Sam.McGeown.co.uk

Migrating VMware Virtual Infrastructure 3 HA Cluster to vSphere 4 – Stage 1: vCenter Upgrade

sammcgeown — Wed, 11 Nov 2009 17:50:31 +0100

I'm currently in the process of migrating a 2-host High Availability cluster of ESX 3.5u4 servers to vSphere 4. This is going to come in 3 distinct stages: Stage 1 is to upgrade VirtualCenter Server 2.5 to vCenter 4, which I am going to cover today. Stage 2 is to upgrade each host, and will be covered as I do it. Stage 3 is the upgrade of the Virtual Machines to the latest VMware Tools and then the new VM hardware.

So to start, I'll outline the process:

Download the vSphere vCenter 4 installer from VMware (~1.8GB).
Download your updated licensing for vSphere.
Back up your VirtualCenter server.
Run the installation.

I'm not going to run through the download of the installer or licensing, if you're not sure how to do that, probably best not to do the rest.

Backing up VirtualCenter Server

My VirtualCenter server is installed on a Virtual Machine, so this makes things a lot simpler – I'll just take a snapshot to start. Being a belt-and-braces kind of situation (live HA cluster), I'm also going to do the database and configuration backup too.

Databases - I'm using SQL Server 2005 express which is supported for vSphere vCenter, so there will be no database upgrades, however the schema will be changed. First off, I've connected to SQL with SQL Management Studio and run a full backup. As I have VMware Update Manager installed too, I'm backing up that database as well.

Configuration file – Make a copy of your vpxd.cfg file, which is stored in the C:\Documents and Settings\All Users\Application Data\VMware\VMware VirtualCenter folder.

SSL Certificates – In the same folder as the vpxd.cfg file there's a folder called SSL, which you'll want to backup too.

If you're not using integrated authentication for the database access, you need to ensure you have the user name and password for the DB access.

Once all that's gathered together and safely backed up, you can move on to the installation.

Installing vSphere vCenter

Open services.msc and stop the VMware VirtualCenter Server service.

Insert your vCenter installation CD, the installer pops up:

Click vCenter Server.

Notice it's detected the earlier version of vCenter server and is going to upgrade.

Enter license details.

Enter DB user details, or leave blank if you're using integrated authentication like me.

If you have any plug-ins installed (e.g. VirtualCenter Update Manager, or Converter) it will let you know that they need to be up to date too.

Select to upgrade the vCenter Server database, and tick that you've backed up the database and SSL folders.

Select the account that you want to use to run the vCenter Server service.

Configure some ports, I've left them as defaults.

Finally, install. It will run a DB upgrade, and various other uninstall/upgrades.

At this point I sat and waited…and waited…and waited. SQL server was chewing 70-80% processor, it was progressing, just slowly.

Eventually, it finished and the server settled down. I ran through the upgrade of Update Manager and Converter Enterprise, all click and go.

Stage 1 complete!

MOSS 2007 – Alternate Access Mapping authentication fails

sammcgeown — Fri, 16 Oct 2009 15:58:46 +0100

If you have an Alternate Access Mapping configured for a MOSS 2007 site with Integrated Authentication you might find that you get prompted for the DOMAIN\UserName and Password. After 3 attempts you get to a HTTP 401 error.

This can be resolved by following the steps in MS KB 896861

HTH,

Sam

My Top Free Tools

sammcgeown — Thu, 15 Oct 2009 13:00:58 +0100

I use a lot of free tools in my everyday work – some don't make the grade, but others I just couldn't do what I do without – check out my top free tools here: http://www.mcgeown.co.uk/BlogEngine/page/My-Top-Free-Tools.aspx

The requested Storage VMotion would move a virtual machine's disks without assigning the virtual machine a new home, but such a move is not supported on the source host

sammcgeown — Wed, 14 Oct 2009 14:04:00 +0100

I'm migrating some hosts off of an older storage LUN, but when I drag the disk to the new Datastore with the SVMotion plug-in the job fails with the following error:

The error occurs because the virtual disk cannot be moved without moving the source files, the .vmx, .vswap etc. Simply drag the entire VM, rather than the virtual disk to the new Datastore.

