Virtual PC Guy's WebLog

Restricting Shared Drives under Windows Virtual PC

Virtual PC Guy — Thu, 05 Nov 2009 04:53:15 GMT

When it comes to minimizing the potential for malicious software running in a virtual machine to affect your physical computer, there are two golden rules to follow:

Secure the virtual machine just like you would a physical computer. This means installing antivirus / anti-malware software, configuring firewalls, regularly installing updates, etc…
Reduce the potential paths for the virtual machine to access your physical computer.

In the latter category there are three common paths:

Standard networking. Here the risk is no greater (or lesser) than if you had a separate computer connected to the same network.
Clipboard sharing. When integration components are enabled, any data that is put into the virtual machines clipboard is automatically copied to the physical computers clipboard (and vice versa). The potential for risk here is relatively low – but if it is a concern for you – you can easily disable this feature under the virtual machine settings.
Shared Drives. Shared drives allow the virtual machine to access the drives of the physical computer – without needing a network connection to be present. This functionality is critical for most people who use Virtual PC – but it is also an obvious path for malicious software to get to data on the physical computer from inside the virtual machine. As such I would like to spend some time talking about how to restrict this functionality appropriately.

The first thing to know is that you can configure drive sharing so that only specific drives are shared:

You should always make sure that this setting is configured appropriately for your environment.

But what if you do not want to share and entire drive? What if you just want to share a single folder?

Well, I have found a handy method to do just this. It is a little cheesy, but it allows you to drastically reduce the surface area that is exposed. Basically – what you need to do is to create the folder that you want to share, open a command prompt, and run the following command:

subst j: c:\MySharedFolder

This creates a “virtual” drive that points to the folder you created (in this case I am mapping “C:\MySharedFolder” to J: – but obviously you can use any drive letter or folder that you want to use). You can then map this drive into the virtual machine:

Cheers,
Ben

Virtual Machine Migration Test Wizard

Virtual PC Guy — Tue, 03 Nov 2009 20:12:46 GMT

I little while ago some member of the Hyper-V test team released a new tool on code.msdn.microsoft.com. It is the Virtual Machine Migration Test Wizard:

http://code.msdn.microsoft.com/VMMTestWizard

In Windows Server 2008 R2 we introduced a new “Processor Compatibility” feature (as discussed here). The primary purpose of this new tool is to allow you to determine if you need to enable this feature in your environment to be able to move virtual machines.

You can also use this tool to determine how physical computers should be grouped – if you want to avoid turning this feature on.

There is also a video available from the author of this Tool – Dinesh – where he talks about how it works and demonstrates it running here.

Cheers,
Ben

Understanding (and troubleshooting) Auto-Publishing in Windows Virtual PC

Virtual PC Guy — Wed, 28 Oct 2009 17:57:00 GMT

One of the cool features of Windows Virtual PC is how applications that are installed into Windows XP, Windows Vista and Windows 7 virtual machines automatically appear in the start menu on the host operating system – and can be launched directly without first needing to open the virtual machine in question:

These shortcuts get created through a process that we call Auto-Publishing. What happens is that we monitor the guest operating system while it is running, and when we detect that a new application has been installed, we create a shortcut for the application in the host start menu.

Most of the time this “just works”. When it does not work there are a couple of areas that you can look:

Does the guest operating system support auto-publishing?

Auto-publishing is only supported for virtual machines running Windows XP SP3, Windows Vista SP1 (or later) or Windows 7. Windows 7 virtual machines are ready to go when it comes to auto-publishing. But Windows XP and Windows Vista virtual machines need to have an extra update installed in them in order for auto-publishing to work. You can download the Windows XP update here and the Windows Vista update here.

No matter which guest operating system you are running you will also need to ensure that the Windows Virtual PC Integration Components have been installed, and that integration features are enabled.
Is auto-publishing enabled?

Auto-publishing is enabled by default, but we allow you to turn it off if you want to. It is always worth double-checking this option in the virtual machine settings, to make sure you have not disabled it accidentally:
Was a shortcut for the application created in the “All Users” start menu in the guest operating system?

