Hyper-V Host in Workgroup and Management Client in Domain Error after Password Change: You do not have the required permission to complete this task . . .

The password for the domain account just rotated at one of our client sites where we have the beginnings of a two node cluster (1 node and 1 Promise VTrak).

After changing the password for the account on the node and then for the domain account we logged off the management machine. Once we logged back in we saw:

• Hyper-V Manager: Virtual Machines
• You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer “HV_Node”

We used John Howard’s HVRemote utility to configure the node which is currently in a workgroup and the management Windows 7 desktop VM that is a member of the SBS 2011 DC running as a guest on the node.

To start with, we ran the following command on the Windows 7 desktop:

• cmdkey /add:HV_Node /user:HV_Node\FirstLast /pass
• Enter the password for 'HV_Node\FirstLast' to connect to 'HV_Node':
• CMDKEY: Credential added successfully.

We then opened the MMC that we created using the domain user’s credentials that was synchronized with the node and we saw the following in the Hyper-V Management node:

We were then good to go and manage the node and its features along with the VMs on it.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Some Thoughts On Standalone, Cluster Host, and VM Recoverability

The following was our post to the Yahoo SBS2K list that we figured would be good to share here.

The question was: How to install ESXi on a Dell using DRAC on a remote server.

QUOTE

Having looked at all of the responses to virtualizing a server on VMWare or Hyper-V, the following is where we are at in this.

We use Hyper-V exclusively. Why? It is very simple to work with.

For standalone servers we run a GUI install of Windows Server 2008 R2 along with an Intel RMM, iDRAC Advanced, iLO Advanced, etc. This gives us full management of both the hardware and the software so that question is moot. As you have indicated.

For clustering, we utilize Hyper-V Server 2008 R2. Again, it is quite simple to set up (after six months of brain busting investigation since documentation stinks for both s/w and h/w) and manage.

The native tools that come with RSAT or built into Windows Server make management and monitoring fairly straight forward.

Now, as to your dilemma we do the following on both the standalone and Hyper-V Nodes:

1. Transcend 16GB TS16GJFV30 formatted NTFS and active.
• Good read speed which is important. We only write once so no worries there.
2. Copy Hyper-V Server 2008 R2 SP1 OS contents onto the flash. The flash will remain plugged into the server for the life of the box.
• CAVEAT: If Win2K8 R2 GUI then put that on the flash.
3. Place needed OS install ISO copies onto the Flash drive.
4. Place needed drivers and firmware on the flash drive.
5. If using Tier 1 have their bootable DVD in the optical drive.
6. RMM, iDRAC ADV, iLO ADV, etc gives us boot control between Optical, USB Flash, and and RAID array with host OS.

What does this do for us?

We have full control over full host recovery, full guest recovery, and more depending on how the backups are structured. As a rule we do _not_ back up the host. It is faster to rebuild the host and either restore the guests from backup or connect existing VHDs depending on the failure.

RMM/iDRAC: We have tried USB redirection to boot the host OS and install via IP KVM and the process is just too painful. BTDT. Send them a fully configured USB Flash drive.

END QUOTE

What the above requires is at least 2 IP addresses from the ISP. One for the Internet connection used by the internal network and the other for the RMM/DRAC/iLO device that will be used to manage the server or cluster node.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

An Updated Hyper-V Monitor Vista/7 Gadget And The Hyper-V Nehalem Update Status Is Good

The server we were having a great deal of issues with has been running since yesterday afternoon with no further freezes.

• Server’s Having A Bad Day When … CLOCK_WATCHDOG_TIMEOUT (101)

It looks as though version 4 of the update has truly dealt with the timing issue Hyper-V has with the Nehalem processors.

Also, the Windows sidebar gadget we have mentioned in the past has received a substantial update:

In addition to showing the available RAM on the Hyper-V server, we now see the CPU utilization as well as which VMs have Integration Services installed (green) and which ones do not (gold).

We also have the ability to TS into the Hyper-V box to manage it, open a VM direct desktop session, and manage the VM’s power status among other things.

This tool is truly useful for at-a-glance views of all Hyper-V servers running on the network. Shown is the one server, we just have not had the time to add the others we also have on our network.

• MINDRE.NET Tore Lervik- Hyper-V Monitor Gadget for Windows Sidebar

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

RSAT for Windows 7 Available For Download

The Remote Server Administration Tools are available for Windows 7 RTM:

• RSAT for Windows 7 (Microsoft download page)

Once RSAT has been installed, note that some of the consoles will need to be enabled Start –> Programs and Features [Enter] –> Turn Windows features on or off –> UAC.

