Recently we purchased a new Lenovo ThinkPad T530 2392-4DU, unfortunately we had to downgrade it to Windows XP for the time being. All installed very well except the graphics driver.
When I tried to install the NVIDIA driver it would error with "NVIDIA Installer cannot continue - This graphics driver could not find compatible graphics hardware."
I tried switching to Intel integrated which wouldn't install and reported "This system does not meet the minimum requirements".
After talking to Lenovo support and for a reason unknown to me we troubshot the UEFI / SATA Controller Mode option (case of support rep not listening and going by a script) I was told that the installer package erroring was a Microsoft issue. Yeah, right. After explaining the issue again and that it wasn't a MS issue, but a Lenovo driver issue I was told that they can't help, so sorry. Long wait on hold for the manager and now it's being escalated, they'll call back next week.
Good golly. Searching around online referencing the past T520 model and I found this:
http://support.lenovo.com/en_IN/downloads/detail.page?submit=true&componentID=1345028200599&DocID=HT062424
Change it to Discrete Graphics, reboot, install NVIDIA driver.
Friday, September 7, 2012
Thursday, May 24, 2012
Windows 7 Trusted Sites for all users - Active Setup
On a recent deployment of laptops I needed to add a certain domain to trusted sites for all user accounts (local and domain) on a number of domain attached computers. Idealy I would use GPO to do this, but I also had to hit the local user accounts (in fact, local accounts would be used almost exclusively for these laptops).
With Windows XP we could do this by adding the proper keys to HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\etc. This would apply the domain to the trusted sites for all users on the computer (note that the site was not visible in Internet Options, but still applied), but in Windows 7 the HKLM option doesn't work anymore. Of course adding the value to HKCU functioned the same as in the past, but I can't do this for each local account all on these computers. Not to mention should I ever need to change it.
Note: There is a GPO to add trusted sites, but when it's enabled it removes the ability for the end user to then add to the list (greyed out).
After poking around I found several mentions of using Active Setup which sounded very promising. Only problem was no one (that I read) really points out how to use it.
To start, here's a great writeup of what Active Setup is: http://www.sepago.de/helge/2010/04/22/active-setup-explained/
And this wiki site briefly hits on it: http://wpkg.org/Adding_Registry_Settings
But again, neither of these really says how to use it. So, by looking at the sites above we get a brief rundown of how it works. blah blah blah by checking on user logon the values in the HKCU with the values in HKLM it knows if it's been applied and runs if it hasn't.
Cool, so if we add a value to HKLM and it hasn't be added to HKCU then it applies, yeah! Even better, we CAN manage HKLM from GPO. So, using Active Setup we can apply settings to the Local Users using Computer Configuration GPO's.
To add an Active Setup key:
All done.
User logs in and it detects that it hasn't been "installed" and runs the command adding the key. Now the user checks his trusted sites via the GUI and see's it and can even modify (to include delete the key you just added). When you want to updated the key you just make your changes to the StubPath and increment the Version value.
Now to push via GPO you just use either an adm or push with registry preferences under Computer Configuration.
With Windows XP we could do this by adding the proper keys to HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\etc. This would apply the domain to the trusted sites for all users on the computer (note that the site was not visible in Internet Options, but still applied), but in Windows 7 the HKLM option doesn't work anymore. Of course adding the value to HKCU functioned the same as in the past, but I can't do this for each local account all on these computers. Not to mention should I ever need to change it.
Note: There is a GPO to add trusted sites, but when it's enabled it removes the ability for the end user to then add to the list (greyed out).
After poking around I found several mentions of using Active Setup which sounded very promising. Only problem was no one (that I read) really points out how to use it.
To start, here's a great writeup of what Active Setup is: http://www.sepago.de/helge/2010/04/22/active-setup-explained/
And this wiki site briefly hits on it: http://wpkg.org/Adding_Registry_Settings
But again, neither of these really says how to use it. So, by looking at the sites above we get a brief rundown of how it works. blah blah blah by checking on user logon the values in the HKCU with the values in HKLM it knows if it's been applied and runs if it hasn't.
Cool, so if we add a value to HKLM and it hasn't be added to HKCU then it applies, yeah! Even better, we CAN manage HKLM from GPO. So, using Active Setup we can apply settings to the Local Users using Computer Configuration GPO's.
To add an Active Setup key:
- Navigate to regedit
- HKLM\Software\Microsoft\Active Setup\Installed Components
- Here you see the list of GUID's from other software / setups
- Add a new key, in my example I'm going to call it {newtrustedsite}. It can be called anything, but has to be unique (duh)
- Within this add a new string value named "Version"
- Give Version a value, but don't use period. Use commas instead. For instance "1,0,1"
- New string named "StubPath". Here what you want it to do. Could be an application to execute, script, other cmd line something.
- We're going to add a trusted site so my StubPath looks like this "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\contoso.com" /v https /d 2 /t REG_DWORD /f
All done.
User logs in and it detects that it hasn't been "installed" and runs the command adding the key. Now the user checks his trusted sites via the GUI and see's it and can even modify (to include delete the key you just added). When you want to updated the key you just make your changes to the StubPath and increment the Version value.
Now to push via GPO you just use either an adm or push with registry preferences under Computer Configuration.
Friday, May 18, 2012
Windows could not parse or process unattend answer file
Had a lot of issues with cloning a Windows 7 system when using an unattend.xml
Windows could not parse or process the unattend answer file for pass [specialize]. The settings spefcified in the answer file cannot be applied. The error was detected while processing settings for component [Microsoft-Windows-Shell-Setup].
After much searching I found this which was spot on:
http://jamiebaldanza.org/2010/03/31/copyprofile-does-not-process-and-causes-windows-could-not-parse-or-process-the-unattend-answer-file-for-the-pass-specialize/
Thank you Jamie!
I had set the copyprofile paramater and had ensured that only the administrator account was present by removing the other profiles through the user control panel.
Seems that when I removed the users through the control panel it did not delete the values in the profilelist registry value.
