How-to: ESX4.1 using Vmotion with Local Host Only Storage

Can you vMotion using local ESX host storage?

 

Oh man the VCPs out there are screaming “No!!! You can’t vMotion Local Storage!”. Oh to the contrary my friend, with a wee bit of ingenuity you can do many things. Now before I go any further I will state the obvious. As any VCP will tell you, you can’t vMotion the local host storage.  But… but.. You can convert the local storage in to shared storage. This is not supported by VMware so do not expect a lot of tech support but let me lay it out for you.

You have several ESX or ESXi hosts running on “Local” storage and have a license in vCenter for the vMotion abilities, but if you don’t want or can’t afford to buy some big ISCSI SANS unit, you will not be able to use your vMotion. The standard Dell Power Vault cost a few pennies and you just don’t have the doe. Here is what you can do.

Virtualize the Local Storage with a SAN VM

 

That’s right!! Create a single VM that consumse all your local storage and let it present ISCSI LUNS back to your ESX hosts.

 

We will build our first VM on the ESX host as a virtual SANdevice. The reason we do the first VM as we will be using it’s storage to build the rest of our VMs on. Leveraging the power of open source software and using the google archive of information on how to setup and use the Openfiler SANS OS is imperative. You want to look at Open Filer. It is a simple ISO image you can run from CD or just mount using NFS or from your vCenter client. It installs very easily and can be configured in less than 20 minutes.

You would build the first VM with all the storage you have available giving this storage then to the Openfiler system to use for your SANS storage. I will not go in to the install of Openfiler here but if you follow the simple instructions you will have a ISCSI SANS with the total amount of available storage of your host system.

You will now have the first host storage shared out as ISCSI and you will connect all hosts via ISCSI to these new LUNs you created in the SANS. See VMware knowledge base for information on how to do this. (It is simple, just outside the scope of this conceptiul article). Now repeat this on all host in your infrastructure. You now have some number of host all with 1 VM installed as a virtual SAN with ISCSI sharing out LUNs to all the host in your infrastructure.

You will now in vCenter set the priority boot options to make sure that the SAN VM is the first to boot and has time to come up and get going before any other VMs boot and you can now install VMs on any of the ISCSI LUNs presented to the hosts.  Do vMotion, Storage vMotion, HA, DRS and the new FT on any of the VMs.

ESX is  available to download as a 60 day full eval, so give it and vCenter a try for sixty days while trying this platform layout. You can use VMware workstation to virtualize the whole thing, from the ESX Hosts to the vSAN VM and any VMs after that. That is also correct… You can virtualize ESX hosts now and then run VMs on those ESX VMs. Is that not just the bomb! I can create and test different ESX deployments inside a VM group inside of VMware workstation.  Build and test complex layouts with out bringing your production environments in to the picture.

Now that I have your mind turning and thinking of all the posibilities, get out and VM something!

Good luck and enjoy…

Cubert

Synchronization with your iPhone failed for 1 items Entourage & Outlook 2011 & Exchange

 

Synchronization with your iPhone failed for 1 items.
The following items couldn’t be sent to your mobile phone. They haven’t been deleted. You should be able to access them using either Outlook or Outlook Web App.
 
        Item Folder:       Inbox
        Item Type:       IPM.Schedule.Meeting.Resp.Pos
        Item Created:       1/11/2010 2:34:18 p.m.
        Item Subject:       Accepted: MyMeetingTest

This problem may occurs when the Accepted: or Declined: email that come back from booking a meeting with a resource or person is opened from Entourage before it was opened with the Iphone. It is related to the unread/read mark placed on the email.

If you leave the Accepted/Declined messages unread you do not get the “Synchronization with your mobile failed for 1 items” but once you have read the message you start getting the errors. What really is happening (or not happening for that matter) is that the message remains unread on the mobile device. So for some reason Exchange is not transferring the read/unread mark to the mobile device as expected.

If you then look at the message on the device it says “This message cannot be displayed because of the way it is formatted. Ask the sender to send it again using a different format or email program. text/plain”

Now if you open the Accepted/Declined message on the device before it has been read on the Entourage client it then reads fine “Your request was accepted” and no errors show up.

It appears to be an problem with Microsoft clients (Entourage & Outlook 2011 and Exchange 2010 and some reports on 2007) .

