Lab Control

SCCM 2012 Console Info

2012-02-09T20:01:00.000+11:00

As a byproduct of developing the Console Actions Manager I thought I would release a cut-down console information viewer to assist with inspecting console GUIDs, queries and returned classes.

The SCCM 2012 Console Information utility is available here.

More SCCM 2012 Utilities

2012-02-08T21:50:00.000+11:00

Well... one other utility anyway. I have created an executable that allows you to execute an Orchestrator 2012 RunBook from within an SCCM 2012 task sequence. The utility allows you to integrate task sequence variables into the required parameters for the RunBook and allows the sequence to pause and consume the published parameters from a RunBook.

SCCM 2012 RunBookExec
Usage: RunBookExec    /S:OrchestratorServer
                     /U:Domain\UserName
                     /P:Password
                     /HTTPS

                     /RI:RunBookID
                     /RN:RunBookName
                     /In:Parameter=Value
                     /In:Parameter
                     /In:Parameter=%Variable%
                     /Out:Variable=Parameter
                     /Out:Parameter

                     /W
                     [/T:Seconds]

IN parameters are parameters to send to a RunBook Job. Parameters without a value will assume a task sequence variable of the same name.

OUT parameters are published parameters from a RunBook Job. Parameters without a target variable will be created with the same name and the value of the Out parameter. Required /W to wait for completion.

e.g. RunBookExec /S:Server /U:Domain\User /P:Password /RN:TestRunBookName /In:FileName="My File.txt" /In:AParam=%TSVariable%/Out:TSResultVariable=ResultParam /W /T:5

The user name and password is optional but will require either permissions assigned to the system running the task sequence or using a Run As User Command line where the user account has permissions to execute the RunBook. At the moment this is only available for 64bit operating systems and requires .Net 4.0 on the system.Give it a try and let me know what you think... RunBookExec can be downloaded here.

SCCM 2012 RC Utilities

2011-11-23T21:37:00.001+11:00

It has been a long time since I postedanything. I have been extremely busy with work and looking into the new SystemCenter 2012 suite and I feel that it is time to share some of the tools andutilities I have been creating in my lab and elsewhere for SCCM 2012 ReleaseCandidate. So, today I have 2 utilities to share. Some may find these useful solet me know if they are and if there are any additional utilities you wouldlike to see.

SCCM2012 CopyRole

First up, a utility created out ofnecessity to deploy SCCM 2012 using a task sequence. Basically, the problem isthat when you deploy SCCM 2012 Primary or CAS sites no user permissions arecreated and nobody can log onto the SCCM installation until the console isexecuted as NT AUTHORITY\SYSTEM and permissions and scopes defined. For this Iwrote the CopyRole utility. This application will copy any existing SCCM 2012security and scope configuration to a new user or group.

Usage:CopyRole.exe /SA: /TA: [/G]

e.g.CopyRole /SA:demo\Administrator /TA:demo\AUser

e.g.CopyRole /SA:demo\Administrator /TA:demo\AGroup /G

I may modify this to allow for theselective copying of either the permissions or the scope; this all depends onthe usefulness. I do not have a need for this, yet.

SCCM 2012 CopyRole can be downloaded here.

SCCM2012 TriggerDiscovery

Secondly, out of necessity I required a scriptedprocess of initiating a full Security Group discovery so that it could betriggered from Orchestrator 2012. I developed TriggerDiscovery to allow this asthere is currently no simple way to trigger full discovery from the commandline.

Usage:TriggerDiscovery /SS: /SC: /T:[Type]

/U:/P: /L

/SS: - SCCM 2012 Site Server(SMSProvider)

/SC: - SCCM Site Code

/U: - Username i.e. domain\username

/P: - User Password

/T: - Discovery Type. One of:

U - User Discovery

F - Forest Discovery

SG - Security Group Discovery

SD - System Discovery Discovery

/L - [Optional] Log to text file in temp directory

SCCM 2012 TriggerDiscovery can bedownloaded here.

I am still working on 2 utilities, adistribution point copy tool and a PXE Service Point password managementutility. I am also working on an application to create, manage and package upcustom SCCM 2012 console actions with integration into Orchestrator 2012.

Here is a screen shot of the currentprogress.

