RDS Error: RemoteApp - The digital signature of this RDP File cannot be verified.

The following error was received on a client’s system this morning:

 RemoteApp

The digital signature of this RDP File cannot be verified. The remote connection cannot be started.

In this case the RDSH is using self-issued certificates for both Broker services. They had expired.

1. Server Manager –> Remote Desktop Services –> Collections –> Tasks –> Edit Deployment Properties
2. Click Certificates
3. Click on the first Broker service and then the Create new certificate button
• 
4. Set a password and save to C:\Temp\2015-04-14-SelfIssuedSSL.pfx
5. Click on the second Broker service and Select an Existing Certificate
6. Choose the above newly created certificate

In the case where our client’s domains are .LOCAL or .CORP or some other non-Internet facing TLD we leave those two self-issued.

If we have an Internet facing domain then we use a third party trusted certificate as can be seen in the snip above.

Because we are deploying a lot of Remote Desktop Services solutions we always use an Internet TLD for the internal domain after making sure the client owns that domain and its registered for a decade.

Philip Elder
Microsoft Cluster MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book

Our Default OU and Group Policy Structure

Over the years between our experiences with the Small Business Server Organizational Unit (OU) and Group Policy Object (GPO) structures plus wearing out a few copies of Jeremy Moskowitz’s books we’ve come to hone our Group Policy configurations down to an _almost_ science. ;)

Today, with our own Small Business Solution (SBS) in production we use the following OU and GPO structure as a starting point:

We tailor all GPO settings around the intended recipient of those settings.

We use the WMI filters to delineate desktop OS versus Server and DC based operating systems. Note that the GPOs for those two sets of systems are not present in the above snip.

They would be:

• Default Update Services Client Computers Policy
• Default Update Services Server Computers Policy

Both enable Client-Side Targeting for WSUS managed updating.

NOTE: We _never_ edit the Default Domain Policy or the Default Domain Controllers Policy. EVER!

When we need something we create the GPO and link it to the OU containing the intended recipient objects or we scope the GPO via Security Group membership.

Some GP Pearls

All GPOs scoped to computers have the User Configuration settings disabled while GPOs scoped to users have the Computer Configuration settings disabled.

We don’t use Group Policy Loopback Processing. There’s just too much room for unintended consequences. Our structure above gives us the flexibility we need to hone our GPO settings down to a user or computer if need be.

Filters are OU membership, Security Group membership, or WMI Filtering.

GPO settings are like Cascading Style Sheets. Settings cascade from the domain level down through the OU structure to the recipient object. The closer the GPO to that object the more weight that GPO’s settings have.

We do not duplicate settings or put opposite settings in GPOs further down the OU structure. We create and link our GPOs accordingly.

We always enable the Group Policy Central Store (blog post) on our DCs. This makes things so much easier in the long run!

We always enable the AD Recycle Bin and if at all possible have the Forest and Domain at the latest available OS version level.

We test any intended changes we intend to make in a lab setting on a restored version of our client’s networks first! We test _any_ and _all_ intended settings changes/additions in a lab first!

Philip Elder
Microsoft Cluster MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book

Hyper-V: Broadcom Gigabit NICs and Virtual Machine Queues (VMQ)

Here is an explanation posted to the Expert’s Exchange forum that we believe needs a broader audience.

***

VMQ is a virtual networking structure allowing virtual Switch (vSwitch) networking to be processed by the various cores in a CPU. Without VMQ only one core would be processing those packets.

In a Gigabit setting the point is moot since the maximum of 100MB/Second or thereabouts per physical port is not going to tax any modern CPU core.

In a 10GbE setting where we have an abundance of throughput available to the virtual switch things change very quickly. We can then see a single core processing the entire virtual switch being a bottleneck.

In that setting, and beyond, VMQ starts tossing vSwitch processes out across the CPU's cores to distribute the load. Thus, we essentially eliminate the CPU core as a bottleneck source.

For whatever reason, Broadcom did not disable this setting in their 1Gb NIC drivers. As we understand things the specification for VMQ requires it to be disabled on 1GbE ports.

VMQ enabled on Broadcom NICs has caused no end of grief over the last number of years for countless Hyper-V admins. With Broadcom NICs one needs to disable Virtual Machine Queues (VMQ) on _all_ Broadcom Gigabit physical ports in a system to avoid what becomes a vSwitch traffic.

***

The above is a summary of conversations had with networking specialists. If there are any corrections or specifics that all y’all have about the VMQ structures please feel free to comment! :)

Philip Elder
Microsoft Cluster MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book

Cluster: Asymmetric or iSCSI SAN Storage Configuration and Performance Considerations

We When we set up a new asymmetric cluster, or if one is using an iSCSI SAN for central storage, the following is a guideline to how we would configure our storage.

