Primer for HDX and 3D in XenApp and XenDesktop

HDX technologies built into Citrix XenApp and Citrix XenDesktop can and do deliver an excellent user experience on a many devices and over smaller network connections. HDX technologies are built on top of the ICA remoting protocol.

HDX has three technical principles:

1. Intelligent redirection; examining screen activity, application commands, and endpoint device, network and server capabilities to determine how and where to render on the server or redirect them on to the client.
2. Adaptive compression; defines codecs for specific network conditions, as manages CPU and/or GPU resources on hosts.
3. De-duplication of network traffic; using multicasting of multimedia streams, delivering of a single transmission  to many users at once. And the de-duplicates of bitmap graphics, files, print jobs and streamed media.

HDX is built on the core of ICA which also has these features to manage network traffic:

1. Adaptive TCP flow control accelerates the flow of all TCP-based traffic, by sensing and responding to high network latency and packet loss. The result is significantly higher network throughput and performance than with standard TCP implementations.
2. Adaptive compression to compress ICA traffic based on its characteristics, infrastructure capabilities and network conditions.
3. Adaptive protocol acceleration performs intelligent acceleration of ICA traffic while sensing and responding to network and traffic conditions.

Under the covers HDX is based on these seven components:

1. HDX Broadcast - Broadcast for providing desktops and applications over any network. It provides the underlying transport for many of the other HDX technologies. HDX Broadcast includes many of the older technologies such as instant mouse click feedback, keystroke latency reduction, multi level compression, session reliability, and queuing and tossing.
2. HDX Plug and Play - Plug and Play provide connectivity for local devices and applications in a virtualised environment, including USB, multi-monitor, printers, and peripherals. HDX Plug and Play includes technologies such as multi monitor support, smart card support, special folder redirection, universal printing, file type association, and USB support.
3. HDX 3D - 3D delivering high end graphics remotely such as image acceleration and progressive display for graphically intensive images.
4. HDX MediaStream - MediaStream for multimedia extends HDX Broadcast capabilities. With technologies for streaming media files to the client device for playing via local codecs with seamless embedding into the remote session.
5. HDX RealTime - RealTime for realtime communications such as voice and web cameras. RealTime extends HDX Broadcast capabilities. HDX RealTime support is in development today with third parties to support realtime communication via both voice and video on the remote client.
6. HDX IntelliCache - IntelliCache is to locally cache bandwidth intensive data and graphics and locally stage streamed applications. IntelliCache caches common application display data for multiple users locally to the branch office, eliminating redundant transfer of commonly used application objects.
7. HDX Adaptive Orchestration - Adaptive Orchestration enable seamless interaction between the HDX Technology categories. A central concept is that all these components work adaptively to tune the unified HDX offering for the best possible user experience.

Citrix Netscaler VPX Express

 

Free for small environments or for testing ‘Citrix Netscaler VPX Express’. The VPX Express supports:

1. Load Balancing Citrix PVS TFTP, Active Directory or LDAP request, DNS
2. Load Balancing Web Site or services
3. Unlimited ICA Proxy connections to XenDesktop/XenApp (throughput limited)
4. Citrix Access Gateway support for up to 5 concurrent users
5. VPN gateway for up to 5 concurrent users
6. Reverse proxy to externally access Exchange OWA or other web sites and file shares.

The license you download for free from MyCitrix.com and you need to replace it each year.

Download it here…

Sweet.

Running NetScaler Gateway VPX on Azure ???

 

Right now I am not sure this works, I was going to try it, but work changed and the plan got put off. So buyer beware for this may or may not work. This is based on the Azure blog here.

Download the NetScaler VPX Hyper-V appliance image

Load it on a Hyper-V server and boot it, login as the secret account and password

Configure the OS to use DHCP, So enable networking

Configure the primary interface for DHCP (later you will fix it via the NetScaler console)

Edit /etc/rc.conf (google it)
service netif restart

Enable SSH

Enable SSH via the /etc/rc.conf file and create the new host keys

echo 'sshd_enable="YES"' >> /etc/rc.conf

ssh-keygen -t dsa -f /etc/ssh/ssh_host_dsa_key
ssh-keygen -t rsa -f /etc/ssh/ssh_host_rsa_key
service sshd restart

Install Python 2.7 and required modules

pkg install python27 py27-asn1




pkg2ng

You may need a symbolic link the new python 2.7 binary?

ln -s /usr/local/bin/python2.7 /usr/bin/python

Install the Azure Linux Agent

On Github – https://github.com/Azure/WALinuxAgent/releases.  The latest agent that supports FreeBSD:

pkg install wget

wget https://raw.githubusercontent.com/Azure/WALinuxAgent/2.0/waagent


mv ./waagent /usr/sbin/


chmod 755 /usr/sbin/waagent


/usr/sbin/waagent –install

Well if this worked, now logon to the NetScaler console and start the real work, let me know how it went?

EdgeSight CRL Checking–Speed up EdgeSight

 

The EdgeSight console uses IIS and .NET which in turn uses built-in Certificate Revocation List (CRL) checking when generating Publisher Evidence for Code Access Security (CAS). When validating the certificate the server walks the chain of Certificates and tries to download the Certificate Revocation List from the internet.

If the computer cannot connect to the internet (timeout, delay, proxy auth, not allowed to etc) this delays the console.

To remove CRL checking add the following to your ASPNET.CONFIG or APP.CONFIG file:

<generatePublisherEvidence enabled="false"/>

ASPNET.CONFIG file is in the following folder.

c:\Windows\Microsoft.NET\Framework64\v2.0.50727

This is what yours should look like:

Open the server management to restart IIS services or restart the server.

Thanks to http://blazetechnical.net/2014/06/edgesight-web-interface-aspnet/ for the tip.

