BitLocker is a useful hard drive encryption tool supported by the Enterprise and Ultimate versions of Windows7. Recovery is handled through the use of 48-digit keys that are generated for each host running BitLocker. Best practice and common sense is to configure your environment so that the recovery keys are stored in Active Directory. There are a number of scenarios in which the use of these keys are required to gain access to the OS. By default only members of the Domain Admins group has access to these keys which is very inconvenient if you have a delegated support staff that are not domain admins. 

You can grant your support group full control to the AD container housing computers with BitLocker enabled and they will still not be able to see the recovery keys. Delegation of this access is done via a script. Just copy the text below, save it to a file with a .vbs extension, and run cscript whatever.vbs from a DC or workstation with a Domain Admin logged in. The only thing you need to change in this script is the second line: enter whatever your support AD group is called here. This all of course only applies to Server 2008/R2 and Windows7.

'To refer to other groups, change the group name (ex: change to "DOMAIN\Help Desk Staff")
strGroupName = "DOMAIN\Help Desk Staff" 

' --------------------------------------------------------------------------------
' Access Control Entry (ACE) constants
' --------------------------------------------------------------------------------

'- From the ADS_ACETYPE_ENUM enumeration
Const ADS_ACETYPE_ACCESS_ALLOWED_OBJECT      = &H5  'Allows an object to do something

'- From the ADS_ACEFLAG_ENUM enumeration
Const ADS_ACEFLAG_INHERIT_ACE                = &H2  'ACE applies to target and inherited child objects
Const ADS_ACEFLAG_INHERIT_ONLY_ACE           = &H8  'ACE does NOT apply to target (parent) object

'- From the ADS_RIGHTS_ENUM enumeration
Const ADS_RIGHT_DS_CONTROL_ACCESS      = &H100 'The right to view confidential attributes
Const ADS_RIGHT_DS_READ_PROP                 = &H10  ' The right to read attribute values

'- From the ADS_FLAGTYPE_ENUM enumeration
Const ADS_FLAG_OBJECT_TYPE_PRESENT           = &H1  'Target object type is present in the ACE
Const ADS_FLAG_INHERITED_OBJECT_TYPE_PRESENT = &H2  'Target inherited object type is present in the ACE

' --------------------------------------------------------------------------------
' BitLocker schema object GUID's
' --------------------------------------------------------------------------------

'- ms-FVE-RecoveryInformation object:
'  includes the BitLocker recovery password and key package attributes
SCHEMA_GUID_MS_FVE_RECOVERYINFORMATION = "{EA715D30-8F53-40D0-BD1E-6109186D782C}"

'- ms-FVE-RecoveryPassword attribute: 48-digit numerical password
SCHEMA_GUID_MS_FVE_RECOVERYPASSWORD = "{43061AC1-C8AD-4CCC-B785-2BFAC20FC60A}"

'- ms-FVE-KeyPackage attribute: binary package for repairing damages
SCHEMA_GUID_MS_FVE_KEYPACKAGE = "{1FD55EA8-88A7-47DC-8129-0DAA97186A54}"

'- Computer object
SCHEMA_GUID_COMPUTER = "{BF967A86-0DE6-11D0-A285-00AA003049E2}"

'Reference: "Platform SDK: Active Directory Schema"

' --------------------------------------------------------------------------------
' Set up the ACE to allow reading of all BitLocker recovery information properties
' --------------------------------------------------------------------------------

Set objAce1 = createObject("AccessControlEntry")

objAce1.AceFlags = ADS_ACEFLAG_INHERIT_ACE + ADS_ACEFLAG_INHERIT_ONLY_ACE
objAce1.AceType = ADS_ACETYPE_ACCESS_ALLOWED_OBJECT
objAce1.Flags = ADS_FLAG_INHERITED_OBJECT_TYPE_PRESENT

objAce1.Trustee = strGroupName
objAce1.AccessMask = ADS_RIGHT_DS_CONTROL_ACCESS + ADS_RIGHT_DS_READ_PROP
objAce1.InheritedObjectType = SCHEMA_GUID_MS_FVE_RECOVERYINFORMATION

' Note: ObjectType is left blank above to allow reading of all properties

' --------------------------------------------------------------------------------
' Connect to Discretional ACL (DACL) for domain object
' --------------------------------------------------------------------------------

Set objRootLDAP = GetObject("LDAP://rootDSE")
strPathToDomain = "LDAP://" & objRootLDAP.Get("defaultNamingContext") ' e.g. string dc=fabrikam,dc=com

Set objDomain = GetObject(strPathToDomain)

WScript.Echo "Accessing object: " + objDomain.Get("distinguishedName")

Set objDescriptor = objDomain.Get("ntSecurityDescriptor")
Set objDacl = objDescriptor.DiscretionaryAcl
 
' --------------------------------------------------------------------------------
' Add the ACEs to the Discretionary ACL (DACL) and set the DACL
' --------------------------------------------------------------------------------

objDacl.AddAce objAce1

objDescriptor.DiscretionaryAcl = objDacl
objDomain.Put "ntSecurityDescriptor", Array(objDescriptor)
objDomain.SetInfo

WScript.Echo "SUCCESS!"

Once the script has run successfully, the BitLocker Recovery tab will now be accessible in ADUC and ADAC.

