[{"content":"As CEO and co-founder of Zure in the UK, Rik helps organisations large and small use cloud better. Whether that\u0026rsquo;s a new adoption where governance and management are key, or an application modernisation project where technology choice and team knowledge are the deciding factors in success.\nThrough his public speaking and community involvement, Rik is a recipient of the Microsoft MVP Programme award for his work with Azure. He is also proud to be a member of the Microsoft Regional Director Programme. As an event organiser, speaker and — on a good week — blogger, Rik is keen to share what he knows with the community, and to encourage and support others doing the same.\nRik is part of the central organising team for the Global Azure worldwide event, and for many years was involved in organising the DDD and DDD North community events in the UK.\nHis grey hair is an indication of how long he has worked in IT, and in that time he\u0026rsquo;s done most of what you\u0026rsquo;d expect of an IT Pro: from crawling under floors pulling cables, to managing large-scale automated OS rollouts, to architecting solutions on-premises and in the cloud. These days he spends more time working with his customers\u0026rsquo; management, sharing that breadth of experience — and still learning.\nAbout this blog # When Software Attacks! has been running since 2007. The posts here span SharePoint 2007 and Windows Server on through to Azure, Bicep and Container Apps — a reasonably honest record of what has been occupying and occasionally defeating me for nearly two decades. Older posts are preserved as originally written; treat anything with a date on it accordingly.\nElsewhere # Zure — where I work Sessionize profile — talks and sessions Microsoft MVP profile Microsoft RD profile Global Azure — the worldwide community event You can also find me on LinkedIn, GitHub, Mastodon and Bluesky.\n","date":"23 August 2026","externalUrl":null,"permalink":"/about/","section":"When Software Attacks!","summary":"As CEO and co-founder of Zure in the UK, Rik helps organisations large and small use cloud better. Whether that’s a new adoption where governance and management are key, or an application modernisation project where technology choice and team knowledge are the deciding factors in success.\n","title":"About","type":"page"},{"content":"This is a personal blog. I am not selling anything, and I have no interest in building a profile of you. What follows is the whole picture.\nYour current choice # Microsoft Clarity is currently running without cookies. No thanks Allow What I use # Microsoft Clarity — and nothing else. No Google Analytics, no advertising networks, no tracking pixels, no email list, no comments system.\nClarity tells me which posts people actually read and where they give up. Some of what is here was written in 2007, and knowing what still gets used helps me decide what is worth updating.\nCookies, and what changes if you allow them # Clarity runs in one of two modes, and it starts in the private one.\nWithout your consent — the default. Clarity is told, on every page load, that storage is denied. It sets no cookies at all. Each page view is counted under a one-off identifier that is discarded immediately, so nothing links your visit to one page with your visit to the next, or to any earlier visit.\nWith your consent. Clarity sets its _clck and _clsk cookies and can follow a single visit across several pages, and recognise a returning reader. That is the part that tells me whether people read a long post to the end or leave halfway.\nI never permit ad-related storage in either mode. There is no advertising on this site, so there is nothing to store.\nWhat Clarity collects # In both modes:\nPages you visit on this site, and how long you spend on them Scrolling, clicks and mouse movement, used to build aggregate heatmaps Your approximate location, derived from your IP address at country or city level Your browser, operating system, device type and screen size The site that referred you here, if any Clarity masks text content by default, so form fields and page text are not captured as readable content. It does not collect your name, email address or anything else that identifies you personally, and I never attempt to work out who an individual visitor is.\nData is processed by Microsoft. Their privacy statement covers what they do with it, and Clarity\u0026rsquo;s own terms describe the service.\nWhat this site does not do # No advertising, and no data sold or shared with advertisers No cross-site tracking, and no tracking across devices No account, login or newsletter The site remembers your light or dark theme preference, and your choice above, in your browser\u0026rsquo;s local storage. Neither ever leaves your device, and neither is tracking.\nChanging your mind # Use the control at the top of this page, at any time.\nIf you withdraw consent after having given it, Clarity deletes the cookies it set, ends the current session and carries on in the cookie-free mode. That takes effect immediately — you do not need to reload the page or clear anything yourself.\nHosting and other services # Pages you request are served as static files, and the host will keep standard web server logs including IP addresses. Embedded content from other services — the speaking schedule comes from Sessionize — is loaded directly by your browser from those services, which will see your IP address as a result.\nGetting in touch # If you have a question about any of this, or want something looked into, reach me on any of the links in the footer.\nLast updated 23 August 2026.\n","date":"23 August 2026","externalUrl":null,"permalink":"/privacy/","section":"When Software Attacks!","summary":"This is a personal blog. I am not selling anything, and I have no interest in building a profile of you. What follows is the whole picture.\nYour current choice # Microsoft Clarity is currently running without cookies. ","title":"Privacy","type":"page"},{"content":" I speak regularly at conferences and user groups on Azure, infrastructure-as-code and the realities of running cloud platforms. The list below is generated live from my Sessionize profile. ","date":"23 August 2026","externalUrl":null,"permalink":"/speaking/","section":"When Software Attacks!","summary":" I speak regularly at conferences and user groups on Azure, infrastructure-as-code and the realities of running cloud platforms. The list below is generated live from my Sessionize profile. ","title":"Speaking","type":"page"},{"content":"Notes from the field on Azure, infrastructure-as-code and DevOps — plus the occasional war story from a career spent watching software misbehave.\n","date":"23 August 2026","externalUrl":null,"permalink":"/","section":"When Software Attacks!","summary":"Notes from the field on Azure, infrastructure-as-code and DevOps — plus the occasional war story from a career spent watching software misbehave.\n","title":"When Software Attacks!","type":"page"},{"content":"","date":"8 July 2026","externalUrl":null,"permalink":"/tags/azure/","section":"Tags","summary":"","title":"Azure","type":"tags"},{"content":"","date":"8 July 2026","externalUrl":null,"permalink":"/posts/","section":"Blog","summary":"","title":"Blog","type":"posts"},{"content":"","date":"8 July 2026","externalUrl":null,"permalink":"/categories/","section":"Categories","summary":"","title":"Categories","type":"categories"},{"content":"","date":"8 July 2026","externalUrl":null,"permalink":"/categories/how-to/","section":"Categories","summary":"","title":"How-to","type":"categories"},{"content":"I\u0026rsquo;ve been working recently on extending a client\u0026rsquo;s application to run across two Azure regions. That\u0026rsquo;s involved enabling geo-replication for our Azure Service Bus instance, which led us to discover an interesting gotcha that I\u0026rsquo;m documenting here for other people.\nThe service bus product team are aware of the issue and are investigating. I can\u0026rsquo;t comment on whether they are able to resolve the issue outside of the mitigation I describe here.\nScenario # Our application is already running in production. We are extending into a new region. Our service bus instance is already deployed into our primary region and is connected into a virtual network with a private endpoint for security.