Author: Chris Bradford

Categories
Domain Migration

AD Migration : Cleanup extensionAttributes

AD Migration : Cleanup extensionAttributes

The Quest migration tools use extensionAttributes to keep objects in the source and destination domains. the script below will remove these entries. Change the desired extensionAttributes you wish to purge, as highlighted in red. You can also change the scope by changing strFilter and strOU.

   Const ADS_PROPERTY_DELETE = 4
   Const ADS_PROPERTY_UPDATE = 2
   Const ADS_PROPERTY_CLEAR = 1
  
   Dim strFilter ‘As String
   Dim oConnection ‘As ADODB.Connection
   Dim oRecordSet ‘As ADODB.RecordSet
   Dim strQuery ‘As String
   Dim strDomainNC ‘As String
   Dim oRootDSE ‘As IADs
   Dim vArray ‘As Variant()
   Dim vSid ‘As Variant
   Dim oDirObject ‘As Variant
   Dim strOU ‘As String

   ‘ Find the domain naming context
   set oRootDSE = GetObject(“LDAP://RootDSE”)
   strDomainNC = oRootDSE.Get(“defaultNamingContext”)
   set oRootDSE = Nothing

   ‘ Setup the ADO connection
   Set oConnection = CreateObject(“ADODB.Connection”)
   oConnection.Provider = “ADsDSOObject”
   oConnection.Open “ADs Provider”
   strOU = “OU=IT,”
   strFilter = “(&(objectClass=user)(objectCategory=person))”
   ‘strFilter = “(&(objectClass=computer))”
   ‘strFilter = “(&(objectClass=group))”
   strFilter = “(&(objectClass=contact))”
   strQuery = “;” & strFilter & “;distinguishedName,objectClass,name,extensionAttribute8,extensionAttribute9,targetAddress”

   ‘Execute the query
   set oRecordSet = oConnection.Execute(strQuery)

   if oRecordSet.Eof then
     WScript.Echo “No objects were found”
     WScript.Quit(0)
   Else
     Dim vClasses ‘As Variant
     Dim strClass ‘As String

     WScript.Echo “The following objects were found:”

     ‘ Iterate through the objects that match the filter
     While Not oRecordset.Eof
        vClasses = oRecordset.Fields(“objectClass”).Value
        strClass = vClasses(UBound(vClasses))
        If IsNull(oRecordSet.Fields(“extensionAttribute8“).Value ) and IsNull(oRecordSet.Fields(“extensionAttribute9“).Value) Then
            ‘Values Empty
        Else
            WScript.Echo chr(34) & oRecordset.Fields(“distinguishedName”).Value  & chr(34) & “,” & _
              chr(34) & oRecordset.Fields(“name”).Value   & chr(34) & “,” & _
              chr(34) & oRecordset.Fields(“extensionAttribute8“).Value & chr(34) & “,” & _
              chr(34) & oRecordset.Fields(“extensionAttribute9“).Value & chr(34)

              If InStr(oRecordset.Fields(“name”).Value, “/”) Then
                  ‘Ignore entries with a “/” in the canonical name – this will cause the script to fail
              Else
                set oDirObject = GetObject(“LDAP://” & oRecordset.Fields(“distinguishedName”).Value)
                oDirObject.PutEx ADS_PROPERTY_CLEAR, “extensionAttribute8“,  0
                oDirObject.SetInfo   
                oDirObject.PutEx ADS_PROPERTY_CLEAR, “extensionAttribute9“,  0
                  oDirObject.SetInfo
                End If   
        End if
        oRecordset.MoveNext
     Wend
   End if

   ‘Clean up
   Set oRecordset = Nothing
   Set oConnection = Nothing

 
Function OctetToHexStr(sOctet)
  Dim k
  OctetToHexStr = “”
  For k = 1 To Lenb(sOctet)
    OctetToHexStr = OctetToHexStr _
      & Right(“0” & Hex(Ascb(Midb(sOctet, k, 1))), 2)
  Next
End Function

Categories
Domain Migration

AD Migration : Dump SIDHistory

AD Migration : Dump SIDHistory

Use the following script to dump SIDHistory for all objcts, or those under a particular OU. Change the strOU attrobute to “” if you wish to dump the SIDHistory for ALL objects, limit the objects that the SIDHistory  is gathered for by using the strFilter attribute. For example:

  • To report on User Account only, change strFilter to: “(&(objectClass=user)(objectCategory=person))”
  • To report on Groups chang strFilter to “(objectClass=Group)”

Save the script below into a vbs file then execute using the command: cscript.exe /nologo .vbs >> SIDHistory

Const ADS_PROPERTY_DELETE = 4

   Const ADS_PROPERTY_UPDATE = 2

   Dim strFilter ‘As String
   Dim oConnection ‘As ADODB.Connection
   Dim oRecordSet ‘As ADODB.RecordSet
   Dim strQuery ‘As String
   Dim strDomainNC ‘As String
   Dim oRootDSE ‘As IADs
   Dim vArray ‘As Variant()
   Dim vSid ‘As Variant
   Dim oDirObject ‘As Variant
   Dim strOU ‘As String

   ‘ Find the domain naming context
   set oRootDSE = GetObject(“LDAP://RootDSE”)
   strDomainNC = oRootDSE.Get(“defaultNamingContext”)
   set oRootDSE = Nothing

   ‘ Setup the ADO connection
   Set oConnection = CreateObject(“ADODB.Connection”)
   oConnection.Provider = “ADsDSOObject”
   oConnection.Open “ADs Provider”
   strOU = “OU=IT,”
   strFilter = “(&(objectClass=*))”
   strQuery = “;” & strFilter & “;distinguishedName,objectClass,name,sidHistory;subtree”

