June, 2012 | Aidan Finn, IT Pro

On The Surface: Microsoft Announces Two Microsoft Tablets for Windows 8

So I was wrong. I was sure the big secret Microsoft announcement last night would just be some streaming media subscription service for the USA. Instead, 99% of the press got it right and Microsoft announced a Microsoft branded tablet line. Stealing the name from the table top device … welcome the Surface:

It is thin, 9.3mm, and that depends on which version of the Surface you choose:

It has a case that doubles as a keyboard and comes in different colours. The case features a built-in kickstand for when you want to prop it up. There is an audible snap when it closes which is nice. It is 0.7mm thick, thinner than a hotel room key:

Two Models

The Surface comes in two models. In broad strokes, the Windows RT (NVIDIA-made ARM-based CPU) is aimed at the consumer and competes with the iPad. It’s the thinner and lighter of the two devices. The Windows 8 Pro version is a twofer: it’s a tablet (slate PC) and a PC replacement. The Pro has an Ivy Bridge Intel i5 CPU and I’m guessing it’ll have around 10 hours battery life based on what we’ve seen from Dell’s future device.

The Body

No, I’m not talking about Elle McPherson, but sexy is what MSFT is aiming for none-the-less. The screen is Gorilla Glass 2. The chassis is made from VaporMg (pronounced Vapor-Mag), an injection moulded metal tolerant down to 0.65mm, and providing a perfectly smooth surface. The cover is snap on. It apparently has a solid snapping action which I saw being described by a present journalist as reassuring. This cover doubles as the keyboard which is flat. Size-wise, it’s thin. It’s the 1300 * 768 screen ratio you can expect of Windows 8 devices, with a landscape layout preferred over portrait.

Price

Nothing was confirmed. The Pro edition will allegedly compete in the Ultrabook price range. The RT edition will be similar to other ARM based tablets. The Pro edition will be some 90 days later.

Release Date

Good luck! Smile Surface RT will be shortly after the Windows 8 GA. It’ll be sold via Microsoft Stores (USA only) and the Microsoft Online Store.

Apps

Windows 8 is still a Release Preview. Metro apps will be released via the Microsoft Store, built into Windows 8. Being Windows with 300+ million PC sales per year, the apps will definitely come. Already there are some big names there, and a Netflix Metro app was announced last night too. This won’t be Windows Phone. Office 2013 RT will be bundled with the RT edition. Only Metro apps and Office 2013 RT can run on the RT Surface. The Pro Surface will run any .exe or Metro app that can run on any Intel/AMD-based Windows 8 PC/laptop.

Reaction

Positive first. Wow, how the hell did MSFT keep this secret? We already know the spec for the XBox 720 and that it’ll likely have Azure integration for cloud content/games. The device is sexy. It’s got a lot of features that I like … built in kick stand for the plane, and a keyboard cover are cool.

My main concern is simple: Will Microsoft release this device outside of the USA? Will it suffer from The Curse Of Zune?

Secondly: how did the CEOs of Acer, Asus, Toshiba, Sony, etc, react when they woke up in Asia this morning? They’re allegedly being charge $85/device for Windows 8 OEM for their devices. Now they will compete with Microsoft on device sales? What will this mean?

The way the announcement was made was strange. It was 23:30 UK/IE time, 00:30 German/France time and God-knows what time in Korea/Japan. Choosing 15:30 Pacific Time said to me that this was an event for an American audience. If an International announcement was important, surely they would have gone for 09:00 or 10:00 PST? Choosing not to stream the event was strange too. I’d scream from the mountain tops if I was announcing this. Inviting 150 journalists, many of whom wouldn’t know Windows from a door, to be your single channel of communications is very strange. Yes, they want to copy Apple and have exclusivity, but this seems wrong to me. Just my independent opinion.

People are talking about this device. I’ve already had 5-6 conversations about Surface this morning in the office in the last 90 minutes. Strange, considering that it looks like only 5% of the world’s population (USA) will be able to buy one.

Summary

The Surface is a fab looking device. I’d like to have a try, and maybe consider buying the Pro version. Will it be an XBox/Kinect or a Zune/Kin? Will I end up even being able to buy one of these innovative devices? Time will tell. Have a look and make up your own mind:

EDIT #1

Some more notes. MSFT released video recordings of the event. You can stream it, or download it.

Above, you can see that the kick stand angles the Surface at 22 degrees. What if you wanted to record something at the table? Having the camera pointed downwards would be useless. The back camera is pointed upwards at 22 degrees to compensate for the kickstand angle.

