RZM – Page 3 – ZM's Information Technology & Life Blog

15 Jun 2015 Monday

Migration DHCP Server from Windows 2008 to Windows 2012

For years this has been a tedious task when it came to moving the DHCP server role. In most case this involved manually creating all subnets, IP reservation, Server option etc. and only the DHCP lease database could be copied over. With Windows Server 2012 Microsoft has addressed the issue and in the spirit of their new approach it has implement some cmdlet in PowerShell to do this rather painless. Depending on your environment you could get away with 4 simple steps, provided you have a Windows 2012 Server with the DCHP role installed ready.

Export ALL setting including DCHP lease from the old Windows 2008 Server
Shutdown down (and disable automatic startup for the service) the DHCP Server
Import the setting into the new DHCP server
Authenticate and start DHCP Server on the Windows 2012 Server

This can take less than two minutes and you are done and ensures you haven’t missed anything either.

PowerShell Export command line (Make sure the directories used exisit):
[codesyntax lang=”powershell”]

Export-DhcpServer -ComputerName ServerName.Old -Leases -File c:\export\dchp.xml -verbose

[/codesyntax]
PowerShell Import command line:
[codesyntax lang=”powershell”]

Import-DhcpServer -ComputerName ServerName.New -Leases -file c:\export\dchp.xml -BackupPath c:\dhcp\backup\ -Verbose

[/codesyntax]

The above are just same plain examples for the syntax. Feel free to explore the cmdlet, i.e. export only the server setting if you plan to set up a second DHCP server to explore the new replication feature that was introduced with Windows Server 2012.

Last but not least, depending on your environment, you may have to update the servers and/or network equipment with the IP/Name of your new DHCP server. Examples are Cisco’s Wireless LAN controllers and Cisco router/switches using IP helper-address to point clients to a remote DHCP server. It might be worth noting that multiple IP helper-addresses per Interface are possible. It might be advisable to have the Cisco router/switch amended before the actual migration.

By RZM 0 Comments

30 Mar 2015 Monday

Hyper-V Cluster-Aware Updating (CAU) Windows 2012R2

One of the great new features in Hyper-V with Windows Server 2012 is Cluster-Aware Updating (CAU). Microsoft have made it easy to enable this feature by providing a wizard that will guide you through the setup. The wizard is accessible either via the Server Manager or the Hyper-V console. It’s recommended to check the first check box, enabling the self-updating mode, because that’s what it is all about. The second option is somehow tricky and misleading. “You domain or IT policies might require you to prestage …”. In most environment you will need to make some changes to the security settings to the OU where the cluster node objects reside.

If you don’t, you may assume the the wizard will take care of this, everything will look fine but the at the end the wizard never returns and you will end up with an error message in you Failover cluster log. The wizard will try to create the required CAU computer object in the same OU where the cluster computer object resides. In order for the wizard to be able to create those the security setting for that OU need to be changed to give Full Control to the cluster object.

Once this is done click on Next and move to the Self-updating Schedule. When setting up the schedule it might be a good idea to take Microsoft monthly patch day into consideration.

Under Advanced Option you will have the opportunity to fine tune the actually upgrade process including time-outs and post and PreUpdate scripts.

The last screen just provides an overview of the option chosen as well as the PowerShell script that will be run, which might be handy if you have enable CAU on more than one cluster.

Here is the script:

[codesyntax lang=”powershell”]

Add-CauClusterRole -ClusterName GLL-CLT-01 -Force -CauPluginName Microsoft.WindowsUpdatePlugin -MaxRetriesPerNode 3 -CauPluginArguments @{ 'IncludeRecommendedUpdates' = 'True' } -StartDate "27/03/2015 03:00:00" -DaysOfWeek 1 -WeeksOfMonth @(3) -EnableFirewallRules;

[/codesyntax]

If everything work you will get the confirmation screen after less than a minute. If you look back at the OU mentioned earlier on you will find the additional computer object that have been created now.

By RZM 0 Comments

17 Feb 2015 Tuesday

Cisco ISO 15.x – Warning: The cli will be deprecated soon

While setting up authentication on a new Cisco 2960G-X switch I kept getting the following warning when booting up.