Our configuration would be as follows:

• JBOD or SAN Storage
  • 6TB of available storage
• (2) Hyper-V Nodes
  • 256GB ECC RAM Each
  • 120GB DC S3500 Series Intel SSD RAID 1 for OS
  • Dual 6Gbsp SAS HBAs (JBOD) or Dual Intel X540T2 10GbE (iSCSI)

There are three key storage components we need to configure.

1. Cluster Witness (non-CSV)
   • 1.5GB Storage
2. Common Files (CSV 1)
   • Hyper-V Settings Files
   • VM Memory Files
   • 650GB Storage
3. Our VHDX CSVs (balance of 5,492.5GB split 50/50)
   • CSV 2 at 2,746.25GB
   • CSV 3 at 2,746.25GB

Given that our two nodes have a sum total 512GB of RAM available to the VMs, though we’d be provisioning a maximum of 254GB of vRAM at best, we would set up our Common Files CSV with 650GB of available storage.

VHDX CSVs

We split up our storage for VHDX files into at least two Storage Spaces/LUNs. Each node would own one of the resulting CSVs.

We do this to split up the I/O between the two nodes. If we had just one 5.5TB CSV then all I/O for that CSV would be processed by just the owner node.

It becomes pretty obvious that having all I/O managed by just one of the nodes may present a bottleneck to overall storage performance. At the least, it leaves one node not carrying a share of the load.

Performance Considerations

Okay, we have our storage configured as above.

Now it’s time to set up our workloads.

• VM 0: DC
• VM 2: Exchange 2013
• VM 3-6: RDHS Farm (Remote Desktop Services)
• VM 7: SQL
• VM 8: LoBs Line-of-Business apps), WSUS, File, and Print

Our highest IOPS load would be SQL followed by our two RDSH VMs and then our LoB VM. Exchange likes a lot more RAM than I/O.

When provisioning our VHDX files we would be careful to make sure our high IOPS VMs are distributed between the two CSVs as evenly as possible. This way we avoid sending most of our I/O through one node.

Why 650GB for Common Files?

Even though our VM memory files would take up about 254GB of that available storage one also needs space for the configuration files themselves, though they are quite small in size, and also additional space for those just-in-case moments.

One such moment is when an admin pulls the trigger on a snapshot/checkpoint. By default the differencing disk would be dropped into the Common Files storage location.

One would hope that monitoring software would throw up an alarm letting folks know that their cluster is going to go full-stop when that location runs out of space! But, sometimes that is _not_ the case so we need room to run our needed merge process to get things going again.

How do I know?

Okay, all of the above is just fine and dandy and begs the following question: How do I really know how the cluster will perform?

No one client’s environment is like another. So, we need to make sure we take performance baselines across their various workloads and make sure to talk to LoB vendors about their products and what they need to perform.

We have a standing policy to build out a proof-of-concept system prior to reselling that solution to our clients. As a result of both running baselines with various apps and building out our clusters ahead of time we now have a pretty good idea of what needs to be built into a cluster solution to meet our client’s needs.

That being said, we need to test our configurations thoroughly. Nothing could be worse than setting up a $95K cluster configuration that was promised to outperform the previous solution only to have that solution fall flat on its face. :(

Test. Test. Test. And, test again!

NOTE: We do _not_ deploy iSCSI solutions anywhere in our solution’s matrix. We are a direct attached storage (SAS based DAS) house. However, the configuration principles mentioned above apply for those deploying Hyper-V clusters on iSCSI based storage.

EDIT 2015-03-26: Okay, so fingers were engaged prior to brain on that first word! ;)

Philip Elder
Microsoft Cluster MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book

Hyper-V: Set Up An Internal Network For Host/Guest File and Service Sharing

Here’s a quick and simple How-To for setting up network communication between a Hyper-V host, both Server and Windows 8/8.1, and any guests.

1. Hyper-V Manager --> R.Click ServerName --> Virtual Switch Manager --> New --> INTERNAL.
• Note the description for the internal vSwitch.
• 
2. Click APPLY and OK
3. Assign the newly created vSwitch – Internal to the required VM(s)
• 
4. On the HOST: Start –> NCPA.CPL [Enter] –> Set an IPv4 IP Address
• 
• Use a different subnet for this network than anything else on the host’s NICs.
5. On the Guest: Start –> NCPA.CPL [Enter] –> Set an IPv4 IP Address
• 
• Note the host and the guest are assigned an IP on the same subnet.
6. On either the Host or the Guest open Windows Explorer
7. \\IPv4Address\
8. Authenticate
1. To host: Either MachineName\Username or DomainName\Username
2. To guest: MachineName\Username
9. Copy and paste files and access services as expected
•  

If there is a need to work with UNC paths, HTTPS and certificates, and more then make sure to set up a small VM running DNS and ADDS if needed. One could also put DHCP on that VM to make addressing simple.

