Here is the 3rd of 3 Sample Videos available for System Engineers, System Architects and Consultants focused on Windows 2008 SP2 Failover Clustering.  Specifically, I would like to call out the Sample Videos available at No Charge on Windows 2008 SP2 Failover Clustering for Highly Available File Services.   This Blog entry is from ‘Task 15 -Review Operational Monitoring capabilities for both Cluster Nodes using the System Center Operations Manager 2007 SP1 Console’.  Below you will find links to the Course Syllabus and the Conceptual Diagram of the Virtualized Lab Environment in which these Videos were created.  Take a look.

These Video Samples are approximately 07:30 of content working at the Console and are designed to provide a ‘feel’ for how this Training Material is offered.

Windows 2008 SP2 Failover Clustering for Highly Available File Services – Sample Video from Task 10

Windows 2008 SP2 Failover Clustering for Highly Available File Services – Sample Video from Task 12

Windows 2008 SP2 Failover Clustering for Highly Available File Services – Sample Video from Task 15 (Video Below)

Here is the 2nd of 3 Sample Videos available for System Engineers, System Architects and Consultants focused on Windows 2008 SP2 Failover Clustering.  Specifically, I would like to call out the Sample Videos available at No Charge on Windows 2008 SP2 Failover Clustering for Highly Available File Services.   This Blog entry is from ‘Task 12 -Review the Client Experience upon Moving File Services from Cluster Node to Cluster Node using a Windows 7 Enterprise Edition Client Workstation’.  Below you will find links to the Course Syllabus and the Conceptual Diagram of the Virtualized Lab Environment in which these Videos were created.  Take a look.

These Video Samples are approximately 07:30 of content working at the Console and are designed to provide a ‘feel’ for how this Training Material is offered.

Windows 2008 SP2 Failover Clustering for Highly Available File Services – Sample Video from Task 10

Windows 2008 SP2 Failover Clustering for Highly Available File Services – Sample Video from Task 12 (Video below)

Windows 2008 SP2 Failover Clustering for Highly Available File Services – Sample Video from Task 15

These Video Samples are approximately 07:30 of content working at the Console and are designed to provide a ‘feel’ for how this Training Material is offered.

Windows 2008 SP2 Failover Clustering for Highly Available File Services – Sample Video from Task 10 (Video below)

Windows 2008 SP2 Failover Clustering for Highly Available File Services – Sample Video from Task 12

Windows 2008 SP2 Failover Clustering for Highly Available File Services – Sample Video from Task 15

Windows 2008 R2 SP1 Hyper-V Component Architecture Poster – Download

Windows 2008 R2 Service Pack 1 – Download

Lynn Lunik
Chief Security Architect
IT Pro Secure Corporation
blog@itprosecure.com

Blog Tags: Amazon Web Services, Forefront Client Security, Forefront Endpoint Protection 2010, Hyper-V, Virtual PC 2007, SCOM2k7, SQL2k8, Windows 7, Windows 2008, Exchange 2007, Exchange 2010, Failover Clustering – ITPS, Failover Clustering – LL

Microsoft Lync 2010 Visio Stencil Download

Lynn Lunik
Chief Security Architect
IT Pro Secure Corporation
blog@itprosecure.com

Blog Tags: Amazon Web Services, Forefront Client Security, Forefront Endpoint Protection 2010, Hyper-V, Virtual PC 2007, SCOM2k7, SQL2k8, Windows 7, Windows 2008, Exchange 2007, Exchange 2010, Failover Clustering – ITPS, Failover Clustering – LL

Microsoft is offering a Beta Version of the Attack Surface Analyzer Tool.  This application provides several functions to Developers, System Engineers, Architects and Consultants.  Specifically, the work of the Attack Surface Analyzer is to compare a Workstation/Server in a known good state to the same Workstation/Server after an Application is Installed and Fully Configured.  How does it work?  Take a look at this sequence for the Attack Surface Analyzer to better understand this comparison.

Step 1 – Install a ‘clean’ Workstation/Server Operating System Image.
Step 2 – Install the Attack Surface Analyzer.
Step 3 – Run a ‘New Scan’ of the Attack Surface Analyzer.
Step 4 – Install and Configure an Application of interest.
Step 5 – Run a second ‘New Scan’ of the Attack Surface Analyzer on the same Workstation/Server.
Step 6 - Run  ‘Generate a Scan Report’ comparing the results from Step 1 (the ‘clean’ Workstation) with Step 5 (after the Application is Installed and Configured).
Step 7 -  Analyze the HTML Report output to identify how the Application of interest modified the Workstation/Server image.

Figure 1 – I Begin with a ‘clean image’ of Windows 7 Enterprise x64 installed.

Figure 2 – Next, I download of the Attach Surface Analyzer – Beta (the download link is listed above in ‘Step 2′).

Figure 3 – I then follow the installation steps for the product through completion.

Figure 4 – The Attack Surface Analyzer Beta Setup Wizard offers a normal install sequence.

Figure 5 – I Accept the End User License Agreement.

Figure 6 – I then specify the File and Folder Path.

Figure 7 – I select ‘Install’ when ready to proceed.

Figure 8 – I Accept ‘Yes’ to the User Account Control prompt to proceed.

Figure 9 – Finally, I select ‘Finish’ to complete the installation and proceed.

Figure 10 – The prior actions allow us to observe the Attack Surface Analyzer Application in the Start Menu and select it to proceed.

Figure 11 – The sequence for using the Attack Surface Analyzer is to initiate a new scan on the ‘clean’ workstation.  Select ‘Run New Scan’ after specifying the location of the output file.  The Attack Surface Analyzer outputs a .CAB file for useage in subsequent steps.

Figure 12 – Once the Attack Surface Analyzer initiates it processes through a variety of data vectors within the Image.

Figure 13 – The resulting .CAB File is the initial output from the Scan.  This .CAB File is effectively then ‘compared’ to the output .CAB File generated after installing the Application then running the Attack Surface Analyzer a second time.

Figure 14 – Here I note the File Path and File Output (.CAB File) locations.

Figure 15 – Next, I will install a sample Application.  I select Mozilla Firefox 3.6 and begin the download and installation process.

Figure 16 – I select ‘Run’ from the File Download Dialogue Window.

Figure 17 – A second time I select ‘Run’ to approve the installation of Firefox 3.6.

Figure 18 – The Windows 7 User Account Control prompt requires Acceptance next.

Figure 19 – The normal Mozilla Firefox Setup Wizard begins.

Figure 20 – I select ‘Standard’ for the Setup Type and proceed.

Figure 21 – I configure one of several options within the Firefox Setup Wizard.

Figure 22 – Finally, after walking through the Mozilla Firefox Setup Wizard I am at the point of a completed install (or near anyway!).

Figure 23 – Firefox offers to import the Internet Explorer Bookmarks as an option.

Figure 24 – Completion!  The application is installed.  Now, I will move back to launch the Attack Surface Analyzer.  A ‘second run’ of the Attack Surface Analyzer generates a new .CAB File with the modifications to Files, Registry Keys, Services, etc. modified as a result of the Mozilla Firefox 3.6 installation.

Figure 25 – I launch the Attack Surface Analyzer for a second run with the Application installed.

Figure 26 – I accept the Windows 7 User Account Control acceptance dialogue.

Figure 27 – Again, on this second run of the Attack Surface Analyzer I specify the name and file location of the output (.CAB file).

Figure 28 – Again, as in the prior run of the Attack Surface Analyzer (Figure 12) the same date vectors are evaluated.

Figure 29 – Upon completion of the second Scan I am now ready to ‘compare’ the contents of the 2 .CAB Files generated previously.  I complete this action by selecting ‘Generate Attack Surface Scan’ and specifying an output .CAB File (the 3rd .CAB File) file name and file path.

Figure 30 – Here I review prior to initiating the Generation of the Attack Surface Report comparison the 2 .CAB Files.

Note: The 3 .CAB Files now have titles: 1) Baseline .CAB, 2) Product .CAB and 3) Report Filename.

Figure 31 – I denote the Attack Surface Report name and generate the Report by selecting ‘Generate’.

Figure 32 – Once Generated, the Report is HTML that requires JavaScript.

Figure 33 – The Report Output of the Attack Surface Analyzer with the generic details about this Workstation, Time and Date of Scan and Scanner Version (5.1.3).

Figure 34 – Once the ‘Security Issues’ Button is selected the Categories of Security Vectors is enumerated.  One of the Vectors noted are ‘Directories with Weak ACLs’.  I will no review the scope of the output or its meanings in the Blog entry.  Simply, this review is understanding ‘what’ the Attack Surface Analyzer generates.

Figure 35 – More detail and examples of the ‘Directories with Weak ACLs’ as noted after the Mozilla Firefox 3.6 installation.

Figure 36 – The detail for this Weak ACL includes the Account and Rights associated with the ACL.

Figure 37 – The ‘Attack Surface’ Button yields the ActiveX, DCOM, COM and File Extensions registered by the installed application.

Figure 38 – Another Section of the ‘Attack Surface’ Report includes ‘Internet Explorer’ with details regarding Protocol Handlers.  Next, the ‘Network Information’ denotes Open Ports for both TCP and UDP.

Figure 39 – Finally, the ‘Attack Surface’ Report yields details on Named Pipes.

Figure 40 – Next, I move to display the File and Folder paths for reference.

Figure 41 – The Context Specific Help within the Attack Surface Report includes detailed links and references material to assist in the evalution process following by Section of the Report.

Figure 42 – This Capture denotes the primary interface for the Attack Surface Analyzer – Beta Build 5.1.3. for reference.

Conclusion
In Software Develpment and Testing the only method for improvement is offering the ‘next’ version.  I believe the Microsoft Development Teams creating the Attack Surface Analyzer – Beta Build 5.1.3 are off to a great start.  There are a number of 3rd Party Products that are Fee Based that generate similar output for System Engineers, Architects, Consultants and Security Researchers.  I find value that the Vendor of several versions of Operating Systems is creating a Product to assess Vectors for Security Compromise.  Based on the fact this is a Beta Product I can only hope the released Builds continue to offer additional features.  I am compelled, as a result of this quick look to write a separate Blog entry along the lines of ’5 Features I would like to see in the Attack Surface Analyzer’.  Until that time, I appreciate another good software resources is being made available by Microsoft.

Lynn Lunik
Chief Security Architect
IT Pro Secure Corporation
blog@itprosecure.com

Blog Tags: Amazon Web Services, Forefront Client Security, Forefront Endpoint Protection 2010, Hyper-V, Virtual PC 2007, SCOM2k7, SQL2k8, Windows 7, Windows 2008, Exchange 2007, Exchange 2010, Failover Clustering – ITPS, Failover Clustering – LL

In mid-2010 I authored a brief White Paper found on the GFI Web Site. The theme of this White Paper is characterizing the importance of IT Professionals and Business Professionals communicating. In addition, I offer a list of what I consider ‘the requirements’ for Technology to ensure a safe, secure, reliable computing experience for all Users.

Here are several of the requirements found within this White Paper.

Lynn Lunik
Chief Security Architect
IT Pro Secure Corporation
blog@itprosecure.com

Blog Tags: Amazon Web Services, Forefront Client Security, Forefront Endpoint Protection 2010, Hyper-V, Virtual PC 2007, SCOM2k7, SQL2k8, Windows 7, Windows 2008, Exchange 2007, Exchange 2010, Failover Clustering – ITPS, Failover Clustering – LL

Lesson 11 – Forefront Client Security Single Server Topology on Windows 2008 Training Video Sample
Lesson 17 – Forefront Client Security Single Server Topology on Windows 2008 Training Video Sample

This Sample, Lesson 0 is the only Sample that does not include actual time at the Console.  Instead, this Sample offers a review of the Slide Deck that covers:

• Introduction to the Training Video
• Review of Topics by Lesson
• Review of the Lab Architecture
• General Orientation to all the Materials including the Syllabus

Additionally, I have uploaded the corresponding Slide Deck for online review.  If you require a detailed, technical review of Forefront Client Security SP1 Single Server Topology please evaluate this material as a resource.

All 18 Lesson are available for purchase through exchangesummit.net. Simply click on the rotating graphic below to see the Syllabus and Ordering details!

Lynn Lunik
Chief Security Architect
IT Pro Secure Corporation
blog@itprosecure.com

Blog Tags: Amazon Web Services, Forefront Client Security, Forefront Endpoint Protection 2010, Hyper-V, Virtual PC 2007, SCOM2k7, SQL2k8, Windows 7, Windows 2008, Exchange 2007, Exchange 2010, Failover Clustering – ITPS, Failover Clustering – LL

All 18 Lesson are available for purchase through exchangesummit.net.  Simply click on the rotating graphic below to see the Syllabus and Ordering details!

