jake's blog

dribble from the Tech World

2. March 2012 09:12
by Jake Rutski

Windows Server 8: Offline servicing

2. March 2012 09:12 by Jake Rutski | 0 Comments

From the little that I've looked into Windows Server 8, my favorite new built-in feature is offline servicing. This was possible in the past with Windows Images (WIM files) using the dism.exe tool, but this new feature looks much more promising - the VHD is becoming a very powerful format.



This will make servicing VMs even easier.


16. September 2011 13:04
by Jake Rutski

SnapMirror from FAS to StoreVault

16. September 2011 13:04 by Jake Rutski | 0 Comments

First, a few warnings:


  • This is NOT supported by NetApp. At all. In any way shape or form.
  • Using anything other than the StoreVault Manager GUI can cause data loss.


You have been warned - do this at your own risk!
First some background - setting aside the fact that FAS to StoreVault is not supported at all - lets go Back to Basics: SnapMirror -
Volume SnapMirror operates at the physical block level. It replicates the contents of an entire volume, including all Snapshot copies, plus all volume attributes verbatim from a source (primary) volume to a target (secondary) volume. As a result, the target storage system must be running a major version of Data ONTAP that is the same as or later than that on the source.
Here's the problem - the StoreVault will likely be running OnTap (S version) 7.2.x and the FAS will be running 7.3.x - thus meaning that volume SnapMirror will not even work. In fact, if you try, you will probably receive an unspecified error when trying to initialize the mirror. What's the solution? Try to get your filers on the same major version? Good luck - especially since the StoreVault is EOL. Or use qtree SnapMirror.
The caveats:
What does this mean? It means that all the great features of VSM do not apply - particularly (in my case) SMVI integration. HOWEVER, all that said it is still possible to efficiently replicate all data from one filer to another based on a schedule. If you are mapping volumes (not qtrees) to LUNs in a VMWare cluster, you are likely wondering how QSM will work - that's where the trick is, and it's fairly simple.
First - remember that SnapMirror is always configured from the destination. Next, use the following syntax to setup a QSM to mirror the entire volume to a qtree:
snapmirror initialize -S SrcFiler:/vol/VolumeName/- DestFiler:/vol/VolumeName/qtreeName
The key is the '/-' to indicate the entire source volume. Also, do NOT create the qtree on the destination filer before initializing the SnapMirror - the initialize will create the qtree for you. This can also be done in the [unsupported] FilerView on the destination StoreVault to enable throttling and a schedule without having to go into the /etc/snapmirror.conf file.

29. August 2011 16:23
by Jake Rutski

The Case of the Print Spooler That Stops Running

29. August 2011 16:23 by Jake Rutski | 0 Comments

Recently, I had cleaned up a virus from a user's laptop - it was a fairly straightforward cleanup, and I thought I was done. Not quite. The user had said that her husband had been trying to print and was getting a print spooler error...had the spooler randomly stopped? I sent the command to restart the spooler. This did not work as it seemed the spooler continually stopped running. I then sent the path for the spool folder to see if there was some corrupt spool files that the spooler did not like - turns out that directory was empty. Finally I recomended to uninstall then reinstall the print drivers for the printer...long story short, the laptop came back in.

There was clearly an issue as the spooler stopped nearly immediately whenever anything print related was done - add a printer, view server properties. I tried removing the entire contents of the driver folder in the spool directory. Still nothing. As always- "When in doubt, run Process Monitor!"

I looked through the log to see what the spoolsv.exe process was doing - did not seem to be anything out of the ordinary. Then I found it: right before the spooler thread exits, there's a QueryOpen to a file in a temp directory:

Why was the spooler looking here? Was this somehow a spool file? I figured I would just rename the file and see if that helped -



Sure enought that worked - I could now use all printing functions on the system...but what the heck was 17EB.tmpjQuery15209008132997218726_1340742345248 Let's check the stack:

Bingo! The description of this image (Zhgemubqnkekkwthf) matches one of the .exe files associated with the malware I had cleaned previously. Additionally, I have heard of malware associated with 'Heaventools Software'. Now the root cause analysis: why did any print function hose the spooler? Clearly this was the cause, but what continually called it? Let's check the registry:

So the malware had injected itself as a print provider. Anytime that a print function was called, the malware would have likely recopied itself, or run one of the executables I had already deleted or done something else undesirable. Additionally, it was added to all ControlSet trees.....it was also REMOVED from the registry entirely, and fixed.


