Posts Tagged ‘Windows’

Virtual Infrastructure Client and the Windows Registry

June 17th, 2009

Hello gang. I apologize for the frequency slowdown in blog posts but I’ve beenΒ  _insert lame excuse everyone has heard before here_. Truth be told, I am busy working on a project which I hope to have available the virtualization community on or before VMworld 2009.

This post is a no brainer, maybe you’ve seen it before on another blog or maybe you’ve figured it out for yourself. For me, I can honestly say it was the latter, but with some minimal registry skills, it’s not so difficult.

In short, my Virtual Infrastructure Client (VIC) cached list of host connection entries (at the login prompt) had gotten much too polluted over time with many stale entries that I wanted to get rid of. This can happen over the course of time if you use your VIC to connect to many different vCenter servers or explicit hosts in various environments. Particularly, I would think this can happen quickly to consultants who travel from site to site supporting virtual infrastructures.

There is a way to manipulate the cached list you see in the pulldown box. And by manipulate, I don’t just mean delete. In addition to deleting entries, you can also modify entries (perhaps for a DNS suffix migration), re-order entries (VMware doesn’t maintain this list in alpha order necessarily or perhaps you’d like a custom sort order), or add entries (consider a scenario where you have a packaged VIC that you want to roll out to your new VMware admin – instead of presenting the new admin, who has no knowledge of the environment, with a blank VIC, help them hit the ground running with a pre-populated list of vCenter servers or ESX hosts to connect to).

As the title of this post indicates, the cached entries are stored in the Windows registry and are tied to each individual user profile (HKU). You’ll find the comma delimited list of entries in the following registry key:

HKU\<User SID>\Software\VMware\VMware Infrastructure Client\Preferences\

The value name is RecentConnections and the type is REG_SZ

There’s one more value nearby that sticks out like a sore thumb:

HKU\<User SID>\Software\VMware\Virtual Infrastructure Client\Preferences\UI\SSLIgnore\

The value names vary by connection name or IP address and the type is REG_SZ. These represent each connection where you’ve checked the little box telling the VIC that you want to ignore SSL certificate warnings which you will receive in an “out of the box” configuration. I can’t think of a great use case scenario why someone who has chosen to ignore SSL warnings would want to re-enable them, other than a situation where they’ve now enabled legitimate SSL.

To find out why disabling SSL warnings might not be such a great idea, see my previous blog post titled SSL Integration With VirtualCenter.

As they say in the ARMY, or at least on M*A*S*H… “That is all”.

vSphere Memory Hot Add/CPU Hot Plug

May 10th, 2009

I’ve been experimenting with vSphere’s memory hot add and CPU hot plug features to determine its usefulness with Windows Server operating systems. I came up with mixed results depending on the version and architecture of the OS.

A few notes about the results:

  1. Memory hot remove is not supported at all by vSphere. It’s not an option no matter what the guest OS.
  2. Although virtual hardware can be hot added depending on the OS, there are caveats in certain cases
    1. A guest reboot may be required (this is outlined in the table below).
    2. Memory that is hot added to guests that support the hot add without a reboot will result in 100% sustained CPU utilization in the guest OS for a variable period of time that is dependent on the amount of of memory that is added. In my testing (and keep in mind your mileage may vary on different hardware):
      1. 1GB of RAM hot added resulted in 100% CPU for 1-3 seconds.
      2. 3GB of RAM hot added resulted in 100% CPU for about 10 seconds.
  3. CPU hot unplug is supported by vSphere but was not supported by any of the Windows operating systems that I tested.
  4. Going from 1vCPU to 2vCPUs in Windows 2008 guest operating systems did not result in a HAL change. From what I can tell, Windows 2008 uses the same HAL for uniprocessor and SMP. When a vCPU is hot added, it does show up right away in the Device Manager, however, it’s not seen in Task Manager or Computer Properties therefore my assumption is that processes are not being scheduled on the added vCPU until after the reboot at which time the additional vCPU shows up in all places that it should (ie. Task Manager, Computer Properties, etc.)
  5. I certainly like the innovation and flexibility here but I’m not sure hot add technology is going to mesh well with planned change management systems. The most important thing to recognize though is that VMware offers this technology to us as our choice to use or not use. It’s not a feature VMware held back drawing their own conclusion that nobody on the planet could ever use it. Microsoft does this today with Hyper-V memory over commit. Or rather they don’t offer memory over commit in Hyper-V because they made the decision on behalf of all their customers that nobody could or should use memory over commit. Instead you should pad your hosts with more physical memory at additional cost to you.

