I ran into an issue on my new notebook "Lennovo W520" that runs Windows Server 2008 R2 w/ SP1. I configured Hyper-V and start building my own Labs. i was happy to build a 24 VM's with different technologies in one day :). so I was tired and i went to sleep, but before that i saved all my created VM's so next day i continue working on my personal Lab.

but, and while am drinking my lovely Coffe Morning, I switch on my laptop and fired up my VM console, and bring all the VM's into running state from the saved mode, but when i tried to connect to these VM's by double click on any of the VM's, i start getting this anoying error:

“Cannot find the physical computer that runs the virtual machine. Try to flush your DNS cache (run ipconfig /flushdns). Then try to connect again. If the problem persists, contact the administrator of the physical computer or your network administrator”

after a quick search over the net, I found that this problem happens if you have DirectAccess Service Enabled and Configured on your Hyper-V Host Server (or notebook as in my case), here is the link for a full description of the problem and the How-To:

https://blogs.msdn.com/b/thompal/archive/2009/11/06/hyper-v-virtual-machine-connection-and-direct-access.aspx

basically what you need to do is either:

1.Quick Workarround :  A less drastic fix, if you happen to have the DirectAccess Connectivity Assistant installed and configured is to right-click the DCA icon in the WIndows taskbar and select "Prefer Local DNS Names". This too clears the NRPT cache from the local computer and gets you around this problem. Re-enabling DirectAccess can be accomplished by right-clicking DCA again and selecting "Prefer Corporation DNS Names"

2. Another Solution: from the Hyper-V Host Server do the following:

- go into the Registry and delete "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\DnsPolicyConfig"   
- in an elevated command prompt, enter: sc control dnscache paramchange

After that the “Virtual Machine Connection” was working fine.

Bit of Background

In the ideal Intra-Forest migration you are consolidating accounts and resources from one domain to another.  The main difference between inter-forest and intra-forest migration is that in intra-forest accounts move (not copy).  How does this create a problem for what I was doing? Well, users in the source domain also had exactly the same SAMAccount name in the target domain and both these accounts are in active use by the same user. All resource access is performed using group access in both source and target domains.

Since the objective of the consolidation is to use the target domain, the majority of the applications users access including Exchange are accessed using the existing account in the target domain, so the target user account will be the account that will be used by all users after consolidation.

Ok, you may say, ADMT has a merge option for migrating user accounts – but this is not available for intra-forest migration. So we can’t do that.  So, what can we do?

Migration Strategy

So the migration strategy that we decided on was as follows:

1) Convert all Global Groups in Source domain to Universal Groups

2) Migrate these Groups to the Target domain

3) Add Target domain “duplicate” accounts to the migrated universal groups

4) Migration Workstation to target domain using ADMT

5)Translate User profile to allow the target account to use the source users profile

6)Migrate Server resources using ADMT.

So steps 1,2,3,4 and 6 are straightforward and can be performed using simple administrative procedures or ADMT, step 5 is not straightforward and this is what the remainder of this post will discuss.

Translating the user profile

This step becomes an issue because normally we would use ADMT to translate the ACLs and profile.  Since we haven’t ADMT’d the user account, when we log on to the workstation with the target account it creates a new profile – this is not what we want.  We want the user to log on to the workstation with the target domain user account and get the profile that they had when they were logging on with the source domain account.

We can do this manually but for a lot of users this means a lot of desktop interaction, testing and making sure that users profile is there.  Ideally as part of the migration process we want this as automated as possible.

Scripting the translation

So I wanted to find a way of scripting this process. So I did a search on the internet and found the following article which did the bulk of what I wanted to do for me.

https://www.pcreview.co.uk/forums/thread-112155.php

It was published back in 2004 and a lot of work was done to get the profile translation right.  In that case, the scenario was translating a workgroup account to allow a new workgroup user to access an existing profile.  So some work needed to be done make it work in an intra-forest migration scenario. The script is principally targeting Windows XP clients. Some work still needs to be done to simplify it and make it work the way we want – but it works!

The script

The script is in the form of a batch file that should be executed using an administrative account as follows:

profiler.bat <target NetBIOS domain Name> <username>

In the script you will notice <srcdomain> – this is the NetBIOS name of the source domain and a reference to a usertosid.vbs script as well as other utilities subinacl and setacl.