   ‘Execute the query
   set oRecordSet = oConnection.Execute(strQuery)

   if oRecordSet.Eof then
     WScript.Echo “No objects were found”
     WScript.Quit(0)
   Else
     Dim vClasses ‘As Variant
     Dim strClass ‘As String
     WScript.Echo “Name, Class, DN, SIDHistory”
     While Not oRecordset.Eof
        vClasses = oRecordset.Fields(“objectClass”).Value
        strClass = vClasses(UBound(vClasses))
        If IsNull(oRecordSet.Fields(“sIDHistory”).Value ) Then
           ‘object does not have a sidHistory
        Else
            ‘WScript.Echo chr(34) & oRecordset.Fields(“name”).Value & chr(34) & “,” & _
            ‘    chr(34) & strClass & chr(34) & “,” & chr(34) & _
            ‘    oRecordset.Fields(“distinguishedName”).Value & chr(34)
           
            set oDirObject = GetObject(“LDAP://” & oRecordset.Fields(“distinguishedName”).Value)
               vArray = oDirObject.GetEx(“sIDHistory”)
              
               For Each vSid in vArray
                   If OctetToHexStr(vSid) > “” Then
                       WScript.Echo chr(34) & oRecordset.Fields(“name”).Value & chr(34) & “,” & _
                        chr(34) & strClass & chr(34) & “,” & chr(34) & _
                        oRecordset.Fields(“distinguishedName”).Value & chr(34) & “,” & chr(34) & _
                        OctetToHexStr(vSid)    & chr(34)
                End If
            Next
        End if

        oRecordset.MoveNext
     Wend
   End if

   ‘Clean up
   Set oRecordset = Nothing
   Set oConnection = Nothing

 
Function OctetToHexStr(sOctet)
  Dim k
  OctetToHexStr = “”
  For k = 1 To Lenb(sOctet)
    OctetToHexStr = OctetToHexStr _
      & Right(“0” & Hex(Ascb(Midb(sOctet, k, 1))), 2)
  Next
End Function

Categories
SQL

SQL : SQL Server Migration Process

image002

SQL Server Migration Process

 

Environment information:

  • Old Domain Name: domold.local / DOMOLD
  • New domain name: domnew.local / DOMNEW

You will need to update these domain names in the relevant processes and scripts detailed below.

Identification of Application Domain Dependencies

Stage one of this process is to establish any domain dependencies within an application. This includes email and active directory (authentication).

Recreation of Service Accounts

Logon to the system you are intending to migrate and identify all service accounts that are on the old domain;

 


 

Each of these accounts must be recreated on the new domnew.local domain. Each account should be prefixed with ‘svc_’ in order to easily identify service accounts in the future.

 

  

 

The accounts should also be configured so that the password does not expire, passwords should be documented. Once recreated you must now modify services so that they use the new service account:

 

         

 

It may also be necessary to mail-enable service accounts, ensuring they have the correct email address.

 

 

File System Permissions

Verify file system permissions and create additional entries for the new service account. Generally speaking these will be application specific directories and must be set manually.


Quest Tools Processing

 

EU Operations are now able to process the machine using the Quest tools. This tool will ensure all file system level user permissions are migrated on the server (excluding service accounts).


  

 

After completion of this step we can now move the server into the domnew.local domain, once complete the server will reboot.

 

  

 

 

Local Server Security Polices

 

Local security policies must be modified to allow logon as a service / batch job rights for individual accounts. On the old domain this was done via GPO, however we have now moved back to local security policies to achieve this.

Identify where the existing service account has been granted permissions and manually recreate them.

 

To identify current permissions Start > Run > gpedit.msc to load the local security policy editor.

 

  

 

 

Expand Computer Configuration > Windows Settings > Security Settings > Local policies > User Rights Assignment

 

  

 

Check for any entries for the local domain such as DOMOLD accounts and replace these with DOMNEW accounts.

                               

 

Application Level Changes

We are now ready to change application level domain dependencies on the migrated server as identified in stage one.

Scheduled Tasks

You will need to ensure all scheduled tasks are using DOMNEW accounts.

  

For non-SQL servers the migration process ends here.


SQL Server Specific Elements for Migration

Create a new service account; this account must be a local administrator on the machine:

 

  

 

The account must be granted logon as a service rights:

 

  

 

 

The account must be granted a SQL Login at the server instance level, this can be achieved form within Enterprise Manager:

 

  

 

         

 

     

 

Please note if the account is shown as the ‘dbo’ user do not set the permissions, instead you must run the sp_changedbown stored procedure against the database:

 

  

 

The Query should look as follows:

 

USE

Expediciones

EXEC sp_changedbowner ‘DOMNEW\SVC_USD1SQL’

 

USE

mdb

EXEC sp_changedbowner ‘DOMNEW\SVC_USD1SQL’

 

Change the Database name (in bold) and the username as is appropriate.

