Antimail : Windows Server

Script recipe: How to increase the maximum number of quotas in the FSRM Quota Report (W2K3 R2)

AdiOltean — Sat, 19 Sep 2009 01:45:00 GMT

One of the customer requests we had on Windows Server 2003 R2 was the ability to increase the maximum number of quotas in the FSRM Quota report. The current limit is 1000 quotas maximum. How do I set this limit to 20,000 for example?

Here is how - assuming that you have Powershell 1.0 installed, just run this script:

$gm=New-Object -com Srmsvc.SrmGlobalStoreManager

$s=[xml]$gm.GetStoreData("Settings", "ReportSettings")

$s.Save("\fsrm-reports-backup.xml")

$s.root.MaxQuotas="20000"

$gm.SetStoreData("Settings", "ReportSettings",$s.get_InnerXml())

One note, however. The script above uses an COM object that is internally used by FSRM to store its internal configuration. Use this COM object as your own risk as this is not a published API.

FCI – how to use classification (video)

AdiOltean — Thu, 28 May 2009 23:23:31 GMT

Just found a new video demonstrating the new classification feature in Windows Server 2008 R2. Enjoy!

Special thanks to dawho1 who posted the video.

Script of the week: how to expire files with Classification

AdiOltean — Fri, 15 May 2009 21:06:00 GMT

It is an eye opening experience to sit at our FCI booth and see customer after customer telling us their biggest problem with managing file servers today: lots of old data sitting on their file servers. When I tell them how that our classification feature solves this problem, it something that always brings a sincere smile on their face.

Creating a file expiration policy is super easy:

Open FSRM management console
Go to the "File Management Tasks" view
Create a file management task to expire your files. You need to specify the following settings:
- The source directory of files to be expired
- The target directory (containing expired files)
- A condition for expiration (such as files created ten years ago (or files that were not modified in the last year)
- A schedule (say, weekly)

Here is an example of the Action tab:

That's it. One simple task to solve the "old files lying around" problem.

Now, a note to be added: the effect of this command will be the to move these expired files into the target location (while trying to keep the original path). One effect though is that the original files will "disappear" from the original location, which in rare cases it might cause confusion to the end users. If you are concerned about that problem, the solution is easy: as part of the file management task you can run your own custom "move" command which leaves in the original path a "stub" (a text file) explaining where the files have gone. Or, you can replace the original files with a symbolic link (or some other form of link) pointing to the target location.

To do this, you need to do a few things:

In the File Management Task dialog, in the Action tab, change the task type from "File expiration" to "Custom". Several more options appear (such as the path to the custom script, the account the script will run under, etc)
Add the [Source File path] macro to the script arguments
Run the command as "local system" (so it will be able to perform the move operation).

Here is an example of how the task will look like:

The move_file_and_leave_link.cmd (located in c:\windows\system32) file is simple:

if exist "c:\protected\%~pnx1" @echo Target file already exists! & goto :EOF
md "c:\HSM\%~p1"
move %1 "c:\protected\%~p1"
mklink %1 "c:\protected\%~pnx1"

The last command (mklink) has the role of creating a symbolic link from the source to the target. That’s it!

A simple way to access Shadow Copies in Vista

AdiOltean — Thu, 28 Feb 2008 21:37:18 GMT

In the past, I presented various ways to browse these mysterious device objects called "shadow copies". Shadow copies are static images in time (snapshots) of your volume contents, at some point in the past. These shadow copies are volumes on their own, with a file system namespace accessible through the regular Win32 APIs such as FindFirstFile/FindNextFile. For example the existing sample code in MSDN for these APIs that enumerates files on a real volume will work just fine on a shadow copy volume. In fact, that's how all backup applications are accessing shadow copy content today.

So, if these devices are real volumes, how can we view them in Explorer? It turns out that you can't view them by default - this is simply because these are volumes without an associated drive letter or root mount point. However, in XP or Windows Server (and Vista), you can still access these shadow copies by assigning them a drive letter using utilities like DOSDEV, or by doing tricks with the FOR command, etc.

