Vista Service Pack 2 Not Applying Group Policy Preferences

We are collaborating on an SBS 2008 and Windows Server 2008 Core Hyper-V fresh installation.

The Hyper-V server will host 8 Windows Vista desktops for the organization that has users that are out of the office more than 85% of the time.

This solution keeps their data organized and protected as well as enables them to run a Line of Business application that is not Terminal Services friendly.

The Vista software is provided by a base retail OS purchase with Open Value Vista Upgrade + SA added.

The media that was downloaded for the VMs:

A fresh Windows Vista Service Pack 2 OS.

Well, we have discovered that the slipstreamed version of the OS does not have the Client Side Extensions functioning properly.

After troubleshooting our User and Computer based GPOs that contain Preferences, the following page came up in a search:

• TechArena: Group Policy Preferences not applying on Vista with Service Pack 2.
• Full thread here: Microsoft Newsgroups on Group Policy.

Ouch … this is not a happy scene because we had to burn critical time today troubleshooting this problem instead of placing the new SBS domain into production.

• The CSE are supposed to be in Vista SP2 according to Microsoft.

Jake Paternoster in the above TechArena page gave us a good lead towards the solution, but for some reason we could not come up with quite the right process to get the CSEs to install.

But almost every combination that we could come up with would fail with:

Or, at least UAC us but still fail ... with nothing in the Event Logs to even give us a clue as to what we were running up against.

But then, wait! It gets better! After leaving the first Vista SP2 VM alone for a while then coming back to work through the processes and see if we missed anything the GPPrefs were applied! 8O

So, was it the RSAT and GPMC that was enabled that made things work? Or, was it running the GP wizards in the GPMC that got things going?

Since we have 8 VMs to play with, we started with the next one and worked our way backwards through the process to figure out which step actually worked.

Gotta love these in the middle of everything too:

Windows 7 TS Client. They have not been very frequent, but they seem to hit when they are the least welcome!

Here is the methodology for getting things working:

1. Download the CSEs (Microsoft KB site).
2. Copy the KB file to C:\KB943729
3. Open an elevated command prompt.
• It is absolutely necessary that the command prompt be elevated with the domain admin credentials.
4. Navigate to C:\KB943729
5. expand Windows6.0-KB943729-x86.msu –F: *\KB943729 [Enter]
• Note the space _ in between the –F:_*
6. Delete the original Windows6.0-KB943729-x86.MSU
7. start /w pkgmgr.exe /ip /m:C:\KB943729\Windows6.0-kb943729-x86.cab [Enter]
   • No quotes around the path.
   • Make sure the full path including the CAB is there.
   • A bunch of files and folders will show up in the directory. This indicates that the CSEs are seemingly installed.
8. GPUpdate /Force [Enter] 
9. shutdown –r –t 0 [Enter]

Note that the syntax of the PkgMgr.exe command is extremely important ...

The actual command line format is to be found in this link:

• Aaron Tiensivu’s Blog: Generic way of brute force installing a .MSU package in Vista or Server 2008.

Lesson:

• Question:
• What is the definition of insanity?
• Answer:
• Doing the same thing over and over and over again and expecting a different result! ;)

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*All Mac on SBS posts will not be written on a Mac until we replace our now missing iMac! (previous blog post)

Windows Live Writer

Vista SP2 on Hyper-V SP1 – Integration Services Install Error Code 1

When trying to install the Hyper-V Integration Services on a newly installed Windows Vista Enterprise VM, this is the error we received:

Error

An error has occurred: One of the update processes returned error code 1.

Apparently, we need to Service Pack 2 our Hyper-V box too (Kit Kai’s Tech Blog).

In the mean time, if connected to the Hyper-V manager via an RDP session, there will be no mouse access to the VM.

To shut the VM down, do the following:

1. Click the button.
2. Hit the down arrow on the keyboard to get to Start Task Manager and hit the Enter key.
3. Type ALT+N to hit the New Task button.
4. shutdown –s –t 0 [Enter]

The VM will shut down. We shut down all of the desktop VMs on this Hyper-V box before installing the service pack.

You folks in the US sure have it good with your Internet connections!

• Windows Server 2008 Service Pack 2 and Windows Vista Service Pack 2 - Five Language Standalone for x64-based systems (KB948465)

The update took a while on the dual Xeon E5420 series Dell 2950 2U. There were 5x 300GB 15K SAS drives in RAID 10 with a hot spare.

We shut the VMs ahead of applying the update to give the server as much dedicated processing and disk I/O as possible. Even though we are working with a Server Core install, the update is quite large.

At about 5 minutes:

And here we are about 17 minutes after the update was initiated:

Keep in mind that any Hyper-V server that hosts Windows Vista Service Pack 1 will need to be updated to Service Pack 2 prior to service packing the Windows Vista VMs.

