Setup and Tweak Your New Asus RT-AC66U or N66U Router! (partially OT)

Asus has been doing an increasingly impressive job in the "home" WiFi router market. With impressive performance approaching enterprise class routing capability and second-to-none Wifi performance, (for an unmanaged single unit) they're hard to beat for the enthusiast market. By using something like TomatoUSB firmware you can get many enterprise-class features. While I may write an article in the future on Tomato or DD-WRT tweaking, I'm going to go through the setup here using the new "Merlin" firmware. Eric Sauvageau, the author of the modified firmware, states of this:

"The primary goals of this project are to fix bugs, add a few basic features and tweaks to the original firmware. This firmware will try to remain as close as possible to the original firmware."

Sounds good to me. I've spent alot of time with Tomato and DD-WRT on my home network, and a change of pace might be nice. Also, you get the piece of mind that you're using mainly the manufacturers' code on this newer hardware.

Note: Some ideas covered in this article may apply to other consumer or enterprise level hardware.

Assumptions:

• You have purchased either a RT-AC66U or RT-N66U (Update 7/6/13: RT-AC56U now supported asw well)
• You have backed up, memorized, or otherwise, your old router settings
• You're comfortable with the basics; I'm not going to re-cover the manual 
• You have power and an internet connection. Setup will be easier and more reliable if you also have a house or apartment, which you should be inside of during this tutorial. 

Let's get to work:

1. Connect the router as described in the manual. If you have a DHCP server (other than the one on the router from your ISP) you'll either need to temporarily disable it or ensure it's assigning the 192.168.1.x range excluding .1.
2. Perform the initial "Quick Internet Setup" wizard
3. After/if it prompts you to update firmware, go ahead and do so.
4. If desired, (and some of my steps will assume this is done) download the "Merlin" firmware from here. In the interface click "Administration->Firmware Upgrade" and specify the path to the trx file. 
5. Now that we've upgraded, let's highlight important setup steps. I'm not going to cover the specifics of your environment, just things I recommend you pay attention to. First, navigate to "Wireless->WPS"  and set it to "OFF". Most implementations of WPS are NOT secure at all. For more information, see: This episode of the wonderful Security Now! podcast or this lifehacker article. There are many ways to get a complex WiFi key to nearly any device securely.

6. Navigate to "Wireless->Professional" and check the "Tx Power adjustment" and reduce it if possible. (Some experimentation required) Make sure you use the dropdown and do both 2.4ghz and 5ghz. Lowering your broadcast power will slightly shorten the range so you aren't broadcasting to your neighbors (polite) and may lengthen your hardware life. (See effect @ "Tools->Radios Temperature")
7. If you disabled the DHCP server, make sure you go to "LAN->DHCP Server->Log DHCP Queries" and hit "Disable".
8. To log stats, insert a USB thumb drive. It can be tiny and slow if you want. Navigate to "System Log->General Log" hit "Refresh". Copy the contents down and search them for the mount messages. In my case, the only message was "Jan  3 18:47:16 hotplug[1032]: USB vfat fs at /dev/sda mounted on /tmp/mnt/1GB", and that corresponds to @ /mnt/1GB for short since /mnt is a symlink to /tmp/mnt. Write this down. 
9. Navigate to "Tools->Other Settings" and set "Traffic history location" to "Custom location".
10. Set "Save history location" to the value you wrote down in step 8, select "Create or reset data files" (if this is the first time you have done this on this disk) and hit "Apply". 
11. (Added 1/12/13) Unless you're using STP with your other switches, etc. navigate to  "Lan->Switch Control" and set "Spanning-Tree Protocol" to "Off".  Cool that it supports STP though! (Update 10/11/2013: There has been some confusion on this, so to simplify: If you have more than one switch not including this Asus router, leave STP enabled. Otherwise, disable it. If you would like to better understand see this.)
12. (Added 1/20/13) If you aren't using IPv6 (yet), navigate to "IPv6"->"Auto Configuration Setting"->"Enable Router Advertisement" and set it to "Disable". 
13. (Added 1/20/13) Let's disable some other services that most people won't need. Unless you're using this router as a filesharing and/or DLNA device, do the following: Navigate to "USB Application"->"Media Server"->"Enable DLNA Media Server" and set it to "Off".
14. (Continued from #13) Navigate to "USB Application"->"Network Place/Samba Share"->"Disable Share" and click "OK" to confirm disabling the service.
15. (Continued from #13) Navigate to "USB Application"->"Miscellaneous Setting" and turn off "Force as Master Browser" and "Set as WINS Server" and click "Apply". 
16. (Added 2/4/2013) Recommended: Though I haven't tested (update 6/7, it's fine as of now, so if you need UPnP go ahead) to see if this firmware is impacted by the recent discovery that a substantial number of firmwares expose UPnP to the external interface of the router(!!) I still recommend turning it of if it's feasible. This means you'll have to forward ports manually, but if you're reading this I suspect you know how to do so anyhow. (If not, comment as such and perhaps I'll write an article about it) To disable the UPnP service navigate to "Advanced Settings->WAN->Internet Connection->Basic Config->Enable UPnP" and set it to "No" Update 5/27/2013:  How to forward ports: 
1. To forward ports, first determine what ports your service/application uses. While a search for "(Service) forward ports" generally returns the  ports needed for that service, you can also use something like portforward.com to look it up. Note that the port spaces of TCP and UDP protocols are separate, so make sure you get the protocol right and know that the port numbers can overlap. There are some pre-baked shortcuts in the Merlin/Asus firmware on the port forwarding page (listed in the next step) that will populate the ports for you; it may be worth checking those out to save some time.
2. After you determine your ports, open the manage interface of your Asus router and navigate to "Wan->Virtual Server/Port Forwarding"
3. Ensure "Enable Port Forwarding" is set to "Yes". 
4. Under "Port forwarding List" type the name of your application under "Service Name". This entry is cosmetic only and serves to identify this forward. 
5. Under "Port Range" enter the port(s) needed for this application. To open a range, separate the lowest port and the top port with a ":". For example, to open up ports 80 through 90 you would put "80:90". You can also put non-joining port ranges on the same rule by adding more ports after a comma. For example, to open ports 80 and 90, you would put "80,90".
6. On "Local IP" put the IP address of the machine hosting the service you would like to expose to the internet. If you don't know this address and you're (as default) using the DHCP server on the router you can find the address by going to the DHCP management on your router. 
7. On "Local Port" you generally want to put exactly what you put under "Port Range". The exception to this rule would be if you want to expose an internal port as a different port externally. 
8. Under "Protocol" select the proper protocol; TCP, UDP, or Both. Again, note that selecting "Both" would result in both sets of ports being opened. 
9. Click the plus icon "Add/Delete" and then click "Apply" at the bottom. Note that if your IP address changes then you'll need to update the rule. 






