Helpdesk when Helpdesk wasn't Cool

Upgrade ESX 4 Update 2 to ESX 4.1

noreply@blogger.com (Rob D.) — Sat, 14 Aug 2010 17:50:00 +0000

Problems with VUM (VMware Update Manager) lead me to upgrade our ESX 4 U2 hosts to ESX 4.1 using the command line. During the upgrade, I was getting an error about a certain rpm package that would not uninstall properly (esxupdate error 15), so I've included that as part of my instructions.

To prepare for the upgrade, you need to download the ESX pre-upgrade zip file as well as the 4.1 upgrade zip file. I used WinSCP to copy them to the /tmp directory on each ESX host, then put the hosts in maintenance mode using vCenter before doing the upgrade. The whole process is pretty quick once you've downloaded and staged the zip files.

Note these instructions assume you use sudo for admin tasks, if not, leave it out.

1. install pre-relase patch:
sudo esxupdate update --bundle=/tmp/pre-upgrade-from-ESX4.0-to-4.1.0-0.0.260247-release.zip
2. install upgrade:
sudo esxupdate update --bundle=/tmp/upgrade-from-ESX4.0-to-4.1.0-0.0.260247-release.zip
3. remove RPM from update 2 that won't remove autmatically (the first command checks to see if it is still installed, the second removes it if it is still there):
sudo rpm -q vmware-esx-apps-4.0.0-2.17.261974
sudo rpm -e vmware-esx-apps-4.0.0-2.17.261974
4. reboot
sudo reboot
5. Afterwards, you can log back in and check the host version:
sudo vmware -v

Learning ESX, Part One

noreply@blogger.com (Rob D.) — Mon, 13 Apr 2009 01:26:00 +0000

Lately I've been doing a lot of research on virtualization in the data center. My specific research deals with the innards of VMware VI. We are in the midst of going virtual whole hog and I'm giving myself a crash course on the proper way to do, well, everything. Yes, we've been using virtualization tools for about three or four years now, but we are changing to moving our production servers to this platform, which requires a different approach than the ad hoc test/dev/desktop use we've seen.

Along the way I've picked up a few tips I thought might be useful for others out there that are either contemplating it or in the midst of setting up their first ESX server ( Or VI infrastructure). Because VMware has a lot of moving parts it seems it can be easy to get a little lost. Planning is key to implementation success (isn't it for everything?). Speaking of planning, I found this great thread on Ars Technica about the Biggest Mistake You've Made with a Virtualization Deployment. Very interesting, and it mentions many of the items I have been reading about.

So for starters, what is the best method of deploying an ESX server? Many folks in the communities believe that a scripted install is the best way to do it. Why scripted, even for just a few hosts? Well one good reason is you'll install it the same way on all your hosts. Second good reason, it'll force you to learn how ESX installs, what the defaults are, and how those defaults can be improved upon. For example, disk partitioning. If you just accept the defaults you might outgrow your space. There are several posts on the subject, here's one at VM /ETC on ESX host partitions. It's also worth noting that if you use the Ultimate Deployment Appliance (UDA) to deploy ESX, Mike Laverick has set default partitions that expand on the default and use many of these recommendations. Read His instructions if you want to use UDA as a PXE server to deploy ESX using a script. Using a PXE server from a virtual appliance is not too difficult and it takes the script theory one better, by giving you a repeatable deployment method that requires no media in the drive!

OK, so there is one issue with disk alignment and partitions. The UDA will create a VMFS partition for you, however it won't be aligned. Read the Recommendations for
Aligning VMFS Partitions from VMware to understand the issue and what to do about it. If you create a VMFS parition using the VI client, it will be automatically aligned. So that is my recommendation, use VI client to create VMFS partitions on the ESX host if needed, don't script the install of those type of partitions. In the UDA appliance I deleted the section of the script that created a VMFS partition during install.

That completes our first two tips, script your installs (possibly by using the UDA) and align your VMFS partitions!

Next post I will talk about networking. I've been following Ken Cline's multiple post article The Geat vSwitch Debate and in his next installment he will conclude with his recommendations. I'm not going to bother trying to explain virtual switching, just read Ken's articles!

Outlook 2007 Cumulative Update (2/2009)

noreply@blogger.com (Rob D.) — Tue, 31 Mar 2009 05:41:00 +0000

OK, if you use Outlook 2007 either at home or at work, you really should get this update. I don't ordinarily post this type of stuff, but Outlook 2007 has some performance issues, and if you use it in Cached Exchange Mode, it can get really bad. I'm happy to report that it is much snappier with the update. Yes, SP2 is coming, but this is still worth the effort.

ITIL v3 Foundations Certification

noreply@blogger.com (Rob D.) — Mon, 19 Jan 2009 22:23:00 +0000

This past December I attended ITIL v3 Foundations training at NetDesk and passed the certification exam. The course was three days long, with a one-hour test at the end of the third day. It was a lot of material to cover, luckily the teacher was good and was a certified ITIL Expert. You can get ITIL certified through self study, but if you have the opportunity to take the training with the financial help of your employer, I would recommend it.

