Friday, 2 August 2013

Exchange Transport TLS Certificate Expiry Warnings and/or Errors

For those that have been supporting SBS Standard for a number of years now will be finding that Exchange Self-Issued certificates are expiring.

One self-issued certificate, and note that it seems to be independent of the SBS Third Party Trusted Certificates Wizard, is used for Transport Layer Security (TLS).

    MSExchangeTransport

    Event Details:   

    There is no valid SMTP Transport Layer Security (TLS) certificate for the FQDN of SBS.DOMAIN.local. The existing certificate for that FQDN has expired. The continued use of that FQDN will cause mail flow problems. A new certificate that contains the FQDN of SBS.DOMAIN.local should be installed on this server as soon as possible. You can create a new certificate by using the New-ExchangeCertificate task.

The domain listed in the error is the key to figuring out which Thumbprint we need.

  • Open Exchange PowerShell (Run As Admin)
  • Get-ExchangeCertificate | Select CertificateDomains,Thumbprint,Status,Services | fl

The resulting list will post all certificates installed in the Personal Store on that server. Note the certificate with an INVALID status that points to SERVER.DOMAIN.LOCAL.

Copy the GUID and paste it into the following command:

  • Get-ExchangeCertificate –Thumbprint GUIDHere | New-ExchangeCertificate

At the prompt to replace the existing certificate answer Yes.

The expired certificate should now be replaced and Exchange Transport will continue on.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer

Wednesday, 31 July 2013

Blackhat 2013 – NSA General Alexander’s Keynote

The director of the NSA, General Alexander, gave a keynote address at the Blackhat conference.

Mark Maunder gives a good overview of the speech along with his thoughts around it.

The blog post is a good read and a link to an audio recording of the speech is at the bottom of the post.

But in all seriousness, headlines seen lately that the latest leaks are hurting US based Cloud businesses should be expected. Not only that, but folks need to keep in mind that pretty much all countries have some sort of monitoring agency or agencies in place.

So, again the question is begged: Who owns the data and has access to it the moment it leaves the on-premises setup?

EDIT: Hat Tip: Susan Bradley

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer

Friday, 19 July 2013

Too Cute For Friday :)

We have a few additions to the “family”.

WP_20130713_005

They are now about 2 weeks old and we are really enjoying having them around.

All I can say is four kittens is good therapy! :D

Have a great weekend and thanks for reading.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer

Some Thoughts on the Need for a Physical DC for Windows Server 2012 Hyper-V Clusters

Introduced in Windows Server 2012 was the ability to cold-boot a Hyper-V cluster without a DC present outside of the cluster setup.

One still needs Active Directory up and running _prior_ to standing up a new cluster in a greenfield deployment but that is pretty much the only “requirement” as far as DCs and clusters go.

The above KB tells us that we can make an exception in that greenfield setup to actually DCPromo _all_ of the nodes prior to standing up the cluster. Then we have our AD and are good to go so to speak.

We, however, prefer to have a standalone DC in place prior to running a greenfield cluster setup or introduce a new physical server box with Windows Server Standard that will be DCPromod into the existing domain and remain after the existing server systems are retired.

Why do we do this?

  • A separate/independent DC is needed for standing up a new cluster.
    • We don’t support the idea of running a DCPromo on all of the nodes in a new cluster and then backing them out afterwards.
  • DNS is absolutely critical when working on a cluster in a recovery/systems down situation.
    • No DNS can mean no RSAT management of the nodes.
  • AD can be needed for authentication purposes when making changes on the nodes.
    • We don’t log into the nodes very often. So, in a setting where domain admin credentials change on a somewhat regular basis we could be locked out.
  • Constrained Delegation for access to resources hosted elsewhere on the network can break without a live DC.
    • No access to that recovery ISO that we needed yesterday. :(
  • A physical DC is needed for high load VMs where timing gets skewed****.

For the cost of a small server and a Windows Server Standard license we can avoid so many headaches in the event that something goes wrong and we need to go into troubleshooting and recovery mode with our cluster.

Depending on the situation one can also build a fairly robust server configuration for that independent DC with a lot of storage. This is our preference where our cluster storage is fairly close to 100% utilized with dedicated LUNs for those VHD/VHDX files.

Then, if we run into a situation where an admin accidentally snapshots something and the VM goes Paused-Critical (previous blog post) we have some free storage to combine the AVHD and VHD files.

Keep in mind that we are talking about a two, three, or four node cluster running in a smaller setting where there may not be any other DCs present beyond the main office.

