Brian Desmond's Blog

At TechEd Next Week

Brian Desmond — Thu, 05 Jun 2008 03:28:31 GMT

I'll be down in Orlando at TechEd IT Pro next week. I'm working a booth of some fashion in the Technical Learning Center most of the week I'm told, so feel free to drop in and say hello if you're in town as well.

Share this post: email it! | digg it! | bookmark it! | live it!

Updated Error Code Lookup Tool

Brian Desmond — Fri, 30 May 2008 04:19:00 GMT

The Microsoft error code lookup tool (which no Windows admin should be without) got updated today: http://www.microsoft.com/downloads/details.aspx?familyid=be596899-7bb8-4208-b7fc-09e02a13696c&displaylang=en&tm.

While it says it's for Exchange, it really covers Exchange, Windows and a number of other Microsoft products. You can plug an error code in and this tool will give you whatever definitions it finds in the headers compiled into it. If you've ever seen an event that says "the error code is in the data", or you get a message that "unknown error 0x80045500" has occurred and you have no idea what to do, this is where to start. I keep the binary in the path on my workstations. Here's a sample for one of the most common codes you'll see:

C:\Documents and Settings\Administrator>err c0000005
# for hex 0xc0000005 / decimal -1073741819 :
STATUS_ACCESS_VIOLATION ntstatus.h
# The instruction at "0x%08lx" referenced memory at
# "0x%08lx". The memory could not be "%s".
USBD_STATUS_DEV_NOT_RESPONDING usb.h
# 2 matches found for "c0000005"

Generally speaking the correct result is the first one for this example. When you get more than one result though you'll have to look at the names of the header files (e.g. usb.h) and see which one makes sense.

Share this post: email it! | digg it! | bookmark it! | live it!

Getting Total Installed Memory with WMI

Brian Desmond — Thu, 29 May 2008 21:24:00 GMT

Getting the amount of memory installed in a machine with WMI is a bit confusing particuarly if you only read the docs partially. I was initially using Win32_ComputerSystem::TotalPhysicalMemory, but the documentation warns "Be aware that, under some circumstances, this property may not return an accurate value for the physical memory. For example, it is not accurate if the BIOS is using some of the physical memory."

The suggested alternative is Win32_PhysicalMemory::Capacity. This was an easy switch in my script, but, I was getting numbers I knew were wrong for the machines I was querying. The part I didn't read was that each instance of Win32_PhysicalMemory represents a single stick of RAM, so, you need to loop through them all and take the sum to get the RAM installed. This snippet will get you the total memory in megabytes:

Set colItems = wmiSvc.ExecQuery("SELECT * FROM Win32_PhysicalMemory", "WQL", wbemFlagReturnImmediately + wbemFlagForwardOnly)
totalMemory = 0
For Each item In colItems
totalMemory = totalMemory + CLng(item.Capacity) / (1024^2)
Next

Share this post: email it! | digg it! | bookmark it! | live it!

Impromptu Hard Drive Refresh - Thanks Acronis

Brian Desmond — Tue, 20 May 2008 03:43:21 GMT

I fix other people's computers and IT problems all day, so the last thing I really feel like doing is fixing my own computer problems at home. My personal workstation decided to blue screen earlier in the evening which was nice. It was one of those blue screens you can't really do anything about without having driver verifier enabled and since I didn't there was nothing I could really do. I did take a SWAG based on the contents of the dump and decide to update my nVidia drivers for my apparently now practically ice age video card. When I rebooted from this driver update, my BIOS gave me some lovely message to the tune of "Primary SATA Drive 0 Not Found". Great, SATA drive 0 has left the building.

I don't really keep anything on my C drive as I have another spindle for data, but, I wasn't really planning to reload my OS and all my settings this week. I don't really do anything that complex on my home PC. I have Carbonite backing up my C drive so if there are odds and ends namely my profile which I needed to recover, I could. I powered down my PC and waited about five minutes and turned it back on and conveniently Primary SATA Drive 0 had returned.