Windows Virtual PC detects that an application has been installed in the virtual machine by looking for shortcuts that have been created in the All Users start menu. If the application installer did not create a shortcut in the start menu, or created one in the local user start menu, Windows Virtual PC will not auto-publish the application. You can check this by looking in the All Users start menu in the guest operating system. Here are the locations to check under each guest operating system:

Windows XP: %SystemDrive%\Documents and Settings\All Users\Start Menu\Programs
Windows Vista: %SystemDrive%\ProgramData\Microsoft\Windows\Start Menu\Programs
Windows 7: %SystemDrive%\ProgramData\Microsoft\Windows\Start Menu\Programs

If you cannot find a shortcut in these locations – create one there and you should be good to go.
Is the application being blocked by policy settings?

In order to stop a blank Windows virtual machine from spamming your start menu with a bunch of shortcuts when you first bring it up – we block a bunch of applications by default. The list of blocked applications is stored in the registry inside the virtual machine at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Virtual Machine\VPCVAppExcludeList. You can go here to check to see if the application you are trying to get published is on this list:

If it is, you can delete the registry key for that application, and it should appear in the host start menu.

Cheers,
Ben

Installing Virtual CD Software in a Virtual Machine

Virtual PC Guy — Tue, 27 Oct 2009 17:19:00 GMT

Like many Hyper-V users, I have created ISO images of most of my CDs / DVDs (and in the case of my MSDN software – have downloaded in ISO format to begin with). I then have these images stored on a file server.

It is possible to connect a CD ISO image on a file server to a Hyper-V virtual machine, as long as you are working in a domain environment and you are running the Hyper-V management user interface directly on the Hyper-V server.

If you run the Hyper-V management user interface on a remote computer, you will need to enable constrained delegation in order to use ISO images on a network share. If you are running in a workgroup environment your only option is to enable anonymous access to the file share that holds your ISO images (obviously not a good idea from a security point of view).

Aside: The reason for these conditions is that Hyper-V requires the use of both your personal user credentials and the Hyper-V servers workstation credentials when connecting an ISO image to the virtual machine.

Your user credentials are used to verify that you personally have permission to use the ISO image in question. The use of your user credentials is why constrained delegation needs to be enable for remote management to work.

The Hyper-V server workstation credentials are used to ensure that we can start the virtual machine, and connect the ISO image to the virtual machine, even when you are not logged into the server (for example, if the server needs to be rebooted). Unfortunately workstation credentials only work in domain environments – so workgroup environments need to enable anonymous access.

As I am using Windows Home Server for my file server – which does not support being joined to a domain – setting up a share with anonymous access was the only option for me. But I found this idea so abhorrent that I would make local copies of ISO files as I needed them instead.

Needless to say I was far from happy with this arrangement.

Furthermore, as I often use Remote Desktop to connect directly to the guest operating system in my virtual machines, I have found it irritating to need to switch back to the Hyper-V management user interface solely for the purpose of connecting a new ISO image.

Luckily I have found a simple and elegant solution to both of these problems.

What I have done is to install Virtual CD software inside each of my virtual machines. This allows me to use ISO images that are stored on my Windows Home Server, and I can connect CD ISO images even when I am connected using Remote desktop. For my virtual machines I am using Alcohol 52%, but other programs to look at for this include Virtual CloneDrive and DAEMON Tools.

This solution will not work for installing operating systems (but I these days I tend to use Windows Deployment Services for that – so that is not an issue for me) but it works for everything you could think of once the operating system is up and running.

Cheers,
Ben

Deploying Windows XP Mode

Virtual PC Guy — Mon, 26 Oct 2009 16:23:00 GMT

We have recently published a very handy video / guide / set of scripts to help with anyone who needs to deploy either a standard or customized version of Windows XP mode to a large number of virtual machines.