If there are branch offices with a local domain controller present one needs to carefully evaluate as to whether that standalone DC in the main office should be left out of the picture. Even in this type of situation we prefer to have an independent DC in the main office.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer

Thursday, 11 July 2013

Server Core: PowerShell Install-WindowsFeature RSAT-Clustering Seems to Hang at 68%

On a Windows Server 2012 Core deploy we ran the following command:

  • Install-WindowsFeature RSAT-Clustering

And we saw the following for a _long_ time!

image

The “Start Installation...” line kept blinking on and off all during the time it seemed to be stuck.

With a little bit of patience we eventually saw the following result:

image

The entire process took about 15-20 minutes.

So, be patient. ;)

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer

Monday, 8 July 2013

Things are Cloudy: Some Monday Morning Cloud Reading and Thoughts on Trust

Here are a few interesting articles that paint some reality on the ongoing Cloud picture.

Both articles are a good read and provide some insight into company’s perspectives on being in the Cloud and Microsoft’s vision for the Cloud.

BTW, what exactly is meant by an “update” anyway? We are not too sure on that one.

Conflicting Messages for SMB IT

Now, the kicker that really brings about the meaning of the word “irony” is in this quote from the Business Week article.

The Office unit says packaged releases will still be available to users who are resistant to Office 365 and its frequent updates, but most of the team’s energy will be focused online. “Microsoft has an established history and trust with customers [emphasis ours],” says Pisoni. “So far those who are hesitant about going to the cloud, they’re willing to put their trust in Microsoft. No other competitor—Google, Box—has that established trust.” Raman Padmanabhan, chief information officer for Xerox’s (XRX) business services unit, has been briefed on Microsoft’s move to faster updates and says he supports the shift as long as the product is good. “It’s all about service and quality,” he says. “You have to have a certain quality or it just kills your business.”

How many of us in SMB have been banging our heads against the wall, so to speak, trying to make the message clear that in SMB IT it is the face-to-face time and relationship trust that we build up with our clients that are keys to both business’s success?

The business relationship and trust have always been, and will always be, the foundation to our way of doing business.

The Cloud Message and many of the Cloud Prophets have been trying to blow that off for SMB IT for the last three or four years now and yet here we have it straight from Microsoft. _Trust_ is the foundation for moving forward.

Yes, there is a little bit of frustration here and it may show so our apologies for that. :S

But, at least it is good to see in print that our own SMB IT way of doing things is confirmed, though not directly. :)

As time goes on we shall see how all things play out.

From this arm chair it looks like Microsoft is in the process of slaughtering their cash cows and diving in for the lowest common denominator ... which in the end means that they will be on the same, and level, playing field as the other Cloud Vendors.

IMNSHO, this is _not_ a good place for Microsoft to go.

Most especially because a huge chunk of the Microsoft Partner base, that is those of us IT Providers in SMB, is being stepped on to get to wherever Microsoft’s current Cloudy Vision is leading them.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer

Saturday, 6 July 2013

Updating the Intel Modular Server from v6.5 to v6.8 Involves Taking the Storage Controllers Offline

We are in the process of updating the firmware on our Intel Modular Server from v6.5 to v6.8 on our way up to v6.10.

When we uploaded the file using Modular Server Control (MSC) we came to the point where the firmware would not go any further before we reset the Storage Controllers into Safe Mode.

image

The process of flipping the two Storage Controllers into Safe Mode takes about five to ten minutes with a few CONFIRM steps required.

Once they are offline, we are able to move on with our firmware updates:

image

Given that storage is offline this particular update will need to be run after hours. A backup is mandatory for any servers whether physical or virtual prior to running this update (we only back up the guests in the case of a Hyper-V Failover Cluster).

image

IE10 is a waste of time. IE9 in Compatibility Mode with the MSC in Trusted Sites will work for the most part. Third Party browser may be the best option for this process.

Note that the IMS will go into Limp Mode once the first SCM goes offline. That means that hearing protection should be worn during the process.

image

The update process can take anywhere from 40 to 60 minutes to complete. Please budget time for this process accordingly.

Intel Modular Server Support:

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer

Saturday, 29 June 2013

A Storage Spaces and Hyper-V Cluster Lab Guide

Here is a good start for a lab environment:

A set of DAS JBOD units can used with two small nodes and 2 SAS based HBAs per node to stand up a Storage Spaces cluster using the Server 2012 R2 bits. A couple of MicroServer Gen8 boxes would round out the Hyper-V side of it.

On this blog there are a lot of configurations discussed that utilize intelligent direct attached storage.

  • Basic setup
    • Intel Server System SR1695GPRX2AC pair with Promise VTrak E610sD or E310sD
    • This category search on the blog has a number of really good posts including configuration examples based on the SR1695GPRX2AC (blog category link)
      • This server unit has been our go-to for base configurations as it is an excellent and flexible platform
  • Advanced setup
    • Intel Server System R2208GZ4GC pair with the Promise VTrak E610sD or E310sD
  • All-Out Setup
    • All of the above plus LSI SAS 6160 Switch pair and Intel Modular Server with 3 nodes.