Now, if you have Vista, it is much simpler to access shadow copy devices directly from Explorer. The trick is to use a new feature called Symbolic Links: to access the contents of a shadow copy as a "directory", simply create a symbolic link to the device. Vista also includes a convenient command-line tool called MKLINK.EXE to create symbolic links, which makes this operation very easy.

Here is an example of accessing the contents of a shadow copy device. The first step is to enumerate shadow copies on the machine, using the VSSADMIN LIST SHADOW command. This will give us the devices and also a creation timestamp.

C:\Windows\system32>vssadmin list shadows |more
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2005 Microsoft Corp.

Contents of shadow copy set ID: {c72c8036-d563-43c8-b351-1994dfad580a}
   Contained 1 shadow copies at creation time: 2/23/2008 9:59:04 AM
      Shadow Copy ID: {f3727808-bea6-4b59-bef7-6849ee721709}
         Original Volume: (C:)\\?\Volume{3e83355f-7c0e-11dc-b416-806e6f6e6963}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy4
         Originating Machine: Adi-Game-PC
         Service Machine: Adi-Game-PC
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: ClientAccessibleWriters
         Attributes: Persistent, Client-accessible, No auto release, Differential, Auto recovered

Contents of shadow copy set ID: {0bf23f77-8461-4869-b391-da4d213940a5}
   Contained 1 shadow copies at creation time: 2/24/2008 4:00:24 AM
      Shadow Copy ID: {87d59b22-9e84-4d0d-81ca-2b565d6f7e55}
         Original Volume: (C:)\\?\Volume{3e83355f-7c0e-11dc-b416-806e6f6e6963}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy5
         Originating Machine: Adi-Game-PC
         Service Machine: Adi-Game-PC
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: ClientAccessibleWriters
         Attributes: Persistent, Client-accessible, No auto release, Differential, Auto recovered

C:\Windows\system32>mklink /d c:\shadowcopy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy5\
symbolic link created for c:\shadowcopy <<===>> \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy5\

C:\Windows\system32>dir c:\shadowcopy
Volume in drive C has no label.
Volume Serial Number is 4A02-860C

Directory of c:\shadowcopy

12/14/2007 01:46 AM    <DIR>          Asi
01/15/2008 12:56 AM    <DIR>          bin
12/13/2007 11:59 PM    <DIR>          debuggers
12/13/2007 11:55 PM        17,644,031 dir.log
01/14/2008 11:41 PM    <DIR>          Downloads
01/01/2008 05:50 PM    <DIR>          dumps
12/30/2007 11:43 PM    <DIR>          garbage
01/08/2008 11:13 PM    <DIR>          Garmin
10/15/2007 09:03 PM    <DIR>          Intel
12/30/2007 11:59 PM    <DIR>          Program Files
01/27/2008 01:32 AM    <DIR>          Program Files (x86)
01/15/2008 12:17 AM    <DIR>          test
01/30/2008 06:52 AM    <DIR>          Users
12/14/2007 01:55 AM    <DIR>          WinDDK
02/13/2008 05:23 AM    <DIR>          Windows
02/21/2008 10:43 PM    <DIR>          Work
               1 File(s)     17,644,031 bytes
              15 Dir(s) 147,657,666,560 bytes free

That's it. Now I have a persistent link called c:\shadowcopy which points to the contents of the shadow copy device - which is the image of my C:\ drive at 4:00 AM (this is when my latest system restore point was created).

A new notes,though:

1) Make sure you use the "/D" option in MKLINK so you create a directory-based, not a file-based symbolic link

2) Make sure you append a backslash to the shadow copy device in the MKLINK command (marked in red above)

If this made you interested about shadow copies - note that you can create, enumerate and delete shadow copies programatically using either VB scripts that use the WMI API for shadow copy administration, or by using the VSS API (documented publicly on MSDN). Sample code is available in the Platform SDK as well.

