War Room - notes from the field

Copy VHD / data files into a CSV Disk -w2k8 r2

Hugofe — Wed, 09 Jan 2013 02:07:27 GMT

Copy VHD / data files into a CSV Disk

We need to use the Coordinator Node

Remember that CSV is optimized for running VM's, so using other tools and mechanisms... such as doing local copies to and from CSV disks from the partent partition is a very poor way to evaluate the performance.

This is expected behavior. Understanding read-writes and what happens when you copy between non-owner nodes will help you out.

What I do is if I need to copy data between CSV's is move the CSV resources to the same node and then copy,

With Cluster Shared Volumes (CSV) one of the nodes in the cluster is responsible for synchronization of access to files on a shared volume. This is the node which currently owns the cluster ‘Physical Disk’ resource associated with that LUN, which is referred to as the Coordinator node. Each LUN can have its own coordinator and all nodes are equal and could be a coordinator, so it could be any node. When a VM is deployed and running on a CSV volume almost all of Hyper-V’s access to VHD files associated with a VM go directly to the disk and the coordinator node is not involved. This enables VMs to have fast direct access and give great performance for the VM and the applications running within the VM. So it really doesn’t matter which node is the coordinator or where VM’s are running.

With Windows Server 2008 R2 one exception to that happens when you are copying VHD files to CSV volumes as you create and deploy your VMs. As you copy/create the VHD files to a CSV volume, those writes to the disk are extending write operations, and, as a result, they are redirected over the network to the coordinator node. This can result in it taking longer to copy the file. The moral of the story is that when you are going to do a file copy to a CSV volume, to get the greatest performance it is best to do the copy on the coordinator node if you are doing a local copy. If you are doing a remote copy over the network, it’s best to have the coordinator node be the target of the copy. You can view the current owner or even move ownership of Physical Disk resources from one node to another with the Failover Cluster manager snap-in (CluAdmin.msc) or PowerShell. So you can make whatever node you are on the coordinator.

Note: With Windows Server 2012 an extending write operation will be done with direct I/O, and these considerations do not apply.

On that node, the writes are all local writes because it is the coordinator itself.

From the other node, the writes are actually redirected over the network to Node1 (because they are extending writes to the file).

So, what does that really mean?

The bottom line here is that if you’re trying to make copies of files to CSV and you want to get this copy to complete in the fastest possible time, make sure you do the copy on the coordinator node.

Best practices for migration of cluster windows 2008 R2 / 2012 - As melhores Praticas para migrar um Cluster de Windows 2008 para Windows 2012

Hugofe — Thu, 06 Dec 2012 01:13:50 GMT

This one is based on a collection of several information available,

Windows Svr 2012 - best practices for migration of cluster win2008 R2 with the role of HyperV available to win 2012 with the role of HyperV

Currently, has a cluster of 4 nodes with win 2008 R2 and the role of HyperV available and needs to know steps to migrate this cluster to win2012 with HyperV.

From a OS perspective we can migrate from w2k8 r2 to w2k12,

however from a feature perspective there is not a migration of the cluster from one version to the other,

So based on this the best option would be to around moving the resources to a group of 2 nodes (w2k8r2) and then build a separated cluster with w2k12,

After this we can migrate from w2k8 to w2k12

After the migration ends we can add the remaining w2k8 r2 nodes to the w2k12 cluster and therefore continue to have a 4 node cluster

· Is there a way to migrate a cluster partially.?

1. evict two of the nodes from the old Cluster.

2. Rebuild them from scratch along with the new machine with Server 2012.

3. Add Hyper-V and Cluster roles and create a new Cluster to the new ones.

4. Run the Cluster Migration Wizard to migrate all the VMs from the old to the new.

5. Destroy the old Cluster.

6. Rebuild the old nodes with Server 2012 and join them to the new Cluster.

How to Move Highly Available (Clustered) VMs to Windows Server 2012 with the Cluster Migration Wizard

The Windows Server 2012 Cluster Migration Wizard is a powerful and time-saving tool that copies cluster roles from a source cluster to a target cluster.

Although the Cluster Migration Wizard can move almost any clustered workload to Windows Server 2012, we get many questions about migrating highly available virtual machines (HA VMs).

There are two ways that you will be able to move HA VMs to a Windows Server 2012 Failover Cluster:

1. Windows Server 2012 Cluster Migration Wizard integrated into the Failover Clustering feature

2. System Center Virtual Machine Manager 2012 (SCVMM 2012) with Service Pack 1

Depending on what operating system version you are running today, there are some considerations:

Tool	Migrate Clustered VMs	Migrate Clustered VMs from Windows Server 2008 R2 SP1 to Window Server 2012	Move Clustered VMs from Windows Server 2008 SP2 to Windows Server 2012
Windows Server 2012 Failover Clustering Cluster Migration Wizard	Yes	Yes	Yes
System Center Virtual Machine Manager 2012 (SCVMM 2012)	Yes	Yes	No

Note: Live Migration of virtual machines (VMs) from Windows Server 2008 R2 to Windows Server 2012 is not supported.

As a result, migrating VMs to Windows Server 2012 can be fast, but it is not a zero-downtime event - a brief maintenance window is required to cut over to the new cluster roles.

Fortunately, cluster migration can be tested with no impact to a running cluster, so that issues can be identified prior to actual migration.

Windows Server 2012 Cluster Migration Wizard Source and Target OS Versions

The Windows Server 2012 Cluster Migration Wizard will move VMs from the following Windows Server OS versions:

Source Cluster Node OS	Target Cluster Node OS
Windows Server 2008 SP2	Windows Server 2012
Windows Server 2008 R2 SP1	Windows Server 2012
Windows Server 2012	Windows Server 2012

Note: The Windows Server 2012 Cluster Migration Wizard requires that the latest service packs be installed on the source clusters. Windows Server 2008 clusters are required to be upgraded to Service Pack 2 prior to migration. Windows Server 2008 R2 clusters are required to be upgraded to Service Pack 1 prior to migration.

Migration for Highly Available (Clustered) Hyper-V VMs

The following steps are required to prepare a new (target) cluster for the Cluster Migration Wizard – it may typically take approximately two hours to prepare a new Windows Server 2012 cluster with a small number of nodes. Here is an overview of the process:

1. The new (target) cluster nodes need to be physically configured (network, storage) – or in the case of cluster virtualization, the virtual network and storage settings of the VMs need to be configured. Ideally, both the old (source) cluster and the new (target) cluster will see common shared storage– storage can be reused and this will allow for the smoothest migration

2. Windows Server 2012 needs to be installed on all of the nodes in the cluster target cluster, and the Hyper-V Server Role and Failover Clustering feature should be installed on all nodes as well.

3. Create the new Windows Server 2012 target cluster using the Failover Cluster Manager or the New-Cluster PowerShell cmdlet.

4. Launch the Cluster Migration Wizard from the Failover Cluster Manager, select the source cluster, and then select the cluster roles on the source cluster that you’d like to migrate to the new cluster.

5. The Pre-Migration Report will identify issues that can impact migration of the selected cluster roles. After migrating, a Post-Migration Report will identify any manual steps that are needed to bring the cluster online.

6. The new cluster roles are always created offline - when VMs and users are ready, the following steps should be used during a maintenance window:

i. The source VMs should be shut down and turned off.

ii. The source cluster CSV volumes that have been migrated should be off-lined.

iii. The storage that is common to both clusters (LUNS) should be masked (hidden) from the source cluster, to prevent accidental usage by both clusters.

iv. The storage that is common to both clusters (LUNS) should be presented to the new cluster.

v. The CSV volumes on the target cluster should be on-lined.

vi. The VMs on the target cluster should be on-lined.

vii. VMs are migrated and ready for use!

Note: If one VM on a CSV disk is selected for migration, the Cluster Migration Wizard will require all VMs (and auto-select them for you) on that CSV to be migrated too.

Walk Through: Migrating a HA VM from Windows Server 2008 R2 to Windows Server 2012

A. Let’s assume that we’ve completed the planning steps 1-3 above, and that we have a Highly Available VM running on a Windows Server 2008 R2 cluster – the source cluster - notice that the VM is running, and that it depends on a CSV disk resource:

B. On the Windows Server 2012 cluster – the target cluster - from the Failover Cluster Manger, select a cluster and then use the More Actions | Migrate Roles… menu to launch the Cluster Migration Wizard:

C. The Cluster Migration Wizard (Migrate a Cluster Wizard) will appear – press Next:

D. Specify the name of the source cluster – press Next:

E. The source cluster (Windows Server 2008 R2) will be scanned, and the resources that can be moved will be identified – here I have selected the VM called “VHD_CSV”:

F. After pressing Next, we see that the Migration Wizard will prompt us for the Virtual Network Switch that the VM should use on the new (target) cluster – here I use the drop-down menu and select “Destination Lab Private”:

G. Pressing View Report will display the Pre-Migration Report – this will show you the Cluster Migration Wizard’s analysis of the cluster roles that can be migrated. Note that the Cluster Group and Available Storage are never migrated:

H. When you are ready to migrate the resources, press Next:

I. After migrating resources, the Post-Migration Report is displayed in the dialog:

J. By pressing View Report, the full report will be displayed in the default browser:

K. Note that there are two new resources on the target cluster – identical to the source cluster. Under Roles, you will see the VHD_CSV VM – note that it is Off. Migrated VMs are always initially set to off on the Target clusters, this allows you to pre-stage the new cluster, but to control when to make the cut over:

L. Under Storage then Disks, you will see the VHD_CSV-disk Physical Disk resource that was copied to the target cluster:

M. Now that the target cluster has been pre-staged, use the following steps during a maintenance window to cut over to the new Windows Server 2012 cluster:

1. Shutdown all VMs on the source Windows Server 2008 R2 cluster that have been migrated.

2. Configure the storage:

a. Unmask the common shared storage (LUNs) so that they are not presented to the Windows Server 2008 R2source cluster

Note: Data could become corrupt if they are presented to multiple clusters at the same time.

b. Mask the common shared storage (LUNs) to the Windows Server 2012 target cluster.