If you're trying to move a 2nd, 3rd or nth disk and you get this error, drag the entire VM as per above over to the new Datastore, once that's completed, go back in to SVMotion and drag the whole VM across again, only this time before you apply, drag the nth disk back to the new Datastore.

ESX 3.5 snapshots of disks on different storage are stored with the VM files

SamMcGeown — Fri, 02 Oct 2009 17:06:00 +0100

A.K.A Why not to use snapshots

I ran into a slightly confusing problem today - our SQL servers are all created with 4 disks on 4 separate LUNs (System, Swap, SQL Data and SQL Logs). When viewing the server through Virtual Center I couldn't see all of the LUNs, just the System LUN. It's not a major problem as the VM can see the storage, but a little annoying when you have to remember what LUN the disks are on.

Slightly more distressing was the fact that the System-LUN was running out of space - fast. A LUN that should have had about 150GB free was running dangerously low. On investigation I found various snapshot files were being stored in with the System-LUN, which is where the VM's VMX, vswap etc are situated. These were the snapshot delta files of the additional disks, which were on other storage! This isn't first apparent at first as the disk snapshots have been named sequentially by ESX, so a VM with 4 disks on separate LUNs will in fact create 4 snapshot files on the SYSTEM-LUN named VM01-00001.vmdk, VM01-00002.vmdk, VM01-00003.vmdk and VM01-00004.vmdk. 00001 is for the System disk, 00002 is for the Swap disk etc etc. This means that the IO on that LUN has been multiplied, and the storage space is shrinking very rapidly.

A little more digging and it seems that this is by design - snapshots are not meant to be kept for very long, and I think VMware made a deliberate decision to make it difficult to do so. Any virtual disks created for a VM, lets call it VM01, were named VM01.vmdk. When additional virtual disks were created through vCenter on a different LUN, they were still named VM01.vmdk - there's no conflict because they're in different locations. However, when vCenter takes a snapshot it places them with the original disk, and because it's got the same name as the existing disk it starts to enumerate them.

This is bad for a number of reasons - most prominent of which is that if the snapshot file grows large, vCenter does not handle the commit well. In fact, neither does ESX, but I'll get to that. vCenter will time out on any operation that takes more than 15 minutes, so a commit of a 10GB snapshot will look for all intents and purposes in vCenter like it's failed. On top of that, the enumeration of snapshot delta files can cause confusion as to which disk it actualy belongs to, and if that happens, commiting

We all know snapshots are performance killers, but the functionality they provide is not insignificant, and as with most things a balance has to be struck between the functionality and the performance.

So the headlines

VMs created with disks on multiple LUNs in vCenter use the SAME DISK NAME (eg; for VM01 the disks were created in /vmfs/volumes/SYSTEM-LUN/VM01.vmdk, /vmfs/volumes/SWAP-LUN/VM01.vmdk etc etc).
- Mitigate this by creating disks using the vmkfstools and adding them to the VM or renaming the existing disks (see below).
Snapshots cause ALL disk delta files onto the "system" LUN (i.e. where your VMX file is stored.) This is bad because a) it multiplies your I/O on that disk and b) you negate the benefits of storing on multiple LUNs.
- Mitigate this by deleting your snapshots. There's no other way*, don't try manually moving them or you will have problems.
Commiting large snapshots takes time - LOTS of time - and can have a big performance hit on your server.
- Mitigate this by shutting down your VM first and commiting the disk using the vmware-cmd out of business hours. You can also merge the old disk and snapshots into a "new" disk, then shut down the VM and boot with the "new disk".
vCenter has a hard coded 15m timeout.
- If you are doing a operation that will take longer than that, do it via the console!

* when I say there's no other way, I mean, there's no other practical way. There are methods to move the snapshot files to another LUN but they bring some serious problems with them.