The keyboard/cover snaps into a magnetically bonded spine. The Metro UI changes colour to match the colour of the Touch Cover! There are aligning and clamping magnets to organically connect correctly. You can hear it snap into place in the video. When you fold it back, the keyboard turns off, thanks to an accelerometer. Touch cover allows your fingers to touch the keyboard and it measures force to count those touches as types. Therefore you can touch type from the rest position.

The Pro edition has a wrap around vent so it’s never blocked. It is silent – I rarely even notice the vent on my Ultrabook, whereas I do on my Build slate.

The screen supports 600 DPI digital ink using a stylus pen. Zoom in and the ink is still smooth. The touch digitiser detects the pen being used and blocks touch so your hand on the screen doesn’t cause chaos for the pen digitiser. The screen is 0.7mm thick, making it the thinnest of it’s kind. The pen clicks into the side of the Surface.

TPM apparently is included. It supports HDMI and DisplayPort. They demo Adobe Lightroom on the Pro edition.

The cover comes in two models:

Touch Cover: a 3mm cover with a multi-touch keyboard.
Type Cover: designed for the touch typist wanting great speed. Key has 1.5 mm travel with full modern trackpad.

This is a beautifully designed device. But I’m told that the same was said of Zune which defined The Curse Of Zune by being only available to 5% of the world’s population – the web site wasn’t even visible to us back then! I’ve asked a person who understands channel, and he reckons it’ll allow MSFT to control the distribution with more quality. Maybe they’ll reach out to large chains like PC World (UK) and Best Buy (USA) next year, or the year after if Surface doesn’t go the way of Zune.

Technorati Tags: Hardware,Microsoft,Windows 8

Windows Server 2012 High-Performance, Highly-Available Storage Using SMB

Notes from TechEd NA 2012 session WSV303:

One of the traits of the Scale-Out File Server is Transparent Failover for server-server apps such as SQL Server or Hyper-V. During a host power/crash/network failure, the IO is paused briefly and flipped over to an alternative node in the SOFS.

Transparent Failover

The Witness Service and state persistence enable Transparent Failover in SMB 3.0 SOFS. The Witness plays a role in unplanned failover. Instead of a TCP timeout (40 seconds and causing application issues), speeds up the process. It tells the client that the server that they were connected to has failed and should switch to a different server in the SOFS.

NTFS Online Scan and Repair

CHKDSK can take hours/days on large volumes.
Scan done online
Repair is only done when the volume is offline
Zero downtime with CSV with transparent repair

Clustered Hardware RAID

Designed for when using JBOD, probably with Storage Spaces.

Resilient File System (ReFS)

A new file system as an alternative to NTFS (which is very old now). CHKDSK is not needed at all. This will become the standard file system for Windows over the course of the next few releases.

Comparing the Performance of SMB 3.0

Wow! SMB 3.0 over 1 Gbps network connection achieved 98% of DAS performance using SQL in transactional processing.

If there are multiple 1 Gbps NICs then you can use SMB Multichannel which gives aggregated bandwidth and LBFO. And go extreme with SMB Direct (RDMA) to save CPU.

VSS and SMB 3.0 File Shares

You need a way to support remote VSS snapshots for SMB 3.0 file shares if supporting Hyper-V. We can do app consistent snapshots of VMs stored on a WS2012 file server. Backup just works as normal – backing up VMs on the host.

Backup talks to backup agent on host.
Hyper-V VSS Writer reaches into all the VMs and ensures everything is consistent.
VSS engine is then asked to do the snapshot. In this case, the request is relayed to the file server where the VSS snapshot is done.
The path to the snapshot is returned to the Hyper-V host and that path is handed back to the backup server.
The backup server can then choose to either grab the snapshot from the share or from the Hyper-V host.

Data Deduplication

Dedup is built into Windows Server 2012. It is turned on per-volume. You can exclude folders/file types. By default files not modified in 5 days are deduped – SO IT DOES NOT APPLY TO RUNNING VMs. It identifies redundant data, compresses the chunks, and stores them. Files are deduped automatically and reconstituted on the fly.

REPEAT: Deduplication is not intended for running virtual machines.

Unified Storage

The iSCSI target is now built into WS2012 and can provide block storage for Hyper-V before WS2012. ?!?!?! I’m confused. Can be used to boot Hyper-V hosts – probably requiring iSCSI NICs with boot functionality.