Reference:

TechNet

This one is easy to overlook and can have you scratching your head weeks to months later. Recently disk space has been mysteriously disappearing on a few select servers of mine. The free/used ratio was way out of whack with >75% of the disk being reported as used by Windows on certain drives. Auditing the drive reveals no culprit, with all visible files not consuming anything near what is being reported, including hidden files. System Volume Information reports 0 bytes and access is denied to this folder. If you use Windows Server Backup (WSB), in Server 2008 R2, and in particular VSS backups this can happen to you too (or VSS at all for that matter).

WSB uses VSS for backups and you have two choices in your backup sets: VSS full or copy backups.

In either case the backup job will create a Shadow Copy task on the volume pertaining to your backup. By default the shadow copy task is set to use no limit which will, eventually, completely consume your drive. The tricky part is that the space consumed by VSS is not visible in Windows Explorer and if you don’t set a hard limit on the shadow copy it can grow out of control.

Make sure to limit these and you should be ok. Changing no limit to use limit will immediately delete and free space on your server!

VSS settings are accessed by opening the properties of any drive in your server and selecting the Shadow Copies tab.

Here’s a  useful quick hit. By default in Windows Vista and 7 you cannot connect to administrative shares on other PCs in a workgroup (C$, admin$). This is the case even after enabling file/print sharing, opening the firewall, etc. Yes, you could just create a share on C:\ named something else but I want to connect to the hidden root without creating additional shares.

To do this open regedit and navigate to:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

Create a new 32-bit DWORD value called LocalAccountTokenFilterPolicy and set its value to 1.

Enabling this registry entry builds an elevated security token that allows for remote administration and access to the administrative shares.

Reference:

http://support.microsoft.com/kb/947232

I recently had a situation come up where I needed to change the traffic flow on my LAN for Outlook Anywhere clients that were going out to the internet to connect to our email provider (outlookanywhere.domain.com). Our provider is also accessible internally via a disparate and complicated network so the internet method was preferred due to less complexity. The Outlook Anywhere public facing servers were having problems, denying my client connections, so I needed to force the connections internally.

Caveats:

• I still want my clients to be able to access Outlook Anywhere outside the office so I can’t disable it or change the address it connects to
• HOSTS files are unmanageable
• I do not own the namespace of the servers that Outlook Anywhere connects to
• I will have to statically route to each destination in the provider’s namespace (from my core network) as our networks are connected but not well routed

To pull this off there are a few available options:

• Leverage conditional forwarders to the affected namespace
• Create a new primary DNS zone for this namespace, add the host record I need to redirect
• Create a new primary DNS zone for each FQDN that I want to redirect

The first option is the simplest, I could just route all of the requests to this domain directly to its internal DNS servers. The problem with this is that I’ll have to also statically route to every possible server/host in that network that users might access. There are too many.

The second option would also work but then I’d need to create A records for any other hosts in that namespace or clients would be unable to resolve them.  The routing problem exists here too so this is a bad option for me.

The third option is the money ticket. Using this method I can simply create a new forward lookup zone for outlookanywhere.domain.com and in that zone create a nameless A record with the internal IP of that server. Easy. I still have to statically route to this server but all other public facing resolutions will continue to work without issue. This solution will work for any external namespace if you need to redirect your internal clients somewhere else.

Citrix currently has 4 flavors of XenApp (XA) being actively sold on the open market: XenApp Fundamentals for server 2008, XenApp 5 for Server 2003, XenApp 5 for Server 2008, and XenApp 6 for Server 2008 R2. For the most part these all look and feel the same from an end user experience perspective. The value for XenApp in my environment is twofold: managing legacy “problem” applications centrally and providing a secure remote access alternative to traditional VPN for my users. While it’s tempting to jump straight to XA6, my first objective prevents this as many of my problem business applications won’t run on Server 2008 R2 (Windows 7) nor on a 64-bit OS. 

Another tool in the Citrix arsenal is application streaming which is the new, and only, version of application isolation. Streaming is available on Advanced, Enterprise, and Platinum versions of XA and there is a special installation method to enable this on Advanced. Streaming is similar to VMware’s ThinApp product where apps are built (profiled) separately on a workstation but published through Citrix. Another advantage is that you can stream directly to the client which will use the client’s hardware resources to run the app taking the load off of the server. Some published limitations exist for streamed apps, however, that include anything requiring special drivers or certain .NET apps.

Planning and design

Unlike XA Fundamentals, the full version of the product contains several roles which can all be distributed depending on your environment. The basic server functions in a XA farm are infrastructure servers and application publishing servers. Infrastructure servers handle the functions not related to directly presenting applications to end users. These roles include licensing, data store, zone data collector, web interface, and XML service broker. These roles are well documented and all relate to farm communication and user application presentation. Best practice is to have at least one infrastructure server that will not publish apps to your users and then at least one publishing server. This design model scales easily depending on the size of your organization and performance requirements.

My deployment will consist of 5 servers, all server 2008 R1 x86, all VMs, running on a highly-available ESX4 cluster. 1 x infrastructure server, 3 x publishing servers, and 1 Citrix Secure Gateway (CSG) server. My infrastructure server will host all core roles including the Web Interface (WI) to publish the PNAgent config.xml. Given the size of my organization I have no need to house the data store in a full blown SQL server so I will use the local SQL Express option. Even smaller organizations can use an Access database as well.

