When designing VDI environments, a couple of things that you should consider are the .vswp file and the GuestOS paging file. In this article I am going to focus on the Paging file and hopefully in the not so distant future I will write a post about the .vswp file in a VDI environment.

What is point of the paging file (also known as the pagefile.sys)?

RAM is a limited resource. Virtual memory was introduced to help remove that limit.

Most modern operating system now use Virtual Memory. Virtual memory is a memory management technique. Applications running on a GuestOS reference memory using virtual memory addresses which are then automatically translated into RAM addresses by the hardware. These virtual memory address spaces are divided in pages or block, usually of 4KB.

If RAM resource is exhusted, the operating system will move 4KB pages of the virtual memory onto the computers hard disk to free up the physical memory (RAM) for other processes. In Windows operating systems, these pages are stored in the pagefile.sys.

A good way to think of this is;

Imagine a restaurant that has just open for the evening. When customers (Processes) arrive they get allocated a table (RAM) to sit and eat at. As the night goes on the restaurant get busier and free tables (RAM) begin to run out for the new customers (Processes) coming through the door. To free up spare tables (RAM) the waiter asks customers (Processes) who have finished eating if they wouldn’t mind moving to the bar (Virtual Memory) where they can continue drink.

Without the paging file, if the physical memory becomes full, applications including the operating system will have to waiting until physical memory becomes available before it can be stored in RAM ready for the CPU to process. As you can imagine this causes massive performance problems.

In summary, you NEED to have a paging file.
Read the rest of this entry »

© Simon for Gestalt IT, 2012. | VDI Paging Files – Big? Small? Or Non At All?
Read more posts categorized as Desktop, Server Virtualization

Note: I realize that they are doing this already, but until recently I hadn’t been close enough to a product that used it to worry much about it.

Then I started getting into Exchange 2010.  PowerShell for managing E-mail from almost all aspects of the process is a damn fine idea.  Now I have a reason to learn more than a few simple commands, because I might actually put them to use.

Where I have been

I signed up for an account at PowerShell.com to get my feet wet and hopefully participate in a community. I have found this to be somewhat useful in the past and am hoping that it allows me an outlet to go dig around in other peoples scripts to see if I can comprehend just what they are doing.

I am on the fence about ISE… I know at some point notepad will become a burden to use, but just starting out, I don’t think I need to worry about that just yet.  If anyone has any suggestions for things to look at in terms of ISE or just good resources for learning PowerShell, please post them in the comments.  I am anxious to get a jump on this thing in the hopes that it will be worth the effort to understand.

Tons to learn

I have tried a few things that I found while binging my way around the web and it has been interesting to see what is out there, surely I haven’t even scratched the surface yet.  I would think a PowerShell magazine or some newsletter type offering would be a huge benefit to the PowerShell community.  Maybe the guys at Redmond Magazine would consider getting something wild like that off the ground??

For now, I will begin re-perusing the books I have on PowerShell and dig into the Internet on the subject further.  Maybe there will be an event near me in the future that will help me learn… I will keep my eyes peeled for that for sure.

© derek for Gestalt IT, 2012. | PowerShell… What an awesome tool
Read more posts categorized as Desktop, Server Virtualization

This is Tom. Ask him about NAT!

After reading the post, I had some thoughts come to mind that I just had to throw into a reaction post.

New Culture

As new generations of individuals grow up and mature, it is expected that cultural shifts will take place. What I do not understand is how a culture of technological availability has morphed into an expectation that an individual can bring anything into the corporate environment and expect to use it for their job.

Too many times, I am approached by users bringing their personal laptop into the office and wanting to know how to connect it to the internal network. Or, users that want to connect their iPhones to the network so they can use Spotify or YouTube without using their cellular data plans… as though the corporate infrastructure and services are there to do their bidding.

This new culture developing assumes that everything in the outside world must be the same as in the corporate world. Their iPad can connect to GMail, so why not just connect it to the Exchange server?

What the user sees.                            What IT sees!

