System Administration

Some Useful Windows 2008 TCP/IP commands

2012-01-22T19:49:00.001-05:00

Here are some useful Windows 2008 TCP/IP commands using netsh.

Enabling IP Forwarding

Suppose you have a Windows 2008 server with two interfaces – Public and Production. Your default gateway is the public interface. But if you want to enable IP forwarding on the Production interface for backend communication, say a database server then you can use the following command.

netsh interface ipv4 set int “Production” forwarding=enabled

Adding persistent static routes

If you need to add a persistent static route to a Windows 2008 server using netsh, you can use the following command

netsh interface ipv4 add route destination_ip_address/mask “interface_name” gateway store=persistent

For example, to add a static route to the network 192.168.1.0 with a subnet mask 255.255.255.0 for an interface named Production with a gateway 192.168.1.1, you will use the command:

netsh interface ipv4 add route 192.168.1.0/24 “Production” 192.168.1.1 store=persistent

Install and Apply FEP 2010 client locally

2012-01-22T19:16:00.001-05:00

In certain cases, the SCCM may not be able to deploy FEP 2010 clients to the servers or desktops. In such a scenario, you may be required to manually install the FEP 2010 client and apply the policy locally. To do so, you can refer to the following steps.

Logon to the client machine.
Open the command prompt in elevated mode
Supposing that your FEP 2010 client is located on a shared server, run the following command : \\servername\sharename\FEPInstall.exe /policy \\servername\sharename\policyname.xml

If you already have a FEP 2010 client installed but its unable to fetch the policy, in that case, do the following:

Logon to the client machine
Open the command prompt in elevated mode
cd “program files\Microsoft Security Client”
Then execute the command: ConfigSecurityPolicy.exe \\servername\sharename\policy.xml

This method is particularly helpful when your clients start showing up in the “Locally Removed” collection in for FEP in SCCM.

Adding multiple IP addresses in a Windows 2008 server

2011-12-27T10:16:00.000-05:00

Due to the change in the architecture of Windows 2008 TCP/IP model, you may encounter issues with multiple ip addresses in a Windows 2008 server. One of the problems that you may face is that your server may register different ip addresses with the DNS other than the ip address that you had initially entered in the TCP/IP settings. The problem and the resolution has been mentioned in detail in the KB article from Microsoft : KB 975808. In order to fix this problem, you should use the netsh command line to add any ip addresses other than the first ip address in a Windows 2008 server.

netsh interface ipv4 add address "interface name" "IP Address" "Net mask" SkipAsSource=true

This ensures that your Windows 2008 server only registers the initial ip address with the DNS.

Extending a Web Application in SharePoint 2010

2011-03-12T19:02:00.002-05:00

1. Open Central Administration. Then click Manage Web Applications listed under Application Management

2. In the Application Management screen, locate your web application. The application we will use to extend is SharePoint-8080

3. Select the application and click on Extend

4. You will be presented with the screen below. Enter the details as per requirement. You can use host headers in case you have multiple websites running on the same port in your IIS web server.

5. Scroll down and you will find the Public URL specifications. This setting configures the SharePoint website for public access. You can customize the settings and the zone as per the requirement.

For the zones you have four choices – Intranet, Internet, Custom and Extranet. Click OK.

6. The web application is now extended. You can either browse the site directly by entering http://servername:Port or you can verify the website from IIS manager as shown below:

7. You may want to do a “iisreset /noforce” in case your site does not come up.

Creating a Web Application

2010-08-02T16:31:00.002-04:00

Once your setup is complete, run the Central Administration from either your SharePoint server or over Internet Browser. Below is a screenshot of your SharePoint 2010 administration dashboard.

Go To Application Management and then click on Manage Web application. On the top left, as shown below, select New Web Application

Fill out the details as shown below. Note that you have to carefully choose the settings while allowing access to the application. You may or may not choose to give access to the Anonymous users based on your requirement.

Once you are done, click OK and the application would be created as shown below. You may now choose to create the site collection or do it later.

Installing SharePoint 2010

2010-08-02T16:22:00.002-04:00

Below is a step by step installation for SharePoint 2010 server on a farm environment.

Insert the CD and run the setup.

Accept the User Agreement.

Choose Server Farm

I chose Complete in order to add servers to the farm at a later date.

Let the setup Wizard copy the files and complete the installation.

Once the installation is complete, choose to run the Configuration Wizard.

Proceed with the psconfig or the Configuration Wizard

Click Yes

You have two options, either to create a new farm or connect to an existing farm. In my case I want to create a new farm since this is the first WFE (Web Front End) server.

Specify the database settings. Make sure you create a service account and use that as a database user. If you are unsure about the database permissions, consult your dba.

Type in a password for server security.

Choose the authentication type and accept the default for the Central Administration website port. Else if you have a specific port in mind you can specify here.

Confirm the settings and click Next

Wait for the configuration wizard to finish configuring your SharePoint install.

Click Finish to end the installation.

You are now finished with the setup of the first WFE – web front end server for your SharePoint 2010 installation.
In the next few blogs, I will go through the steps to create a new web application, site collection and extend an application.

Publishing Active Sync using ISA Server - Shortcut

2010-06-03T22:12:00.002-04:00

In one of my earlier blogs, I explained the steps to create Active Sync publishing rule from scratch. However, if you are short on resources such as IP address or you don’t have the budget to buy additional SSL certificates then you have a very easy way out. All you need to have is an existing OWA rule and that’s it. Use the existing OWA rule and add /Microsoft-Server-ActiveSync/* to the Paths section and apply the rule.

Publishing Outlook Mobile Access using ISA Server

2010-05-14T14:34:00.002-04:00

Publishing Outlook Mobile Access using ISA server is fairly simple. Assuming that you already have a rule published for Outlook Web Access, all you need to do is to add the /oma/* folder in the Paths section of the rule and then Apply. Note that this better than creating a new rule as it utilizes the same security and SSL certificate as that of the OWA access to publish your Outlook Mobile Access.

Fixing Disk Issues for P2V servers in ESXi

2010-05-04T22:13:00.002-04:00

I have encountered this error several times in the past when I tried to virtualize a server using VMware Standalone converter and then trying to import the server in ESXi.

“Failed to Open SCSI DIsk 0:0 unsupported and/or invalid Disk Type 7"

There is an easy fix for this but you will have to enable SSH or console access in ESXi and use the VMKFSTOOLS from the ESXi console to clone the disk.
First of all, use the following command to enable SSH in the ESXi server :

Go to the server console, press ALT-F1 and type unsupported.
When prompted for password, type your root password
Then using vi editor open the file /etc/inetd.conf and search for SSH string.
Uncomment the line where the SSH services are specified.
Restart the services from /sbin/services.sh restart

If this does not work restart the ESXi host and it should work.
Once you are logged in using SSH or have console access to the ESXi server, navigate to the directory where you have the recently P2ved server stored (say /vmfs/server) and type the following :
vmkfstools –i /vmfs/server/originaldisk.vmdk /vmfs/server/newdisk.vmdk –d thin
where :
originaldisk.vmdk is the disk that was created when you initially used the standalone converter to convert your server to virtual.
newdisk.vmdk is the newly created clone from the console

Fixing WMI errors

2010-05-04T21:47:00.002-04:00

Although this may be a common error in Windows but I have experienced this specially after virtualizing a Domain controller, you may face several WMI related errors which may be very annoying. There is an easy fix and the main contributor for this is Jason Weaver, one of the smartest guys I have ever seen and worked with. He is vastly experienced in every form of Windows Operating Systems and a Subject Matter Expert in Active Directory.

So for the fix, follow the steps below:

Stop the Windows Management Instrumentation service from Services console.
Delete all the contents from C:\WINDOWS\system32\wbem\Repository folder.
Reboot the server.

If you continue to face the errors you will have to re-register the WMI components by running the following commands from command window, one at a time :

cd /d %windir%\system32\wbem
for %i in (*.dll) do RegSvr32 -s %i
for %i in (*.exe) do %i /RegServer
Reboot the server again.

