Ben’s Tech Blog

I re-installed Vista on my laptop a few days ago and since rebuilding I haven’t been able to download the latest version of messenger - It always comes up with “page cannot be displayed”. I tried a lot of different things but still couldn’t download it. In the end I managed to download MSN Messenger 7.5 and then upgrade by logging into my machine as an administrator and logging into MSN messenger. When logging in it asked me if I wanted to upgrade - It then downloaded the latest version successfully. I’m still not sure why I couldn’t download it directly from the webiste but the main thing is that I’ve got it installed now. I thought I’d post this in case it helps anyone else.

We recently noticed that there were some blank entries in the GAL, in other words, there was a completely blank line between some objects in the GAL. If I double-clicked on any of these blank entries I’d receive the following message:

The properties dialog box could not be displayed. Internal MAPI error: An unsupported interface was requested of an object property. Contact your administrator.

The blank entries where only included in the ‘online’ GAL, offline address books were not affected, as well as Outlook Web Access and Outlook Mobile Access.

It turned out that someone had modified the security ACL of an OU, and Exhange no longer had access to view these users. The OU contained user objects for users who had left, but they were still mail-enabled, although interestingly enough, hidden from address lists. Once I set the permissions of the OU back to the default (which includes rights for the Exchange Domain Servers and Exchange Enterprise Servers, and rebuilt the domain RUS object the blank entries disappeared.

It isn’t possible to create a checkpoint with SCVMM beta1 for VMs that are running. The obvious solution is to write a script to stop the VM first, then create the checkpoint and start it again. I’ve written a script that does exactly that, and it does it for all running VMs.

When I first looked at the checkpoint feature I was dissapointed that there wasn’t an option to add a description. I’ve discovered that while it’s not possible to add and view descritptions through the GUI, you are able to do it using PowerShell.

The following script stops all running VMs, creates a checkpoint with a description, then starts the VMs again.

$VMs = Get-VM -server localhost | where{$_.VMState -eq 'Running'}
$StopVMs = $VMs | Stop-VM
$CheckpointResult = $VMs | New-VMCheckPoint -description "CheckPoint created from script"
$StartVMs = $VMs | Start-VM

You won’t be able to view the description through the GUI, but you can see it if you retreive the checkpoint information via the Get-VMCheckpoint cmdlet:

Get-vmcheckpoint -server server1

Note that server1 is the SCVMM server, not a VM. The cmdlet will list all checkpoints for all VMs that are managed by SCVMM. There is a -VM option, but it doesn’t work with beta1 (along with a lot of other options) There is a way to get around this limiation however, and that is to get the VM object first and then use the Get-VMCheckPoint cmdlet. You can do this for other commands like Start-VM and Stop-VM as well. Here’s an example, including the output:

PS C:\> $VM = "wnlabap101"
PS C:\> $VMObject = Get-VM -server localhost | where{$_.Name -eq $VM}
PS C:\> $VMObject | Get-VMCheckPoint -server localhost

VM : WNLABAP101
ObjectType : VMCheckpoint
Accessibility : Public
Name :
Description :
CreationTime : 12/03/2007 1:25:08 PM
ModifiedTime : 12/03/2007 1:25:11 PM
AccessedTime : 12/03/2007 1:25:11 PM
MarkedForDeletion : False
MostRecentTask :
ServerConnection : Microsoft.VirtualManager.Monad.Remoting.ServerConnection
ID : 899be449-6130-41ba-bbe9-ba47ae907981

Well I promised that I’d post again soon, and I think 2.5 hours later fullfills that promise! Now that I have the basics down, I looked at creating the most obvious script - “Start all VMs that are stopped”. I did a lot of googling and couldn’t find any examples, so I worked it out myself - not that it is very complex at all. Here are the 2 lines of code that will start all stopped VMs:

$StoppedVMs = Get-VM -server localhost | where{$_.VMState -eq 'PowerOff'}
$StartResult = $StoppedVMs | Start-VM

It’s very straight forward; the first line creates a collection of VMs that are stopped. The second line starts each VM based on that collection. I used $StartResult simply to suppress the output created by the Start-VM cmdlet. The next script that I am planning to create will stop a VM, create a checkpoint and then start it again.