17. (Added 7/20/2013,Critical) A vulnerability has been discovered with the AICloud software. There is an official firmware that has been released that is reported but not confirmed to fix the problem, but that includes a very poor wifi driver so I would not recommend its use unless you have no 5ghz WiFi clients. The Merlin 372_30_2 build does not address this problem because Eric based it on a pre-release 372 version that didn't yet include the fix. (Confusing versioning by Asus..) If you don't run that new stock FW make sure you disable the AICloud! (AICloud->Smart Disk/Cloud Access) Update 7/24/13: There is a Merlin build that addresses this issue now available. See below for links.  Update 2/18/14: There have been stories about either this exploit and/or a potentially newly found exploit involving FTP and the AI cloud feature. I think the best advice at this time is from Eric (the author of the firmware).  The point: Because it is uncertain if this is entirely based on the old vulnerability, disable these features until the full nature of the exploit is disclosed and confirmed fixed.   Update 3/16/14: This should be fixed with the newest build (374.40) but frankly I would still leave them off.
18. (Added 11/3/2013) If you notice that your WiFi continues to loose connectivity and you need to reboot the router to fix it, try naming your 2.4Ghz and 5Ghz radios differently. I've noticed that some dual band devices (the iPad specifically) will bounce between frequency spectra and this will cause the Asus to become confused and stop relaying requests to the DHCP server correctly. To do so go to Wireless->General and dropdown between "2.4Ghz" and "5Ghz", ensuring they have different SSIDs so that your devices will target one of the two explicitly.

If I find any other important info I'll add it. Enjoy!

Note 1: If you enable "Tools->Other Settings->Enable advanced (per IP) monitoring" it will disable hardware acceleration. While you most likely won't notice this unless you've got an internet connection approaching 100Mbit, be aware that you may loose some performance for that functionality.

Note 2: Check out "USB Application-> 3G/4G"... very interesting stuff.

Note 3: I'm investigating an issue that results in WiFi being unable to communicate with the LAN ports. It manifests itself in the log as: Jan 11 17:05:23 kernel: eth1: received packet with  own address as source address . I'll post updates on this later.

Update 2/2/2013: Merlin posted a new beta build. Discussion, Changelog .

Update 2/23/2013: More new builds & bugs fixed! Release Thread and changelog.

Update 3/16/2013: Another new build! Release Thread, Changelog

Update 3/29/2013: Eric just uploaded a new beta build based on a beta release from Asus. A couple exciting changes here including new wireless driver and tools. Note that you'll need to re-add you WoL clients (if you had any) because Asus added a new WoL tool. Also, note this warning from Eric:
"New wireless driver. This new driver brings quite a few improvements over the older one. Note that if you experience any issue with this new driver, it is strongly recommended to revert back to factory defaults, and re-configuring your router. There are a few low-level changes, and some new default values that you won't pick up until you revert back to factory defaults."  Release Thread, Changelog, Download

Update 4/4/2013: It looks like some folks are having issues on the new build with the 5Ghz radio. There is quite a lively discussion going on and Eric has answered quite a few questions.

Update 7/6/2013: A new build has been released that introduces support for the RT-AC56U! Release Thread, Changelog, Download

Update 7/24/2013: Another new build, (3.0.0.4.372.31) this time fixing the AI Cloud security issue and introducing the Yandex DNS filtering service. Be wary though that Yandex is in Russia, so if you use this feature (off by default) it may noticeably slow internet browsing since it redirects all your DNS queries. Release Thread, Changelog, Download.


Update 10/3/2013: Eric has been hard at work on a new build(3.0.0.4.374.33) based on a new source that includes fixes to general performance, parental controls, and more. Note this warning from Merlin: 

"IMPORTANT:
Due to the SDK change on the RT-N66U, you *MUST* revert back to factory default and manually reconfigure your router if coming from an older firmware! The only exception is if you were previously running either the Pixie Dust release (3.0.0.4.374.32-sdk6), or a previous beta of 3.0.0.4.374.33 (except for the -sdk5 Beta, of course).

Asus also recommends doing the same for the other models, however feel free to try without doing so. It might work fine for most people, but be prepared to do a factory default reset + reconfiguration if you run into any odd issues.

And by "manually reconfigure", I really mean it. Reloading saved settings would totally nullify the action of resetting to factory defaults, since you will just end back to where you started, with all the same (possibly invalid) settings."