Technorati Tags: Event Notes,Windows Server 2012,Storage

Building a Highly Available Failover Cluster Solution With WS2012 From The Ground Up

Some notes taken from TechEd NA 2012 WSV324:

I won’t blog too much from this session. I’ve more than covered a lot of it in the recent months.

Cluster Validation Improvements

Faster storage validation
Includes Hyper-V cluster validation tests
Granular control to validate a specific LUN
Verification of CSV requirements
Replicated hardware aware for multi-site clusters

CSV Improvements

No external authentication dependencies for improved performance and resiliency
Multi-subnet support (multi-site clusters)

Asymmetric Cluster

BitLocker on CSV

This will get the BitLocker status of the CSV:

manage-bde –status C:ClusterStorageVolume1

This will enable BitLocker on a CSV:

manage-bde –on C:ClusterStorageVolume1 –RecoverPassword

You get a warning if you try to run this with the CSV online. You need the volume to be offline (Turn On Maintenance Mode under More Actions when you right-click the CSV) … so plan this in advance. Otherwise be ready to do lots of Storage Live Migration or have VM downtime.

NOTE! A recovery password is created for you. Make sure you record this safely in a place independent from the cluster that is secure and reliable.

Get the status again to check the progress.

It’s critically important that you add the security descriptor for the cluster so that the cluster can use the now encrypted CSV. Get that by:

get-cluster

Say that returns the name HV-Cluster1.

Now run the following, and note the $ at the end of the security descriptor (indicating computer account for the cluster):

manage-bde C:ClusterStorageVolume1 –protectors –add –sid HV-Cluster1$

That can be done while the CSV is encrypting. Once encrypted, you can take it out of maintenance mode.

AD Integration

You now can intelligently place Cluster Name Objects (CNO) and Virtual Computer Objects (VCO) in desired OUs.
AD-less Cluster Bootstrapping allows you to run/start a cluster with no physical domain controllers. This gets a justifiable applause It’s great news for branch offices and SMEs.
Repair action to automatically recreate VCOs
Improved logging and diagnostics
RODC support fro DMZ and branch office deployments

Node Vote Weight

In a stretch or mult-site cluster, you can configure which nodes have votes in determining quorum.
Configurable with 1 or 0 votes. All nodes have a vote by default. Does not apply in Disk Only quorum model.
In the multi-site cluster model, this allows the primary site to have the majority of votes.

Dynamic Quorum

It is now the default quorum choice in WS2012 Failover Clustering
Works in all quorum models except Disk Only Quorum.
Quorum changes dynamically based on nodes in active membership
Numbers of votes required for quorum changes as nodes go inactive
Allows the cluster to stay operations with >50% node count failure

Thoughts:

I guess it is probably useful for extremely condensed cluster dynamic power optimisation (VMM 2012)
Also should enable cluster to reconfigure itself when there are node failures

Configuration:

EnableDynamicQuorum edit a cluster common property to enable dynamic quorum

DynamicWeight Node private property to view a node’s current vote weight

Cluster Scheduled Tasks

3 types:

Cluster wide: On all nodes
Any node: On a random node
Resource specific: On the node that owns the resource

PowerShell:

Register-ClusteredScheduleTask
Unregister-ClusteredShceduledTask
Set-ClusteredScheduledTask
Get-ClusteredScheduledTask

Technorati Tags: Windows Server 2012,Failover Clustering,Hyper-V,Virtualisation

Windows Server 2012 Cluster-In-A-Box, RDMA, And More

Notes taken from TechEd NA 2012 session WSV310:

Volume Platform for Availability

Huge amount of requests/feedback from customers. MSFT spent a year focusing on customer research (US, Germany, and Japan) with many customers of different sizes. Came up with Continuous Availability with zero data loss transparent failover to succeed High Availability.

Targeted Scenarios

Business in a box Hyper-V appliance
Branch in a box Hyper-V appliance
Cloud/Datacenter high performance storage server

What’s Inside A Cluster In A Box?

It will be somewhat flexible. MSFT giving guidance on the essential components so expect variations. MSFT noticed people getting cluster networking wrong so this is hardwired in the box. Expansion for additional JBOD trays will be included. Office level power and acoustics will expand this solution into the SME/retail/etc.

Lots of partners can be announced and some cannot yet:

HP
Fujitsu
Intel
LSI
Xio
And more

More announcements to come in this “wave”.