All technician laptops need these tools installed.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*All Mac on SBS posts will not be written on a Mac until we replace our now missing iMac! (previous blog post)

Windows Live Writer

Hyper-V Error – Access Denied. Unable to establish communication between Hyper-V and Client

While setting up a Hyper-V server for Wayne and Justin to work with some VMs to troubleshoot the SBS 2003 to 2008 replication error, we ran into a roadblock with getting the Hyper-V Manager connected to the Hyper-V Server 2008 box:

Virtual Machines

Access denied. Unable to establish communication between ‘Hyper-V Server’ and ‘Hyper-V Manager’.

This is puzzling since the workstation has been connected to this particular Hyper-V server many times using other network profiles. The profile we created for the Microsoft folks was seemingly giving us the connection issue.

The fix took a bit of searching to find and needed to be accomplished on the Windows Vista system where the Hyper-V Manager was installed:

1. Close the Hyper-V Manager
2. Click Start and type: %windir% [Enter].
• A Windows Explorer window will open to the Windows directory.
3. Type: dcomcnfg in the Search Windows field at the top right hand of the Explorer window.
• You will see the following in your search results:
4. Right click on dcomcnfg and Run As Administrator.
• Authenticate with the local admin credentials if UAC prompts for credentials, or Continue if it does not.
5. Open the Component Services node, then the Computers node, then right click on My Computer and click on Properties.
6. Click on the COM Security tab.
• You will see the following:
7. Click the Edit Limits button under Access Permissions.
8. Enable Remote Access for Anonymous Logon
• Before and after shot:
9. Click Apply and OK.
10. Close the Component Services console and the Windows Explorer window.
11. Start the Hyper-V Manager and continue through the UAC.

The virtual machines, if any, will show up in the Hyper-V Manager console after that.

Thanks to Augusto Alvarez for the clearest and exact explanation for the fix:

• Augusto Alvarez: Hyper-V Server: Installing, configuring and troubleshooting (about half way down).

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*All Mac on SBS posts will not be written on a Mac until we replace our now missing iMac! (previous blog post)

Windows Live Writer

Ack! SBS 2008 Not Genuine!

The situation we find ourselves in right now is a little silly.

Going to download the Hyper-V manager for Windows Vista SP1, the site called for a Windows Genuine Advantage verification.

Okay, we are on a newly built SBS 2008 box with its Server Core Hyper-V partner almost built and ready for the Windows Vista VM installs.

All of the local workstations on this newly set up SBS domain are Windows XP Pro SP3 but not added to the new domain yet. We could install the Hyper-V manager on any of them anyway.

We ran through the WGA which failed of course. It then required that we download the WGA tool and run it to get a key to get through to the download.

Once the tool ran and we got the key, the WGA site choked on the key and stated that we were not running genuine software.

Yikes!

Okay, so we went into the Change Product Key routine and entered the SBS 2008 Open Value license key and ran through the validation. Well, that failed too!

This is getting a bit nerve racking since the last backup was done about an hour ago when we had finished the last batch of updates. We are working on a new server install for a client in Florida.

Since activation was stating that we had to activate today, meaning the server would go catatonic on us at anytime soon, we needed to get this situation resolved or we were recovering the server before we want to.

Nothing in our searches turned up a plausible solution.

However, since we did not enter the product key for the install (we never do until the server goes live), why not try and rearm the “trial” period and see if that corrects the problem.

1. Start –> right click Command Prompt and Run As Administrator
2. cscript %windir%\System32\slmgr.vbs –rearm [Enter]
3. shutdown –r –t 0 [Enter]
4. Once logged on: Start –> right click Computer –> Properties.
5. Click Change Product Key
6. Enter the product key and go.

Eventually, the following will show:

Lesson learned: Never run the WGA tool for any other OS on the server! 8*O

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*All Mac on SBS posts will not be written on a Mac until we replace our now missing iMac! (previous blog post)

Windows Live Writer

RSAT for Windows 7 x86 or x64

RSAT for Windows Vista will not work on Windows 7.

There is a version for Windows 7, though we needed to dig around for it:

The links on the Microsoft Download site do not work.

But, this site has a direct link to the downloads themselves (x86 and x64) that work as of this writing: Remote Server Administration Tools (RSAT).

After downloading and installing them, note that they need to be enabled in the Windows 7 Programs and Features on or off.

Note the lack of a check mark beside the Remote Server Administration Tools feature.

Once in, we have access to the Hyper-V Manager which is what spurred the search on in the first place.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*All Mac on SBS posts will not be written on a Mac until we replace our now missing iMac! (previous blog post)

Windows Live Writer

Hyper-V Monitor Gadget for Windows Sidebar Updated

This is a neat little tool:

Hyper-V Monitor Gadget for Windows Sidebar

We can start, stop, reset VMs on Hyper-V, or even double click on one to bring up a VM console session.

