Microsoft Offline Virtual Machine Servicing Tool

Posted on By Mark Wilson

In my recent article about the realities of managing a virtualised infrastructure, I mentioned the need to patch offline virtual machine images. Whilst many offline images will be templates, they may still require operating system, security or application updates to ensure that they are not vulnerable when started (or when a cloned VM is created from a template).

Now Microsoft has a beta for a tool that will allow this – imaginatively named the Offline Virtual Machine Servicing Tool. Built on the Windows Workflow Foundation and PowerShell, it works with System Center Virtual Machine Manager and either System Center Configuration Manager or Windows Server Update Services to automate the process of applying operating system updates through the definition of servicing jobs. Each job will:

  1. “Wake” the VM (deploy and start it).
  2. Trigger the appropriate update cycle.
  3. Shut down the VM and return it to the library.

Although I haven’t tried this yet, it does strike me that there is one potential pitfall to be aware of – sysprepped images for VM deployment templates will start into the Windows mini-setup wizard. I guess the workaround in such a scenario is to use tools from the Windows Automated Installation Kit (WAIK) to inject updates into the associated .WIM file and deploy VMs from image, rather than by cloning sysprepped VMs.

Further details of the Offline Virtual Machine Servicing Tool beta may be found on the Microsoft Connect site.

Heterogeneous datacentre management from Microsoft System Center

Posted on By Mark Wilson

Back in 2005, I quoted a Microsoft executive on his view on Microsoft’s support for heterogeneous environments through its management products:

“[it’s] not part of our DNA and I don’t think this is something that we should be doing.”

Well, maybe things are changing in post-Gates Microsoft. I knew that System Center Virtual Machine Manager 2008 (named at last week’s Microsoft Management Summit) included support for managing VMware ESX Server and a future version should also be able to manage XenSource hosts, but what I had missed in the MMS press release was System Center Operations Manager (SCOM) 2007 Cross Platform Extensions. These allow SCOM to manage HP-UX, Red Hat Enterprise Linux (RHEL), Sun Solaris and SUSE Linux Enterprise Server through management packs with Novell, Quest and Xandros adding support for common applications like Apache, MySQL and (a real surprise) Oracle. Then, for those with existing investments in major enterprise management suites, there are SCOM connectors to allow interoperability between System Center and third-party products like HP OpenView and IBM Tivoli.

I really think this is a brave step for Microsoft – but also the right thing to do. There are very few Microsoft-only datacentres and, whilst I am no enterprise management expert, it seems to me that corporates don’t want one solution for each platform and the big enterprise management suites are costly to implement. With System Center, people know what they are getting – a reasonably priced suite of products, with a familiar interface and a good level of functionality – maybe not everything that’s in Tivoli, UniCenter or OpenView, but enough to do the job. If the same solution that manages the WIntel systems can also manage the enterprise apps on Solaris (or another common Unix platform), then everyone’s a winner.

Xobni

Posted on By Mark Wilson

Xobni logoEven though Inbox Zero has helped me gain some control over my e-mail, I still need all the help I can get. Last week, Simon Coles sent me an invitation for Xobni – a plugin for Microsoft Outlook that offers fast search, conversation threading, a social networking platform, and many other features designed to make email better – or as Xobni (inbox spelt backwards) like to put it:

“Xobni is the Outlook plug-in that helps you organize your flooded inbox.”

It’s already becoming very useful – earlier today I couldn’t find a document that I was sure I’d been sent (and the Outlook 2007 search functionality didn’t seem to find it either). I used Xobni to highlight another e-mail from the same correspondent and there was the missing document – one of the listed files that we had exchanged – from where I could open the original e-mail, or the attachment that I was after. Xobni will pull contact information out of e-mail messages (even if I don’t have an address book entry for a particular contact) and tells me who my contacts correspond with that I do too. There’s also an analytics feature that lets me track the volume of e-mail I receive (and how long it takes me to process), ranking my correspondents and telling me what time of day they tend to send me e-mail. It can also read my calendar and automatically highlight the times that I am available over the next few days, placing the details in an message, all ready to send. There’s VOIP integration too – although clicking on the Skype logo launched Office Communicator on my system (I don’t have Skype installed but I do have OCS). Finally, Xobni has its own built in search capabilities, which I’ve used a few times this evening to track down long lost e-mails based on the snippets of information that I could recall from the recesses of my mind. In fact, the only niggle I found was in my work e-mail, where it struggles to differentiate between first and last names (our display names are formatted with the lastname in front – e.g. “Wilson Mark” – and, even though the e-mail address is something like mark.wilson@country.companyname.com, Xobni thinks my name is “Wilson” but has no such problem for contacts with sensible display names – like “Mark Wilson” – or with punctuation in the display name – such as “Wilson, Mark”).