In the above setups the key is the intelligent storage providing mitigation services to the SAS HBAs and OS access to the central storage.

With the 2012 R2 bits we are going to put together a redundant JBOD setup for a Storage Spaces cluster. This is the next direction we are delving into as we can put together a small SS cluster for a very reasonable cost.

Today, we are working on the following (similar to David Ziembicki’s setup) setup for clustered Storage Spaces:

  • Basic
    • Intel Server System R1208JP4OC with pair of SAS HBAs (RS25GB008) (2 nodes)
      • 32GB of ECC per node to start
    • Intel Storage System JBOD2224S2D2 JBOD2224S2DP Intel JBOD units (2 units)
      • JBOD is dual expander and dual port backplane
      • Seagate Savvio SAS drives are dual port
    • 1m SAS Cables (4)
    • Windows Server 2012 R2 beta – Storage Spaces Cluster Setup
    • Intel Server System R2208GZ4GC pair for Hyper-V nodes (we have had these in our lab for a year or so now).
      • 64GB to 128GB of ECC
    • Windows Server 2012 R2 beta or RTM – Hyper-V Nodes
  • Advanced
    • Add a pair of 8-Port or 12-Port NETGEAR 10Gbit Ethernet switches
      • Ports on each NIC would be split between switches for redundancy
    • Add a pair of Dual-Port 10Gbit PCIe and/or I/O Module NICs to each node
      • 10Gbit Ethernet would SMBv3 Storage Spaces located VHDX
      • 10Gbit Ethernet would be for Live Migration Network
    • LSI SAS Switches (we have a pair of these in our lab setting)
    • Additional Intel JBOD units to test switches and scaling storage out

Using David Ziembicki’s setup though one would be able to start at the base level and put together a similar configuration on a budget.

An HP MicroServer Gen8 would make an excellent platform for testing as they are relatively inexpensive and have pretty close to the full Intel virtualization Acceleration feature set.

Note that the Sans Digital MS28X listed in his blog post splits drives 0-3 and 4-7 between the two available external SAS connections. That means that there is no ability to use this storage unit without an LSI SAS 6160 Switch pair (Sans Digital MS28X Quick Installation Guide PDF)!

However, the Sans Digital MS8X6 unit does support redundancy and therefore they could be used to test Storage Spaces clustering configurations (Sans Digital MS8X6 Quick Installation Guide PDF).

Of course, for the added functionality there will be an extra cost involved, however one could drop the LSI SAS Switch for a set of these units for about the cost of the original MS28X plus SAS Switch!

  • Storage Spaces Cluster
    • Storage Spaces Node
      • Intel Xeon E3-1230
      • Intel Server Board S1200BTLSH
      • 16GB ECC
      • Intel Integrated RAID RMS2AF040
      • 120GB Intel 320 Series SSD (or small 10K SAS) RAID 1 pair for host OS
      • Quad-Port Intel Gigabit Server NIC PCIe
      • Intel certified chassis (whether Intel or other)
    • Storage
      • Sans Digital MS8X6
        • 300GB 15K 3.5" SAS drives can be found for a good deal today
    • Hyper-V Node
      • Intel Xeon E3-1230
      • Intel Server Board S1200BTLSH
      • 32GB ECC
      • Intel Integrated RAID RMS2AF040
      • 120GB Intel 320 Series SSD (or small 10K SAS) RAID 1 pair for host OS
      • Quad-Port Intel Gigabit Server NIC PCIe
      • Intel certified chassis (whether Intel or other)
    • OPTIONS
      • Add Intel RMM4 for full KVM over IP
      • Add Dual-Port 10Gbit Intel Ethernet for SMBv3 and Live Migration Networks
      • Add Intel Storage Systems JBOD2224S2DP at a later date for full SAS Dual Port Redundancy

There are so many different ways to go about this.

The main thing is to start small and work one’s way up to a full scale server grade lab as the jobs come in! That’s how we built our own lab systems up and how we built up the knowledgebase and experience!

EDIT: Oops, Star Wars on the mind. Intel Storage Systems part number should be JBOD2224S2DP (I had JBOD2224S2D2 above!). :)

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer

Friday, 28 June 2013

Some Early Morning, Well Okay it's Early Here, Secure Browsing Related Reading

After posting about the Flash Cache clearing that we usually do via the online control panel we thought it would be a good idea to post some reading on safe browsing habits in general.

Security MVP Harry Waldron obliged a request for pointers with the following blog posts:

The following are pointers for Microsoft properties:

The following article has some excellent tips on social networking:

Have a great long weekend for those of us celebrating Canada Day Weekend and have a great Independence Day celebration/break next week to our US readers!

