Metro-Ethernet

There is a lot to like about metro-Ethernet offerings. It’s fast, it’s Layer 2, and comparably it is significantly cheaper than its DS-x counterparts for similar speed offerings with less complexity.  The caveats are lighting the fiber and any construction costs associated with building into your facility. If you are too far from access to the provider’s fiber ring, construction could be a deal breaker.

In the Metro-E space the most utilized offerings include a private solution (managed) and a standard offering that is fiber pairs handed off at the demarc. The key difference here is that in a private model the service provider will install switches in your premise and “light” the fiber from end to end so that they can manage and monitor it. You simply cross-connect into their switch. While this is a very nice option it comes at a steep price. The alternative via a standard type of offering is where the provider simply hands off pairs of fiber to your facility, they light the fiber to you, and you are responsible to light it back to them (Tx/Rx). The catch here is that you need to have your own optics capable of lighting the fiber possibly over a great distance so the required optics will be expensive (ZX).

In either case redundancies will be costly as ideally in a dark/lit fiber scenario you would employ multiple paths to the provider ring through at least two entrances to your facility, literally. Construction costs double as do MRCs but if you absolutely cannot afford for your internet or site-to-site connection to be jeopardized, at any cost, then this is the solution for you. Leading data center providers (Savvis, Rack Space, etc) all have multiple data providers each with multiple entrances to their facilities.

Fiber type and connecting modules are extremely important, pay attention to these details. It may seem obvious but when you’re buying, connecting, and configuring three dozen other pieces of infrastructure at the same time these details can be overlooked. The Metro-E provider will be using single-mode fiber cabling as is the standard for shooting light great distances. Your optics MUST match the fiber type. So if you will need to buy ZX modules for your own Cisco switches be sure to get the ones that match the handed off fiber type. These modules come in both single-mode and multi-mode flavors. Your cross-connect cables must match as well.

Whether standard or private, your service provider will demarc the connection in a location of your choosing, most likely a cabinet in your datacenter. The installation should include a fiber distribution box that they will install and terminate. Your provider will most likely hand off SC connectors on the other side of the distribution box. Your Cisco ZX module will require LC connectors so you will need to acquire a cable with different ends. Having just gone through this, my provider handed off duplexed SC connections so I had to remove the clips on the SC side of the cable to split the SC connections.

Questions to ask:

• What are the differences between a private managed service and a standard service?
• Do you need a point-to-point connection between 2 or more locations, or just internet access?
• What is the type of fiber being handed-off by your provider? Single-mode (SMF)? multi-mode (MMF)?
• Which standard SX? LX? ZX?
• What are the service SLAs?

Fiber Cabling

There are 2 primary types of fiber optic cabling in play in today's datacenters: single-mode (SMF) and multi-mode (MMF). SMF is capable of transmitting almost infinite bandwidth over hundreds of kilometers so is used mainly in backbone fiber rings. MMF can transmit light a shorter distance so is found in campus location use. SMF is also very expensive and less flexible than MMF. Of these 2 types there are a few different options. MMF is found in 50/125µm or 62.5/125µm and SMF is found in 8.3/125µm. These numbers, measured in microns (µm), indicate the diameter of the glass core that carries the light, and the outer cladding which confines the light to the core. 50 micron is the most common flavor of multi-mode fiber and is commonly used for both Ethernet and fiber-channel.

62.5 micron is the older standard, 50 micron is the newer. You can read more about both in the linked documents in the reference section below. A third specification groups the different transmission quality of the fiber types.  The performance codes for MMF are OM1, 2, and 3, for SMF they are OS1 and 2. These codes indicate the bandwidth capabilities for different light wavelengths. See the attachment “Understanding OM1, OM2…” below. For example, I just installed 6 strands of 50 micron OM3 MMF between my datacenter and user floor to run 3 x 10GigE links.

Just like CATx cabling, fiber cabling can be purchased from many “big name” companies like CablesToGo, or Belkin at steep premiums. I strongly recommend against buying from these companies as better quality can be found by smaller e-tailers that make and certify their own cables. My favorite vendors right now are fibercablesdirect.com and monoprice.com.

References:

Cabling and Test Considerations for 10Gige LANs [via fiberoptic.com]

Understanding OM1,OM2,OM3,OS1,OS2 Fiber for Data Centers [via Cisco Learning Network]

Multimode Fiber: 50 micron vs 62.5 micron [via netoptics.com]

Power is and always will be an issue in the datacenter, especially as gear gets denser, faster, and hotter. Power circuits can be sized improperly from lack of due diligence or simply devolve as equipment moves in and out of racks. Having gone through a few datacenter build outs I wanted to share some of my methodology for power sizing and planning at the rack level.