The content of the batch file is follows:

subinacl /subdirec “c:\documents and settings\%2” /setowner=%1\%2
subinacl /subdirec “c:\documents and settings\%2 /replace=<srcdomain>\%2=%1\%2
subinacl /subdirec “c:\documents and settings\%2\*.*” /setowner=%1\%2
subinacl /subdirec “c:\documents and settings\%2\*.* /replace=<srcdomain>\%2=%1\%2
c:\windows\system32\reg load hku\script_user “c:\documents and settings\%2\ntuser.dat”
setacl users\script_user /registry /grant %1\%2 /full /r:cont_obj /silent
c”\windows\system32\reg unload hku\script_user
for /f %%1 in (‘cscript /nologo usertosid.vbs “%2”’) do set sid=%%i
echo Windows Registry Editor Version 5.00 > temp.reg
echo. >> temp.reg
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\%sid%] >> temp.reg
echo “ProfileImagePath”=”c:\\documents and settings\\%2” >> temp.reg
echo. >> temp.reg
regedit /s temp.reg
del temp.reg

Batch File Components

subinacl is a Microsoft utility,the package should be installed on the system running the script and can be found here, :

https://www.microsoft.com/downloads/en/details.aspx?FamilyID=e8ba3e56-d8fe-4a91-93cf-ed6985e3927b&displaylang=en

setacl is a third party utility and should be in the folder where the script is being run and can be found here:

https://helgeklein.com/download/

(note that hopefully I will use subinacl to replace this command in a future update)

usertosid.vbs

This script is based on this post: https://www.winvistatips.com/re-get-user-sid-t749526.html

and as is listed as follows:

' user2sid.vbs
'
' Author: MagicWorm
' https://magicw.secuz.org
' Date: 2003-08-22
''''''''''''''''''''''''''''''''''''
Const GENERAL_FAILURE = 2
Dim ArgObj ' Object which contains the command line argument
Dim Args(10) ' Array that contains all of the non-global arguments
Dim ArgCount ' Tracks the size of the Args array
Dim strComputer
Dim Account
Set ArgObj = WScript.Arguments
If ArgObj.Count < 1 or ArgObj.Count >2 Then
DisplayHelpMessage
WScript.Quit (GENERAL_FAILURE)
End If
Select Case ArgObj.Count
Case 1
strComputer = "."
Account = argObj(0)
Case 2
strComputer = argObj (0)
Account = argObj(1)
End Select

On Error Resume Next
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set colItems = objWMIService.ExecQuery("Select * from Win32_Account where Name = '" & Account & "'" )
For Each objItem in colItems
Wscript.Echo objItem.SID
Next

''''''''''''''''''''''''''''
'
' Display Help Message
'
''''''''''''''''''''''''''''
Sub DisplayHelpMessage()
WScript.Echo
WScript.Echo UCase(WScript.ScriptName) & " By MagicWorm"
WScript.Echo "https://magicw.secuz.org"
WScript.Echo String(80, "_")
WScript.Echo "The goal of the utility is to obtain SID from the account
name, usage:"
WScript.Echo
WScript.Echo UCase(WScript.ScriptName) & " [computer_name]
account_name"
WScript.Echo
WScript.Echo "where computer_name is optional. By default, the search"
WScript.Echo "starts at a local Windows NT computer."
End Sub

I have replaced the section

On Error Resume Next
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set colItems = objWMIService.ExecQuery("Select * from Win32_Account where Name = '" & Account & "'" )
For Each objItem in colItems
Wscript.Echo objItem.SID
Next

with

On Error Resume Next
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set objaccount = objWMIServce.Get(“Win32_UserAccount.Name=’”& Account &”’, Domain=’<targetdomain>’”)
Wscript.Echo objaccount.SID
Next

This replacement I got from The Scripting Guys

https://blogs.technet.com/b/heyscriptingguy/archive/2004/12/03/how-can-i-determine-the-sid-for-a-user-account.aspx

The reason this replacement was made is because the original script finds the SID of the computer as well, I don’t want that, I want the SID of account in the target domain.