The first thing to look at is the deployment video – available here:

http://www.microsoft.com/downloads/details.aspx?FamilyID=f0ef9c63-2d2d-4f18-be39-57f8e794fe07

Then you can go and grab the associated white paper / scripts from here:

http://www.microsoft.com/downloads/details.aspx?FamilyID=9f142a1a-a7b7-4d0b-bd56-d9627f39c14f

This will give you the necessary tools to do such things as:

Automate installation of Windows XP Mode
Customize Windows XP Mode for your environment
Build your own template Windows XP virtual machine for deployment in your own environment

Good stuff.

Cheers,
Ben

Windows Virtual PC / Windows XP Mode RTM now available for general download

Virtual PC Guy — Thu, 22 Oct 2009 07:29:41 GMT

Go and get it:

http://www.microsoft.com/windows/virtual-pc/download.aspx

Cheers,
Ben

Setting up Hyper-V with a UPS

Virtual PC Guy — Thu, 22 Oct 2009 07:16:23 GMT

People have asked me how you go about setting up a UPS (Uninterruptable Power Supply) with Hyper-V. This is much easier than it sounds. The first thing to understand is that when you shut down the physical computer, the virtual machines will be automatically put into a saved state. Virtual machines that were running when the server shuts down will be started automatically when the physical computer starts back up.

This all means that – for the most part – things “just work” when you connect a UPS and configure the management operating system like you would for a stand alone computer.

Depending on your environment – there are some configuration changes that you may want to make:

Changing the automatic stop action

As I mentioned, Hyper-V will save state any running virtual machines when the physical computer shuts down. Depending on how much memory is assigned to the virtual machine, and the software installed inside the virtual machine, you may prefer to have the virtual machine shut down instead. I have gone with this option on my server at home:
Changing the automatic start action

Only virtual machines that were running when the system was shut down will be started automatically. If you are paranoid, like me, you can go in and configure essential virtual machines to always start automatically – even if they were not running when the physical system was shut down:

You can also configure start up delays, to ensure that more important virtual machines are started first.
Setting aside enough time for system shut down

This one is critical. It can take a while for Hyper-V to shutdown as we are trying to save state / shut down a bunch of virtual machines. For this reason you need to ensure that your system starts shutting down with enough battery life left in order to make it through the whole shut down process.

My personal UPS story:

You would not believe, but living in north Redmond the power quality around here is lousy. I often get strange power surges / flickers – and have to deal with half a dozen black-outs of one hour or more each year. Needless to say I have lost a bunch of hardware over the years as a result of this.

A while ago I went out and bought a nice beefy UPS to protect my Hyper-V server and all of my networking gear. To start with I just hooked up the power and confirmed that I could run for about 30 minutes before running out of power. I connected the USB monitoring cable, but did not setup any monitoring software, for a couple of reasons:

I got an APC UPS. I love these guys for their hardware – I hate them for their software. For that matter, I do not know of any UPS provider where I would be happy to install their monitoring software on my servers.
I am lazy.

Recently, when I was performing some hardware maintenance on in my Hyper-V server I decided to go and have a look in the device manager to see what Windows thought about my UPS. Much to my surprise I saw that Windows had detected the presence of a UPS battery with no intervention from me:

Once I noticed this I decided to have a look around – and I discovered that Windows had enabled standard power support – and was acting like my server was essentially a really big clunky laptop. I had a battery icon in the task bar that accurately reflected the amount of charge in my battery, and when I disconnected power from the UPS – Windows immediately knew about it.

Next I opened the power policy settings and configured my system to get a low battery alert when the battery was at 75% charged, and to shut down when the battery reached 50% charged:

I have since tested this – and everything works perfectly – all with no need for anything other than the “in-box” capabilities of Windows Server 2008 R2. Neat!

Cheers,
Ben

Hotfix needed to move R2 differencing disk to Windows Server 2008

Virtual PC Guy — Sat, 17 Oct 2009 00:26:52 GMT

A virtualization MVP recently bought this to my attention:

In Windows Server 2008 R2 there was a minor change to the format of differencing virtual hard disks. As a result you will need to apply an update to Windows Server 2008 if you want to move differencing disks from Windows Server 2008 R2 to Windows Server 2008.