26. August 2011 11:03
by Jake Rutski

Aironet AP Missing config command?

26. August 2011 11:03 by Jake Rutski | 0 Comments

Doing just a simple SSID and security change on an AP, I was using the web GUI. But then I was not able to successfully enable WPA, so I resorted to the CLI, only to find that I couldn't even get into global config mode!
-----ES-AP#config t
% Invalid input detected at '^' marker.

Exec commands:
  <1-99>           Session number to resume
  access-enable    Create a temporary Access-List entry
  access-template  Create a temporary Access-List entry
  archive          manage archive files
  cd               Change current directory
  clear            Reset functions
  clock            Manage the system clock
  connect          Open a terminal connection
  copy             Copy from one file to another
  crypto           Encryption related commands.
  debug            Debugging functions (see also 'undebug')
  delete           Delete a file
  dir              List files on a filesystem
  disable          Turn off privileged commands
  disconnect       Disconnect an existing network connection
  dot11            IEEE 802.11 commands
  dot1x            IEEE 802.1X Exec Commands
  enable           Turn on privileged commands
  erase            Erase a filesystem
  exit             Exit from the EXEC
  format           Format a filesystem

Where's the configure commandjQuery15205602584033231411_1340742310610? This one had me confused for a while...but then I did a show version:

cisco AIR-LAP521G-A-K9     (PowerPCElvis) processor (revision A0) with 24566K/8192K bytes of memory.
Processor board ID #############
PowerPCElvis CPU at 262Mhz, revision number 0x0950
Last reset from power-on
1 FastEthernet interface
1 802.11 Radio(s)
And there in the unit model number AIR-LAP512G - this is a lightweight AP!! And there's not even a controller at this site?!?!

24. August 2011 12:35
by Jake Rutski

RemoteApp Icons missing

24. August 2011 12:35 by Jake Rutski | 3 Comments

I ran into something strange when adding the Failover Cluster Manager tool to RemoteApp - the icon on both the RD web services site and RemoteApp and Desktop Connections did not show properly - here's what I mean:


The above was taken from RemoteApp and Desktop connections - here's what it looked like on the RD Web Services site:


As you can see, the Failover Cluster Manager app has the standard RDP connection icon. Something is clearly wrong with this - all other icons are showing correctly.

First troubleshooting step: Clear the icon cache on the RD Web Services - on the server, the icon cache is located at: C:\Windows\Web\RDWeb\pages\rdp All of the image files and RDP files in this directory can be safely deleted - when you re-open the RD Web Services site (or refresh it) it will reload all of the images and files in the cache folder. This did not work - the Failover icon was still the default RDP icon.

Second troubleshooting step: Remove then re-add the app in RemoteApp Manager. This led me to the solution - the first re-add did not work, however I noticed that the path (as on all other icons in RemoteApp) is a UNC path to the server hosting the app - for example \\rdserver\c$\Windows\... This got me thinking about permissions - I check all directory permissions - which were all correct. Then I ran RemoteApp explicitly as Administrator. When adding the app back, the path to the icon file became a local path - and upon refreshing the site, all icons showed correctly! As a side note, when running RemoteApp Manager as Administrator, you cannot change the user assignment on the app when first creating it.

I'm not sure if it was because of running RemoteApp Manager as Administrator explicitly or the path to the icon - which in this case is different from most others - C:\Windows\Cluster.


16. August 2011 16:51
by Jake Rutski

Data Protection Manager 2010 - Backup to [empty] Disk

16. August 2011 16:51 by Jake Rutski | 0 Comments

When I transfered most of my VMs over to shared storage, I didn't really have the time (or money) to build a respectable storage environment. Needless to say there are some VMs that are stored on non-redundant storage....but most are on at least a RAID1 volume. It was at this time I decided to install Data Protection Manager 2010 and start getting things backed up. Obviously I will be using backup-to-disk as 1. no tape drives or libraries and 2. not paying for cloud storage for a home environment.

The bit that I was confused about was adding storage - Don't add disks into a DPM storage pool if you have the whole disk allocated with a volume - the operation will be successful, but you will not have any available space for DPM to allocate and use.