Create a vmdk (virtual disk) using vmkfstools

Log in to your server console.
Type su - (to log in as root, enter root password, note the "-" to load the root user environment variables)
Navigate to the storage that you wish to use. E.g. cd /vmfs/volumes/System-LUN/
Create a new folder for the virtual disk: mkdir VM01
Navigate to the folder: cd VM01
Create the disk: vmkfstools -c <size> <filename> -a <buslogic|lsilogic>
For help just type vmkfstools

Rename vmdk files using vmkfstools

Shut down the VM in vCenter.
Edit the VM settings and remove the disk you wish to change. Do not delete the file!
Log in to your server console.
type su - (to log in as root - enter root password, note the "-" to load the root user environment variables)
use the command: vmkfstools -E /vmfs/volumes/<LUN>/<Server Name>/<Disk Name>.vmdk /vmfs/volumes/<LUN>/<Server Name>/<New Disk Name>.vmdk
Go back to the vCenter and re-add the disk, using the new name.

Commit your snapshots using vmware-cmd

Log in to your server console.
Type su - (to log in as root, enter root password, note the "-" to load the root user environment variables).
Use the vmware-cmd -l command to list your VMs. Note the path to the VM you want to deal with.
Remove all snapshots for a VM: vmware-cmd /path/to/vm/VM01.vmx removesnapshots

Teaming NICs with ESX 3.5 and Cisco Switches in an aggregate.

SamMcGeown — Wed, 30 Sep 2009 12:24:00 +0100

Here's the setup. We have a core switch of 2 Cisco 3750s, connected together for fault tolerance as a single logical switch; we also have several ESX 3.5 hosts with 4 Gigabit Ethernet NICs installed each. The Virtual Machines will all be on VLAN 8 (reserved for internal servers) and the VMKernel will be on VLAN 107 (reserved for VMKernel traffic like VMotion). I want to create a load balanced, fault tolerant aggregate of these four NICs over the Core Switch.

Configure ESX server's vSwitch

Configuring the vSwitch is actually pretty simple, but there are a couple of gotchas, so don't skip this bit! First thing to note is that if you are making changes to the vSwitch and the Service Console is on that vSwitch you can quite easily lock yourself out. Make sure you configure this correctly, first time! In this setup, I am adding all 4 NICs to vSwitch0, which will be the only vSwitch. I'll then use Port Groups to assign VLANs and Active/Passive configurations to the VMKernel/Service Console.

First things first then - assign the four NICs to the vSwitch. This is done in the Configuration Tab in VMware Infrastructure Client, then the Networking page. Edit the properties of your vSwitch, then select the Network Adaptor tab. Add all the NICs you wish to team in there (they may already be in there, depending on your setup). You should end up with something that looks like this (note that I've not assigned any VLAN yet):

Now you need to configure the NIC teaming, so edit the vSwitch Properties and under the Ports tab select the vSwitch. Click edit, and then go to the NIC teaming tab. Configure the teaming options like this:

That's the easy part over and done with! Time to move onto the Cisco!

Configuring the Cisco Core Switch

Firstly, we need to log on to the switch and enter enable mode; I'm going to assume you know how to do this - if not, you really shouldn't be attempting this setup!

Determine the switches trunk load balancing setup by using the command "show etherchannel load-balance". It should look something like this:

If the protocol is NOT src-dst-ip, then you won't be able to establish a trunk connection with the ESX server. If your protocol is not src-dst-ip, change it with the command "port-channel load-balance src-dst-ip". This now matches the "Route based on IP hash" setting you configured in ESX. Although ESX has a setting for MAC based hashing, as does the Cisco, I was unable to get it to work.

Moving on. You need to create a Port-Channel interface for the trunk (this is a virtual interface that binds the 4 GigabitEthernet interfaces together). As i've got other Port-channels in use for connections to other switches, I'm setting up port-channel 40. Move to config mode (conf t) and then enter the setup:

interface Port-channel40
description VMTEST01 Aggregate
switchport trunk encapsulation dot1q
switchport trunk native vlan 8
switchport mode trunk
switchport nonegotiate
spanning-tree portfast trunk
end

Description simply adds a description, "switchport trunk encapsulation dot1q" sets the encapsulation of the trunk to 802.1Q. "switchport trunk native vlan 8" means that any traffic without a VLAN tag will be automatically assigned to VLAN 8. "switchport mode trunk" obviously designates that we want a trunk, rather than access. "switchport nonegotiate" means that it will not attempt to negotiate the protocol, and be a static trunk, rather than LCAP or PGaP. "spanning-tree portfast trunk" causes a Layer 2 LAN interface configured as an access port to enter the forwarding state immediately, bypassing the listening and learning states (i.e. if the link goes down and then comes back up, it will do so quickly).

