0 to DC in 60 Minutes: Virtual Windows 2k8r2 Core as DC in existing Domain

Let's build a Server Core 2k8r2 machine on VMWare ESXi 4.1 and join it to an existing domain. This should be fun. This guide assumes you have already prepared the domain for 2k8 DCs. If you need help there, see this great blog. The moral of the story is that you need to perform adprep.exe /forestprep on the schema master, /domainprep and /domainprep /gpprep on the infrastructure master, and /rodcprep on the domain naming master.

We'll build it from scratch; no image. First, lets' configure the VMWare machine.

VMWare Settings

Unless noted, settings are default. (i.e. if a component is omitted it's default) 

Memory: 4096GB

CPUs: 2

SCSI Controller 0: LSI Logic SAS (Paravirtual would require a driver disk for setup)

Network Adapter: Proper VLAN, Paravirtual or E1000. I generally use E1000 for domain controllers. 

Hard Disk 0: 40GB for core

Hard Disk 1: (optional) 20GB for logs, 3rd party apps if necessary

Mount your Win2k8r2 ISO on the CD/DVD drive and make sure it's Connected/Connected at Power on. Start the VM. 

Installing Winders

Note: Select x64 or x86 as you prefer. Feel free to add a x64 machine in with DCs that are only x86. 

When navigating through the installer select the correct version. In this exercise I'll be selecting "Windows Server 2008 R2 Standard (Server Core Installation)". If prompted for the type of installation, select "Custom (advanced)". Select Disk 0 as the install target. The install should go quick, and the first thing you'll be prompted to do is select an Administrator password. Use "password" and never change it. (Hah Hah! You see what I did there?) 

Using the console, log on to our new server as administrator and then we'll go point by point; unless noted otherwise commands are assumed to be executed from a command prompt on the target server. 

Configuration

Install VMWare tools (or HyperV if you desire) 

• Mount the CD: (Right Click VM->Guest->Install VMWare Tools)
• Assuming D:  msiexec.exe /i "D:\Vmware Tools.msi" /qn
• The server will automatically reboot after installation; log back on after it comes up. 

Set IP Addressing information

• netsh int ipv4 set address name="Local Area Connection" static 192.168.11.99 255.255.255.0 192.168.11.254
• Where: "Local Area Connection" is the name of the connection, "static" defines the IP as static, "192.168.11.99" defines the IP, "255.255.255.0" defines the mask, and "192.168.11.254" represents the default gateway
• netsh int ipv4 add dnsserver "Local Area Connection" 192.168.11.103 index=1
• netsh int ipv4 add dnsserver "Local Area Connection" 192.168.11.100 index=2 
• Where: "Local Area Connection" is the name of the connection, "192.168.11.103" represents the IP of the DNS server, and "index=1" is the priority of the server

Rename the computer and join it to the domain

• netdom renamecomputer %computername% /newname:COMPUTERNAME
• Where: "renamecomputer" is the command we're issuing, "%computername%" is the necessary part of the argument that specifies the current name of the computer, (feel free to use the variable, it'll work) and "/newname:COMPUTERNAME" is the new computer name. Replace with your naming standard. For enterprise scalability I recommend naming your servers after your neighbor's kids. 
• shutdown /r /t 0 
• This will shutdown and restart the computer; "t 0" specifies wait for 0 seconds. After the reboot you'll still need to use the VMWare/HyperV console because we haven't opened RDP ports yet. 
• netdom join %computername% /Domain:DOMAINNAME /UserD:username /PasswordD:password
• Where: This command joins the computer to the domain. Specify the NETBIOS domain name (a couple configs may need the DNS Name) and a username/pass that can add machines to the domain. Note that the extra D after user and password is NOT a typo. 
• shutdown /r /t 0

Enable RDP and open appropriate Firewall holes

• Cscript %windir%\system32\SCRegEdit.wsf /ar 0
• Enables RDP
• netsh advfirewall firewall set rule group="Remote Desktop" new enable=yes
• Allows RDP through firewall 
• netsh advfirewall firewall set rule group="Remote Administration" new enable=yes
• Allows "Manage This Computer" functionality remotely
• netsh advfirewall firewall set rule group="Remote Event Log Management" new enable=yes
• Allows browsing through Event Logs remotely