Release Thread, Changelog, Download.

Update 12/14/2013: New build! (3.0.0.4.374.35_4) GPL 374.339 (Time machine support for some models), Asus' OpenVPN implementation. (Note this is a total overhaul), Namecheap DDNS, and more.  Release Thread(With Changelog), Download.

Update 1/22/2014: New build! (3.0.0.4.374.38) GPL 374.2078, major driver/SDK changes. RT-N16 is not supported by this build. This is SDK6 only. In short, if you have issues with this build, particularily with wi-fi performance, fall back to an earlier build. That said, the feedback in the forum regarding this build has been great thus far. Note: in most situations, Eric does recommend resetting to factory defaults & manually re-configuring. Release Thread With Changelog, Download

Update 2/16/2014: New build, out for a bit. (3.0.0.4.374.39) Dumps SDK5 and adds a new parental control option to use DNS services to block category based URLs as well as bug fixes. Release Thread, Changelog, Download

Update 3/16/2014: New build: 374.40. Not stable for the RT-AC68U but fixes the RT-N16. DNSFilter enhanced along with IPv6 fixes. This build should also address the highly publicized security issues from last month, but I would still recommend highly against enabling FTP, "Cloud AI", or any other outward facing services on principal. Release Thread, Changelog, Download.

Update 6/6/2014: New build: 374.43. Another new release from Eric today, mostly bugfixes. One feature added; the ability to force a DDNS refresh after a configurable number of days. Release Thread, Changelog, Download. Also, SmallNetBuilder forum member "000111" (7?) had the great idea to start a donation thread for Eric. If you appreciate his efforts it's worth considering heading over to this thread and throwing him a few bucks for the effort.

Update 11/7/2014: New build: 376.48_1. Merge with Asus code 3.0.0.4.376_2769, Samba upgraded to 3.6.24, Miniupnpd to 1.9, Dropbear to 2014.66, OpenSSL 1.0.0o, SNMP enhanced, RT-AC68P support. Release Thread, Changelog ,Download. Also, Eric (Merlin) warns of a but that causes wifi issues. Quoting him: "Note: Previous firmwares (both Asuswrt-Merlin and stock Asus) suffered from a bug where some nvram settings might end up being corrupted, which can lead to the loss of the 2.4 or 5 GHz settings on the webui with newer firmwares. To fix the issue, either do a factory default reset, or run the following commands over SSH:

Code:
nvram set wl0_band=2
nvram set wl1_band=1
nvram commit

The actual bug was fixed both on my end and by Asus a few releases ago, however the corrupted setting will cause issues starting with newer firmware versions if not corrected."

Update 8/292015: There have been several new builds, the last of which was great, but this update is to address how to perform source based routing with Merlin/Busybox:

In my case I've got two different internet connections and I want to selectively route different machines through different internet gateways. To accomplish routing traffic based on the source, we'll use the ip rule and ip route commands.  First, make the rule:

ip rule add from [IP]/[CIDR] table [NAME]

where [IP] is the from addr or range, [CIDR] is the applicable CIDR bitmask, and [NAME] is a unique integer to call the route, i.e.

ip rule add from 10.0.0.1.22/32 table 10

then the custom route:

ip route add default via [Gateway IP] table [NAME] dev [ADAPTER]

where [Gateway IP] is the IP of the desired gateway, [NAME] is the same integer as referenced above, and [ADAPTER] is the NIC to which the rule applies, i.e.

ip route add default via 10.0.0.254 table 10 dev eth0

You can re-use the route for multiple rules if desired. To make these rules persistent you'll need to use user scripts.I use services-start with a 10 second sleep in the beginning. Have fun!

SQL 2012: msiexec.exe running constantly after SP1 install

Heads up on a SQL 2012 SP1 bug; this happened to me on two pretty bare 2012 installs:

Symptoms: 

After installing SQL 2012 SP1, 2 msiexec processes spawn and run constantly. These generate significant CPU and disk activity.

Description: 

An error with the installer causes the .NET NGEN (Native Image Generator) to run in an indefinite loop. According to one post, it may even cause registry bloat to the point where the registry reaches the maximum size and you may need to re-install the OS on the machine. :-/ That said, I haven't verified that claim.

Fix:

None yet available

Update: Microsoft posted the official fix (the same as the early one below) here.

Workarounds:

1. (Per Steve Philip) "Uninstalling the Management Tools (both Basic and Complete) feature seemed to resolve the problem for us on most of our servers. On those that had the Data Tools feature installed, we also had to remove that."
2. (Per the Microsoft SQL Team.. supposedly) "Hello all, we have identified a temporary workaround for this issue. We will continue to work on a permanent fix and will communicate more information as it becomes available.If you are currently experiencing this issue, perform the following steps appropriate for you CPU architecture: 
   1. - Open an elevated cmd.exe 
   2. - If you are on a 64-bit architecture machine, run both of the following commands in the cmd.exe window:
   3.      - %windir%\Microsoft.NET\Framework\v4.0.30319\ngen.exe queue pause
   4.      - %windir%\Microsoft.NET\Framework64\v4.0.30319\ngen.exe queue pause
   5. - If you are on a 32-bit architecture machine, run only the following command in the cmd.exe window:
   6.      - %windir%\Microsoft.NET\Framework\v4.0.30319\ngen.exe queue pause
   7. After running these command(s) CPU consumption should return to normal and the 1004/1001 events should cease being published to the event log.
   8. More information on ngen.exe can be found here: http://msdn.microsoft.com/en-us/library/vstudio/6t9t5wcf(v=vs.100).aspx
   9. Note - after a machine reboot, the workaround will need to be re-applied"
3. (Per "DizzyBadger") "Just stop and disable ALL Microsoft .Net Framework NGEN services, and make sure you kill any lingering msiexec.exe processes. If your software hive has already reached 2GB on the other hand, you are screwed. (Again, unverified) Then you have to reinstall the OS, at least if it is a production machine. You can murk around in the registry and delete the keys manually, but there is no knowing what else has been scrambeled due to the fact that nothing can be added to the registry hive past 2GB. The bloated keys are HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGENService &HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v2.0.50727\NGENService"
4. (Update1; Per Paul D., see comments) Paul came up with a workaround to allow for the optimization tasks to still run; since we're still waiting on the official hotfix from MSFT you may want to have a look at that fix here.

