The tool is available here for SCOM R2

The switch to use is /Cleanservers

I am sure there are other switches to look at!

This will then go through the registry etc and clean up the server.

Turning on logging on TMG 2010 I noticed the below logs from a Domain controller to the issuing CA

TMG has a rule that allows RPC traffic from the client server to the issuing CA and Root CA with Enable Strict RPC Compliance turn off

So what’s happening, well basically the domain controller is initiating traffic on RPC port 135 and the CA is communicating back telling the server to talk on port 49246, because this traffic is encrypted TMG cannot read it or understand it so drops the traffic.

What can be done?

One way to resolve this issue is to configure the issuing CA and Root CA to listen on a static port instead of a dynamic range and configure a custom protocol in TMG to allow the traffic.

Step 1.

Log into the issuing CA and run dcomcnfg.exe this will open the Component Services MMC

Step 2.

Expand Component Services, Computers, My Computer, and then select DCOM Config on the left.

Step 3.

Right Click CertSrv Request and select Properties, in the dialog box select the Endpoint tab and select Add, select the radial Use static endpoint in the box to the right input the port you wish the client servers to use to talk to the CA server. To check what the server is listening on you can run from a command shell the below.

I used 789, once you have closed the dialog boxes by selecting OK where appropriate you then need to restart the CA services

Step 4.

Now that the CA is listening on a static port or should I say telling the client server to use a static port you now need to amend your firewall rules to allow it, you will need to add a new custom protocol for TCP 789 or whatever you used.

Checking the server event log I can see it has worked.

And the TMG 2010 event logs show the same

I was confused as to why FPE does not assign SCL ratings between 1 and 4, intact any messages that are between those values get assigned a value of –1. this got me a little confused when i was monitoring the system to see how it was working.

more info on Content Filtering here

It then occurred to me would blocked senders work. It turns out after some digging I had to use a Extended Option to turn this on.

From the FPR Management Shell

New-FseExtendedOption –Name CFAllowBlockedSenders –Value true

I suspect I will post more useless info on this subject as I tweak the system sorry!!

To do this:

1. Download the WIM2VHD.WSF file from http://archive.msdn.microsoft.com/wim2vhd/Release/ProjectReleases.aspx?ReleaseId=2603
2. Copy the install.wim file from a Windows Server 2008 R2 installation media to a working directory, I used C:\
3. Ensure you have the Windows® 7/Server 2008 R2 Automated Installation Kit (AIK) or the Windows® 7/Server 2008 R2 OEM Preinstallation Kit (OPK) installed.

During the process you need to choose which SKU to use, in order to determine the SKU’s available in the wim file run the below from a normal command prompt

C:\>cscript wim2vhd.wsf /wim:c:\install.wim

I want to create a VHD which has Windows 2008 R2 Standard Edition installed, so I will use “SERVERSTANDARD” AS MY SKU.

In order to create the actual VHD run the below command, this command will inspect the WIM file and create a VHD image of the SKU I selected, it will them save this to the root of my E drive. When complete it leaves you with a small log file and the VHD file.

cscript wim2vhd.wsf /wim:c:\install.wim /sku:SERVERSTANDARD /vhd:e:\2008R2Standard.vhd

You can enable this via a hidden menu by following the below steps.

1. Logon to your management webpage.
2. Replace main.html in the url to diag.html.
3. Select “Internal Settings”.
4. Scroll down to “Security Service Settings”.
5. Select “Enable enforcement of a limit on maximum allowed advertised TCP window with any DPI-based service enabled”.
6. Change “Set a limit on maximum allowed advertised TCP window with any DPI-based service enabled (KBytes)” from 64 to 256.
7. Scroll to the top of the page and select “Apply”.

During the course of my testing I found out that although I can create IP pools they are only really any use when deploying a VM, so if I have a VM with one network adapter and I deployed it from a VM template,I can select a IP pool for the VM to get it’s IP address from. GEAT this helps me keep to my standard, however if I have deployed a VM already and I need to added an additional network adapter to the VM I do not have the ability to choose a IP Pool, I need to deploy the VM then go back to the VM and change it’s IP address, not so good. I would have really liked the ability in VMM 2012 to choose the IP pool for the server under any condition. This does actually make sense when you understand that VMM 2012 sets the IP address and network interfaces using the unattended.xml file during deployment and with not with any of magic. One to bare in mind.

During my testing as well I discovered some odd happening with IP addresses and IP allocations. If you add and remove servers through VMM it will managed your IP addresses for you. What I mean by that is it will check IP addresses in and out to ensure there are no IP conflicts. however I found myself in a position this week where I created a new IP Pool and assigned an IP to a virtual machine only to realize I made a mistake with my ranges. I could not amend the range because a number of them were assigned to servers including a few host machines. I changed the VM IP address and forced a refresh from within VMM2012 and the number of allocated IP’s did drop however I was expecting for all IPs to be checked back in. I checked the inactive IP address section on the pool properties and nothing was there, as far as I was concerned nothing should be using this pool any longer but I could see no way to amend or delete this pool. Thanks to the TechNet forums I have discovered a handy and simple PowerShell command that will tell you where IP Addresses are used and a second commandlet to check it back in to the pool.