SCCM 2012 Console Actions Manager

I hope I can get more time to work on thisas this is something I work on when I get 30 – 60 minutes here and there. Thecurrent version is very much an alpha, starting to be a beta, as it is capableof creating all the required XML files. If you are interested in seeing more,let me know and I will hook you up with the latest build, for your TESTenvironments.

SCCM 2007 OSD Denial-of-service issue

2009-12-08T21:19:00.004+11:00

I have been setting up a lab environment and recreating some base images for the various operating systems I intend to use and have come across an issue that I have not seen before. There also appears to be no information on this issue, related to SCCM 2007, posted on the internet so I thought I would share.

I have a basic SCCM 2007 R2 SP2 installation on SQL 2008 STD and Server 2008 R2. All this installed on a single server which is also the domain controller. I have created a task sequence and succesfully create a Server 2008 R2 Eval WIM image and began to create another task sequence for a Server 2003 SP2 base image. During the build and capture task sequence, I received a fatal error with the following logged in the status manager:

The task sequence execution engine failed execution of a task sequence. The operating system reported error 64: The specified network name is no longer available.

and ...

The task sequence execution engine failed executing the action (Prepare OS) in the group (Capture the Reference Machine) with the error code 64
Action output: \sms\framework\tscore\bootimage.cpp,714)
Entering ReleaseSource() for \\SERVER.DOMAIN.DOM\SMSPKGD$\HAD00001reference count 1 for the source \\SERVER.DOMAIN.DOM\SMSPKGD$\HAD00001\ before releasing
Released the resolved source \\SERVER.DOMAIN.DOM\SMSPKGD$\HAD00001TS::Boot::BootImage::StageBootImage(sPkgID), HRESULT=80070040 (e:\nts_sms_fre\sms\client\osdeployment\prepareos\prepareos.cpp,933)
PreStageWINPE(m_bDebug), HRESULT=80070040 (e:\nts_sms_fre\sms\client\osdeployment\prepareos\prepareos.cpp,1374)
pCmd->Sysprep(bActivate, bMsd), HRESULT=80070040 (e:\nts_sms_fre\sms\client\osdeployment\prepareos\main.cpp,270)
De-Initialization successful
Exiting with error code 64
Unable to copy boot image \\SERVER.DOMAIN.DOM\SMSPKGD$\HAD00001\boot.HAD00001.wim locally.
The specified network name is no longer available. (Error: 80070040; Source: Windows)
Failed to pre-stage WINPE image, hr=0x80070040
Unable to sysprep the machine, hr=80070040
Sysprep'ing the machine failed, hr=80070040. The operating system reported error 64: The specified network name is no longer available.

The initial indications are that the WINPE image is not available. In the failed PXE deployment, I validated the network connectivity and name resolution was not a problem. On the server I inspected the event logs and saw the following error message:

Event ID: 2025
Source: SRV
Description: "The server has detected an attempted Denial-Of-Service attack from client \\IP_Address, and has disconnected the connection."

The link to the information on Microsoft's website is here: KB898468

I followed the instructions in Method 2: Disable denial of service attack detection and rebooted the server. The problem went away. I would suggest that this issues is caused by an attempted connection is made from the same client using various credentials in an attempt to download the 32-bit WINPE image. What is of significant interest is that the first task sequence used the 64-bit WINPE image while the 2003 sequence was required to download the 32-bit WINPE image as the 64-bit was advertised to the Unknown computers collection after the 32-bit. Could it be that there is a Denial-of-service LIKE action that takes place as a result of an Unknown computer executing a 32-bit based deployment after PXE booting from a 64-bit WINPE image? Let me know if you are able to recreate this error.

Strange Virtual PC vhd compacting behaviour

2009-08-06T18:39:00.004+10:00

I have been testing the RC version of Virtual PC and have discovered a very annoying "feature". A new addition to the RC version is the ability to compact VHDs and differential disks from the command line. The command is

VPCWizard.exe /type evhd /filepath /compactdiffdisk

The cool thing is that you can use this command to compact any vhd from the command line. If only it was that easy. To run this command, you need to run the vpcwizard as Administrator! What are you guys thinking? Why can I not automate the compacting of vhds? Why does a simple process like this require elevated privileges?