When the Integration Services disk gets inserted into the VM the AutoPlay feature should pop up a window that enables us to hit the Enter key to initiate the setup routine and an ALT+A to continue through the UAC prompt.

If the VMGuest.ISO was already mounted, then make sure to dismount and click Insert Integration Services Setup Disk in the VM’s Action menu.

Once installed, we will see:

After the reboot, our remote mouse movements will be enabled. If the above menu gets lost behind the default Vista Welcome window, hit the CTRL+ALT+DLTE button in the VM manager and bring up the Task Manager to switch to the Hyper-V setup.

Another reason Windows 7 in a VM is way ahead of Windows Vista! Windows 7 has the Hyper-V Integration Services already installed!

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*All Mac on SBS posts will not be written on a Mac until we replace our now missing iMac! (previous blog post)

Windows Live Writer

Windows 7 XP Pro Mode – Requires a Physical Box with AMD-V or Intel VT Turned On

When it comes to running the new XP Pro Mode on Windows 7, the host OS must be on physical hardware that has hardware virtualization enabled in the system’s BIOS.

Hyper-V, VMWare, Virtual PC, and other virtualization products running Windows 7 in a VM will not allow for us to test the new XP Pro Mode in Windows 7.

The download on Connect shows that with the:

NOTE: Windows Virtual PC requires processor (sic) capable of hardware virtualization, with AMD-V™ or Intel® VT turned on in the BIOS.

The link in the screenshot is the actual link in the above quote but it is not live yet.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*All Mac on SBS posts will not be written on a Mac until we replace our now missing iMac! (previous blog post)

Windows Live Writer

Hyper-V on Server Core Rehash - Scratch to Production and Hardware Considerations

Server Core + Hyper-V after the fact: Build it and they will come! :)

Blog posts:

• Server Core - From Scratch to Hyper-V Production.
• NetSH reference: Server Core - Firewall NetSH Command Line Reference.
• Simple scripted updates for Server Core: Server Core - Updates are available + How to manually update.

When working with the Server Core installation on a domain, it is a good idea to add the principle domain user to the local domain admins group. But only that user.

For other users that will manage only certain VMs on the Hyper-V box, there is AzMan. This is just a teaser since the Tech Days presentation went through AzMan and Hyper-V rather quickly, we will need more time to delve into the methodology. Anyone already familiar please feel free to drop some hints/suggestions/tidbits into the comments! ;)

Once the above steps have been completed, Hyper-V Manager on Vista SP1 or in Server 2008 (either Hyper-V Role enabled or management tool) will be able to connect.

Make sure to enable the remote advanced firewall management on the Server Core box for all profiles! If all else fails, at least we can still work the firewall rules via a GUI.

When it comes to the Hyper-V on Server Core hardware, make sure the box has at least 2 network cards! One NIC needs to be tied to the internal domain/workgroup and needs to be dedicated to management use only.

The second NIC, or any additional ones, will be for the Hyper-V virtual switch. Once the second NIC is bound via the Virtual Network Manager in Hyper-V, it is okay to disable the NIC in the Device Manager of the Hyper-V Server Core box. The Hyper-V Switch will continue to function since it is riding directly on the NIC hardware.

Also, when it comes to the hardware configuration and the number of cores enabled for a VM, there may not be a logical progression for core assignment. Here is an example (CPU focus only):

• Hardware has a pair of E5440 Xeons (8 Cores).
• 1 Virtual CPU: Vista VM
• 1 Virtual CPU: Vista VM
• 1 Virtual CPU: XP Pro VM
• 1 Virtual CPU: XP Pro VM
• 2 Virtual CPUs: Server 2008 VM + SQL 2008 Standard
• 2 Virtual CPUs: Server 2008 VM + Exchange 2007 Standard

The logical thought progression would be to settle each VM on a core for the singles and a pair of cores for the VMs that have two virtual CPUs. Eight virtual CPUs demanded by the VMs with 8 cores available. But, that is not how the actual CPU tasks are served up across the cores. The above example may run just fine for a small shop with relatively low CPU to VM usage. But, as the VMs demand more processor horsepower, the more difficult it becomes to divvy up a pair of cores for the VMs with 2 virtual CPUs.

Now, take the above configuration and tweak it a bit:

• Hardware has a pair of E5440 Xeons (8 Cores).
• 2 Virtual CPUs: Vista VM
• 2 Virtual CPUs: Vista VM
• 4 Virtual CPUs: Server 2008 VM + SQL 2008 Standard
• 4 Virtual CPUs: Server 2008 VM + Exchange 2007 Standard

We dropped the XP Pro single CPU VMs by moving them to another Hyper-V box because we knew the load on this particular Hyper-V box was going to jump.