Explaining What the Script does to the Profile:

subinacl /subdirec “c:\documents and settings\%2” /setowner=%1\%2
subinacl /subdirec “c:\documents and settings\%2 /replace=<srcdomain>\%2=%1\%2
subinacl /subdirec “c:\documents and settings\%2\*.*” /setowner=%1\%2
subinacl /subdirec “c:\documents and settings\%2\*.* /replace=<srcdomain>\%2=%1\%2

This section sets the owner of the target account on the profile and replaces the SID from the source domain with the SID of the account from the target domain

c:\windows\system32\reg load hku\script_user “c:\documents and settings\%2\ntuser.dat”
setacl users\script_user /registry /grant %1\%2 /full /r:cont_obj /silent
c”\windows\system32\reg unload hku\script_user

This section sets permissions on NTUser.dat for the profile

for /f %%1 in (‘cscript /nologo usertosid.vbs “%2”’) do set sid=%%i
echo Windows Registry Editor Version 5.00 > temp.reg
echo. >> temp.reg
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\%sid%] >> temp.reg
echo “ProfileImagePath”=”c:\\documents and settings\\%2” >> temp.reg
echo. >> temp.reg
regedit /s temp.reg
del temp.reg

This section sets the SID of the target domain account in the profilelist in the registry.  This must be in the registry or a new profile will be generated.

Summary

So this is the first effort I’ve put together for the script that works, There does need to be some changes around automation but it works very nicely.  Users can log on with the new account and get their old profile with absolutely no issues and that was primarily the goal.  If any updates are done to the script I will post updates.

I hope people who come across this post find it useful.

Cheers

Jon

Here is the link for the Downloadable White Paper (WP) :

WP: Publishing Exchange Server 2010 with Forefront Unified Access Gateway 2010 and Forefront Threat Management Gateway 2010

Key Hyper-V Cloud Programs that you want to understand:

• Hyper-V Cloud Deployment Guides To help you get started building your own private cloud with Microsoft products.
• Hyper-V Cloud Fast Track  For pre-validated configurations from Microsoft and OEM server partners.
• Hyper-V Cloud Service Providers For partners who can host a dedicated private cloud for you.

To help you deploy commercial private and public clouds based on Windows Server 2008 R2 Hyper-V, System Center, and related products, Microsoft offers a set of programs and initiatives called Hyper-V Cloud. These programs can help you:

• Build your own private cloud with help from the Hyper-V Cloud Deployment Guides and Hyper-V Cloud partners.
• Get a pre-validated private cloud configuration from Hyper-V Cloud Fast Track OEM partners. Hyper-V Cloud Fast Track partners have worked with Microsoft to combine hardware and software offerings based on a reference architecture for building private clouds.
• Find a service provider in the Hyper-V Cloud Service Provider Program who can host a dedicated private cloud for you.

Microsoft is also investing in a set of engagements to help customers with IaaS assessments, proofs-of-concept, and deployments with help from our partners or Microsoft Services. The investments are designed to help reduce the risk, cost, and time associated with testing and deploying a cloud environment.  Deploying Microsoft’s private cloud infrastructure also positions you to take advantage of the Windows Azure public cloud platform through powerful identity, development, and management tools. These tools span across private and public cloud environments so that you can more easily build, migrate, or extend out to the public cloud and benefit from virtually unlimited scale and even greater efficiencies whenever you need it.

So what happens when you get to a customer site and you need to get information on how many servers a customer has in their Active Directory including the Server OS Version and Service Pack level?  You turn to the Microsoft Assessment and Planning Tool…..yeah then you run it and you find that all the ports are blocked and you’re not getting any good information out…….what do you turn to?

Active Directory Users and Computers of course! Ok, you can do this the long way or the short way.  You can go an manually one by one on each server and note down each server in turn but that’s going to take ages, so what about Active Directory queries?  Ah haaaaa – Yes!

