Learning to Fly - Mika's Blog : Misc

My TechEd top 4 & Network Monitor 3

mika — Fri, 16 Jun 2006 16:45:00 GMT

I'm sitting on the last stint on the TLC at TechEd 2006. There have been quite a number of people who found this area and us technical experts here Thanks everyone for coming!

Over these five days, the most common questions and some additional info for myself were:

1) Group Policy processing problems

You can find basic flowchart for troubleshooting on Figure 1 of the white paper entitled "Troubleshooting Group Policy in Microsoft Windows Server". You can also test your understanding of the group policy processing by checking little flowchart displayed in this figure in order to see whether you know what all different reasons for problems mean. Derek Melber just presented a session MGT425 here on this topic. You can also find additional information on our book

The first option I tend to use most often for GP troubleshooting is to open rsop.msc. The right (or secondary) mouse button is useful in this tool. A more advanced way of troubleshooting group policy is to use different log options available. I detail here the steps to enable the UserEnv log and a (free!) tool to interpret it. I can say that I learned my group policy skills with this log file I wish Policy Reporter would have been available in 1999 or that I would have found it then.

Either use http://support.microsoft.com/default.aspx?scid=kb;EN-US;221833 to set the UserEnvDebugLevel registry setting OR perform steps 2-7
Download GPO Logging ADM Template from http://www.gpoguy.com/Tools.htm#EventLogADM.
Extract gpolog.adm from the zip file.
Open gpedit.msc (GPOE) on the machine you want to start monitoring.
Add the template into GPOE (right-click Administrative Templates > Add/Remove Templates… > Add… > pick the gpolog.adm
In the View menu, select Filtering… uncheck setting “Only show policies that can be fully managed”
Open Local Computer Policy\Administrative Templates\System\Group Policy\Logging
Enable UserEnv.Log logging of policy (and profiles) with Verbose logging.
Restart the computer.
Log file userenv.log is created in %Windir%\Debug\UserMode.
In order to interpret this file, download Policy Reporter from http://www.sysprosoft.com/policyreporter.shtml.
Install Policy Reporter and start it.

The new version of Policy Reporter even displays the processing delays. Obviously, you have to run these steps as an administrator. I use runas most of the time.

Other well hidden gems worth mentioning are 32 GPMC scripts (found in %Program Files%\GPMC\Scripts after installing GPMC) that many haven't found yet. They are great for backing up GPOs and documenting them.

2) Active Directory DCs on 64-bit architecture

You can find a recent white paper entitled "Active Directory Performance for 64-bit Versions of Windows Server 2003" on this topic. Microsoft's recommendation is to start considering converting existing environments to 64-bit architecture on environments when the size of your AD database exceeds 2.75 GB.

3) Problems with large number of group memberships

Another question that we discussed with several attendees had to do with Maximum Kerberos token size which may become an issue (e.g. kb 327825) in larger environments. Good information is available on http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/security/tkerberr.mspx. You can download command line tool called TokenSz in order to see the current token and to further diagnose it.

4) DNS problems

DNS being the cornerstone of Active Directory network is very often the culprit for various problems (authentication, replication, GP processing etc.). There is a plenty of information available on many sites. The best troubleshooting tip is to get it right the first time i.e knowing what you are doing when configuring the DNS service. In case you are having problems, you might want to start with TechNet Support WebCast: Troubleshooting DNS @ http://support.microsoft.com/?kbid=905900 & DCDIAG tool to pinpoint your problems.

Network Monitor III

The most exciting tool I've seen this week was Microsoft Network Monitor III. For many problems and troubleshooting them, I often use Network Monitor 2.0 (either the one included in Windows Server operating systems or the full version from SMS 2003). The new version 3.0 will become available on a limited beta at the end of the summer. Some of the features that we saw today, were:

Capturing multiple interfaces simultaneously
Dynamic display filters
Configurable parsers
Only network monitor tool to work on Windows Vista

I'm looking forward to the beta programme and the lauch of the tool - when it's going to be ready.

That's all for now. Regards to everyone and thanks! This was my second TechEd and the first in U.S. It was also the best TechEd so far

TechEd 2006

mika — Sun, 11 Jun 2006 04:20:00 GMT

I have safely arrived in Boston and will be working as an Technical Expert on the Technical Learning Center in Windows Server Infrastructure Track. Hope to see you there!

It's that time of the year again - Technet Pro tomorrow

mika — Wed, 01 Mar 2006 19:12:00 GMT

Tomorrow, I'll present a talk on Windows Server 2003 R2 in the Technet Pro 2006 seminar in the Finlandia Hall. The event was fully booked weeks ago with some 1400 registrations! My demo setup for tomorrow will include four virtual machines (three WS03 R2 & one Windows XP) running on Virtual Server R2 which runs on Windows Server 2003 R2, Enterprise Edition. Since I won't demo ADFS, this setup should be enough. any way, I'm looking forward to a great event.