When I first fired up Powershell I was searching for the SCVMM related cmdlets but couldn’t see them. I ran Get-Command to list all the cmdlets but I didn’t see any related to VMs. I saw a reference to a Get-VM command after doing some googling, but when I tried to run the command it failed with:

PS C:\> get-vm
'get-vm' is not recognized as a cmdlet, function, operable program, or script file.
At line:1 char:6
+ get-vm <<<<

This was becuase I had started powershell using the shortcut from the PowerShell 1.0 start menu folder and not the shortcut from the Microsoft System Center Virtual Machine Manager 2007 start menu folder.

If you take a look at the shortcut’s target, you can see that it is starting powershell with the -PSConsoleFile switch:

"C:\Program Files\Windows PowerShell\v1.0\powershell.exe" -PSConsoleFile "D:\Program Files\Microsoft Systems Center Virtual Machine Manager 2007\bin\cli.psc1" -NoExit

So it appears that the SCVMM cmdlets are loaded from the cli.psc1 file that is included in the shortcut target, and that would explain why my first attempt at executing Get-VM didn’t work.

Once I started using the correct shortcut I started to explore all of the SCVMM related cmdlets. Get-Command is a good way to do this. You can also use Get-Command *vm to list all of the commands that end in “vm”. This however won’t list all of the commands related to SCVMM as not all of them are associated with VM functions. For example there are also cmdlets associated with Virtual Hard Disks.

I’ve listed all of the SCVMM cmdlets below. To generate this list I used Get-Command | CLIP which outputted all of the cmdlets to the clipboard. I then pasted the restults in notepad and removed all of the non-SCVMM commands by comparing them against the same results that I generated from the standard powershell console (by using the standard shortcut).

Add-VFD
Add-VirtualDisk
add-vmhost
add-vmhostnetworkadapter
Copy-HardDisk
discardsavedstate-vm
discover-vmhost
Get-DVDDrive
Get-FloppyDrive
Get-HardwareConfig
Get-ISO
Get-LibraryServer
Get-MachineConfig
Get-NetworkAdapter
Get-OperatingSystem
Get-OSConfig
Get-Script
Get-SelfServicePolicy
get-step
get-task
Get-Template
Get-VFD
Get-VirtualDisk
get-virtualnetwork
Get-VM
Get-vmcheckpoint
get-vmhost
Get-VMHostGroup
get-vmhostnetworkadapter
Get-VMHostRating
get-vmhostvolume
Move-VM
Move-VMHost
Move-VMHostGroup
New-DVDDrive
New-HardwareConfig
New-MachineConfig
New-NetworkAdapter
new-OSConfig
new-p2v
New-patchcache
New-SelfServicePolicy
New-Template
new-virtualnetwork
New-VM
New-vmcheckpoint
New-VMHostGroup
refresh-vm
refresh-vmhost
Remove-DVDDrive
Remove-HardwareConfig
Remove-ISO
Remove-NetworkAdapter
Remove-OSConfig
Remove-Script
Remove-SelfServicePolicy
Remove-Template
Remove-VFD
Remove-VirtualDisk
remove-virtualnetwork
Remove-VM
Remove-vmcheckpoint
remove-vmhost
Remove-VMHostGroup
remove-vmhostnetworkadapter
restart-task
restart-vm
Restore-vmcheckpoint
resume-vm
savestate-vm
Set-DVDDrive
Set-FloppyDrive
Set-HardwareConfig
Set-ISO
Set-NetworkAdapter
set-OSConfig
Set-Script
Set-SelfServicePolicy
set-server
Set-Template
Set-VFD
Set-VirtualDisk
set-virtualnetwork
Set-VM
set-vmhost
Set-VMHostGroup
shutdown-vm
start-vm
stop-task
stop-vm
Store-VM
suspend-vm


Normally, if you want to learn more about a command, you can use get-help and specify the command. However if I use Get-Help Get-VM I get an error:

PS C:\> get-help get-vm
Get-Help : Error loading help content for Get-VM from file "Monad.ImgLibCmdlet.
dll-Help.xml". Details: Monad.ImgLibCmdlet.dll-Help.xml.
At line:1 char:9
+ get-help <<<< get-vm