3. Start all VMs on the target Windows Server 2012 cluster.

Summary

In Windows Server 2012, the Cluster Migration Wizard is a powerful tool that provides agility and flexibility to customers using highly available VMs on Failover Clusters.

https://technet.microsoft.com/en-us/library/jj592687.aspx

https://technet.microsoft.com/en-us/library/jj574226.aspx

WINDOWS 2008 / 2008 R2 SAN Migration

Hugofe — Wed, 04 Jul 2012 06:09:14 GMT

Some of the Cluster Recovery functionality is built into Windows 2008 Failover Clustering.

Say I have 4 disks in the Cluster (1 witness and 3 data) and I want to replace them with new ones.

Quorum Type,

Here are the steps I would take. Please ensure all nodes are up and functioning in the Cluster.
1. Change the Quorum Setting from Witness to Node Majority.
a. Right Mouse Click the name of the Cluster on left and choose PROPERTIES
b. Choose MORE ACTIONS
c. Choose CONFIGURE CLUSTER QUORUM SETTINGS
d. Select NODE MAJORITY
e. FINISH

Disk Resources

“How do I replace a disk?”

I’ll walkthrough the process of replacing a 1GB disk with a 2GB disk.

This process is similar to how you could go about doing a SAN migration where you are replacing all of your shared disks with storage from a new SAN.

The preferred way of getting a larger cluster disk is to use the built in capability of most SANs to dynamically expand a LUN then use an OS utility like DiskPart or Disk Manager to extend the size of the disk.

If that’s not feasible or you simply want to replace a LUN with a larger one or as I mentioned, as part of a SAN migration, this process works well.

2.1:

The first thing we need to do is present your new disk to the cluster.

The nuts and bolts of how to do that are outside the scope of this post so just ask your SAN administrator for a new LUN and present it to all nodes of the cluster.

Since by default in Server 2008, we leave new LUNs offline, there’s no risk in presenting a new LUN to all nodes at the same time.

In the below figure is what Disk Manager would look like after my new disk had been presented.

Figure 1.

Note how the new disk ‘Disk 9’ is in an ‘Offline’ state. In order to prepare it to be the replacement disk for an existing disk, we need to do the following.

Online the disk
Initialize the disk (MBR or GPT)
Create a new volume
Format as either FAT32 or NTFS

Figure 2.

Figure 2 now shows ‘Disk 9’ as Online and formatted with an NTFS partition.

Add the NEW disk to the Available Storage Group

Take all the resources OFFLINE except the NEW and the OLD Disks,

Copy the Data:

robocopy G: B: /MIR /SEC /R:5 /W:1 /LOG:C:\copia_log.txt /TEE /ETA /COPYALL

robocopy H: E: /MIR /SEC /R:5 /W:1 /LOG:C:\copia_log.txt /TEE /ETA /COPYALL

robocopy I: F: /MIR /SEC /R:5 /W:1 /LOG:C:\copia_log.txt /TEE /ETA /COPYALL

robocopy J: S: /MIR /SEC /R:5 /W:1 /LOG:C:\copia_log.txt /TEE /ETA /COPYALL

robocopy K: T: /MIR /SEC /R:5 /W:1 /LOG:C:\copia_log.txt /TEE /ETA /COPYALL

robocopy M: U: /MIR /SEC /R:5 /W:1 /LOG:C:\copia_log.txt /TEE /ETA /COPYALL

robocopy N: V: /MIR /SEC /R:5 /W:1 /LOG:C:\copia_log.txt /TEE /ETA /COPYALL

robocopy L: W: /MIR /SEC /R:5 /W:1 /LOG:C:\copia_log.txt /TEE /ETA /COPYALL

robocopy P: X: /MIR /SEC /R:5 /W:1 /LOG:C:\copia_log.txt /TEE /ETA /COPYALL

robocopy R: Y: /MIR /SEC /R:5 /W:1 /LOG:C:\copia_log.txt /TEE /ETA /COPYALL

robocopy O: Z: /MIR /SEC /R:5 /W:1 /LOG:C:\copia_log.txt /TEE /ETA /COPYALL…

At this point, we can now go into Failover Cluster Manager to complete the rest of the replacement.

The screenshot below shows a File Server group with ‘Cluster Disk X:’ of size 1GB. This is the disk that I am going to replace with the new 2GB disk from above.

Figure 3.

Failover Cluster Manager has a built in ‘repair’ functionality that allows replacing a failed disk with a new disk.

Since we’re not really replacing a failed disk but a working one, we need to ‘trick’ the cluster into putting that disk into a failed state so that the ‘repair’ function will be enabled.

First we need to change the properties of ‘Cluster Disk X:’ to not restart or failover when I simulate a failure of the disk. Right-click the disk resource, [Properties], [Policies Tab]. Set the ‘Response to resource failure’ to ‘If resources fails, do not restart’.

Figure 4.

Now right-click ‘Cluster Disk X:’, ‘More Actions’, ‘Simulate failure of this resource’

Figure 5.

You’ll now see that the disk resource is in a ‘Failed’ state. Don’t worry, data is still intact and disk is fine.

Figure 6.

Now right-click the disk resource, ‘More actions…’, ‘Repair’. This will launch the ‘Repair a Disk Resource’ window.

Figure 7.

Figure 7. shows the disk that we presented and created in Figure 2. Select that disk, click [OK]/

So after this we now have the NEW disk,

Now bring the resource online. You’ll see in Figure 8. that the disk now shows as 2GB. We essentially swapped one disk for another without having to worry about resource dependencies.

If the drive letter needs to be changed to match the old drive letter, do so now.

Figure 8.

Now, we need to set the restart properties of the resource back to their default. Right click on the disk, Properties. Select the ‘If resource fails, attempt restart on current node’. We’re undoing what we did in Figure 4.

Figure 9.

Other Option to copy the DATA is:

So now that we’ve replaced the 1GB disk with the 2GB disk, what happened to the old disk?

When you used the ‘Repair’ function, the old disk got removed from under the control of the cluster.

The final step in the replacement is to bring the old disk back into the cluster so that we can bring it online and move the data from the old disk to the new.

To add the disk back in, from Failover Cluster Manager, go to the ‘Storage’ group. In the right-most column, in the ‘Actions’ pane, click on ‘Add a disk’

Figure 10.

Figure 11 shows the disk we just removed from the cluster. Select this disk, click [OK]

Figure 11.

This disk now shows up in ‘Available Storage’. Figure 12.

Figure 12.

The final steps in the replacement are to assign this disk a drive letter so that it’s exposed to the OS to get your data moved from the old disk to the new.

Figure 13.

Now that ‘Cluster Disk 7’ (the old disk) shows as online and has a drive letter (D:) , you can use your favorite data copy method to move the data from the old disk to the new disk.

If you are no longer going to use the old LUN, you can simply delete this resource from Failover Cluster Manager and unpresent that LUN from all nodes of the cluster.

That finishes up the clean-up process. You can also just leave the disk in ‘Available Storage’, format it, and have it ready for some other ‘Service or application’ cluster group to use in the future.

Hope you find this useful especially for those SAN migrations.

https://technet.microsoft.com/en-us/library/cc756229(v=WS.10).aspx

Recommended hotfixes KBs for SCVMM 2008 R2 / SCVMM 2012:

Hugofe — Thu, 21 Jun 2012 03:00:44 GMT

Recommended hotfixes KBs for SCVMM 2008 R2 / SCVMM 2012

1- for VMM 2012:

2724596 Recommended hotfixes for Microsoft System Center 2012 Virtual Machine Manager

https://support.microsoft.com/kb/2724596/EN-US

VMMCA will be updated to check for the hotfixes mentioned in the KB.