Next we must change the SQL Agent Job owners for the database. You can view all jobs from enterprise manager:

 

  

 

Double-click each job and change the owner to the new DOMNEW object:

 

  


To automate job changes you can use the following T-SQL script, this will change the owner of all jobs that have domold.local ownership to domnew.local\svc_sqladmin

 

–********* Before proceeding please backup the MSDB database in order to provide roll-back. ***********

 

USE MSDB

GO

SELECT GETDATE() AS ‘ExecutionTime’

GO

SELECT @@SERVERNAME AS ‘SQLServerInstance’

GO

SELECT j.[name] AS ‘JobName’,

Enabled = CASE WHEN j.Enabled = 0 THEN ‘No’

ELSE ‘Yes’

END,

l.[name] AS ‘OwnerName’

FROM MSDB.dbo.sysjobs j

INNER JOIN Master.dbo.syslogins l

ON j.owner_sid = l.sid

WHERE l.[name] like ‘%DOMOLD\%’ or l.[name] like ‘%DOMOLD\%’

ORDER BY j.[name]

GO

 

SET NOCOUNT ON

SELECT ‘EXEC MSDB.dbo.sp_update_job ‘ + char(13) +

‘@job_name = ‘ + char(39) + j.[Name] + char(39) + ‘,’ + char(13) +

‘@owner_login_name = ‘ + char(39) + ‘DOMNEW\svc_sqladmin’ + char(39) + char(13) + char(13)

FROM MSDB.dbo.sysjobs j

INNER JOIN Master.dbo.syslogins l

ON j.owner_sid = l.sid

WHERE l.[name] like ‘%DOMOLD\%’ or l.[name] like ‘%DOMOLD\%’

ORDER BY j.[name]

 

 

 

Next we must identify and change all DTS Packages that are owned by old domain accounts. The following T-SQL will identify all unique accounts, which own DTS packages:

 

SELECT distinct owner FROM sysdtspackages

 

 

You will need to manually list the unique users and then run the following T-SQL for each user. Change the @old_owner and @new_owner definition at the start of the script:

 

–********* Before proceeding please backup the MSDB database in order to provide roll-back. ***********

 

DECLARE @old_owner varchar(100), @new_owner varchar(100), @name sysname, @id uniqueidentifier

 

set @old_owner = ‘DOMOLD\sqladmin’

set @new_owner = ‘DOMNEW\svc_sqladmin’

 

IF (NOT EXISTS (SELECT * FROM sysdtspackages WHERE [owner] = @old_owner))

BEGIN

   RAISERROR(‘User ”%s” does not own any packages’, 16, 1, @old_owner)

   RETURN

END

 

SELECT DISTINCT [name], [id]

FROM sysdtspackages

WHERE [owner] = @old_owner

 

 

DECLARE cur_sysdtspackages CURSOR FOR

   SELECT DISTINCT [name], [id]

   FROM sysdtspackages

   WHERE [owner] = @old_owner

OPEN cur_sysdtspackages

FETCH NEXT FROM cur_sysdtspackages

INTO @name, @id

WHILE @@FETCH_STATUS = 0

BEGIN

     Print +N’Re-assigning owner on DTS Package: ‘ + @name

       EXEC sp_reassign_dtspackageowner @name=@name, @id=@id, @newloginname=@new_owner

     FETCH NEXT FROM cur_sysdtspackages

     INTO @name, @id

END

CLOSE cur_sysdtspackages

DEALLOCATE cur_sysdtspackages

 

 

Finally, change the credentials for the SQL services:

  

 

Enter the new DOMNEW username and password:

 

  

Verify that Database Level Users are added for the new DOMNEW domain:

  

 

Categories
Windows Server 2003

DNS : Enabling DNS Dynamic Update Credentials

image002

DNS : Enabling DNS Dynamic Update Credentials

 

For further info see MS KB Article: http://support.microsoft.com/default.aspx/kb/816592

 

This should be setup when you enabled secure updates only for an AD-Integrated DNS zone and have devices that are unable to perform secure dynamic updates of their A/PTR records. Examples of this type of device are Thin Client terminals.

 

Configure service account details on each server as detailed below, use the service account ‘svc_dnsproxy’

 

    

 

Then add the computer objects to the ‘DNSUpdateProxy’ group in AD:

 

 

Finally it is necessary to remove the stale records from reverse DNS manually. We can immediately clear the 10.144.X.X reverse DNS records then selectively remove remaining stale records ensuring that DCs, Servers and Static Addresses are not deleted.

 

Forward lookup entries should not be affected by this change.

 

This change will probably be necessary on all European sites.

 

Records will now register as follows:

 

Categories
General

ESXi : Performing P2V Conversions using VMWare Converter

image002

ESXi : Performing P2V Conversions using VMWare Converter

 

In order to convert a system it must be out of production – i.e. no transactions or processing can take place during the conversion.

 

I recently had to conduct around 60 P2V migrations to an ESXi cluster. The physical machines were on various subnets protected by firewalls that could not be modified ad-hoc to facilitate the migrations. I had two options:

 

1.        Create rules for P2V communication; this requires (more information here: http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1010056)

 

Source

Destination

TCP Ports

UDP Ports

Converter server

Source computer

445, 139, 9089, 9090

137, 138

Converter server

VirtualCenter

443

 

Converter client

Converter server

443

 

Source computer

ESX

443, 902

 

 

2.        Use a conversion hub to bridge the required networks and act as the converter. This should be a Windows 2008 R2 VM with a VMXNET3 adapter connected to each network hosting physical machines )enabled on-demand, as required). The server should have RRAS installed as detailed below; this server must have an interface on the management network of the ESXi hosts.

 

 

  

 

  

 

 

Concepts;

3 servers are involved in the migration process;

  • Source Server – the physical server you wish to convert to a virtual server
  • ESX/Destination Server – the destination ESX host you wish to virtualise the physical server too.
  • Converter Server – hostname vCONVERTER – Standalone Windows 2008 R2 with IP Routing Capabilities and VMware Converter – use RDP to access.