In my opinion, this makes this feature almost useless. I have attempted to code this as part of the Windows 7 VPC manager I am creating and it returned an error "The compact operation can only be performed on dynamically expanding virtual hard disks."

Windows 7 VPC Manager

2009-07-22T20:24:00.004+10:00

I have spent some time working on a new project. VPC Manager is a virtual machine manager environment for Windows 7 virtual pc. I just wanted to show you what the interface looks like so far. There are quite a few things that need to be built and coded but the basics are there.

Some things that I would like to add are:

Group snapshots
Library for VMs and tasks
Multiple VM snapshots
VM display embedded into the interface

If you would like a closer look, send me a message and I will consider you for a closed alpha. This little utility may or may not work in your environment so don't try using it on virtual machines you cannot afford to lose.

This little project is quite a drag at the moment as I am not quite happy that Microsoft took the decision to not support 64bit guests. All my 64bit testing is done in VMWare Workstation. Oh well...

SCCM 2007 SP2 Beta 2

2009-06-12T21:28:00.007+10:00

Downloaded the latest beta of the SCCM 2007 SP2 and fired it up. I am please to say that OS deployment appears to be working, well almost, for all the supported operating systems. The one test that still failed was the build and capture of a Server 2008 with SP2 image. I have not had a lot of time to investigate this but it appears that the Prepare OS task cannot locate the sysprep tools.

Windows 7 build and capture and image deployment works now and so does Windows Vista with SP2, which is why I cannot understand the problems with the Server 2008 SP2 build and capture. SP2 beta 2 cannot build and capture Server 2008 R2 but can perform an unattended installation.

Passed 70-401 MCTS: Configuration Manager

2009-06-12T21:21:00.003+10:00

Took some time out to do the System Center Configuration Manager 2007 exam today. Passed it with a full 1000!!! This was the easiest exam I have ever done, and only 1K so far, with nearly every question having some relation to something I have done with SCCM before. This is also the result of spending the last 18 months ripping it to pieces to understand what is going on under the hood.

There were one or two questions that raised the eye-brow but a process of elimination narrowed down the answer. Some BS DHCP question... Go figure.

Which to do next, SCOM or SCVMM?

WLanAUTH - Wireless profile authentication utility

2009-06-09T13:41:00.006+10:00

Here is a utility I created to create and configure wireless profiles. This utility can be used to import an exported wireless profile XML file and configure authentication options at the commend line. The command line accepts variables that are substituted into the command line XML which allows you to modify the XML without writing the file to disk.

Download it here.

WLanAUTH (Wireless Lan Profile and Authentication Tool) - Version 1.0.0
============================================================================

Copyright 2009 Dean Brighton (dean@brightonmail.net). All rights reserved.

The wireless lan profile and authentication tool was designed to allow the user to configure wireless networks, including authentication settings, from the command line. The WLanAUTH tool can create profiles and configure security from custom or template XML files.

USAGE: WLanAUTH.exe [options]
/P:[Wireless Profile Name (case-sensitive)]
/PX:[Profile XML path]
/AX:[Authentication XML path]
/V:[Comma separated key and value used for substitution]
/L:[Log file path and file name]
/S:[Sample name] - Outputs sample authentication XML to a file:
EAPCHAP - EAP MS-CHAPv2 sample XML
EAPTLS - EAP TLS sample XML
PEAPCHAP - PEAP MS-CHAPv2 sample XML
PEAPTLS - PEAP TLS sample XML
/X Show XML with substituted variables
/? Show this help information

EXAMPLE: Using WLanAUTH to configure a wireless profile.
WLanAuth.exe /PX:MyProfileXML.xml /L:c:\Logs\WirelessConfig.log

EXAMPLE: Using WLanAuth to set authentication settings.
WLanAuth.exe /P:MyWirelessNetwork /AX:AuthXML.xml /L:Wireless.log /V:UserName,MyUsername /V:Password,P@ssw0rd

EXAMPLE: Create a sample authentication xml file.
WLanAuth.exe /S:PEAPCHAP

The templates and examples provided with the /S option can be used as part of the command line and come preconfigured with standard variables for Username, Password and Domain. The following command line creates a profile and configures PEAP-MSCHAPv2 authentication. Values specified for variables are substituted prior to use.