Now, the question is, will increasing the number of virtual CPUs actually improve VM performance?

What we actually end up with is a competition for CPU cycles between the low virtual CPU count Vista VMs that are easier to assign CPU cycles to and the high virtual CPU count Server 2008 VMs. As demand increases VM performance would actually decrease due to the need to juggle virtual CPU demands across the 8 Xeon cores.

We could throw the most expensive pair of Xeon X5492 Quad Cores that we have bumped up to 3.9GHz into the Hyper-V box running the second set of VMs and still we would not see top performance out of them due to the virtual CPU count in the VMs.

Ultimately, the point is that increasing the VM virtual CPU count does not necessarily mean that the VM's performance will increase.

Some of the Tech Days virtualization sessions discussed the above hardware considerations. We tied them into our own virtualization experiences.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

SBS 2008 - Some test lab considerations

One of the major questions we need to ask ourselves when we are going to test a new server OS or workstation OS product is: how?

Some criteria to consider in that how:

• Internet connection.
• Static IP with URL A for DNS, MX for mail, SSL.
• dDNS setup.
• No Internet connection at all.
• SBS 2003/8 specific: Remote Web Workplace functionality.
• Server or workstation hardware
• Virtualized OSs.
• Terminal Services
• Group Policy settings from OU structure right through to the minutest GPO and its settings.
• Workstations.
• Hardware or Virtualized.
• XP Pro and/or Vista Business/Ultimate
• Microsoft Office version
• Line of Business Applications

The above list is by no means complete. But, it does give us food for thought.

For us, the imperative when looking to test a beta product, SBS 2008 for example, is to make sure that we have a setup that is close to what a real production environment would be like.

This imperative becomes all the more important as we began to realize just how much SBS 2008 has changed over SBS 2003. We absolutely needed an Internet connection with at least a dDNS setup or, in our case, a dedicated static IP with the proper DNS settings in place.

As an example, we wanted to run through setting up SSL with a third party certificate for Remote Web Workplace because the new Getting Started Tasks contained a wizard just for that purpose. With that cert in place, the next step was figuring out how to make ISA 2004/6 work with the SBS 2008 RWW setup and so on.

When it comes to our client specific setups, we create a lab environment that mirrors their production environment. It is then critical for us to provide the necessary infrastructure to facilitate the mirror. To some extent, virtualization can help a lot here, but not completely.

In the case of SBS 2008, as mentioned in previous posts, we have a couple of lab setups in the shop. The critical one for us right now is the Springer Spaniels SBS 2008 setup that is a part of the book that I am co-authoring with Harry Brelsford.

It is the Springers' lab setup that needs to be stable and properly configured as our other lab setup is the one we like to blow up by doing silly things like enabling the Intel ProSet NIC Teaming settings and then running the wizards ... can you say reinstall anyone? ;)

This is an overview of the Springers' lab:

• Intel X3070 Xeon Dual Core CPU on an Intel S3000AHLX server board, 8GB Kingston ECC Intel approved RAM, Intel SRCSASRB RAID controller in RAID 0+1 with 4x 320GB Seagate ES series hard drives for a total of 640GB of storage.
• SBS 2008 RC1 is installed and in the process of being configured.
• 4x workstations configured as follows:
• Intel Core 2 Quad Q6600, Intel DQ965GF or Intel DQ35JO motherboard , 6-8GB Kingston RAM, 2x 320GB Seagate ES or AS series hard drive in RAID 1 via on board RAID controller all tucked into an Antec Minute 300 or 350 for space saving.
• Windows Vista Ultimate x64.
• Workstation VM setup:
• Station 1: 4x Windows XP Pro VMs using our TechNet Plus for licensing (lab).
• Station 2: 4x Windows XP Pro VMs using our TechNet Plus for licensing (lab).
• Station 3: 2x Windows XP Pro, 2x Windows Vista Ultimate VMs using TechNet Plus (lab).
• Station 4: Server 2003 R2 Std for ISA (TechNet in lieu of Open Lic.), Server 2008 Std x64 (SBS 08 RC1 Premium).
• Network Setup:
• Internet static IP bound to our own ISA 2004 (on SBS R2 Premium) with DNS A, MX, SPF records in place for springersltd.com.
• The Springers' SBS 2008 box sits behind a D-Link DI-604 consumer router with a publishing rule on our ISA 2004 to allow it out only.
• D-Link internal Springers' IP range: 192.168.99.0/24
• D-Link WAN port IP: 192.168.125.210 (reservation on our internal SBS DHCP setup)
• Our ISA 2004 has the Springers' SSL certificate bound a publishing rule set to allow HTTPS and SharePoint 987 to forward to the D-Link's internal IP. The D-Link forwards those to the Springers' SBS 2008 box.
• Our ISA 2004 also has VPN and SMTP for the springersltd.com forwarded to the D-Link then on to the Springers' SBS 2008 box.