[RO] Seminar - Storage si programare distribuita

AdiOltean — Thu, 03 May 2007 20:57:00 GMT

Florin Lazar, Todi Pruteanu si cu mine am demarat in cursul acestei saptamani un seminar tehnic pe teme de storage in Vista si programare distribuita in WCF. Mai multe detalii aici: http://reg.studentclub.ro.

Pana acum seminariile din Bucuresti si Cluj au avut un raspuns fantastic! Daca aveti opinii, impresii (pozitive sau negative) m-as bucura sa le puneti in sectiunea de comentarii...

Si nu in ultimul rand, multumiri lui Todi si Microsoft Romania pentru organizarea acestui eveniment.

Windows Home Server - links

AdiOltean — Fri, 16 Mar 2007 01:43:27 GMT

A friend of mine didn't know about Windows Home Server - so I sent him these links:

- Main site: http://stopdigitalamnesia.com

- Interview with Charlie Kindel http://channel9.msdn.com/ShowPost.aspx?PostID=270965

- Download: https://connect.microsoft.com/site/sitehome.aspx?wa=wsignin1.0&siteid=38

- Articol on Wikipedia: http://en.wikipedia.org/wiki/Windows_Home_Server

- Blog: http://blogs.technet.com/homeserver

- Press release: http://www.microsoft.com/Presspass/press/2007/jan07/01-08WindowsHomeServerPR.mspx

Demo: New virtualization technologies in Windows Server (Longhorn)

AdiOltean — Fri, 02 Mar 2007 23:32:16 GMT

A nice demo that shows you several things:

- Windows Server virtualization (a separate partition running a striped-down version of Windows to manage all other virtual machines)

- Running an 8-proc virtual machine

- 64-bit and 32-bit machines running concurrently

- Managing virtual machines with System Center (nice UI)

- System Center Operations Manager: monitoring the VMs, provisioning new hardware in a scriptable manner.

Video: Longhorn - Windows Server Virtualization

The next generation of storage management is here!

AdiOltean — Thu, 07 Dec 2006 08:45:00 GMT

Storage management is complex, we all know it. For many people, even the simplest opeartions in a SAN look like black magic. It's no wonder why - if you want to, say, create a brand new 5 TB file share using your brand new your SAN box: you need to create a new LUN in your SAN, mounting it on a machine, initialize the disk, create partitions, assigning drive letters, create the file shares and assign proper permissions, etc.

The new Windows product launched today solves this problem. WUDSS offers simple, easy-to use wizards, for the complex operations above, plus of course, the famous Finish button. It's that simple!

And, yes, as you could guess, the main theme is simplifying and integrating all storage management scenarios (at least for file servers) in a single management UI:

- A new out-of-the-box experience (OOBE) that allows you to "initialize" your brand new shiny storage box with a few mouse clicks.

- Combined file, print and block-level storage services in a single management interface

- Easy remote management through a single HTTP URL

- New cluster configuration wizard that vastly simplifies provisioning and creation of shared disk resources.

The product will ship on Dell's new PowerVault NX 1950 hardware initially, and other OEMs will incorporate it in other NAS boxes.

P.S. WUDSS stands for Windows Unified Data Storage Server 2003 - a long name, in our established Microsoft tradition :-)

Gartner redesigns Windows Vista

AdiOltean — Sat, 26 Aug 2006 23:55:47 GMT

There is an article in Techworld.com mentioning a curious research report from Gartner implying a redesign of the Windows Vista code base, around virtualization. Huh? To quote from the article:

Instead, the research firm predicts, Microsoft will be forced to migrate Windows to a modular architecture tied together through hardware-supported virtualisation. "The current, integrated architecture of Microsoft Windows is unsustainable - for enterprises and for Microsoft," wrote Gartner analysts Brian Gammage, Michael Silver and David Mitchell Smith.

