Wintel & Virtualization...

System Center 2012 Self-Study Guide

2013-05-29T14:47:00.000+08:00

Top-level link for System Center 2012 is: http://www.microsoft.com/systemcenter

System Center 2012

In this section are study material related to System Center 2012 in general. The data here represents the study material that does not fit neatly into one of the specific component categories. Further sections will deal with the specialty components that make up System Center 2012

Microsoft Virtual Academy (free online courses and knowledge measures)

· What’s New in System Center 2012

· System Center 2012 Data Warehouse and Reporting

· System Center 2012 Licensing & Pricing - Overview

· Introduction to Systems Management & Service Delivery

o Introduction to Systems Management & Service Delivery (video)

o Systems Management Cheatsheet (PDF)

o Value and Types of Service Management (video)

o Policies & Processes, Scale & and Automation (video)

o Metrics, Billing, Self Service (video)

o Exam: Introduction to Systems Management & Service Delivery

Training Videos and Webcasts

· Deliver Flexible and Cost-Effective Infrastructure with System Center 2012

· Automated Remediation with System Center 2012

· Deliver Flexible and Cost-Effective Infrastructure with System Center 2012

· Private Cloud Demo Extravaganza

o Private Cloud Demo Extravaganza 1: Deploy Bare Metal Servers to Hyper-V with System Center 2012

o Private Cloud Demo Extravaganza 2: Multiple Hypervisors for Cloud Resources & Adding ESX Servers with System Center 2012

o Private Cloud Demo Extravaganza 3: Add Resources to a Failover Cluster with System Center 2012

o Private Cloud Demo Extravaganza 4: Service Template Creation & Deployment with System Center 2012

o Private Cloud Demo Extravaganza 5: Standardized Service Updating with System Center 2012

o Private Cloud Demo Extravaganza 6: Monitor Network Devices with System Center 2012

o Private Cloud Demo Extravaganza 7: Monitor and Automatically Resolve Issues in the Fabric with System Center 2012

o Private Cloud Demo Extravaganza 8: Create an Orchestrator Runbook and Integrate with Service Manager with System Center 2012

o Private Cloud Demo Extravaganza 9: Create Self-Service Request Offerings using the Service Catalog with System Center 2012

o Private Cloud Demo Extravaganza 10: Deliver Self-Service Request Offerings using the Service Catalog with System Center 2012

o Private Cloud Demo Extravaganza 11: Gain Insight & Visibility through Service Manager Reporting with System Center 2012

o Private Cloud Demo Extravaganza 12: Enabling Application Performance Monitoring with System Center 2012

o Private Cloud Demo Extravaganza 13: Creating an Application Performance Monitoring Dashboard with System Center 2012

o Private Cloud Demo Extravaganza 14: Deep Application Diagnostics & Insight with System Center 2012

o Private Cloud Demo Extravaganza 15: Managing Applications Across Private & Public Clouds with System Center 2012

o Private Cloud Demo Extravaganza 16: Managing Application Resources Across Private & Public Clouds with System Center 2012

o Private Cloud Demo Extravaganza 17: Self-Service Application Deployment with System Center 2012

Podcasts

· Deliver Flexible and Cost-Effective Infrastructure with System Center 2012

· Automated Remediation with System Center 2012

· Deliver Flexible and Cost-Effective Infrastructure with System Center 2012

Virtual Labs

These are online simulations that allow users to experience System Center technology first-hand.

· Guided Labs

o Provide Resources through Self-Service Requests

o Drive Consistent Service Delivery

o Provision Additional Cloud Infrastructure

o Delegate Cloud Resources

o Create Consistency through Service Templates

o Perform a Standardized Application Deployment to Test

o Stage Application Resources

o Self-Service Deployment of an Application to a Production Environment

o Gain Insight and Visibility Through Reporting

o Monitor Infrastructure

o Taking Corrective Actions in the Infrastructure

o reduce Time to Resolution with Application Performance Monitoring

o Deploy and Update to a Service Instance

o Explore Creating Dashboards

Articles/Documentation

In this section are articles relating to System Center 2012, including the top-level TechNet site for all things relating to System Center 2012.