\nWe deployed new services into a second Azure region, and updated our service bus instance to add a replica in our second region. As per the documentation we then added a second private endpoint, connected to our virtual network in our second region.\nWe have a private DNS zone with a record. By default that record points at the IP of the private endpoint in our primary region.\nEmergent connectivity issue # When performing failover testing we tried different scenarios:\nWe run in our primary region with the DNS record using the IP of the private endpoint in our primary region. Result: Connectivity to service bus succeeds. We promote the service bus replica in our second region and update the DNS record to use the IP of the private endpoint in that region. Result: Connectivity to service bus succeeds. We promote the servce bus replica in our second region and leave the DNS record pointing at the IP of the private endpoint in our primary region. Result: Connectivity to service bus fails. We run in our primary region but the DNS record points at the IP of the private endpoint in the secondary region. Result: Connectivity to service bus succeeds. This difference in behaviour led us to create a support ticket, and to liaise with the product team. There is a clear difference between the original private endpoint, created before we enabled geo-replication and added a replica, and the new one, created at the point of enabling replication.\nHypothesis: Private endpoint connection differs between regions # Our working theory was that somehow the private endpoints were connected to the service bus instance in different ways. The original endpoint was created before we enabled geo-replication; the secondary was created after. We wondered if the first was connected in such a way as to prevent us reaching the replica, whereas the second, because it was created after the replica was present, was somehow able to access the replicas in both regions.\nResolution: Recreate private endpoint in primary region # As an experiment, we deleted the original private endpoint and created a new one in our primary region. We wondered if this would establish connectivity in the same way as the secondary privte endpoint.\nThe connectivity behaviour now matched that of the private endpoint in our secondary region - both replicas were accessible through this private endpoint.\nRecommendation: If adding geo-replication, recreate primary private endpoint # We don\u0026rsquo;t always know that we need geo-replication early in our application lifecycle. If you have deployed a service bus instance with private endpoints for virtual network connectivity and are now looking to enable geo-replication, plan to recreate the private endpoint in your primary region.\nObviously, this means creating the secondary endpoint, updating DNS to point at the secondary IP, and then removing and recreating the private endpoint. Be aware that your messaging traffic is going to cross into your secondary region during the operation - ensure your connectivity is working.\nWe believe that a new service bus instance, with geo-replication enabled from the point of initial creation and private endpoints added onace the service is in that state should work. We have not tested this scenario, however.\n","date":"8 July 2026","externalUrl":null,"permalink":"/posts/private-endpoints-when-using-azure-servicebus-geo-replication/","section":"Blog","summary":"Connectivity gotcha when using private endpoints with Azure Service Bus georeplication","title":"Private endpoints when using Azure Service Bus geo-replication","type":"posts"},{"content":"","date":"8 July 2026","externalUrl":null,"permalink":"/tags/","section":"Tags","summary":"","title":"Tags","type":"tags"},{"content":"","date":"3 January 2026","externalUrl":null,"permalink":"/tags/ai/","section":"Tags","summary":"","title":"Ai","type":"tags"},{"content":" In early December the nice people at Packt got in touch again to ask if I would like to review a new book. This one really piqued my interest for several reasons. As always, I made it clear that I would provide an honest review. What\u0026rsquo;s interesting to me is that my opinion changed as I read more of the book itself.\nLet\u0026rsquo;s be clear: This is a well written book, authored by people for whom I have the utmost respect. I think my prejudice is more with the subject of the book - Copilot in Azure, a shining example of Microsoft dropping \u0026lsquo;copilot\u0026rsquo; everywhere - and my previous experience in using it.\nSo, let\u0026rsquo;s split this post in two. First of all, my thoughts on the book, who it\u0026rsquo;s aimed at, and whether it hits it\u0026rsquo;s target. Then we can talk where I have concerns about the effectiveness of Copilot itself, which I think is the heart of my cynicism when I picked up the book and begain reading.\nPart One: The review # This is a book designed to help the reader get the best from the Copilot now available in the Azure Portal. It takes a laudable approach to this by tackling key areas of cloud deployment, management, and operation, and providing example prompts to solve relevant challenges that are appropriate to each chapter.\nIt also ties these tasks back to the Well-Architected Framework, underlines the necessity of each chapter by connecting to security risks and controls, or cost management requirements, or simple good practice. In this way it provides context for those who may be less experienced with Azure looking for Copilot to enable faster adoption and problem solving.\nThe book presents itself without strong opinions and is very clear whether the exercises will result in advice (usually pulled from Learn and other documentation), scripts that will achieve the objective when run by the user, or interactions that can provide direct results. In this way I think it sets the readers\u0026rsquo; expectations well - the user is in charge and is expected to take the actions which will impact services; Copilot in it\u0026rsquo;s current form will not simply go and do things.\nThere is also a clear discussion about how the users\u0026rsquo; permissions affect the capabilities of Copilot, and discussion of what role assignments will be needed for the different scenarios being discussed. The book does not simply hand-wave this important topic away and explains the need for caution when granting rights and consideration of the impact of doing so.\nOverall I like the approach taken. This could so easily have turned into a copy-paste of prompt and response that delivered less value to the reader. Each chapter provides several examples of hwo to create clear instructions for Copilot and only shows the responses if there is something the reader needs to understand (like seeing the tool for the first time, or what an adaptive card might look like when Copilot can go and perform a task, if authorised).\nFinally, the book also provides links to some good external resources on writing effective prompts, with samples, to help the reader continue their learning.\nOn balance, then, I believe this book can be a good accelerator for somebody who is new to Azure and wants to learn effective management in a hands-on way, using the latest built-in AI tooling for support, but with alignment to the accepted corpus of best practice that has been built up by experienced practitioners. I think it could also be useful for existing, more skilled users who may not have yet experimented with Copilot or who may have had subpar experiences with it in the past.\nPart Two: Broader thoughts # Hands on the table, I am a sceptic when it comes to a lot of \u0026lsquo;AI-enabled\u0026rsquo; software and services that are being thrown at us all. When it comes to Azure operations I think that having an assistant to support me in tasks that I may have less experience with is a great idea. When it works.\nAnd there\u0026rsquo;s the rub. As an experienced user, I would not use Copilot to provision new resources. Nor would I use the imperative scripts it might present me with. I\u0026rsquo;ve spent a long time helping customers implement repeatable, manageable deployments using declarative infrastructure-as-code. Sure, the script might work, but how does it set the user up for success in the long term. And don\u0026rsquo;t get me started on how terrible Copilot is at certain tasks where you would hope it might really be useful, like an crafting an APIM policy.