THE OFFICIAL BLOG OF THE SBS "DIVA"

Planning for growth

bradley — Fri, 25 May 2012 05:13:00 GMT

Before we begin to install a virtual SBS Essentials, one has to determine what you want to do as far as planning for disk space.

http://blogs.technet.com/b/sbs/archive/2012/05/23/how-to-use-full-disk-for-the-o-s-install-in-small-business-server-2011-essentials.aspx

While you can follow the SBS blog for the how to use a config file to set the drive sizes, you can also use Robert Pearman's GUI scripting tool http://gallery.technet.microsoft.com/SBS-2011-Essentials-Answer-5bfc015a to set the configuration.

That's the hard drive space used after about 22 computers, several with archived backups, along with two stored backups for computers that are now removed from the office.... When I did the very first backup of each computer, it was about 1T for the whole shebang. The total of the drives that are being backed up is about 2T worth of stuff (on my box a bunch of ISOs that probably don't need to back up. So it's about a 50% reduction of the drive space of the computers being backed up.

You can't choose less than 60 gigs for the OS drive. Then determine what your data drive is. But be careful about the 2T brick wall. Not that long ago Terrabytes were considered insanely huge. Now we think a Terrabyte is normal. There's an issue when you have a drive greater than 2T on a Windows backup... Windows Backup has a 2T limit. A good discussion is here: http://homeservershow.com/forums/index.php?/topic/2212-backup-limitations-a-counterpoint/ Chunk down your data so that you can get it backed up.

A bit of scripting for the ADSIEdit edit

bradley — Thu, 24 May 2012 07:00:00 GMT

We're revisting this post: http://msmvps.com/blogs/bradley/archive/2012/05/23/empty-cn-servers-container-causing-issues-with-public-folders-on-small-business-server-2011.aspx

Instead of ADSIEDIT -- use this instead: http://gallery.technet.microsoft.com/ADSI-Edit-Exchange-Mail-da735c16

I require assistance in setting up Active Directory Domain Services on a Windows Small Business Server 2011 Essentials edition

bradley — Thu, 24 May 2012 06:50:00 GMT

Dear.. person posting on oDesk with a project to "install Active Directory on SBS Essentials'

Active Directory Installation on SBS 2011 Essentials - Networking & Information Systems Jobs - oDesk:
https://www.odesk.com/jobs/~~cb9d901c17a7c6f1?source=rss

You have a domain already. It's already installed. If you paid even one penny to anyone to "install Active Directory" on SBS Essentials you paid one penny too much. Now there is a domain name wizard to park the external domain, but you already named your internal domain and that box already became a domain controller during the install process.

What confuses many is that under the group policies there are no default policies. So they think they have a box that can't support AD. Nothing could be further from the truth. It not only already is a domain controller, it HAS to be a domain controller.

So again Mr. oDesk person, if you paid one single penny to anyone who said they installed it, you paid too much.

Empty ‘CN=Servers’ Container Causing Issues with Public Folders on Small Business Server 2011

bradley — Thu, 24 May 2012 06:27:00 GMT

We'll get back to my blog posts on HyperV... in the meantime I wanted to call this post out

Empty ‘CN=Servers’ Container Causing Issues with Public Folders on Small Business Server 2011 - The Official SBS Blog - Site Home - TechNet Blogs:
http://blogs.technet.com/b/sbs/archive/2012/05/17/empty-cn-servers-container-causing-issues-with-public-folders-on-small-business-server-2011.aspx

If you migrate from SBS 2003 to SBS 2011 and never mail enable your public folders, you'd probably never know that you needed to do one more step. As of about two BPA updates ago, this is now included as a BPA flagged item. Many who migrated and then got the bpa installed wondered what they did wrong.

Nothing actually.

Me, I'd personally like it if there was some better gui way of doing this because as a card carrying SBSer, I can count the number of times I've been into ADSIedit on one hand.

Bottom line if you run the bpa on your sbs 2011 and it freaks out over an empty server container, don't freak out, you didn't do anything wrong and your migration is still just fine.