Here is the table of results I came up with:

Memory hot
add
Memory hot
remove
CPU hot
plug
CPU hot
unplug
Windows Server 2003 STD x86 πŸ™ πŸ™ πŸ™ πŸ™
Windows Server 2003 STD x64 πŸ™ πŸ™ πŸ™ πŸ™
Windows Server 2003 ENT x86 😎 πŸ™ πŸ™ πŸ™
Windows Server 2003 ENT x64 😎 πŸ™ πŸ™ πŸ™
Windows Server 2008 STD x86 😎 * πŸ™ πŸ™ πŸ™
Windows Server 2008 STD x64 😎 * πŸ™ 😎 * πŸ™
Windows Server 2008 ENT x86 😎 πŸ™ πŸ™ πŸ™
Windows Server 2008 ENT x64 😎 πŸ™ 😎 * πŸ™
Windows Server 2008 DC x86 😎 πŸ™ πŸ™ πŸ™
Windows Server 2008 DC x64 😎 πŸ™ 😎 πŸ™
Windows Server 2008 R2 DC x64
(experimental support only)
😎 πŸ™ 😎 πŸ™
* Reboot of guest OS required to recognize added hardware

MobilePress caused 55,000+ files in c:\windows\temp

March 19th, 2009

A while after installing the MobilePress 1.0.3 plugin for WordPress, my IIS server locked up.Β  I rebooted it and all was well.Β  A while later, it locked up again.Β  Upon further investigation, I found 55,000+ files in the c:\windows\temp\ folder and new files were popping in there at a rate of a few per minute.

Each of the 55,000 files looked like:

sess_1dq5436rb4m9b399cojhnmitd1

sess_3meinb58v9oqra5ia0869pqig6

sess_5hbicsnrt0hn1qj9lc5q9n7g30

where the prefix of sess_ is common but the rest is random.

Using Sysinternals procmon.exe, I was able to identify right away that the process responsible for creating the files was w3wp.exe which pointed me to IIS.Β  However, I wasn’t sure why IIS would begin doing this after being stable for a long time.

Searches on the internet said the files were being generated by PHP and indicated new user sessions as visitors hit my blog.Β  That helped confirm the fact that these were coming from IIS and the blog but still no tell tale reason as to why all of the sudden.

Then I opened up one of the files and it showed:
SESS_MOBILE_BROWSER|s:6:”mobile”;SESS_MOBILE_ACTIVE|b:0;SESS_MOBILE_THEME|s:7:”default”;

That was enough to jog my memory that I had recently installed the MobilePress plugin.

Removing the plugin immediately resolved the issues and the temp files are no longer created.

How to install Windows 7 on VMware Fusion

January 25th, 2009

The VMware Fusion team has put together a great “how to” guide for installing Microsoft Windows 7 (beta) on VMware Fusion on Mac.Β  Complete with screenshots and detailed explanations, this resource should have you up and running Windows 7 in no time.

I’m hearing from various people in the trenches that Windows 7 on a VM runs very well, better than Vista, and one report says with as little as 512MB RAM.Β  Sometimes it’s hard to tell if people are more excited about running the new Windows OS as a VM, or the fact that the Windows promise land that Vista never provided may be right around the corner.