· System Center 2012

o App Controller

o Configuration Manager

o Data Protection Manager

o Endpoint Protection

o Operations Manager

o Orchestrator

o Service Manager

o Unified Installer

o Virtual Machine Manager

Useful Blogs

In this section are articles and guidance written by System Center 2012 technical experts.

· The System Center Team Blog

· Steve Rachui's Manageability Blog

· System Center Weblog

Forums

In this section is al list of forums where System Center administrators can post comments, ask questions, and join in conversations related to System Center 2012.

· System Center Forums

Support for System Center 2012

The link below is a central page that provides a wide variety of resources and solutions to help System Center administrators resolve problems and issues.

· Support for Microsoft System Center

How Microsoft does IT

2013-05-29T14:44:00.000+08:00

I wanted to take this opportunity to share best practices and experiences from Microsoft IT that provide a unique, inside view into how Microsoft IT plans for, deploys, and manages its own enterprise solutions – from Microsoft IT professionals to IT professionals—peer to peer.

Microsoft views IT as an instrumental vehicle in implementing business strategy, which is why Microsoft IT actively shares best practices from using Microsoft technologies to deliver tangible business solutions while reducing costs and increasing productivity. The challenges, solutions, and benefits Microsoft experiences by using its own products and technologies are captured in IT Showcase award-winning content.

Some of our latest content includes:

· Windows Server BranchCache

· System Center 2012 Operations Manager

· Wireless Infrastructure

· Deploying FAST Search Server 2010 for SharePoint

· Consumerization of IT (Article | Quick Reference Guide)

· Monitoring Applications via Windows Phone 7.5 Devices and the Cloud (Article | Technical Case Study)

Also, please feel free to peruse all content by the products and subjects outlined below:

By Product:

By Solution Area:

· Exchange Server

· Internet Explorer

· Internet Protocol

· Lync

· Microsoft Desktop Optimization Pack

· Microsoft Dynamics

· Microsoft Forefront

· Office 365

Office System

· Office Communications Server

· SharePoint Server

· Office

· SQL Server

System Center

· System Center Configuration Manager

· System Center Data Protection Manager

· System Center Operations Manager

· System Center Service Manager

· Virtual Machine Manager

· Visual Studio

Windows

· Windows Azure

· Windows Client

· Windows Phone

· Windows Server

Application Architecture

Business Intelligence

Consumerization of IT

Database Technologies

Environmental Sustainability

Information Worker—Exchange

Information Worker—Lync

Information Worker—Office

Information Worker—SharePoint

Productivity

Security

Server Infrastructure

Systems Management

Other Resources

· Subscribe to Our Content - Subscribe to one or more of our new RSS feeds, and be notified when new Microsoft IT content publishes for the topics you care about most.

· Microsoft IT—Committed to the Cloud - Microsoft IT shares its experiences and benefits from its internal deployments of Microsoft cloud services.

· Advance your career with FREE training! - The Microsoft Virtual Academy helps you to improve your IT skill set and advance your career with a free, easy to access training portal that allows you to learn at your own pace, focusing on Microsoft technologies.

2013-05-29T14:33:00.000+08:00

E-book gallery for Microsoft Technologies... which is free download:

http://social.technet.microsoft.com/wiki/contents/articles/11608.e-book-gallery-for-microsoft-technologies.aspx

Migration of File Server and local group

2012-10-17T13:38:00.001+08:00

I would like to share on my recent work where migrating a file server to a new hardware. Actually, it should be straight forward migration, however, the folder permission was configured with local group (not domain group), thus this make the permission invalid when migrated to the new server, due to the local group SID (Security Identifier). You can find more info of SID at http://en.wikipedia.org/wiki/Security_Identifier

OK, now let go into the topic, there are several handy tools that required for this migration:

1. Addusers.exe (from Windows 2000 resource kit – Attached in this blog also)

2. SubinACL (http://www.microsoft.com/en-us/download/details.aspx?id=23510)

3. Getsid.exe (from Windows 2000 resource kit – Attached in this blog also)

4. Robocopy (should be come with current OS – eg: Windows 2008)

5. Beyond Compare 3 (optional – this will be use for folder comparison only)

Let run thru overview of those tools:

1. Addusers.exe

a. This will be use to export the local group info and then import the group info into the new server.

2. SubinACL

a. We need this primarily to replace the existing group SID with new SID on the new server.

b. This also comes handy when we need to fix some access denied issue when we want to copy file/folder into new server.

