For The Developers! : Windows Server 2008

Windows Server 2008 App Compat Labs Released

jolson — Wed, 30 Apr 2008 01:20:26 GMT

The first four labs in a series of Windows Server 2008 Application Compatibility labs have been released on MSDN. You can find them as follows:

- MSDN Virtual Lab: Windows Server 2008 - Access Rights, Impersonation

- MSDN Virtual Lab: Windows Server 2008 - Impact of Code Signing

- MSDN Virtual Lab: Windows Server 2008 - Installer Detection

- MSDN Virtual Lab: Windows Server 2008 - Session 0 Isolation

There will be more labs in the coming weeks. Stay tuned and enjoy!

New App Compat Video - Debugging

jolson — Wed, 30 Jan 2008 00:43:02 GMT

A new video has been posted to the Developer Meet Server Show on Channel 9. In this video, we discuss tools and resources you should know about when debugging application compatibility issues. From the description of the video:

"In this video, we sit down (well, stand up actually) with Chris Jackson and Gov Maharaj to chat about debugging application compatibility issues (and some of the things Microsoft has done to mitigate typical app compat issues we've run into)."

Enjoy!

WS08 Feature of the Week #14 - Sub-queues in MSMQ 4.0

jolson — Wed, 30 Jan 2008 00:19:03 GMT

What are sub-queues? Subqueues are implicitly created local queues that are logical partitions of a physical queue. Applications can use subqueues to group messages. Subqueues are implicitly created when opened, are deleted when empty, and have no open handles. Messages cannot be sent to a subqueue. Messages can be received from subqueues, moved between the main queue and its subqueue, or moved between a pair of sibling subqueues.

Subqueues do not have their own properties or state, but share the properties and state of their parent queue. For example, a subqueue does not have its own quota, access control list (ACL), or transactional type. Subqueues share the quota of the main queues. Messages in the subqueues consume the quota of the main queue. Subqueues cannot be created under journal and other system queues, or other subqueues. If journaling is enabled, copies of messages that are removed from a subqueue are sent to the journal queue of the main queue.

So why sub-queues? MSMQ-based applications often require messages to be grouped based on some criteria. Previously, the only way to do this was to create several queues and when a message arrived in the main queue, move the message into a specific queue based on some selection criteria.

Here’s the thing: moving messages between physical queues is a resource-intensive process. If you are wanting to build a high performance application, it is best to try to avoid this resource-intensive process. But if you were building an application based on MSMQ 3.0, this was not very feasible. Now, the new sub-queues feature enables you to logically group messages within a single queue without the need of creating another physical queue.

- MSDN Documentation

- WCF Examples

New App Compat Video - MSI Installer Issues

jolson — Fri, 18 Jan 2008 22:32:58 GMT

I have posted a new video to the Developer Meet Server Show on Channel 9. This video discusses common MSI Installer Issues you might run into if deploying an application onto Windows Vista or Windows Server 2008. From the description of the video:

"In this video, we chat with Robert Flaming about application compatibility issues around Windows Installer for Windows Vista and Windows Server 2008. Mark Taylor, from our first Application Compatibility video, sits in as well to fire off some important questions (well, questions that are perhaps more educated than I would ask)."

Enjoy!

WS08 Feature of the Week #13 - Windows Process Activation Service (WAS)

jolson — Fri, 18 Jan 2008 22:11:57 GMT

What is Windows Process Activation Service? Windows Process Activation Service, also referred to as WAS, is a new component in IIS 7.0 that manages application pool configuration and worker processes instead of the WWW process. This enables the same configuration for both HTTP and non-HTTP sites to be used. Thanks to this separation (and in combination with the new modular architecture of IIS 7.0), you can even host non-HTTP sites without the WWW Service even being installed in the first place.

How does Windows Process Activation Service work? Taken directly from the documentation:

“The WAS process model generalizes the IIS 6.0 process model for the HTTP server by removing the dependency on HTTP. This allows WCF services to use both HTTP and non-HTTP protocols, such as Net.TCP, in a hosting environment that supports message-based activation and offers the ability to host a large number of applications on a given machine."