I had been noticing (and ignoring) for the past couple of months probably that various clattering noises had been coming out of the case of this machine, and obviously I probably should have done something about it a while ago. I also ordered a couple too many drives for my other machine last summer, so I had a couple of 500GB spindles in inventory. The folks over at Acronis were kind enough to give me a copy of their Disk Director Server product to play with a while ago, and I've always been really happy with it using it to resize partitions and copy them when I've needed to upgrade the size of a drive.

Tonight I used the Acronis Rescue CD wizard to burn a CD with their toolset on it, and then I booted from that CD and copied the old drive onto the new. Their tool is so simple to use which is great, and it took all of 25 minutes to copy my 50GB of data over. You'd think I wouldn't care that much about simple being that I do this for a living, but like I said before - the last thing I want to do is be reading manuals and searching the web to make my home PC work.

I'd definitely recommend picking up a copy of this tool to have around or the Disk Director product if you don't need to run it on a server OS (I run Windows 2003 at home). I keep one of the rescue CDs laying around just in case I do need it somewhere as it works pretty much everywhere.

In other news, remember when Dell sold tool-less chassis' for their consumer models? The PC in question is a Dell Dimension 4700 minitower which is perhaps 2 or 3 years old. In order to replace this hard drive, I had to remove a screw from the bottom of the case, remove a screw from a hard to reach place inside the case, and then figure out how to properly maneuver their stamped drive carrier to unlatch it from the other stamped metal carrier in the case. This whole mechanical activity probably took me just as much time as imaging the new drive between taking it apart, figuring out how to balance the new drive in there so the short cables reached, and installing the new drive in the carrier.

Share this post: email it! | digg it! | bookmark it! | live it!

Group Policy Editor Shortcuts

Brian Desmond — Sat, 17 May 2008 18:50:22 GMT

I came across these shortcuts today for navigating the group policy editor and thought they'd be worth sharing. They're holdovers from Windows Explorer that also work in the GPO editor.

If you press * while targeting a folder in the console, the folder and all of its' children will be expanded
If you press + while targeting a folder in the console, the folder will be expanded one level
If you press - while targeting a folder in the console, the folder will be collapsed

When you double click on a policy setting, that dialog that comes up is non-modal. What this means is you can click in the GPO editor again and the setting dialog will go to the background. The settings dialogs are not shown in the taskbar, so you'll need to use Alt+Tab to access them.

Share this post: email it! | digg it! | bookmark it! | live it!

Getting Rid of Apple Software Update

Brian Desmond — Sat, 10 May 2008 03:17:59 GMT

I had to load Quicktime on my PC for one reason or another in the past few months. It's not generally a package I load, but, apparently I needed it for some reason. I of course did the extra legwork to find the Quicktime installer that didn't include iTunes, as I also don't have any use for iTunes. In the past few weeks this really annoying dialog started popping up periodically hawking not only some new QuickTime build, but also iTunes.

I have been clicking Quit for weeks now and it's been getting old. I hadn't really invested the time to figure out where this annoying application was launching itself from, but, tonight I stumbled upon the answer by accident. Check your scheduled tasks - apparently Apple took the liberty of installing a job that runs this update application of theirs. I deleted the job - hopefully it doesn't come back and hopefully I don't see this dialog anymore:

Share this post: email it! | digg it! | bookmark it! | live it!

Windows 2003 Forest Functional Level

Brian Desmond — Fri, 11 Apr 2008 05:34:00 GMT

Thought I'd post an informational post for folks who are moving an AD forest to Windows 2003 forest functional level (aka FFL2) as I realized today this piece of information might not be quite as well known as I might have thought. As an FYI, this change adds a number of attributes to the partial attribute set (aka the PAS or global catalog):

Ms-DS-Trust-Forest-Trust-Info
Trust-Direction
Trust-Attributes
Trust-Type
Trust-Partner
Security Identifier
Ms-DS-Entry-Time-To-Die
MSMQ-Secured-Source
MSMQ-Multicast-Address
Print-Memory
Print-Rate
Print-Rate-Unit
MS-DRM-Identity-Certificate

This is done when you upgrade the forest functional level because at this point there are no Windows 2000 domain controllers in the forest and thus a change to the PAS will not force a GC resync. Recall that in Windows 2000, modifying the PAS caused every global catalog in the forest to replicate the global catalog from scratch. In a large environment this could be a major undertaking. Windows 2003 removes this and only replicates the changes. By waiting until Windows 2003 FFL, you mitigate this issue of adding these attributes to the PAS.