Why would you want to get ITIL certified, anyway? It helps if you know what ITIL is, and truthfully, before my training I knew little about it. From the official ITIL site, here is the answer to the question, What is ITIL?

What is ITIL?

ITIL is best practice in IT Service Management, developed by OGC and supported by publications, qualifications and an international user group. ITIL is intended to assist organisations to develop a framework for IT Service Management. Worldwide, ITIL is the most widely used best practice for IT Service Management.

So there you have it. ITIL is best practice for service management, and if you work in an IT shop, you are providing IT service (not everyone seems to understand this concept). Delivering those services effectively is what ITIL is all about. Have you ever wanted to improve your helpdesk? Manage change in your environment better? Get a firm grasp on what services your IT group provides, and how you can improve? ITIL can help you with these processes.

Of course, there are detractors that remain skeptical about ITIL . A little skepticism can be healthy when undertaking any new initiative. There are also ITIL zealots that try to force it on the organization. I prefer a more balanced view. Learn about ITIL and take what you can from it to improve your service management, but don't think it can magically fix every problem. And don't try to force it on your organization. My instructor gave our class some good advice about ITIL. First, start with a vision of what ITIL could do in your organization, then get people to buy into that vision. Don't start by showing up at a staff meeting and saying "We're gonna do ITIL!" If the staff aren't in agreement that service managment and continual service improvment are necessary they will probably throw up road blocks and generally resist change. But if you get everyone together behind the idea, then you might successfully use ITIL to improve your IT service management. Delivering good service cost effectively should be on the mind of every IT manager.

More reading: How Microsoft Moves ITIL v3 from Concept to Practice.

Windows 7 Really Does Seem To Improve on Vista

noreply@blogger.com (Rob D.) — Thu, 15 Jan 2009 05:56:00 +0000

I had a funny conversation the other night. A couple I know have Vista installed on their laptop, as well as Office 2007. They don't use it much, preferring to work on their Windows XP desktop with Office 2003. They said they heard Vista crashed a lot; That Vista had a lot of problems, that no one was using it. Then they complained that they didn't like the toolbar changes and couldn't find their files.

I'm wondering, will Windows 7 make converts out of these folks? I was just reading a long blog post by Tim Sneath on the Bumper List of Windows 7 Secrets. I have to say I'm impressed with the usability features they are adding. But will it be enough to make a billion people happy?

Download Windows 7 Beta and try it for yourself. I have little doubt it will make most techies happy. It'll be interesting to see how everyone else likes it.

A note about the download. I used Firefox with the java Download Manager. I tried pausing the DL then resuming this morning. No dice, I had to start from scratch, and on my DSL, that meant about five hours wasted. The error said the file size didn't match, would you like to retry (to no avail)? Why didn't they use Bittorrent? uTorrent can pause and resume fat downloads all day long with no issues whatsoever. In this day and age, the problem of downloading big files should be solved. Come on Microsoft!

Qwest DSL: Now With More Fiber

noreply@blogger.com (Rob D.) — Wed, 14 Jan 2009 22:13:00 +0000

Qwest is rolling out fiber optic internet service. It is not fiber to the premises, just to the neighborhood terminal. The speeds are relatively good, but at this time, I can't get the service at my house. After I saw the Qwest commercial advertising the new fiber service, I called the number on the screen, and the person I reached didn't really seem to know what I was talking about. I went looking for more information and found this list of Zip codes with service in Oregon. There is also a phone number listed...so I called it, and was connected to a friendly customer service rep, and he was able to tell me that my Zip should have service between May and August 2009. I suppose I can wait that long.

At this time, I will not use the local cable company for my ISP. There are some companies I would rather not do business with if I can help it (my cable TV was just repaired, after a wind and snow storm left the cable dangling in my yard for the last 11 days). If this Qwest service doesn't work out, there is also WiMAX coming to town. But the prices are higher, and the speeds lower, at least for now.

Update: Here is the list of major investors in the Clearwire WiMAX service. The list includes the two major cable companies.

Connect to Mac OS X with UltraVNC

noreply@blogger.com (Rob D.) — Sun, 21 Dec 2008 20:55:00 +0000

This works for me but your mileage may vary. Download UltraVNC 1.05 and install at least the viewer portion. 1.05 works well with Vista and Server 2008.

Click the UltraVNC icon to start it up. In the connection screen, click Options.

On the Options page, for the encoding select Hextile, then click OK.

Back on the main screen click Connect. Enter your Username and Password. After you have connected, to can save this connection as a shortcut. Press CTRL-ALT-F5 to save the connection.

Of course to do all this VNC should be enabled in Mac OS X first!

The NEW Java Install

noreply@blogger.com (Rob D.) — Sun, 21 Dec 2008 20:38:00 +0000

Sun has shipped Java 6 update 11, (and you can download the full installer here) and has fixed many of the gripes I had with the prior versions. Finally Java installs into a single folder, and you don't have to manually remove the prior versions, it just updates the current install to the new version. This behavior actually started in version 10, but I didn't notice. What I did notice about 10 was the new drag-an-applet-to-your-Desktop feature, also known as JavaFX. You can view a JavaFX demo and I tried the MP3 player, but when I dragged it to my Desktop I was unable to close it. Oh well, guess there are a few more bugs to work out.