What scenarios does this enable? Since WAS is not specific to HTTP sites, you can use WAS to host non-HTTP sites as well. But what do we mean by “non-HTTP sites?” Well, simply put, WAS can be used to host sites built on technologies like Windows Communication Foundation, for example. If you are using WCF with WAS, are you limited to listening over HTTP? Not at all. In fact, that is the beauty and power of WAS. You can be hosting a WCF service within WAS that is using a netTcpBinding, netMsmqBinding, etc. As an extension to this, since WAS supports both HTTP and non-HTTP sites, this also means that you can be hosting a service that exposes itself over both HTTP and NET.TCP as well.

An actually funny video about Windows Server

jolson — Sat, 12 Jan 2008 01:52:24 GMT

Well, at least I found it funny. A coworker brought this to my attention today. I thought it was pretty clever and enjoyed it. Then again, I've known for a while how great Windows Server 2008 is :). Here's an excerpt:

Once I was almost famous. For years, my friends and I were on the front lines: we were the Windows Server 2003 servers that powered Microsoft.com, one of the hottest Web sites in the world. Then, early last summer, everything changed. Quietly, without warning, the new kids took over. Windows Server 2008. Yes, I know, the product’s not even done yet. These were Beta 3 servers, for Pete’s sake. Long way from prime time. But there they were, humming away. No problems. All of ‘em on Windows Server 2008. Except me. The last Windows Server 2003 left at Microsoft.com.

Enjoy!

WS08 Feature Of The Week #12 - IIS7 Administration API

jolson — Fri, 11 Jan 2008 23:28:39 GMT

Hello everyone, and welcome back after our winter break hiatus. We have a lot of cool features to cover in the coming weeks that will especially show off the power of Windows Server 2008 as an application server. So, this week we will kick off the new year by taking a short little peek at the new management API coming in IIS7.

What is new in IIS7 Administration? IIS7 provides a comprehensive managed-code API that allows complete manipulation of the XML configuration files and convenience access to server objects. IIS7 includes Microsoft.Web.Administration, which is a new management API for the web server that enables editing configuration through complete manipulation of the XML configuration files and also provides convenience objects to manage the server, its properties and state. The configuration editing aspect of the API provides programmatic access to read and write configuration properties in the IIS configuration file hierarchy and specific configuration files. The object management aspect of this API provides a series of top-level administration objects for direct management of the server (i.e. sites, application pools, worker processes, etc.).

The management classes reside in the Microsoft.Web.Administration namespace. The classes provide a weakly-typed interface to access configuration sections and convenience objects with properties and methods representing attributes of the configuration (like the path of a virtual directory) or actions to take on the object (like recycling an application pool).

Resources

How To Use Microsoft.Web.Administration

Video - App Compat and Windows Server 2008

jolson — Fri, 11 Jan 2008 23:10:30 GMT

As part of the "Developer Meet Server" show on Channel 9, I have started a new series of videos on the topic of application compatibility for Windows Server 2008. I will be releasing one video interview per week all the way until launch, so make sure to keep an eye open!

in this first video, we discuss a bunch of topics in this video that are very pertinent to the topic of Application Compatibility on Windows Server 2008, from Session 0 Isolation to IIS 7 to Mandatory Integrity Control, among many others (I will give any of you five geek points if you can work in "Session 0 Isolation" or "Mandatory Integrity Control" into your next dinner party conversation!).

So, make sure to go check it out.

The launch of marshal-as.net

jolson — Fri, 23 Nov 2007 02:03:05 GMT

In my previous post, I talked about why I personally love C++/CLI as a solution for managed and native interop. With the launch of Visual Studio 2008, and the include of the new marshalling library, there is on part of the equation missing, I believe. On the C# side of the interop equation, you have http://www.pinvoke.net. When I'm wanting to interop with a given Windows API, there is a very (very) good chance that the wrappers have already been posted onto pinvoke.net.

While the marshal_as<> construct of the marshalling library in VC++ 2008 is quite extensible through the use of templates, there is no community site for me to go to in order to retrieve an existing piece of the interop puzzle. That is, until now.

With the help of Kate Gregory, there is now a new website for those C++/CLI users out there: http://www.marshal-as.net. If that link doesn't work for you, give it a day or two as this is a new website and DNS is still propagating for it.

I have already sent Kate a couple of samples that I had done for my own interop work with Visual C++ 2008 (have I mentioned yet how easy my life is now that I'm using C++/CLI in Visual C++ 2008?). You should pop over and check it out. If you have your own samples that you want to submit, feel free to use the contact form (the email icon) at the website and email your sample to the website.

