May, 2008

AccessChk v4.1

Mark Russinovich released a new very nice tool for IT Pro (System Administrators), AccessChk v4.1.
Windows administrators often need to know what kind of accesses specific users or groups have to resources including files, directories, Registry keys, global objects and Windows services. AccessChk quickly answers these questions with an intuitive interface and output.

Examples

The following command reports the accesses that the Power Users account has to files and directories in \Windows\System32:

accesschk “power users” c:\windows\system32

This command shows which Windows services members of the Users group have write access to:

accesschk users -cw *

To see what Registry keys under HKLM\CurrentUser a specific account has no access to:

accesschk -kns austin\mruss hklm\software

To see the security on the HKLM\Software key:

accesschk -k hklm\software

To see all files under \Users\Mark on Vista that have an explicit integrity level:

accesschk -e -s c:\users\mark

To see all global objects that Everyone can modify:

accesschk -wuo everyone \basednamedobjects

Sysinternals Live - Execute Sysinternals Tools Directly from the Web

The Beta of Sysinternals Live was announced today. A service that enables you to execute Sysinternals Tools directly from the web without manually downloading them. Enter a tool’s Sysinternals Live path into Windows Explorer or a command prompt as \\live.sysinternals.com\tools\<toolname>
View the entire Sysinternals Live Tools directory in a browser at http://live.sysinternals.com.

Remote Server Administration Tools for Vista SP1 has been released. ALL server languages!

I’m MCITP: Server Administrator & Enterprise Administrator

Yes, finally I’ve finished with all my exams and I’m now a MCITP Server Administrator & Enterprise Administrator :).

PowerShell on Windows Server 2008 Core Edition

Everybody, who just started deal with Windows 2008 knows a very nice (IMHO) version, Windows 2008 core. One of the things, that I , and not just I, do not love, Core Editions of Windows 2008 doesn’t support PowerShell. Equally, we can use PowerShell with Windows 2008 Core, but just from remote computer. Dmitry Sotnikov, MVP in PowerShell, published step-by-step instruction on installing Windows PowerShell on Windows Server 2008 in Server Core mode. To know how to do this, go to Dmitry Sotnikov’s PowerBlog.

SBS and EBS videos on Technet Edge

There are new demonstration videos of the upcoming Small Business Server 2008 and Essential Business Server 2008 on TechNet Edge.

Hyper-V RC1 Release Available

Update for Windows Vista (KB949587) 

Update for Windows Server 2008 x64 Edition (KB950049)

The Release Candidate 1 (RC1) update to the Hyper-V role provides improvements to security, stability, performance, user experience, forward compatibility of configurations, and the programming model.

Update for Windows Vista for x64-based Systems (KB949587) 

Install this update to enable remote management of a Windows Server 2008 computer running the Hyper-V RC1 role.

Microsoft Virtual PC 2007 with SP1

Few days ago Microsoft released a Microsoft Virtual PC 2007 with SP1. This update for Microsoft Virtual PC 2007 includes support for the following additional Host and Guest Operating Systems:

Additonal Guest Operating System support:
Windows Vista® Ultimate Edition with Service Pack 1 (SP1)
Windows Vista® Business Edition with Service Pack 1 (SP1)
Windows Vista® Enterprise Edition with Service Pack 1 (SP1)
Windows Server® 2008 Standard
Windows XP Professional with Service Pack 3

Additional Host Operating System support:
Windows Vista® Ultimate Edition with Service Pack 1 (SP1)
Windows Vista® Business Edition with Service Pack 1 (SP1)
Windows Vista® Enterprise Edition with Service Pack 1 (SP1)
Windows XP Professional with Service Pack 3

Download from here

BGP

BGP is the protocol that binds the Internet together. It is what sends one packet across the globe in a few milliseconds and allows you to send email, . Typically, you will see Cisco routers that will handle this sort of heavy lifting and that is the IOS that we will review briefly.

ASN – Starting point
In order to have a BGP connection you will need to have an ASN(Autonomous System Number). You can get one of these through ARIN (American Registry for Internet Numbers). BGP uses ASN’s like VLAN id’s or a higher level view of subnetting. There are private ASN’s if you are planning on using BGP for internal purposes only. The private BPG range is AS64512 through to AS65535.

