Bruce123

Hi, We have several ESX hosts (with local storage), that are managed through vSphere, but don't report if a HDD has failed in the RAID5 array (the health logs don't indicate any hardware issues). The servers are old-ish HP servers. Does anyone know of any way we can view the status of the RAID array (without actually visiting the server and checking for LEDs)? I am fairly new to VMware/ESX (my experience is with Hyper-V ). Any advise / help would be greatly appreciated. Kind Regards, Bruce.

That could prove very useful. And very handy to know that it's possible.

I've been asked to investigate digital-signing of PDF forms. Had anyone dealt with this before? The idea is to replace the paper-based forms currently used to record each student's progress in work-based learning, with PDF forms. The assessor would fill-in the form and perhaps the student as well. When in agreement, both the assessor and the student need to be able to digitally sign the form (the equivalent to a pen/paper based signature but using digital IDs aka Certificates). The form then gets sent back to College. The electronic copy is retained and used in two ways: A permanent record of the document (and the two signatures can be checked electrically, presumably by auditors). Data from the fields can be extracted into a DB. I did a little test with a PDF form that the guy sent me to try out the signing process. It provided me with 3 options: 1) Use a "roaming ID server". I am prompted to type in the URL of the Roaming ID server, from where it can download the user's digital certificate to sign the document. 2) Create a self-signed document 3) Select an existing certificate file. 1) I am having trouble getting any info on this, is this a Adobe specific technology or could Certificate Services for Windows be adapted to perform this function? 2) I think I can safely exclude as it doesn't provide any real level of authentication, anyone can create a self-signed certificate in anyone's name. 3) The candidates/assessors could be provided with a certificate each (including the secret key) which requires a password to be unlocked. The problem is it would be bit would be a faff because each assessor/student would need a way of storing their own certificate. And we would have to have a secure method of telling the student their password to unlock their certificate. If the password isn't secure it undermines the whole process/signatures and the user could deny having signed it. Is anyone aware of any cloud-based solutions that might simplify all this? I.e. by allowing the user to sign the PDF online without the need to worry about signatures, but does allow the College to download the PDF for storage. But then how would the assessor/candidate authenticate themselves to the service? I did ask if they could not stick to using paper-based forms but scan them all (we can scan to email) so they can be stored electronically, but they said that this wouldn't meet requirement no. 2 (extracting data from the forms directly into a DB). Digital signatures are obviously the future when it comes to signing of digital documents, but I am just having trouble how they could be implemented in a practical way in this scenario. Any help would be very much appreciated. Many Thanks, Bruce

I've been asked to investigate digital-signing of PDF forms. Had anyone dealt with this before? The idea is to replace the paper-based forms currently used to record each student's progress in work-based learning, with PDF forms. The assessor would fill-in the form and perhaps the student as well. When in agreement, both the assessor and the student need to be able to digitally sign the form (the equivalent to a pen/paper based signature but using digital IDs aka Certificates). The form then gets sent back to College. The electronic copy is retained and used in two ways: A permanent record of the document (and the two signatures can be checked electrically, presumably by auditors). Data from the fields can be extracted into a DB. I did a little test with a PDF form that the guy sent me to try out the signing process. It provided me with 3 options: 1) Use a "roaming ID server". I am prompted to type in the URL of the Roaming ID server, from where it can download the user's digital certificate to sign the document. 2) Create a self-signed document 3) Select an existing certificate file. 1) I am having trouble getting any info on this, is this a Adobe specific technology or could Certificate Services for Windows be adapted to perform this function? 2) I think I can safely exclude as it doesn't provide any real level of authentication, anyone can create a self-signed certificate in anyone's name. 3) The candidates/assessors could be provided with a certificate each (including the secret key) which requires a password to be unlocked. The problem is it would be bit would be a faff because each assessor/student would need a way of storing their own certificate. And we would have to have a secure method of telling the student their password to unlock their certificate. If the password isn't secure it undermines the whole process/signatures and the user could deny having signed it. Is anyone aware of any cloud-based solutions that might simplify all this? I.e. by allowing the user to sign the PDF online without the need to worry about signatures, but does allow the College to download the PDF for storage. But then how would the assessor/candidate authenticate themselves to the service? I did ask if they could not stick to using paper-based forms but scan them all (we can scan to email) so they can be stored electronically, but they said that this wouldn't meet requirement no. 2 (extracting data from the forms directly into a DB). Digital signatures are obviously the future when it comes to signing of digital documents, but I am just having trouble how they could be implemented in a practical way in this scenario. Any help would be very much appreciated. Many Thanks, Bruce.