KB2518864, KB2633880 and KB2572073 keep getting reoffered

bradley — Wed, 23 May 2012 05:34:00 GMT

If you are still seeing these updates get offered up over and over again...

and you are running Windows XP or Server 2003 sp2

...and you have "download but do not install" as your windows update settings

Try this - you'll need to reset your Windowsupdate settings.

http://support.microsoft.com/kb/971058 Use that fixit to reset it.

The underlying issue was a Microsoft update detection problem with http://support.microsoft.com/default.aspx?scid=kb;en-us;2656353. This update supercedes (takes the place of) KB2518864, KB2633880 and KB2572073. When KB2656353 was removed from the update servers to get ready for a rerelease, it caused an issue where these three old .net's got reoffered.

For those with automatic updates enabled, you got .net's over and over again but could go to the yellow icon, click on it, and get rid of the faulty detection. For anyone with "download but do not install", you have the patches stuck in your software distribution folder.

So here's what I'm recommending, use the fixit in http://support.microsoft.com/kb/971058 to reset your software distribution folder.

Let me know if that works.

That didn't work. Try this:

Method 10: Empty the software distribution folder

Click Start, click Run, type services.msc, and then click OK.

Note On a Windows Vista-based computer, click Start, type services.msc in the Start Search box, right-click services.msc, and then click Run as administrator.
In the Services (Local) pane, right-click Automatic Updates, and then click Stop.
Minimize the Services (local) window.
Select all the contents of the Windows distribution folder, and then delete them.

Note By default, the Windows distribution folder is located in the drive:\Windows\SoftwareDistribution folder. In this location, drive is a placeholder for the drive where Windows is installed.
Make sure that the Windows distribution folder is empty, and then maximize the Services (local) window.
In the Services (Local) pane, right-click Automatic Updates, and then click Start.
Restart the computer, and then run Windows Update again.

.NET update problem from this morning should be resolved now

bradley — Wed, 23 May 2012 00:48:00 GMT

So I had a server at home with these three updates still being offered. I clicked on the yellow icon to attempt to install them. I got this window, I clicked close and the yellow icon went away and I'm no longer being offered these updates.

If you see differently holler, as I can't repro anymore getting these updates.

Hang loose until someone in Redmond wakes up and fixes Microsoft update.

bradley — Tue, 22 May 2012 06:43:00 GMT

MS12-016: Description of the security update for the .NET Framework 2.0 Service Pack 2 on Windows XP and Windows Server 2003: February 14, 2012:
http://support.microsoft.com/default.aspx?scid=kb;en-us;2633880
MS11-044: Description of the security update for the .NET Framework 3.5 Service Pack 1 and .NET Framework 2.0 Service Pack 2 on Windows XP Service Pack 3 and on Windows Server 2003 Service Pack 2: June 14, 2011:
http://support.microsoft.com/default.aspx?scid=kb;en-us;2518864
MS11-078: Description of the security update for the .NET Framework 2.0 SP2 for Windows XP and Windows Server 2003: October 11, 2011:
http://support.microsoft.com/default.aspx?scid=kb;en-us;2572073

Seeing these being offered up tonight on a Server 2003 and on XP on unmanaged, or Automatic updates enabled machines.

Hang loose until someone in Redmond wakes up and fixes Microsoft update.

It is reported that it will be fixed sometime after 10 a.m pacific. It appears that MS12-035 will be rereleased and this is what is causing our momentary blip in detection.

Edit: Now fixed, and the Microsoft securty bulletin alert indicates that some of these updates got a detection change.

********************************************************************
Title: Microsoft Security Bulletin Minor Revisions
Issued: May 22, 2012
********************************************************************

Summary
=======
The following bulletins have undergone a minor revision increment.
Please see the appropriate bulletin for more details.