Configure Disks: (Optional)  In my example I'm assigning the virtual CD/DVD-Rom to J: and then creating a partition for my second disk, formatting it, and setting it to D:

• diskpart
• list volume
• Volumes will be listed. You need to find the DVD-Rom, which will list its Fs type as "UDF". In my case it's volume 0, but I'll refer to it in the next example as "X"
• select volume X
• Use the correct volume number. 
• assign letter=X
• We put our server standard to J to keep it away from common HDD letters. 
• list disk
• now we will look for the disk # representing the secondary disk; it should be the disk with the size and free space reporting the same size. In my case it's Disk 1, but I'll use X in the command
• select disk X
• Use the correct disk number for X
• create partition primary
• Creates a "standard" partition
• assign letter=D
• Replace "D" with whatever drive letter you want
• select partition 1
• Select the partition we just creatd
• format fs=ntfs label="Data" QUICK
• Format the volume, replace the label with whatever you desire; QUICK is a quick format

Activate the Server (important to do before we bring it into the domain)

• slmgr.vbs -ato
• If you receive an error, you may have used the wrong ISO and you'll have to switch the product key. To do so, contact MSFT, get the new key, then do: 
• slmgr.vbs -ipk PRODUCT KEY HERE
• slmgr.vbs -ato 

Update the Server

• Use the sconfig tool or this method to fully update the server prior to install.

Create the Unattended Answer File for DCPromo

If you don't have an unattended answer file from an earlier DCPromo (which is likely or you probably wouldn't be here) you will have to create one from scratch. This isn't so tough as it would seem. The guidelines for the unattended answer file can be found here. Feel free to use mine as a starting point; here is my final file with the appropriate information obfuscated. Note that my example changes the default locations for the Database Path, LogPath, and SYSVOL path. This is not necessary and if those lines are omitted they will be installed to the default locations. Also note that if you're not adding this DC to an existing domain but rather creating a new one, this file should be quite different. 

[DCINSTALL] 

UserName=userName

UserDomain=NETBIOSDomainName

Password=passwordHere

SiteName=Site-Name-Here

ReplicaOrNewDomain=replica

DatabasePath="D:\NTDS" 

LogPath="D:\NTDS" 

SYSVOLPath="D:\SYSVOL" 

InstallDNS=yes

ConfirmGC=yes

SafeModeAdminPassword=passwordHere

ReplicaDomainDNSName=FQDomainName.lan

RebootOnCompletion=no

After you have completed the creation of your unattended answer file, place it in a temp folder on the target machine. For the purposes of this guide, we will assume \\ComputerName\c$\temp\dcpromo.txt

Promote the Machine to a Domain Controller

• dcpromo.exe /answer:c:\temp\dcpromo.txt
• Remember that we're assuming c:\temp\dcpromo.txt for where the unattended file was placed; if you don't 
• If all is successful towards the end you should see "Active Directory Domain Services is now installed on this computer for the domain "domain.name.here"
• shutdown /r /t 0

 Test the new DC

• dcdiag /c /v /f:c:\temp\dcdiag.txt
• This performs all DC Diagnostic tests (/c) and logs verbosely (/v) to c:\temp\dcdiag.txt . If you're not confident troubleshooting this output add an /i to the command line after /c, which will suppress unimportant error messages.
• After running, review the log for errors. It is normal to see a couple warning messages from the File Replication Service right around the time of the DC promotion.

That's it, you're done! Feel free to comment or e-mail with questions or comments.

Update 5/20/2013: I wanted to note that I've successfully used this methodology for Windows 2012 core as well, despite dcpromo being deprecated. The only change to note since the article was written is to ensure you use e1000e (or VMXNet3) rather than e1000 if you're using a VMWare VM.

Enabling SPDY Protocol in Firefox!

Google services seem slower on FF than on Chrome?

The recently released Firefox 11 supports the SPDY protocol. Google services use SPDY if negotiated & Chrome has had it enabled by default for some time. Let's enable it on Firefox: 

• Open a new tab in Firefox and navigate to about:config (no http:// or anything)
• Click "I'll be careful, I promise!"
• In the search box, type "spdy". 
• Double-Click "network.http.spdy.enabled" to toggle it to user set - boolean - true
• Restart the browser

That will do it! For more info about SPDY check out this great podcast: Security Now! With Steve Gibson and Leo Laporte Episode 343.