We have been waiting for Microsoft to release a fix for this issue to which the just did on May 25, 2011 with the release of Update Rollup 3 for Exchange Server 2010 Service Pack 1.

http://support.microsoft.com/kb/2529939

Recursive Access Control Lists with Max Depth

Here is a Visual Basics script I put together which will list all of the Access Control Lists (ACL’s) for all folders in a particular directory.

It allows you to specify a start point and a max depth to recurse.

I needed this so that I could generate a report listing the ACLS’s for various shares. It uses the CACLS executable and as long as you have access to the shares it should run without issue. (However, as with anything Microsoft, I make no guarantees that it will function properly on your system). I tried to account for various idiosyncrasies’ in the way windows operates but if you find a bug, let us know and we will try to correct it.

Download -> ACL List script

How-to Allow End Users To Manage Exchange 2010 (SP1) Distribution Groups

Distribution Groups in Exchange 2010 are managed from the OWA or what it’s now know as Outlook Web App. Owners of a distribution list can manage there own distribution list if you have correctly set the feature RBAC (Role Based Access Control)in Exchange 2010.  As you can guess Microsoft Exchange Server 2010 now comes with the new RBAC (Role Based Access Control) permissions model. This new permissions model allows you to define both a broad, as well as a more granular assignment of permissions.

While you can perform granular assignments in Exchange 2010, there are also Predefined Role Groups that you can use if you want an easier way of assigning permissions to end users. Below I will walk you through a very quick and easy way to provide end users the ability to modify distribution groups.

First we will need to create a new custom role based on the default ‘MyDistributionGroups’ Role. To do this we will use the Exchange Management Shell in Exchange 2010 aka Powershell with Exchange Modules.

Open up the Exchange Shell and copy and paste the following:

New-ManagementRole -Name MyUsersDistributionGroups -Parent MyDistributionGroups –Description “This role enables individual users to view distribution groups and add or remove members to distribution groups they own.”

The above cmd  made a new role based on MyDistributionGroups, we need to make change to this new role because we don’t want all the same settings as MyDistributionGroups.

Next we need to modify the new role.

Remove-ManagementRoleEntry MyUsersDistributionGroups\Set-Group -Confirm:$false
Remove-ManagementRoleEntry MyUsersDistributionGroups\Remove-DistributionGroup -Confirm:$false
Remove-ManagementRoleEntry MyUsersDistributionGroups\New-DistributionGroup -Confirm:$false

Then we set the DistributionGroup parameters:

set-ManagementRoleEntry MyUsersDistributionGroups\Set-DistributionGroup -parameter Confirm ,ErrorAction ,ErrorVariable ,Identity ,MailTip ,MailTipTranslations , OutBuffer ,OutVariable ,WarningAction ,WarningVariable ,WhatIf

Then finally we need to apply this role to our users. For all people to get these setting you must add the new role to the existing “Default Role Assignment Policy” which is applied to every one.

New-ManagementRoleAssignment -Role MyUsersDistributionGroups -Policy “Default Role Assignment Policy”

Once that’s done you must add the user who will manage group to the distribution list so the user can modify the members of the Distribution Group. This is done inside the Exchange Management Console under recipients / Distribution Groups.  Find the Group you want to allow the user to manage and place them in the “Managed By” box under the Group Information Tab.

 

That’s It!!!  Now we let the user login to the Outlook Web App and make  modifications to the distribution groups the now own. To make edits they should login and select the options menu then select all options. It will display a menu that will provide access to Groups. Select groups and you should see 2 lists, The 1st list is all groups your a member of and the 2nd list is all groups you own or manage. Double click the group name to manage that group and its memberships.

 

 

I hope this helps someone else get group management working after a upgrade from Exchange 2007, and in less time than it took me.

Enjoy

Cubert

How to launch control panel items or objects from a RUN or CMD line.

Sometimes it is just simpler to run from CMD line control panel objects. It is even easier to get a user who does not have the menu items available to hand them a “RUN” CMD to open the correct control panel object you need them to. Below is a list of all the control panel objects just type the CMD in the RUN or DOS windows and you place a user right where you need them.