VDI verses RDS/Terminal Server

 

This is a read and a nice definitive conclusion, I will leave you to read the artical, but here is the punchline:

“As for the myth that VDI scales almost as well as RDS, well I think we can officially call that myth busted!!!  Anyone who says RDS only scales 20% better than VDI is dead wrong!!! RDS is still king and in most real world environments will give you 100 – 200% greater user density than VDI!”

http://blogs.citrix.com/2014/08/15/rds-vs-vdi-making-sense-of-the-numbers-with-loginvsi/

Manually Install/Remove Individual Citrix Receiver Components

To extract the .msi files, run the following at command prompt:
For Receiver 4.x: CitrixReceiver.exe (For 3.x use: CitrixReceiverEnterprise.exe /extract [Destination_name]). The directory must exist already and /extract adds a subfolder called extract to that directory.

You can install the .msi files, just double-click each file (in elevated mode). The .msi files are supported per-machine and require administrator privileges to deploy them.

Installing the Components:

When installing the Receiver components, install in the following order:

1. RIInstaller.msi
2. CitrixReceiverUpdater-user.msi
3. ICAWebWrapper.msi
4. GenericUSB.msi
5. DesktopViewer.msi
6. CitrixHDXMediaStreamForFlash-ClientInstall.msi
7. Vd3dClient.msi
8. AuthManager.msi
9. SSONWrapper.msi
10. SelfServicePlugin.msi

Removing the components:

When removing the components, remove them in the following order:

1. SelfServicePlugin.msi
2. SSONWrapper.msi
3. AuthManager.msi
4. Vd3dClient.msi
5. CitrixHDXMediaStreamForFlash-ClientInstall.msi
6. DesktopViewer.msi
7. GenericUSB.msi
8. ICAWebWrapper.msi
9. CitrixReceiverUpdater-user.msi
10. RIInstaller.msi

Each .msi file has an Programs and Features entry.

MSI Name	Name in A/R Programs	Details or notes
RIInstaller.msi	Citrix Receiver Inside	Citrix Receiver was split apart into "Receiver Updater" and a "Receiver Inside". The Receiver Inside component was then bundled into the Online plug-in installer to form a new Receiver package.
ICAWebWrapper.msi	Online Plug-in	Wrapper for Receiver inside
PNAWrapper.msi	Citrix Receiver (PNA)	Recently Citrix has renamed Receiver Enterprise to Receiver (Legacy PNA)
SSONWrapper.msi	Citrix Receiver (SSON)	Single sign-on/pass-through authentication
CitrixHDXMediaStreamForFlash-ClientInstall.msi	Citrix Receiver (HDX Flash Redirection)	HDX Flash redirection
DesktopViewer.msi	Citrix Receiver (DV)	Desktop Viewer (XenDesktop)
GenericUSB.msi	Citrix Receiver (USB)	USB redirection
Vd3d.msi	Citrix Receiver (Aero)	Windows 7/2008 Aero Support
AuthManager.msi	Citrix Authentication Manager	Domain Pass-through
CitrixReceiverUpdater-User.msi	Citrix Receiver Updater	Update services
SelfServicePlugin.msi	Citrix Single Sign-On Plug-in	Allows users to add and remove StoreFront stores

The CitrixReceiver is downloaded as a modular MSI packages interact with the main EXE wrapper and Citrix Receiver. The self-extracting EXE can be launched from the Autorun, Browser, Network share, Script, Explorer, or a Command line.

The EXE wrappers are responsible for:

1. Performing installation, upgrade and un-installation of the MSI Packages.
2. Passing the MSI command lines necessary to install each of the MSI Packages.
3. Generation of installation Logs.
4. Detecting the appropriate language from the user's system locale.
5. Rollback of installation files in the event of a failed installation of one or more of the MSI packages.

In General, most user specified MSI Properties passed in at the command line to the EXE are passed to the MSI Sub packages, however, note that it is passed to all of them. The MSI package the MSI property is targeted for will read the Property, while the other packages just ignore the Property.

It is also possible to apply MST’s to an MSI sub package, however, note that the MST will be passed to all of the packages. The MSI package the MST is targeted for will read the Transform, while the other packages just ignore the Transform.

Example: Add TRANSFORMS=C:\mytransform.mst to the command-line and the transform should be applied to all MSIs in the self-extractor. If you need to use transforms just for one, then you’ll have to extract them.

 

Original source for this is here: http://support.citrix.com/article/CTX132447  http://support.citrix.com/article/CTX123039

Additional information from: http://www.thomaskoetzing.de/index.php%3Foption%3Dcom_content%26task%3Dview%26id%3D361%26Itemid%3D310

Citrix XenApp 6.5 SDK and powershell tools

 

Get and install the SDK http://tinyurl.com/XenApp65PSSDK   

Or use the migration module if it has what you need

Run the right powershell, the one with the SDK not shown.

get-help *citrix*

Here is a script I used to dump out files for each area:

<#
Script Name     : XAInventory.ps1
Dependencies    : Powershell
Description     : Retrieves inventory from server
Purpose            : Inventory
OS Versions     : 2008R2
Date            : June 2014
Release            : v1.0
Usage : XAInvetory.ps1
#>

Write-Host "01. Get-XAFarm"
Get-XAFarm

write-host "02. Get-XAFolder"
Get-XAFolder

Write-Host "03. Get-XAZone"
Get-XAZone

#write-host "qfarm /load"
#qfarm /load

Write-Host "04. Get-XAZone | Get-XAServer | Get-XAServerLoad | format-table -wrap"
#Get-XAZone | Get-XAServer | Get-XAServerLoad | format-table -wrap
Get-XAServerLoad | sort 

Write-Host "05. Get-XAServer * | Select-Object ServerName, LogOnMode"
Get-XAServer * | Select-Object ServerName, LogOnMode

write-host "06. Get-XAServer * | Select-Object ServerName, OSVersion,CitrixVersion, CitrixServicePack"
Get-XAServer * | Select-Object ServerName, OSVersion,CitrixVersion, CitrixServicePack