You can download this update from here:

http://support.microsoft.com/kb/971677

Note that this applies to Windows Server 2008 and Windows Server 2008 SP2 (not to Windows Server 2008 R2). If you do not have this update installed and you try to use a differencing disk created with Windows Server 2008 R2 you will receive an error message that states that the virtual hard disk is corrupted or unreadable.

Cheers,
Ben

Hyper-V Hotfix for "0x00000101 - CLOCK_WATCHDOG_TIMEOUT" on Nehalem systems

Virtual PC Guy — Fri, 16 Oct 2009 18:20:52 GMT

We have just released a new hotfix for Windows Server 2008 R2 that address the issue that users were getting a bluescreen of death on Intel Xeon 5500 series processor-based computers with the following text:

0x00000101 (parameter1, 0000000000000000, parameter3, 000000000000000c)CLOCK_WATCHDOG_TIMEOUT

You can download the hotfix from here: http://support.microsoft.com/kb/975530

For the curious, this issue is actually caused by a bug (or in Intel terms “erratum”) that causes these processors to generate spurious interrupts. You can read about this in the latest Intel documentation for this process series: http://www.intel.com/assets/pdf/specupdate/321324.pdf

Cheers,
Ben

Why is F12 not working with my virtual machine?!?!

Virtual PC Guy — Wed, 14 Oct 2009 23:09:18 GMT

Here is a problem that I hear about at least 2 or 3 times a month:

Someone is trying to do a network installation of an operating system using either Hyper-V or Virtual PC, they setup the virtual machine appropriately, but when they try to press “F12” to initiate network installation – nothing happens.

Every time I get asked about this – the answer is simple:

If your keyboard has a “Function Lock”, “F Lock” or “Fn” key – make sure it is pressed prior to trying to use the F12 key.

Cheers,
Ben

Hyper-V Management + Delegated Administration + SCVMM

Virtual PC Guy — Tue, 13 Oct 2009 17:29:00 GMT

A while ago I blogged about how to allow non-administrators to control Hyper-V. You do this by editing the Hyper-V authorization store. What I failed to mention at that time was that this method does not work if you are using SCVMM to manage your Hyper-V servers.

When you start using SCVMM to manage a Hyper-V server, SCVMM creates their own authorization store to be used by Hyper-V. As long as you only use SCVMM to manage your environment – this is fine. But if you want to continue to use the Hyper-V management tools, and want to allow a non-administrator to control Hyper-V – you can do this.

All you need to do is to is follow the directions in my original post – but instead of editing “\ProgramData\Microsoft\Windows\Hyper-V\InitialStore.xml” on the system partition edit “\ProgramData\Microsoft\Virtual Machine Manager\HyperVAuthStore.xml” on the system partition.

Then everything will work correctly.

Cheers,
Ben

Windows 7 Eval VHD now available for Hyper-V

Virtual PC Guy — Tue, 13 Oct 2009 09:24:14 GMT

We have just released a prebuilt Windows 7 evaluation virtual hard disk for use with Hyper-V that you can download from here:

http://www.microsoft.com/downloads/details.aspx?FamilyID=606ae07e-b7db-405b-974b-dd61fc41add4

Windows validation is required to be able to download this – and the copy of Windows is limited to 90 days. But it is still a neat and easy way to check out Windows 7 if you have a Hyper-V server handy.

Cheers,
Ben

Data Protection Manager 2010 Beta available for download

Virtual PC Guy — Tue, 13 Oct 2009 06:55:58 GMT

The beta release of System Center Data Protection Manager 2010 is now available for download.

You can read more here:

http://www.microsoft.com/systemcenter/dataprotectionmanager/en/us/2010beta-overview.aspx

And download it from here:

http://go.microsoft.com/?linkid=9686964

Key features that should be of interest to Hyper-V users are:

Protection of Live Migration-enabled servers running on CSV in Hyper-V R2
Flexibility to protect virtual machines from Windows guests or from the hypervisor host
Host-based backups will now enable single-item restores from within the VHD
Ability to restore virtual machines to an alternative host

Cheers,
Ben

How I Manage Servers in my House

Virtual PC Guy — Mon, 12 Oct 2009 18:25:00 GMT

Last week I posted a description about the servers (physical and virtual) that I have configured in my house. Today I would like to spend a moment to talk about how I manage this environment.