Warning: The cli will be deprecated soon
'tacacs-server host 10.60.21.114 timeout 5'
Please move to 'tacacs server <name>' CLI

Press RETURN to get started!

After some research it turn out the switch was running IOS 15.02 and the syntax has changed. The following steps will remove the warning and apply the correct syntax going forward.


Switch#conf t
Switch(config)#no tacacs-server host x.x.x.x timeout 5
Switch(config)#no tacacs-server key 7 047B08055C2D401D070D
Switch(config)#Radius Server TACAS-SERVER
Switch(config-radius-server)#address ipv4 x.x.x.x
Switch(config-radius-server)#key 7 047B08055C2D401D070D
Switch(config-radius-server)#exit
Switch(config)#exit
Switch5#

The config will look like this:


!
radius server TACAS-SERVER
address ipv4 x.x.x.x auth-port 1645 acct-port 1646
key 7 047B08055C2D401D070D
!

It might we worthwhile verifying that you have …

aaa new-model

… in your configuration as well.

By RZM 0 Comments

11 Feb 2015 Wednesday

Use PowerShell to check for installed .NET Framework Version

As part of an application upgrade we had to check all of our Domain Controllers for the .NET Framework version installed as we had a minimum requirement. Rather than logging into each server a Powershell script can be used to remote do the check and record the output for further analysis. The script plus some more details can be found here. The script will take a list of computers to run against but with PowerShell we can pipe in the result of a Active Directory look-up serving as the input. To find out who to tailor this part please refer here. In our case all DC are following a naming convention, i.e. the DC server name will look like ‘XXX-ADC-XX’. The common pattern here is ‘ADC’ which we use as a filter for the AD query. Here is the command line:

[codesyntax lang=”powershell”]

Get-DotNet-Version.ps1 -ComputerName $(Get-ADComputer -Filter '*' | Where { $_.Name -imatch 'ADC' } | Select -ExpandProperty Name)

[/codesyntax]

After the script has finish the results will be written into three files in the current directory. The DotNet-Versions-2015-02-11.csv CSV file contain the Server name and all of the installed .NET version and can be opened with Excel for further analysis.

By RZM 0 Comments

27 Jan 2015 Tuesday

Automatic WSUS Server Cleanup

After having migrated a WSUS role to a new Windows 2012R2 Server I was looking for a way to run the WSUS Server cleanup automatically on a schedule. Once a month seems to be sufficient as Microsoft has move to one official patch day per month apart from emergencies. As part of Windows Server 2012R2 Microsoft has released some PowerShell cmdlets do do exactly this.

Based on that TechNet article I have put together the following PowerShell script.

[codesyntax lang=”powershell”]

Get-WsusServer -Name ServerName -PortNumber 8530 | Invoke-WsusServerCleanup -CleanupObsoleteComputers -CleanupObsoleteUpdates -CompressUpdates -CleanupUnneededContentFile -DeclineExpiredUpdates -DeclineSupersededUpdates

[/codesyntax]

The above command line can be copied into a file and invoked either manually or via the task scheduler. Below is a sample output.

When setting up a scheduled job you may want to redirect the output to a file. To do this simple add “| Out-File C:\Scripts\clean_wsus.log” at the end. The filename and directory can of course be changed. Here is the full script.

[codesyntax lang=”powershell” container=”DIV”]

Get-WsusServer -Name glw-ccm-01 -PortNumber 8530 | Invoke-WsusServerCleanup -CleanupObsoleteComputers -CleanupObsoleteUpdates -CompressUpdates -CleanupUnneededContentFile -DeclineExpiredUpdates -DeclineSupersededUpdates | Out-File C:\Scripts\clean_wsus.log

[/codesyntax]

By RZM 2 Comments

12 Jan 2015 Monday

Internet Explorer 11 Group Policy Preferences GPO

With the release of Windows 10 organisations will have to look at what version of Internet Explorer will be used for internal and external services. As of now it looks like that Microsoft will ship IE11 as part of the new Windows release, mainly for backwards compatibility reason properly. Regardless, a decision might have been made to role out IE11 even for Windows 7/8.1 to get the benefit of longer support. As part of this deployment IT departments would look at customising and testing certain setting before making the update available to the entire user base. One would assume that just like it was done for IE10 there would be a template for IE11. However, even on Windows 8.1 or Windows Server 2012R2 only Internet Explorer 10 is available to choose from but not IE11.