If you face the following error or event in Event viewer follow the resolution steps :

EVENT ID 1090
Windows couldn't log the RSoP (Resultant Set of Policies) session status. An attempt to connect to WMI failed. No more RSoP logging will be done for this application of policy. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

cd /d %windir%\system32.
regsvr32 /n /I userenv.dll.
cd wbem.
mofcomp scersop.mof.
gpupdate /force

For Windows Server 2003

Use the following command to detect and repair a corrupted WMI Repository:

rundll32 wbemupgd, RepairWMISetup

Removing Non Present Devices in Windows Virtual Machines after P2V

2010-04-01T21:49:00.003-04:00

Sometimes you may get an ” ip address already exists” error when you try to re-ip your Virtual Machine virtual NIC just after completing P2V from a physical machine. This occurs because your physical network interface is no longer available but the ip address information along with the physical NIC is still stored in the TCP/IP stack of the machine and in the registry. In such a case, you will need to do the following to get rid of the stale information :

Open command prompt

Type set DEVMGR_SHOW_NONPRESENT_DEVICES=1

Next Open Device manager by typing devmgmt.msc from the same command window and select Show Hidden Devices

Delete grayed out non-present hardware

ISA and Load Balancing

2010-04-01T21:37:00.002-04:00

Yes, ISA server can load balance your backend web servers or CAS so long you are using HTTP pr HTTPS traffic. It is not possible for ISA to load balance RPC traffic. It is recommended that you use a hardware load balancer or Microsoft NLB for load balancing your CAS servers. If you need further details on this discussion you can refer to the Technet Forum :
http://social.technet.microsoft.com/Forums/en-IE/exchange2010/thread/35adc3bf-a5b1-43a8-9753-e9ea40a6eb1e
But having said that, don’t we already know that ISA 2006 or TMG should be used as a reverse proxy with Exchange for OWA or RPC over HTTPS publishing ONLY? Both of these are HTTP or HTTPS traffic. The Outlook Anywhere rule templates are precisely for this purpose. Opening up RPC traffic over Internet can lead to serious security issues. As for internal traffic is concerned, use RPC over HTTPS instead of RPC if you want faster response times.
Summary, ISA 2006 or TMG provides load balancing as a feature, there are other ways of load balancing your web or CAS servers. But if you want an out of the box solution for a small or medium business where spending on hardware load balancers may be an issue then ISA 2006 or TMG can do the work to load balance your web or CAS servers.

P2V continued – Destination Virtual Machine actions

2010-04-01T18:18:00.002-04:00

Once you have completed P2V, perform the following actions or ‘ clean ups” on the converted virtual machine AFTER you have SHUT DOWN the physical server that was virtualized :

Allow the Operating system for the virtual machine to complete Detecting Hardware. Make sure you have updated the HAL. And do not change the number of vCPU before updating the HAL. This severely affects the performance.

Tip : Always update the CPU drivers from Device Manager and choose ACPI multi or uniprocessor drivers depending on the numbers of vCPUs.

Complete all reboots.

Finish VMware Tools installation

Verify peripherals from Device manager.

Remove non-present and old hardware

Remove all vendor software needed for RAID, NIC Teaming, etc.

Check Shared Folders and permissions

Disable unneeded services.

Check Event Viewer for Errors

Check Antivirus

Set the IP Address on the network adapters and verify they are connected to the proper VLANs.

Perform ipconfig /registerdns to complete registration with the DNS server

Ping the newly converted virtual machine and try to access remotely

P2V checklist

2010-04-01T18:10:00.002-04:00

Before you start virtualizing the physical servers, here is a brief check list of what all you need to remember when you embark on the virtualizing spree :
Physical Server Related tasks
Investigate the Physical Server and do the following :

Confirm at least 200MB of free space in C:\
Ensure that the server has at least 512MB RAM
Run CHKDSK to clear any disk errors
Run Defrag and reclaim space
Ensure Local Administrator login is correctly set
If you are using a domain login, ensure that you have logged in to the Server to Cache your Credentials.
Ensure 1Gbs Network Connection exists
Open TCP/UDP ports 139, 445, and 902 and 443 if the server is behind a firewall
Establish network connectivity using Ping from Target machine to Source ESX Server and Virtual center
Make a note of shares and permissions
Make a note of ip configuration information
Restrict user access
Disable any unneeded services
Disable System Restore if you are virtualizing Windows Xp
Remote P2V : Use local administrator to Install Agent for the converter. For NT and Windows 2000, it will need a reboot before proceeding with P2V.
Local P2V : Install Converter and agent directly on source machine if you are converting directly into ESX Server.

P2V Converter Specifications

2010-04-01T17:59:00.002-04:00

While initiating the P2V wizard, keep the following in mind :

Create the target Virtual Machine with correct specifications – such as memory, CPU and Hard disk.

Resize the disks volume – this is recommended for file servers which always keeps going out of space. Plan out your data storage requirements carefully when you resize the size of hard disks.

DO NOT clone utility partitions – you wont need it any longer

Make sure you have "Install VMware Tools" checked. This comes handy when you P2V Windows 2000 Servers as sometimes P2V does not copy over the VMWare compatible LSI or BusLogic SCSI drivers.

Adjust the virtual CPUs.

Delete USB devices unless specifically required.

Delete Serial and parallel devices UNLESS specifically required.

Remove Floppy drive

Virtual Switches configuration from ESX Command Line

2010-03-24T12:41:00.002-04:00

Assuming that you have one vswif adapter vswif0 bind to one virtual switch vSwitch0, the following commands will help you to delete and recreate the adapter and switch from scratch via command line.

a.. To list the name of the vswif adapter, run :
esxcfg-vswif -l

b. To delete the vswif adapter, run the following command:
esxcfg-vswif -d vswif0 ; where vswif0 is the first adapter
c. Now list the name of the vSwitch:
esxcfg-vswitch -l
d. To delete the vSwitch, run the following command:
esxcfg-vswitch -d vSwitch0
e. Now create the vSwitch:
esxcfg-vswitch -a vSwitch0
f. Now create the port groups for vSwitch:
esxcfg-vswitch -A "VM Network" vSwitch0
esxcfg-vswitch -A "Service Console" vSwitch0
g. Now you would need to create the vswif adapter by the following command:
esxcfg-vswif -a -p "Service Console" -i=www.xxx.yyy.zzz -n=255.255.0.0 vswif0 ; netmask depends on what ip has been sepcified by the –i switch
h. Next verifiy your network settings and network adapters by :
cat /etc/sysconfig/network
esxcfg-nics –l

i. Then associate the vmnic with the vSwitch0 :

esxcfg-vswitch -L vmnic1 vSwitch0
j. Verify that the vmnic is associated with the vSwitch:
esxcfg-vswitch -l
k. Verifiy network connectivity by pinging an ip address.
You are now all set with your vSwitch configuration.

Fixing Legato Backups for VMware Esx

2010-03-15T11:24:00.002-04:00

Backing up your ESX servers using Legato can sometimes be a pain. Here is a check list of what needs to be done to run the backups successfully :

Install your legato client with the –nodeps swicth

rpm –i –-nodeps legatoxxxclnt.rpm

Open the firewall ports associated with the legato client

esxcfg-firewall –o portrange ( follow the syntax from the esx firewall commands section). Typically you would want to open up specific ports. If not open 10000-30000 and 7937 and 7938. Open both TCP and UDP.

Enable nfs client communication through the esx firewall by :

esxcfg-firewall –e nfsClient

Run rpcinfo –p LegatoServer name to check if the communication is working
From esx command line , run the following to setup the initial communication

nsrexecd –s legatoservername

The following commands may be used to restart your Legato service from esx command line :

service networker stop

service networker start

Backing up SQL Express

2010-03-12T16:28:00.002-05:00

Ever wondered how you can automate your backups for SQL Express? Specially when you don’t have the JOBS option? Well, here is a cool tool from www.lazycoding.com – SQL Scheduler which you can use to automate your SQL Express backups. Once you have installed the software, follow the steps below to configure :

First connect to a server. Make sure you put in the correct syntax for the SQL Express server – Servname\Instance name. Then name the backup job per your convenience.

Refer to the script below and paste the script in the window. Note that I am backing up my sharepoint database WSS_Content to e:\admin\sql_backup folder with date and timestamp. You can also use the syntax checker to make sure your T-SQL scripts are correct.

DECLARE @BackupName VARCHAR(255)

DECLARE @BackupFileName VARCHAR(255)

SET @BackupName = 'WSS_Content_' + convert(nvarchar(20), getdate(), 112) + N'.bak'

SET @BackupFileName = N'e:\admin\sql_backup\' + @BackupName

BACKUP DATABASE WSS_Content TO

DISK = @BackupFileName WITH NOFORMAT, NOINIT,

NAME = @BackupName, SKIP, REWIND, NOUNLOAD, STATS = 10

Setup a schedule

Provide your email address to make sure you are alerted when the job is complete. You will have to configure an SMTP server for sending the emails. I have IIS-SMTP running on the same server.

Execute the job to make sure it runs from the main console.

Check the last run result

Physical To Virtual Determination

2010-03-12T15:40:00.002-05:00

Before you start converting your physical servers to virtual or P2V you would need to analyze in details as to what parameters or criteria you should be using to evaluate a potential P2V candidate. Below are some useful guidelines which can help you decide :

CPU

You need to carefully inspect the CPU of the physical server you want to virtualize. You need to note the CPU speed, number of processors, whether they are multi-core, etc.