Xobni’s invitation-only period is over (although they are still banding around the beta tag in true web 2.0 style) and the product is available for all to download. I’ve only been using it for a few days but I’m very impressed with the information that it gives me – even so, I’ll leave the product review to those who know it best – check out the video below:

What I can say is that I reckon Xobni is pretty cool. It seems I’m not alone as Bill Gates demoed the product in his keynote at the 2008 Office Developers Conference and Xobni was selected for Microsoft’s Startup Accelerator Program but the founders are reported to have walked away from an outright takeover. If you use Microsoft Outlook for your mail, then Xobni is worth checking out and could save you a lot of time.

Microsoft 2.0

Posted on By Mark Wilson

As someone who works closely with Microsoft, I’m very interested to see what happens to the company as Bill Gates steps aside. Changes are already afoot – anyone who has attended a recent marketing event (like the 2008 launch wave) will have heard about the idea of software plus services – and some of Microsoft’s partners need to start thinking about their own business models as hosted services become more and more attractive to corporates.

Two years ago, I wrote that I didn’t think the “webtop” would replace the desktop. I still think that is true – enterprises are not yet ready to store their data in “the cloud” – but things are starting to change and there seems little doubt that web services are the direction that were all heading in. Windows and Office will be here for a while yet but Microsoft desparately needs to get a piece of the action if it is to stay relevant – hence their failed attempt to buy Yahoo!. Meanwhile, rather than follow the Google model of storing everything in cyberspace, Microsoft Live Mesh looks at how to make data accessible by connecting people, processes and technology – wherever they are.

Last week’s Windows Weekly podcast (episode 57) featured an interview with Mary Jo Foley, author of Microsoft 2.0: How Microsoft Plans to Stay Relevant in the Post-gates Era. I’ve not read the book yet (it’s on my Amazon wishlist) but it may be interesting to track the accompanying blog – Microsoft 2.0.

Personally, I’m glad that Microsoft didn’t launch a hostile bid for Yahoo! and instead withdrew their offer. It seems pretty clear that the Yahoo! Inc. management team would rather have hit the self-destruct button than become part of Microsoft Corporation and, to me, that implies a degree of immaturity. Meanwhile, Microsoft can keep their cash and move forward with their software plus services model. When one of the world’s largest companies has to borrow money for a takeover, that’s not a good sign – and that’s an awful lot of money that they could do something useful with.

The no-compromise ultraportable?

Posted on By Mark Wilson

As the day job has been taking over my life (reducing my time for blogging), I thought I’d finish up the week with some light-hearted humour. I’ve commented before that I think Apple’s MacBook Air ultraportable PC is overpriced and underspecced. And whilst it may be selling to the Apple fanboys and those execs with more money than sense it’s not really much use for people who really need a light PC to travel with for their work (in my opinion, as someone who travels a lot, and uses standard notebook PCs – although, sadly, my employer won’t give me a ThinkPad either). Not wanting to start up the Mac vs. PC rubbish (I’ve been there before), I thought I’d post Lenovo’s view on what an ultraportable PC should be like:

This video has been floating around the web for a few days now, and some of the responses I’ve seen have been along the lines of “Yeah, but the MacBook Air does everything I need without needing to plug anything in”. Right. Of course it does. Well, if the MacBook Air is good for you, then all I have to say is “good for you”. Personally, I’ll take the ThinkPad. And if Vista is too much of a compromise (I don’t think it is) then I’ll take a normal Apple MacBook (mine is running OS X and Vista).