There is another workaround listed on the site involving removing and re-installing the SQL management studio after patching, but this didn't work for me. 

Here is the Microsoft connect article.

Given the potential need to rebuild the OS it would make sense to check your production systems for this problem now.

Update 2: In the Microsoft connect article, MSFT has posted a fix, but gave the following warning about using it: "Please Note: The patch should only be applied if you're on SQL 2102 SP1. If you have already applied a Cumulative update or an "On Demand" fix on top of SP1, please wait for the associated hotfix update to be made available.


Thanks and regards
Shamik Ghosh
[SQL Server Team]"

I can't speak to the success of this patch; I'll be waiting for the associated hotfix.

Exchange 2010 Initial Database Setup

Here's a quick how-to on Exchange 2010 addressing a couple common problems:

Assumptions:

• You have completed Exchange 2010 setup and not yet migrated mailboxes to it. 
• You want to create one or more mailbox databases and delete the default. (The default names make it more difficult to manage) 
• You have more than one domain controller (See point 2 below)
• You are executing commands directly on the server in question. (You can do it remotely, but the syntax of the commands is different) 

Steps: 

1. First things first, let's create your new database. Pick an appropriate name and open up the Exchange Management Shell (as admin)
2. Most Exchange 2010 setups I've been through have been subject the error detailed here. Though the article talks about a multiple domain environment it may still appear in a single domain setup. It is due to the replication delay between your domain controllers. For this reason, I've found that keying your preferred server can alleviate this and a few other issues. Long story short, pick your best (local) domain controller, and execute:  Set-ADServerSettings -PreferredServer DC.FQDN.Here  . If you would like to see the DC configuration, you can use the command Get-ADServerSettings | Format-List . 
3. Now make the DB by using the command: New-MailboxDatabase -server 'NETBIOSNAME' -Name 'DB_NAME' -EdbFilePath ':\DB_PATH\DB_NAME.edb' -LogFolderPath ':\LOG_FILE_PATH'  .  Where: EdbFilePath and LogFolderPath are where you want the DB and its log files. For best performance, put the DB and Logs on different drives. (Different physical disk, not partitions) Use this command to create additional databases if you like. (Archive, for example) 
4. Mount the database with the following command: mount-database -Identity db_name
5. Now we must move the System Mailboxes from the default DB per this article. Execute the command Get-Mailbox -Arbitration | New-MoveRequest -TargetDatabase "db_name"
6. Now the discovery search mailbox; Get-Mailbox | where {$_.Name -like "DiscoverySear*"}| New-MoveRequest -TargetDatabase 'db_name'
7. To check the move request status, execute Get-MoveRequest
8. Once the move requests are completed, clear them all by executing Get-MoveRequest|Remove-MoveRequest and confirm. Note: This will clear all move requests, so if you have setup any moves other than those outlined in this article and don't want to clear them you'll need to be more granular. 
9. Dismount the original db name with the following command: Dismount-Database 'OriginalDBName'  and confirming, I.E. Dismount-Database 'Mailbox Database 1781398675'
10. Remove the old database with the command: Remove-MailboxDatabase 'OriginalDBName' and confirm. 
11. You can now delete the DB folder and the log folder of the db you just deleted. The remove-mailboxdatabase command should have told you where the DB was located and by default the log folder is in the same location. 

You did it, time to celebrate. Now is when you should setup your DAGs, etc. and then move user mailboxes. Let me know if there are any questions. 

Off-Topic: Eac3to 3.24 with Arcsoft dtsdecoderdll.dll 1.1.0.0 on Windows 8

When I'm not doing my job one of my hobbies involves archiving all my movies to my NAS and make them available to my HTPC for my wife to watch at the touch of a button. After upgrading to Windows 8, however, I noted the encoding tool eac3to no longer worked correctly with Arcsoft dtsdecoderdll.dll V 1.1.0.0. (The only version that correctly decodes DTS-MA 6.1 tracks) It seems that the this older version of the DLL is hard-coded to use the Microsoft VC DLL MSVCP71.dll, which will not register correctly on Windows 8. (It uses a newer version of VC out of the box) To work around this, you need to run eac3to in Windows 7 compatibility mode and copy the dlls to the syswow64 directory. (No need to register since the app calls them directly) Here's a step by step:

1. Copy msvcr71.dll and msvcp71.dll from a Windows 7 machine to the :\Windows\syswow64 directory
2. Ensure your copy of ASAudioHD.ax is registered successfully. (This accompanies the dtsdecoderdll.dll) 
3. Navigate to your eac3to folder and right click eac3to.exe-> properties.
4. Click the "Compatibility" tab and click "Change settings for all users" (may as well)
5. Under "Compatibility mode" check "Run this program in compatibility mode for" and select "Windows 7" 
6. Click "OK"

As stated above, there is no need to register the msvcr71 and msvcp71 files because the app calls them directly. Now, you can test it by opening a command prompt, navigating to the eac3to directory, and typing:

eac3to.exe -test

You should see the following: 

If encoding a DTS-MA 6.1 to 5.1, make sure to use the command line -0,1,2,3,5,6,4 -down6 .