\nPerhaps because of my age, I prefer to check documentation first, then take my first steps with a new technology. I\u0026rsquo;d like to know of any significant gotchas before I begin resource deployment because some things are really difficult to undo.\nI worry about the loss in critical thinking skills current AI tooling may bring about, and the use cases for AI in this book are almost all focused on just that - problem solving, gathering and analysing information, forming hypotheses, and taking actions.\nConclusion # Let\u0026rsquo;s pull these two threads together. The further I read of this book, the more I realised I had to set aside my own experience to do it justice.\nDo I think this is a good book? Yes. Do I think this can be helpful for a general audience? Yes. But I would strongly urge that audience to use this book as an accelerator - to help them undertake tasks more quickly, particularly new ones. But also to use it as a guide for their own leaerning and development. Sure, Copilot can come up with some simple KQL queries and look at your telemetry to help with many things, but it\u0026rsquo;s no substitute for your own skills and insights and experience with your own application data. Yes, it can create scripts to deploy and update services, but it won\u0026rsquo;t replace robust automation and you should use these scripts as stepping stones to learning how to write your own.\nIn the end, David Rendón and Steve Miles wrote a book that made me think. I don\u0026rsquo;t know that it was their intention, but in the end it was a good thing.\n","date":"3 January 2026","externalUrl":null,"permalink":"/posts/microsoft-copilot-in-azure-review/","section":"Blog","summary":"Reviewing David Rendón and Steve Miles’ book Microsoft Copliot in Azure: AI-powered cloud automation and optimization","title":"Microsoft Copilot in Azure - Review","type":"posts"},{"content":"","date":"3 January 2026","externalUrl":null,"permalink":"/categories/reviews/","section":"Categories","summary":"","title":"Reviews","type":"categories"},{"content":" Late last year the nice people at Packt asked if I would mind writing a review of Azure for Developers in exchange for a free copy of the book. They were happy when I made it clear that I don\u0026rsquo;t do marketing, but I would happily write an honest review after reading.\nWhilst I received a digital copy, I bet the physical edition of this is a weighty tome. It\u0026rsquo;s author, Kamil Mrzygłód, aims high for the book\u0026rsquo;s purpose which is to take developers through a range of Azure services, explain how they can form part of an application architecture, when to chose one over another, and provide working code samples to boot.\nCards on the table - I don\u0026rsquo;t consider myself a developer. I can read code, but I can\u0026rsquo;t write it well. Most of my time is spent with infrastructure-as-code and PowerShell. However, I\u0026rsquo;ve seen plenty of books that show the \u0026lsquo;happy path\u0026rsquo; and ignore topics like security or deployment with CI/CD. This isn\u0026rsquo;t that kind of book.\nIf I had one grumble it would be that the command line examples are almost entirely Azure CLI. However, in fairness Kamil has an entire chapter on choosing between the two, and page counts are limited enough that having samples for both is impractical.\nStructurally, the book is an epic journey that begins with choosing your developer tools and accessing Azure for the first time, travels through creation of applications and choosing hosting like App Services, then onto configuration and secret management and beyond. There are excellent sections on containers and the hosting options in Azure, messaging services, databases, telemetry and monitoring, and then AI services and DevOps.\nSome chapters feel like they have more room to breathe than others, but where space is short there are plenty of external references to help the reader learn more. I really appreciate authors who do that - technology books struggle with the pace of change in our industry, but here the discourse is on core skills and understanding, with pointers to official docs to ensure currency.\nThis is a solid and dependable book for developers who are new to Azure (perhaps cloud in general; perhaps coming from another cloud). It will help that audience learn about what Azure services offer and which to use where, along with good practice for connecting to and managing the Azure tenant, subscriptions and services.\nThis isn\u0026rsquo;t a deep dive on any given area of service and nor does it ever present itself as such. However, it\u0026rsquo;s not a flimsy high-level book either. The experience of the author shows in every chapter and the reader will come away with a good understanding of what they need to learn in order to do aAzure development well.\nI feel comfortable in recommending this for people involved in Azure software projects. I think it has more value to developers and architects then the platform and operations side of the house, but that\u0026rsquo;s not to say it\u0026rsquo;s just for developers. I would say that non-coders would get less value, though.\nImportantly, this isn\u0026rsquo;t some short-lived, left behind by the tech tomorrow kind of book. The simple fact that this is the third edition really underlines that fact. It\u0026rsquo;s the kind of book that you can and will refer back to, and can comfortably recommend to a friend a year from now safe in the knowledge that it will still have value.\nYou can find the book on the Packt website or in a bookshop of your choice.\n","date":"1 January 2026","externalUrl":null,"permalink":"/posts/azure-for-developers-review/","section":"Blog","summary":"Reviewing Kamil Mrzygłód’s book Azure for Developers","title":"Azure for Developers - Review","type":"posts"},{"content":"","date":"8 December 2025","externalUrl":null,"permalink":"/tags/architecture/","section":"Tags","summary":"","title":"Architecture","type":"tags"},{"content":" A little while ago, Stéphane Eyskens reached out to ask if I would review the latest edition of his book. I\u0026rsquo;ve known and respected Stéphane for a long time, so of course I said yes!\nFull disclosure: The very nice people at Packt sent me a copy of the book with a clear understanding that it would be an honest review.\nIf you\u0026rsquo;ve ever seen him speak at a conference, Stéphane\u0026rsquo;s approach in this book should come as no surprise. Walking through a series of scenarios, the book uses the map conceit to provide something that is always a challenge in the broad and fast-moving world of Azure: context. As it says right at the start, this book isn\u0026rsquo;t just for architects. Engineers and technical executives will find it helpful as it positions Azure services in the overall landscape of IT, as well as offering guidance on using those services through a series of scenarios drawn from real customer engagements.\nThis isn\u0026rsquo;t a small book, and it covers a lot of ground. It\u0026rsquo;s never an exhausting read, however, and is welstructured. A game of two halves, the first focuses on fundamentals such as infrastructure and application hosting options. Each area explains the different choices, accepted standard architectures, and things to consider when choosing which is right for your scenario. Related services are clearly compared to explain the factors you should consider when choosing between, for example, Azure Kubernetes Service and Azure Container Apps.\nThe second half of the book moves onto Data, AI, and Security. These three areas build nicely upon each other, whilst still referring back to the fundamentals covered in the previous section. The Ai section in particular is clear and without hyperbole - describing the different services that sit beneath the \u0026lsquo;AI\u0026rsquo; umbrella in Azure and their appropriate uses.\nThroughout the journey, Stéphane presents his maps as a way of grounding everything and connecting the scenarios.\nIn my opinion this is a great book for a very broad range of readers: Whilst not an introductory text, it is a great way to learn about many Azure services, where they are best used, and how they fit together. It\u0026rsquo;s definitely a good reference for architects tasked with designing solutions in Azure. I\u0026rsquo;d make the same case for engineers - knowing why a service is a better fit through context is important. Finally, there is value in here for people in operations and infosec. Azure is a complex beast and Stéphane makes strides in taming it here.