Accessibility Options
 access.cpl

Add/Remove Programs
 appwiz.cpl

Add Hardware Wizard
 hdwwiz.cpl

Automatic Updates
 wuaucpl.cpl
 
Bluetooth Properties
 bthprops.cpl
 
Display Properties
 desk.cpl
 
Firewall Properties
 firewall.cpl
 
Game Controllers
 joy.cpl
 
Internet Options
 inetcpl.cpl

iSCSI Initiator
 iscsicpl.cpl
 
Java Control Panel
 jpicpl32.cpl
  
Licensing Mode
 liccpa.cpl
 
Mouse Properties
 main.cpl
 
Network Connections
 ncpa.cpl

Network Setup Wizard
 netsetup.cpl
 
ODBC Properties
 odbccp32.cpl
 
Power Options
 powercfg.cpl
 
Regional and Language Options
 intl.cpl
 
Sound and Audio Devices
 mmsys.cpl

Stored Passwords
 keymgr.cpl

System Properties
 sysdm.cpl
 
Telephone and Modem Properties
 telephon.cpl

Time and Date Settings
 timedate.cpl
 
User Accounts
nusrmgr.cpl
 
Windows Security Center
 wscui.cpl

Wireless Link
 irprops.cpl

 

This works on Windows XP, Windows Vista, Windows 7, Windows server 2003 a/ R2 and Windows Server 2008 / R2

Repair and Reset TCP/IP Winsock Catalog Corruption in Windows Vista or Windows 7

Winsock 2 accommodates layered protocols. A layered protocol is one that implements only higher level communications functions, while relying on an underlying transport stack for the actual exchange of data with a remote endpoint. LSP  aka Layered Service Provider can be a security layer that adds protocol to the connection establishment process. An example of an LSP is the Microsoft Firewall Client Service Provider installed as part of the Internet Secutity and Authentication Server (ISA) on clients. The Microsoft Firewall Client Service Provider installs over the Winsock base providers for TCP and UDP.

To check which LSPs installed on your Windows Vista or Windows 7, use netsh winsock show catalog command.

Sometimes the winsock settings in Windows may get corrupted, causing errors and problems with Internet connectivity. When Winsock corrupts, the networking errors that you may face include unable to access network services, web pages, Windows update services or other odd network behaviors.

Now to reset Winsock we can use a similar cmd “netsh winsock reset”. 
What netsh winsock reset command does is it resets Winsock Catalog to a clean state or default configuration. It will remove anyWinsock LSP (Layered Service Providers) previously installed, including any potentially malfunctioning LSP that may cause the loss of network packets or transmission failures. So any previously installed LSPmust be reinstalled. This command does not affect Winsock Name Space Providers.

To repair and reset the Windows Vista or Windows 7

  1. Click on Start button.
  2. Type Cmd in the Start Search text box.
  3. Press Ctrl-Shift-Enter keyboard shortcut to run Command Prompt as Administrator. Allow elevation request.
  4. Type netsh winsock reset in the Command Prompt shell, and then press the Enter key.
  5. Restart the computer.

Good luck,

Cubert

The User Profile Service Service failed the logon. User profile cannot be loaded, when logging on to Windows 7 or Windows Vista

Ever get this when logging in to a Vista or Windows 7 system?  I seem to get it all the time, here is how to quickly fix it. By the way that is not a typo in my subjectline but how the error shows up when you try logging in. Not sure why but I am guessing that “User Profile Service is a Service and thus the “User Profile Service Service”  as the title of this post.

Log in with a admin account and run regedit. Go to the following key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

You will find a key or maybe several keys that have “.bak” extenion on them. You will also find the same key with out the “.bak“, Rename the key without  the  “.bak”  to same name + “.new” then rename the Key with “.bak” removing the “.bak“.  Basically we are making the .bak key the original key and so forth.


Now that you have that done we need to edit 2 keys inside of the newly renamed key.  Choose the folder without .bak, in the right pane, double click RefCount and type 0 and then click OK, next choose the folder without .bak, in the right pane, double click State and type 0 and then click OK.

Close the regedit and logout and back in as the user profile that was failing. It should allow you in now.

I hope this helps someone out there

Cubert

Weird Network Issues, Can’t surf the web or web applications are failing but ping and DNS works?