So I created a custom query based on Computer –> Operating System starts with “Windows Server”.  This listed all the servers in the domain but still didn’t tell me what OS or Service Pack level was.  There had to be a way and then after a quick search of the web I found this article that solved my problem:

Thank you Pber! https://www.pberblog.com/post/2009/06/21/Add-extra-columns-to-Active-Directory-Users-and-Computers-display.aspx

What this told me was the methodology to add new columns to Active Directory Users and Computers.  So I wanted to see Operating System and Service Pack level.  Using Pber’s methods I modified the default display specifiers extracolumns attribute as follows:

operatingSystem,Operating System,0,-1,0

operatingSystemServicePack,Service Pack,0,-1,0

After Restarting Active Directory Users and Computers I could add the New Columns for Operating System and Service Pack.  Problem Sorted.  This works nicely for AD queries.  As Pber notes in his blog this doesn’t work at OU level and you have to modify the organizationalunit specifiers.

Job done I get a list of servers with all their OS versions and Service Pack levels – sorted!

That’s it – hope this helps anybody stumbling across this.

Microsoft Windows Enterprise: MED-V

Microsoft Desktop Optimization Pack (MDOP) Technologies TechCenter

TechNet: Microsoft Enterprise Desktop Virtualization

The Official MDOP Blog

While working with MED-V I can across a couple of issues that will probably affect most other users of MED-V.

1. When a second user logs on the a desktop running the MED-V client there are permissions issues.with the workspace which means it fails to start resulting in the workspace failing to start for any subsequent users.  I worked out that there are file permission issues which I resolved by giving Domain Users Full Control of the folders, but the workspace fail to load - There is a workaround for the multi-user scenario. This is no longer required in MED-V v2 as shared workspaces are supported out-of-the-box.
2. Some applications fail when the Windows XP Mode image uses NAT (Shared Networking) - Here is an article on the MED-V blog that might be helpful in troubleshooting failure to connect to domain resources using NAT.
3. The client has multple IE6 based applications, but MED-V isn't granular enough when it comes to chosing which websites must be viewed using Windows XP Mode.  The options MED-V provides are Domain Suffix, IP Suffix, or All Local Addresses.  How can I configure MED-V web rules for specific websites, primarily internal websites but with/without the domain suffix? - MED-V v2.0 will be offering much more granularity for redirection. There is no workaround for 1.0 unless the MED-V administrators also control DNS and can make adjustments there (such as  adding CNAMES).  Here is the v2.0 Beta announcement which talks about where you can register and download the code and also mentions the options for Internet Explorer redirection in v2.0.

I hope you find this information informative.

There are many variables to consider when estimating network traffic. Some of these variables are:

• The services that your company has subscribed to
• The number of client computers in use at one time
• The type of task each client computer is performing
• The performance of your Internet browser software
• The capacity of the network connections and network segments associated with each client computer
• Your company’s network topology and the capacity of the various pieces of network hardware

This guidance provide guidelines for estimating the bandwidth usage of each service. Read the guidance here

We are pleased to announce the availability of the Release Candidate (RC) of the Monitoring Management Pack (MP) for Windows Azure (version 6.1.7686.0), which can be immediately deployed by customers running System Center Operations Manager 2007 and Operations Manager 2007 R2

Customers should head to the MP page on Microsoft Pinpoint to find more information on the MP, as well as download the bits (due to replication times, some customers may have to wait up to 24 hours from this notice before being able to download the bits).  Customers who download the MP will be supported by Microsoft in their production deployments.

To answer some immediate questions on the management pack and its capabilities:

Q. What does the Windows Azure MP do?
A. The Windows Azure MP includes the following capabilities:

• Discovery of Windows Azure applications.
• Status of each role instance.
• Collection and monitoring performance information.
• Collection and monitoring of Windows events.
• Collection and monitoring of the .NET Framework trace messages from each role instance.
• Grooming of performance, event, and the .NET Framework trace data from Windows Azure storage account.
• Change the number of role instances.

Q. Why is the Azure Management Pack a Release Candidate (RC) and not RTW?
A. We have released this as an RC as we work to implement new monitoring scenarios in the cloud.

Q. When will the RTW version of the Azure Management Pack be available?
A. We expect to make it available in H1 CY2011

Q. Is this MP supported in production deployments?
A. Yes the Release Candidate of the Azure Management Pack will be supported for customers using it in production deployments.

The poster helps you understand how the major components of Exchange 2010 work and serves as a quick reminder and a learning tool. The printed version also looks really impressive on your wall!

Head over to the Download Center to download the Exchange Server 2010 Architecture Poster (PDF).