VDI-in-a-Box 5.1 offers a new setting at the template level to reset the activation timer. Leaving this unchecked implies that the image’s activation clock is not rearmed during prepare. Checking the box implies that the image’s activation clock is rearmed during prepare, decrementing the activation count. If the image’s activation clock is rearmed more than 3 times before the image is activated by KMS (Microsoft activation Key Management Service), the image cannot be prepared because the /generalize will fail.
According to Microsoft: “Resetting the activation timer prevents the image’s grace period from expiring before the image is deployed. Running Sysprep.exe does not remove the installed product key, and administrators are not prompted for a new key during mini-setup… When building demo virtual machines (VMs) for internal use (e.g., building VMs for the organization’s sales department or to set up a temporary training environment), running the Slmgr.vbs script with the /rearm command-line option extends the grace period another 30 days, which in turn resets the activation timer but makes no other changes to the computer. The activation timer can be reset three times for computers running Windows 7 or Windows Server 2008 R2.”
Want to connect to and run the SysInternals tools locally but don’t want to install them on your server or workstation ? Just use explorer to connect to \live.sysinternals.comtools and there they are.
Sometimes people write really excellent articles on the web. This is one of those occassions where an article needs nothing adding to it. If you set up labs to learn new technologies, study for exams or just to pre-flight technologies before you put them live and struggle to have certificates working “inside” and “outside” of your lab based environment, the article at http://www.windowsnetworking.com/articles_tutorials/Certificate-Revocation-Checking-Test-Labs.html walks you through publishing CRL’s (to an “external” server for example) or even turning off revocation checking so that its no longer an issue (only advisable in lab environments).
Great news. Microsoft have started to release news about SP 1 for Windows 2008 R2. Still slated for release in Q4, there are two major announcements for anyone interested in virtualisation – RemoteFX which essentially supercharges the vide experience for end users of Remote Desktop Services. So powerfullis this that for once Citrix will be licensing the Microsoft solution on graphics acceleration ratehr than the other way round. Read more about it here.
The other big announcement is dynamic memory allocation in Hyper-V. You can read about that here. VMWares “killer” feature has always been memory over commit. Essentially it just pages non used memory to the hard drive so in highly virtualised environments where VM’s need to use their RAM this can lead to excessive paging and poorly performing infrastructures. However, it is still the number 1 reason why people choose VMWare over other virtualisation vendors so even though, in my opinion, its not as great as its cracked up to be, if you ant to do virtualisation then you have to offer this functionality. The good news its, that’s one less reason to spend a fortune on VMWare if you are on a budget.
New in Windows 2008 R2 active directory is the concept of Active Directory Optional Features and the first of these which have been made available is the Recycle Bin feature. Ever since Active Directory was launched you have been able to recover individual deleted items by undertaking an authoritative restore of sections of the database, even down to an individual object. From 2003 onwards deleted objects have been tombstoned and you have been able to use the ADRestore tool (available to download from http://technet.microsoft.com/en-us/sysinternals/bb963906.aspx). However, the issue with these methods has always been with back links or, to put it another way, restoring these items with any group membership they had and, yes, it has been possible to do that with multiple authoritative restores of the database but that is at best tiresome and at worse can be dangerous. What the Recycle Bin feature does for you is restore with these back links / group memberships in place.
However, to use this feature the first thing you need to do is have your Forest at the Windows 2008 R2 level. Whilst your schema may be at the R2 level (meaning your forest can play host to 2008 R2 Domain Controllers) your domains and forest may still be running Domain Controllers with previous operating systems such as 2008 RTM or 2003 R2. The easy way to check your domain level in Windows 2008 R2 is to start the new Active Directory Administrative Centre. If you select the domain node on the left hand side (the netbios name of my domain is philipflint) then you will be able to check and raise the domain / forest functional levels in the action pane on the right hand side.
Click to Enlarge
If your forest level is not at Windows 2008 R2 you can raise it.
Click to Enlarge
We can now install the Recycle Bin feature. Care should be taken before undertaking the next procedure. Enabling the Recycle Bin feature for a domain / forest is a one way process with no way back. In a typical environment the recycle bin feature will grow the Active Directory database by 10 – 20% which may have an affect on performance especially in larger environments which many thousands of users where servers have been sized to run the complete database in RAM.
You should also note that, even though the Recycle Bin is an optional feature, it cannot be added as a Role Service nor as a Feature.
