Altaro – Webinar & eBook On Microsoft Licensing For Virtual Environments

Altaro has published a free e-book called Licensing Microsoft Server in a Virtual Environment. I know this is a hot topic because it’s one of this site’s top search results every month. The ebook, written by Eric Siron, covers:

  • The concept of Microsoft licensing in a virtual environment
  • Windows Server, Hyper-V Server 2012 & 2012 R2 licensing
  • Difference between keys & licenses
  • Understand license transfers, stacking & implications for a cluster
  • Mapped example diagrams of common virtual licensing environment

Altaro is also running a webinar on this topic on Decentber 4th, featuring fellow Hyper-V MVP Thomas Maurer and Andrew Syrewicze. This webinar will run for 45 minutes with live Q&A, starting at 10am EST or 3pm GMT.

Getting An Ultrabook To Boot From USB

Do you have a new laptop that refuses to boot from USB? You’re failing to get Windows to install from a removable device? Don’t have an RJ45 port to do PXE installs?

If so, I think I have a hack for you. This is what I used for my Toshiba KIRAbook when wiping Windows 10 Techniacl Preview to reinstall Windows 8.1 – it took a lot of Googling and experimentation to get the thing to boot from USB. My fix is not perfect because you sacrifice Secure Boot, but it works. And no, this page from Microsoft, which is copied endlessly on the Internet, is Bull$h1t.

The cause of the issue is UEFI, the successor to BIOS. You are going to have to configure 3 things:

1) Disable Secure Boot

Reboot your laptop into the UEFI setup (probably one of the function keys – this page is pretty good).

2) Enable CSM Boot/Disable UEFI Boot

In my Toshiba KIRAbook, I found this under Advance > System Configuration. The setting name changes depending on if it is enabled or not.

Note that this setting might be greyed out if you haven’t disabled Secure Boot yet.

3) Prepare a Boot Stick

I used a free tool called Rufus to prepare a USB stick from the Windows 8.1 with Update ISO file.

You can now install Windows on your laptop. You’ve lost Secure Boot and UEFI Boot (Windows 8.1 will not start when they are enabled), but you are able to install Windows. I’ll update this post if anyone comes up with something better.

Note: I hate this bolloxology. This stuff should be much easier.

Microsoft News – 24 November 2014

It’s been a slow few news days in the Microsoft world. Stuff I’m not linking to: the infinitely linked webcasts on mobility management and the Reign malware infecting computers in Ireland, Russia, and Saudi Arabia.

Windows Server

Windows Client

Azure

Office 365

Miscellaneous

Microsoft News – 20 November 2014

There are a lot of upset people because of (1) the Azure outage and (2) how Microsoft communicated during the outage. We had a couple of affected customers. The only advice I can give to Microsoft is:

  1. Don’t deploy your updates to everything at the same time.
  2. Now you know how customers feel when bad updates are issued. Bring back complete testing.
  3. Communicate clearly during an issue – that includes sending emails to affected customers. You’ve got monitoring systems & automation – use them. Heck, you even blogged about how (Azure) Automation could be used by customers to trigger actions.

Hyper-V

Azure

Miscellaneous

November 2014 Update Rollup For Windows–And It Has Issues

Microsoft released November 2014 update rollup for Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2 yesterday. This rollup includes lots of fixes, including improved performance of a SOFS cluster during parallelized restores. As usual, I recommend waiting 4 weeks to let others be Microsoft’s testing canaries.

Correction: There are no known problems with the above update.

However, an update rollup released at the same time for Windows Server 2012 DOES in fact have a problem. Microsoft Hyper-V PM, Taylor Brown, tweeted that applying KB2996928 fixes the issue.

Microsoft News – 19 November 2014

Pay attention to the security update for Windows that was released out of band last night. It’s an important one that prevents people from crafting custom Kerberos tickets.

Hyper-V

Windows Server

Azure

Security

Office 365

Microsoft News – 17 November 2014

I’ve had a crazy few weeks with TechEd Europe 2014, followed by the MVP Summit, followed by a week of events and catchup at work. Today, I’ve finally gotten to go through my news feeds. There is a LOT of Azure stuff from TEE14.

Hyper-V

Windows Server

System Center

Windows Client

  • Windows 10 – Making Deployment Easier: Using an in-place upgrade instead of the traditional wipe-and-load approach that organizations have historically used to deploy new Windows versions. This upgrade process is designed to preserve the apps, data, and configuration from the existing Windows installation, taking care to put things back the way they need to be after Windows 10 has been installed on the system. And support for traditional deployment tools.
  • Windows 10 – Manageability Choices: Ensuring that Windows works better when using Active Directory and Azure Active Directory together. When connecting the two, users can automatically be signed-in to cloud-based services like Office 365, Microsoft Intune, and the Windows Store, even when logging in to their machine using Active Directory accounts. For users, this will mean no longer needing to remember additional user IDs or passwords.