We have limited the number of virtual workstations to 4 per physical workstation as we plan on stress testing the setup by having a number of people logging in at the same time as the Springers' users. They will do things like run Outlook to create and send e-mail, Word documentation, SharePoint, and the like.

Yes, the workstation grade hardware hosting the VMs will not necessarily provide the "real world" experience like having those desktops on a Hyper-V enabled server with a high performance RAID array setup and a couple of cores assigned to each would provide, however, it will give us some indications as to how the Xeon 3070 will hold up under 10 users with a number of the server services in use simultaneously.

Note that the D-Link is a temporary measure until we reach the stage where we are installing the Windows Server 2008 x64 Standard server that is a part of the SBS 2008 Premium setup. When we have reached that stage, then, we will look at setting up ISA on Windows Server 2003 R2 Standard either as a VM, or if we have a spare box kicking around, a dedicated hardware solution.

There is a significant cost in time and equipment in the lab setups we have. It only makes sense that if we want to provide the best possible product knowledge to facilitate our ability to provide our clients with the best solutions for their needs, then we need to invest time and money.

This is critical: The closer and closer we get to the Cloud and its opportunities and pitfalls, the more our knowledge and experience will be the key to us and our I.T. company moving forward successfully.

Take careful note: The "we" and "our" in the above sentence means every single employee and contractor that works with us under this umbrella we call MPECS Inc. It also means our clients and their feedback, the vendor contacts we work with, our peers in the local I.T. industry, and you our blog readers that provide excellent feedback for us to build on.

Ultimately, it will be our teamwork that carries us through this transition period.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

Windows Vista Service Pack 1 Retail Part Numbers

Finding the Windows Vista fully packaged product (retail) part numbers can be a bit of a struggle via the Internet or even our supplier's Web sites.

Different key words for different folks.

Here are the Windows Vista SP1 retail edition part numbers:

• 66G-02689 Windows Vista Home Basic SP1
• 66I-02387 Windows Vista Home Premium SP1
• 66J-06353 Windows Vista Business SP1
• 66R-02261 Windows Vista Ultimate SP1

All full retail editions come with both the x86 (32bit) and x64 (64bit) DVDs.

We sell retail into client locations as the foundation for our desktop OS virtualization setups. We then add on Windows Vista Software Assurance (>$75/Yr) and the Microsoft Desktop Optimization Pack for Software Assurance (>$20/Yr) for each required desktop VM on an Open Value Agreement with 3 year spread payment option.

For virtualization where we require a fine tuned desktop via Group Policy, or Line of Business Application compatibility across a number of remote client users, we have a good thing going with this setup.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

Hyper-V on Server Core - Some initial observations and hardware planning

We have had a chance to have some production Windows XP and Vista virtual machines running in Hyper-V on Server Core Standard for a few days now.

We decided to copy over our production VMs to Hyper-V, because that was the only way we were going to get any real experience with the product.

All in all, the experience has been positive.

Some of the high points:

• VM performance is faster than Virtual Server 2005 R2 SP1 on W2K3 R2 Standard SP2.
• Single core to single core on an identically equipped 1U Intel Xeon 3000 Series.
• From VM boot times, to program start up, to running some pretty intense reports in QuickBooks, things move a lot quicker.
• Adding a second core to the Hyper-V based VM increases performance significantly.
• Server Core's overhead is a paltry 256MB of RAM, in this case leaving 7.75GB to the VMs.
• Server Core's hard drive footprint is relatively small, and can be made smaller by removing not needed packages (Server Core blog how-to).

One of the first things we needed to do to get Hyper-V to work with the newer Intel S3000AH series NIC setup in our 1U was to download the Hyper-V RC0 and install it.

We downloaded the MSU file to a company folder share the Server Core system was connected to, copied it over to a local folder on the Server Core machine, then ran the update from the command line from that folder by typing it's full name and hitting Enter.

The RC0 install routine fired up with no issues, rebooted the machine, then ran some more install routines on login.

We needed to have Windows Vista SP1 on the workstation we were going to install the Hyper-V management console (x64 Console, x86 Console) on.

We have run into a few Hyper-V hiccups and a strange VM performance issue:

• Our Windows Vista SP1 VM that came from a Virtual Server 2005 R2 SP1 with Virtual Machine additions removed would not setup on Hyper-V at all.
• This is a known limitation at this point
• Our Hyper-V based server must have read/write permissions given to shared folder where any ISOs reside
• Access to the ISOs on our Windows based storage server works fine
• Access to ISOs on an Intel SS4000E in either Local Authentication or Active Directory Authentication Mode will not work.
• The XP VMs go into some sort of near death pause for anywhere from 15-30 seconds periodically and somewhat randomly.