Enjoy!

What's Mandatory Integrity Control?

jolson — Tue, 13 Nov 2007 02:00:37 GMT

Mandatory Integrity Control (MIC) is a cool new security feature built in to Windows Vista and Windows Server 2008. It adds another "layer" of security to Windows resources (files, processes, etc.) over the usual DACL (Discretionary Access Control Lists) that we have in Windows XP and Windows Server 2003.

Essentially, Mandatory Integrity Control adds an "Integrity Level" to resources present in the Windows operating system. There are four possible integrity levels. They are (from most privileged to least privileged): System IL, High IL, Medium IL, and Low IL. System Services run at System IL, Administrative Processes run at High IL, and all resources in Windows with an explicitly set integrity level exist at Medium IL by default. When one resource wants access to another resource, the first resource's integrity level must be greater than or equal to the integrity level of the requested resource. This integrity level check takes place before we even check the DACLs on each resource.

Processes, for instance, can access files that have an integrity level lower than or equal to their own integrity level. So let's say I have Notepad running under my own local account (not an administrative account). By default, Notepad.exe is launched with an integrity level of Medium. As long as I am trying to write to a file that has an integrity level of Medium or below, then the operation will success just fine.

However, if I have a file that is sitting there with an integrity level of High, the write operation from Notepad will fail because Notepad doesn't have the proper integrity rights to access and to write to that resource.

Let's go ahead and take a look at this in action (you can work through this "demo" if you are currently running Windows Vista or Windows Server 2008).

Demo

You _must_ be running Vista and Windows Server 2008 for this demo to work

1) Launch Notepad

2) Enter some text and save the file as “test.txt” on your desktop. Now we have a text file with the default Medium IL.

3) Launch a command prompt as Administrator (from the shortcut, right click and choose “Run As Administrator”)

4) Navigate to your desktop (“cd C:\Users\USER_NAME\Desktop” in the command line for a default Vista installation).

5) Issue this command to set the created file’s integrity level to a High IL: “icacls test.txt /setintegritylevel H”. Now that the file has a high integrity level a default notepad process won’t be able to save the file.

6) Launch Notepad again (make sure it isn’t launched as Administrator since Administrator permissions will make it have an integrity level of High, voiding this experiment).

7) Open test.txt from your desktop

8) Change the file and try to save it. Notepad will fail while trying to save (Notepad gives a “user-friendly” error, but the underlying error is actually “Access Is Denies”).

There you have it, Mandatory Integrity Control in action! However, that's not the end to the story!

Did You Know? Internet Explorer “Protected Mode” actually uses Mandatory Integrity Levels under the hood to achieve its goals. Since IE Protected Mode runs with a low integrity level, and all files on the file system (and running processes) are a medium integrity level by default, an attempt to write to those files or processes fails.

Tech Ed Developer (Europe)

jolson — Mon, 05 Nov 2007 14:03:07 GMT

Howdy all, I will be at Tech Ed Developer this week doing several things. First of all, I will be giving two talks: the first on Application Compatibility in Windows Server 2008 outlining the top issues developers need to be aware of when developing for it, and second, a talk on Transactional NTFS as it pertains to Windows Server 2008.

Also, I will be "manning" the Ask The Experts booth for Windows Server 2008. So if you want to chat about Windows Server 2008 (or just say hello), make sure to drop on by (I will have the hours I plan on working the booth posted there at the booth).

Here's a rundown:

Monday, 3pm - [INF203] WS08 For Developers - App Compat, Tent 1
Thursday, 4:30pm - [INF307] WS08 For Developers - Transactional NTFS

I'm also hoping to attend some sessions myself. These will mostly be around C++ (TLA323, TLA302, TLA404, etc.).

So, if you're going to be at the conference, please, drop on by the Ask The Experts booth for Windows Server 2008 and say hello!

New Works With Windows Server 2008 Program

jolson — Wed, 01 Aug 2007 00:10:00 GMT

There is a new kid on the block around our Logo program with Windows Server. What is that? With the release of Windows Server 2008, we will be introducing a new "Works With" program. What is the "Works With Windows Server 2008 Program"?

The "Works With Windows Server 2008 Program" is a program that helps highlight and promote applications that are compatible with Windows Server 2008. The program requirements are actually a subset of the requirements for the "Certified For Windows Server 2008" program. This helps provide a better "stepping stone" for ISVs that are interested in delivering high quality applications for the Windows Server platform.

