Dario IT Solutions Blog

December 2008 - Posts

Incorrect Home Folder Mapping

Symptoms

Users' Home Folder maps incorrectly on workstations.
The home folder is mapped to the base share instead of the complete path to the profile.
This only happens on PCs. When logging on to terminal servers the mapping is done correctly.

Example:
Home folder set to: \\fileServer\Company\Department\UserName
The mapping that the user receives : \\fileServer\Company
Manually mapping the path completes successfully and all files are accessible.

The users are the owners of their folders and all permissions are sufficient for drive mapping.  

 

Cause

Network delays may cause the workstation to try and map the home folder before completely initializing networking during logon.

 

Resolution

Apply the following setting using GPO :

Computer Configuration / Administrative Templates / System / Logon / Always wait for the network at computer startup and logon

 

More Information

 

Description of the Windows XP Professional Fast Logon Optimization feature
http://support.microsoft.com/kb/q305293/

 

Info from the policy's description

Determines whether Windows XP waits for the network during computer startup and user logon. By default, Windows XP does not wait for the network to be fully initialized at startup and logon. Existing users are logged on using cached credentials, which results in shorter logon times. Group Policy is applied in the background once the network becomes available.

Note that because this is a background refresh, extensions such as Software Installation and Folder Redirection take two logons to apply changes. To be able to operate safely, these extensions require that no users be logged on. Therefore, they must be processed in the foreground before users are actively using the computer. In addition, changes that are made to the user object, such as adding a roaming profile path, home directory, or user object logon script, may take up to two logons to be detected.

If a user with a roaming profile, home directory, or user object logon script logs on to a computer, Windows XP always waits for the network to be initialized before logging the user on.

If a user has never logged on to this computer before, Windows XP always waits for the network to be initialized.

If you enable this setting, logons are performed in the same way as for Windows 2000 clients, in that Windows XP waits for the network to be fully initialized before users are logged on. Group Policy is applied in the foreground, synchronously.

If you disable or do not configure this setting, Windows does not wait for the network to be fully initialized and users are logged on with cached credentials. Group Policy is applied asynchronously in the background.

Note: If you want to guarantee the application of Folder Redirection, Software Installation, or roaming user profile settings in just one logon, enable this setting to ensure that Windows waits for the network to be available before applying policy.

Note: For servers, the startup and logon processing always behaves as if this policy setting is enabled.

Quote from Microsoft's Official eBook "Configuring Windows Server 2008 Active Directory"

"It is highly recommended that you enable the Always Wait For Network At Startup And Logon policy setting for all Windows XP and Windows Vista clients. Without this setting, by default, Windows XP and Windows Vista clients perform only background refreshes (of GPOs), meaning that a client might start up and a user might log on without receiving the latest policies from the domain."

Operation Manager 2007 in Highly Available and Distributed Enterprise Environments

SCOM MVP Andy Dominey has compiled a very nice document on installing System Center Operations Manager 2007 with high availability.

Get it from here - SCOM in Highly Available and Distributed Enterprise Environments.

Presentations from the System Center Round Table for Enterprise Clients

As promised, I’ve uploaded the presentations from the sessions I gave on December 18th at Microsoft Israel. Enjoy.

 

Moravec's paradox

http://en.wikipedia.org/wiki/Moravec%27s_paradox

Trend Micro OfficeScan on Server 2008 Cluster
Issue:
Trend Micro OfficeScan Version 8.0 SP1 on a server 2008 Failover Cluster may cause the cluster service to fail while moving a resource group. 

Cause:
Current TDI Driver of the OfficeScan causes a loss of connectivity between the cluster nodes, and may cause the cluster service on one of the nodes to fail. The current version of  office scan doesn't support Windows Server 2008 Clusters yet. It should be supported in the next version. 

Workaround:
Until the newer version of OfficeScan, a workaround is available for this issue.
Follow these instruction : 

Open Device Manager
Select View > Show Hidden Devices
Expand Non-Plug and play devices
Select Trend Micro TDI Driver  > Properties
Go to Driver tab
Under Current Status press the stop button
Under Startup change the type to Disabled (Uninstalling the driver didn't work, because it was installed automatically at the next boot.) 

Repeat these steps on both nodes and restart them.

Tools for Virtualization and System Center

Check out these direct download links to a bunch of highly usable tools that can make your life easier:

Windows 2008 R2 NLB & Failover Clustering

Check out this nice list of new clustering features just around the corner:

New Failover Clustering features in R2:

  1. Cluster Shared Volumes (CSV) – A distributed access file system optimized for Hyper-V allowing virtual machines and their disk resources to reside be on any cluster node
  2. Live Migration – Move virtual machines between different physical machines while keeping them running and maintaining client connections
  3. PowerShell Support – The scripting language of the future which will gradually replace cluster.exe
  4. DFS-Replication support – Make the primary member of your replication group highly available so that it always has access to the authoritative copy of the data
  5. Remote Desktop / Terminal Services support – Make the Connection Broker highly available ensuring that clients are reconnected to their same session or virtual machine within a server farm
  6. Network Prioritization – Plan your internal cluster network for efficiency, giving the fastest network the highest priority for internal traffic (heartbeat, CSV & Live Migration traffic)
  7. Read-Only APIs – This security enhancement allows admins to query the state of the cluster, but not perform any actions, making it ideal for first-level triage who "can look, but not touch"
  8. ETW logging channels – New Crimson channel makes cluster-wide events easier to manage
  9. Performance Monitor – Clustering counters allow the user to monitor the cluster and tweak it for optimal performance
  10. Enhanced Validation – Improvements to the functional test tool with additional tests which execute on production cluster nodes to ensure they are running optimally, with best practices deployed
  11. Migration – The clustering upgrade path now supports more workloads and configurations and offers detailed information about what will be migrated and any additional steps required by the user

New Network Load Balancing features in R2:

  1. Extended Affinity – Ensures clients are reconnected to the same node to retain cached information if they are disconnected
  2. PowerShell Support – The new NLB scripting language which will gradually replace nlb.exe and wlbs.exe
My Presentation on Windows 2008 Security

Windows 2008 has a lot new security features like CNG, RODC, ASLR, Windows Auditing, Windows Defender, Security Center, Service Hardening, Bitlocker, NAP, UAC.

If you are interested on learning more about them and what is different from Windows 2003\XP to Windows 2008\Vista you are welcome to check a session I gave at Microsoft Israel.

Windows 2008 Security
View SlideShare presentation or Upload your own. (tags: auditing windows)
IBM Deployment Pack for Microsoft System Center Configuration Manager 2007

The IBM Deployment Pack for Microsoft System Center Configuration Manager 2007 is a deployment kit that extends Configuration Manager 2007 by providing IBM utilities, drivers, and custom tasks for creating automated deployment scripts for IBM target servers. The IBM extensions are available as built-in actions within the Configuration Manager menus.

The IBM Deployment Pack includes various IBM and third-party tools that are needed to configure items such as RAID adapters, management cards, BIOS settings, and other vendor specific settings that are required when deploying servers. While it is true these types of activities can be manually added to the operating system deployment (OSD) process, the Deployment Pack is a much simpler solution that puts everything in the right place for the user, so the tools are ready to use in a custom task sequence.

It also includes a custom boot image that is already prepared to work with Configuration Manager OSD. This tool is highly recommended and will save a huge amount of setup and preparation time for the deployment of x86 / x64 servers.

Download from here:

IBM Deployment Pack for Microsoft System Center Configuration Manager 2007

IBM Deployment Pack for Configuration Manager 2007, v1.0 Release Notes

Controlling Processor Resources in Hyper-V Guests

Hyper-V by default provides all virtual machines equal priority and access to resources. You may have situations where you want to guarantee that a virtual machine has a specific amount of processing power available at all times, that you want to be sure that the virtual machine can never consume more than a specific percentage of processing power, or that you want it as a default to balance power except in peak processing times and then give a specific VM more processing priority. Hyper-V gives you the flexibility to choose your resource control method on a per virtual machine basis.

Check out the following post to learn more.

Virtual Machine Manager Configuration Analyzer 2008 (VMMCA)

Microsoft has just announced the availability of Virtual Machine Manager Configuration Analyzer 2008 (VMMCA). Virtual Machine Manager 2008 Configuration Analyzer (VMMCA) is a diagnostic tool that you can use to evaluate important configuration settings for computers that either are serving or might serve Virtual Machine Manager (VMM) roles or other VMM functions.

To download VMMCA 2008 -

http://www.microsoft.com/downloads/details.aspx?FamilyID=02d83950-c03d-454e-803b-96d1c1d5be24&displaylang=en

Does a datacenter really needs a roof?

Take a look at this picture:

image

Is there any chance it looks like a datacenter to you? :)

Well, believe it or not, but it is. it’s actually the 4th generation of Microsoft datacenter design. A couple of very interesting posts has been published by the design team, I highly recommend you check them out:

Our Vision for Generation 4 Modular Data Centers - One way of Getting it just right . . .

Microsoft's Generation 4 Data Center Vision - the Architects' Perspective

Data Protection Manager SP1

SP 1 for System Center Data Protection Manager 2007 will be available on December 8th 2008. Along with the roll up update this release enhances many of the core features of DPM 2007. The key among them being

  1. Protection of Hyper-V™ virtualization platforms
  2. Enhanced SQL Server 2008 protection
  3. Microsoft Office SharePoint Server 2007 and Windows SharePoint Services 3.0
  4. Protection for Exchange Server 2007 Standby Cluster Replication (SCR)

In addition to enhancing the protection of each of the core Microsoft application workloads, additional capabilities have also been introduced with the release of DPM 2007 SP1, such as:

  1. Provision for a Client DPML answers customer demand for a more cost-effective way to protect Windows XP and Windows Vista clients using the same DPM 2007 infrastructure that protects their servers
  2. Disaster Recovery capabilities within DPM 2007 SP1 now include the ability to leverage a 3rd party vaulting partner via the cloud (SaaS) powered by Iron Mountain.