What we are also finding out with the current setup is that the performance bottleneck has moved from the Windows OS to the storage subsystem. We have discovered that we need a really good hardware accelerated RAID controller to reduce or eliminate that bottleneck.

All in all, as Hyper-V goes through its final development phase into RTM, things can only get better.

Working with both Server Core and Hyper-V has been a really good experience so far. A neat part of the whole endeavour is discovering all of the quick and simple ways one can manage the server from the command line. And subsequently, manage the Full Server 2008 Install in the same manner.

Next up ... PowerShell! ;)

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

Windows Vista - Error - Windows could not connect to the System Event Notification Service service

We have a virtual machine with Vista Business installed on it that is connected to our internal domain.

It is being used for some particular network and application testing for our environment.

Every once in a while, it is impossible for any restricted level user to log onto the machine.

We get the following error:

Windows could not connect to the System Event Notification Service service.
Please consult your system administrator.

Well, we are the system administrator! ;)

After a great deal of searching around, there doesn't seem to be any "fix" for the situation yet.

The workaround is to reboot the system and hope for the best. In our case, it works, but in investigating this problem, there are people out there supporting classroom systems that are having this hiccup during classes on several hundred machines.

Here is a direct quote from user iquazee about half way down this MSDN Forum post Limited User account cannot log on due to error: "could not connect to the system event notification service" (Note that the registry keys are continuous ... they are broken into two lines for formatting reasons):

I did some investigation with a debugger when the problem occurred again on my computer.
And here is what I found so far:

1. Although Vista no longer supports Winlogon Notification Packages, there is still a similar mechanism in place used internally by Windows components (see HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet
... \Control\Winlogon\Notifications\Components).
It is quite different though - instead of loading each component as an in-process DLL, the new mechanism uses RPC to communicate with the registered components, and each of them runs as a separate service.

What's interesting, the System Event Notification Service, which is the official replacement for now-unsupported Winlogon notification packages depends on this mechanism (see HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet
... \Control\Winlogon\Notifications\Components\Sens).

2. When a logon event occurs (this can be a logon, logoff, lock, unlock, etc.) Winlogon calls each of these 'components' (by binding to a predefined RPC endpoint, the endpoint name seems to be derived from the service SID of each service that is registered for the logon notifications).

There seems to be a timeout if the registered service does not respond quick enough - about a couple of minutes.

3. If some service fails to respond to the logon event, it may cause the logon to fail.

However, it seems that if the user is a local administrator, the logon does not fail (although it may be slow due to the timeouts).

4. It seems that the service which causes the most problems is the TrustedInstaller service.

This service is used to install Windows components, including Windows updates (.MSU files).

It is not used for the installation of 'normal' Windows Installer (.MSI) packages.

What I found is that sometimes, after installation of an update the TrustedInstaller service stops responding to the Winlogon notifications, causing the problem.

The Windows Defender service is not the cause of the problem.

However, when Windows Defender in enabled, most updates installed by Windows Update are the Windows Defender definition updates.

5. The workaround is to kill the TrustedInstaller.exe service using Task Manager (it cannot be stopped otherwise).

Of course, you should not do that while an update is being installed.

The TrustedInstaller service will be automatically restarted when needed (for example, when you use Windows Update).

This is a pretty good description of what is happening in the event logs.

Here is the first error we see:

Event ID 1530: User Profile Service - Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.
...
Process ID 868

It is followed by:

Event ID 6003: Winlogon - The winlogon notification subscriber [TrustedInstaller] was unavailable to handle a critical notification event.

Both errors occurred around the time the restricted user was trying to log onto the Vista virtual machine.

In this case, as indicated in the previous MSDN Forums (above MSDN link starting at the first page) posts, the process ID that was holding onto the registry was indeed Windows Defender.

So, we may be seeing another bug within the Update Services setup within Windows Vista. Not that we are software debuggers by any means! :D

Links:

• Microsoft Live Search: Vista Cannot Connect to the System Event Notification Service.
• Microsoft MSDN Forums: Limited User account cannot log on due to error: "could not connect to the system event notification service"
• Tablet Questions.com: Event 1530, User Profile Service (Specific to the Event ID 1530)

Hopefully we will be seeing at least a hotfix sometime soon!

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

Virtual Server - VM Memory & CPU requirements

We have been working with Virtual Server 2005 R2 SP 1 for our virtualization needs.

The two key physical limitations to the number of virtual machines, in our experience, are the amount of memory installed and the speed and number of cores on the CPUs.

Windows Server 2003 Standard R2 x64 serves most of our virtualization needs. With the /PAE switch in boot.ini, we get to address as much RAM as we need.