Lynn Lunik
Chief Security Architect
IT Pro Secure Corporation
blog@itprosecure.com

Blog Tags: Amazon Web Services, Forefront Client Security, Forefront Endpoint Protection 2010, Hyper-V, Virtual PC 2007,  SCOM2k7, SQL2k8, Windows 7,  Windows 2008, Exchange 2007, Exchange 2010,  Failover Clustering – ITPS, Failover Clustering – LL

The focus of this Lesson is demonstrating a method to harden the Forefront Client Security Registry Keys and Services using Group Policy Objects within Active Directory. In this Sample from Lesson 11 I offer examples using a User Context of 1) Local Administrator, and, 2) Service Administrator for Forefront Client Security.

Review this Sample Lesson.  The complete Module is available for purchase on the exchangesummit.net web site.  Just select the rotating graphic that follows!  In addition, here is a Visio Diagram of this Lab Configuration available as part of this Module.

Lynn Lunik
Chief Security Architect
IT Pro Secure Corporation
blog@itprosecure.com

Blog Tags: Amazon Web Services, Forefront Client Security, Forefront Endpoint Protection 2010, Hyper-V, Virtual PC 2007,  SCOM2k7, SQL2k8, Windows 7,  Windows 2008, Exchange 2007, Exchange 2010,  Failover Clustering – ITPS, Failover Clustering – LL

Introduced the Administrative Console for Windows 2008 SP2 Failover Clustering.

Reviewed the Benefits of using the System Center Operations Manager 2007 SP1 Console to Monitor a Windows 2008 SP2 Failover Cluster Configuration.

Additionally, I posted a Video Blog from Microsoft TechEd 2010 Europe reviewing some of the changes in Clustering in Windows 2008 R2. Here’s the reference to that post:

Video: Microsoft Failover Clustering in 2008 R2 – What’s New – TechEd 2010

Please review these Blog entries as additional reference material if required.

The focus of my actions is 2 Nodes (referred to as Node 1 and Node 2).  Due to the numerous Cluster Nodes in my Lab Environment, these Nodes don’t correlate directly for Node Number to Host Name.  Here’s what I mean:

• Failover Cluster Node 1 – ‘b01-node-4.corp.itpslab.local’.
• Failover Cluster Node 2 – ‘b01-node-5.corp.itpslab.local’.

The general steps for these actions I ascribe to in a Production Environment are as follows (Yes, my procedure requires 2 Reboots, which some Shops frown upon, but, in my experience you can reduce problem resolution time if you encounter problems using this method – it’s a tradeoff!).  The steps I follow below are different from these steps as this document outlines work in a Lab Environment.  The Production Environment steps may include:

1.  Identify the ‘Health’ of both the Active Node and the Passive Node.
2.  Move to the Passive Node and validate Cluster Groups and Cluster Resources are not associated with the Passive Failover Cluster Node.
3.  Focus on the Passive Node and place in ‘Paused’ State in Failover Cluster Management Console.
4.  Reboot Passive Node (I do this action as I have found it helps ‘identify’ problems even before a Patch is installed).
5.  Patch and Reboot Passive Node.
6.  Validate Passive Node Health.
7.  Move Passive Node from ‘Paused’ State to ‘Active’ State.
8.  Move Cluster Groups and Cluster Resources from Active Node to Passive Node.
9.  Focus on the Passive Node (originally was Active Node) and place in ‘Paused’ State in Failover Cluster Management Console.
10.Reboot Passive Node.
11.Patch and Reboot Passive Node.
12.Validate Passive Node Health.
13.Move Passive Node from ‘Paused’ State to ‘Active’ State.
14.Move Cluster Groups and Cluster Resources from Active Node to Passive Node.
15.Validate Service Availability from Client Perspective

Finally, I have compiled a complete Video for purchase entitled ‘Windows 2008 SP2 Failover Clustering for Highly Available File Services’ available in Windows Media (Encrypted) format.  I also offer brief, sample excerpts from the Video for examination prior to purchase.  These are available on the exchangesummit.net Web Site.  The exchangesummit.net Web Site is the distribution mechanism I use for offering Videos of advanced IT Training Materials!

Figure 1 – I begin by Logging into the Passive Node of the Failover Cluster and open the Failover Cluster Management Console.  Note the Disk Drives (Volume L:\, M:\, and N:\ respectively), the Highly Available File Service Client Access Point (CAP) (file-cluster-fs.corp.itpslab.local) and the Network Connections (Private and Public) that comprise the aggregate Service.  Compare this Screen Capture to Figure 2 which includes the File Shares for Highly Available File Services.

Figure 2 – The Active Node (b01-node-4) Login details the Public IP Address Scheme (192.168.1.65/24) and Private IP Address Scheme (172.16.1.65/16).

Figure 3 – Selection of the Client Access Point (CAP) titled ‘file-cluster-fs’ in the Failover Cluster Management Console yields details about the Cluster Resources such as 1) the Current Owner (b01-node-4), 2) the Preferred Owner (b01-node-4), 3) the Online Status and 4) the Shared Folders.

Figure 4 – Selecting the Passive Failover Cluster Node (b01-node-5) provides validation that most of the Cluster Groups and Cluster Resources are NOT associated with this Failover Cluster Node.  Based on this fact, I move to ‘Pause’ the Passive Failover Cluster Node.

Figure 5 – The purpose of enabling a ‘Pause’ of the Passive Failover Cluster Node is to initiate the Operating System Patching process.  If you notice the ‘General Steps’ above I do not perform each step outlined.  This sequence of steps is being performed in a Lab Environment and is different from steps followed in a Production Environment.

Figure 6 – Now the Passive Failover Cluster Node is ‘Paused’ and I can move to Login to the Passive Failover Cluster Node to perform the Patching process.

Figure 7 – The Login to the Passive Failover Cluster Node (b01-node-5) indicates available Operating System Patches (or Updates) in the System Tray in the lower right hand corner of the screen.  In this example I am using the Updates made available from Microsoft Update.  In most Larger Environments Operating System Updates are scheduled using a Systems Management Application like System Center Configuration Manager 2007 or a similar Product.

Figure 8 – I review the ‘Application’ Event Log and other Event Logs to identify problems outside the scope of Patching.  Once clear (or comfortable with the Events) I will proceed.

Figure 9 – A review of the ‘System’ Event Log indicates good health (lots of ‘Information’ Warnings).  Outside the view of these Screen Captures I ‘parse’ the Event Logs using the Windows 2008 Event Log Filter capability.  It is evident in the ‘Action Pane’ in the far right column under the heading ‘Filter Current Log’.

Figure 10 - I select the ‘Windows Update’ icon from the Control Panel and then ‘View Available Updates’ indicates the Updates in both the ‘Important’ and ‘Recommended’ Categories.  Here, we have roughly 7 Updates (Patches) to apply to this ‘Paused’ Passive Failover Cluster Node. A recommended ‘Best Practice’ is to keep both Cluster Nodes (the Active Node and the Passive Node) matched exactly regarding Patches, BIOS Updates, Firmware, etc.  Also, it is important to keep the time interval between Patching the Passive Node and Active Node as short as possible.

Figure 11 – Upon successfully installing all 7 Patches, it is time to ‘Reboot’ the Passive Failover Cluster Node.  Since this Cluster Node is ‘Paused’ the Failover Cluster Management environment will be unaffected.

Figure 12 – The Passive Failover Cluster Node (b01-node-5) Reboots successfully and permits a Login.  Next I move to review the Event Logs to validate successful installation of each Update and Feedback regarding Application and Service Health.  These steps are required prior to moving the Passive Failover Cluster Node from a ‘Paused’ State to an ‘Active’ State.

Figure 13 – Analysis of the ‘System’ Event Log and the other Event Logs indicate ‘good health’ after applying these 7 Updates (Patches).  Additionally, the Operating System provides Feedback that ‘Windows Installed New Updates’ as seen in the Balloon Tip from the System Tray.  Again, the investment in time to ‘parse through’ the Event Logs pays for the reward of ‘no surprises’ over the next several days when Errors appear that are clearly noted in the Event Log detail.

Figure 14 – Upon observing the Passive Failover Cluster Node is in ‘good health’ after receiving Updates (Patches), I move to move this Cluster Node from ‘Paused’ to ‘Active’ by selecting ‘Resume’ from the Fly Out Menu.

Figure 15 – Upon selecting the Passive Failover Cluster Node (b01-node-5), then ‘Right Mouse Clicking’ I select ‘Resume’ from the Fly Out Menu. This makes the Passive Failover Cluster Node (b01-node-5) a Target for ‘moving’ the current Active Failover Cluster Node (b01-node-4) Cluster Groups and Cluster Resources onto.  The action of ‘Moving’ these Resources will occur next.

Figure 16 – I move to the Active Failover Cluster Node (b01-node-4) and Login.  I focus on the Active Failover Clustering Node (b01-node-4) to apply Updates (Patching) to ensure the Updates (Patches) applied previously to the Passive Failover Cluster Node (b01-node-5) match accordingly.  Upon selecting the CAP (file-cluster-fs.corp.itpslab.local) in the Failover Cluster Management Console I observe 1) CAP Name (file-cluster-fs), 2) File Server Applications (visible under ‘File Server’), 3) Disk Volumes associated with the File Services (L-Data and M-Data), and 4) Share Folders associated with the File Server.

Figure 17 – I am now at a Critical Point for a Production Environment.  Upon selecting the CAP (file-cluster-fs.corp.itpslab.local) and then ‘Right Mouse Clicking’ I receive the Option to ‘Move this Service or Application to Another Node’.  This Option will move the Cluster Groups and Cluster Resources from the Active Failover Cluster Node to the Passive Failover Cluster Node. I select ‘Move this Service or Application to Another Node’ and then select ‘b01-node-5′ (the current ‘Passive Node’).

Translation: In the interval (seconds to minutes) to move the Highly Available Service or Application, the Cluster Group and the Cluster Resources there will be a brief outage for End Users!

Figure 18 – The ‘Please Confirm Action’ dialogue window requires selecting the confirmation to ‘Move ‘file’cluster-fs’ to ‘b01-node-5′.  This action will ‘Move’ the Highly Available File Services from the Active Failover Cluster Node to the Passive Failover Cluster Node.  It is important to observe the Groups of both the ‘Available Storage’ and the ‘Cluster Group’ remains on the current Active Failover Cluster Node (b01-node-4).  I will review a process using an Administrative Command Prompt to manually ‘Move’ these Groups to the newly designated Active Failover Cluster Node (b01-node-5) following this ‘Move’ of the Highly Available File Services using the Failover Cluster Management Console.

Figure 19 – As the Cluster Group, Cluster Resources and Highly Available File Services move from the Active Failover Cluster Node (b01-node-4) to the Passive Failover Cluster Node (b01-node-5) which becomes the Acvie Failover Cluster Node.  Notice the ‘Status’ of the Resources appear as either ‘Offline’ or ‘Online Pending’ during this ‘Move’.  Critical Events are logged in the ‘Cluster Events’ Log with the option of separate logging in a Verbose fashion (not detailed here!).

Figure 20 – Review of the Failover Cluster Management Console indicates the ‘Current Owner’ of the Failover Cluster for Highly Available File Services is ‘b01-node-5′ (formerly the ‘Passive Node’ and now the ‘Active Node’).  The Highly Available File Services should be available to End Users again with no loss of data.  Since there are several more steps to follow (and we are still working within a ‘hypothetical Maintenance Window’ to complete these steps we can proceed to make additional observations).

Figure 21 – One of those observations regarding the current status of the Highly Available File Services is the current placement of the 1) Highly Available File Services, and 2) the associated Disk Drives (Disk Volumes) supporting the Highly Available File Services.

Figure 22 – A second observation regarding this Highly Available File Services 2 Node Active-Passive Cluster configuration is the Quorum Configuration.  This Windows 2008 SP2 configuration ‘automatically’ selects the appropriate Quorum Configuration based on the number of Cluster Nodes and if/how a 1) Quorum Drive, or, 2) File Share Witness is made available.  I prefer to move the Quorum Drive to the second Cluster Node during the Maintenance Window.  This provides the opportunity to ensure a ‘Move’ is possible, and validates ‘Voting’ (to gain a Quorum) occurs (that is, if the ‘Move’ fails, the remaining Cluster Nodes and the ‘Cluster Event Log’ receive Error Messages).  Next I will move the ‘Quorum Drive’ from the Passive Failover Cluster Node (b01-node-4) to the Active Failover Cluster Node (b01-node-5) in preparation to ‘Patch’ the Passive Failover Cluster Node (b01-node-4).

