Cisco Offers Free Nexus 1000V Integrated Switch for Hyper-V

Hyper-V 3.0 on Windows Server 2012 offers a new feature called an extensible virtual switch.  This feature allows you to replace the Windows integrated virtual switch in Hyper-V with a third-party switch, such as the Cisco 1000V.  You can get a quick overview of Hyper-V extensible virtual switches here.

The Cisco 1000V virtual switch provides many advanced capabilities to Hyper-V VMs such as advanced switching (private VLANs, ACLs, PortSecurity, and Cisco vPath), security, monitoring, and manageability.

The following information comes from Cisco's Cisco Nexus 1000V Switch for Microsoft Hyper-V website:

Features and Capabilities

The Cisco Nexus 1000V Switch for Microsoft Hyper-V:

• Offers consistent operational experience across physical, virtual, and mixed hypervisor environments
• Reduces operational complexity through dynamic policy provisioning and mobility-aware network policies
• Improves security through integrated virtual services and advanced Cisco NX-OS features

The following table summarizes the capabilities and benefits of the Cisco Nexus 1000V Switch for Microsoft Hyper-V.

Capabilities	Features	Operational Benefits
Advanced Switching	Private VLANs, Quality of Service (QoS), access control lists (ACLs), portsecurity, and Cisco vPath	Get granular control of virtual machine-to-virtual machine interaction.
Security	Dynamic Host Configuration Protocol (DHCP) Snooping, Dynamic Address Resolution Protocol Inspection, and IP Source Guard	Reduce common security threats in data center environments.
Monitoring	NetFlow, packet statistics, Switched Port Analyzer (SPAN), and Encapsulated Remote SPAN	Gain visibility into virtual machine-to-virtual machine traffic to reduce troubleshooting time.
Manageability	Simple Network Management Protocol, NetConf, syslog, and other troubleshooting command-line interfaces	Use existing network management tools to manage physical and virtual environments

The Cisco Nexus 1000V won the Best of Microsoft TechEd 2013 award in the Virtualization category.

If you're interested in learning more about the Nexus 1000V extensible switch, I encourage you to view the following 2 hour session on CiscoLive365: BRKVIR-2017. - The Nexus 1000V on Microsoft Hyper-V: Expanding the Virtual Edge (2013 London).  Free registration is required.  Bennial also posted the PowerPoint slide deck for this session on ScribD here.

Best of all it's free to download here!  The download itself is for a 60 day trial.  I received confirmation from Cisco that after 60 days you have to get a license, but it is free:

1. Go to www.cisco.com/go/license 
2. Select the License Wizard, Check Product Category, Select Nexus 1000v, Select Add a License to Rehost
3. Enter the Nexus 1000v Serial Number (obtained from the virtual switch) or the existing PAK (Prod Auth Key)
4. A license file (PAK) will be generated and emailed to you
5. Just apply the new license file

Read more ...

Get a Free Windows Azure One Month Pass

Microsoft is offering a free one month trial of their Windows Azure platform for you to use with no credit card required.  This is a great way to experience Microsoft's Platform as a Service (PaaS) to see what it is and what it can potentially do for you.

PaaS delivers a computing platform (Windows) and a solution stack (your application) from the cloud for your business and/or customers.  Microsoft Azure offers both Windows and SQL as PaaS offerings.

The free offer website also has links to videos about the Azure cloud computing platforms, virtual labs, demos and more.

Read more ...

How to Use the Windows Mobile 6.1 Device Emulator

The Windows Mobile 6.1 Emulator is a software version of a Windows Mobile phone that you can use to test Windows Mobile applications, such as Exchange ActiveSync.  This tool is enormously helpful for testing, troubleshooting, and creating documentation.

The WM emulator has been around since about 1998, but disappeared for a while, due to some legal issues.  I remember using this tool at TechEd a few years ago in a session that taught you how to create applications for Windows Mobile.  It's back now, with improved functionality and ease of use.