At any rate the new install behavior is a welcome change for enterprise installs. Read more about update 11 in the readme file.

Powershell Problem with XP SP3

noreply@blogger.com (Rob D.) — Fri, 13 Jun 2008 04:40:00 +0000

There is a KB on Powershell that is a bit vague. The title is "You cannot upgrade a Windows-based operating system when you have Windows PowerShell 1.0 installed". What this means is, if you have Powershell installed and try to install Windows XP service pack 3, it might fail. The cure is to remove Powershell before upgrading. This bug seems to affect 2003 and Vista as well.

I've been updating my VMware templates for Windows XP, using the volume license version of XP with SP3 built-in. Typically I use the CMDLINES.TXT file to install Powershell and some other apps. But now that function is broken. I'll have to add it after the OS is fully installed. Unfortunately, there are multiple machines in our domain that have Powershell installed, and now I'll have to automate the removal to upgrade them all. Great!

On a side note, if you install IE7 as part of your build process, you may have had problems with that as well. To fix that, download the latest build from Microsoft which was posted in May. Another problem I've encountered is with Windows Update after SP3 is installed. It seems you can download the latest version, then install it with the /wuforce switch to fix it, as described in KB943144. I found that tip on the TechNet forums.

So far SP3 has been a pain. Not nearly as bad as SP2, so I guess I *should* be happy about that.

Symantec Fix for WinXP SP3 and Vista SP1 Problem

noreply@blogger.com (Rob D.) — Sat, 07 Jun 2008 19:10:00 +0000

As noted on ComputerWorld, Symantec has released a fix for the trouble some people are having after installing Windows XP SP3 or Vista SP1.

If you are having problems like not seeing devices in Device Manager or having your network connections deleted after the upgrade, get the tool. For those that have not installed SP3 or SP1 yet, the latest LiveUpdate for your Norton product should fix the issue.

I have Vista SP1 and Symantec NIS 2008 installed, and I had no issues. Haven't tried SP3 on my WinXP machines yet, as I was waiting for this to be fixed first.

Bandwidth Consumption

noreply@blogger.com (Rob D.) — Fri, 06 Jun 2008 03:48:00 +0000

All the latest news about metered bandwidth from the cable companies made me think about how much I actually use. So I've decided to find out. The first thing I did was look around for a light-weight program I could use to show my consumption, by the day, week, month, something FREE, something that worked. I found NetMeter. It does just what I need it to do. It even imports and exports using CSV files. Pretty slick! (The red line around the screenshot is courtesy of the Vista snipping tool).

NebuAd and Cables Cos Team Up to Watch You

noreply@blogger.com (Rob D.) — Mon, 26 May 2008 21:37:00 +0000

NebuAd and Charter cable have teamed up to serve you advertising based on your surfing habits. They will serve this advertising based on data they mine using deep packet inspection of every single bit of traffic you generate online. Think of it like someone reading all your e-mail or monitoring everything you put down the drain. To be fair, Charter is not the only company signing up.

I love this quote from the article:

I suggested to Mr. Schremp that there would probably be a fair number of customers who don’t consider having their Internet activities tracked to be an enhancement.

Read more on the NY Times Bits blog or an interview with the CEO of NebuAd on GigaOM.

Combine internet tracking with the fact that cable pricing keeps on going up, and waiting for Qwest fiber optic internet service suddenly doesn't seem like such a bad idea.

Update 6/24: Charter backs off plan - for now

Windows XP Service Pack 3 Reboots

noreply@blogger.com (Rob D.) — Mon, 19 May 2008 17:28:00 +0000

If your PC is rebooting after install of Service Pack 3 for Windows XP, try these instructions from the HP Web site.

Repackage an ActiveX Control for Deployment

noreply@blogger.com (Rob D.) — Sat, 29 Mar 2008 01:48:00 +0000

One thing Microsoft got right in Windows Vista is the ActiveX installer service. With it you can enable standard user accounts the ability to install ActiveX controls from approved Web sites, and they don't need Admin rights. Windows XP has no such service, so what I end up doing is repackaging ActiveX controls so that I can deploy them with Altiris or Group Policy. I use a program named Advanced Installer (AI) to create the MSI package. AI comes in a free version, and I recommend you try it out.

Now, on to the tutorial. The ActiveX control I recently repackaged is for SQL 2005 Reporting Services printing. It allows anyone viewing a report to print it with proper formatting. The control can be found on the SQL server, in a CAB file named RSClientPrint.CAB (I think). Just do a search of the Program Files\SQL folder for CAB files, you'll find it.

Extract the files from the CAB file into a folder, using a program like 7-zip.

After you install AI, open it up.
Create a new project and save it somewhere with a meaningful name. It will create a file with an AIP extension, for Advanced Installer Project.

In the left-pane select Product Details. Give your program a name and assign a version number, like 1.0.0. Add other details if you want.

