Jens Jönsson

How to create your own selfsigned SSL UCC SAN Certificate to use with Exchange 2007/2010

2010-03-04T08:10:00Z

If you don't want to spend money on a SSL SAN UCC certificate you can create a selfsigned SAN certificate yourself by following this guide from Microsoft: http://support.microsoft.com/kb/931351. The guide will work for both Windows 2003 and 2008/2008 R2.

To enable UCC SAN certificates on Windows 2008/2008 R2 Certificate server run the following commands from a command prompt (Remember to run the command prompt "As Administrator"):

certutil –setreg policy\SubjectAltName enabled
certutil –setreg policy\SubjectAltName2 enabled
net stop certsvc
net start certsvc

On Windows 2008 Server you can't use Webenrollment if you have installed your Certificate Server as a Stand-alone CA, so I haven't tried the web way. Instead I have created the request.inf file as stated in the link above and used the certreq.exe program from the command line (I followed the guide "How to use the Certreq.exe utility to create and submit a certificate request that includes a SAN").

It's important that you omit the line "EncipherOnly = FALSE" in the request.inf file (Put a semicolon ; in front of the line to omit it) or else it will fail on Server 2008 with the following error:

Certificate Request Processor: The data is invalid. 0x8007000d (WIN32: 13)
request.inf([NewRequest] EncipherOnly = "FALSE")

The domains/hosts you want listed on the SAN attribute in the certificate must be added to the line:

SAN="dns=.fabrikam.com&dns=ldap.fabrikam.com"

My request.inf file looks like the following:

[Version]

Signature="$Windows NT$

[NewRequest]
Subject = "CN=EXCHANGE.internaldomain.local" ; must be the FQDN of domain controller
;EncipherOnly = FALSE
Exportable = TRUE ; TRUE = Private key is exportable
KeyLength = 2048    ; Common key sizes: 512, 1024, 2048,
     ;    4096, 8192, 16384
KeySpec = 1             ; Key Exchange
KeyUsage = 0xA0     ; Digital Signature, Key Encipherment
MachineKeySet = True
ProviderName = "Microsoft RSA SChannel Cryptographic Provider"
ProviderType = 12
RequestType = CMC

; Omit entire section if CA is an enterprise CA
[EnhancedKeyUsageExtension]
OID=1.3.6.1.5.5.7.3.1 ; Server Authentication

[RequestAttributes]
;CertificateTemplate = WebServer ;Omit line if CA is a stand-alone CA
SAN="dns=mail.externaldomain.tld&dns=autodiscover.externaldomain.tld&dns=externaldomain.tld"

Please notice that I have omitted the line: CertificateTemplate = WebServer because I have only installed a Stand-alone CA, not a Enterprise CA.

The external domain names for a Exchange setup is normally: owa.domain.tld, autodiscover.domain.tld and mail.domain.tld. Remember to include both internal and external domain names in the SAN attribute if you use both.

A selfsigned certificate will fail if root certificate is not trusted. You therefor have to copy your root certificate from your CA to your PC, mobilphone, Smartphone etc. On your Windows XP/Vista/7 computer Import it to the Trusted Root Certification Authorities store on your computer account.

Need to update BIOS, BMC firmware etc. but no floppy drive in the server ?

2010-01-21T20:11:00Z

Often BIOS and other firmware upgrade tools are still in good old DOS format. So to update your server you need to create a floppy disk with the files to boot from, but to what need when your server doesn't have a floppy drive ?

The solution is to boot from a USB stick and here's how to make one easily:

1) Download Unetbootin and run it!

2) Choose "FreeDOS" from the "Distribution" menu.

3) Insert your formatted USB stick

4) Click "OK" to make your bootable USB stick with FreeDOS

5) Copy your BIOS update software and BIOS files to the USB stick.

6) Boot your server and remember to choose to boot from USB in the boot menu...

7) Update your BIOS !

Done!

Convert from .VHD to .VMDK or vice versa

2010-01-21T20:05:00Z

I found this nice free tool the other day and would like to share it with you! It can convert .VHD to .VMDK and vice versa. Migrate from local storage to shared storage etc.

http://www.starwindsoftware.com/converter

Enjoy!

Missing default gateway on Windows 2008 server deployed from template in VMWare vCenter

2009-11-10T16:16:00Z

Sometimes it happens that the default gateway IP-address is missing when using static IP-addressing on a Windows 2008 and Windows 2008 R2 server and it's deployed from a template in vCenter.

To fix this run REGEDIT and browse to:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]

HKEY_LOCAL_MACHINE
     \SYSTEM
          \CurrentControlSet
               \Services
                    \Tcpip
                         \Interfaces
                            \<Interface GUID ex: {87272408-3736-4F1F-BA27-07C452A8370C}>

If you click on the registry setting "DefaultGateway" you'll see that a extra linie is added.