With the Port-channel configured, you now need to edit your GigabitEthernet ports and assign them to the Port-channel. For each port in the trunk, enter the following config (this example is port 8 on the master switch in my stack, hence 1/0/8):

interface GigabitEthernet1/0/8
description VMTEST01 VMNIC1
switchport trunk encapsulation dot1q
switchport trunk native vlan 8
switchport mode trunk
switchport nonegotiate
channel-group 40 mode on
spanning-tree portfast trunk
end

The difference between that and the Port-channel setup? "channel-group 40 mode on" is simply assigning the port-channel in static mode.

Once all four NICs are assigned you might have to wait a few minutes for every layer of the connection to settle down before the trunk comes up. To check the status of the etherchannel you can use the command "show etherchannel 40 summary", replacing the 40 for whichever number you assigned to your port-channel.

I hope this helps navigate the minefield that I found to be setting up the NIC teaming!

DCDIAG /TEST:DNS fails with errors regarding root hint servers

SamMcGeown — Mon, 21 Sep 2009 17:19:00 +0100

I recently resolved an ongoing DNS issue where the Active Directory Integrated DNS was loaded in both the Domain and the DomainDNSZones partition of AD - this is a separate issue and should be resolved differently. My problem when I tried to verify that the fixed DNS setup had propogated around my domain controllers, DC01 and DC02. DC01 kept failing "DCDIAG /TEST:DNS" with errors regarding the root hint servers. Googling about it was clear that a lot of people were suffering the same issue, but no article I read had correctly identified the solution.

The error looked something like this:

P:\>dcdiag /test:dns

Domain Controller Diagnosis

Performing initial setup:
   Done gathering initial info.

Doing initial required tests

   Testing server: SITE\DC01
      Starting test: Connectivity
         ......................... DC01 passed test Connectivity

Doing primary tests

   Testing server: SITE\DC01

DNS Tests are running and not hung. Please wait a few minutes...

   Running partition tests on : ForestDnsZones

   Running partition tests on : DomainDnsZones

   Running partition tests on : Schema

   Running partition tests on : Configuration

   Running partition tests on : DOMAIN

   Running enterprise tests on : DOMAIN.com
      Starting test: DNS
         Test results for domain controllers:

            DC: DC01.DOMAIN.COM
            Domain: DOMAIN.com

               TEST: Forwarders/Root hints (Forw)
                  Error: Root hints list has invalid root hint server: a.root-se
rvers.net. (198.41.0.4)
                  Error: Root hints list has invalid root hint server: b.root-se
rvers.net. (192.228.79.201)
                  Error: Root hints list has invalid root hint server: c.root-se
rvers.net. (192.33.4.12)
                  Error: Root hints list has invalid root hint server: d.root-se
rvers.net. (128.8.10.90)
                  Error: Root hints list has invalid root hint server: e.root-se
rvers.net. (192.203.230.10)
                  Error: Root hints list has invalid root hint server: f.root-se
rvers.net. (192.5.5.241)
                  Error: Root hints list has invalid root hint server: g.root-se
rvers.net. (192.112.36.4)
                  Error: Root hints list has invalid root hint server: h.root-se
rvers.net. (128.63.2.53)
                  Error: Root hints list has invalid root hint server: i.root-se
rvers.net. (192.36.148.17)
                  Error: Root hints list has invalid root hint server: j.root-se
rvers.net. (192.58.128.30)
                  Error: Root hints list has invalid root hint server: k.root-se
rvers.net. (193.0.14.129)

               TEST: Dynamic update (Dyn)
                  Warning: Dynamic update is enabled on the zone but not secure
DOMAIN.com.