Speaking personally, if you can find a way to copy the backup files to USB HDD reliably, then I wouldn't bother with tape. Think of it this way - if your tape drive located in your server room and there is a small fire there and your tape drive is destroyed you can't even begin to think about recovering data until you get hold of a new compatable tape drive/SAS cable & card and connect it to a server. If your weekly backups are on USB drive (off-site) then you can plug them into any PC/laptop to recover the files. Again, just my opinion. Bruce.

I can confirm that what you're trying to do is possible with ISA 2006. It can be configured to permit web client access at both via layer 7 (proxy) and layer 3/4 (routed - no proxy required) concurrently. For the latter, have you installed the ISA firewall client onto the PCs that require direct (layer 3/4) access? Not strictly necessary in some configuations, but it helps. The firewall client .EXE is stored on the ISA server somewhere, or can be downloaded from MS website. It's been a while since I have done this, but you may also need to add a NAT routing rule from Test Range to External. I notice that your test IP range is the same network as your ISA Server, is this really what you intended? Thanks, Bruce.

Au contraire mon ami. You can (quite easily) do folder/file recovery from a Windows Server Backup file, not by using the backup/recovery tool itself, but by mounting the VHD file in Storage Management. Here's how. From either Windows 7 or Windows 2008 R2; Right click My Computer->Manage -> Storage -> Right click Disk Management then Attach VHD, Select the appropriate VHD backup file. Once it is mounted you may need to assign a drive letter (right click in the disk area of the Window). Very easy and very powerful way to recover files. Note: If you have configured Windows 2008 R2 to backup incrementally to the same media/drive (as it was really designed to be used), then it is possible to select the backup date/time as well, I just can't remember how it's done as I haven't needed to do this for a while. Your method isn't a bad way (at all) to backup physical servers (for both DR and file recovery). However, for VMs I would use a method to backup the server at the Hyper-V host level. Thanks, Bruce.

HP printers have a feature called "mopier", which causes this to happen when trying to print multiple copies of a document (it can be disabled in the driver somewhere). Not sure if there may be a similar thing happening on the Samsung. Short: Mopier HP Printers Make Me Sad | LaslowNET Bruce.

Also, I would check the Event logs on both, the DPM server and probably more importantly, the Hyper-V host of the VM that it failed on. Thanks, Bruce.

DPM can be prone to this sort of thing. A few things. You say that your DPM server is connected via iSCSI to a Buffalo NAS, which I assume is used as the Storage Pool? Is this via a dedicated NIC on the server? Or does it share the same NIC as what is used for pulling the data from the protected servers? If you are going to use iSCSI to a NAS, I would strongly recommend you dedicate a NIC for it (and use the other NIC to connect to the network to pull backup data from protected servers). In order to work affectively, iSCSI really requires a dediciated 10Gbit connection (or 1Gbit minimum). I could be wrong, but the error message appears to show the DPM server is having trouble connecting to it's Storage Pool, which could be due to the NIC being overloaded by the traffic of data it is pulling from the protected servers. Alternatively, if the error is referring to problems connecting to the protected server, then the issue could be the flipside of this. That the iSCSI traffic (perhaps from a concurrent backup job), could be causing the DPM server to lose connectivity with the protected server. I notice that you are backing up System States, these (and BMR) can be very network intensive (as I don't believe they are Incremental) and could potentially interfer with other DPM concurrent backups. Looking at the logs, does it looks like the failed VM backups could coincide with BMR/System State Backups? What happens if you manually re-start a failed VM backup when you know that there are no other backups happening? Could you schedule the BMR/System State backups so they don't run concurrently the VM backups? Finally, for each DPM protected source DPM sets up two volumes in the Storage Pool (one for the main replica and one to store any changes), check that they are both big enough (right click on the protected source). Good luck, Bruce.