\nYou can find the book on the Packt website or in a bookshop of your choice.\n","date":"8 December 2025","externalUrl":null,"permalink":"/posts/the-azure-cloud-native-architecture-mapbook-review/","section":"Blog","summary":"Reviewing Stéphane Eyskens book The Azure Cloud Native Architecture Mapbook","title":"The Azure Cloud Native Architecture Mapbook - Review","type":"posts"},{"content":"","date":"22 March 2025","externalUrl":null,"permalink":"/tags/pagerduty/","section":"Tags","summary":"","title":"Pagerduty","type":"tags"},{"content":"One of my customers uses PagerDuty to manage alerts and incidents for the application we are building. We were struggling to integration Azure alerts with the new orchestration functionality in PagerDuty until we learned of the currently undocumented API we should be using.\nEmitting Azure alerts into PagerDuty # Wiring up Azure with PagerDuty so that triggered Azure alerts generates an alert the information appears in PagerDuty looks pretty simple on the face of it: You create an Aure Integration which gives you a url including an integration key:\nhttps://events.pagerduty.com/integration/\u0026lt;integration key\u0026gt;/enqueue\nYou stick that url in your Acton Group as a webhook and away you go - every time an alert fires, data is sent to PagerDuty and you get a json object that you can manipulate.\nOur application is pretty complex though, and the support team wanted to build out a service map and route alerts accordingly. Using the Azure Integration this is actually pretty complex - it looked like they would need to define several services in PagerDuty and create a separate azure integration (each with its own integration key) for each one.\nThere is a better way of doing this in PagerDuty now - orchestrations allow you to create processing rules for alerts as they come into the system. The problem is that this uses the new V2 PagerDuty API and all the docs say you need to send the Integration Key as a header. Action Groups don\u0026rsquo;t allow you to customise the request - only to specifiy the url so no joy.\nYes, we could create a logic app, as suggested in documentation - the action group calls the logic app url and then we process the alert message, enriching it with the data we need and calling PagerDuty. But this adds another service that we must manage and maintain - and that could break. It\u0026rsquo;s not a great solution.\nThe new v2 webhook url # Our friends at PagerDuty were very helpful, once we\u0026rsquo;d explained our problem. It turns out that there is a url we can use, that includes the integration key just like the v1 API does:\nhttps://events.pagerduty.com/x-ere/\u0026lt;integration key\u0026gt;\n","date":"22 March 2025","externalUrl":null,"permalink":"/posts/using-pagerduty-orchestration-with-azure-alerts/","section":"Blog","summary":"Configuring Azure alert action groups with the PagerDuty v2 api","title":"Using PagerDuty Orchestration with Azure Alerts","type":"posts"},{"content":"","date":"17 May 2024","externalUrl":null,"permalink":"/tags/azure-container-apps/","section":"Tags","summary":"","title":"Azure-Container-Apps","type":"tags"},{"content":"","date":"17 May 2024","externalUrl":null,"permalink":"/tags/bicep/","section":"Tags","summary":"","title":"Bicep","type":"tags"},{"content":"If you\u0026rsquo;re hosting your application infrastructure in Azure and consolidate the diagnostic and audit information from your services into Log Analytics or elsewhere, it\u0026rsquo;s pretty easy to do using Bicep. It\u0026rsquo;s not very well documented, however, which is the reason for this post.\nA quick description of our problem # If we\u0026rsquo;re building an application using Azure services then it\u0026rsquo;s important to think about telemetry. In simple terms, we have two sources of telmetry: Our application code should be instrumented to emit telemetry, either using Open Telemetry, or the Application Insights SDK (this isn\u0026rsquo;t an otel article - whichever works for you); The Azure services also generate metrics, audit data and logging.\nIf we want to be able to effectively fault-find and monitor our application we really want to combine those two data sources. Fortunately, using a single Log Analytics workspace to act as a store for both works really well. However, documentation on how to configure the Diagnostic Settings for each service is somewhat sparse.\nThe good news, though, is that it\u0026rsquo;s standard across all services, and the bicep is remarkably straightfoward. In this post we\u0026rsquo;ll create a template using App Services as an example.\nA worked example # Create the Log Analytics Workspace # I normally have separate modules for the different Azure services in my application to make it easier to read, edit and debug. In our example then, I have a template to create the Log Analytics workspace.\nI use several parameters that are used to control things like tags and resource names.\nTip: The hidden-title tag is used by the portal and is great for putting human-readable names on your resources without compromising your resource naming policies. The content of the tag is dispaly in parentheses after the resource name in the portal.\nTip: In my opinion, the bicep is source code that is used to generate a compiled artefact - the ARM template. There is a field in the ARM template nameed contentVersion. We stamp that with the build version of our artefact, and the bicep reference deployment().properties.template.contentVersion enables us to put that value into a tag so it\u0026rsquo;s visible in the portal as to which version of my code was used to deploy the infrastructure.\n// ** Variables ** // *************** var LogAnalyticsWorkspaceName = toLower(\u0026#39;log-${projectName}-${environment}-${location}\u0026#39;) // ** Resources ** // *************** // Deploy Log Analytics Workspace resource LogAnalyticsWorkspace \u0026#39;Microsoft.OperationalInsights/workspaces@2022-10-01\u0026#39; = { name: LogAnalyticsWorkspaceName location: location tags: { project: projectName environment: environment owner: owner displayName: \u0026#39;Log Analytics\u0026#39; \u0026#39;hidden-title\u0026#39;: \u0026#39;Log Analytics\u0026#39; version: deployment().properties.template.contentVersion } properties: { sku: { name: logAnalyticsSku } } } Reference Log Analytics and create App Service Plan # Since our Log Analytics workspace is created elsewhere, we need to reference is as an existing resource when it comes to our service module. Doing this means I don\u0026rsquo;t need to work out the resource Id to be able to reference it.\nThis snippet from my App Services module creates a new hosting plan. It uses a parameter to control whether we want Linux or Windows, and another for the service tier (sku)\n// ** Variables ** // *************** var AppServicePlanName = toLower(\u0026#39;asp-${projectName}-${environment}-${location}\u0026#39;) var LogAnalyticsWorkspaceName = toLower(\u0026#39;log-${projectName}-${environment}-${location}\u0026#39;) // ** Resources ** // *************** // Reference existing Log Analytics Workspace resource LogAnalyticsWorkspace \u0026#39;Microsoft.OperationalInsights/workspaces@2022-10-01\u0026#39; existing = { name: LogAnalyticsWorkspaceName } //Deploy App Service Plan resource AppServicePlan \u0026#39;Microsoft.Web/serverfarms@2023-01-01\u0026#39; = { name: AppServicePlanName location: location tags: { project: projectName environment: environment owner: owner displayName: \u0026#39;${componentName} App Service Plan\u0026#39; \u0026#39;hidden-title\u0026#39;: \u0026#39;${componentName} App Service Plan\u0026#39; version: deployment().properties.template.contentVersion } sku: { name: appServicePlanSku } properties: { reserved: toLower(appServicePlanKind) == \u0026#39;linux\u0026#39; ? true : null } kind: appServicePlanKind } Configure the diagnostic settings # The DiagnosticSettings resource type is how we configure our service to emit it\u0026rsquo;s telemetry into our Log Analytics workspace. The resource is tied to our service using the scope property, rather than the more common parent.\nWithin the properties section, we configure what metrics and logs we want to send to Log Analytics. Getting the specific settings for each service is simplified by using the Azure Portal - the JSON View option in the blade where you configure the settings will provide what you need; you just need to convert it to bicep.