Demo Equipment

They show some sample equipment from two Original Device Manufacturers (they design and sell into OEMs for rebranding). One with SSD and Infiniband is shown. A more modest one is shown too:

That bottom unit is a 3U cluster in a box with 2 servers and 24 SFF SAS drives. It appears to have additional PCI expansion slots in a compute blade. We see it in a demo later and it appears to have JBOD (mirrored Storage Spaces) and 3 cluster networks.

RDMA aka SMB Direct

Been around for quite a while but mostly restricted to the HPC space. WS2012 will bring it into wider usage in data centres. I wouldn’t expect to see RDMA outside of the data centre too much in the coming year or two.

RDMA enabled NICs also known as R-NICs. RDMA offloads SMB CPU processing in large bandwidth transfers to dedicated functions in the NIC. That minimises CPU utilisation for huge transfers. Reduces the “cost per byte” of data transfer through the networking stack in a server by bypassing most layers of software and communicating directly with the hardware. Requires R-NICs:

iWARP: TCP/IP based. Works with any 10 GbE switch. RDMA traffic routable. Currently (WS2012 RC) limited to 10 Gbps per NIC port.
RoCE (RDMA over Converged Ethernet): Works with high-end 10/40 GbE switches. Offers up to 40 Gbps per NIC port (WS2012 RC). RDMA not routable via existing IP infrastructure. Requires DCB switch with Priority Flow Control (PFC).
InfiniBand: Offers up to 54 Gbps per NIC port (WS2012 RC). Switches typically less expensive per port than 10 GbE. Switches offer 10/40 GbE uplinks. Not Ethernet based. Not routable currently. Requires InfiniBand switches. Requires a subnet manager on the switch or on the host.

RDMA can also be combined with SMB Multichannel for LBFO.

Applications (Hyper-V or SQL Server) do not need to change to use RDMA and make the decision to use SMB Direct at run time.

Partners & RDMA NICs

Mellanox ConectX-3 Dual Port Adapter with VPI InfiniBand
Intel 10 GbE iWARP Adapter For Server Clusters NE020
Chelsio T3 line of 10 GbE Adapters (iWARP), have 2 and 4 port solutions

We then see a live demo of 10 Gigabytes (not Gigabits) per second over Mellanox InfiniBand. They pull 1 of the 2 cables and throughput drops to 6,000 Gigabytes per second. Pop the cable back in and flow returns to normal. CPU utilisation stays below 5%.

Configurations and Building Blocks

Start with single Cluster in a Box, and scale up with more JBODs and maybe add RDMA to add throughput and reduce CPU utilisation.
Scale horizontally by adding more storage clusters. Live Migrate workloads, spread workloads between clusters (e.g. fault tolerant VMs are physically isolated for top-bottom fault tolerance).
DR is possible via Hyper-V Replica because it is storage independent.
Cluster-in-a-box could also be the Hyper-V cluster.

This is a flexible solution. Manufacturers will offer new refined and varied options. You might find a simple low cost SME solution and a more expensive high end solution for data centres.

Hyper-V Appliance

This is a cluster in a box that is both Scale-Out-File Server and Hyper-V cluster. The previous 2 node Quanta solution is set up this way. It’s a value solution using Storage Spaces on the 24 SFF SAS drives. The space are mirrored for fault tolerance. This is DAS for the 2 servers in the chassis.

What Does All This Mean?

SAN is no longer your only choice, whether you are SME or in the data centre space. SMB Direct (RDMA) enables massive throughput. Cluster-in-a-Box enables Hyper-V appliances and Scale-Out File Servers in ready made kits, that are continuously available and scalable (up and out).

Technorati Tags: Event Notes,Windows Server 2012,Storage,Failover Clustering,Networking

KB2722461 – High Rate Of SMIs May Cause Hyper-V Host To Hang At Boot On W2008 R2

A new KB article related to Hyper-V was posted this morning.

You have a Windows Server 2008 R2 system with the Hyper-V role enabled. If the BIOS has been set to inject SMIs at a high rate, 11 SMI/sec for example. The system may hang during boot time.

As the rate of SMI injections increases, the likelihood of failure (system hanging) increases.

Cause

If an SMI occurs before all processors are ready to receive SMIs, Windows boot will hang.

Resolution

Reduce the rate of SMI injection in the BIOS to prevent a hang during Windows boot.