         Summary of test results for DNS servers used by the above domain contro
llers:

            DNS server: 128.63.2.53 (h.root-servers.net.)
               1 test failure on this DNS server
               This is not a valid DNS server. PTR record query for the 1.0.0.12
7.in-addr.arpa. failed on the DNS server 128.63.2.53

            DNS server: 128.8.10.90 (d.root-servers.net.)
               1 test failure on this DNS server
               This is not a valid DNS server. PTR record query for the 1.0.0.12
7.in-addr.arpa. failed on the DNS server 128.8.10.90

            DNS server: 192.112.36.4 (g.root-servers.net.)
               1 test failure on this DNS server
               This is not a valid DNS server. PTR record query for the 1.0.0.12
7.in-addr.arpa. failed on the DNS server 192.112.36.4

            DNS server: 192.203.230.10 (e.root-servers.net.)
               1 test failure on this DNS server
               This is not a valid DNS server. PTR record query for the 1.0.0.12
7.in-addr.arpa. failed on the DNS server 192.203.230.10

            DNS server: 192.228.79.201 (b.root-servers.net.)
               1 test failure on this DNS server
               This is not a valid DNS server. PTR record query for the 1.0.0.12
7.in-addr.arpa. failed on the DNS server 192.228.79.201

            DNS server: 192.33.4.12 (c.root-servers.net.)
               1 test failure on this DNS server
               This is not a valid DNS server. PTR record query for the 1.0.0.12
7.in-addr.arpa. failed on the DNS server 192.33.4.12

            DNS server: 192.36.148.17 (i.root-servers.net.)
               1 test failure on this DNS server
               This is not a valid DNS server. PTR record query for the 1.0.0.12
7.in-addr.arpa. failed on the DNS server 192.36.148.17

            DNS server: 192.5.5.241 (f.root-servers.net.)
               1 test failure on this DNS server
               This is not a valid DNS server. PTR record query for the 1.0.0.12
7.in-addr.arpa. failed on the DNS server 192.5.5.241

            DNS server: 192.58.128.30 (j.root-servers.net.)
               1 test failure on this DNS server
               This is not a valid DNS server. PTR record query for the 1.0.0.12
7.in-addr.arpa. failed on the DNS server 192.58.128.30

            DNS server: 193.0.14.129 (k.root-servers.net.)
               1 test failure on this DNS server
               This is not a valid DNS server. PTR record query for the 1.0.0.12
7.in-addr.arpa. failed on the DNS server 193.0.14.129

            DNS server: 198.41.0.4 (a.root-servers.net.)
               1 test failure on this DNS server
               This is not a valid DNS server. PTR record query for the 1.0.0.12
7.in-addr.arpa. failed on the DNS server 198.41.0.4

         Summary of DNS test results:

                                            Auth Basc Forw Del Dyn RReg Ext
               ________________________________________________________________
            Domain: DOMAIN.com
               DC01                    PASS PASS FAIL PASS WARN PASS n/a

         ......................... DOMAIN.com failed test DNS

It looks pretty horrific - DNS is failing at a basic level! It turns out that the actual issue is an old version of DCDIAG.EXE. After several hours and a lot of head scratching I checked the versions of the DCDIAG.EXE (normally c:\Program Files\Support Tools\dcdiag.exe) and "Lo! And Behold!" the version was different. I downloaded the Windows Server 2003 Support Tools R2, uninstalled the old version (v5.2.3790.1800) and installed the new one (v5.2.3790.3959).

Et voila! The working test...

P:\>dcdiag /test:dns

Domain Controller Diagnosis

Performing initial setup:
   Done gathering initial info.

Doing initial required tests

   Testing server: SITE\DC01
      Starting test: Connectivity
         ......................... DC01 passed test Connectivity

Doing primary tests

   Testing server: SITE\DC01

DNS Tests are running and not hung. Please wait a few minutes...

   Running partition tests on : ForestDnsZones

   Running partition tests on : DomainDnsZones

   Running partition tests on : Schema

   Running partition tests on : Configuration

   Running partition tests on : DOMAIN

   Running enterprise tests on : DOMAIN.com
      Starting test: DNS
         Test results for domain controllers:

            DC: DC01.DOMAIN.COM
            Domain: DOMAIN.com

               TEST: Dynamic update (Dyn)
                  Warning: Dynamic update is enabled on the zone but not secure
DOMAIN.com.