WLanAUTH.exe /p:WifiNet /px:WifiNet.xml /ax:peapchap.xml /v:Username,myusername /v:Password,MyPassword /v:Domain,ThisDomain /s:peapchap /x /l:Logfile.log

NOTE: Variable KEYs are case sensitive.

Advanced Task Sequencing

2008-07-31T08:56:00.015+10:00

The latest blog entry from The Deployment guys, Task Sequence logic tricks using MDT variables got my attention as this has quite a lot to do with what we have been working on. The concept of using variable to manage the logical flow of task sequences is not new but when exploited well can be a very effective way of managing different builds with the same, single task sequence.
Personally I find this approach cumbersome and potentially fraught with issue, especially if the logic gets messed up somewhere. What happens when you want to change the logic or are forced to change the logic due to initial design issues? You will need to rebuild the task sequence from scratch. From experience, something much more flexible and customizable is required and that is why I have been developing the Advanced Task Sequencing Toolkit. In the last few months, I have designed and developed a new concept in task sequence development which fundamentally allows “object oriented” development of task sequences through the use of inter-linking sequences in SCCM 2007. What exactly is this? Well, it is a framework that allows you to "link" different task sequences, I call them "mini-sequences", into a "master-sequence". The master is then compiled into a usable task sequence.

The ATS Toolkit is currently an internal beta at Dimension Data so I cannot publicly share it or go into too much detail about how it all works but I would like to let people know what I have been working on. In this post, I will provide you with an overview of the custom actions and in a later post show you how we put our task sequences together.

The ATS Toolkit contains additional SCCM 2007 custom actions and console right-click actions which build the framework for advanced and complex task sequence development. Here is an overview of the 8 custom actions:

ATS Toolkit Setup

The toolkit setup performs a similar function to the MDT 2008, Use MDT Package, custom action but the ATS Setup Action has a LOT more going on under the hood. The Setup action has the ability to store ATS task sequence variable via an additional "Variables" tab. More on this in further posts. Here is a sneak peak.

ATS Debugging Tools

The ATS Debugging tools action is used to provide various debugging capabilities from within the Advanced Task Sequence. The most commonly used debugging features are task sequence variable dumps, sleeps and opening a command prompt when required.

ATS SYNC Event

This is a personal favourite of mine. The ATS SYNC Event allows you to pause a task sequence and wait for an action to have occurred on another system being built. This is a fundamental component of building complex server environments and a primary component of the ATS Toolkit.

ATS Task Sequence Link

Part of the “object oriented” approach to Advanced Task Sequence development, the ATS Sequence Linker is used to identify linked “mini-sequences” within the “main / master” sequence. This custom action is also a major component of the ATS Toolkit. You can see this in action in further posts.

ATS Task Sequence Variables

A nifty little custom action that allows you to set as many variables as you like, all within the single custom action. This custom action is also responsible for variable validation and hierarchical management of variables during task sequence linking. All these components fit together to do some real interesting things with task sequencing. More on this later too...

ATS Registry Editor

Created more out of frustration that the default task sequence custom actions do not have an easy way to edit the registry. The ATS Registry Editor has proved to be one of my most valuable tools in the Toolkit as modifying registry settings any other way is painful. Anyone wants to have a library of pre-created custom actions with registry settings to do a whole bunch of things? I do.

ATS Advanced Script Launch

The ATS Advanced Script Launch is able to automatically extract variables from scripts selected from the ATS Toolkit package. Variables are automatically presented to the user which allows for system independent transfer of scripts from one SCCM environment to another, safe in the knowledge that other administrators can use it without knowing which variables are required to get the script to run. Useful and I like it.

ATS Dynamic Script

Script on the fly anyone? How would you like to be able to create a neat script and just copy and paste it into an action that will be executed on the target machine? What about a library of pre-created custom actions with various capabilities, ready to do your bidding? Currently, you would need to create the script file, package it up and use run command line or something else to get it to work.

I hope you have enjoyed this little overview of the custom actions. The next post will be looking at the right-click console actions, the real processes that bring the framework together and will demonstrate the advanced capabilities by fully automating a complex environment.

How bad could it get?

2008-02-12T08:49:00.001+11:00

Edit: Ok, just to make things clear. Everyone knows that you can hack any LOCAL machine when you have local, physical access. This is NOT the issue here. The problem is that the ENTIRE DOMAIN is compromised. There is no other way to say this.