2· Updated the VMM 2008 R2 KB:

2397711 Recommended hotfixes for System Center Virtual Machine Manager 2008 R2

https://support.microsoft.com/kb/2397711/EN-US

Lista proactiva de updates / proactive recommended updates ( Windows Server 2008 R2 RTM / SP1 Cluster ) April 2012

Hugofe — Mon, 02 Apr 2012 04:09:35 GMT

Lista proactiva de updates / proactive recommended updates ( Windows Server 2008 R2 RTM / SP1 Cluster ):

Kernel

2667227 You cannot access an RDX removable disk that you formatted by using NTFS in Windows Server 2003, in Windows Vista, in Windows Server 2008, in Windows 7, or in Windows Server 2008 R2

https://support.microsoft.com/default.aspx?scid=kb;EN-US;2667227

TCPIP

2675785 Data transfer speed is slow in Windows 7 or in Windows Server 2008 R2

https://support.microsoft.com/default.aspx?scid=kb;EN-US;2675785

NDIS

2624668 "STOP: 0x0000003B" error occurs during the shutdown process in Windows Server 2008 R2 or in Windows 7

https://support.microsoft.com/default.aspx?scid=kb;EN-US;2624668

RDBSS

2647452 Paged pool leaks when you map a network drive and then disconnect it frequently in Windows 7 or in Windows Server 2008 R2

https://support.microsoft.com/default.aspx?scid=kb;EN-US;2647452

MPIO

2661794 MPIO does not remove a disk that is on a failed path in Windows Server 2008 R2

https://support.microsoft.com/default.aspx?scid=kb;EN-US;2661794

MSDSM

2460971 MPIO failover fails on a computer that is running Windows Server 2008 R2

https://support.microsoft.com/default.aspx?scid=kb;EN-US;2460971

VOLSNAP

2632149 "fvevol!FveFilterDeviceControl+1d0" Stop error when you create a VSS snapshot backup in Windows Server 2008 R2 SP1

https://support.microsoft.com/default.aspx?scid=kb;EN-US;2632149

CLUSSVC

2674551 Redirected mode is enabled unexpectedly in a Cluster Shared Volume when you are running a third-party application in a Windows Server 2008 R2-based cluster

https://support.microsoft.com/default.aspx?scid=kb;EN-US;2674551

CSVFILTER

2639032 "0x0000003B," "0x00000027," and "0x0000007e" Stop errors when a connection to a CSV is lost on a Windows Server 2008 R2-based failover cluster

https://support.microsoft.com/default.aspx?scid=kb;EN-US;2639032

Clusres.dll

2637197 CSV LUNs fail if you use a VSS hardware provider to back up virtual machines on a Windows Server 2008 R2-based cluster

https://support.microsoft.com/default.aspx?scid=kb;EN-US;2637197

storport.sys

2654363 Computer crashes when you use Driver Verifier to monitor Storport.sys if you disable the HBA in Windows 7 or Windows Server 2008 R2

https://support.microsoft.com/default.aspx?scid=kb;EN-US;2654363

NTFS.SYS

2618914 A hotfix is available that adds the FileFsSectorSizeInformation information class to Windows 7 and to Windows Server 2008 R2

https://support.microsoft.com/default.aspx?scid=kb;EN-US;2618914

WMI

2465990 "0x80041002 (WBEM_E_NOT_FOUND)" error occurs when you try to open a WMI namespace on a computer that is running Windows 7 or Windows Server 2008 R2

https://support.microsoft.com/kb/2465990/en-us

Advisory-Auditing cluster regkey

Hugofe — Tue, 22 Nov 2011 05:49:29 GMT

Audit any changes in the cluster registry (HKEY_LOCAL_MACHINE\Cluster) in a windows 2003 cluster environment.

Purpose:

Advisory-Auditing cluster regkey

Action Plan:

Please be aware that the type of information that the Audit gives in windows 2003 is not so explicit as it is in more recent operating systems like in windows 2008.

Identify type of changes made either manually by editing the resource in the registry or possibly some script or application that run

Those action in terms of the GPO and the Registry need to be applied equally on all the nodes of the cluster.

324739 HOW TO: Use Group Policy to Audit Registry Keys in Windows Server 2003

https://support.microsoft.com/kb/324739

Turn On Auditing on a Computer

1. Click Start, and then click Run.

2. In the Open box, type gpedit.msc, and then click OK.

3. Under Computer Configuration, expand Windows Settings, expand Security Settings, expand Local Policies, and then click Audit Policy.

4. In the right pane, double-click Audit object access.

5. Click to select the Success check box, click to select the Failure check box, and then click OK.
NOTE: The Audit object access policy is enough to turn on auditing for the Windows registry.

6. Quit the Group Policy Object Editor snap-in.

Audit a Registry Key

1. Click Start, and then click Run.

2. In the Open box, type regedit, and then click OK.

3. Locate and click the registry key that you want to audit, for example:

HKEY_LOCAL_MACHINE\Cluster\NetworkInterfaces

HKEY_LOCAL_MACHINE\Cluster\Networks

4. On the Edit menu, click Permissions.

5. Click Advanced, click the Auditing tab, and then click Add.

6. Type the user EVERYONE to this registry key you want to audit, click Check Names to verify the name, and then click OK.

7. In the Apply onto box, click the option that you want.

8. Click to select the Successful and Failed check boxes next to the following access types:

9. Click OK, and then click OK.

10. Quit Registry Editor.

Audit events are displayed in the Security log of Event Viewer

Example:

Those are the events that are generated.

3.1:

3.2:

Detailed events that are reported if we delete or change any key,

3.2:

Detailed events that are reported if we delete or change any key,

Event Type: Success Audit

Event Source: Security

Event Category: Object Access

Event ID: 560

Date: 11/22/2011

Time: 10:38:59 AM

User: VPCLAB\Administrator

Computer: SETPSFIFNO5

Description:

Object Open:

Object Server: Security

Object Type: Key

Object Name: \REGISTRY\MACHINE\CLUSTER\Networks

Handle ID: 312

Operation ID: {0,270998}

Process ID: 2496

Image File Name: C:\WINDOWS\regedit.exe

Primary User Name: Administrator

Primary Domain: VPCLAB

Primary Logon ID: (0x0,0x28D54)

Client User Name: Administrator

Client Domain: VPCLAB

Client Logon ID: (0x0,0x28D54)

Accesses: READ_CONTROL

Query key value

Enumerate sub-keys

Privileges: -

Restricted Sid Count: 0

Access Mask: 0x20009

Event Type: Success Audit

Event Source: Security

Event Category: Object Access

Event ID: 560

Date: 11/22/2011

Time: 10:39:00 AM

User: VPCLAB\Administrator

Computer: SETPSFIFNO5

Description:

Object Open:

Object Server: Security

Object Type: Key

Object Name: \REGISTRY\MACHINE\CLUSTER\Networks\136a7de2-8375-4a19-a57d-242afebaff41

Handle ID: 308

Operation ID: {0,271033}

Process ID: 2496

Image File Name: C:\WINDOWS\regedit.exe

Primary User Name: Administrator

Primary Domain: VPCLAB

Primary Logon ID: (0x0,0x28D54)

Client User Name: Administrator

Client Domain: VPCLAB

Client Logon ID: (0x0,0x28D54)

Accesses: READ_CONTROL

ACCESS_SYS_SEC

Query key value

Enumerate sub-keys

Privileges: SeSecurityPrivilege

Restricted Sid Count: 0

Access Mask: 0x1020009

Event Type: Success Audit

Event Source: Security

Event Category: Object Access

Event ID: 560

Date: 11/22/2011

Time: 10:39:00 AM

User: VPCLAB\Administrator

Computer: SETPSFIFNO5

Description:

Object Open:

Object Server: Security

Object Type: Key

Object Name: \REGISTRY\MACHINE\CLUSTER\Networks\136a7de2-8375-4a19-a57d-242afebaff41

Handle ID: 308

Operation ID: {0,271033}

Process ID: 2496

Image File Name: C:\WINDOWS\regedit.exe

Primary User Name: Administrator

Primary Domain: VPCLAB

Primary Logon ID: (0x0,0x28D54)

Client User Name: Administrator

Client Domain: VPCLAB

Client Logon ID: (0x0,0x28D54)

Accesses: READ_CONTROL

ACCESS_SYS_SEC

Query key value

Enumerate sub-keys

Privileges: SeSecurityPrivilege

Restricted Sid Count: 0

Access Mask: 0x1020009

Event Type: Success Audit

Event Source: Security

Event Category: Object Access

Event ID: 560

Date: 11/22/2011

Time: 10:39:00 AM

User: VPCLAB\Administrator

Computer: SETPSFIFNO5

Description:

Object Open:

Object Server: Security

Object Type: Key

Object Name: \REGISTRY\MACHINE\CLUSTER\Networks\136a7de2-8375-4a19-a57d-242afebaff41

Handle ID: 308

Operation ID: {0,271038}

Process ID: 2496

Image File Name: C:\WINDOWS\regedit.exe

Primary User Name: Administrator

Primary Domain: VPCLAB

Primary Logon ID: (0x0,0x28D54)

Client User Name: Administrator

Client Domain: VPCLAB

Client Logon ID: (0x0,0x28D54)

Accesses: READ_CONTROL

Privileges: -

Restricted Sid Count: 0

Access Mask: 0x20000

Event Type: Success Audit

Event Source: Security

Event Category: Object Access

Event ID: 560

Date: 11/22/2011

Time: 10:39:00 AM

User: VPCLAB\Administrator

Computer: SETPSFIFNO5

Description:

Object Open:

Object Server: Security

Object Type: Key

Object Name: \REGISTRY\MACHINE\CLUSTER\Networks

Handle ID: 308

Operation ID: {0,271039}

Process ID: 2496

Image File Name: C:\WINDOWS\regedit.exe

Primary User Name: Administrator

Primary Domain: VPCLAB

Primary Logon ID: (0x0,0x28D54)

Client User Name: Administrator

Client Domain: VPCLAB

Client Logon ID: (0x0,0x28D54)

Accesses: READ_CONTROL

ACCESS_SYS_SEC

Query key value

Enumerate sub-keys

Privileges: SeSecurityPrivilege

Restricted Sid Count: 0

Access Mask: 0x1020009

Event Type: Success Audit

Event Source: Security

Event Category: Object Access

Event ID: 560

Date: 11/22/2011

Time: 10:39:04 AM

User: VPCLAB\Administrator

Computer: SETPSFIFNO5

Description:

Object Open:

Object Server: Security

Object Type: Key

Object Name: \REGISTRY\MACHINE\CLUSTER\Networks\136a7de2-8375-4a19-a57d-242afebaff41

