks, so cop on!  Spend half a day installing it, doing the discovery, and starting the measurement, and 1 week later come back and run some sizings against different infrastructure specs.  Run some reports and you have a scientifically sized infrastructure.  Surely that’s better than the guesswork that you would have done instead?  Oh you must be the exception because you know your customer’s requirements.  If I had a Euro for every time I’ve heard that one …

If you can’t guess, this stuff makes me angry.  But never mind me; you probably know better than me, Microsoft, real VMware experts, etc.  If I had another Euro for every time I’ve heard that one …

Related posts:

1. Download RunAs Radio Podcast – I’m Talking About Windows Server 2012 Hyper-V
2. Patching A Windows Server 2012 Failover Cluster, Including Hyper-V
3. Hyper-V NU January 2012 Slide Decks, Including My One on Windows Server 8 Hyper-V Networking

Failed to store data in the Data Warehouse.Failed to store data in the Data Warehouse. Cannot resolve the collation conflict between "SQL_Latin1_General_CP1_CI_AS" and "Latin1_General_CI_AS" in the equal to operation.

A bit of quick checking and I found that the SQL server instance had the default and incorrect collation of Latin1_General_CI_AS while the OpsMgr databases had the correct collation of SQL_Latin1_General_CP1_CI_AS (check the properties of SQL Server and the databases in SQL Management Studio to verify).

And this pretty much explained why reports from new management packs weren’t appearing in OpsMgr.  The odd thing is that this problem went unnoticed for over 6 months and many management packs functioned perfectly well.

I knew what was ahead of me: a SQL rebuild.  So that’s what I did, with some guidance from a blog post by Marnix Wolf, MVP.  I veered a little from the guidance he gave.  I opted to start with a new SQL Reporting DB because it was easier to do this and I had no customisations to rescue.  So I didn’t restore it, I didn’t run ResetSRS, and I just needed to reinstall OpsMgr Reporting and supply the details.

Interestingly, the OpsMgr Reporting installed froze about half way through.  There were no visible issues, no performance bottlenecks, no clues, nothing to explain the setup hang … except for the Application Log in Event Viewer.  There McAfee reported that it was preventing lots of .Net stuff.  Uh oh!  I temporarily disabled the McAfee protection and the installer wrapped up almost immediately.

Once everything was back I verified that monitoring worked, that the datawarehouse was still OK, and that reports were repopulating and working.  But then a flood of alerts came in:

Microsoft.EnterpriseManagement.Common.UnknownServiceException: The service threw an unknown exception. See inner exception for details. —> System.ServiceModel.FaultException`1[System.ServiceModel.ExceptionDetail]: Execution of user code in the .NET Framework is disabled. Enable "clr enabled" configuration option. (Fault Detail is equal to An ExceptionDetail, likely created by IncludeExceptionDetailInFaults=true, whose value is: …

That looked nasty but the fix was easy enough.  As Alexy Zhuravlev said, run this on the SQL server against the OperationsManager database:

sp_configure @configname=clr_enabled, @configvalue=1
GO
RECONFIGURE
GO

After that, everything was okey dokely and the SQL 2008 R2 DB was updated to get it OpsMgr 2012 ready

Related posts:

1. ConfigMgr 2007 Management Point Won’t Install – Failed to Create the CCM_Incoming Virtual Directory
2. MMS2012 – I’ve Deployed OpsMgr 2012 Application Performance Monitoring (APM); Now What?
3. MMS 2012: Automating Data Protection And Recovery With DPM and System Center 2012

• Deploy collectors
• Discover vCenter servers/hosts
• Monitor
• Run reports

Oh and the reports!  There’s so many of them with lots of information.  It’s a very nice management pack.  And it accomplishes what the client wanted: they have visibility into VMware from System Center.

Does it work?  Yeap; it detected read latency on a HBA, an oversubscribed VMFS volume (based on potential growth of thin VMDKs), and a full VMFS.

Related posts:

1. What Impresses Me Most About the Veeam nworks Management Pack for System Center …
2. Veeam ESX Monitoring for SCOM
3. Citrix XenApp Monitoring Management Pack For System Center Operations Manager – Import Fails

When you have a cluster of virtualisation hosts using shared storage systems, you need some sort of orchestration to say which host should access what folders and files.  That’s particularly important during Live Migration and failover.  Without orchestration you’d have chaos, locks, failed VMs, and corruption.

One virtualisation cluster file system out there does it’s orchestration in the file system itself.  That, in theory, places limits on how that file system can scale out.