Figure 23 – I Login to the current Passive Failover Cluster Node (b01-node-4) with the intent to move the ‘last’ associated Cluster Group and Cluster Resource to the current Active Failover Cluster Node (b01-node-5) which was just Patched.

Figure 24 – I open an Administrative Command Prompt (accepting the User Account Control popup) and issue the ‘cluster group’ Command.  This Command details the Cluster Groups for this configuration.  I note that both the ‘Available Storage’ and ‘Cluster Group’ is associated with the current Passive Failover Cluster Node (b01-node-4) which I would like to move to the Active Failover Cluster Node (b01-node-5).

Figure 25 – The Command to move the ‘Cluster Group’ from the Passive Failover Cluster Node (b01-node-4) to the Active Failover Cluster Node (b01-node-5) is ‘cluster group ‘cluster group” /move:b01-node-5′.  Notice the ‘Cluster Group’ is immediately moved to the Active Failover Cluster Node (b01-node-5).

Figure 26 – I follow a similar process to move the ‘Available Storage’ from the Passive Failover Cluster Node (b01-node-4) to the Active Failover Cluster Node (b01-node-5).  The Command is ‘cluster group “available storage” /move:b01-node-5′.  If I issue the ‘cluster group’ Command again I should observe all the Cluster Groups moved over onto the Active Failover Cluster Node (b01-node-5).

Figure 27 – Issuance of the ‘cluster group’ Command indicates the Groups of ‘Available Storage’ and the ‘Cluster Group’ reside on the Active Failover Cluster Node (b01-node-5).  It is almost time to begin patching the Passive Failover Cluster Node (b01-node-4) which was previously the Active Failover Cluster Node.

Figure 28 – Prior to proceeding, I select the Passive Failover Cluster Node (b01-node-4) in the Failover Cluster Management Console.  The Graphical User Interface (GUI) indicates no associated Groups, Resources -with the exception of the required ‘Network Connections’, Applications or Services on the Passive Failover Cluster Node (b01-node-4).

Figure 29 – I select the Highly Available File Services (file-cluster-fs.corp.itpslab.local) in the Failover Cluster Management Console.  My intent is to validate the Cluster Groups, Cluster Resources and Highly Available File Services are all associated with Active Failover Cluster Node (b01-node-5) in preparation for Patching the Passive Failover Cluster Node (b01-node-4).  This is confirmation I am prepared to begin the Patching process on the Passive Failover Cluster Node (b01-node-4).

Figure 30 – I select the Active Failover Cluster Node (b01-node-5) in the Failover Cluster Management Console.  Note the ‘Quorum Drive’ is associated with the Active Failover Cluster Node (b01-node-5) based upon previously issuing the Command to move the ‘Cluster Group’ in the prior steps.

Figure 31 – In the Failover Cluster Management Console, I select the Passive Failover Cluster Node (b01-node-4) object and ‘Right Mouse Click’ to select the ‘Pause’ menu option.  The ‘Pause’ option allows the Cluster Configuration to ‘understand’ the intent to Patch and even Reboot the Passive Failover Cluster Node (b01-node-4).

Figure 32 – Upon placing the Passive Failover Cluster Node (b01-node-4) into a ‘Paused’ state I begin the Patching process.

Figure 33 – Following a similar sequence as occurred in the prior Figures where I Patched the Passive Failover Cluster Node (b01-node-5 at that time!), I first review the Event Logs, Reboot and then begin Patching.  I have eliminated those steps and Figures here for purposes of brevity.

Figure 34 – Upon completion of Patch ‘Installation’ I perform a Reboot of the Passive Failover Cluster Node (b01-node-4).  Again, since the Failover Cluster Configuration (both Active and Passive Node and the Quorum Drive) ‘understand’ the Passive Failover Cluster Configuration is ‘Paused’ I can even Reboot as seen here.

Figure 35 – A successful Reboot and Login to the Passive Failover Cluster Node (b01-node-4) provides the ability to again review the Application and System Event Logs for Errors and Warnings.  I invest time now reviewing these Event Logs to save time later when problems might arise!

Figure 36 – I select the Passive Failover Cluster Node (b01-node-4) in the Failover Cluster Management Console and validate the Cluster Node is still ‘Paused’. This is simply a precaution to ensure the Active Failover Cluster Node (b01-node-5) remains ’Active’.  I will begin the review of the Event Logs at this point in time.

Figure 37 – A review of the ‘Application Event Log’ indicates successful installation of a single Update.  Analysis of the Event ‘Source’ column yields the sequence of Updates (Patches) applied to this Passive Failover Cluster Node (b01-node-4).  Upon completion of these Event Logs, this Passive Failover Cluster Node (b01-node-4) is ready to ‘Move’ back into an ‘Active’ status in the Cluster Configuration.

Figure 38 – In the Failover Cluster Management Console I select the Passive Failover Cluster Node (b01-node-4).  I then ‘Right Mouse Click’ and select ‘Resume’ from the Fly Out menu.  This action makes the Passive Failover Cluster Node (b01-node-4) participate in this Active-Passive Failover Cluster.

Upon successful completion of these steps I have achieved the objective of Patching a 2 Node Active-Passive Failover Cluster running Highly Available File Services.  As part of this objective I ‘Moved’ the Highly Available File Services from Node to Node and also validated a ‘Move’ of the Quorum Drive in a similar fashion.  Please note, the Cluster Node originally the ‘Passive Node’ (made the ‘Active Node’ in this Patching Process) now is the ‘Active Node’ for this configuration.  In some environments there is a preference to ‘Move’ the Application or Services back to the ‘original Active Node’.  This requirement yields a second brief End User outage while that ‘Move’ occurs.  Keep this in mind if you ascribe to this philosophy!

Summary: In this Blog entry, I review the approach and sequence of steps required to apply Operating System Updates (Patches) to a 2 Node Active-Passive Windows 2008 SP2 Failover Cluster running Highly Available File Services.  I successfully apply the required Updates to both Cluster Nodes while yielding a minimal downtime for the End User of these Highly Available File Services.

Lynn Lunik
Chief Security Architect
IT Pro Secure Corporation
blog@itprosecure.com

Blog Tags: Amazon Web Services, Forefront Client Security, Forefront Endpoint Protection 2010, Hyper-V, Virtual PC 2007,  SCOM2k7, SQL2k8, Windows 7,  Windows 2008, Exchange 2007, Exchange 2010,  Failover Clustering – ITPS, Failover Clustering – LL

Microsoft Sysinternals TechNet Web Page
Microsoft Sysinternals File Download Web Page

If you haven’t begun working with any of the Utilities from the Sysinternals Teams I would highly recommend you take a look at the links above.  These are not Utilities just to cut loose in a Production Environment.  My hope is to offer more insights in future Blog entries into use of several of these fine Utilities valued in the day to day interactions of a working System Engineer!

Microsoft Sysinternals TechNet Web Page

Microsoft Sysinternals File Download Web Page

Lynn Lunik
Chief Security Architect
IT Pro Secure Corporation
blog@itprosecure.com

Blog Tags: Amazon Web Services, Forefront Client Security, Forefront Endpoint Protection 2010, Hyper-V, Virtual PC 2007,  SCOM2k7, SQL2k8, Windows 7,  Windows 2008, Exchange 2007, Exchange 2010,  Failover Clustering – ITPS, Failover Clustering – LL

There are a number of noteworthy highlights in this Session.  Specifically, the following:

Additional FEP2k10 Reporting through Reporting Services – 12:38 Minutes
FEP2k10 Client Deployment Experience including upgrading from Forefront Client Security and 3rd Party Anti-Virus Products (McAfee – Symantec – Trend) – 20:11 Minutes
Network Inspection System (Vulnerability Shielding as found in Forefront Threat Management Gateway) – 30:00 Minutes

Lynn Lunik
Chief Security Architect
IT Pro Secure Corporation
blog@itprosecure.com

Blog Tags: Amazon Web Services, Forefront Client Security, Forefront Endpoint Protection 2010, Hyper-V, Virtual PC 2007,  SCOM2k7, SQL2k8, Windows 7,  Windows 2008, Exchange 2007, Exchange 2010,  Failover Clustering – ITPS, Failover Clustering – LL

Take a look at the Web Site by Michel de Rooij, Consultant with Dimension Data.  Michel has a number of useful links:

Active Directory Schema Versions
Exchange Schema Versions
Exchange Versions and Builds
Exchange Toolkit

Additionally, there are a number of useful reference links on the Microsoft TechNet Wiki for Exchange 2010, posted by Henrik Walther and Members of the Exchange Development Teams.

Exchange Server Update and Rollup Build Numbers
Exchange Server Version and Features
Exchange Network Port Reference
Exchange Server Virtualization Resources
Exchange 2010 Permissions Reference
Managing Exchange Management Shell Remote Connections
Exchange 2010 Commandlets

Lynn Lunik
Chief Security Architect
IT Pro Secure Corporation
blog@itprosecure.com

Blog Tags: Amazon Web Services, Forefront Client Security, Forefront Endpoint Protection 2010, Hyper-V, Virtual PC 2007,  SCOM2k7, SQL2k8, Windows 7,  Windows 2008, Exchange 2007, Exchange 2010,  Failover Clustering – ITPS, Failover Clustering – LL

Although this Session is loaded with informative insights, if you are searching for details on the following topics you will find them at the times denoted:

Enhanced Logging Features – 39:30 Minutes
Service Packs and Patching – 41:01 Minutes

Lynn Lunik
Chief Security Architect
IT Pro Secure Corporation
blog@itprosecure.com

Blog Tags: Amazon Web Services, Forefront Client Security, Forefront Endpoint Protection 2010, Hyper-V, Virtual PC 2007,  SCOM2k7, SQL2k8, Windows 7,  Windows 2008, Exchange 2007, Exchange 2010,  Failover Clustering – ITPS, Failover Clustering – LL

The following Video from TechEd 2010 North America (SIA 309) presented by Bill Jensen, Microsoft Senior Product Planner and Adwait Joshi, Microsoft Senior Technical Product Manager provide good insight into the Architecture, Installation Requirements and Methodology for using FEP 2010 and the integration with System Center Configuration Manager 2007 R2 and above (including System Center Configuration Manager vNext!). Althought other Products in the Marketplace offer a ‘consolidated Console’ for Malware/Threat Management, it is of note to understand that the integration of FEP 2010 and SCCM 2007 R2+ (as a Systems Management/Configuration Management Platform) will take Administration of Windows Clients (including Windows 7 Phone) to a different level.

Lynn Lunik
Chief Security Architect
IT Pro Secure Corporation
blog@itprosecure.com

Blog Tags: Amazon Web Services, Forefront Client Security, Forefront Endpoint Protection 2010, Hyper-V, Virtual PC 2007,  SCOM2k7, SQL2k8, Windows 7,  Windows 2008, Exchange 2007, Exchange 2010,  Failover Clustering – ITPS, Failover Clustering – LL

Microsoft Exchange 2010 Visio Stencil

Here’s a sample of some (not all) of the Objects in this Stencil.  I’ve validated this Stencil works in both Visio 2007 and Visio 2010.

Lynn Lunik
Chief Security Architect
IT Pro Secure Corporation
blog@itprosecure.com

Blog Tags: Amazon Web Services, Forefront Client Security, Forefront Endpoint Protection 2010, Hyper-V, Virtual PC 2007,  SCOM2k7, SQL2k8, Windows 7,  Windows 2008, Exchange 2007, Exchange 2010,  Failover Clustering – ITPS, Failover Clustering – LL

The download is here:
Exchange Server 2010 Component Architecture Poster

Martin’s Blog is here:
ThePosterGuy

Here’s a sample of several of the Components on this poster.

Lynn Lunik
Chief Security Architect
IT Pro Secure Corporation
blog@itprosecure.com

Blog Tags: Amazon Web Services, Forefront Client Security, Forefront Endpoint Protection 2010, Hyper-V, Virtual PC 2007,  SCOM2k7, SQL2k8, Windows 7,  Windows 2008, Exchange 2007, Exchange 2010,  Failover Clustering – ITPS, Failover Clustering – LL

I hope to complete a similar endeavor in the future using Microsoft Azure Services.  I already use both Amazon Services and Microsoft Azure Services and value both as they offer unique Service Offerings based upon the planned objective.

Initially we should come to agreement on some Amazon/Virtualization terms.  Here’s a short list pertinent to this dialogue:

Cloud Computing – running Servers/Services from a Remote Data Center Hosted by a dedicated Hosting Provider.

Server Virtualization – the process of using Server Virtualization Software to offer Virtualized Guest Partitions of an Operating System.