Operating System

The version of the operating system and its service pack and patch level. Though there are no restrictions to the OS you can virtualize on VMware or Hyper V yet its necessary that you ascertain the OS details. Make a note of the vendor provided drivers as well since sometimes a vendor may not support virtualized servers.

Storage

One of the most important criteria that will affect your virtualization decision is based on storage. You have to make sure that once you have virtualized your server your storage is intact. This is very essential when your physical servers is a part of the cluster and may be attached to a SAN, iSCSI or NAS.

Peripherals and Devices

Be sure to do a physical inspection of the server. Make a note of all the devices that may be connected – modem, security dongle or any other devices apart from the regular ones.

Server Role

Ascertain the role of the server and talk to the business client about the application installed. Make sure you take into consideration applications that use licenses that may be tied to a CPU. If the server is a web server your requirement of virtual resources would be less compared to an Exchange or MS SQL or Oracle server.

The above are the 5 core technical points that helps you decide a P2V candidate. However, as you start working on a more detailed plan you will come across other factors that will influence your decision – such as ROI, obtaining approvals from groups involved , etc.

Configuring SSO Cluster

2010-03-09T09:15:00.003-05:00

If you are configuring BizTalk in production environment then it is very necessary that you build an SSO cluster for your production environment so that your Master Secret Server has high availability. Note that you cannot install Master Secret Server on a NLB cluster and you will have to install a Microsoft Windows 2003 cluster and then configure your Enterprise Single Sign On to operate on clustered environment. Also, you must be an SSO administrator to perform the configuration.

Assuming the fact that you have two servers, say Server A and Server B for this cluster where Server A is the active node and Server B is the passive node.
During the installation, use the BizTalk configuration wizard to configure Server A as the Master Secret Server. When you configure the Server B, DO NOT configure it as a Master Secret Server. Also, remember to follow the instructions and Backup the master secret in Server A as you will need it during the cluster configuration to restore the master secret in Server B. Its normally in the format of some random_number.bak
After configuring the single sign on on both the nodes, stop the SSO service and then you would have to change the name of the master secret server to the cluster name in the credentials database. For example, when you first installed the master secret server it was Server A but now that you have a cluster, the name of the master secret server should that be of the cluster, e.g SSO CLUSTER or anything that you may seem appropriate. You can do this by

a. Copy following into an .xml file and save the file, say cluster.xml :

<sso>
<globalInfo>
<secretServer>SSO_CLUSTER</secretServer>
</globalInfo>
</sso>

b. From the command prompt, go to c:\Program Files\Common Files\Enterprise Single Sign-On. Type ssomanage -updatedb cluster.xml (see previous step) to update the master secret server name in credential database. This is where the single sign on gets installed by default unless you change the location.

If you receive any errors, that is because of the fact that MS DTC service is not configured. To resolve this error , configure the DTC to run on the cluster:

a. On Server A , at the command line prompt, type comclust -a.
b. From the Services MMC , right-click Distributed Transaction Coordinator, and then click Restart.
c. On Server B , at the command line prompt, type comclust -a.
d. From the Services MMC, right-click Distributed Transaction Coordinator, and then click Restart.

To configure the service and resource parameters for the cluster

Open Cluster Administrator, and then click the cluster group that has the master secret server cluster.
On the File menu, point to New, and then click Resource.

a. On the New Resource window, type the Name of the SSO resource, say ENTSSO and for the Resource type choose Generic Service. Click Next
b. On the Possible Owners section, include both nodes Server A and Server B.

After you have created the ENTSSO resource, right-click ENTSSO, and click Properties.
In the Cluster Properties dialog box, click the Security tab, and make sure that the user has appropriate rights. This can be your SSO administrator user which you used to configure the application.

To restore the master secret on the second node

Open Cluster Administrator, right click the master secret server cluster group, and then click Move group. This moves the master secret server resources from the Server A to Server B.
Login to Server B and at the command prompt, navigate to the Enterprise Single Sign-On installation directory.
Type ssoconfig -restoresecret random_number.bak, where random_number.bak is name of the backup file that contains the master secret that you had backed up earlier in Server A in the very beginning during the configuration of Single Sign On cluster on Server A.

System Center – Virtual Machine Manager

2010-03-01T17:40:00.001-05:00

Here is a glimpse of the administrator console of the VMM with the health stats of the host and machines

Playing with Virtual Machine Disks

2010-02-26T23:50:00.001-05:00

Check out http://vmtoolkit.com/ , great site with cool tools. You can use the VHD resizer for extending your virtual machine disks or you can use the utility to convert vhd from vmdk files.

Creating a new Virtual Machine using System Center - VMM

2010-02-17T09:45:00.001-05:00

Click on New Virtual Machine on the right window pane

Next when the wizard comes up choose to create virtual machine with a blank hard disk.

Enter the virtual machine name

Next configure the hardware attributes such as disk, processor, memory, etc. The reason I have chosen a dynamic disk here is because I want the size of the disk to grow per need. If you don't want that you can choose a fixed disk size.

Look at the options of the CPU types. This is something very unique in VMM and is a great feature that I like

Click Next and select the destination of the machine. Typically this would be the host where you are creating the virtual machine

Next Select the host if you have more than one host.

Select the storage location. This is typically the path in the Hyper V server where your virtual machine would be stored.

Select the network

Next in the additional properties choose the Operating system and other parameters like Automatic Start action, etc

Note the Operating System choices you get

Once you have the summary screen, go through the details and click on Create

System Center – Virtual Machine Manager

2010-02-15T21:49:00.001-05:00

Here are the steps to add a host running Hyper V 2008 Server R2 edition using the System Center Virtual Machine Manager.

Choose Add Host

Enter your Credentials

Click Next

Click Yes. This comes up when you have Windows 2008 Virtual machines running

Click Next

Choose the target directory where the virtual machines will be created. Remember that this is the target directory at the Hyper V server and not in the server running System Center – VMM.

Wait for the task to be completed.

Once the task is complete the Hyper V server is now connected to your System Center – VMM 2008 R2

Hyper V Management Console

2010-02-15T20:35:00.001-05:00

Here is a screenshot of my Hyper V Management Console connecting to my Hyper V Server. I am running the management console from my Windows 7 PC

Below are some of the settings that are available for each of the virtual machine that you create

SSL Certificate formats

2010-02-11T16:46:00.001-05:00

I have experienced a lot of questions from my colleagues who face issues trying to convert SSL certificate formats when it comes to import. This particular blog is dedicated to my best friend Oz Casey Dedeal who is an Exchange MVP and has been telling me to write something about SSL certificate issues. You can follow his blog from the link in the Great Blogs section

Not all the web servers, proxies today accept any and all the SSL certificate formats. Some may accept .pfx while others may go with .p7b, etc, etc. In such a scenario, I would advise the use of openssl tool kit to convert the certificates to the required format. This is open source and is a remarkable tool. Go to the website www.openssl.org for further details. It has an awesome HOW TO document.

SSL Certificate for Web servers – IIS 6.0

2010-02-11T16:29:00.001-05:00

Certificate Request -For new Certificates

From IIS manager, Right click and open the properties of the web site
Choose properties of web site, choose Directory Security tab.
Click Server Certificate to Launch Server Certificate Wizard.
Choose “Create a new Certificate”. Click Next.
Choose “Prepare the Request Now, but send it later”. Click Next.
Enter name as the fully qualified URL (e.g www.company.com)
Choose bit length as 1024. Click Next.
Choose Organization and Organizational Unit . Click Next.
Enter common name for the request. FQDN preferred. Click Next.
Choose City, State, and Country. (You would need to specify this if the default selection is not available).
Save certificate request (CSR) in local hard disk.

Certificate Request - For Renewing certificates

Choose Properties of the website from IIS manager that needs the certificate renewed.
Choose Directory Security Tab
Click Server Certificate to Launch Server Certificate Wizard.
Click on Renew the current Certificate
Choose “Prepare the Request Now, but send it later”. Click Next.
Save certificate request (CSR) in the designated directory for the website.

Your next step would be to copy and paste the CSR to the Certificate authority ( VeriSign, Go daddy, Thawte, etc) from where you need to buy the certificate. Once you have purchased the certificate, you will be sent the certificate in .cer or .p7b whatever format the Certificate Authority prefers. Once you have that file you will need to perform the following steps on your web server from where you created the request.

Certificate Import to the Web server

Open IIS Manager
Select properties of web site concerned.
Go to Directory Security tab. Click Server Certificate to launch wizard.
Choose “Process the pending request and install certificate”. Click Next.
Browse to .cer file saved in your disk. This is the file sent by your Certificate Authority and which contains the certificate.
Click Next. Click Next. Click Finish.
Click OK in IIS properties windows.
Close IIS manager.

Exporting Certificates

You may have to export the certificates in PFX formats often required by ISA / TMG for reverse proxy rules.