My 3 publishing servers will be configured in dual-mode to host both published and streamed apps. 2 of the servers will host identical applications so connections can be load-balanced while the third will be used to host a business application that can only be used with Office 2003. I plan to stream these 2 apps together but I also want to be able to publish these apps externally via a web interface.

My CSG server will be configured to run the gateway and WI for external users to connect to. It will  be configured in a single-hop DMZ design. Dual-hop would separate the CSG from the WI on different servers in different DMZs but I don’t have a need to do that now. The firewall will need to be configured to allow the CSG server to talk to each of the publishers via TCP/1494 (ICA), TCP/2598 (session reliability), and TCP/80 for the XML service (optionally configured to use HTTPS). The CSG will also need to be able to talk to the infrastructure server on TCP/80 for XML/ STA (Secure Ticket Authority) services. There is no need to open anything further to the infrastructure server.

Here is the logical architecture for my deployment:

Infrastructure Server Installation

There are plenty of walk-throughs that take you step-by-step through the install process, check out http://www.dabcc.com for some good ones. I want to discuss some of the less documented gotchas that I ran across during my build-out. One of my big complaints with XA5 is the handling of pre-requisites. While this is much improved in XA6, XA5 is pretty painful in this regard depending on which components you install. There are 3 main roles that will be needed on the infrastructure server: terminal services, application server, and web server. My TS licensing is hosted on another server so I only need to install the actual TS component. Please note that EVERY XA server that you turn up, including the infrastructure server, requires terminal services to be installed. Even though your infrastructure server will not be publishing apps, it will be fully capable of doing so. XA cannot be installed without the TS role installed first!

Each component of the XA setup wizard will prompt you for the role services that it needs for the install to complete, but you will have to restart the wizard each time if you are missing anything.  To save you the trouble ensure that the following IIS role services are installed before you launch setup (make sure to also enable Windows Authentication under security, not shown):

Optionally add the COM+ Network Access role service to the Application Server role if you want to be able to remotely manage your server from the Access Management Console (AMC):

You will also need the latest x86 JRE installed for the licensing server component. Important to note is that you will need the x86 JRE even on an x64 server!

If you plan to use SQL Express for the data store, go ahead and get this ready now as well because the setup wizard will not do it for you. Run SetupSqlExpressForCPS.cmd in DVDRoot\Support\SqlExpress_2005_SP2. It will instal SQL Express 2005 SP2 and create a database called CITRIX_METAFRAME that the XA setup will look for if you choose the SQL Express installation option. Citrix strongly recommends that you do not install SQL Server on your XA server, only Access or SQL Express.

With those pieces installed you should be good to kick off the XA installer. XA5 doesn’t really break out individual roles like “XML broker” or “zone data collector”, much of it is implied. Such as the first server in a farm automatically becomes the XML broker, STA, and zone data collector. All servers will run the XML Service but only the XML broker will be running IIS which can share the same port. Any of the servers are capable of becoming the Zone Data Collector, controlled via election preferences, which is controlled in the Advanced Configuration tool. If you are installing Advanced Edition and plan to use Application Streaming, you must run the Platinum Edition installer! The server edition will be changed later in the AMC.

Select the Application Virtualization option next which will launch the installer for all common components. On your infrastructure server enable all options, for you publishers all you need is the Access Management Console and XenApp:

Here is why you run the Platinum installer with the intention of ultimately running Advanced Edition, the Advanced installer does not have this option available:

Each component will install separately and can be upgraded individually. This will provide you with the base install. There are 2 additional categories of installables after the base install: hotfixes and feature packs (FP). Hotfixes are provided per OS platform and are installed sequentially, each requiring a reboot. The feature pack, currently FP3 for XA5, includes upgrades to individual server components installed individually, such as the AMC, License server, plugins, Secure Gateway, and WI. Install your required hotfixes then upgrade the individual components included in the FP. You may not need everything in the pack. For Server 2008 R1 x86 I have the following hotfixes installed on each server in my farm. There will eventually be a hotfix rollup that bundles these but not as of this writing. I installed these in order:

XAE500W2K8005.msp
XAE500W2K8017.msp
XAE500W2K8018.msp
XAE500W2K8030.msp
XAE500W2K8042.msp
XAE500W2K8049.msp

Don’t forget to also upgrade the online and offline plugins on all XA servers! 

[Advanced only] Once installation is complete and all desired components are updated, launch the AMC, run the discovery process, navigate to your server and set the server edition to Advanced. This will allow proper licensing to work and make your publishers streaming capable:

Repeat this process on all XA servers and you’ll be ready to start installing and publishing apps. The first time you run the AMC it will run discovery on the environment, uncheck the Password Manager piece or you will get errors, unless you installed single-sign on with Platinum. The very next thing you should do is create the XenApp Services Site that clients using the online plugin will connect to. Under the Citrix Web Interface Console, right-click the XA Services Site and click create site. Once the PNAgent site is set up, right click it in the WI Console for a number of configuration options. I chose to enable pass-through authentication and made it the default, as well as enabled dual-mode for resource types, for starters. Publishing apps is fairly self-explanatory. Install the on/offline plugins on your client’s PCs and when they are granted access to applications they will see them either in the plugin, the start menu, desktop, or all three.

