About a year ago, a deployed a VMware Essentials environment and began virtualizing some of my servers. Some are conversions from physical to virtual and others are migrating or upgrading services onto new virtual machines. (Maybe I should create some posts on my vm enivronment. -Justin)

My current, soon to be old, WSUS server is an old Dell PE1650 with Windows Server 2003. It has held up pretty well. The new server is a VM running Windows Server 2008 R2 Enterprise. Why Enterprise? Because I have a license for it.

I decided to reduce the amount of effort in migration by attaching the new server to the old database. I tried every way I could think of and search for. I kept getting the same error about not being able to connect to the remote database. I spent more time trying to migrate the existing data than I would have spent just recreating all the settings. The configuration is just not that complex. Fortunately, it being a VM and me doing a snapshot before the install process failures, I was able to roll back to a clean slate and do a clean install.

This time around, I would try a different option. Instead of connecting to the existing database, I had it do a new Windows Internal Database. I also decided to try and configure it as a Replica Server of the other server. After it finishes synchronizing, I deselect the Replica option and see if it can run on it’s own. Oh, look at that. It worked! Much easier.

After reviewing the approved updates to make sure that they are all there and some finishing touches on the configuration, I create a new Group Policy that points to the new WSUS server and assign it to a couple of computers for testing.

Everything is looking good. Moving on to the next thing that I’m behind on.

While being able to download updates from the update server did allow me to apply updates to all of my servers, it did not help in updating my notebooks.

I did begin to download the Nov 2011 ISOs. I had 2 out of 6 downloaded including the Windows ISO. I ‘CopyToCache’d them over and created a new notebook installer package that worked. I was very happy. Of course, after the notebook connected to the server it begain to install the Dec 2011 updates. Late last week I took another look at the available ISOs to download and noticed te Dec 2011 ISOs. I killed my Nov 2011s and began downloading the Dec 2011s instead. After the download, I created another new package and did a test install. This time there were no updates to be applied. This is good as the majority of the notebooks that need the backup client are not in the same office as the server and it will reduce the time it takes to get them up and going.

The ‘Backup Monitor’.

After installing the Dec 2011 package, I noticed I had a new program installed. The Backup Monitor allows the user to see when the last backup occurred, initiate a backup, and initiate a restore. For it to work properly, you have to configure your backup server to integrate with your Active Directory environment and assign your users access to their notebook. I went ahead and added my Backup Admins group access to all of the notebooks and servers as well as a precaution.

The strange this is that the Backup Monitor did not show up on the older notebooks after they had received their updates. It looks like the program will install with a new install of either the Nov or Dec 2011 packages. That means I have to test a upgrade install of the client using the new package I built. We’ll see if I can install on top of the existing client or if I have to uninstall/reinstall to get it to work.

More on that later…

Update: Do not install on top of existing client. It will create a second instance instead of replacing the existing instance. Trying the uninstall/reinstall method now.

-Justin

Could these problems be related? Probably. I suspected I broke the downloading of new updates when I tried to fix the updating of the notebooks. Either that, or it happened when I attempted to implement a secondary software cache of the updates to the remote offices to reduce network traffic.

The worst part of all of this was that the log files would show nothing useful. The DownloadSoftware.log file would simply stop updating with the following as the last two lines. The update job itself would never fail or provide and error.

RecurseDownloadPackages() – Beginning timestamp pass
CaptureMasterTimestampFile() – Capturing master timestamp file …/AllTimeStamps_##########.exe

I searched all over CommVault’s documentation, knowledge base, and forums. I could have submitted a ticket to get help but I’m just too stubborn when it comes to things that I might have caused.

Even after deleting the CVPackages and CVUpdates out of the SoftwareCache and using the ‘CopyToCache’ utility to recreate the CVPackages from the physical media did not help. Today, I decided I would go ahead and download the latest version of the media, Nov 2011, and copy that version to see if it made a difference.

While waiting for the download, I continued to poke around. I decided to try to execute that executable file, AllTimeStamps_##########.exe, to see what it does. Guess what? When I tried to run it, I got an error.

What the?!? “Can’t create output file”? I’m in the Administrators group! I then try to run it as Administrator. Executes without error and creates the text file.

After a quick Google search, I find that this is caused by User Account Control (UAC) and I find how to disable UAC. One quick reboot later and updates are downloading again. Now, once the updates are done, I’ll check to see if the notebook clients will receive updates.

-Justin

That’s just great!

The server is… was a Barracuda SpamFirewall model SF-300a. When I started at my current company, they were running McAfee anti-spam thingie whatever version. And they were running it right on the Exchange 2000 server. Within two months, I converted a little used desktop to a incoming email server with SpamAssassing/ClamAV to offload the over 30,000 spam attempts each day. This worked okay but needed to be watched to make sure it was working properly and did not have some of the refinements that were available in commercial offerings. So, I got an eval unit of the Barracuda and a month later purchased it. It worked just great for the longest time. It could handle the 150 user accounts easily. It had automatic updates of anti-spam rules and anti-virus definitions. It also had a very easy to use quarantine system that users could access via daily emails. Over the years, I had many vendors try to pitch me their new, “better than Barracuda” system. Frankly, it just wasn’t worth my time to truly investigate options to improve a system that was already running very well. I had a mile long list of pressing needs to take care of.

But then, the problems started. It first happened in November of last year. All of a sudden, we were not receiving any emails from the outside. I checked on the SpamFirewall and found out it had crashed. I had to go into the server and power cycle the unit. It came up just fine and we started receiving email again. Then, in December, it happened three more times. I was a little frustrated. Especially since the only way I could get it back was to hit the red button on it. When it happened at 11pm New Year’s Eve, I was like, I HAVE to get this resolved.

I started looking at other options. While I did have the hardware warranty on the unit where it could be replaced, I wanted to see what my other options were. After all, I really didn’t want to have to worry about a single point of failure on my network if I could avoid it. I considered signing up with MessageLabs or Postini to do offsite mail reception. But, quite frankly, I feel they are a little overpriced for what they offer. And… I didn’t want to have to retrain all my users. That terrified my the most.

So… I decided to go ahead and call in for a replacement hardware. But, while on hold, I was poking around on Barracuda’s website and saw that they now offer a VMware version of their appliances. It made sense for them. Their appliances are really just standard servers of various levels. My SF-300a is barely a cheap desktop with a Linux OS and other packages. The real power of the SpamFirewall was the management software. But… I don’t have any VMware. Yet…

Coincidentally, I had just got approval to buy six new servers for my main server room. Most of the servers I had were pretty old and needed upgrades. While deciding if I should go with individual servers or a blade/chassis system, I got pitched with a VMware solution. I’ll have to post the details on that once it gets ordered. Long story… Unlike this one… Uh…

So, I decided to grab the ESXi HyperVisor and put it on a converted desktop (OptiPlex 960: Core 2 Duo with 4GB RAM and 500GB hard disk). Loaded up the SpamFirewall Virtual Appliance Eval and started playing. It was definitely faster. I ended up deciding to go with it and put an order in for it. I got a reasonable trade-in value for the remaining warranty and subscription on my hardware unit. Though, I must say, it was painful to get the virtual appliance actually ordered and activated. It seemed like they weren’t fully prepared on their end. But, it got taken care of and I’m a proud new “owner” of a Barracuda SpamFirewall SF-300Vx. Yeah!

Now, I just have to box up the old one and send it in. I have no idea why I kept the box…

–Justin

It will be my first technical conference. I’m not sure if my previous experience 20 years ago at gaming conventions is going to help much. Still, I think it’ll be fun and informative.

I’m taking advantage of some of the training that is being offered. Here are the sessions I’ve signed up for. These sessions will help me round out some rough spots in how I perform my duties.

• Internal Documentation for SysAdmins
• Windows Enterprise Security
• Non-Obvious Nagios

I was going to take the “Using and Migrating to IPv6″ session. But, I’d rather attend the Keynote and ITIL session.

That was the good news. Now the bad. I missed the discounted hotel rate by like 12 hours or so. So, it will cost another $70 or so. Not too bad. Bit still a bummer.

Also, I haven’t decided on how I will get there. I’m in DC. I could drive or take the train. If I drive, it would take about 4 hours to get there. If I take the train, it’s a little more complicated. I would take  Amtrak from DC to New Brunswick on Thursday night. On Saturday, I would take a New Jersey Transit from New Brunswick to Trenton and Amtrak from Trenton to DC. We’ll see what the wife says…

-Justin

What does DCDIAG actually… do? – Ask the Directory Services Team – Site Home – TechNet Blogs.

When I started at my last job, the Active Directory was a mess. There were too many domain controllers in the wrong locations and not enough in others. Sites weren’t defined. There was a ‘rogue’ second domain without any domain controllers. There was even a “production” SQL Server that was also running as a domain controller.

DCDIAG was the tool I lived with for months to work out all the issues. I ran it every morning when I came in to identify the problems to resolve. There were times I had to run it on each of the domain controllers to get a feel for how each unit was seeing things. Later, I also started running NETDIAG. Another useful tool for figuring out what’s going on.

Nowadays, I try to run them about once a month just to make sure everything is working smoothly.

-Justin

Top 21 ways for your IT department to make some real money.

This forum post from dslreports.com kind of summed up my frustration levels. And that is only because it just seems stupid from the consumer’s point of view.

[HD] 2010 New HD Channels for Comcast Chicago – dslreports.com.

I want my Season 5 of Doctor Who in HD. If I wanted to, I could go find downloads of the episodes that have already aired. But, I’m not that guy. I don’t mind waiting for it. Heck, I don’t mind paying for it. I just want it in HD.

So, I did what I had to do. Got the season pass on iTunes for $35 or so. It’ll download Saturday night. Actually, I’m not sure when I’ll be able to start downloading it. It’s the first season pass I’ve purchased. After it downloads, I’ll transfer it to my iPhone and my newly bought Apple TV and BAMM! Doctor Who in HD faster than xfinity!

I also saw that I can get NetFlix on my Wii. Hmmm. If I could get a Hulu client for the TV then I could just about tell TV Signal providers of all flavors — B’Bye!

Justin

I’ve had to clean up more FakeAV this year than any other problem. It’s just crazy. Takes nearly 3 hours if the user has notified me early of the problem. If they had the problem for awhile, the malware is usually too deep and it’s faster to do a rebuild. A rebuild takes about 4 or 5 hours of semi-attentive time.