IOS – Configuration info
Here is the basic output of two connections to two different autonomous systems from one Cisco router.

router bgp 64512
no synchronization
bgp log-neighbor-changes
bgp dampening
network 3.3.3.0
neighbor 1.1.1.1 remote-as AS64513
neighbor 1.1.1.1 description Provider 1 >>Provider 1 Support Line<<
neighbor 1.1.1.1 password 7 09823490822093482F
neighbor 1.1.1.1 update-source Loopback1
neighbor 1.1.1.1 version 4
neighbor 1.1.1.1 route-map Provider1 out
neighbor 2.2.2.2 remote-as AS64514
neighbor 2.2.2.2 description Provider 2 >>Provider 2 Support Line<<
neighbor 2.2.2.2 password 7 09823490822093482F
neighbor 2.2.2.2 update-source Loopback2
neighbor 2.2.2.2 version 4
neighbor 2.2.2.2 weight 50
Let’s walk through the configuration a bit. Here are the same commands but with comments added in at various places

! This line is telling the BGP router which ASN it should advertise.
! A Cisco BGP router can only administer one ASN at a time.
router bgp 64512

! Log the changes when the neighbor goes up and down.
! This way you can see if the other BGP router that you are peering with is stable.
bgp log-neighbor-changes

! This is the network that you are advertising via BGP
network 3.3.3.0
! This is the ASN of your ISP or peered BGP network.
neighbor 1.1.1.1 remote-as AS64513
! While you don’t technically need this line it is important that you use it
! for your own clarification
neighbor 1.1.1.1 description Provider 1 >>Provider 1 Support Line<<
! Encrypted password for transferring your BGP data back and forth with your peer.
! Encrypting your BGP data will ensure that no one hijacks you routers.
neighbor 1.1.1.1 password 7 0934099082282F8234
! Using a loop back interface will ensure that the BGP peer always sees one
! interface that is in the network that you are advertising as being up.
! This will always keep the peering with your ISP up.
neighbor 1.1.1.1 update-source Loopback1
! The version of BGP that you are using. Version 4 is the most widely used and most recent.
neighbor 1.1.1.1 version 4
neighbor 1.1.1.1 route-map Provider1 out
As a final note, BGP is a powerful protocol with lots of features and options. However, most ISP’s don’t support the full suite of options that BGP provides so don’t expect to use all of them in order to shape your traffic.

iSCSI in VMWare ESX 3

iSCSI has become a very popular way of having shared storage among several physical or virtual computers. The benefits of shared storage are even greater when combined with the abilities of VMWare such as VMotion, High Availability and Distributed Resource Scheduler.

Below are the basic (and I do emphasize basic) to configuring iSCSI storage with VMWare 3.0. Like any shared storage infrastructure there are a number of possible methods and structures that could change the way that iSCSI is installed and used.

Step 1 - Add in extra Service Console and iSCSI VMKernal
The service console and VMKernal need to be on the same physical NIC on the ESX server. The IP’s for these services need to be on the same subnet as the iSCSI storage device. The pictures below outline the end-result if your iSCSI VLAN were to be 192.168.4.0/24. Note that the service console that you is shown below is the second and therefore additional service console. The original stays unchanged.

Sample Configuration Page

Sample End Result

Step 2 - Allow iSCSI traffic through the firewall
The Software iSCSI Client for ESX needs to be allowed through the firewall which is located under the security profile section. If you don’t do this then you will not be able to use the service. I found this interface “tricky” to use. Sometimes I would make changes and they wouldn’t take effect until the server was rebooted.

Step 3 - Enable Software Initiator Properties
The iSCSI storage adapter needs to be configured. Find the newly created iSCSI Software Adapter on the Storage Adapters tab you will need to:

1. Open the properties
2. Configure and subsequently enable the iSCSI Initiator
3. On the Dynamic Discovery tab you can add in the iSCSI server IP

Step 4 - Create iSCSI targert on iSCSI device
This will depend on your iSCSI hardware as to how you do this. Each manufacturer has their own way of doing this.

Step 5 - Add LUN to target

Links:
VMWare’s design guide for iSCSI – short but good:  http://www.vmware.com/pdf/vi3_iscsi_cfg….
Really good blog post by David Davis about VMWare and iSCSI:
 http://www.petri.co.il/connect-vmware-es…