Edit: note that this change is per-user, not system wide.
Edit2: A new addon that reports if the site was pulled via SPDY with an address bar indicator!

Complete IT Systems Overhaul Nearly Complete

I've just finished the initial phase of a complete systems overhaul for my current employer. We've virtualized the vast majority of the servers, re-engineered the network and replaced nearly every switch, installed new firewalls and built the rules from scratch, setup a centrally managed & secured wifi infrastructure, provisioned a new SAN, and much more. I've been fortunate enough to work with brand new Cisco, VMware, EMC, HP, Redhat, Veeam, Symantec, Microsoft products. I intend on posting lessons learned here along with how-to articles for some very interesting tech. Stay tuned!

Trunking an Extreme 450a to a Cisco 3750 via LACP

I've seen several attempts of this elsewhere on the 'net but most had a few errors that caused issues. Here's the approach that worked for me:

Extreme side: Assuming ports being assigned are not untagged on any VLANs or in use by anything else

Assuming port 5,6,7,8:

Enable sharing 5 grouping 5,6,7,8 lacp

Add to VLANS we need to route:

configure VLANname1 add ports 5 tagged

configure VLANname2 add ports 5 tagged

Cisco commands:

Assuming 2x core switches chained, ports 37 and 38 each. 

interface range g1/0/37-38,g2/0/37-38

description temp connection to extreme core

switchport trunk encapsulation dot1q

switchport mode trunk

channel-group 48 mode active

interface port-channel48

description temp connection to extreme core

switchport trunk encapsulation dot1q

switchport mode trunk

3/22/12 update: We've finally retired the old Extreme switches. I am happy to say that this LACP trunk config performed perfectly for nearly 5 months to tie a new Cisco infrastructure to an old Extreme one. 

I should post before a year has passed.

Being this is a "free time" blog, this exemplifies the last year quite well. This last year has been one of the most challenging I can remember. A couple quick updates to keep it less than a year old:

- I'm working with MSDeploy to build a continuous integration model. I aspire to post my findings here. It has been exceptionally promising thus far.
- Baby #2 is due within the next few weeks. I'm very excited and a bit nervous at the same time.
- Amplifier released their new (pseudo?) concept album The Octopus. Initially I didn't care for it as much as I had hoped, but now that I've given it about 3 listens it's really sticking in my brain.

App-V, WAS 6.1 is the final 6.0, We have a child!

Just moved + baby + 80 hr workweeks=not much spare time. I don't have any time to type out valuable information, but in the interest of making it look like I still care here are some very brief updates:

• I've been experimenting with Microsoft Application Virtualization via "App-V". (Apps over RDP) The implementation is impressive; I'm even running outlook full time without having it installed on my PC. There are some key limitations that prevent enterprise class adoption however: Load balancing options are limited, (this is being worked on) it doesn't operate quite correctly on the desktop side with the Aero interface, and there are at this point no ways to control the "branching" behavior of the app in question. For example, if you get an e-mail with an http: link there is no way to control where that link is opened. At this point all links, etc. default to opening within your RDP session on the server and a new virtualized app is created to facilitate that. Obviously there are few scenarios where you want to virtualize IE at this point in time due to the rendering requirements.
• Quick point; WAS 6.1 is a major improvement over WAS 6.0 in terms of manageability. I am eager to work in depth with 7.0. I have figured out how to run Websphere Application Servers on the Windows platform without administrative privileges for the service account associated with the process. I was very disappointed to find that IBM didn't know this information, so I had to "go it alone". The very limited guidance their tier 3 support was able to offer was inaccurate, and I got the feeling that their expertise level on the Windows platform is somewhat limited. I suppose I should be surprised by that... anyhow the details are a little lengthy to type out at this time, so if interested shoot me an e-mail and I'll help you out. Also quickly re: WAS, be aware of this issue if using WAS with IIS 6.0/certificate authentication : http://blogs.msdn.com/jiruss/archive/2007/04/13/http-413-request-entity-too-large-can-t-upload-large-files-using-iis6.aspx (look how much more interesting that guy's blog is than mine. Must be focus.)
• My kid is the cutest kid ever, but I may be slightly biased. Not sure.
• My friend turned me on to a band that is absolutely amazing; I haven't enjoyed the collective works (only 3 albums mind you) of one band as much as this in quite some time. If you like progressive rock please give 'em a shot: http://www.amplifiertheband.com/
• Tech PSA: If you're on the Google Wave preview program, please sign on. I have about 20 friends on there and not one of them has signed on in the last week. It's awkward sending all these waves back and forth to myself. ;-D

See ya!