The problem is that the operating system's increasing complexity is making it ever more difficult for enterprises to implement migrations, and impossible for Microsoft to release regular updates. This, in turn, stands in the way of Microsoft's efforts to push companies to subscription licensing.

There is a basic confusion going on here about architectural choices vs. release frequency.

On the last point (release frequency), Microsoft is committed to not repeat the mistake of delaying a Windows version that much (or any other Windows version) and instead, impose a sense of predictable rythm in releasing incremental, predictable and evolutionary improvements in future versions of Windows. Gaining this sense of rythm can be done even with an extremely complex code base such as Windows, and the proof is the predictable, stable releases of Windows Server versions already exist: Windows 2000 (beginning of 2000), then Windows Server 2003 RTM (april 2003), then Windows Server 2003 R2 (RTM November 2005).

That said, if we are talking about Operating Systems in general, the architectural idea of achieving modularity through virtualization is a very interesting idea. I would like to point out to a cool research project called Singularity which achieves exactly that goal. If you want to see how operating systems will look like, say, 20 years from now, you can start with Singularity. One note, though: Singularity achieves isolation through pure software mechanisms. Hardware protection (like Hypervisor support from the AMD processors) is also possible to be used in conjunction with software isolation, although this is not a direct goal of the Singularity project.

WS-Management? Already here in Vista!

AdiOltean — Sat, 19 Aug 2006 08:19:00 GMT

WS-Management is a new web services-based management protocol. It's SOAP-based of course, and it is compatible with the rest of the specifications in the WS-* Web Service stack, like WS-Transfer, WS-Enumeration, WS-Addressing.

WS-Management is enabled in Vista (and Longhorn Server) in several ways.

On the client side, you have a standard library (called WinRM) which can "consume" other WS-Management enabled interfaces. You could also use Indigo, or other web service frameworks to access the same services as well. Finally, there is a command-line tool also named WINRM which can be used to communicate with WS-Management enabled servers.
On the server side, any WMI class can be made remotely accessible through WS-Management.

Security

WS-Management is securely enabled on Vista machines. To find out the security configuration of your machine (both for client and server) you can use WS-Management itself like in the command below:

C:\>winrm get winrm/config
Config
    MaxEnvelopeSizekb = 150
    MaxTimeoutms = 60000
    MaxBatchItems = 20
    MaxProviderRequests = 25
    Client
        NetworkDelayms = 5000
        URLPrefix = wsman
        AllowUnencrypted = false
        Auth
            Basic = false
            Digest = true
            Kerberos = true
            Negotiate = true
        DefaultPorts
            HTTP = 80
            HTTPS = 443
        TrustedHosts
    Service
        RootSDDL = O:NSG:BAD:P(A;;GA;;;BA)(A;;GR;;;ER)S:P(AU;FA;GA;;;WD)(AU;SA;GWGX;;;WD)
        MaxConcurrentOperations = 100
        EnumerationTimeoutms = 60000
        MaxConnections = 5
        AllowUnencrypted = false
        Auth
            Basic = false
            Kerberos = true
            Negotiate = true
        DefaultPorts
            HTTP = 80
            HTTPS = 443
        IPv4Filter = *
        IPv6Filter = *
    Winrs
        AllowRemoteShellAccess = true
        IdleTimeout = 900000
        MaxConcurrentUsers = 5
        MaxShellRunTime = 28800000
        MaxProcessesPerShell = 5
        MaxMemoryPerShellMB = 80
        MaxShellsPerUser = 2

By default, WS-Management is not enabled for remote access, Windows authentication is used by default on local acceess, and encryption is turned on.

You can enable remote access by typing:

C:\>winrm quickconfig
WinRM is not set up to allow remote access to this machine for management.
The following changes must be made:

Set the WinRM service type to delayed auto start.
Start the WinRM service.
Create a WinRM listener on HTTP://* to accept WS-Man requests to any IP on this machine.
Enable the WinRM firewall exception.