\nA hat tip to my friend Mikael Sand, who has a handy blog post showing you how to do this, so I\u0026rsquo;ll point you to him rather than run through in detail here.\nOur example below for App Services is sending all metrics to the Log Analytics workspace\n// Configure diagnostics on app service plan resource DiagnosticSettings \u0026#39;Microsoft.Insights/diagnosticSettings@2021-05-01-preview\u0026#39; = { name: \u0026#39;LogAnalytics\u0026#39; scope: AppServicePlan properties: { metrics: [ { enabled: true retentionPolicy: { days: 0 enabled: false } category: \u0026#39;AllMetrics\u0026#39; } ] workspaceId: LogAnalyticsWorkspace.id logAnalyticsDestinationType: null } } The logAnalyticsDestinationType is normally null but in some services, other values can be specified. For example, below is the bicep for diagnostics on API Management. That service allows you to choose whether logs appear in dedicated service-specific tables or the common Log Analytics tables for service diagnostics or metrics. Here I am specifying \u0026lsquo;dedicated\u0026rsquo; for the service-specific type.\n// Configure diagnostics on api management resource DiagnosticSettings \u0026#39;Microsoft.Insights/diagnosticSettings@2021-05-01-preview\u0026#39; = { name: \u0026#39;LogAnalytics\u0026#39; scope: ApiManagement properties: { logs: [ { category: null categoryGroup: \u0026#39;audit\u0026#39; enabled: true retentionPolicy: { days: 0 enabled: false } } { category: null categoryGroup: \u0026#39;allLogs\u0026#39; enabled: true retentionPolicy: { days: 0 enabled: false } } ] metrics: [ { enabled: true retentionPolicy: { days: 0 enabled: false } category: \u0026#39;AllMetrics\u0026#39; } ] workspaceId: LogAnalyticsWorkspace.id logAnalyticsDestinationType: \u0026#39;Dedicated\u0026#39; } } ","date":"17 May 2024","externalUrl":null,"permalink":"/posts/configuring-diagnostic-settings-for-azure-services-using-bicep/","section":"Blog","summary":"If you’re hosting your application infrastructure in Azure and consolidate the diagnostic and audit information from your services into Log Analytics or elsewhere, it’s pretty easy to do using Bicep. It’s not very well documented, however, which is the reason for this post.","title":"Configuring diagnostic settings for Azure services using bicep","type":"posts"},{"content":"When working on a project recently I needed to deploy a Container App Environment within a virtual network in Azure. Thanks to the joys of internet search, I started off reading the wrong bits of the official documention and got incredibly confused, and much of the community content about this uses out of date schemas and code. This article is so I don\u0026rsquo;t need to go through that again, and hopefully it will help others, too.\nWhat\u0026rsquo;s the problem? # Pretty much every organisation I work with these days stipulates that all their cloud apps must be deployed within a virtual network. Within Azure there are several different ways services use to meet this need, varying from service to service: Some deploy within a subnet, provisioning resources directly; others use private endpoints, providing a secure connection into the network over which we can communicate with the service instance.\nContainer Apps has been a rapidly evolving service, and because of that it has two ways of deploying within a virtual network. From a distance they look very similar, but they behave differently, and the way you get the service to use one method or another is really not obvious.\nA quick note about the way we don\u0026rsquo;t want to do this # If you hit the wrong page of documentation first as I did, things feel pretty straightforward. To connect your Container Apps Environment into the virtual network you will need to create a dedicated subnet within your virtual network. That subnet is used to connect both the service components and the containers themselves, so a /23 address space is needed.\nYou then add a simple few properties to get the service deploying within the virtual network:\nvnetConfiguration: { internal: true infrastructureSubnetId: vNetSubnet.id } The internal property tells the service we want to connect to a virtual network, and the infrastructureSubnetId takes the resource Id of the subnet we want to deploy into.\nThat sounds great, right? The trouble is that when the service deploys, it also creates a resource group for some of its components, and the name of that resource group is autogenerated. That means it doesn\u0026rsquo;t meet any of the naming policies in your tenant, if there are any (and who doesn\u0026rsquo;t have policies for that, these days?). I would try to deploy and either get blocked by policy, or somebody would spot the resource group and delete it without my knowledge.\nI looked at the API documentation for Microsoft.App/managedEnvironments and found the infrastructureResourceGroup property, but no matter what I specified the deployment would ignore it.\nAn example for how we do want to do this # It turned out that there is a second way to deploy within a virtual network. That way was added later by the team, and the documentation is quite detailed, but it doesn\u0026rsquo;t really make clear how you make the service deploy in the new way as opposed to the old.\nThe answer turns out to be both simple and not obvious. When deploying in a virtual network we can optionally define one or more workload profiles - these allow us to specify dedicated compute as well as consumption.\nworkloadProfiles: [ { name: \u0026#39;Consumption\u0026#39; workloadProfileType: \u0026#39;Consumption\u0026#39; } ] If you add any workload profiles at all, the service switches from the old way of deploying to a virtual network to the newer, better way. I hadn\u0026rsquo;t done this because I wanted to use consumption and the documentaion told me this was the default, so I didn\u0026rsquo;t think I needed to specify anything.\nAdding a Consumption workload profile suddenly changed how things deployed. This meant:\nThe resource group name I was specifying in infrastructureResourceGroup was now honoured. The way the service deploys changes and as a result containers do not consume IP addresses from the dedicated virtual network. This means we can go from the very large /23 to a much smaller /27 address space. Deploying the environment # I use separate bicep modules for different resources. This means that I create my virtual network and subnets in one module, a long analytics workspace for telemtry in another, and my container app environment in a third.\nIn the container app environment module I reference the existing virtual network and log analytics resources so I can connect them to my new container app environment.\nI use parameters to compose my resource names, and I use the same parameters in tags.\nTip: The hidden-title tag is used by the portal and is great for putting human-readable names on your resources without compromising your resource naming policies. The content of the tag is dispaly in parentheses after the resource name in the portal.\nTip: In my opinion, the bicep is source code that is used to generate a compiled artefact - the ARM template. There is a field in the ARM template nameed contentVersion. We stamp that with the build version of our artefact, and the bicep reference deployment().properties.template.contentVersion enables us to put that value into a tag so it\u0026rsquo;s visible in the portal as to which version of my code was used to deploy the infrastructure.\n// ** Variables ** // *************** var ContainerAppEnvironmentName = toLower(\u0026#39;cae-${projectName}-${environment}-${location}\u0026#39;) var LogAnalyticsWorkspaceName = toLower(\u0026#39;log-${projectName}-${environment}-${location}\u0026#39;) var vnetName = toLower(\u0026#39;vnet-${projectName}-${environment}-${location}\u0026#39;) var InfrastructureResourceGroupName = toLower(\u0026#39;rg-${environment}-${projectName}-caeinfra\u0026#39;) var subnetName = \u0026#39;ContainerApps\u0026#39; I need to reference the virtual network in order to then reference the subnet.