In some testing I was doing with VM HA monitoring – and I would highly recommend Duncan’s post for some more information on the subject - I needed to crash a VM to test the functionality.

So in essence what does it do?

When enabling this feature – VMware HA monitors the guest itself for Operating system failure and if recognized – it reboots the VM (according to the defined threshold)

So how do you crash a Windows VM? And how do you crash a Linux VM?

Windows

This Microsoft KB gives you the answers

Methods to generate a manual memory dump file

There are several methods to generate a manual kernel or complete memory dump file. These methods include using the NMI, keyboard (PS2/USB), remote kernel, or NotMyFault.exe tools.

How to generate a manual memory dump by using the NotMyFault tool

If you can log on while the problem is occurring, you can use the Microsoft SysInternals NotMyFault tool. To do this, follow these steps:

1. Download the NotMyFault tool from the following Microsoft Web site:

   http://download.sysinternals.com/Files/Notmyfault.zip

2. Click Start, locate and right-click Command Prompt, and then click Run as administrator.
3. At the command line, type NotMyfault.exe /crash, and then press ENTER.

Note This will generate a memory dump file and a "Stop D1" error.

How to generate a manual memory dump file by using the keyboard

• If you are using a PS/2 keyboard, you have to create the

  CrashOnCtrlScroll

  registry entry. For more information about how to generate a memory dump file by using the keyboard, click the following article number to view the article in the Microsoft Knowledge Base:

  244139  Windows feature lets you generate a memory dump file by using the keyboard

• If you are using a USB keyboard, this feature is not supported in Windows Server 2008 Service Pack 1 until you install hotfix KB 971284. For more information about using the hotfix, click the following article number to view the article in the Microsoft Knowledge Base:

  971284  A hotfix is available to enable crash on CTRL-SCROLL support on Vista S about using the hotfix and Windows Server 2008 on a USB keyboard

  However, it is supported in Windows Server 2008 Service Pack 2 or later versions. You must create the CrashOnCtrlScroll registry entry on the Windows Server 2008-based computer for this feature to work. To enable the feature on a computer that uses a USB keyboard, follow these steps:
  

  1. Start Registry Editor.
  2. Locate and then click the following registry subkey:

     HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kbdhid\Parameters

  3. On the Edit menu, click Add Value, and then add the following registry entry.

     Name : CrashOnCtrlScroll 
     Data Type : REG_DWORD 
     Value : 1 

  4. Exit Registry Editor.
  5. Restart the computer. (On a computer that uses a USB keyboard, you do not have to restart the computer. Unplugging the keyboard and plugging it back again is sufficient. After that, the Memory dump file can be generated.)
  Note The keyboard operation will generate a memory dump file and a "Stop E2" error.
  This hotfix is included in Service Pack 2 for Windows Vista and Windows Server 2008.

From my testing – I could not get the manual method to work, so I tried the Sysinternals one  which worked well for me.

Linux

The easiest way I found to crash a Linux machine was to issue the following command at command prompt

echo c > /proc/sysrq-trigger

Which of course produces this:

I wish for you that may these be the only crashes you encounter in your day.

Hope you enjoyed the ride…

Thank you William Lam @lamw!!!!!!!

Due to William's How to Run Windows 8 on vSphere 5 (for reals) post I can now try out
Windows 8 Developer Preview on my ESX boxes.

This was resolved in patch ESXi500-201112001 - it just seems that no-one told us until now.. It would be very interesting to hear what actually changed in this patch.

Running on Workstation was not a good option for me. My lab is on ESX boxes.

But now I am happy - and I can start to finally get to know the new OS.

I would close up what we have learned from part 1 and part 2. During my work with the VMware Support on this case, one of the questions I asked, was is it possible to to inject a parameter into the customization process, but the only option was to import a full sysprep file. This would in essence break a good deal of the automation process, such as the rename of the OS to match the deployed VM name. So this was out of the question.

Unfortunately there was not much I could do here. So I rebuilt a new VM. But I had to take some certain precautions. Once your KMS is registered in the DNS and new OS connects to the network and gets an IP, it automatically looks up for a DNS record for the KMS server and will activate - which is exactly what I did not want.

The machine was started disconnected from the external network. I applied a MAK Key to the machine and then connected it to the network. Once a machine is activated with a MAK key, it will not try to contact a KMS server, so I was set.

So just to re-cap

1. Build your VM
2. Customize the OS - including your default profile settings
3. Do not connect it to the network
4. Install a MAK Key
5. Connect to the network
6. Activate the MAK key

The last part of the puzzle was how to change the MAK key to KMS for all the VM's that will be deployed from this template? This was actually the easiest part. In the Customization Spec you can enter a License Key, and yep you guessed it here you insert the MAK key.