I beleive this is because the help file for the command hasn’t been written yet (it is only Beta1 after all!). This is consistent with the fact that the help file for the SCVMM console is mostly empty too. I discovered another way to find out more information about each command. Using Get-Command lists a ‘Definition’ column, but most of the text is truncated. However, if you use the Format-List option it will output all of the text:

PS C:\> get-command get-vm | format-list

Path :
AssemblyInfo :
DLL : D:\Program Files\Microsoft Systems Center Virtual Machine Ma
nager 2007\bin\Monad.ImgLibCmdlet.dll
HelpFile : Monad.ImgLibCmdlet.dll-Help.xml
ParameterSets : {__AllParameterSets}
ImplementingType : Microsoft.VirtualManager.Monad.Cmdlets.GetVMCmdlet
Verb : Get
Noun : VM


This helped me get a bit further with scripting SCVMM, becuase some of the cmdlets prompt for values unless you specify them. For example, if you use Get-VM it will prompt for a server value:

PS C:\> get-vm

cmdlet get-vm at command pipeline position 1
Supply values for the following parameters:
Server:

The server value required is the name of the SCVMM server. You can pipe the name by issuing the command with the -server option, e.g get-vm -server "labscvmm01". This will allow you to actually use the command in a script.

That’s all I’ll cover in this post, but I have more to add so watch this space!

I’m currently setting up a Microsoft System Center Virtual Machine Manager (SCVMM) environment. I can see that there are quite a few things that I’d like to script (starting and stopping VMs, creating checkpoints etc) so it’s time to start playing around with PowerShell.

One of the first things that I noticed was that I wasn’t able to run .ps1 scripts due to the execution policy. By default, only interactive commands can be run in PowerShell; all scripted commands are restricted. You can however change this to one of these settings:

Restricted
- Default execution policy.
- Does not run scripts.
- Interactive only.

AllSigned
- Runs scripts.
- All must be signed by a publisher that you trust.

RemoteSigned
- Runs scripts.
- Downloaded files must be signed by a publisher that you trust.

Unrestricted
- Runs scripts.
- No digital signature is required.

(note that I pasted the settings from the help text that generated by running Get-Help Set-ExecutionPolicy)

To get started, I set it to RemoteSigned by running the following command:

set-executionpolicy RemoteSigned

Once I set the execution policy I was able to run .ps1 files. To run a .ps1 file, open notepad and paste in a powershell command, for example write-host "test", then save the file with a .ps1 extention, for example test.ps1. To run the script, open PowerShell and type in the full path name of the file. Note that you can ommit the extension:

PS C:\> c:\scripts\test
test

If you are already in the correct directory (which you can change by using cd\ c:\scripts then you can just issue .\test:

PS C:\Scripts> .\test
test

So that’s it. I’ll post some more examples specific to SCVMM once I’ve got some scripts working.

I was updating a link that we have in our MailSweeper 4.3 notification messages (i.e the messages that are sent to recipients when an email is blocked), and came across an issue. The new link contained a space, so it had ‘%20′ in it. For example, http://intranet.net/email%20policy. The problem was that Mail Sweeper uses the ‘%’ symbol to identify a ‘token’ as they call it. This was screwing up the message notification and causing it to remove all the text between the ‘%’ in ‘%20′ and then next ‘%’, which happened to be a few lines down. This makes sense because it assumes that any text between two ‘%’ symbols is a token.

I managed to implement a work-around by encapsulating the link with < > brackets instead of using ‘%20′ for the space. So, I inserted the link like this instead:

<http://intranet.net/email policy>

I recently built some Microsoft CRM 3.0 servers and came across a problem when trying to create the CRM databases on a SQL server. The CRM installation routine was returning the following error:

Action Microsoft.Crm.Setup.Server.InstallDatabaseAction failed.
The Microsoft Search service cannot be administered under the present user account

I made sure that the account that I was using to install CRM (and effectively create the CRM databases) had local admin rights on the SQL server. As it turned out, this problem was actually caused by a documented issue where the Microsoft Search Service can become out of sync with the SQL service account if the SQL service account is changed via the services applet instead of Enterprise Manager. As the following article explains, when the service account is changed via Enterprise Manager, SQL Server adds itself as an administrator to the Microsoft Search Service.

http://support.microsoft.com/default.aspx?scid=KB;EN-US;277549

Once I changed the service account to use the system account, and then back to the domain service account via Enterprise Manager I was able to successfully create the CRM databases during the CRM installation routine.