Next add your files. In the left-pane of AI, select Files and Folders. I added the files to the Windows Volume -> Windows -> Downloaded Program Files folder, which is a repository for ActiveX controls you install via your browser. I do it this way, in the event a new version comes out, the downloaded installer will overwrite the old files. I added all the files that were in the CAB file to this folder in AI.

After the files are added, right-click the rsclientprint.dll (or any DLL or OCX files in your project). Select Properties. Check the Auto register file check box, to ensure the control is registered during install. Click OK when you're done.

Now you are ready to build your installer. Click the Build icon on the toolbar (it looks like a stack of bricks). An MSI package will be built in the same folder where you saved your AI package, and it will have the same name, with the MSI extension.

Now you can roll it out with SMS (SCCM), Altiris, Group Policy, or just manually install it. I recommend you test it on a virtual machine and make sure it works correctly before deployment.

Next time I talk about Advanced Installer, I'll post instructions for signing your projects with a digital certificate.

Updated Microsoft Deployment Toolkit 2008

noreply@blogger.com (Rob D.) — Tue, 25 Mar 2008 04:44:00 +0000

The Microsoft Deployment Toolkit 2008 replaces the Business Desktop Deployment 2007 tool. The new updated version supports Vista SP1 and Windows Server 2008 (hopefully a new one won't come out next month for WinXP SP3). While you're at it, get the new Windows Automated Installation Kit (WAIK), too. Together these two tools, combined with a server running Windows Deployment Server (WDS), allow you to automate Windows deployment.

If you still haven't setup WDS and started using the MDT and WAIK to automate your lite touch deployments, head over to The Deployment Guys blog and download the Lite touch Video Walkthrough. Its 30 minutes long, but moves at a pretty fast pace. Overall, a well done overview that covers a lot of detail for a process that in reality will take you several days to setup. I recommend it as it will help you understand where to start. The MDT interface can be a bit overwhelming the first time you run it.

More about the MDT update from the Deployment Toolkit Team Blog.

Developer Starts Flame War Comparing .NET to American Tourists

noreply@blogger.com (Rob D.) — Mon, 10 Mar 2008 17:48:00 +0000

There is an interesting post titled "Are .NET Developers the American Tourists of the Software Industry?"at a blog named Caffeinated Coder by Russell Ball. If you have strong opinions about Microsoft .NET or American Tourists, I encourage you to add your comments to the long list already up there.

As you can probably guess, the usual hilarity ensues, with plenty of name calling by everyone. The author writes a post about being a .NET dev from the USA, and then goes on to say that he will try a few new languages outside of his comfort zone. Good for you, Russell, as it will probably make you a better, more well-rounded programmer. Much like being a tourist and exploring other places and cultures makes you a more well-rounded human.

However, I don't think that anyone that works with Microsoft technology has to apologize, (just like I don't think that every American tourist is a naive loud-mouthed rube). Making generalizations about people based on what technology they use is good for a flame war but not much else, as Jeff Atwood of Coding Horror says in his post about the Mac vs. PC debate titled "Because they all suck",

That's the other problem with the Mac vs. PC debate: it completely misses the point. Computers aren't couture, they're screwdrivers. Your screwdriver rocks, and our screwdriver sucks. So what? They're screwdrivers. If you really want to convince us, stop talking about your screwdriver, and show us what you've created with it.

I tend to agree with Jeff. Microsoft .NET, Python, LAMP, Ruby on Rails, they're just screwdrivers. If you know how to use one or more of these tools to create good code, then you probably are a good programmer. Just because you use Python or another language and look down on people that use .NET does not. (Insert the sound of kid on a playground making a raspberry sound with his tongue.)

That said, just because I think the arguments about This Technology being aesthetically, technically and morally superior to That Technology are stupid, doesn't mean I don't like reading a good flame war every now and then..

Problem Restoring Files with Enterprise Vault

noreply@blogger.com (Rob D.) — Thu, 06 Mar 2008 17:43:00 +0000

Recently we had an interesting problem with a file server. This file server had a share that was an archive point for Symantec Enterprise Vault (EV). An archive point allows you to archive files from the file server to the EV using automated tasks based on rules you specify. For example, archive files that have not been modified in a year. The point is to keep files on the file server that are in use, and to move files that aren't in use to EV for long-term storage on low-cost disks. There are many other advantages to using EV such as indexed searches, and locked partitions (for reducing backups of data that does not change) and if your firm has trouble with ballooning file storage needs, I'd encourage you to read up on this product and see if it might be right for you.

Now, to the problem at hand. When we had a problem with a file server recently, we repaired the RAID array and attempted to restore data to it from backup. When we did this, the file server would register Event ID 26 and Event ID 50, a 'Delayed Write Failed' message. Eventually the server would freeze, and on a couple of instances, it rebooted mid-restore. We could restore data to other folders on the same array, which led us to believe (correctly) that the hardware was working fine.

The fix was to uninstall the EV file server agent (FSA Agent). The FSA Agent installs several services on the file server, including one called the Placeholder service, and also a mini filter driver (EVFilter.sys or evmf.sys). A Placeholder is a special shortcut that links to a file in the vault. We had tried the restore with the Placeholder service disabled, but that didn't do the trick. After we uninstalled the FSA Agent, which removed the mini filter driver, the restore was successful.