Handle ID: 256

Operation ID: {0,271122}

Process ID: 2496

Image File Name: C:\WINDOWS\regedit.exe

Primary User Name: Administrator

Primary Domain: VPCLAB

Primary Logon ID: (0x0,0x28D54)

Client User Name: -

Client Domain: -

Client Logon ID: -

Accesses: DELETE

READ_CONTROL

WRITE_DAC

WRITE_OWNER

Query key value

Set key value

Create sub-key

Enumerate sub-keys

Notify about changes to keys

Create Link

Privileges: -

Restricted Sid Count: 0

Access Mask: 0xF003F

Event Type: Success Audit

Event Source: Security

Event Category: Object Access

Event ID: 560

Date: 11/22/2011

Time: 10:39:12 AM

User: VPCLAB\Administrator

Computer: SETPSFIFNO5

Description:

Object Open:

Object Server: Security

Object Type: Key

Object Name: \REGISTRY\MACHINE\CLUSTER\Networks\136a7de2-8375-4a19-a57d-242afebaff41

Handle ID: 304

Operation ID: {0,271256}

Process ID: 2496

Image File Name: C:\WINDOWS\regedit.exe

Primary User Name: Administrator

Primary Domain: VPCLAB

Primary Logon ID: (0x0,0x28D54)

Client User Name: -

Client Domain: -

Client Logon ID: -

Accesses: Query key value

Enumerate sub-keys

Privileges: -

Restricted Sid Count: 0

Access Mask: 0x9

Event Type: Success Audit

Event Source: Security

Event Category: Object Access

Event ID: 560

Date: 11/22/2011

Time: 10:39:12 AM

User: VPCLAB\Administrator

Computer: SETPSFIFNO5

Description:

Object Open:

Object Server: Security

Object Type: Key

Object Name: \REGISTRY\MACHINE\CLUSTER\Networks\136a7de2-8375-4a19-a57d-242afebaff41

Handle ID: 256

Operation ID: {0,271259}

Process ID: 2496

Image File Name: C:\WINDOWS\regedit.exe

Primary User Name: Administrator

Primary Domain: VPCLAB

Primary Logon ID: (0x0,0x28D54)

Client User Name: -

Client Domain: -

Client Logon ID: -

Accesses: Query key value

Enumerate sub-keys

Privileges: -

Restricted Sid Count: 0

Access Mask: 0x9

Event Type: Success Audit

Event Source: Security

Event Category: Object Access

Event ID: 560

Date: 11/22/2011

Time: 10:39:12 AM

User: VPCLAB\Administrator

Computer: SETPSFIFNO5

Description:

Object Open:

Object Server: Security

Object Type: Key

Object Name: \REGISTRY\MACHINE\CLUSTER\Networks\136a7de2-8375-4a19-a57d-242afebaff41

Handle ID: 256

Operation ID: {0,271260}

Process ID: 2496

Image File Name: C:\WINDOWS\regedit.exe

Primary User Name: Administrator

Primary Domain: VPCLAB

Primary Logon ID: (0x0,0x28D54)

Client User Name: -

Client Domain: -

Client Logon ID: -

Accesses: DELETE

Privileges: -

Restricted Sid Count: 0

Access Mask: 0x10000

Event Type: Success Audit

Event Source: Security

Event Category: Object Access

Event ID: 560

Date: 11/22/2011

Time: 10:49:40 AM

User: VPCLAB\Administrator

Computer: SETPSFIFNO5

Description:

Object Open:

Object Server: Security

Object Type: Key

Object Name: \REGISTRY\MACHINE\CLUSTER\Networks\teste

Handle ID: 308

Operation ID: {0,294077}

Process ID: 2496

Image File Name: C:\WINDOWS\regedit.exe

Primary User Name: Administrator

Primary Domain: VPCLAB

Primary Logon ID: (0x0,0x28D54)

Client User Name: -

Client Domain: -

Client Logon ID: -

Accesses: DELETE

Privileges: -

Restricted Sid Count: 0

Access Mask: 0x10000

New in Windows 2008/2008 R2

Configuring Auditing for a Windows Server 2008 Failover Cluster

https://blogs.technet.com/askcore/archive/2009/01/19/configuring-auditing-for-a-windows-server-2008-failover-cluster.aspx

The Windows Server 2008 Failover Clustering auditing feature has been requested by customers and provides the capability to monitor, or audit, cluster access. The cluster auditing feature can be enabled to audit accesses (Success and\or Failure) of an object. The object, in this case, will be the Microsoft Failover Cluster. This is accomplished by auditing client accesses to a cluster using Cluster APIs. This basically means that a client trying to access a cluster using either the Failover Cluster Management snap-in (Cluadmin.msc), the cluster.exe command line or any custom application that calls cluster APIs, will be subjected to auditing events if configured.

Extend system partition and Disk Cleanup in Windows 2000/2003/XP/2008/2008 R2 /7:

Hugofe — Mon, 17 Oct 2011 04:02:43 GMT

1 - Extend system partition:

1.1:

Windows PE

This article discusses the support boundaries that Microsoft Customer Support Services (CSS) provides for use of Microsoft Windows Preinstallation Environment (Windows PE) to extend the drive that contains the Microsoft Windows operating system. Windows PE can be used to extend both the system and boot partitions if they are separate.

To use Windows PE to extend the drive that contains the Windows operating system, the customer must meet the following requirements:

The version of Windows PE must be Microsoft Windows PE 2005 or a later version. Windows PE 2005 is based on Windows Server 2003 Service Pack 1 (SP1).
The hard disk partition that is being extended must be running Windows Server 2003 or a later version.
The kind of disk that is being extended must be basic and not dynamic.
The hard disk partition that is being extended must have free space directly next to the partition that is being extended.
The file system on the hard disk partition that is being extended must be a NTFS file system.

To use Windows PE to extend the drive that contains the Windows operating system, follow these steps:

1. Perform a full backup on the hard disk partition that is being extended.
Note If you back up the data on this hard disk partition, the data will not be lost in case there is a problem or corruption occurs.

2. Make sure that unallocated space is available on the hard disk next to the hard disk partition that is being extended. You can use the software utility that is provided by the hardware vendor to physically create unallocated space on the hard disk.

3. Restart the computer by using the Windows PE CD.

4. Open a command prompt.

5. At the command prompt, type Diskpart.exe, and then press ENTER.

6. Type List volume, and then press ENTER to display the existing volumes.

7. Type Select volume volume number. volume number is the number of the volume that you want to extend.

8. Type Extend, and then press ENTER to extend the hard disk partition into the free space.
Note You can use the size=N option to specify how much space in megabytes (MB) to add to the current partition. If no size is specified, the disk is extended to use all the contiguous unallocated space. For example, type extend size=2000 to add 2,000 MB of free space to the current hard disk partition.
For more information, click the following article number to view the article in the Microsoft Knowledge Base:

325590 (https://support.microsoft.com/kb/325590/ ) How to use Diskpart.exe to extend a data volume in Windows Server 2003, in Windows XP, and in Windows 2000

9. To exit the command prompt, type exit, and then press ENTER.

10. Restart the computer, and then log on to Windows.

11. Verify that the hard disk partition that contains the operating system is now extended to include the available free space.

Support boundaries for using Windows PE to extend the drive that contains the Windows operating system

https://support.microsoft.com/kb/911896

1.2:

Data Volumes on any OS or System Partition in windows 2008:

This article describes the following:

· How to use the Diskpart.exe command prompt utility to extend a data volume into unallocated space in Windows Server 2003, in Windows XP, and in Microsoft Windows 2000.

· How to extend the boot partition in Windows Server 2008.

How to use Diskpart.exe to extend a data volume in Windows Server 2003, in Windows XP, and in Windows 2000

You can use the Diskpart.exe utility to manage disks, partitions, and volumes from a command-line interface. You can use Diskpart.exe on both Basic disks and Dynamic disks. If an NTFS volume resides on a hardware RAID 5 container that can add space to the container, you can extend the NTFS Volume with Diskpart.exe while the disk remains a Basic disk.
Use the extend command to incorporate unallocated space into an existing volume while preserving the data.
The following are the requirements for the extend command:

· The volume must be formatted with the NTFS file system.

· For Basic volumes, the unallocated space for the extension must be the next contiguous space on the same disk.

· For Dynamic Volumes, the unallocated space can be any empty area on any Dynamic disk on the system.

· Only the extension of data volumes is supported. System or boot volumes may be blocked from being extended, and you may receive the following error:

Diskpart failed to extend the volume. Please make sure the volume is valid for extending

· You cannot extend the partition if the system page file is located on the partition. Move the page file to a partition that you do not want to extend.

To extend a partition or volume, you must first select the volume to give it the focus, and then you can specify how large to make the extension. To extend a volume, follow these steps:

1. At a command prompt, type diskpart.exe.

2. Type list volume to display the existing volumes on the computer.

3. Type Select volume volume number where volume number is number of the volume that you want to extend.

4. Type extend [size=n] [disk=n] [noerr]. The following describes the parameters:

size=n
The space, in megabytes (MB), to add to the current partition. If you do not specify a size, the disk is extended to use all the next contiguous unallocated space.
disk=n
The dynamic disk on which to extend the volume. Space equal to size=n is allocated on the disk. If no disk is specified, the volume is extended on the current disk.
noerr
For scripting only. When an error is thrown, this parameter specifies that Diskpart continue to process commands as if the error did not occur. Without the noerr parameter, an error causes Diskpart to exit with an error code.