Philip Elder
Microsoft Cluster MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen ASP Project
Find out more at
Third Tier: Enterprise Solutions for Small Business

Sample Client Phish Prevention E-mail

Here’s a sample of an e-mail we would send to our clients on a semi-frequent basis to help keep users wary and informed.

If there is ever a doubt about an e-mail claiming to represent anything from a bank to a newspaper NEVER click on any link in that e-mail.

Open a new browser session and navigate directly to the purported site and log on there.

In today’s day and age we need to be very mindful of clicking on anything.

For anything with a link in it hover your mouse over and a small pop-up will happen:

The above snip came from hovering over the Unsubscribe link in the email below.

As a rule, NEVER click on a link on any e-mail with perhaps the exception of the ones CONTACT sends out with software update links. Even then, hover your mouse over the link in her e-mail just in case someone is specifically targeting the firm!

One more point: We’ve been seeing a LOT of Word and Excel based macro virus transmission files. Anyone sending something should be requested to do so in PDF format if at all possible. For folks on the not-so computer savvy side they can click on FILE –> SAVE AS –> PDF (change Save As Type to).

While PDF files are not much safer than Office files they, at least at this point, marginally better. ;)

Happy Monday everyone. :)

Philip Elder
Microsoft Cluster MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen ASP Project
Find out more at
Third Tier: Enterprise Solutions for Small Business

Business Guidance Pearls Mentoring Opportunity

Our blog post on Some IT Pro Business Guidance Pearls has generated a _lot_ of questions! Thank you for that. :)

So, how about this?

Third Tier has a special on a block of 3 hours that ends in a few days.

Drop in to the Third Tier Help Desk, register, and purchase a time block. From there, open a ticket: Business Guidance Pearls Mentorship.

I would pick up the ticket and get in touch about scheduling our time together.

The structure would be:

• 1 Hour: Practice Assessment and Goals
• 1 Hour: Goals Roadmap
• 1 Hour: Goals Implementation Steps

I was very fortunate to have a former employer that worked very hard to teach me how to run an I.T. business. By “run” we’re talking about a lot more than just the bookkeeping and cash flow aspects.

Believe me when I say this, you’d not regret any minute spent. We’d look at the big picture right through to the details to facilitate growth in your I.T. Pro practice.

Philip Elder
Microsoft Cluster MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen ASP Project
Find out more at
Third Tier: Enterprise Solutions for Small Business

Some IT Pro Business Guidance Pearls

Here are some bits and pieces of business wisdom that I’ve gathered over the years. Much of my initial business formation came from my first employer out here Larry MacDonald while working for Logical Computer Company.

• Keep a business journal (for me it’s my blog, Twitter, and forum helps)
• Document everything (take pictures of everything with SmartPhone, use Snip in Windows ALL THE TIME)
• Create build documentation for everything
• We have builds for clusters, Exchange setups, Exchange migrations, SBS setups, SBS Migrations, More
• Be consistent (build documentation helps)
• Use Tasks in Outlook and on the phone to track everything
• Be disciplined in tracking, responding, and being present to clients
• Spend 10%-20% on R&D
• Spend 10%-15% on lunches, dinners, and such with others
• Put 10% away for a rainy day
• Get involved with user groups or start one
• Get a _good_ accountant and keep them

As far as recurring revenue:

• IMSNHO, blended is better than full MSP
• ~$60/User to $110/User for:
• Server OS patch, Server App patch, and Microsoft App patch/install management
• Desktop OS patch and Microsoft App patch management
• A/V Management along with e-mail sanitation (we use ExchangeDefender)
• Remote Server Monitoring and management included
• On-site not included
• Phone and e-mail support beyond 15 minutes not included
• Offer backup rotation with quarterly full bare metal or hypervisor restore
• $150-$250 per OS per month
• Need a dedicated box for this (Intel S1400FP4 with 96GB ECC, and RAID 6 across spindles or SSDs)

Services

• Non-contract break/fix:
• $250/Hr immediate response
• $200/Hr 4 hour response
• $175/Hr 24 hour response
• Contract on above
• 4 Hour response included
• Immediate response at 1.5 rate
• Time Blocks offered at discounted rates

*Response being an acknowledgement of the request/ticket.