For Intel based uniprocessor servers we are limited to 8 GB of RAM. For dual processor servers we are limited to 32 GB of RAM.

We tend to configure one (1) virtual machine for each core on a processor. For a Quad Core uniprocessor server we would run a maximum of 4 virtual machines. For a V8 server, dual Quad Core CPUs, we would run a maximum of 8 virtual machines.

This setup is, of course, based on the limitations of VS 2K5 of one core to one virtual machine.

VMWare Server would give us the option of dual SMP - two cores - for a virtual machine if the situation warranted. We would reduce the number of VMs running on the host OS accordingly.

A good portion of our client based virtualization needs are for remote desktop serving. The ability to run virtual XP Pro or Vista Business desktops provides flexibility for Group Policy based desktop security, user and application limitations via Group Policy, Line of Business apps that may not be able to be installed on a Terminal Server, Remote Web Workplace access via "Connect to my computer at work", and more.

An XP Pro VM can run quite comfortably on 512 MB of RAM while on a dual 3.06 GHz Intel Xeon based server. Virtualization is one place where Hyper-Threading actually works.

Windows Vista Business will require a minimum of 1 GB of RAM when running virtually. Anything less than that and Vista takes a pretty heavy performance hit.

We tend to set at least 2 GB of RAM to a virtualized SBS installation. That is the minimum we would install on a physical SBS installation, so we stick with it for VMs.

Windows Server 2003 Standard R2 serving DNS to the Internet can run on 256 MB of RAM. Install Exchange and the memory requirements jump up to at least 1 GB with 2 GB being better. ISA virtualized will run okay on 512 MB but better on 1 GB.

A rule of thumb is to leave a minimum of 384 MB of RAM for the host OS. Make sure that only the host OS basics are installed. For Windows Server 2003 Standard R2, remove or disable all nonessential services to lean out the OS.

So far, virtualization has done great things for our clients and for us. It can greatly reduce the costs of running a few extra dedicated remote desktops when all of the client's staff is laptop based. It can provide a single box solution for a number of light duty server roles that are easy to backup and restore as needed and in short order.

For those of us in IT, it eliminates the hardware/$$$ limitation on our testing labs. One V8 server will serve most small shop's server/client VM environmental needs. No more need to have four, five, or more boxes with a KVM or two just for those lab situations where we need to test whether our client boxes will blow up with the next run of updates and patches!

It also gives us a tremendous time saver: Undo Disks! With undo disks enabled, if that run of patches or updates does blow up the virtualized client SBS or other server box, we can undo the patches by discarding the changes and then start again. Hopefully we will be able to figure out which patch is causing the problems with what installed component and go from there.

All in all, virtualization can provide an excellent way for us to create some pretty neat solutions for our clients with a very attractive price point.

This is needed to enable Windows Server 2003 Standard R2 x64 to access installed RAM above 4 GB: Microsoft KB 283037: Large memory support is available in Windows Server 2003 and in Windows 2000

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

SBS - Vista Based Group Policy Management Reminder

We are in the process of fine tuning some GP setups for Remote Desktops based on Windows Vista Business.

We set the GP setting for remote shutdowns to only be allowed by Domain Admins. This setting was placed in a domain level linked GPO we create for the non-SBS specific security settings called: Default Domain Security Policy.

But, when a non-domain admin remote user hits the "Windows Security" Vista based Start Menu option, they are presented with:


See that little red button on the bottom right hand side? They should not be seeing that. By clicking on it, they can shutdown the VM, the actual Remote Desktop server if it is a 1U dedicated box, or their local workstation. Windows XP does not show a shutdown option at all.

Not a good thing for the next person who needs access is it? 8*O

So, since we have a Vista dedicated policy on SBS now, and any machine based on Windows Vista should not be able to be shut down remotely, we will enable that setting.

When working on GP settings that are specific to Windows Vista, most changes must be done from a Vista based workstation. One must logon to the workstation as domain admin, open GPMC.msc from the search bar or Run command, and navigate through to the settings that need to be changed.

GPMC from via Windows Vista:


The first time one clicks on a GPO, the following notice will come up:

You have selected a link to a Group Policy Object (GPO). Except for changes to link properties, changes you make here are global to the GPO, and will impact all other locations where this GPO is linked.

In other words, any changes made to the GPO will be implemented at the Domain level.

And now, we run into a bit of a problem.


Run GPEdit.msc on the local Visa machine, and there it is! The setting is implemented to not allow anyone to shut the system down remotely. But, the little red button is still there and the user can still run the shutdown command from within the command prompt.

There is an explanation, whether we are missing a Vista specific GP setting elsewhere, or it is an actual GP related bug in Vista. The Windows XP machines and VMs picked up the settings with no problems.

The puzzling thing is that we can move the user out of the local admin group into the RD Users group and they can still shut the system down! That is a real predicament as they no longer have admin rights!