The Windows Server 2003 Active Directory Users and Computers snap-in (ADUC) includes the ‘Saved Queries’ feature which allows you to save queries for future use. One of the nice things about this feature is that once you save the query you can view the actual LDAP query string. You can then proceed to customize the string, or copy and paste it into a script for example.

The biggest shortfall that I see with the ADUC find/search utility, is when it comes to selecting a Condition, and this is where you may need to customise a LDAP query. The drop-down allows you to choose from Starts with or Ends with etc, but what about Contains? If you want to search all users to find a description for example that contains a word or phrase anywhere in the description you can’t using the standard method. This is where using a saved query comes in handy.

The easiest way to construct a custom query is to start by creating a query that is close to what you would like to search for. In this case you could construct the query by using either Starts with or Ends with as the condition, and then modify the query string once its saved. I’ll run through this now.

1. Right click on Saved Queries, then Select New -> Query.
2. Give the query a name, then click on Define Query
3. In this example, we’ll just search users, so select Custom Search from the drop-down.
4. Click on the Field button and select User -> Description.
5. Select Starts with and enter the text that you want to search for, e.g “test lab”, then click on Add.
6. Click on OK. Notice that the Query string field is now populated. Highlight and copy the Query string text and click on Define Query again.
7. Higlhight the criteria that you added before and click on Remove.
8. Click on the Advanced tab, and then paste in the query text
9. At this point you can now customise the query text. To search for descriptions that contain “test lab”, you need an asterix (*) on either side of the text. So you need to add an asterix to the end of the search text so that it looks like the text in the image below.

10. Click on OK, then OK again.
11. Right click on the Saved Query and click on Refresh. You’ll see that users with “test lab” anywhere in the description will be listed, for example, a user with “Sydney test lab user account” as the description would be listed in the results.

Of course, customizing your LDAP searches can allow you to do a lot more than what I just demonstrated. If you start exploring ADSI Edit you’ll find more attributes of objects that you can search on that aren’t listed in the ADUC search fields. For example, if you wanted to search for all users that have mailboxes on a particular Exchange server, you could use the msExchHomeServerName attribute. Your LDAP query would like something like this:

(&(&(objectCategory=user)(msExchHomeServerName=/o=OrgName/ou=AdminGroupName
/cn=Configuration/cn=Servers/cn=ServerName)))

The LDAP queries that you construct aren’t limited for use in ADUC, you can implement them in scripts that perform LDAP queries or third-party software that performs LDAP lookups for example. The ADUC saved queries feature just allows you to construct the basic query, from there you can modify it to do what you need. I should point out that you can also construct LDAP queries and view the LDAP string when you create Query-based distribution lists, or Exchange Address Lists/GALs.

When you connect to a resource on another machine and supply a username/password, you are given the option to “save password”. It took me a little while to find where these credentials are stored in Windows XP, so I thought I’d share it with you.

The process is slightly different depending on whether or not the logged on user has local admin rights.

Viewing cached credentials – with Admin rights

Viewing cached credentials – without Admin rights

In either case, you will be presented with the following box that allows you to add, remove or modify cached credentials.

One of the issues that I’ve come across at various times in the past is that you can only authenticate to a machine with a single set of credentials. In other words, if you map a drive to \\server1\share1 as UserA, then you cannot map a drive to \\server1\share2 as UserB. You need to use a single user account that has access to both shares.

A while back we needed users to access resources on a server in an untrusted domain (in other words, there was no trust relationship between the two domains/forests). Because the server was in and untrusted domain, users were prompted for a username and password when they tried to access an application stored on the server. We created a generic account in the destination domain so that users could connect to the server and access the application. However, the server was also a file server, and some users needed to access another share with a specific user account that the generic account didn’t have access to. The problem was that the users had already connected to the server with the generic account and had saved the password. This is where being able to remove the saved credentials came in handy. Once we removed the cached credentials of the generic account, we could then have users connect to the server with the specific account and access both the application and the data share.