         Summary of DNS test results:

                                            Auth Basc Forw Del Dyn RReg Ext
               ________________________________________________________________
            Domain: DOMAIN.com
               DC01                    PASS PASS PASS PASS WARN PASS n/a

         ......................... DOMAIN.com passed test DNS

Multi-homed Domain controller logs Event ID 1030 and 1058

SamMcGeown — Thu, 10 Sep 2009 12:46:00 +0100

I recently had an issue where a hosting environment was registering a lot of Netlogon Event 1030/1058 issues, being unable to find the Group Policy objects or download them. In this example, the server DC is the domain controller for DOMAIN.LCL.

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1030
Date:  10/09/2009
Time:  06:24:29
User:  NT AUTHORITY\SYSTEM
Computer: DC
Description:
Windows cannot query for the list of Group Policy objects. Check the event log for possible messages previously logged by the policy engine that describes the reason for this. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1058
Date:  10/09/2009
Time:  06:24:29
User:  NT AUTHORITY\SYSTEM
Computer: DC
Description:
Windows cannot access the file gpt.ini for GPO CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=DOMAIN,DC=LCL. The file must be present at the location <\\DOMAIN.LCL\sysvol\DOMAIN.LCL\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini>. (Windows cannot find the network path. Verify that the network path is correct and the destination computer is not busy or turned off. If Windows still cannot find the network path, contact your network administrator. ). Group Policy processing aborted. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

On the affected machines, when navigating to \\DOMAIN.LCL there were no shares available, however navigating to \\DC shows the NETLOGON and SYSVOL shares. Pinging DOMAIN.LCL and then the DC showed that the IP addresses were not the same as expected, DOMAIN.LCL was resolving to the backup network, whereas DC was resolving to the servers LAN IP.

I checked the DNS records for the server, which were correct. Investigating the adaptor binding settings under Control Panel > Network Connections > Advanced > Advanced Settings showed that the backup network's adaptor was first in the list. I moved the adaptor for the LAN to the top of the list and OK'd my way out. I restarted the NETLOGON service and the issue was solved.

Windows servers have never been particularly good at being multi-homed, especially domain controllers. My advice comes from some bitter experience...

If you have multiple network adaptors for extra bandwidth/redundancy/resiliance, then I would strongly recommend using Teamed adaptors, most of the major manufacturers' drivers and management software support it. This will eliminate any issues with multi-homing because as far as the server is concerned, it has one adaptor.
If you have multiple network adaptors for different network segments and you're using RRAS to route between them, I would strongly suggest not using a Domain Controller at all for this purpose. Better yet, buy a hardware router.
If you have multiple network adaptors for different purpose networks (e.g. a LAN, a backup network and an iSCSI network) then make sure you do the following:
- Disable "File and Printer Sharing for Microsoft Networks" and "Client for Microsoft Networks" on all but the LAN adaptor.
- Ensure that your LAN adaptor is the FIRST adaptor in the bindings in the advanced network settings.

Hope that helps!

GFI Backup – Home Edition: Free backup for home users!

sammcgeown — Fri, 17 Jul 2009 13:27:15 +0100

Why should a home user backup? Most don’t, most people just have their photos, music and video collection on a single hard drive, maybe an external drive or even a USB key. Unfortunately, no-one ever thinks about what they’d do if their drive were to fail, losing all their precious holiday snaps, their slightly embarrassing music collection, or perhaps their family finances. But stop and think for a second – can you really replace those holiday snaps? What about your music collection – do you want to spend 3 days importing all your CDs or DVDs? Or maybe your personal finance app – is that something you could afford to lose?

With my little preachy bit out of the way, I’ll come to my point – GFI have released their own home backup software, and from what I can see, it’s pretty good. Installation is dead simple, and then you’re presented with your main screen:

Simple enough, Backup lets you…well…backup, Restore, funnily enough, lets you restore, Sync is a handy tool for syncing data across several sources, and finally My Tasks lets you modify previously configured Backup, Restore and Sync tasks.

Backup

Configuring Backups is as simple as selecting What, Where and When – What do you want to backup? Where do you want to back it up to? When do you want to back it up? There are some nice features over the bundled-with-Windows NTBackup

email notifications
backup to an FTP site
backup registry keys
backup email applications
backup user settings (i.e. your AppData folder)
“stacked backup” that keeps versions of your data
zip compression
aes encryption

In my test the pre-scan element of the backup took a while, but the actual backup itself was pretty speedy. I backed up my website (about 3000 files, 10mb) in 54 seconds to an external USB drive.