Write-Host "07. Get-XAServer * | Select-Object ServerName, zonename, ElectionPreference"
Get-XAServer * | Select-Object ServerName, zonename, ElectionPreference | sort ElectionPreference

write-host "08. Get-XAZone | Get-XAServer | select ServerName, IPAddresses | Sort-Object IPAddresses"
Get-XAZone | Get-XAServer | select ServerName, IPAddresses | Sort-Object IPAddresses

write-host "09. Get-XAZone | Get-XAServer | select ServerName, IPAddresses | Sort-Object servername"
Get-XAZone | Get-XAServer | select ServerName, IPAddresses | Sort-Object servername

write-host "10. Get-XAServer | select ServerName | Get-XAPrinterDriver | Format-Table -Wrap"
#Get-XAServer | select ServerName | Get-XAPrinterDriver | Format-Table -Wrap
Get-XAServer | select ServerName | Get-XAPrinterDriver

write-host "11. Get-XASession | select ServerName, BrowserName, AccountName | sort servername | Format-Table -auto"
Get-XASession | select ServerName, BrowserName, AccountName | sort servername

write-host "12. Get-XASession | select clientname, AccountName, BrowserName | Sort-Object Accountname"
Get-XASession | select clientname, AccountName, BrowserName | Sort-Object Accountname

write-host "13. Get-XASession | select ServerName, BrowserName, AccountName, clientname | Sort-Object clientname"
Get-XASession | select ServerName, BrowserName, AccountName, clientname | Sort-Object Servername

write-host "14. Get-XAWorkerGroup | select WorkerGroupName, OUs"
Get-XAWorkerGroup | select WorkerGroupName, OUs

#write-host "Get-XAAdministrator"
#Get-XAAdministrator

write-host "15. Get-XAAdministratorPrivilege *"
Get-XAAdministratorPrivilege *

write-host "16. Get-XAAdministrator | select AdministratorName, FarmPrivileges"
Get-XAAdministrator | select AdministratorName, FarmPrivileges

write-host "17. Get-XAApplicationReport * | select WorkerGroupNames, DisplayName | Sort-Object workergroupname | ft -autosize -wrap"
#Get-XAApplicationReport * | select WorkerGroupNames, DisplayName | Sort-Object workergroupname | ft -autosize -wrap
Get-XAApplicationReport * | select WorkerGroupNames, DisplayName | Sort-Object workergroupname

write-host "18. Get-XAApplicationReport * | select DisplayName, Accounts | Sort-Object workergroupname | ft -autosize -wrap"
#Get-XAApplicationReport * | select DisplayName, Accounts | Sort-Object workergroupname | ft -autosize -wrap
Get-XAApplicationReport * | select DisplayName, Accounts | Sort-Object workergroupname

write-host "19. Get-XAApplicationReport * | select DisplayName,CommandLineExecutable | Sort-Object displayname | ft -autosize -wrap"
#Get-XAApplicationReport * | select DisplayName,CommandLineExecutable | Sort-Object displayname | ft -autosize -wrap
Get-XAApplicationReport * | select DisplayName,CommandLineExecutable | Sort-Object displayname

write-host "20. Get-XAApplicationReport * | select DisplayName,WindowType, ColorDepth | Sort-Object displayname | ft -autosize -wrap"
#Get-XAApplicationReport * | select DisplayName,WindowType, ColorDepth | Sort-Object displayname | ft -autosize -wrap
Get-XAApplicationReport * | select DisplayName,WindowType, ColorDepth | Sort-Object displayname

write-host "21. Get-XAApplicationReport * | select DisplayName,EncryptionLevel, EncryptionRequired, SslConnectionEnabled | Sort-Object displayname | ft -autosize -wrap"
#Get-XAApplicationReport * | select DisplayName,EncryptionLevel, EncryptionRequired, SslConnectionEnabled | Sort-Object displayname | ft -autosize -wrap
Get-XAApplicationReport * | select DisplayName,EncryptionLevel, EncryptionRequired, SslConnectionEnabled | Sort-Object displayname

write-host "22. Get-XAApplicationReport * | select DisplayName, PreLaunch | ft -autosize -wrap"
#Get-XAApplicationReport * | select DisplayName, PreLaunch | ft -autosize -wrap
Get-XAApplicationReport * | select DisplayName, PreLaunch

write-host "23. Get-XAApplicationReport * | select DisplayName, Enabled, AnonymousConnectionsAllowed | Sort-Object displayname | ft -autosize -wrap"
#Get-XAApplicationReport * | select DisplayName, Enabled, AnonymousConnectionsAllowed | Sort-Object displayname | Sort-Object ENABLED | ft -autosize -wrap
Get-XAApplicationReport * | select DisplayName, Enabled, AnonymousConnectionsAllowed | Sort-Object displayname | Sort-Object ENABLED

Write-Host "24. GET-XALoadEvaluator | select MachineName, LoadEvaluatorName"
GET-XALoadEvaluator | select MachineName, LoadEvaluatorName, IsBuiltIn

Write-Host "25. GET-XALoadEvaluator | select MachineName, LoadEvaluatorName  | Format-Table -wrap"
#GET-XALoadEvaluator | select LoadEvaluatorName, ApplicationUserLoadEnabled, ContextSwitchesEnabled, CpuUtilizationEnabled | Format-Table -wrap
GET-XALoadEvaluator | select LoadEvaluatorName, ApplicationUserLoadEnabled, ContextSwitchesEnabled, CpuUtilizationEnabled

Moving an Azure VM between networks

 

Moving an Azure VM between networks was before, delete, recreate, reattached disk as documented here:

http://blogs.msdn.com/b/walterm/archive/2013/05/29/moving-a-virtual-machine-from-one-virtual-network-to-another.aspx

Which works a charm by the way, however you can now powershell it as documented here:

https://fabriccontroller.net/blog/posts/migrating-your-microsoft-azure-virtual-machine-to-a-different-subnet-with-the-new-powershell-cmdlets/

“

$context = Get-AzureVM -ServiceName contosomed -Name server01

Set-AzureSubnet -SubnetNames "WFE" -VM $context

Update-AzureVM -ServiceName contosomed -Name server01 -VM $context.VM

“

Install MYOB on XenDesktop 7.5 in Azure on Server 2012 r2

 