To fix rather than making a new sysprep image I did the following:
Windows could not parse or process the unattend answer file for pass [specialize]. The settings spefcified in the answer file cannot be applied. The error was detected while processing settings for component [Microsoft-Windows-Shell-Setup].
After much searching I found this which was spot on:
http://jamiebaldanza.org/2010/03/31/copyprofile-does-not-process-and-causes-windows-could-not-parse-or-process-the-unattend-answer-file-for-the-pass-specialize/
Thank you Jamie!
I had set the copyprofile paramater and had ensured that only the administrator account was present by removing the other profiles through the user control panel.
Seems that when I removed the users through the control panel it did not delete the values in the profilelist registry value.
To fix rather than making a new sysprep image I did the following:
- Exported the wim from WDS
- Mounted my image from the wds server
- imagex /mountrw d:\
2 c:\mountedimage - Modified the system registry values
- Open Regedit
- Highlight HKEY_LOCAL_MACHINE
- File - Load Hive
- Navigate into your mounted image to Windows\System32\Config
- Select the SOFTWARE (no extension)
- Give a temp name to the hive
- Navigate into the temp hive mount and remove the obsolete keys
- Select the temp hive name
- File - Unload Hive
- Commit changes
- imagex /commit c:\mountedimage (I found that using commit and unmount in seperate command limited the amount of times I get the error that it couldn't fully unmount)
- Unmount
- imagex /unmount c:\mountedimage
- Imported the wim back into WDS as a new build
- Right click my install images group and "Add Install Image"
Wednesday, May 16, 2012
Add Driver Package to Capture Image - Windows Deployment Services 2008 R2
Using Windows Deployment Services 2008 R2 with a Capture Image of Version 6.1.7600 I have now had two instances where the network doesn't load. In both cases I've found that this is due to the network driver missing from the capture image.
I've found a lot of posts and blogs on how to add the drivers to the image and some do it the easy way, but a good number of them don't.
After booting from the capture image you attempt to enter the servername / ip address for the WDS and hit connect. This results in:
Error: The network location cannot be reached. For information about network troubleshooting, see Windows Help.
At this point if you press Shift F10 to open command prompt and type wpeutil InitializeNetwork followed by ipconfig it will result in a blank response. Running ipconfig /renew results in "The operation failed as no adapter is in the state permissible for this operation"
Add the driver to WDS:
Note: you can test the NIC prior to adding it to the image by getting the NIC drivers on a floppy or USB, PXE booting to capture, pressing Shift F10 to open cmd prompt, running drvload "path to .inf" and then issuing wpeutil InitializeNetwork.
I've found a lot of posts and blogs on how to add the drivers to the image and some do it the easy way, but a good number of them don't.
After booting from the capture image you attempt to enter the servername / ip address for the WDS and hit connect. This results in:
Error: The network location cannot be reached. For information about network troubleshooting, see Windows Help.
At this point if you press Shift F10 to open command prompt and type wpeutil InitializeNetwork followed by ipconfig it will result in a blank response. Running ipconfig /renew results in "The operation failed as no adapter is in the state permissible for this operation"
Add the driver to WDS:
- Download the NIC from the manufacturer and extract the .inf / other files.
- Place the driver files on the WDS server. In my case I put them in the following directory: C:\Drivers\Lenovo\E520\x64 and x86
- Open your WDS console
- Right click on Drivers
- Add Driver Package
- Select driver from a folder
- Navigate to the Drivers folder
- Next
- You should see it list all the drivers it finds
- Check the ones you want and press next
- Next
- It will copy the drivers
- Next
- Select or create a new driver group
- Finish
- Ensure your capture image isn't in use
- Go to Boot Images
- Select your Capture Image
- Right click and "Add Driver Packages to Image"
- Next
- "Search for Packages"
- In the results pane select the drivers you want to add
- Next
- Image will be mounted, drivers added and dismounted
- Finish
Note: you can test the NIC prior to adding it to the image by getting the NIC drivers on a floppy or USB, PXE booting to capture, pressing Shift F10 to open cmd prompt, running drvload "path to .inf" and then issuing wpeutil InitializeNetwork.
Thursday, May 3, 2012
Windows 2008 R2 View Print Server Properties
In Windows 2003 / 2008 to view the installed print drivers you could open your print server properties by simply right clicking white space in the printers windows.
With Windows 2008 R2 the process is just as easy, but since it's now different, it can be very difficult to find...
With Windows 2008 R2 the process is just as easy, but since it's now different, it can be very difficult to find...
- Open Devices and Printers
- Highlight any object under the Printers and Faxes section
- At the top of the window three new options appear next to the normal "add a device" and "add a printer"
- See What's printing
- *Print Server Properties
- Remove Device
Tuesday, February 21, 2012
Exchange 2010 SP1 ActiveSync device lockdown
The other day I began working on locking down ActiveSync so that only pre-approved devices could sync. I found that there where a lot of things available that gave portions of the solutions or hinted at parts, but none that gave the full solution (excuding one site which I didn't find until later).
I'm not going to give a full layout of all the options, but below I intend to layout the method that I'm using. From this it can easily be modified to do add rules for the needs or your organization.
ActiveSync in Exchange 2010 SP1 can control devices by allowing (default), blocking, and quarantine of the device. This is handled by identifying the device via the Device ID. The Device ID appears to differ depending on the device type, but for example with Apple's iPad the id is the Serial Number with Appl appended to the begining. So, ApplDFGGYUDVBFJ2 is what one might look like if your serial number was DFGGYUDVBFJ2. My understanding is that Andoid is not generated from the serial number.
I'm going to cover doing this through Powershell. It can also be done through the Exchange ECP via this excellent post by the exchange team (this is the one I found after I was done doing it through Powershell)
http://blogs.technet.com/b/exchange/archive/2010/11/15/3411539.aspx
Set-CASMailbox -Identity aarons -ActiveSyncAllowedDeviceIDs "ApplDFGGYUDVBFJ2","ApplDFGGYUDVBFJ3"
To set a user back to no allowed devices use the following:
Set-CASMailbox -Identity aarons -ActiveSyncAllowedDeviceIDs $Null
Note: I found that sometimes it could take awhile for a device in quarantine to generate an email stating it was in quarantine. This appeared to be because it didn't actually go to quarantine, but it was just straight out denied. In my tests this occured when the mailbox was large or contained a large number of messages.