Enjoy!

Reccomended Network Adapter DNS Settings for a Domain Controller\DNS Server

DNS client settings for your domain controller

This comes up at nearly every client I've been to, and I have yet to see any comprehensive article from MS on the topic. There is always quite a bit of confusion surrounding what you should set the preferred DNS servers to in the network adapter of the DNS server itself. Here are some quick guidelines to save you some time:

Do:

• Use another DNS server in the same domain as the primary, secondary, etc...

• Use the loopback address, but not as the preferred server. Set it as the last server in the order. (Use the Advanced tab if you have more than two servers)

• Clear the automatically added ::1 as the primary and only DNS server for the IPv6 stack unless you actively use IPv6. If so, then the same rule applies knowing that ::1 is the loopback address for IPv6.

• Bonus, here's the command: netsh interface ipv6 delete dnsservers "Local Area Connection" ::1 where "Local Area Connection" is the name of the connection in question. It may say something to the effect of "No DNS Servers" after you execute the command, but that tingling just lets you know it's working like Denorex.

Example: 

My lab has two DNS servers in one domain: 192.168.1.30 and 192.168.1.110. Here is the IP config of the 1.30 machine:

Where there another DNS server in the domain that would be listed BEFORE 127.0.0.1. Note that the DNS servers list does not include ::1 as the preferred server since I removed that with the command listed above.

Do Not:

• Use the server's own IP as the primary. Why? If something becomes wrong with the zone configuration or the replication of the records you could inadvertently isolate domain controllers from each other and give entirely inconsistent results to clients making troubleshooting the troublesome DC more difficult.

• Use the loopback address as anything but the last entry.

• Disable IPv6 entirely. See excellent blog posts by: Sean Siler, Romainia Networking Team, and Joseph Davies. 

Discussion: Some prefer to set the server's own DNS as preferred to reduce network traffic, and while I don't recommend that myself I will stress one final thing:
Whatever you decide to do with settings, be consistent. Lack of consistency inevitably costs time and money, usually when you don't have either.

Setup Share Nothing Hyper-V Live Migration: Step-by-Step

Forward

Share nothing live migration in 2012 is pretty cool; it allows you to move a running VM from one Hyper-V host to the other with NO elements shared between the two prior to the move. For more information about the feature, see:

Microsoft: Live Migration Description
Aidan Finn: Live Migration Demo

How-To

Setup Constrained Delegation

First we need to setup constrained delegation so we don't run into permissions issues during this operation. For more information regarding constrained delegation, see Matthijs Seldam's description and this Technet description. 

Perform the following for each Hyper-V host in your environment: 

1. Find the computer object in Active Directory Administrative Center (preferably) or AD Users and Computers
2. Drill into the properties and locate the "Delegation" location/tab
3. Select "Trust this computer for delegation to specified services only" and "Use Kerberos Only"
4. (Repeat for EVERY Hyper-V host you intend to use other than the host you are editing) Click "Add" and type the machine name for the other Hyper-V host in question. Click "OK". 
5. Select the following: (CTRL Click for multiple targets)

1. Microsoft Virtual System Migration Service/COMPUTER
2. Microsoft Virtual System Migration Service/COMPUTER.FQDN
3. cifs/COMPUTER
4. cifs/COMPUTER.FQDN
6. (Optional if using file servers for ISOs or VHD storage) For each file server repeat step 4 and then 5 adding ONLY the cifs services
7. Click "OK" to save & close the properties of the host. Ensure you repeat step 4&5 for each Hyper-V host. 

Setup Hyper-V

Important: repeat this process for each Hyper-V host.

1. In the Hyper-V manager, open the properties of the host you want to edit. 
2. Select "Live Migrations" on the left. 
3. On the Live Migrations property page, Check "Enable incoming and outgoing live migrations". Under Authentication protocol, select "Use Kerberos", under Incoming Live Migrations select "Use these IP addresses for live migration" and then add each IP address on this host you would like to use for migrations. More IPs=more available bandwidth. 
4. Click "OK" to accept changes and close the properties. Make sure to repeat these steps for each host.  

Move that thing!

1. In Hyper-V manager, right click the guest you want to migrate and select "Move"
2. Click "Next" on the Before you Begin page. 
3. Keep "Move the virtual machine" selected and click "Next"
4. Specify the name of the destination Hyper-V server and click "Next"
5. Keep "Move the virtual machine's data to a single location" and click "Next"
6. Select the destination folder on the target server and click "Next". 
7. At this point the wizard will present you with any other decisions that need be made concerning the move; one common one is which HyperV Switch should be used on the target host
8. Click "Finish"

It should migrate; (if not see below) the guest migration will trigger after the disk has copied over. Migration time will depend  on your disk read performance reading on the former host, writing perf on the target host, and network bandwidth. 

OH NO!

So let's say you're migrating between hosts with differing processors; they could even be the same brand. In my case, for example, I am migrating between a "Core 2 Quad" era Xeon and an "Ivy Bridge" Xeon. If the differences are substantial enough the machine won't move because the features exposed to the VM are missing on one of the platforms. Unfortunately you'll have to power down the guest to perform this fix, but it's a one time deal so next time the live migration will work. Lets do it: 

1. Power down the guest. 
2. Open the settings and expand the CPU specification
3. Under "Compatibility" select "Migrate to a physical computer with a different processor version"
4. Hit "OK" and start the guest back up. Live migration should now work. 