There are a lot of benefits over time as far as financial stability but also client relationships become a lot more stable and long term with support contracts in place versus a break/fix model.

We soon discover the clients that value our IT services and those that don’t when we move into the above model. What business that runs a fleet does not have a crew of mechanics to maintain that fleet? Why is IT infrastructure any different?

A major plus is in the routines that we build up. Our schedule gets a lot more stable and predictable. While we are still at our client’s beck and call we now have an established set of boundaries as far as how, when, and where the help would be provided.

We can have a few more evenings a week pursuing other things and _not_ looking at screens! ;)

Philip Elder
Microsoft Cluster MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen ASP Project
Find out more at
Third Tier: Enterprise Solutions for Small Business

SMB Kitchen ASP Author’s Chat: Wednesday the 17th Open To All!

You are invited to a preview during our SMBKitchen Chat on December 17th 7pm eastern. Download to your calendar now!

Our Chat will introduce the following new items at Third Tier. In addition we'll cover our usual content about security and patching. Join us for this special sneak preview of...

Tech Your Books: You know your books are supposed to do more for you than just keep you out of trouble with the IRS right? They are supposed to be a powerful business tool that helps you be more profitable and provide information so you can make evidence backed decisions about your business. It’s time to Tech Your Books!

Look, A Whale! What do you do when you’ve got a Whale? Be it a crisis or a project, your company could benefit greatly if you choose to have a third party representing your organization.

Our First Product: SBS IaaS Ever since Microsoft ceased production of small business server saying that small businesses would prefer to be "in the cloud" IT providers have wondered where that leaves them. Well we have a solution for you - Be The Cloud! 

Super Secret News: ASP members have been enjoying reading classified documents from US intelligence and security agencies giving them the early information on the latest hacks, industry targets and break-out infections. Learn about our after ASP plans to bring this information to you.

In addition to these great new Third Tier services, we are continuing to offer advanced helpdesk and microstaffing.If you would like to read more about each of these, we have some information available on our website already with more to come soon. http://www.thirdtier.net

And ItsA Gonna Be A Gooder! ;)

Philip Elder
Microsoft Cluster MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen ASP Project
Find out more at
Third Tier: Enterprise Solutions for Small Business

Microsoft Ups Support Ticket to $499 – We Have a Great Alternative: Third Tier!

It seems that this may, or may not, depending on one’s thoughts of how Microsoft sees IT Pros in today’s “Cloud First Mobile First” be another shot at IT Pros that provide much of the front line support to SMB/SME clients.

• Redmond Magazine: Microsoft Increases Support Costs for IT Pros

I’ve been helping out with Third Tier for well over a year and a half now. I’ve been privileged to work on a team of amazing folks as well as work with a great group of IT Pros.

I believe that we at Third Tier offer a viable alternative to Microsoft’s $499 ticket (though I’m not sure what that will work out to in Canada as we pay substantially more than the US equivalent) for spot support or even ongoing support needs.

Given the experience our team has the Third Tier rate of $175/Hour is very reasonable. Active Directory, Exchange, Remote Desktop Services, Hyper-V, VMware, Cluster, and very soon a number of key vertical products and services to help our IT Pros get the job done right the first time!

• Third Tier Help Desk

Third Tier offers a Micro Staffing program where we can be a part of your IT Pro team for ongoing support challenges or staffing challenges. We can be a part of your team for a very reasonable cost.

I’m also excited about some of the things we’ve been working on at Third Tier to provide our IT Pros with a one-stop solution for their data centre that will allow them to provide IaaS and even our SBS (Small Business Solution) at a very reasonable cost per seat! More to come on that soon.

One final thought. If one is caught in a bind with a server down situation then the Microsoft ticket may be the best way. With Action Pack we still get BizCrit (Business Critical) support though via a call back model.

Our response model tends towards scheduled time for tickets as opposed to crash responses. So, please keep that in mind.

Here are some of the areas we can help you with:

• Disaster Recovery Planning and Practice
• Infrastructure planning, migration, support, and recovery
• Active Directory and Group Policy planning, support, and recovery
• Remote Desktop Services planning, support, and recovery
• Exchange planning, migration, support, and recovery
• SQL planning, migration, support, and recovery
• Hyper-V planning, support, and recovery
• Virtualization Solution Performance planning and support
• Specialized Bookkeeping Support and Services
• IT Business Models, Plans, Direction, Vision, and More

Whatever the task, we have a team member that can help. Not only that, one can expect the task to be done in short order and in a professional manner.

If you have not checked us out before please do now.