Citrix Secure Gateway

Both the Citrix Access Gateway (CAG) and Secure Gateway solutions accomplish the same thing, the difference being that the CAG is an appliance (not free) and the CSG (free) runs on a Windows server. The installation process is similar although you can skip right to the latest versions of both the WI and CSG. You will need a valid SSL cert on this server as it will be public facing and accepting only secure connections. When you generate your Cert request (CSR) make sure to choose at least 2048-bits as most CAs are requiring this as a minimum now. This will generate a 256-bit certificate for your site.

My goal was to provide an HTTP redirect to the gateway, so clients can connect to http, as well as host the WI on a TCP port not opened to the world. By default the WI will install into the default IIS site bound to TCP/80. I created a new site, bound to tcp/8080, where the WI would live. I left a single page in the default site that performs a simple redirect to tcp/443. The CSG is the only service that should be listening on this port. Run the WI installer first and create your XenApp Web Site in the new IIS site with port 8080. Once your new certificate is installed on your server you can run the CSG Configuration Wizard. It should find your new cert. Most of the defaults in the configuration wizard can be accepted. You will need to specify your STA server (infrastructure), as well as specify where the WI lives. If you follow my example you will need to tell the CSG that the WI is installed on the same server on TCP/8080.

Make sure to set up your WI site properly with your farm info and the appropriate secure access method. Direct is the simplest unless you’re using NAT between your DMZ and inside networks in which case you’d use gateway alternate or gateway translated. Customize your WI appearance how you like and assuming all firewall changes are in place you should now be able to access the WI externally.

At a high-level that’s it for my architecture. Citrix is a deep well and there are obviously a ton of other options and features that one could deploy. Another consideration worth pondering is user profiles. Citrix recommends using roaming TS profiles centrally stored on NAS or SAN to ensure a consistent user experience. This is easily enforced via GPO which I have employed and it works well. In combination with folder redirection this provides a very solid solution for managing your Citrix resources.

While it is ok to mix x86 and x64 servers in your XA farm, consider the implications this will have on program installations and user profiles. Published apps are defined via paths to their executables so if these paths are not the same on all of your servers you will have to make special concessions (c:\program files vs c:\program files (x86)). There are also additional differences in appdata folders used by some applications for x64 or x86 platforms. Many have had luck using the Flex Kit for managing profiles in these environments.

Although not cheap, XenApp 5 provides a very slick application delivery solution. XA5 Advanced costs in the neighborhood of $250/CCU and you also need to buy TS CALs as well. Enterprise and Platinum Editions increase costs significantly. The basic RemoteApp functionality baked into Server 2008 works well but at the sacrifice of granular presentation management, detailed performance tuning, and easy scalability. Citrix doesn’t care how many servers you put in your farm or what roles you run where, it’s all about the CCU licenses. Citrix and Microsoft have a very cohesive relationship going way back so XenApp will integrate seamlessly into your environment. One thing to watch out for is XenApp component changes to your servers after installation. I’ve noticed some finicky behavior specifically with regard to the license server component and having to reinstall it to get it working correctly again. 

Resources:

Application Streaming with XenApp Advanced

XenApp 5 Installation Guide

Citrix Secure Gateway Admin Guide

Web Interface 5.0.1 Admin Guide

The XenApp (XA) brand was a name change that continues the Citrix Presentation Server (CPS) product line. CPS 4.5 for Server 2003 ended and XenApp 5 for Server 2008 x86 began. Citrix has recently released XA 6 which is 64-bit and designed to run on Server 2008 R2. Citrix Essentials, the scaled down SMB product, was renamed to Citrix Fundamentals (XAF). XAF is akin to XA 5 functionally for all intensive purposes. XenApp 5 and 6 come in Advanced, Enterprise, and Platinum flavors, each unlocking different features.

XAF is targeted for small to medium enterprises that need only a maximum of 75 named users. That is the main drawback, concurrent licensing is not available on this platform. The idea is simplicity and XAF achieves that goal handily while providing a full XA experience. When installing XAF you are presented with 2 installation types: application or DMZ (secure gateway). The intended design is for the Secure Gateway to sit in a firewalled DMZ (single-hop) and point to the application server sitting on the LAN inside.

Installing the application server piece is incredibly simple with the installer taking care of everything including all prerequisites. Make sure to enable Remote Desktop Services prior to install with all licensing requirements taken care of.

Once the “Set Up Server” wizard launches, you have a choice to configure a stand-alone server or a server group. Advanced mode can be enabled now or later which unlocks user profile management, load balancing, and server failover. The advanced features rely heavily upon Active Directory and currently only Server 2008 R1 functional-level domains are supported. The OU structure will be created in 2008 R2 domains but the advanced mode initialization will ultimately fail. Citrix is aware of the issue and says that we should see some kind of fix in 2-3 weeks.

Once setup completes, launch the Quick Start tool and add your license file. I am using evaluation licenses provided by Citrix for this trial.

The Quick Start tool walks you through the steps to get your sever up and running, including publishing apps, linking up with the Secure Gateway (if you choose), publishing printers, and delegating administrative access. Application installations work just like any other terminal server install, start up “install app in TS-mode” and install. Then the application can be published, assigned to user groups/ servers, associated with file types, and appearance controlled. You can open the familiar Citrix Access Management console at any time to complete any of these tasks.

Performance optimizations can be set at the farm or server levels and include Session Reliability, CPU/Memory Optimization, etc.