There are many symptoms that may arise when you are installing a new firewall on a network that is using a DSL circuit and the MTU is not set correctly. That’s right the MTU, Max transmission Unit as it is know is a happy 1500 bytes on any Ethernet,  that medium makes up most endpoint networks on the Internet. Most admins never think about what the MTU is set at the gateway device, when they forget to realize that the circuit to the Internet is a DSL circuit they may see things on the network that can’t seem to explain.

MTU is the maximum packet size (in bytes) that can be transported reliably across any particular network; IP Ethernet in this case. The maximum size of an IP Ethernet packet is 1500, but overhead like IP, TCP, and PPPoE must also be taken into account. The wrong MTU will actually prevent you from accessing some web sites or FTP sites. It may even cause you to not authenticate properly on mail servers or secure web sites. There are too many variables to be able to estimate what your optimum MTU should be but my rule of thumb is -32bytes which makes the MTU 1468.

If your running a VPN to a remote domain and you are having domain failures that don’t seem to make since? Some people have no issues and others fail with different errors when the should work?

Only some websites working correctly?

DNS and ping work but other services  may fail like mail or ftp?

What maybe taking place is a conflict in the MTU available on a DSL circuit. The Ethernet is placing packets on the wire at up to 1500 bytes each but the DSL has only 14XX bytes available to it so a fragment has to take place that ends up breaking the request being made.

It is simple to overcome such a issue by setting the MTU of your firewalls DSL facing Ethernet device. This will then cause the firewall to regulate the MTU and control the MTU going out to the DSL circuit.

You can also change the MTU in a Windows workstation so it will not send out a packet bigger than what the DSL circuit can handle.

To do this edit the registry with REGEDIT and change the following key.

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\
Interfaces\[Adapter ID]]

Value Name: MTU
Data Type: REG_DWORD (DWORD Value)
Value Data: Default = 0xffffffff (1500)

This will fix the Windows system but I prefer to do it at the firewall so one edit changes all systems. Do what you need to do.

Hope this helps someone out there

 

Cubert

Monitor a WD ShareSpace using XYMon on any remote network

Do you happen to be a systems support guy who needs a method of getting the basic stats of a WD ShareSpace into your XYmon or MAG monitor? If you are like me then you are a systems admin responsible for many different networks spread across the Internet. You then may have deployed a few NAS systems including the WD ShareSpace that runs a version of BusyBox Linux. This is good news because WD provides access to the shell over SSH if you enable it via the web admin (advanced section). So now go enable SSH access and then puttythe system using the username “root” and a password of “welc0me”  where the 0 in welc0me is a zero.

With shell access we can do many things, one of which is getting the stats from the system.  Currently we have only 1 method to get the stats to XYmon but we are exploring some custom XYmon client binaries we can distribute in future versions of this article.  That may make this article a mute point so check back every so often for updates.

Today we have to do monitoring in 2 parts,

#1 Have a script on WD ShareSpace running on a regular intervals, that executes  the basic commands to produce the files we need to stat the system in XYmon.

#2 Have a Windows system grab the stat files from WD ShareSpace and process them before sending them on to the XYMon server.

First script is the WD Sharespace script which is a very simple shell script that does nothing more then cat to several text files ( meminfo, df, du, uptime and load) and saves them to a share on the WD ShareSpace called Public. You can modify the script to place files on any share you want. The script should then be executed with the following command while SSHed in to the WD ShareSpace

The first time you run the script you will need to make it executible. To do so type:

chmod 0755 ./Report.sh

The to run the shell script type:

Report.sh &

This will place the script in the background as a process and release your shell so you can logout without stopping the script. The script will run then sleep for 5 minutes then run again replacing files with updated files every 5 minutes until you stop it(which should be never).  You will need to change the permissions on the files the first time you run script so that the report files are world readable. To do this use the following command.

chmod 0777 ./*report.txt

We now have stat files on a share that we want to “FTP” off. The key word here is FTP so we will want to allow anonymous FTP to the WD ShareSpace. Login to the web admin of the WD ShareSpace and enable FTP on the device. This allows the Perl script we use next to grab the stat files, process them and then send them on to the XYmon sever via a proxy connection.

WDShareSpace Scripts

The next step is to setup the Windows system to proxy the stats to the remote XYMon server. I normally use one of the Windows server we monitor via XYMon but if this is the only thing you monitor then a windows desktop can be used as well. Either way you will need a Active State Perl set up on a Windows box to be the proxy.