The other part of this controlled setup that we origninally implemented was to also disable ActiveSync for all users and then explicitely enable it for users at the time of need, but if all devices go to quarantine or are blocked this no longer matters and stands in as a way to disable ActiveSync for all users without actually disabling ActiveSync (in case someone still wants to disable ActiveSync: Get-CASMailbox -identity username | Set-CASMailbox -ActiveSyncEnabled $False , you can exclude the -identity username to make it apply to all users)
I'm not going to give a full layout of all the options, but below I intend to layout the method that I'm using. From this it can easily be modified to do add rules for the needs or your organization.
ActiveSync in Exchange 2010 SP1 can control devices by allowing (default), blocking, and quarantine of the device. This is handled by identifying the device via the Device ID. The Device ID appears to differ depending on the device type, but for example with Apple's iPad the id is the Serial Number with Appl appended to the begining. So, ApplDFGGYUDVBFJ2 is what one might look like if your serial number was DFGGYUDVBFJ2. My understanding is that Andoid is not generated from the serial number.
I'm going to cover doing this through Powershell. It can also be done through the Exchange ECP via this excellent post by the exchange team (this is the one I found after I was done doing it through Powershell)
http://blogs.technet.com/b/exchange/archive/2010/11/15/3411539.aspx
- Open the Exchange Management Shell
- Get-ActiveSyncOrganizationSettings | fl DefaultAccessLevel
- This will report your current default level, most likely it's set to Allow
- Set-ActiveSyncOrganizationSettings -DefaultAccessLevel Quarantine -AdminMailRecipients admin@didyourestart.com
- Here we are setting the default level to Quarantine and then specifying an email address to be notified when a device is quarantined. You will want this so that you can see what the DeviceID is of new devices (makes for easier adding of devices for allow access)
- You'll now find that if you try to connect your iPad it will be quarantined. Quarantined devices can be found via the Exchange ECP as described in the link above to blogs.technet.com or via Powershell
- Get-ActiveSyncDevice | where {$_.deviceaccessstate -eq 'Quarantined'} | ft DistinguishedName
- This can also be used to find the DeviceID. On iPad this results in simular to following
- CN=iPad§ApplDFGGYUDVBFJ2,CN=ExchangeActiveSyncDevices,.....
- Next step is to allow this device access for the user
- Set-CASMailbox -Identity username -ActiveSyncAllowedDeviceIDs "ApplDFGGYUDVBFJ2 "
- You can view the list of allowed devices at anytime by using the following
- Get-CASMailbox -Identity aarons | fl ActiveSyncAllowedDeviceIDs
Set-CASMailbox -Identity aarons -ActiveSyncAllowedDeviceIDs "ApplDFGGYUDVBFJ2","ApplDFGGYUDVBFJ3"
To set a user back to no allowed devices use the following:
Set-CASMailbox -Identity aarons -ActiveSyncAllowedDeviceIDs $Null
Note: I found that sometimes it could take awhile for a device in quarantine to generate an email stating it was in quarantine. This appeared to be because it didn't actually go to quarantine, but it was just straight out denied. In my tests this occured when the mailbox was large or contained a large number of messages.
The other part of this controlled setup that we origninally implemented was to also disable ActiveSync for all users and then explicitely enable it for users at the time of need, but if all devices go to quarantine or are blocked this no longer matters and stands in as a way to disable ActiveSync for all users without actually disabling ActiveSync (in case someone still wants to disable ActiveSync: Get-CASMailbox -identity username | Set-CASMailbox -ActiveSyncEnabled $False , you can exclude the -identity username to make it apply to all users)
Tuesday, November 29, 2011
Citrix XenApp 6 and 6.5 Legacy DefaultPRNFlags
With versions of Citrix XenApp prior to version 6 you could set the reg key DefaultPRNFlags to modify printing options. In earlier posts I referenced using these values for allowing admins access to autocreated printers to suppressing errors in the event log, etc
http://support.citrix.com/article/CTX119684
With the release of XenApp 6 and 6.5 the DefaultPRNFlags key has been changed both to a new location and seperated out into different keys with true / false data.
http://support.citrix.com/article/CTX124885
http://support.citrix.com/article/CTX119684
With the release of XenApp 6 and 6.5 the DefaultPRNFlags key has been changed both to a new location and seperated out into different keys with true / false data.
http://support.citrix.com/article/CTX124885
Friday, August 12, 2011
Convert MAK to KMS Client or KMS Host to Client with slmgr.vbs
By default all Windows Vista and above clients are shipped as a KMS client with a GVLK installed. So, by default if you have a KMS host setup then any new installs will work immediately with your KMS environment.
Lets take a look:
on a fresh system open cmd and go to C:\Windows\System32
run cscript slmgr.vbs /dlv
It will report a KMSCLient
http://technet.microsoft.com/en-us/library/ff793421.aspx
But lets say you already activated this client with a MAK key or as a KMS Host with the KMS key and now you want it to be a client again. This process is as simple as changing the key back to the GVLK key.
Note: To convert from MAK to KMSClient it is the exact same steps. (the volume descriptions will be different to represent the MAK instead of KMSHost)
__________________________________________________________________________
In the following example the admin accidentally activated the system using the KMS host key.
- Note that running slmgr.vbs /dlv shows it's a KMS Host
- We can see that it's Windows Server 2008 Standard so we can go to our friends at MS and grab the correct GVLP key of TM24T-X9RMF-VWXK6-X8JC9-BFGM2 (http://technet.microsoft.com/en-us/library/ff793421.aspx)
- Then run cscript slmgr.vbs /ipk TM24T-X9RMF-VWXK6-X8JC9-BFGM2
- Now we can activate it with the KMS Host that you already have setup on the proper server using cscript slmgr.vbs /ato
- Then you can run cscript slmgr.vbs /dlv again and get a good activation description
From this we can see that we've now successfully activated the KMSClient against the KMS Host listed at "KMS machine name from DNS:" and that it will activate again in 180 days.