For the last few weeks I've started to get myself familiar with Office 2007. Also, I've "upgraded" my Vista installation to build 5308 - and I've done it twice already. The first time I joined the machine into AD domain over VPN and on the second time I made the join while connected through Ethernet. It seems that the second time & route made the Vista run smoother :) BTW, there's a lot of great info on Vista @ http://windowsconnected.com/. I'm sure that the IE 7 chat that I just participated will find its way into the forums of that site as well - it's there already!!!

In the beginning of the week, I conducted a IIS 6 course, MOC 2576. During the research, I came across with another MVP's, Bernard Cheah's great IIS blog. http://www.iistoolshed.com/ is a nice collection of IIS related tools. To start off with diagnosing IIS, you could first check out IIS Diagnostics Toolkit.

Sovelto and FCS Partners merge

mika — Mon, 09 Jan 2006 18:52:00 GMT

My employer (and the company that I was a senior partner and shareholder of), Sovelto Oy, merged with another ICT training and consulting company, FCS Partners Oyj, as of today. We are really excited about the merger and are really looking forward to an exciting future. Together we form the largest ICT training company in Finland. FCS Partners and Sovelto are the two rising stars in the market. Both companies have grown and developed under the hard circumstances after the rapid growth in the IT market. The organization of the merged company will be based on experts and partners with high value on expertise and professional training. In the flat hierarchy organization all personnel will be directly interfacing the customers.

Over the last weekend we've started to integrate our IT systems. So far, so good :) Of course, there have been minor hickups but nothing major so far. What makes it so interesting is that both companies are using the latest versions of most Microsoft server applications and operating systems.

BTW, the name of the new company is FCS Sovelto Oyj.

Santa's five days early

mika — Mon, 19 Dec 2005 21:58:00 GMT

As I write this, I'm happily downloading the new December CTP build of Vista and Longhorn. Should be here (or actually in Helsinki) by morning... :)

Great autumn is all but over

mika — Sun, 18 Dec 2005 19:43:00 GMT

Since msmvps.com is now running on Community Server, I thought it's about the time to get my act together again... I started by changing the display skin - partially since the one that I used before the upgrade wasn't available ;)

Autumn has been great! A lot of things have happened the absolute best being the MVP Summit in Redmond at the end of September. It was my second time on Microsoft campus and definitely better than the first! (The first was a pre-conference two-day MSF course of Windows 2000 MCT Technology Week in 2000). It was great to meet all those great and active fellow MVPs whose books, messages, postings and articles I've seen over the years. I learnt quite a bit about new technologies to come. It was also great to see the amount of effort and dedication Microsoft is putting into MVP programme :)

On Tuesday of that week I participated (Windows Server 2003) R2 September Tour with some 40 other beta testers. We met with a number of program groups and probably had some contribution to the final product. R2 RTM'd (was released to manufacturing) on an easy day for me to remember - the 6th of December, which happens to be our (Finland) Independence Day. R2 beta programme was the best I've ever participated! Now, we've only yet to get the Volume Licensing versions. I've talked and presented on R2 on various events during the autumn. Centralized print management, new distributed file system and file server management with new filtering, quotas and reporting are certainly going to implemented in most R2 deployments. Active Directory Federation Service (ADFS) is conceptually the most difficult R2 technology to grasp but it also enables some interesting scenarions for web applications between organizations. BTW, you can get the Windows Server 2003 R2 Administration Tools Pack with the following administration tools

Print Management
File Server Resource Manager (which includes Distributed File System)
Identity Management for Unix
MMC 3.0

X86
http://www.microsoft.com/downloads/details.aspx?FamilyID=9bfb44f5-232a-4fb5-bc14-45bfd81b7ac1&DisplayLang=en

x64
http://www.microsoft.com/downloads/details.aspx?FamilyID=8f7df3a5-e738-44b4-91eb-4907511f87c6&DisplayLang=en

TechEd Europe

mika — Tue, 05 Jul 2005 15:44:00 GMT

Greetings from Amsterdam!

I've already experienced a fabulous canal cruise and an excellent 1-day preconference session by Mark Russinovich and David Solomon. You can find me at R2 Branch Office Ask-The-Experts stand (20A) during the remainder of the week

MVP again

mika — Sat, 02 Jul 2005 05:42:00 GMT

I just received an MVP recognition e-mail from Microsoft :) Thus, my annual MVP in Windows Server - Directory Services was renewed! I'm glad to be in for another year!

Windows Server 2003 Service Pack 1 is out

mika — Thu, 31 Mar 2005 10:58:00 GMT

You can get it on http://www.microsoft.com/technet/prodtechnol/windowsserver2003/servicepack/default.mspx . I used the beta & RC versions in the past and due to the great experiences with them, installed SP1 to my WS03 Std Edition straight away. So far, everything is good...

http://www.microsoft.com/WindowsServer2003/downloads/servicepacks/sp1/sp1datasheet.mspx has a nice overview what's new.

http://www.microsoft.com/windowsserver2003/64bit/x64/default.mspx states that x64 versions of Windows Server 2003 for AMD64 and Intel EM64T systems will be available in another 24 days.