5. Type exit to exit Diskpart.exe.

How to extend the boot partition in Windows Server 2008

To extend the boot partition in Windows Server 2008, follow these steps:

1. Click Start, and then click Server Manager.

2. In the navigation pane, expand Storage, and then click Disk Management.

3. In the details pane, right-click the volume that you want, and then click Extend Volume.

4. Follow the instructions in the Extend Volume Wizard to extend the boot partition.

Note You can only extend the boot partition in contiguous unallocated disk space.

How to extend a data volume in Windows Server 2003, in Windows XP, in Windows 2000, and in Windows Server 2008

https://support.microsoft.com/kb/325590

1.3:

Not supported but might work, System Partition in windows 2003:

The Diskpart.exe utility that is included in Microsoft Windows Server 2003 and in Microsoft Windows XP does not let you extend the Windows boot and system partitions into unallocated space.
The Diskpart.exe utility supports only the extension of data partitions. System or boot partitions may be blocked from being extended. You may receive the following error after you try to extend a system or boot partition:

Diskpart failed to extend the volume. Please make sure the volume is valid for extending.

The Diskpart.exe utility that is included with the Microsoft Windows 2000 Resource Kit may let you extend Windows 2000 boot and system partitions into unallocated space. However, the file system may not be extended, and when you try to extend boot or system partitions, your computer may stop responding.
Caution You may find that Microsoft Windows XP Service Pack 1 (SP1) lets you use the Diskpart.exe utility to extend Windows boot and system partitions. The boot and system partitions may be extended, but the file system may not be extended. Therefore, your computer may stop responding if you try to extend the boot and system partitions. The Diskpart.exe utility was not intended for extending Windows boot and system partitions.
Windows XP and Windows Server 2003 include the Diskpart.exe utility as part of the base operating system.
To download the Diskpart.exe utility for Windows 2000, visit the following Microsoft Web site:

https://www.microsoft.com/downloads/details.aspx?FamilyID=0fd9788a-5d64-4f57-949f-ef62de7ab1ae&displaylang=en

886986 Functionality restrictions of the Diskpart.exe utility to extend system and boot partitions in Windows Server 2003 and in Windows XP

https://support.microsoft.com/default.aspx?scid=kb;EN-US;886986

2 - Disk Cleanup:

2.1:

The Disk Cleanup tool helps you free up space on your hard disk by searching your disk for files that you can safely delete. You can choose to delete some or all of the files. Use Disk Cleanup to perform any of the following tasks to free up space on your hard disk:

· Remove temporary Internet files.

· Remove downloaded program files. For example, ActiveX controls and Java applets that are downloaded from the Internet.

· Empty the Recycle Bin.

· Remove Windows temporary files.

· Remove optional Windows components that you are not using.

· Remove installed programs that you no longer use.

2.2:

While Windows is running , you may receive a "low disk space" message in the notification area. This may prevent the ability to download and install Windows updates.

This article describes how to reclaim disk space on a Windows XP and Windows Server 2003 based systems.

You may have to reclaim disk space on your computer so that you can install additional Windows updates, service packs, and programs. Or, you may have to do this in order to save additional personal files.

Run the Disk Cleanup tool

The Disk Cleanup tool searches your hard disk for files that you can safely delete. You can choose to delete some of or all these files.
For more information about the Disk Cleanup tool, click the following article number to view the article in the Microsoft Knowledge Base:

310312 (https://support.microsoft.com/kb/310312/ ) Description of the Disk Cleanup Tool in Windows XP

To start the Disk Cleanup tool, use one of the following methods:

Click Start, click Run, type cleanmgr in the Open box, and then press ENTER.
Click Start, point to All Programs, point to Accessories, point to System Tools, and then click Disk Cleanup.
In Windows Explorer or in My Computer, right-click the drive on which you want to reclaim disk space, and then click Properties. In the Properties dialog box, click the General tab, and then click Disk Cleanup.

To reclaim space on your hard disk, click the Disk Cleanup tab, select one or more files to be deleted, and then click OK.
Note By default, some files are automatically selected. You can accept the default setting by clicking OK.
The listed files can include items from the following:

Temporary Setup Files
These are files that were created by a Setup program that is no longer running.
Downloaded Program Files
Downloaded program files are ActiveX controls and Java programs that are downloaded automatically from the Internet when you view certain Web pages. These files are temporarily stored in the Downloaded Program Files folder on the hard disk. When you click the Temporary Setup Files item, you see a View Files button that lets you review the files before Disk Cleanup deletes them. This button opens the C:\Winnt\Downloaded Program Files folder.
Note Downloaded program files are selected by default.
Temporary Internet Files
This folder contains Web pages that are stored on your hard disk for quick viewing. Disk Cleanup deletes these pages but leaves your personalized settings for Web pages intact. When you click the Temporary Internet Files item, you see a View Files button. This button opens the C:\Documents and Settings\ Username \Local Settings\Temporary Internet Files\Content.IE5 folder.
Offline Webpages
Offline pages are webpages that are stored on your computer so you can view them without being connected to the Internet. If you delete these pages now, you can still view your favorites offline later by synchronizing them. Your personalized settings for webpages will be left intact.
Old Chkdsk Files
When the Chkdsk tool checks a disk for errors, it might save lost file fragments as files in the root folder on the disk. These files are unnecessary.
Recycle Bin
The Recycle Bin contains files that you have deleted from the system. These files are not permanently removed until you empty the Recycle Bin. When you click the Recycle Bin item, you see a View Files button that opens the Recycle Bin.
Setup Log Files
Files created by Windows.
Temporary Files
Programs sometimes store temporary information in a Temp folder. Before a program exits, it typically deletes this information. You can safely delete temporary files that have not been modified within the last week.
WebClient/Publisher Temporary Files
The WebClient/Publisher service maintains a cache of accessed files on this disk. These files are kept locally for performance reasons only, and can be deleted safely.
Temporary Offline Files
Temporary offline files are local copies of recently used network files. These files are automatically cached so that you can use them after you disconnect from the network. When you click the Temporary Offline Files item, you see a View Files button that opens the Offline Files folder.
Offline Files
Offline files are local copies of network files that you specifically want to have available offline so that you can use them after you disconnect from the network. When you click the Offline Files item, you see a View Files button that opens the Offline Files folder.
Compress Old Files
Windows can compress files that you have not used recently. When you compress old files, you save disk space. However, you can still use these files, and no files are deleted. Because files are compressed at different rates, the displayed amount of disk space that you will gain is approximate. You can use the Options button to specify the number of days to wait before Disk Cleanup compresses an unused file.
Catalog Files for the Content Indexer
The Indexing service speeds up and improves file searches by maintaining an index of the files that are on the disk. These Catalog files remain from earlier indexing operations, and they can be safely deleted.

The More Options tab in the Disk Cleanup dialog box contains options for cleaning up Windows components or installed programs. By using these options, you can reclaim additional space on the computer:

The Windows Components option creates free space by removing optional Windows components that you do not use. By clicking Clean Up, you start the Windows Components Wizard.
The Installed Programs option reclaims more disk space by removing programs that you do not use. By clicking Clean Up, you start the Change or Remove Programs option in the Add or Remove Programs tool.
The System Restore option creates free space by removing all restore points except for the most recent one.

Delete memory dump files, and modify the Startup and Recovery options

Memory dump files are created when system failures occur, and they can be used to determine the cause of a failure. These files can be safely deleted if they are no longer required.
To delete memory dump files, follow these steps:

1. Delete the files in the %AllUsersProfile%\Application Data\Microsoft\Dr Watson folder. These log and memory dump files are created when applications stop working.

2. Delete the files in the %Windir%\minidump folder. These minidump files are created when Windows stops responding or crashes.

3. Delete the %SystemRoot%\MEMORY.dmp file. This is the complete memory dump file that is created when Windows stops responding or crashes.

You may also want to prevent your system from creating a complete memory dump file in the future. Complete memory dump files record the contents of system memory when the computer stops responding or crashes. These complete memory dump files can be very large. To save space, you can modify your Startup and Recovery options to create only a small memory dump file.
To configure the system to create a small memory dump file instead of a complete dump file when failures occur, follow these steps:

1. Right-click My Computer, and then click Properties.

2. Click the Advanced tab, and then click Settings under Startup and Recovery.

3. Under Write Debugging Information, select the kind of information that you want Windows to record in a memory dump file if the computer stops responding. To record the smallest volume of information for use in troubleshooting the problem, select the Small Memory Dump option. This option requires a paging file of at least 2 megabytes (MB) on the boot volume of the computer, and it specifies that Windows will create a new file every time that the system stops responding or crashes.

4. Click OK.

Delete the remote desktop connection cache files

If you delete the cache files, the screen may not update very quickly while you are running Remote Desktop Connection.
To delete the Remote Desktop Connection cache files, delete all the bitmap cache files (files that use the .bmc extension) in the %Userprofile%\Local Settings\Application Data\Microsoft\Terminal Server Client\cache folder.

Disable other Windows features

Warning Although disabling certain Windows features can save disk space, this may affect the performance and functionality of the computer. Consider the effect that this option will have on the computer before you disable Windows features.
You have the following options:

Disable hibernation, and delete the hibernation file.

1. Disable the hibernation file. For more information about how to disable the hibernation file, click the following article number to view the article in the Microsoft Knowledge Base:

920730 (https://support.microsoft.com/kb/920730/ ) How to disable and re-enable hibernation on a computer that is running Windows Vista

2. Delete the %SystemDrive%\hiberfil.sys file.

Move the paging file to another volume, disable it, or delete it.