Make these changes [y/n]? y

WinRM has been updated for remote management.

WinRM service type changed successfully.
WinRM service started.
Created a WinRM listener on HTTP://* to accept WS-Man requests to any IP on this machine.
WinRM firewall exception enabled.

The output above already illustrates one main advantages of web services - their flexibility with respect to firewall access. Say that you want to enable your current machine to accept incoming WS-Management SOAP requests through the port 80 (as HTTP requests). Then, all you need to do is opening port 80 and that's it! Also, NAT is not a problem, of course.

Try this type of exercise when enabling DCOM through the firewall, and you'll have nightmares. This can get really complicated. Furthermore, DCOM doesn't really work in NAT environments.

A simple example

At this point, you have a secure web service enabled on your machine, that you can then use to perform regular management queries, in WMI style. Let's get some information about a Windows service, like the status of the Spooler service.

Note that I am doing a remote query - basically contacting the machine AOLTEAN-D2, through an internal, WS-Management web service interface:

C:\>winrm get wmicimv2/Win32_Service?Name=spooler -r:aoltean-d2
Win32_Service
    AcceptPause = false
    AcceptStop = true
    Caption = Print Spooler
    CheckPoint = 0
    CreationClassName = Win32_Service
    Description = Loads files to memory for later printing
    DesktopInteract = true
    DisplayName = Print Spooler
    ErrorControl = Normal
    ExitCode = 0
    InstallDate = null
    Name = spooler
    PathName = C:\Windows\System32\spoolsv.exe
    ProcessId = 1472
    ServiceSpecificExitCode = 0
    ServiceType = Own Process
    Started = true
    StartMode = Auto
    StartName = LocalSystem
    State = Running
    Status = OK
    SystemCreationClassName = Win32_ComputerSystem
    SystemName = AOLTEAN-D2
    TagId = 0
    WaitHint = 0

Well, it looks like the spooler service is started. We can perform even more complicated queries, such as this one, to find the list of stopped services which are supposed to be started:

C:\trace>winrm enumerate wmicimv2/* -filter:"select * from win32_service where StartMode=\"Auto\" and State = \"Stopped\" " -r:aoltean-d2

XmlFragment
    Win32_Service
        AcceptPause = false
        AcceptStop = false
        Caption = Media Center Service Launcher
        CheckPoint = 0
        CreationClassName = Win32_Service
        Description = Starts Media Center Scheduler and Media Center Receiver services at startup if TV is enabled within Media Center.
        DesktopInteract = false
        DisplayName = Media Center Service Launcher
        ErrorControl = Ignore
        ExitCode = 0
        InstallDate = null
        Name = ehstart
        PathName = C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
        ProcessId = 0
        ServiceSpecificExitCode = 0
        ServiceType = Share Process
        Started = false
        StartMode = Auto
        StartName = NT AUTHORITY\LocalService
        State = Stopped
        Status = OK
        SystemCreationClassName = Win32_ComputerSystem
        SystemName = AOLTEAN-D2
        TagId = 0
        WaitHint = 0

So, where does WS-Management comes into play? At its roots, WS-Management is a simple management protocol that allows us to operate with resources. WS-Management defines a few operations on these resources:

Get resource properties - this is used by the "winrm get ..." command above. We can see that we interrogate here a resoure (the "spooler" Windows service) and we obtain various properties like PathName, Started, etc.
Enumerate resources - this is a more complex command that allows us to enumerate several resources at once
Set properties on a resource
Create or delete resources
Execute methods on a resource, just like WMI methods.

In some sense, resources can be viewed as "objects" in OOP point of view, and WS-Management defines a simple protocol to manipulate these "objects".

Under the hood

So where do web services come into play? Can we peek into the actual management protocol?