Open MMC for Certificates. Remember to choose the local machine when you add the Snap In.
Navigate to Console Root | Certificates (Local Computer) | Personal | Certificates.
Select certificate you imported to IIS. This should be displayed by now in the Certificate Console. If not, refresh the view and it will show up.
Right click and choose All Tasks | Export.
Click Next.
Select “Yes, export the private key”. Click Next.
Select Personal Information Exchange – PKCS #12 (.PFX) and Enable strong protection. Click Next.
Enter password you want to(challenge phrase). Click Next. Remember this password as you will need it when you import the certificate in another machine.
Save the file by browsing to local disk. Enter filename as whatever.pfx ( your choice) . Click Next. Click Finish.

Your certificate can now be copied over to a different machine and can be imported.

Single Sign On configuration for MOSS 2007

2010-02-11T15:43:00.001-05:00

Below are the steps to configure Single sign-on feature in MOSS 2007. Please note that I have used a regular Domain administrator account but it is highly advised and recommended that you should create a service account both for MOSS service account and SSO service account.

The prerequisites are as follows :

The account used for SSO should be an user account in the domain.
It must be have permissions to the server farm in MOSS 2007.
It should be a member of the local administrator group in the server where the SSO service will run. This can be the first web server in the farm. The first server where it runs also stores the SSO encryption key.
The account must have Security admin and db creator permissions to the SQL server database – see screenshot

Configure Microsoft Single Sign On Service

On the first web server of the MOSS server, configure the Microsoft Single- Sign On service as shown below

Repeat this step on each server that you have in the farm where you want to run the service.

Configure SSO from the Central Administration Console in MOSS 2007

Open the Central Administration console in MOSS 2007 and click on the Manage Single Sign On settings as shown below

Click on Manage server settings as shown below :

The enterprise application definition administrator account is the one who can manage credentials of an enterprise application definition. In our case scenario, we are using the same account as the SSO administrator account. It can also be a domain global group but not local.

Once you have filled up the details you can click on OK to finish.

Once you return to the same page again, you can then configure other options such as Encryption keys, Define Enterprise application, etc.

Alternate Access Mappings (AAM)

2010-02-10T11:10:00.001-05:00

The basic functionality of AAM is to enable Sharepoint or MOSS to map requests from the users to the correct web application. This enables Sharepoint to deliver the correct content to the users. This is particularly helpful when you have a single site internal to the company network known by say http://intranet.company.com which is published by a different name to the external users in the internet say http://externalweb.company.com . When a user from Internet requests for the web site, Sharepoint not only delivers the content but also generates the link for each pages http://externalweb.company.com to the internal users even when the original site collection is published at http://intranet.company.com .

A public URL is what users use to get to the site collection or MOSS website, and that URL appears in the links on the pages.Internal URLs are in the URL requests that are sent to the MOSS or sharepoint site.

Each Web application can have upto five collections of mappings per URLas shown in the screenshot below - default, intranet, extranet, Internet, and custom.

MOSS 2007 backup Script

2010-02-10T09:15:00.001-05:00

In order to backup MOSS or WSS contents, you can use the backup utility from the STSADM tool. The following scripts can be used to create a batch file and then you can schedule the batch file using Scheduled tasks and run it per your own schedule. Remember that the user account you use to schedule the task and run the batch files must have write access to the network share or local folder where you backup the files.

Full backup Script

@echo off

echo====================================

echo Back up Entire WSS Farm to E:\Backups

echo=====================================

cd C:\Program Files\Common Files\Microsoft Shared\web server extensions\12\BIN

@echo off

date /t > c:\Admin\BackupScripts\time_backup.txt

time /t >> c:\Admin\BackupScripts\time_backup.txt

stsadm.exe -o backup -directory "E:\Backups" -backupmethod full -overwrite

time /t >> c:\Admin\BackupScripts\time_backup.txt

echo FUllMOSS Backup Operation completed >> c:\Admin\BackupScripts\time_backup.txt

Differential backup script

@echo off

echo ==============================

echo Back up Entire WSS Farm to E:\backups\differential

echo ==============================

cd C:\Program Files\Common Files\Microsoft Shared\web server extensions\12\BIN

@echo off

date /t > C:\Admin\BackupScripts\time_backup.txt

time /t >> C:\Admin\BackupScripts\time_backup.txt

stsadm.exe -o backup -directory "E:\Backups\differential" -backupmethod differential -overwrite

time /t >> C:\Admin\BackupScripts\time_backup.txt

echo DiffentialWSS Backup Operation completed >> C:\Admin\BackupScripts\time_backup.txt

Scheduled task Settings

Poor man’s SAN/ iscsi Dream

2010-02-07T19:21:00.001-05:00

Now, most of us already have a so called ‘Home-Lab’ where we play around the latest stuff. I know that the thing that I missed most was a SAN or some sort of iscsi devices that would help me setup a fully functioning VMware HA environment. Then one of my colleagues in India told me about this neat ( yeah just neat and fantastic) software that can turn your box into an iscsi device. If you guys are not aware of this already you should really check this out – its called OpenFiler and it simply rocks!!!
You can check out the details at their website http://www.openfiler.com/
Its got an admin guide too and believe me its easy, fast and fantastic.

Microsoft Hyper V

2010-02-07T19:04:00.001-05:00

Currently playing with Hyper V. It’s quite easy to setup the Hyper V bare metal server ( free from Microsoft http://www.microsoft.com/downloads/details.aspx?familyid=48359DD2-1C3D-4506-AE0A-232D0314CCF6&displaylang=en ). Good thing about it is I was able to install the server on my home HP PC that has SATA disks. This is different from an ESXi or an ESX install where the number of drivers for disks are pretty limited to the well known RAID technology and server end only. Will contribute more as I investigate the features. Being used to the VMware technology for the last 4-5 years, I was a little skeptical about Hyper V at first but hey its not that bad at all…

ESX Firewall Commands

2010-02-07T18:40:00.001-05:00

The ESX firewall is based on Linux IPtables. However, there is a command line utility that will help you perform the regular firewall operations. Its a great utility and also has a pretty thorough help which you can refer to. Here are some of the commonly used commands :

To list the services controlled by the firewall : esxcfg-firewall –s
To list the firewall rules: esxcfg-firewall -q [servicename] or you can simply type : esxcfg-firewall -q
Enable a service: esxcfg-firewall -e [servicename] , for example, esxcfg-firewall -e httpd
Disable a service: esxcfg-firewall -d [servicename] , for example, esxcfg-firewall -d httpd
Open a port range: esxcfg-firewall -o 10000:30000 ,tcp,out,out-lgtoclient
Close a port range: esxcfg-firewall -c 10000:30000,tcp,out,out-lgtoclient

Creating Templates in VMware

2010-02-06T21:32:00.001-05:00

There are various ways you can create a VMware template. Here are some of the options you have

You can convert an existing virtual machine to a template
You can clone a virtual machine to a template
You can clone an existing template

To convert an Existing machine to a template

Login to the Virtual Center Server from the VI client
Click the Inventory button in the navigation bar to expand the Inventory and select a Virtual machine.
Turn off the virtual machine using the shut down or power off options
From the the popup menu, click Convert to Template. You can then refer to the Recent tasks pane to check the progress of the template process.

To clone a virtual machine to a template

Log in to the Virtual Center Server and Expand the Inventory Panel.
Right‐click the virtual machine and click Clone to Template. In case the option is grey-ed out you will need to shut down the machine.
The Clone Virtual Machine to Template wizard appears. Assign a new template a name, select its inventory location, and click Next.
Select the host or cluster, and click Next.
Specify a datastore for the template. Click Next.
Select a to leave the virtual disks in their normal virtual machine format and Click Next.
Click Finish and wait for the task to be completed in the Recent task Pane.

To clone an existing Template

Log in to the Virtual Center Server
From the inventory pane, Select the datacenter that contains the template. The virtual machines and templates associated with the datacenter appear in the datacenter panel.
Right‐click the template and choose Clone.
From the Clone Template wizard give the new template a unique name and description, and click Next.
Select the host or cluster, and click Next.
Choose a datastore for the template. Click Next.
Next leave the virtual disks in their Normal virtual. Click Next.
On the Ready to Complete window, review the information and click Finish.

