Discover what's new with Windows Server Management experiences
Monday, September 25, 2017 at 4:00pm in OCCC West Hall F1
Presenters: Samuel Li and Jeff Woolslayer

Sneak peek #4: Introducing Project “Honolulu”, our new Windows Server management experience

• High CPU on your WSUS server – 70-100% CPU in w3wp.exe hosting WsusPool
• High memory in the w3wp.exe process hosting the WsusPool – customers have reported memory usage approach 24GB
• Constant recycling of the W3wp.exe hosting the WsusPool (identifiable by the PID changing)
• Clients failing to scan with 8024401c (timeout) errors in the WindowsUpdate.log
• Mostly 500 errors for the /ClientWebService/Client.asmx requests in the IIS logs

System.Threading.ThreadAbortException: Thread was being aborted.

   at System.Buffer.__Memcpy(Byte* dest, Byte* src, Int32 len)

   at System.Buffer._Memcpy(Byte* dest, Byte* src, Int32 len)

   at System.Buffer.Memcpy(Byte* dest, Byte* src, Int32 len)

   at System.String.CtorCharPtrStartLength(Char* ptr, Int32 startIndex, Int32 length)

   at Microsoft.UpdateServices.Internal.CabUtilities.ExpandMemoryCabToString(Byte[] src)

   at Microsoft.UpdateServices.Internal.DataAccess.ExecuteSpGetCoreUpdateXml(Int32[] revisionIds)

   at Microsoft.UpdateServices.Internal.DataAccessCache.GetCoreUpdateXml(Int32[] revisionIds, 
DataAccess da, Int64 maxXmlPerRequest)

   at Microsoft.UpdateServices.Internal.ClientImplementation.GetSyncInfo(
Version clientProtocolVersion, DataAccess dataAccess, Hashtable stateTable, 
Hashtable deploymentTable, Boolean haveGroupsChanged, Boolean driverSyncNeeded, 
Boolean doChunking)

   at Microsoft.UpdateServices.Internal.ClientImplementation.SoftwareSync(DataAccess dataAccess, 
UnencryptedCookieData cookieData, Int32[] installedNonLeafUpdateIds, Int32[] leafUpdateIds, 
Boolean haveGroupsChanged, Boolean expressQuery, Guid[] filterCategoryIds, 
Boolean needTwoGroupOutOfScopeUpdates)

   at Microsoft.UpdateServices.Internal.ClientImplementation.SyncUpdates(Cookie cookie, 
SyncUpdateParameters parameters)

   at Microsoft.UpdateServices.Internal.ClientImplementation.SyncUpdates(Cookie cookie, 
SyncUpdateParameters parameters)

• WS2016/RS1: KB4039396
• WSUS 2012 R2 KB4039871
• WSUS2012: KB4039873
• WSUS 3.0 SP2: KB4039929

• Make a copy of \Program Files\Update Services\WebServices\ClientWebService\Web.Config.
• Open \Program Files\Update Services\WebServices\ClientWebService\Web.Config.
• Find the element “<httpRunTime”. It will look like this (in an unmodified web.config):

<httpRuntime maxRequestLength="4096" />

• Modify httpRunTime by adding an executionTimeout attribute:

<httpRuntime maxRequestLength="4096" executionTimeout="3600" />

• Save the web.config to a different location and copy the modified one into the directory.
• From an elevated command prompt, run IISReset to restart IIS.

• WSUS: Client Web Service | Cache Size counter for spgetcorexml instance.
• Process | Private Memory counters.
  • If there is more than one w3wp.exe, add them all – the one with the highest memory usage is probably the WSUSPool, but you can also add Process | ID Process to determine which worker process should be monitored.