Assuming you have roaming profiles, one possibility is that someone had setup something in this user's roaming profile to set this local printer as the default and Windows is trying to do this whatever PC they logon to. Have a look in their roaming profile under Programs->Startup (it could be that they meant to put it in the Allusers Programs-> Startup on this PC, but accidently put it in the user's roaming profile instead). Also look at their registry HKCU. Or, to eliminate this as a possible cause, you could rename their roaming profile, delete any cached copies from these two PCs and logon them again to see if the problem still exists. If it doesn't, you know there must have been something setup in their roaming profile. If the problem still exists you could always add a little script to each PC to set the default printer. Set WshNetwork = CreateObject("Wscript.Network") WshNetwork.SetDefaultPrinter "Local Printer Name" Save as a .vbs file into the allusers\programs\startup folder. Probably not worth doing anything at the GPO level for this problem. Thanks, Bruce.

I am not that familar with Hyper-V clusters, but I do know that an Export of a VM will include the configuation of the VM (such as any virtual hardware configuration). An Export can be done on a VM that is in Running or Shutdown or Suspended State. An Export of a Running VM depends heavily of the VSS Service. An Export of a Suspended VM also includes a snapshot of the memory/registers. An Export of a Suspended or Shutdown VM should be faster than an Export of a Running VM (due to the latter requiring the VSS service). If you simply copy the VHD files I understand that you have no option but to shutdown the VM first (to release the lock on the VHD files), and it won't automatically include the configuration files. Depending on what you're doing your best bet might be to Shutdown the VMs, then Export... You get a fast Export, knowing that it includes all the VHDs and config of the VM. Thanks, Bruce.

Rollup.. Rollup.. Rollup... Rollup 2 for SCCM 2012 released on 24/07/2012 May be worth fitting into the Summer projects. See Description of Update Rollup 2 for System Center 2012. Includes updates for App Controller DPM Operations Manager .... Also a rollup for DPM2010 released at the same time. Regards, Bruce.

Hi James, Just to let you know that MS have released update rollup 4.0.1915.0 which includes a fix for this issue: Issue 9 Tapes are marked as reusable on the next day after the date of expiry as DPM runs a reclamation job only at midnight. If you want the tape to be reusable on the same date as it is expired, create the ExpireDatasetOnDayStart 32- bit DWORD, and set its value to 1 under the following registry key: HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft Data Protection Manager\Configuration\MediaManager See Description of Update Rollup 2 for System Center 2012 for more info. Looking at the release date it was released hours from when you posted your response. Perhaps MS perused these forums and decided to release it earlier than planned! Mind you it's a pretty stupid bug if you ask me, and I'm amazed that it has taken this long for a fix. The fix is also included in the rollup for 2010. Thanks, Bruce.

There is a bug in DPM 2010 where recovery points don't quite expire in time causing the backup to fail when the tape is reused and I think it still exists in 2012. I thought it just applied to libraries though. Microsoft said that they were working on a fix back in January, but I haven't heard anything yet. Your solution should work, but the problem is that the tape catalogues will automatically get pruned (deleted) when the recovery points expire (one week early in your case). In 2010 there was nothing that I could do about it. But I have the impression that in 2012 it allows you to adjust how long they are retained beyond the date the recovery points are due to expire. I've not tried 2012, so I can't say for sure, but if you can you could set DPM to retain the catalogue for an extra week. Or.... If you can specify the retention period in days rather than weeks, you could you set it to 20 days rather than 3 weeks, giving the recovery points one full day to expire. If the tape catalogues are pruned you can still recover from the tape, but only as a single flat file / set of files for each recovery point. E.g. If you are protecting all files on a drive on a server, you have to recover the entire backup to a network share (possibly as a VHD file, then mount it to find the individual file/folder). Not a position you want to find yourself in. The MS DPM team still has a lot of work to do to improve the way it deals with tapes and tape libraries. Hope this helps. Bruce. Sent from Android.

If you are interested in how I got on with, then please see my follow-up thread in: Thin Client and Virtual Machines Thanks, Bruce.