Tomcat Server Configurations for SSL and Bindings

2010-02-06T20:27:00.001-05:00

Its pretty easy to configure or bind the tomcat web/application servers with SSL certificate on a specific ip address depicted by x.x.x.x . Below are the steps that you need to follow. Note that you may require a tomcat service restart :

Open Server.xml file and go to the following section of the file


<Connector URIEncoding="UTF-8" acceptCount="100" address="x.x.x.x" connectionTimeout="20000" disableUploadTimeout="true" enableLookups="false" maxHttpHeaderSize="16384" maxSpareThreads="75" maxThreads="500" minSpareThreads="25" port="8080" redirectPort="8443"/>

<Connector port="8443" maxHttpHeaderSize="16384" address="x.x.x.x"
maxThreads="500" minSpareThreads="25" maxSpareThreads="75"
enableLookups="false" disableUploadTimeout="true"
keystoreFile="E:\Certs\cert.pfx" keystorePass="abcdef" keystoreType="PKCS12"
acceptCount="100" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS" />

Standard P2V Process

2010-02-06T19:43:00.001-05:00

Prerequisites
VMware Converter and its Agent must be installed on the Physical machine that needs to be converted to Virtual. The Converter and its agent run on the following Microsoft Windows operating systems:

Windows NT SP6+ (with IE5 or higher)
Windows 2000
Windows 2003 32‐bit and 64‐bit
Windows XP Professional 32‐bit and 64‐bit

Download the latest version of VMware Converter from the VMware Web site and install it on the Physical machine that needs to be converted to Virtual Machine on the ESX farm.

Launch the VMware Converter application.
Click Import Machine in the upper left part of the toolbar
Click Next on the Welcome to the VMware Converter Import Wizard page.
On the Source page, click Next to go to the Source Type page.
Select the Physical computer radio button on the Source Type page, and click Next.
For a remote machine, type its name or IP address.
Type the DOMAIN\user name and Password for the remote machine on the Source Login page, and click Next. Note: You will receive a warning message:
Remote Installation Required: Choose Automatically Uninstall the files when import is complete and click Yes.
Choose the disks to import by following the remaining steps in this procedure. Note: Deselect any volumes you do not want to import. Uncheck the option where the mapped network drives are selected.
Specify the volume size you want in the New Disk Space drop down combo box, and click Next
You will be prompted to select the destination for your converted virtual machine.
Click Next on the Destination header page to move to the Destination Type page.
Select the VMware ESX Server radio button and click Next.
In the Destination Login page, log on to the destination ESX server using the administrative account ( example, root user) and click Next.
In the Virtual Machine Name page, enter the name you want to assign to the converted virtual machine, and click Next.
Specify the resources for the imported virtual machine in the Host or Cluster page and click Next.
In the Host page, choose the specific ESX server host for the virtual machine and click Next.
Specify the DataStore for the virtual machine’s configuration files and disks, and click Next.
Map the virtual machine’s network adapters and keep the default settings (choose Private), and click Next.
On the Customization page, ensure that the Install VMware Tools check box is selected and the Customize the identity of the new virtual machine check box is not selected. Also select Power on the new Virtual Machine. Click Next.
Review the summary of the settings for the new virtual machine. Click Finish.

Installing Virtual Center 2.5

2010-02-06T19:42:00.001-05:00

Prepare a SQL Server Database

On your Microsoft SQL Server, create a SQL Server database using Enterprise Manager
On your Microsoft SQL Server, create a SQL Server database user with database operator (DBO) rights.
On your VirtualCenter Server, open the Windows ODBC Data Source Administrator.
To create a new SQL Server ODBC connection:
Click Add.
Type an ODBC data store name (DSN) name in the Name field
Select the server name from the Server drop down menu.
Type the SQL Server machine name in the text field if you cannot find it in the drop‐down menu.
Click Next.
Select one of the authentication methods:
Type your SQL Server login name and password and click Next.
Note: Ask your database administrator for this information.
Select the database created for VirtualCenter from the Change the default database to menu and click Next.
Click Finish
From the ODBC Microsoft SQL Server Setup menu, choose Test Data Source.
If the test data source is acceptable, click OK. If it is not acceptable, return and reconfigure any incorrect items.
To close the ODBC Data Source Administrator, click Close
Ensure that the SQL Agent is running on your database server.

Install VMware Infrastructure Manager

Login as an Administrator to the Virtual Center Server System, insert the installation CD for Virtual Center Server software.
When the VMware Infrastructure Management Installer screen appears, click “Next”.
Read the Introduction page and click “Next”.
Select I accept the terms in the license agreement and click “Next”.
Type your user name and company name and click “Next”
Select one of the installation types and click “Next”.The choices are:
Select the option corresponding with the database you configured. If you have configured a supported database, click Use an existing database and enter your database connection information.Type the DSN associated with your database that you created in the earlier section. This must be a system DSN.If your database is a local SQL Server database using Windows NT authentication, leave the user name and password fields blank. Otherwise, type the user name and password associated with the datasource name and click Next.If your connection fails, a warning appears. Click OK and re‐enter your database connection information until you can continue.
Select the following option:
- To use VirtualCenter in licensed mode with an existing license server:
- To use VirtualCenter in licensed mode when you do not have an existing license server:
Enter the port and proxy information that you want to use or accept the default information shown on screen and click Next. This step applies only to custom installations.The default port for HTTPS is 443. If you configure VirtualCenter to use a different port for HTTPS, you must use the configured port number when you log in to VirtualCenter.
Enter information about the system on which you are installing VirtualCenter and click “Next”. Enter:
For VMware Update Manager, you can use the same database that you use for VirtualCenter, or you can use another database.For VMware Update Manager, enter the port and proxy information that you want to use or accept the default information shown on screen. This step applies only to custom installations
For VMware Converter, enter the port information that you want to use or accept the default information shown on screen. This step applies only to custom installations. Click Next to continue through the deployment options screens.
Accept the default destination folders and click “Next”. If you do not want to accept the default destination folders:
Click “Install”.
Click “Finish” to complete the VMware Infrastructure installation.

Installing ESX 3.5 Server

2010-02-06T19:41:00.001-05:00

Power on the machine with the VMware ESX Server CD in the CD drive
Press Enter to start the graphical installer or type “esx text” and press “Enter” to start the text installer.
Click “Test” to have the installer inspect the installation CD media for errors.
Click “OK”.
Click “Next” (graphical installer) or “OK” (text installer)
Select your keyboard language from the list and click “Next” (graphical installer) or “OK” (text installer).
Select your mouse and click “Next” (graphical installer) or “OK” (text installer).
Select your keyboard language from the list and click “Next” (graphical installer) or “OK” (text installer).
Select your mouse and click “Next” (graphical installer) or “OK” (text installer).
Select the type of installation. The Select Installation Type dialog box appears only if the installer detects a previous ESX Server installation.
- Install – For a clean installation preserving no ESX Server configuration data, select Install and click Next (graphical installer) or OK (text installer).
- Upgrade – If you are upgrading, refer to upgrade document. Do not continue with this procedure.
If you are using the graphical installer, read through the end user license agreement and select I accept the terms of the license agreement and click “Next”. If you are using the text installer, read through the end user license agreement and select Accept End User License and click “OK”.
If you do not have data on the drive, click “OK” to allow partitioning to occur. You must initialize a drive to use it during installation.
Select a partitioning option.
- Recommended – Configures default partitions, based on the capacity of the hard drive.
- Advanced – You specify all partition settings. Select this option to configure the partitions manually
Select how the ESX Server will boot:
- From a drive (install on the MBR of the drive) – Use this option for most installations. This drive must match the first boot device set in the host BIOS. If these settings do not match, the host cannot boot into the ESX Server software.
- To boot an ESX Server host from a SAN, choose a SAN‐based LUN from the drop‐down menu. If you are using the text installer, click “OK”.
- From a partition – Use this option for legacy hardware that stores BIOS information in the MBR. If you are using the text installer, click “OK”.
To add default options to the boot command, enter them into the General kernel parameters field. Any options you enter are passed to the ESX Server kernel every time it boots.
Click “Next” (graphical installer) or “OK” (text installer) to continue the installation.
Select the network interface for use by the ESX Server console. If you are using the text installer, click “OK”.
Configure the ESX Server host network IP address. If you are using the text installer, click “OK”.
Enter the ESX Server host name. Type the complete machine name, including the domain where appropriate.
Enter a VLAN ID.
De-Select “Create a default network for virtual machines” to create a default port group for virtual machines. This option is selected by default.
Click “Next” (graphical installer) or “OK” (text installer).
Set your time zone.
Enter a root password.Type the same password into both fields and click “Next” (graphical installer) or “OK” (text installer).The root password must contain at least six characters. A warning appears if the passwords do not match.
Confirm your installation configuration and click “Next” (graphical installer) or “OK” (text installer).
Click “Finish” to exit and complete the installation and reboot the server
Logon to the server at the URL location provide on the screen after the server comes back online

Publish Active Sync using ISA

2010-02-04T12:37:00.001-05:00

Prerequisites : You must create the SSL web listener rule before you proceed .