Instance – the reference name for a Virtualized Server.

AMI – Amazon Machine Image.  Pre-configured Images of specific Operating Systems including pre-installed Applications (such as Web Services or Database Services) generated by Amazon or other AWS Users.

Volume – dedicated Disk Storage consumed by a Virtualized Server.

Key Pair – Cryptographic Key Pair integrated into the AWS EC2 offering used to generate the Local Administrative Password for the Instance.

Load Balancer – dedicated Hardware Device designed to direct Web Traffic to a defined destination for a Client Web Browser.

Elastic IP Address – dedicate AWS EC2 IP Address Administered using the AWS EC2 Console.

EBS Snapshots – point in time copies of specific Volumes generated using the AWS EC2 Console capable of being copied across Amazon Data Centers for safekeeping.

Security Group – defined Security Parameter through which dedicated Protocols and Ports are matched similar to a Firewall Rule.  Used by the Virtualized Instance (or just Instance) to define Access Control by List (or ACL).

Amazon EC2 Console Dashboard – dedicated Web-Based Administrative Console designed for Remote Administration of AWS EC2 Instances and Services.

Figure 1 – The URL for accessing Amazon Web Services is ‘http://aws.amazon.com’.

Amazon Web Services Enterprise Cloud Computing (AWS EC2) requires an AWS User ID and Password.  At the top of this Web Page I select ‘Sign in to the AWS Management Console’ as I have previously created an AWS User ID and Password.

Figure 2 – A Signin to Amazon Web Services using the previously created User ID and Password.

The AWS Sign In Page requires a User ID (E-Mail Address) and Password to proceed.  I completed the User ID creation process several years back.   Cloud Based Computing Services requires a User ID matched to an E-Mail Address and Credit Card for payment.

Figure 3 – A successful Login to the AWS Console through which all creation, modification and configuration of a Windows 2008 Virtualized Server Instance occurs.

The AWS EC2 Console Dashboard provides a Web based Interface to Setup, Configure, Maintain, Backup and Monitor AWS EC2 Instances across Amazon Global Data Centers.  Next, I will focus on the ‘My Resources’ Section of the AWS EC2 Console.

Figure 4 – The ‘My Resources’ section of the AWS Management Console includes each component that builds an available Windows 2008 Server.

I now change the focus to the ‘My Resources’ Section of the AWS EC2 Console Dashboard to create a Key Pair.  As defined above, a Key Pair is the Cryptographic Key Pair generated by the Virtualization Software and then provided to the Instance Owner to permit automated generation of a User ID matched to an Encrypted Password for the Server Instance.  The initial steps I follow is to create a Key Pair for the Windows 2008 x64 Data Center Edition Server Instance.

Figure 5 – The AWS Management Console provides the method to ‘Create Key Pair’ for the planned Windows 2008 x64 Data Center Edition Server Instance.

In the AWS EC2 Console I select ‘Key Pairs’ on the Left Menu Column.  Then, I select the ‘Create Key Pair’ Button to begin the process.

Figure 6 – The AWS Management Console with a Key Pair Name designated.

I choose to name the Key Pair a similar name sequence and number sequence.  Record the Key Pair Name separately for use when the Instance is generated.  The Key Pair Name should be maintained as confidential information.

Figure 7 – The AWS Management Console with a successful Key Pair visible including the Fingerprint.

Upon successful completion of the Key Pair Generation the Key Pair should be visible in the AWS EC2 Console upon select ‘Key Pairs’ in the Left Column Menu.  The Key Pair (as in all Cryptography) matches a unique Fingerprint.

Note: A successful generation of a Key Pair yields a single downloadable file called a .PEM File.  The .PEM File should be maintained in strictest confidence as it is a matching Key to the Key Pair.  Download the .PEM File for use later when Decrypting the auto-generated Administrator Password for the Server Instance.

Figure 8 – The AWS Management Console provides the ability to download the unique .PEM File that comprises the Private Key of the Key Pair.

I begin the download of the unique .PEM File from AWS Management Console.  Secure storage on private, secure medium should hold the .PEM File as it provides one of the factors to gaining access to the Windows 2008 x64 Data Center Edition Server.

Figure 9 – The AWS Management Console indicates the Geographical Location by Region the Key Pair is housed.

The AWS EC2 Console indicates my focus is on the Amazon ‘US East’ Data Center and that a single Key Pair is available for use.

Figure 10 – In the AWS Management Console the Windows 2008 x64 Data Center Server is launched as an Instance.

Next I begin the process of launching a Virtualized Server Instance through the AWS Management Console.  The Server Instance planned for creation will run Windows 2008 SP2 x64 Data Center Edition.  Amazon offers a number of Linux Distributions and both Windows 2003 and Windows 2008 Operating Systems.

Figure 11 – The AWS Management Console initiates the ‘Request Instance Wizard’ offering Instances of Windows and Linux Distributions.

I select a Win2k8 SP2 x64 Data Center Instance made available by Amazon.  This Instance is preconfigured with a Base Operating System and can included SQL 2008 if selected.

Figure 12 – The ‘Request Instance Wizard’ in the AWS Management Console advances to the ‘Instance Details’ Screen where the Instances Type and other variables are selected.

I begin the ‘Instance Detail’ step in the ‘Request Instance Wizard’ by observing the Drop Down Menu Options for ‘Availability Zone’, ‘Instance Type’ and ‘Launch Instances’.  AWS offers ‘Spot Instances’ which are reduced price Virtualized Server Instances made available when additional capacity is free within the AWS Data Centers.

Figure 13 – The ‘Request Instance Wizard’ in the AWS Management Console provides a Drop-Down Menu to select the ‘Instance Type’.

I select ‘High-Memory Extra Large (m2.xlarge)’ as the Instance Type.  A Win2k8 Server running 2 Cores and 17GB of Memory.

Figure 14 - The ‘Request Instance Wizard’ in the AWS Management Console provides a Drop-Down Menu to select the ‘Availability Zone’, or the Geographical Data Center through which the Instance is offered.

The ‘Request Instance Wizard’ focused on the ‘Availability Zone’ provides the list of available Amazon Data Centers through which the Instance is associated.

The Availability Zone is a selectable option matched to a Data Center source.  I have discovered that specific Amazon Data Center Zones support only specific size Instances (as seen under ‘Instance Type’).  For example, I attempted to match the ‘m2.xlarge’ Instance Type to the ‘us-east-1d’ Data Center Availability Zone only to receive an Error Message regarding the Instance Size.  Be aware of this consideration as you Request an Instance.

Figure 15 - The ‘Request Instance Wizard’ in the AWS Management Console options are summarized here.

The ‘Request Instance Wizard’ displaying final selections for the Windows 2008 ‘High Memory Extra Large’ Virtualized Server Instance.

It is my intention to make a single Instance for this Blog entry.  The High Memory Extra Large Instance will be created in the ‘us-east-1c’ Availability Zone.  Additionally, if ‘Request Spot Instances’ is selected the ability to identify the current ‘spot price’ for this Instance Type is visible.  Once visible it is possible to ‘bid’ on a Spot Instance.

Figure 16 - The ‘Request Instance Wizard’ in the AWS Management Console in the ‘Instance Details’ configuration step provides the ability to configure the CloudWatch Monitoring Service for the Instance.

The ‘Request Instance Wizard’ displaying the ‘Instance Details’ selections for the Windows 2008 ‘High Memory Extra Large’ Virtualized Server Instance.

AWS EC2 offers a Service branded ‘CloudWatch Monitoring’.  In subsequent Screen Captures this Monitoring capability is visible.  Basics such as Disk Input/Output, Memory Consumption and Process Utilization are visible. In this configuration I select the CloudWatch Monitoring to make this Monitoring Service available through the AWS EC2 Management Console.

Figure 17 -  The ‘Request Instance Wizard’ in the AWS Management Console in the ‘Create Key Pair’ configuration step allows matching the Key Pair to the Virtualized Server Instance.

The ‘Request Instance Wizard’ displaying the ‘Create Key Pair’ selections for the Windows 2008 ‘High Memory Extra Large’ Virtualized Server Instance.

Earlier (Figures 5- 8) a Key Pair was generated.  The Key Pair Cipher is contained within the .PEM File made available for download during that process (Figure 8).  If I had not previously generated a Key Pair I could generate the Key Pair during this Wizard drive process.  The Key Pair will be matched to this Server Instance.

Figure 18 – The ‘Request Instance Wizard’ in the AWS Management Console in the ‘Configure Firewall’ configuration step requires definition of ‘Security Groups’ that permit Server Administration to the Virtualized Server Instance.

Examination of the Security Group indicates a parallel concept to a ‘Firewall Rule’ permitting 1) Group Name, 2) Application, 3) Transport Protocol, 4) TCP/UDP Port and 5) Source Network. It is imperative to define at least the TCP 3389 Inbound Rule to provide Remote Desktop Protocol access to the Virtualized Server Instance.  Multiple Security Groups are defined in this interface.

Figure 19 – The ‘Request Instance Wizard’ in the AWS Management Console in the ‘Review’ configuration step summarizes the configuration changes through the Wizard for the Virtualized Server Instance.

The summary for this Virtualized Server Instance is displayed on this dialogue window.  Upon completion of this step it will be possible to launch the Windows 2008 x64 Data Center Edition Server.  Note that I have opened up TCP 3389 Inbound to permit an RDP Connection for Server Administration.  I have not configured in this sequence the ‘Public Interfaces’ for offering Services such as a Web Site (TCP 80 for HTTP).

Figure 20 – The ‘Launch Instance Wizard’ begins immediately following successful completion of the ‘Request Instance Wizard’.

Once the Instance configuration parameters are selected it takes between 5-10 minutes for the Instance to launch initially.

Figure 21 – The AWS Management Console displays the status of the Windows 2008 x64 Data Center Edition Virtualized Server Instances just launched.

Examination of the AWS Management Console indicates the Instance launched successfully and the associated details of this Virtualized Server Instance.

Figure 22 – The AWS Management Console providesfor ‘Instance Management’ by ‘Right-Mouse Clicking’ the Server Instance and selecting ‘Get Windows Password’ from the Drop-Down Menu.

It’s important upon Lanuching an Instance to obtain the Local Administrators Password using the AWS Management Console ‘Instance Management’ Menu Option.  Additionally, I have selected the ‘Monitoring’ Tab to display the status of the CloudWatch Monitoring as the Server spins up.

Figure 23 – The AWS Management Console provides feedback if actions are taken when the Virtualized Server Instance is initially provisioned.

In this case I have not been nearly patient enough to allow this Virtualized Server Instance to initialize.  Once initialized the Server Instances spin up rapidly.

Figure 24 – The ‘Retrieve Default Windows Administrator Password’ Dialogue Window is used to offer the Local Administrators Password using the Matching Key Pair from the Key Pair generated earlier (Figures 6 through Figures 9 above).

I have broken the Dialogue Window into 3 Parts: 1) Encrypted Password section (the location the ‘Unencrypted Password’ will appear upon placing the Text Values from the .PEM File from prior steps, 2) the Key Pair, or, the Key Pair matched to this particular Virtualized Server Instance, and 3) the Private Key Input section (where the Text Value from the .PEM File (the Key Pair) is Pasted).  Upon Pasting the proper Text Values the Encrypted Password is Decrypted and visible to Copy and Paste in a secure location.

Figure 25 – The ‘Retrieve Default Windows Administrator Password’ Dialogue Window with the Private Key Text Values Pasted correctly.

Upon Pasting the Private Key Text Values from the .PEM File and selecting ‘Decrypt Password’ I will gain access to the Local Administrator Password for this Windows 2008 x64 Data Center Edition Virtualized Server Instance.

Figure 26 – The ‘Retrieve Default Windows Administrator Password’ Dialogue Window displaying the ‘Computer Name’ and ‘Decrypted Password’ for the Local Administrator.

Section 1 indicated above is the Fully Qualified Domain Name (FQDN) of this Virtualized Server Instance, while Section 2 is the Local Administrator Password.  I record both for my records and initiate my first Login Session shortly.

Figure 27 – The AWS Management Console focused on the ‘My Resources’ Section.

I have completed a number of steps to properly provision this AWS Virtualized Server Instance of Win2k8 x64 Data Center Edition.  Addressing each of the components separately allows us to properly build the 1) Instance, 2) the EBS Volume (or Disk) for the Instance, 3) the Key Pair that derives the Cryptographic sequence necessary to secure a Local Administrators Password and finally, 4) the Secure Group that defines the Inbound Port(s) through which the Server is accessed.

Figure 28 – The AWS Management Console after selecting the Instance and then using the ‘Connect’ Menu Option from the ‘Instance Management’ Drop Down Menu.