 

You have two options for the P2V conversion;

1.        Online (with transactional processing stopped)

2.        Cold Clone

 

For cold clone scenarios boot from the cold clone CD available and then proceed from step 6 under P2V Conversion. Things to bear in mind:

  • You cannot ping the WindowsPE cold clone operating system, this is due to Windows Firewall. You can disable this using petool (supplied with cold clone ISO) – petool -i -f –disable
  • The default gateway on the cold clone should be IP address of the vCONVERTER machine’s interface on the same subnet.
  • You can inject SCSI/Network drivers into the coldclone iso file using petool, use ‘-n’ for network and ‘-d’ for storage; petool -i -n

 

Online P2V

 

Preparation

 

1.        Reset the local administrator password on the source server, unless you are 100% sure you know the password.

 

2.        Stop all transactional processing (SERVICES) on the source server and then configure service start-up as follows:

a.       For SQL servers: set SQL services manual.

b.       For Citrix use the cold clone CD

c.        For a Domain Controller use the cold clone CD

 

3.        On the source server capture all IP addressing and NLB information/configuration:

 If the server is on a different subnet to the ESXi hosts you will need to configure host routes to facilitate firewall bypass:

For example:

  • Physical host IP address: 172.20.20.152
  • ESXi Server IP address: 10.144.120.1
  • vCONVERTER ESXi Mgmt Network IP: 10.144.120.100
  • vCONVERTER emote subnet IP address: 172.20.20.155

 

                     I.      On the source server create a static host route to the ESXi server (change ESXi server IP address to suit), for example when EUVM01 (IP Address 10.144.120.1) is the destination – change the IP highlighted to suit:

route add 10.144.120.1 mask 255.255.255.255 172.20.20.155 -p

 

                    II.      On the destination ESXi server create a static host route to the source server (change source server IP address to suit), for example when ECOMWA4 is the source server – change the IP highlighted to suit:

esxcfg-route -a 172.20.20.152/32 10.144.120.100

 

 

P2V Conversion

 

1.        Logon to vcCONVERTER using Remote Desktop.

 

2.        Enable the additional NIC that is valid for your required conversion, at the very least you require the following NICs to be enabled:

a.       VMGMT-NETWORK-10.144.120.100-VLAN120

b.       INTERNAL

 

 

3.        Open the VMWare Converter Standalone Client from the desktop:

 

 

4.        Select connect to local server and click ‘Login’

 

 

5.        Click the Convert Machine button to proceed:

 

 

6.        Enter the source server name or IP address, authentication details and then click ‘Next.’ You may be prompted to install the VM Conversion agent, proceed; however this may reboot the server.

 

 

 

Once installed manually reboot the server.

 

7.        You will then be prompted to select a destination host. Because we have vApps the old converter crashes when you connect to the vCenter – If you do the converter will crash and you will have to start again!

 

 

8.        Enter the desired VM name (just the hostname, not FQDN), select the correct storage pool and ensure that the VM version is ‘Version 7’

 

 

9.        You are now able to modify the hardware that the virtual machine will be allocated; click EDIT next to any of the groups (Network etc) to begin the customisation.

 

 

Firstly configure the NIC VLAN membership; do not create teams etc.

  • Un-tick the ‘Connect at power on’ option.
  • Do not worry about selecting the correct VLAN/Network at this stage, for some reason this is ignored during the conversion process.

 

 

10.     Now reduce the CPU count to 1 or 2(MAX) depending on function of the server.

 

 

11.     Finally increase/decrease the storage allocation for each LUN, beware there are three type of clones that can occur:

1.        Disk-based Block-Level (Disk-based)

Available during a cold clone only; disks are copied to the destination block by block.

 

2.        Volume-based Block-Level (Volume-based)

Examine the source partition to determine what the partition boundaries are on-disk and then copy just the selected partitions on to the target disk on a block-by-block basis

 

3.        Volume-based File-Level (File-level)

Converter creates the target disk, partitions and formats it appropriately and copies over data from the source to the target on a file-by-file basis

 

If you reduce the size of a volume it will use the Volume-based File-Level method; typically this is around 5-10 times slower. In a trial conversion of a BL35p we saw Volume-based Block-Level run at around 18MB/sec and Volume-based File-Level run at around 100-300KB/sec. Disabling anti-virus, defragging the volume may help to speed up Volume-based File-Level clones.

 

Select Advanced

 

 

12.     If the server has 2 partitions split these into different vDisks as it will make future growth exercises far easier, click the Add Disk, then click the ‘Move Down’ – do this for each partition.

 

 

You can, if desired, perform a ‘Thin’ P2V using the option available here under the ‘Type’ column select the drop-down box to change disk format to thin.

 

13.     Service Management:

a.        If server is a Citrix Server set all Citrix services to ‘Manual’

b.        If this is a SQL Server set all SQL services to Manual

c.        Disable all HP (or similar OEM) Hardware/Management Services:

 

 

14.     Finally select the ‘Power off source machine’ and ‘Install VMWare Tools…’ options, then click ‘Next.’

 

 

 

 

15.     Review the task you are about to initiate, then click Finish – you may be prompted to reboot the source server, click Yes to reboot – the conversion will start automatically after the reboot.

 

 

 

16.     Once the VM conversion has finished power on the VM and then allow the server to reboot automatically once it has installed the VM tools, you’ll be prompted to select a host to power on the VM on:

 

 

17.     If the physical server was a Windows 2000 server, check that it is not stuck on the ‘It is now safe to turn off your computer’ screen. Physically power it off and remove from the rack/chassis.