I have been giving the Server 2008 "flaw" additional thought and the ramifications of this “design decision” are huge! In all my time dealing with active directory domain environments I do not believe that anything has ever come close to being able to take over an entire domain, short of sniffing or otherwise finding out the Administrators password. Readers have commented on the use of PE to gain access to a member server SAM and the issue here is that you have never been able to gain access to the SAM of a domain controller. The requirement for all domain controllers to use bit-locker is mandatory from now on!

Imagine a company network with 5000 seats. In this network there are several branch offices dotted around the globe and someone in some far off country gets pissed off for some reason. They decide to take it out on the company as a whole and they hijack the network. They gain enterprise level access, delete all 5000 machine accounts, all 10000 groups, revoke all certificates, delete all domain controller account and then as a last move, delete all user accounts. Oh and just to make sure, they initiate a domain replication. Not that there are any other servers left to replicate to.

Well... I know that I would not like to be the administrator responsible for fixing that mess. Each DC would need to be rebuilt, the domain as a whole will need to be restored from backup and each desktop or server will require attention to get it back on the network. Ouch! The cost of this little “architectural flaw” would be astronomical.

Server 2008 Domains, Cracked wide open!

2008-02-11T19:34:00.001+11:00

This post is purely for information purposes only. It is NOT a security advisory and is not public disclosure of an exploit. This technique has been around in Vista for a while but as far as I know, this is the first to crack open a Server 2008 or much worse, a Server 2008 domain!

I take no responsibility for anyone using this information for anything illegal or gaining unauthorised access to systems and domains. Use this at your own risk. I do not condone hacking but feel that this is significant enough to start a discussion on how using this method of unauthorised access can be prevented. And Microsoft, please let us know which registry key to set to disable ALL Accessibility option! Having them on by default on an uber hard OS like Server 2008 is a no-no.

Let’s get down to it then.

Cracking open Server 2008 servers and domains

To me this is not an exploit in the OS, more an architectural design flaw. As with operating systems of any kind, the same general rule applies, if you have physical access to ANY server, you own it. The reason I feel that this should be discussed is that the hack is such a simple hack, it literally took me 30 minutes to do this, 25 to install the domain controller, 5 minutes to hack it. This hack uses the Utilman.exe file in the SYSTEM32 folder. I have done some checking and have found similar hack for Vista but those required gaining access to the system when someone with admin rights is logged on. This hack is different in that it allows you to gain 100% control over an entire 2008 DOMAIN, never mind just the server and you don’t even need to jump onto the server while someone it not looking.

Step 1 – Setting the scene

You have your Server 2008 domain controller (DC) or member server (Use this process to reset the local Administrator account on a stand-alone or member server. Don’t bother asking me which commands to use... that is what Google is for). The domain controller can be ANY DC in the domain, including a DC located at a branch office. Those are the greatest risk as they usually are not physically secured and ANYONE with physical access and 5 – 10 minutes on their hands can perform this modification.

Do you see the little button on the left of the screen? This kicks off the accessibility options to assist with logons to the DC or server. It is called the “Ease of Access” button. (Boy if they only knew!) When you click this button, it kicks off an executable called Utilman.exe. The problem is that this process runs as SYSTEM and there is absolutely NO validation that the executed application is the application that should be kicked off.

Step 2 – Getting to the point

For step 2, you are going to need to have some understanding of Windows PE and potentially the Vista or Server 2008 deployment process. This will make things a little easier but if you don’t it’s not a big deal and you can find what you need online. What we want to do if create a boot cd that provides access to the hard drive. What I did was, being a favourite topic of mine, I downloaded the Microsoft Deployment Solutions Accelerator and used the Workbench to create a bootable media distribution point. When all was said and done, I had a bootable CD, without any task sequences available to it. If you have no idea what I am talking about, go check it out. I will be covering more of this in the future.

Once you have the cd or any other NTFS capable boot cd, boot the server with the CD...

Step 3 – Performing the hackage

When you are in the Microsoft Deployment PE Environment or other, you are presented with a command prompt as shown...