Microsoft took a different option.  Instead, each cluster shared volume (CSV) has an orchestrator known as a CSV Coordinator that is automatically created and made fault tolerant.  The CSV coordinator is a highly available function that runs on one of the clustered hosts.  By not relying on the file system, Microsoft believes they have a more scalable and better performing option.

How scalable?  A few years ago, EMC (I believe it was EMC, the owner of VMware, but my memory could be failing me) stood on a stage at a Microsoft conference and proclaimed that they couldn’t find a limit on the scalability of CSV versus performance on their storage platform.  In other words, you could have a monstrous CSV and place lots and lots of 64 TB VHDX files on there (GPT volumes grow up to 16 EB).

OK; back to the question at hand: how many VMs should I place on a CSV.  I have to give you the consultant’s answer: that depends.  The fact is that there is no right answer.  This isn’t VMware where there are prescribed limits and you should create lots of lots of “little” VMFS volumes.

First, I’d say you should read my paper on CSV and backup.  Now keep in mind that the paper was written for Windows Server 2008 R2.  Windows Server 2012 doesn’t do redirected I/O (mode) when backing up VMs from CSV.  In that document I talk about a process I put together for CSV design and VM placement.

Next, have a look at Fast Track, Microsoft’s cloud architecture.  In there they have a CSV design where OS, page file, sequential files, and non-sequential files are split into VHDs on different CSVs.  To me, this complicates things greatly.  I prefer simplicity.  Plus I can’t imagine the complexity of the deployment automation for this design.

An alternative is to look at a rule of thumb that many are using: they have 1 CSV for every host in their cluster (or active site in a multi-site cluster).  Beware here: you don’t want to run out of SCSI-3 reservations (every SAN has an unadvertised limit) because you’ve added too many CSVs on your SAN (read the above paper to learn more).

My advice: keep it simple.  Don’t overthink things.  Remember, Hyper-V is not VMware and VMware is not Hyper-V.  They both might be enterprise virtualisation platforms but e do things differently on both platforms because they both work differently.

Related posts:

1. MS10-086 – Vulnerability in Windows Shared Cluster Disks Could Allow Tampering
2. See Windows Server 8 Hyper-V Shared Nothing Live Migration In Action
3. The New Hyper-V Gotcha – No Permission to Remotely Manage VMs on SMB Shared Folder

I’ve been thinking a lot about DR and how to approach it with Windows Server 2012 Hyper-V.  There is no one right solution.  In fact, we have lots and lots of options thanks to VMs just being files.  Yup, thanks to VHDX scaling out to 64 TB, the last reasonable reason to use passthrough disk (other than to get that last 2 or so percentage points of performance) are dead.  That makes even the biggest of VMs “easy” to replicate.

Let’s look at 2 approaches from a very high altitude level.  An approach I’m seeing quite a bit for cross-campus or short range DR plans is to build a stretch cluster.  The usual approach is to use something like a HP P4000 SAN and stretch it between two sites.  A single Hyper-V cluster is built, stretching across the WAN link.

SAN-SAN replication

It’s not a cheap solution and it comes with complexities – and that’s true no matter what virtualisation you use:

• You have to choose a storage solution that stretches across sites and can do active/active.  You are locked into a single spec across both sites, making the hardware sales people very happy.
• You probably need a witness for the storage and the virtualisation cluster in a 3rd site, with site A and site B having independent network access to the witness site to avoid split brain when the link between A and B fails (and it will fail).
• Some high end storage solutions won’t like CSV for this and you might need to so 1 VM per LUN
• The networking (IP redirect, stretched VLANs, routers, switches, and all that jazz) is messy.
• The WAN for this is mega pricey.
• Honestly, a stretch Hyper-V cluster doesn’t play well with System Center Virtual Machine Manager – VMM just sees a single cluster and doesn’t care about the WAN link or the impact on backup, client/server app interaction, and so on.
• If you want to replicate to a hosting company then you need colo hosting and to place hardware in rented rackspace.
• Once a VM is created in a replicate LUN, it’s replicated to site B.  That’s pretty nice in a cloud.
• When everything works it’s a pretty fine solution, capable of having 0 data loss.  But corruption in site A will replicate to site B because this SAN likely has synchronous replication.

The above solution is something I see more and more, even in medium sized sites.  It’s complex, it’s pricey, and very often they are struggling with getting it to work even in testing, let alone in the worst day of their professional careers.