The emulator runs on top of Microsoft Virtual PC 2007 (a free download).  Virtual PC 2007 provides the hooks to the host operating system to provide network access and resource sharing.  This makes the emulator much simpler to configure than in the past.

You will need to download the following two packages from Microsoft:

• Virtual PC 2007 (32 or 64-bit, 30.5MB)
• Windows Mobile 6.1 Emulator Images (Standard 185MB or Professional 272MB)

Install Virtual PC 2007 first, accepting all the defaults in the setup wizard.  No further configuration of Virtual PC 2007 is required.

Next, install Windows Mobile 6.1. Emulator Images, accepting all the defaults in the setup wizard.

To configure the emulator, run it from Start > All Programs > Windows Mobile 6 SDK > Standalone Emulator Images > US English > WM 6.1 Professional.  Click File > Configure.  On the General tab, browse to your Desktop as the Shared Folder.  This will make your Desktop the external storage card on the emulator.  Now check the Network tab and check Enable NE2000 PCMCIA network adapter and bind to checkbox and click OK.  By now the emulator should have finish starting up. 

Use your mouse to configure a network connection on the emulator, as follows:

• Click Start > Settings on the emulator.
• Click the Connections tab and Connections.
• Click the Advanced tab and Select Networks.
• Select My Work Network in the top dropdown box
• If you use a proxy server to access the Internet click Edit.  Click the Proxy Settings tab, configure your proxy settings.  Use the Advanced button to configure the proxy port, user name, password, and domain.  Click OK to get back to Network Management.
• Click OK to return to Settings.
• Click Network Cards.
• In the My network card connects to dropdown box select Work
• Click NE2000 Compatible Ethernet Driver.  Check to see that the NE2000 Ethernet Driver has received an IP address from your DHCP server, or configure the IP address and name servers here.  Click OK twice to return to Settings.
• Close Settings.

Now test your Internet connectivity by clicking Start > Internet Explorer.  Enter www.microsoft.com, which will redirect to mobile.microsoft.com, as shown.

You can now use the WM 6.1 emulator just like a real hardware mobile device!  Use it to test Exchange ActiveSync, your company's AutoDiscover record, or your custom applications.  The emulator runs the exact same code that Microsoft offers to device manufacturers.

There are several Windows Mobile 6.1 Professional (touchscreen PocketPC) emulator images:

• WM 6.1 Classic
• WM 6.1 Professional (used in the screenshots above)
• WM 6.1 Professional 240x240
• WM 6.1 Professional 480x480
• WM 6.1 Professional Square
• WM 6.1 Professional Square QVGA
• WM 6.1 Professional Square VGA
• WM 6.1 Professional VGA

The Windows Mobile 6.1 Standard (non-touchscreen SmartPhone) emulator images include:

• WM 6.1 Standard (shown below)
• WM 6.1 Standard 400x240
• WM 6.1 Standard 440x240
• WM 6.1 Standard Landscape
• WM 6.1 Standard QVGA
• WM 6.1 Standard Square

Read more ...

Microsoft Begins 20-Part Webcast on Virtualization

Microsoft kicked off a 20-part virtualization webcast series last week on TechNet.

The series covers a wide array of subjects, from "What is virtualization?" to managing your virtual infrastructure. It's presented by Microsoft virtualization evangelists and covers Hyper-V virtualization, as well as System Center Virtual Machine Manager 2008 (VMM 2008).

The series objectives are to not only help you develop technical depth on various virtualization solutions, but to appreciate the essentials of a typical virtualization project in a real world implementation.

Each webcast is about 90 minutes long and is geared toward level 300 technical detail. This looks to be an interesting series.

The series includes the following live webcasts:

• 01/14/2009, TechNet Webcast: Virtualization in a Nutshell


• 01/16/2009, TechNet Webcast: Selecting the Right Candidates for Virtualization


• 01/21/2009, TechNet Webcast: Virtualizing Test and Development Environments for a Quick Return on Investment


• 01/23/2009, TechNet Webcast: Managing the Virtualized Test and Development Environment


• 01/28/2009, TechNet Webcast: If I Virtualize It, How Do I Manage It?