Disable or move the paging file. To do this, see the "Change the size of the virtual memory paging file" article in Microsoft TechNet. To do this, visit the following Microsoft Web site:

https://technet.microsoft.com/en-us/library/cc772755.aspx (https://technet.microsoft.com/en-us/library/cc772755.aspx)

Delete the %SystemDrive%\Pagefile.sys file.

Delete Windows update files

Warning If you delete the folder for each update, the corresponding Windows update cannot be uninstalled. Consider the effect that this will have on the computer before you delete the Windows update files.
To delete Windows update files, follow these steps:

1. Delete only those %Windir%/$NtUninstallKB number$ folders that were created more than a month ago as backup files for Windows updates. Do not delete those that were created within the last 30 days.

2. To delete the download cache for Windows updates, delete all the folders in the %Windir%\SoftwareDistribution\download folder that were created more than 10 days ago.

3. Delete the following log files in the %Windir% folder:

o kb*.log

o setup*.log

o setup*.old

o setuplog.txt

o winnt32.log

o set*.tmp

Delete Windows service pack files

Warning If you delete the backup folders for each Windows service pack, you will be unable to uninstall Windows service packs.
If you delete the folder for the installation files and the cache for the Windows service pack, you will be unable to restore corrupted Windows service pack files or to install additional Windows features that are not installed by default. You may want to keep a copy of these files in another location. For more information about how to keep a copy of these files, click the following article number to view the article in the Microsoft Knowledge Base:

271484 (https://support.microsoft.com/kb/271484/ ) Files and folders are added to your system after service pack is installed

Consider the effect that this will have on your computer before you delete these files.
To delete Windows service pack files, follow these steps:

1. Delete the %Windir%\$NtServicePackUninstall$ folder to delete the backup folders for the Windows XP service packs.

2. Delete the %Windir%\ServicePackFiles folder to delete installation files and cache folders for the Windows XP service packs.

956324 How to reclaim disk space on Windows XP and Windows Server 2008-based computers

https://support.microsoft.com/default.aspx?scid=kb;EN-US;956324

Best Regards

Hugo Ferreira

Configuring a Certificate for Virtual Machine Connection in Hyper-V or thru SCVMM:

Hugofe — Tue, 04 Oct 2011 03:31:49 GMT

Configuring a Certificate for Virtual Machine Connection in Hyper-V or thru SCVMM:

Replacing the self-signed certificate used by HYPER-V /SCVMM, with a certificate issued using an Internal Enterprise Certificate Authority.

Windows Server 2008, Windows Server 2008 R2

Tip

These procedures are intended for advanced users; required steps include editing the registry. You should perform these steps only if the default behavior of Hyper-V does not meet the needs or policies of your environment.

One security issue that Hyper-V was designed to address is better protection against “man in the middle” attacks (sometimes referred to as MITM). Use of trusted certificates can help protect against MITM attacks. When you use the Virtual Machine Connection tool or a custom application that uses Remote Desktop Protocol (RDP) ActiveX controls, Hyper-V uses a single-port listener that utilizes trusted certificates for server authentication. (This does not occur when you use the Remote Desktop Connection client, because it does not use the single port listener.) As explained later in this topic, under certain circumstances Hyper-V issues a self-signed certificate that is then used for server authentication. As an alternative to this approach, you can configure Hyper-V to use a different certificate, such as one issued by a certification authority (CA).

Tip

During a MITM attack, a malicious party listens and intercepts communication between two parties, then injects information into the communication stream, without the knowledge of the two communicating parties. This information triggers some action that amounts to a security breach.

Certificate requirements and selection

Hyper-V Virtual Machine Management Service (VMMS) requires that a certificate meet all of the following criteria to be considered a valid certificate. The certificate must have:

A valid certificate chain, which is connected to a trusted root certificate
A “Subject Name” that matches the FQDN of the machine
A purpose of “Server Authentication”
The certificate has to have a Specific Extention else it will not be used by the Hyper–v service.

[Extensions]
1.3.6.1.4.1.311.62.1.1.1 = AgEE

A private key file that includes ‘read’ access for the Virtual Machine group security ID (SID).

When VMMS starts, Hyper-V searches for an existing, valid certificate to prepare for future communication requests. If one is not found, Hyper-V generates a self-signed certificate in the VMMS certificate store. The search for a certificate occurs as follows:

1. First, Hyper-V checks the registry for the thumbprint value of a certificate, under \HKLM\Software\Microsoft\Windows NT\CurrentVersion\Virtualization\AuthCertificateHash. Hyper-V uses this value to try to locate a matching certificate.

2. If no matching, valid certificate is found, Hyper-V checks the certificate store of the computer.

3. If no valid certificate is found in the certificate store of the computer, Hyper-V checks the VMMS certificate store, under Hyper-V Virtual Machine Management Service (VMMS).

4. If the VMMS certificate store does not contain a certificate that is valid for use with Hyper-V, VMMS generates a self-signed certificate in its service certificate store.

Configuring your CA server and obtaining a valid certificate for use with SCVMM.

Note: The VMMS service requires two critical certificates Extension Fields These are:

Field= “Key Usage” Value = “Key Encipherment, Data Encipherment (30)”

Field= “1.3.6.1.4.1.311.62.1.1.1 Value = “02 01 04”

Make sure the usage of the certs contain Key Encipherment and Data Encipherment (30)

Here is how we can get the said “Field” (1.3.6.1.4.1.311.62.1.1.1) in the certificate with the value 02 01 04 using certreq.

Note: We assume you have an Enterprise CA.

· Create a duplicate v2 template (Windows Server 2003) based on “WebServer”, e.g. Web Server 2003 Export.

Execute below set of commands on the certificate server to allow for the Extensions needed.

· Certutil -setreg policy\EnableRequestExtensionList +1.3.6.1.4.1.311.62.1.1.1

· Net stop certsvc

· Net start certsvc.

· On the duplicated v2 certificate template based on “WebServer”, that we were using please make sure the Subject name tab is set to “Supply in the Request”.

Increase the "Validity Period" from General tab and ensure that you have the Allow exporting of the Private key is enabled.

· The please copy the below test to a Request.inf file changing the subject name from test to the name of the server:

[Version]

Signature="$Windows NT$

[NewRequest]

Subject = "CN=test"

KeySpec = 1

KeyLength = 1024

Exportable = TRUE

MachineKeySet = TRUE

KeyUsage = "CERT_KEY_ENCIPHERMENT_KEY_USAGE | CERT_DATA_ENCIPHERMENT_KEY_USAGE"

[Strings]

szOID_ENHANCED_KEY_USAGE = "2.5.29.37"

szOID_PKIX_KP_SERVER_AUTH = "1.3.6.1.5.5.7.3.1"

szOID_CUSTOM = "1.3.6.1.4.1.311.62.1.1.1"

[Extensions]

%szOID_ENHANCED_KEY_USAGE% = "{text}%szOID_PKIX_KP_SERVER_AUTH%"

%szOID_CUSTOM% = "{hex} 02 01 04"

· Once you save the Request.inf execute below command. (from the same directory you copied the file to)

o Certreq –new request.inf request.req ( this will convert the certificate to the correct format )

o Then please copy the content of the request.req file to the certificate request page and submit the certificate to be issued.

o Launch the Certificate in Machine context – select the installed Cert and export with the private key,

o Launch the Certificate in hyper-V service context – import the private key we exported above.

More information https://technet.microsoft.com/en-us/library/cc740063(WS.10).aspx

Then please proceed with the rest of the actions to ensure that you disable self-signing VMMS certificate and set the certificate to be used.

Deploying a certificate issued by a CA

If you do not want to use a self-signed certificate, you can obtain a certificate issued by a certification authority (CA) and then deploy that certificate to use with Hyper-V. The following steps assume that you have obtained a certificate from a CA and stored it in the certificate store of the computer account of the server running Hyper-V.

To deploy a certificate issued by a CA

1. Prevent Hyper-V from generating a self-signed certificate by adding a registry key.

a. Open Windows PowerShell.

b. Run the following command:
reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Virtualization" /v "DisableSelfSignedCertificateGeneration" /f /t REG_QWORD /d 1

Warning

Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer.

2. Check the VMMS certificate store for a self-signed certificate and delete it if it exists.

a. Open the Certificates snap-in.

i. Open Microsoft Management Console. Click Start, click Run, type mmc, and then click OK.

ii. Under the File menu, click Add/Remove Snap-in.

iii. Under Available snap-ins, click Certificates.

iv. Click Service account, and then click Next.

v. Click Local computer and then click Next.

vi. In the Service account list, select Hyper-V Virtual Machine Management and then click Finish.

b. In the navigation pane, expand Certificates. Expand vmms\Personal and then click the Certificates folder.

c. In the details pane (center pane), right-click the certificate and click Delete.

d. Expand vmms\Trusted Root Certification Authorities and click Certificates. Find the copy of the certificate that you deleted in the previous step and delete it from this folder.

e. Close the Certificates snap-in.

3. Find the thumbprint value of new certificate that you want to deploy.

a. Open the Certificates snap-in again to load the certificate store of the computer. Select Computer account, and then complete the wizard to load the certificate store.

b. In the Details pane, double-click the certificate and then click the Details tab.

c. Select Thumbprint. If it does not appear in the list, set Show to .

d. In the text box below the list, copy the hexadecimal value.

e. Paste the string into a text file for use later in this procedure.