The Web Interface is fully customizable providing options for authentication methods , secure access, and internal/external web site appearance.

The External Access server portion (Secure Gateway) is even simpler. Again all requisite components are taken care of by setup.

Once setup completes the Quick Start tools launches displaying the External Access options.

Configuring the gateway consists of specifying the FQDN it will respond to on the internet and the address of the internal Citrix application server. You can generate a temporary SSL certificate but you’ll have to install the cert and add the issuer as a trusted publisher before your applications will be usable. I opted to use a free comodo cert instead. The last step is opening TCP/1080 through your firewall from your DMZ server to your internal application server. That’s it.

The Secure Gateway has its own Web Interface which can be customized in appearance as well. Additionally you can choose which plugins to publish and whether or not the native plugin should be preferred. All of the other Web Interface options are available here as well.

The default login form is clean and simple. Domain names can be required to login using a UPN or domain\username formats. Assuming the domain name that resolves to your Secure Gateway does not have the same name as your internal domain, this can add some easy additional security.

Once authenticated, if you don’t have the Citrix client you will be directed to a screen where you can download and install it before you continue. Once installed you will be presented with your published applications. Access to your enterprise is now a click away.

Performance is very good and there are no issues running the entire solution in a virtual environment. Application Isolation as it was known in CPS is gone in XenApp, replaced by Application Streaming. This feature is only available in the Enterprise and Platinum versions. After my environment was set up, anytime I closed an app I also saw the Server 2008 logoff screen. While not a huge deal this disturbs the seamless Citrix user experience. To get around this I added a logoff script to the user portion of my terminal server baseline GPO. Create a .bat file and put the following in it, no more logoff screens:

tsdiscon %sessionname%

Licensing is roughly $100 per concurrent user for XAF, plus the TS CAL, plus any applicable application licensing. Definitely not a cheap solution, especially since Server 2008 includes Remote Apps by default. Like most out-of-the-box Microsoft solutions what they give you is adequate but if you want all the bells and whistles you have to go third-party. I plan to completely replace my legacy Cisco VPN solution with Citrix as well as provide an environment to run applications with Windows7 compatibility problems. Home user PCs and whatever nightmares they harbor will stay in their homes. Citrix provides a secure, reliable, and rich user experience that will ultimately reduce support calls and make application maintenance easier.

As with any terminal server environment, the challenges will come with publishing apps and ensuring that users have access to all the proper resources. I ran into another issue publishing Office 2003 SP3 to satisfy a companion legacy reporting application. Not having any application isolation options to publish Office 2003 along side 2007, I decided to publish Office 2003 with the 2007 compatibility pack. Office itself worked fine but to get the compatibility pack converters to work I had to use some trickery. wordconv.exe as well as the excel and ppt converters had to be added to the DEP exception list. I also had to enable compatibility mode for all users on the core executables themselves (winword.exe, etc). With these changes in place I was able to open and edit 2007 file formats without issue. All told I’m very pleased with XAF and if they fix the advanced mode compatibility issues with 2008 R2 domains I’ll be ecstatic. If anything pushes me towards XA Enterprise though, it will be application streaming.

I came across a thread in the TechNet forums discussing printer queue naming best practices. One of the Microsoft Printing Team members chimed in to explain how they do it internally in Microsoft.

At Microsoft the printer names are associated only with locations + A, B, C and CLR if it’s color.

Possible examples: Sales-A-CLR or Bldg3_Flr2_West-A

They then include more detail in the location field and device brand, model, PCL/PS, etc in the comments field. This way the queue (name) is not married to a specific printer type. When they physically replace a printer they only have to change the driver and port name, then update the comments. A very clean and simple way to do it.

When the user searches for network printers using AD they will see:

NAME (this is the share name of the print queue)

LOCATION (text has been entered in the location field of the print queue)

MODEL (driver in use on the print queue – very misleading unless 1:1 always in place)

SERVER NAME (the print server where the print queue resides)

COMMENTS (text has been entered in the comment field of the print queue)

Reference:

Technet Forums

BGInfo has been around for ages and has been a long time favorite in Windows shops all over the world. While sometimes quirky it worked fine in Server 2003 shops. Since Server 2008 dropped 2 years ago BGinfo has had to be greatly tweaked to get it to display all of the same info due to system security enhancements in Windows Server. There are 3 parts to BGInfo: bginfo.exe bginfo.bgi and bginfo.bmp. The first two parts can be stored on a file server and pointed at through a startup shortcut or copied locally and shortcutted to that way. In the shortcut the EULA has to be accepted along with any other manipulations you need (timer=0). [The executable creates a bitmap that can be stored in a location of your choosing, but all users of the system must be able to modify it.] Each time a user logs into the server the bitmap will be recreated and reapplied to the desktop background. I have had to include custom VB scripts to get the IP address and OS/Service pack fields to display properly as well. You also end up having to copy the bits to each server which makes management difficult if you ever want to make changes to the layout. Too many moving parts for such a simple end result.

Looking for a better and easier way to display the same information more dynamically across a large environment, I ran across a utility called DesktopInfo by Glenn Delahoy. Desktopinfo is a simple exe with an ini configuration file. It can live happily on a network share with no EULA to accept or any other annoying shortcut path modification requirements. The executable is loaded into memory under the context of the logged in user and displays near REAL-TIME data of the machine it’s loaded on. It runs fine on x86 or x64 machines. There are no bitmaps and the display can be moved around by dragging or by modifying the ini file.