Power analogy

Think of electrical circuits and delivery through copper wires like water through piping. There are 3 main facets that we are concerned with in sizing the power infrastructure: voltage, amperage, and power. Resistance, measured in ohms, is equivalent to the size of the water pipe, but since power cables are provided to us by electricians and vendors, we’re not overly concerned with that aspect here. (Although I should mention that it is important to ensure that the power cables used to connect to equipment power supplies are capable of max PSU draw).  Voltage is equivalent to the pressure (force) of the water flow. Amperage is equivalent to the rate of flow (current) of the water and also helps us determine efficiency. The power of the circuit is determined by multiplying the force (voltage) by rate of flow (amps). Assuming a Power Factor of 1, this equation also determines volt-amps, most commonly rated in Kilovolt-amps (Kva). This of course changes a bit in a three-phase circuit but I’ll get to that later. In either case, increasing the force or current flow will result in more power generated.

Watts or volt-amps (single-phase) = Voltage x Amps

Efficiency

In most cases, when you increase the voltage supplied to a server, storage, or networking device, it becomes more efficient in the way it utilizes power. In other words higher voltage = reduction in current draw. For example, an HP DL380 G6 with a 750 watt power supply can, as rated by HP, draw up to ~8 amps @ 110 volts. If you provide this same server with a 208v power circuit its draw decreases to just over 4 amps. The consumed current continues to decrease as you increase the voltage. These power supplies can go up to 240v reducing the current draw to a nominal 3.6a. That’s a 45% difference in draw between the lowest and highest capable voltages. The advantages of higher voltage in power constrained environments is obvious.

Sizing

So how big do you go? Single phase? Three-phase? 110? 208? 220? An enterprise-class UPS typically has 3 power phases: A, B, and C. The utility power circuits attach here usually as 480v @ 600a mains, two for redundancy. That’s 1200 amps of draw and any number of voltage scenarios that can be built off of the breaker box on the other side of the UPS, assuming it can handle it. Each phase has a maximum current and voltage depending on the size of the breakers installed in the UPS. You can quickly get a general idea on how much current your datacenter is consuming by looking at the load levels of each phase on the UPS, displayed in amps.

Let’s assume that the power infrastructure has been properly built and that the internal UPS breakers are setup so that all available power is being distributed to breaker boxes evenly. We need to figure out what size circuits, called whips, need to be pulled from the breakers to the racks. You can calculate based on averages or peaks. Calculating based on peak loads will make for absolute certain that you have enough available juice to power all of your attached gear if it were running at 100% load. If this is unlikely to ever occur in your environment, you should be ok using the averages.

There are 2 factors you need to figure out to properly size your power circuits: total power required (watts) and how much draw (amps) at a given voltage. As I stated before, this number will vary depending on input voltage. All equipment power supplies are rated by the manufacturers of the devices. From each device you plan to place in a single rack, add the rated draw from each system’s power supply and the required watts of each. You will need to ensure that you can provide enough total power as well as draw.

For example we determined that we need: 6000 watts and 25 amps total with 208v delivery. To meet these demands, assuming two circuits per rack for redundancy, the minimum circuit size we could run would be 208v @ 20a single phase. This yields 4.2Kva per circuit or 8320 watts total delivered to the rack ((208 x 20)x2). If 110/120 power is all that you have available, then you need to re-calculate your equipment requirements because current draw will likely double at this reduced voltage.

If you aren’t completely filling your target racks then don’t forget about providing room for growth. You may only need 6Kva day one, but your rack is only half full. In the example above, the two 208v @ 30a circuits will give us 28% additional headroom. If we plan to double the same type and number of equipment in this rack then these circuits will not be enough. If we plan for a 50% potential increase then we need to provide enough power for 12000 watts of power and 50 amps of draw. To meet this demand we’ll need to increase our circuit size to 30 amps at 208 volts. This will provide 6.2Kva per circuit for a total of 12.4Kva. This is a solid and safe sizing estimate for our new rack.

Three-Phase Power

While extremely efficient and better for redundancy, 3-phase circuits can be more expensive because of the increased power output. This is where we have to remember the overall Kva output of our UPS. If not careful, then we can overrun its capabilities. To calculate the power rating of a 3-phase circuit, start with the formula above, then multiply by 1.732.

Watts or volt-amps (three-phase) = Voltage x Amps x 1.732

Referring back to the scenario above, we need 12000 watts and 50 amps for our new rack. In a single-phase solution we need 30 amp circuits running at 208 volts. If we took those specs and turned them into 3-phase circuits, we would get 10.8Kva per circuit or 21.6Kva for the entire rack, a lot more than we need. Because of the increased output of 3-phase power we could now actually reduce our circuit size to the rack. 208v @ 20a, 3-phase, yields 7.2Kva per circuit or 14.4Kva total which is closer to our calculated estimate. 3-phase power saves us 20 amps of draw from the UPS on this particular rack!