4. Open or switch back to Windows PowerShell.

5. Find the private key file of the certificate.

a. Copy the following string and replace thumbprint_value with the string value you copied in the previous step.

the correct command is $certs = dir cert:\ -recurse | ? { $_.Thumbprint -eq "thumbprint_value" }.

b. Run the command.

c. Run the following command to obtain a certificate object:
$cert = @($certs)[0]

d. Run the following command to obtain the private key file name of the certificate:
$location = $cert.PrivateKey.CspKeyContainerInfo.UniqueKeyContainerName

6. Run the following commands in the order shown to modify the access control list (ACL) so that the Virtual Machine group security identifier has read access. Text in quotes in the following commands represents literal values, not placeholder text, and should be included as shown in the command strings.

$folderlocation = gc env:ALLUSERSPROFILE

$folderlocation = $folderlocation + "\Microsoft\Crypto\RSA\MachineKeys\"

$filelocation = $folderlocation + $location

icacls $filelocation /grant "*S-1-5-83-0:(R)"

7. Verify that the Virtual Machine group has read access to the certificate.

a. Switch back to the Certificates snap-in to view the certificate store of the computer account.

b. In the Details pane, right-click the certificate, click All Tasks, and then click Manage Private Keys.

c. Under Group or user names, select Virtual Machines.

d. Under Permissions for Virtual Machines, verify that Read is set to Allow.

8. Run the following commands to set the registry key to the hash value of the certificate:

$thumbprint = $cert.Thumbprint

reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Virtualization" /v "AuthCertificateHash" /f /t REG_BINARY /d $thumbprint

9. If the version of Hyper-V is earlier than the one included in Windows Server 2008 R2, perform the following steps:

a. Run the following commands:
Net stop vmms
Net start vmms

b. Switch to or open Hyper-V Manager. Save the state of each running virtual machine and then restore each one.

Some notes about Hyper-V

1) The Hyper-V management service (VMMS) will automatically create its own local-host based Security Certificate if one does not exist that is currently valid.

2) VMMS will delete any key that is expired from its local Certificate Store.

Best Regards

Hugo Ferreira

Disk Timeout

Hugofe — Wed, 07 Sep 2011 00:34:52 GMT

Hi All

A very important info regarding Disk Timeout,

Disk timeout value: Less is better

The Windows Disk timeout is stored in the following registry key:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Disk\

For example, most array vendors will set this value to (at least) 60 seconds. This means, for all intents and purposes, that Windows will not report any problems with timeouts until at least 60 seconds have passed.

If for some reason, the Fibre Channel frame in question was dropped ,this is further exaggerated by the fact that after this timeout is hit, Storport.sys will retry the I/O operation 8 times at the interval of the timeout for disk.sys, and during this time, since Windows is waiting for the SAN to return data, the operating system may appear to be frozen, depending on what the data was.

This means that with the value of 60 seconds, the effective impact to the user is the following:

· I/O Timeouts will not be exposed in the Windows Event log until after 60 seconds AND the timeouts have expired, so effectively, this translates to an 8 minute delay before the I/O is retried.

While there is not any single rule which will apply equally to everyone in this case, I think most people would agree that waiting 8 minutes is far too long.

Going forward, Microsoft is recommending that the Disk timeout value be set as low as possible, and no greater than 20 to 30 seconds at a maximum. In this way, you can decrease the time to recovery on dropped I/O packets.

Why not just set it to 1 second? I don’t want to wait that long:

Keep in mind that the disk.sys timeout value is a global setting. If you were to set it to 1 second, this would mean that it would also have the effect of allowing only 1 second to spin up a drive which is asleep before reporting a timeout on the device.

It’s also important that this value be set high enough when using systems which are not only using SAN storage. For example, if you were to set the timeout value to 5 seconds on Windows Client operating systems where a SAN is not connected, you would likely see timeout errors which were not actually a problem, such as when a DVD or local disk are spinning up after being asleep. A good starting point to consider using is a value between 10 and 30 seconds.

Clearly, the need for a reasonable value is key, however we would strongly recommend that this be no more than 30 seconds going forward. As with any other change, this is something that should be evaluated for impact in a test environment prior to implementing this in a production environment.

What are the key things to consider when setting the disk timeout value?

The greater this value, the longer it will be before any timeout errors are surfaced by Windows. We would in general recommend setting this value low enough to meet any required SLA’s on the storage, rather than setting it too high.

To drive this point a little further, let’s review a potential scenario:

o Let’s say that I have a SQL Server deployment, and my primary concern is fast I/O to the SQL database. SQL in general requires very short delays on I/O responses, and delays can translate to a delay in client applications built on top of SQL.
In fact SQL Server will generate an Application event any time an I/O takes longer than 15 seconds.

The problem with this approach, is that using the default value of 60 (or more) seconds employed by most array vendors, would prevent you from seeing any System events related to I/O timeouts unless the timeouts are for longer than 60 seconds.
This can make troubleshooting extremely difficult, because on one hand you would have a SQL client application acting slow, and SQL reporting slow I/O, at the same time that there are no events from Windows.
To ensure that these additional system events required for troubleshooting are not lost you would likely want to find a timeout closer to a maximum of 15 seconds that still works well under production workloads without generating excessive event log noise.

If you are using Fibre Channel-based storage, any occurrence of a dropped FC frame will cause all I/O to halt until recovery occurs, or until Storport has exceeded its 8 retry attempts at intervals of the Disk timeout.

So as I mentioned previously, 60 seconds will likely be far too long in this case, as it would translate to a 8 minute outage on a dropped frame.

More Information

Even if you are not using Fibre Channel storage, in most cases, a disk timeout value of 60 seconds would be too long, as it would mask timeout errors far beyond the point where a user could perceive slow access to data.

When troubleshooting issues with storage performance, it may be beneficial to set this slightly lower than normal to increase the chances of catching timeout errors.

Best Regards

Hugo Ferreira

Lista proactiva de updates / proactive recommended updates:

Hugofe — Mon, 05 Sep 2011 08:04:04 GMT

Windows Server 2003 SP2 Cluster

1.1: P1 – CLUSTER SERVER ( BASE & STORAGE & FILE SYSTEM )

Kernel

2393802 MS11-011: Vulnerabilities in Windows Kernel could allow elevation of privilege

https://support.microsoft.com/default.aspx?scid=kb;en-US;2393802

Win32k,gdi32

2506223 MS11-034: Vulnerabilities in Windows Kernel-Mode drivers could allow elevation of privilege: April 12, 2011

https://support.microsoft.com/default.aspx?scid=kb;en-US;2506223

Ntfs

981166 Some data is corrupted when cached and noncached I/O operations occur by using the same NTFS file handle

https://support.microsoft.com/default.aspx?scid=kb;EN-US;981166

Storport

Storport : check with SAN provider OEM in order to use the latest storport validated by the OEM

957910 A Windows Server 2003 SP2-based iSCSI boot server cannot generate dump files if the server uses a Storport virtual miniport as the LUN controller

https://support.microsoft.com/default.aspx?scid=kb;EN-US;957910

On HP ProLiant Server platform please check for:

· latest hpcisss2 .sys (=> version 6.14.0.32/64 from 7-Jan-2009)

· latest E200/E200i firmware (=> rev. 1.82, from 17-Apr-2009)

HP Server https://support.microsoft.com/kb/940015

hpcisss2.sys You receive a Stop error message after you install update 932755 or 941276 on an HP ProLiant server that is running Storport in Windows Server 2003

Ref HP: hpcisss2.sys, build date 7-Jan-2009, version 6.14.0.32/64

HP Server https://support.microsoft.com/kb/969550

E200/E200i Stop error messages after Memory Corruption on several HP ProLiant servers, firmware due to a problem with firmware of E200/E200i (HP Smart Array SAS/SATA Controller)

Ref HP : E200/E200i firmware rev. 1.82, 17-Apr-2009

Mountmgr.sys

940307 A Microsoft Windows Server 2003-based computer may stop responding if an application frequently uses the mount manager to query volume information

https://support.microsoft.com/default.aspx?scid=kb;EN-US;940307

Disk.sys

929161 You receive a Stop error message on a Windows Server 2003 SP1 or Windows Server 2003 SP2-based computer when a device is suddenly disconnected from a host bus adapter

https://support.microsoft.com/default.aspx?scid=kb;EN-US;929161

ScsiPort.sys

934848 If you load the Intel iSCSI Setup driver for an iSCSI disk during Windows Server 2003 installation, the installation program reports that no disk is detected, and the installation process fails

https://support.microsoft.com/default.aspx?scid=kb;EN-US;934848

Dmadmin.exe

957271 The Logical Disk Manager Administrative Service process may stop unexpectedly on a Windows Server 2003-based computer

https://support.microsoft.com/kb/957271

Vds.exe

960831 Drivers or hardware providers that use the Virtual Disk Service to manage hardware LUN IDs encounter exceptions after a disk is physically removed from a computer that is running Windows Server 2003

https://support.microsoft.com/kb/960831

Clusdisk.sys / Clusres.dll

Rollup Cluster

919117 A hotfix is available that adds support for GUID partition table (GPT) volumes that are larger than 2 terabytes on a Windows Server 2003-based server cluster

https://support.microsoft.com/kb/919117

982438 You cannot install AD DS in Windows Server 2008 in a Windows Server 2003-based domain if another computer that is in the same domain has MSCS installed

https://support.microsoft.com/default.aspx?scid=kb;EN-US;982438

Resrcmon.exe

948701 The Resource Monitor may crash on a Windows Server 2003-based cluster node that has Windows Server 2003 SP2 or hotfix 921181 installed

https://support.microsoft.com/default.aspx?scid=kb;EN-US;948701

SNP

948496 (https://support.microsoft.com/kb/948496/ ) An update to turn off default SNP features is available for Windows Server 2003-based and Small Business Server 2003-based computers

https://support.microsoft.com/kb/948496

1.2: P2 – CLUSTER SERVER ( BASE & STORAGE & FILE SYSTEM )