With web services, it is actually easy - all we need to do is to use a network protocol analyzer to sniff the HTTP packets between client and the server. Ultimately, web service interactions are nothing more than exchanging XML packets using HTTP/HTTPS, so analyzing these interactions is no more difficult than analyzing HTTP request/response commands between a browser and a web server.

Let's take the GET command above (winrm get wmicimv2/Win32_Service?Name=spooler -r:aoltean-d2). In our case, the client program attempts to get the properties of a given resource of type "wmicimv2/Win32_Service", identified by the selector "Name=spooler".

Let's dive in. With the network sniffer we obtain the following SOAP request message:

<s:Envelope
xmlns:s="http://www.w3.org/2003/05/soap-envelope"
xmlns:a="http://schemas.xmlsoap.org/ws/2004/08/addressing"
xmlns:w="http://schemas.dmtf.org/wbem/wsman/1/wsman.xsd">
<s:Header>
    <a:To>http://aoltean-d2:80/wsman</a:To>
    <w:ResourceURI s:mustUnderstand="true">http://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2/Win32_Service</w:ResourceURI>
    <a:ReplyTo>
      <a:Address s:mustUnderstand="true">http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous</a:Address>
    </a:ReplyTo>
    <a:Action s:mustUnderstand="true">http://schemas.xmlsoap.org/ws/2004/09/transfer/Get</a:Action>
    <w:MaxEnvelopeSize s:mustUnderstand="true">153600</w:MaxEnvelopeSize>
    <a:MessageID>uuid:2A553640-AA45-4BE1-8CE8-C3F20BD3C74E</a:MessageID>
    <w:Locale xml:lang="en-US" s:mustUnderstand="false" />
    <w:SelectorSet>
      <w:Selector Name="Name">spooler</w:Selector>
    </w:SelectorSet>
    <w:OperationTimeout>PT60.000S</w:OperationTimeout>
</s:Header>
<s:Body></s:Body>
</s:Envelope>

Correspondingly, the WS-Man response packet looks like this:

<s:Envelope xml:lang="en-US" xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://schemas.xmlsoap.org/ws/2004/08/addressing" xmlns:w="http://schemas.dmtf.org/wbem/wsman/1/wsman.xsd">
<s:Header>
    <a:Action >http://schemas.xmlsoap.org/ws/2004/09/transfer/GetResponse</a:Action>
    <a:MessageID >uuid:3E0BE062-2615-497E-BE6A-2FC7D5B7C9C3</a:MessageID>
    <a:To>http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous</a:To>
    <a:RelatesTo >uuid:2A553640-AA45-4BE1-8CE8-C3F20BD3C74E</a:RelatesTo>
</s:Header>
<s:Body>
    <p:Win32_Service xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:p="http://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2/Win32_Service" xmlns:cim="http://schemas.dmtf.org/wbem/wsman/1/base" xsi:type="Win32_Service">
      <p:AcceptPause>false</p:AcceptPause>
      <p:AcceptStop>true</p:AcceptStop>
      <p:Caption>Print Spooler</p:Caption>
      <p:CheckPoint>0</p:CheckPoint>
      <p:CreationClassName>Win32_Service</p:CreationClassName>
      <p:Description>Loads files to memory for later printing</p:Description>
      <p:DesktopInteract>true</p:DesktopInteract>
      <p:DisplayName>Print Spooler</p:DisplayName>
      <p:ErrorControl>Normal</p:ErrorControl>
      <p:ExitCode>0</p:ExitCode>
      <p:InstallDate xsi:nil="true"/>
      <p:Name>spooler</p:Name>
      <p:PathName>C:\Windows\System32\spoolsv.exe</p:PathName>
      <p:ProcessId>1596</p:ProcessId>
      <p:ServiceSpecificExitCode>0</p:ServiceSpecificExitCode>
      <p:ServiceType>Own Process</p:ServiceType>
      <p:Started>true</p:Started>
      <p:StartMode>Auto</p:StartMode>
      <p:StartName>LocalSystem</p:StartName>
      <p:State>Running</p:State>
      <p:Status>OK</p:Status>
      <p:SystemCreationClassName>Win32_ComputerSystem</p:SystemCreationClassName>
      <p:SystemName>AOLTEAN-D2</p:SystemName>
      <p:TagId>0</p:TagId>
      <p:WaitHint>0</p:WaitHint>
    </p:Win32_Service>
</s:Body>
</s:Envelope>

That's it for now. I hope that in a future post I will cover the actual structure of WS-Management messages.