Today the script is Perl, tomorrow it could be a Powershell or some other language suitable for Windows but for today it’s Perl. Perl is not native to Windows so you will need to add it’s language to Windows by the way of Active State Perl for Windows. To install ASP go to Active State Perl.  Install Perl and make sure you select to place Perl in the PATH variables with in Windows during install process. Now download our Perl script and place it in  a directory on your Windows server.

You should edit the script variables so that it reflects your setups, (Share to look for files in, the name of the WDShareSpace as seen on XYMon server ).  The run the Windows Scheduler and create a new daily schedule to run the perl script “WdShareSpace.pl”. After creating the daily schedule go back in and edit the schedule and select the advanced section. Find the “run every” and set it to 5 minutes and the in the “run for” place in 24 for 24 hours a day. This will get the script running every 5 minutes which is the same schedule as the shell script running on the NAS so you will get updates every 5 minutes.

So to summarize:

We have 2 scripts (Report.sh and WDSharespace.pl) Report.sh runs on the NAS and after permissions are changed it is executed with the (&) symbol after it so it drops to the background and keeps running when you close the ssh window. This script creates a set of report text files in the same directory as the script. The WDShareSpace.pl runs on Windows with Active State Perl installed and it has several varibles in script that need to be edited to point it to the NAS and XYMon servers and it is scheduled to run inside of Windows Scheduler(AT) on a 5 minute interval.

If all is successful you should get some thing like the following in your XYmon server if you configured the BBHOST for the WDShareSpace HOST.

Disk view:

How to close cmd or command window after executing a program

Get the CMD.exe Window to close

Do you ever have a bat or cmd file that you have written to do something like update a config file then launch a application or process, and have it fail to close the cmd window after it completes even with the “EXIT” command placed at the end of script?

Yes? Funny…  me too.

Here is what I found fixes the issue.

I have a script that updates the desktop gadgets your profile should launch upon login.  Pretty simple script, it copies the settings.ini file from a network share and places it in your profile directory under “sidebar” and then launches sidebar.exe with a switch. This is a great script for controlling the gadgets seen on a users desktop. (Script example below if you want it)

The problem I was having with this script was I was trying to launch the sidebar application after the update and that was causing the cmd window not to close after it launched the application.

C:\Program Files\Windows Sidebar\sidebar.exe” /autostart

Here is the trick to get a cmd that fails to release after launch in a batch file to actually release.

start “” “C:\Program Files\Windows Sidebar\sidebar.exe” /autostart

If you look at the command, I use the “start” cmd and then supply (“”) a literal nothing as a switch to the “start” cmd. Then in quotes (if spaces exist) the command to run.

Wow, the window now closes after it launches the sidebar application.

I hope this helps some scripter out there with login scripts they are writing. Below you will find a copy of my login script to set gadgets up on Desktop when a user logs in.

 

Here is a little more about the “load default gadgets at login” script.

[Force default gadgets to load on the desktop when a user logs in]

How to force default gadgets on a users desktop, First off to get started you need to setup a profile and launch the gadgets you want on the desktop. Move them where you want them to be on the desktop so that they are placed in the areas you want them. We have dual monitors across our tech team so we placed all gadgets on second monitor.

Now go grab the config file you just created by moving and launching the gadgets you wanted. The default location for the gadget config file in a users profile is:

%userprofile%\AppData\Local\Microsoft\Windows Sidebar\Settings.ini

Lastly we create a batch file to recopy this file each time a user logs in and then launches the sidebar application.

 

Create a new batch file called gadgets.bat then place the following in the file.

REM @echo off
taskkill /IM sidebar.exe /f
copy /Z /Y \\myserver\myshare\Settings.ini  “%userprofile%\AppData\Local\Microsoft\Windows Sidebar\”
start “” “C:\Program Files\Windows Sidebar\sidebar.exe” /autostart

Copy the Settings.ini file to a network share. Edit the “myserver” and the “myshare” to represent your network share that holds the “Settings.ini” file.

Then add it to your users login script active directory properties.  You can also just copy and paste the lines in to an existing login script if your using them to do other things like mapping drives or printers and such.

Download script -> Launch Default Gadgets batch file