Configuring RPC over HTTP for access to Exchange Server

Posted on By Mark Wilson

Microsoft Outlook Web Access (OWA) is great for occasional access to e-mail but if you’re using a non-Microsoft browser (as I often do) then it degrades to a rather sorry state. Consequently, for a couple of years now, I’ve been meaning to get RPC over HTTP (aka. Outlook Anywhere) working so that I can use a full Outlook client to access my Exchange Server mailbox when I’m on the road (iPhone access to Exchange Server via IMAP or Outlook Mobile Access from my Nokia 6021 are useful for checking for messages throughout the day but I need to run the full Outlook client to filter out the junk e-mail). After doing most of the preparation work some time ago, I didn’t get around to testing it fully – mostly because a lot of my access is from behind an authenticated proxy (and I’m told that Outlook doesn’t like anything getting in the way).

Tonight, I’m in a hotel, and the iBahn connection has no such restrictions, so I finally got around to testing the connection, using Outlook 2007 to communicate with an Exchange Server 2003 (SP2) server.

Full details may be found in Microsoft knowledge base article 833401 but, as ever, I found Daniel Petri’s articles on the subject more useful:

For me, the process was simplified as I already had OWA working over HTTPS but, as Daniel highlights, Harry Bates’ RPCNoFrontEnd utility can save a lot of time in checking that the registry keys are correctly set for the RPC proxy server ports and the Windows Server 2003 resource kit rpccfg /hd command is useful to confirm their operation:

Using rpccfg to confirm the RPC proxy settings

Secondly, running outlook /rpcdiag gave some useful diagnostic information for confirming that the connection was indeed using HTTPS:

Using the Outlook 2007's RPC diagnostics to check connection status

Ironically, I’ve finally got this working with Exchange Server 2003 just before I’m about to move my mail over to a new server running Exchange Server 2007!

Windows Vista and Office 2007 deployment brain dump

Posted on By Mark Wilson

This week I’m working on a Desktop Deployment Planning Services (DDPS) engagement with a customer. It’s been a while since I last looked at deployment (basically I haven’t done anything since I passed the Windows Vista and Office 2007 deployment exam) so I’m revising my notes in preparation for a workshop tomorrow.

As a supplement to my previous post on a BDD 2007 overview and Office 2007 customisation and deployment using BDD 2007, this is a rollup of just about everything I could lay my hands on about Vista and Office deployment. It’s not particularly well structured – let’s just call it a “brain dump”. If anyone has anything extra to add, please leave a comment at the end of this post:

Windows imaging technologies

  • ImageX (imagex.exe) is a command line tool for manipulating Windows Imaging Format (.WIM) files. It is built using the Windows imaging API (WIMGAPI) together with a .WIM file system filter.
  • Windows Vista images are HAL-independent and make use of single instance storage. To minimise the amount of space used by Windows Vista installation images, use imagex.exe to apply images to separate folders on a computer and then append these images to the final image.
  • Windows System Image Manager (SIM) is used to create and maintain answer files.
  • To modify an image, use imagex.exe to mount it and then apply an unattended setup answer file (unattend.xml).
  • Package Manager (pkgmgr.exe) can be used to update both image files and computers that have already had an image applied:
    • When used to update computers that have already had an update applied, pkgmgr.exe can install, configure and update features in Windows Vista (e.g. installed components, device drivers, language packs, updates). It can also be used with an unattended installation answer file for new installations.
    • When adding additional drivers to an existing Windows Vista image, use pkgmgr.exe to add the drivers from a folder.