Click to Enlarge
Instead the role is enabled by running a command in PowerShell. PowerShell is installed by default Windows 2008 R2 servers. However, PowerShell itself has no knowledge of Active Directory. Instead we need to load up the scripts and Verbs that PowerShell needs to be aware of to connect and control Active Directory. There are two ways to do this. The first, and simplest, is to click on Start | All Programs | Administrative Tools | Active Directory Module for Windows PowerShell.
Click to Enlarge
The other alternative is to start PowerShell by clicking on the below icon on the taskbar and then running the command below to import the Active Directory modules.
Import-Module ActiveDirectory
Click to Enlarge
We can now enable the Recycle Bin Feature. Below is a piece of code that you can change to use in your environment.
I’ve highlighted in Red the three pieces of information you have to change. If you have a two tier domain name (such as .co.uk) then you will have to add another DC= section. An example is given below for a domain called philipflint.co.uk.
After amendment for the appropriate domain name variables this command is simply cut and paste into the PowerShell window.
Click to Enlarge
I was not given a chance to back out of the addition of the feature as I used the PowerShell switch –confirm:$false which provides any confirmation when asked. If you do not include this switch then you will be asked to confirm the action.
NOTE: This command needs to be run for each domain in your forest for which the Recycle Bin should be installed.
After synchronising the domain the Recycle Bin will be active on all Domain Controllers and you can now test it out by creating test OU’s and test users and deleting them and restoring them. I have created two users called ‘William Shakespeare‘ and ‘Enid Blyton’ in an OU called ‘Authors‘.
They are both members of the Global Group ‘Famous‘ and the Domain Local group ‘Published‘.
Click to Enlarge
We can now delete the William Shakespeare account.
Click to Enlarge
To restore a user that has been deleted I have provided a script for you below.
As before, simply change the section in Red with the display name of the user you want to restore. I use the logon name as its something that you can ask the user that they are likely to know but if they don’t know this (‘Its always there, I just enter my password’) then you can use another field which uniquely identifies them, their email address for example.
The user account is now restored along with all group memberships.
Click to Enlarge
Memberships below.
Click to Enlarge
Now, of course, its possible that a user may be deleted who is in an OU that has also been deleted. It is not possible to restore the user without first restoring the OU of which they were a member or, in extreme cases, the whole OU tree if multiple OU’s have been deleted.
Unless your records are up-to-date there is a chance that you may not know what your exact OU structure was and so you need a method of finding out what was the parent object of a deleted user. The code to do this is below.
As can be seen from the output, we can see that the last know parent (i.e. the containing OU for this user) was the Authors OU directly under the domain node. Note that the Authors OU has not been deleted and so the user object may be directly restored. Below is a screenshot with the same command but where the Authors OU has been deleted.
Click to Enlarge
In this case we can query the Authors OU to find its last known good parent until we find a containing object which has not been deleted.
Once we know which is the first object to be restored we can begin the restoration process. Previously I have given you the code to restore a user. The command to restore an OU is slightly different and I show it below.
Before Windows 2003 if you wanted to add functionality to a Windows Server you would have to access “Add / Remove Programs” in control panel and then “Add / Remove Windows Components” and choose which components to install. You may or may not have chosen the right components for what you were trying to achieve and you may have installed the correct dependencies (leading to a potentially unstable server if you didn’t) or, indeed, too many dependencies making your server less secure. This situation led to a high number of calls to Microsoft for “broken” software when, in reality, the solution had not been deployed correctly.
Because of this, from 2003 Microsoft onwards Microsoft introduced the “Configure your server” wizard which allowed users to add core functionality to a server with a reduced set of configuration options. That is, the wizard only installed those items necessary to get the server to do the chosen job. This not only led to more stable servers but also more secure servers.
This philosophy has now been extended out for Windows 2008 onwards such that a whole raft of functionality is no longer deployed by default leading to a more secure base server environment (secure by design). Instead, you have to expose this functionality to Windows Server if you want to use it and the wizard will then deploy that functionality for you without introducing flaws due to mis-configuration of the base requirements for a solution. This functionality has been encapsulated in two areas under Server Manager – Roles and Features. So, now you know how we got here, what’s the difference between the two ?
Well, its simple really, a role is something that the servers offers to someone else (clients) such as Logon (AD), IP addresses (DHCP), name resolution (DNS) etc. A feature is something the server consumes or uses itself, for example Network Load Balancing, Telnet Client, Failover Clustering etc. Now if you need to find a certain “feature” of Windows Server I hope this will help you know the most likely place to find it.
If you’ve selected to “Do not show this window at logon” and then can’t get back to the initial configuration taks pane in Windows Server 2008, simply click on the start button and type oobe.exe in the the search field and press return.
This command can also be run from a command prompt.
Philip Flint 