Running Windows 8 on VM

Past few months were really exciting with all the System Center 2012 testing and this month was even more exciting with Windows 8 preview. I presented SCCM 2012 technical overview to Singapore Windows User Group, http://sgwindowsgroup.org/blogs/swug/archive/2011/09/08/september-2011-newsletter.aspx and it was well received!

Now is time to get started with Windows Server 8! If you are just like me, trying to setup Windows 8 on Virtual PC or Hyper-V, you might encounter an error. There are fixes out there to make it work, however, the easy way around is to use Oracle VM VirtualBox.

Have fun!

Hyper-V on Windows 8 Client

It is such a good news to hear that Microsoft will include Hyper-V in Windows 8 client OS. Hyper-V requires a 64-bit system that has Second Level Address Translation (SLAT) in the current generation of 64 bit processors by Intel and AMD, and at least 4GB of RAM.

This enables you to run multiple test environments and provide a simple mechanism to quickly switch between these environments without incurring additional hardware costs.

Read about it here.

Redirect a user profile to a network storage

Enterprise Security is always a hot topic and there are so many areas to cover in terms of Enterprise Security. Personally, I think of two areas at a very high level. The End-Point and the Network. These are two areas to begin with if you want to start focusing on Enterprise Security.

I will begin a series of blog post on Enterprise Security in the coming weeks, months or years. This is the first blog post on Enterprise Security and I am going to illustrate how to use GPO to lock down a user profile to a network location.

First, let me explain the synopsis. Every company will always want to protect its data from being leak into the hands of its competitors. Sadly, the primary source of leak is usually from internal, yes from its employees. How many of you have copy data into your USB storage devices? Let me remind you that every piece of work that you do at work belongs to the company. So as part of IT Enterprise Security, you have to ensure that these confidential data does not leave your company.

So this blog post I will illustrate how to create folder redirection to redirect a user profile to a network storage. There are a few benefits of doing this.

1. User data is not stored locally on hard disk. Data will reside on your file server.
2. User can logon to any computer as their profile are now on network storage. No worries of client hardware failure.
3. User will not scream at you when their desktop hard disk crashed and they lost all their years of work.
4. User Group Policy to set disk quotas, limiting how much space is taken up by user profile folders.

Folder Redirection is located under \User Configuration\Policies\Windows Settings\Folder Redirection.

The Target tab of the folder’s Properties box enables you to select the location of the redirected folder on a network storage. You can choose a few options from the drop-down list.

• Basic – Redirect everyone’s folder to the same location
• Redirect to the following location
• Redirect to the local user profile location
• Advanced-Specify locations for various user group
• Follow the Documents folder. (Available only for Music, Pictures and Videos folder)

The Settings tab in the Properties box for a folder enable you to configure the follow settings:

• Grant the user exclusive rights
• Move the contents of [FolderName] to the new location
• Also apply redirection policy to Windows 2000, Windows 2000 Server, Windows XP, and Windows Server 2003 operating systems.
• Policy Removal

This is the first series of locking down an End-Point client by storing its data on a network storage instead of having it on local hard disks. To find out more, please read refer to TechNet.

Microsoft shows off early peek at Windows Server 8

Today Microsoft provided a brief peek at Windows Server 8. Mary-Jo Foley blogs about it live from WPC. Check out her blog post here.

In summary, three points were covered at WPC.

16+ virtual processors within a Hyper-V VM. The team did a demo on a 16 virtual processor machine under heavy load. Note that 16 virtual processor is not the limit!

Hyper-V Replica. This is something very interesting in today’s context to achieve resiliency. Hyper-V Replica is asynchronous, application consistent and has virtual machine replication built-in. You can replicate from one location to another, independent of hardware vendor, regardless its server, network or storage.

Unlimited replication in the box. This feature is to challenge VMWare VSphere 5.0 VM replication with Site Recovery Manager. Hyper-V provides unlimited replication in the box while VMWare is charging customers per VM to replicate.

MICROSOFT HYPER-V SERVER 2008 R2 SP1 RELEASED!

The good news just keeps coming and we’re pleased to keep the momentum rolling with the latest release of our rock stable, feature rich, standalone Microsoft Hyper-V Server 2008 R2 with Service Pack 1! For those who need a refresher on Microsoft Hyper-V Server 2008 R2, it includes key features based on customer feedback such as:

• Live Migration
• High Availability with Failover Clustering
• Cluster Shared Volumes
• 10 Gb/E Ready
• Processor Compatibility Mode
• Enhanced Scalability
• …and much more.