Delete the extra linie and close regedit. Reboot and done :-)

How to apply a patch to Windows 2008 Server Core

2009-08-28T06:38:00Z

To install a patch on Windows 2008 Server Core run the following command:

wusa.exe <name of patch.msu> /quiet /norestart

As you may figure out, you have to download the patch from another computer as a Server Core does not include Internet Explorer :-)

.MSU is the new name for Vista/7/2008 patches.

Cannot deploy template: Number of virtual devices exceeds the maximum for a given controller (VMWare ESX vCenter)

2009-08-03T13:16:00Z

If you get this error when trying to deploy a virtual machine from a template, it could be because you have changed the name of the virtual machine network, ie. from "VM Network" to something else.

To fix it, do the following:

Convert template to virtual machine.
Edit settings of virtual machine.
Choose correct network for template (it probably shows no name)
Convert virtual machine to template
Try to deploy new virtual machine from template to see if it works correct again.

Install OS from USB drive

2009-07-28T13:44:00Z

If you need to install a computer/server fast, use a USB drive. It's very easy and if the USB drive is large enough you can also add drivers/programs.

This nice utility does the work for you if you want to install Windows Vista/7/2008. Just feed it with a USB drive minimum 4 Gb and the ISO file: http://www.askvg.com/a-bootable-usb-utility-to-create-bootable-usb-drive-to-install-windows-vista-server-2008-and-7/.

If you want to install VMWare ESX v4.0 from USB, try this utility: http://unetbootin.sourceforge.net/ I think that this can also be used for the different versions of Windows, but I haven't tried it yet. To install VMWare ESX when you have booted from the USB drive, press TAB in the first menu, when you're presented with the different install options. This brings up the standard line of install options to pass into the kernel. Add ASKMEDIA to the end of the line and press ENTER to start the installation.

Remember to choose to boot from USB (This is done in the BIOS).

Install VMWare vCenter4 (vSphere) on Windows 2008 SP2 x64 with SQL database on separate server

2009-07-28T09:43:00Z

It's possible to install and run vCenter4 (vSphere) on Windows 2008 Server 64-bit (x64) when placing the vCenter database on separate SQL server. (Normal install is with local SQL Express 2005 database).

Create the vCenter database manually on the separate SQL server. You can call the database VIM4_DB or whatever you like. If you upgrade from vCenter v2.5 you can use the same database. (I prefer new clean database).

You have to create a 32 bit System DSN for vCenter to connect to the database. To do this, install the SQL Native Client (download the x64 version here: http://download.microsoft.com/download/4/4/D/44DBDE61-B385-4FC2-A67D-48053B8F9FAD/sqlncli_x64.msi)

Go to Start / Run. Type %windir%\SysWOW64\odbcad32.exe and click OK to run the 32 bit ODBC Data Source Administrator. Now go to System DSN tab and click Add. Choose "SQL Server Native Client" and click Finish.

Now you're ready to configure the connection to your newly created SQL database on your separate SQL server.

Start installation of vCenter4 and point to your newly created 32 Bit System DSN.

Remember to activate VSS (Volume Shadow Copy) support in VMWare tools for correct point-in-time backup

2009-06-19T08:38:00Z

If you're taking backup of running virtual machine with VCB or backup software like VEEAM's Backup, you can enable VSS support to take correct backup of data from applications like MS SQL, MS Exchange etc.

On the virtual machine you want to have VSS support goto Control Panel / Add or Remove programs.

Choose to "Change" settings for VMWare tools.

Click next to "Modify" settings for WMWare Tools

Enable "Volume Shadow Copy Services Support" and click next. When finished you have to reboot your VM.

Now you're able to make point-in-time backup of your running VM's....

If you want to read more about Volume Shadow Copy follow this link: http://technet.microsoft.com/en-us/library/cc738819(WS.10).aspx

VGA settings in Windows 2008 Server Core with VMWare tools installed

2009-05-23T13:32:00Z

When you have installed WMWare tools in your Windows 2008 Server Core running as a VM on your VMWare ESX system (See my guide how to here!), you can change resolution and fine tune VGA settings by following this guide (Yeah, I know it's not a installation with a GUI !):

From your Server Core command prompt start regedit by typing: REGEDIT
Browse to the following key: HKLM\System\CurrentControlSet\Control\Video
You should see some subkeys named by GUID. Browse to the 0000 subkey of the one with the 0000\Volatilesettings subkey (There should be only one containing the subkey VolatileSettings).
Here you find records for resolution (DefaultSettings.XResolution and DefaltSettings.YResolution) and colordepth (DefaultSettings.BitsPerPel). Change these according to the settings you want, remember to choose decimal value.
Remember to change the record Acceleration.Level to 0. This is the same as Display Settings / Advanced Settings / Troubleshoot / Change Settings / Hardware Acceleration = Full.
To use the settings logoff. You can use the command: shutdown /l (lowercase L)

Enjoy your new settings!

How to install VMWare Tools in Windows 2008 Server Core

2009-05-23T12:15:00Z

If you're running Windows 2008 Server Core on your VMWare ESX system you also need to install VMWare tools as this upgrades drivers etc.