I recently listed to a RunAs Radio podcast where the guest spoke about his preference for VMware SRM for DR replication.  I can understand why.  Software replication can stretch much greater distances.  You aren’t as beholden to the storage vendor as before.  Hyper-V Replica is surely going to have the same impact … and more … without costing you hundreds of dollars/euros/pounds/etc on a per VM basis like SRM does:

Hyper-V Replica

• Hyper-V is hardware independent.  You can replicate from a host to a host, from a cluster to a host, or from a host to a cluster.  You can replicate from a HP cluster with a P4000 to a bunch of Dell hosts with a Compellent.
• Hyper-V Replica is built for unstable WAN connections.  It cannot automatically failover … in fact, many of us prefer a manual decision on failover.  We can reduce the RTO by automating VM start up using PowerShell and/or Orchestrator in the DR site.  The storage ni both sites is independent.  No need for 3rd party witnesses and their networking.
• VMs are replicated instead of LUNs, therefore CSV is fully supported.  You can replicate VMs from a CSV in site A to a CSV or a normal LUN in site B.
• Networking is easy!  And you have options!  The pipe for the replica probably either should be dedicated or have QoS to allow replication without impacting normal Internet connectivity.  Because the replication is asynchronous, the WAN doesn’t need massive bandwidth and low latency.  You can choose to stretch VLANs, or you might not.  You might use Network Virtualisation in site B or you might use IP address injection to change the VMs’ IP addresses for the destination network.  By the way, you can also dedicate a virtual switch(es) for firing up test copies of your VMs for DR testing.
• Hyper-V Replica is built for commercial broadband.  Remember that your upload speed is the important factor.  Sizing is tricky … I’ve been saying that you could take your incremental backup and divide it by the number of 5 minute windows there are in your workday to figure out how much bandwidth Hyper-V Replica will require to replicate every 5 minutes … but that’s worst case because there is pre-transmit compression going on.
• Hyper-V Replica is not a stretch cluster … therefore systems management solutions such as VMM will play nice by keeping it’s placement of VMs local in site A.
• Your hardware options are very flexible.  You could replicate to hardware you own in a branch/head office or datacenter, you could rent rackspace and put hardware in colo hosting, or you could replicate to a hosting partner that hosts Hyper-V Replica.
• There just aren’t as many delicate moving parts in this architecture.  You pretty much have 2 simple independent infrastructures where 1 copies compressed differential data to another.
• Hyper-V Replica is configured on a per-VM basis.  PowerShell can do this – I’ve already seen examples posted online.  You could probably make this a part of the Orchestrator runbook in a cloud implementation.  So a little more work is requires but you can fire it and forget.
• Best of all, Hyper-V Replica is a tick box away in Hyper-V.  Yup, zero dollars, nada, keine kosten, gratuito, free.  Of course, you are free to continue wearing a tinfoil hat and paying vTax ….

Clinging to his overpriced DR with his cold dead hands because he thinks Stevie B. wants to steal his brainwaves

Related posts:

1. Patching A Windows Server 2012 Failover Cluster, Including Hyper-V
2. Planning Your Windows Server 2012 Hyper-V Deployment
3. Hyper-V NU January 2012 Slide Decks, Including My One on Windows Server 8 Hyper-V Networking

Cause?  It’s Linux’s desire to have sticky MAC addresses (which also causes problems if you have the default dynamic MAC addresses and you move/Live Migrate a Linux VM).  I did some Penguin-eering and found that there’s a file called 70-persistent-net.rules which can be found at /etc/udev/rules.d.  If you run:

cat /etc/udev/rules.d/70-persistent-net.rules then you’ll see that it contains a rule that locks the network activity to your original VM’s MAC address.  Solution?  Delete that rule.

Ubuntu doesn’t have a default root (administrator) account enabled for direct login.  Instead you use a lesser account and elevate your privileges – it’s kind of like UAC but the concept has been in UNIX for a long time.  You’ll use sudo to accomplish this.  It’s relevant because 70-persistent-net.rules is a locked down system file.  On your reference VM you’ll need to do this before copying it.

sudo vi /etc/udev/rules.d/70-persistent-net.rules will edit the file using vi.  Navigate to the line in question.  Use dd (press dd twice) to delete the line.  Then press : and enter wq! to quit vi while writing the changes with no confirmation.  Did I mention that I started my career as a UNIX developer?   Some old things are hard to forget.

Shutdown the VM (easiest way for us noobs is to use the shutdown command in Hyper-V Manager or POSH) which cleanly does this via the Hyper-V integration components that are built into the Linux kernel (featured in Ubuntu 12.04).