Check it out!

Windows on multicore processors

January 22nd, 2009

Great article by Randall C. Kennedy comparing Windows XP, Windows Vista, and Windows 7 and their multicore efficiencies (or lack thereof).Β  If you want to know which Windows OS is going to take most efficient advantage of AMD and Intel multicore technology, this article is worth a read.Β  You may be surprised at the results.

Excerpt:

“In order to test the limits of Windows multicore support, I constructed a comprehensive, multiprocess workload test package using the ADO (database), MAPI (workflow), and WMP (media playback) Stress objects from the DMS Clarity Studio; see “How I tested” for the details. I then executed the package across representative dual- and quad-core systems in an effort to document the scalability, the execution efficiency, and the raw performance of the workloads when running against each of the available Windows incarnations.”

Read the full article here.

Three VirtualCenter security tips Windows administrators should know

January 15th, 2009

Good morning!Β  I’d like to take the opportunity to talk a bit about something that has been somewhat of a rock in my shoe as a seasoned Windows administrator from the NT 3.5 era:Β  The VirtualCenter (vCenter Server, VirtualCenter Management Server, VCMS, VC, etc.) security model, or more accurately, its unfamiliar mechanics that can catch Windows administrators off guard and leave them scratching their heads.

Tip #1: The VCMS security model revolves around privileges, roles, and objects.Β  The more than 100 privileges define rights, roles are a collection of privileges, and roles are assigned to objects which are entities in the virtual infrastructure as shown in the diagram borrowed below:

1-15-2009 11-24-45 AM

Windows administrators will be used to the concept of assigning NTFS permissions to files, folders, and other objects in Active Directory.Β  It is very common for Windows objects to contain more than one Access Control Entry (ACE) which can be a group (such as “Accounting”, “Marketing”, etc.) or an explicit user (such as “Bob”, Sally”, etc.)Β  The same holds true for assigning roles to object in VC.

In some instances, which are not uncommon at all, a user may be granted permission to an object by way of more than one ACE.Β  For example, if both the Accounting and Marketing groups were assigned rights, and Sally was a member of both those groups, Sally would have rights to the object through both of those groups.Β  Using this same example, if the two ACEs defined different permissions to an object, the end result is a cumulative, so long as the ACE doesn’t contain “deny” which is special:Β  Sally would have the combined set of permissions.Β  The same holds true in VC.

Let’s take the above example a step further.Β  In addition to the two groups, which Sally is a member of, being ACLd to an object, now let’s say Sally’s user account object itself is an explicit ACE in the ACL list.Β  In the Windows world, the effect is Sally’s rights are still cumulative combining the three ACEs.Β  This is where the fork in the road lies in the VirtualCenter security model.Β  Roles explicitly assigned to a user object trump all other assigned or inherited permissions to the same object.Β  If the explicit ACE defines less permissions, the effective result is Sally will have less permissions than what her group membership would have provided.Β  If the explicit ACE defines more permissions, the effective result is Sally will have more permissions than what her group membership would have provided.Β  This is where Windows based VC administrators will be dumbfounded when a user suddenly calls with tales of things gray’d out in VirtualCenter, not enough permissions, etc.Β  Of course the flip side of the coin is a junior administrator suddenly finds themselves with cool new options in VC.Β  “Let’s see what this datastore button does”

Moral of the story from a real world perspective:Β  Assigning explicit permissions to user accounts in VC without careful planning will yield somewhat unpredictable results when inheritance is enabled (which is typical).Β  To take this to extremes, assigning explicit permissions to user accounts in VC, especially where inheritance in the VC hierarchy is involved, is a security and uptime risk when a user ends up with the wrong permissions accidentally.Β  For security and consistency purposes, I would avoid assigning permissions explicitly to user accounts unless you have a very clear understanding of the impacts currently and down the road.

