How cool is it that there will be a pediatric oncology camp in a hotel in the city.  Take a look at their website at https://www.campkidsarekids.org.  They are getting ready for the camp to start in Aug 2014. 

https://www.mikepoulson.com/2013/08/migrating-tfs-2010-or-2012-personal.html

https://www.mikepoulson.com/2012/02/home-circuit-power-monitoring-part-2.html

The issue:
When adding a port to >1 vlans as tagged the QBridge interface incorrectly does not check if only adding as “Egress Port”. 
Example: Add Port 24 tagged to vlan 100, attempt to add port 24 tagged to vlan 101 via SNMP.  The latter will fail. 

Additional Note: Brocade/Foundry Private MIBs cannot be used exclusively on the Turbo Iron due to limitations in the switch software.

The Workaround:
For Tagged/Trunked ports only
1. Check if adding port to vlan as tagged
2. Enumerate all vlans on switch
3. Enumerate all vlan members in Vlans to find if Port is member of any vlan as tagged
4. If port is already member call private OID (1.3.6.1.4.1.1991.1.1.3.2.6.1.3.<tag>.<ifIndex>) to add port to vlan as tagged.  You can find more on this OID at https://ipmsupport.solarwinds.com/mibs/FOUNDRY-SN-SWITCH-GROUP-MIB/item.aspx?id=snVLanByPortMemberRowStatus
5. If port is NOT already member use Qbridge interface to add port to vlan.

Code Snip:
public bool addPortToVlan(int tag, int ifIndex, bool isTagged)
        {
            try
            {
                Byte[] currentMembers;
                if (GetQBridgeVlanMembers(tag, isTagged, out currentMembers) == false)
                    return false;

                if (currentMembers.Length == 0)
                    return false; //vlan needs to be created first

                currentMembers = this.GeneratePortByteStream(ifIndex, currentMembers, true);
                //Due to bug in TI code
                //Issue is that QBridge Add port to vlan logic does not check if target port is tagged
                //So if target port is already member of another vlan as tagged it will fail on all other adds

                //Workaround is to use 1.3.6.1.4.1.1991.1.1.3.2.6.1.3.<tag>.<ifindex> i 4 to add the port to the vlan after it is added via qbridge to first

                //If we are doing tagged we need to do workaround
                if (isTagged)
                {
                    //check to see if target port is already member of another vlan
                    if (isPortTaggedinAnotherVlan(ifIndex) == true)//add with snVLanByPortMemberRowStatus 
                        return sendSNMP("1.3.6.1.4.1.1991.1.1.3.2.6.1.3." + tag + "." + ifIndex, 4);

                    //if this did not find and return fall through to qbridge
                }

                return SetQBridgeVlanMembers(currentMembers, tag, isTagged);

            }
            catch (Exception e)
            {
                return false;
            }
        }

Side note: Our business model required that we have a visually appealing design.  This required that we have transparent glass on front doors.  The LCP+ system also required that the doors be non-perforated so no ambient air was pulled into cooling system.
 
Our light touch system deployment automation (SNaPs aka Green Monster) along with having more than 1 customer onsite at a time poses several issues. 

For example:  

1. How do you audit physical access to servers inside of a rack?
2. How do you allow customers physical access to only servers that they have reserved? 
3. How to you allow customers physical access to their servers without providing them access to the back? 
1. Preventing access to the rear of the racks reduces the risk that cables will be moved.  By knowing which power, network and KVM ports systems are connected to allows for easier automation (see project SNaPs).

These along with many other items drove the decision to secure each rack. 

Requirements:

1. Inexpensive solution - less than $4,000 for 33 racks with 66 (2 doors per rack) access points
2. Integrate with existing RFIDs issued to Employees/Partners and customers 
3. Integrate with 24volt Electromagnetic locks that were available on our Rittal racks https://www.rittal-corp.com/products/product_details.cfm?n1Id=5&n2Id=53&n3Id=182&pn=7320721 
4. SQL based backend for ACLs and Auditing 
5. Easy to use User Interface (UI) 
6. Access KIOSK must run Windows 7 
7. C# based UI (WinForms or WPF) 

An option that was considered was to integrate the 24v locks with the Microsoft facilities building access control system.  While this option would have been ideal it had a few issues.