Now the VHDX can be copied and reused in new VMs.  Don’t worry if you’ve got already copied VMs.  Just do the above edit and reboot them and you’ll be sorted … or get their new MAC address from the VM properties, edit the rules file, and reboot.

EDIT: This will probably apply if using this cloning technique with any hypervisor.

Related posts:

1. Ubuntu 12.04 With Built-In Hyper-V Guest Support Is Available
2. Ubuntu 12.04 Will Have Hyper-V Drivers By Default
3. Linux Integration Services 3.1 for Hyper-V

When is Application-Consistent Backup Vital? Not all situations require an application-consistent backup. Things such as file and print servers will be fine with crash-consistent and possibly inconsistent backups. If your application doesn’t provide a VSS writer, there might not even be a way to get an application-consistent backup of it while its containing machine is live. The most common need for application-consistent backups is the usage of database-backed applications.

Give it a read to learn about backup from a backup developer.

Related posts:

1. VSS Crash Consistent Versus Application Consistent VSS Backups
2. Altaro Launch Hyper-V Backup V3
3. Altaro Launches Hyper-V Backup … And How To Win an Unlimited Copy!

Today we moved to physical machine testing, verifying the drivers were installed, and IDing/importing those that got missed out.  Interestingly, the recently released HP all-inclusive driver pack for PCs/laptops is missing quite a few drivers.  We’re finding them in the per-model archives with no issues, as we are for the Dell machines.

One of the nice finds today was that I’d forgot to turn on Multicast on the distribution point and set the network speed in Multicast.  By default it is 100 Mbps.  I switched that sucker up to 1 Gbps.  Two things happened:

1. All deployments that were on-going broke as the DP was updated.  This wasn’t instant either, taking a couple of minutes.
2. Damn, OS deployment became so much quicker afterwards, as one would expect.

One of the nasties was a 3G modem “driver” by Ericsson on one of the HP laptops.  I say “driver” because there isn’t the usual collection of files including a .sys and .inf.  Instead, it’s a setup.exe.  Extract that and you get more files and another setup.exe.  Crap!  Maybe it has a silent install.  Maybe if it does we can package it up, and distribute it to a collection based on the model name of the laptop in question.  I’m even wondering if we can make it a conditional step in the task sequence where the condition is based on a ZTIGather model discovery.   It’s the only 3G modem we’ve had like this in about 8 or so laptop models so it sucks that it stands out like a sore thumb.

Related posts:

1. MMS 2012: Deep Dive Into ConfigMgr 2012 DRS and SEDO
2. Operations Manager 2012: Network Monitoring
3. Deploy Office 2010 via ConfigMgr 2007

VMware Cloud Infrastructure Suite is really more of a marketing term. Those of you know our products deeply know that they don’t fit this well together as they need to. Some of them have multiple databases, some don’t look the same, some install differently, and what I can’t stand that is Site Recovery Manager doesn’t currently work with vCloud Director. So, what we are basically able to say is that we created and acquired companies that led to a lot of individual products that don’t work well enough together yet.

Worse … he was caught on video, as you can see on the link in Dave’s post.  Someone call Tad!

Seriously, I’ve been talking about this for a while.  VMware went and bought a slew of companies in the last few years.  Last year I was at a big VMware event in Dublin where they pushed their “integrated” cloud solution for vSphere.  If by integrated they meant that they changed the icons, grouped them together, and stuck a “v” in front of the name, then they did no better than Amdahl or CA were doing in the 1990’s.  I know; I worked with both product sets back then.  What you got were uncoupled, different, and non-integrated point solutions.  Hardly a cloud at all.

That sort of thing should be buried with grunge rock and rap metal back in that dark, dark decade.

On the other hand, a couple of months ago I was asked to whiteboard the integration of System Center 2012.  I had to tell the people in question that I might as well scribble lines all over the board because it was so deeply integrated.  That’s a modern day, integrated solution for ya!