Windows Vista deployment

  • Windows Setup (setup.exe) for Vista is now GUI-only and there is no more winnt.exe and winnt32.exe.
  • Windows installation is structured around a number of configuration passes:
    • Windows PE.
    • Offline servicing.
    • Generalise.
    • Specialise.
    • Audit system.
    • Audit user.
    • OOBE system.
  • unattend.xml is a single unattended installation answer file, replacing multiple files in previous versions of Windows – including unattend.txt, cmdlines.txt, winbom.ini, oobeinfo.ini and sysprep.inf.
  • To avoid prompting users for input during the installation of Windows Vista, create an unattended setup installation file and copy this to a USB flash drive, then ensure that the flash drive is present during Windows Vista installation.
  • unattend.xml must be renamed to autounattend.xml when used on removable media during installation and replaces winnt.sif.
  • The Out-of-Box Experience (OOBE) is now known as Windows Welcome and is controlled with oobe.xml, which includes options for Windows Welcome, ISP sign-up and the Windows Vista Welcome Center.
  • Disk repartitioning can be configured in the first pass of the Windows PE section of unattend.xml.
  • When using multiple hardware configurations, create a distribution point that includes an Out-of-Box Drivers folder.
  • Windows Deployment Services (WDS) replaces Remote Installation Services (RIS).
  • When using WDS with computers that do not have PXE capabilities, create a WDS discovery image and use this to create a bootable CD for Windows Vista installation.
  • When using WDS on a server that provides DHCP services, enable DHCP Option 60 and configure WDS to listen on port 67.
  • If the WDS Image Capture Wizard is unable to capture a reference computer image, restart the reference computer and run sysprep /generalize /oobe.
  • The Windows Automated Installation Kit (WAIK) replaces deploy.cab and contains updated versions of tools previously provided to OEMs (e.g. Windows PE) for use in corporate deployments.
  • The OEM Preinstallation Toolkit (OPK) is for system builders, containing the WAIK and additional OEM-specific information (e.g. OEM licensing).
  • bootsect.exe is used to enable deployment alongside earlier versions of Windows with the Windows Vista boot manager (bootmgr.exe) – it replaces fixfat.exe and fixntfs.exe (both included with Windows Vista). Microsoft knowledge base article 919529 has more details.
  • boot.ini has been replaced by the >Boot Configuration Data.
  • The System Preparation Tool (sysprep.exe) is installed by default on Windows Vista systems in %windir%\system32\sysprep and there are several changes when compared with previous versions:
    • sysprep /reseal is replaced with sysprep /generalize /oobe.
    • sysprep /factory is replaced by sysprep /audit.
    • sysprep /mini is replaced by sysprep /oobe.
    • sysprep /nosidgen is replaced by sysprep /generalize.
    • sysprep /clean and sysprep /bmsd are deprecated.
    • sysprep /activated is replaced by sysprep /generalize (together with slmgr.vbs for managing the activation status of a computer)
    • OEMs are required to run sysprep /oobe before delivery of new computers.

Customising Office 2007 installations

  • Windows Installer Patch (.MSP) files can be used to produce customised Office installations (and then called using a script).
  • Multiple installation shares can be defined within a .MSP file.

Office 2007 deployment

  • To create an Office 2007 installation share (e.g. for scripted deployment), create a shared folder on a server and copy the installation files from the source media to the root of the shared folder.
  • To slipstream Microsoft Office 2007 updates into the deployment, create a folder called updates in the Microsoft Office 2007 distribution folder and copy all updates to this folder.

User data migration:

  • The User State Migration Toolkit (USMT) v3.0 can be used with both Windows XP and Windows Vista.
  • miguser.xml can be used to ensure that USMT captures files with a particular extension during migration.
  • The USMT scanstate.exe command can be used with the /p switch to ensure that sufficient free space exists in a target folder.
  • USMT can migrate user state using a network server during an upgrade that involves repartitioning of disks.
  • If the partition table is to be left intact during a migration, use a local partition with sufficient free space for temporary storage.
  • scanstate.exe can scan a source computer, collect files and create a store without modifying the source. The default action is to compress files and store them in image file (usmt3.mig).
  • loadstate.exe will migrate files and settings from and existing store to the destination computer.
  • The scanscate.exe and loadstate.exe commands have matching command line arguments.
  • Migration XML files include rules to define what should be migrated and are specified with the /i switch:
    • Custom XML files define components to exclude and are created using scanstate /genconfig:config.xml.
    • migsys.xml is used with the /targetxp switch to migrate operating system and browser settings.
    • migapp.xml is used to migrate application settings.
    • miguser.xml is used to migrate user files, folders and filetypes.
    • If the destination computer is running Windows XP, modify miguser.xml, migapp.xml and migsys.xml
    • If the destination computer is running Windows Vista, modify miguser.xml and migapp.xml but migsys.xml is not supported – use config.xml instead.
    • migxml.xsd can write and validate xml files.
  • scanstate /p can be used to create a space estimate file called usmtsize.txt (it will also be necessary to specify /nocompress).