Installing MYOB 19.10 in Azure Server Windows Server 2012 r2

Disable UAC via the registry, reboot

Install .NET 3.5

Just install the SERVER product for terminal services

Don’t just install it, do it via the old ‘add remove programs’

Install Application on Remote Desktop

Install

You may get stuck at this screen

If you do and hit cancel this is the error message

This is the workaround to this issue:

1. Log on to the system with Administrative Privileges
2. Open “Local Group Policy Editor” go to:
3. Computer Configuration
4. Administrative Templates
5. Windows Components
6. Remote Desktop Services
7. Remote Desktop Session Host
8. Application Compatibility
9. In the right pane, right click on ‘Turn off Windows Installer RDS Compatibility” and select Edit from the drop down menu
10. Select ‘Enable’
11. Hit OK

Hat tip for this http://community.myob.com/t5/Installing-and-upgrading/Upgrade-to-2014-2-hanging/td-p/263121

Rerun this install and it will work fine.

Few more next next nexts, Finish to complete

Then if you are using XenDesktop 7.5 allocate the application to users.

Good to go.

List to MYOB Supported platforms http://myob.com.au/business/customer-service-support/support/new-microsoft-environments-page/microsoft-windows-8-1257830102169

How to install and use Citrix WebInterface 5.4 on Windows Server 2012 R2

 

Prepare your Windows Server 2012 r2

Install the following roles and features:

• .NET Framework 3.5 Features
• .NET Framework 3.5 (includes 2.0 and 3.0)

• Web Server (IIS) with sub-components
• Management Tools with sub-components
• IIS 6 Management Compatibility
  IIS 6 Metabase Compatibility

Install Citrix WebInterface

• install Microsoft Visual J# from the XenApp 6.5 installation media
• Citrix WebInterface 5.4 from the XenApp installation media

After the installation is completed you can now open the Citrix WebInterface Management Console. At this point the installation will fail.

• You can work around this issue by creating a text file named mmc.exe.config in %WinDir%\SYSWOW64 with this content:

<?xml version ="1.0"?>
<configuration>
        <startup>
                <requiredRuntime version="v2.0.50727"/>
                <supportedRuntime version="v2.0.50727"/>
        </startup>
</configuration>

• Now in the Citrix WebInterface Management Console again and create the required sites

The file mmc.exe.config can cause issues with other tools, so remove it after you are done

• Now correct the CitrixWebInterface5.4.0AppPool in IIS

If you try to access a new WebInterface site you will receive an error message about .NET complilation.

You can fix this for all sites on this server by changing the .NET Framework version for the Citrix application pool:

1. Open Information Manager Service (IIS) Manager
2. Open your server
3. Open the Application Pools
4. Edit Basic (or advanced) Settings on CitrixWebInterface5.4.0AppPool
5. Chose .NET Framework Version v2.0.50727 (or Dot NET CRL 2.0 in advanced)

Thank you to Marcel Meurer, www.sepago.de/e/marcel/2012/09/25/how-to-install-and-use-citrix-webinterface-54-on-windows-server-2012 who I based this on.

PVS Target install silently

 

There are lots of issues with installing the target software via SCCM to build gold images. The command line needed is documented, but here is the right command line switch!

PVS_Device_x64.exe /s /v” /qn /norestart

The installation help file says nothing of this funny quote (“) but it is the secret source. Good luck.

Manually Install MSU or CAB files

 

An .msu file contains the following contents.

Content	Description
Windows Update metadata	Describes each update package that the .msu contains
One or more .cab files	Each .cab file represents one Windows update
An .xml file	This .xml file describes the .msu update package. Used for unattended installation of the update by using the Package Manager tool (Pkgmgr.exe).
A properties file	This file contains string properties that Wusa.exe uses. For example, this file contains the title of the associated article in the Microsoft Knowledge Base.

To install an .msu update package, run Wusa.exe together with the full path of the file.
EG: if the Windows6.3-KB999777.msu file is in the C:\999777 folder, type the following command at a command prompt to install the update package:

• wusa.exe d:\999777\Windows6.3-KB999777.msu

 

If you want to expand it you can expand the .msu file to a temporary folder:

• expand -f:* "C:\999777\Windows6.3-KB999777.msu" %TEMP%

Then, you type the following command at a command prompt:

• pkgmgr.exe /n:%TEMP%\Windows6.3-KB999777.xml

OR if the package expands to a CAB file. You run the following commands to install the packages:

start /w Pkgmgr /ip /m:c:\temp\Windows6.3-KB999777-x86.cab

NOTE: Package Manager installs only the first cab found in a folder.

 

Source of this information: http://support.microsoft.com/kb/934307

Move SCVMM DB Server

 

If you have moved SCVMM 2012 r2 (or earlier) the only official way to change is to uninstall and reinstall. However in my case I have moved from a SQL instance on a standard server to a AllwaysOn instance on the same host.

Instead of uninstalling SCVMM 2012 just modify a database string – then restart the SCVMM service if you did not stop before..

You should stop the SCVMM Service and Agent Services.

Open RegEdit on the SCVMM 2012 server and navigate too: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft System Center Virtual Machine Manager Server\Settings\Sql

Under the SQL key, change all references to the old SQL Server, this includes the following sub-keys;

ConnectionString
DatabaseName
InstanceName
MachineFQDN
MachineName

Active Directory Forest and Domain Levels

 

Features that are available at domain functional levels

The following table shows the features that are available at each domain functional level.