It’s time to begin connecting to this Virtualized Server Instance as we have spent only a brief amount of time Provisioning this Server.  I appreciate the Server Provisioning Process through AWS as I find is logical and the Interface straightforward to navigate.

Figure 29 – The AWS Management Console ‘Instance Management’ Section offers the ‘Connect’ Menu Option.  Once selected the ‘Console Connect – Remote Desktop Connection’ Dialogue Windows appears.

The Dialogue Windows offers a Hyperlink to ‘Download Shortcut File’ for a file with an .RDP File Extension.  This is the Default File Extension for the Remote Desktop Software found within the Windows Operating System.  Additionaly, note the FQDN of the Server Instance (with the name blurred purposely in this Capture).

Figure 30 – The File Download Security Warning for the available .RDP File for use in a Remote Desktop Session from the AWS Management Console.

I download the .RDP File to my Local Workstation and appreciate the IP Address information available within this preconfigured file.

Figure 31 – The Downloaded .RDP File includes preconfigured values to correctly connecting using Remote Desktop Protocol (RDP) to the Virtualized Server Instance.

Launching this .RDP File provides the ability to input the Administrator User ID and Password generated previously.

Figure 32 – Selection of the .RDP File provides the Connection Parameters to the Virtualized Server Instance.

Once connected I input the Local Administrator Password generated in Figures 6-9 and Decrypted in Figures 24-26.

Figure 33 – A Remote Desktop Session to the Amazon Web Services Virtualized Server Instance running Windows 2008 x64 Data Center Edition.

Notice that AWS runs RedHat as the Hyper-Visor for all Server Instances.  I appreciate the Provisiong Process and the mechanisms AWS provide to offer a secure and reliable Instance.

Figure 34 – The System Information Utility within Windows 2008 confirms the Processor Count and Memory Values.

This Virtualized Server Instances is ready for updating and use!

Figure 35 – The AWS Management Console summarizing the status of the Virtualized Server Instance.

The experience in provisioning this Virtualized Server was good.  AWS Servers are available through several different charge mechanisms.  Although a review of Fees is not part of this Blog entry it is definately another facet of AWS to understand before Provisioning Servers for even Testing Purposes.

Summary: The Objective of this Blog entry was to walk through the Provisioning of a Virtualized Server Instance using the Amazon Web Services Management Console.  Completion of this objective occurred as visible in Figure 33 whereby I successfully Logged into a Windows 2008 x64 Data Center Edition Virtualized Server running on Amazon Web Services!

Lynn Lunik
Chief Security Architect
IT Pro Secure Corporation
blog@itprosecure.com

Blog Tags: Amazon Web Services, Forefront Client Security, Forefront Endpoint Protection 2010, Hyper-V, Virtual PC 2007,  SCOM2k7, SQL2k8, Windows 7,  Windows 2008, Exchange 2007, Exchange 2010,  Failover Clustering – ITPS, Failover Clustering – LL

Thank you for considering my Blog entries on various Enterprise Security topics to be of value as you work to correctly install, configure, administer, maintain, secure and optimize Windows Products!

Lynn Lunik
Chief Security Architect
and Microsoft MVP – Enterprise Security
IT Pro Secure Corporation
and exchangesummit.net
blog <at> itprosecure.com

Blog: http://lynnlunik.net/feed/

Thank you for the consideration!  I look forward to continuing to contribute to the Windows Security Community in a variety of ways!

Lynn Lunik
Chief Security Architect
and Microsoft MVP – Enterprise Security
IT Pro Secure Corporation
and exchangesummit.net
blog <at> itprosecure.com

Blog: http://lynnlunik.net/feed/

In the interim, here’s the details on this 2 Day Event.  Also note, there is a really interesting Track for the System Technical Implementer I have highlighted below.  Finally, I have included the Registration Form for reference.

Lynn Lunik
Chief Security Architect
IT Pro Secure Corporation
blog@itprosecure.com

Blog Tags: Amazon Web Services, Forefront Client Security, Forefront Endpoint Protection 2010, Hyper-V, Virtual PC 2007,  SCOM2k7, SQL2k8, Windows 7,  Windows 2008, Exchange 2007, Exchange 2010,  Failover Clustering – ITPS, Failover Clustering – LL

Here are links to all 3 Posts in this Series.  I am happy these Blog entries are of value!

Post 1 of 3

Post 2 of 3

Post 3 of 3

Lynn Lunik
Chief Security Architect
IT Pro Secure Corporation
and exchangesummit.net
blog <at> itprosecure.com

As I begin this process you must understand that the maintenance of an ‘unsealed’ Windows Image is to provide the ability at some point in the future to ‘re-open’ that Image and apply Security Updates, Install Applications or add Files and Folders required for usage of the Image.  Upon completion of these additions it is necessary to begin a new ‘sealed’ Windows 7 Enterprise x86 Image dated according to the date of modification (most System Engineers use Version Numbers).  The process of creating a new ‘sealed’ Image for use includes maintaining both ‘sealed’ (those Windows Images ‘sealed’ with the Sysprep Process) and ‘unsealed’ (those Images simply ‘Shut Down’ without sealing with the Sysprep Process).

If you are reading this Blog entry without reading the prior associated entries in this sequence, here is a summary of those posts and the tasks addressed in this entry:

Part 1 of 3 – Create a Windows 7 Enterprise x86 Virtual Machine Image booting from an .ISO of the Windows 7 Enterprise x86 Source Media using a Windows 7 Enterprise Host Workstation.

Part 2 of 3- Use the File Copy Process to duplicate the Windows 7 Enterprise x86 Virtual Machine Image Hard Disk and then use the Sysprep Process to ‘seal’ the Windows 7 Enterprise x86 Virtual Machine Image.  Create a new Virtual Machine in Virtual PC from the ‘sealed’ Windows 7 Enterprise x86 Virtual Machine Image.  Use the New Virtual Machine in Virtual PC for Testing.

Part 3 of 3 – (This Blog entry) I will ‘re-open’ the ‘unsealed’ duplicate Windows 7 Enterprise x86 Virtual Machine Image Hard Disk and apply Security Updates and Install a selected Application.  Then, duplicate the ‘updated’ and ‘unsealed’ Windows 7 Enterprise x86 Virtual Machine Hard Disk to be retained as the new ‘unsealed’ Virtual Machine Image.  Use the Sysprep Process a second time to ‘seal’ the ‘updated’ Windows 7 Enterprise x86 Virtual Machine Hard Disk to create the new ‘Master’ and ‘sealed’ Virtual Machine Image.  Finally, use the ‘master’ and ‘sealed’ Windows 7 Enterprise x86 Virtual Machine Hard Disk Image to create a new Virtual Machine in Virtual PC for Testing.

Additionally, I use a specific folder structure at the Operating System level that works for me.  You may find labeling of the folders these that the Virtual Machine Files are held requires different titles to suit your need.  Again, my idea here is to offer my approach, understanding others will refine, change and pioneer modifications that are appropriate.  Here’s the summary:

Drive\Directory\Win7x86_Sealed

This folder holds the Sysprep ‘sealed’ Virtual Machine Files through a defined Date when the Image was created.  Use of the single .VHD (Virtual Hard Disk) file using a manual file copy process into a new folder permits creation of a Virtual Machine within Virtual PC that when the Virtual Machine Boots for the first time the Mini-Setup Wizard initiates.  This allows creation of Virtual Machines as required.

Drive\Directory\Win7x86_UnSealed

This folder holds the ‘unsealed’ Virtual Machine Files through a defined Date when the Image was created.  The purpose of this folder is to store the ‘reference unsealed’ Virtual Machine for rebooting, adding Updates and Applications and then following the ‘copy off into a new unsealed folder’ and then use the Sysprep Process to ‘seal’ the updated Workstation Image.  This process allows quick updating when required.

Additionally, before getting underway with this last Blog entry in this sequence, let’s agree on terms that apply to this endeavor (used throughout these entries):

VHD – Virtual Machine Hard Drive Image

VMC – Virtual Machine Configuration File

VPCBackup – Virtual Machine Backup File

VUD – Virtual Machine Undo File (not used in this Blog series – but helpful to know!)

Let’s get underway now where I left off in Part 2 of 3.  Let’s take a summary review of the Folders and Files compiled to date.

Figure 1 - A Virtual Machine Image created from the ‘sealed’ (i.e. Sysprepped) Windows 7 Enterprise x86 Virtual Machine.  The Host Name for this Virtual Machine is ‘WS-1′ and it is comprised a 3 Files in the Folder.  File 1 – the Virtual Machine Hard Disk Image named ‘ws_1_vhd1.vhd’.  File 2 – the Virtual Machine Configuration File named ‘ws-1′.  File 3 – the Virtual PC Backup File named ‘ws-1.vmc.vpcbackup’.  Note that I store all Virtual Machine Images used for Testing in a Folder titled ‘VMs_in_Use’.

Figure 2 – This is the current ‘master sealed’ Windows  7 Enterprise x86 Image in the Library.  To create a new Virtual Machine from this ‘master’ Image I manually copy the .VHD File to a new Folder and use that .VHD File as the Bootable Hard Disk for the new Virtual Machine as the Boot source.  This Blog entry will demonstrate how to create a replacement for this ‘master sealed’ Windows Image that includes the lastest Security Updates and Applications necessary for your Virtual Machine Testing.

Figure 3 – This ‘unsealed’ Windows 7 Enterprise x86 Image is retained for use as the mechanisms from which to create a new Virtual Machine to which are applied Security Updates and Applications Installed to maintain a current Virtual Machine Image that includes all appropriate Applications for Testing.  If you observe closely this Folder will retain both the historical and new ‘unsealed’ Virtual Machine Images in the form of a Virtual Machine Hard Disk (.VHD) File.

Figure 4 – Here the work of this Blog entry begins.  I first create a new Folder titled ‘ Win7x86_Sealed_thru_3-9-2010′.  I place a copy of the ‘unsealed’ VHD File (found in the folder titled ‘Win7x86_Unsealed’) into the new Folder.  Finally, I rename the VHD File to ‘Win7x86_3-9-2010′ which reflects the Date in which this ‘unsealed’ VHD will be updated (with Security Updates and Installed Applications) through.

Figure 5 – In Figure 4 I created a Folder and placed a VHD File within that Folder.  Now, I will create a Virtual Machine to use the VHD File.  Again, with this Virtual Machine I will Boot from the VHD File (the ‘unsealed’ VHD File) and then apply Security Updates and Install an Application.  Once current, this Virtual Machine will be copied off for safe keeping and then ‘sealed’ using the Sysprep Process to become the new ‘master sealed’ Windows 7 Enterprise x86 Workstation Image within Virtual PC.  I open Virtual PC on Windows 7 using the ‘Manage Virtual Machines’ Menu Option.

Figure 6 – I initiate the ‘Create Virtual Machine’ Task focused on the opening the ‘unsealed’ Virtual Machine Hard Disk Image.

Figure 7 – Using the ‘Create a Virtual Machine’ Wizard in Virtual PC I offer the Virtual Machine Image a ‘Name’ and ‘Location’.  I select both a descriptive name and location for easy reference.

Figure 8 – Following the same process for creating a New Virtual Machine as found in the prior Blog entry (Step 2 of 3) I select specific Memory and Networking Options.

Figure 9 – Here’s an important step.  Select the VHD File manually copied into the new Folder under ‘Use an Existing Virtual Hard Disk’.  In this configuration the VHD File selected is the Boot mechanism for the Virtual Machine Image.  I have highlighted the File Name in yellow above.

Figure 10 – Upon completing the ‘Create a Virtual Machine’ Wizard no event happens.  I move to start the New Virtual Machine using the ‘Manage Virtual Machines’ Task from the All  Programs Menu.

Figure 11 – The ‘Manage Virtual Machines’ Task details all Virtual Machine Images available within Virtual PC on the Host Workstation.  I select the appropriate Virtual Machine to Open.

Figure 12 – The Virtual Machine using Windows 7 Enterprise x86 opens correctly providing the ability to Login.

Figure 13 – The intent for opening this ‘unsealed’ Windows 7 Enterprise x86 Virtual Machine Image is to 1) apply Security Updates through the current Date/requirement, and, 2) Install Applications necessary for the Testing Environment.  I begin by updating Malware Definitions for Microsoft Security Essentials.  I also Install the latesting version of Adobe Reader 9.X.  Before I begin these processes I choose to change the Workstation Host Name and Reboot.

Figure 14 – I navigate to ‘Control Panel, then ‘System and Security’ and then to the ‘System’ Application.  Observe the Host Name of ‘win7x86-3-2-10′.  I use this naming convention to quickly identify the Date through which this Virtual Machine was last updated.  I will next advance this Host Name to ‘win7x86-3-9-10′ for reference.