Philip Elder
Microsoft Cluster MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen ASP Project
Find out more at
Third Tier: Enterprise Solutions for Small Business

Cluster: Firewall GPO Settings

Here are some firewall settings that we configure via GPO for both our AD environment but also for our cluster setups.

Domain linked GPO:

At the domain level, thus all systems are impacted by these settings, we configure Remote Desktop inbound, Remote Event Log Management, Remote Volume Management, and finally Remote Firewall management.

Cluster OU linked GPO:

Here we set the inbound rules that allow us to manage our clusters. The Inbound Rule for Remote Shutdown is a critical one to implement as that allows Cluster Aware Updating to run.

And, there is one rule that seems to be in both places. Chalk that up to export/import. :)

Philip Elder
Microsoft Cluster MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen ASP Project
Find out more at
Third Tier: Enterprise Solutions for Small Business

Hey SMB Kitchen ASP Subscribers! Author’s Chat Starts Shortly.

Sorry about the short notice it has been a banner day for things breaking like power poles and such at client sites.

Link for the chat is in your subscriber e-mail.

Thanks for supporting us! :)

Philip Elder
Microsoft Cluster MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen ASP Project
Find out more at
Third Tier: Enterprise Solutions for Small Business

ASP Webinar Today at 1700 MST: Setting up ARR and URL ReWrite for One WAN IP

We've had a number of requests to do a Webinar specifically on how we get things set up for our Small Business Solution (SBS) whereby we only require one WAN IP address for all Internet facing services being published.

At 1700 MST please join me as I walk through a step-by-step of installing and configuring ARR and URL ReWrite.

• Install ARR and URL ReWrite
• Configure ARR settings in IIS
• Configure ARR settings for EAS
• IIS Sites and settings
• SSL configuration
• URL ReWrite rule configuration
• ReWrite rule testing

By the time we are finished we will have a fully functional setup.

For this Webinar we will be using our three VM Azure based lab running a DC, Exchange 2013, and RDS.

Please do join us if you can and if not the event is being recorded and will be available to subscribers in the ASP Knowledgebase.

Philip Elder
Microsoft Cluster MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen ASP Project
Find out more at
Third Tier: Enterprise Solutions for Small Business

Azure VMs: A Series Versus D Series

We’ve been working with our Microsoft Partner Azure credit to see just how it all works as we have a client that needs a highly redundant, scalable, and global infrastructure setup.

Here is an A Series VM setup:

This is the setup for the D Series VM:

Cost wise the D series would be a bit more but the performance difference is noticeable.

When it comes to evaluating where to place client workloads one definitely needs to keep in mind what grade of VM to be utilizing.

Note that it looks as though one cannot mix A and D VMs in the same Cloud Services container. Please verify as to whether that is the case in your particular Azure Portal.

Philip Elder
Microsoft Cluster MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen ASP Project
Find out more at
Third Tier: Enterprise Solutions for Small Business

SMB Kitchen Content Posted: Exchange Migration Documentation, Cluster Quotes, and Proposal Template

I’ve published three very significant documents to the ASP SMBKitchen knowledgebase.

Exchange Migration Guide

The following is the product of many Exchange 2003 to Exchange 2013 migrations.

The guide walks through all of the necessary steps to migrate from Exchange 2003 and up to Exchange 2013. If migrating from v2003 then a two-step process would be required where we’d migrate to Exchange 2010 and then on to 2013.

We’ve done the two-step process on a number of occasions with small and large Public Folder stores without any real issues. It works quite well

Note that the primary focus of this guide is all of the PowerShell required to configure Exchange, work within the process, and recover from some specific errors that may happen. Everything is there as far as configuring Virtual Directories, the Service Connection Point (SCP), setting quotas, limits on send, and more.

On-Premises Proposal Document

The second document posted is an Excel spreadsheet that allows us to publish a proposal for an on-premises infrastructure deployment. It presents one number including a number for deposit to the end-user.

It includes two Intel Server Systems based configurations, which can be changed to Dell or other system, software licensing costs, and a labour section that allows for a detailed scope for us with a brief in the proposal itself.

1U Cluster Quote

The third document is a quote in Excel for the base Scale-Out File Server Cluster setup we would propose for an on-premises infrastructure setup.

It uses the above template with four Intel Server Systems R1208JP4OC 1U single socket servers configured for either the Scale-Out File Server cluster node or the Hyper-V cluster node. It uses a 10GbE backend for SMB traffic via two NETGEAR XS712T 12-Port 10GbE switches.

Philip Elder
Microsoft Cluster MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen ASP Project
Find out more at
Third Tier: Enterprise Solutions for Small Business