• 01/29/2009, TechNet Webcast: Consolidation and Rapid Provisioning


• 02/04/2009, TechNet Webcast: Building on Your Existing Virtual Environment


• 02/06/2009, TechNet Webcast: Virtualization Solutions for High Availability


• 02/11/2009, TechNet Webcast: Client-Side Virtualization


• 02/13/2009, TechNet Webcast: Using Presentation Virtualization


• 02/18/2009, TechNet Webcast: Scaling Terminal Services Out (1/2)


• 02/20/2009, TechNet Webcast: Scaling Terminal Services Out (2/2)


• 02/25/2009, TechNet Webcast: Running Legacy Applications with Virtualization (1/2)


• 02/27/2009, TechNet Webcast: Running Legacy Applications with Virtualization (2/2)


• 03/04/2009, TechNet Webcast: Creating a Virtual Desktop Infrastructure


• 03/06/2009, TechNet Webcast: Securing the Virtual Environments


• 03/11/2009, TechNet Webcast: Virtualization with Centralized, Policy-Based Management


• 03/13/2009, TechNet Webcast: Virtualization Solutions in Branch Offices


• 03/20/2009, TechNet Webcast: Road Map for the Future of Virtualization


• 03/24/2009, TechNet Webcast: Managing Virtual Solutions

If you should miss any one of these webcasts, the content will be recorded and available within a few days from the same site.

Read more ...

Exchange Server Virtualization Support Policy Summary

Microsoft released their Microsoft Support Policies and Recommendations for Exchange Servers in Hardware Virtualization Environments document this month. I reviewed the support document and summarized the salient facts here.
Exchange 2007 Virtualization

Host Requirements:

• A hypervisor virtualization solution that has been validated by the Windows Server Virtualization Validation Program
• Adequate storage space to accommodate the host OS and components, paging file, management software and crash recovery (dump) files
• Storage space must be allocated for Hyper-V temporary memory storage (BIN) files, equal to the amount of RAM allocated to each guest

Guest Requirements:

• Exchange 2007 SP1 (or later) deployed on Windows Server 2008
• Cannot have the Unified Messaging Role installed
• The total maximum number of virtual processors cannot exceed the twice the number of physical cores.Typically 2 virtual processors are required for each Exchange server guest, but use this as a baseline
• Large mailboxes (1GB and larger) require the use of Cluster Continuous Replication (CCR)
• CCR nodes must be hosted on separate physical host servers to provide true redundancy and high availability
• Mixing physical and virtual nodes is supported for CCR and SCC environments
• Exchange supported backups must be run from the guest
• Both legacy backups (using ESE streaming APIs) and Exchange-aware software-based VSS backups (Data Protection Manager) are supported
• VSS backups of the an Exchange guest is supported if the guest uses only VHDs (not pass-through disks)

Guest Storage Requirements:

• Supports fixed size VHDs, SCSI pass-through and iSCSI storage
• Storage must be dedicated to one guest machine. In other words, a pass-through disk must be dedicated to one, and only one, guest.
• Guest OS must use a minimum fixed-size VHD of 15GB plus the size of virtual RAM allocated to the guest
• VHD limit is 2,040GB (nearly 2TB) in Hyper-V
• Hub and Edge Transport servers require sufficient storage for message queues and log files
• Mailbox servers require sufficient storage for databases and log files
• iSCSI storage using an iSCSI initiator within the guest is supported. This offers greater portability, but decreased performance

Not Supported:

• Dynamically expanding VHDs are not supported
• Snapshots or differencing disks are not supported
• Virtualization high availability solutions, such as Hyper-V Quick Migrations, are not supported. Only Exchange aware HA solutions (SCC, LCR, CCR and SCR) are supported.
• VSS backups of the Exchange guest machine's pass-through disk from the host are not supported

Recommendations:

• Storage should be hosted on separate disk spindles from the guest's OS
• Use SCSI pass-through storage to host transport and mailbox databases and transaction logs
• When using iSCSI storage, configure the iSCSI Initiator on the host and present it as a pass-through disk to the guest
• Use dedicated NICs with jumbo frames and not bound to a Virtual Network Switch, Gigabyte Ethernet, and isolated networks for iSCSI storage

Exchange 2003 Virtualization

Host Requirements:

• The hardware virtualization software is Microsoft Virtual Server 2005 R2 or any later version of Microsoft Virtual Server

Guest Requirements:

• Exchange Server 2003 SP2 (or later)
• Microsoft Virtual Server 2005 R2 Virtual Machine Additions must be installed on the guest operating system
• Exchange Server 2003 is configured as a stand-alone server and not as part of a Windows failover cluster
• Each guest must have only one CPU

Guest Storage Requirements:

• The SCSI driver installed on the guest operating system is the Microsoft Virtual Machine PCI SCSI Controller driver
• The virtual hard disk Undo feature is not enabled for the Exchange virtual machine

Recommendations:

• Consider adding a dedicated virtual network adaptor for Exchange Server backups
• Create separate fixed-size VHDs for Exchange Server databases and log files and store them on separate physical drives on the host
• Exchange Server performance should be validated before production by using the Exchange Server 2003 Performance Tools
• Make sure that the host server is sized correctly to handle the number of virtual machines that you plan to deploy
• Use a storage solution that enables fast disk access
• Antivirus programs should be configured to not scan VHD files

Read more ...

Microsoft Exchange Virtualization and Licensing Announcements

Microsoft announced some significant changes to its licensing and support policies for applications in hardware virtualization environments. There are two key parts of the announcement worth highlighting for Exchange customers:

• Microsoft now supports Exchange Server 2007 SP1 running Hyper-V or hypervisors validated under the Microsoft Server Virtualization Validation Program (SVVP).
• Microsoft is waiving its 90-day license reassignment policy to enable customers who virtualize Exchange to move their licenses between servers within a data farm as often as necessary.

Microsoft has published a new whitepaper, Microsoft Support Policies and Recommendations for Exchange Servers in Hardware Virtualization Environments, which includes Microsoft's support policy and recommendations for running Exchange Server 2003 in a Microsoft Virtual Server 2005 R2 environment. This article is a must-read for anyone considering a virtualized Exchange environment.

See this article on the Exchange Team blog for more details.

Read more ...

Failure installing VMM2008

When installing the server component of Microsoft System Center Virtual Machine Manager 2008, you may come across the following error:

Microsoft System Center Virtual Machine Manager 2008 installation did not complete successfully. Review the error log for information, and then try Setup again.
ID: 205. Details: Fatal error during installation

Virtual Machine Manager Server installation did not successfully install. All items that were copied during the installation process have been removed, however some required prerequisite software is still present on the machine. It is not necessary to remove the remaining software before you run Setup again. But you can uninstall the prerequisite software by going to Add or Remove Programs.
For error details, click the Error tab.

The ServerSetup.log file also references error 1603 in various places. This is caused by name resolution (DNS lookup) failures. Examine your DNS configuration for any or more of the following errors:

• Misconfigured TCP/IP settings
• Primary DNS is misconfigured on the VMM server
• The VMM server is unable to resolve the DC by name
• The VMM server does not have a record in DNS
• The DC is unable to get proper name resolution of the VMM server
• Incorrect DNS forwarding
• DNS is not functioning correctly on the DNS server

Once the errors have been corrected, reinstall the VMM server component.

Read more ...

Can my system support Hyper-V?

This is a common question. Hyper-V requires three things: processor virtualization support, BIOS virtualization support and Windows Server 2008 with Hyper-V.

Processor virtualization is provided by Intel (Intel VT) and AMD (AMD-T) processors. You can check each of these websites to see if a processor supports virtualization. AMD offers an AMD Virtualization™ Technology and Microsoft® Hyper-V™ System Compatibility Check Utility that will tell if the installed AMD CPU supports it.