Figure 15 – I complete the processes of applying  Malware Updates and I changd the Host Name.  Finally, I initiate a Reboot.

Figure 16 – After a successful Reboot I observe the Host Name change is also successful.

Figure 17 – Here I use an Administrative Command Prompt to issue an appropriate Product Key for the Windows 7 Enterprise x86 Image.  The Product Key is accepted with confirmation.

Figure 18 – The process of identifying required Security Updates includes navigating to ‘Control Panel’, then ‘System and Security’ and finally ‘Windows Update’.  I then select ‘Check for Updates’ to query the Microsoft Update Services for outstanding Security Updates.  Note that 3 ‘Important Update’s are required.

Figure 19 – Upon completing the Installation of the 3 Security Updates I initiated a Reboot using the ‘Restart Now’ Button.

Figure 20 – After a successful Reboot, I use Internet Explorer to navigate to the Adobe Web Site to download Adobe Reader 9.X.

Figure 21 – Installation of the Adobe Reader 9.X occurs without incident.  I am quickly closing in upon all the required Security Updates, Malware Updates and Applications for Installation to update this Windows 7 Enterprise x86 Virtual Machine Image.

Figure 22 – Prior to ‘sealing’ this freshly updates Windows 7 Enterprise x86 Virtual Machine Image I ‘shutdown’ the Virtual Machine.  Once ‘shutdown’ I can then use a file copy process to move a copy of the ‘unsealed’ and newly updated Virtual Hard Disk into a retention folder.  Storage of the VHD in its current state is required for use in the future when more Security Updates, Malware Updates or Applications for Installation are required.

Figure 23 – I have not ‘sealed’ this Virtual Machine Image yet (so the naming can be a bit confusing at this point).  I copy the Virtual Hard Disk (.VHD) file named ‘Win7x86_3-9-2010′ to the ‘Win7x86_Unsealed’ Folder for storage.  This Folder still holds the prior ‘unsealed’ VHD File originally generated on 3-2-2010.

Figure 24 – Examination of the ‘Win7x86_Unsealed’ Folder yields clarity as to the contents.  The 2 Files (VHD Files) held within this Folder are the 2 ‘unsealed’ Virtual Machine Images maintained in the Library of ‘unsealed’ Virtual Machine Images.  I am able to use either File over and over based upon need.  If the need is for a Virtual Machine without Adobe Reader 9.X I can use the VHD File named ‘Win7x86_3-2-2010′.  If a Virtual Machine Image is required that includes Malware Updates on Microsoft Security Essentials through 3-9-2010 I use the VHD File named ‘Win7x86_3-9-2010.  ‘

In both cases it is important to note I must follow the process to copy the ‘unsealed’ VHD File to a new Folder, create a new Virtual Machine, ‘seal’ the new Virtual Machine using the Sysprep process then use this ‘sealed’ Virtual Hard Disk (VHD) as the Bootable Virtual Hard Disk to the new Virtual Machine Image running Windows 7 Enterprise x86.

If you this seems like alot of steps  – it is!  Once mastered the number of steps becomes insignificant compared to including the appropriate Security Updates, Malware Updates and Installed Applications.  If you are considering doing this in an automated fashion there are several ‘Enterprise’ Products that automate this whole process.  The folks at Microsoft (System Center Virtual Machine Manager), VMWare  and Citrix make products that automate this whole process.

Figure 25 – I focus back on the ‘Win7x86_Sealed_thru_3-9-2010′ Folder to prepare to ‘Restart’ the Virtual Machine Image to then use the Sysprep Process to ‘seal’ the Virtual Machine Image.

Figure 26 – After a successful ‘Restart’ of the Windows 7 Enterprise x86 Virtual Machine Image I confirm all settings as ‘final’ prior to using the Sysprep Process.

Figure 27 – I open an Administrative Command Prompt to invoke the Sysprep Process.  Then, I select ‘Enter System Out-of-Box Experience (OOBE)’, ‘Generalize’ and ‘Shutdown’ from the ‘Shutdown Options’ Drop Down Menu.  These selections will remove any unique characteristics for this Virtual Machine Image and using the ‘Generalize’ Check Box will require Plug-and-Play to detect the Hardware Configuration.

Again, the power of this approach to creating ‘sealed’ Virtual Machine Images is upon completion of this process the VHD File can be used as the basis for creating new Virtual Machine Images that are unique.

Figure 28 – As validation of the effectiveness of the method outlined in this 3 Part Blog entry I will generate a new Virtual Machine running Windows 7 Enterprise x86 using the newly updates Virtual Machine Image (the Image from 3-9-2010).  If you recall, the original Virtual Machine Image is from 3-2-2010 and DOES NOT include Adobe Reader 9.X.  I begin by creating the new Virtual Machine named ‘WS-2′ in a Folder titled ‘WS_2_Win7x86′ under the ‘VMs_in_Use’ Folder.

Figure 29 – Using the same process outlined twice previously I rename the VHD to match the Naming Convention suitable for easy recognition (previously named ‘Win7x86_3-9-2010.vhd’ and renamed ‘ws_2_vhd1.vhd’).

Figure 30 – Virtual PC is opened using the ‘Manage Virtual Machines’ Task from the Virtual PC Menu option on the Start Menu in Windows 7.

Figure 31 – Upon using the ‘Open’ Menu Option the ‘Create a Virtual Machine’ Wizard provides Options for completion for the ‘Name’ and ‘Location’.  The ‘Location’ is the File Path selected in Figure 29.

Figure 32 – I select ‘Memory’ and ‘Networking’ Options and proceed.

Figure 33 – Finally, I select the ‘sealed’ VHD File that was copied (using file copy) and renamed from Figure 29.

Figure 34 – The ‘Create a Virtual Machine’ Wizard completes succesfully.  Next I ‘Open’ the Virtual Machine Image running Windows 7 Enterprise x86 using a ‘Right Mouse Click’ and then ‘Open’ from the Drop Down Menu.

Figure 35 – The Virtual Machine Image for Host Name ‘ws-2′ launches the Out-of-Box Experience (OOBE) from the Mini-Setup Wizard.

Figure 36 – I input the ‘Initial Administrator’ User Name and the ‘Computer Name’.

Figure 37 – Next, input of a Password for the ‘Initial Administrator’ User ID and a ‘Password Hint’.

Figure 38 – Next, acceptance of the ‘License Terms’ advances the process.

Figure 39 – The ‘Automatic Update’ Settings require a selection to advance.

Figure 40 – Next, I select the appropriate ‘Time Zone’ to proceed.

Figure 41 – Finally, I select the ‘Network Location’ for the Virtualized Image.  Upon completing this final step we can validate the Installed Applications include Adobe Reader 9.X as the ‘sealed’ Windows 7 Enterprise x86 Virtual Machine Image should include.

Figure 42 – Success!  The Virtual PC Virtual Machine Image running Windows 7 Enterprise x86 includes Adobe Reader 9.X.  This confirms succesful completion of a process to use the newly ‘sealed’ Windows 7 Enterprise x86 Virtual Machine Image updated through 3-9-2010.

Since this process includes 3 Blog entries and over 130 Figures I felt it appropriate to review the contents of the Files and Folders contents that are part of this sequence.  Here’s is the summary of the File and Folder contents.

Figure 43 – In the Sub-Folder under ‘VMs_in_Use’ titled ‘WS_1_Win7x86′ are the Virtual Machine Files for Workstation 1 supporting a Virtualized Machine named ‘ws-1′.  This Virtual Machine was generated using a ‘sealed’ Windows Image updated through 3-2-2010.

Figure 44 – In the Sub-Folder under ‘VMs_in_Use’ titled ‘WS_2_Win7x86′ are the Virtual Machine Files for Workstation 2 supporting a Virtualized Machine named ‘ws-2′. This Virtual Machine was generated using a ‘sealed’ Windows Image updated through 3-9-2010 and included specific Security Updates, Malware Updates and a spefically Installed Application of Adobe Reader 9.x.

Figure 45 – In the Folder titled ‘Win7x86_Sealed’ includes a ‘sealed’ Virtual Machine with Updates through 3-2-2010.  This Windows 7 Enterprise x86 Virtual Machine Image was generated using the Sysprep Process.  Duplication of the VHD File provides the ability to create numerous additional unique Virtual Machines using a defined process.

Figure 46 – In the Folder titled ‘Win7x86_Sealed_thru_3-9-2010′ includes a ‘sealed’ Virtual Machine with Updates through 3-9-2010.  This Windows 7 Enterprise x86 Virtual Machine Image was generated using the Sysprep Process with the ‘Win7x86-3-2-2010′ ‘unsealed’ Virtual Hard Disk (VHD) as the basis.  Duplication of the VHD File provides the ability to create numerous additional unique Virtual Machines using a defined process.  This Virtual Machine Image includes the Adobe Reader 9.X Application as an example.

Figure 47 – In the Folder titled ‘Win7x86_Unsealed’ includes 2  ’unsealed’ Virtual Machines unique based upon the ‘Date Modified’ and the File Naming Convention.  These Windows 7 Enterprise x86 Virtual Machine Images retain the Security Updates, Malware Updates and Installed Applications through each respective Date and Time.  Duplication of each respective VHD File occurred and was the basis through which each of the ‘sealed’ Virtual Machine Images including those updated on 3-9-2010 was generated.

Summary:In this Blog entry, Part 3 of 3 I demonstrated a method to use an ‘unsealed’ Virtual Machine Image running Windows 7 Enterprise x86, update the Security Update, Malware Updates and Installed Applications, to then copy the updated Virtual Machine Image and then use the Sysprep Process to generate a ‘sealed’ Virtual Machine Image.  This ‘sealed’ Virtual Machine Image can then be used in a defined duplication process for creating numerous unique Virtual Machine Images running Windows 7 Enterprise x86.  This Blog series, consisting of 3 Parts includes a sequential series of steps leading up to the final steps in Part 3 of 3.

Lynn Lunik
Chief Security Architect
IT Pro Secure Corporation
blog@itprosecure.com

Blog Tags: Amazon Web Services, Forefront Client Security, Forefront Endpoint Protection 2010, Hyper-V, Virtual PC 2007,  SCOM2k7, SQL2k8, Windows 7,  Windows 2008, Exchange 2007, Exchange 2010,  Failover Clustering – ITPS, Failover Clustering – LL

Here’s some reference vocabulary for this endeavor:

Sealed - the process of using Microsoft Sysprep to ‘seal’ a Workstation Image for duplication.  The ‘sealing’ process applies to either Physical or Virtual Machine Images.

Unsealed – the process of updating a Virtual Machine Image and then retaining the Image without ‘sealing’ for future updates.

Again, because in Virtual PC a series of Files comprise a Virtual Machine it is this fact I capitalize upon to retain both a ‘sealed’ and ‘unsealed’ Virtual Machine Image.

Figure 1 – As I begin, here’s a quick refresher of the items constructed in Step 1 of 3.  In a Folder titled ‘Win7x86_Sealed’ I have created a Virtual Machine Hard Drive Image (VHD) titled ‘Win7x86_3-2-2010.  This VHD will become a ‘sealed’ VHD with updates and Applications through 3-2-2010.  Also note the ‘supporting files’ such as the ‘Virtual Machine Settings File’ and the ‘VPC Backup File’ in the folder.

The concept of ‘sealing’ a VHD includes using the Microsoft Sysprep Process to remove any uniquely distinguising characteristics from the Image.  Examples of characteristics include 1) Domain Membership and 2) Machine SID (among others).

Figure 2 – Next, I create a new Folder titled ‘Win7x86_Unsealed’.  This folder will ‘store’ the unsealed version of the VHD for future modification.  In summary, because this VHD is not ‘sealed’ using the Sysprep Process it can be ‘re-opened’, then modified and maintained in the future.  I copy the VHD from the ‘Win7x86_Sealed’ Folder PRIOR TO SEALING THE VHD FILE!  (This is important as the naming convention for the folder can be confusing initially!)

Figure 3 – The ‘unsealed’ VHD is copied (a manual file copy) from the ‘sealed’ folder to the ‘unsealed’ folder titled ‘Winx86_Unsealed’.  Again, the ‘unsealed’ VHD is for storage and future useage.

Figure 4 – After moving a copy of the VHD into the ‘unsealed’ folder for safe keeping – I ‘Open’ the VHD to begin the Sysprep Process.

Figure 5 – The Windows 7 Enterprise Workstation Image opens without issue.  I have added the Sysinternals BGInfo 4.16 application to provide the details displayed as the Desktop Background.