All of my management is done from my Windows 7 computer.

I had a couple of goals when setting up my management environment:

I wanted a single console for server management.

I want it to be easy to diagnose issues – so I do not want to be jumping between different tools depending on what server I am looking at.
I wanted to maintain good security etiquette.

To this end I have three user accounts setup in my environment:
1. “Benjamin” – This is the account that I use for day-to-day desktop computing. This account has no special rights in my domain.
2. “David” – This is a user account in the domain that I have given permission to manage my various servers. This account is not a member of the domain administrators group. (In case you were curious - “David” is my middle name).
3. “Administrator” – This is the domain administrator account. It is my goal to only ever use this account when I need to create / edit objects in active directory.

To meet these goals I installed the Remote Server Administration Toolkit, and enabled the remote administration tools for Hyper-V, Remote Desktop Services and DHCP.

I then created my own MMC snap-in that contains entries for:

System Center Operations Manager (SCOM)

SCOM does not provide an MMC based management interface, but it does provide a web based one. A little known fact is that you can embed pretty much any web page in MMC. You do this by:
1. Opening the File menu on MMC
2. Selecting Add/Remove Snap-in…
3. Selecting Link to Web Address from the Available snap-ins list and clicking Add
4. Enter the web address from the SCOM website and clicking Next
5. Enter the friendly name for the site to be displayed under MMC and click Finish
6. Finally click OK
Remote Desktop Services

This is a great tool. It allows you to easily switch between Remote Desktop sessions on multiple computers. This is the usual method I use to interact with most of my virtual machines. There are a couple of reasons why I like it:
1. I can use this tool to manage my physical computer and virtual machines, and never have to think about when I am connecting to one over the other.
2. I can redirect my local drives, and get an easy way to move files around.
3. By configuring this tool to remember my credentials, I never need to login when connecting to a server.
4. I get clipboard integration (the ability to copy and past data).
Hyper-V

Hopefully you can guess why this is here. I use it for creating and configuring virtual machines and virtual hard disks.
Event Viewer

I have Event Viewer configured to connect to my physical computer that is running Hyper-V. This way I can keep an eye on the health of the system, without having to login to it directly.
Performance Monitor

I do not use Performance Monitor that much – but I keep it handy so that I can diagnose any performance issues that I might encounter.
DHCP

I have the DHCP management tools here so that I do not need to login to my domain controller to troubleshoot network problems.

Finally, I have created a shortcut that starts this MMC snap-in with my “David” account. Normally you cannot use “runas” to launch MMC – but you can work around this by wrapping it with CMD.EXE. The shortcut I have created runs the following command:

runas /user:ARMSTRONG\David "cmd /c C:\ServerAdministration.msc"

This works like a charm:

My only complaint is that I would like to get to a point where I only use Remote Desktop for trouble shooting – but as a number of my servers do not support remote administration (or do not integrated with MMC) I cannot do this.

So what setup do you use for managing your servers?

Cheers,
Ben

Disk2vhd v1.0 now available

Virtual PC Guy — Thu, 08 Oct 2009 01:28:07 GMT

The SysInternals team just announced the availability of a new tool: Disk2vhd.

This is a tool that you run on a running Windows computer to create virtual hard disks copies of the physical disks that are attached. Under the covers this tool works by taking a Windows Volume Snapshot (VSS) image of the physical hard disk – and then pouring that into a virtual hard disk.

There are a number of cool uses for this – with a “poor mans P2V” leading the charge. One thing that you should be aware of is that this tool does not change the drivers / HAL that is used in a system drive – so you may need to take manual steps to make the VHD actually boot in a virtual machine.

Another potential use is to allow you to move a physical installation of Windows 7 to a “boot from VHD” configuration.

You can download this tool here:

http://technet.microsoft.com/en-us/sysinternals/ee656415.aspx

It is supported on Windows XP SP2 / Windows Server 2003 and higher.

Cheers,
Ben