Once again, here's the KMS Client Setup Keys
http://technet.microsoft.com/en-us/library/ff793421.aspx
Lets take a look:
on a fresh system open cmd and go to C:\Windows\System32
run cscript slmgr.vbs /dlv
It will report a KMSCLient
Name: Windows Server(R), ServerStandard editionNote the partial product key is BFGM2. Also note the description contains VOLUME_KMSCLIENT channel. From the following link provided by MS we can see that this is the key for Windows Server 2008 Standard KMSClient
Description: Windows Operating System - Windows Server(R), VOLUME_KMSCLIENT channel
Activation ID:
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID:
Installation ID:
Partial Product Key: BFGM2
License Status: Initial grace period
Time remaining: 86400 minute(s) (60 day(s))
Key Management Service client information
Client Machine ID (CMID):
DNS auto-discovery: KMS name not available
KMS machine extended PID:
Activation interval: -1 minutes
Renewal interval: -1 minutes
http://technet.microsoft.com/en-us/library/ff793421.aspx
But lets say you already activated this client with a MAK key or as a KMS Host with the KMS key and now you want it to be a client again. This process is as simple as changing the key back to the GVLK key.
Note: To convert from MAK to KMSClient it is the exact same steps. (the volume descriptions will be different to represent the MAK instead of KMSHost)
__________________________________________________________________________
In the following example the admin accidentally activated the system using the KMS host key.
- Note that running slmgr.vbs /dlv shows it's a KMS Host
C:\Windows\System32>cscript slmgr.vbs /dlv
Microsoft (R) Windows Script Host Version 5.7
Copyright (C) Microsoft Corporation. All rights reserved.
Software licensing service version: 6.0.6002.18005
Name: Windows Server(R), ServerStandard edition
Description: Windows Operating System - Windows Server(R), VOLUME_KMS_B channel
Activation ID:
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID:
Installation ID:
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=48189
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=48190
Use License URL: http://go.microsoft.com/fwlink/?LinkID=48192
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=48191
Partial Product Key:
License Status: Licensed
Key Management Service is enabled on this machine
Current count: 0
Listening on Port: 1688
DNS publishing enabled
KMS priority: Normal
Key Management Service cumulative requests received from clients
Total requests received: 0
Failed requests received: 0
Requests with License Status Unlicensed: 0
Requests with License Status Licensed: 0
Requests with License Status Initial grace period: 0
Requests with License Status License expired or Hardware out of tolerance: 0
Requests with License Status Non-genuine grace period: 0
Requests with License Status Notification: 0
- We can see that it's Windows Server 2008 Standard so we can go to our friends at MS and grab the correct GVLP key of TM24T-X9RMF-VWXK6-X8JC9-BFGM2 (http://technet.microsoft.com/en-us/library/ff793421.aspx)
- Then run cscript slmgr.vbs /ipk TM24T-X9RMF-VWXK6-X8JC9-BFGM2
C:\Windows\System32>cscript slmgr.vbs /ipk TM24T-X9RMF-VWXK6-X8JC9-BFGM2- Now if we run cscript slmgr.vbs /dlv again we see
Microsoft (R) Windows Script Host Version 5.7
Copyright (C) Microsoft Corporation. All rights reserved.
Installed product key TM24T-X9RMF-VWXK6-X8JC9-BFGM2 successfully.
C:\Windows\System32>cscript slmgr.vbs /dlv
Microsoft (R) Windows Script Host Version 5.7
Copyright (C) Microsoft Corporation. All rights reserved.
Software licensing service version: 6.0.6002.18005
Name: Windows Server(R), ServerStandard edition
Description: Windows Operating System - Windows Server(R), VOLUME_KMSCLIENT channel
Activation ID:
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID:
Installation ID:
Partial Product Key: BFGM2
License Status: Initial grace period
Time remaining: 86400 minute(s) (60 day(s))
Key Management Service client information
Client Machine ID (CMID):
DNS auto-discovery: KMS name not available
KMS machine extended PID:
Activation interval: -1 minutes
Renewal interval: -1 minutes
- Now we can activate it with the KMS Host that you already have setup on the proper server using cscript slmgr.vbs /ato
C:\Windows\System32>cscript slmgr.vbs /ato
Microsoft (R) Windows Script Host Version 5.7
Copyright (C) Microsoft Corporation. All rights reserved.
Activating Windows Server(R), ServerStandard edition...
Product activated successfully.
- Then you can run cscript slmgr.vbs /dlv again and get a good activation description
C:\Windows\System32>cscript slmgr.vbs /dlv
Microsoft (R) Windows Script Host Version 5.7
Copyright (C) Microsoft Corporation. All rights reserved.
Software licensing service version: 6.0.6002.18005
Name: Windows Server(R), ServerStandard edition
Description: Windows Operating System - Windows Server(R), VOLUME_KMSCLIENT channel
Activation ID:
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID:
Installation ID:
Partial Product Key: BFGM2
License Status: Licensed
Volume activation expiration: 259200 minute(s) (180 day(s))
Key Management Service client information
Client Machine ID (CMID): 5a05921b-8405-4d46-af89-f40a3d60b698
KMS machine name from DNS: machinename.fqdn:1688
KMS machine extended PID:
Activation interval: 120 minutes
Renewal interval: 10080 minutes
From this we can see that we've now successfully activated the KMSClient against the KMS Host listed at "KMS machine name from DNS:" and that it will activate again in 180 days.
Once again, here's the KMS Client Setup Keys
http://technet.microsoft.com/en-us/library/ff793421.aspx
Tuesday, August 9, 2011
Understand and Installing KMS Server
There are 2 different types of keys with todays Office and Windows products, KMS and MAK. These are used to manage Windows Server 2008 and 2008 R2, Windows Vista and 7, and Office 2010.