Machine is deployed, the Customization Spec injects the xml (with the MAK key) into the VM, the vm is sysprep'ed (without a problem because you have 3 ReArms left) and when it comes back up automatically is activated with the KMS server.

A few things still puzzle me though. All of this worked - flawlessly on vCenter 4.0 - I did not have to go through this whole process with MAK and KMS and USD and BS! So did something change? Was there a change in the way the machines are customized from the previous version?

The deployment and templates were a bit icky after the upgrade.  I could not edit of my previous templates in vCenter - they all had to be re-registered VMware KB………

I also had another issue of not being able to deploy any templates at all (Windows / Linux) with customization until the vCenter Server got a kick in the butt and was restarted.

Small little things that do not add up. I am happy to say that I did manage to educate VMware support a bit on how this works, and in turn I learned a decent amount in the process of how the VMware deployment process works as well. All in all it was an educating experience all around. I was told that the information learned from this case will possibly be used in a VMware KB for all of our benefit.

On to solve the next problem. Hope you enjoyed this series of posts.

Continuing the problem from part 1.

Over the past 8 months this template has been updated with Microsoft security patches (released once a month) and during that time the template OS was activated - while connected to the network.

After the upgrade to 4.1, I noticed that I could no longer deploy a Windows 2008 R2 template with customization. (There were several issues here. In the beginning I could not deploy a template at all - but after a restart of the vCenter server and an SR submitted to VMware on the issue that was solved). But when customizing the the template - either with a manual Customization Spec or with a previous one we had been using for almost a year, the customization would not work. None of it.

Now this can become extremely annoying. Because once you get used to working with deploying a template with a customization spec, to do it manually takes time and can be cumbersome and prone to inconsistencies.The VM name would not be changed, network settings would not work, VM's were not being deployed with their vNIC's connected. There of course is a workaround to the whole problem, to do it manually but as I said before, this is not ideal.

Last week I finally found the reason this was happening, and partly for my own benefit (documentation) and to share the experience, let me explain what was happening.
When a Windows (7 or 2008) OS is activated with a MAK License Key, the OS is automatically set with a ReArm count of 3. This you you can see with a running the following command.

C:\Users\msaidelk>cscript c:\Windows\system32\slmgr.vbs -dlv
Microsoft (R) Windows Script Host Version 5.8
Copyright (C) Microsoft Corporation. All rights reserved.
Software licensing service version: 6.1.7600.16385
Name: Windows(R) 7, Enterprise edition
Description: Windows Operating System - Windows(R) 7, VOLUME_MAK channel
Activation ID: xxxxx-xxxxx-xxx-ad1e-7fe15931a8dd
Application ID: xxxxx-xxxxx-xxx-983e-d6ec3f16059f
Extended PID: xxxxx-xxxxx-xxx-132882-03-1033-7600.0000-2292010
Installation ID: xxxxx-xxxxx-xxx0249086468222046584484281164682806770
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: xxxxx
License Status: Licensed
Remaining Windows rearm count: 3
Trusted time: 04/01/2011 08:56:51

An OS which is licensed with a KMS License will look like this

C:\Windows\system32>cscript slmgr.vbs -dlv
Microsoft (R) Windows Script Host Version 5.8
Copyright (C) Microsoft Corporation. All rights reserved.
Software licensing service version: 6.1.7601.17105
Name: Windows Server(R), ServerStandard edition
Description: Windows Operating System - Windows Server(R), VOLUME_KMSCLIENT channel
Activation ID: xxxxx-xxxxx-xxx-97be-d11a0f55633f
Application ID: xxxxx-xxxxx-xxx983e-d6ec3f16059f
Extended PID: xxxxx-xxxxx-xxx-03-1037-7600.0000-0132010
Installation ID: xxxxxxxxxxxxx073476703659683995395732413372005
Partial Product Key: xxxHC
License Status: Licensed
Volume activation expiration: 253260 minute(s) (175 day(s))
Evaluation End Date: 01/12/2011 01:59:59
Remaining Windows rearm count: 1
Trusted time: 16/01/2011 23:27:12
Key Management Service client information
    Client Machine ID (CMID): a41eaf55-64a2-4509-ac85-2118804023f0
    KMS machine name from DNS: ilkms.maishsk.local:1688
    KMS machine extended PID: xxxxx-xxxxx-xxx-021634-03-1033-7600.0000-0132010
    Activation interval: 120 minutes
    Renewal interval: 10080 minutes
    KMS host caching is enabled

Once your OS has been activated through a KMS server - your ReArm count will be set to 1. If you try and change it back to a MAK key thereafter - the Rearm count will still be kept as 1.
So what happened? Somewhere along the way, my template was was activated with a KMS Key - which meant I only had 1 ReArm left.