The way DPM B2D works is by allocating each replica its own individual volume then mapping it into the DPM directory. Here's how it will look:


Each volume is mapped to the DPM directory - it's a bit of a long winded path:

C:\Program Files\Microsoft DPM\DPM\Volumes\Replica\Microsoft Hyper-V VSS Writer\

The directory will also depend on which type of replica - in this case, these volumes all correspond to Hyper-V snapshots...but if you browse further down into the directory, it is a full snapshot of the VM storage - VHD and config files - as you would expect.



12. August 2011 12:38
by jake rutski

Fine Tuning Media Center 7 - Is it all worth it?

12. August 2011 12:38 by jake rutski | 0 Comments

See Part 2 here.

I didn't think that it would come to this...but we have finally switched to a cable box, and I'll be re-purposing the Media Center PC shortly. This post has 2 purposes: 1. To help me make sure I did the right thing and work out ways to get functionality back. 2. Help anyone that is thinking about going this route make the decision. We have used a Media Center based TV for nearly 5 years now. It wasn't always easy as you may have guessed from some of my other posts - and there were times where I almost gave up completely. This time, the 2nd media hard drive in the system failed, and we were greeted with a BSOD. Upon reboot, the system hung completely. I booted into WinPE from a USB key I keep around and as soon as I [tried] to run Diskpart - I knew what the problem was. When the drive was unplugged, the system booted just fine.

Several friends and family have asked about having me setup this kind of system for them...and the answer has always been "it's expensive, and you're knowledge of PCs doesn't meet the requirements". I believe one of the biggest problems is that Windows is a General Purpose Operating System - there's just too much 'other' functionality built in that gets in the way of Media Center. The other major problem with Media Center is thanks to cable providers and broadcast companies that want to have WAY too much control of content. Why the hell is there even a need for a flipping cable card? An OCUR device is really just a QAM tuner with a decryption engine - HD channels work fine if they are not encrypted (and some of them still are not encrypted). Even the term "OCUR" scares broadcasting companies - "Open Cable"?!?! They all want a closed system...anyway, I digress.

Our system has been through several changes - hardware changes, upgrades...we started with one QAM tuner (when most HD channels were not yet encrypted) then I purchased 2 ATI DCT CableCard tuners. We started with Vista, then the [ahem...hacked...] TV Pack 2008 update, then Windows 7 and finally the digital cable adviser tool. I believe that Media Center is a great product - when it works, it's just plain awesome. Every single person that saw it was always impressed - but when it doesn't work...it just sucks. So here's the meat and potatoes: The 'Pros' are things that make Media Center awesome - and in my case, I'm trying to work out ways to replace them. The 'Cons' are things that are in the most general sense "Things that get in the way of watching TV". Granted some of the cons may be specific to my hardware setup and environment, but still - it's good to know what CAN happen.

The Pros:

  • Audio Library
    • Having your entire music library at hand is always nice - and if it's not stored on the PC itself, across the network works just fine too. It's searchable by artist, album, song name, or playlist, AND while the music is playing, the background image - a scrolling mosaic of all of your album covers - just looks fantastic on a large TV. I have found that the only problem with this is can be having TOO MUCH music to search through - playlists can fix this for the most part, but that is more work. Not to mention all of the online content from streaming services such as Pandora.
    • The Replacement: Music to either the TV or PS3 via DLNA. And as soon as I can get my hands on a receiver with DLNA support, the better.
  • Picture Library
    • There are two parts to this - the first is being able to do a full screen slideshow of a folder of pictures (or everything) with music in the background. The second part is the default "screen saver" in Media Center - it is a B&W mosaic of all pictures in the library that is constantly scrolling, zooming in, and changing. It really is a great conversation piece - the ultimate digital photo frame. While it is nice, I found that we only used this feature when guests were around or when we went on a trip.
    • The Replacement: Photos to the TV or PS3 via DLNA
  • Video Library
    • Much like the above - we all know that a PC can play nearly ANY multimedia content. This includes downloaded movie trailers, videos taken from a camera, movies, and the other big portion of this section - online video content such as youtube, hulu, Netflix, etc. Keep in mind that the Netflix plugin for Media Center is a native plugin and works perfectly.
    • The Replacement: A combination of DLNA and the Netflix plugin on the PS3...and OnDemand - see below. While it won't play everything, it's not terrible.
  • Excellent DVR
    • Your MediaCenter-based DVR is limited in storage space by the amount of hard drive space you have - and when you think about the fact that any storage type is supported (external drives, flash, USB thumb drives, network drives, iSCSI...) - the storage truly is unlimited. Additionally, if a show is not marked with copy protection, you can copy the .wtv file to any Windows 7 PC and watch it over and over. This also includes the live tv pause buffer - this part is nice - phone rings right when the killer is revealed? That's what pause is for.
    • The Replacement: Sadly - none in this case. We found that we did not record that much any more, and chose not to use a DVR from the cable provider...and yes, we already miss the pause buffer
  • Video Upconversion
    • I don't know if this is the true version of "up-converting" to 1080P, but the TV was always in 1080P mode regardless of what was being displayed.
    • The Replacement: None - this does not really apply.
  • Built in optical drive
    • No need for more boxes here - the DVD player is built right in to the box - and the drive looks nice too! On top of that, while I never had a chance to do this, Blu-Ray internal drives have been available for some time and are becoming more and more affordable.
    • The Replacement: PS3
  • Huge PC
    • Having a computer connected to a large TV is just nice...forget tablets being all the rage - this is a full PC with a GIANT screen and a wireless full keyboard and mouse. Don't knock it until you try it. And did I mention games? Ever played Dawn of War on a 55" screen? I didn't think so.
    • The Replacement: None.
  • Sports package
    • All scores listed for all major leagues, plus near-play-by-play during games. Additionally, there is a FoxSports add-in that allows for stories, news, and commentaries that's built for the Media Center.
    • The Replacement: None.