Domain functional level	Available features	Supported domain controller operating systems
Windows 2000 native	All of the default AD DS features and the following directory features are available: Universal groups for both distribution and security groups. Group nesting Group conversion, which allows conversion between security and distribution groups Security identifier (SID) history. Note In Windows Server 2008 R2, the Personal Virtual Desktop feature was introduced. It requires the Windows 2000 native domain functional level	Windows Server 2008 R2 Windows Server 2008 Windows Server 2003 Windows 2000
Windows Server 2003	All the default AD DS features, all the features that are available at the Windows 2000 native domain functional level, and the following features are available: The domain management tool, Netdom.exe, which makes it possible for you to rename domain controllers Logon time stamp updates The lastLogonTimestamp attribute is updated with the last logon time of the user or computer. This attribute is replicated within the domain. The ability to set the userPassword attribute as the effective password on inetOrgPerson and user objects The ability to redirect Users and Computers containers. By default, two well-known containers are provided for housing computer and user accounts, namely, cn=Computers,<domain root> and cn=Users,<domain root>. This feature allows the definition of a new, well-known location for these accounts. The ability for Authorisation Manager to store its authorisation policies in AD DS Constrained delegation Constrained delegation makes it possible for applications to take advantage of the secure delegation of user credentials by means of Kerberos-based authentication. You can restrict delegation to specific destination services only. Selective authentication Selective authentication makes it is possible for you to specify the users and groups from a trusted forest who are allowed to authenticate to resource servers in a trusting forest.	Windows Server 2012 R2 Windows Server 2012 Windows Server 2008 R2 Windows Server 2008 Windows Server 2003
Windows Server 2008	All of the default AD DS features, all of the features from the Windows Server 2003 domain functional level, and the following features are available: Distributed File System (DFS) replication support for the Windows Server 2003 System Volume (SYSVOL) Last Interactive Logon Information Fine-grained password policies Personal Virtual Desktops	Windows Server 2012 R2 Windows Server 2012 Windows Server 2008 R2 Windows Server 2008
Windows Server 2008 R2	All default Active Directory features, all features from the Windows Server 2008 domain functional level, plus the following features: Authentication mechanism assurance, which packages information about the type of logon method (smart card or user name/password) that is used to authenticate domain users inside each user’s Kerberos token. When this feature is enabled in a network environment that has deployed a federated identity management infrastructure, such as Active Directory Federation Services (AD FS), the information in the token can then be extracted whenever a user attempts to access any claims-aware application that has been developed to determine authorisation based on a user’s logon method. Automatic SPN management for services running on a particular computer under the context of a Managed Service Account when the name or DNS host name of the machine account changes.	Windows Server 2012 R2 Windows Server 2012 Windows Server 2008 R2
Windows Server 2012	The KDC support for claims, compound authentication, and Kerberos armoring KDC administrative template policy has two settings (Always provide claims and Fail unarmored authentication requests) that require Windows Server 2012 domain functional level.	Windows Server 2012 R2 Windows Server 2012
Windows Server 2012 R2	DC-side protections for Protected Users. Protected Users authenticating to a Windows Server 2012 R2 domain can no longer: Authenticate with NTLM authentication Use DES or RC4 cipher suites in Kerberos pre-authentication Be delegated with unconstrained or constrained delegation Renew user tickets (TGTs) beyond the initial 4 hour lifetime Authentication Policies (forest-based Active Directory) Authentication Policy Silos	Windows Server 2012 R2

 

Features that are available at forest functional levels

The following table shows the features that are available at each forest functional level.

Forest functional level	Available features	Supported domain controllers
Windows 2000	All of the default AD DS features are available.	Windows Server 2008 R2 Windows Server 2008 Windows Server 2003 Windows 2000
Windows Server 2003	All of the default AD DS features, and the following features, are available: Forest trust Domain rename Linked-value replication (change group membership replicate values for individual members instead of replicating the entire membership ) The ability to deploy a read-only domain controller (RODC) Improved Knowledge Consistency Checker (KCC) algorithms and scalability The ability to create instances of the dynamic auxiliary class named dynamicObject in a domain directory partition The ability to convert an inetOrgPerson object instance into a User object instance, and to complete the conversion in the opposite direction The ability to create instances of new group types to support role-based authorisation. These types are called application basic groups and LDAP query groups. Deactivation and redefinition of attributes and classes in the schema. The following attributes can be reused: ldapDisplayName, schemaIdGuid, OID, and mapiID. Domain-based DFS namespaces running in Windows Server 2008 Mode, which includes support for access-based enumeration and increased scalability.	Windows Server 2012 R2 Windows Server 2012 Windows Server 2008 R2 Windows Server 2008 Windows Server 2003
Windows Server 2008	All of the features that are available at the Windows Server 2003 forest functional level, but no additional features are available. All domains that are subsequently added to the forest, however, operate at the Windows Server 2008 domain functional level by default.	Windows Server 2012 R2 Windows Server 2012 Windows Server 2008 R2 Windows Server 2008
Windows Server 2008 R2	All of the features that are available at the Windows Server 2003 forest functional level, plus the following features: Active Directory Recycle Bin, which provides the ability to restore deleted objects in their entirety while AD DS is running. All domains that are subsequently added to the forest will operate at the Windows Server 2008 R2 domain functional level by default. If you plan to include only domain controllers that run Windows Server 2008 R2 in the entire forest, you might choose this forest functional level for administrative convenience. If you do, you will never have to raise the domain functional level for each domain that you create in the forest.	Windows Server 2012 R2 Windows Server 2012 Windows Server 2008 R2
Windows Server 2012	All of the features that are available at the Windows Server 2008 R2 forest functional level, but no additional features. All domains that are subsequently added to the forest will operate at the Windows Server 2012 domain functional level by default.	Windows Server 2012 R2 Windows Server 2012
Windows Server 2012 R2	All of the features that are available at the Windows Server 2012 forest functional level, but no additional features. All domains that are subsequently added to the forest will operate at the Windows Server 2012 R2 domain functional level by default.	Windows Server 2012 R2

 

Guidelines for raising domain and forest functional levels

The following guidelines apply to raising the domain or forest functional levels:

You must be a member of the Domain Admins group to raise the domain functional level.

You must be a member of the Enterprise Admins group to raise the forest functional level.

