Create VM in ESX 3.0

I have trouble deploying VM from from templates with customization option. I have talked to VM support, and they suggest to run all the updates first. However, it is not a consideration at this time because of the VLAN project. The workaround

1. First step is the same "Deploy VM from this template"

2. Complete all the necessary steps and choose "Do not Customize" for guest customization

3. Once VM created, start VM

4. Login to the Windows 2003 Server, download the sysprep tools "http://www.petri.co.il/download_windows_2003_sp1_sysprep.htm"

5. Unzip the sysprep tool. You will find several files including setupmgr (edit existing sysprep.inf such as computer name...to suit the settings of the VM). In case you have not created sysprep.inf, run setupmgr.

6. Copy the sysprep.inf and all the unzip files in the sysprep tool to the VM "C:\sysprep\"

7. Edit sysprep.inf. Make sure “ExtendOemPartition=1” (it will extend the partition to all the available space)

8. Then run sysprep.

9. Power down VM.

10. Now, modify the size of VM (sorry, you can only increase after version 3.0). Login to ESX server through console.

11. Run “vmkfstools –X 12G /vmfs/volumes/VMName/vmname.vmdk”
(In this case, the VM VMName will be extended to 12G. Now powerup the VM. You should see the size of C drive increasing to 12G. For existing VM, if you want to increase the size of C, do not use sysprep because this will re-generate the SIDs.)

Add domain user to local admin group through Group Policy

Using Security group
1. In Active Directory, created a Global Group with Security group type called LocalAdmin.
2. Included the users as members of the LocalAdmin.
3. Created a GPO.
4. Edited the GPO by clicking Computer Configuration -> Windows Settings -> Security Settings -> Restricted Groups. Add GroupName "Administrators".
5. Then Add domain admins and DOMAIN\LocalAdmin as member of this group
6. It will take some time for the group policy to take effect. One draw back of this method: If a Restricted Groups policy is defined and Group Policy is refreshed, any current member not on the Restricted Groups policy members list is removed. This can include default members, such as administrators. For example, if you had added DOMAIN\user1 to local admin in the past, DOMAIN\user1 will be removed from the local admin group of the machine.

If you do not prefer central management, then create a group policy. (from http://www.tutorials-win.com can't find the posting any more)
1. Create a startup script in the policy with this command. NET localgroup Administrators /add "Domain\Domain Group" (if you just want to add specific user, change "Domain\Domain Group" to Domain\user)
2. make sure the workstations placed in the correct OU
3. Domain Group has to be less than 30 chars. You cannot add more than one domain group to the same local group. This is a limitation.

HP C-Class Blades single point of failure

We powered down the SAN for maintenance about a week ago. Prior to that, we have to power down all the servers connected directly to the SAN first. We have a C-class blade enclosure with five servers currently. After the SAN upgrade was completed, we tried to power the enclosure back up. Guess what. The onboard administrator of enclosure failed to start up. We attempted to power up the server and it failed. We contacted HP support. The answer was a hardware failure. The part arrived at UPS store close to Pearson airport. We figured out we went to there to pick it up instead of waiting for them to deliver. Replace the onboard admin and all servers power up. Now, update with latest firmware and reload the config from backup. If you don't have config file backup, it won't take long to re-config it. So, make sure you save the config before power down the whole enclosure.

The HP support told me the servers would keep running if the onboard admin failed while the servers were powered on. However, if I powered down the servers, you could not power them back up until onboard admin was replaced. One thing forget to ask was "can I replace onboard admin while the servers are running".

Activesync Attempt with Exchange gives 0x80072EE2 error

This issue was resolved few months ago actually. What happens was one of the directors always had trouble sync with the Exchange Server. However, he didn't want to use Blackberry. He had 5 different WM phone at home. He tried all of them and still had the same issue. Everytime, he had to power cycle (turn off the phone and take the battery out) the phone, then it will sync again. After a while, it will not work again.