Perform the following there:

a. Change to the C:\WINDOWS\SYSTEM32 folder and rename Utilman.exe to Utilman.exe.old

b. Copy CMD.EXE to the same folder with the name Utilman.exe

c. Change to the C:\WINDOWS\WINSXS\x86_microsoft-windows-utilman_31bf... directory

d. Rename the Utilman.exe to Utilman.exe.old

That is it... we are done here. Reboot the server back into Server 2008.

Step 4 – Changing the DOMAIN ADMINISTRATOR password

When you get to the logon window, click the “Ease of Access” (hehe, I love it!) button and a command prompt will be executed. This CMD.EXE runs as SYSTEM. Run DSA.MSC at the command prompt and you are in the Active Directory Users and Computers MMC console.

Select the Administrator or any other user for that matter... (What the hell, make a few other secret Domain Admins accounts or elevate you own account privileges.) Right click the Administrator account and reset the password.

The password will be changed as shown.

When you are done, you own the entire domain (or local server if that is what you are going for).

Understanding the hack.

As I said at the beginning of this post, I do not consider this an exploit in the true sense. I do consider it an architectural defect. There are several issues here. Some are Server 2008 problems and the rest are yours.

Server 2008’s problems...

1. Give an anonymous console user the ability to kick of a SYSTEM level process. DOH!

2. Not having the GINA validate what it is launching.

3. Having this as the default and not an option. DOH! Again!

4. SYSTEM Full Control over the Active Directory – Priceless!

Your problems...

1. Branch offices will be an easy target. The bigger the environment the easier it will be.

2. Large but not very large organisations do very seldom keep track of users who have membership to various groups around the domain. It will be hard to spot a compromised or elevated user.

3. You cannot trust anyone with your servers.

4. Use other security measures like bit-locker.

How to prevent your servers or domain from being hacked in this way.

I have no idea. I have not been able to find ANY way to disable the Windows+U or the “Ease of Access” button. Guess this little hack will just have to be our secret... maybe not!

Something quite interesting coming very soon... stay tuned.

2008-02-08T11:25:00.000+11:00

Is Server 2008 more or less secure than Server 2003? It took 30 minutes to compromise not only a box but a 2008 domain itself. Time to lock up those branch office bitches and make sure that the TSA checks out your staff...

Stay tuned.

Lighter look at development styles

2007-06-22T06:19:00.000+10:00

I was doing the rounds on my favourite news sites and came across this gold nugget blog post, Asshole driven development, on digg.com and had a great time reading the post and comments. No doubt those in the development world have experience quite a few projects based on some of these "not so unreal" unreal management systems. Some of my personal favourites are:

Asshole Driven development (ADD) - Any team where the biggest jerk makes all the big decisions is asshole driven development. All wisdom, logic or process goes out the window when Mr. Asshole is in the room, doing whatever idiotic, selfish thing he thinks is best. There may rules and processes, but Mr. A breaks them and people follow anyway.

Over-engineered Über-specified Development (OÜD) where 90% of the development time is spend on over-specifying architecture, service interfaces, requirements and other things which do not get build, because the project is 3 years late and gets canceled.

Decapitated Chicken Process - A time honored micromanagement technique where each day managers identify a drastic emergency and require developers drop what they are doing ...

Document Driven Development (DDD) - copious amounts of inaccurate, verbose and unnecessary documentation are prepared and maintained as if they somehow embody everything that needs to be done in the software.

No doubt before the next year is up, I will experience several of the existing solutions development processes and a few new ones. Enjoy!

Virtual Server 2003 R2 SP1 is out now

2007-06-14T23:24:00.000+10:00

The first service pack for Virtual Server 2003 R2 is out and can be found over here. There is a registration required but I am sure most of you will know what to do there. From the release notes, the new features are:

Support for hardware-assisted virtualization technology
Support for greater than 64 virtual machines on x64-based hosts
VHD Mount command-line tool and APIs
Interoperability with Volume Shadow Copy Service
Support for additional guest and host operating systems
Service publication using Active Directory Service Connection Points
Host clustering white paper
Virtual SCSI fix for Linux guests
Larger default size for dynamically expanding virtual hard disks
VMRC ActiveX control and Internet Explorer security zones
New VMRC client option to enable video stretch in full screen mode
IVMGuestOS::Get_OSName property returns more operating system information

Microsoft fixes ADS ramdisk.sys problem caused by SP2

2007-06-04T03:44:00.000+10:00

Since the release of Service Pack 2 for Server 2003, Automated Deployment Services has not functioned correctly. It was not possible to boot a server into the Deployment Agent as the ramdisk.sys driver kept the temporary files locked and the image process could not complete. A new KB article 937088 has been released that states that a fix has been created but this patch is not freely available. Why do Microsoft do these painful releases? I will get some inside contacts to obtain said patch for me and will update this post with my finding. Here's hoping we can get a few more years out of ADS before they can it entirely.