\n// Reference existing Log Analytics Workspace resource LogAnalyticsWorkspace \u0026#39;Microsoft.OperationalInsights/workspaces@2023-09-01\u0026#39; existing = { name: LogAnalyticsWorkspaceName } // Reference existing VNet resource vNet \u0026#39;Microsoft.Network/virtualNetworks@2023-09-01\u0026#39; existing = if (connectToVnet) { name: vnetName } // Reference existing Subnet resource vNetSubnet \u0026#39;Microsoft.Network/virtualNetworks/subnets@2023-09-01\u0026#39; existing = if (connectToVnet) { parent: vNet name: subnetName } The bicep for the Container App Environment references the log analytics worksapce and uses the listkeys function to specify the access key directly.\nThe workload profile section tells the service that I want to use the newer way of connecting to my virtual network, and the infrastructureResourceGroup can now follow our organisational naming convention.\n// Deploy Container App Environment resource ContainerAppEnvironment \u0026#39;Microsoft.App/managedEnvironments@2023-08-01-preview\u0026#39;= { name: ContainerAppEnvironmentName location: location tags: { project: projectName ApplicationName: projectName environment: environment owner: owner displayName: \u0026#39;Container App Environment\u0026#39; \u0026#39;hidden-title\u0026#39;: \u0026#39;Container App Environment\u0026#39; version: deployment().properties.template.contentVersion } properties: { appLogsConfiguration: { destination: \u0026#39;log-analytics\u0026#39; logAnalyticsConfiguration: { customerId: LogAnalyticsWorkspace.properties.customerId sharedKey: LogAnalyticsWorkspace.listKeys().primarySharedKey } } workloadProfiles: [ { name: \u0026#39;Consumption\u0026#39; workloadProfileType: \u0026#39;Consumption\u0026#39; } ] infrastructureResourceGroup: InfrastructureResourceGroupName vnetConfiguration: { internal: true infrastructureSubnetId: vNetSubnet.id } zoneRedundant: (environment == \u0026#39;prod\u0026#39;) ? true : false } } Creating a private DNS zone for our container apps # Creating the environment is all well and good, but you won\u0026rsquo;t be able to actually connect to your containers unless you also create a private DNS zone. Once again, the service autogenerates a subdomain for your instance, so we need to reference the defaultDomain property.\n// Create Private DNS Zone for website domain resource PrivateDNSzone \u0026#39;Microsoft.Network/privateDnsZones@2020-06-01\u0026#39; = { name: ContainerAppEnvironment.properties.defaultDomain location: \u0026#39;global\u0026#39; tags: { project: projectName ApplicationName: projectName environment: environment owner: owner displayName: \u0026#39;Private DNS Zone\u0026#39; \u0026#39;hidden-title\u0026#39;: \u0026#39;Private DNS Zone\u0026#39; version: deployment().properties.template.contentVersion } } Don\u0026rsquo;t forget to connect that private DNS zone to either your virtual network, or you hub network if you\u0026rsquo;re using a hub-spoke architecture with a private DNS resolver\n// Connect private dns zone to virtual network resource PrivateDNSzoneNetLink \u0026#39;Microsoft.Network/privateDnsZones/virtualNetworkLinks@2020-06-01\u0026#39; = { name: \u0026#39;link_to_${vnetName}\u0026#39; parent: PrivateDNSzone location: \u0026#39;global\u0026#39; properties: { registrationEnabled: false virtualNetwork: { id: vNet.id } } } Then, finally, we need to create a DNS record so other services can resolve the names of our containers. The record points at the IP address of the load balancer within the Container App Environment using the staticIp property of the resource.\nresource record \u0026#39;Microsoft.Network/privateDnsZones/A@2020-06-01\u0026#39; = { parent: PrivateDNSzone name: \u0026#39;*\u0026#39; properties: { ttl: 3600 aRecords: [ { ipv4Address: ContainerAppEnvironment.properties.staticIp } ] } } ","date":"17 May 2024","externalUrl":null,"permalink":"/posts/deploying-an-azure-container-app-environment-within-a-virtual-network-using-bicep/","section":"Blog","summary":"When working on a project recently I needed to deploy a Container App Environment within a virtual network in Azure. Thanks to the joys of internet search, I started off reading the wrong bits of the official documention and got incredibly confused, and much of the community content about this uses out of date schemas and code. This article is so I don’t need to go through that again, and hopefully it will help others, too.","title":"Deploying an Azure Container App Environment within a virtual network using bicep","type":"posts"},{"content":"I recently needed to set KEDA scaling rules on an Azure Container app that used the number of messages in a Service Bus queue. There\u0026rsquo;s plenty of info out there on the internet about scaling rules, but not when it comes to Service Bus, so I\u0026rsquo;m writing up what I learned here.\nProblem Space # A recent project made use of Azure Container Apps for backend services, driven through messages placed on Service Bus queues. To ensure performance, we need to create scaling rules to add instances of the containers based on the number of messages in the queue.\nA worked example # Service Bus Authorisation Rule # For our scaler to work, we need to create an Authorisation Rule that allows KEDA to read the number of messages in our queue. Whilst it\u0026rsquo;s possible to creat Authorisation Rules at the queue level, frankly I find it easier to create them at the namespace level.\nNote: There is a maximum number of rules you can create, so I tend to create one rule and use it for all my Container Apps within an application. If you need to ensure that each container app only has rights to look at its own queue, you\u0026rsquo;ll probably need to create the rule at the queue level.\nAs I\u0026rsquo;ve mentioned in other posts, I like to keep different services in separate modules, so Service Bus is created in its own file, then I have another for the Container App. However, I want to keep the Authorisation Rule with the scaler rule, so I reference the Service Bus instance as an existing resource.\nI then create the rule, specifying the Service Bus namespace resouce as its parent to create it at the namespace level.\n// reference existing Service Bus resource ServiceBus \u0026#39;Microsoft.ServiceBus/namespaces@2021-11-01\u0026#39; existing = { name: ServiceBusName } // Create service bus authorisation rule for autoscaler resource ServiceBusAuthorisationRule \u0026#39;Microsoft.ServiceBus/namespaces/AuthorizationRules@2021-11-01\u0026#39; = { name: ServiceBusAuthorisationRuleName parent: ServiceBus properties: { rights: [ \u0026#39;Send\u0026#39; \u0026#39;Listen\u0026#39; \u0026#39;Manage\u0026#39; ] } } Container App scaling rule # This isn\u0026rsquo;t a post about creating Container App environments or the Container Apps themselves, so the sample bicep below shows the stuff we need rather than the whole resource definition.\nWe can\u0026rsquo;t create the scaling rule without the Authorisation Rule, but we don\u0026rsquo;t reference that resource directly, so we need to add a dependency to make sure we only deploy after it\u0026rsquo;s created.\nWe must provide an appropriate access key in order to connect to Service Bus. That gets defined as a secret within the Container App and as you can see, I\u0026rsquo;m using the listkeys function to get the ARM fabric to populate our secret with the connection string.\nWe need to specify the minimum and maximum number of instances we want, setting the upper and lower bounds for our scaler. I use a parameter to pass the maximum value in, which is used here.\nThe scaling rule needs the correct type so KEDA knows it\u0026rsquo;s a queue-based scaler - queue-based-autoscaling. Then within my scaling rule I reference another parameter specifying the number of messages that must be on the queue before a new instance is deployed, and the name of the Service Bus queue to watch.\n// create Container App in managed environment resource ContainerApp \u0026#39;Microsoft.App/containerApps@2023-08-01-preview\u0026#39; = { name: ContainerAppName dependsOn: [ ServiceBusAuthorisationRule ] location: location ... properties: { managedEnvironmentId: ContainerAppEnvironment.id configuration: { ... secrets: [ { name: ServiceBusAuthorisationRuleName value: listKeys(listKeysEndpoint, ServiceBus.apiVersion).primaryConnectionString } ] } template: { containers: [ ... ] scale: { minReplicas: 1 maxReplicas: containerAppMaxReplicas rules: [ { name: \u0026#39;queue-based-autoscaling\u0026#39; custom: { type: \u0026#39;azure-servicebus\u0026#39; metadata: { queueName: ServiceBusQueueName messageCount: autoscalerRuleMessageCount } auth: [ { secretRef: ServiceBusAuthorisationRuleName triggerParameter: \u0026#39;connection\u0026#39; } ] } } ] } } } } And that\u0026rsquo;s it. You can combine the queue-based scaling rule with others - I usually add at least a CPU utilisation rule, but those are already well documented. A big thanks to my good friend Tom Kerkhove who has a sample in his GitHub which he pointed me at when the internet gods failed to answer my cries for help!