Microsoft: Hyper-V Processor Compatibility Mode

A Note on Performance: 

While the live migration performs well, the weakest link in your chain will be the speed things move at. Take this example: 

Read from: 4x 7200RPM SATA in RAID 10 

Write To: 6x 7200RPM SATA in RAID 5

LAN: 3x 1GB Full-Duplex w/Jumbo Frames

It does seem to automatically use SMB 3.0 Multi-Channel, but I am having a bit of problem scaling performance. While the screenshot above is held back by the source read speed, I didn't realize much more performance reading from the RAID 5 array, which has very good read speeds, to a different SSD-based RAID 10 array, which has crazy write speeds. I'll post any additional performance info I find. 

Installing .NET 3.5 on Windows10/8/Server 2012 With Powershell

Here's how to install .NET 3.5 (or another feature by subbing the feature name) on Windows 8/10 or Server 2012 from Powershell:

• Launch Powershell as Admin

Install .NET 3.5 using default sources (Windows Update or defined in group policy)

• 2012: Install-WindowsFeature –name NET-Framework-Core
• Win8/10: Enable-WindowsOptionalFeature –Online –FeatureName NetFx3 –All

Install .NET 3.5 using a network SxS share: 

• 2012: Install-WindowsFeature –name NET-Framework-Core -source \\server\share\source\sxs
• Win8/10:Enable-WindowsOptionalFeature –Online –FeatureName NetFx3 –All -LimitAccess -Source \\server\share\source\sxs
• On Windows 8, -all indicates that all parent features should be enabled as well and -LimitAccess prevents it from connecting to Windows Update. These options are not valid on Win 2012. 

Install .NET 3.5 using DVD-ROM 

• 2012: Install-WindowsFeature –name NET-Framework-Core -source j:\sources\sxs    (See note below)
• Win8:Enable-WindowsOptionalFeature –Online –FeatureName NetFx3 –All -LimitAccess -Source J:\sources\sxs

Make sure to run Windows Update after install if you're installing from a non-updated source!

Note: Depending on your configuration, on server 2012 you may need to use the install.wim on the install media and specify the index of the proper version of your install. To do so, execute:

Get-WindowsImage -ImagePath {OpticalDrive}:\sources\install.wim
This will display a list of images with associated indexes. Take note of the index of your install type.
Then, instead of the -source line above, use -source:wim:e:\sources\install.wim:X (where X is the number of the appropriate index. 

Update: Confirmed this works on Windows 10 as well!

Server 2012 Fixes HyperV VM Import Process

When copying VHD files from one machine to another or re-creating a VM, Windows 2008r2 and 2008 required you to manually grant rights to the VM Specific SID after import to successfully start the VM. The import process wouldn't stamp the copied files with the proper machine ACLs resulting in a "General Access Denied" error. (fix here) Server 2012 seems to have fixed that problem. When importing a HyperV guest to 2012, the correct rights are automatically applied. This is a welcome time-saving fix and thus far I'm very impressed with the Hyper-V improvements in 2012. More to come on that... this is obviously small relative to the major functionality changes, but I'm happy they paid attention to the details as well.

Windows 8 Media Center Free For a Limited Time

Though it doesn't seem to work yet, you can go here and get your key for Windows Media Center for Windows 8 Pro. I'm guessing it will go active tomorrow. I love WMC, and I'm guessing this will be Microsoft's last release of it; it seems they've chosen the Xbox as the go-forward media platform. Here's hoping some third parties can replicate the SmartGlass functionality for other devices with different software. :) Thanks for the heads up @GaborFari via @danielauger.

WSUS 3.0 vs. 2012/Windows 8 Notes

As I posted earlier, server 2012 includes a new version of WSUS. There are a few gotchas associated with WSUS and Server 2012/Windows 8, especially as it pertains to using a previous version of WSUS. Here are some key points:

• Windows 8 and Server 2012 "clients" will NOT work with WSUS 3.0 SP2 or any version that isn't shipped with 2012 unless this update is installed BEFORE any clients connect to it. 
• If your Win8/2012 clients attempted to talk to an older WSUS server before patching or upgrading, you will need to perform the following before they will update again: 
• Net stop wuauserv
• rd /s %windir%\softwaredistribution\
• Net start wuauserv
• If your new WSUS 2012 server is downstream from an older WSUS server, it will have the same effect as if your clients were pulling directly from that older server. All WSUS servers between the clients and MSFT need to be newer or patched. 
• According to Microsoft, updates canNOT be scanned by an intermediary... i.e. HTTPS inspection must be turned off on content from Windows Update. 

Client errors may manifest themselves as "error 0x80246003". According to the WSUS error table that corresponds to an unrecognized hash. I haven't completed my research yet but I'm guessing that the new endpoints will only honor update packages from MSFT using a new, stronger hash to raise security in the aftermath of the Flame malware. 

Sources:

Microsoft: WSUS SP2 Patch

Microsoft: Discussion on this topic

WSUS on 2012 Using SQL Install Note

Here's a quick tip that will hopefully save you some time:

As you may have noticed, WSUS can now be installed as a role service in Windows 2012. I'm using it successfully now with an "external" SQL server. If you plan on doing the same, note that when you install the role it will inform you that the Windows Internal Database feature is a prerequisite even though you don't intend on using it.

As you're going through install, feel free to un-check the Windows Internal Database feature. You'll get a chance to specify the SQL target during the configuration phase of the install and all should work right off the bat.

Unicast Network Load Balancing... Reliably

Microsoft Network Load Balancing can be difficult to setup reliably and there are a myriad of better options out there. With that enthusiastic endorsement, I'm writing this guide to walk you through (at a very high level) how to setup unicast clusters reliably.

Assumptions

• 2008r2 Servers (this should work down to 2k3 but there will be minor differences) 
• Both hosts are connected to the same switch or vSwitch
• You can have at least two NICs per host
• 1 static IP address per NIC. (i.e. 2 per host) 
• 1 IP for your clustered address
• You really want to do this and don't have a better way to split network traffic 

Example Network: 

In this example, we use the following addresses. Substitute in yours where applicable. 

• HostA: 192.168.1.5, (IP For Cluster NIC) 192.168.1.6 (IP for Other)
• HostB: 192.168.1.7, (IP For Cluster NIC) 192.168.1.8 (IP for Other)
• ClusterIP: 192.168.1.22

Steps

• Ensure each host has at least two NICs with the appropriate IPs configured. You *can* setup a unicast NLB cluster with one per host, but trust me you don't want to. (unless your app can't handle a multi-homed server)
• (Do for each host) Navigate to the advanced TCP/IP settings->DNS tab of the adapter that will participate in the cluster and UNcheck the box "Register this connection's addresses in DNS"
• Note: This will ensure that when the machine is looked up by its dedicated individual IP as opposed to the IP used by the cluster adapter which will share a MAC address with the other host. 
• Install the NLB feature. If you're not sure, here's some help: howto. 
• Open the NLB Manager Administrative Tool and right click the root->New Cluster
• Under Host, type the first host you wish to add, click connect, and then select the IP of the adapter that you removed from DNS a couple steps above and click "Next"
• Set the priority and default state. Priority is this host's priority in the cluster where a lower number represents a higher priority, and default state represents the participation of this host in the cluster. If you're not sure, take the defaults of 1 and Started. Click "Next"
• Click "Add" and put in your Cluster IP address. Click "Next"
• On the next "Cluster Parameters" screen, put in the DNS alias you will use for the cluster IP under "Full Internet Name" and set "Cluster operation mode" to "Unicast". Click "Next".

Cluster Params

• On the New Cluster: Port Rules you can accept the defaults unless you want to be explicit with your clustered ports. Click "Finish"
• Quick note: MS NLB doesn't support automatic failover based on service status, I.E. if the host is responding to any network requests it is assumed to be up even though the service may have failed. That's why I chose to accept the default and host all services on the cluster IP and dedicate a NIC to the task. This has proven to be substantially more reliable. For security, ensure your firewall is active and configured correctly. 
• Right click the newly created cluster and click "Add host to cluster" and input the second host. Follow the same steps that we did above for this host and exit the wizard. 
• If you're using VMWare: perform the steps under "Configuring Unicast Mode" listed in this document. This disables the automatic MAC relocation on the vSwitches. 
• If desired, do a static DNS registration for the "full internet name" of the cluster. 

That should do it. Remember that you will have to do fail-over manually in most circumstances. 

Sources/Additional Research: 

Microsoft: Tech Overview

Microsoft Forum: "Startup Warning"

Microsoft: NLB setup on 2k3 (Still relevant)

Microsoft: Selecting Multicast or Unicast

VMWare: Sample NLB Setup (good write-up)

VMWare: Microsoft NLB Multicast and Unicast Modes
VMWare: Implementing MS Network Load Balancing

Microsoft Clarifies TMG/Forefront Death Watch

As I'm sure you're aware, Microsoft recently announced the cancellation of Threat Management Gateway as well as Forefront Protection for Exchange & Sharepoint. This is disappointing news to many and I'm trying my best to avoid reading between the lines on this one.

That said, I found that on the fifth page of the comments the team posted a clarification post, which I'll quote here for reference:

Microsoft Server and Cloud Platform Team
  September 20th, 2012 2:32 PM

"We wanted to clarify some details around the discontinuation of Forefront TMG to help address many of the questions we’ve seen posted in the comments section.

First, it is important to note that while Forefront TMG is being discontinued, it will continue to be supported in mainstream support through April 14, 2015 and in extended support through April 14, 2020.  When and how a customer transitions to a replacement solution will depend on how the customer is using TMG today.  Customer use scenarios vary, but these general guidelines should help:

•  For customers using TMG for caching, secure web gateway (forward proxy), and firewall, we recommend that, prior to April 14, 2020, customers examine the many vendor solutions available in market today that offer comparable features to the TMG product.   Microsoft does not plan to transition this functionality to any other Microsoft products.

• For customers using TMG for reverse proxy, transitioning to Forefront UAG is an option.  Most web publishing scenarios that are supported by TMG can be published by UAG, though specific functionality may not be identical.   For customers who do not want to transition to Forefront UAG, customers should plan on transitioning to an alternative vendor solution prior to April 14, 2020.

•  For customers using Forefront TMG Web Protection Services, we recommend that customers examine the many vendor solutions available in market today that offer comparable reputation services by Dec. 31, 2015.  This product will no longer receive updates starting January 1, 2016.

We hope that these general guidelines provide additional clarity.  Please continue to contact your Microsoft account teams or partner managers with any questions about your specific scenarios.   

Regards,

The Forefront TMG Team"

HowTo: Run (Signed) Powershell Scripts as Scheduled Tasks with Minimal Rights

This is meant to be a straightforward howto: on the topic. While this sort of thing is quite common, I often times see people missing a few critical details that end up resulting in alot of unnecessary troubleshooting time. I will also cover steps needed to run signed scripts.