Your particular power requirements may reveal that 3-phase power is unfeasible as it might produce too much power for your given application potentially overwhelming your UPS. I just went through a scenario where single-phase actually made more sense based on current load of the UPS and our power requirements. There are certainly more factors that could be considered but this should give you a good basis for determining power needs in your environment.

References:

Power formulas

Power calculator

Microsoft Press is giving this new 200 page eBook away for free.

Topics include: Hyper-V, VDI, AD, File Services, IIS 7.5, and DirecAccess. You certainly can’t beat the price!

Introducing Windows Server 2008 R2

Time services play a pivotal role in the Kerberos authentication process, so ensuring that they are set up properly is important. With the exception of a few deprecated time-related command switches, not a lot has changed with regard to time in Server 2008/ Windows 7. Having just upgraded a 2008 domain to 2008 R2 with new domain controllers I wanted to share the process of setting up time services for the domain.

By default the DC that holds the PDC Emulator role is the time keeper for the domain. Also in its default state the PDCe assumes that it is itself the stratum 1 time provider, as reflected in the registry key value \HKLM\System\CurrentControlSet\services\W32Time\Parameters: Type NT5DS. This value controls the synchronization type which specifies if time is to be received from the domain hierarchy (NT5DS) or from an external provider (NTP). The default is fine if you’re alright with the server using its own CMOS clock to provide time for the domain. In this case all you need to do is configure the Announce Flags (see KB). To force the DC to use an external time provider, on the DC that holds the PDCe role, change this value to “NTP”. Per RFC 1305 (via MS KB816042), the PDCe must not be configured to sync time with itself.

NTP.org maintains the lists for publicly accessible time servers. Pool servers, stratum 1 (primary) and stratum 2 (secondary) servers are documented here. You can configure your PDCe to point directly to several stratum 1 servers, or you could just point to the pool addresses which employs DNS round robin to ensure you always have a reliable stratum 2 time source. In this scenario I will be pointing to the US pool servers: us.pool.ntp.org.

Net Time is still alive in Server 2008 but /querysntp and /setsntp have been deprecated. Configuration must be performed via W32tm.exe. Since we now have our PDCe set to sync to an external time source, we need to configure its peer list which can be FQDNs or IPs. This is done via: w32tm /config /manualpeerlist:"0.us.pool.ntp.org 1.us.pool.ntp.org 2.us.pool.ntp.org 3.us.pool.ntp.org"

Run a quick update with w32tm /resync /rediscover then verify the configuration is working by running w32tm /query /peers /verbose

C:\Windows\system32>w32tm /query /peers /verbose
#Peers: 4

Peer: 1.us.pool.ntp.org
State: Active
Time Remaining: 37.7327154s
Mode: 1 (Symmetric Active)
Stratum: 2 (secondary reference - syncd by (S)NTP)
PeerPoll Interval: 8 (256s)
HostPoll Interval: 8 (256s)
Last Successful Sync Time: 9/1/2009 3:32:37 PM
LastSyncError: 0x00000000 (Succeeded)
LastSyncErrorMsgId: 0x00000000 (Succeeded)
AuthTypeMsgId: 0x0000005A (NoAuth )
Resolve Attempts: 0
ValidDataCounter: 8
Reachability: 255

Peer: 0.us.pool.ntp.org
State: Active
Time Remaining: 37.6859151s
Mode: 1 (Symmetric Active)
Stratum: 3 (secondary reference - syncd by (S)NTP)
PeerPoll Interval: 8 (256s)
HostPoll Interval: 8 (256s)
Last Successful Sync Time: 9/1/2009 3:32:37 PM
LastSyncError: 0x00000000 (Succeeded)
LastSyncErrorMsgId: 0x00000000 (Succeeded)
AuthTypeMsgId: 0x0000005A (NoAuth )
Resolve Attempts: 0
ValidDataCounter: 8
Reachability: 255

Peer: 2.us.pool.ntp.org
State: Active
Time Remaining: 37.6859151s
Mode: 1 (Symmetric Active)
Stratum: 2 (secondary reference - syncd by (S)NTP)
PeerPoll Interval: 8 (256s)
HostPoll Interval: 8 (256s)
Last Successful Sync Time: 9/1/2009 3:32:37 PM
LastSyncError: 0x00000000 (Succeeded)
LastSyncErrorMsgId: 0x00000000 (Succeeded)
AuthTypeMsgId: 0x0000005A (NoAuth )
Resolve Attempts: 0
ValidDataCounter: 8
Reachability: 255

Peer: 3.us.pool.ntp.org
State: Active
Time Remaining: 37.7015152s
Mode: 1 (Symmetric Active)
Stratum: 2 (secondary reference - syncd by (S)NTP)
PeerPoll Interval: 8 (256s)
HostPoll Interval: 8 (256s)
Last Successful Sync Time: 9/1/2009 3:32:37 PM
LastSyncError: 0x00000000 (Succeeded)
LastSyncErrorMsgId: 0x00000000 (Succeeded)
AuthTypeMsgId: 0x0000005A (NoAuth )
Resolve Attempts: 0
ValidDataCounter: 8
Reachability: 255

The other DCs will look to the PDCe as their time source and domain clients will look to their authenticating DC. If you need to get more granular with time services there are a few GPO settings capable of some good granularity. “Computer Configuration\ Administrative Templates\ System\ Windows Time Service” contains policy items to configure polling intervals, phase corrections, or to disable the client altogether, which is useful if you need to implement a 3rd-party NTP solution in your organization. If any other domain clients or servers need to be updated immediately, simply run w32tm /resync /rediscover.

References:

NTP.org time server lists

How to configure an authoritative time server in Windows Server

New for Server 2008 R2 and Windows 7 is the AD admin center (part of the Windows 7 RSAT). A UI based on PowerShell, ADAC provides a slightly richer experience over the MMC-based ADUC. Object-related tasks are clearly visibly, object properties are consolidated in a single flowing pane, multiple domains can be seamlessly managed, and new query abilities make up some of the major improvements.

All aspects of a computer or user object can be managed from one intuitive interface, although a majority of the tabbed extensions still exist in the new pane. Account, Org, Member of, and profile were broken out separately.

Another nice feature is that you can quickly view many advanced details about an object such as last log on, SIDs, USNs, and GUIDs.

Filtering allows administrators to perform searches through the directory to quickly determine many details such as disabled or locked accounts, accounts that haven’t logged on in x days, etc.

I’m not sure I’m ready to give up ADUC just yet for ADAC but I’ll keep playing to possibly uncover additional value.

A few minor things have changed since the RTM build of 2008 R2 dropped with regard to this feature. Here is a quick recap and overview.

First your domain must be running in Server 2008 R2 forest and domain functional level, which means all of your DCs must be running 2008 R2.

Once this is achieved you will be allowed to enable the recycle bin AD feature (which must be done from the DC holding the Domain Naming master role).

To verify that the feature was successfully enabled fire up ldp.exe in admin mode. In the 2008 R2 RC the deleted objects container was now visible but in RTM it isn’t. Hit View—>Tree—> and select the Configuration partition for the BaseDN. Expand down to the Partitions container and verify the recycle bin has been enabled under msDS-EnabledFeature.

Ok good, the feature is enabled but we still can’t see the deleted objects container nor any objects that we delete at this point, even though the container is visible in the well known objects list. This is because the container itself is marked as deleted. Deleted object restore or view operation attempts will fail at this point as well.

To change this, with the domain root selected as BaseDN, click Browse—>Search, enter CN=Deleted Objects,DC=domain,DC=com for the Base DN, change the filter from * to user, then click options. Change the search call type to extended then click the controls button. In the “Load Predefined” drop down select “return deleted objects” and double-click the 1.2.xx item in the active controls pane. Click Check in, then Ok. The TechNet link at the bottom goes into greater detail about this.

Refresh the tree and you should now see the deleted objects container. You should now be able to view and restore your deleted objects via ldp or PowerShell.

Reference:

TechNet

I originally had a bit of trouble with the betas of XP Mode but the Release Candidate is polished smooth and fully functional. XP Mode is comprised of two applications: Virtual PC and XP mode. Virtual PC can still be used to run a multitude of custom VMs but consumers will get XP Mode for free. This includes a fully licensed XP Pro VM and some very cool application virtualization features as well. Virtual PC, most notably, now supports USB drives and smart cards. Tighter host integration is achieved by more integration features and host hardware device access. An important distinction of this version from its predecessors is that CPU hardware virtualization is required. Your CPU must be capable of running the AMD-V or Intel-VT instruction set to use the software.

Having a fully licensed XP Pro VM at your disposal has a lot of obvious benefits. Any legacy application incompatibilities can be remedied by installing in the XP environment. The concept of virtual machines may prove troublesome to some end users in the enterprise so as part of XP Mode, full published application virtualization is available as well. Any application installed in the XP Mode VM is, by default, automatically published to the XP Mode Applications folder in the start menu. 

You can easily publish any application you want by creating a shortcut in the “all users” folder on the XP VM. When XP Mode applications are launched the VM cannot be running. If you attempt to launch a virtualized application while the VM is running, you will be informed that the VM must first be closed. The default action is hibernation.

Now for the magic. Using XP Mode Applications you can run two versions of the same program. conflict free, including IE! Have a web app that will only work on IE 6? No problem. Need to run Office 2007 and Office 2003? No problem. The best part is that the virtualized app is seamlessly integrated into the workflow area with no obvious indication it’s virtualized at all. If you’ve used ThinApp or the like this experience is very similar, except provided near natively.

Even from a process standpoint it simply appears that two instances of IE are running. Combined with the Virtual PC instance this solution has a relatively small footprint. YMMV, of course.

I will be deploying Windows 7 in my enterprise soon, which combined with XP Mode will provide a very solid solution. Application virtualization was previously a potentially expensive investment depending on technology and implementation. Free is certainly hard to beat, and the complexity of this solution couldn’t be any less.

I have operated in production environments with AD accounts in full-time admin mode as well as non-privileged mode (2 accounts). In a domain setting UAC can make the later tolerable by prompting you for credentials when attempting to run an application requiring greater privileges. In the XP days this was accomplished by using “Run As”. The temptation is to just turn off UAC and run as a full-time admin but I’m trying to be good and resist this temptation, especially with Windows 7 and the new security levels UAC provides.

You can find the UAC settings able to be modified via group or local policy in Computer Configuration\Security Settings\Local Policies\Security Options:

By default, Microsoft PowerShell runs in non-privileged mode, with UAC enabled, as does the command prompt. This means that if you want to run elevated commands or applications then you would need to open another session in administrative mode (right-click—>run as administrator). In UNIX this issue is addressed with the sudo command that provides temporary elevation to “super user” status to execute an otherwise restricted process. One could then define elevated accounts via the sudoers group where you can define which accounts can be used for sudo, the goal here is to not needlessly give out the root password.

We can emulate this behavior in Windows with PowerShell with the help of UAC. If you’re only looking to executed elevated processes in PowerShell without entering alternate credentials then you can ignore the UAC piece. The first step is to create a profile in PowerShell, if you haven’t already. Enter $profile in PowerShell to show the path to the profile. The MSDN link at the bottom of this entry will give more information on the various locations profiles can exist. Test-path $profile will show you if that profile exists and if it’s operational.  If the test comes back false then you will need to create the profile first by executing:

To follow up on an earlier posting about how to enable the new recycle bin feature in AD, this post will outline how to perform an object restore. Once the recycle bin has been successfully enabled you can use the ldp.exe tool or PowerShell to view the deleted objects container (hidden in ADUC) as well as recover anything contained within.

Via LDP

Get connected and expose the domain tree: Type ldp into the start search bar, click Connection—>Connect—>enter applicable DC information—>once connected click Connection—>Bind. Next click View—>Tree and enter the AD root as BaseDN you want to work within: dc=domain,dc=com. Drill down into your AD tree and look for CN=Deleted Objects… This is where all your objects go once deleted in AD. Double-click this line and you will see every object currently in a deleted state. Double click on a child object to reveal more details. The CN’s of each should be recognizable as their friendly names and in the details pane the Name value will be visible as well, in my case I deleted a user account named Temp.

To restore, right click the object you want to recover and click Modify. In the “Edit Entry Attribute” box type isDeleted, leave “Values” empty, click the “Delete” radial under Operation, then click the Enter button. You will see the new entry in the Entry List box. Next, go back to the “Edit Entry Attribute” box and type distinguishedName, in the values box type the original DN of the object before it was deleted. The DN of the object in it’s deleted state will not work here. (Look for the “lastKnownParent” line of the deleted object in the details pane and add the object’s CN to it). Click the “Replace” radial under operation then click Enter. You should now have 2 entries in the Entry List box. Tick the “Extended” box at the bottom left and click run. The output window should show that the object was modified with no errors. Go back to ADUC and verify that your object is back from the dead.

Via PowerShell

The PowerShell method is a one line command that pipes a get object operation to a restore object operation. This method is much faster but less gratifying for some reason. The filter criteria can be modified but going by display name should be easy enough. You will get no confirmation of success or failure in the PowerShell display.

Get-ADObject -Filter 'displayName -eq "temp"' -IncludeDeletedObjects | Restore-ADObject

Resource:

Technet

This applies to Server 2008 R2 and Windows 7 as well, of course. While this may be old news to some, MaxPC had a good article in their latest issue about using symbolic links in Vista. To paraphrase, symbolic links are like shortcuts but at the OS level, not the file system level. Starting in Vista/Server 2008, Microsoft changed the naming convention for user profile folders which would break applications configured to point to these locations (i.e. c:\documents and settings —> c:\users).  So to preserve application functionality Windows uses symbolic links to provide a path to get to the new location via the old paths, even though they don’t exist anymore. Look inside any user’s profile and you will see what look like shortcuts to my documents, local settings, etc. These are directory symbolic links.

The command mklink is used to create links and its options include: symbolic links for a file or a directory, hard links in place of symbolic links, or directory junctions.   Directory symbolic links probably get the most use and can be useful to preserve pathing of a folder that has been moved to a new location. The original directory name becomes the symbolic link and cannot exist prior to running mklink.

C:\Windows\system32>mklink /D c:\test c:\newtest
Cannot create a file when that file already exists.

C:\Windows\system32>mklink /D c:\test c:\newtest
symbolic link created for c:\test <<===>> c:\newtest

Now any reads or writes looking for c:\test will be seamlessly pointed to c:\newtest and the application won’t know the difference. Hard links are used to point directly to a file so the OS will treat the link like it’s the actual file, while soft links behave more like shortcuts. Links can be deleted directly in the file system just like any other file or folder.

I finally got this working after banging my head into the wall for 2 days. This is a very tricky implementation on Server 2008 with everything running on ONE box, much more so in a distributed environment. The basic steps of installing SSRS and integrating into SharePoint are well documented and consist of installing SSRS on SQL, installing the Reporting Services Add-in for SharePoint, and configuring. There are a lot of twists, turns, and caveats along the way, however, that can make this a not so simple setup.

The Reporting Services Configuration Manager should be used first to properly setup IIS, the database, encryption keys, and service accounts. No matter what you do or change to make things work, this should come up all greens whenever launched after configuration. If you manually change application pool credentials or authentication schemes, launch this tool again and make sure everything is green. I chose to install the RS virtual directory into my home SharePoint site, not the default website.

The first clue to ensuring things are working properly is the existence of the “Reporting Services” section under Application Management on the Central Admin page. If this new section does not exist, you may have to manually install the SharePoint add-in bits via command line. First run the installer which will copy all the bits without installing:

rsSharePoint.msi SKIPCA=1

Next find rsCustomAction.exe which should be in a temp directory in your user profile. This will deploy and activate the RS features to SharePoint:

rsCustomAction.exe /i

Watch for any permissions errors, correct if any exist, and rerun the installer. Once successful you should see the Reporting Services section in the Central Admin site.

http://my.opera.com/duncans/blog/2009/01/14/no-reporting-services-section-in-application-management-after-installing-rs-ad

Now you will see 3 new links under the RS section and each should be able to be accessed and configured without errors. Under Manage integration settings I had to set my report web service URL to http://<servername>/reportserver. The SP site alias did not work here for some reason [which may have been resolved in the finally step]. I also set the authentication mode to “windows authentication”. I read that many people set this to “trusted” with a service account but this did not work so well for me. 

Next grant your service account database access. Even though this is supposed to be setup during the RS Config tool, I had to manually give my service account rights to the DB in SQL before I could get this working.

The last link, set server defaults, is another hurdle that will truly test if your install is working. For a long while I would get 401: unauthorized errors here which required a lot of fiddling with IIS to get things working. Here is how my configuration ended up to make it work:

cscript adsutil.vbs set w3svc/NTAuthenticationProviders "NTLM"

• 
  
  Set IIS application pool identities to use service account with right to DB and SP. Managed pipeline mode should be classic.


• 
  
  Enable anonymous authentication on ReportServer vdir in IIS and set it to use the app pool identity. Ensure that the ASP.NET impersonation is set to use the authenticated user. Leave Windows Authentication enabled.


• 
  
  On the home SP site, enable basic authentication, set the default domain, and ensure that ASP.NET impersonation is set to use the authenticated user.

Ok, finally, I can get to the set server defaults link on the Central Admin site. Nothing earth-shattering to set or change there but now it is accessible at least. Making progress.  So next I tried to add the SQL Reporting Services Viewer web part to a page in SP to test. Click the “load tool” link to choose a report, click the “…” button and after a moment got a new window with yet another 401: unauthorized error. Even entering the path manually and clicking apply yielding the error below in the web part. This one was baffling and took days of scouring the internet before finally discovering a fix. I came very close to calling Microsoft about this after nothing was working.

I came across the following MS KB a couple of times but ignored the work around part, almost positive that it didn’t apply to me. Then I ran across another blog posting that explained the problem and fix in detail. The underlying issue appeared to be because of the way SP uses hostnames, especially when making calls between web services on the server. The fix was to add a new multi-string value in the registry called BackConnectionHostNames that contained both NetBIOS and FQDN’s of the site. Then like magic I could finally choose a report for the web part with no more errors!

KB 896861 via [MSDN blogs]

After attempting to install the patch KB967831 on OCS 2007 R2, if you don’t have MS message queue services installed, the install will fail and prevent the front end service from restarting. To fix you need to install the MS messaging queue services + server and reapply the patch. The front end service will then start again without issue.

To install these services quickly, from cmd run:

• ServerManagerCmd -i MSMQ-Services
• ServerManagerCmd -i MSMQ-Server

http://blogs.technet.com/exchangept/archive/2009/05/21/ocs-front-end-service-fails-to-start-after-kb967831.aspx

For whatever reason your SharePoint server is dead. The database checks out ok and is still accessible but you cannot get the portal to load and need to extract a critical document for an executive meeting 5 minutes from now.  By default, SharePoint stores documents in the SQL Server database as BLOBs (Binary Large Objects) and cannot be easily exported without assistance from the presentation tier.

Pascal Gill decided to write a custom application to solve this very problem and did so handily. His creation, SharePoint Database Exporter, can connect directly to the WSS_Content database and provides the ability to save any stored version of any document in the database in its native format. This includes the ability to capture custom lists, metadata, and even web parts.

Simply launch the utility (a single, self-contained executable), log in to the database, find the content you need to extract, and save it off somewhere. Done. Clean, simple, incredibly effective.

http://blog.dreamdevil.com/index.php/2007/03/13/sharepoint_2003_database_exporter/

If you’ve ever tried to enable SQL Reporting Services, after the fact, on an existing SQL server you may have noticed the Reporting Services button greyed out in the setup wizard. SSRS depends heavily on IIS and needs some very specific components installed before it will become available for install. These dependencies also exist in Server 2003, of course, but enabling them is very different in Server 2008.

http://support.microsoft.com/default.aspx/kb/938245/

The aforementioned KB walks through the steps of enabling via the Server Manager MMC, so here is the list of essential IIS role services that must be available to the server before SQL setup will allow you to install SSRS:

• Static Content
• Default Document
• Directory Browsing
• HTTP Errors
• HTTP Redirection
• ASP.NET
• Windows Authentication
• IIS Metabase Compatibility
• IIS 6 WMI Compatibility
• IIS 6 Scripting Tools
• IIS 6 Management Console

I stumbled across something very interesting today regarding these two components that is worth sharing, especially for anyone else managing a Server 2008 environment. Many of us got used to disabling the firewall in Server 2003 unless we needed to solve very specific security requirements with limited resources. The Firewall in Vista/Server 2008 has been completely revamped and is now a truly stateful firewall complete with profiles, profile-specific rules, and the ability to separately manage inbound/ outbound traffic. Host-based firewalls certainly add complexity to any environment and one has to be very cognizant of hosted services as well as consuming applications and users. Troubleshooting can be frustrating if you forget that “oh yeah that server has its firewall turned on”.

In my current dev environment I disabled the firewall on all servers, 2003 and 2008, via GPO. This is how you do it in XP and 2003 so the same applies to 2008, right? While this does in fact disable the firewall in 2008, there appears to be an underlying system dependency on the firewall service in Server 2008. I installed the April Windows updates on both a Server 2008 STD (x86) VM and a Server 2008 STD (x64) physical host. After rebooting, both servers came back up fine but were completely inaccessible from the network. No PING, no RDP, no CIFS. From the servers themselves, outbound traffic flowed without issue, to the internet, ping other hosts, browsing, etc. This was baffling especially since the firewall was disabled. Nothing should be blocking traffic! I followed the usual troubleshooting methods of digging through logs, checking driver revs, I even added a new vNIC and reinstalled vmTools in my VM thinking that maybe the virtual device had become corrupted somehow. Nothing worked!!

So I decided to do a packet capture to dig a bit deeper hoping that maybe the answer would become clear in the annals of the IP stack. Ok I see ICMP echo-requests coming into the server but it’s not replying, hmm. Let’s try a telnet to TCP 3389, I see SYN messages but the server isn’t sending a SYN-ACK back, what is going on here?? It seems that the server is flat choosing to not respond to inbound traffic. The firewall is definitely disabled.

Thinking this had something to do with Windows update, I opened a sev3 case with Microsoft. In the meantime I continued to troubleshoot and finally developed a work-around before they called me back. There is no stated dependency or published best practice (that I’ve seen) that recommends leaving the firewall enabled on Server 2008 lest you risk network problems. I think most people assume that it’s a security feature that can be safely disabled without adversely affected normal server performance or function [as it should be]. To fix the problem I enabled and started the firewall service, then in the firewall management MMC set all 3 profiles to allow/allow for inbound/outbound access. Both problem servers are now accessible and functioning perfectly on the network.

This experience changes the way I will setup Server 2008 environments as it appears the firewall is a mandatory service that the network service depends upon for normal operation. Microsoft doesn’t have a KB or any information yet about this issue so the support people are kicking my case up to the product teams for review. I also submitted a change request on the Connect site so hopefully someone will take notice and at the very least write a KB stating that the firewall service is a required component of Server 2008. Ideally this dependency will be dropped altogether but we’ll see. Here is my submission:

https://connect.microsoft.com/WindowsServerFeedback/feedback/ViewFeedback.aspx?FeedbackID=464554

To sum: leave your firewalls turned on in Server 2008 and if you wish to make them transparent then do so by allowing all traffic inbound/outbound for all profiles. Don’t disable the service!!

I’m a big fan of ISA and have been since 2000, yes even 2000. Many things have changed since then and mostly for the better. Layer 7 application filtering is a concept that has been around since the beginning and is one of the reasons ISA is a powerful firewall solution. The management of app filter behavior has gone from front and center to somewhat hidden, hence the purpose of this post. App filters provide the ability to control aspects of specific protocols that pass through the firewall: FTP, HTTP, RPC, SMTP, DNS, etc.

If you enable the FTP and HTTP filters on a general outbound internet access policy, the affects of the filters in default form can be quite limiting, especially for FTP. You can edit the policy’s filter behavior one of two ways: right-click context menu on the policy item, or via the filtering button on the Protocols tab in the policy item itself.

The default mode of the FTP filter is read only so you will be able to log into an external FTP site, execute dir/ls commands but transfers to or from will fail. Uncheck read only from the FTP protocol policy to enable full FTP functionality through the firewall. This behavior can be frustrating to troubleshoot if you don’t know where to look, especially since the configuration of the app filters is not particularly obvious.

The Windows 7 Release Candidate finally dropped and if you’re like me you’ve already installed it on every machine you own. =] A problem that I have had since Beta 1 is support for my HP OfficeJet V40xi. This is an all-in-one printer/fax/copier that is almost a decade old now but solid and stable as a rock. Vista has the drivers for it but none of the versions of Windows 7 have so far. HP hasn’t made a driver for this printer since XP. I also have a ReadyNas NV+ which serves as my print server so I connect to the the V40 via my NAS. Unfortunately the NAS doesn’t store and serve drivers so these have to be installed independently. Here is a work-around to get your legacy printer working with Win7 if both Microsoft and your printer manufacturer have abandoned your device.

Before you rebuild that last Vista PC, navigate to C:\Windows\System32\DriverStore\FileRepository\ and search for “prnxxx…” where xxx is your manufacturer and in my case prnhp001.inf_2ade4966 holds the drivers I need. Copy this folder off to a thumb drive or somewhere else safe. On your Win7 machine, connect to the legacy printer and when prompted for drivers point to the INF stored in this folder. Find your printer in the resulting list, let the system install your drivers, and you will be able to use your ancient printer on the next-gen OS. Cheers. :)

So you just got a great deal on a hosted/ dedicated server from one of the major hosting providers. KVM (IPMI) access has been established and the host OS has been installed, in this case Server 2008 x64. The server package comes with 1 dedicated and routable IP address but more are available for purchase, usually in packs.  The goal is, partially, to host VMs that are publically accessible from the internet. Hosters such as GigeNet and SoftLayer sell IP packs that are based on networks which rely on the primary host’s IP network. In other words, you can’t just assign the IPs from these ranges to VMs because, for one reason, they’re not on the same subnet as the host. The intention of the hoster is that you’ll bind these IPs to the NIC of the host, then assign them to websites. Access to these addresses are made available via the host’s primary network which has access to a default gateway. The IP pack networks have no gateway and as such are not routable on their own, even though they’re ultimately accessible via the internet. For example, my host’s IP is x.x.50.70/19 and my IP block is x.x.220.200/29. The /29 network has no routable gateway for my VMs to use and is not in the same subnet as my host so is unusable on its own. While this presents a challenge to solve it also offers some inherent security. The host, being on a completely separate subnet with a different IP scheme means that the it cannot be easily discovered via access to the VMs. There is nothing publicly accessible that exposes this relationship. Still with me?

To pull this off we need to enable routing on the host server. The same principle should apply to any host-based virtualization platform that makes use of virtual network interfaces (vNICs) to connect VM guests. In my scenario I’m using VMware Server 2.0. The first step is to enable the Network Policy and Access Services role in Server 2008. All that you need to make this work is RRAS which includes the RAS and Routing functionalities.

Once installed, launch your virtual network configuration and set up a new virtual adapter. You could modify a default adapter but I prefer to leave these alone and build one from scratch. In VMware Server you have 3 options for virtual networks:

• Bridged - shares the Host NIC with the virtual adapter (this requires routable IPs on the guest VMs)
• NAT – allows you to put your guests on a private network (192.x) and all traffic in/out from the VMs will use the Host’s IP
• Host-only – a private network shared with the host (this can be used to create an isolated network not internet accessible)

In this scenario the only viable option is the host-only network type which will allow me to bend the rules a bit. Create a new host virtual adapter and assign the subnet from your block of assigned IPs to it. This needs to be the address of the subnet which is not a usable address and in my case is .200.

Once the new virtual adapter is created you will see a new network interface in the network connections list on the host. Assign the next IP in your block to this interface and this will become the gateway for your VMs.

Now to apply the glue to hold it all together. In RRAS, create a new static route under the IPv4 context. Select the new virtual gateway interface (VMnet2) and point it to the host server’s network, subnet mask, and gateway. The destination is the host network’s subnet address, in this case x.x.50.64.