Unknown/Unowned Devices

The IT ecosystem is a carefully designed and tightly guarded world.

None shall pass!

Systems are selected carefully to ensure a proper balance between functionality, supportability, and stability. The discovery of an unknown device is enough to throw an IT professional into a fit of rage. The environment has been compromised in some fashion and there is potential to throw off the carefully designed balancing act.

The presence of an unknown device opens up a venerable Pandora’s Box and raises a huge red flag. Suddenly, the corporate environment is now vulnerable to a machine or device infested with trojans, a honeypot of virus infections, access to corporate resources, and not managed by IT.

IT has been assigned a critical role in modern businesses… provide tools that enable the business to function. Traditionally, this included the workstation, network, monitors, servers, etc… With more people feeling as though it is acceptable to provide their own devices, who is responsible for supporting them? What happens when the “S” key breaks off or the monitor is too blue for their liking. When IT owns and manages a device, IT is responsible. When the users owns the device, but is using it in a corporate environment, the answer is much foggier. An IT persons says the user is responsible. However, the true answer lies somewhere in the depths of politics and policy.

Unknown devices also introduce the loss of data control. The moment a user is allowed to bring in a USB drive, iPod, access GMail, or Dropbox, the data is no longer under any control of the company.

Corporate IT Adaptation

First and foremost, IT has a responsibility to the company to ensure the protection and function of corporate technological resources and systems.

However, with that said, IT needs to acknowledge the changing ways of technology. Anyone who has been in IT longer than 1 month knows that times have a way of changing and the minute you buy your phone, it is obsolete. That is the way of the world and 42 is the ultimate answer to the ultimate question of live, the universe, and everything.

Is Google “Deep Thought”?

IT departments need to be cognoscente of what exists in the marketplace, impacts (both positive and negative) to overall productivity/security, and the long term viability of those entities. A tablet, for example, may seem like a large phone (cough iPad cough). However, for an executive that spends more time meeting customers and reading email, it is a perfect tool to enable them to get their job done without needing a laptop… but how is it secured?

Security becomes one of the most important concerns for IT in a time where users have expectation of providing their own devices. NAC/NAP/Port Security ensures authorized devices are allowed on the network. Remote technologies (Application Presentation (XenApp/RemoteApp) and VDI (View, XenDesktop)) allow users to interact with applications running on protected and trusted infrastructure from unknown endpoints. Proper backups, snapshotting, and antivirus on the server and storage side ensure the data consistency is proper and recoverable in the event of a break in security.

Finally, IT needs to engage with the business to keep them abreast of concerns. Open dialogue with the business will help ensure technological expectations meet some sort of equilibrium between what IT feels is appropriate and what the business feels is necessary.

What do you really think, Bill?!

I whole heartedly do not like the idea of users bringing in their own devices for business use. Maybe I am cruisin for a bruisin (politically speaking), but I see my environment as known and trusted. The introduction of a new device takes some planning and testing because I have a responsibility to the company to provide a stable and operational environment. The introduction of a Mac laptop into my environment is not smooth. Exchange and SharePoint support is so horrible that Mac users need to use a Fusion VM running Windows 7 to fully function.

However, while it is possible to be completely restrictive and be more like “The Man”, I feel that the best way to manage the user owned devices converging on my environment is more political.

- I encourage the business to adapt corporate policies addressing the need to not bring personal devices into the environment.

- I encourage the business to develop a stricter definition of who needs email outside of the office, partial compensation for use of personal devices OR providing a company owned and managed phone, and which devices are supported.

- Have an open and friendly dialogue with those users that approach IT for assistance with personal devices. Being honest and frank about not supporting devices, needing management approval, and being unsure as to the functionality/operation of the device goes a long way.

I love the idea of new devices and new technology in the workplace. But, I want the introduction to be more structured and tested.

Tom – Thanks for the awesome post. Definitely food for thought and got my wheels spinning!

