Boot Time and FSMO info

systeminfo| find "System Boot Time"
netdom query fsmo

Hyper-v backup

Cannot backup Hyper_v machines on Windows 2008 R2 cluster host.

Solution:

hklm\software\microsoft\windowsNT\currentversion\spp
created the reg_Multi_SZ DisabledWriters
value = {66841cd4-6ded-4f4b-8f17-fd23f8ddc3de}
net stop wbengine && net start wbengine

Copy NTFS security info.

To copy NTFS information from a volume on Windows 2008 sp2:

robocopy \\fs01\ustore c:\temp\ustoresec /secfix /copy:SOT /E

I will copy the directory structure with security information for folders - no individual files.

S - security
O - ownership
T - timestamp
E - copy all subdirectories including empty

Backup VM on Hyper-V Cluster

First: Backup Exec 12.5 agent for Hyper-V does not work for the cluster configuration! So, you will spend $1000 for nothing.

Here how you can backup VMs with Microsoft Windows Backup. I did configure it for Windows 2008 sp2 Hyper-V cluster.

1. Enable Windows backup on each cluster node.
2. Create a batch what will include backup of all VMs and Quorum in the cluster.
3. Using Windows Scheduler run the batch (with high privileges).

The script example:

echo off

wbadmin start backup -backupTarget:\\hvbackup\hvvms\dc01 -include:N: -vssFull -noVerify -quiet

if %errorlevel% equ -2 echo skipped dc01

if %errorlevel% equ -2 goto quorum

:quorum

wbadmin start backup -backupTarget:\\hvbackup\hvvms\quorum -include:Q: -vssFull -noVerify -quiet

if %errorlevel% equ -2 echo skipped quorum

if %errorlevel% equ -2 goto ts02

:ts02

wbadmin start backup -backupTarget:\\hvbackup\hvvms\ts02 -include:S: -vssFull -noVerify -quiet

if %errorlevel% equ -2 echo skipped ts02

if %errorlevel% equ -2 goto util01

:util01

wbadmin start backup -backupTarget:\\hvbackup\hvvms\util01 -include:P: -vssFull -noVerify -quiet

if %errorlevel% equ -2 echo skipped util01

if %errorlevel% equ -2 goto util02

:util02

wbadmin start backup -backupTarget:\\hvbackup\hvvms\util02 -include:O: -vssFull -noVerify -quiet

if %errorlevel% equ -2 echo skipped util02

exit

The script you will need to run on each node and it will skip VM currently on other node. In my configuration I have separate LUN for each VM it is not R2 yet.

Do not forget to apply Microsoft fix on each Hyper-V host: http://support.microsoft.com/kb/958662

Microsoft FTP 7.5

The task was to create a FTP service for non-active directory users:

1. Users have rights for all directories from the root down.
2. Users have access only isolated directories under root.

Solution:

1. Use windows 2008 sp 2 VM on Hyper-V
2. IIS 7.0
3. FTP 7.5
4. IIS Manager Authentication
5. FTP Virtual Host Names
6. FTP User Isolation - "User Name directory (disable global virtual directories)

Notes:

1. Do not forget to change security for "Network services" account (ref.3)
2. Created 3 FTP sites - one for global access (ref.5) needed to enable IE connection, second for non separated FTP and third for isolated users.
3. In IE7 and 8 you can use "Open FTP site in Windows Explorer" option under "Page", but you will need authenticate second time.
4. To authenticate you need to type user name as pointed in (ref.4) - "ftpheader.yourdomain.com|username" or with (ref.4) "ftpheader.yourdomain.com\username". The authentiacation will take place after connection to the global FTP site (ref.5).
5. Regular FTP clients can connect directly using "Virtual host names".