The Cons:

  • Boot time\Sleep issues
    • I'm lumping these two together as I feel like they are related. If you read the previous post about Power Optimization then you know that the only way to make a Media Center usable daily is to have it go to sleep and wake from sleep - this way it appears that the TV powering on is nearly instant. In Windows 7 - the sleep function works great. But you have to realize how many times you power on and off a TV - quite a few. Otherwise, it's a full boot from no power and you're waiting for a minute or so before the system is fully usable. There were also times where I would bring the system up from sleep, everything would be powered on, but the TV would be completely black...moving the mouse around, I could hear the tones when rolling over the guide...Ctrl+Shift+Esc would open task manager, but Media Center would always be in focus. Sometimes I could get it to close - and no, Alt+F4 didn't work. I don't know what was causing this, but it was quite annoying - fortunately it didn't happen all that often.
  • Guide jump to Recorded TV
    • This also happened semi-frequently: when selecting 'Guide' from the menu, the cursor would slide back one space left to 'Recorded TV' and select it. I don't know if this was a remote control issue or IR receiver issue, but it was annoying. A close and re-open of media center resolved this one.
  • Overall remote issues
    • I'm going to blame this one on the i-Mon IR receiver and LCD package that is a part of the PC case. Don't get me wrong - the LCD is pretty cool, even more so when the ability to turn it off quickly and schedule on\off times was released in software. Also, not having an external IR receiver was also nice as there was one build next to the LCD screen in the case - but its reception SUCKED - it required pretty close to direct line of sight and there always seemed to be just a tad bit of a delay. It's even more evident with a cable box as we can have the remote sitting on the coffee table and can still change the channel. And no, the multiple IR emitter array in the Harmony remote didn't help with this one. There were also key repeat\key stuck issues - if you tried to punch in channel 438 - you might end up on channel 433333333333333333333333.
  • No OnDemand
    • This is a known limitation of the setup from the very beginning - if you are using a CableCard, you don't get OnDemand (or an interactive Guide, but the MediaCenter took care of that). This is because the whole premise of the CableCard is that it works in an OCUR - Open Cable Unidirectional Receiver. But the strange part that I don't understand: look inside of a cable box...what do you see? A CableCard. WTF?!? Either way, I must admit that OnDemand is pretty nice - especially now that the cable companies keep touting the service and adding content to it.
  • Hardware failure
    • This is what brought us to this point. Two failed (or failing) hard drives, weird motherboard issues where the system wouldn't boot if a cable was not sitting the right way (that's the only thing I can figure - if it was happening, the fix was to pop open the case and jiggle wires....it worked)
  • Heat and Noise
    • Also known as "everything you would expect from a very high performance PC". Let me explain: 2 Digital Cable Tuners (and these things get frigging HOTT!!), a dual-slot high end video card, 8GB of RAM with heat sinks, 2 hard drives - one of which has constant, high I/O, and a 3.2GHz CPU. All of this on air cooling. In a micro-ATX case. With just 2 120mm fans in the case. I know - not the best case, but aesthetically, it is an awesome case. It looked very nice, it was approved by the "review board" of the house, had a nice flip-door for the optical drive tray, and a built in IR receiver. On days when it was hot outside and the A\C in the house was not on full blast, this thing got loud...that's all there is to it.
  • Cable provider service updates
    • This happened when we went to the Cable Card tuners and there are two parts to this - and they are both VERY frustrating. The first is caused because of the fact that Cable Cards are VERY rare for cable providers - VERY FEW subscribers use them, so when there is an issue with yours, good luck getting it fixed. The Cable Card must be paired to the Receiver and stay with that receiver in order to work. We went through weeks where one of the two tuners would not work....I probably spent hours on the phone trying to get it all sorted, but never did. This problem was actually caused by the second part of this section: If the cable provider sends out a channel update and your system is turned off or asleep, you won't receive the update and it will need to be manually sent out. The channel table is what tells the guide what channel number is what station - the service provider can (and will) change the channel lineup at will, and this can get difficult. Also, if you change your service to get a new package or premium channel - an update will need to be sent to your receiver(s). When non-CableCard proficient support personnel try to work on CableCards - things just don't work out. The long story short is that cable boxes work natively with the cable system - everyone can work on them, and do not require special attention.