For example, the WindowsPEX64 folder below

• C:\surface_laptop_drivers\SurfacePlatformInstaller\Drivers\System\GPIO
• C:\surface_laptop_drivers\SurfacePlatformInstaller\Drivers\System\SurfaceHidMiniDriver
• C:\surface_laptop_drivers\SurfacePlatformInstaller\Drivers\System\SurfaceSerialHubDriver

• Surface Studio ships with Hybrid Drive Configuration.  In order to talk to this drive configuration, you need the Intel Chipset SATA Raid Controller driver that ships with latest Surface Studio driver download.
• Surface Studio requires the use of the “Intel Chipset SATA Raid controller”, iastora.sys that ships in latest Surface Studio driver download.  It is not supported to use any version of this driver from other sources (Intel.com, other OEM vendors, etc.)
• Changing the configuration of the Hybrid Drive is not supported currently.  There is no mechanism in UEFI or any Microsoft supplied driver to change the cache size or disable the cache

• Latest Windows ADK is installed
• Latest Surface Studio .MSI is downloaded from here and extracted
  • msiexec /a SurfaceStudio_Win10_15063_1701606_0.msi targetdir=C:\SurfaceStudioDrivers /qn
  •  Note: When extracting driver files from the MSI, the destination folder (targetdir) must be different than the folder containing the MSI file.
• Windows 10 Version 1607 ISO (or later) contents are copied to USB drive E:\

1. Mount the boot image index #2(where setup runs from)
   • DISM /MOUNT-IMAGE /IMAGEFILE:E:\SOURCES\BOOT.WIM /INDEX:2 /MOUNTDIR:C:\MOUNT
2. Add the Intel Chipset SATA Raid Controller driver(iastora.sys) to the boot image
   • DISM /IMAGE:C:\MOUNT /ADD-DRIVER /DRIVER: C:\SURFACESTUDIODRIVERS\SURFACEPLATFORMINSTALLER\SURFACESTUDIO_WIN10_15063_1701606_0\DRIVERS\SYSTEM\RST_AHCI\IASTORAC.INF
3. Unmount the boot image and commit changes
   • DISM /UNMOUNT-IMAGE /MOUNTDIR:C:\MOUNT /COMMIT
4. Mount the install.wim image
   • DISM /MOUNT-IMAGE /IMAGEFILE:E:\SOURCES\INSTALL.WIM /INDEX:1 /MOUNTDIR:C:\MOUNT
5. Add the Intel Chipset SATA Raid Controller driver(iastora.sys) to the install image
   • DISM /IMAGE:C:\MOUNT /ADD-DRIVER /DRIVER: C:\SURFACESTUDIODRIVERS\SURFACEPLATFORMINSTALLER\SURFACESTUDIO_WIN10_15063_1701606_0\DRIVERS\SYSTEM\RST_AHCI\IASTORAC.INF
6. Unmount the install.wim and commit changes
   • DISM /UNMOUNT-IMAGE /MOUNTDIR:C:\MOUNT /COMMIT

1. Create Windows PE image
   • COPYPE.CMD AMD64 C:\WINPE_X64
2. Mount Windows PE image
   • DISM /MOUNT-WIM /WIMFILE:.C:\WINPE_X64\MEDIA\SOURCES\BOOT.WIM /INDEX:1 /MOUNTDIR:C:\WINPE_X64\MOUNT
3. Add the Intel Chipset SATA Raid Controller driver(iastora.sys) to the WinPE boot image
   • DISM /IMAGE:C:\WINPE_X64\MOUNT /ADD-DRIVER: C:\SURFACESTUDIODRIVERS\SURFACEPLATFORMINSTALLER\SURFACESTUDIO_WIN10_15063_1701606_0\DRIVERS\SYSTEM\RST_AHCI\IASTORAC.INF
4. Dismount the image
   • DISM /UNMOUNT-WIM /MOUNTDIR:C:\WINPE_X64 /COMMIT
5. Create the USB Windows PE image
   • MAKEWINPEMEDIA /UFD C:\WINPE_X64 E:

• These same steps would apply if you decided to deploy Windows 10 Professional instead of Enterprise
• These same steps would apply if you want to deploy Windows 10 Version 1607(Anniversary update/RS1). Surface Studio requires at least Windows 10 1607

• Copy SurfaceStudio_Win10_15063_1701606_0.msi to c:\bin
• At elevated cmd prompt run the following:
  • msiexec /a c:\bin\SurfaceStudio_Win10_15063_1701606_0.msi targetdir=C:\SurfaceStudioDrivers /qn