Time Machine: Vista Previous Versions are now making their way into Mac OS X Leopard...

AdiOltean — Mon, 07 Aug 2006 23:25:00 GMT

Mac OS X Leopard incorporates now a previous versions feature called Time Machine - similar with something that we added in Windows Server 2003 a while back, and recently in Windows Vista as well.

If you just read the text at http://www.apple.com/macosx/leopard/timemachine.html it looks a lot with what Vista already offers as well - automatic backup of your whole system at night, ability to use an external drive for your backups (Vista can also backup to a DVD-RW), ability to restore any file by going back in time, etc.

However, their UI is very interesting - it is a Flip3D-like browser of previous versions of your file system.

P.S. Time Machine? Funny enough - when we designed the Previous Versions feature in Windows Server 2003 back in 2001, the code name of our product was Timewarp.

The Previous Versions feature in Vista - an ArsTechnica review

AdiOltean — Mon, 31 Jul 2006 22:30:00 GMT

ArsTechnica noticed our new Previous Versions feature in Vista. Give it a click:

http://arstechnica.com/news.ars/post/20060730-7383.html

Why Flash memory is good for your computer

AdiOltean — Wed, 05 Jul 2006 12:17:00 GMT

Simply put, flash memory will enable a revolution in improving computer performance in daily utilization scenarios. Your computer will boot up faster. It will launch applications significantly faster. (Hey, it will shutdown faster as well.)

The problem

To see why we will have this dramatic performance improvement, let's remember how harddisks work: whenever you have a mixture of random I/O requests, the actuator moves across different tracks to read/write the corresponding data. Switching tracks is a slow operation. For an average SATA drive, this is around 9 milliseconds. This might not seem much, but a few milliseconds per seek means that you can have at most a few hundred random I/Os per second. And this feels like light-years compared with the performance of other components in the system like RAM access speeds or even CPU frequency. So, just to give you an example, a random I/O with 4 KB requests and average of 4 ms seek time per request would mean around 1000/4 * 4 KB = 1 MB per second disk transfer rate. Pretty small, don't you think? Especially when you compare it with sequential I/O, where you can get a much faster transfer rate (say, 60-70 MB/s on a regular harddisk, depending the rotational speed, data density, etc).

One trick to alleviate this performance issue is to minimize seek time by reordering writes and/or serving reads from cached memory. Memory caches can greatly help in this regard, but here is a little problem: applications, the OS, and other components do not expect writes to be reordered. When you a write reordering is detected at the application level, then a data corruption can appear, especially when you reboot the machine in the middle of performingg a set of reordered writes.

For example the applicaiton is performing Write(block1) followed by Write(block2) in one thread, and Read(block1) followed by Read(block2) on a different thread. In the sequence above, the application expects block1 to be written always before writing block2. Having this guarantee simplifies for example applicaiton recovery semantics, assuming that the computer can crash between writing block1 and block2. But if we perform write reordering, and only write to the disk block2, then our application recovery logic cannot be done in any way. And so we get to corruption.

Still, storage controllers perform today all sorts of tricks like maintaining a write-through cache in volatile RAM, coupled with limited reordering. More advanced controllers, or SAN equipment use persistent caches (battery-backed volatile RAM) to perform write reordering, complementing advanced storage features like RAID configurations, etc.