You can raise the domain functional level on the primary domain controller (PDC) emulator operations master only. The AD DS administrative tools that you use to raise the domain functional level (the Active Directory Domains and Trusts snap-in and the Active Directory Users and Computers snap-in) automatically target the PDC emulator when you raise the domain functional level.

You can raise the forest functional level on the schema operations master only. Active Directory Domains and Trusts automatically targets the schema operations master when you raise the forest functional level.

You can raise the functional level of a domain only if all domain controllers in the domain run the version or versions of Windows Server that the new functional level supports.

You can raise the functional level of a forest only if all domain controllers in the forest run the version or versions of Windows Server that the new functional level supports.

You cannot set the domain functional level to a value that is lower than the forest functional level, but you can set it to a value that is equal to or higher than the forest functional level.

With versions of Windows Server that are earlier than Windows Server 2008 R2, you cannot roll back or lower a functional level under any circumstances. If you have to revert to a lower functional level with a version of Windows Server that is earlier than Windows Server 2008 R2, you must rebuild the domain or forest or restore it from a backup copy.

After you set the domain functional level, you cannot roll back or lower the domain functional level except in the cases listed in the following table. The domain functional level can be lowered only by using Windows PowerShell.

Current domain functional level	Current forest functional level	Rollback options
Windows Server 2012 R2	Windows Server 2012 R2	None unless you first lower forest functional level
Windows Server 2012 R2	Windows Server 2012	Windows Server 2012
Windows Server 2012 R2	Windows Server 2008 R2	Windows Server 2012 or Windows Server 2008 R2
Windows Server 2012 R2	Windows Server 2008	Windows Server 2012, Windows Server 2008 R2, or Windows Server 2008
Windows Server 2012	Windows Server 2012	None unless you first lower forest functional level
Windows Server 2012	Windows Server 2008 R2	Windows Server 2008 R2
Windows Server 2012	Windows Server 2008	Windows Server 2008 R2 or Windows Server 2008
Windows Server 2008 R2	Windows Server 2008 R2	None unless you first lower forest functional level
Windows Server 2008 R2	Windows Server 2008	Windows Server 2008
Windows Server 2008 or lower	Windows Server 2008 or lower	None

After you set the forest functional level, you cannot roll back or lower the forest functional level except in the cases listed in the following table. The forest functional level can be lowered only by using Windows PowerShell.

 

Current forest functional level	Recycle Bin enabled?	Rollback options
Windows Server 2012 R2	Yes	Windows Server 2012 or Windows Server 2008 R2
Windows Server 2012 R2	No	Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2
Windows Server 2012	Yes	Windows Server 2008 R2
Windows Server 2012	No	Windows Server 2008 R2 or Windows Server 2008
Windows Server 2008 R2	Yes	None
Windows Server 2008 R2	No	Windows Server 2008

 

Source material: http://technet.microsoft.com/en-us/library/understanding-active-directory-functional-levels(v=ws.10).aspx

Remote GPUpdate on Windows Server 2012

 

You often need to run ‘gpupdate /force’ to ensure the latest policy is applied to systems. Now you can remotely run this command. This method creates a task through task scheduler. The task will execute within the next 10 minutes, which runs the ‘gpupdate /force’ locally on the machine.

This uses a remote connection, you will need the firewall rules enabled on clients.

• Remote Scheduled Tasks Management (RPC)
• Remote Scheduled Tasks Management (RPC-EPMAP)
• Windows Management Instrumentation (WMI-In)

There are two ways you can invoke a remote Group Policy update.

GPMC

From the GPMC, right click on an OU that contains computer objects. Click the “Group Policy Update” option.

This will run a ‘gpupdate /force’ on all computers in the OU, and any sub-OUs. Computer policy will be refreshed for each computer, and user policy will be refreshed for any and all users currently logged into those computers.

 

Powershell

The Invoke-gpupdate cmdlet is part of the Group Policy Powershell Module.

An example of the most basic use of invoke-gpupdate:

Invoke-gpupdate computername

The completion of this cmdlet will put a task on the computer that will execute a gpupdate /force

Want to run it on many in series?

$cn = Get-ADComputer -filter { name -like 'my*hyperv*' } | select -ExpandProperty dnshostname

$cn | % { Invoke-GPUpdate -Computer $_ }

To find the installed .NET Framework versions manually (versions 4.5 and later)

 

Open regedit.exe

Open the following key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full

Check for Release. Just having the Release key shows that the .NET Framework 4.5 or newer has been installed

The value of Release shows which version of the .NET Framework is installed

Value of the Release DWORD	Version
378389	.NET Framework 4.5
378675	.NET Framework 4.5.1 installed with Windows 8.1
378758	.NET Framework 4.5.1 installed on Windows 8, Windows 7 SP1, or Windows Vista SP2
379893	.NET Framework 4.5.2

Note: You need to reboot before the correct release is shown.

Migrating DHCP Scopes between Windows Servers

 

Need to move a DHCP database from a computer that is running Microsoft Windows Server 2003 right through to Microsoft Windows Server 2012 r2 update 1. Here is how…

 

The one-time export/import process

Export the DHCP database from Windows, On the Windows DHCP server, navigate to a command prompt, type the following commands:

netsh

DHCP

\\Name or IP Address

export c:\oldserver.txt all

Or in a single command: netsh dhcp server \\servername export c:\oldserver.txt all

Then to import the DHCP database onto another server. Copy the exported DHCP database file to the local hard disk of the Windows Server that you have installed the DHCP Role on the server.

Stop the DHCP server service on the server.

net stop DHCPserver

Delete the c:\windows\system32\DHCP\DHCP.mdb

net start DHCPserver

Open the cmd prompt using elevated privileges. Type the following Commands:

• netsh
• DHCP
• server \\Name or IP Address
• import c:\oldserver.txt all

To do the import in one command: netsh dhcp server \\servername import c:\oldserver.txt all

• Activate the server if needed then restart DHCP.
• You need to update all affected router DHCP relays.