3. Getsid.exe

a. This is to dump the local group SID on existing server and new server. Then we will use SubinACL to do the SID replacement.

4. Robocopy

a. Use to copy files/folders together with NTFS permission.

5. Beyond Compare 3

a. This is an optional item, where I use it to do folder comparison after copying using robocopy. You can use other alternative tools as well that perform the same job, which is comparing folder between existing server and new server.

Basically, I divided into several part’s:

Part 1: Let “copy” the local group from existing server to new server

ServerA = existing old server (source)

ServerB = New server (destination)

1. 1. Go to Server A, run “addusers \\ServerA /d myGroupSource.txt”

a. It will dump all the local group/users information into a file called myGroupSource.txt

2. 2. Open and edit the myGroupSource.txt, you should able to see there is 3 section’s:

a. [User]

b. [Global]

c. [Local]

3. As we want to only copy the local group into new server, thus please remove whole section of [User] and [Global]. As per screenshot below, removed those inside the red color box.

3. Once edited, your first line of myGroupSource.txt, should be started with “[Local]”.

5. 4. Edit the myGroupSource.txt again, this time we want to remove those built-in group. Eg: Administrators, Backup Operators, Power Users, etc. Remember each group is per line, thus remove the whole line and not just the word “administrators” :P

6. 5. Once it is tidy up, copy the myGroupSource.txt to Server B (new server) and run below command, this will import/create the local group based on the “myGroupSource.txt” info.

a. addusers \\ServerB /c myGroupSource.txt

7. 6. Now, go to manage computer à Local users & Group, you should able to see newly created group with membership based on the “myGroupSource.txt”

Note: This only create new local group (new group SID) and it group members and will NOT migrate the users. Thus if the group members contain local User ID of server A, it will become invalid, and you should only see those SID string and not username.

Part 2: It is time to do some massive data migration…. :P

Simple tasks for those used robocopy before, just type some switches and viola…..

1. 1. On the Server B, type below sample command

a. robocopy \\ServerA\D$\mydata d:\mynewdata /E /ZB /COPYALL

i. robocopy <source of the data> <destination> <Option>

ii. For more details, you can look at robocopy /?, in fact, you can do more advance this with those option available, eg: mirroring, monitoring, logging, etc

2. 2. If your file server is large enough (eg: TB in size), this will take some times, for me, I’ll run multiple robocopy session against multiple different folder.

3. 3. Once copied, use the BeyondCompare tools or similar tool to do folder comparison, as we want to make sure we copied all the files/Folders.

Part 3: Prepare the SID matching file and fix the folder/file permission.

As every user or group created in a server, it will assign a SID and it is unique on every creation and server even with the same name. Example, a local group called “FinanceDept” in Server A is NOT the same as “FinanceDept” local group created in Server B. As both groups contain different SID.

Thus, if the file NTFS permission was granted Read permission for a Local group (eg: FinanceDept) in Server A, when you migrate the file and file permission to Server B, the permission of “FinanceDept” will become invalid. Reason being the SID of “FinanceDept” is simply not recognized by Server B.

So, as we already created the local group in Server B (as stated in Part 1), a new SID was assign to the newly created group. Thus, we need to prepare a SID matching file and use SubinACL to replace those ServerA SID with ServerB SID. So that domain user ID resides in that group will able to access to the shared folder when you migrate file server into the new server.

1. 1. First you need to create a test file where the content will list out all the group that you want to do the matching and replacement. Each line will represent each group, name the file as Localgroup.txt

2. 2. Create 3 batch files with the following content and file name:

a. Filename: ListSID.bat

echo off

cls

if exist groupssid.txt del groupssid.txt

for /F "tokens=1" %%a in (localgroup.txt) do call listsid1.bat %%a

b. Filename: ListSID1.bat

getsid \\ServerA %1 \\ServerB %1 >sid1.txt

for /F "skip=1 tokens=5,7" %%a in (sid1.txt) do call listsid2.bat %%a %%b

Note: \\ServerA = The source server name (existing file server)

\\ServerB = The Destination server name (new file server)

c. ListSID2.bat

echo %1 %2 >>groupssid.txt

3. 3. Save all the file/batch file created in part 3 stated above into a same folder as GetSID.exe

4. 4. Use command prompt, run the ListSID.bat

5. 5. Once it completed, an output file called groupSSID.txt will be created. Open the file and you will see similar content

6. 6. Now edit the content so that it is only contain SID info with this format:

a. <ServerA Group SID> <ServerB Group SID>

7. 7. Now the matching file is ready, assuming your file copy using robocopy is completed (must wait till it completed), next we will run SubinACL to read the matching file and do the permission (SID) replacement.