9. August 2011 08:41
by Jake Rutski

SBS System drives running out of space

9. August 2011 08:41 by Jake Rutski | 0 Comments

I have seen this issue more and more lately...don't get me wrong, Windows SBS is a perfect solution for smaller businesses that can't afford a more robust infrastructure...however - the nature of Small Business Server can be its downfall: all applications and core services running on a single server. Thus the problem: a SBS system drive tends to run out of space quick.

Consider the following applications\services running on a single box:

  • Active Directory Domain Services
  • IIS Website(s)
  • Exchange
  • SQL Server instance(s)
  • SharePoint
  • [pagefile]
  • Anti-Virus server\management
  • Backup application
  • ...

If not thought about when setting up SBS initially, the system drive will be given some standard size - let's say 25GB - then partition the rest out for file shares, etc. This space will be full in no time!! There needs to be a warning in SBS setup that the system drive needs to be at least 40 - 60GB...if not larger. A 25GB system drive is just fine for a single-role member server, but SBS is COMPLETELY different.

Here's a blog from TechNet describing how to reclaim some space in SBS 2003\2008: TechNet: Recovering Disk Space on the C: Drive ... clearly this is an issue that has come up before...

And sure SQL and Exchange DB's can be moved easily enough...and the pagefile also...but what about 3rd party applications that either MUST be installed on the C: drive, or cannot be easily moved once installedjQuery15208511156332965185_1341255164768 One of the biggest hogs of space I have found is SEP. It is possible, while not the easiest thing to do, to get both the AV content directory and the database (embedded SEM5) moved post-install, with minimal downtime.

The database move is fairly straightforward assuming you have space elsewhere and know all of the credentials: Move SEM5.db for SEP 11

Moving the content directory is a bit more tricky, but Symantec has a TECH article to follow. It's really just creating a symbolic link to the directory that points elsewhere, but it is just nice to know that Symantec supports this configuration: Symantec TECH 148333

20. July 2011 09:08
by Jake Rutski

Cardmember Service hijacked

20. July 2011 09:08 by Jake Rutski | 0 Comments

The other day a user sent me a screenshot of an online banking website with a comment of "I have a virus..?" I was happy that the user had learned to spot malware or fraudulent activity so quickly....but as it turns out, the user had already called the bank and spoke to the support team - they were the ones that informed the user about having a virus. I tried logging in to the banking site impersonating the user...and everything looked normal - she was in fact infected. Here's what the site looked like:

Clearly that white box is the problem - my favorite part is the "...need to ask for additional information when you access you account online." So - no other sites were being 'attacked' in such a manner - only this financial site. As a bonus, the malware even ripped off the address logo and pasted it into the pop-up window.

Sadly, I did not have time to troubleshoot this further to determine the root cause - this workstation was in desperate need of a re-image anyway, so I just proceeded with doing that. Problem resolved.