For more info on Microsoft Hyper-V Server 2008 R2, read: http://blogs.technet.com/b/virtualization/archive/2009/07/30/microsoft-hyper-v-server-2008-r2-rtm-more.aspx. Service Pack 1 for Hyper-V Server 2008 R2 includes all the rollup fixes released since Microsoft Hyper-V Server 2008 R2 and adds two new features that greatly enhance VDI scenarios:

• Dynamic Memory
• RemoteFX

After installing the update, both Dynamic Memory and RemoteFX will be available to Hyper-V Server. These new features can be managed in a number of ways:

• Using the updated R2 SP1 Hyper-V Manager user interface on a full version of Windows Server 2008 R2 SP1
• Using the updated Remote Server Administration Tools (RSAT) for Windows 7 & Windows 7 SP1
• System Center Virtual Machine Manager 2008 R2 SP1
• System Center Virtual Machine Manager 2012 Beta

Dynamic memory is an enhancement to Hyper-V R2 which pools all the memory available on a physical host and dynamically distributes it to virtual machines running on that host as necessary. That means based on changes in workload, virtual machines will be able to receive new memory allocations without a service interruption through Dynamic Memory Balancing. In short, Dynamic Memory is exactly what it’s named. If you’d like to know more, I've included numerous links on Dynamic Memory below.

Configuring RemoteFX with Microsoft Hyper-V Server 2008 R2 SP1

Although using Dynamic Memory does not need any additional server side configuration beyond installing the R2 SP1 update, enabling RemoteFX does require some additional configuration on the host.  The exact steps for enabling the RemoteFX are detailed below:

1)      Verify the host machine meets the minimum hardware requirements for RemoteFX. 

2)      Verify the host has the latest 3D graphics card drivers installed before enabling RemoteFX.

3)      Enable the RemoteFX feature using the following command line:

Dism.exe  /online /enable-feature /featurename:VmHostAgent

4)      From a remote machine running the full version of Windows Server 2008 R2 SP1 or a client OS running the latest version of RSAT, connect to the Hyper-V Server machines, create a Windows 7 R2 SP1 virtual machine and under “Add Hardware”, select “RemoteFX 3D Video Adapter”.  Select “Add”.

If the “RemoteFX 3D Video Adapter” option is greyed out, it is usually because RemoteFX is not enabled or the 3D video card drivers have not been installed on the host yet. Before attaching the RemoteFX adapter, make sure to set user access permissions, note the computer name and enable Remote Desktop within the VM first. When the RemoteFX 3D video adapter is attached to the VM, you will no longer be able to connect to the VM local console via the Hyper-V Manager Remote Connection.  You will only be able to connect to the VM via a Remote Desktop connection.  Remove the RemoteFX adapter if you ever need to use the Hyper-V Manager Remote Connection.

Now you get Microsoft iSCSI Target for FREE!

Are one of those IT Pros whom need a SAN but don’t have the budget to pay for one? You like to deploy Hyper-V clusters for the benefits of LM and HA?

You can now build your own SAN box by installing Microsoft iSCSI software target on a Windows Server 2008 R2 system.

Read about the announcement here.

Introducing Attack Surface Analyzer

Chance upon this interesting security tool that I like to share with you. Attack Surface Analyzer is a verification tool by Microsoft to catalog changes in system state, runtime parameters, and securable objects on the Windows OS. This analysis helps identify any increase in attack surface that is caused by installing applications. Because Attack Surface Analyzer does not require source code or symbol access, IT Pros and security auditors can use the tool to gain a better understanding of the aggregate attack surface change that may result from the introduction of line-of-business (LOB) applications to the Windows platform. Attack Surface Analyzer enables:

• Developers to view changes in the attack surface resulting from their applications


• IT Pros to evaluate aggregate attack surface changes by LOB applications


• IT security auditors to identify risk related to attack surface during threat risk assessments


• IT security incident responders to better understand the state of securable objects on a system during investigations

Read more and download from here.

Microsoft Virtual Academy is Launch!

Microsoft Virtual Academy (MVA) is a new training and learning resource site to help train IT Pros on Cloud Services. Check it out!! MVA

System Center Virtual Machine Manager 2008 R2 SP1 is available now

SCVMM 2008 R2 SP1 was released today.
Check it out here.