*** Updated ***

Got one of my contacts to provide me with the KB937088 patch. If you are receiving the following error messages when you try boot to the ADS Deployment Agent,

Event Type: Warning
Event Source: ADSBUILDER
Event Category: Builder
Event ID: 775
Date: 04/06/2007
Time: 16:17:43
User: N/A
Computer: ADSTEST
Description:
An error occurred during an attempt to access the following file: c:\windows\temp\adsbuild.tmp\{GUID}\{ANOTHERGUID}.ramdisk
The ADS Builder service requires exclusive access to this file, and if any other service or application has open handles on this file, ADSBUILDER will fail.
Please ensure that no other service or application is currently accessing this file.
Error Code: 20

and ...

Event Type: Error
Event Source: ADSBUILDER
Event Category: Builder
Event ID: 774
Date: 04/06/2007
Time: 16:17:43
User: N/A
Computer: ADSTEST
Description:
An error occurred during the building of an image for the product {GUID} and client hash {ANOTHERGUID}.
Error Code: 81070307

...then this is the patch for you. One word of warning though, this patch has not been regression tested and it could introduce additional problems and stability issues, but considering that you currently have a server that is not working at all, this is a massive improvement. One more thing, you WILL need to go through Microsoft support to get this patch. Apparently they "need to confirm that you are having this problem."

The fact that I could build a basic virtual deployment server in around 10 - 15 minutes is proof of the simplicity of ADS. Lets hope that the support continues for another few years. Next stop... crow-barring the ADS agent into Windows Vista and Server 2008. Stay tuned.

New Microsoft server deployment newsgroup

2007-05-16T16:55:00.000+10:00

Just a quick note to point out that about a month ago Microsoft started a new newsgroup with the focus on server deployment. I presume this is in anticipation of the Longhorn WAIK & BDD goodies that have started to ship with Beta 3. So point your favourite news reader at news.microsoft.com and check out Microsoft.Public.Deployment.Server or visit the web based newsgroups over here.

Virtual Machine Manager 2007... Dead before it begins?

2007-05-14T19:23:00.000+10:00

I have been on the Microsoft VMM beta since day one and I have a lot of praise for what is rising from the “ashes” of Virtual Server. I have used beta 1 to successfully manage a few hundred virtual machines, not always knowing the outcome of the action I was taking though (23 bugs and suggestions filed already), but still having great success. It took quite a bit of nerve to install a beta product to manage our development environment, especially with 25 – 30 developers all relying on the labs to be available but the prospect of a manual or even scripted creation and configuring of these VMs was not my idea of a fun time and besides, I like new stuff.

Using VMM 2007 to escape the scripting solutions I had in place has saved me heaps of time. I am not talking about a few minutes here or there, I mean DAYS of time. It is a very interesting and important product that has mountains to climb to compete with VMWare ESX server and I am sure that Microsoft knows what they are doing in this space... or do they?

While checking out the VMM beta news groups, there was a post by a fellow beta tester asking, “Are there any plans in the works to make the OS Customization parameters compatible with Vista? For example: Being able to inject custom computer name per VM would be really useful.” a straight forward question and one that I would expect Microsoft to be addressing already. (For those who don’t know VMM 2007, this is a very basic feature that is already available to Windows Server 2003 and XP VM creation). How wrong I was! The response from Microsoft was, “SCVMM currently does not support using VMM templates / customization with Vista VM's. We will however look into this scenario.”

After dealing with Microsoft for many years, I know this as the standard response of, “We have already decided where we are going now go away”. This response got me thinking about where exactly they were planning to take VMM 2007. After all, we are already at beta 2 and by now most of this sort of functionality is in the builds that are available.