 

18.     If server was IDE based you will need to perform the steps here and modify the vmdk files so that the adapterType is not IDE but buslogic. Then detach and re-attache the VMDK:

http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1016192

 

 

 

19.     If the server is a Windows 2003 or newer server, or you P2V’d using the cold clone disk you will have to add a new adapter,

o         For Windows 2003/2008/R2: remove all E1000 adapters on Windows 2000+ VM’s and use VMXNET3,

o         For Windows 2000 use E1000.

 

Click Add, select Ethernet Adapter and change the type to VMXNET3. Finally select the desired network to connect to.

 

 

 20.     From the assign the correct VLAN to each virtual NIC, enable one at a time to know the correct one for each VLAN – they will become active in Control Panel once connected:

 

 

21.     Power off and remove all COM Ports, Floppy Drives and USB Controllers, once complete power on the server:

 

 
 

22.     From Add/Remove Programs remove all HP components except from Data Protector. Once completed reboot the server. You may have to kill a stuck service using task manager if the HP Insight Agents are in a Stopping State, look for cqmgserv.exe.

 

 

23.     Manually remove the HP Network Team Adapter from Device Manager:

 

 

24.     Take a snapshot of the Virtual Machine.

 

25.     Download and run the ‘renewusb_2k.cmd’ (available here: http://cb-net.co.uk/downloads/devcon.zip) script to cleanup hidden/now invalid devices.

 

26.     If server is a HP server download (available here: http://cb-net.co.uk/downloads/HPPSPCleaner.exe). Credits for this tool http://ctxadmtools.musumeci.com.ar/HPPSPCleaner/HPPSPCleanerDownload.html.

 

 

Check network connectivity, check network connectivity x-chassis’ and x-host

 

27.     Delete static route from ESXi server (modify to suit the route you created earlier!):

esxcfg-route -d 172.20.20.141/32 10.144.120.100

 

28.     Delete the route from the Windows Host

 

29.     Delete the snapshot you created earlier.

 

 

30.     If this is a Citirx server perform the following additional actions:

                                                       

a.        To ensure users cannot access VMware Tools from the system tray or control panel:  

1.        Go to C:\Program files\VMware\VMware Tools .

2.        Right-click VMControlPanel.cpl properties and choose Security.

3.        Click Advanced and deselect Allow inheritable permissions.

4.        Click Deny for Read and Execute and Read for the users

5.        Log in as an Administrator.

6.        Right-click on the VMware Tools system tray icon.

7.        Choose Disable.

8.        In the registry editor, delete the VMware Tools key under

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

 

b.        Install WindowsServer2003-KB978243-x86-ENU.exe from P2V folder.

c.        Set /NoExecute=OptIn in the boot.ini file if the Citrix server is x86.

d.        Again, for Citrix Ensure that WindowsServer2003-KB2279561-x86-ENU.exe is installed (available in P2V folder) – this resolves stop 0x00000050 errors when using user mode printer drivers:

 

 

e.        If server is a Citrix server adjust the page file to be RAM x 2 + 100MB (or if equal to/above 8GB RAM then RAM + 100MB)

f.         If you have modified the PageFile and extended the System drive run PageDefrag to create a contagious page file.

g.        If server is a Citrix server set services back to the correct start-up value:

 

 

h.        Finally, in order to ensure user profiles are not corrupted:

1.        Access the Windows Registry. Choose Start > Run, then type regedit. The Registry Editor window opens.

2.        Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order\.

3.        Right-click ProviderOrder and choose Modify. In the Edit String Value dialog box, edit the value data string and remove the word hgfs, vmhgs, or vmhgfs).

o        If the value data string contains LanmanWorkstation,hgfs, LanmanWorkstation,vmhgs, or LanmanWorkstation,vmhgfs, change it to LanmanWorkstation.

o        If the value data string contains only hgfs or vmhgfs, erase it and leave the value data string empty.

4.        Click OK.

5.        Close the registry editor. Choose File > Exit.

Reboot the virtual machine.

 

31.     If server is Windows 2003+ use Network Load Balancer MMC tool to re-add host, for Windows 2000 manually reconfigure the host. Including adding the secondary IP address to the host.

 

32.     If server is a Windows 2003 server power off VM and configure Hardware Instruction Set and MMU virtualisation. Under the properties of the VM select the ‘options’ tab, then select CPU/MMU Virtualisation options. Select the value to suit your environment.

 

 

33.     Again, if the server was a HP server, Delete the following registry keys:

Ø       HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CPQTeamMP

Ø       HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CPQTeam

Ø       HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cpqasm2

Ø       HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CpqCiDrv

Ø       HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CpqCiDrv\Security

 

34.     Remove any HP Network Utility bindings from the VM NICs

 

 

35.     Configure LAN interface power management options (disable power management!):

 


36.     Move VM to the correct resource pool and adjust resource pool shares accordingly

37.    Confirm that the following DWORD value is set to HEX 3C:

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Disk\TimeOutValue

38.     Test server/application.

Categories
General

ESXi : Using VMA to manage ESXi server logs

image002

ESXi : Using VMA to manage ESXi server logs

ESXi uses a scratch partition to store logs files; when a server is restarted/rebooted logs will be lost. Using vMA it is possible to ship logs to another server in order to preserve them for troubleshooting purposes.