• Under operating systems create folder structure SourceFiles\Windows 10 Enterprise 1703 X64
• Right click “Windows 10 Enterprise 1703 X64” and choose import operating system
• Browse to Windows 10 Enterprise 1703 ISO mounted to DVD drive

Step 3:  Add latest cumulative update

• Go to the Windows 10 Update history page
• Locate the latest cumulative update for the operating system you are deploying
• Download the update (*.msu) from the Microsoft Update catalog and put it in a folder, c:\update
• Right click packages and choose import OS package
• Browse to c:\update
• Choose Finish

• Under “Out of box drivers” create folder called WindowsPEX64
• Under “Out of box drivers” create folder structure Windows10\x64\Surface Studio
• Right click “Surface Studio” and choose import drivers
• Browse to c:\SurfaceStudioDrivers

• Under Advanced configuration right click selection profile and choose “New selection profile”
• Name the selection profile WindowsPEX64
• Choose the WindowsPEX64 folder under Out Of Box Drivers

• Right click WindowsPEX64 and choose import drivers
• Browse to C:\SurfaceStudioDrivers\SurfacePlatformInstaller\SurfaceStudio_Win10_1701006_0\Drivers\System\RST_AHCI
• Right click WindowsPEX64 and choose import drivers
• Browse to C:\SurfaceSTudioDrivers\SurfacePlatformInstaller\SurfaceStudio_Win10_1701006_0\Drivers\Network\Ethernet

• Right click the Deployment Share and choose properties
• Click the WindowsPE tab
• Click Drivers and Patches
• Choose X64 for platform.  NOTE:  Make sure you are configuring X64
• For selection profile choose WindowsPEX64

• Right click Task Sequences and choose “new task sequence.  Set the following options:
  • Task Sequence ID:  1
  • Task Sequence Name: “Build Windows 10 Enterprise 1703”
  • Standard Client Task Sequence
  • Choose the Windows 10 Enterprise 1703 source files install.wim
  • Do not specify product key
  • Set your organization
  • Set local admin password

• Right click “Build Windows 10 Enterprise 1703” task sequence and choose properties
• Click Task Sequence tab
• Under Preinstall section choose Enable Bitlocker (offline)
• Click add, general, set task sequence variable
• Set:
  • Name:  Set DriverGroup001 to Model
  • Task Sequence Variable:  DriverGroup001
  • Value:  Windows10\X64\%model%

• Choose Apply
• Choose the Inject Drivers step
• Set “Choose a selection profile” to nothing
• Choose “install all drivers from the selection profile”

• Right click the deployment share and choose “Update Deployment Share”
• Choose “completely regenerate the boot images”
• This updates the Lite Touch boot images located in \DeploymentShare\Boot

• Import Lite Touch Images(DeploymentShare\Boot\LiteTouchPE_X64.wim) into your Windows Deployment Server (WDS) and PXE boot.
• Boot Lite Touch from USB drive (which connects back to your MDT server over network)
• Create MDT Media deployment on USB drive.  This is basically a copy of your entire deployment share on USB drive and does not require any network connectivity back to MDT server.  See steps below for creating

• Under Advanced Config right click Selection Profile, choose new selection profile
• Name it “Offline Media Deployment 1703”
• Choose these folders

Note:  Be sure and choose all folders noted

• Choose Ok
• Create a folder c:\mediadeployment
• Under Advanced Config, right click media and choose “new media”
• Choose the “Offline Media Deployment 1703” selection Profile
• Choose c:\mediadeployment

• Click the Windows PE tab
• Choose X64 platform.  NOTE:  Be sure and choose X64
• Choose Drivers and patches tab
• Set the selection profile to WindowsPEX64

• Choose OK
• Right mouse click Media001 and choose Update Media Content
• This will create the following files/folders:

• Format a USB drive as FAT32
• Copy everything under the content folder to the root of the USB drive
• You can now boot from this USB drive on Surface Studio and do your deployment

• When PXE booting Lite Touch you will have to use the OSK keyboard (located in lower right corner of screen) or physical USB keyboard to press Enter if required by your PXE server.
• During Lite Touch, touch is available to choose options but in order to type in credentials or other information you will need a physical USB keyboard attached.  It is possible to fully automate Lite Touch by adding appropriate entries into customsettings.ini
• The keyboard and mouse included with Surface Studio are Bluetooth and require pairing once setup is complete.