BIOS virtualization support, however, can be dicey. Normally, a BIOS manufacturer will offer the ability to turn virtualization on or off -- but not always. I have a Dell Dimension E521, for example, that doesn't offer virtualization configuration. Thankfully, it's enabled by default in this BIOS.

So how do you tell if your machine will support Hyper-V? Well, the easiest way by far is to use a utility by Gibson Research called SecurAble. This handy little program will quickly tell you if your computer is 64bit, running hardware DEP and is virtulization capable.

Note that SecurAble will report that Hardware Virtualization is "No" if you run it on a Windows Server 2008 computer that has the Hyper-V role installed. This is because Hyper-V capability is "hidden" once it's installed. See the Virtual PC Guy's WebLog for more details about this.

Read more ...

New Microsoft Hyper-V Virtualization Unleashed Book

I'm pleased to announce that I will be a co-authoring a new book, Microsoft Hyper-V Virtualization Unleashed, with Rand Morimoto, Ph.D. Rand is president, CEO and owner of Convergent Computing (CCO), the consulting services company I work for.

The content will cover Hyper-V planning and design, installation of Hyper-V, and getting into the management, administration and support of Hyper-V, including the new System Center Virtual Machine Manager 2008. This book is scheduled for completion this summer and will be on store shelves worldwide once VMM2008 ships, which will likely be end of the summer.

I've been a contributing writer for several other books including Exchange Server 2007 Unleashed and Exchange Server 2003 Unleashed, and most recently was the technical editor for Windows Server 2008 Unleashed. This will be the first time my name will be on the outside cover of a book, so it's rather exciting!

Read more ...

Hyper-V Integration Components For Windows 2003 SP1

Well, kinda.

Big Red Disclaimer: The steps listed here are not supported by Microsoft (or me). I've tested it several times and have not found any issues. If it doesn't work for you - well, sorry.

The Integration Components for Hyper-V RC0 are only avaialable for Windows XP 32-bit with SP3 or later, Windows Server 2003 with SP2 or later, Windows Vista 32-bit with SP1 or later , all versions of Windows Server 2008 and, just recently, Linux.

So what do you do if you want to virtualize a Windows 2003 SP1 server? After all, you may have a legacy application that won't run on SP2 and one of the hopes of virtualization is to move these servers off of dedicated hardware. Here's how to do it:

• Gather your CDs. You'll need the following:
• Windows 2003 Server CD (RTM or SP1 - make sure it doesn't have SP2 slipstreamed into it)
• Windows Server 2003 SP2 upgrade CD or ISO (available here from Microsoft)
• Create a new Windows 2003 virtual server using the Hyper-V New Virtual Machine Wizard
• Upgrade the virtual machine to SP2 using the SP2 CD or ISO.
• From the Hyper-V Action menu, insert the Integration Services Setup disk and install the Integration Components. The installation will require a restart when it's complete.
• After the restart, uninstall Windows Server 2003 SP2 using Add or Remove Programs in Control Panel. The uninstall will warn you that KB943295 and the Integration Components may not work if you continue the uninstallation. Click Continue.
• Restart the virtual machine to complete the uninstallation.

Now you have a Windows 2003 VM with SP1 which runs the Integration Components! You can use this base image to make as many servers as you like. Be sure to use a tool like NewSID to generate unique SIDs for each clone, otherwise you'll run into problems in a domain.

Note: I haven't tested this for Windows Server 2003 RTM, Vista RTM or Windows XP RTM/SP1/SP2, but I expect it will work. Please post a comment if you have success or failure.

Read more ...

Windows Server 2008 Upgrade Complete

In a previous post I mentioned that I was going to upgrade my network to Windows Server 2008. Well, I've completed the upgrade and it ROCKS!

I now have a single W2K8 Enterprise server running Hyper-V RC0. This server hosts two guests, one x86 domain controller and one x64 Exchange 2007 server running ForeFront Security for Exchange Server. The host server is running this blog as well as Exchange 2007 Edge services. The performance is outstanding! Much better than my old x64 Windows 2003 host running VMware.