1. Cost:  At ~$1000 per door (we have 33 racks for a total of 66 doors) to integrate the cost would have been very high.  This is the cost that our team would pay to be have a connection into the building security system.
2. Audit log access: Access to audit information is not readily available to teams that are not part of Microsoft physical security teams 
3. API to control access permissions (badge to door mapping): This is not an offering by the access control team

Because the building access integration was not an option I had to come up with another solution.  I determined what components I needed and set out to create a Proof of Concept.
 
Components (After countless searches on Bing I had found all the parts I needed for a solution.):

1. All-in-One touch screen PC that was inexpensive and supported Windows 7 (at the time was not released) 
1. This was a tricky one.  Because Windows 7 had not been released finding a system that was small and had current driver support - https://www.tangent.com/t_thinclients/lcd_515_517.htm
2. USB based RFID badge reader - RFIdeas pcProx Enroll reader https://www.rfideas.com/products/pcprox_readers/pcprox_enroll/index.php
1. This was easy.  Anyone visiting Microsoft's Cafeterias has probably seen the badge readers used at the registers for employee meal accounts
3. 24v DC Relay system that had programmatic ability to be controlled (preferably over Wired Ethernet) - SeaLevel O-440 https://www.sealevel.com/store/440e-ethernet-modbus-tcp-to-32-reed-relay-outputs.html
1. Hardest item to find:  C# APIs, 24v DC @~100mAmps / relay and have enough ports to keep costs down (remember I have 66 doors to secure)
4. 24v power supplies to power locks when engaged - SeLevel TR108 https://www.sealevel.com/store/accessories/power-supplies/tr108-100-250vac-to-24vdc-at-2-7a-desktop-power-supply-requires-power-cord.html
1. The power system must support having 66 locks engaged at a time (Full Open mode).  @~100mAmps per lock it was a significant amount of current

Video that shows concept:

UI Showing limited User access based on RFID badge scanned. User has limited access to only front doors.  And NO access to P1-R1

UI Showing FULL access based on RFID badge scanned.  Includes Lockdown button to disable all relays and open all to allow fast open of all racks.

End-To-End scenario

1. User (Employee, Partner, Customer) uses RFID to enter POD.  RFID access to room is managed with building access control system. 
2. User "taps" RFID to reader attached to Touch Screen directly inside pod door 
3. Badge reader queries SQL DB (using badge SN) to get "Allowed Doors" list 
4. Based on "Allowed Doors" list UI updates to provide user with unlock options for permitted doors 
5. User selects 1 or more doors they wish to have engaged for access and submits request 
6. System creates audit entries in SQL, updates current status of door lock (engaged/disengaged) in SQL, calls "relay control" to engage locks on selected doors 
7. User then walks to selected doors 
8. User presses door handle release button to actuate handle into unlocked position 
9. 60 Seconds after locks were marked as engaged (aka unlocked) command sent to relay control to disengage lock to prevent further access

Rittal Lock notes:
The Rittal locks have 4 handle positions:

1. Locked - cannot be opened and 24v lock is not energized 
2. Energized - 24v lock has been powered and user can press "access button" on lock to move to position
3. Unlocked - Door is unlocked but not opened.  Handle is in "released" position and can be moved to position 4 (Opened) or locked (position 1).  At this point the 24v lock can be energized or not
4. Opened - Door handle is in "up" position and door will swing open on its own.  24v lock can be engaged or not.  Door handle can be locked without closing door (which prevents door from being closed without unlocking again).

Key Access: Each lock ships with a set of keys (that by default is the same for all locks).  Because our physical security requirements are not that high simply collecting the keys was enough for us.  In some scenarios a unique keyed core might be required.
 
Handle position sensor:  Each lock/handle assembly has a sensor to detect if the handle is in positions 3 or 4 (Unlocked or Opened).  My solution did not utilize this feature but some simple additions in hardware would allow it.  This sensor along with adding a contact sensor to the physical door could provide the pieces to create solution that would notify you if the door was left unlocked or opened.  We decided to use policies rather than technology for that.
 
Project source can be downloaded at https://code.msdn.microsoft.com/Inexpensively-improving-d6e0f6d1

The main issue I ran into when first doing Diff disks with VMM was making sure the Parent VHD was on the target HyperV host.  The PowerShell script at https://www.mikepoulson.com/2011/07/how-to-create-differencing-disk-vm-from.html does that work for you.

https://www.mikepoulson.com/2011/07/new-home-power-monitor.html

Currently uses both Microsoft-hohm and Google Power meter. I will soon have to find a new solution.

https://blog.microsoft-hohm.com/news/11-06-30/Microsoft_Hohm_Service_Discontinuation.aspx