   * MS11-100 - Critical
   * MS12-034 - Critical
   * MS12-035 - Critical
   * MS12-MAY


Bulletin Information:
=====================

* MS11-100 - Critical

   -http://technet.microsoft.com/security/bulletin/MS11-100
   - Reason for Revision: V1.5 (May 22, 2012): Added entry to the
     update FAQ to announce a detection change for KB2656352 for
     Microsoft .NET Framework 2.0 Service Pack 2 to correct an
     installation issue. This is a detection change only. There were
     no changes to the security update files. Customers who have
     already successfully updated their systems do not need to take
     any action.
   - Originally posted: December 29, 2011
   - Updated: May 22, 2012
   - Bulletin Severity Rating: Critical
   - Version: 1.5

* MS12-034 - Critical

   -http://technet.microsoft.com/security/bulletin/MS12-034
   - Reason for Revision: V1.2 (May 22, 2012): Added an entry to
     the Frequently Asked Questions (FAQ) Related to This Security
     Update section to explain this revision.
   - Originally posted: May 8, 2012
   - Updated: May 22, 2012
   - Bulletin Severity Rating: Critical
   - Version: 1.2

* MS12-035 - Critical

   -http://technet.microsoft.com/security/bulletin/MS12-035
   - Reason for Revision: V2.1 (May 22, 2012): Added entry to the
     update FAQ to announce a detection change for KB2604092 for
     Microsoft .NET Framework 2.0 Service Pack 2 and KB2604110 for
     Microsoft .NET Framework 3.0 Service Pack 2 to correct an
     installation issue. This is a detection change only. There were
     no changes to the security update files. Customers who have
     already successfully updated their systems do not need to take
     any action.
   - Originally posted: May 8, 2012
   - Updated: May 22, 2012
   - Bulletin Severity Rating: Critical
   - Version: 2.1

Multiple monitors and Windows 8

bradley — Tue, 22 May 2012 00:06:00 GMT

MSDN Blogs:
http://blogs.msdn.com/b/b8/archive/2012/05/21/enhancing-windows-8-for-multiple-monitors.aspx

Data collected through the Windows Feedback Program indicates that approximately 14% of desktop PCs and approximately 5% of laptop PCs have run with multiple monitors.

Steven honey, 100% of the users in this office have multiple monitors and if I hear that you are coding through telemetry one more time... I may scream.

That is currently one of the weak points of Windows 8 - the multiple monitor experience. Glad to know that you you are listening to some feedback.

Snapshots are for test, not for real

bradley — Sun, 20 May 2012 07:48:00 GMT

So here's one best practice that I for sure follow... I ignore the ability to do snapshots in anything other than my Test HyperV. On my real production, snapshots are to be ignored.

http://www.techrepublic.com/blog/five-apps/five-tips-for-optimizing-hyper-v/726

Primarily in my mind for the fact that making a snapshot of a DC isn't wise as it could lead to tombstone issues where if you roll back you could be going back in your AD history unknowingly, and then secondly ...now granted by TestHyperV is an overgrown Frys desktop, but it nails that servers performance when it snaps an image.

So just plan on having a normal backup for your HyperV child and not taking snapshots.

NUMA settings in small firms?

bradley — Sun, 20 May 2012 06:56:00 GMT

Viorel in the comments says..."So what about NUMA settings Susan? And Processor core allocation? There is a good opportunity to use Hyper-V Server 8 (2012) for better performance ( >4 core) and NUMA management.

For management purpose I suggest to use add-in (cheap) netcard - onboard cards are server grade and can be more usefull for VM. "

Keep in mind that my personal experience with virtualization... I am talking about one server with two, maybe three, maybe four virtual machines on it. And I don't think that NUMA settings really make a huge difference for this size of deployments. If you guys have tests and benchmarks on small servers, by all means post them, but most of the NUMA articles I see are server farm discussions and I've not see benchmarks and tests for small servers.

http://technet.microsoft.com/en-us/magazine/hh750394.aspx

http://blogs.technet.com/b/winserverperformance/archive/2009/12/10/numa-node-balancing.aspx

I think the better idea is to have a good enough machine that you aren't having to squeeze out that last bit of performance.

For a SBS standard, you give it all cores that are exposed in the virtual interface. For any other computer, I have personally found that when I put in a small virtual workstation, it worked better with two cpus than one. Again, think about what cpu you'd be physically buying for the workload. In the servers that I have running HyperV, the CPU load honestly isn't pulling that much.