If you are having trouble with a file server restore, and you are using Enterprise Vault, try removing the FSA Agent altogether, then reboot and try again. Note that we run EV 2007 with SP1, and as we are the first customer that reported this issue with this version, there is no hotfix available. I'll be keeping an eye out for one in the future.

Fixing Cmdlines.txt

noreply@blogger.com (Rob D.) — Thu, 07 Feb 2008 04:19:00 +0000

As I mentioned in my first post on Cmdlines.txt, you can use this file to customize your Windows XP install, and add many newer add-ons, such as Remote Desktop 6, Internet Explorer 7, or the latest DirectX update.

It turns out the trying to install Windows Media Player 11 using Cmdlines.txt calling my batch file Build.cmd, caused all kinds of problems. After Setup was complete Windows would load the Desktop, but it would be set to use the Windows Classic theme, and the net connection would be dead. Further investigation showed that most of the Services set to Automatic (like Themes and DHCP) didn't start. A reboot fixed the problem, but I wanted to know what was causing it, which turned out to be hard to troubleshoot as the Event Log service didn't start either.

After many trial-and-error installs, I determined it was Windows Media Player 11 causing the problems.

I've updated the file and removed the section on Windows Media Player 11. Download Build.cmd version 2. There are two extra files in the Zip, one is WMP11.cmd and the other is WMP.reg.

The method I'm using now to install WMP11 is the Enterprise Deployment Pack for Windows Media Player. With the EDP I create a new installer named mpsetupedp.msi. I then add a section to my unattend.txt answer file called [GuiRunOnce] and in that section added "%systemdrive%\WMP11\WMP.cmd".

It will look like this:


[GuiRunOnce]
  "%systemdrive%\WMP11\WMP.cmd"

I add the mpsetupedp.msi, WMP11.cmd and WMP11.reg files (in the Zip you download) into a folder named WinXPFiles\i386\ $oem$\$1\WMP that I've created, setup then copies that folder to the system drive (C: drive) during install. The GuiRunOnce command then calls that batch file and installs Media Player. The reg file removes the License and first-run nags from Media Player.

Here is how I used the EDP:
Install WMP 11 on a clean computer
Set the preferences how you want them
Install the EDP
Download WMP 11, then copy the file to the c:\MSEDP\Redist folder
Rename wmp11-windowsxp-x86-enu.exe to MP10Setup.exe
Download the lastest update for Media Player and put it in the folder too
Then run msedp.exe. Follow the prompts, Y|N, to add your customizations.
You end up with mpsetupedp.msi, WMP 11 repackaged for deployment.

Before the Administrator account automatically logs in the first time on your fresh install of WinXP, Media Player will install quietly, with the latest patch(es), and no nag screens when you or your users run it the first time.

WinPE: Eject CD and Reboot

noreply@blogger.com (Rob D.) — Thu, 31 Jan 2008 19:48:00 +0000

We use WinPE for installing Windows and also running disk imaging sessions, and I want the disk to eject before WinPE exits and the system reboots. There are some command-line utilities out there for Windows that will eject the CD with no problem. But most won't work in WinPE, as it is the boot drive, and PE locks it.

I finally found a utility to eject and reboot. It was written for BartPE but works just fine for WinPE.

Here are the steps:

Download Shutdown (currently Shutdown08a) from http://paraglidernc.com/plugins/plugins.htm
Use Winzip or 7-Zip to extract the files from the CAB file.
In the extracted Shutdown08a\Files folder, copy PEGina.dll, Shutdown.exe, and ShutdownRes.dll to the i386\System32 folder of your PE disc.
In the STARTNET.CMD batch file in the WinPE i386\System32 folder, set the last line to be shutdown /B /R.
That command ejects the CD then reboots the machine.

Sysprep Tips

noreply@blogger.com (Rob D.) — Thu, 31 Jan 2008 03:06:00 +0000

As part of the further automation of our Windows setup and imaging, I've been updating our Sysprep process to work a little better. During my research I read David Remy's excellent series on Sysprep (now up to 8 parts). I posted a few comments on his blog about stuff I've picked up/figured out over the years, and so I thought I'd post them here.

And now, Sysprep tips, in no particular order:

Unsigned drivers will not install during mini-setup, unless you run sysprep with the -pnp switch. So it basically ignores the DriverSigningPolicy=Ignore entry in the [unattended] section of the sysprep.inf file. Of course, adding the -pnp switch means the PC does a full plug and play hardware enumeration during mini-setup, which slows down the imaging process.

Read the setupapi.log file as a starting point for driver install problems. This file is located in the %windir% folder (C:\Windows). It was in this file that I found the error where the unsigned video driver wouldn't install during mini-setup.

If you want to setup Windows XP in the Microsoft BDD 2007, read this FAQ on the deployment team blog. We haven't done this yet, but probably will when we get ready for Vista or Windows 7.