New features includes.
Dynamic Memory:

• Better utilization of memory resources on a Hyper-V host.
• Allows administrators to create and deploy Virtual Machines and report on the "currently in use" memory.
• More efficient utilization of memory, consistent performance and higher consolidation ratios.

Microsoft RemoteFX:

• Allows administrators to create and deploy Virtual Machines with RemoteFX enabled to qualified Windows Server 2008 R2 SP1 Hyper-V hosts.
• New set of end user experience enhancements.
• Rich, local-like desktop enivronment over the network.

Virtual Machine Folder ACL access denied

I upgraded a Windows 2008 Hyper-V server to R2 and one of the virtual machine failed to start with error “Account does not have sufficient priviledge to open attachment “<Virtual machine file>” (0x80070005). (Virtual machine ID <GUID>)”.

Hyper-V could not read the virtual machine files due to ACL issues. Added SYSTEM account, etc does not work as Hyper-V has it’s own Service SID “NT VIRTUAL MACHINE”

To resolve this, try the follow:

Open the directory that stores your virtual machine

Open the “Virtual Machines” subdirectory under your virtual machine directory

Record the GUID as per the file name of the .xml file in this directory

Run icacls “<virtualmachinefolder>” /grant “NT VIRTUAL MACHINE\<virtualmachineguid>”:F /T

Hosting Windows 7 VHD on Virtual PC

Follow up to my earlier post to convert your Windows 7 physical computer to virtual. Let’s create a Virtual Machine on Virtual PC to run your Windows 7 VHD.

First, you need to have your Windows Virtual PC installed. And get ready your Windows 7 DVD or ISO image.

1. Open Windows Virtual PC and click on Create Virtual Machine.

2. Give your Virtual Machine a meaningful name and specify the location to save the virtual machine file.

3. Specify the memory to allocate to this VM and specify whether you want to enable network connectivity to this VM.

4. Attached the Windows 7 VHD that you create from Disk2VHD earlier. Specify if you want to enable Undo Disk. Undo disk allows you to delete any changes you made to the VHD and recover it to its initial state.

5. Open your new VM.

6. You will encounter boot error. Attach your Windows 7 DVD or ISO to your VM and configure your VM BIOS to first boot to CDROM.

7. Reboot your VM to Windows 7 DVD and select to Repair your computer.

8. On System Recovery Options, select Repair and restart.

9. You should be able to login to your system after restart. The final step is to install Integration Components.

10. You are done after installing Integration Components!!

Converting your Windows 7 computer to VHD

Here I am working on a project to convert my Windows 7 laptop to a VHD. With this VHD I can keep my workspace regardless of hardware as long as I am able to boot from a VPC.

It also proves to be a good way to backup your computer while keeping your programs and files the way they are. You can always use a cloning tool to restore the VHD to your hard disk.

There are a few tools we need:

1. Disk2vhd – Windows Sysinternals tools http://technet.microsoft.com/en-us/sysinternals/ee656415.aspx

2. VHD Resizer – VMToolKit http://vmtoolkit.com/files/folders/converters/entry87.aspx

3. Windows Virtual PC http://www.microsoft.com/Windows/virtual-pc/default.aspx

Let’s start to convert your Windows 7 computer to VHD.

1. Run Disk2vhd, select the disk to convert to VHD. Then enter a VHD file name. Once done, click on Create to start the conversion.

2. One of the limitations of Windows Virtual PC is IDE hard disk and disk size limit of 127 GB. For those of you who’s hard disk are bigger than 127GB, you have to shrink it. To shrink the VHD, open Computer Management Console and Attach VHD.

3. Right click and bring the VHD Online.

4. Shrink the OS volume.

5. Now shrink the VHD volume to less than 127GB. Detach the VHD when shrinking completes.

6. Open VHD Resizer to resize the VHD to less than 127GB.

This completes how to convert your physical Windows 7 computer to a VHD. I will be posting an article on running this Windows 7 VHD on a Windows Virtual PC soon.

vSphere vs XenServer vs Hyper-V

For those of you trying to compare the different hypervisors, this is one good link to help you.

http://www.projectvrc.com/ Project VRC released an interesting whitepaper analyzing Terminal Services workloads running on the latest generation hardware and hypervisors in the market.

Happy reading!!