To get started, check out http://www.innovateonwindowsserver.com/OverviewBenefits.aspx. In the coming weeks, Microsoft will be releasing an analyzer tool for the Works With program that will help you discover application compatibility issues you may face when ensuring your application works with Windows Server 2008.

So make sure to keep an eye out on Innovate On for coming announcements (and I will continue to make this information available to you directly on this blog, of course). Stay tuned!

Listing Running Transactions In A Resource Manager

jolson — Fri, 20 Jul 2007 00:34:00 GMT

The more I work with TxF, the more I realize that our (Microsoft's) coverage of certain KTM topics is sorely lacking. One of those areas is around documentation and samples of managing resource managers (important if you are wanting to investigate programatically the running status of a resource manager).

Sometimes, being an evangelist can be quite fun (or frustrating) because the documentation leaves something to be desired and you can't run to the internet because the only results you get back or to the documentation on MSDN. And of course, since you're on the cutting searching for the control codes online provides you with two results, both pointing back to MSDN. It becomes doubly "interesting" if you are a managed developer because a large number of management-oriented information for KTM is all done through DeviceIoControl (an API that is NOT fun to try to P/Invoke into, especially using certain control codes).

Anyways, that's all beside the point... moving right along.

If you are writing an application to monitor TxF (or even building it into your own application), there are some core "things" that you need to do. One of the first ones (and the one I will cover in this post) is to get a list of transactions in a given resource manager. This is done using the FSCTL_TXFS_LIST_TRANSACTIONS control code.

What structure is DeviceIoControl passing back to us in this instance? A TXFS_LIST_TRANSACTIONS structure. Looking at this structure, we see two fields: NumberOfTransactions and BufferSizeRequired.
That's nice and all, but where is the information about those transactions? The information is stored in a TXFS_LIST_TRANSACTIONS_ENTRY structure.

The trick is that the TXFS_LIST_TRANSACTIONS_ENTRY structure is mentioned nowhere in the documentation for FSCTL_TXFS_LIST_TRANSACTIONS. So how do you get to it? An array of TXFS_LIST_TRANSACTIONS_ENTRY structures are stored in memory after your TXFS_LIST_TRANSACTIONS structure. So assuming you have two running transactions in the given resource manager, you would pass in a pointer to the TXFS_LIST_TRANSACTIONS structure, and here is what the memory would actually look like coming back from DeviceIoControl:

The impact of this is that you need to allocate enough memory for not only your TXFS_LIST_TRANSACTIONS structure, but the array of TXFS_LIST_TRANSACTIONS_ENTRY structures as well. You might notice a little bit of a "chicken and egg" problem here. If I'm using FSCTL_TXFS_LIST_TRANSACTIONS to retrieve the transactions, how could I know how many entry structures to allocate when I don't know how many transactions there are yet?

Well, assuming there are one or more running transactions in the resource manager, you have to call DeviceIoControl with FSCTL_TXFS_LIST_TRANSACTIONS at least twice: once to find out how big of a buffer you need to allocate (read: to calculate how many ENTRY structures to accomodate for), and then another time after allocating the extra memory to have it fill the actual ENTRY structures.

Why do I say "at least" twice? Because, between the time we make our first call and the time we make our second call, more transactions could have appeared and we will have to allocate even more memory. A little bit of a "cat and mouse game," I must say.

If you are a managed developer, this may sound a bit scary. Don't be scared though, it's not too bad (and I know I at least have fun writing this kind of lower-level code :P).

So let's dive right in and look at the code to make this work!

In pseudo-code, this is what we have to do:

------------------------
while (true)
{
// Deallocate memory from last loop through this

// Allocate memory for transaction list buffer

// Call DeviceIoControl with FSCTL_TXFS_LIST_TRANSACTIONS

// If DeviceIoControl Succeeded

// Get list of transaction entries after TXFS_LIST_TRANSACTIONS structure
}

// Deallocate any remaining memory
------------------------

Not that bad really. So here it is implemented in native code:

#include 
#include 
#include 
#include "Winioctl.h"

int _tmain(int argc, LPTSTR argv)
{
    DWORD lastError, bytesReturned;
    HANDLE rmDirectory;
    TXFS_LIST_TRANSACTIONS *txList = NULL;