Azure

clip_image001

ASR SAN replication topology

Office 365

Intune

Operational Insights

Licensing

TEE14 Scripted Demo 6 – Extended Port ACLs

My sixth  TechEd Europe 2014 demo was a fun one: Extended Port ACLs, which is the ability to apply network security rules in the virtual switch port, which cannot be overruled by the guest OS admin.

There is a demo VM that is running IIS with a default site. The Windows Firewall is turned off in the guest OS. The script will:

  1. Clean up the demo lab
  2. Open a window with a continuous ping to the VM, showing the open network status
  3. Starts IE and browses to the VM’s site
  4. Kills IE and applies an extended port ACL to block everything.
  5. IE is re-opened (with flushed cache) and fails to load the site. Ping packets are dropping in the continuous ping.
  6. Kills IE and creates another extended port ACL to allow inbound TCP 80
  7. Reopens IE to show the site is accessible. Meanwhile, pings continue to fail.

There’s plenty of process management, and controlling IE in this script.

cls
#Clean up the demo to start up with
Get-VMNetworkAdapterExtendedAcl -VMName PortACLs | Remove-VMNetworkAdapterExtendedAcl

$DemoVM = "PortACLS"

Write-Host "Extended Port ACLs Demo"

#Clear IE Cache
RunDll32.exe InetCpl.cpl, ClearMyTracksByProcess 8

#Ping the VM
Start-Process Ping -ArgumentList "-t","PortACLS"

#Start IE
$ie = new-object -comobject InternetExplorer.Application
$ie.visible = $true
$ie.top = 200; $ie.width = 900; $ie.height = 600 ; $ie.Left = 100
$ie.navigate("http://portacls.demo.internal")

#Block all traffic script block
Read-Host "Block all traffic to the VM"
#Kill IE
Get-Process -Name IEXPLORE | Stop-Process
RunDll32.exe InetCpl.cpl, ClearMyTracksByProcess 8
Write-Host "`nAdd-VMNetworkAdapterExtendedAcl –VMName PortACLs –Action `“Deny`” –Direction `“Inbound`” –Weight 1"
Sleep 3
Write-Host "`nAll inbound traffic to the virtual machine is blocked" -foregroundcolor red -backgroundcolor yellow
Add-VMNetworkAdapterExtendedAcl –VMName PortACLs –Action “Deny” –Direction “Inbound” –Weight 1
#Start IE to show the site is offline
$ie = new-object -comobject InternetExplorer.Application
$ie.visible = $true
$ie.top = 200; $ie.width = 900; $ie.height = 600 ; $ie.Left = 100
$ie.navigate("http://portacls.demo.internal")

#Put in web traffic exception script block
Read-Host "`n`n`nAllow HTTP traffic to the VM"
#Kill IE
Get-Process -Name IEXPLORE | Stop-Process
RunDll32.exe InetCpl.cpl, ClearMyTracksByProcess 8
Write-Host "Add-VMNetworkAdapterExtendedAcl –VMName PortACLs –Action `“Allow`” –Direction `“Inbound`” –LocalPort 80 –Protocol `“TCP`” –Weight 10"
Sleep 3
Write-Host "`nAll inbound traffic to the virtual machine is blocked EXCEPT for HTTP" -foregroundcolor red -backgroundcolor yellow
Add-VMNetworkAdapterExtendedAcl –VMName PortACLs –Action “Allow” –Direction “Inbound” –LocalPort 80 –Protocol “TCP” –Weight 10
#Start IE to show that the website is now back online, despite all other traffic being blocked
$ie = new-object -comobject InternetExplorer.Application
$ie.visible = $true
$ie.top = 200; $ie.width = 900; $ie.height = 600 ; $ie.Left = 100
$ie.navigate("http://portacls.demo.internal")

Read-Host "`n`n`nEnd the demo"

#Clean up after the demo
Get-Process -Name Ping | Stop-Process
Get-Process -Name IEXPLORE | Stop-Process
Get-VMNetworkAdapterExtendedAcl -VMName PortACLs | Remove-VMNetworkAdapterExtendedAcl

Ever Wonder HOW Microsoft Upgrades The Firmware of New Employees? I Have Evidence!