TVersity/Websphere Security

Working on my basement & trying to get the XBOX 360 as a usable media viewing platform for my wife. My goal is to have it be the central point of her living room, as I'm moving my main HTPC downstairs with me. :D I have my 500 movie collection ripped to a couple TB drives and encoded in various different formats. Since I don't want to re-rip them all to supported 360 formats (UGH! http://blogs.msdn.com/xboxteam/default.aspx) I've been looking into TVersity. (www.tversity.com) I'm trying to get it up and running on my dedicated server. Here are a couple tech notes that pertain to getting this to work:

-As they state, disable SSDP and UPNP services inherent to Win2k8. The software has it's own UPNP code.
-If you have a multi homed box, make sure you use whatever interface your machine likes to dish out in ARP communications. This one is kinda odd.... I haven't figured out all the details yet, but my server makes ARP requests and dishes out the IP of it's secondary interface to communicate. I had to bind the TVersity server service to that IP specifically to get clients to connect reliably. Had to use wireshark to figure this one out.
-Your server needs a soundcard to build the graph to transcode videos. I believe this to be a OS limitation, as it uses the native windows codec priority to build graphs, and you can't build a transcoding graph without an audio out pin. This is disappointing, as the only sound card I have lying around is a creative card and I REALLY don't want to install a creative labs sound card on a server due to YEARS OLD DRIVER ISSUES CREATIVE IS HORRIBLE GAH WHY DO I STILL BUY THEIR PRODUCTS SOMETHING IS WRONG WITH MY BRAIN.... sorry that just spilled out.

Enough of that. From a more professional perspective, I've been trying to get real keystores working throughout an implementation of Websphere 6.0.2.x ND Application Server(s). After much trial and error, let me make the following recommendations as to how to pursue this:

1. Do Not: make a new repitoire. This is unfortunate, but IBM's implementation of repitoire management is lacking at best, horrible and unworkable at worst. Even if you go through the trouble to change all web container referance points to the new keys, you will still have to scour other config files manually (mainly server.xml files) to replace references. This is obviously prone to error. I reccomend instead replacing the default keystores and truststores (under websphere\appserver\profiles\\etc\dummy*.jks with your real keys.
2. Do: change the password on the default keystore after you update it. This won't cause issues with two exceptions... you will have to update the passwords in \websphere\appserver\profiles\\properties\sas.client.props and soap.client.props with the new passwords. Make sure to encrypt the files after you do so using IBM's encryption script.
3. Do: delete ALL "dummy" keys and expired certs from all stores. No reason to keep them, it's just a security risk.
4. Do: update the plugin keystore if you use a web server front-end. You just need to make sure that the keystore/truststore (this one should be shared) has your issuing CA chain. Note that this keystore is in CMS format and you'll need to use the GSK7 version of ikeyman to update it. If it doesn't launch properly make sure you have JAVA_HOME set to \websphere\appserver\java\ .

Anyhow, I'm going to try to update this more regularly (and my failure to do so will be for all to see...) to have a repository for "gotcha" info I haven't been able to find anywhere else on the internet. This will serve two purposes: 1. We go through so much I can't seem to remember this stuff later, so I'll have documentation of it... 2. Hopefully others will stumble across this info and find it useful since I haven't found it anywhere else.

On the music font, Coheed and Cambria is amazing. I can't stop listening to their 2k5 album release.

Ping!

pong.

This looks cool in concept but is coded very poorly and utterly unsupported. Damn. http://www.arfx.nl/ It would be great if the developer took it seriously.