This should be a nonevent really but if you've got any issues in the forest that might come out of the woodwork with a PAS modification then this could cause you some grief. Having made this change numerous times, I've only had an issue once and it was a replication block that worked itself out on its' own.

Share this post: email it! | digg it! | bookmark it! | live it!

Upgrading my MCSE

Brian Desmond — Wed, 02 Apr 2008 05:38:00 GMT

So I have an MCSE: Messaging 2003. Took something like 7 or 8 tests to get that way back when and it's still good. Being the good consultant that I am I decided I'd figure out what I need to do to get whatever the new equivelants are on Windows 2008 and Exchange 2007:

The new Windows 2008 exam seems to be an "MCITP: Enterprise Administrator":

Windows 2003 MCSE upgrade Test
Windows Vista Test
Windows 2008 Enterprise Administrator Test

OK so, three tests total for an upgrade. That's a lot of test questions, but, seeing as my transcript says I took the Windows 2000 client test - they have a point. Unfortunately this means I'm going to have to make peace with Vista on some piece of hardware and actually use it. Not looking forward to that - 2003 runs so well on my machines.

The new Exchagne 2007 tests I can run as a seperate thread - seems that's now called an "MCITP: Enterprise Messaging Administrator":

Configuring Exchange 2007 Test
Designing Exchange 2007 Test
Deploying Exchange 2007 Test

Well, three more tests to upgrade. 3 + 3 = 6 tests total to upgrade. I only took 7 or 8 originally so might as well not even call this an upgrade - perhaps renumbering would be a better term.

So, I need to take six tests to change the alphabet soup in my signature line at work. Speaking of alphabet soup - what is up with these new certification names? I can fit "MCSE: Messaging" in my signature without any sort of space constraint. If I plug in there that I'm an "MCITP: Enterprise Administrator and MCITP: Enterprise Messaging Administrator" I'm going to practically have a buffer overrun at only 80 characters across the screen, not to mention I'd look like one of those folks that spells out their 12 useless certifications in their signature line and pastes the jpegs in that they send you when you pass.

Time to start the test taking and theorizing on how to summarize that whole jumble.

Share this post: email it! | digg it! | bookmark it! | live it!

Forcing a Blue Screen via iLO

Brian Desmond — Thu, 27 Mar 2008 05:03:00 GMT

Sometimes one of the most useful resources at your disposal when troubleshooting a hang or other issues is the memory dump file Windows will write out during a blue screen. If a system is hung and you are not able to get to it locally, pressing Ctrl+ScrollLock, ScrollLock isn't going to be a feasible solution. If the server is an HP server with an iLO card (Integrated Lights Out), and you've set a registry key in Windows ahead of time, you can force the system to bluescreen, write the memory dump, and restart.

The key to doing this is generating what's called a nonmaskable interrupt or NMI. The long and short of it is that NMIs are hardware interrupts which have to be serviced immediately. Windows has a concept of IRQ levels, or IRQLs. The highest IRQL is always serviced, preempting any lower level interrupts which are currently being serviced. The preemptive behavior here is called masking the interrupt. So, an NMI is an interrupt which must be serviced immediately. Generally you get an NMI when there's a major hardware fault that prevents the operating system from continuing. This is exactly what happens if we trigger one manually in the iLO.

The first step to getting this functionality working is setting a registry key outlined in KB 927069. Don't mind the part about this only applying to HP Blades or that it only applies to Windows 2000. This works on 2000 and 2003 and it works with hardware other than HP blades. Here's the registry key info:

Path: HKLM\System\CurrentControlSet\Control\CrashControl

Value: NMICrashDump

Data: 1

Type: REG_DWORD

You'll need to reboot for the change to take effect.

If you have the Automated System Recovery (ASR) functionality enabled on the server and you need to get a full memory dump, you will need to turn it off as it can interfere with this process. This is a BIOS setting which I don't have the steps to change easily available. If there's demand (leave a comment), I can track them down.