Office 2003-2007 interoperability

Localisation

  • To add multiple language support to Office 2007 applications, install the appropriate language pack on the installation share and update config.xml.
  • To add a language pack to an existing computer, use pkgmgr.exe to apply a new unattended setup installation file that references the appropriate language pack.
  • If the Windows SIM is unable to access language pack settings in a customised Windows Vista image, generate a new catalog based on the custom image.

Further reading

My living room PC finally becomes a reality

Posted on By Mark Wilson

Some time back, I wrote about my plans for a living room PC but before this could happen there were several hurdles to overcome:

  1. Earn enough money to replace my Mac Mini so that it could move to the living room.
  2. Negotiate the wife approval factor for IT in a common area of the house (must look good – hence Mac Mini).
  3. Find a software setup that works for me, but is also consumer-friendly for the rest of the family (i.e. no hint of a Windows, OS X or Linux interface).

Fortunately, the first two items came together for me quite easily – after I decided to raid my savings and buy a MacBook a couple of months back, my wife asked me which PC it was replacing and I said “that one” (pointing at the Mac Mini), never expecting the response that she gave – “Oh. I like that one. It’s cute.”! This was a revelation to me – my wife has never before referred to any of my IT as “cute” – so I grabbed the moment to say something like “yeah, I thought it could go in the living room for when we watch films and stuff” (and the lack of any objection was interpreted as implicit approval).

The hardest part was the software setup. I still feel that Windows Vista’s Media Center capabilities are vastly superior to Apple’s Front Row – there’s TV support in there for starters. There are other options too: EyeTV would add TV support to the Mac (the problem is that it only has a 1 year TV guide subscription in Europe); Center Stage looks promising, but is still an alpha release product (and has been for a while now); Myth TV could work too (but my research suggested that USB TV tuner support could be a bit of a ‘mare). Then I thought about it a bit harder – we have lousy terrestrial TV support in my house (digital or analogue), so the clearest TV signal I have is on satellite (Freesat from Sky). Unless I can find a way to interface the Mac with my digibox, TV on the living room PC is not going to happen (this solution looks interesting but is for Windows/Linux only). Which meant that the criteria for a living room PC were:

  • Access to my iTunes library (which lives on my MacBook) to watch podcasts, listen to music, etc.
  • Ability to play content from CD/DVD.
  • Ability to play content ripped from DVD or obtained by other means (e.g. home movies or legally obtained digital downloads).
  • Simple (no technical skills required) user interface.

So, ruling out the need for TV integration meant that Apple Front Row was suddenly a contender as the OS X 10.5 (Leopard) version of Front Row can access shared libraries from other PCs (so I don’t have to copy/convert the media) and the remote control supplied with the Mac Mini does not rely on line of sight to control the PC. Vista Media Center could do this but I’d need to have that huge IR receiver and ugly remote control. Of course, I could just buy an Apple TV, but the Mac Mini gives me so much more (and it can output to my aging, but still rather good Sony Trinitron 32″ widescreen TV). I will stress though, that if I ever manage to get a decent TV signal from our aerial, Windows Vista Media Center would beat Front Row hands down.

It’s ironic that I’m writing this in a hotel room in Bolton (nowhere near my living room) but so far, the software stack on the Mini is:

I may have to add a few more codecs over time (but Perian seems to include most of what I need) and furthermore, this headless PC (sorry, Mac – for the purists out there) is suiting my requirements pretty well. I’ve watched films from the hard disk with no issues at all, and streamed video podcast (and audio) content from my MacBook across an 802.11g Wi-Fi network (with no apparent playback issues – despite the signal having to travel through several walls and to the furthest corner of my living room – although I wish iTunes would mark podcasts as played when viewed remotely). There is one caveat though (and that’s a hardware issue) – even though the Leopard version of Front Row supports DVD playback, I still watch DVD content on my home theatre setup as that gives me true 5:1 surround sound (it’s only stereo on the Mac Mini).

Other applications that will probably find their way onto the mini over time include:

Those are for the future though – at this point in time, I’m ripping my content (and performing iPod conversion as required) on other machines and transferring it to the Mini across the network (see below). I also tried running a Windows XP virtual machine for downloading from BBC iPlayer and Channel 4 On Demand but didn’t manage to set up the tools that are necessary to remove the Windows Media DRM in order to play the content on the Mac (I do at least have a PC running older software releases that I can use for that).