We are turning to the Partner based News Groups for the next step. As soon as we know, you will! ;)

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

Mac on SBS - Microsoft Office for Mac 2004 & Parallels Coherence

We just received our Office Standard 2004 for Mac via Open Value licensing.

Integration with pre-2007 version documents and spreadsheets are seamless. Opening and modifying between the PC and Mac versions works well.

I am hoping that the Office for Mac version that is supposed to be shipping sometime later this year or early next year will share the same XML basis for its files as the current Office 2007 for PC. This will make working with files between Mac and PC that much simpler. Given that the PC Office 2003 and Mac Office 2004 versions work well together, I am trusting that we will see the same happen between the PC Office 2007 and Mac Office 2008.

Entourage, the Mac somewhat equivalent to Outlook e-mail client works somewhat okay integrated into our SBS based Exchange environment. It picks up the Inbox setup with the huge number of nested folders as well as the Calendar with the nested Calendars too.

Entourage 2004 is missing a huge chunk of functionality though. :(

• No Exchange based Tasks
• No Exchange based Notes
• No Public Folder shared Tasks or Notes
• Calendar Category functionality is extremely limited (versus Outlook 2003 or 2007)

Because of the timeline between now and when the new Office for Mac 2008 will be released, we may end up with a Parallels based Vista installation running the appropriate Windows based applications in Coherence mode.

I do believe that Parallels Coherence may be the single reason why Microsoft reversed their virtualization licensing intentions for Windows Vista Home editions. About 5 months ago, Microsoft announced that they were considering allowing us to run virtually any version of Vista in a virtualized environment.

Well, that was probably based on the assumption that the Mac user would be flipping back and forth between the Mac and Windows environment. In reality though, this is not the case.

Parallels Coherence is a feature that is identical to one of the new Server 2008 Terminal Services features (was originally SoftGrid on TS 2003): The ability to have an icon on the desktop that a user can click on and "run" an application. In reality, much like a Remote Desktop connection, all they are seeing is a "picture" of the application running. Everything is actually being done on the terminal server somewhere else.

So, the user clicks on the Outlook 2007 icon on their desktop, and up comes "Outlook 2007" seemingly running on Mac's OS X. The user is oblivious to the fact that nested somewhere on their Mac is a Vista environment with Office 2007 actually installed in it! With the Windows Vista environment unseen like that, the writing is on the wall as far as Joe User thinking that they are now running Office 2007 on their Mac.

Thus, we hear recently that Microsoft did an about face on Windows Vista virtualization: Only Vista Business and Ultimate can be virtualized.

On ZDNet: Microsoft flip-flops on Vista virtualization. Mentions the software vendor Parallels specifically.

We downloaded the trial version of Parallels and installed a trial version of Vista Business on it. Next up is adding the Virtualized Vista to our SBS domain with the Office 2007 following. From there we will start playing with Coherence. It is definitely something to look forward to!

Need QuickBooks on a Mac? Heh :D

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

Virtual Server - VSS Service and Virtual Machine Memory Usage

We utilize Microsoft Virtual Server 2005 R2 on a number of different hardware platforms running a number of different operating systems.

One of the curious things that I have noticed is with regards to memory management by the VSS service.

The following is a screen shot of the server's Task Manager Process Tab:


The VSS service is using about 12 MB of physical memory.

The configuration of this particular machine is as follows:

• Intel SR2300 2U
• Two Intel Xeon 2.8 GHz CPUs
• 6 GB ECC PC2700 RAM
• Dual Seagate 76 GB SCA2 SCSI SW RAID 1
• Windows Server 2003 Enterprise with PAE switch

We have loaded up two XP Pro SP2 and two Vista Business virtual machines with both having an allotted 1 GB of system memory.

The above Task Manager shot was taken while all four virtual machines were running. There is no evidence from the service memory usage that they are running.

However, on the Performance Tab, we see the following:


The server has a total of 4.21 GB of RAM allotted to running processes.

So, somewhere in there, the VSS has grabbed the necessary physical RAM and made sure that the respective machines are getting what they need.

To date, other than one glitch with one of the Virtual Vista machines blue screening on a boot up, we have had trouble free performance.

The primary purpose for this platform is to test virtualizing the desktop OS environment to provide our clients with a solid alternative to Terminal Services.

The Microsoft Virtual Server 2005 R2 site.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

Need to familiarize yourself with SBS? Try This --->

Do you have a spare machine around with enough memory and processor speed to install a base OS and Virtual Server on top? If you do, the following assumes a little bit of experience with Virtual Server 2K5 R2 as that is what we run our virtual environments on.

You could run your SBS install stages; install some XP desktops, Vista desktops, and another server or servers if you like within the virtual environment.