8. 8. Create 2 batch files with following:

a. Filename: ReplaceMe.bat

for /F "tokens=1,2" %%a in (groupssid.txt) do ReplaceMe2.bat %%a %%b

b. Filename: ReplaceMe2.bat

subinacl /subdirectories D:\SharedFolder1\*.* /replace=%1=%2

9. 9. Make sure the file above are saved in the same directories as SubinACL.exe

10. At command prompt, run ReplaceMe.bat

Note: You may need to run the command prompt with Administrator Elevated privilege.

11. Once you run the same batch file against all your folders, then you are Good to Go..! and ready to cut over the new file server as production.

Hope above steps able to assist you on your File migration… Any suggestion or idea to do the same thing is welcome…

More Details Resources:

You cannot resolve local groups when you migrate files between member servers of different domains

http://support.microsoft.com/kb/250267

New Windows Server 2012 released…..

2012-09-06T16:58:00.002+08:00

Excited about new server platform released by Microsoft, the Windows Server 2012….

It comes with 4 Editions:

Windows Server 2012 Datacenter
Windows Server 2012 Standard
Windows Server 2012 Essentials
Windows Server 2012 Foundation

Below table show the supported upgrade path:

There is hundreds of new functionality provided by Windows Server 2012, which there are few, catches my eyes and keep me to drill in more details, such as;

Cloning of Active Directory Domain Controller

This feature allow AD administrator to clone existing virtualized domain controller, thus saving time in term of DC deployment.

High Availability of DHCP server (without using Cluster)

This feature provides the ability to have two DHCP servers serve IP addresses and option configuration to the same subnet or scope, providing for continuous availability of DHCP service to clients.

Hyper-V Replica

This feature enables you to replicate virtual machines between two sites to provide business continuity and disaster recovery. It is something like VMware SRM.

For full new features introduce by Windows Server 2012, you can refer to:

http://technet.microsoft.com/en-us/library/hh831769

I’m still downloading the trial version of this new release, meanwhile whoever wants to test on the virtual lab, you can go to:

http://www.microsoft.com/en-us/server-cloud/evaluate/virtual-labs.aspx

For Trial download, get it from:

http://www.microsoft.com/en-us/server-cloud/evaluate/trial-software.aspx

Next... will drill more on features mentioned above…

Memory Leak – Trace it with PoolMon

2011-08-29T14:27:00.000+08:00

Memory leak! What I understand about memory leak is pieces of memory block that has been allocated, however it is no longer required/references by application/services. Which mean, the application/processes did not release that piece of memory block when it is no longer required.

Below is the 2 common Event ID (2020 and 2021) that you will see when you have memory leak issue.

Event ID: 2020

Source: Srv

Description: The server was unable to allocate from the system paged pool because the pool was empty.

Event ID: 2019

Source: Srv

Description: The server was unable to allocate from the system nonpaged pool because the pool was empty

Additionally, your system will become unresponsive, behave unexpectedly or hung.

So, now, how do we know which culprit keep “eating” the memory?

There is a tool from Microsoft called PoolMon, where this tool will capture and display current usage of the paged pool(pp) and non paged pool (np). You can get this tool from Microsoft Support Tools that ship with Operating System CD/DVD.

Below is the screenshot of the option that you can use when running the poolmon:

So, how to use this tool? First of all, you need to enable the tag mode for poolmon. You can refer to:

http://support.microsoft.com/kb/177415 on how to enable the tag mode. Basically, you can enable it by using registry or Gflags.exe utility.

Note: we do not need to enable the tag mode in Windows 2003 as it is enabled by default.

To run the poolmon, normally I’ll use below switches “–u –n <logfile path>” (poolmon.exe –u –n C:\mypoolmontest.txt), this will display data with sort by bytes, then dump the output into the logfile that you specified.