Here's how I did it:

Log in to your Windows 2008 Server Core virtual machine using the administrator account
From your VI client right click the virtual machine and choose: "Install/Upgrade VMWare tools". This will mount the VMWare tools CD in your virtual machine.
From the command line in your VM switch to the CD-drive (D: or what ever drive letter the CD is mounted as).
Run the following command: msiexec /i "d:\VMware Tools.msi" (Remember to substitute d: with correct drive letter)
Click "Next" to start installation
Choose "Typical" and click "Next"
Click "Install" to start installation
Click "OK" when the warning about old Internet Explorer appears
Click "Finish" to finish installation
Click "Yes" to reboot

It's important not to choose any other installation type than "Typical" as the installation will fail....

Another way to mount the VMWare Tools CD is to edit settings for the VM. Under "CD/DVD drive 1", click on "Connected" in "Device Status" and click on "Datastore ISO file" in "Device Type". Browse to local datastore/tools-isoimages and choose the "Windows.iso" file as this contains VMWare tools.

Update:

On vSphere (ESX v4.0) the 32 bit version of the tools are named: VMware Tools.msi 64 bit version of the tools are named: VMware Tools64.msi

Check your VMWare ESX v3.x configuration with free Tripwire ConfigCheck utility

2009-03-05T13:49:00Z

With this free utility you can check your VMWare ESX v3.x server configuration. Both configuration and security settings according to VMware Infrastructure 3 Security Hardening guidelines.

Download it for free here: http://www.tripwire.com/configcheck/

Remember to upgrade your Citrix XenApp (former Presentation Server) v4.5 license server after applying Hotfix Rollup Pack 3

2009-01-29T09:41:00Z

After patching all my Citrix XenApp (Presentation Server) v4.5 Servers with the Hotfix Rollup Pack 3 I ended up with no users able to logon.

The following was logged in the Application Eventlog:

Source: RADEEvents EventID: 3015

Description: Streaming License: Your version of the license server on <SERVER> is older than the version of the Citrix server. Please upgrade your license server or specify a license server location with the correct version.

The following was logged in the System Eventlog:

Source: MetaFrame EventID: 9017

Description: This computer running Citrix Presentation Server will now stop accepting connections. This server is no longer in or could not enter a licensing grace period.

Also clients got this error message when trying to logon:

Citrix Presentation Server license aquisition error (500): Unable to acquire a license from (SERVER) server. Please contact your system administrator or open Event Viewer for more details.

The solution is to upgrade the license server to newest version. It can be downloaded from here: http://www.citrix.com/English/ss/downloads/details.asp?downloadId=1681211&productId=186

My green >4 Tb NAS project with iSCSI and NFS support

2009-01-22T10:54:00Z

One of my goals this spring is to become a VMWare Certified Professional (VCP). Instead of only reading books, hands on experience is always a good thing. So I decided to setup my own studying lab. To that I needed some shared storage so I can play with VMotion and all the other cool stuff you can do with shared storage, and since my purse and bank advisor agreed that it could not become a SAN with 15 k FC SAS disks, etc. I had to come up with something else.

My idea was to make my own NAS with iSCSI and NFS support. And it should be green, but also fast, so I bought these components after surfing the net for ideas:

1 pcs. VIA VB8001 Mini-ITX Board because of the 1 GbE Nic and one free PCIe slot and of course because it's green.

2 pcs. 2 Gb RAM modules (4 Gb total)

1 pcs. Adaptec RAID 3805 controller for SATA disks (Supporting up to 8 direct attached drives or 128 drives with SAS expander: Enough for future needs...)

6 pcs. Western Digital WD10EACS SATA disk drives.

This gives me a NAS with a total of 6 Tb diskspace and plenty of room for my Virtual Machines to play with

The software I'm using for my NAS is OpenFiler. Not the easiest to get to work when, like me, you're not an expert on Linux partitioning.

After some time of playing I decided to go for a RAID 6 setup. This way 2 disks must fail before things get critical and I don't want to wait for drive to rebuild (especially on those large drives) if I have to test something and a drive has failed. I have heard that RAID 6 would be slow, so I was of course also curious to see if that was true...

When I'm finished studying I'm going to use this NAS primarily for music, movies, pictures and the like. To that use I think RAID 5 will be sufficient, giving me some more space than with RAID 6....

At the moment my Study LAN is only running 100 Mbit/s because of the switch. But I must say that speed is above all expectations when running my Virtual Machines from the iSCSI storage on the NAS. So I look forward to my new 1 Gbit/s switch (of course with VLAN so I can separate iSCSI network from LAN network), which should only make things even faster.....

When heavy loaded the system consumes about 100 watt power....

When I get my new case for this system I'll add some pictures for you...

Get help to allocate resources for your virtual servers without impacting performance

2009-01-14T10:17:00Z

The company VKernel has created a cool new community website to help allocating the right resources for your VM's. They call it CompareMyVM... Check it out here: http://www.comparemyvm.com/

I think it's pretty cool.... Thumbs up to the guys at VKernel