Logs are stored under /var/log/vmware/


 

The following logs are collected from ESXi servers:

  • Hostd – Host Management service log
  • messages – VMkernel, vmkwarning, and hostd log
  • vpxa – vCenter Agent log

 

 

The settings defined in your vMA setup will determine how many logs are stored for your ESXi hosts, for example the following command will store 20 log files with a maximum size of 10MB per log file, logs will be collected every 10 seconds:

vilogger enable –server vm01.domain.local –numrotation 20 –maxfilesize 10 –collectionperiod 10

 

It is also possible to use the built-in syslog server to store logs to a datastore: http://kb.vmware.com/selfservice/microsites/search.do?cmd=displayKC&externalId=1016621

Categories
General

vCenter : Creating a new vSphere Cluster in vCenter

image002

Creating a new vSphere Cluster in vCenter

Right-click the Datacenter object in the vCenter tree and select ‘New Cluster’

    

 The ‘New Cluster Wizard’ will be launched, enter a Cluster Name and select the cluster features you would like to enable:

     

 If you enable DRS you will be prompted to configure DRS;

  • Manual (suggest only, no automation)
  • Partially Automated (VM’s will automatically start on a node determined by DRS, but will not be moved)
  • Fully Automated (VM’s auto power on DRS assigned node and will be moved according to DRS)

     

 You will also be prompted to enable/disable DPM (VM hosts will be powered on/off dynamically as capacity requirements increase):

  • Off
  • Manual (recommend only)
  • Automatic (automated)

     

 

Next you’re prompted to configure VMHA, depending on your configuration you will want to set:

  • Enable Host Monitoring (recommended in most scenarios)
  • Enable/Disable Power on VM’s that violate availability constraints

 I have selected the latter because I have then determined VM HA requirements on a per-VM basis on the cluster (shown later).

     

 

You’ll then be prompted to configure the defaults for VM restart priority and the Host Isolation Response:  

     

You can also monitor individual VM’s if required; VM’s will automatically restart if monitoring fails:

     

In order to ensure host compatibility with the cluster you can enforce an EVC mode:

     

Configure the default swap-file location:

     

Then click finish to create the cluster:

     

To add nodes to the cluster simply drag and drop them into the new cluster object in the vCenter tree:

     

 You will see the progress of each node being added in the task status area of the venter console:

    

 

Categories
Windows 2008

HP Dataprotector 6.0: Backup SQL Server 2008

HP Dataprotector 6.0: Backup SQL Server 2008

In order to backup SQL 2008 using DP 6.0 you must use the DataProtector 6.11 Agent (as well as installing the SQl 2005 Backwards Compatibility Pack), if you do not use the 6.11 agent you will receive the following error on the Cell Manager Session logs:

[Critical] From: @demhpdb01.domain.local “”  Time: 08/06/2011 13:47:13
    Virtual Device Interface reported error:
The object was not open.

    See also Data Protector debug.log and SQL Server error log for details.

[Normal] From: [email protected] “MHP”  Time: 08/06/2011 13:47:14

Completed OB2BAR Backup: demhpdb01.domain.local:/MHP/model/0 “MSSQL”

[Major] From: [email protected] “MHP”  Time: 08/06/2011 13:47:14

[Normal] From: [email protected] “MHP”  Time: 08/06/2011 13:47:41

[Critical] From: @demhpdb01.domain.local “”  Time: 08/06/2011 13:47:42
    Virtual Device Interface reported error:
The object was not open.

    See also Data Protector debug.log and SQL Server error log for details.

From: @ “”  Time:

From: @ “”  Time:

[Major] From: [email protected] “CDC-WIN-DEMHPDB01-SQL 2”  Time: 08/06/2011 13:46:49

Bad catalog access – FormatMessage() failed with 1813Bad catalog access – FormatMessage() failed with 1813Bad catalog access – FormatMessage() failed with 1813

The Application Event Log on the client will also log:

SQLVDI: Loc=IdentifySQLServer. Desc=MSSQLSERVER. ErrorCode=(1060)The specified service does not exist as an installed service.
. Process=3208. Thread=3912. Client. Instance=. VD=.

Categories
General

vCenter : Installation Steps for Remote Clustered SQL Database

vCenter Build : Installation Steps

1    vCenter 4.1 does not support 32-bit OS; use Windows 2008 R2 x64 Standard

2    Install / Configure a SQL 2008 R2 Cluster Database (outside the scope of this document), set the Instance port to 2126

3    Execute the following SQL to allow DP backups:   

  • CREATE LOGIN [DOMAIN\svc_DP-agent] FROM WINDOWS 
  • sp_addsrvrolemember @loginame =  [DOMAIN\svc_DP-agent], @rolename = 'sysadmin'

4    Create two databases on the HA database cluster:  

  • VCDB1 
  • VCUMDB1

5    Create a sevrice account for the vCenter cluster:   

  • svc_euvcenter01 (Note each vCenter must have a unique account (offline vCenter shares the same as online))

6    Using secpol.msc or Group Policy grant the service account tothe following user rights on both VCENTER servers:

  • Act as part of the Operating System
  • Logon as a Service

8    Execute the following SQL to add the user to the SQL instance:  

  • CREATE LOGIN  [DOMAIN\svc_euvcenter01] FROM WINDOWS

9    Execute the following SQL:

  • ALTER LOGIN   [DOMAIN\svc_euvcenter01] WITH DEFAULT_DATABASE = VCDB1

10    On VCDB1 execute the following SQL:  

  • EXEC sp_changedbowner @loginname='svc_euvcenter01' @map='true'

11    On VCUMDB1 execute the following SQL:  

  • EXEC sp_grantdbaccess 'DOMAIN\svc_euvcenter01', 'svc_euvcenter01'   EXEC sp_addrolemember 'db_owner', 'svc_euvcenter01'