Screenshot above showed that I’m in Paged pool screen, and my current highest paged pool is process/app with “CM31” tag.

So, what we need to do is, capture these information every 15-30 minutes, do it for several hours or days. Once you compiled those data, do a trace manually as in which tags that always have paged or non paged pool “Bytes” increased and never come down.

What I’m going to do is, I’ll check the last screenshot of the poolmon, check which is the highest tag in Bytes is, then I trace backward, see if the pattern is keep increasing. (I mean if we trace backward, you should see the Bytes should be lesser and lesser).

On my recent case, the tag MPIO was keep increasingly using Non Paged pool, after drill more information from Internet, MPIO tag is referring to MPIO.sys driver that is meant for multi path I/O. This driver was develop by Microsoft and shipped by vendor on their multipath I/O application. In my case, I installed the EMC powerpath which come with MPIO version 1.21.

Again, found out that MPIO.sys version 1.21 have known memory leak issue which fixed in updated version MPIO.sys version 1.23. So, escalated to EMC, and I have to upgrade the EMC PowerPath to latest version fix this issue as the latest EMC PowerPath come with MPIO.sys version 1.23

Summary, above method to detect memory leak is abit too manual for data capture, however, it does able to help you to be Memory Leak Hunter…

Cheers… Happy troubleshooting….

Want to learn more about memory management? Check this out: http://blogs.technet.com/b/askperf/archive/2007/03/07/memory-management-understanding-pool-resources.aspx

Process Monitor – save your live sometimes…

2011-08-06T00:15:00.003+08:00

Hello again,

Heard of Process Monitor from SysInternal? Most probably yes for Wintel guys, I guess? If the answer is No, then I would like to share this handy tool with you. It is one of my “must have” tool for troubleshooting.

A lot of time, we will not know in details, which file's/registry key's that the application try to access to grab information, setting, configuration, etc…. This tool will actually monitor file system, registry key, DLL activity, etc in real time. Of course you can save the output for later viewing.

For example, you try to start a service, however, it failed to start and you have no idea where to check, where it fail, etc.. then you can start the Process Monitor to capture what/which file or registry key that the service try to access.

In a scenario where example, I try to launch myapp123 application, however it failed to start with error message “Access is denied”. In this case what I’ll do is:

Start the Process Monitor
Make sure the “Capture Event” is selected, click on File --> Capture Events, then it will start to capture all events.
Once it starts capturing info, I’ll try to launch the myapp123 application again to reproduce the error.
Once the error popup again, then stop the event capture by click on File --> Capture Events again or simply press CTRL + E.
Go to the last section of the output log, normally, you should able to see some indicator which file/registry key is failed to be accessed. Check which file or registry key that have value of “Access Denied” in Result column.

Sometimes, you just cannot find any indicator on the culprit, then another way or rather technique on using this tool is to capture event on “problem” server and compare the output with another healthy server.

Normally, we need to check on those results that stated “ACCESS DENIED” or “NAME NOT FOUND”.

“ACCESS DENIED”, as the value is self explaining, which mean the application/services try to access to certain file/registry key that do not have permission.

“NAME NOT FOUND”, which mean, the application/services try to access to certain registry key but it doesn’t exists. However, take note, some application/services by design will try to look up some registry key for any extra configuration, if no key found, only then it will load their own default setting. Thus, not all “NAME NOT FOUND” is guilty. :P

Another common result value, you should see is “BUFFER OVERFLOW”, this seem to be a big problem as my system have so many buffer overflow issue… don’t panic.. hold on! Read below, (copied from Microsoft Windows Internals)

“It does not indicate a buffer-overflow exploit in the application that receives it. Instead, it’s used by the configuration manager to inform an application that the buffer it specified to store a registry value is too small to hold the value. Application developers often take advantage of this behavior to determine how large a buffer to allocate to store a value. They first perform a registry query with a 0-length buffer that returns a buffer-overflow error and the length of the date is attempted to read. The application then allocates a buffer of the indicated size and rereads the value. You should therefore see operations that return BUFFER OVERFLOW repeat with a successful result”

By the way, you can download this great tool from http://technet.microsoft.com/en-us/sysinternals/bb896645

Have a great troubleshooting day…!!!

Event ID 16650: The account-identifier allocator failed to initialize properly – Am I struggling my brain or Mr. Macho brain?

2011-08-05T12:01:00.008+08:00

Hello World…

Just want to share an interesting experience of mine on this event ID 16650, which get me laughing till now. This “experience” happened around 2 years ago… the story begins…

I got a call from some senior management which we work together before to assist on a case which has been unresolved for 1-2 months; I took the call and try to understand what is happening on the issue over the phone with his lead engineer (Mr. Macho). They are hitting error 16650 when trying to create any Active Directory object. With some basic information capture, I did some research on the net before going to meet their team for details discussion and action plan.

Surprise me, when getting into their meeting room, there is some architect, project manager senior manager, senior engineer is discussing the issue. Once there, the senior manager introduce me to the team and I did some clarification, detail understanding, like what happen, what has been done, what is the objective, etc… from the discussion understand from the team that before me, they already engaged several Wintel SME to assist but still failed to get it resolved. Basically, what they try is to create a test AD environment by backup and restore one of the domain controller, the restore is successful but failed to create object. After 30 mins of listening the “sound like very complex” technical story from Mr. Macho, I was requested to be on-site to the data center to look into the issue.

While packing up my stuff, a “Macho” question pop up from Mr. Macho to me like below:

Me: OK, I’m ready to go.

Mr. Macho: OK, just want to confirm, you are not struggling your brain, try to understand what I explain to you just now, right?

Me: (I was stunned by the question and speechless; don’t really expect such a question)

Me: No No.. I think it’s fine and I understand what you have explained + (smile while looking at the senior manager which earlier asked me to assist on this issue)

Senior Manager: (To make me feel better, he explain to Mr. Macho about my past experience ……)

Once in the datacenter, Mr. Macho showed me where the problem is.. and prove that he already remove all other domain controller except the being restored from the “Active Directory User and Computer” console. He is like show me the problem in 5 mins and left myself to troubleshoot with no hope of getting it resolved. Just like he want to fulfill his manager request to let me try to troubleshoot the issue, which I’m getting more frustrated, anyway keep cool… J

When looking at the ADUC.msc, indeed all DC has been removed except the restored DC, no more replication link on the “AD Site and Services” console, etc… to double confirm that he properly clean up the AD as claim by Mr. Macho , I did a detail check using NTDSutil tools.

For those who do not know what is NTDSutil, you can refer to http://technet.microsoft.com/en-us/library/cc753343%28WS.10%29.aspx for more details.

What I found from NTDSutil, the other domain controller information is still listed, which mean the other DC information is not cleanup from metadata yet. Great finding, upon verification on the DC details, I use metadata cleanup command from NTDSutil to get it cleaned.

Viola….. once cleaned up, I can create any Active Directory object that I want, user, group, etc…. Informed Mr.Macho that the problem seems resolved, with unbelievable eyesight, he try to create user object by himself and yes, it is resolved. He looked at me speechless and in return I gave my “Are you now struggling your brain on what I did to get it resolved?” eyesight… (That is the best moment I have after so many years in troubleshooting) Yeah….!

Lesson learned, when we restore RID Master from backup, we have to ensure the replication link between DC is working fine, which mean the RID Master must able to contact all other DC, this is to check that there is no other RID Master exists in the domain to avoid conflict. Of course if the domain only have single domain controller then this will not be an issue. In above scenario, because they are trying to create an isolated test environment, thus there is no network connection to all other existing domain controller, thus they must properly cleanup the Active Directory using NTDSutil metadata cleanup command and yes I meant properly clean up not just delete the computer object from ADUC like what Mr. Macho did. Please refer to http://support.microsoft.com/kb/216498 or http://www.petri.co.il/delete_failed_dcs_from_ad.htm on how to perform cleanup.

You can refer to http://support.microsoft.com/kb/839879 “Event ID 16650: The account-identifier allocator failed to initialize in Windows 2000 and in Windows Server 2003” on the issue mentioned here.

P/S: I wrote a summary report email to all relevant party including several senior managers with “Time taken to resolve = < 1 hour” (whereby Mr. Macho “struggling his brain out” on this issue for 1-2 months *Devil Devil* :P

Mr. Macho, if you manage to read this blog, no hard feeling OK? Just want to register my experience on the internet. :)