Technorati Tags: Hyper-V,Windows Server 2008 R2,Hardware,Virtualisation

Cluster Shared Volumes Reborn in WS2012: Deep Dive

Noes from TechEd North America 2012 session WSV430:

New in Windows Server 2012

File services is supported on CSV for application workloads. Can leverage SMB 3.0 and be used for transparent failover Scale-Out File Server (SOFS)
Improved backup/restore
Improved performance with block level I/O redirection
Direct I/O during backup
CSV can be built on top of Storage Spaces

New Architecture

Antivirus and backup filter drivers are now compatible with CSV. Many are already compatible.
There is a new distributed application consistent backup infrastructure.
ODX and spot fixing are supported
BitLocker is supported on CSV
AD not longer a dependency (!?) for improved performance and resiliency.

Metadata Operations

Lightweight and rapid. Relatively infrequent with VM workloads. Require redirected I/O. Includes:

VM creation/deletion
VM power on/off
VM mobility (live migration or storage live migration)
Snapshot creation
Extending a dynamic VHD
Renaming a VHD

Parallel metadata operations are non disruptive.

Flow of I/O

For non-metadata IO: Data sent to the CSV Proxy File System. It then routes to the disk via CSV VolumeMgr via direct IO.
For metadata redirected IO (see above): We get SMB redirected IO on non-orchestrator (not the CSV coordinator/owner for the CSV in question) nodes. Data is routed via SMB redirected IO by the CSV Proxy File System to the orchestrator via the cluster communications network so the orchestrator can handle the activity.

Interesting Note

You can actually rename C:ClusterStorageVolume1 to something like C:ClusterStorageCSV1. That’s supported by CSV. I wonder if things like System Center support this?

Mount Points

Used custom reparse points in W2008 R2. That meant backup needed to understand these.
Switched to standard Mount Points in WS2012.

Improved interoperability with:

Performance coutners
OpsMgr (never had free space monitoring before)
Free space monitoring (speak of the devil!)
Backup software can understand mount points.

CSV Proxy File System

Appears as CSVFS instead of NTFS in disk management. NTFS under the hood. Enabled applications and admins to be CSV aware.

Setup

No opt-in any more. CSV enabled by default. Appears in normal storage node in FCM. Just right click on available storage to convert to CSV.

Resiliency

CSV enables fault tolerance file handles. Storage path fault tolerance, e.g. HBA failure. When a VM opens a VHD, it gets a virtual file handle that is provided by CSVFS (metadata operation). The real file handle is opened under the covers by CSV. If the HBA that the host is using to connect the VM to VHD fails, then the real file handle needs to be recreated. This new handle is mapped to the existing virtual file handle, and therefore the application (the VM) is unaware of the outage. We get transparent storage path fault tolerance. The fault tolerant SAN connectivity (remember that direct connection via HBA has failed and should have failed the VM’s VHD connection) is re-routed by Redirected IO via the Orchestrator (CSV coordinator) which “proxies” the storage IO to the SAN.

If the Coordinator node fails, IO is queued briefly and the orchestration role fails over to another node. No downtime in this brief window.

If the private cluster network fails, the next available network is used … remember you should have at least 2 private networks in a CSV cluster … the second private network would be used in this case.

Spot-Fix

Scanning is separated from disk repair. Scanning is done online.
Spot-fixing requires offline only to repair. It is based on the number of errors to fix rather than the size of the volume … could be 3 seconds.
This offline does not cause the CSV to go “offline” for applications (VMs) using that CSV being repaired. CSV proxy file system virtual file handles appear to be maintained.

This should allow for much bigger CSVs without chkdsk concerns.

CSV Block Cache

This is a distributed write-through cache. Un-buffered IO is targeted. This is excluded by the Windows Cache Manager (buffered IO only). The CSV block cache is consistent across the cluster.

This has a very high value for pooled VDI VM scenario. Read-only (differencing) parent VHD or read-write differencing VHDs.

You configure the memory for the block cache on a cluster level. 512 MB per host appears to be the sweet spot. Then you enable CSV block cache on a per CSV basis … focus on the read-performance-important CSVs.

Less Redirected IO

New algorithm for detecting type of redirected IO required
Uses OpsLocks as a distributed locking mechanism to determine if IO can go via direct path

Comparing speeds:

Direct IO: Block level IO performance parity
Redirected IO: Remote file system (SMB 3.0) performance parity … can leverage multichannel and RDMA

Block Level Redirection

This is new in WS2012 and provides a much faster redirected IO during storage path failure and redirection. It is still using SMB. Block level redirection goes directly to the storage subsystem and provides 2x disk performance. It bypasses the CSV subsystem on the coordinator node – SMB redirected IO (metadata) must go through this.