As for getting media onto the living room PC (the stuff that I don’t want to stream across the network), I can always plug in a USB drive and control it remotely using the screen sharing capabilities in OS X.

Screen sharing in OS X to access the living room TV remotely

OS X screen sharing is only VNC but it works well across my network (and scales the display accordingly – it even gave a decent representation of my 1680×1050 resolution display downscaled to fit on a 1280×800 MacBook display, although the picture here is with the Mac Mini hooked up to a standard definition TV). One point to note – it’s necessary to disconnect the shared screen session before trying to control the living room PC with the remote control or else it won’t work.

Further reading

Wikipedia article on Apple Front Row.
MacInTouch Intel Mini Home Theater.
ARS Technica review of various Mac Mini media solutions.

And finally…

This guy has some great details of how he set up his Mac Mini in his living room – he uses MythTV but gives some good details about mounting the hardware to only take up 97mm (3.8″) of room space.

At last, a new service pack for Windows XP

Posted on By Mark Wilson

It’s been a long time coming – almost 4 years – but Microsoft has just announced that Windows XP service pack 3 has been released to manufacturing.

In the announcement, Release Manager, Chris Keroack, said:

“Today we are happy to announce that Windows XP Service Pack 3 (SP3) has released to manufacturing (RTM). Windows XP SP3 bits are now working their way through our manufacturing channels to be available to OEM and Enterprise customers.

We are also in the final stages of preparing for release to the web […] on April 29th, via Windows Update and the Microsoft Download Center. Online documentation for Windows XP SP3, such as Microsoft Knowledge Base articles and the Microsoft TechNet Windows XP TechCenter, will be updated then. For customers who use Windows XP at home, Windows XP SP3 Automatic Update distribution for users at home will begin in early summer.”

Microsoft released a white paper a few months back, detailing the improvements that Windows XP service pack 3 will bring – XP SP3 is basically a rollup of updates and some of the networking technologies from Windows Vista – for example NAP client support.

Accessing unsecured Wi-Fi – is it a crime?

Posted on By Mark Wilson

Whilst I was researching my earlier post about WiMax in Milton Keynes, I came across an article on The Register about a couple of guys who got themselves arrested for accessing someone’s open Wi-Fi connection.

The comments make interesting reading – I recommend a read but will warn you that there are 111 of them, so you’d better be good at skim reading!

There are lots of useful analogies there (and the general consensus seems to be that, if a Wi-Fi access point is open, then you are inviting people to come in – especially with most wireless cards configured to connect to the strongest available signal – and that, if it’s secured, then it is clearly a private computer system) but I found a few of them particularly interesting after reading Section 1 of the Computer Misuse Act, 1990 (I’m sure other laws can equally be applied):

Unauthorised access to computer material
(1) A person is guilty of an offence if—
(a) he causes a computer to perform any function with intent to secure access to any program or data held in any computer;
(b) the access he intends to secure is unauthorised; and
(c) he knows at the time when he causes the computer to perform the function that that is the case.
(2) The intent a person has to have to commit an offence under this section need not be directed at—
(a) any particular program or data;
(b) a program or data of any particular kind; or
(c) a program or data held in any particular computer.
(3) A person guilty of an offence under this section shall be liable on summary conviction to imprisonment for a term not exceeding six months or to a fine not exceeding level 5 on the standard scale or to both.

[Computer Misuse Act, 1990]

Based on this it could be argued that, if anaccess point is broadcasting SSIDs and is unencrypted, then a person cannot know that the access that they intend to secure is unauthorised. It could also be argued that, by broadcasting its presence, the access point accessed any computers with wireless cards in the area without their respective owners’ permissions. Or consider, as another commenter highlighted, what happens when pinging a computer’s IP address – is that not requiring the other computer to perform an action (even if that action is to reject ping responses, it still has to read the packet)? What about accessing a web server – did I explicitly give you permission to come here and read this article? No, but by publishing this website, I gave implicit permission, which is expanded further in my legal notice. Ergo, by leaving wireless access point open and broadcasting it’s SSID, I would be giving implicit permission to access it.

I know there’s at least one Copper who reads this blog and I’m sure he has an opinion. As of course, do I. And that’s why I locked down my Wi-Fi.

Usual caveats apply: I am not a lawyer; don’t interpret anything you read here to be legal advice; etc., etc..