Figure 6 – A quick enumeration of the ‘Start Menu’ indicates installation of only basic Applications within this Windows 7 Enterprise Image.  Next, I will begin the Sysprep Process to ‘seal’ this Image.

Figure 7 – An ‘Administrative Command Prompt’ is required to run the Sysprep Process.

Figure 8 – The Sysprep Process is initiated.

The commands required from an Administrative Command Prompt for Sysprep include:

cd \windows\system32\sysprep

sysprep

Figure 9 – The Sysprep Tool v.3.1.4 opens within this Windows 7 Enterprise Image.  It is important to select ‘Enter System Out-of-Box Experience (OOBE)’ from the ‘System Cleanup Action’ Drop Down, and ‘Shutdown’ from the ‘Shutdown Options’ Drop Down Menu.

Upon completion of this step (when successful) a fully ‘sealed’ version of a Windows 7 Enterprise Virtual Machine is stored within the Virtual Machine Hard Drive Image file.  This VHD is ‘current’ with Updates and installed Applications through the creation date (3-2-2010).  I can now duplicate this ‘sealed’ VHD for creation of any Windows 7 Enterprise x86 Virtual Machines required for Testing.

Figure 10 – Observing the ‘Win7x86_Sealed’ Folder denotes the 3 Files that comprise the Windows 7 Enterprise Virtual Machine just ‘sealed’ by the Sysprep Process.

Creating a Workstation Image from the ‘Sealed’ Windows 7 Enterprise x86 Sysprep Image

Figure 11 – I create a Folder Hierarchy of ‘E:\VMs_in_Use\WS_1_Win7x86′ for storage of Virtual Machines for Testing.  If you observe the Folder Names it should be clear my intent is to make a Windows 7 Enterprise x86 Virtual PC Image with a Host Name of ‘WS-1′.  I will copy the ‘sealed’ VPC Hard Disk to the ‘\WS_1_Win7x86′ Folder.

Figure 12 – Upon completion of copying the ‘sealed’ Windows 7 Enterprise x86 VHD into the destination folder where the VPC Workstation Image files will reside, I then ‘rename’ the VHD File.  This renaming process allows for orderly storage, reference and usage when numerous Virtual Machines are involved.

The next step will entail creating a new Virtual Machine using Virtual PC and the referenced Virtual Machine Hard Disk.

Figure 13 – After renaming the Virtual Machine Hard Disk to match the naming criteria of the Testing Workstation (WS-1), I can begin to ‘Create’ the Virtual Machine using the Virtual PC Console.

Figure 14 – I begin creation of the new Virtual Machine using the ‘sealed’ Windows 7 Enterprise x86 Virtual Hard Disk Image by selecting ‘Manage Virtual Machines’ from the ‘Windows Virtual PC’ Application.

Figure 15 – Upon opening the ‘Windows Virtual PC’ Application I select ‘Create Virtual Machine’ from the menu choices.

Figure 16 – The ‘Create a Virtual Machine’ Wizard provides the ability to name the Virtual Machine and define the File Path.  Note the File Path to the Virtual Machine Hard Disk Image previously ‘sealed’ using the Sysprep Process.

Figure 17 – Next, the amount of Memory and desired Network Interface Connection type are selected.

Figure 18 – Here’s the important step in using a ‘sealed’ Sysprep Image in Virtual PC – BE SURE TO SELECT THE VHD PREVIOUSLY COPIED INTO THE VIRTUAL MACHINE FOLDER. Again, I previously copied the ‘sealed’ Windows 7 Enterprise x86 VHD named ‘WS_1_VHD1.VHD’ into this folder for useage.

Figure 19 – Upon completion of the ‘Windows Virtual PC’ Wizard for creating a Virtual Machine I move to the Folder where the new Virtual Machine is stored. Upon selecting the Virtual Machine, I then select ‘Open’ from the menu options.

Figure 20 – The new Virtual Machine running Windows 7 Enterprise x86 initiates for the first use.  The Sysprep Options selected in Figure 9 above yield starting of the System-Out-of-Box Wizard.

Figure 21 – This Windows 7 Enterprise x86 Image is starting correctly.  Again, this is a ‘sealed’ Image created using the Sysprep Process.

Figure 22 – The initial steps in the ‘Set Up Windows’ Wizard include 1) naming the Computer and 2) identifying the initial Administrator for the Workstation Image.

Figure 23 – Upon inputting a Password for the initial Administrator, along with a Password Hint, I proceed to the next step in the ‘Set Up Windows’ Wizard for this Windows 7 Enterprise x86 Virtual Machine.

Figure 24 – I select Acceptance of the License Terms next.

Figure 25 – I select the Recommended Settings for Automatic Updates.

Figure 26 – I select the appropriate Time Zone and Time.

Figure 27 – Finally, I select the Network Connection matched to the Computers Current Location.

Figure 28 – Upon completing of the ‘System Out-of-Box’ Wizard, a very usable Windows 7 Enterprise x86 Virtual Machine is available.  This Virtual Machine is Updated through the Date of creation and includes any Applications I have included in the original ‘sealed’ Image.

In creating a prepared Windows 7 Enterprise x86 Virtual Machine Image I have the flexibility to create as many Virtual Machines as required for the Testing or usage Scenarios I address.  If another Windows 7 Enterprise x86 Virtual Machine Image were necessary I would simply follow the process again beginning at Figure 11 above through Figure 28.  Of course each of these Virtual Machines require additional System Resources which can be allocated as available.

In Part 3 of 3 I will demonstrate how to ‘maintain’ the Windows 7 Enterprise x86 Virtual Machine Image that is ‘unsealed’.  Specifically, when additional Security Updates are made available I will apply them to the ‘unsealed’ Virtual Machine Image and then update the ‘sealed’ Image using the ‘fresh’ Virtual Machine Hard Disk Image.  Take a look at Part 3 of 3 when you have interest.

Summary: In this Blog entry I focus on ‘sealing’ a Windows 7 Enterprise x86 Image created using Virtual PC and then using the Sysprep Process. I also demonstrated the required steps to separately maintain an ‘unsealed’ version of the Windows 7 Enterprise x86 Image stored in a separate Folder.  This Blog entry is Step 2 of 3 in a 3 part series.  In the Part 3 of 3 I will demonstrate how to ‘update’ the ‘unsealed’ version of the Windows 7 Enteprise x86 Image stored in Part 2 of 3 for future useage.

Lynn Lunik
Chief Security Architect
IT Pro Secure Corporation
blog@itprosecure.com

Blog Tags: Amazon Web Services, Forefront Client Security, Forefront Endpoint Protection 2010, Hyper-V, Virtual PC 2007,  SCOM2k7, SQL2k8, Windows 7,  Windows 2008, Exchange 2007, Exchange 2010,  Failover Clustering – ITPS, Failover Clustering – LL

The key to this endeavor is understanding that generating the initial Windows 7 Image in Virtual PC is a straightforward process.  The Virtual PC method of mounting an .ISO Image of the Windows 7 Source Media files from the Host Workstation CD/DVD Drive within the image, and then using the mounted .ISO File (of Windows 7 Source Media) for the Virtualized Guest Operating System Installation provides an effecting method to creating the initial Image.  Once the Virtualized Guest Partition running Windows 7 Entprise is installed, my hope is to offer a manual method to ‘maintain’ the Windows 7 Image for future updates, while, at the same time creating a copy of the Image and then sealing the Image using the defined Sysprep Process from Microsoft.  The usefulness of having a Windows 7 Image readily available for use in Virtual PC is endless.  The fact that you will always have a ‘current’ Windows 7 Image in your Virtual PC Library is invaluable.   Over and above this usefulness I will review a method to duplicate the VHD File prior to using Sysprep for ‘sealing’ and then maintaining the ‘unsealed’ VHD File for use in subsequent months when Security Updates or additional Application are required within the Image.

Of course, the method I review is very manual.  There are plenty of points along the way where scripting or use of specific utilities or tools would be appropriate.  My goal is to offer a framework for the process whereby you can apply any nuances, scripting or any other activities you feel appropriate.  Again, this is a multi-part Blog entry.  Here’s how each part lays out.

1. In this Blog entry Part 1 of 3 I will generate a Windows 7 Enterprise Image on a Windows 7 Workstation running Virtual PC.  Typically this is termed ‘provisioning an image’ as we are starting in Virtual PC with nothing and finishing with Windows 7 Enterprise running as a Virtual Guest Partition within Virtual PC on a Windows 7 Host.
2. In Part 2 of 3 I will use a process to ‘seal’ a copy of the Virtual Hard Disk (VHD File Format) using Sysprep that can then be used as a ‘current’ Windows 7 Image.
3. Finally, in Part 3 of 3 I will review a method to maintain an ‘unsealed’ copy of the Virtual Hard Disk, update the Image with Security Updates, duplicate the VHD then ‘seal’ the ‘new current’ Windows 7 Image to be made the ‘most up to date’ and ‘fresh’ Windows 7 Enterprise Image when the need arises for its use.

Figure 1 – Launch Virtual PC on the Windows 7 Enterprise Host to begin creation of the Windows 7 Enterprise Guest Partition.

On the Windows 7 Enterprise Host Workstation I begin by opening Virtual PC using the ‘Manage Virtual Machines’ Task.  I have several Virtual Guest Partitions already on this Host as you can see by the blurred Guest Partition Names under ‘Recent Virtual Machines.  Use of the ‘Manage Virtual Machine’ Task is required to create a new Guest Partition (our Windows 7 Enterprise Image).

Figure 2 – Select ‘Create Virtual Machine’ to begin the creation process for the Guet Partition.

The ‘Create Virtual Machine’ Task initiates the Wizard that generates the Windows 7 Enterprise Image.

Figure 3 – Selection of a Folder named ‘Win7x86-Sealed’ to store the Virtual PC Guest Partition files.

I have created a Folder on the Volume titled ‘Win7x86-Sealed’ as the location for the files generated by Virtual PC when creating a Guest Partition.  I select this precise name as it is a reminder that when completed this Image of Windows 7 Enterprise will need to be ‘sealed’ using the Sysprep process prior to use.

Figure 4 – The ‘Create a Virtual Machine’ Wizard begins where both a ‘Name’ and a ‘Location’ are specified.

Figure 5 – Next the amount of ‘Memory’ and ‘Networking’ parameters are defined.  I select to ‘Use Computer Network Connections’ which ‘bridges’ the Guest Partition across the Host Network Interface (NIC).

Figure 6 – The next selection in the ‘Create a Virtual Machine’ Wizard is specific to the ‘type’ and ‘size’ of the Virtual Hard Disk.

Figure 7  – Note that (a quick aside ) to view the contents of the ‘Win7x86_Sealed’ Folder where the Virtual PC Guest Partition Files for this Windows 7 Enterprise Image are held includes 2 files at this point.  File 1 is the ‘Virtual Machine Hard Drive Image’ file while File 2 is the ‘Virtual Machine Settings File’.

Figure 8 – Now that the ‘Create a Virtual Machine’ Wizard is completed status of the Guest Partition (the Windows 7 Enterprise Image) is visible located on the ‘E:’ Drive.  Next, I will focus on the ‘CD/DVD’ Setting for the Guest Partition in order to ‘Boot’ this Bare Metal Guest Partition to an Operating System it is necessary to place the Windows 7 Source Media (DVD) in the form of an .ISO Image.  This .ISO Image Virtual PC can read and used as Boot Media for the Virtualized Guest Partition Operating System installation.

Figure 9 – Upon selecting the Windows 7 Enterprise Image it is possible to modify the ‘Settings’ for this Guest Partition.

Figure 10 – Upon selecting the ‘Settings’ Option for this Guest Partition the ‘Windows Virtual PC Settings’ Dialogue Window is visible.  The focus is on the ‘DVD Drive’ named ‘D:\’.

Figure 11 – Here is the key to creating this Windows 7 Enterprise Image (also called a ‘Guest Partition’) – selecting an .ISO File with the Windows 7 Enterprise Source Media (MSDN, Select or Volume Licensing) for the initial ‘Boot Process’ to create the Operating System Install.  Since the ‘DVD Drive’ is pointed to the .ISO File of Windows 7 Enterprise Source Media I now move  to ‘Boot’ the Guest Partition for the first time.

Figure 12 – Using the ‘Open’ Menu Option ‘starts’ the Windows 7 Enterprise Guest Partition for the first time.  Remember here, this Guest Partition should use the .ISO File of Windows 7 Enterprise Source Media and initiate the ‘Installation Process’ for Windows 7 Enterprise.