You can speed up redirected IO using SMB 3.0 features such as Multichannel (many NICs and RSS on single NICs) and RDMA. With all the things turned on, you should get 98% of the performance of direct IO via SMB 3.0 redirected IO – I guess he’s talking about Block Level Redirected IO.

VM Density per CSV

Orchestration is done on a cluster node (parallelized) which is more scalable than file system orchestration.
Therefore there are no limits placed on this by CSV, unlike in VMFS.
How many IOPS can your storage handle, versus how many IOPS do your VMs need?
Direct IO during backup also simplifies CSV design.

If your array can handle it, you could (and probably won’t) have 4,000 VMs on a 64 node cluster with a single CSV.

CSV Backup and Restore Enhancements

Distributed snapshots: VSS based application consistency. Created across the cluster. Backup applications query the CSV to do an application consistent backup.
Parallel backups can be done across a cluster: Can have one or more concurrent backups on a CSV. Can have one or more concurrent CSV backups on a single node.
CSV ownership does not change. There is no longer a need for redirected IO during backup.
Direct IO mode for software snapshots of the CSV – when there is no hardware VSS provider.
Backup no longer needs to be CSV aware.

Summary: We get a single application consistent backup snapshot of multiple VMs across many hosts using a single VSS snapshot of the CSV. The VSS provider is called on the “backup node” … any node in the cluster. This is where the snapshot is created. Will result in less data being transmitted, fewer snapshots, quicker backups.

How a CSV Backup Work in WS2012

Backup application talks to the VSS Service on the backup node
The Hyper-V writer identifies the local VMs on the backup node
Backup node CSV writer contacts the Hyper-V writer on the other hosts in cluster to gather metadata of files being used by VMs on that CSV
CSV Provider on backup node contacts Hyper-V Writer to get quiesce the VMs
Hyper-V Writer on the backup node also quiesces its own VMs
VSS snapshot of the entire CSV is created
The backup tool can then backup the CSV via the VSS snapshot

Post-TechEd North America 2012 Additions To My WS2012 Hyper-V Features List

A number of new Windows Server 2012 Hyper-V and related features were made public last week at TechEd NA 2012. I have updated my list to include those features.

Technorati Tags: Windows Server 2012,Hyper-V,Virtualisation,Failover Clustering,Networking,DR,Security,Cloud Computing,Hyper-V Server

Hyper-V Is NOT Affected By VU#649219 VM “Break Out”

It was reported by the media earlier this week that an issue on Intel based servers could lead to a “break out” from a VM to the host in certain virtualisation products, including Microsoft. Obviously this would be a huge concern, especially in environments where security and isolation are an issue, e.g. public cloud/hosting.

I asked the Hyper-V product group if Hyper-V was actually affected. They group allowed us to share that:

The problem does affect the 64-bit OS’s on Intel hardware, but Hyper-V is not affected.
This problem will not lead to break outs from Hyper-V VMs.
Windows 8/Server 2012 are not affected.

So that’s put that one to bed.

Technorati Tags: Security,Hyper-V,Virtualisation,Windows Server 2008 R2

SYSRET 64-bit OS Privilege Escalation Vulnerability On Intel CPU Hardware

CERT reported that:

Some 64-bit operating systems and virtualization software running on Intel CPU hardware are vulnerable to a local privilege escalation attack. The vulnerability may be exploited for local privilege escalation or a guest-to-host virtual machine escape.

That last bit is the piece that should concern you. Microsoft responded with one of this month’s Patch Tuesday updates (thanks to Patrick Lownds for the link). MS12-042 fixes this issue and is distributed through the normal Windows Updates catalogue.

An elevation of privilege vulnerability exists in the way that the Windows User Mode Scheduler handles system requests. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full administrative rights.

Mitigating factors for user mode scheduler memory corruption vulnerability:

An attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability. The vulnerability could not be exploited remotely or by anonymous users.
This vulnerability only affects Intel x64-based versions of Windows 7 and Windows Server 2008 R2.
Systems with AMD or ARM-based CPUs are not affected by this vulnerability.

Update your servers, including Hyper-V hosts with this update. System Center 2012 VMM will automate this for you if you have it and configured the updates feature.

Technorati Tags: Security,Hyper-V,Windows Server 2008 R2