Assumes:

• Powershell 2.0
• Windows Server 2008 or R2 (will work on others but steps will be slightly different) 
• If signing script you know how to get a cert and basics about managing certs

Creating a signed script (optional) 

1. Ensure you have a valid code signing cert installed in your user store and that you're logged on as that user. This is easiest if your organization has PKI with a code signing template enabled. This user should NOT be the service account user, but rather the author of the script. (you I'm guessing)
2. After finishing your script, execute: 
1. $cert=@(Get-Childitem cert:\CurrentUser\My -codesigning)[0]  (assuming you have only one code signing cert) 
2. Set-AuthenticodeSignature .\myscriptname.ps1 $cert

Note: whenever you modify the script you'll need to re-sign it. 

Stage Server/Account 

1. Create the service account. To be controlled correctly this should be a domain account with no additional privileges above that of a standard user. For additional security, set it so the user can only log on to the computer you intend to run the script on. Use a  good password.
2. Give that user "Log on as a batch job" rights on the target server using the local security policy or group policy if applicable.
3. Create the directory the script will be stored in. Give the service account READ access to that directory.
4. Copy the script to the target directory
5. Variable step if signing or not:
1. If Signing: 
1. If signing execute as admin in powershell on the server: Set-ExecutionPolicy AllSigned
2. Log onto the server with the service account and run the script manually. This will prompt powershell to ask if you want to trust the publisher based on the cert. Select that you will always trust this publisher. (which is you!) If you can't log on locally or on a VM console you'll need to temporarily grant the service acct RDP access. 
2. If not signing, execute as admin: Set-ExecutionPolicy Unrestricted

 Setup Scheduled Task

1. Open Task Scheduler and navigate to the folder you would like the task to reside in. 
2. In the right plane, right click->Create New Task...
3. Give the Task a Name and Description. Don't skip the description, it'll save time having it there in the future. 
4. Select "Run whether user is logged on or not" and ensure the "Do not store password" box is NOT checked. Select "Run with highest privileges" ONLY if your script requires it. (Powershell itself does not) 
5. Click "Change User or Group" and enter the service account you created earlier. 
6. Select the "Triggers" tab and set triggers as appropriate
7. Select the "Actions" tab and click "New..."
8. Action: "Start a program"; Program/script: "powershell.exe" (full path shouldn't be necessary) ; Add arguments: "-NoLogo -NonInteractive -WindowStyle Hidden D:\path\to\your\script.ps1"
9. Change settings on the "Settings" tab if desired
10. Click "OK" and enter the password for the Service Account

That's it! If everything was done correctly it should run without problem. Depending on what the script does you may need to grant additional rights to filesystems, etc, but that's up to you to figure out since you wrote the script. :) I hope this post saved you some time getting your script up and running. 

No muss and/or fuss SQL DB Mirroring

So I've never really known what "muss" is, but this doesn't have any of that. It's sans muss. (without muss)

I must say that the SQL DB Mirroring error messages (at least as of 2008R2) leave something to be desired. Because of this, I figured I'd write a straightforward HOWTO on the topic. I've performed these steps on SQL 2008R2, but I suspect it will work on other versions as well.

This guide assumes the following:

• You have a DB on the Principal server that you wish to mirror
• That DB is NOT on the mirror target server (drop/delete it if so) 
• You do NOT intend on using a witness server.... using one however won't invalidate this guide, but we don't address the extra couple steps required to do so. 
• Your database is using a "Full" recovery model. (not possible otherwise) 
• You have sa access to both the Principal and Mirror server

Here are the steps, in order:

1. Log onto the Principal server
2. Perform a full backup to disk of the database in question. Ensure this is a new backup that doesn't include any previous backups.
3. Perform a tranlog only backup on the same database. While this step shouldn't be required, I've found that restoring a tranlog backup after the full results in a successful mirror pairing substantially more often. 
4. Copy the backup files to the Mirror server
5. On the Mirror server, perform a full restore of the desired database:
1. On the "General" page, ensure the "To database" is set to the exact same database name
2. On the "Options" page, select "Leave the database non-operational..." "RESTORE WITH NORECOVERY"
6. Right click the newly restored DB and select "Tasks"->"Restore"->"Transaction Log"
1. On the "General" page, select the appropriate file
2. On the "Options" page, select "Leave the database non-operational..." "RESTORE WITH NORECOVERY"
7. On the Principal server, select "Tasks"->"Mirror"
8. Click "Configure Security"
9. Select "No" for "Include Witness Server" and click "Next>"
10. Leave the ports default unless there is a reason to do otherwise. Make sure this port is properly opened on all firewalls (including the local firewall) between the to servers!
11. Select the target server, set the settings per your requirements (default are fine) and click "Next>". Double check that all firewalls are open on and between both servers. 
12. Enter the appropriate service account for this replication. While it is a lesser secure configuration, using the SQL instance domain service account (if you have one) works without issue. NOTE: If your SQL service instance is running as a local user, (including system) you must use certificate authentication which is NOT covered here.
13. Click "Next","Finish" then "Start Mirroring". All should work at this point. Note it is normal for the state on the Mirror server to be "Synchronized/Restoring".

Troubleshooting:
Explicitly grant connection rights to the "Mirroring" endpoint (note that's a name not a concept) to a given service account:
GRANT CONNECT ON ENDPOINT::Mirroring TO "Domain\Username"


Note that if you re-create the mirror it does not delete the endpoint. To delete the endpoint on each server: (assuming you took the default name of "Mirroring")
DROP ENDPOINT MIRRORING



References:
http://msdn.microsoft.com/en-us/library/ms189047(SQL.105).aspx
http://msdn.microsoft.com/en-us/library/ms189127.aspx

Good Luck!