Click on the Firewall Policy in the ISA Firewall console and then click the Tasks tab on the Task Pane. On the Tasks tab, click the Publish Exchange Web Client Access.
On the Welcome to the New Exchange Publishing Rule Wizard page, enter a name for the new rule. Click Next.
On the Select Services page, select Exchange Server 2007 from the Exchange version drop down . Select Exchange ActiveSync option. Click Next.
On the Publishing Type page, select the Publish a single Web site or load balancer option and click Next.
On the Server Connection Security page, select the Use SSL to connect to the published Web server or server farm and click Next.
On the Internal Publishing Details page, enter the name of the web site that is used to identify the published Client Access Server internally. This is not the server name instead it is the common name associated with the certificate bound to the OWA Web site on the Client Access Server. For example, if the name on the Web site certificate bound to the OWA Web site on the Client Access Server is owa.company.com, so you will need to enter owa.company.com. You may check the option to Use a computer name or IP address to connect to the published server and then use the Browse button to find the server as well. Click Next.
On the Public Name Details page, select the This domain name (type below) option from the Accept requests for drop down. In the Public name box, enter the name that external users will use to connect to the ISA Firewall in order to reach the RPC/HTTP site. This may be same as your internal name, for example owa.company.com.
On the Select Web Listener page, select the SSL listener you created earlier from the Web listener drop down list and click Next.
On the Select Web Listener page there will be some additional information:“The session timeout function of the Web listener will not be applied to non-browser clients. This will allow the continued use of stored credentials for ActiveSync users”.
On the Authentication Delegation page, select the Basic authentication option from the Select the method used by ISA Server to authenticate to the published Web server drop down list. Click Next.
Accept the default setting, All Authenticated Users on the User Sets page and click Next.
On the Completing the New Exchange Publishing Rule Wizard page, review settings and click Finish.
Double click on rule that you created. In the ActiveSync Properties dialog, click the Paths tab. The wizard adds the following path :

RPC over HTTPS

2010-02-04T12:35:00.003-05:00

Prerequisites : You must create the SSL web listener rule before you proceed .

Click on the Firewall Policy in the ISA Firewall console and then click the Tasks tab on the Task Pane. On the Tasks tab, click the Publish Exchange Web Client Access.
On the Welcome to the New Exchange Publishing Rule Wizard page, enter the name for the Web Publishing Rule. Then click Next.
On the Select Services page, select the Exchange Server 2007 option from the Exchange version drop down list. Choose Outlook Anywhere (RPC/HTTP) and also choose the option for the Publish additional folders on the Exchange Server for Outlook 2007 clients.
On the Publishing Type page, select the Publish a single Web site or load balancer option and click Next.
On the Server Connection Security page, select the Use SSL to connect to the published Web server or server farm and then click Next.
On the Internal Publishing Details page, enter the name of the web site that is used to identify the published Client Access Server internally. This is not the server name instead it is the common name associated with the certificate bound to the OWA Web site on the Client Access Server. For example, if the name on the Web site certificate bound to the OWA Web site on the Client Access Server is owa.company.com, so you will need to enter owa.company.com. You may check the option to Use a computer name or IP address to connect to the published server and then use the Browse button to find the server as well.
Enter name on the Web site certificate on the Client Access Server in the Internal site name and the actual computer name or IP address in the Computer name or IP address. Click Next.
On the Public Name Details page, select the This domain name (type below) option from the Accept requests for drop down list. In the Public name text box, enter the name that external users will use to connect to the ISA Firewall in order to reach the RPC/HTTP site. You can choose to have both internal and external clients use owa.company.com to reach the ISA Firewall or different as you feel.
On the Select Web Listener page, select the SSL listener you created earlier from the Web listener drop down list and click Next.
On the Authentication Delegation page, choose NTLM authentication from the Select the method used by the ISA Firewall to authenticate to the published Web server drop down list. The ISA server automatically detects that a non-browser client is trying to connect to the SSL web listener and will change to basic authentication. The Outlook (which is configured as RPC/HTTP client ) will then use Basic authentication to authenticate to the ISA Firewall which in turn, authorizes the user. If the user is authenticated and authorized, the ISA Firewall will forward the user’s credentials as NTLM credentials to the Client Access Servers. Click Next.
On the User Sets page, accept the default setting All Authenticated Users and click Next.
Review the settings on the Completing the New Exchange Published Rule Wizard page and click Next.
Double click on the Publishing Rule , Click on the Paths tab in the Properties dialog box. The wizard, by default creates the following paths:

/unifiedmessaging/*
/rpc/*
/OAB/*
/ews/*
/AutoDiscover/*

OWA Publishing Rule

2010-02-04T12:35:00.001-05:00

Prerequisite : You must create the SSL Listener rule in place before you proceed .

Click the Firewall Policy in the ISA Firewall console. In the Tasks tab in the Task Pane, click the Publish Exchange Web Clients. Then on the Welcome to the New Exchange Publishing Rule Wizard page, enter a name for the Web Publishing Rule. Click Next.

On the Select Services page, select Exchange Server 2007 from the Exchange version drop down list. In the Web client mail services section, choose Outlook Web Access.Click Next.

On the Publishing Type page, select the Publish a single Web site or load balancer option. In case of multiple Exchange Client Access Servers you can choose the option to Publish a server farm of load balanced Web servers. Click Next.

Next on the Server Connection Security page, choose the type of connection the ISA Firewall's internal interface will establish to the actual Client Access server. For enhanced security, select Use SSL to connect to the published Web server or server farm option. Click Next.

In the Internal site name box, enter the name of the web site that is used to identify the published Client Access Server internally. This is not the server name instead it is the common name associated with the certificate bound to the OWA Web site on the Client Access Server. For example, if the name on the Web site certificate bound to the OWA Web site on the Client Access Server is owa.company.com, so you will need to enter owa.company.com. You may check the option to Use a computer name or IP address to connect to the published server checkbox and then use the Browse button to find the server as well.Enter name on the Web site certificate on the Client Access Server in the Internal site name and the actual computer name or IP address in the Computer name or IP address. Click Next.

On the Public Name Details section, select the This domain name (type below) option from the Accept request for drop down. Enter the name on the certificate bound to the Web listener in the Public name text box. This is the name that external clients will use to connect to the ISA Firewall to reach the Client Access Server. You can choose to have both internal and external clients use owa.company.com to reach the ISA Firewall or different as you feel. Click Next.

On the Select Web Listener section, select the SSL Listener and click Next.

On the Authentication Delegation page, select the Basic authentication option from the Select the method used by ISA Server to authenticate to the published Web server drop down box. Click Next.

On the User Sets page, choose All Authenticated Users.

Review the settings on Completing the New Exchange Publishing Rule Wizard page and click Next.

Double click on the Web Publishing Rule. Click on the Paths tab in the Properties dialog box. The wizard, by default creates the following paths:
/public/*
/OWA/*
/Exchweb/*
/Exchange/*

You can then try to open the owa site from the following location https://owa.company.com/owa
****** Make sure that your DNS entries exist on the local area network and your Internet facing DNS servers. ******

ISA 2006 on ESX – NLB Issues – Use Multicast

2010-02-04T12:32:00.001-05:00

For ISA 2006 solutions, where there is a configuration storage server ( and if required a replicate configuration storage server ) along with and one or more array servers it is necessary to configure Network Load Balancing( NLB) with virtual ip address or ip addresses. This ensure redundancy and high availability for your website or server you want to publish via ISA.
ISA 2006 SP1 supports NLB through Unicast, Multicast and IGMP multicast. Though it is pretty simple to configure NLB using unicast and multicast in physical ISA installations, you might run into issues if you configure Unicast NLB when you have ISA servers on VMWare. This is because VMWARE by itself does not support Unicast until you make some changes to the VMWare networking and prefers multicasts for its internal virtual switches. In such circumstances where you do not want to change the VMware networking configurations, the solution is to run the scripts to configure multicast following the example presented by Microsoft KB article kb938550. You can download the scripts by following the instructions in the article.
The script that you would need to run is :
cscript kb938550.wsf /array:NameOfArray /nlb:multicast /net1:ArrayNetwork

Replication Between Configuration Storage Servers

2010-02-04T12:30:00.001-05:00

I have seen a lot of blogs and forums where people have had issues configuring a replicate configuration storage server. The easy solution to this is once you have your Primary Configuration Storage server up and running, go to Enterprise policy and add the second server name to the Replicate Configuration Storage Server computer Set from the Tool box. You should do this even before you start installing ISA 2006 on the second server you are trying to configure as Replicate Configuration Storage Server.

SFTP and SSH Publishing in ISA

2010-01-31T13:13:00.001-05:00

After numerous retries and failures which lead to my frustration, I was able to configure SSH & SFTP publishing using ISA 2006. This is a pretty straight forward configuration. I researched several websites and blogs but could not find a definitive answer. So, I decided to setup my own virtual environment and test it out.
First of all, it is very much necessary to understand what is SFTP. SFTP is a tool that uses the underlying SSH protocol to transfer files. It is NOT FTP on port 22 neither it is FTPS. So as long as your SSH is working you should be able to use SFTP and even SCP.
Now here is the requirement and process for publishing a SSH server using ISA 2006 :

Your ISA should have at least two interfaces. If your ISA server has one interface then your Non Web server publishing rule may not work. Web publishing, OWA and other web publishing rule works but somehow SSH publishing does not. At least this has been my personal experience.