• WinRM runs as NETWORK SERVICE, while the Virtual Machine Management Service (VMMS) runs as SYSTEM.
• The way WinRM does inbound authentication stores the nice, forwardable Kerberos ticket in a location that is unavailable to NETWORK SERVICE.

1. Enable Delegation Trust this computer for delegation to specified services only “Use any authentication protocol” on the core server object (CORE2016) in Active Directory.
2. Add SPN cifs/2016GUI [GUI server]
3. Restart the server for the changes to take effect or run gpupdate /force on all servers involved.

1. Enable Delegation Trust this computer for delegation to specified services only “Use any authentication protocol” on the core server object (CORE2016) in Active Directory. Do this for all CORE cluster nodes.
2. Add SPN cifs/SOFS2016 [SOFS network name]
3. Restart the server for the changes to take effect or run gpupdate /force on all servers involved.

1. In the Nodes view of Failover Cluster Manager, right-click on the node where the Failover Clustering feature is being uninstalled, select More Actions > Evict, and wait for the node to be removed from the Nodes view.
2. Open Server Manager and click Manage > Remove Roles and Features.
   • If prompted, click Next on the “Before you begin” window.
3. Select the server where the Failover Clustering feature is being uninstalled, and click Next.
4. Click Next on the “Remove server roles” window.
5. On the “Remove features” window, deselect the checkbox next to “Failover Clustering” and click Next.
   • If prompted, deselect the checkbox next to “Remove management tools (if applicable)” to retain the Failover Cluster Management Tools and PowerShell modules, if desired, and click Continue.
6. On the “Remove features” window, click Next.
7. Select the checkbox next to “Restart the destination server automatically if required”, and confirm that the server will be restarted if required if prompted before clicking Remove.
8. The server will be rebooted when the feature is successfully removed.

1. Open Server Manager and click Manage>Add Roles and Features.
2. If prompted, click Next on the “Before you begin” and “Select installation type” windows, then select the server on which the Failover Clustering feature is to be installed.
3. Click Next on the “Select server roles” window.
4. Select Failover Clustering on the “Select features” window, and click Next.
   • If prompted, select the checkbox next to “Include management tools (if applicable)” to install the Failover Cluster Management Tools and PowerShell modules, if desired, and click “Add Features”.
5. Select the checkbox next to “Restart the destination server automatically if required”, and confirm that the server will be restarted if required if prompted before clicking Install.
6. The server will be rebooted when the Feature is successfully installed.
7. When the reboot is complete, open Failover Cluster Manager, Click “Add Node”, and follow the instructions in the “Add Node Wizard” to add the node to a cluster.

Import-Module FailoverClusters Import-Module ServerManager

1. Run the following command to evict the node where the Failover Clustering feature is being uninstalled: Remove-ClusterNode -Cluster <clustername> <nodename>
   • Select Yes if prompted for confirmation.
2. Run the following command to confirm that the desired node is not listed as a member of the cluster: Get-ClusterNode -Cluster <clustername>
3. Run the following command to remove the Failover Clustering feature from and reboot the desired node: Remove-WindowsFeature Failover-Clustering -ComputerName <nodename> -Restart

Import-Module FailoverClusters Import-Module ServerManager

1. Run the following command to remove the Failover Clustering feature from and reboot the desired node: Install-WindowsFeature Failover-Clustering -ComputerName <nodename> -Restart
2. When the reboot is complete, run the following command to add the node back to a cluster: Add-ClusterNode -Cluster <clustername> <nodename>
3. Run the following command to confirm that the desired node is listed as a member of the cluster: Get-ClusterNode -Cluster <clustername>