Related posts:

1. New VMware Licensing – Really? Are they Mental or What?
2. More on the VMware Fiasco
3. VMware Updates vSphere 5.0 Licensing

The key log to analyse during a task sequence execution is SMSTS.LOG which can be found in \Windows\Temp\SMSTS on the X drive.  You can get access to this log by enabling the command prompt for diagnostics in your boot image (remember to redistribute to your distribution points) and pressing F8 while the boot image is running.  In here I found:

Error 0x800705AA: Insufficient system resources

Damn!  I had to think for a few moments about this one.  Then it hit me.  I develop my reference image using a VM (snapshot right before the sysprep so I can rollback [apply snapshot], tweak and recapture) and I test on VMs before moving onto driver testing on reference hardware.  How were the VMs configured?  Dynamic memory with 512 MB startup memory.  The boot image doesn’t appear to have integration components for DM so  the 512 MB never burst up to the potential maximum memory of 4096 MB.  The boot image requires a minimum of 512 MB.  I guess the boot image needed more RAM than the startup, couldn’t avail of the maximum amount, and failed the task sequence.

The quick fix: I bumped the startup memory to 1024 MB, tested, and everything’s sorted.

Related posts:

1. Configuration Manager 2012 Error, Past Due – Will Be Retired
2. HP P4000 VSA Fails To Install On Hyper-V With ‘Unmounting the configuration drive…’ Error
3. KB2639032 – "0x0000003B" Stop Error When Connection To CSV Is Lost On W2008R2-based Failover Cluster

The Microsoft Solution Accelerators Team is pleased to announce that Microsoft Application Approval Workflow is now available for download! 

The Application Approval Workflow (AAW) takes an application request submitted through the System Center 2012 Configuration Manager Application Catalog and transforms it into a System Center 2012 – Service Manager service request, allowing flexible approval lists and activities.      

The AAW illustrates the integration of the components of System Center 2012, taking the basic functionality of the ConfigMgr 2012 Application Catalog and extending it into the Service Catalog of Service Manager.

Key feature list:

• Sync Configuration Manager applications data into the Service Manager database.
• Monitor and transport Configuration Manager Application Catalog requests requiring approval to Service Manager and open a service request.
• Return the completed approval workflow status to Configuration Manager for handling.
• Allow administrators to define and maintain application selection criteria for specific applications or application groups and specific users or user groups.
• Track service application requests and view application catalog contents in Service Manager.

Related posts:

1. Microsoft Deployment Toolkit (MDT) 2012 Download
2. Application Catalog Is The Killer Feature In System Center 2012 Configuration Manager
3. System Center 2012 RTM is Available To Download

Unfortunately, if disaster does strike, there are often more questions than answers. Planning ahead is critical, and that involves knowing what sort of backup you need and if your backup application can provide it.

Related posts:

1. VSS Crash Consistent Versus Application Consistent VSS Backups (Part 2 of 2)
2. Altaro Launch Hyper-V Backup V3
3. Whitepaper – Planning Hyper-V CSV and Backup

Here, we have events in Belfast (May 21st, Wellington Park Hotel) and Dublin (May 22nd, Microsoft Building 2, Leopardstown).  The agenda of the events is:

• 13:00     Registration opens
• 13:30     Introduction                              Dave Northey
• 13:50     Manageability                           Alex Juschin
• 14:35     Storage and Availability            Aidan Finn
• 15:20     Coffee
• 15:40     Virtualisation (Hyper-V)             Aidan Finn
• 16:25     Remote Desktop Services          Alex Juschin
• 17:10     End

It’s a long time since we had a release like Windows Server 2012.  It would be considered a huge release with the Hyper-V changes.  If you’re serious about server, then don’t get left behind.

EDIT1:

Details have just been announced for the London (June 14th) and Edinburgh (June 15th) events in GB.  I’ll be taking time off to present so hopefully I’ll see you there

Related posts:

1. Hyper-V.nu Community Event, January 2012
2. Planning Your Windows Server 2012 Hyper-V Deployment
3. Mark Your Calendar: Windows 8/Server 2012 RC In The First Week of June

If you currently have a Windows Server 2008/R2 Hyper-V cluster, then you have a few options for patching it with no VM downtime:

• Manually Live Migrate VM workloads (Maintenance Mode in VMM 2008 R2makes this easier), patch, and reboot each host in turn, which is a time consuming manual task.
• Use System Center Opalis/Orchestrator to perform a runbook against each cluster node in turn that drains the cluster node of it’s roles (VMs), patches it and reboots it.
• Use the patching feature of System Center 2012 Virtual Machine Manager – which is limited to Hyper-V clusters and adds more management to your patching process.