I wouldn't recommend HyperV Server 2012 on a client machine. It's a beta. Play with it, learn about it, but it's still a work in progress at this time.

http://www.vadapt.com/2011/05/performance-recommendations-for-virtualizing-anything-with-vmware-vsphere-4/

And I'm not a fan of overcommitting ram or resources. Again, these servers that I'm talking about are typically in a single firm, not in a server farm. I think if you go down the path of squeezing every last performance out of a server, I think that's asking for trouble in small businesses. You want room for growth and expansion.

So bottom line I let the box handle the NUMA settings and don't mess with tweaking.

http://blogs.technet.com/b/windowsserver/archive/2012/04/05/windows-server-8-beta-hyper-v-amp-scale-up-virtual-machines-part-1.aspx

http://www.techrepublic.com/blog/five-apps/five-tips-for-optimizing-hyper-v/726

http://workinghardinit.wordpress.com/2011/08/08/virtualization-with-hyper-v-the-numa-tax-is-not-just-about-dynamic-memory/

Granted you have to understand my HyperV mindset. In my HyperV world, it's the SBS that is the head cheese and everyone else is secondary. If you have a SQL server that you want to tweak because there's some app that is written poorly and needs some TLC, well you might want to play around with those settings.

Bottom line I can't give best practices here because I personally haven't done enough testing to know what a best practice for SBS would be.

This one I think you'll have to do some tests yourself.

Ram and networking

bradley — Sat, 19 May 2012 06:35:00 GMT

So how much RAM do you need?

When you are using the full GUI of 2008 r2 as the parent, reserve 1 gig for the needs of the OS. Then carve out the ram for the rest. SBS, Exchange and SQL will not do dynamic memory. I've got a small biz mentality that isn't so sold on "over committing" memory anyway.. I think it's asking for trouble.

SBS 2011 standard - I'd say 16 gigs or more is where you want to have your mind at. SBS 2011 essentials however, you can set that RAM much less.

And remember whatever the inside child is assigned as ram, that's what the outside partner will have in use.

And how much ram should you have in the parent? Remember that win2k8 r2 standard has a max of 32gig. If you use the free non gui HyperV server you can bump up the ram.

Make sure you've installed all bios updates on the parent. Dig into the network card and especially if it's a broadcom, get those latest nic drivers.

http://social.technet.microsoft.com/wiki/contents/articles/365.hyper-v-gotchas.aspx

Because SBS doesn't support nic teaming I tend not to do it. Sometimes keeping it simple means you keep it simple.

So now that you've built the parent, have it in your mind that you got so much ram for each child, you've got a network connection set up on two nics, one is the main nic I'll call the "admin" nic. This is the one you'll RDP into and use for maintenance. Now set up at least another one that will be the nic that you bind the children to.

This took a bit of mind wrapping... as you end up with something I'm going to call the outside nic and an inside nic.

First off on the parent all you install is the HyperV role. That's it. Nothing else. And in fact on the free HyperV server, that's all you are allowed to do. Same with the 1+1 role you get when you get a copy of Win2k8 r2 server and are allowed to lay down a parent HyperV. You start the server, go to Server manager and add the HyperV role.

Now you launch the HyperV manager. On the right hand side you click on Virtual Network manager and you build a network connector. I normally call this External so I know that this connects to the outside.

(this is my test HyperV box at the office). The box that is checked that says "allow management operating system to share this network adapter" is checked that way due to the HyperV wizard - http://blogs.msdn.com/b/taylorb/archive/2009/01/12/hyper-v-v2-guest-only-external-networks-add-roles-wizard-changes.aspx

When it does that ..and this is the part you have to get your head around... that one physical nic turns into two nics and the bindings on each indicates which one has the bindings inside the virtual machine.

See how one has the virtual bindings and one does not?

You need to set up a virtual nic and bind it to a live nic in order to have external internet connectivity

For every physical nic you can bind connections to it. In a small firm ..and especially in a test server you can actually have multiple machines share the same virtual nic. In production you probably want to plan your nic bindings a bit more carefully and not so willy nilly.

Up next...we start to install the SBS Essentials.

So about that raid

bradley — Sat, 19 May 2012 05:53:00 GMT

Raid can be a bit of a religious argument. Raid 5, Raid 10 ...what's your passion? In my case I like Raid 10 because someone told me I should get Raid 10 for the type of data I have - SBS. http://www.cyberciti.biz/tips/raid5-vs-raid-10-safety-performance.html Others have actually done testing, me I just believe.