MAK - Multiple Activation Key - Activate one-time basis against MS hosted activation services (across internet)
KMS - Key Management Service - Activate systems within internal network
KMS and MAK can be mixed in an environment based on client needs.
Frequently Asked Questions About Volume License Keys
http://www.microsoft.com/licensing/existing-customers/product-activation-faq.aspx
Why use KMS?
1. MAK has usage limits, this is important in corporate environments especially with virtual desktop environments. Improperly utilizing MAK keys can lead to all of the activations being consumed (see FAQ site linked above).
2. Easier to manage new deployments with KMS. Set it and forget it
Why use MAK?
1. Mobile workstations that will not have visibility to KMS host within timeframe required for activation limits (180 days).
2. Very small deployments of less than 25 workstations, or less than 5 servers (running described OS). See below for KMS Host activation thresholds. Note: if in a vdi environment then review support for MAK deployment by the software vendor (ie Citrix XenDesktop supports MAK for Windows 7 with PVS, but does not support MAK for Office 2010 at time of this writing).
What is a CMID?
The CMID is how KMS identifies unique machines. This is important in environments that utilize virtualization such as XenApp and XenDesktop (or other virtual technologies).
KMS Host activation thresholds:
The activation threshold how many end clients have to request a license from the host before the host will activate and start handing out valid licenses. This is different by product:
Windows OS - Either 5 Server client requests or 25 Workstation client requests
Office 2010 - 5 client requests
Once the proper number of clients have requested activation then the Host will begin handing out licenses.
The KMS Host will also cache twice the number of clients to ensure that the count does not drop below the required count to remain activated.
This is important to note for a few reasons:
1. If your planning redundancy of kms hosts then the number of clients is somewhere over double the minimum number of clients needed for activation. This is due to having to meet the threshold on two hosts and the fact that each has a activation threshold cache.
2. Application virtualization and vdi/workstation virtualization technologies may actually only count as 1 client since they will all have the same CMID.
I will not be focusing on installing / configuring redundant KMS hosts. It should be noted that you can configure the weight / priority of hosts in this type of environment.
Client Discovery:
Client discovery by default is done through dns via a srv record through tcp port 1688. Note that Windows 7 firewall by default blocks so it needs enabled.
Understanding KMS
http://technet.microsoft.com/en-us/library/ff793434.aspx
Installation
Installation of KMS Host is as easy as plugging in the KMS license key for the Windows OS or installing the service for Office.
Note: extra steps may be needed for depending on which OS flavor it would be hosted on. Extra patches may be needed for 2003 and 2008 hosts.
Windows OS Host setup
1. Pull your KMS license key out of your Volume license site. This key should ONLY be used on servers you intend to be hosts.
2. Open Control Panel\System and Security\System
3. Change product key
4. Enter your KMS product key
5. Click Yes to the prompt warning you that you are using a KMS key that will setup activation services
Note that a Windows Server 2008 R2 can activate both servers and clients.
http://technet.microsoft.com/en-us/library/ff793412.aspx
Office 2010 Host setup
1. Go to your volume license downloads
2. Download the "Office 2010 Key Management Service Host". Note that if you have different versions you may see one for Professional, Standard, etc. Either one will do (don't need both). This doesn't include the actual keys
3. Get the Office suites KMS key from the license agreement page
4. Run the installer and accept the EULA.
5. When it asks for the host product key enter the KMS key
Fresh installations of the OS or Office by default are set to search out a KMS host and activate (via the DNS srv record).
Viewing KMS info
In order to see information about the KMS Host you can use the slmgr.vbs script. This is done from a command prompt at C:/Windows/System32
To display Windows license information use cscript slmgr.vbs /dlv
This does not display information regarding Office licensing
In addition you can use /dlv all to display information on all licenses (ie Windows and Office)
If you only want to see office KMS licensing information you can add the activation id of the product. Thus it would look like this:
cscript slmgr.vbs /dlv bfe7a195-4f8f-4f0b-a622-cf13c7d16864
DNS Srv Record
If we look in DNS we'll find a new srv record for each KMS Host.
You'll find the records under the Forward Lookup Zones - your domain - _tcp
The records will be named _VLMCS
MAK - Multiple Activation Key - Activate one-time basis against MS hosted activation services (across internet)
KMS - Key Management Service - Activate systems within internal network
KMS and MAK can be mixed in an environment based on client needs.
Frequently Asked Questions About Volume License Keys
http://www.microsoft.com/licensing/existing-customers/product-activation-faq.aspx
Why use KMS?
1. MAK has usage limits, this is important in corporate environments especially with virtual desktop environments. Improperly utilizing MAK keys can lead to all of the activations being consumed (see FAQ site linked above).
2. Easier to manage new deployments with KMS. Set it and forget it
Why use MAK?
1. Mobile workstations that will not have visibility to KMS host within timeframe required for activation limits (180 days).
2. Very small deployments of less than 25 workstations, or less than 5 servers (running described OS). See below for KMS Host activation thresholds. Note: if in a vdi environment then review support for MAK deployment by the software vendor (ie Citrix XenDesktop supports MAK for Windows 7 with PVS, but does not support MAK for Office 2010 at time of this writing).
What is a CMID?
The CMID is how KMS identifies unique machines. This is important in environments that utilize virtualization such as XenApp and XenDesktop (or other virtual technologies).
KMS Host activation thresholds:
The activation threshold how many end clients have to request a license from the host before the host will activate and start handing out valid licenses. This is different by product:
Windows OS - Either 5 Server client requests or 25 Workstation client requests
Office 2010 - 5 client requests
Once the proper number of clients have requested activation then the Host will begin handing out licenses.
The KMS Host will also cache twice the number of clients to ensure that the count does not drop below the required count to remain activated.
This is important to note for a few reasons:
1. If your planning redundancy of kms hosts then the number of clients is somewhere over double the minimum number of clients needed for activation. This is due to having to meet the threshold on two hosts and the fact that each has a activation threshold cache.