Resource usage is incredibly low.

The ini configuration file allows for enabling/disabling a number of fields along with changing their corresponding colors. Many fields have low/high threshold characteristics that can change the color of a field like RAM usage from green to red. Currently you cannot change the order of the fields displayed or make other text edits like bolding. I wrote Glenn to compliment him on his tool and added a few wish list items that are not currently supported:

• Bolding or increasing the font size of an individual line like “Host Name” (bold and italics now available)
  
• Changing the order in which items are displayed (fixed in v1.00)
  
• Option to show the physical platform like "HP Proliant DL380..."
• (longshot) ability to set a label like "production" or "dev" based on a specified domain computer object OU location

After testing this tool for a few weeks I have rolled it into my production environment completely replacing BGInfo. To implement, I used a simple GPO Preference item that creates a startup shortcut pointing to the exe on a file share that holds the two required files. Simple and beautiful. Good bye BGInfo, you had a good run. :)

Glenn has a bunch of other cool utilities to check out as well!

Links:

Desktopinfo

Glenn’s Eclectic Freeware

I’m documenting the easy method to this process having just gone through the more round-about backdoor method. The proper process to mask and present LUNs on a NetApp array is through the creation of LUNs and iGroups (mask) which is wizard driven inside the NetApp System Manager. This can all be done, of course, via the CLI which I have done but this way is much simpler. This all assumes that you have already properly setup FCP or iSCSI on your array and that all requisite fiber-channel zoning is complete. My filers are running ONTAP 7.3.2 and I have 2 fiber-channel fabrics powered by Brocade switches.

Open System Manager and navigate to the controller node that will be hosting your LUN. Expand Storage and click LUNs. Click create under LUN Management. Enter a name for your new LUN along with the size and presentation type.

Next allow ONTAP to create a new volume or choose an existing container. I’ll create a new volume:

The next step will mask the LUN to a host of your choosing via the creation of an iGroup. Click Add Initiator Host and select the WWpN of the host HBA you wish to connect to the LUN. You can only add a single initiator in this step. Once complete move your new iGroup from “Known initiator hosts” to “Hosts to connect”.

Review the changes to be made in the summary and click next to start the process. When complete you will see your new LUN and iGroup with the host’s WWpN. By default NetApp likes to put each initiator port in its own iGroup. Because I am building a SQL cluster and need all hosts to see all of the same LUNs I will be adding all cluster members to the same iGroup. This can be done either by creating a new iGroup and selecting the WWpN you want to add followed by reassigning it to the proper iGroup, or you can copy/paste the port name into the iGroup you just created.

Make sure to enable ALUA if your array supports these features.

Verify the iGroup via the CLI if you wish by issuing the igroup show command:

Now, assuming you have ONTAP DSM (MPIO) installed, you should see the new LUN on your host.

Time services play a pivotal role in the Kerberos authentication process, so ensuring that they are set up properly is important. With the exception of a few deprecated time-related command switches, not a lot has changed with regard to time in Server 2008/ Windows 7. Having just upgraded a 2008 domain to 2008 R2 with new domain controllers I wanted to share the process of setting up time services for the domain.

By default the DC that holds the PDC Emulator role is the time keeper for the domain. Also in its default state the PDCe assumes that it is itself the stratum 1 time provider, as reflected in the registry key value \HKLM\System\CurrentControlSet\services\W32Time\Parameters: Type NT5DS. This value controls the synchronization type which specifies if time is to be received from the domain hierarchy (NT5DS) or from an external provider (NTP). The default is fine if you’re alright with the server using its own CMOS clock to provide time for the domain. In this case all you need to do is configure the Announce Flags (see KB). To force the DC to use an external time provider, on the DC that holds the PDCe role, change this value to “NTP”. Per RFC 1305 (via MS KB816042), the PDCe must not be configured to sync time with itself.

NTP.org maintains the lists for publicly accessible time servers. Pool servers, stratum 1 (primary) and stratum 2 (secondary) servers are documented here. You can configure your PDCe to point directly to several stratum 1 servers, or you could just point to the pool addresses which employs DNS round robin to ensure you always have a reliable stratum 2 time source. In this scenario I will be pointing to the US pool servers: us.pool.ntp.org.

Net Time is still alive in Server 2008 but /querysntp and /setsntp have been deprecated. Configuration must be performed via W32tm.exe. Since we now have our PDCe set to sync to an external time source, we need to configure its peer list which can be FQDNs or IPs. This is done via: w32tm /config /manualpeerlist:"0.us.pool.ntp.org 1.us.pool.ntp.org 2.us.pool.ntp.org 3.us.pool.ntp.org"

Run a quick update with w32tm /resync /rediscover then verify the configuration is working by running w32tm /query /peers /verbose

C:\Windows\system32>w32tm /query /peers /verbose
#Peers: 4

Peer: 1.us.pool.ntp.org
State: Active
Time Remaining: 37.7327154s
Mode: 1 (Symmetric Active)
Stratum: 2 (secondary reference - syncd by (S)NTP)
PeerPoll Interval: 8 (256s)
HostPoll Interval: 8 (256s)
Last Successful Sync Time: 9/1/2009 3:32:37 PM
LastSyncError: 0x00000000 (Succeeded)
LastSyncErrorMsgId: 0x00000000 (Succeeded)
AuthTypeMsgId: 0x0000005A (NoAuth )
Resolve Attempts: 0
ValidDataCounter: 8
Reachability: 255