CAU is actually pretty simple:

1. Have some patching mechanism configured: e.g. enable Automatic Updates on the cluster nodes (e.g. Hyper-V hosts), approve updates in WSUS/ConfigMgr/etc.  Make sure that you exempt your cluster nodes from automatic installation/rebooting in your patching policy; CAU will do this work.
2. Log into Failover Clustering from a machine that is not a cluster node (Hyper-V host) member.  Run the CAU wizard.
3. Here, you can either manually kick off a patching job for the cluster nodes or schedule it to run automatically.  The scheduled automatic option requires that you have deployed a CAU role on the cluster in question to orchestrate the patching.

When a patching job runs the following will happen:

1. Determine the patches to install per node.
2. Put node 1 in a paused state (maintenance mode).  This drains it of clustered roles – in other words your Hyper-V VMs will Live Migrate to the “best possible” hosts.  Failover Clustering uses amount of RAM to determine the best possible host.  VMM’s advantage is that it uses more information to perform Intelligent Placement.
3. Node 1 is removed from a paused state, enabling it to host roles (VMs) once again.
4. CAU will wait then patch and reboot Node 1.
5. When Node 1 is safely back online, CAU will move onto Node 2 to repeat the operation.

VMs are Live Migrated throughout the cluster as the CAU job runs and each host is put into a paused state (automatically Live Migrating VMs off), patching, rebooting, and un-pausing.  It’s a nice simple operation.

The process is actually quite configurable, enabling you to definite variables for decisions, execute scripts at different points, and define a reboot timeout (for those monster hosts).

Something to think of is how long it will take to drain a host of VMs.  A 1 GbE Live Migration network will take an eternity to LM (or vMotion for that matter) 192 GB RAM of VMs, even with concurrent LMs (as we have in Windows Server 2012).

Sounds nice, eh?  How about you see it in action:

I have edited the video to clip out lots of waiting:

• These were physical nodes (Hyper-V hosts) and a server’s POST takes forever
• CAU is pretty careful, and seems to deliberately wait for a while when a server changes state before CAU continues with the task sequence.

Related posts:

1. Windows Server 8 Hyper-V Failover Cluster Failover Startup Priority
2. Hyper-V NU January 2012 Slide Decks, Including My One on Windows Server 8 Hyper-V Networking
3. See Windows Server 8 Hyper-V Simultaneous Live Migration & Cluster Host Drain In Action

A forensic IT study by a U.K. security consultancy found that some multi-tenant public cloud providers have "dirty disks" that are not fully wiped clean after each use by a customer, leaving potentially sensitive data exposed to other users.

FYI, AFAIK most of the mentioned companies are using some variant of Xen or vSphere.  The issue here is that Customer A buys a VM and uses it to store data in a virtual disk.  That virtual disk is a file that is stored on physical disk.  Customer A eventually decommissions the VM or their storage is relocated.  Now think about what a delete really is; it’s not a secure delete.  Deleting a file simply removes the entries from the file system table.  The 1’s and 0’s are still there, waiting to be read.

Now along comes Hacker B who buys a VM and deploys it.  Their VHD is placed over the same location of physical disk as Customer A’s old VM.  Without any security measures, Hacker B can simply run a disk scan tool, from within their VM, and find those 1’s and 0’s, pretty much doing some disk forensics to restore the “deleted” data that Customer A previously stored in their VM.  And that’s exactly what that study found was possible with a number of public cloud providers:

… Rackspace and VSP.net had the vulnerability.

The Microsoft developers VHD/VHDX were aware of this and took measures to prevent it.  When you create a VHD/VHDX it securely wipes the contents of the file as it is created.  This prevents access to data that was previously on the underlying physical disk.  Disk forensics will get you nowhere.

A number of 3rd party tools are out there to instantly create fixed VHDs but they fail to implement this secure wipe so the process can be speeded up, thus putting the hosting company at risk of this threat.  In this case, it is a matter of balancing a genuine security risk (especially in a public cloud) versus performance (of deploying new virtual machine storage while the customer watches a progress bar on a web portal).

The story continues to report that the mentioned affected hosting companies resolved the issue after they were informed.

Related posts:

1. Windows Server 2008 R2 Hyper-V Achieves BSI EAL 4+ Security Certification
2. The Virtualisation Smackdown – Hyper-V VHDX Scales Out to 64 TB – Yes, I said 64 Terabytes!
3. Deploy The MS12-020 Security Fix Or Face The Consequences

• Mount a Ubuntu ISO in a Hyper-V VM
• Install the OS
• Avail of all the Hyper-V devices and integrations that are supported by Linux with no extra IC installations required

Nice!  In fact, The Register agrees with that assessment too.  I hope that the other Linux distro’s catch up with Ubuntu.

Congrats Mike & the team!