2. Application virtualization and vdi/workstation virtualization technologies may actually only count as 1 client since they will all have the same CMID.
I will not be focusing on installing / configuring redundant KMS hosts. It should be noted that you can configure the weight / priority of hosts in this type of environment.
Client Discovery:
Client discovery by default is done through dns via a srv record through tcp port 1688. Note that Windows 7 firewall by default blocks so it needs enabled.
Understanding KMS
http://technet.microsoft.com/en-us/library/ff793434.aspx
Installation
Installation of KMS Host is as easy as plugging in the KMS license key for the Windows OS or installing the service for Office.
Note: extra steps may be needed for depending on which OS flavor it would be hosted on. Extra patches may be needed for 2003 and 2008 hosts.
Windows OS Host setup
1. Pull your KMS license key out of your Volume license site. This key should ONLY be used on servers you intend to be hosts.
2. Open Control Panel\System and Security\System
3. Change product key
4. Enter your KMS product key
5. Click Yes to the prompt warning you that you are using a KMS key that will setup activation services
Note that a Windows Server 2008 R2 can activate both servers and clients.
http://technet.microsoft.com/en-us/library/ff793412.aspx
Office 2010 Host setup
1. Go to your volume license downloads
2. Download the "Office 2010 Key Management Service Host". Note that if you have different versions you may see one for Professional, Standard, etc. Either one will do (don't need both). This doesn't include the actual keys
3. Get the Office suites KMS key from the license agreement page
4. Run the installer and accept the EULA.
5. When it asks for the host product key enter the KMS key
Fresh installations of the OS or Office by default are set to search out a KMS host and activate (via the DNS srv record).
Viewing KMS info
In order to see information about the KMS Host you can use the slmgr.vbs script. This is done from a command prompt at C:/Windows/System32
To display Windows license information use cscript slmgr.vbs /dlv
This does not display information regarding Office licensing
In addition you can use /dlv all to display information on all licenses (ie Windows and Office)
If you only want to see office KMS licensing information you can add the activation id of the product. Thus it would look like this:
cscript slmgr.vbs /dlv bfe7a195-4f8f-4f0b-a622-cf13c7d16864
DNS Srv Record
If we look in DNS we'll find a new srv record for each KMS Host.
You'll find the records under the Forward Lookup Zones - your domain - _tcp
The records will be named _VLMCS
Friday, August 5, 2011
Forfiles to manipulate files based on date
Nothing new here...
You can use Forfiles to manipulate files based on their date.
/P Path to search
/M SearchMask
/S Subdirectories
/C Command
/D Date (valid as "mm/dd/yyyy" or in greater than + or less than -)
Examples:
Search current and subdirectories for files older than 30 days from current date and echo them to screen
forfiles /s /d -30 /c "cmd /c Echo @file"
Same but only display iso's
forfiles /s /m *.iso /d -30 /c "cmd /c Echo @file"
Same but this time display the full path to the file
forfiles /s /m *.iso /d -30 /c "cmd /c Echo @path\@file"
So now we have the basic concept you could use this to script to delete files older than x days/date.
forfiles /p C:\backups /s /d -30 /c "cmd /c del @path"
or move them to cheaper storage
forfiles /p C:\backups /s /d -30 /c "cmd /c move /y @path C:\Destination"
You can use Forfiles to manipulate files based on their date.
/P Path to search
/M SearchMask
/S Subdirectories
/C Command
/D Date (valid as "mm/dd/yyyy" or in greater than + or less than -)
Examples:
Search current and subdirectories for files older than 30 days from current date and echo them to screen
forfiles /s /d -30 /c "cmd /c Echo @file"
Same but only display iso's
forfiles /s /m *.iso /d -30 /c "cmd /c Echo @file"
Same but this time display the full path to the file
forfiles /s /m *.iso /d -30 /c "cmd /c Echo @path\@file"
So now we have the basic concept you could use this to script to delete files older than x days/date.
forfiles /p C:\backups /s /d -30 /c "cmd /c del @path"
or move them to cheaper storage
forfiles /p C:\backups /s /d -30 /c "cmd /c move /y @path C:\Destination"
Thursday, April 21, 2011
Server 2008 R2 Print Server with 64 and 32bit drivers
Scenario: Mixed environment of 32 bit and 64 bit workstations / Terminal servers. You want to use one print server to serve out both architectures of both native and third party drivers.
Example drivers:
Example drivers:
- Native HP Laserjet 5
- Native HP Laserjet 2200 PCL5
- Native HP LaserJet 4100 PCL6
- etc
First, prep your server and get the Print and Document Services role installed. I did this on 2008 R2 with SP1.
Open Print Management. Go to drivers and click add.
x64 install - this one is easy...
- Next
- Choose x64, Next
- Click Windows Update and wait (this gets you more drivers such as the LJ 5, yes it normally takes that long)
- Select your driver
- Next
- Finish (may take awhile if it's pulling from Windows Update)
- Told you it was easy.
But now you need the exact same driver in 32bit...
x32 install - Native drivers
- You have to pull the native driver from a x32 2008 server. So you'll need at least one 2008 SP2 32bit server in your environment.
- Click Add driver
- Next
- Choose x86, Next
- Note the list is blank, click Have Disk
- enter the following path where servername is the name of your 2008 32bit server. file://servername/c$/Windows/System32/DriverStore/FileRepository/prnhp*****
- In my case the actual inf was named prnhp001.inf_87f859f3. Not sure if this is always the case.
- Select the exact same driver that you did for x64.
- Note that for this to work properly it has to be the exact same driver name.
You know have the 32bit and 64 bit version of the Native MS driver.
Now you can do the same thing with your Third Party driver, but point the "Have Disk" to the .inf that you downloaded from their website. Note that again, you'll have to download both the 32bit and 64bit version of the same driver (unless of course they have 1 download that contains both versions)
Your driver windows should look something like this when your done... Notice that I have a x86 and x64 for each driver listed, but that they have the exact same name.
Hint: you can make driver names match via editing the .inf prior to driver installation. Test it well if you do as your mileage may vary from my results.
