P2V for KVM

Some resources I plan on using when trying to P2V a Windows Vista laptop to use on either RHEL or CentOS KVM.

• How to convert vmware vdk image to kvm
• Windows XP p2v conversion with KVM

Right now, the best solution looks to be to convert the physical box to a VM using VMWare vCenter Converter

I haven't ruled out using Xen, but my initial research indicates this may be easier to do on KVM then Xen. KVM appears to be more similar to Solaris Containers, whereas Xen uses paravirtualization. I've had limited experience with Xen, and no experience with KVM, so this should be a good learning exercise. Here's some more resources for reference:

• Xen vs KVM
• Xen vs KVM and KVM Migration
  

Managing Windows Bitlocker Drive Encryption (BDE)

A quick and easy way to manage Windows Bitlocker Drive Encryption (BDE).

C:\Users\user>manage-bde.wsf -help

Microsoft (R) Windows Script Host Version 5.7
Copyright (C) Microsoft Corporation. All rights reserved.

manage-bde[.wsf] -parameter [arguments]

Description:
Configures BitLocker Drive Encryption on disk volumes.

Parameter List:
-status Provides information about BitLocker-capable volumes.
-on Encrypts the volume and turns BitLocker protection on.
-off Decrypts the volume and turns BitLocker protection off.
-pause Pauses encryption or decryption.
-resume Resumes encryption or decryption.
-lock Prevents access to BitLocker-encrypted data.
-unlock Allows access to BitLocker-encrypted data.
-autounlock Manages automatic unlocking of data volumes.
-protectors Manages protection methods for the encryption key.
-tpm Configures the computer's Trusted Platform Module (TPM).
-ForceRecovery or -fr
Forces a BitLocker-protected OS to recover on restarts.
-ComputerName or -cn
Runs on another computer. Examples: "ComputerX", "127.0.0.1"
-? or /? Displays brief help. Example: "-ParameterSet -?"
-Help or -h Displays complete help. Example: "-ParameterSet -h"

Examples:
manage-bde -status
manage-bde -on C: -RecoveryPassword -RecoveryKey F:\
manage-bde -unlock E: -RecoveryKey F:\84E151C1...7A62067A512.bek

Making it much easier to image and P2V a machine. This will come in handy when I P2V Windows to run on virtualized hardware, so I can finally make the switch to all open source OS (read: Linux)!

Deploying an EXE patch using GPO

Recently at my client site, we needed to push a Microsoft Patch that we couldn't push using our update solution. The ideal solution would be to wrap the executable up into an MSI and just push the MSI using a GPO. After trying this using a 3rd party MSI wrapper utility, we created an MSI and pushed it to all workstations, where the wrapper itself installed, but the executable failed to run. In the interest of time, we needed to engineer a solution quickly to push our patch to ensure that users would be able to continue to access certain resources within our infrastructure. I know that you can create a Setup package by using Visual Studio .NET (another tutorial here), but we didn't have the time to sit down and hammer out a solution and test it.

Instead, I suggested that we push the executable using a GPO and simple VB script. The trick is we'd have to build into the script a way to check to make sure the executable hasn't already been installed- otherwise every computer getting the GPO will run the executable every time it boots (something we don't want). After a bit of Googling, I wrote the following VB script, which does the following:

# Pseudo Code
Check if a reg key exists
If the reg key does not exist, execute the executable installer with switches to make it a passive installer
Once the executable complete, create a registry key marking that the install has completed

'Reg key to create. Doesn't have to be this key, but since this is technically a patch, put it in Windows Update
sRegKey="HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate"
sExePath = "\\path\to\executable"
sSwitches = "/passive /warnrestart:45" 'Check available flags on Executable for options here

' Suppress error in case values do not exist
On Error Resume Next

' Check for the Reg Key Marker
sRegMarkerValue = "" ' initial value
sRegMarkerValue = oShell.RegRead( sRegKey & "\WindowsXP-KBXXXXX-x86-ENU.exe")
On Error Goto 0

' To ensure update is only installed once, test the reg key marker
If sRegMarkerValue <> "yes" then

'Run the executable with switches
oShell.Run Chr(34) & sExePath & Chr(34) & " " & sSwitches, 1, True

' Create the Reg Key marker
oShell.RegWrite sRegKey & "\WindowsXP-KBXXXXX-x86-ENU.exe", "yes"
End If

After applying the GPO, we rebooted all of the workstations, and our patch was successfully applied!