The Exchange Team posted a great article, Speeding up installation of Exchange Server 2007 SP1 Prerequisites on Windows Server 2008. It offers XML files that configure the Windows Server 2008 prerequisites for Exchange 2007 SP1. While it wasn't that difficult to install everything manually, it would have saved some time for me if I had this before my upgrade.

Last night I completed the upgrade and decommissioned the old W2K3 DC, Exchange and Edge servers.

Please let me know if you have any issues with the blog. The migration went very smooth and I don't anticipate any problems.

Read more ...

Getting Networking to Work in Hyper-V Beta

First, I thoroughly recommend reading Ben Armstrong's article, "Understanding Networking in Hyper-V," for an explanation of how networking changes on a Hyper-V enabled host. He explains that the real NIC on the host is converted to a virtual network switch and a new virtual NIC is created on the host to access the network using the virtual switch.

Sometimes networking doesn't get setup properly on the host when the Hyper-V role is installed. Here's how to fix it:

When networking is not configured properly after Hyper-V is installed, you'll see only the one physical adapter in Network Connections (assuming, of course, that you have only one network adapter).

1. Open network properties of the NIC and uncheck all the connections on the adapter (Client for Microsoft Networks, IPV4, IPV6, ...everything) and click OK. Obviously, this will disrupt network communication to and from the server, so plan this work accordingly.

2. Click Virtual Network Manager in the Hyper-V console and create a new external network bound to the real NIC. This will convert the real NIC on the host to a Microsoft Virtual Switch and create a new virtual NIC for the host to use for its network adapter (see step 4).

3. In each Hyper-V guest, select the External Virtual Network for the VM's network adapter.

4. Back on the host, you will now see two NICs in the Network Connections window. Local Area Connection (the original real NIC) is now a Microsoft Virtual Switch and is using only the Microsoft Virtual Network Switch Protocol. You will also see a new virtual NIC (usually named "Local Area Connection 3," in my testing). I've renamed it here to Virtual Local Area Connection.

5. Open the properties of the new virtual NIC and re-IP it to it's original static IP address.

6. Verify that the host has network connectivity, and then check your VM guests for connectivity.

Let me know if this helps you.

Read more ...

You can't get there from here...

This weekend I'm starting the migration of my production network from Windows 2003 servers running VMware for virtualization to Windows Server 2008 with Hyper-V.

I have it all planned out like this:

• Clone my existing W2K3 VMware VMs (DC and E2K7) to a USB drive


• Convert the VMware VMs to VHDs using System Center Virtual Machine Manager 2007


• Mount the VMs on my new isolated W2K8 host; test


• Create a new W2K8 DC VM to upgrade the domain


• Create a new W2K8/E2K7 VM and migrate all the mailboxes to it


• Decommission the W2K3 DC and E2K7 VMs


• Test the new environment


• Move my blog and websites to the new W2K8 host


• Turn off my old W2K3 box and re-IP the W2K8 server with the W2K3 server's IP. This will put it into production.


• Test the web, Exchange, OWA environment again


• Drink a beer to celebrate. OK, there might be some pre-celebration drinking throughout the process...

By following this plan, I'll minimize downtime to a few minutes and I'll always be able to roll back to the old server simply by turning it back on.

Sounds like a good plan, but here's why it won't work -- the only tool that can convert VMware VMs to VHDs is Virtual Machine Manager 2007 (Hyper-V can't do this on its own), but VMM 2007 can't create or convert x64 VMs. Both my DC and E2K7 server are 64-bit, so at this time there's no way to get there from here. I only wish I'd have remembered this before I spent 4 hours configuring the VMM2007 server and domain. Doh!

By the way, the failure I got during the x64 VM conversion was on step 1.5, "Make operating system virtualizable." This happened right after the plug and play system reported it was "Installing Microsoft Virtual Server Storage devices."

Microsoft Virtual Machine Manager 2008 is expected to create and convert 64-bit guests, but the earliest bits whon't be available for it till around March.

So, my updated migration plan is this:

• Clone my existing W2K3 VMware VMs (DC and E2K7) to a USB drive as backups


• Build a new Windows Server 2008 Hyper-V host


• Introduce a new W2K8 DC Hyper-V guest into the domain


• Create a new W2K8/E2K7 Hyper-V guest


• Configure a new Edge server on the W2K8 host


• Migrate all the mailboxes from the old E2K7 server to the new one


• Decommission the W2K3 DC and E2K7 VMs


• Test the new environment


• Move my blog and websites to the new W2K8 host


• Turn off my old W2K3 box and re-IP the W2K8 server with the W2K3 server's IP. This will put it into production.


• Test the web, Exchange, OWA environment again


• Commence said beer drinking celebration

Read more ...

DEP and Virtual Machines

Data Execution Prevention (DEP) is a security feature included in all versions of Windows since XP SP2. It’s intended to prevent an application or service from executing code from a non-executable memory region. This helps prevent certain exploits that store code via a buffer overflow, for example.

DEP runs in two modes: Hardware-enforced DEP for CPUs that support it, and software-enforced DEP for CPUs that don’t. Software DEP is performed by the operating system, and as such, has a (small) performance hit.

It may make sense to disable DEP in virtual machines (especially test VMs) to eek out a little more performance. Read on for an explanation of how to do this.

Software DEP configuration is controlled through switches in the Boot.ini file.

There are four options to set the DEP mode are:

• OptIn - Enables DEP only for OS components, including the Windows kernel and Windows drivers. Administrators can enable DEP for selected executable files with the Application Compatibility Toolkit (ACT).
  
• OptOut - Enables DEP for the OS and all processes, including the Windows kernel and Windows drivers. However, administrators can disable DEP on selected executable files with the Control Panel System applet.
  
• AlwaysOn - Enables DEP for the OS and all processes, including the Windows kernel and Windows drivers. All attempts to disable DEP are ignored, and all DEP configuration options are disabled.
  
• AlwaysOff - Disables DEP. Attempts to enable DEP selectively are ignored, and the DEP GUI is disabled.

In Windows Server 2008 and Vista, you use bcdedit to set the DEP mode. The DEP configuration can be viewed using the bcdedit /enum osloader /v command. To configure DEP, use the /set nx switch. For example, to set the currently booted OS to DEP AlwaysOff, you would use the command:

bcdedit /set nx AlwaysOff

You configure DEP in other operating systems from the Advanced tab Performance Settings of the System Control Panel applet.

Read more ...

Eating My Own Dog Food

This weekend I upgraded my home production domain from Windows 2003 R2 (x32) and Exchange 2003 to Windows 2003 R2 SP2 (x64) and Exchange 2007. My goal was to pretend I was at a customer site and had to migrate this environment successfully to the new hardware.

My home production equipment consisted of a single Dell 4600 all-in-one box. It was a W2K3 R2 Enterprise domain controller with SP1, which also ran Exchange 2003 Enterprise SP2 and served as a DNS, WINS, WWW and file server. The server had a single Intel 2.8Ghz HT CPU, 2GB of RAM and a 160GB hard drive. My replacement server is a Dell E521 with an AMD Athlon 64 Dual-Core, 4GB of RAM and a 250GB hard drive.

Since I am still limiting myself to a single physical server, I decided to use VMware to virtualize most of my environment. All servers will run Windows Server 2003 R2 (x64) with SP2. The host server (GATEWAY) will be a workgroup server running Exchange 2007 Edge Server and VMware Workstation. The two virtual servers are DC01, a domain controller/DNS/WINS server, and EX01, an Exchange 2007 server with the Hub Transport, Client Access, and Mailbox roles. My LAN is connected to the Internet via a Netgear wireless router/firewall, as per the following diagram.

First I installed x64 Windows Server 2003 R2 Enterprise SP1 on GATEWAY and used the Microsoft Update site to install SP2, IE7, ADAM (required for Exchange Edge server) and all the critical updates. SP2 installs the Windows firewall by default, so I disabled it. Then I installed VMware Workstation 5.6. I chose Workstation since ESX will not recognize SATA drives and GSX only allows one snapshot per VM.

Next I created a base image VM using x64 Windows Server 2003 R2 Enterprise, upgraded to SP2, IE7 and all the critical updates, and disabled the firewall. I use this image to base all my servers on, which makes provisioning future servers a breeze.

I then created two new linked clone servers, DC01 and EX01 and joined them to the domain. I promoted DC01 to a domain controller and installed DNS and WINS. I installed IIS, .NET Framework 2.0 and 3.0, and the necessary patches on EX01 in preparation for Exchange 2007. I took a snapshot of both servers at this point and then began to install Exchange 2007.

Here's where it gets interesting. The Exchange 2007 setup has a lot of logic and workflow built into it. You pretty much install the DVD, answer a few questions and let it run. Setup will check that the server meets the prerequisites and pre-qualifies the environment to ensure a smooth installation. In theory. The installation went happily along updating the schema, preparing the domain and installing the server roles. But as it was installing the Hub Transport role it errored, saying that the disk could not be read and to try setup again later. It did not offer a "retry" button. The trouble turned out to be a smear of what I can only guess was macaroni and cheese on the DVD. Kids. Gotta love 'em.

So, I cleaned off the DVD and ran setup again. Now setup said that the Hub Transport role was not installed properly and to remove it first. Trouble is, neither setup or the Exchange Management Console (EMC) show that any roles have been installed, so I can't uninstall it. I'll spare you the gory details, but I tried uninstalling it using PowerShell, the switches in setup, and reverting to my snapshot. No good. I then removed the Exchange Administrative Group (FYDIBOHF23SPDLT) and Exchange Routing Group that setup automatically creates in a mixed mode environment using ADSI Edit. This let me run setup again, but now I got an error complaining that Exchange Administrative Group (FYDIBOHF23SPDLT) was missing. I recreated both the AG and RGC on the Exchange 2003 side (I had to use ADSI Edit again to rename the AG using the parentheses) and tried again. Success!

After I ensured that I had mail flow between the E2K3 and E2K7 servers, I installed the Edge Server role and Microsoft ForeFront (antivirus/antispam) on GATEWAY. This created a new RGC to the Internet on GATEWAY. I then created an EdgeSync subscription and tested it. I moved the mailboxes to EX01 and successfully tested OWA and Outlook.

Now to put it into production. I have one MX record published on the Internet for inbound email. My firewall allows SMTP port 25 and HTTP port 80 traffic to WWW (x.x.x.50). I reconfigured WWW to use a different address and configured GATEWAY to use x.x.x.50. I successfully tested inbound and outbound email and that my web pages worked properly from GATEWAY. I then reconfigured my firewall to forward SSL port 443 to EX01. Exchange setup automatically configures OWA on the CAS role to use SSL. I used ts.cco.com to look back into my OWA and successfully tested email again.

The final step was to decommission my old DC/Exchange 2003 server. There are a few steps I needed to do in Exchange 2007, such as re-home the OAB, replicate Public Folder content, etc. After that, it was simply a matter of deleting the RGCs to the Exchange 2003 AG, deleting the old AG itself, and uninstalling Exchange 2003. I'm pleased to say that the customer is very satisfied. :)

I learned a lot through this entire process. Highlights are:

• Dog food is delicious.
• Ensure your media is OK. Keep sticky fingers and food away! I was surprised at this, since setup copies the binaries to the local hard drive and re-compiles them.
• Microsoft put a lot of work into the install process, but it's not perfect. I would imagine I would have had the same problem if the DVD was ejected during setup.
• Never give up. I could have always used exmerge and rebuilt my domain, but few customers would accept this.
• 64-bit hardware, lots of RAM and VMware are "good things"
• Giving 512MB to my virtual DC and 2GB to my virtual Exchange Server yields respectable performance
• Since VM Workstation won't start as a service, I enabled auto-logon on GATEWAY and wrote a script that launches and runs my VM team
• Microsoft Forefront is still a Sybari product with Microsoft stickers on it (needs work)

Read more ...