FTP certificate should be chosen on IIS 7.0 server level:

references:

1. http://learn.iis.net/page.aspx/310/what-is-new-for-microsoft-and-ftp-75/
2. http://learn.iis.net/page.aspx/305/configuring-ftp-75-user-isolation/
3. http://learn.iis.net/page.aspx/321/configure-ftp-with-iis-70-manager-authentication/
4. http://blogs.iis.net/jaroslad/archive/2009/04/16/addressing-the-separator-problem-for-virtual-ftp-sites-ftp-7-5.aspx
5. http://blogs.msdn.com/robert_mcmurray/archive/2008/12/17/ftp-clients-part-3-creating-a-global-listener-ftp-site.aspx
6. http://learn.iis.net/page.aspx/320/using-ftp-virtual-host-names/

Windows 2008 Terminal services

To configure access:

1. Create AD group, for example: "TS Users"
2. Put the group in local "Remote Desktop Users" group on the terminal server.
3. Put the terminal server in local "Terminal Server Computers" group on the "TS licensing" server to enable to read licensing information.
4. Put the terminal server in separate OU and create a GPO. The GPO "Security Filtering" should include the terminal server itself and "TS Users" group. This will disable all limitation for administrators. Do not include administrators in "TS Users". Remove "All Authenticated" group from the GPO "Security Filtering"

Hyper-V Config 4096 Error

In my case it was old references to removed VMs on my Hyper-V host: 

"The Virtual Machines configuration DC6D0B26-9438-4504-9500-73342A42EC0B at 'E:\UTIL02-VM' is no longer accessible: The system cannot find the path specified. (0x80070003)"

So, I just delete configuration reference XML file  "DC6D0B26-9438-4504-9500-73342A42EC0B.xml" from: 

"C:\ProgramData\Microsoft\Windows\Hyper-V\Virtual Machines"

But be careful, do not delete valid reference!

SLMGR - license manager

I took the reference from other blog - slmgr tool is "Software Licence Manager" :"SLMgr Commands and Options

I’ve been dealing a lot lately with activation of Server 2008. It’s not been as easy as I’d like. In searching for some help, I came across a great article on SLMgr: SLMgr Commands and Options with Windows Vista Product Key Activation. This article provides a good look at the options with this SLMgr.ext tool. "

VMM 2008 error 13805

Then trying to add the cluster to VMM get error 13805 "Unable to contact cluster service on servername.domain" . VMM installed on one node in the cluster.  Cluster Group located on same server.

Solution: move Cluster Group to different node. From elevated CMD type: cluster group "Cluster Group" /move

To see the help for cluster group command type: cluster group /?

Broken by updates.

Symptoms:

You can not access IIS web sites locally, search indexing does not work, any service what should authenticate to IIS with NTLM does not work.

Solution: 

From http://support.microsoft.com/kb/896861

I fixed it by this method on two MOSS 2007 servers -

"Method 2: Disable the loopback check

Follow these steps:

1. Click Start, click Run, type regedit, and then click OK.
2. In Registry Editor, locate and then click the following registry key:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
3. Right-click Lsa, point to New, and then click DWORD Value.
4. Type DisableLoopbackCheck, and then press ENTER.
5. Right-click DisableLoopbackCheck, and then click Modify.
6. In the Value data box, type 1, and then click OK.
7. Quit Registry Editor, and then restart your computer. "

Windows 2008 Task Scheduler Problem

Can not enter a Domain User Account in Task Scheduler on Windows 2008, it give me "account name is not valid" error message. I found a solution on Microsoft tech net forum:
"Workaround:
1. Start Task Scheduler
2. Create a new task without changing user and user group (anything else can be specified at this time).
3. Export this task to an xml file (the Scheduled Task configuration file)
4. Delete this task.
5. Open the exported task using a text editor.
6. Find the following section:
DomainName\UserName
Please note that there may be other elements within the Principle node.
7. Change DomainName\UserName (ex. Companyname\administrator) accordingly. Note: DomainName is the NetBIOS name of the domain.
8. Save the file.
9. Import the task into Task Scheduler."

It works.