First comments on Windows Server Update Services (WSUS)

mika — Thu, 31 Mar 2005 10:07:00 GMT

I've had a 16 (virtual) machine WSUS RC test lab up and running now for almost a week and it is running sweet :) This time I decided to use a workgroup scenario and WSUS's own computer group targeting. A bit more work than using AD & Group Policy but nice to see how well it works. Few comments:

If you use virtual machines (and are running on a "memory-limited" host machine), make sure to reserve at least 384 MB of RAM for the WSUS server
In order to speed things up initially in the clients i.e. to make the AU client to check up a specific SUS/WSUS server once, I used Software Update Services Utility instead of hacking the registry and restarting the Automatic Update service manually. The utility is a small command line tool with which you can force the AU client to call up a specific SUS/WSUS server within the next ten minutes instead of waiting for hours
Computers will show up in the Computers section after they've made the first contact with the WSUS server. There is no "magic button" to add them there
As stated in the WSUS Deployment Guide, "Microsoft Windows SQL Server 2000 Desktop Engine (WMSDE) ships with WSUS. It is available only if you install WSUS on a computer running Windows Server 2003. It is similar to the next option, SQL Server 2000 Desktop Engine (MSDE), but without limitations for database size or connections."
Information on updates is first downloaded into the database. When a WSUS client reports that it needs an update, WSUS decides that on the next synchronization cycle, it'll download the update
http://www.susserver.com/ has tons of info on SUS but especially the forum starts to heat up on WSUS as well

Overall, the system has been running really well. WSUS will certainly be a very welcome (and recommended) upgrade over SUS.

WMI Scripting Made Easy - Scriptomatic 2.0 released

mika — Tue, 18 Jan 2005 17:39:00 GMT

You might have come across version 1.0 of the Scriptomatic tool. Microsoft Scripting Guys wrote that little tool to make it a no-brainer to accomplish simple WMI scripts. The tool itself was a great little addition to the toolbox of a Windows administrator but the story behind it is probably the funniest you'll find at the moment on www.microsoft.com :) BTW, you can also find the story as Write WMI Scripts Like the Pros.doc when when you uncompress the downloaded scriptomatic.exe.

Last week they released Scriptomatic 2.0. The title of the properties of the readme.doc accompanying the tool summarizes it all: "Back in the good old days, people were much easier to please than they are now". The readme.doc reveals that the guys have done some homework at least in religion, history, literature and arts (especially pop music) in the seek of making the second release a success. And I must admit, they've succeeded - also in the readme department. The funniest and most entertaining story of version 1.0 has got even more entertaining (and sould I say cultivating) successor. It is stated that version 1.0 has been downloaded almost half a million times. Consequently, the readme included a transcript of a press conference! The tool itself has also improved. I recommend you to read the readme, which details all improvements and new features. The highlights are:

Using any WMI local or remote (!) namespace (instead of just root\CIMV2 as in version 1.0)
Output directed to command prompt, txt, HTML or Excel
Script in VBScript, JScript, Perl, or Python
Easy to target the script to multiple computers
Handles arrays and displays dates in more readable format

The readme is so entertaining that I don't want to even try to list the features. Go get the tool install (uncompress) it and read the readme.doc yourself! You won't be disappointed.

In addition to the Scriptomatic, you might also have a look at WMI Tools (for exploring WMI) and the latest version of TechNet Script Center Sample Scripts. Also, see the WMI scripting primer (part 1, part 2 and part 3) that those Scripting Guys wrote.

Modified display skin

mika — Mon, 10 Jan 2005 21:45:00 GMT

I used Isolation display skin to start with but learnt last night that it doesn't display correctly in FireFox. Not that anybody would be reading blogs with browser... Now I use Cogitation :)

MVP Summit 2005 is on!

mika — Tue, 04 Jan 2005 13:21:00 GMT

SearchWin2000.com reports that MVP Summits (Redmond & Asia) will be announced later this month :) Glad to get together with fellow MVPs.

Blogging - yet another new technology to learn

mika — Mon, 03 Jan 2005 04:47:00 GMT

I've been trying to start blogging for the last few months of 2004. When I really think about it, it was in June when we sat in a sauna with Ilija and discussed blogging. He made it earlier ;)

Then in December came the interview about MVP programme for the Microsoft Finland b-to-b magazine Circle. I promised to start my blog by the time the magazine hits the mailboxes in January. The next struggle was to to think about the name. For some reason, it had to do with flying. Pink Floyd's Learning to Fly made it since my motto "Never fly faster than your guardian angel" doesn't have any resemblence with learning.

I've yet to learn how to fly but in the meantime, I'm trying to learn something about how computers work... You can learn few thing about me @ Microsoft MVP Gallery.

I'm looking forward to sharing some of my discoveries through this blog.