Now I don't set up the configuration so that the vhd's match the partitioning in the HyperV parent but some do.

But the main thing is when you have a hyperV parent and are planning multiple virtual machines... you are putting your eggs in one basket in terms of hardware. So select well so that it will keep chugging even if it drops a drive and what not.

110 max in a distribution list?

bradley — Fri, 18 May 2012 05:44:00 GMT

Distribution and recipients list 100 email address limitation | Forums | Groups | Go Daddy Support:
http://support.godaddy.com/groups/community/forum/topic/distribution-and-recipients-list-100-email-address-limitation/?pc_split_value=1

In the native (not Exchange) hosted email of Godaddy you can only set up a Distribution list that contains a maximum of 100 members.

Wow..who knew.

So how do you do a HyperV that includes SBS Essentials?

bradley — Thu, 17 May 2012 06:11:00 GMT

I'm going to blog that answer over a series of blog posts.

Step one, get a nice server. If you are going to do hyperV you want one that does raid. I like a box that you can walk up to it, yank a drive out and the server keeps on chugging.

I prefer HP myself.

Next I haven't seen a server of that quality that didn't have a quad nic card. While I'm of the opinion that separating the management nic from the "working" nic is probably not as big of a thing if you are only running one or two machines in HyperV, you'll have a quad card there anyway.

However you set up the server for the raid, you'll end up partitions in the virtual machine that may or may not match the physical disks on the actual server. And that's actually okay.

Next up installing the operating system...

Congrats to Jeremy Anderson

bradley — Thu, 17 May 2012 03:39:00 GMT

Congrats to Jeremy Anderson named https://www.microsoftcommunitycontributor.com/logon.aspx Microsoft Community Contributor for his work in the forums.

Way to go Jeremy. He'll be in New Orleans with the Third Tier preday event as well!! http://www.sbsmigration.com/pages/406/

Jeremy Anderson :: Third Tier:
http://www.thirdtier.net/who/jeremy-anderson/

Read the fine print

bradley — Wed, 16 May 2012 04:21:00 GMT

Cloud Computing Security Benefits Dispel Adoption Barrier for Small to Midsize Businesses:
http://www.microsoft.com/en-us/news/Press/2012/May12/05-14SMBSecuritySurveyPR.aspx

Now before you read the report... read the fine print of how many people they surveyed...and how people self selected themselves for this...

Note: With pure probability samples of 94 (U.S. cloud) and 93 (U.S. noncloud), one could say with a 95
percent probability that the overall results for U.S. cloud users and nonusers would have a sampling error
of +/- 10.1 and 10.2 percentage points, respectively. Besides sampling error, all sample studies and polls
may be subject to several additional sources of error that cannot be calculated, including, but not limited
to, coverage error, error associated with nonresponse, error associated with question wording and
response options, and post-study weighting and adjustments. It should be noted that the sample used in
this study is based on those who initially self-selected for participation, therefore no complete estimate of
sampling error can be calculated.

The level of Microsoft support

bradley — Wed, 16 May 2012 03:50:00 GMT

I'm getting increasingly concerned in regards to the level and quality of Microsoft support. I have personally set up support cases for folks on this thread - http://answers.microsoft.com/en-us/windows/forum/windows_xp-windows_update/kb2686509-repeatedly-fails-with-error-code/0deeacb6-115c-419d-ac37-03ff8927b79c and have had folks email me saying that they contacted Microsoft.

The guy who contacted Microsoft directly at 1-800-microsoft was sent off to consumer support where the technician used logmein. Since when does Microsoft support use logmein? He wrote...