\n","date":"17 May 2024","externalUrl":null,"permalink":"/posts/using-bicep-to-define-service-bus-scaling-rules-for-azure-container-apps/","section":"Blog","summary":"I recently needed to set KEDA scaling rules on an Azure Container app that used the number of messages in a Service Bus queue. There’s plenty of info out there on the internet about scaling rules, but not when it comes to Service Bus, so I’m writing up what I learned here.","title":"Using bicep to define Service Bus scaling rules for Azure Container Apps","type":"posts"},{"content":"Not every project can host services in the cloud. If you have a local environment running on virtual machines, connecting to that from the Android emulator running on the same host can be tricky. This post details the solution I use and the tools needed to enable it.\nDetailing the problem # At Black Marble we don\u0026rsquo;t just build solutions for our customers that run in the cloud. Sometimes things still need to be hosted on-premises. We have one project that involves a mobile application and a multi-tier service back end. For development we need to make sure developers don\u0026rsquo;t trip over one another, and that requires a dedicated environment, running in virtual machines that each developer can run on their computer.\nIn the beforetimes, when we all worked in the office, we could host the environments centrally. With remote working this is much less practical.\nThe Android emulator has supported using Hyper-V for some time now, but it is still self-contained and doesn\u0026rsquo;t know about the virtual switches that can be created on a Windows development machine. Instead, it connects straight to the network the host uses and there is no straightfoward way to change that, or override network settings such as DNS, and a local hosts file is a no-go.\nI need to be able to connect the mobile app running on the emulator to the services running in Hyper-V. That environment is self contained with it\u0026rsquo;s own Domain Controller, DNS, Certificate Services, ADFS and more. I need the android emulator to be able to resolve the hostnames of the services I must access, and then communicate over a secure http connection with no cert trust issues.\nStep 1: DNS # It\u0026rsquo;s always DNS. The emulator documentation is clear: When it starts, it looks at the DNS configuration of the host machine and uses those addresses. If I simply add the address of the DNS inside my environment then the emulator will pick it up. I can override the DNS settings if I like, providing I start it from the command line, so that might work\u0026hellip;\nThat\u0026rsquo;s great, but then routing becomes the problem: My environment is deployed to an Internal Hyper-V Virtual Switch. We do this so we can control the configuration - each VM has a fixed IP address. Access to the internet is handled by the host, which uses NAT to allow outbound traffic and handle the response. The emulator is not connected to that internal switch, and the VMs aren\u0026rsquo;t directly accessible from the network to which the host is connected.\nI could define several specific NAT port mappings to allow comms with a port on the host that is then routed to the VM. However, these would need to be custom ports, and that isn\u0026rsquo;t going to work with the emulator. Since all the hostnames would then need to resolve to the host, that also won\u0026rsquo;t work unless I run a separate DNS on the host itself.\nDNSCrypt-Proxy # Even though I didn\u0026rsquo;t want to run a DNS server on my host laptop, that gave me a thread to pull on. I wondered if such a thing as a DNS Proxy existed. It turns out they do, and the one I\u0026rsquo;m using is from DNSCrypt.\nSecure DNS is a laudable idea, but not what I\u0026rsquo;m looking for. However, the DNSCrypt-Proxy also supports \u0026rsquo;traditional\u0026rsquo; DNS requests on port 53. The software is well-maintained, regularly updated and extremely well documented.\nDNSCrypt-Proxy allows me to configure DNS forwarding. It lets me do that through powerful rules that mean I can just forward requests for the .local domain my environment uses. It then sends all other requests to the DNS server on my network.\nTo enable forwarding there are two things I must do. First of all, I need to find the relevant bit of the dnscrypt-proxy.toml file that is the main source of configuration and uncomment the line about forwarding rules.\n################################################################################## # Route queries for specific domains to a dedicated set of servers # ################################################################################## ## See the `example-forwarding-rules.txt` file for an example forwarding_rules = \u0026#39;forwarding-rules.txt\u0026#39; I then need to edit the forwarding-rules.txt file to uncomment the local domain and give it the IP address of the DNS in my environment.\n## Forward *.lan, *.local, *.home, *.home.arpa, *.internal and *.localdomain to 192.168.1.1 # lan 192.168.1.1 local 192.168.254.2 # home 192.168.1.1 # home.arpa 192.168.1.1 # internal 192.168.1.1 # localdomain 192.168.1.1 # 192.in-addr.arpa 192.168.1.1 When you download the zip containing the windows release all the config files are named example-\u0026lt;config file\u0026gt;.toml or example-\u0026lt;config file\u0026gt;.txt so you need to copy or rename them to drop the \u0026rsquo;example-'\nI can simply run the dnscrypt-proxy.exe file in a console and edit my machines\u0026rsquo;s network settings to include 127.0.0.1 in the DNS servers alongside whatever is the local DNS on the network. If I the run DNS queries using nslookup or similar I should be able to resolve hostnames from the environment\u0026rsquo;s DNS as well as from elsewhere.\nStep 2: HTTP # Being able to find the IP address is great, but without a way to communicate with that IP it\u0026rsquo;s not very helpful.\nThe Android emulator does allow us to configure a web proxy through it\u0026rsquo;s settings, so all I need to do is find one.\nI started, as we probably all do, with Fiddler Classic. It\u0026rsquo;s a stalwart of developers whenever we need to monitor traffic in our app. However, no matter what I did or how I configured it, I could not get the emulator to communicate through it.\nmitmproxy # After some research I found mitmproxy which is a command-line tool that you can even install from the Microsoft Store. It supports a wide range of protocols including HTTP/2 and WebSockets - both of which our app uses.\nThe documentation for mitmproxy is excellent. I knew that certificates would be a challenge - I need to use https and that means the proxy must decrypt and re-encrypt the traffic. I need it to trust the certs in my environment and I need to get the emulator to trust its certs.\nThe second part was really easy because it\u0026rsquo;s well documented: Simply point your browser in the emulator at a specific page, download the root cert for mitmproxy and install it on the emulator.\nTrusting the certs in my environment I thought would be easy. Because mitmproxy runs on my local machine I can simply drop the root cert from the CA inside the environment into the Trusted Root store on my machine and that should be it. However, it wasn\u0026rsquo;t. I kept getting cert trust warnings from mitmproxy that it couldn\u0026rsquo;t verify the upstream cert and the emulator wouldn\u0026rsquo;t communicate properly when I tried accessing web pages served by the environment in a browser.\nThe solution turned out to be a startup switch ssl_insecure that turns off the upstream cert verification.\nThis did make me nervous though - I might trust my own environment, but the same proxy allows access to other sites from the emulator. I\u0026rsquo;m less trusting of those!\nOnce again, the documentation provides the solution. It\u0026rsquo;s possible to control what sites the proxy will handle and the Ignoring Domains section of the docs goes into this in detail. Rather than lsiting which domains to ignore, however, you can list just the domains you want to proxy using the allow-hosts switch and some regex.