 

Consolidating scopes onto one server

NOTE: split scopes cannot be consolidated from two servers and server options that conflict will fail to import.

To do this you need to just to the specific scopes. Type the following Command:

• netsh
• DHCP
• server \\Name or IP Address
• export c:\dhcp-scopename.txt scope-ip-range

In one command line: netsc dhcp server \\servername export c:\dhcp-scopename.txt scope-ip-range

Repeat for all affected scopes

To import: netsc dhcp server \\servername import c:\dhcp-scopename.txt

 

DHCP relay

If you have multiple physical networks connected through routers, and you do not have a DHCP server on each network segment, the routers must be capable of relaying DHCP traffic. If you do not have such routers, you can set up the DHCP Relay Agent component on at least one server in each routed subnet. The relay agent relays DHCP message traffic between the DHCP-enabled clients on a local physical network and a remote DHCP server located on another physical network.

 

Here is the original material: http://support.microsoft.com/kb/962355

Deleting orphaned Hyper-V disks from a server

 

I have a tame Powershell expert on hand, and the problem with Hyper-V is the standard GUI does not delete the disk when you delete a Virtual Machine, this can lead to a bunch of ophan VHD/VHDX files on the server. This script must be run on the server and will put out the VM drive path, the VMs that are on the server, the VHX/VHDX’s and will allow to see or delete them.

NOTE NOTE NOTE: This will delete valid snapshots… No I did not have any … Just a warning.

To view them run:

Delete-OphanedDisks.ps1 –whatif

To delete them run:

Delete-OphanedDisks.ps1

And follow the confirmation prompts.

PS: SCVMM does not have this problem. Cheers.

 

Script below, written by Peter Bertok

 

[CmdletBinding(ConfirmImpact='High',SupportsShouldProcess=$true)]

PARAM (

[switch]$Force,

[string[]]$Extensions = @( '*.vhdx', '*.vhd' )

)

BEGIN {

$disks = @( Get-VM | Get-VMHardDiskDrive | select -ExpandProperty Path )

$store = (Get-VMHost).VirtualHardDiskPath

If ( -not ( Test-Path $store ))

    {

Throw "Cannot find default VM disk path: $store"

    }

$List = @( $Extensions | `

ForEach-Object { dir -Path:$store -Filter $_ } | `

Select-Object -ExpandProperty FullName | `

Where-Object { $_ -notin $disks } | `

Select-Object -Unique )

If ( $Force )

    {

$List | del -Force:$Force -Confirm:$False -WhatIf:$False

    }   

Else #If ( $PSCmdlet.ShouldProcess( "$($List.Length) Files", "Delete" ))

    {

$List | del -Confirm:$ConfirmPreference

    }

}

Working with Server 2012 r2 Core

 

General

 

Changing computer name

Netdom renamecomputer %computername% /newname:w12r2DC1 /reboot

 

Join to a domain, ex “colv.in”:

Netdom join %computername% /domain:colv.in /userD:administrator passwordD:secret11

 

Configuring IP

SCONFIG.EXE is easier on Server Windows Server 2012 r2 but here is the old way.

netsh interface ipv4 show addresses

netsh interface ipv4 set address “eth” static 10.0.1.41 255.255.255.0 10.0.1.1

To set the DNS server on interface “eth” of 10.0.1.10 as primary and 10.0.1.15 as secondary:

netsh interface ipv4 set dnsservers “eth” static 10.0.1.10

netsh interface ipv4 add dnsservers “eth” 10.0.1.15 index=2

 

Enable remote desktop in the windows command prompt

cscript %windir%\system32\scregedit.wsf /ar 0

View remote desktop settings in the windows command prompt

cscript %windir%\system32\scregedit.wsf /ar /v

0=enabled 1=disabled

 

Restart Computer

shutdown /r /t 0

 

Server Core Vs Server GUI

 

Change from Server core to Full Windows UI

Install-WindowsFeature Server-Gui-Mgmt-Infra -source wim:d:\sources\install.wim:2

Install-WindowsFeature Server-Gui-Shell -source wim:d:\sources\install.wim:2

 

Windows Full to Minimal Server Interface

Uninstall-windowsfeature Server-Gui-Shell

Minimal Server Interface to core

Uninstall-windowsfeature Server-Gui-Mgmt-Infra

 

Full Windows GUI to server Core

Uninstall-WindowsFeature Server-Gui-Shell -source wim:d:\sources\install.wim:2

Uninstall-WindowsFeature Server-Gui-Mgmt-Infra -source wim:d:\sources\install.wim:2

 

Firewall

 

Get the status of all the firewall profiles:

netsh advfirewall show allprofiles

netsh advfirewall firewall show rule name=all profile=any

 

To get the status of firewall profiles

Get-NetFirewallProfiles

 

To see the firewall rules

Get-NetFirewallRule

 

To enable the appropriate firewall rules

Enable-NetFirewallRule -DisplayGroup "Remote Service Management"

Enable-NetFirewallRule -DisplayGroup "Remote Event Log Management"

Enable-NetFirewallRule -DisplayGroup "Remote Firewall Management"

Enable or Disable Windows Features Using DISM

 

Just like APT-GET but more Windows’ie…

Deployment Image Servicing and Management (DISM) is a command-line tool that is used to modify late model Windows Operating Systems (OS) or disk images. DISM can enable or disable Windows features directly from the command prompt.

To use it, open command with administrator privileges.

Use the /Get-ImageInfo to retrieve the index number for the image that you want to modify.

• Dism /Get-ImageInfo /ImageFile:D:\images\install.wim

Mount the Windows image

• Dism /Mount-Image /ImageFile:D:\images\install.wim /Name:"Windows Image" /MountDir:C:\test\Windoze

To find available Windows features in an image. List all of the features available in the operating system.

• Dism /online /Get-Features

To work with an image, specify the location of the mounted image directory.

• Dism /Image:C:\test\offline /Get-Features

Use /Get-FeatureInfo to list specific features

• Dism /online /Get-FeatureInfo /FeatureName:TFTP

To enable features

You can use the /All to enable all of the features in the one command.