I've seen your messages on the Microsoft Answers group regarding this update and the fact that many people, myself included, are having difficulties installing it. I decided to contact Microsoft for assistance. I spoke with a very patient gentleman who, to his credit, worked on the problem for nearly four hours. He had me download a logmein client and was able to take control of my computer. However, after several failed attempts he tried to convince me that this update was likely not compatible with my computer. I asked him how he knew this and he gave me very generic answers about how certain updates are compatible depending on usage. I kept asking him to elaborate and I think that his point was that certain updates are compatible with certain programs but I found his answers vague and extremely generic, not to mention unhelpful. If it can be explained to me that this update is not necessary or applicable then I will accept this and won't worry about it. I told him that I was not satisfied with the resolution of the call and that I wished to speak with another technician. He said that someone would call me in an hour or two. I know that others on the forum have had success in installing this update when doing some registry hacks. I don't mind doing it but I'd like guidance while I do it. I consider myself an intermediate user and I'm not afraid to try anything that might fix this. Is there anything you can advise me when/if this person should call back as far as what I can suggest or how to direct the technician?

This patch is applicable to all Windows XP machines. It is applicable to all Windows XP machines.
Next I set up several support cases and the "scope" email that was setup for two of the cases said this...

Issue Definition: Unable to install the specific update KB2686509Scope Agreement: We will work together to help you install the KB2686509 through the course of this case. Once we are able to install the update we will consider the ticket as resolved. AlsoYou receive this message if any registered keyboard layout files are not in the %Windir%\System32 folder. In this scenario, the computer is incompatible with the security updates. If that is the scenario then there is nothing much we can do because the hardware is not compatible with the update.

Nothing much we can do? Excuse me?
Genius bar this isn't for sure....

Cristian wrote a VB Script to fix two problems while running microsoft security update KB2686509

bradley — Tue, 15 May 2012 04:17:00 GMT

From a comment in the blog:

(Cristian not me) I wrote a VB Script to fix two problems while running microsoft security update KB2686509

HKLM\SYSTEM\CurrentControlSet\Control\Keyboard Layout\Scancode Map

and

HKLM\SYSTEM\CurrentControlSet\Control\Keyboard Layouts

for those who are no registry freaks.

Here you can download my little hotfix as ZIP-file.

http://www.vivus.net/dl/

What does it do? Nothing magic!

1. Makes a registry backup

2. delete Scancode Map if exists

3. checks every keyentry in Keyboard Layouts against existing file in %SystemRoot%\System32

Hope I help someone with this script.

Regards

Christian from Germany

Status report on my Acer Travelmate C110

bradley — Sat, 12 May 2012 07:16:00 GMT

For anyone that knows I still have an Acer Travelmate C110 you'll be pleased to know it can handle a SSD drive.

What it can't handle is Windows 8. Barfs. Completely. So I think I've hit the wall with it on Windows 7.

But at least it's a little more speedy now. Still is a nice size for travel.

Dealing with the patching weekend

bradley — Sat, 12 May 2012 06:57:00 GMT

It's the patch Tuesday weekend and we have a doosey. I've seen on average about 18-24 patches PER workstation. Several .nets per version of .net and several versions of .nets. Which makes for a slow patching weekend.

The patch causing either no issues or lots of issues appears to be KB2686509 - which is ONLY on XP and Windows 2003. It's a backporting of an keyboard protection that Vista and later already has.

MS12-034: Description of the security update for CVE-2012-0181 in Windows XP and Windows Server 2003: May 8, 2012:
http://support.microsoft.com/default.aspx?scid=kb;en-us;2686509

While I applaud Microsoft for backporting a protection that they already gave Vista and Windows 7, the fact that the deployment of it .... is .... for lack of a better description... totally sucky.... leaves a lot to be desired. The patch installs and should it fine keyboard files that shouldn't be whereever they are, it fails with a cryptic error message.

In my personal case, I had disabled a scroll lock key and this alone caused the failure -- with no failedkeyboard.log file as there is supposed to be in the documentation.

In other cases, there is left behind a failedkeyboard.log file and you are told to dig into your computer and copy .dll files.

There appears to be a third failure as yet not documented well in the KB. In this third one, any language keyboard files under the keyboard registry key causes the failure. The failedkeyboard.log file doesn't point to dll files, but rather kbd files listed in the log file.

Bottom line, install the .net's separately (assuming you want to do them this weekend. And be prepared to deal with this XP patch.

We're patching for this issue: http://blog.coresecurity.com/2012/05/10/the-big-trick-behind-exploit-ms12-034/?utm_source=dlvr.it&utm_medium=twitter