Thanks for reading. :)

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer

Wednesday, 26 June 2013

Adobe Flash Player Cache Management

It’s always been a bit strange that we need to go to a third party site in order to manage content on a local computer.

image

Using that control panel we are able to see just what kind of things have been happening, at least to some degree, via the Adobe Flash plugin.

Besides that, there is Start –> Internet Options and DELETE to remove history.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer

Tuesday, 25 June 2013

SMBKitchen: Just Released: Hyper-V Cluster Configuration Considerations

This chapter, just released to the SMBKitchen Project’s knowledgebase, is jam packed with pearls that were the result of _months_ of trial and error plus sifting through all of the very incomplete and lacking vendor documentation.

image

Covered are all of the key elements required for setting up a Hyper-V Cluster on the Intel Modular Server with or without Direct Attached Storage via two SAS Controllers.

Also covered are the key elements required for setting up a cluster on a two or more node setup that utilize SAS based DAS intelligent storage. This configuration is the one we have been running with and is now our main focus as the Intel Modular Server has been retired.

image

This document covers a lot of different areas including node configuration, storage, networking, and more.

Cluster for highly available virtual machines, and now that we have the 2012 R2 bits, for Storage Spaces are an important part of our SMB business strategy going forward into the On-Premises and Hybrid future.

Coming soon for the SMBKitchen project will be a series of How-To videos on everything from teaming in Windows Server 2012 via PowerShell to configuring RemoteFX. There are plans to do cluster How-To videos as well.

Tie that into the author’s chats we have once a month that give subscribers front-line access to the authors and I am sure that we are providing great value for the subscription dollars! :)

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer

Monday, 24 June 2013

SMBKitchen: Author's Chat in 10 Minutes!

Hello SMBKitchen subscribers!

We have an author's chat in 10 minutes.

Let's discuss my new Hyper-V Hardware Configuration Guide and my upcoming Hyper-V Cluster Considerations document (in final review – pending Amy's vacation return!).

This particular monthly chat is available to subscribers only. :)

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer

Tuesday, 18 June 2013

Channelpro SMB Magazine Cover and Article

Now, just who is that on the cover of Channelpro SMB Magazine eh? :D

image

Thanks to Stephanie Cragg Corporate for an awesome photo shoot and the fantastic pictures.

My article can be found on pages 30/31 in the online magazine and gives a good run-down of the history of our company, where I’ve been in our industry, and the principles involved in building our company.

Mainly, I believe the best part of our SMB focused IT is the amazing people we have the privilege to work with.

And going forward, I believe that will not change. Through all of the changes that are happening today in our industry the key in SMB will _always_ be the people that provide awesome solutions for their clients and most especially their _clients_ that recognize the value they receive in their IT.

Thanks for reading! :)

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer

Wednesday, 12 June 2013

Looking Cloudy: Can't get in to any Microsoft property :(

My Microsoft ID is set to expire the password every 72 days.

image

Okay, so the warning came through that the password has expired. But, no matter what I try I can't seem to get anywhere to change it:

image

Something went wrong and we can't sign you in right now.

Please try again later.

Fortunately the data I'm after is located locally in my SkyDrive folder. But, changes made on other systems also connected to that folder will not happen until something gets straightened out and I am allowed to change the password!

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer

SMBKitchen: My Hyper-V Configuration Guide Is Released!

I'm very excited to announce that my Hyper-V Configuration Guide has been released to the SMBKitchen Project's knowledgebase!
image
I walk through a number of critical areas in this guide relative to deploying a properly sized Hyper-V virtualization solution.
  • Questions to ask the client
    • Verticals they serve, software products used, data volume and growth
  • Various solution grades
    • Entry, mainstream/mid-level, and high performance configurations
  • Needs analysis
    • Find the top five key pain points for the prospect/client
  • Hardware
    • Bottlenecks in the system and how to address them
    • CPU and Memory
  • Client types
    • 10 seat accounting firm
    • 35 seat architectural/engineering firm
    • 55 seat manufacturing client
  • Each client type gets a number of options made available. Each option is explained with highlights of what they provide value for the client/prospect.
    I believe this chapter in the SMBKitchen solution kit will be well worth your time.
    And, when it comes time for the next Author's Chat subscribers will have the chance to discuss and ask questions about the many points in this article!
    Soon to come: Hyper- V Cluster Configuration Considerations
    image
    This document is composed of the pearls born of many a month of painstaking sifting through vendor's documentation tied into much trial and error. :)
    Our blog article on How to Subscribe to the SMBKitchen.
    Philip Elder
    MPECS Inc.
    Microsoft Small Business Specialists
    Co-Author: SBS 2008 Blueprint Book
    Chef de partie in the SMBKitchen
    Find out more at
    www.thirdtier.net/enterprise-solutions-for-small-business/
    Windows Live Writer