Peer: 0.us.pool.ntp.org
State: Active
Time Remaining: 37.6859151s
Mode: 1 (Symmetric Active)
Stratum: 3 (secondary reference - syncd by (S)NTP)
PeerPoll Interval: 8 (256s)
HostPoll Interval: 8 (256s)
Last Successful Sync Time: 9/1/2009 3:32:37 PM
LastSyncError: 0x00000000 (Succeeded)
LastSyncErrorMsgId: 0x00000000 (Succeeded)
AuthTypeMsgId: 0x0000005A (NoAuth )
Resolve Attempts: 0
ValidDataCounter: 8
Reachability: 255

Peer: 2.us.pool.ntp.org
State: Active
Time Remaining: 37.6859151s
Mode: 1 (Symmetric Active)
Stratum: 2 (secondary reference - syncd by (S)NTP)
PeerPoll Interval: 8 (256s)
HostPoll Interval: 8 (256s)
Last Successful Sync Time: 9/1/2009 3:32:37 PM
LastSyncError: 0x00000000 (Succeeded)
LastSyncErrorMsgId: 0x00000000 (Succeeded)
AuthTypeMsgId: 0x0000005A (NoAuth )
Resolve Attempts: 0
ValidDataCounter: 8
Reachability: 255

Peer: 3.us.pool.ntp.org
State: Active
Time Remaining: 37.7015152s
Mode: 1 (Symmetric Active)
Stratum: 2 (secondary reference - syncd by (S)NTP)
PeerPoll Interval: 8 (256s)
HostPoll Interval: 8 (256s)
Last Successful Sync Time: 9/1/2009 3:32:37 PM
LastSyncError: 0x00000000 (Succeeded)
LastSyncErrorMsgId: 0x00000000 (Succeeded)
AuthTypeMsgId: 0x0000005A (NoAuth )
Resolve Attempts: 0
ValidDataCounter: 8
Reachability: 255

The other DCs will look to the PDCe as their time source and domain clients will look to their authenticating DC. If you need to get more granular with time services there are a few GPO settings capable of some good granularity. “Computer Configuration\ Administrative Templates\ System\ Windows Time Service” contains policy items to configure polling intervals, phase corrections, or to disable the client altogether, which is useful if you need to implement a 3rd-party NTP solution in your organization. If any other domain clients or servers need to be updated immediately, simply run w32tm /resync /rediscover.

References:

NTP.org time server lists

How to configure an authoritative time server in Windows Server

I have operated in production environments with AD accounts in full-time admin mode as well as non-privileged mode (2 accounts). In a domain setting UAC can make the later tolerable by prompting you for credentials when attempting to run an application requiring greater privileges. In the XP days this was accomplished by using “Run As”. The temptation is to just turn off UAC and run as a full-time admin but I’m trying to be good and resist this temptation, especially with Windows 7 and the new security levels UAC provides.

You can find the UAC settings able to be modified via group or local policy in Computer Configuration\Security Settings\Local Policies\Security Options:

By default, Microsoft PowerShell runs in non-privileged mode, with UAC enabled, as does the command prompt. This means that if you want to run elevated commands or applications then you would need to open another session in administrative mode (right-click—>run as administrator). In UNIX this issue is addressed with the sudo command that provides temporary elevation to “super user” status to execute an otherwise restricted process. One could then define elevated accounts via the sudoers group where you can define which accounts can be used for sudo, the goal here is to not needlessly give out the root password.

We can emulate this behavior in Windows with PowerShell with the help of UAC. If you’re only looking to executed elevated processes in PowerShell without entering alternate credentials then you can ignore the UAC piece. The first step is to create a profile in PowerShell, if you haven’t already. Enter $profile in PowerShell to show the path to the profile. The MSDN link at the bottom of this entry will give more information on the various locations profiles can exist. Test-path $profile will show you if that profile exists and if it’s operational.  If the test comes back false then you will need to create the profile first by executing:

This applies to Server 2008 R2 and Windows 7 as well, of course. While this may be old news to some, MaxPC had a good article in their latest issue about using symbolic links in Vista. To paraphrase, symbolic links are like shortcuts but at the OS level, not the file system level. Starting in Vista/Server 2008, Microsoft changed the naming convention for user profile folders which would break applications configured to point to these locations (i.e. c:\documents and settings —> c:\users).  So to preserve application functionality Windows uses symbolic links to provide a path to get to the new location via the old paths, even though they don’t exist anymore. Look inside any user’s profile and you will see what look like shortcuts to my documents, local settings, etc. These are directory symbolic links.

The command mklink is used to create links and its options include: symbolic links for a file or a directory, hard links in place of symbolic links, or directory junctions.   Directory symbolic links probably get the most use and can be useful to preserve pathing of a folder that has been moved to a new location. The original directory name becomes the symbolic link and cannot exist prior to running mklink.

C:\Windows\system32>mklink /D c:\test c:\newtest
Cannot create a file when that file already exists.

C:\Windows\system32>mklink /D c:\test c:\newtest
symbolic link created for c:\test <<===>> c:\newtest

Now any reads or writes looking for c:\test will be seamlessly pointed to c:\newtest and the application won’t know the difference. Hard links are used to point directly to a file so the OS will treat the link like it’s the actual file, while soft links behave more like shortcuts. Links can be deleted directly in the file system just like any other file or folder.