Related posts:

1. Ubuntu 12.04 Will Have Hyper-V Drivers By Default
2. Cloned Ubuntu VMs On Hyper-V Can’t Get DHCP Address
3. KB2636573 – Hyper-V Guest OS May Crash When Performing Live Migration

This label has two purposes:

1. You can tell from admin tools that this is a CSV volume and is shared across the nodes in the cluster
2. It allows applications to know that they are working with a CSV rather than a simple single-server volume.  This is probably important for applications that can use the filter extensibility of Windows Server 2012 Hyper-V, e.g. replication or AV.

BTW, this screenshot is taken from the virtualised scale-out file server that I’m building with a HP VSA as the background storage.

Related posts:

1. KB2687646 – A LUN That Is Registered To A CSV Is Invisible & Inaccessible In W2008 R2
2. KB2674551 – Redirected Mode Enabled Unexpectedly In CSV When Running 3rd-Party Application In W2008R2-Based Cluster
3. Whitepaper – Planning Hyper-V CSV and Backup

• Windows XP Service Pack 3 (SP3)
• Windows Vista (Service Pack 1, or Service Pack 2)
• Windows 7

Yes, Windows XP and Windows Vista are both still supported for this new development, even though they are both in extended support.  You can understand this exception when you consider the reason for MSE’s existence.  It exists to help prevent the spread of malware on PCs that otherwise would not be protected:

• People who get free 90 days of AV with an OEM PC but never buy the subscription
• People who can’t afford to or won’t buy AV

One of the best stories we have of MSE locally was when we did a community launch event for Windows 7 in Belfast.  We talked about MSE and how it could help defend against Conficker which was all the rage with unpatched PCs at the time (and unfortunately still is thanks to negligent [IMO] admins/managers).  Irish DPE, Dave Northey, saw a photographer was taking photos on behalf of the venue and asked for a copy of some of the photos.  The photographer came over at the end of the event with a USB stick.  Dave joked that he hoped that Conficker wasn’t on the stick – MSE was on Dave’s laptop and screamed about finding Conficker on the photographer’s USB device

You might ask about support for Windows 8.  Good question.  Windows 8 comes with Defender built in (more later).  Defender in Windows 8 is not the Defender of old.  It actually is anti-spyware and antivirus, meaning that you don’t need to download/install MSE on it.

Built-in AV, eh?  Imagine what Symantec’s lawyers, the EU, and so on will think of that!  Many of us are presented with a browser chooser when we setup Windows 7 for the first time.  I wouldn’t be surprised if we see something similar for AV.  Personally, I’d stick with Windows 8 Defender, but there’s nothing to stop you from choosing an alternative.  I wouldn’t be surprised if OEMs continue to ship subsidised trial copies of AV and retail stores continue to push AV boxes on customers with their PC/laptop/tablet purchase.  You still have a choice, but at least with Windows 8, you have protection by default.

Related posts:

1. Will Windows 8 Metro & Microsoft Store Increase Our Security?
2. So … I Prefer No Antivirus on Hyper-V Hosts?
3. Deploy The MS12-020 Security Fix Or Face The Consequences

I’ve been saying for a while that the Windows 8 schedule looks very like the one for Windows 7.  It’s a little  different (one month behind) but not that different.  My gut is saying it’s an August RTM (on MSVL, MSDN, and TechNet soon after) and an October launch/GA (LAR/distributor pricelist for new volume license purchases, OEM machines, on the shelves).

It won’t be long after that when we have SP1 for System Center with support for Windows Server 2012 and Windows 8.

Related posts:

1. Mark Your Calendar: February 29th
2. It’s Official: Windows Server 2012
3. Windows Server 2012 Community Events

We recorded the podcast a few weeks ago when we still referred to Windows Server 2012 by it’s beta codename of Windows Server “8”.

Thanks to the folks at RunAs Radio for asking me on as a guest!

Related posts:

1. Planning Your Windows Server 2012 Hyper-V Deployment
2. Choosing A Windows Server 2012 Hyper-V DR Architecture
3. Hyper-V NU January 2012 Slide Decks, Including My One on Windows Server 8 Hyper-V Networking

• “Windows To Go Use Rights: Windows To Go will allow companies to support Bring Your Own PC scenarios and will give employees who need to work from home more secure access to their full corporate environment. With Windows To Go use rights under Software Assurance, an employee will be able to use Windows To Go on any company PC licensed with Windows SA as well as from their home PC. Additionally, through a new companion device license for SA, employees will be able to use WTG on their personal devices at work.
• Windows RT Virtual Desktop Access (VDA) Rights: When used as a companion of a Windows Software Assurance licensed PC, Windows RT will automatically receive extended VDA rights. These rights will provide access to a full VDI image running in the datacenter which will make Windows RT a great complementary tablet option for business customers.
• Companion Device License (CDL): For customers who want to provide full flexibility for how employees access their corporate desktop across devices, we are introducing a new Companion Device License for Windows SA customers. For users of Windows Software Assurance licensed PCs this optional add-on will provide rights to access a corporate desktop either through VDI or Windows To Go on up to four personally owned devices”.

Windows To Go is a pretty cool feature.  Long-story-short: you can install Windows 8 Enterprise onto a USB 3.0 stick and then plug that into any USB 3.0 capable machine (assuming the drivers are there for PNP) to boot that machine up.  The idea is that a business can build these sticks and give them to employees to enable bring your own device (BYOD) while still using a corporate build of Windows.  Teamed up with Network Access Protection (NAP), you could isolate the non-corporate OEM Windows installs on the network (should the employee boot from the on-disk install instead of the USB 3.0 one) and give “unrestricted” access to the USB 3.0 boot image (for normal corporate resource access).

At the moment, setting up Windows To Go and deploying it is command line messing with WAIK.  I’d suspect MSFT will give us an updated deployment tool that enables driver and update injection so we can automatically handle many models of hardware.

Windows RT is what we briefly called Windows on ARM (WOA), the OEM-only build of Windows 8 for ARM based tablets.  If you use one of these as a secondary device to a SA covered desktop then you’ll get VDI rights for this device.  That’s cool!  Windows 8 Enterprise (SA) per desktop (not for the RT tablet) gives that PC rights to access VDI.  Without SA for the tablet, the company would have had to license it with the per-device VDA which would be very costly.

For non-Windows companion devices, such as the iPad, there will be an optional add-on called CDL.  We don’t know the price of that – I suspect GA for Windows 8 will be October so I’d expect LARs and distributors will have updated price lists on October 1st.  When you attach CDL to a PC’s software assurance, you will entitle up to 4 personally owned companion devices (iPad, iPhone, etc) of that PC to access Windows based VDI or Windows To Go.  This is an improvement … right now personally owned devices probably should have VDA.  With the estimate being that tech savvy employees personally own 4-5 of these devices, that could be very expensive for the company.  CDL will greatly reduce that cost.

It sounds to me that corporate owned devices will still require VDA.

Right now, all we have is a single light on detail blog post to go on.  We’ll have to wait until MSFT updates their licensing training and Product Usage Rights (PUR) for Windows 8 to get the specifics.

Related posts:

1. Comparing the Core CAL and Enterprise CAL Suites
2. Windows 8 Names, Editions, and Features
3. Windows Thin PC for Software Assurance Customers

Folks, the game has changed.  It’s one thing to hear MSFT marketing talk about it, or to hear it for 5 days straight at a conference.  But it’s something completely different when customers are demanding it.  Organisations want a service centric IT department with self-service, automation, governance, deep monitoring, and …. and … you get the picture. 

That means 2 things:

• You need System Center 2012 Orchestrator for the automation and deep integration into the rest of System Center, AD, and 3rd party products
• You need System Center 2012 Service Manager as a portal to the IT department and the service catalogue that it provides

At MMS we just had one session after another that illustrated how some business scenario could be dealt with using some component(s) of System Center in combination with the above two products.  Every time, the user would request a service in Service Manager, Orchestrator would orchestrate the tasks, and the rest of System Center would implement the desired changes, possibly requiring some manual approval via a service ticket.

With this huge increase in demand, I’ve come to the conclusion that I cannot avoid Service Manager or Orchestrator anymore.  They’re very different to the “2007” generation of the same products, and people are aware of the need for solutions that do what these products do.  With those two products gluing the rest of System Center together, you can have an incredible service delivery from your (or your customers’) IT organisation.  I will have to learn these two products.  Damn you Microsoft!  Now I need to learn:

• Windows 8
• Windows Server 2012 Hyper-V
• Pretty much all of System Center 2012
• And let’s not forget that Office wave 15 beta is around the corner

Ugh!

Related posts:

1. Top 10 Production Experiences With Service Manager and Orchestrator
2. Service Manager 2012 “Service Ticketing”
3. Application Catalog Is The Killer Feature In System Center 2012 Configuration Manager