During the deployment process of a VM with a Customization Spec, a number of files files are injected into the VM by vCenter.

Expanding C:\Windows\TEMP\vmw979D.tmp\guestcustutil.exe
Expanding C:\Windows\TEMP\vmw979D.tmp\imgcust-reboot.exe
Expanding C:\Windows\TEMP\vmw979D.tmp\sysprep\guestcustutil.exe
Expanding C:\Windows\TEMP\vmw979D.tmp\sysprep\sysprep.xml
Expanding C:\Windows\TEMP\vmw979D.tmp\sysprepDecrypter.exe
These files are then moved later on to c:\Sysprep
Moving directory 'sysprep' to 'C:'
vCenter takes the information passed from the the Customization Spec, decrypts the info and creates a new sysprep.xml file which is then in turn called from the customization process
Executing command C:\windows\system32\sysprep\sysprep.exe /quiet /generalize /oobe /reboot /unattend:C:\sysprep\sysprep.xml

Now how do I know all of this? A bit of reverse engineering. The deployment logs are located in C:\Windows\Temp\vmware-imc. The Sysprep logs are located here: C:\Windows\System32\sysprep\Panther

Two log files are created during the Sysprep process - setupacct.log and setuperr.log The first is the activity of the Sysprep and the second reports the errors that occurred.
When deploying a VM with an activated KMS license - I was getting these errors from the setuperr.log

2010-01-14 09:42:42, Error      [0x0f00a4] SYSPRP WinMain: Unable to parse command-line arguments to sysprep; GLE = 0x36b7[gle=0x000036b7]
2010-01-14 09:42:57, Error      [0x0f0043] SYSPRP WinMain:The sysprep dialog box returned FALSE
2010-01-14 09:43:04, Error      [0x0f0060] SYSPRP ParseCommands:Found unsupported command line option '/?'[gle=0x000036b7]
2010-01-14 09:43:04, Error      [0x0f00a4] SYSPRP WinMain: Unable to parse command-line arguments to sysprep; GLE = 0x36b7[gle=0x000036b7]
2011-01-12 11:18:48, Error      [0x0f0082] SYSPRP LaunchDll:Failure occurred while executing 'C:\Windows\System32\slc.dll,SLReArmWindows', returned error code -1073425657
2011-01-12 11:18:48, Error      [0x0f0070] SYSPRP RunExternalDlls:An error occurred while running registry sysprep DLLs, halting sysprep execution. dwRet = -1073425657
2011-01-12 11:18:48, Error      [0x0f00a8] SYSPRP WinMain:Hit failure while processing sysprep generalize internal providers; hr = 0xc004d307

Even though there was 1 left on my ReArm count this was not working. A quick syprep on the machine attested to that fact.

We will now close this series with how the problem was solved in Part 3.

I have been dealing with an issue that has been bugging me for quite a while. It has to do with the deployment of Windows 7 or Windows 2008 R2 VM's and License Activation.

First let's describe the environment and situation. The whole infrastructure is at 4.1, vCenter and all ESX hosts as well. It was upgraded recently from 4.0. 7 months ago I created my templates - with all my customizations. Some of these customizations included different OS settings, menu sizes, toolbars etc. In order to copy all of these settings to the default profile, once upon a time all you had to do was to copy that current user profile to the Default User Profile, and subsequently every user than would logon thereafter would have all those settings defined. Starting with Windows 7 and 2008 (perhaps also Vista - I am not sure, we gave this version a skip) this was not the recommended way to this. There is a detailed Microsoft KB that explains the method - which is to Sysprep the machine and provide a setting in the unattend.xml file which will copy the profile. This can be done manually but that is not recommended. You should use the WAIK. This tool is available from Microsoft.

After installing the software you attach a Operating System Image and create an answer file. In that answer file you can search for the Copy Profile option and set:

<CopyProfile>true</CopyProfile>

My first problem I ran into then was that I was not aware of the fact you can only Sysprep a machine 3 times, thereafter you will not be able to do it any more. This of course led me to a problem of after making changes to the VM and Sysprep'ing again and again and again - I could no longer continue with this Template (Thank you VMware for snapshots!!).

Failure occurred while executing 'C:\Windows\System32\slc.dll,SLReArmWindows', returned error code -1073425657

There is a solution to this issue which can avoided by adding an additional flag to the unattend.xml file <SkipReArm>1</SkipReArm>.

The Activation grace period is typically 30 days. It begins after Windows Setup finishes and the computer boots for the first time. While there is no limit to the number of times that the Sysprep command can run on a computer, there is a limit to the number of times Windows can be rearmed. Typically, a system can be rearmed only three times. Using this setting enables you to run the Sysprep command multiple times without resetting the activation clock.

And now I finally had my template customized, and ready for deployment.

Now over the past 8 months the we have implemented a Microsoft KMS server. Before that let us go into what has changed since the days of XP/2003 in terms of licensing/activation. With Windows 2003/XP organizations were provided with a VL (Volume License) Key. That meant I could put the serial number in the image / template / Sysprep file for each and every machine. Once installed there was no further action needed. Starting with 2008/Windows (remember we skipped Vista) we were provided with 2 different License Keys, a MAK key and a KMS Key.

Frequently Asked Questions About Volume License Keys. A MAK key is one that you add to the OS and that has to be activated with Microsoft. This can be done over the internet or with the VAMT (I will not go into how to provide a proper licensing mechanism for your OS's in your organization). This is not an automatic process and for a small amount of OS's it is quite suitable. Christian Mohn has created a good explanation of how to use this tool. But when you are talking about hundreds and thousands of operating systems, this does not scale well. Also not always do you want to open your firewall to allow each and every computer to activate with a Microsoft Server somewhere "out there". Therefore Microsoft introduced the KMS (Key Management Server). It is a role that you can install on Windows Server 2008 which will act as your activation server for all OS's in the organization. There is a record in the DNS that is created which each new OS will look for by default and if found will activate the OS - automatically. Much better for a bigger environment.

We will continue into part 2 of this series with the issue at hand.

I have been entrusted with converting a large number of Virtual machines that are currently hosted on Xen Server into the VMware Infrastructure.

There are all sorts of ways of migrating these a virtual machine exporting to VMDK's, Xen can export to a VMDK, convert to an OVF, other tools etc. I have found that the easiest way for the conversion is to treat the XEN VM as a live machine.

Besides all the different other lessons I am learning regarding the ins-and-outs of Xen Server  and their virtual machines, and all kinds of gotchas that you need to prepare for (look out for them in the upcoming blog posts). During the testing of the process, I noticed something quite interesting.

So the Xen VM is running either RHEL 4 / RHEL 5 / Windows XP / Windows 2003.

Importing Virtual machines directly with the vCenter Enterprise Converter is supports Windows targets only.

So in order to simplify the process and not have to use two different tools and procedures, I went with the vCenter Converter Standalone 4.0.1 for both flavors.

I will not put you through the steps on how to convert the live machine - you can actually refer to this post from a quite a while back.

Once the conversion starts - a new VM is created - as per your input, but this is where it differs.

A Linux conversion. The VM is powered on, connected to the network, booted with the helper ISO and the conversion begins. Creation of the partitions and copying them over one by one. Here are the screen shots of the converter and the details of the process in the vCenter as well.

And now a windows conversion. The VM is created but not powered on. The copy of the data actually takes place directly into the VM without having to use the Helper VM. Look at the screenshot below.

I find this quite interesting because I it seems that the conversion is occurring somehow in the background without having to use the helper VM. And even more so - if this can be done for a windows VM - why can this not be done also with a Linux VM?

I would be very interested in hearing if you have any more insight as to what happens in the background during the Windows Conversion.

Hope you enjoyed the ride.

I received a number of comments on my previous post and offline as well I want to clear up some things regarding the previous post.

I am not against virtualizing domain controllers - not at all. I am against trying to P2V a domain controller. It seems that was not clear enough from the last post. I do still advise that if your risk analysis - you should do that before virtualizing your domain controllers (or anything else for that matter) comes out that it is more cost effective to keep one Physical DC then do so. There are a number of reasons to go either way - it all depends on your environment and what you are willing to risk.

It will save you so much headache and anguish - if you would just promote a new clean VM to a Domain controller.

Now lets go into a a good reason (or two) why you should actually virtualize your domain controllers

1. Domain Controllers do not need that many resources
   
    
   Of course there is a whole science behind this and a good amount planning guides out there - you can see that a domain controller does not need that many resources. It has relatively stable RAM usage (loading the AD database into RAM is mostly what it does) - CPU usage will depend on the authentication traffic - same with Network and Disk IO.
   The resource usage can be predicted very well - so you can plan the resources for such a Machine.
2. You should have more than one - if you don't then you are not doing your job correctly. But that means if your one of your Domain controllers fail - because your ESX host failed - then you are still up and running - because you have another DC running (either on an ESX host or physical).
3. Testing purposes. You need to prepare your AD Schema for the upgrade to Exchange 2010. Even though the schema extension is a Microsoft product, and has probably been tested countless amount of times with all levels of AD Domains. But of course every domain is different. And no matter how many times Microsoft have tested it - it has not been tested on my domain, in my environment, with my applications.
   So for this I would need to test the upgrade. So what better way to do it on a replica of my Production Environment.
   All I need need to do is to power off the DC, copy the VM to a closed lab environment, power them both back on, fix up a whole bunch of stuff to get it working in the lab without access to the outside world, and hey I have a full replica of my production domain that I can test.

So as you can see there are benefits to virtualizing your DC's - just a few of them above.

What other benefits would you add to the above list? I would appreciate your comments.

Do you know the feeling?

You have 40 domain controllers located in 20 different locations - with a multitude of child domains and children of those child domains, on all sides of the globe (yeah I know a globe does not have sides….), with different people at different levels of expertise managing these DC's? Sound familiar?

And for some reason someone went on vacation and forgot to clean up a movie that they put on the DC's C: drive - because they had nowhere else to put it? (well I am joking of course - but the reasons for disk space running out could be for multitude of reasons).

And the C: drive has no more free space.

And therefore the DC's stops responding properly.

And your start getting replication errors between the Domain Controllers.

So do you know the feeling??

Now of course you could have someone (or something monitor your logs for you - but not necessarily would you catch the replication issue - because you would have to monitor more than just one DC).

Well thanks to Microsoft there is small tool which will give you the replication status and if you would like it can do a whole lot more than that, but for this example the replication status will suffice.

Repadmin - and if you have not used it before then I suggest you get to know the tool.

repadmin.exe /showrepl * /csv

Ok .. Whoopee! And now what do I do with that info? Well you could:

1. open it in Excel and
2. filter out all the values that have 0 failures
3. and then see where the issues are

That would be nice… but not automated!!

What if you could get the data, filter out to retrieve only what you wanted (which would be all the failures) and send it to an admin by mail. And to make your life complete (just kidding), have this run on a regular schedule?

Here you are.

# ==============================================================================================
# NAME: Check-Replication
# 
# AUTHOR: Maish Saidel-Keesing
# DATE  : 27/04/2010
# 
# COMMENT: Will check the replication status and if there are failures will send an email to the
# Assigned Addresses.
# ** Requires Repadmin from the Windows resource Kit accessible in the default path **
# ==============================================================================================

$from = "Replication Status<maishsk@gmail.com>"
$to = "Maish<maishsk@gmail.com>"
#Collect the replication info

#Check the Replication with Repadmin
$workfile = D:\software\USB_Tool_Kit\Tools\repadmin.exe /showrepl * /csv 
$results = ConvertFrom-Csv -InputObject $workfile | where {$_.'Number of Failures' -ge 1}


#Here you set the tolerance level for the report
$results = $results | where {$_.'Number of Failures' -gt 1 }

if ($results -ne $null ) {
	$results = $results | select "Source DC", "Naming Context", "Destination DC" ,"Number of Failures", "Last Failure Time", "Last Success Time", "Last Failure Status" | ConvertTo-Html
	} else {
	$results = "There were no Replication Errors"
}

Send-MailMessage -From $from -To $to -Subject "Daily Forest Replication Status" -SmtpServer "smtp.maishsk.local" -BodyAsHtml ($results | Out-String)

Line 17. Run the command and put it into CSV format

Line 18. Convert the results from the variable into a variable and filter them

Lines 20-24. If the results are not empty (which means you have errors) then apply some formatting to the output and convert that output to HTML. If there were no errors then set the variable to show that fact.

Line 26. Send the results by email

So from going from lines and lines of this

to this - which I can get in my inbox every 4 hours because it is now running as a scheduled task.

or this if all is fine and dandy

Hope this is useful to someone!

--UPDATE--

I updated the script above to remove the use of a temporary file - it was not necessary - everything can be saved into variables and clean up some logic.

P2V a machine - who does not want to get rid of all their physical machines to get the rid of the old hardware? If so raise you hand!

So now that we have that out the way - P2V'ing a Windows 2000 Operating System is not always as straight forward as a the other operating systems.

Take into account the following scenario. you have a Windows 2000 SP6 Server running a customized app. You start the Convert process, either using Converter Standalone - or the Guided consolation plug-in. You let the process run - and anything from 45minutes to  hours later - you have a new VM registered in you virtual infrastructure.

Yey! - But - the conversion process - reported as failed somewhere between 97-99%.

The VM - is there so you power on the VM - and BAM! Blue Screen!!!

• STOP 0x7B INACCESSIBLE_BOOT_DEVICE

or

• STOP 0x0000007B INACCESSIBLE_BOOT_DEVICE

And of course I could not boot the converted machine.

This brought me to this KB article on VMware's site - which provided this solution
Injecting SCSI controller device drivers into Windows

Before you convert the virtual machine you should perform the following on the source OS.

All Windows Versions (vmscsi only)

To copy the appropriate disk controller driver from a working virtual machine with a Windows guest operating system:

Download the VMware SCSI Disk Controller driver diskette here.

Copy the contents of the floppy either by mounting it or extracting the files

Right-click vmscsi.inf and click Install. The VMware SCSI drivers are installed.

Restart the source machine to complete installation.

Windows XP / 2000 / NT (buslogic and vmscsi)

Find a working VM installed with the same OS. Export these 3 registry keys.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BusLogic

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CriticalDeviceDatabase\
pci#ven_104b&dev_1040

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vmscsi

(Note: The vmscsi service registry key may not exist if VMware Tools is not installed on the virtual machine.)

Import these 3 registry keys onto your source machine.

Perform your conversion

Windows 2003 (lsilogic and vmscsi)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\symmpi

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CriticalDeviceDatabase\
pci#ven_1000&dev_0030

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vmscsi

(Note: The vmscsi service registry key may not exist if VMware Tools is not installed on the virtual machine.)

Import the registry keys onto your source machine.

Restart the source to complete installation.

Perform another conversion with VMware Converter.

Now will this be needed every time? No! I have performed many a P2V on all of the above Operating Systems - without any problems at all and without injecting the registry keys beforehand. But for the case that the conversion will fail  - this should help you out immensely.

Personally -  I would make this best practice and inject the drivers in by default.

I was asked to day at work, "What would be the quickest way to add all of the members of a Distribution Group to a Security Group?", the reason of course being because you cannot assign permissions to a Distribution group.

My answer was, "To script it."

And I never would have thought how easy it would be

Get-QADGroupMember "My_DG_GROUP" | Add-QADMemberOf -Group "MY_SG_GROUP"
 

• Amount of time spent on Task: 30 seconds
• Financial investment in that task: Depends on how much you make per hour :)
• The reaction I got for doing something so complicated "so quickly": PRICELESS!!!!!

Something that I do every now and again (almost every day - many times per day) is to connect to the Event Viewer / Computer Management / Services console of a Remote Windows machine for troubleshooting purposes.

Now of course you could do it like this:

Start -> Run -> compmgmt.msc

Right-Click -> Connect to another computer -> <Computer_Name> -> OK

or you could make it even shorter

Start -> Run -> compmgmt.msc /computer:<Computer_Name>

But after spending some time reading about Powershell today, I decided since I have a Powershell prompt open the whole time would it not be easier to do it in Powershell as well? And maybe also do it one command with switches?

The result is the function below:

function manage-server {
    param ()
    	if ($args.count -eq 0)  {
            do {
    	       $compname = Read-Host "Which server would you like to connect to?"
            } until ($compname -ne $null)
        } else {
        $Compname = $args[0]
    	}
        if ($args[1] -eq $null) {
            do {
                $task = read-host "Which task would you like to perform? [Manage/Event/Services]"
            } until (($task -match "manage") -OR ($task -match "event") -OR ($task -match "services"))
        } else {
        $task = $args[1]
        }

    switch ($task) {
        Manage   {compmgmt.msc /computer:$compname}
        Event    {eventvwr.msc /computer:$compname}
        Services {services.msc /computer:$compname}
    }    
}

And to make it even shorter you can create an Alias for the command

New-Alias -Name manage -Value manage-server -Description "Quick Remote Manage Server"

3-5. If the Server name is not entered you will be prompted for input.

10-13. If you have not entered which task you would like to perform - you will be prompted.

18-22. A Switch statement on the task variable will perform the correct task.

I am loving Powershell more and more and more!!

Ladies and Gentlemen!!!

Because I have seen two such posts in almost as many days here and here - dealing with installation of vCenter Server on Windows 2008 R2 (which of course is 64-bit only)  I feel it is important to point out that this is not a good idea and to bring your attention to the
vSphere Compatibility Matrix - pg.18.

vCenter is not supported (as of today) running on Windows 2008 R2!!!!!!!!!!!

Will it work on Windows 2008 R2? -- Yes!!

Does vSphere client run on Windows 2008 R2? -- Yes!!

Does Update Manager run on Windows 2008 R2?? -- Yes!!

Are you willing to risk the fact that your infrastructure is running on an unsupported platform - and if you run into a problem that is OS related - you are on your own?? I for sure am not!!
For a test Environment or a lab - sure no problem - why not. But I would not do it (and refused) for my Production Infrastructure.

Until VMware updates the above document - I would strongly advise that if you want to install vCenter on Windows 2008 - do so on Windows 2008 64-bit SP2 - that way you can still upgrade to R2 when the OS becomes officially supported.

Personally I think it it is a technicality that the QC process was not completed on Windows 2008 R2 before the release of 4.0 Update 1 - and it will be just a matter of time until it is added in ….

I have been busy with using Powershell in these past few days.

I would like to share with you two of the scripts that I used lately. They were both used because of a password change that was made on a service account.

Now the thing about service accounts in Windows 2003 is, they are good, they need elevated privileges in some cases, and since the account is used for the specific purpose then you know that you have to change it once in a while and you know where. Problem is though unless you catch them all – and someone – somewhere  did not update the password somewhere, then you will start having issues with account lockouts.

First is to get all the services from all the computers in my OU, and change the password

   1: $logfile = "c:\temp\results.log"

   2: $serviceaccount = "svcmacct"

   3: $password = ""

   4:  

   5: $serviceslist = Get-QADComputer -SearchRoot "OU=Public Servers,DC=maishsk,DC=local" -OsName window* -searchscope "subtree" -ErrorAction SilentlyContinue | ` 

   6: ForEach-Object {

   7:     (Get-WmiObject -Class Win32_Service -ComputerName $_.Name -ErrorAction  `

   8:             SilentlyContinue | where {

   9:                 $_.'StartName' -like $serviceaccount

  10:             }

  11:     ) 

  12: }

  13:  

  14: [System.Reflection.Assembly]::LoadWithPartialName('system.serviceprocess')

  15:  

  17:     ForEach ($line in $serviceslist) {

  18:         Write-Host Processing $line.Systemname

  19:         $service = Get-WmiObject win32_Service -ComputerName $line.Systemname -Filter "Name='$($line.Name)'"

  20:         Write-host Stopping Service $line.Name

  21:         (new-object System.ServiceProcess.ServiceController($($line.Name),$($line.Systemname))).Stop()

  22:         (new-object System.ServiceProcess.ServiceController($($line.Name),$($line.Systemname))).WaitForStatus('Stopped',(new-timespan -seconds 90)) 

  23:         if ($? -eq $true) {

  24:         $service.Change($null ,$null ,$null ,$null ,$null ,$null , $serviceAccount, $password )

  25:         Write-host Starting Service $line.Name

  26:         (new-object System.ServiceProcess.ServiceController($($line.Name),$($line.Systemname))).Start()

  27:         (new-object System.ServiceProcess.ServiceController($($line.Name),$($line.Systemname))).WaitForStatus('Running',(new-timespan -seconds 40)) 

  28:         write-output $(get-date -DisplayHint time)` --` Service` $($line.Caption)` on` $($line.SystemName)` has` been` updated` and` restarted >> $logfile

  29:         } else {

  30:         write-output $(get-date -DisplayHint time)` --` Service` $($line.Caption)` on` $($line.SystemName)` update` failed >> $logfile

  31:         }

  32: }

Line 5 – get all the computers in the desired OU and get the services.

Line 22 – Here is a wait statement for the service to stop, otherwise this will cause issues with the rest of script. Please remember that the time span is there to ensure that if something goes wrong – then you script will continue, otherwise you will have to close the shell window - Ctrl+C will not work.

Line 28 – logs the results to a file including a time stamp.

Second script was to change the passwords for all the scheduled tasks using this same service account

   1:  

   2: $mycomps = Get-QADComputer -SearchRoot "maishsk.local/Public Servers" -SearchScope Subtree -SizeLimit 0 

   3:  

   4: $logfile = "c:\temp\tasklist.csv"

   5: $results = "c:\temp\results.log"

   6:  

   7: $report = @()

   8: $mycomps | ForEach-Object -ErrorAction SilentlyContinue {

   9:     schtasks.exe /s $_.Name /query /v /fo csv >> $logfile 2>>c:\temp\errors.txt

  10:     }

  11: $report = import-Csv $logfile

  12:  

  13: ##Get all tasks that are run under a certain user

  14: $svcaccount = Read-Host "Please Enter Service account Name (Domain\Username)"

  15: $mytasks = ""

  16: $mytasks = $report | Where-Object {($_."Run As User" -like $svcaccount) -and ($_."Next Run Time" -ne "Disabled")} | select Hostname, TaskName

  17: #Remove unwanted Characters

  18: $mytasks | ForEach-Object {

  19:     $_.TaskName = ($_.TaskName).Trimstart("\")

  20:     }

  21:  

  22: ##Change credentials for the task

  23:  

  24: foreach ($task in $mytasks) {

  25:     schtasks.exe /change /S $($task.HostName) /TN "$($task.Taskname)" /RP $password >> $results 2>>c:\temp\errors.txt

  26: }

Line 9 – schtasks.exe is the was I decided to go to get the info – I could not find anything else in Powershell that would extract the info.

Line 18-19 – the output came back with an extra “\” in the beginning – I used the Trimstart method to remove it.

Line 25 – This actually took a while to find the exact syntax that I was looking for.

If you have any comments or  improvements I would appreciate you input.

I was asked to update an attribute of the EmployeeNumber for each and every user in the Enterprise for a new Application that will be using the newly populated attribute for a Global Database application.

I had several examples that I could use for the job utilizing VbScript – but I wanted to use Powershell for the task.

It turned out to be a relatively easy task – using the Quest Active Directory Commandlets.

   1: add-PSSnapin quest.activeroles.admanagement 

   2:  

   3: Connect-QADService -Service domain.com -Credential (Get-Credential)

   4:  

   5: $infile = Import-Csv "c:\temp\file.csv"

   6:  

   7: $logfile = "c:\temp\logfile.log"

   8: foreach ($line in $infile) {

   9:         set-QADObject ($line.domain +"\" + $line.login) -ObjectAttributes `

  10:             @{employeeNumber=$line.guid} 

  11:         if ($? -eq $true){

  12:         Write-output "Updated: $($line.domain)\$($line.login) with employeeNumber: `

  13:             $($line.guid)" >>  $logfile

  14:         } else {

  15:         Write-output "Error in updating: $($line.domain)\$($line.login)" >> $logfile

  16:         } 

  17:     }    

  18:  

  19: ##Get Results

  20: $results = foreach ($line in $infile) {

  21:     get-QADObject ($line.domain +"\" + $line.login) -IncludedProperties ` 

  22:         Name, employeeNumber | select Name, employeeNumber 

  23:     } 

  24: $results >> $logfile

  25:  

  26: Disconnect-QADService -Service domain.com

A Quick explanation:

Line 1: Add the Quest Snapin

Line 3: Connect to the domain with acquired credentials

Lines 5-7: import the CSV file that was formatted - domain,login,guid, and create a log file for results

Lines 8-17: Go through each line in the CSV – if successful log to the file and if not then report the error to the log file.

Lines 20-24: Go through the list of users again – retrieving only the Name and EmployeeNumber properties and pipe the results in the same log file.

The script to a longer to write than it did to run.

Hope you enjoyed the ride.

VMware have released an official KB regarding the problem that we have all known about for
ummm… how long is it already :) ?

Cannot launch vSphere Client after installing in Windows 7 or Windows 2008 R2

I guess that all the traffic that Joep Piscaer was getting on his blog post on the subject will start to slow down now.

VMware – we are still waiting on a permanent fix for this!

VMware Update Manager is the Enterprise tool for Patching your ESX Hosts and for some also the tool used to patch your Windows / Linux Guests as well.

This is all fine and dandy, but what is you do not have all of your ESXi hosts connected to your vCenter?

Why would you so that – you may ask? Well in my environment, we have several labs that are running their Environment on a ESXi Whitebox,with the free ESXi License. No vCenter, and central management is not that easy.

Now you could update all of these hosts with the VMware infrastructure Update Client and I showed in a previous post – how you can upgrade from ESX3i to ESX4i with this tool. To update the patches is more or less the same.

Today I was asked to automate this process for a number of ESX3i hosts that were all at
build 123629 (ESX3i U2) and update them to build 199239 (ESX3i U4).

I did this with the GUI client, but it was too cumbersome, so I looked for another method.

I downloaded the package from VMware. This contents of the zip file are below.

As you can see the contents of this bundle contain 3 separate Updates.

(The three ESXi patches for Firmware "I", VMware Tools "T," and the VI Client "C" are contained in a single offline "O" download file.)

After Unpacking the 3 patches I was left with this:

In each folder there is an exe file:

The Command Syntax:

C:\ESXe350-200910402-T-BG>remoteInstall.exe

Allowed options:
  -? [ --help ]         Display program usage

  -h [ --host ] arg     ESX host name
  -u [ --userName ] arg User name
  -p [ --password ] arg Password

So all you need to do is:

remoteInstall.exe –h <HOSTNAME> –u <USERNAME> –p <PASSWORD>

While the patch is installing the output on the screen is is the progress:

progress: 0
progress: 5
progress: 7
.
.
.
progress: 100

Run this for both 3 patches, reboot your ESXi Host, and you are done

To automate the process I created  a small batch file update.bat (I did not use Powershell – because not all the end-users have Powershell installed – YET!! )

echo off

set host=%1
set user=%2
set password=%3

if "%1" == "" goto error
if "%2" == "" goto error
if "%3" == "" goto error

for /f "tokens=*" %%i in ('dir *. /b') do (
cd %%i
echo Installing patch %%i .....
remoteinstall.exe -h %host% -u %user% -p %password%
cd ..
)
echo Patching Complete !!

:error
echo ==========================================================
echo = Missing command line parameter!
echo ==========================================================
echo =
echo = Command Line Parameters:
echo =         update.bat hostname/ip username password
echo =
echo = Example:
echo =         update.bat 1.1.1.1 root 123456
echo ==========================================================
goto end

:end

The script accepts 3 parameters: user host password, for example:

update.bat myesxhost root 123456

Reboot your host – and yep you are upgraded.

And thanks to Dave Mishchenko for the information.