The solution - why flash is good

By now it should be clear how flash can be used in this picture: you can use inexpensive flash as a persistent write-through cache for reads/writes. Also, the fact that this flash is persistent enables reordering I/O requests at an unprecedented level, therefore greatly reducing our nasty seek time bottleneck:

The new 2Gb OneNAND chip doubles the capacity of a OneNAND memory device (from 1Gb) and increases the chip's ‘write' speed from 9.3MByte to 17MByte per second.

”We're seeing a rapidly widening market for our OneNAND memory because of its outstanding performance and capacity that has become even more noteworthy with the application of 60 nm technology,” said Don Barnetson, Director, Flash Marketing, Samsung Semiconductor. [...]

Because of its exceptionally high performance, OneNAND can serve as a catalyst in the development of new product markets. A much-discussed example of this application-creating role is in how OneNAND memory is now being specified as the buffer memory inside a hybrid hard disk.

Samsung successfully demonstrated a commercial Hybrid-HDD prototype for the first time at the MS Developer Conference (WinHEC: Windows Hardware Engineering conference) in Seattle last month.

[source: http://www.physorg.com/news70899414.html]

Flash-based I/O optimizations - already present in Vista

One more thing worth mentioning: Vista already benefits from Flash-based optimization. The feature is called EMD (External Memory Device), and can boost the performance of your computer by simply adding a USB thumbdrive and designate it as an EMD device. Under the cover, it works in a similar way with the technique described above.

Passwords: Bad "best practices"

AdiOltean — Tue, 25 Apr 2006 09:17:00 GMT

So, you think that your password is secure? Let's see: does it contain a mixture of uppercase/lowercase letters, punctuation marks and digits? Yes? Well, even in this case, your password might be still completely insecure. Read ahead why...

To understand the problem, we need first a little rehash of the basic password cracking techniques. The simplest algorithm would be to simply (1) enumerate all English words and names from a given dictionary and (2) check to see if this word matches as your password.

You might say - but in this context we are talking about other characters like punctuation marks and digits that are part of the password. What would an attacker do in this case? Simple - use a little psychology.

The problem is that most people feel that adding digits and other characters is just a burden. When the "password will expire today" dialog comes, they will be in a hurry to get a new password, maybe an easy-to-remember word, and then alter it in a few ways:
1) First, the password needs to have a capital letter. Most people will naturally choose the first letter from our English word to be capitalized. So, a word like "flowers" becomes "Flowers".
2) Second, the password needs to contain some digits. The password would look nicer (and easier to remember) when these digits are appended to the word. Even more, people are usually unimaginative here, and just append one digit, or in more complex cases, digit sequences like "123" or "01" or eventually their birthdate.
3) Third, we need some non-alphanumeric characters. Well, let's see. If we replace an "s" with "$", "a" with "@" or "o" with zero, then we get what we want, right? It is hard to resist the tentation to replace "s" with "$" at least (and not an "a" with "$"), and therefore getting a false sense of security. In some cases also using delimiter characters like "!" or "#" to separate the word from the digit sequence.

So, with the example above, the altered forms of the word "flowers" might be: "Fl0wer$" or "Flower$01" or "Fl0wers#123" and so on and so forth.

The problem with these alteration rules is that they are so predictable. All the attacker has to do is to take the same list of English words, and apply the rules above. He will probably get a longer list by, say a factor of 10-100 which is not that much.

In conclusion, it's not that hard to enter into the minds of regular people, and neither in the minds of attackers. So, if you used any of these rules above, then stop using them. Instead, here are some rules to create strong passwords.

P.S. As for me? I just uuidgen.exe to create a random sequence of digits.

How to run Defrag on a scheduled basis

AdiOltean — Fri, 07 Apr 2006 10:18:00 GMT

On Windows XP, it's simple. Just run this command and you are done:

schtasks /create /TN defrag /RU "NT AUTHORITY\SYSTEM" /SC weekly /TR "defrag %systemdrive%"