Eventually, we found out he plugged the phone to laptop to sync the notes through USB. Our internal Exchange Server ip is 10.x.x.x. The webmail address he used to sync wirelessly is a public address of course. Based on the research found in internet, it has to do with Windows Mobile DNS cache not being cleared properly when USB cable is unplugged. When plugged into the desktop to sync inside the office, it will use the internal address for Exchange server. After unplugged from USB, it will cause issue of course because the DNS will point to internal address of Exchange server instead of the webmail address. Workaround....powercycle after unplug from a machine in the internal network.

Persistent Binding with VMWare

Persistent Binding is highly recommended in SAN environment. However, this is not required for ESX Server 3. ESX Server 3 uses UUID's written to the LVM of the disk. For luns containing VMFS volumes and the ESX Server boot disks, persistent binding is no longer required.

You can check UUID in Linux with following command.
ls -l /dev/disk/by-uuid

Version of OS on Windows Mobile Phone

Have some time today to re-arrange all the notes and printout. One of them is about the version of Windows Mobile Phone on your pocket PC. I believe it is from Pocket PC Central.

Version Number and OS Version

3.0.9348 Pocket PC 2000
3.0.11171 Pocket PC 2002
4.20.xxxx Windows Mobile 2003
4.21.xxxx Windows Mobile 2003 SE
5.1.xxxx Windows Mobile 5
5.2.xxxx Windows Mobile 6

PMX spam filter server and recieve emails for multiple domains in your exchange server

Recently, we receive alert from ISP about mail latency. Check Exchange server logs and everything looks fine. Compare logs. The process time between PMX and Exchange is quite short. In this case, either spam filter or routing is the source of the problem. Double check and no one has made any changes to the router.

Check the PMX server. The load and iostat is high. Looks like the bottleneck is on the local disk. Increase memory does not really help. The only other option is to take the database out and migrate it to another server. However, we don't have enough space in the rack since we plan to retire one more rack. We get an appliance from Sophos ES4000. Very easy to setup. Once installed, no more performace issue.

We only config inbound email pt to the appliance. Outbound email will bypass the appliance. Basically make sure routing is setup correctly (point to your exchange server). If you are config to receive emails for multiple domain, make sure include those domain in the PMX config. No more sendmail.mc, pmx.conf modification and recompile. Other than routing setup on the appliance, make sure you have MX record setup correctly on your DNS server and ISP. Also, make sure your recipient policy in your Exchange server include the other domains you are going to receive emails in your Exchange server.

For example, your company has a domain called first.com. Your Exchange server is config to receive email sent to first.com. However, you register another domain for your other product called second.com. You can receive emails sent to second.com on your Exchange server. First, contact your isp to add a MX record (may take 1 to 24 hrs to replicate). Then go to your DNS server (most likely ur DC and add the MX record) . Basically, point the MX record for second.com to your exchange server for first.com (for example, mail.first.com). Add second.com to the accepting mail domain in your PMX appliance. Lastly, goto your Exchange server default recipient policy, add SMTP for second.com. Force update the recipient policy so you can receive emails immediately for your second.com.

Timeout on HBA

If you see Event ID 129 for your HBA as well as path connection drops by failover software,

The description for Event ID ( 129 ) in Source ( elxstor ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: \Device\RaidPort1.

Check your HBA driver, switch firmware and failover software. Also, make sure the SAN controller firmware is in support matrix. Sometimes, you may need to check the HBA settings to make sure those are supported by vendor. There are chance you may need to reapply firmware on HBA. Compare switch logs to see if GBIC requires replacement.

Storport vs SCSIport

If you use some older HBA, you will see there are two sets of drivers; storport and SCSIport. Bascially, Storport provides better I/O performance and widely used for new HBA.

For old HBA, you can try to use Storport. However, SCSIport is more stable.

Here is the Microsoft article
http://download.microsoft.com/download/5/6/6/5664b85a-ad06-45ec-979e-ec4887d715eb/Storport.doc

Security Configuration Wizard for Windows 2003 SP1

Security Configuration Wizard for Windows 2003 SP1 is a very handy tool to config security on Windows 2003 server with at least SP1 installed. I find out a lot of ppl don't know about this tool. Search the internet and find an introductory article about SCW.

The tool helps you config firewall, audting and services......

http://www.windowsecurity.com/articles/Security-Configuration-Wizard-Windows-Server-2003-SP1.html