To crash the box, these are the steps. I shot these screens on a DL360 G4 which is fairly recent hardware. I suspect the screens and locations of options may vary a bit by age (and especially on older legacy Compaq stuff), but the basic process is the same.

1. Login to the ILO and then proceed to the "Server and iLO Diagnostics" link on the left hand navigation:

2. Select the Virtual NMI Button option on the toolbar:

Warning! I can't guarantee that this button generates a warning when you click it on all versions of the iLO firmware. Generating an NMI will HALT your system. Don't click this button just to see what happens!

3. Generate the NMI. This button is towards the bottom of the page so if your browser doesn't automatically scroll down to it, you'll have to drill down:

4. You will get a warning dialog to make sure you're really certain this is what you want to happen. Remember, doing this will HALT your system!

5. The iLO will write a status message to the status bar in IE:

6. At this point Windows will crash with a 0x80 bugcheck and reboot (assuming your machine is configured to automatically reboot after a bluescreen). You can hopefully use the memory dump to assist in troubleshooting the problem at hand.

Note that this capability is present in the Dell DRAC cards (at least certain versions). I'm trying to find out what happened to the option in the latest versions of the cards as it seems to have gone AWOL. I'll post the directions whenever I find out.

Share this post: email it! | digg it! | bookmark it! | live it!

Loading VMWare 6 Tools on 2008 Server Core

Brian Desmond — Sun, 23 Mar 2008 04:37:00 GMT

Normally in VMWare when you go "VM>Install VMWare Tools..." with a Windows guest, autorun kicks right in and the installer launches. On server core this isn't the case. You need to launch the MSI by hand.

To do this, swich to your CD drive (e.g. "D:"), and then launch the MSI manually:

msiexec /i "VMware Tools.msi"

The MSI will launch, but at least for me it appeared hung shortly into the install. There are a couple DLLs it tries to load which aren't in the server core image. The errors about this are hidden behind the installer so if you drag it off the screen some you should be able to OK the message boxes and continue. You'll also get prompted for installing the HTML help engine. I declined this.

These issues aside the VMWare Tools install seems to have suceeded on a 2008 Enterprise Server Core x86 install. I'm running VMWare Workstation 6.0.3 so perhaps the MSI issues will get fixed in a subsequent update to VMWare Workstation.

Share this post: email it! | digg it! | bookmark it! | live it!

How to Sysprep in Windows 2008

Brian Desmond — Sun, 23 Mar 2008 03:43:00 GMT

I thought I'd document how to setup the new sysprep process equivalent on Windows 2008 since the old setupmgr file for making sysprep.inf's doesn't exist anymore (and neither does sysprep.inf).

The first step is acquiring the Windows Automated Installation Kit (WAIK) from somewhere. You can get it from Microsoft's website, MSDN subscriber downloads, and probably the volume licensing downloads site too I'd guess (though I haven't checked). The ISO is available at http://www.microsoft.com/downloads/details.aspx?FamilyID=94bb6e34-d890-4932-81a5-5b50c657de08&DisplayLang=en, and is about an 800MB install on my 2003 SP2 x86 box.

You'll also need to copy the install.wim from your 2008 DVD sources folder to the hard drive as the tool won't work with it if it doesn't have write access.

The tool of choice is the Windows System Image Manager (WSIM). When you start it you'll get a blank screen like this:

The first step is to catalog the image file. You can do this from Tools>Create Catalog, selecting your install.wim and then what image(s) to catalog. I'm setting up 2008 enterprise so I selected the appropriate option. The final three choices are the server core variants:

All of the settings you will want to setup in your unattend.xml file are in the tree under Windows Image. The documentation for all the settings can be found at http://technet2.microsoft.com/WindowsVista/en/library/69eee519-55a6-440d-ab94-56330ef57e291033.mspx. This link http://technet2.microsoft.com/WindowsVista/en/library/71b576bd-cca6-466f-a1db-16500be3098f1033.mspx shows a mapping table between the sysprep.inf file and the new unattend.xml format.

All of the various settings can be applied during different passes of the setup process which sysprep will trigger. You can read about these passes here: http://technet2.microsoft.com/WindowsVista/en/library/7cc1b17c-8cc6-4cb4-a652-fe7c5e40a29c1033.mspx. I built a simple unattend file just for sysprep'ing my base image which includes settings in the generalize, specialize, and oobeSystem passes. All of the settings I chose are outlined below.

My answer file tree:

Disabling the initial configuration dialog:

Disabling auto-starting the server manager application:

Setting my product key, timezone settings, and my name:

Configuring the screen resolution and color depth - 1280x960 is what works in VMWare full screen mode with the tabs across the top:

Configuring setup not to show me the EULA again:

Configuring setup to install a default local administrator account password:

One of the things I discovered doing this is that unlike sysprep from Windows 2000 - 2003, the unattend.xml file isn't deleted at the conclusion of the sysprep process. Recall that downlevel sysprep deletes the c:\sysprep folder when it finishes. In order to replicate this functionality, you can put a command in to delete the unattend.xml file in the SetupComplete.cmd batch file (which must be located in c:\windows\setup\scripts\) which gets called at the end of sysprep. See this link for more info - http://technet2.microsoft.com/WindowsVista/en/library/9cc0e504-9924-4543-89ae-7430906d85e71033.mspx?mfr=true.

I put a simple one line command in my SetupComplete.cmd file:

del /Q /F c:\windows\system32\sysprep\unattend.xml

In order to run sysprep you'll need a new command. The old sysprep UI that was there in Windows 2000 - 2003 doesn't really exist anymore. All of the sysprep command line switches are documented at http://technet2.microsoft.com/WindowsVista/en/library/72cc64e2-a0f3-4516-84fc-097577127fc91033.mspx.

sysprep /generalize /oobe /shutdown /unattend:sysprep.xml

So far this process is working fine for me with Windows 2008 Enterprise x86 full installs. I haven't tried it with server core yet, but if it's different I'll post something about that. I'm inclined to believe given how new and different this process is to me compared to the previous process that there may be some updates to this post over the next several months as I learn the in's and out's of the sysprep process in Windows 2008.

Share this post: email it! | digg it! | bookmark it! | live it!

Windows 2008 - Windows System Image Manager Error

Brian Desmond — Sat, 22 Mar 2008 23:04:00 GMT

I'm working on adding Windows 2008 to my lab and the first step of this for me anyway is making templates. The whole sysprep process in Vista and Windows 2008 has been completely re-engineered so I'm learning on the go here. Turns out you need to load the Windows Automated Installation Kit (WAIK) on a machine and then run the Windows System Image Manager to build the new XML based unattend files. Given this is an 800MB install (versus like 800K for the old setupmgr.exe) I decided to load it on my VMWare host machine which is Windows 2003 x64 R2. My first 2008 VM template is an x86 build.

I was getting the error dialog and stack trace below every time I tried to catalog the install.wim for my x86 Windows 2008 DVD:

System.Reflection.TargetParameterCountException: Parameter count mismatch.
at System.Windows.Forms.Control.MarshaledInvoke(Control caller, Delegate method, Object[] args, Boolean synchronous)
at System.Windows.Forms.Control.Invoke(Delegate method, Object[] args)
at Microsoft.ComponentStudio.Common.ErrorReporting.ShowErrorConfirmation(Form owner, String message, Exception ex, String caption, MessageBoxButtons buttons, MessageBoxDefaultButton defaultButton, String servicingPath)
at Microsoft.ComponentStudio.CatalogGenerator.CreateCat(ProgressDialog pd, Object o)
at Microsoft.ComponentStudio.Controls.ProgressDialog.ThreadProc()
at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state)
at System.Threading.ThreadHelper.ThreadStart()

I did some Googling and discovered that if you load the WAIK on an x64 machine, you can only catalog x64 Windows images. So, I loaded the WAIK on my x86 machine and it worked. I also learnt that this problem is documented in the readme which I of course elected not to read from the get-go. The readme file is available at http://www.microsoft.com/downloads/details.aspx?FamilyID=051091e8-51ea-4d2c-96b3-dc9863edebd9. Per the readme the follow permutations are supported:

x86 Image Manager
Can create catalogs for x86, x64, and Itanium-based Windows images.
x64 Image Manager
Can create catalogs only for x64 Windows images.
Itanium-based Image Manager
Can create catalogs only for Itanium-based Windows images.