    // Get handle to directory where resource manager resides
    rmDirectory = CreateFile(TEXT("C:\\"), 
        GENERIC_READ,
        FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
        NULL,
        OPEN_EXISTING,
        FILE_FLAG_BACKUP_SEMANTICS,
        NULL);

    if (rmDirectory != INVALID_HANDLE_VALUE)
    {
        // Get a list of transactions within the given
        // resource manager
        DWORD neededBufferSize = sizeof(TXFS_LIST_TRANSACTIONS);
        while (true)
        {
            // Deallocate previously allocated memory if we are back
            // here after getting back ERROR_MORE_DATA
            if (NULL != txList)
            {
                delete[] (char*)txList;
                txList = NULL;
            }

            // Get the list of running transactions in the RM
            txList = (TXFS_LIST_TRANSACTIONS*)new char[neededBufferSize];
            if (!DeviceIoControl(rmDirectory,
                FSCTL_TXFS_LIST_TRANSACTIONS,
                NULL,
                0,
                txList,
                neededBufferSize,
                &bytesReturned,
                NULL))
            {
                // How did we fail?
                lastError = GetLastError();
                if (lastError == ERROR_MORE_DATA)
                {
                    // We need to enlarge the buffer and try again
                    neededBufferSize = txList->BufferSizeRequired;
                    continue;
                }
                else
                {
                    _tprintf(TEXT("Unhandled exception: %u\n"), lastError);
                    break;
                }
            }
            else
            {
                _tprintf(TEXT("Transaction Count: %u\n\n"), txList->NumberOfTransactions);

                // List Tx details
                TXFS_LIST_TRANSACTIONS_ENTRY *txEntry;
                txEntry = (TXFS_LIST_TRANSACTIONS_ENTRY *)((char *)txList 
                        + sizeof(TXFS_LIST_TRANSACTIONS));
                for (DWORD i = 0; i < txList->NumberOfTransactions; i++)
                {
                    txEntry++;

                    // Get GUID string
                    WCHAR szGuid[40];
                    StringFromGUID2(txEntry->TransactionId, (WCHAR *)&szGuid, 40);

                    // Print Tx info
                    _tprintf(TEXT("TX %s: %u\n"), 
                        szGuid,
                        txEntry->TransactionState);
                }

                break;
            }
        }

        // Any memory left to deallocate?
        if (NULL != txList)
        {
            delete[] (char*)txList;
            txList = NULL;
        }
    }
    else
    {
        _tprintf(TEXT("Unable to get valid handle to Resource Manager\n"));
        return 1;
    }

    _tprintf(TEXT("\nPress any key to exit...\n"));
    getchar();

    return 0;
}

And that's how you do it. It's not the most fun getting in to DeviceIoControl (unless you're a geek like me and enjoying this kind of stuff), but hopefully with this post out there to help it will be easier to find out how to do this since there is a lack of documentation around this area.

In closing, there is some work that needs to be done around making management of kernel-level transactions a lot easier than it is now. In some ways, it is pretty clear that this is still a "1.0" technology. So while you could use the KTM directly for your transaction coordination, I would highly recommend sticking with using DTC for your transaction coordination as it is much more mature from a management perspective (and there are quite a few enhancements with DTC in Vista and Windows Server 2008).

Windows Server 2008 Developer Training Kit

jolson — Fri, 20 Jul 2007 00:03:51 GMT

James Conard announces over on his blog that our team has just released the Windows Server 2008 Developer Training Kit for Beta 3. Mosey on over and check it out. You can find resources on everything from WCF, to Cardspace, to WF, to Windows Eventing, to PowerShell, to IIS 7, to Transactional NTFS.

So if you are a developer interested in checking out Windows Server 2008, make sure to grab it.

Windows Server "Longhorn" - Beta 3 Has Arrived!

jolson — Thu, 26 Apr 2007 04:08:32 GMT

Well, it's official. Beta 3 of Windows Server "Longhorn" has launched. With it, I finally get to release some of the work I've been working on lately.

If you are a developer, I encourage to take a look at "The Top Ways To Light Up Your Apps On Windows Server 'Longhorn'" that was just launched today. It outlines key ways that you, the developer, can leverage all the new and improved enhancements to the Server platform to really make your applications shine in a whole new light.

I encourage any of you with access to Beta 3 to try it out. Windows Server "Longhorn" is quickly shaping up to be the best Server release from Microsoft ever.