• Dism /online /Enable-Feature /FeatureName:Telnet /All

To service an offline image, specify the location of the mounted image directory.

• Dism /Image:C:\test\Windoze /Enable-Feature /FeatureName:Telnet /All

To get the status of the feature you have enabled.

• Dism /online /Get-FeatureInfo /FeatureName:Telnet

If the status is Enable Pending, you must reboot the image in order to enable the feature entirely.

To restore removed features

If the files are not found in the default location, DISM will contact Windows Update (WU) for the required files. You can use the /LimitAccess argument to prevent DISM from contacting WU.

If you specify multiple /Source arguments, the files are gathered from the first location where they are found and the rest of the locations are ignored.

• Dism /Online /Enable-Feature /FeatureName:TFTP /Source:Z:\sources\SxS /Source:C:\test\mount\windows /LimitAccess

To service an offline image you need the mounted image directory.

• Dism /Image:C:\test\offline /Enable-Feature /FeatureName:Telnet /Source:C:\test\mount\windows

Optional: Get the status of the feature you have enabled.

• Dism /online /Get-FeatureInfo /FeatureName:Telnet

If the status is EnablePending, you must reboot enable the feature .

To disable Windows features

Disable a specific feature in the image.

• Dism /online /Disable-Feature /FeatureName:Telnet

To service an offline image, specify the location of the mounted image directory.

• Dism /Image:C:\test\offline /Disable-Feature /FeatureName:Telnet

Optional: Use DISM /GetFeatureInfo to get the status of the feature you have disabled.

• Dism /online /Get-FeatureInfo /FeatureName:Telnet

If the status is DisablePending, you must reboot the image in order to disable the feature

Hyper-V Server 2012 r2 verses WS2012r2 Standard or WS2012r2 DataCenter

 

“Microsoft Hyper-V Server 2012 (HYS) does not contain the full set of features and roles that the full Windows Server 2012 operating system has, however, from a pure Hyper-V perspective, Microsoft Hyper-V Server 2012 has feature parity with the feature set of Windows Server 2012 Hyper-V”. Hyper-V Server does not contain a GUI.

The ONLY Roles available on Hyper-V server 2012 R2:

• File and Storage Services
• File and iSCSI Services
• File Services
• Storage Services
• Hyper-V
• Remote Desktop

Hyper-V Server is a dedicated stand-alone product that contains the hypervisor. Hyper-V Server is ideal where no new Windows Server licenses are required or where the servers being consolidated are running an alternative OS.

You configure Hyper-V Server by using the Server Configuration tool (SCONFIG.CMD). You can use an ordinary command prompt for operations that are not available in the Server Configuration tool. This is the command reference: http://technet.microsoft.com/en-us/library/cc754340.aspx 

The TL;DR licence details:

• Hyper-V Server, Standard or Datacenter all support as many as you put on them.
• Standard comes with a license for 2 Windows Server VMs on up to 2 CPUs (on the same motherboard).
• Datacenter comes with a license for as many Windows Server guests as you can run on up to 2 CPUs (in the same motherboard). You buy more CPUs are required
• Hyper-V Server 2012 R2 has no cost for its own license. The guests OSs must still be licensed, exactly as stated in the previous paragraph. The guest licenses are not tied to what hypervisor you actually use.

Hyper-V server 2012 Enhanced Storage Capabilities:

• Virtual Fiber Channel – Enables virtual machines to integrate directly into Fiber Channel SAN (fiber channel-based Hyper-V Guest Clusters)
• Support for 4-KB Disk Sectors in Hyper-V Virtual Disks
• New VHD Format. VHDX
• Offloaded Data Transfer (ODX). Offload storage-related tasks to the SAN, increasing performance.
• Boot from USB Disk.
• Storage Spaces. treat SAS & SATA disks as storage pools, from which logical disks can then be provisioned. Thinly or fully provisioned, and support advanced features such as trim provisioning.

Enhanced Resource Management include:

• Dynamic Memory (great for VDI)
• Resource Metering provides the ability to track and report the amount of data that is transferred per virtual machine
• QoS specifying the minimum bandwidth that is available to a virtual machine or a port.
• Data Center Bridging (DCB) converged networking… Look this one up.

Hyper-V Extensible Switch:

• Private VLANS (PVLANS) - Provide isolation between two virtual machines on the same VLAN
• ARP/ND Poisoning/Spoofing
• DHCP Snooping/DHCP Guard - Protects against rogue DHCP servers
• Virtual Port ACLs - Isolate networks and metering network traffic for a virtual port
• Trunk Mode to Virtual Machines
• Monitoring & Port Mirroring
• Windows PowerShell/Windows Management Instrumentation (WMI)

Microsoft Hyper-V Server 2012 Clusters:

• Maximum Nodes per Cluster                      64
• VMs per Cluster                                        8,000
• Maximum Guest Cluster Size (iSCSI)         64 Nodes
• Maximum Guest Cluster Size (Fiber)          64 Nodes
• Maximum Guest Cluster Size (File Based)  64 Nodes
• Guest Clustering with Live Migration          Yes
• Guest Clustering with Dynamic Memory     Yes

Hyper-V Server has the following upper limits on virtual machines:

• Virtual machines with 64 virtual processors
• 1 TB of RAM per virtual machine
• 64 TB virtual hard disks by using the VHDX format.

 

http://download.microsoft.com/Documents/UseTerms/Hyper-V_Server%202012%20R2_English_adc2a6ba-32b4-4a69-ab8a-e09d3fd1f785.pdf 

http://download.microsoft.com/download/7%2F7%2F0%2F7707E736-4557-4310-9709-87358F7E6D1A/WindowsServer2012VirtualTech_VLBrief.pdf

http://download.microsoft.com/download/5/7/8/578E035F-A1A8-4774-B404-317A7ABCF751/Competitive-Advantages-of-Hyper-V-Server-2012-over-VMware-vSphere-Hypervisor.pdf