Just to follow this up. I did quite bit of research, and it appears that both VMware and Hyper-V have the same issue with virtualizing servers with GPT partitions, basically neither support VMs with GPT paritions (consequently P2V of existing servers with GPT partitions will fail). The reason is that both virtualization environments emulate the older style BIOS in the VM but not the newer UEFI BIOS/architecture (found on newer servers) on which GPT partitions depend. The other problem is that apparently the Windows installation is tied closely to the partition type (e.g drivers etc., configuration), so it's no simple matter of tweaking the partition type in the VHD, as Windows will get confused and won't boot. Someone has produced a free tool which is supposed to allow you get around this (it does a disk2VHD, converts the partition to MBR then attempts make the appropriate changes to the Windows boot/driver to fix the boot problem). However, it's a third party tool and there is no guarantee it will always work. I didn't have time to try it My advice, if you are setting up a new server with 2008 R2 and there is any possibility of the need to convert this to a VM at a future date, then choose MBR rather than GPT. Apparently 2008 R2 defaults to GPT if it detects a UEFI BIOS, so you need to actively change it from GPT to MBR during installation. I don't know what 2012 defaults to. I am surprised this issue hasn't come up more often, but the UEFI BIOS is a fairly recent development and most people are P2V-ing existing (older) servers. Thanks, Bruce.

Hi James, I'm not sure what setup you have from your description. How do you backup to two tapes each night with only a standalone drive? Do you start one backup in the afternoon which completes before you leave, thus enabling you to swap the tape over in time for the night backup? It sounds like the last backup on the tape has not expired (is still within the retention range) when the next backup is due to start. To protect the unexpired data it appends rather than overwrites. What version of DPM are you using? What retention range have you setup for these backups? When you insert the tape is it showing as expired? It has to be for DPM to overwrite it. Examine the backup sets on the tape, right click, to see when each backup source is due to expire. Is tape Co-location enabled? http://technet.microsoft.com/en-us/library/ff399230.aspx The above article on Co-location tweaks may be useful. Regards, Bruce. Sent using Android

I have just come to do a P2V of a server setup with a GPT partition table and discovered that the P2V tool on 2008 R2 VMM doesn't support conversion of GPT disks. The MS article suggests two ways around this; 1) Use Disk2Vhd.exe tool to create the VHD files, create a new VM, link in the VHD files, then boot to the 2008 R2 DVD to repair it. I tried this and not surpisingly it wouldn't boot straight off and it also wouldn't let me use the repair option when booting from the Virtual DVD (something about wrong version of Windows even though it was the correct version). 2) Convert partition table type from GPT to MBR (which wipes all data), then restore the "data" from a backup. It doesn't say anything about system boot partitions. The problem with this is whether a BMR backup can be used to restore the server *after* changing the partition table type from GPT to MBR. If the BMR doesn't work, I could be left with no working version of the server (either physical or virtual). Has anyone encounted this problem before? Or any advice? Regards, Bruce.

I have just come to do a P2V of a server setup with a GPT partition table and discovered that the P2V tool on 2008 R2 VMM doesn't support conversion of GPT disks. The MS article suggests two ways around this; 1) Use Disk2Vhd.exe tool to create the VHD files, create a new VM, link in the VHD files, then boot to the 2008 R2 DVD to repair it. I tried this and not surpisingly it wouldn't boot straight off and it also wouldn't let me use the repair option when booting from the Virtual DVD (something about wrong version of Windows even though it was the correct version). 2) Convert partition table type from GPT to MBR (which wipes all data), then restore the "data" from a backup. The problem with this is whether a BMR backup can be used to restore the server *after* changing the partition table type from GPT to MBR. If the BMR doesn't work, I could be left with no working version of the server (either physical or virtual). Has anyone encounted this problem before? Or any advice? Regards, Bruce.

OK, is this something to do with WINS? Obviously NT4's name resolution used WINS (replaced with DNS as the preferred resolution method since W2K). Although Win2K8 supports WINS for for backwards compatibility, it's not something you necessarily need or want. Is WINS enabled on the DC (a role I guess) and is there a DHCP option to hand out IP addresses for the WINS servers to the clients? If so, I'd remove both... Not that I have seen WINS causing an issue like this but you never know. [WINS=Windows Internet Naming Service] Thanks, Bruce.

A time when a cloud meant fluffy thing in the sky!

Yes but that was about the whole extent of Win95 security Hmm not quite true, I forgot you could also share folders/printers and set permissions to restrict access to network users, and when on a workgroup you could password protect them instead. Those were the days! Thanks, Bruce.

Why not just link the new VM to the existing external virtual switch, or is it that you want a dedicated NIC per VM for performance? Bruce.

Check the options in your DHCP Scope, I think there is something there to prefix the client DNS registrations with your domain name. With this the client gets registered as machine1.domain.ac.uk rather than just machine1. Also, in DNS properties you may want to enable unsecure updates to the Zone (although technically this shouldn't be necessary for authorised members of the domain). Thanks, Bruce.