If you’ve ever tried to enable SQL Reporting Services, after the fact, on an existing SQL server you may have noticed the Reporting Services button greyed out in the setup wizard. SSRS depends heavily on IIS and needs some very specific components installed before it will become available for install. These dependencies also exist in Server 2003, of course, but enabling them is very different in Server 2008.

http://support.microsoft.com/default.aspx/kb/938245/

The aforementioned KB walks through the steps of enabling via the Server Manager MMC, so here is the list of essential IIS role services that must be available to the server before SQL setup will allow you to install SSRS:

• Static Content
• Default Document
• Directory Browsing
• HTTP Errors
• HTTP Redirection
• ASP.NET
• Windows Authentication
• IIS Metabase Compatibility
• IIS 6 WMI Compatibility
• IIS 6 Scripting Tools
• IIS 6 Management Console

I stumbled across something very interesting today regarding these two components that is worth sharing, especially for anyone else managing a Server 2008 environment. Many of us got used to disabling the firewall in Server 2003 unless we needed to solve very specific security requirements with limited resources. The Firewall in Vista/Server 2008 has been completely revamped and is now a truly stateful firewall complete with profiles, profile-specific rules, and the ability to separately manage inbound/ outbound traffic. Host-based firewalls certainly add complexity to any environment and one has to be very cognizant of hosted services as well as consuming applications and users. Troubleshooting can be frustrating if you forget that “oh yeah that server has its firewall turned on”.

In my current dev environment I disabled the firewall on all servers, 2003 and 2008, via GPO. This is how you do it in XP and 2003 so the same applies to 2008, right? While this does in fact disable the firewall in 2008, there appears to be an underlying system dependency on the firewall service in Server 2008. I installed the April Windows updates on both a Server 2008 STD (x86) VM and a Server 2008 STD (x64) physical host. After rebooting, both servers came back up fine but were completely inaccessible from the network. No PING, no RDP, no CIFS. From the servers themselves, outbound traffic flowed without issue, to the internet, ping other hosts, browsing, etc. This was baffling especially since the firewall was disabled. Nothing should be blocking traffic! I followed the usual troubleshooting methods of digging through logs, checking driver revs, I even added a new vNIC and reinstalled vmTools in my VM thinking that maybe the virtual device had become corrupted somehow. Nothing worked!!

So I decided to do a packet capture to dig a bit deeper hoping that maybe the answer would become clear in the annals of the IP stack. Ok I see ICMP echo-requests coming into the server but it’s not replying, hmm. Let’s try a telnet to TCP 3389, I see SYN messages but the server isn’t sending a SYN-ACK back, what is going on here?? It seems that the server is flat choosing to not respond to inbound traffic. The firewall is definitely disabled.

Thinking this had something to do with Windows update, I opened a sev3 case with Microsoft. In the meantime I continued to troubleshoot and finally developed a work-around before they called me back. There is no stated dependency or published best practice (that I’ve seen) that recommends leaving the firewall enabled on Server 2008 lest you risk network problems. I think most people assume that it’s a security feature that can be safely disabled without adversely affected normal server performance or function [as it should be]. To fix the problem I enabled and started the firewall service, then in the firewall management MMC set all 3 profiles to allow/allow for inbound/outbound access. Both problem servers are now accessible and functioning perfectly on the network.

This experience changes the way I will setup Server 2008 environments as it appears the firewall is a mandatory service that the network service depends upon for normal operation. Microsoft doesn’t have a KB or any information yet about this issue so the support people are kicking my case up to the product teams for review. I also submitted a change request on the Connect site so hopefully someone will take notice and at the very least write a KB stating that the firewall service is a required component of Server 2008. Ideally this dependency will be dropped altogether but we’ll see. Here is my submission:

https://connect.microsoft.com/WindowsServerFeedback/feedback/ViewFeedback.aspx?FeedbackID=464554

To sum: leave your firewalls turned on in Server 2008 and if you wish to make them transparent then do so by allowing all traffic inbound/outbound for all profiles. Don’t disable the service!!

This is great news on a long overdue feature. If you’re fortunate enough to manage a tight ship with regard to AD then you may have never had the need to restore a deleted object. In the pre-2008 R2 world if you did need to restore a deleted object then you were looking at an authoritative restore via Directory Services Restore Mode. In 2008 R2, deleted objects go to a new hidden container called “Deleted Objects”. This feature is not enabled by default but can be turned on by raising the forest functional level to 2008 R2 and by running a PowerShell script from the Active Directory Module for Powershell. For ease, import the AD cmdlets into PowerShell first by running:

Then to enable the feature (replace contoso with your domain name):

Enable-ADOptionalFeature –Identity ‘CN=Recycle Bin Feature,CN=Optional Features,CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration, DC=contoso,DC=com’ –Scope ForestOrConfigurationSet –Target ‘contoso.com’

Restores can occur via PowerShell or LDP. Via PowerShell:

Open the Active Directory PowerShell command Prompt and use the following syntax: Get-ADObject -Filter {displayName -eq "Brian"} -IncludeDeletedObjects | Restore-ADObject

Recycling Active Directory Trash [Life of Brian], [Technet]