© Bill for Gestalt IT, 2011. | BYO(a)D Reaction
Read more posts categorized as Desktop, Featured

Sure they seem like small things, but over time, these small things like change in the couch cushions can add up to a big ticket problem.  For me, the issue wasn’t all that bad, but it did take some head scratching (outside the scope of the actual issue) and a brief conversation with someone wiser than I about the symptoms of my issue.

We don’t trust you anymore, go away

Windows 7 is a rather finicky OS (moreso that Windows XP, and probably a bit less so than the OS between XP and 7).  Because computers are still objects within Active Directory that access other secured resources within the directory, they too authenticate.  In reality, this means that computers have accounts equivalent to User objects within the AD environment. These accounts allow computers to tell Active Directory that they belong within the environment and should be allowed to access resources.  Just like when I logon to the domain and request access to resources by providing credentials, computers in the environment do the same.

If for some reason, the Domain Controller cannot match the credentials presented by the computer to what is stored in its database, the Domain Controller refuses authentication and presents a message about trust relationships.

I didn’t create credentials for the computer, what the heck do I do now?

When a computer is added to an Active Directory domain its account is established and the password set.  Then the password is managed by the computer and AD and changed automatically about every 30 days or so.  If the computer is no longer trusted by the domain, it is likely that the password is incorrect or has gotten lost in translation causing authentication to fail.

My issue was a replication issue which caused the computer accounts of a few workstations to fail authentication.  Because it is not the best idea to maintain only one domain controller in any Active Directory environment, and because of the way that AD manages information about objects, replication happens.

Perhaps an example will work here.  Suppose I create a user object for John Smith using Active Directory Users and Computers (ADUC) on a Domain Controller named creatively DC1 at my office.  John will be starting his new career as a data entry specialist in my company’s Houston office in a week or so.  Adding the user account for John to a DC in my office works just as well as if I had flown to Houston (or remoted into the DC there) and added the account.  Because replication sends all objects created, maintained, or deleted to all other replication partners within the domain, a user account created in my office on DC1 can be replicated to Houston on DC2 and when John gets to work, he can logon and all is well.

Replication happens in the background and is pretty much out of site when things are going smoothly, but from experience I can tell you that you should check in on your friend replication regularly.  Maybe not daily, but weekly for sure.  Just to make sure that objects in the directory are being moved around without errors.

What might cause replication problems?

There are any number of settings and configurations that can cause problems with replication.  Surely more than I have seen or have time to list here, but some of the basic things are:

• Improperly configured links
• Unmanaged Replication configurations
• Misconfigured Firewalls
• Equipment failure

Improperly configured links

When you establish replication between two (or more) Active Directory domain controllers, you create links between them that allow these DCs to exchange information.  The links are one way which means that each domain controller has two links to each replication partner.  The links can be configured to handle high speed links (fast connections, like you might see between domain controllers in the same site) and slow links (which may be used to link two remote locations).  When the links are configured correctly things work really well, but if you neglect to consider the speed of your Internet connection (on both ends) replication may suffer as a result.

Replicating information across a slow link that is configured to behave like a fast one might be a little less dire to watch than downloading a blu-ray quality video over a dial up connection, but missing information can have rather large repercussions in your environment which may be seen as inability to login, latent access or no access to resources and other things.

Unmanaged replication configurations

By this I am not suggesting that you check on replication statuses every day (depending of course on the size of your environment) but you should be looking at it regularly enough to know what is going on and that replications in all directions are happening as you need them to.

Because Active Directory is a multi-master beast, meaning that any machine configured as a domain controller carries just as much weight as any other machine configured as a domain controller, information for an object that has not yet replicated throughout the environment could be a problem.  As in my earlier example, if I created the user object for John Smith, and it failed to replicate to the domain controller in Houston by the time he needed to log in, we might have a problem.

The login would likely happen, but would take a significant amount of time because the most local domain controller didn’t have the information needed to handle the request.

Misconfigured Firewalls (and other Network issues)

Windows includes a firewall to help keep things out of your environment that shouldnt be there.  I would recommend disabling the firewall on all your Windows computers and servers because it will likely be a bigger headache than you are ready for.  Also because all organizations should use dedicated firewalls to protect their corporate assets from the outside world.

My issue with replication came at the hands of a misconfigured firewall.  The firewall was enabled for a good period of time which caused hiccups in the replication of information throughout my Active Directory environment. The symptoms displayed were the previously mentioned domain trust errors that popped up when logging on or trying to unlock a PC.

In my research and previous experience the best fix for the trust problem is to disjoin the affected system from the domain and delete the computer account from Active Directory.  Then rejoin the system to AD.  Normally this will take care of the symptom.  Not necessarily the problem.

Outages and Equipment Failures

There is the obvious replication issue with failures and downed equipment.  If the replication is scheduled to occur between two systems and one of those systems is down, obviously replication cannot happen.

Working on these issues is an interesting scenario as well.  For the sake of troubleshooting, the usual steps must be followed and checked out even if the steps do not solve the problem, they will likely help you down the path to correcting the problem.

The moral?

Do not be afraid to check out the functionality of your Active Directory environment, being proactive and working to pay attention to things like replication and group policy settings.  Keeping up with those tasks before the problem strikes and requires many late nights to correct.  You will still have some long nights working with Active Directory, but they can be worth it, without all the fires.

© derek for Gestalt IT, 2011. | Trust. It is an interesting thing in Active Directory.
Read more posts categorized as All, Desktop, Server Virtualization

Checking for compatibility

One new thing I noticed is that the SP installer checks currently installed applications for compatability with the service pack.  This is definitely new (or at least newly advertised).  Because of this compatibility check, the installation failed.  It said that an application was not compatible and stopped before problems were caused.

The incompatible application was Security Essentials.  So following the instructions provided, mainly telling me to make sure the incompatible items were at their latest version, I tried to update Security Essentials.  The application is as up to date as I can get it which means I have to wait until a later version is released to move to SP1.

I realize that the Security Essentials team and the Windows / Service Pack teams are different and that getting the post SP1 release of Security Essentials will likely allow me to load the service pack, but allowing the update for the application that fails the service pack to be requested by the process would be a pretty sweet feature.

Speeding the process

Allowing the Service Pack installation or compatibility checker to get the latest (or newer than latest) version of a Microsoft application to rectify the problem and allow the service pack to complete would be yet another improvement to the service pack process. I think the compatibility check is a huge step in the right direction, but correcting the issues that hold up the process would be pretty amazing and innovative too.

© derek for Gestalt IT, 2011. | Service Pack 1 is here… for some
Read more posts categorized as Desktop, Server Virtualization

When testing this, customers can often see unexpected results. This is often due to their misconception of how this function of View works. 

Why? View 4.5 looks for the datastore/s that have the highest "weighted available space". The formula that View 4.5 uses to calculate this is:

weighted_available_space = datastore_capacity * overcommit_factor – virtual_usage

datastore_capacity = As you would expect, the size of the datastore.

overcommit_factor = The Storage Overcommit setting applied to each datastore when selecting which datastores to use for your desktop pools.

• None - Storage is not overcommitted.
• Conservative - x4 the size of the datastore. (This is the default level.)
• Moderate - x7 the size of the datastore
• Aggressive - x15 the size of the datastore.

virtual_usage = The maximum possible usage of all existing VMs on this datastore, which is calculated by adding up current sizes of all disks and configured sizes of memories of all existing VMs on the datastore.

Examples

• DS1 - 1000GB (Datastore Size) * 4 (Conservative Overcommitment) – 0 (No VM's deployed) = 4000
• DS2 - 1000GB (Datastore Size) * 4 (Conservative Overcommitment) – ((20GB + 130MB)x5) (5 VM's already deployed) = 3865
• DS3 - 1000GB (Datastore Size) * 7 (Moderate Overcommitment) – ((20GB + 130MB)x5) (5 VM's already deployed) = 6865

Common Scenario

You have a desktop pool with DS1 as it's only datastore. You then decided to add a second datastore, DS2. You perform a Rebalance on the pool to spread the VM's across the two datastores, but nothing happens… Why? Because DS2's weighted_available_space is less than that of DS1's.

• If you increased the Overcommit level on DS2 to Moderate (x7) and ran Rebalance, the VM's would all migrate completely over to DS2 because it's weighted_available_space would be more than that of DS1 even though there are already 5 VM's on DS2. (See DS3 example)
• If you Storage vMotioned the 5 VM's off of DS2 and ran Rebalance, the VM's in the pool should evenly distribute themselves across both DS1 and DS2.

Summary

As you can see, by default you may not get your desired effect. But with a little bit of maths you can get the reaction you want from the Rebalance feature. I must stress, this is only for VMware View 4.5 and older. 

© Simon for Gestalt IT, 2011. | VMware View 4.5: Rebalance
Read more posts categorized as All, Desktop, Server Virtualization

In this post I am going to look at using RoboCopy to migrate information to new storage.

Featured Tool: RoboCopy

RoboCopy is a command line tool from Microsoft that allows for multi-threaded file copying.  It functions similarly to Copy.exe or XCopy.exe but has a few of its own nuances which will be look at here.

Using RoboCopy is quite straight forward, specifying the source, destination, files to be copied,and any options you wish, for example:

robocopy “c:\myfiles” “d:\newstorage” blogpost.docx

Note: Examples in this post will use simple paths on my local machine, but these can be changed to accommodate any storage.

In the above example, the utility will move the blogpost.docx file from the C drive to the D driv

e.  If the file exists in the destination, it will be skipped without prompt.

If a more robust feature set is needed to act on files during the copy operation, robocopy supports the following options:

With the amount of options available for use with RoboCopy, it is an extremely robust tool.  If you are comfortable with the command line it might be the best choice for a data migration.  With a little scripting knowledge you could schedule copies and use the Windows Task Scheduler and options in RoboCopy to move/migrate piles of data.

While researching and playing with RoboCopy, I also discovered a GUI add-on for the utility, details on that can be found here. I highly recommend testing it for data migration, you might be surprised with what you get that you don’t need to pay for.

© derek for Gestalt IT, 2011. | Storage Migration Tools: RoboCopy
Read more posts categorized as Desktop, Server Virtualization, Storage

In a corporate environment, being special means exceptions to the norm, non-standard, complicated. As my company has grown, we are seeing more and more deviation from what I would consider to be the norm.

Now, we see

• Sales people that are never in the office and on the road. They think they can handle managing a workstation (keeping AV up to date, patching, purchasing software, backing up data, etc…). However, all too many times the laptop ends up being left on the passenger seat and is “borrowed” by a stranger or IT is forced to support/troubleshoot an application that they have never seen nor have access to.
• Power users that seem to think they need the most powerful workstations and niche applications to get their job done. Sadly, the business approvers go for it and they get what they want. Power does not mean horsepower. Rather, it is more a function of the depth that you can go with your position.
• Operations users that work in 1-2 applications primarily but demand full application suites locally.
• Executives and high profile individuals that only ever need to check email and ocassionally open .pdf and MS Office files. Despite their relatively easy technical needs, they have to have the coolest, smallest, largest laptop that allows them to puff their feathers and strut around. Image is everything right?

Multiple models of workstations, desktops, and laptops exist. Multiple versions of software exist. Same old song and dance that every corporation/company experiences. So, I am sure I am singing to the choir.

However, we are on the verge of making a breakthrough. We are developing a user classification program and a standard computing environment program.

With limited resources and the common interrupt driven issues, development of this program has been slow-going. However, we are making progress and I love it.

The new schema is going to involve 4-5 hardware platforms:

• Small Laptop (for travelers/Road Warriors)
• Regular Laptop
• Regular desktop
• Thin Client
• Tablet (Android, iOS, whatever)

Users are going to be grouped based on their computing needs, not position. So, we are going to be positioning more and more people in our future-VDI environment for most computing. With VDI, Application Virtualization, and Citrix/RDS, we are going to be able to host most users in the datacenter, where they can be closer to their data.

Plus, users are going to be granted access to applications based on a restaurant menu style system. You want your user to have access to Microsoft Office? Office 2010 then. User wants to get Adobe Acrobat to print .pdf files? No more purchasing Acrobat… CutePDF for them. We are developing a menu of software that is acceptable and supported by IT. No supersizing, substitutions. No shirts, no shoes, no service (unless working from home! ).

By taking the “specialness” and “uniqueness” out of the end user computing environment, we are going to be able to provide a more standardized and optimized environment for the user to run in and be more efficient.

We have a long way to go, but I am very hopeful that we are going to be able to get there. From my position now, I have no doubts we can get close. With a couple system additions and changes, we can definitely hit that target.

As we speak (or I type), I am eating our own dog food. I am taking one of the Road Warrior-ish laptops on the road (OS X 10.6 – older model, but I am more concerned with OS functionality) and seeing just how useful this platform is going to be. I have a little list of tweaks, apps, etc… that we are going to need to make this work for people.

Have you gone through something like this? Do you have strictly adhered to standards at your company. Please feel free to share in the comments. I always welcome commentary and examples!

© Bill for Gestalt IT, 2011. | User Classification And Standardizing
Read more posts categorized as All, Desktop

The Tech Field Day staff have added live streaming from Tech Field Day 5 in San Jose this week.

Tech Field Day always includes innovative companies and sometimes sees launches, but it’s rare to have a company launch itself at an event like this. Nimble Storage was successful in using our 2010 Seattle event as their springboard, and remote data protection newcomer Druva followed their lead this week.

Druva is not as new a company as the “launch” nomenclature indicates. The company has spent years building a data protection product, inSync, for remote enterprise PCs and already boasts hundreds of customers. The company is profitable and successful already, but decided to come to the United States and initiate a growth effort.

The Druva staff felt that the influential delegates invited to Tech Field Day 5 would be key to achieving notice in the crowded enterprise IT market, and their February 10 presentation was the first time the company engaged with this audience.

Following the Druva presentation, W. Curtis Preston and I met with Jaspreet Singh, co-founder and CEO of Druva to discuss the product and the market.

A 30-day trial of inSync is available for download if you would like to try it out.

The entire presentation is embedded below.

© Stephen Foskett for Gestalt IT, 2011. | Druva Launches at Tech Field Day 5
Read more posts categorized as Desktop, Exclusive, Featured, Storage, Top Story

I am curious about this idea but have another idea. Sure syncing between two Drobo enclosures would be great, but wouldn’t a file replication application, either on the Drobo or on the desktop do the job just as well? Perhaps what Drobo should consider is some technology and a subscription service to replicate data stored on my Drobo with Amazon S3.

Set a price point based on the size of the customers Drobo at the time of sale or create several models of pricing so that small medium and large Drobo storage can be replicated there.

Like a dropbox situation for your Drobo. Just a thought at this point, but syncing to the cloud might be an additional solution especially if the customer only has one site.

Perhaps per GB pricing won’t work here because there isn’t a flat fee structure, but allowing Drobo to provide x TB of disk at S3 for data replication would help with off site storage/backup and allow the data to be backed up by Amazon to reduce failure points.

For the smaller shops considering or even using a Drobo, this might be a great solution for off site backup. Sure multiple Drobo units syncing across the network or a VPN is a great solution, it just seems that a way to push this straight to the cloud, using something similar to DroboSync might be an additional offering.

Now if only I were a developer with the time to create such an application or if it existed or was being planned already… Thoughts anyone?

Would be great to heard from the Tech Field Day delegates attending in February, perhaps we can get some ideas from Drobo on the topic.

© derek for Gestalt IT, 2011. | Synchronization from Drobo to the cloud
Read more posts categorized as All, Desktop, Storage