Dfssvc.exe

945050 The private bytes that the DFS service consumes continue to increase on a Windows Server 2003-based domain controller that hosts the PDC emulator role

https://support.microsoft.com/kb/945050

Dfs.sys

938666 Event ID 2019 is logged in the System log when a DFS domain root server stops responding on a Windows Server 2003-based server

https://support.microsoft.com/kb/938666

Localspl.dll

955455 The print process crashes under heavy stress on a computer that is running Windows Server 2003 or Windows XP Professional x64 Edition if the computer uses hyper-threading technology

https://support.microsoft.com/kb/955455

Local security policy

902069 You may receive a "Stop 0x0000000A" error message when you shut down or restart a computer that is running Windows Server 2003

https://support.microsoft.com/kb/902069

COM+

934016 (https://support.microsoft.com/kb/934016/ ) Availability of Windows Server 2003 Post-Service Pack 2 COM+ 1.5 Hotfix Rollup Package 12

https://support.microsoft.com/kb/934016

All the previous mentioned updates include the latest versions of the 935640,

Recommended hotfixes for Windows Server 2003 Service Pack 2- based server clusters

https://support.microsoft.com/kb/935640

2 - Windows Server 2008 SP1 / SP2 Cluster

2.1 : P1 – CLUSTER SERVER ( BASE & STORAGE & FILE SYSTEM )

KERNEL

2295810 The shutdown process may stop responding in Windows Server 2008 SP2 or in Windows Vista SP2 after you enable the "Shutdown: Clear virtual memory page file" Group Policy setting

https://support.microsoft.com/default.aspx?scid=kb;en-US;2295810

FLTMGR

975759 An application or service that uses a file system filter driver may experience function failure on a computer that is running Windows Vista, Windows Server 2003, or Windows Server 2008

https://support.microsoft.com/default.aspx?scid=kb;EN-US;975759

NTFS

2525064 Ntfs.sys driver takes a long time to mount a large volume in Windows Vista or in Windows Server 2008

https://support.microsoft.com/default.aspx?scid=kb;en-US;2525064

STORPORT

983554 "0x000000BE" Stop error message when you use the Storport.sys driver to manage some storage devices in Windows Server 2008, in Windows Vista, in Windows 7 or in Windows Server 2008 R2

https://support.microsoft.com/default.aspx?scid=kb;EN-US;983554

Storport: check with SAN provider OEM in order to use the latest storport validated by the OEM

HP ProLiant servers:

check for latest E200/E200i firmware (=> rev. 1.82, 17-Apr-2009, or higher)

check for latest hpcisss2 .sys (=> version 6.14.0.32/64 from 7-Jan-2009 or higher)

A Stop error occurs on an HP ProLiant server that has the firmware from an E200/E200i HP Smart Array SAS/SATA controller installed on any Windows Server platform

Ref HP: E200/E200i firmware rev. 1.82, 17-Apr-2009

https://support.microsoft.com/kb/969550/en-us

MPIO

2406705 Some I/O requests to a storage device fail on a fault-tolerant system that is running Windows Server 2008 or Windows Server 2008 R2 when you perform a surprise removal of one path to the storage device

https://support.microsoft.com/default.aspx?scid=kb;en-US;2406705

check with DSM/SAN provider OEM in order to use the latest mpio validated by the OEM

MSDSM

2277440 Stop error message “0x000000D1” occurs in MSDSM.sys on a computer that is running Windows Server 2008

https://support.microsoft.com/default.aspx?scid=kb;en-US;2277440

MOUNTMGR

977153 Error message: When you unmount volumes, delete snapshots or try to fail over disks on which snapshots are saved: "0x00000D6 DRIVER_PAGE_FAULT_BEYOND_END_OF_ALLOCATION"

https://support.microsoft.com/default.aspx?scid=kb;EN-US;977153

VOLSNAP

2279787 Event ID 82 may be recorded in the System log after you extend the protected dynamic volume on a computer that is running Windows Vista or Windows Server 2008

https://support.microsoft.com/kb/2279787/en-us

VSS

955928 A parallel backup operation may fail when the operation is performed by Volume Shadow Copy Service (VSS)

https://support.microsoft.com/kb/975928/en-us

VSSVC

983425 The System State backup operation fails together with the "0x800423f3" error in Windows Server 2008 and in Windows Vista

https://support.microsoft.com/kb/983425/en-us

NETSH

979101 The command "netsh interface ipv4 dump" does not export the subnet mask setting in Windows 7, in Windows Server 2008 R2, in Windows Server 2008, and in Windows Vista

https://support.microsoft.com/kb/979101/en-us

TCPIP

2469100 Manually added route table entries are deleted unexpectedly when you delete an additional IP address in Windows Vista or in Windows Server 2008

https://support.microsoft.com/kb/2469100/en-us

TCPIP

MS10-058: Vulnerabilities in TCP/IP could allow elevation of privilege https://support.microsoft.com/kb/978886/en-us

NDIS

Stop error message on a computer that is running Windows Vista or Windows Server 2008: "STOP: 0x0000007F"

https://support.microsoft.com/kb/972907/en-us

AFD

A memory leak occurs when a Winsock API function is called together with the TF_REUSE_SOCKET flag in Windows Server 2008 and in Windows Vista

https://support.microsoft.com/kb/977332/en-us

MRXSMB

You cannot access shared files or shared printers that are hosted on a remote server in Windows Server 2008 or in Windows Vista

https://support.microsoft.com/kb/2251180/en-us

RDBSS

A deadlock in Rdbss.sys occurs while a Windows Server 2008 SP2-based or Windows Vista-based computer is performing a FastWrite

https://support.microsoft.com/kb/2488754/en-us

SRVNET /SRV2 /SRV

A Windows Vista-based, Windows Server 2008-based, Windows 7-based or Windows Server 2008 R2-based computer that shares some files and some folders may not respond to file share requests

https://support.microsoft.com/kb/2492806/en-us

SRVNET / SRV2 /SRV

MS10-054: Vulnerabilities in SMB Server could allow remote code execution

https://support.microsoft.com/kb/982214/en-us

RPCRT4

An access violation exception occurs in the "NdrClientCall2" function in Windows Vista or in Windows Server

2008

https://support.microsoft.com/kb/2023170/en-us

RPCRT4

MS09-026: Vulnerability in RPC could allow elevation of privilege

https://support.microsoft.com/kb/970238/en-us

WMI

The WMI repository is corrupted on a computer that is running Windows Server 2008 or Windows Vista

https://support.microsoft.com/kb/2464876/en-us

CLASPNP / PARTMGR

PhysicalDisk counters contain invalid and duplicate entries when you use Microsoft Multipath I/O (MPIO) to control one or more storage devices

https://support.microsoft.com/kb/974878/en-us

CLUSSVC

Failback does not occur within the set time period in a Windows Server 2008-based failover cluster

https://support.microsoft.com/kb/982636/en-us

CLUSRES

Authentication requests between nodes in the same cluster may be unable to use the Kerberos protocol if the Negotiate SSP is specified

https://support.microsoft.com/kb/982549/en-us

CLUSRES / VOLSNAP

The failover operation takes a long time to fail over a shared disk resource that is located on a cluster node of a Windows Server 2008-based failover cluster if many snapshots are saved on the shared disk https://support.microsoft.com/kb/973763/en-us

We recommend that you install the following Windows Server 2008 hotfixes, depending on your environment:

952247 (https://support.microsoft.com/kb/952247/ ) The Cluster network name resource and the File Share Witness resource may not come

951308 (https://support.microsoft.com/kb/951308/ ) Increased functionality and virtual machine control in the Windows Server 2008 Failover Cluster Management console for the Hyper-V role

950179 (https://support.microsoft.com/kb/950179/ ) When you run the Validate a Configuration Wizard on a Windows Server 2008-based computer or on a Windows Vista-based computer, the validation does not pass

969550 (https://support.microsoft.com/kb/969550/ ) A Stop error occurs on an HP ProLiant server that has the firmware from an E200/E200i HP Smart Array SAS/SATA controller installed on any Windows Server platform

970529 (https://support.microsoft.com/kb/970529/ ) The volume GUID may unexpectedly change after a volume is extended on a Windows Server 2008 failover cluster node

953652 (https://support.microsoft.com/kb/953652/ ) A physical disk resource may unexpectedly fail or go offline when the IsAlive function is executed on a Windows Server 2008 cluster node

Recommended hotfixes for Windows Server 2008-based server clusters

https://support.microsoft.com/kb/957311

3 - Windows Server 2008 R2 RTM / SP1 Cluster

3.1 : P1 – CLUSTER SERVER ( BASE & STORAGE & FILE SYSTEM )

Kernel

2417038 A child process cannot be created by calling a CreateProcess function that uses the PROC_THREAD_ATTRIBUTE_PREFERSec_NODE parameter in Windows 7 or in Windows Server 2008 R2

https://support.microsoft.com/kb/2417038/en-us