Wednesday, December 15, 2010
Deloy Citrix Merchandising Server with Receiver 2.0 using anonymous access
Citrix Merchandising server 2.0 adds in the ability to deploy the receiver with tokens. This allows the receiver to be utilized with anonymous access and elimates the need for users to login for receiver updates (note this doesn't change the need to login for online plugin which will be presented as a receiver login prompt, don't confuse the 2 different authentication prompts)
For this I used both Merchandising server 2.0 and 2.1 along with Receiver 2.0 and 2.1.
Configure the Merchandising Server
Citrix has a tool available for packaging the receiver. It works very well. Unfortunately I don't like it because it forces you package it alongside the Access Gateway client, which I don't necessarily want to push to all my workstations that will be using receiver. If you want to push that client as well then use this to package your receiver with the token.
Otherwise:
Here's an excellent tip on packaging the receiver. http://www.xenappblog.com/2010/receiver-asking-for-logon-information-after-msi-install/
Download the receiver msi from citrix.com. Then make your installation look like the below. Note that the token comes from the "Authentication" tab in the receiver. It's the token we generated way back on step 15.
start /wait msiexec /i "Receiver.msi" /qn ALLUSERS=1 REBOOT="ReallySuppress" SERVER_LOCATION=https://receiver.fqdn.com/appliance/services/applianceService VERBOSE=true AUTOUPDATE=true TOKEN=yourtoken
Alternatively you could use Orca to modify the msi.
New! Citrix has added a new page in their edocs regarding how to push the Citrix receiver and the switches available. You'll find it under Receiver for Windows - Installing Receiver for Windows.
For this I used both Merchandising server 2.0 and 2.1 along with Receiver 2.0 and 2.1.
Configure the Merchandising Server
- Download and import the merchanding server (8GB HD space req)
- Configure with IP, subnet, etc and install the latest XenServer tools. Use receiver.yourfqdn as the hostname
- open https://ipaddress/appliance
- login as root with the default password (found in the citrix edocs, note this is different than the unix password you configures from the console)
- Configure Active Directory
- Source Name = your call
- Server Address = IP address to DC
- Server port = 389 or 3268
- Bind DN = user account to sync ldap (ie ldap@here.contoso.com)
- Bind Password = the password to the ldap account
- Base DN = your base dn (ie DC=here,DC=contoso,DC=com)
- Save (if it errors you did it wrong)
- Permissions
- In the search users box type your domain user first or last name (username will result in nothing)
- Select the radial button and click Edit
- Change to Admin
- Repeat for all other admins
- Logoff
- Enter a dns record for "receiver" pointing to the merch server IP address
- point your browser to https://receiver/appliance
- Logon as your newly configure admin account. Note that you'll need to use domain\username for now
- Go to configurations - options
- Enter your support desk email, website, phone as desired. Ensure you select Token Expiration of Never (unknown to me at this time if you set it to expire if the end clients will update automatically, or if it will just break it).
- Enter the default domain name desired (note that this will fix the need for using the domain\username format)
- Save
- Go to configurations Authentication
- Click Generate Token (needed for the anonymous access)
- Click Save
- Now we need to generate an ssl cert. Since most intermediaries now require all ssl certs be generated with 2048 or higher you won't be able to use the CMS built in cert request as it only generates at 1024. I used IIS7 for this.
- Open IIS manager
- On the server find Server Certificates
- Click Create Certificate Request
- Common name = receiver.ncgi.com
- Fill out rest of the request and generate the csr
- Copy the contents of the CSR and generate a cert (I used Godaddy)
- download the completed cert
- In IIS7 select the cert and click "Complete Certificate Request"
- Once finished select the cert and click export
- enter a location and password
- Download and install openssl http://www.openssl.org/related/binaries.html
- Convert the new cert from pfx format to pem using openssl
- open command prompt and navigate to where you installed openssl (default is C:\openssl\bin)
- openssl pkcs12 -in c:\certs\yourcert.pfx -out c:\certs\receiver.pem –nodes
- Enter the password you gave it when you exported it.
- Now that we have a cert in the proper format we can import it to the receiver. Go to configuration - ssl certifcate management
- Change the drop down to "import certificate from a certificate authority"
- For "Public Certificate File" browse to the newly created pem file
- For "Private Key File" browse to the newly created pem file
- Enter the password
- Submit
- The CMS will reboot at this point. When it comes back up you'll notice that you don't get a cert warning anymore (provided everything was done right).
- Dedicate an external IP address and map the external address to your internal address at your firewall. You'll need port 443 open obviously.
- Get the A-records mapped externally for receiver.fqdn to point to your external address if you haven't already
- under plug-ins click Get new
- select a plug-in that you want and click Download to server
- under Deliveries click Create/Edit
- Create
- Delivery Name = Default
- Check mark default delivery
- enter how often to check for updates
- Add a plug-in to push as the default package
- Set the schedule for Deliver Now
- Click Schedule
Citrix has a tool available for packaging the receiver. It works very well. Unfortunately I don't like it because it forces you package it alongside the Access Gateway client, which I don't necessarily want to push to all my workstations that will be using receiver. If you want to push that client as well then use this to package your receiver with the token.
Otherwise:
Here's an excellent tip on packaging the receiver. http://www.xenappblog.com/2010/receiver-asking-for-logon-information-after-msi-install/
Download the receiver msi from citrix.com. Then make your installation look like the below. Note that the token comes from the "Authentication" tab in the receiver. It's the token we generated way back on step 15.
start /wait msiexec /i "Receiver.msi" /qn ALLUSERS=1 REBOOT="ReallySuppress" SERVER_LOCATION=https://receiver.fqdn.com/appliance/services/applianceService VERBOSE=true AUTOUPDATE=true TOKEN=yourtoken
Alternatively you could use Orca to modify the msi.
New! Citrix has added a new page in their edocs regarding how to push the Citrix receiver and the switches available. You'll find it under Receiver for Windows - Installing Receiver for Windows.