Tip #2: Beware the use of the built in role Virtual Machine Administrator.Β  It’s name is misleading and the permissions it has are downright scary and not much different than the built in Administrator role.Β  For instance, the Virtual Machine Administrator role:Β  can modify VC and ESX host licensing, has complete control over the VC folder structure, has complete control over Datacenter objects, has complete control over datastores (short of file management), can remove networks, has complete control over inventory items such as hosts and clusters.Β  This list goes on and on.Β  I have three words:Β  What The Hell?!Β  I don’t know – the way my brain works is those permissions stretch well beyond the boundaries of what I would delegate for a Virtual Machine Administrator.

Moral of the story from a real world perspective:Β  Use the Virtual Machine Administrator role with extreme caution.Β  There is little disparity between the Administrator role and the Virtual Machine Administrator role, minus some items for Update Manager and changing VC permissions themselves. Therefore, any user who has the Virtual Machine Administrator role is practically an administrator.Β  The Virtual Machine Administrator role should not be used unless you have delegations that would fit this role precisely.Β  Another option would be clone the role and strip some of the more datacenter impactful permissions out of it.

Tip #3: Audit your effective VirtualCenter permissions on a regular basis, especially if you have large implementation with many administrators “having their hands in the cookie jar” so to speak.Β  If you use groups to assign roles in VC, then that means you should be auditing these groups as well (above and beyond virtualization conversations, administrative level groups should be audited anyway as a best practice).Β  This whitepaper has a nice Perl script for dumping VirtualCenter roles and permissions using the VMware Infrastructure Perl Toolkit.Β  Use of the script will automate the auditing process quite a bit and help transform a lengthy mundane task into a quicker one.Β  While you’re at it, it wouldn’t be a bad idea to periodically check tasks and events to see who is doing what.Β  There should be no surprises there.

Moral of the story from a real world perspective:Β  Audit your VirtualCenter roles and permissions.Β  When an unexpected datacenter disaster occurs from users having elevated privileges, one of the first questions to be asked in the post mortem meeting will be what your audit process is.Β  Have a good answer prepared.Β  Even better, avoid the disaster and down time through the due diligence of auditing your virtual infrastructure security.

For more information about VirtualCenter security, check out this great white paper or download the .pdf version from this link.Β  Some of the information I posted above I gathered from this document.Β  The white paper was written by Charu Chaubal, a technical marketing manager at VMware and Ph.D. in numerical modeling of complex fluids, with contributions from Doug Clark, and Karl Rummelhart.

If VirtualCenter security talk really gets your juices flowing, you should check out a new podcast launched by well known and respected VMTN community member/moderator and book author Edward Haletky that starts today called Virtualization Security Round Table.Β  It is sure to be good!

Introducing: IT Knowledge Exchange/TechTarget

December 18th, 2008

Have you seen TechTarget’s IT Knowledge Exchange? If you are an IT staff member in search of answers or excellent technical blogs, ITKE is one site you’ll want to bookmark. Their award winning editorial staff include virtualization bloggers such as Eric Siebert, David Davis, prolific VirtualCenter plugin writer Andrew Kutz, Rick Vanover, Edward Haletky, and many more.

Search or browse by hundreds of tags covering hot IT topics such as Database, Exchange, Lotus Domino, Microsoft Windows, Security, Virtualization, etc.

Their value proposition is simple: provide IT professionals and executives with the information they need to perform their jobsβ€”from developing strategy, to making cost-effective IT purchase decisions and managing their organizations’ IT projects.

One month ago, brianmadden.com was purchased by TechTarget. I think this addition will be a nice shot in the arm for ITKE. In one transaction they integrate an established rich Citrix/Terminal Services/Virtualization knowledgebase and talented staff of bloggers that it can in turn use to help its readers and advertising clientele.

TechTarget has over 600 employees, was founded in 1999, and went public in May 2007 via a $100M IPO.

12-18-2008 8-27-33 AM