I also encountered this exception on my x86 machine when I renamed the wim from something other than install.wim in an effort to mark what it was actually for. Renaming it back solved it.

Share this post: email it! | digg it! | bookmark it! | live it!

At DEC This Week

Brian Desmond — Sun, 02 Mar 2008 19:50:00 GMT

I'm heading downtown in a bit for DEC 2008 and will be around all week. Please do say stop by and say hello and join in the conversations if you're there! If you're looking for suggestions on local things I can try and help since I'm from Chicago too.

Share this post: email it! | digg it! | bookmark it! | live it!

Exchange 2007 SCC Install Error

Brian Desmond — Sat, 12 Jan 2008 21:47:00 GMT

Apparently when installing a new Exchange 2007 SCC cluster, you can't give the resource group containing the physical disks the same name as what the cluster virtual name will be.

For example if your mailbox virtual server will accessible via shortname "vmbx01", calling the cluster group "vmbx01" will result in setup failing with this error:

Cluster Common Failure Exception: Cluster Common Failure Exception: The group or resource is not in the correct state to perform the requested operation. (Exception from HRESULT: 0x8007139F)

Once I renamed my cluster group to "vmbx01-disk", setup proceeded business-as-usual. After setup completes you need to migrate all the disks to the new "vmbx01" cluster group that setup will create. This is documented in this article starting at step 19: http://technet.microsoft.com/en-us/library/bb123969.aspx.

Share this post: email it! | digg it! | bookmark it! | live it!

Cool Tool - Anagram

Brian Desmond — Fri, 21 Dec 2007 20:49:25 GMT

Anagram is this really slick tool that will convert generic selected text into Outlook contact records or appointments. I use the contacts feature every day multiple times a day. Here is the scenario - you know the insanely long signatures people put on the bottom of their email message. It's got their phone numbers, email, website, title, company, and inevitably half a dozen other pieces of information. The process of getting all this information into your Outlook address book is time consuming - make a new contact, get each bit of information into the right field, etc. Of course inevitably sometimes you do all this work and Outlook goes "Oh, you already have a contact for this person, do you want to merge?" Anagram converts all this info to a contact object automatically whether it's in an email, webpage, or elsewhere on your machine. You highlight a bunch of text and press F12 and a new prefilled contact form shows up on your desktop. If it's complete (which generally speaking it is) you just hit save and close. It takes all of about 5 seconds from hitting F12 to clicking Save & Close.

My experience with the software has been that it is extremely accurate - sometimes it will mistake the company name for a department or something like that but given the myriad of ways folks lay out their email signatures, it does a top notch job in general. I use this every day a few times a day to catalog folks into my contacts and it makes it SO much easier. You can select text anywhere on the computer, hit F12, and "poof".

As an example I took my usual email signature on my personal account and added a few typical fields to it - title, company, and work phone. I selected the text and hit F12 and you can see the resulting Outlook contact object that got created. Anagram places anything it couldn't parse in the "Notes" field which in this case was my salutation - "Thanks," since I included that in the selection. This is a cool (configurable) feature so you can easily see what it wasn't able to parse if anything.

Anagram also does appointments where if you select something with info about a date/time it will pre-fill a new appointment form for your Outlook calendar. I personally have only used this feature once or twice as I generally get actual meeting request messages. I'm not really comfortable saying much about this part since I never use it but I can only assume that it works just as well as the contact parsing functionality. Their website also talks about compatibility with Palm devices and some other services but I have no experience with this stuff.

I stumbled across Anagram by Textual one way or another probably at least six months ago. I bought it after a few days of using the trial and it's been some of the best thirty bucks I've spent on software in quite a while. I'd highly recommend taking a look at Anagram if the scenario in this post sounds anything like what you're doing all the time. I get one or two uses a day out of the product at least.

Share this post: email it! | digg it! | bookmark it! | live it!