In the sysprep.inf file, there are two places for you to enter passwords. One is for joining the PC to the Domain, the other is for the local Admin password. There are ways of making this more secure. For starters, you cannot change the local Admin password in sysprep.inf. Unless the local admin password is blank, the password in the sysprep.inf file is ignored. So feel free to leave out the AdminPassword under [Guiunattended], and just set the Admin password when you install Windows. If you must change it later, you could script it.

The second place for a password is for an account to join the Domain. Despite the name of the entries DomainAdmin and DomainPassword under the [Identification] section, you can use a regular User account here. Just use the AD delegation wizard to allow that account to create machine accounts in your computer OU, and also give that account privileges to create more than 10 accounts on the Domain. Then you don't leave the Domain Admin password in a text file.

That's all the tips for this post. There are more floating around in my head I may write down later, or more elsewhere if you read David's series.

My other posts on Sysprep:
Sysprep Hangs During Mini-Setup
Reducing Drive Images

Use Cmdlines.txt to Deploy Updated Windows XP

noreply@blogger.com (Rob D.) — Sat, 19 Jan 2008 22:54:00 +0000

Recently I refreshed our Windows XP Pro build (we have not migrated to Vista yet). I added quite a few downloads from the Microsoft Web site that are post-SP2 add-ons. I don't really use Cmdlines.txt to add hotfixes, just additional programs to WinXP that are new over the past year or so. Stuff like IE7, Media Player 11, Remote Desktop 6. In fact, what inspired me to update the file was StealthPuppy's list Unattended Windows Vista tech. on Windows XP/2003. It is easier to add these files one time to your build then to have to add them all on after you install Windows.

To set this up, you need the volume Windows XP SP2 install files in a folder, like WindowsXPSP2. In the subfolder i386, create the folder $oem$. This is all part of setting up your unattended install of WinXP, which I won't go into here.

In the $oem$ folder create CMDLINES.TXT. For me, this is a small file with not much in it.

The contents of my CMDLINES.TXT file:


[COMMANDS]
"Build.cmd"

Yup, that's it. Next create a batch file in the same folder. Mine is named build.cmd, and contains the commands to install the add-ons and updates. The reason why I use a separate batch file, is because the Cmdlines.txt file doesn't let you use every command you can in a batch script and has trouble with quotes.

Some of the newer commands were taken from StealthPuppy's example, particularly the Windows Media Player 11 install command, which is pretty hairy. You'll need to download all these files from Microsoft. I've remmed-out a few installs, such as Windows Defender, but left them in the file for reference. At the bottom of the batch file is a command that sets the default wallpaper for all users. The wallpaper bitmap (defwallpaper.bmp) needs to go into the windowsxpsp2\i386\$oem$\$$ folder, which you may need to create. It is then copied into c:\windows when WinXP is installed. The reg.exe command sets it as the default for all users and the local admin account.

Update 2/6/08: I've removed Windows Media Player 11 from the build.cmd batch file, as it was hosing my WinXP install. After Windows installed, the desktop would load for the Administrator account, in the Windows Classic theme, with no net connection. After flogging (er, testing) my setup for another day, I figured out it was Media Player (WMP11). I've since moved the WMP11 install to after Windows is done installing and the GUI is loading for the first time, by using the GuirunOnce entry in the unattend.txt file.

Read Fixing Cmdlines.txt to download the updated Build.cmd batch file.

Here's the file listing (with WMP11 removed):


:: Build.cmd  by Rob Durkin January 2008
:: Portions from Aaron Parker’s techblog, http://blog.stealthpuppy.com/deployment/unattended-windows-vista-tech-on-windows-xp2003
:: Purpose to include post-SP2 updates and add-ons for Windows XP during setup
:: Called from CMDLINES.TXT during Windows Setup or Sysprep operation
:: Delete CMDLINES.TXT for Sysprep use!
:: Place executables in $oem$ folder for install during Windows XP setup
:: Windows Media Player 11 moved to [GuiRunOnce]

::@ECHO OFF
:: Windows Installer 3.1
START /WAIT WindowsInstaller-KB893803-v2-x86.EXE /PASSIVE /NORESTART

:: Microsoft Core XML Services 6.0
START /WAIT MSIEXEC /I MSXML6_x86.MSI ALLUSERS=TRUE REBOOT=SUPPRESS /QB

:: Internet Explorer 7
START /WAIT IE7-WindowsXP-x86-enu.EXE /PASSIVE /NORESTART /UPDATE-NO

:: Windows Defender 1.1
::START /WAIT MSIEXEC /I WindowsDefender.MSI ALLUSERS=TRUE REBOOT=SUPRESS CHECK_WGA=0 LAUNCHPROGRAM=0 LAUNCHSCAN=0 /QB-

:: .NET 1.1
START /WAIT dotnetfx.exe /q:a /c:"install.exe /q"
:: .NET 2.0
START /WAIT dotnetfx2.EXE /q:a /c:"install.exe /q"
:: .NET 3.0
START /WAIT dotnetfx3.EXE /PASSIVE /NORESTART

::  .NET Framework 3.5
START /WAIT dotnetfx35.EXE /PASSIVE /NORESTART

:: Windows Desktop Search 3.01
::START /WAIT WindowsDesktopSearch-KB917013-V301-XP-x86-enu.EXE /QUIET /NORESTART