Microsoft has slightly changed is policy and with the IE10 option, Internet Explorer 10 AND greater will be covered, meaning that IE11 will pick up the settings/customisation you have specified for IE10, making IT administrator’s life somehow easier. However, as with every Internet Explorer version there are some new features and corresponding setting that will not be covered by the preferences like the Enterprise Mode. For those Microsoft has made a IE11 Administration Templates available that should be used to customise these features as required.

By RZM 0 Comments

10 Jan 2015 Saturday

GPO – Auto Disconnect Idle Remote Desktop Sessions

Working in a geographically distributed Windows Server environment I often found that most servers have a number of idle RDP connection. As Windows Server only allows for two concurrent Remote Desktop connections for administration you are sometimes faces with the choice of disconnecting other user blindly or in the case of Windows Server 2003 not to be able to connect at all. The same applies also to some Virtual Client machine hosting legacy application that a frequently used by different users, who would not have administrator right to force a disconnect.

The obvious way to address this issue is to use a Group Policy do disconnect any idle session after a given time period. The are few more settings that can be set in this regards like as to whether to keep application running or not when disconnecting (Microsoft Technet Article).

We want to set a time-out limit for an active RDP session when this has been reached for all computer in a giving OU. To do this open the Group Policy Management Editor and go to …

Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits

… and enable “Set time for active Remote Desktop Services sessions” and “End session when time limits are reached”. When done apply GPO and test.

By RZM 0 Comments

11 Dec 2014 Thursday

Ubuntu do-release-upgrade fails with

When trying to run do-release-upgrade, the process stops with …

Not enough free disk space

The upgrade has aborted. The upgrade needs a total of 55.8 M free
space on disk ‘/boot’. Please free at least an additional 47.5 M of
disk space on ‘/boot’. Empty your trash and remove temporary packages
of former installations using ‘sudo apt-get clean’.

A quick df will show that the /boot partition is indeed nearly full.

Filesystem                          1K-blocks    Used Available Use% Mounted on
/dev/mapper/glw–oee–serv–vg-root 100750768 3442692 92183572   4% /
udev                                  1012076       4   1012072   1% /dev
tmpfs                                  204388     264    204124   1% /run
none                                     5120       0      5120   0% /run/lock
none                                  1021920       0   1021920   0% /run/shm
/dev/sda1                              233191 212670      8080 97% /boot

The main reason is that the /boot partition is filled with old kernels. First check uname -a to check your current version as we are going to clean-up some of the old packages. The run the following command to get a list of install kernel packages.

[codesyntax lang=”bash”]

dpkg -l 'linux-*' | sed '/^ii/!d;/'"$(uname -r | sed "s/\(.*\)-\([^0-9]\+\)/\1/")"'/d;s/^[^ ]* [^ ]* \([^ ]*\).*/\1/;/[0-9]/!d'

[/codesyntax]

The output will look something like this:

server:~$ dpkg -l ‘linux-*’ | sed ‘/^ii/!d;/'”$(uname -r | sed “s/$.*$-$[^0-9]\+$/\1/”)”‘/d;s/^[^ ]* [^ ]* $[^ ]*$.*/\1/;/[0-9]/!d’
linux-headers-3.8.0-29
linux-headers-3.8.0-29-generic
linux-headers-3.8.0-30
linux-headers-3.8.0-30-generic
linux-headers-3.8.0-32
linux-headers-3.8.0-32-generic
linux-headers-3.8.0-33
linux-headers-3.8.0-33-generic
linux-headers-3.8.0-34
linux-headers-3.8.0-34-generic
linux-headers-3.8.0-35
linux-headers-3.8.0-35-generic
linux-headers-3.8.0-37
linux-headers-3.8.0-37-generic
linux-image-3.8.0-29-generic
linux-image-3.8.0-30-generic
linux-image-3.8.0-32-generic
linux-image-3.8.0-33-generic
linux-image-3.8.0-34-generic
linux-image-3.8.0-35-generic