Restore

Restoring is just as easy, you can select to restore the entire backup, or individual files and folders. Both work well and are intuitive. I restored the same web folder back to my hard drive in an incredible 9 seconds.

Sync

I’ve not tested comprehensively, but on the surface it looks like a great piece of home software, which I’ll be using to do some off-site backups at home. And it’s free, which means you can’t go far wrong – nice one GFI!

Download GFI Backup – Home Edition here

Using AC97 audio with Windows 7

SamMcGeown — Tue, 07 Jul 2009 09:29:00 +0100

Like thousands of other IT pros out there, I'm testing Windows 7 out on my laptop - since I don't want to mess around with my main PC, it's running on some older kit. The problem with that is that there aren't many Vista drivers around for the hardware - why would there be, it's not even supposed to be able to run Vista?! It does, however, run Windows 7 very admirably (just one of the many improvements).

The only problem was the sound card, the only drivers available from Dell for the onboard sound were for XP, which crash in both Vista and 7. The sound card is compatible with Intel's generic AC97, so it didn't take long to find a Vista compatible AC97 driver from RealTek which will run any AC97 hardware, regardless of the actual manufacturer.

Internet Explorer or Services.msc problems after McAfee Uninstall

SamMcGeown — Thu, 02 Jul 2009 14:34:00 +0100

I'm in the middle of rolling out Sophos as a replacement to the incumbent McAfee at work. One interesting thing that I found as I rolled out to some test users was that they were unable to log on to one of our internal systems using NTLM (integrated authentication). Instantly the roll out of Sophos was blamed - and I can understand why - the problem did not occur until Sophos was installed.

But the truth is that in it's dying breath McAfee had one last laugh and had un-registered jscript.dll and vbscript.dll. I can say that now because I've spent a morning with Sophos support and been on the brink of abandoning our roll-out until I looked into one of the side symptoms.

Sophos was ruled out as the cause because a) it did not effect ALL the Sophos test machines, just ones where McAfee was uninstalled b) with Sophos disabled (services and browser add on) the problem did not go away c) Uninstalling Sophos did not solve the problem. It did however, point me in the right direction - during the uninstall there was an error message, the fix for which was to re-register jscript.dll (clue #1)

When I opened Services.msc, the Extended view simply showed a blue frame - Standard view was fine. One of the fixes for this was to re-register jscript.dll and vbscript.dll (clue #2).

Clue #3 came when I googled McAfee and jscript.dll, rather than blaming it on Sophos. A myriad of pleas for help from McAfee users with stuffed browsers, update issues and the like.

The Solution

Download and run the McAfee Consumer Product Removal tool (http://service.mcafee.com/FAQDocument.aspx?lc=2057&id=TS100507)
Reboot if required
Open a command prompt (Start > Run > "cmd")
Type the following commands in one at a time, hit enter and acknowledge the result
- Regsvr32.dll jscript.dll
- Regsvr32 vbscript.dll
Reboot again

On successful completion of this, you should be back up and running.

Now, let me take this opportunity to say that McAfee is a resource hogging, trouble making screwed up piece of software which I pray to God that I never have to support again. </rant>

Why not to use Dell Connection Point Manager, or any Dell 3G wireless software

SamMcGeown — Fri, 01 May 2009 10:08:00 +0100

I have to support about 20 laptops with 3G connections in them, they're all Dell and range from D800s with PCMCIA 3G data cards, D830s with internal Dell Wireless 5520 Modems and some newer E4200s with internal Dell Wireless 5530 Modems. Both the D830s and the E4200s are shipped with Dell software to manage the connections. The D800s use Vodafone Mobile Connect, and have never, ever, caused me a problem.

The Dell software on the other hand, is a nightmare. The most common issue is the classic "Sim Card Not Found", which occurs most of the time. I have spent literally hours on the phone to Dell support and our telecoms provider trying to get someone to help. I have flashed firmware on the cards, upgraded BIOS, installed countless versions of the drivers and generally wasted a LOT of my time. We even got as far as replacing all the SIM cards with various different versions just to try and get a connection.