Windows Batch Scripting and Win2k8 AD GPO Functionality

Created this script and saved it as a .bat file to loop through values stored in a comma-delimited file to reboot specific machines:

FOR /F %%A IN (filename.csv) DO (
ECHO. %%A >> result.txt %1
shutdown -m \\%%A -r -f -t 10 -c "Your workstation will reboot in 10 seconds for scheduled maintenance" >>result.txt %1
)

And some cool functionality that you can do using GPOs in AD 2008:

• Set/Change Local User Passwords on all workstations in the domain
• Map network drives without using vb scripts/batch files
• Map printers without using vb scripts/batch files
• Disable USB storage devices using REG keys
• Disable specific hardware devices (CDROM drives, imaging devices, etc)
  

RedHat Certified Technician

I am officially a RedHat Certified Technician! Although I'm not gaining any experience in RedHat on my current project, I managed to get RedHat training approved by my firm, and took the RH133 course last week. The course was great- I learned a good deal of administration tips and tricks and it really helped fill in some crucial voids in my Linux repertoire.

I'm hoping to continue on the Red Hat path to obtain my RHCE in the next year, hopefully in October if possible. Admittedly, Gentoo still holds a special place in my heart, but in terms of usability and enterprise server-grade Linux, Red Hat has gained a lot of points in my book, particularly with its implementation yum and system configuration tools.

The class also inspired me to take a closer look at Xen and KVM virtualization. I'm hoping to P2V my Windows 7 box at home, and instead use RHEL (or CentOS) as a hypervisor and run Windows 7 as a VM.

RH courses I'm hoping to attend (and gain certification in) in the coming months include:

• RH253 - Red Hat Linux Network and Security Administration
• RH318 - Red Hat Virtualization Administration

Fast Forward 8 Months

So again, I have criminally lapsed in my posts on this blog. Since that September post, I left my previous job at the University of Georgia, had a nice 2-week backpacking trip through Europe away from computers and familiar faces, and returned in mid October to begin work for the man a large technology consulting firm, based out of the Atlanta office.

I'm currently on a 6-month 10-month project for a federal government client, spending 4-5 days of the week in the greater DC area, working as, to my dismay, a "Windows Desktop Engineer." I've been able to grab a few server tasks on the side, and the role has afforded me some valuable experience with Windows Server 2008 and Active Directory, however I find myself a good distance away from where my true interests lie: Linux servers and virtualization technologies.

At work, I've learned a good bit about GPO authoring, Active Directory 2008 configuration and management, Ghost Suite 2.5, Windows Server 2008 implementation of DHCP and DNS, enterprise-level IT, and the nature of consulting.

In what little time I have at home every few weekends (I tend to spend weekends in different cities or staying in DC), I've been playing around with Windows Server 2008 and Active Directory architecture in a virtual environment. Since leaving UGA, I had to forfeit my VMWare Workstation license, and thus have been learning to use Sun's VirtualBox. Aside from the networking, I've found that many of the standard features are comparable to VMWare Workstation.

In the coming weeks, I hope to have the opportunity to play around with Xen virtualization and KVM in Linux. More on that later!

Mounting ISOs in Windows 7

One feature that I was hoping Windows 7 would have (as Linux has had it since I can remember) is the built-in ability to mount ISOs... but alas, again Microsoft disappoints. To add insult to injury, neither Daemon Tools nor PowerISO work reliably in Windows 7. Windows XP SP3 broke Daemon Tools (something with sptd-SCSI Pass Thru Direct), and PowerISO installs on Windows 7 only unreliably, apparently determined by the particular workstation's hardware- here at work my coworkers who use Dell 740s have no problem, but the install always fails on my Dell GX620.

So what's the solution? Pismo File Mount. And it may be better than PowerISO or Daemon Tools anyways. It allows much more granular control of the mounted ISO, such as mounting for the owner only and establishing access (rw,r) for other users. It also allows you to mount ISO where they are, as opposed to a virtual disk, allowing quicker and better Windows explorer integration.