Now use the following command to clean-up up some of those packages and free up space on /boot.

sudo apt-get -y purge some-kernel-package

Example: sudo apt-get -y purge linux-image-3.8.0-29-generic

By RZM 0 Comments

10 Dec 2014 Wednesday

Firefox 34.0.5 – Secure Connection Failed

After the recent update of Firefox to version 34.0.5 you may get the following error message when trying to to access a site via https.

Secure Connection Failed
An error occurred during a connection to xxx.xxx.xxx.xxx.
Cannot communicate securely with peer: no common encryption algorithm(s). (Error code: ssl_error_no_cypher_overlap)
The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
Please contact the web site owners to inform them of this problem.

To fix this you have to edit two setting in the advanced setting. Type about:config into the address field and enter the configuration modus. In the Search filed type in security.tls.version. This will return 5 values. We need to set the following to preference to value “0”. Close the Tab/Window and reload the page.

Security.tls.version.min
security.tls.version.fallback-limit

By RZM 0 Comments

09 Dec 2014 Tuesday

Synology HA Cluster for Windows 2012 Hyper-V

Having used some of the Synology NAS boxes in the past I was looking forward to use some of the new features release in DSM 5.1, particular the HA option installed by default now. How to set up the HA-Cluster and the prerequisite are all explained here. Having met all the requirements is was a matter of 10 minutes to setup the SHA cluster.

One thing to bare in mind is that once the cluster is up and running we do end up with a Active/Passive Server. As the RS814+ that we used come with 4 x 1 Gbps port 3 where teamed up (one is used for the cluster heart beat), using the Link aggregation Mode IEEE 802.3ad. Below are the configuration for those three ports when using a Cisco router/switch.

[codesyntax lang=”text”]

!
interface Port-channel1
 switchport mode access
 switchport nonegotiate
 spanning-tree portfast
 spanning-tree bpduguard enable
!
interface GigabitEthernet0/18
 description AUR-SAN-02
 switchport mode access
 switchport nonegotiate
 channel-group 1 mode active
 spanning-tree portfast
 spanning-tree bpduguard enable
!
interface GigabitEthernet0/19
 description AUR-SAN-02
 switchport mode access
 switchport nonegotiate
 channel-group 1 mode active
 spanning-tree portfast
 spanning-tree bpduguard enable
!
interface GigabitEthernet0/20
 description AUR-SAN-02
 switchport mode access
 switchport nonegotiate
 channel-group 1 mode active
 spanning-tree portfast
 spanning-tree bpduguard enable

[/codesyntax]

I noticed that Synology seem to have that working probably now with regards to traffic load balancing. In previous installations, although the network interface where aggregated the the fail-over worked, traffic only ever utilised on interface.

The actually failover of the cluster can either be done manually or is triggered automatically via the heartbeat connection between the two servers. Although this seem to be reliable, the actually failover, making the Passive Server the Active one will take in excess of 5 minutes. Depending on the requirements that might prove to long. During a manual failover we were hosting Hyper-V VM on one of the LUN’s created. With the standard settings all VM eventually went offline and as we were running a cluster had to be brought up manually once the Synology cluster was responsive again. There might be a workaround by increasing the Windows iSCSI Timeout value, however, depending on the application deployed on those VM’s that might not be desirable.

To finish of the setup you might enable SNMP for you preferred monitoring tools. One configuration that often gets overlooked of forgotten is to deal with power outages. The Synology server support to methods for monitoring a UPS and initiating a graceful shutdown. The fist one is to connect the Synology server via USB to one of the approved UPS’s. If you have an existing infrastructure in place you can also use SNMP monitoring.

Last but not least go to Update & Restore to backup the current configuration.

By RZM 0 Comments

Author: RZM

Posts pagination

Send a Message