The final insult was when we ordered the new E4200s and they just would not connect to 3G. They'd connect to 56k WAP ok, intermittantly not recognise the SIM, but never actually manage 3G. After yet more hours of support calls and useless flashing of firmware, I struck gold.

The solution? Vodafone Mobile Connect. Bin the Dell connection manager software, it's unstable, buggy and does not work. Even on laptops we COULD get a connection, it crashed frequently. Not only that, but VMC has features far beyond the Dell solution. I don't know if other providers have their own software, or whether it's any good, but I can hazard a guess it will be better than Dell's.

New look and feel, revised categories and a traffic milestone!

SamMcGeown — Tue, 07 Apr 2009 12:22:00 +0100

Just a quick note to mark the fact that I've updated the look and feel of the blog - hopefully with a bit more space and cleaner lines. It's still teething, so report any bugs you see! I've had a bit of a cleanup of the categories to remove some of the less "category" like ones - they were being a bit blurred with the tags.

Lastly, I'm really quite amazed to say that my blog is now well over 100 visitors a day on a weekday, so thank you for visiting! (Now if only a few more clicked on the adverts, It would start to recover some of the cost of hosting!)

As ever, let me know what you think!

Sam

How to force the removal of Folder Redirection from specific user accounts

SamMcGeown — Fri, 03 Apr 2009 11:14:00 +0100

We have a folder redirection policy in place for all of our users in combination with a roaming profile policy - this policy is applied to the OU that contains our users. Unfortunately this policy was accidently linked to the root of our domain too, causing our Domain Admin users to be redirected too - something we do not want. When the mistake was discovered, the policy was unlinked, but the redirection remained (despite being set to revert when users fall out of scope). I tried re-applying the policy, modifying the out of scope policy and then moving the Domain Admin user out of scope, but it failed to remove the folder redirection.

In the end, the solution was straight forward enough:

Create a new OU (I used "Temp") and move the affected user(s) there:

Create and link a new Group Policy Object to the new OU. Name it something descriptive so you know what it is in future - Folder Redirection Removal.

Edit the group policy, drill down to User Configuration > Windows Settings > Folder Redirection and right click - properties on each folder you want to reset. Set the setting to “Basic – Redirect everyone’s folder to the same location” and set the target folder location to “Redirect to the local userprofile location”.

Select the settings tab and make sure the Policy Removal setting is set to “Redirect the folder back to the local userprofile location when the policy is removed.”

Set that for each folder you want to reset. Close the Group Policy Object Editor, and GPMC. Log onto the user's account on each computer you want to remove the redirection on - in my case, several servers. Check the location of the redirected folders to make sure it’s been removed. Once you’re sure, you can move your user back to the correct OU.

VMWare Server: The VMware Host Agent service terminated with service-specific error 4294967295 (0xFFFFFFFF).

SamMcGeown — Wed, 18 Feb 2009 12:02:00 +0100

Having just rebooted my laptop, I clicked on the link to open VMWare Infrastructure Web Access in the my browser and was slightly puzzled by the "page cannot be displayed" error. I figured it was probably the VMWare Server Web Access service not starting for some reason, so I opened services.msc and checked it out. The Web Access service was actually running, but the Host Agent service was not, so I tried to start it - it failed. Dutifully opening Event Viewer for some more information I found the error:

The VMware Host Agent service terminated with service-specific error 4294967295 (0xFFFFFFFF).

Great. Thanks for the elaboration. Time to check the VMWare logs, (c:\ProgramData\VMWare\VMWare Server\) - the most recent of which contained the following entry:

[2009-02-18 10:55:27.908 'App' 4408 info] Trying hostsvc
[2009-02-18 10:55:27.948 'App' 4408 panic] error: not well-formed (invalid token)
[2009-02-18 10:55:27.948 'App' 4408 panic] backtrace:(backtraces not supported)
[2009-02-18 10:55:27.948 'App' 4408 info] Win32 service stopped

A bit of Googling pointed me in the right direction, "not well-formed" refers to the XML config files which are stored in c:\ProgramData\VMWare\VMWare Server\hostd, after that it was just a case of opening each one in turn until I found the malformed one. I backed it up and replaced it with a default version, and lo and behold, my services started!