::DirectX 9.0c Nov 2007
START /WAIT directx_nov2007_redist.exe /T:C:\WINDOWS\Temp /Q:A
START /WAIT C:\WINDOWS\Temp\dxsetup.exe /silent
Del /Q C:\WINDOWS\Temp\*.*

::  Remote Desktop Connection 6.0
START /WAIT WindowsXP-KB925876-x86-ENU.EXE /PASSIVE /NORESTART

:: LLTD Responder
START /WAIT WindowsXP-KB922120-v5-x86-ENU.EXE /PASSIVE /NORESTART

:: Image Mastering API
START /WAIT WindowsXP-KB932716-x86-ENU.EXE /PASSIVE /NORESTART

:: Microsoft Management Console 3.0
START /WAIT WindowsXP-KB907265-x86-ENU.EXE /PASSIVE /NORESTART

:: Windows Script 5.7
START /WAIT scripten.exe /PASSIVE /NORESTART

:: Windows PowerShell 1.0
START /WAIT WindowsXP-KB926139-x86-ENU.EXE /PASSIVE /NORESTART

:: XPS Essentials Pack
START /WAIT MSIEXEC /I "XPSEP XP and Server 2003 32 bit.MSI" ALLUSERS=TRUE REBOOT=SUPRESS /QB

::  Peer Name Resolution Protocol (PNRP) version 2.0
START /WAIT WindowsXP-KB920342-x86-ENU.EXE /PASSIVE /NORESTART

:: Silverlight 1.0
START /WAIT SILVERLIGHT.EXE /Q

::  Network Diagnostic Tool
START /WAIT WindowsXP-KB914440-v12-x86-ENU.EXE /PASSIVE /NORESTART

:: WS-Management v1.1
START /WAIT WindowsXP-KB936059-x86-ENU.EXE /PASSIVE /NORESTART

:: Windows Rights Management Services Client with Service Pack 1
:: START /WAIT WindowsRightsManagementServicesSP1-KB839178-Client-ENU.EXE /PASSIVE /NORESTART

:: Set the default wallpaper
reg load HKU\DefUser "C:\Documents and Settings\Default User\ntuser.dat"
reg add "HKU\DefUser\Control Panel\Desktop" /v Wallpaper /d "c:\windows\DefWallpaper.bmp" /f
reg unload HKU\DefUser
reg add "HKCU\Control Panel\Desktop" /v Wallpaper /d "c:\windows\DefWallpaper.bmp" /f

Note that I say to delete cmdlines.txt if using this with Sysprep in the comments section. The reason why is, if you use a single disk image on multiple PCs, often times you'll need to copy the i386 folder to c:\sysprep\i386 before you run sysprep and reseal the machine for disk imaging. So, if cmdlines.txt is in the folder c:\sysprep\i386\$oem$, it will run again. If you don't want it to run, then delete it (I run this at the initial install of Windows, not part of Sysprep). If you did have certain programs you wanted to install during Sysprep, you could add them to build.cmd.

This technique works for Windows XP as well as Windows 2003 server. I'm not sure exactly what the procedure is for Vista yet, but I do know that unattended.txt, sysprep.inf and cmdlines.txt are all replaced by unattend.xml.

Add Office 2007 SP1 to Install Point

noreply@blogger.com (Rob D.) — Sat, 22 Dec 2007 21:09:00 +0000

Office 2007 SP1 is out, and if you are an admin deploying this to a bazillion users, you might want to integrate it into your administrative install point. Sometimes people call this patching an administrative installation point, or "slipstream a service pack".

The Office 2007 SP1 Whitepaper tells you how to do it. The short version is:

Copy the Office 2007 CD contents (or ZIP file from Microsoft Volume Licensing Downloads) to a folder, for example, c:\Office12.
Download the service pack
Run the service pack with the command:

office2007sp1-kb936982-fullfile-en-us.exe /extract:”c:\Office2007SP1”

Then copy the .MSP files from the c:\Office2007SP1 folder into the c:\Office12\Updates folder.

When you run the Office 2007 setup program, it will install SP1 along with Office. The old way of having a administrative install point for office is over, no more patching MSI files. Now you just extract any Office 2007 patches, and copy the files into the c:\Office12\Updates folder. Of course there are more details if you want them in the whitepaper. And note that this only works for the initial install. If you have clients already running Office 2007, patch them directly, don't re-run setup. That method doesn't work anymore.

Office 2007 Service Pack 1

noreply@blogger.com (Rob D.) — Wed, 12 Dec 2007 00:35:00 +0000

Handy list from Bink.nu of Office 2007 SP1 links.

While you're at it, take a look at the list stealthpuppy has accumulated of updates for Windows XP that are in Vista, such as IMAPI (CD/DVD Authoring API) version 2, Remote Desktop 6, and more. Download and add them to your WinXP builds.