You could run the entire project virtually, start to finish, without impacting your production environment. If need be, all operating systems can be Eval versions so as to not impact licensing issues.

Running things virtually requires nothing special in the way of hardware or software.

To get to RWW on the virtual SBS domain via your internal network do the following:

Virtual SBS: Create an internal network accessible only by the workstations and SBS NIC 1. Add a second NIC to the virtual SBS box that is attached to the machine's physical NIC so it can pull an IP from your internal DHCP server.

On your internal DHCP server, create a reservation for the MAC address of the virtual SBS NIC 2.

On your internal DNS server, add an (A) record to the IP address reserved for the virtual SBS server above: virtualsbs.mydomain.local (your domain setup) = IP 192.168.xxx.xxx (your IP subnet)

Run the SBS setup on your virtual server, complete stage 1, post stage 1 install and configure the base installation as you normally would and then continue on with stage 2 for the complete SBS install.

Internet Wizard URL: same as your internal DNS (A) record: virtualsbs.mydomain.local

You will be able to send e-mail from the virtual domain, only SMTP e-mail coming in will not happen if you already have an SBS server, or Exchange server on your internal network. POP3 Connector solution could be implemented here if you want full e-mail functionality on the virtual domain. RWW will be accessible via your Web browser internally: http://virtualsbs.mydomain.local/remote.

Install the workstation OSs. This can be done at the same time as the SBS stage 2 install.

Once you have the SBS install, Premium Tech (if needed), and the ToDo list finished, you can go ahead and create some virtual users and computers and then run through the Add Computer wizard for the XP and/or Vista workstations. This gives you the opportunity to install the SBS/Vista RipCurl! ;)

The above will give you a complete install, start to finish. Mess up? No worries, start again. You will be able to run Eval versions for about 6 months give or take from the install date. This is more than enough time to play with the virtual SBS environment to get comfortable with the look and feel of installing SBS.

You can get SBS 2K3 Premium SP1 Eval on eBay without a problem, and SBS 2K3 Premium R2 Eval by purchasing the R2 Eval pack which is little more than shipping and handling from Microsoft. XP Pro can be had via eBay, as can Office, and others. Vista trial can be had via any Vista RTM media obtained via TechNet, MSDN, or a DVD that came with a system.

This setup also gives you the opportunity to explore Group Policy settings without creating havoc on a production SBS environment. Create and destroy OU's and policies. Learn how to get very granular with the application of your policy settings. No risk of GP tattoos on your virtual desktops ... you can pause the virtual desktops to be hit with the GP before hand and copy the VHD. Save it for later when you want to reverse things. The same is true for the virtual SBS VHD.

Need to figure out how to install software to certain machines via GP? Then this is the place to do it! Office 2003, 2007, Windows Defender for XP, and more can be distributed via GP (Eval and OLP versions for Office).

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

Virtual Vista - Blue Screen STOP 0x000000D1

DRIVER_IRQL_NOT_LESS_OR_EQUAL

I was doing some tweaking on our two virtual Vista Business installations. They were both rebooted at the same time, with one BSOD as above.

The system is a new SR2300 with dual 2.8 GHz. Xeons and 6 GB of RAM. Drives are a pair of Seagate SCSIs mirrored by the host OS.

The funny thing is, the other instance just kept trucking. A "reboot" of the virtual machine allowed the instance to boot with no issues.

There is no virtualization tech on this particular machine. So, there could be any number of reasons why it happened. One is an attempt to hit a spot in memory that was already occupied, another being something with the hardware itself.

Some further testing will be in order. Though, in this case the Vista machines are for testing purposes only. We also have two XP Pro SP2 instances on it that are running quite stable. So, time will tell as we tear Vista apart, and put it back together again!

I like that ability with the virtualized OS: Kill it, then kill it again, then kill it again...As long as my original VHD copy is around, I am good to go!

The machines are virtualized on Microsoft's Virtual Server 2005 R2 Enterprise Edition.

Microsoft's take on it: KB 293077 Error Message: STOP 0x000000D1 DRIVER_IRQL_NOT_LESS_OR_EQUAL.

UPDATE 2009-04-01: The above link is now a dud. Here is a link for a search for the stop error on Microsoft's support site: 0x000000D1 Search.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

Virtual Vista Windows Experience Index

We are testing out Vista in a virtualized environment. The following is the message one will receive if the Assessment is run when connected by TS into the virtual machine:

It won't run. Period.

Vista Business RTM (TechNet) is the version of the operating system installed.

Here is the message one will receive when connected via the Virtual Server Web Console:

There isn't a whole lot out there about this, but I suspect that it has to do with the fact that Vista is running on virtualized hardware.

Not a big deal, just an interesting quirk.

Happy Vista Virtualizing!

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists