Vmware Infrastructure 3

I have just recently returned from Vmware Infrastructure 3 training in Denver, I'm seriously considering spending a little time studying for the VCP exam.

Then again, I've lately been viewing certification as an exercise in running a study/test treadmill. (It's a single test though, and doesn't ever expire.)

Although our shop has been using Vmware since 1.5 and I've been heavily involved with it since 2.5, this was the first official training class for Vmware I've attended. The class was one of the better training classes I've ever attended. It's pretty refreshing to have a class where all the product labs "just work".

DRS and HA were unique features, representing the ability for Vmware to automatically load balance across multiple ESX hosts and failover VM's when one or more ESX hosts fail. Some of the things I learned that I never knew where that Virtual Center automatically imports members of the local administrators group on the Host running Virtual Center into the Virtual Center Administrators group. (Which is something I confirmed in class. We had no Active Directory or I would test for nested groups, but I suspect they don't import.) Another item is that performance of Raw Device mappings, is supposedly slightly worse than using a vmdk file. The official position is that RDM's should only really be used if software needs raw access to a SAN (such as SAN management software) or if you are doing clustering between vm's or between vm and a physical server.

One point that made me smile, was that neither the instructor or any other students thought it was possible to extend a system disk (such as the C: drive) on a Windows server. Something one of my former colleagues had come up with long ago, by attaching the vmdk to another "helper" vm and using it to extend the disk.

Some of the useful information I found that wasn't part of the course ware material included:

List of Maximums in Vmware

Memory overhead associated with running a Virtual Machine (Page 129.)

If pursuing the VCP, the Blueprint covers the test objectives. (Although attendance in a Vmware class is required for the VCP, no one class covers all the material.)

Passed XP 70-270 Test! Now an MCSA!!

I just recently took and passed the Windows XP 70-270 exam. I had previously taken the following exams (in chronological order) beginning with 70-297, 70-290, 70-294, 70-284 and 70-291.

Even though I waited this long to take the XP 70-270 exam, I was a little surprised to find that I had a perfect (1000) score on this particular test.

Anyway, this completes my requirements for MCSA and leaves me one test short of MCSE. (I plan to start studying for the 70-293 after Vacation. I think I probably should have taken it right after 70-291.)

My study recommendations for the 70-270 are to be thoroughly versed in Share/NTFS permissions, Windows XP install situations and knowledgeable of IE security settings (especially if you don't encounter settings different from the defaults in your day to day activities).

I used an older copy of Exam cram 2, but since it was a pre sp2 for XP version I found it lacking. What benefited the most was hands on experience, and second was Microsoft's own Self Study book. I also used Self Test software, but be sure to understand the explanations and do not just try to memorize the answers.

Understanding the Exchange DST tool in KB930879

For any of those who are actively working to prepare an Exchange 2003 environment for the 2007 Daylight Saving changes are probably looking at the Microsoft KB article 930879

If you are anyone like me, you might find this KB article a little vague and confusing at points.

Some of the issues I hit were:

• Exchange tools (Exchange System Manager) were installed on my admin workstations, and had to be uninstalled. (Which also had it's issues, as I found I had to run the setup from the Exchange CD to remove all components from Add/Remove programs. Going to Add/Remove to uninstall would remove the tools, but leave the Exchange server parent entry and prevent the install of the CDO tools.)
• I missed the mentioning of needing .Net 2 Framework installed, and it took a bit of searching on Google to determine the issue.
• Lastly, it was not very clear how to format the Server DN name when running MSEXTMZCFG.exe. I stumbled across the correct formatting after examining the MSEXTMZ.ini file. (Silly me, I was using LDAP formatting.)
• The registry key for Outlook (in my case) needed to be changed to the 11.0 hive from the 12.0 hive.
  

The Exchange Team blog has a much better walkthrough on this than the KB article.

Unfortunately, it also brought to my attention the issue with these tools and the Auto Accept Agent for resource mailboxes. The current solution is to painfully unregister each mailbox before running the tool, but at least on Exchange team member says they want be able to come up with another solution.

Good luck!

Daylight Saving Time (DST) 2007 Changes

Earlier in the month I started work on getting a jump on patching systems for the 2007 Daylight Saving Time changes.

(As of March 2007, DST begins on the second Sunday in March and ends on the first Sunday in November. For more information, see Sec.110 of the Energy Policy Act of 2005.)

A short summation of what I found was:

Microsoft has a patch for 2003 and XP with sp2.

For other versions, you should be able to change the settings with registry keys.

Exchange 2003 gets a little complicated in that you need a CDO patch in addition to the Windows OS patch, but your appointments made by clients with the XP patch may be off an hour or more without the CDO update tools for Outlook 2003 that they have yet to release. I'm still trying to determine if one should also hold off on the Exchange 2003 server patch until the Outlook tool is release.

Also, apparently there is an update for Entourage for Mac users.

Windows SharePoint Services 2.0 also has a patch. (WSS 2.0 is a part of Project 2003 server and SharePoint Portal Services 2003 in our environment.)

Sun has a time zone updater for Java builds 1.4 and greater.

Novell has a utility to change the DST start and stop values, but you can change them manually.

Blackberry for Exchange needs the Windows OS DST patch and the CDO Exchange patch, and is planning on releasing a patch/CDO update for Blackberry devices in early February.

Windows Update Error 0X8024402C

Although I generally use Shavlik's HFNETCHKPRO to patch Windows Servers, I recently stumbled across two cases where Windows Update failed to work and I received the error 0X8024402C.

I found Microsoft's article on the issue, but clearing all proxy entries wasn't exactly what I was looking for in my case. (One server was running Project server 2003 and had added an entry as part of the Project server install. The other servers were running Veritas' Enterprise Vault product and had been configured with some proxies as part of their install.)

My solution was to observe the current settings by just running "proxycfg" without any switches and then appending "*.microsoft.com;*.windowsupdate.com" to the bypass list.

For example:

Run "proxycfg" and obtain the results:
Proxy Server(s): https://project;http://project
Bypass List : <local>;project

then run

proxycfg -d -p "<local>" "<local>;project;*.microsoft.com;*.windowsupdate.com

NOTE THERE IS NOT AN ENDING QUOTE

Help files over network shares

Came across an interesting issue the other day where a SAP Administrator had enabled sharing of the C: drive on a SAP deployment server, only to find he could no longer access the help files.

Apparently Microsoft has change functionality with MS05-026 to prevent a vulnerability in HTML help files and remote code execution. With security update 892675 installed you can't open HTML help files over network shares.

The workaround I used after scouring posts on the internet was to add the following registry key and then uninstall Internet Explorer Enhanced Security Configuration.

REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\HTMLHelp]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\HTMLHelp\1.x\HHRestrictions]
"MaxAllowedZone"=dword:00000001
"EnableFrameNavigationInSafeMode"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\HTMLHelp\1.x\ItssRestrictions]
"MaxAllowedZone"=dword:00000001

Passed 70-291!

Passed 70-291!

I took the test on Friday and passed with an 866.

I had perfects in:
Implementing, Managing and Maintaining Name Resolution
Maintaining a Network Infrastructure

I performed well on:
Implementing, Managing and Maintaining IP Addressing
Implementing, Managing and Maintaining Network Security

My weak area was:
Implementing, Managing and Maintaining Routing and Remote Access

Like many organizations, we use third party solutions for Routing and Remote Access so I had less practical experience with RRAS.

To study I used the Mike Meyers Passport book, the ExamCram 2 book, the Syngress book, Self-Test software and converting from NetWare DHCP and BIND to Windows 2003 DNS and DHCP at my company.

Just a heads up, my test did have an error in the provided information for one of my simulation questions (both in the text displayed before launching the simulation and the text displayed during the simulation). I’m positive it’s an error, because I did what I thought was correct instead and received a perfect in that category. I did leave a comment for Microsoft on that one.

Bug with trusts, 2003 sp1 and ESX VMware

While setting up some new trusts with some older NT domains, I found an interesting bug that prevented me from establishing an RPC connection.

Some googling (is that a word?) found at least this thread at VMware's forums.

One user recommended installing a Microsoft hotfix, but I preferred to find a workaround if possible and wait for resolution with a mainstream service pack for either Windows 2003 or ESX.

I found that I could use an xp desktop running the Windows 2003 sp1 adminpak tools to create the trust. I did of course have to make sure netbios was turned on and that I added the entries in my lmhosts file. (No WINS at our location.)

Poor Windows 2003 DHCP server documentation?

While recently working with Windows 2003 DHCP server, I hit a big snag with Dynamic DNS.

Here's a copy of my post to the Windows forums after much frustration:

"After much testing and head-scratching, I've come to the conclusion that all
the documentation (both Microsoft and third party) is greatly misleading
regarding the radio button in Windows 2003 DHCP to "Always dynamically
update DNS A and PTR records".

I expected that when selected, that this would have all DHCP clients of the
server to register both their A records and PTR records in DNS. DHCP option
15 is set for the correct domain name, and DHCP option 6 lists the Windows
2003 DNS servers. The DHCP server is a member of the DNSUpdateProxy group
and I even added credentials to the DHCP server. (Note DNS and DHCP are not
on the same servers, not that it really matters in my situation.)

DHCP scopes configured to:
Enable DNS dynamic updates according to the settings below
Always dynamically update DNS A and PTR records
Discard A and PTR records when lease is deleted

The results of all this? XP and 2000 Clients only register their PTR
records. Why? They don't have the option to register their connections in
DNS selected on each XP and 2000 client? But why should they, I'm telling
DHCP to do it?

Anyway, I fixed it by checking the option on the DHCP server to "Dynamically
update DNS A and PTR records for DHCP clients that do not request updates
(for example, clients running Windows NT 4.0). I realize this is supposed
to be enabled by default, or that I could script it (although all the WMI
scripts I saw wouldn't work without SP2 on XP).

No offense, but all the wording in the interface and in the documentation
I've seen is a bit misleading on how all this should work."

Windows Server 2003 Access-based Enumeration

Now that we are sporting Windows 2003 SP1 in our production environment, I took a look at the Windows 2003 Access-based Enumberation utility available from Microsoft. In short, this prevents users from seeing folders, files and shares that they don't have rights to access. Coming from a Novell NetWare environment, it's great to see this functionality.

It requires Windows 2003 SP1, and provides for either a command line or GUI interface to enable the functionality globally or on a individual share basis.

Good Stuff!

Vacation and AIX Training

I've taken a break from the Microsoft World to take a trip to Estes Park, CO and then after a brief touchdown at work, off for an IBM AIX class in Houston, TX.

I am trying to studying up for the 70-291 exam, but it's a slow going process.

Passed 70-284!

I took the test on Saturday and passed with a 790. Not great, but it's a pass.

I had perfects in:
managing security in the exchange environment
managing recipient objects and address lists

I performed well on:
managing and monitoring technologies that support exchange server 2003
installing, configuring and troubleshooting exchange server 2003

My weak areas were:
managing, monitoring and troubleshooting exchange server computers
managing, monitoring and troubleshooting exchange organization

Mostly my problem was I didn't focus in-depth enough on things that we didn't implement in my organization: ISA and Exchange, Microsoft Cluster and Public Folders in Front-end/Back-end configurations.

To study I had the Microsoft class, the ExamCram 2 book, Self-Test software and converting from GroupWise to Exchange 2003 at my organization.

One last thing, I didn't realize until after the test the large number of Exchange 2003 webcasts out there:

Webcasts

Terminal Services in Windows 2003

In an effort to provide some file sharing and applications to our China office, I delved into Terminal Server that was built into Windows Server 2003. (My first thought was Windows Sharepoint Services which is free with a licensed copy of Server 2003, but that's another blog entry.)

First decision was whether or not I needed Standard or Enterprise Windows 2003 server. I went with standard since we were not planning for a multi-server implementation. A comparison can be found here .

Installation was painless since it's all built-in components on the Windows Server 2003 CD. I did defer from the recommendations and install the licensing server on the same box, since this was going to be a small implementation.

Speaking of licensing, one really interesting thing I found was that Microsoft was providing a 1:1 licensing match for Terminal Services based on the number of XP Desktop licenses you had when Windows 2003 shipped. Check the bottom of this article.

I only had a few applications to install, one of them being Office 2000 which required a special MST .

I also found Deb Shinder's article on securing Terminal Services in Windows 2000 useful.

Auto Accept Agent

Now that the majority (almost 700) of our users are off groupWise and on Exchange 2003, manually handling calendars for Resources such as conference rooms is becoming a pain.

First, I looked at setting this in Outlook 2003, but found it too intensive based on the requirement to set permissions for each user that is going to send appointments to the resource and the Outlook client must be running (so one might have a dedicated desktop running Outlook with all resources).

Next, I looked at Exchange server auto accept agent . It's a COM application that runs on your Exchange server and handles the auto accept on it's own. Plus side is that it doesn't use Free/Busy generation to search scheduling, so it's faster, and also the resource doesn't have to be added to the meeting as a resource (. i.e. it still works if a users adds the recourse in the TO: field). Negatives are that you have a single XML configuration file that will apply to all Exchange accounts you configure to auto accept, so no configuration options down to the mailbox level and you must also set some AD values and permissions for it to work. (Although they supply a cscript to make this a little easier).

Check out the documentation here .

Disabled accounts and Exchange

Well, being relatively new to the world of Exchange, I was surprised to find it took more than a single click to resolve situations where with a disabled mailbox enabled account being re-enabled. I was expecting that once re-enabled, the mailbox would also be set to work, but it turns out there is a little more legwork needed.

Here is the Microsoft KB article on it, which is a bit windy. However, I found the comments at amset.info a little easier to digest.

This is probably not a big deal for most organizations, but since we are also using DirXML and GroupWise doesn't behave this way, I can see some headaches when NDS/eDir accounts are disabled previous to Exchange account access being transferred if needed.

DirXML populating

Now that the Novell DirXML Starter Pack is up and running, synching NDS/eDirectory accounts and Active Directory accounts, I needed a way to gradually add existing users to the sync as the desktop group migrated the client from GroupWise to Outlook 2003. Since this would be happening almost everyday for over a month, I didn't want to burn too much time in the iManager interface.

My solution was to first export the entire Active Directory forest as a comma delimited file using the Microsoft CSVDE tool. (Here's an overview from Guy Thomas.) I had previously populated the accounts with DirXML, but had removed the driver for a reconfiguring at one point. Desktop wanted the sync to be enabled as close as possible to the migration day anyway, so it actually helped that the accounts weren't entirely linked. I took the CSVDE export and narrowed it down to just the DN, the GUID and the SAMaccount name.

Next step was an import into UltraEdit (kedit is another good editor) and a save. This broke the DN down into fields for each aspect of the context, and allowed me to perform a search and replace on the first part of the DN with the SAMaccount name inside of Microsoft Excel. (This was necessary as the DirXML starter pack uses the Full Name attribute out of NDS/eDirectory for the Common Name in AD, and I was trying to populate the DirXML attribute on NDS/eDirectory).

This left me in the dilemma of how to get a comma delimited file into NDS/eDirectory, and although the developer version of the ICE command line is supposed to support imports from delimited files, I was never able to figure out the right combination of switches. Instead I found a Novell Consulting tool that takes a CSV and generates and LDIF file.

After a little more search and replace to correct syntax and issues such as an Organization unit (O) being and Organizational Unit (OU) in AD, I had a flat LDIF file of all my user accounts.

As the desktop support team serves up a list of user daily, I perform a find on my master list and stage an import LDIF file for ConsoleOne.

Admodify.NET rocks!!

Here's a tool that neither one of my AD classes or anything I had read mentioned: Admodify.

Excellent for bulk changes, I used it to add the appropriate UPN suffix to several hundred accounts that were missing it. I've also used it to modify the display name.

MSExchange.org has a nice write-up on it.

You can download it from Microsoft here. The .NET version is the latest.

Passed 70-294!

Woo Hoo! I passed the 70-294 exam for "Planning, Implementing and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure" this Saturday.

Here's a rip from MCSE World on my thoughts:

OUTSIDE READING IMHO is a must for this exam.

I took the Microsoft 2269 class, used the ExamCram2 book and used the Self Test practice software and still failed the first time.

You absolutely must read up on:
COM+ Partitions
COM+ Partition sets
Certificates
Terminal Servers and GPO Software installs

Don't focus on these 100%, that's what the main objectives are for, but do except a question to two.

I even had a good ol' fashioned disk quota question.

I also found Mike Meyers' Passport book on the 70-294 helpful, and in some ways a better overview than the ExamCram2 book

Another DirXML tweak

Turns out I still needed to tweak DirXML further for my environment. The templates used by administrators to create new users in eDirectory were creating a "Other User" name that would become the "user name" in AD.

Check out the Novell TID here.

Worst week ever or "So you want to use DirXML?"

Have you ever heard of the VH1 show Best Week Ever ? Well, that definitely wasn't my last week. Whew! I thought getting DirXML to work and staying on top of participating in a slew of job interviews and Sarbanes Oxley meetings was going to kill me.

I survived and thought I'd share a few of the oddities I hit in my endeavors.

Still being a hybrid Novell NDS/eDirectory and Microsoft AD shop, we were wanting a way to sync the passwords since the pace of our Exchange 2003 migration is preventing our Desktop support to join the PC's to the domain. If Outlook 2003 would behave consistently for us on password changes for non-domain PC's, it would be a non-issue. Microsoft's solution appears to be their PEWA tool from the Exchange 2003 Resource Kit. Neither MIIS, nor Microsoft's tool from their Services for NetWare is an option, as we wanted to password sync to also work from NDS/eDirectory to AD. Leaving the Novell DirXML Starter Pack the only option.

Tricky to setup with all the caveats, but it can work in a 2003 AD environment , but must be installed on a 2000 member server. Also, it doesn't handle UPN's out of the box either, you must add a stylesheet. Another one that caught me off guard was that even though I had the sync set to one-way from NDS to AD, a delete in AD would delete the NDS object. Further points of interest were that NMAS must be disabled on the Novell Client. Contrary to the Novell DirXML documentation, I found that changing the password from ConsoleOne would change the password in AD, with the exception being the initial account creation. Lastly, I manually manipulated placement rules to handle the fact that the NDS/eDirectory environment had two high level Organization (O's) that contained multiple Organizational Units (OU's) that I wanted to sync to AD. Whew!

Oh yeah, I changed the blog name. It's pretty cheesy, but at least more accurately reflects where this thing is headed I think.