Citrix Online Plugin SSOn with Windows 7 x64
I was having issues getting SSOn working with any version of the Online plugin on Windows 7 x64. Mainly I was working on getting it running with the Citrix Receiver 2.0 deploying Full online plugin 12.1.
Checked that ssonsvr.exe was indeed running.
Found that the GPO template provided by Citrix contains what appears to be invalid entries for the SSOn keys. (note that SSOn for winXP working using these settings)
http://forums.citrix.com/thread.jspa?threadID=262201&start=0&tstart=0
Finally, discovered that it *was* the credentials that SSOn was attempting to use. I found that using the FQDN for the domain field would result in a failure, but using the "pre-Windows 2000" domain name would work.
Bingo, the PNA services site was set to allow only the "pre-windows 2000" version of the domain name. On the services site I added a second allowed domain name as the fqdn and everything took off running. Apparently XP was passing through the domain name that I had allowed, whereas Windows 7 was using the FQDN (which would make sense).
Checked that ssonsvr.exe was indeed running.
Found that the GPO template provided by Citrix contains what appears to be invalid entries for the SSOn keys. (note that SSOn for winXP working using these settings)
http://forums.citrix.com/thread.jspa?threadID=262201&start=0&tstart=0
Finally, discovered that it *was* the credentials that SSOn was attempting to use. I found that using the FQDN for the domain field would result in a failure, but using the "pre-Windows 2000" domain name would work.
Bingo, the PNA services site was set to allow only the "pre-windows 2000" version of the domain name. On the services site I added a second allowed domain name as the fqdn and everything took off running. Apparently XP was passing through the domain name that I had allowed, whereas Windows 7 was using the FQDN (which would make sense).
Monday, December 13, 2010
Remove Sleep and Hibernate from Start Menu in Windows 7 via GPO
Looking around on the internet I found a LOT of incorrect and incomplete information on this.
To remove the sleep and hibernation options from the Windows 7 start menu via GPO do the following (this doesn't disable sleep entirely, just removes it from start menu, to disable sleep via GPO you can do a power plan with it set to 0 and then select the power plan):
Sleep:
Computer Configuration\Policies\Administrative Templates\System\Power Management\Sleep Settings
Allow Standby States (S1-S3) When Sleeping (Plugged In)
Set to disabled
Hibernate
Note that I tried changing the HibernationEnabled key with no success. Running processmonitor I found that this key and many others are updated, contrary to many of the posts I found on the internet. In addition I found that many of the proposed adm templates for this actually caused GPO processing failure (so beware).
Computer Configuration\Preferences\Windows Settings\Registry
Action - Update
Hive - HKEY_LOCAL_MACHINE
Key Path - SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Value Name - DisableHibernate
Value Type - REG_SZ
Value Data - %systemroot%\system32\powercfg.exe -h off
Common Tab - Apply once and do not reapply (optional)
To remove the sleep and hibernation options from the Windows 7 start menu via GPO do the following (this doesn't disable sleep entirely, just removes it from start menu, to disable sleep via GPO you can do a power plan with it set to 0 and then select the power plan):
Sleep:
Computer Configuration\Policies\Administrative Templates\System\Power Management\Sleep Settings
Allow Standby States (S1-S3) When Sleeping (Plugged In)
Set to disabled
Hibernate
Note that I tried changing the HibernationEnabled key with no success. Running processmonitor I found that this key and many others are updated, contrary to many of the posts I found on the internet. In addition I found that many of the proposed adm templates for this actually caused GPO processing failure (so beware).
Computer Configuration\Preferences\Windows Settings\Registry
Action - Update
Hive - HKEY_LOCAL_MACHINE
Key Path - SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Value Name - DisableHibernate
Value Type - REG_SZ
Value Data - %systemroot%\system32\powercfg.exe -h off
Common Tab - Apply once and do not reapply (optional)
Monday, May 17, 2010
BlackBerry Express Dispatcher service fails to start
Recently in an installation of BB Express with SQL Server 2005 Express I had some issues with the Dispatcher and SQL.
Event Type: Warning
Event Source: BlackBerry Dispatcher pubBESExpress
Event Category: None
Event ID: 25137
Date: 5/17/2010
Time: 10:11:24 AM
User: N/A
Computer:
Description:
{ConnectionItem::ConnectToDB} Failed to connect. Connection string is Provider=SQLNCLI.1;Server=servername\SQLEXPRESS;Database=BESMgmt;
This error was followed by:
Event Type: Warning
Event Source: BlackBerry Dispatcher pubBESExpress
Event Category: None
Event ID: 25105
Date: 5/17/2010
Time: 10:11:24 AM
User: N/A
Computer:
Description:
Failed to authenticate connection - local machine time may be out of sync with domain controller time. Please restart Windows Time Service.
I eventually found this here: http://supportforums.blackberry.com/t5/BlackBerry-Enterprise-Server/BES-5-0-Post-installation-Issues/td-p/420078 where Keithk23 nails it.
Set the SQL Browser service to automatic and started it and all was well.
Event Type: Warning
Event Source: BlackBerry Dispatcher pubBESExpress
Event Category: None
Event ID: 25137
Date: 5/17/2010
Time: 10:11:24 AM
User: N/A
Computer:
Description:
{ConnectionItem::ConnectToDB} Failed to connect. Connection string is Provider=SQLNCLI.1;Server=servername\SQLEXPRESS;Database=BESMgmt;
This error was followed by:
Event Type: Warning
Event Source: BlackBerry Dispatcher pubBESExpress
Event Category: None
Event ID: 25105
Date: 5/17/2010
Time: 10:11:24 AM
User: N/A
Computer:
Description:
Failed to authenticate connection - local machine time may be out of sync with domain controller time. Please restart Windows Time Service.
I eventually found this here: http://supportforums.blackberry.com/t5/BlackBerry-Enterprise-Server/BES-5-0-Post-installation-Issues/td-p/420078 where Keithk23 nails it.
Set the SQL Browser service to automatic and started it and all was well.
Subscribe to:
Posts (Atom)