I’ve had a number of friends “go blue” over the years, that is, they joined Microsoft as full time employees (FTEs). All were like me, some things they liked and others they didn’t like at Microsoft … BEFORE they joined the company. Not long after joining, they flew to the mother ship in Redmond for “training” or “meetings” and returned very different people. Everything was awesome; even the dodgiest endeavours by Microsoft were the best things ever.

I and others would joke about our friends having their firmware updated. That was a joke … until now. I have the evidence that something mysterious is indeed happening. I was behind the curtains yesterday, and went to get a Coke from the fridge when I spotted this:

IMAG0318

Sparking water made by … Microsoft! Of course, I will be taking this evidence to a lab to be analysed and searched for traces of psychotropic substances. I suspect this may indeed be the actual firmware upgrade that is supplied to unwitting new blue badges when they are transported to Redmond, WA. I shall follow up as soon as the results are in from the lab.

Note: This article is written with my tongue firmly in my cheek. If you are offended or think I am being serious in any way, then please visit a reality consultant.

TEE14 Scripted Demo 5 – Out-Of-Band File Copy

In my fight demo at TechEd Europe 2014, the topic was OOB File Copy, the ability to place a file into a VM’s storage, via the VMBus, and without network connectivity to the VM (e.g. tenant isolation).

The script does the following:

  1. Cleans up the demo
  2. Opens up notepad. I manually copy and paste text from a website into the file and save it.
  3. Enable the Guest Service Interface for the VM to enable OOB File Copy
  4. Copy the file to the VM
  5. Disable Guest Service Interface
  6. Connect to the VM. I manually log in and open the file to verify that the file I created is now inside of the VM
  7. Clean up the demo

 

function KillProcess ($Target)
{
    $Processes = Get-Process
    Foreach ($Process in  $Processes)
    {
        if ($Process.ProcessName -eq $Target)
        {
            Stop-Process $Process
        }   
    }
}

cls

$DemoHost1 = "Demo-Host1"
$DemoVM1 = “OOBFileCopy”
$DemoFile = "CopyFile.txt"
$DemoFilePath = "C:\Scripts\TechEd\$DemoFile"
$VMConnect = "C:\Windows\system32\vmconnect.exe"
$VMConnectParams =  "$DemoHost1 $DemoVM1"

#Prep the demo
#Use a remote command to delete the file from the VM
Invoke-Command -ComputerName $DemoVM1 -ScriptBlock {Remove-Item -ErrorAction SilentlyContinue "C:\CopyFile.txt" -Confirm:$False | Out-Null}
Disable-VMIntegrationService $DemoVM1 -Name "Guest Service Interface"
Remove-Item -ErrorAction SilentlyContinue $DemoFilePath -Confirm:$False | Out-Null
New-Item $DemoFilePath -ItemType File | Out-Null

#Start the demo

#Note to self – script the network disconenct of the VM along with a continuous ping to confirm it.

Read-Host "`nStart the demo"
Write-Host "`nCreate a file to be copied into the virtual machine" -foregroundcolor red -backgroundcolor yellow
Start-Process "c:\windows\system32\notepad.exe" -ArgumentList $DemoFilePath

#Copy the file
Read-Host "`nEnable the Guest Service Interface integration service"
Write-Host "`nEnable-VMIntegrationService $DemoVM1 -Name `"Guest Service Interface`""
Enable-VMIntegrationService $DemoVM1 -Name "Guest Service Interface"

Read-Host "`nCopy the file to the VM"
Write-Host "`nCopy-VMFile $DemoVM1 -SourcePath $DemoFilePath -DestinationPath C: -FileSource Host"
Copy-VMFile $DemoVM1 -SourcePath $DemoFilePath -DestinationPath C: -FileSource Host

Read-Host "`nDisable the Guest Service Interface integration service"
Write-Host "`nDisable-VMIntegrationService $DemoVM1 -Name `"Guest Service Interface`""
Disable-VMIntegrationService $DemoVM1 -Name "Guest Service Interface"

#Check the file
Read-Host "`nLog into the virtual machine to check the file"

Set-VMHost -EnableEnhancedSessionMode $true | Out-Null
Start-Process $VMConnect -ArgumentList $VMConnectParams

#End the demo
Read-Host "`nEnd the demo"
KillProcess "vmconnect"
Disable-VMIntegrationService $DemoVM1 -Name "Guest Service Interface"
Remove-Item -ErrorAction SilentlyContinue $DemoFilePath -Confirm:$False | Out-Null
#Use a remote command to delete the file from the VM
Invoke-Command -ComputerName $DemoVM1 -ScriptBlock {Remove-Item -ErrorAction SilentlyContinue "C:\CopyFile.txt" -Confirm:$False | Out-Null}