To see where I addresses are used run the below from a VMM Powershell Session

Get-SCIPAddress

this will return a list of IP’s and where they are used.

In the above example it shows that a Virtual Machine has the 172.16.1.4 IP address, it even gives me the name of the machine.

If I wanted to force this IP address back into the pool I can revoke it, however you must be sure it is no linger in use. Use the below command to do this.

$ip = get-scipaddress –IPAddress “172.16.1.4”

$ip | revoke-scipaddress

That fixed it for me, but one thing I did find while working in the fabric was that it is great that VMM now has started to managed IP’s and I can clearly see how many have been allocated and are available but it really does lack an insight into where IP have been used. I would really like to be able to look at a IP pool and see who has what IP. You never know someone might write an app for this as the information is there.

I have jumped through a number of hoops and hurdles to get this far some of which I have blogged about. I finally had it all setup so VMM talked to the iDRAC cards on my blades and booted the system, after a few tweaks it booted into a WinPE but afew minutes in it seemed to freeze on “Synchronizing Time” and popped a error dialogue box inviting me to read the error logs which was not that helpful as I have no ability to press SHIFt +F10.

After a quick step away it occurred to me to check both the DNS settings in DHCP and add a scope option to set a NTP time server, which I did and low and behold it worked, I can now deploy a base image. I now need to play a little more to understand how this works and my options.

The DNS servers were set to loop back, which I guess it picked up form the server as that’s the setting locally. I think that’s what fixed it but it could be the DHCP option, I will test this shortly.

The event log was not much help, just giving me a Event ID 257 containing Error Information:0xFFFFFBB3

After a little head scratching, I ran the below command to disable the WDS server from listening on port 67 which is the port DHCP would use and as it is on the same computer it would cause some conflict.

wdsutil /set-server /UseDHCPPorts:No /DHCPOption60:yes

Still not luck and finally I found this blog that shows someone else hitting the same issue.

The server this is installed on is also fitting with two six core processors with hyper threading, providing 24 cores to the host OS. There appears to be a bug where the maximum number of processors is 20 before the service will not start.

To resolve:

Change the number of used processors used :

From a command prompt run the below command and reboot

bcdedit /set {current} numproc 2

Just like magic it is all up and running

To revert the changes back:

bcdedit /deletevalue {current} numproc

Now I can continue……….

The VM was in a saved state.

When I attempted to delete, start or anything I got an error saying “The operation cannot be performed while the object is in its current state.”

Navigate to C:\ProgramData\Microsoft\Windows\Hyper-V\Virtual Machines and delete the xml file for the VM and just like magic the VM is gone form the console you just need to clean up the files left.

But….. right at the beginning of my project I have hit an issue configuring the host network adapters, I have three mezzanine cards, giving me eight network adapters some of which will be teamed others like iSCSI not, see the table below.

@echo off&Title=Set Adapter Names &MODE CON: COLS=100 LINES=20

powershell -nologo -command "Write-Host ‘Attempting to rename adapters named Local Area Connection* to their MAC address’; $Shell = New-Object -com shell.application; $NetCons = $Shell.Namespace(0×31); $NetCons.Items() | where {$_.Name -like ‘Local Area Connection*’} | foreach{$AdapName=$_.Name; get-WmiObject -class Win32_NetworkAdapter| where-Object {$_.NetConnectionID -eq $AdapName} | foreach {$MAC=$_.MacAddress}; Write-Host Renaming $_.Name to $MAC; $_.Name=$MAC.replace(‘:’,’.’)}" | more

pause

note: If anyone has a good addin for code snippets for WordPress/live writer please let me know!

This solution is no good for me so digging around further, I came up with this solution.

What I found was if you have the same identical blades and mezzanine configuration you seem to always get the same PCI settings on the physical network devices, below I am displaying the properties of a 10GB Ethernet adapter on two different blades. note the PCI bus is the same.

Using the Broadcom Advanced Control Suite, I configured one server with all the teams and vlans as I required, shown below.

Once I had the teams configured the way I wanted them I then used the command line options for the Broadcom suite to export the configuration.

To do this:

1. open a command prompt

2. change directory to the Broadcom installation directory containing a cli tool called “BACScli.exe”, in my case this was “C:\program Files\Broadcom\BACS”

3. Run the command BACScli –t team “save –f BDF c:\Network-Config.bcg”

The file created looks like this when opened in notepad

Now copy the file to the other server and import the configuration as follows:

1. open a command prompt

2. change directory to the Broadcom installation directory containing a cli tool called “BACScli.exe”, in my case this was “C:\program Files\Broadcom\BACS”

3. Run the command BACScli –t team “restore c:\Network-Config.bcg”

Looking in the Broadcom Advanced Control Suite I can confirm by looking at the MAC address that I have everything where I want it and all the vlans have been created

I have a few more test to do as I would like to confirm if other settings will carry over like team configurations, advanced NIC settings but it is looking good I can now carry on with the project knowing this can be built into my provisioning system.

Happy Days.