You will have to define a custom protocol , say SSH inbound on port 22. No other secondary protocol ports are required to be defined. The default SSH protocol that ISA 2006 has is for outbound only but this will not work when you publish a SSH server. So it is necessary that you define the new SSH Inbound protocol from Toolbox --> Protocols.

You will have to use your ISA server internal interface ip address as the default gateway for your SSH server.

Once you have taken care of the above, go ahead and create a Firewall policy using the Non web server publishing rule.

Remember to associate a new ip address on the external interface of the ISA server that will do a Nat-ing to the internal ip address of the SSH server. You may want to associate your default ISA server external ip address for this purpose but I dont guarantee that it will work.

Enabling SNMP monitoring for Servers published by ISA

2010-01-31T13:00:00.001-05:00

Enabling SNMP access through ISA 2006 was a big challenge. I was able to configure the ISA servers to respond to SNMP walk from Servers in a different network ( or External Servers from ISA point of view) but was unable to get the servers in the DMZ respond to SNMP. My ISA setup had a NAT supported Network Rule instead of Route.
Here are the steps that I had to do for allowing SNMP walk to the DMZ servers :

Create an inbound protocol definition with the following specifications :
a. Protocol Type : UDP
b. Ports : 161-162
c. Direction : Receive and Send. ( Donot set it to Send and Receive as that represents Outbound Traffic)
Add ip address to the External Interface of the Firewall. This ip address should be in the range of the ip addresses allocated to the External interface of the ISA server.
Add aNon Web Server publishing Rule with the ip address of the DMZ server you want to do an SNMP walk to as the destination .
Choose the newly created SNMP protocol that you have defined in 1.
Group the SNMP Manager hosts ( or your source servers) into a Computer Set ( from Toolbox under Firewall Policy) and set the group as Source.

Creating Redirections in ISA 2006

2010-01-31T12:56:00.001-05:00

Creating Redirections in ISA 2006 is pretty simple. Suppose you would want to publish OWA for Exchange 2007 CAS servers, for that you would need to do the following
1. Create a Deny OWA Publishing Rule for the public URL , say https://owa.domain.org/ . After you finish the rule, go into the properties of the rule and configure a redirect to https://owa.domain.org/owa.
2. Create an Allow OWA Publishing Rules for https://owa.domain.com using the the Exchange 2007 OWA publishing wizard . Remember that you MUST put this rule right under the Deny rule that you have created.

Configuring ISA 2006 for Terminal Services Gateway on Windows 2008 Server

2010-01-31T10:45:00.001-05:00

Create a web listener with the following parameters:
Authentication: Basic
Authentication Validation: Windows (Active Directory)
Connections: Enable SSL (HTTPS) connections on port 443
Certificates: certificate issued to hostname.domain.org, e.g tsgateway.domain.org
Networks: External
Create Publishing Rule
The web publishing rule for publishing Terminal Service Gateway involves the use of the RPC proxy, the same communication method used by Outlook’s RPC over HTTPS. The RDP clients will use the same protocol that Outlook Anywhere uses, so we need to choose the Exchange Server 2007 Wizard.

Right-click on the Firewall Policy, select New, and then click Exchange Web Client Access publishing rule.
On the Welcome to the Create a New Web publishing rule page, type the name of the rule and click Next.
On the Select Rule Action page, select the option Allow and click Next.
On the New Exchange publishing rule page, select the Exchange version which is Exchange Server 2007. Select Outlook Anywhere (RPC/HTTP(s)) and click Next.
On the Publishing Type page, select the option to Publish a single Web Site or load balancer and click Next.
On the Server Connection Security page, select Use SSL to connect to the published Web server or server farm and then click Next.
On the Internal Publishing Details page, in the Internal site name box, type the name of the TS Gateway server (tsagateway.domain.local). Remember that if you choose the server name option, the name you use must match the common or subject name on the Web site certificate bound to the TS Gateway Web site hosted by IIS on the Windows 2008 Server. For convenience, create a certificate with the common name tsgateway.domain.org and bind it to the IIS server of the Windows 2008 Server that hosts the terminal services gateway.
On the Public Name Details page, from the Accept requests for dropdown list, select This domain name (type below) and then, in the Public name box, type the public name that matches the name of the certificate that was issued for this URL—in our case, the name is tsgateway.domain.org. Then click Next.
On the Select Web Listener page, click on the dropdown list and select the Web Listener that was previously created, and then click Next.
On the Authentication Delegation page, select the option No delegation, but client may authenticate directly, and click Next.
On the User Set page, verify that the default option (All Users) is selected, click Next, and then click Finish. Once done, Apply the policy on the ISA firewall.

Bypassing Java Applet Issues or Active X issues for web server publishing rules

2010-01-31T10:13:00.001-05:00

You may encounter issues while publishing websites with java applets using ISA 2006 web publishing rules. The easiest way to work around this problem is to create a Non Web server publishing rule for protocols Inbound HTTP and HTTPS and publish the target server. Note that by default ISA 2006 blocks Active X and Java Applets in its HTTP filters.

Disable Reverse Proxy Caching

2010-01-30T22:03:00.001-05:00

Sometimes ISA 2006 may render contents that are expired and may not render updated contents from web servers successfully. In such an event if you would like to disable Caching for Reverse Proxy by doing the following :
1. Click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.
2. In ISA Server Management, double-click ServerName, and then double-click Configuration.
3. Right-click Cache, and then click Disable Caching.

SSL Web Listeners

2010-01-30T21:59:00.001-05:00

Assumptions

Site to be published : owa.company.com

Single Domain for ISA Servers, CAS and Users

Click on the Firewall Policy in the ISA Firewall console and then click the Toolbox tab in the right pane. Click Network Objects and then right click on Web Listeners. ClickNew Web Listener.

On the Welcome to the New Web Listener Wizard page, enter the name of the Web Listener. Lets name it as SSL Web Listener and click Next.

On the Client Connection Security page you can either create an SSL or an unsecured HTTP connection with the ISA Firewall. In this case, we select the Require SSL secured connections with clients and click Next.

On the Web Listener IP Addresses section specify the IP addresses that this Web listener will be binded to or will listen to. For our case ( refer to the diagram above), external users connect to the ISA Firewall using the ISA Firewall’s external interface IP address which is connected to the Internet or Public Network. This is a virtual ip address or load balanced ip address of the ISA array , we will discuss how to create an ISA Server 2006 array with virtual ip address and configure load balancing in a different section. The internal users will connect to the ISA Firewall using the ISA Firewall’s internal interface IP address which is connected to the internal or LAN.

Check both the External and Internal network's options and then click on the Internal network and click the Select IP Addresses button.

In the Internal Network Listener IP Selection dialog box, select the Specified IP addresses on the ISA Server computer in the selected network option. Then click the IP address in the Available IP Addresses section and click the Add button to move that IP address to the Selected IP Addresses section. Click OK.

Note that this is again an ip address from the internal network that is added to the ISA server in addition to its default ip addresses and is NOT the internal or private ip addresses of the ISA servers. For each web listener it is a must to have an ip address available. This is a recommended approach since you may be publishing more than one website or application using the same ISA servers and so it is not a good approach to use the internal ip address assigned to the ISA server itself.

On the Web Listener IP Addresses page see now that the Internal network listener is listening on IP address from the internal subnet . Click the External network and then clickSelect IP Addresses.

In the External Network Listener IP Selection dialog box, select the Specified IP addresses on the ISA Server computer in the selected network option. Click the external IP address in the Available IP Addresses(say X.X.X.X) list and click the Add button to move that IP address to the Selected IP Addresses list.

Note that this is again an ip address from the external network that is added to the ISA server in addition to its default ip addresses and is NOT the external or public ip addresses of the ISA servers. For each web listener it is a must to have an ip address available. This is a recommended approach since you may be publishing more than one website or application using the same ISA servers and so it is not a good approach to use the internal ip address assigned to the ISA server itself.

On the Web Listener IP Addresses section you can now see that the Web Listener is now listening on an ip address from the external interface. This is because we want to set the publishing website in such a way so that it resolves to the external ip address from Internet while it resolves to the internal or private ip address for the internal users. You will have to use Split DNS for name resolution. Also note that the screenshots here only depicts the internal network but basically the process of assigning the external and internal network ip addresses to the listener is same and is covered under one step.

On the Listener SSL Certificates page, select the Assign a certificate for each IP address. Click the internal network address and then click the Select Certificate Button. In theSelect Certificate dialog box, select the SSL certificate owa.company.com that you have prepared for the site you want to publish and click Select.