Can't see XP in Vista Network Map

noreply@blogger.com (Rob D.) — Mon, 10 Dec 2007 23:51:00 +0000

If you open the Control Panel and then Network and Sharing Center in Vista, there is a link on that page, View Full Map, and when you click it, it opens the Network Map feature. Yes, you barely notice it is there, but when you open it, you see a useful map of your home/work network, which shows how everything is connected.

Windows XP computers won't show up, however, unless you install the Link-Layer Topology Discovery responder component. Follow the link.

"Network Map in Windows Vista does not display computers that are running Windows XP"
http://support.microsoft.com/kb/922120

SQL Queries for Altiris Inventory

noreply@blogger.com (Rob D.) — Sun, 02 Dec 2007 18:33:00 +0000

One of the problems I have with the basic report writer in Altiris, is that it is not easy to customize your queries. When we first implemented Altiris to inventory our systems, I would clone, then modify the reports or write simple queries using the built-in tool. Often the results would not be what I wanted, and I would hit a wall where I could not get those results.

One of the problems I have with the built-in tool is that it doesn't let you select some of the very handy views in the Altiris database. For example, the vComputerEx view, which gives the computer name, Guid, and user (Altiris has a built-in algorithm to determine the main user of a computer). Another problem I have is that it is hard to filter your results using the tool. For example, you are trying to determine if a computer has Adobe Acrobat Professional installed as a stand-alone application and not part of Creative Suite. The only easy way to do that with the tool is to create a collection of computers with CS installed and then filter the report, excluding that collection.

Here are the example queries, the first shows computers with Internet Explorer 6 installed but not Internet Explorer 7, the second showing computers with Acrobat Pro, without Creative Suite. I wrote the queries in the SQL 2005 manager tool then export them to Altiris. Now I am not a query-writing expert, and I'm sure many DBAs out their could trim these queries down quite a bit to get the same result. That said, these queries can be copied-and-pasted into a report or collection in Altiris and will function correctly.

Some notes on the queries. I use the TOP clause (i.e. TOP 1000 or 5000) because Altiris will not let you use the ORDER BY clause without the TOP clause. In your environment, set the TOP clause to be higher than the number of computers you inventory and you'll be fine. Second, I use the vComputerEx view to get the PC and User names that are associated with the inventory. Third, I use a LEFT OUTER JOIN in these queries for the second join, as it will include null values, where a standard INNER JOIN will not. And yes, there are other T-SQL statements you can use to filter out results, but this method works fine for me.

Here are the queries:

SELECT DISTINCT TOP 1000
vc.[Name] AS 'PC Name',
vc.[User] AS 'PC User',
sw.[ProductName] AS 'Product Name',
sw.[ProductVersion] AS 'Product Version',
vc.[Guid] AS 'Guid'
FROM vComputerEx vc
JOIN [Inv_AeX_SW_Audit_Software] sw
ON vc.[Guid] = sw.[_ResourceGuid]
LEFT OUTER JOIN (SELECT DISTINCT TOP 1000
ar.[Name] AS 'Product Name',
vc.[Guid] AS 'Guid'
FROM vComputerEx vc
JOIN [AeXInv_AeX_OS_Add_Remove_Programs] ar
ON vc.[ResourceID] = ar.[WrkstaId]
WHERE ar.[Name] = 'Windows Internet Explorer 7') AS ie
ON ie.[Guid] = vc.[Guid]
WHERE
sw.[File Name] = 'iexplore.exe'
AND sw.[ProductName] LIKE 'Internet Explorer%'
AND ie.[Guid] IS NULL
ORDER BY vc.[Name]

SELECT DISTINCT TOP 5000
vc.[Name] AS 'PC Name',
vc.[User] AS 'PC User',
ar.[Name] AS 'Product Name',
sw.[ProductVersion] AS 'Product Version',
vc.[Guid] AS 'Guid'
FROM vComputerEx vc
JOIN [Inv_AeX_SW_Audit_Software] sw
ON vc.[Guid] = sw.[_ResourceGuid]
JOIN [AeXInv_AeX_OS_Add_Remove_Programs] ar
ON vc.[ResourceID] = ar.[WrkstaId]
LEFT OUTER JOIN (SELECT DISTINCT TOP 5000
ar.[Name] AS 'Product Name',
vc.[Guid] AS 'Guid'
FROM vComputerEx vc
JOIN [AeXInv_AeX_OS_Add_Remove_Programs] ar
ON vc.[ResourceID] = ar.[WrkstaId]
WHERE ar.[Name] LIKE 'Adobe Creative%Suite%') AS CreativeSuite
ON CreativeSuite.[Guid] = vc.[Guid]
WHERE
sw.[File Name] = 'acrobat.exe'
AND ar.[Name] LIKE 'Adobe Acrobat%Professional'
AND CreativeSuite.Guid IS NULL
ORDER BY vc.[Name]

Now after you have looked at the queries, you might be wondering why I have written the IE6 query. After all, shouldn't you just be able to query for the version of iexplore.exe and use that result? The problem is, there can be multiple copies of this file on your system, as each time you upgrade or patch IE, it caches the old file, in case you want to revert back to the old version. In some cases we have systems with 7 copies of iexplore.exe on them, some version 6.x, some version 7.x. This query works around that problem.