See you in 3 months or so. :D

Using server Core as a domin controller

A couple quick notes:

1. Core obviously doesn't have a GUI, so your dcpromo wizard is gone. The easiest way to circumvent this is by using an unattended file. See: http://www.petri.co.il/creating-unattend-installation-file-dcpromo-windows-server-2008.htm

2. Set all interfaces to static addresses (IPv6 included! P.S. Stay tuned for a bunch of IPv6 setup info) using the netsh command. http://www.petri.co.il/configuring-windows-server-2008-networking-settings.htm and http://technet.microsoft.com/en-us/library/bb878102.aspx

Here's a big catch that really disappointed me: when creating an unattend.txt file for dcpromo purposes, you CANNOT use an already existing DC! What the hell?! It would stand to reason that the smartest approach Msft could take on this would be to allow you to create a file from a already installed and tweaked server, but as it stands that's not possible. The only chance you get to create an unattend.txt file is right at the end of the initial DCPromo. That being said, even if you aren't sure about your DCPromo setup on a non-core machine, utilize the "Export Settings" anyhow. At least then you'll have a baseline to start from and you won't have to do the whole thing from scratch like me. Yuck.

Hyper-V, HyperV, HyperADD, whatever

So, after the Microsoft "Heroes Happen Here" launch event, I'm playing around with my copies of software. I've got all new hardware for a dedicated HyperV machine as my main lab setup and I'm experimenting with setting up a new infrastructure with PKI, IPSec, AD Services, Exchange, etc.

Here are some Hyper-V specific notes:

- Emulated hosts are SLOW. Holy cow! I can't believe how slow hosts are on this platform before installing the Integration Services (VMware addons equiv.) It is BY FAR slower than VMWare ESX, VMWare Server, or Virtual Server 2005R2 without the addons. After installation the performance is great, but it took me hours to get a 2003 host setup and patched before that installation, since the minimum requirements are somewhat steep for the guest OS to support the IS software. This is disappointing.

- Can't boot from emulated SCSI, only emulated IDE. I have links about this, I'll post 'em later.

- Most annoying "quirk" sofar: When you create a fixed size disk, which is what I prefer to do for performance reasons, all related activity on that set of drives STOPS. Guests that rely on that drive set will nearly lock up until the completion of the disk is completed. This is byfar the most annoying thing I've seen sofar. It's not a low performance I/O setup I've got here; An adaptec 3405 SAS/SATA RAID card with 4x WD 5000KCS drives in a RAID 5EE array. I realize it's not enterprise class, but it should be well enough to do two things at once. The creation routine for the fixed disk is far to agressive with I/O in my opinion.

This whole post is a touch light on details. I'll add more later.

Edit: Add..

Another annoying quirk; Since the addons that shipped with Win2k8 were a beta, the RC0 addons are not fully compatible. Because of that, they don't work until you manually update them with this update: http://www.microsoft.com/downloads/details.aspx?FamilyId=DDD94DDA-9D31-4E6D-88A0-1939DE3E9898&displaylang=en

hello world

This is probably the 1 millionth blog opened with the title "hello world". I'm super creative like that.

I plan on using this space as a sounding board for technologies I'm working with, including notes and "gotchas" in the process. My sole purpose is to "give back" to the blogging "community" that has been so helpful in my pursuit of eventual free time through completed work. As you can see, as well, I am also here to glorify the "quote".

A small bit about me: I'm currently an Apps Engineer for one of the largest banks in the world, (Just a touch paranoid about giving out my employer details on a blog) and I work mainly with middle tier software solutions to facilitate relatively simple technical solutions for relatively complex business problems. If you like you can check out my LinkedIn profile for more details: http://www.linkedin.com/in/tobymeyer

I also help out at TopDogPC (www.topdogpc.com) in my spare time, a local St. Paul based network services company. They specialize in Managed Services and business solutions (voip, exchange, etc.) for small to medium size companies.

I have been a "Microsoft guy" the majority of my life, (Windows, IIS, SQL, Exchange, Biztalk) but I'm by no means an evangelist. I sway in that direction when I evaluate solutions simply because it's where I have the most experience, but I've also engineered end to end solutions using alternative solutions. ( Linux, Websphere, Apache, etc.) To entertain myself I maintain a mach network @ home, and most of the things I'll probably blog about will be my experience working with the technologies I experiment with there. To add some credibility to that statement by the way, substute "home" with "lab".

And yes, I have the "lab" to impress the ladies. Har har har.