Windows XP Mode no longer requires Hardware Virtualization Technology

This must be a great piece of news for users who’s computer does not supports Hardware Virtualization Technology. This is also good news for small and medium enterprise. Now you can migrate to Windows 7 and still able to support Windows XP-based applications in Windows XP Mode.

You have to install this update package KB977206 to enable Windows XP mode on non HAV machines.

http://support.microsoft.com/kb/977206

Adding Trusted Sites to Internet Explorer using GPO

For those of you whom wanted to customize the Internet Explorer settings for your clients, you should check out IEAK – Internet Explorer Administration Kit.

In this post, I will illustrate a simple scenario where an organization with Active Directory wants to add Trusted Sites to users’ Internet Explorer settings using GPO.

Before we start doing anything, please note that on Windows Server 2003 and 2008, we have Internet Explorer Enhanced Security Configuration turned on. This will not work with Windows XP, Vista or Windows 7 clients. So to begin, we have to turn off Enhanced Security Configuration to create a GPO for computers that do not have Enhanced Security Configurations.

To disable IE ESC, open Server Manager, Security Information, click on Configure IE ESC.

Turn off Internet Explorer Enhanced Security Configurations.

Now we are ready to configure a GPO to add Trusted sites to IE settings. You can find IE configuration settings on User Configuration –> Policies –> Windows Settings –> Internet Explorer Maintenance –> Security. Open Security Zones and Content Ratings.

Under Security Zones and Privacy, select Import the current security zones and privacy settings.

You will see a pop-up that warn you that you are configuring settings for computers that don’t have IE Enhanced Security Configuration enabled.

Add your Trusted sites and you are ready to test out your new GPO.

App-V 4.6 RTM and MED-V v1 SP1 RC now available

Microsoft released App-V 4.6 and MED-V v1 SP1 RC on the 23 Feb 2010 as part of MDOP 2010. You can download App-V 4.6 from TechNet and MSDN. You can download MED-V v1 SP1 RC from Connect while we awaits the final release which is expected to come in April 2010.

Please read about it on The Official MDOP Blog here.

Linux Integration Components for Windows Server 2008 Hyper-V

This latest version 2 of Linux IC for Hyper-V was released on 29 Jan 2010. Supported Host Operating Systems includes Windows Server 2008, WIndows Server 2008 R2, Microsoft Hyper-V Server 2008, and Microsoft Hyper-V Server 2008 R2.

Supported Guest Operating Systems includes:

SUSE Linux Enterprise Server 10 SP2 x86 and x64 (1 vCPU)
SUSE Linux Enterprise Server 11 x86 and x64 (1 vCPU)
Red Hat Enterprise Linux 5.2, 5.3, and 5.4 x86 and x64 (1 vCPU)

Installing Steps are similar to my previous post here.

Create a Multiboot System for Windows 7

This is a nice way to have Windows 7 if you like to keep your existing version of Windows.

This article is on Technet Magazine. Have fun with your multiboot Windows 7. Click here.

Infrastructure Planning and Design Guides for Virtualization (IPD Guides)

Microsoft released an updated series of IDP guides which covers Windows Server 2008 R2.

If you are trying to find out more before deploying your virtualization projects or you are looking for some guides that can get you up to speed quickly to start planning, then these IPD guides are the right documents you need.

The Infrastructure Planning and Design guide series gives you architectural guidance for Microsoft infrastructure products. The IPD guides help clarify and streamline design processes for Microsoft infrastructure technologies, with each guide addressing a unique infrastructure technology or scenario.

You can either choose to download the entire IPD series or Individual guides by Scenario. Check it out guys!!

Get the Guides

• Download the entire IPD series
• Download the IPD Series Intro

Guides by Scenario

• IPD Guides for Virtualization
• IPD Guides for Windows Server
• IPD Guides for System Center
• IPD Guides for Optimized Desktop Scenarios
• IPD Guides for SQL Server
• IPD Guides for Microsoft Online Services
• IPD Guides for Security

Offline Virtual Machine Servicing Tools

Microsoft released this Offline Virtual Machine Servicing Tool 2.1 that allows you to perform operating system updates to your offline virtual machines that are stored in your Microsoft System Center Virtual Manager library.

This is helpful in keeping your offline virtual machines up-to-date so that when you create a new virtual machines from your selected library, you can confidently bring it online as it will not introduce vulnerables into your organization.

It also saved your time and effort in recreating library images when new service packs and updates are released.

Download it here. Click.