12    Grant the service account db_owner permissions on the MSDB database:  

  • USE MSDB;   GO   EXEC sp_grantdbaccess 'spicerseu\svc_euvcenter01', 'svc_euvcenter01'   EXEC sp_addrolemember 'db_owner', 'svc_euvcenter01'

13    Create the following SQL Maintenence Tasks:  

  1. Daily 21:00 Check Integrity, Backup and Cleanup old BAK Files VCDB1  
  2. Daily 22:00 Check integrity, Backup and Cleanup old BAK Files VCUMDB1  
  3. Weekly 00:00 Sunday Check Integrity, Backup and Cleanup BAK Files SYSTEM Database

14    Make the svc_euvcenter01 account a local administrator on the vCenter server

15    Install SQL 2008 Native Client on both vCenter Servers

16    Create a 64-bit ODBC DSN for VCDB1:  

  1. Select SQL Native Client as driver  
  2. Server: EUVCDBCL1I1\I1,2126  
  3. Use Windows Authentication (do not define SPN)  
  4. Change default database to be VCDB1

17    Create a 32-bit ODBC DSN for VCUMDB1:  

  1. Select SQL Native Client as driver  
  2. Server: EUVCDBCL1I1\I1,2126  
  3. Use Windows Authentication (do not define SPN) 
  4. Change default database to be VCUMDB1

18    Create a exclusion policy for McAfee and apply to vCenter servers:   \Device\vstor*

19    Create firewall exceptions on EUVCENTER01/02:  

  • netsh advfirewall firewall add rule name="vCenter HTTP" dir=in action=allow protocol=TCP localport=80
  • netsh advfirewall firewall add rule name="vCenter AD Services" dir=in action=allow protocol=TCP localport=389
  • netsh advfirewall firewall add rule name="vCenter Client Listener" dir=in action=allow protocol=TCP localport=443
  • netsh advfirewall firewall add rule name="vCenter Linked Mode SSL" dir=in action=allow protocol=TCP localport=636
  • netsh advfirewall firewall add rule name="vCenter Management" dir=in action=allow protocol=TCP localport=902
  • netsh advfirewall firewall add rule name="vCenter Console" dir=in action=allow protocol=TCP localport=903
  • netsh advfirewall firewall add rule name="vCenter Management WebService" dir=in action=allow protocol=TCP localport=9080
  • netsh advfirewall firewall add rule name="vCenter HTTPS" dir=in action=allow protocol=TCP localport=9443
  • netsh advfirewall firewall add rule name="vCenter SDK" dir=in action=allow protocol=TCP localport=60099

20    Enable ICMP Echo Request on both vCenter Servers

21    Install .NET 3.5.1 via Server manager > Features

22    Install J# x64 from VMware-VIMSetup-all-4.1.0-259021\redist\vjredist

23    Install Visual C++ 2005, 2008 (x64 and x86) from VMware-VIMSetup-all-4.1.0-259021\redist\vcredist\2005

24    Logon as service account

25    Install vCenter:

  • Ensure that Web Server HTTP/HTTPS ports are changed from 8443 and 8080 to 9443 and 9080 this is because these ports conflict with McAfee EPO
  • Create dependency on MacAfee Framework Service for vpxd (due to conflict)

26    Restart server, check all VMWare services start

27    Remove MSDB permissions for svc_euvcenter01 account (when second sever is completed)

28    Configure Virtual Connect profiles for all VM servers   

29    Deploy ESXi to all virtual hosts using HP ESXi media

30    Configure TCP/IP, hostname and root password to XXXXXXXXX and set management VLAN (if applicable)

31    Configure forward and reverse DNS entries for vCenter Servers

32    Login to vSphere Client

33    Add licenses to vCenter

34    Create a new Datacenter

35    Import vSphere Hosts

36    Set Time Server Settings

37    Create a vSphere cluster

38    Drag and drop nodes imported into cluster

39    Create the following distributed switches:  

  • dvSwitch_Management/vMotion
  • dvSwitch_Ecommerce
  • dvSwitch_Internal

40    Create the following dvPortGroups under dvSwitch_Management/vMotion: 

  • dvPortGroup_Internal_VLAN120  
  • dbPortGroup_Internal_VLAN121
  • dbPortGroup_Internal_VLAN121

41   Create the followingdvPortGroups under dvSwitch_Internal:  

  • dvPortGroup_Internal_VLAN1  
  • dvPortGroup_Internal_VLAN90  
  • dvPortGroup_Internal_VLAN110  
  • dvPortGroup_Internal_VLAN115

42   Create the followingdvPortGroups under dvSwitch_Ecommerce:

  • dvPortGroup_Ecommerce_VLAN1  
  • dvPortGroup_Ecommerce_VLAN10  
  • dvPortGroup_Ecommerce_VLAN20  
  • dvPortGroup_Ecommerce_VLAN35  
  • dvPortGroup_Ecommerce_VLAN70

43  On dvSwitch_Internal change teaming and failover settings so that VLAN120 is preferred on adapter dvUplink1 and VLAN121 and VLAN122 are preferred on dvUplink2

44  Migrate server console to dvSwitch_ManagementvMotion

45    Define host level vmk1 and vmk2 Virtual Adapter and enable vMotion – this is a manual process on each host individually

46    Create host profile and validate all nodes against this

47    Present shared storage to all cluster nodes

48    Configure datastores and ensure availability on all hosts; odds sys side, evens cdc side

49    Create Windows and Linux VM’s

50    Test vMotion Host move

51    Test vMotion Datastore Move

52    Test VMWare HA

53    Test vVMWare DRS

54    Test DR scenarios:  

  1. Controlled shutdown
  2. Storage failover
  3. VMHA – Poweroff Node and wait for VM startup on another node
  4. SAN Storage Failover