It is a really kewl tool!!

Some of its features from Tore’s blog:

• Hyper-V Monitor title
  Double click on the title to launch the Hyper-V Manager*.
• Host title
  Double click on the host title to launch a new Remote Desktop connection to the host.
• Host title RAM amount
  Displays the RAM amount the host has left.
• VM title
  Double click to launch VMConnect* to the VM.
• VM Status
  Displaying the status of the VM in both color and text.
• VM Control
  Hover over the status to get a set of buttons for the current VM. (Start, Turn Off, Shut Down and Save)
• Large Size (Undocked)
  You can make the gadget bigger by using the Large Size (Windows 7) or Undock it from the sidebar (Vista).

It can be had from here: MINDRE.NET Tore Lervik: Hyper-V Monitor Gadget for Windows Sidebar.

Our original post: Hyper-V Gadget for Windows Vista Sidebar.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts will not be written on a Mac until we replace our now missing iMac!

Windows Live Writer

Intel AMT - Active Management Technology and vPro gives us the edge

Having the ability to work with servers, workstations, and now laptops at a level where the machine's current power state is irrelevant can give us the edge when it comes to managing our client's networks.

Intel's AMT, or Active Management Technology, gives us that edge.

Using a simple tool like Intel's System Defense Utility, we are able to power cycle a system, redirect the boot source to a network based image, and more.

All of Intel's Q series Executive desktop boards and any of the new Centrino vPro series laptops have AMT built in.

Out of the box, we need to enable it in the system's BIOS, setup a new password (default out of the box: admin), and configure AMT for either an Enterprise environment where management servers will exist, or Small Business which essentially means it is stand alone.

Add a product like Microsoft's System Center Essentials to the mix along with Intel's AMT management pack, and we have an excellent foundation for our Managed Services solution.

While problems with the AMT setup are rare, they do happen.

We had a new Acer 6592G series laptop hiccup after the AMT was initialized and we had finished setting up the client's apps. On a reboot, a red flash went by where the AMT messages should have been. It took a number of tries to get to the message: AMT Error was all it said.

A call to Acer's support line, and subsequently into their top tier support people, and we needed to RMA the laptop. There was no simple way to reset the BIOS, TPM, and AMT.

Some AMT links:

• Intel vPro Expert Center
• Intel Active Management Technology
• Intel AMT Quick Reference Guide (PDF)

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

Hyper-V Gadget for Windows Vista Sidebar

We manage a number of internal Server Core Hyper-V servers as well as client based Hyper-V servers.

Up to now, we have been using the Remote Server Administrator Tools (RSAT x86 and RSAT x64) on Windows Vista SP1 to manage them.

One of the things that was missing with RSAT was an at-a-glance setup for our Hyper-V systems.

We now have one: the Hyper-V Monitor Gadget for Windows Sidebar by Tore Lervik.

Windows Vista Hyper-v Monitor

We have the ability to add all of our Hyper-V instances to the monitor, configure the user that will authenticate to them, as well as perform some basic VM management like turning them on and off.

This is an excellent little gadget to have.

Thanks to the Virtual PC Guy for the tip: Hyper-V Sidebar Gadget.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

Vista - Enabling UAC with Credentials for Local Admins when managing Server 2008

The Remote Server Administration Tools for Windows Vista SP1 is available:

• Microsoft Remote Server Administration Tools for Windows Vista for x64-based Systems (KB941314)
• Microsoft Remote Server Administration Tools for Windows Vista (KB941314)

Validation is required for both downloads. Once they are downloaded, both should be placed on the Technician's Thumb Drive for later installation.

When running the admin tools, we need to be prompted by UAC for credentials so that we can authenticate in the management console as domain admin.

If, however, we are working on a Windows Vista workstation where the user account has local admin priviledges, then the UAC will only prompt to continue on into the admin consoles.

This will not work for managing servers as that elevation is local admin only.

We need UAC to prompt for credentials every time. To do this we do the following:

1. Start
2. GPEdit.msc [Enter]
3. Navigate to: Local Computer Policy --> Computer Configuration --> Windows Settings --> Security Settings --> Local Policies --> Security Options:


• 

  UAC Prompt: Behaviour for admins

4. Change the default from "Prompt for Consent" to "Prompt for credentials"


• 

  UAC Behaviour Options

5. Click Apply and OK
6. Close the Local Group Policy Editor

One should now be prompted for credentials every time a UAC is presented.

This setting is machine specific, so any users of the machine will need to enter their domain credentials if they are presented with a UAC prompt. Keep this in mind for systems that are used when at the client site for server management.

Thanks to Josh's Windows Blog for providing us with the tip: Windows Vista Tip: Run as administrator.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.