For a NEW product, I believe that Microsoft is going to push VMM 2007 in the direction of “the platform to run your legacy operating systems on”. Which I also believe would be a very silly thing to do as nearly all people who currently use Virtual Server do so in a lab or development process and not in the production environment. Most businesses are inclined to use ESX over VS and not being able to get a strong foothold as the best virtualization solution for deploying Vista & Longhorn server will be a death blow for VMM. You can bet that VMWare is already working on a solution.

Believe me, the prospect of using WDS, WAIK, BDD, OSD and SMS, (Yes, ALL OF THESE AT THE SAME TIME!) for the full automation of Vista and Longhorn operating systems does not make virtualization or even physical OS deployment fun!

My response to this rather short thread ultimately asked if getting to know VMM 2007 was a waste of time for those who work on cutting edge project and products. I can see the benefits of being able to use VMM in the lab environment but it will most certainly have a very short life as more and more projects start taking on Longhorn. Then again, the current “best practice” for deploying Vista is so poor and “all over the place” that it’s no wonder the VMM dev team are trying to stay as far away from it as possible.

R.I.P. System Center Virtual Machine Manager 2007... Well, not just yet! Longhorn is still going to be a long way off.

Getting Started...

2007-05-05T08:42:00.000+10:00

Not being the person who blogs, I have recently been encouraged by a friend and work colleague to start a blog. Also, not knowing much about the blog scene I have no idea how one starts a blog but I know what I want to blog about.

To get started, let me share some information about myself and my history and try detailing some of topics that I will be covering on this blog. My name is Dean Brighton. I am what I consider to be a Technical Infrastructure Architect for development projects. What is this exactly? Well, I provide infrastructure services and solutions for development teams and projects. That is the short version of what can only be described as an “eye glazing, yawn” job description for the non-technical person. The longish version is that I am the guy who works with the software developers, software testers and project owners to deliver robust infrastructures for websites and back-office solutions. I do not believe that any development project can easily succeed without bringing someone like me onboard to develop their infrastructure to be resilient, scalable and efficient.

I come from a pretty usual IT background but have over the last 3 – 4 years become fascinated with the concepts of build automation and software development processes. I have worked on quite a few prominent projects, some of which were very interesting and some of which were your normal, run of the mill, projects. When I talk about build automation, I am not talking about software build automation, source code control and management or anything in the development process; I am talking about the processes and configuration management of automating the building of server test rigs and labs. I may dip ever so slightly into the source code management aspects but not too deeply.

Over the years, I have used quite a few server build automation tools to achieve various tasks. Each task has been closely related to software development and testing working with the test and release teams to create reliably reproducible environments. Some projects have been 10 – 20 servers and some have involved 150 – 200 or more virtual and physical servers. With tight budgets and limited resources, being responsible for the design, construction and implementation of the test, system test, pre-production and production environments, you need all the automation help you can get! After all, when you have automated the test environments, porting this to the production environment becomes easy so the more powerful the tools, the better and easier the delivery.

With Windows Vista just released and Longhorn server not too far away, it is clear to me that the usual automated deployment and management tools will not do the job, especially when considering the changes to the deployment process of these operating systems. With Windows Deployment Services, BDD 2007 and System Center Configuration Manager 2007 all coming to the “aid” of people like me, there are some good and bad aspects to moving away from the tools I know and love. In this blog, I will be covering the following topics from here on in:

• Server deployment automation tools & utilities – Free and “Pay Lots Of Money”
• Software deployment processes and tools
• Large scale server and client deployment
• Exploring new developments in the field of build automation and comparing today’s technologies with the tools that have been successfully used to deliver the solutions I previously have.
• General tech commentary
• Various aspects of server virtualisation
• Systems management and maintenance
• Building a powerful automation and provisioning framework of my own... more on this later!

I hope that other Infrastructure Architects out there will contribute to the posts and information. I have not found blogs or sources completely dedicated to this aspect of IT as there are not that many people who do what I do. I am sure they exist so drop me an e-mail with some links. From what I have seen, information is available on the internet but it’s scattered around and its takes time to get to know the various locations.

So if you have made it this far, this may be a subject you are interested in or just curious about the wide variety and aspects of automated server provisioning. Stick around, there is lots of information on the way.