55    Configure Network IO correctly on each Distributed Switch

56    Configure vCenter Mail Settings

57    Configure Exchange CAHT relay permissions

58    Configure alarms to send emails for the following host related issues:  

  • Host connection failure  
  • Host Storage Status  
  • Network connectivity lost  
  • Network uplink redundancy degraded  
  • Host CPU Usage  
  • Host Memory Usage

59    Modify c:\Program Files\VMware\Infrastructure\VirtualCenter Server\extensions\com.vmware.vim.stats.report\extension.xml  

  • Replace * with server FQDN this will resolve the ‘Navigation to the webpage was cancelled Refresh the page’ error

Setup Standby vCenter Server

1  Stop live vCenter VMWare Services, shutdown live vCenter

2    Perform full database backup

3    Make the svc_euvcenter01 account a local administrator on the vCenter server

4    Install SQL 2008 Native Client

5    Create a 64-bit ODBC DSN for VCDB1:  

  • Select SQL Native Client as driver  
  • Server: EUVCDBCL1I1\I1,2126  
  • Use Windows Authentication (do not define SPN) 
  • Change default database to be VCDB1

 6   Create a 32-bit ODBC DSN for VCUMDB1:  

  • Select SQL Native Client as driver  
  • Server: EUVCDBCL1I1\I1,2126  
  • Use Windows Authentication (do not define SPN)  
  • Change default database to be VCUMDB1

7    Create a exclusion policy for McAfee and apply to vCenter servers:   \Device\vstor*

8    Install .NET 3.5.1 via Features

9    Install J# x64 from VMware-VIMSetup-all-4.1.0-259021\redist\vjredist

10  Install Visual C++ 2005, 2008 (x64 and x86) from VMware-VIMSetup-all-4.1.0-259021\redist\vcredist\2005

11  Logon as service account:   svc_euvcenter01   p/w:XXXXXXXXX

12  Install vCenter, using the same license key as the other vCenter  

  • Ensure that WebServer HTTP/HTTPS ports are changed from 8443 and 8080 to 9443 and 9080 this is because these ports conflict with McAfee EPO

13    Restart server, check all VMWare services start

14    Modify c:\Program Files\VMware\Infrastructure\VirtualCenter Server\extensions\com.vmware.vim.stats.report\extension.xml  

  • replace * with EUVCENTER01.spicers.europeThis will resolve the ‘Navigation to the webpage was cancelled Refresh the page’ error

15   Configure same IP address as EUVCENTER01 – YES

16   Login to the Standby vCenter

17   Re-connect each ESXi host

18   Create dependency on mcAfee framework service for vpxd

Categories
Windows Server 2003

Dataprotector : IDB Maintenence

image002

Dataprotector : IDB Maintenence

.1 IDB Backup

Make sure all Data Protector production backups have completed overnight. Any backups that need to be re-run should be re-run before the backup of the IDB is taken. It would also be worth making sure there is no known requirement for a Data Protector restore. Disable all backups scheduled to run before 6pm.

Note: Timings listed on this document are approximate, based on previous run times. Depending on the condition of the Data Protector IDB and available resource on the Cell manager, times could differ. Though it’s expected regular purge procedures on the DP IDB will decrease job times lower than projected.

Take the following services Offline:

OBVS_MCRS

OBVS_VELOCIS

Copy the Data Protector IDB files from the R:/ of UKSPICDP. These files should be backed up to a local drive.

Once copied, bring the above listed services back online.

1.2 IDB Purge

 

Run the following commands from a command line on the Data Protector Cell manager:

omnidb –strip               (seconds)
Omnidbutil –purge –filenames –days 1  -force ( >5 hours)

(This task can take a number of hours, if this task is not finished by early afternoon 3 – 3.30pm, this complete process should be re-run another day)

Note in the above screen shot, this error will be displayed if you try to run another omnidbutil command whilst one is in progress.

To monitor the purge bring up task manager. The rds.exe process is running your purge task.

Omnidbutil –purge –sessions 1  -force   (Seconds)
Omnidbutil –purge –DCBF –days 1  -force       (Seconds)
Omnidbutil -purge_failed_copies                       (Seconds)

Create the folder c:\IDBtemp on Cell Manager (If directory already exists delete any existing files)

Run the following commands:
Omnidbutil –writedb –mmdb c:\IDBtemp -cdb c:\IDBtemp   (>1 hours)

(This command exports the data base files to a temp folder)

Omnidbutil –readdb –mmdb c:\IDBtemp -cdb c:\IDBtemp                    (>40 minutes)

(This command re-imports the data, leaving behind purged files)

 

omnidbutil -remap_dcdir                       (Seconds)
omnidbutil –fixmpos                              (Seconds)
omnidbutil -remap_dcdir                       (Seconds)
omnidbutil -cdbsync ukspicdp   (Seconds)

Any Backups disabled before the purge task should be re-enabled.

Perform a test or monitor a production backup to completion to confirm DP is working.

1.3 Stopping purge jobs

Purge jobs should only be cancelled if totally necessary, IE urgent business requirement of a restore/ High impact on Production backups.

If for some reason no up to date backup was taken of the IDB, the job should not be cancelled and procedure completed fully. Disabling a purge job in progress can corrupt the IDB, meaning restoring from an offline backup to get Data Protector operational.

If purge commands do need to be stopped, the following command should be used:

Omnidbutil -purge_stop