On the Listener SSL Certificates page, click the external ip address (say X.X.X.X) entry (which will be a different IP address as it needs to be a valid address on the public network) and click Select Certificate dialog box, select the SSL certificate owa.company.com that you have prepared for the site you want to publish and click Select. The screenshots here depicts only one network interface but when you have the listener set for both external and internal interface you will see that all the ip addresses assigned to the listener is being displayed in the Assign a certificate for each IP address section.

On the Listener SSL Certificates page both the internal and external IP addresses are now associated with the owa.company.com certificate. Click Next.

On the Authentication Settings section, click Select how clients will provide credentials to ISA Server drop down list and select HTML Form Authentication. Select the Windows (Active Directory) option from the Select how ISA Server will validate client credentials list. Click Next.

On the Single Sign On Settings page, check Enable SSO for Web site published with this Web listener .enter the single sign on domain in the SSO domain name box which is the domain to which your CAS servers, Users and ISA Servers belong. Noe that we are considering a single domain architecture only.

Review the settings on the Completing the New Web Listener Wizard page and click Finish.

Custom Profile Import Configuration

2010-01-30T21:49:00.001-05:00

To import user profile information from one or more domains, Go to the Shared Services Provider or SSP page and then to the Configure Profile Import page, click Custom source in the Source section.

To Add a Connection

On the Manage Connections page, click New Connection. In the Connection Settings section on the Add Connection page, type a domain name in the Domain name field.

By default, a domain controller is automatically detected. To select a specific domain controller, click Select a domain controller and type a domain controller name in the Domain controller name box for the Active Directory server that you want to add.

To access this server by using a Secure Sockets Layer (SSL) secure connection or Secure LDAP, select the Use SSL-secured connection option.

To limit the amount of time spent attempting to access a server, type a value in the Time out field.

In the Search Settings section, type a name in the Search base field. It is recommended that you do not enter anything here as MOSS enters the appropriate information.

In the User filter box, you can add your own query to filter the user profile data that you are importing. The default value is an LDAP query.

In the Scope section, select to what level in the Active Directory server may be searched for user profiles to import. You can limit the scope by selecting One level or search more deeply by clicking Subtree.

Page size box limits the amount of data imported in each user profile.

Page time out box limits the amount of time spent attempting to access a server.

Issue- However if you have more than one domain you will have to have additional configuration for the profile import to work correctly. For example, say you are logged in to the SSP as DomainA\userid and want to add a connection to a different domain, say Domain B. When you give access to the account of DomainB\userid and try to save , you will get error messages about MOSS not being able to verify the details. The easiest way is to complete the configuration by clicking through but when you try to import user profiles, it will not work correctly.
Resolution - In order to resolve this, you will need to add the content source when you are logged in as DomainB\userid. Here, you need to give DomainB\userid access to the SSP and appropriate access to update user profiles and then create the new connection as that user.

SSP Permissions

2010-01-30T21:47:00.001-05:00

1. Open SharePoint Central Adminstration
2. Click on the Applications Tab
3. Under Application Security click on Policy for Web Application
4. In the Web Application selection drop-down the SSP Web Application
5. Click on the Add Users
6. Click on Next
7. Add the users, (in our case AD Security Group) in the Choose Users window
8. Select Full Control

Adding MOSS Servers to an Existing Farm

2010-01-30T21:46:00.001-05:00

Insert the MOSS cd-rom and start the setup. After you have entered the license key, click Next and then accept the “Microsoft Software License Terms” and click “Continue

Choose “Advanced” installation

In the Server Type section choose “Complete”

Click on “Install Now” to complete the installation

Once the installation is complete click on close to “Run the Sharepoint Products and Technologies Wizard”

Click on Next to proceed

Choose Yes

Choose “Yes I want to connect to an existing Farm”. Click Next

Enter the database connection settings specific to your farm and click Next

Click Next

Wait for the wizard to finish the configuration

Click Finish to complete the configuration

Fixing People Picker Issues

2010-01-30T21:17:00.001-05:00

In a multi domain or forest scenario, the people picker may not work correctly. In that case, by default, People Picker can only find people in the resource domain - the domain that MOSS servers belong to. For other domains/forests, you'll need to do the following:

There exists at least a one way trust between the domain the moss servers are in and the other domains. In this case, the MOSS domain should be trusting the other domains. For example, if the moss servers belong to Domain A and there are 3 other domains such as Domain B, C and D, then there should be an one-way trust where Domain A should be trusting Domain B, C and D respectively.
Also, you would need to run the following command from all the servers where you have MOSS installed just to make sure it propagates properly. :

stsadm.exe -o setapppassword -password <string> [ This is to encrypt the password that will be used in the next stsadm command for the parameters domain:DnsName,LoginName,Password OR forest:DnsName,LoginName,Password and store the encrypted password in the database. Also, please use the same <string> to run stsadm.exe -o setapppassword -password <string> on all machines where SharePoint is installed]

For example, stsadm.exe -o setapppassword -password mosspassword

Stsadm.exe –o setproperty –pn peoplepicker-searchadforests –pv <list of forests or domains> -url <webapp>[The format of <list of forests or domains> is a list of forest:DnsName,LoginName,Password OR domain:DnsName,LoginName,Password] separated by semicolon.

For example, stsadm.exe -o setproperty -url http://moss.company.com -pn "peoplepicker-searchadforests" -pv "domain:DomainB”,DomainB\Account,password; "domain:DomainC”,DomainC\Account,password; "domain:DomainD”,DomainD\Account,password

If they are two-way trusted domains/forests, then it is not necessary to pass in the LoginName or Password, just in the format of forest:DnsName OR domain:DnsName and in that case run 2 only.

Protocols and Ports for MOSS

2010-01-30T00:04:00.001-05:00

HTTP – 80 TCP 443 TCP
Directory Services – 445 TCP 445 UDP
Kerberos Authentication – 88 TCP 88 UDP
LDAP – 389 UDP
DNS – 53 TCP 53 UDP
SQL – FHA chosen, non-standard port
Direct Hosted SMB – 445 TCP 445 UDP
Admin Site – HTTP over FHA chosen, non-standard port
RPC for SSO – 135 TCP and FHA chosen high port range

System Administration

Some Useful Windows 2008 TCP/IP commands

Enabling IP Forwarding

Adding persistent static routes

Install and Apply FEP 2010 client locally

Adding multiple IP addresses in a Windows 2008 server

Extending a Web Application in SharePoint 2010

Creating a Web Application

Installing SharePoint 2010

Publishing Active Sync using ISA Server - Shortcut

Publishing Outlook Mobile Access using ISA Server

Fixing Disk Issues for P2V servers in ESXi

“Failed to Open SCSI DIsk 0:0 unsupported and/or invalid Disk Type 7"

Fixing WMI errors

Removing Non Present Devices in Windows Virtual Machines after P2V

ISA and Load Balancing

P2V continued – Destination Virtual Machine actions

P2V checklist

P2V Converter Specifications

Virtual Switches configuration from ESX Command Line

Fixing Legato Backups for VMware Esx

Backing up SQL Express

Physical To Virtual Determination

CPU

Operating System

Storage

Peripherals and Devices

Server Role

Configuring SSO Cluster

To configure the service and resource parameters for the cluster

To restore the master secret on the second node

System Center – Virtual Machine Manager

Playing with Virtual Machine Disks

Creating a new Virtual Machine using System Center - VMM

System Center – Virtual Machine Manager

Hyper V Management Console

SSL Certificate formats

SSL Certificate for Web servers – IIS 6.0

Certificate Request -For new Certificates

Certificate Request - For Renewing certificates

Certificate Import to the Web server

Exporting Certificates

Single Sign On configuration for MOSS 2007

Alternate Access Mappings (AAM)

MOSS 2007 backup Script

Poor man’s SAN/ iscsi Dream

Microsoft Hyper V

ESX Firewall Commands

Creating Templates in VMware

Tomcat Server Configurations for SSL and Bindings

Standard P2V Process

Installing Virtual Center 2.5

Installing ESX 3.5 Server

Publish Active Sync using ISA

RPC over HTTPS

OWA Publishing Rule

ISA 2006 on ESX – NLB Issues – Use Multicast

Replication Between Configuration Storage Servers

SFTP and SSH Publishing in ISA

Enabling SNMP monitoring for Servers published by ISA

Creating Redirections in ISA 2006

Configuring ISA 2006 for Terminal Services Gateway on Windows 2008 Server

Bypassing Java Applet Issues or Active X issues for web server publishing rules

Disable Reverse Proxy Caching

SSL Web Listeners

Custom Profile Import Configuration

SSP Permissions

Adding MOSS Servers to an Existing Farm

Fixing People Picker Issues

Protocols and Ports for MOSS