Figure 13 – Here the WinPE Environment from the Windows 7 Enterprise Source Media is Booting correctly.  Now the initial Installation is underway a normal sequence of selecting IP Settings, Workgroup Mode, etc. occurs.

Figure 14 – The standard Mini-Boot Sequence for Windows 7 Enterprise is underway.  Again, this is a Virtualized Guest Partition running on a Windows 7 Enterprise Host.  Once this Guest Partition is complete with selected Security Updates and Applications I will duplicate the Virtual Hard Disk storing one ‘unsealed’ version for future Updates and using the second by ‘sealing’ using the Sysprep Process as the ‘master’ for duplicating as many times as required based on the need for a Windows 7 Enterprise Image.

Figure 15 – One of the Features of a Virtual PC Configuration running on a Windows 7 Enterprise Host is the requirement to Install the ‘Virtual PC Integration Components’ to achieve real usability.  Upon initially attempting to select the ‘Next’ Button from Figure 14 above, a Popup like this appears.  Do note the ‘Ctrl+Alt+Left Arrow’ requirement to ‘release’ the mouse point prior to installing the Virtual PC Integration Components.  Once the VPC Integration Components are installed (Requires a Reboot) this Key Sequence is no longer necessary.

Figure 16 – The Guest Partition is ready to installation of Windows 7.

Figure 17 – The Windows 7 Install Process requires Acceptance of the License Terms to advance.

Figure 18 – The Default allocation for a Dynamically Expanding Virtual Hard Disk Size is ’127 GB’.  This information correlates to Figure 6 above.

Figure 19 – Succesful selection of a Partition advances the Installation Process to begin the exchange of files from the Windows 7 Source Media to the Guest Partition.

Figure 20 – The cycles of the Windows 7 Installation near a close.  Again, once we build this Windows 7 Image once I will review using it successfully over and over.

Figure 21 – After a successful Reboot the ‘Set Up Windows’ Dialogue Windows offers the ability to configure the ‘first Administrator’ and the ‘Computer Name’.

Figure 22 – Since the ‘first Administrator’ controls the Workstation the Wizard advances the requirement for Password Confirmation and a ‘Password Hint’ field.

Figure 23 – The ‘Automatic Update Settings’ near the final step to a successful Login to this Windows 7 Enterprise Virtualized Guest Partition.

Figure 24 – After a selection of the ‘Time Zone’ and a validation of the correct Time I proceed.

Figure 25 – Finally, the Windows Firewall Settings correlate to selection of the ‘Computers Current Location’.  I select ‘Public Network’ as the most restrictive Windows Firewall Settings are included.

Figure 26 – Success!  Upon viewing the Windows 7 Enterprise Desktop I begin the process of installing the ‘Virtual PC Integration Components’.  Again, these components allow interaction between the Virtual Environment and the Host Workstation in a fluent way.

Figure 27 – The Virtual PC Integration Components display as being ‘inserted’ into the Guest Partition CD/DVD.  I select ‘Run Setup.exe’ from the ‘Autoplay’ dialogue windows.

Figure 28 – The ‘Virtual PC Integration Components’ use a typical .MSI Installation paradigm.

Figure 29 – The ‘VPC Integration Components’ install a variety of Drivers to ‘shim’ between the Hardware Assisted Virtualization and Hardware Components on the Host Workstation.

Figure 30 – In this capture the ‘VPC Integration Components’ installation is complete pending a Reboot.  Observe the Error Balloons offered carefully.  Further investigation of this Error Balloon will occur following the Reboot.

Figure 31 – The pending Reboot moves this Installation closer to visiting Microsoft Update for Security, Critical and Important Updates.

Figure 32 – After a successful Reboot I login as the ‘first Administrator’ configured previously.  I will begin the ‘patching process’ next.  Additionally, I will add any Applications appropriate for this Image.

Figure 33 – The ‘Virtual PC Integration Components’ installed successfully as demonstrated by the availability of the ‘USB’ Drop Down Menu that includes integrating the ability to ‘Attach’ to the Host Workstation ‘ Desktop’.

Figure 34 – After a quick switch of the ‘Default Picture’ I am ready to begin next steps.  These steps include 1) applying Security Updates and 2) installing Applications.  Applications for consideration are any used in the Image that would require time and effort in the future when provisioning this Virtualized Image for usage.  Time spent once is gained back triple if carefully installed.

Figure 35 – A clean, working Desktop is available in this Virtualized Guest Partition running Windows 7 Enterprise.  Control of this Image is available through the Host Workstation.  I will begin adding appropriate Security, Critical and Important Updates from Microsoft Update.

Figure 36 – Upon selecting ‘Control Panel’, then ‘Check for Updates’ from the ‘Windows Update System and Security Center’ I begin to mature this Image to full health.  Remember, I selected ‘Public’ as the ‘Network Connection’ which provides well defined Windows Firewall settings.

Figure 37 – After selecting and installing a varity of Security Updates a Reboot is in order.  I will ‘complete’ this Image by adding additional Applications for productivity.

Figure 38 – Success!  Again, this is the first sequence of steps to mature this Image for additional use.

Summary: In this Blog entry focused on creating and maintaining a Windows 7 Image using Virtual PC on Windows 7 I initiated the creation of a Virtual Guest Partition running Windows 7 Enterprise Edition.  this Virtual Guest Partition running Windows 7 Enterprise Edition will be used in subsequent Blog entries where both ‘sealed’ and ‘non-sealed’ Images will be preserved.

Lynn Lunik
Chief Security Architect
IT Pro Secure Corporation
blog@itprosecure.com

Blog Tags: Amazon Web Services, Forefront Client Security, Forefront Endpoint Protection 2010, Hyper-V, Virtual PC 2007,  SCOM2k7, SQL2k8, Windows 7,  Windows 2008, Exchange 2007, Exchange 2010,  Failover Clustering – ITPS, Failover Clustering – LL

My name is Lynn Lunik and I work as a Security Consultant focused on Windows Core Services.  I have had the privilege of working alongside some talented System Engineers, Architect, Developers and Executives over the years.  As part of the experiences to offer Advanced Solutions using Windows Core Services, I have found I am constantly looking for technical resources on the Internet from my Peers, Colleagues and fellow System Engineers working on similar endeavors.  This Blog Site is a catalog of some of my experiences relative to Configuring, Testing, Optimizing, Maintaining, Securing and simply Using the varied Technologies available to the System Engineer, System Architect and Consultant focused on the Windows Core Services and the Windows Platform. My hope is you view the Blog entries on this Web Site as a refererence resource for comparison to your work in your Lab Environment.

I currently maintain several Web Sites. These Sites offer Blog Entries and Advanced Training Videos for purchase.  This content is designed for anyone searching for Advanced Training Material.

The IT Pro Secure Corporation Blog Site maintains a library of Blog entries starting in early 2006 through March 2010.  I am transitioning the content from the IT Pro Secure Corporation Blog Site to this Blog Site over time.   In the meanwhile, please keep the RSS Feed Subscription to IT Pro Secure Corporation for your records.  The new RSS Feed Subscription for this Web Site is located in the top, right hand corner of this Site.

A number of months back I began to create Advanced Training Materials for the Windows System Engineer, Consultant, System Architect and Developer.  I use the exchangesummit.net Web Site as the location to Preview and Sell these Training Videos.  Expect more Advanced Training Videos on the exchangesummit.net Web Site coming in the near future.  Here are several Sample Videos to reference to assist with clarifying the type of Training Material available.

Finally, if I can offer clarity on any of the Blog entries found herein please drop me a line at blog <at> itprosecure.com.  I will do my best to return your e-mail in an appropriate fashion.

Kindest Regards,

Lynn Lunik
Chief Security Architect
IT Pro Secure Corporation
blog@itprosecure.com

Blog Tags: Amazon Web Services, Forefront Client Security, Forefront Endpoint Protection 2010, Hyper-V, Virtual PC 2007,  SCOM2k7, SQL2k8, Windows 7,  Windows 2008, Exchange 2007, Exchange 2010,  Failover Clustering – ITPS, Failover Clustering – LL

Let’s begin by simply issuing the following command:

route print

An Administrative Command Prompt output shows the following the following sections of the Command Output:

Figure 1 - Issuing the 'route print' Command from an Administrative Command Prompt in Windows 7

Observing the output of the Command indicates there are 5 Major Sections.  The Sections include:

• Interface List
• IPv4 Route Table
• IPv4 Persistent Routes
• IPv6 Route Table
• IPv6 Persistent Routes

On this Workstation a single Physical Network Interface is visible and has been assigned a DHCP Address of ’10.1.1.36′.

The IP Stack for this Workstation is as follows:

• IP Address: 10.1.1.36
• Subnet Mask: 255.255.255.0
• Default Gateway: 10.1.1.1
• DNS Server: 10.1.1.1
• DHCP Server: 10.1.1.1
• DNS Suffix: YYY.YYY.isp-provider.net

Most of the time our focus is upon the IPv4 Routing Table output.  Here are the sections of the IPv4 Routing Table output for reference.

Figure 2 - The IPv4 Route Table output listing the 'all networks' route through the Default Gateway.

The next IPv4 Routing Table entry indicates ’10.1.1.36′ (the Host Workstation’ is a member of the ’10.1.1.1/24′ Network and would route packets out the ’10.1.1.36′ Interface.

Figure 3 - The Workstation Host at '10.1.1.36' is a member of the '10.1.1.0/24' Network Subnet.

The next IPv4 Routing Table entry indicates ’10.1.1.36′ may receive a Broadcast from the ’10.1.1.0/24′ Network (as noted by the Subnet Mask of ’255.255.255.255′).

Figure 4 - The Workstation Host at '10.1.1.36' can offer a Broadcast on the '10.1.1.0/24 Network' (as noted by the 255.255.255.255 Subnet Mask).

Another IPv4 Routing Table entry focused on Broadcast Addresses is the following.  The Host Workstation at ’10.1.1.36′ may offer Network Broadcasts to the ’10.1.1.0/24′ Network.

Figure 5 - The Workstation Host at '10.1.1.36' can receive Network Broadcasts from the '10.1.1.0/24' Network (as noted by the '10.1.1.255' Network Destination).

The next IPv4 Routing Table entries (3 of them) are focused on the Loopback Network Values of ’127.0.0.0/8′,  ’127.0.0.1/32′ and the Loopback Network Address of ’127.255.255.255/32′ respectively.  These Addresses provide Services to the Local Host (or Loopback Adapter).  The Loopback Network Destination of ’127.0.0.0′ provides access to the Loopback Network through ’127.0.0.1′ the Loopback IP Address.  The Loopback IP Address of ’127.0.0.1/32′ receives Limited Local Broadcast to the Loopback Network while the Loopback IP Address of ’127.255.255.255/32′ provides Limited Broadcast to the Loopback Network.

Figure 6 - The Workstation Host at '10.1.1.36' uses 3 Addresses for Services to the 'Local Host'. All 3 Addresses incorporate the '127.x.x.x' format.

Next the Routing Table includes 2 specific entries for the Multicast Network (224.0.0.0/4) for both the ‘Local Host’ or Loopback  Address of ’127.0.0.1′ and the Host IP Address of ’10.1.1.36′ that are ’224.0.0.0/4′ .  These are used for Multicast Network functions.

Figure 7 - The Workstation Host at '10.1.1.36' includes 2 Multicast Addresses (starting with '240.0.0.0') reserved for use through either the Loopback Address '127.0.0.1' or the Host IP Address '10.1.1.36'.

The last 2 Routing Table entries provides Services through Limited Broadcast Addresses.  The Network Destination of ’255.255.255.255/32′ are the Limited Broadcast Address Ranges for both the Loopback Adapter ’127.0.0.1′ and the Host IP Address ’10.1.1.36′.

Figure 8 - The Workstation Host at '10.1.1.36' includes 2 Limited Broadcast IP Address Values to Service both the Loopback Network '127.0.0.1' and the Host IP Network '10.1.1.36'.

Finally, upon understanding the sections of the Windows 7 Routing Table there are additional functions available when using the ‘route’ Command.  This Blog entry is focused solely on output from the ‘route print’ Command.

Summary: In this Blog entry focused on using the ‘route print’ Command from an Administrative Command Prompt in Windows 7.  Each of the defined routes for a Workstation running Windows 7 Enterprise were reviewed for reference.

Lynn Lunik
Chief Security Architect
IT Pro Secure Corporation
blog@itprosecure.com

Blog Tags: Amazon Web Services, Forefront Client Security, Forefront Endpoint Protection 2010, Hyper-V, Virtual PC 2007,  SCOM2k7, SQL2k8, Windows 7,  Windows 2008, Exchange 2007, Exchange 2010,  Failover Clustering – ITPS, Failover Clustering – LL