\nTo only proxy secure traffic from my internal environment\u0026rsquo;s domain and disable the certificate check, my command-line looks like this:\nmitmproxy.exe --ssl-insecure --allow-hosts \u0026#39;^(.+\\.)?mydomain.local:443$\u0026#39; Pulling everything together # Now I have all the components I need, the steps I must follow are pretty straightfoward:\nStart the VMs in my virtual environment. Edit the DNS servers on my host\u0026rsquo;s network connection (physical or wifi) to have 127.0.0.1 as the first entry, followed by whatever was there before (most likely the IP address of my home router). Start DNSCrypt-Proxy. Start mitmproxy making sure to include the command-line switches I need. Fire up the Android Emulator. When I\u0026rsquo;m done I can exit all the apps and shut down my environment, but I must remember to reset the DNS servers on my host.\n","date":"17 February 2024","externalUrl":null,"permalink":"/posts/accessing-a-local-hyper-v-environment-from-the-android-emulator/","section":"Blog","summary":"Not every project can host services in the cloud. If you have a local environment running on virtual machines, connecting to that from the Android emulator running on the same host can be tricky. This post details the solution I use and the tools needed to enable it.","title":"Accessing a local Hyper-V environment from the Android emulator","type":"posts"},{"content":"","date":"17 February 2024","externalUrl":null,"permalink":"/tags/android/","section":"Tags","summary":"","title":"Android","type":"tags"},{"content":"","date":"17 February 2024","externalUrl":null,"permalink":"/tags/hyper-v/","section":"Tags","summary":"","title":"Hyper-V","type":"tags"},{"content":"","date":"5 February 2024","externalUrl":null,"permalink":"/tags/devops/","section":"Tags","summary":"","title":"Devops","type":"tags"},{"content":"Bicep is a great improvement over ARM Templates but doesn\u0026rsquo;t remove the need to validate our code at build time. I could continue to use the ARM-TTK and validate the generated template, but bicep has it\u0026rsquo;s own built in rules. Getting build errors in a way that can provide meaningful information in my CI/CD tooling is an interesting challenge.\nA quick problem description # We are using Azure DevOps for build and release automation. It supports ingestion of test results in a variet of formats such as NUnit and JUnit. With ARM Templates we can use the ARM-TTK, and Sam Cogan\u0026rsquo;s great task that creates the right formatted output to ingest using the PublishTestResults task.\nBicep now has a \u0026rsquo;lint\u0026rsquo; option that we can use to validate our templates before we build them, and it supports the SARIF standard format for those results. Whilst there is an extension for Azure DevOps to display SARIF files, I would prefer to see those test results in the same place as things like unit tests.\nTo get what I want we\u0026rsquo;ll need to do three things:\nRun bicep lint in our pipeline and capture the SARIF format results to a file. Transform the SARIF file to a format Azure DevOps understands like NUnit or JUnit Publish the test results file during the pipeline. Simple, right?\nBetter yet, somebody has already done it! John Reilly has an excellent post that covers both Azure DevOps pipelines and GitHub Actions.\nWell, we wouldn\u0026rsquo;t be here if everything worked how I wanted it to\u0026hellip; I followed John\u0026rsquo;s post in my pipeline and got errors. This post is about what those errors were and how I solved them.\nStep 1: Running bicep lint in our pipeline # Problem one: Text format # John is using the AzureCLI task in his pipeline and the az bicep lint command with output simply piped to a file. He the uses an NPM package called sarif-junit to convert the file to xml.\nWhen I tried the same thing, however, the conversion failed with the error: Unexpected token '�', \u0026quot;��{\nI spotted that John\u0026rsquo;s pipeline was using a linux cloud agent; I was using Windows. Could it be text formatting? Examination of the file showed that it was UTF-16, and apparently the node task didn\u0026rsquo;t like that. The fix, then, was to capture the output into a PowerShell var rather than pipe straigh to file, and then specify the text formatting when I saved it:\n$output = az bicep lint --file ${{parameters.bicepFile}} --diagnostics-format sarif $output | Out-File -FilePath $(Build.SourcesDirectory)\\bicep.sarif -encoding ascii Problem two: Errors give no output # By default the bicep linter treats the issues it can handle as warnings. That means the bicep build command doesn\u0026rsquo;t fail, so the pipeline doesn\u0026rsquo;t fail. It also means that the transformed output from bicep lint actually gets imported as a passing test, not a warning. That\u0026rsquo;s not terribly helpful.\nThe solution to that problem is to use the bicepconfig.json file that the CLI supports and change the warnings to errors:\n{ \u0026#34;analyzers\u0026#34;: { \u0026#34;core\u0026#34;: { \u0026#34;enabled\u0026#34;: true, \u0026#34;rules\u0026#34;: { \u0026#34;adminusername-should-not-be-literal\u0026#34;: { \u0026#34;level\u0026#34;: \u0026#34;error\u0026#34; } } } } } When I did that, however, I got no output from the command at all! It turns out that (at time of writing) there is a documented bug in AZ CLI which results in no output from the bicep linter being displayed.\nThe solution to that turned out to be pretty simple: Use the Bicep CLI instead of AZ CLI. Including the transformation, my pipeline task looks like this:\n- task: AzureCLI@2 displayName: \u0026#39;Lint Bicep files\u0026#39; inputs: azureSubscription: $(azureServiceConnection) scriptType: \u0026#39;ps\u0026#39; scriptLocation: \u0026#39;inlineScript\u0026#39; useGlobalConfig: true inlineScript: | #az bicep install $output = bicep lint ${{parameters.bicepFile}} --diagnostics-format sarif $output | Out-File -FilePath $(Build.SourcesDirectory)\\bicep.sarif -encoding ascii npx -y sarif-junit -i $(Build.SourcesDirectory)\\bicep.sarif -o $(Build.SourcesDirectory)\\bicep.xml Followed by the PublishTestResults task to ingest the JUnit format file:\n- task: PublishTestResults@2 displayName: \u0026#39;Publish Bicep test results\u0026#39; inputs: testResultsFormat: \u0026#39;JUnit\u0026#39; testResultsFiles: \u0026#39;$(Build.SourcesDirectory)\\bicep.xml\u0026#39; testRunTitle: \u0026#39;Run_$(Build.BuildNumber)\u0026#39; failTaskOnFailedTests: true condition: always() Step 2: Presenting test results # Problem: Results not imported correctly # JUnit test results in Azure DevOps The image above shows how the test results are displayed when the JUnit file is imported. As you can see, it\u0026rsquo;s actually not very helpful:\nThe column where we would expect to see the name of the test (e.g. adminusername-should-not-be-literal) actually contains the error message, including the line number. Selecting the test to view more details actually shows less: There\u0026rsquo;#s no error message and nothing tells me what file the error is present in. The PublishTestResults task has excellent documentation, including details of how the JUnit files are imported and what field value goes where.\nHere is a sample output file, using the no-hardcoded-location test, as generated by the sarif-junit module.\n\u0026lt;?xml version=\u0026#34;1.0\u0026#34; encoding=\u0026#34;UTF-8\u0026#34;?\u0026gt; \u0026lt;testsuites tests=\u0026#34;2\u0026#34; failures=\u0026#34;2\u0026#34; errors=\u0026#34;0\u0026#34; skipped=\u0026#34;0\u0026#34;\u0026gt; \u0026lt;testsuite name=\u0026#34;My suite\u0026#34; tests=\u0026#34;2\u0026#34; failures=\u0026#34;2\u0026#34; errors=\u0026#34;0\u0026#34; skipped=\u0026#34;0\u0026#34;\u0026gt; \u0026lt;testcase classname=\u0026#34;no-hardcoded-location\u0026#34; name=\u0026#34;Ln 39 A resource location should not use a hard-coded string or variable value. Please use a parameter value, an expression, or the string \u0026#39;global\u0026#39;. Found: \u0026#39;uksouth\u0026#39; [https://aka.ms/bicep/linter/no-hardcoded-location]\u0026#34; file=\u0026#34;//D:/repos/tuServFakeExternalSystems/Bicep/Shared/Modules/KeyVault.azuredeploy.bicep\u0026#34;\u0026gt; \u0026lt;failure/\u0026gt; \u0026lt;/testcase\u0026gt; \u0026lt;testcase classname=\u0026#34;BCP104\u0026#34; name=\u0026#34;Ln 53 The referenced module has errors.\u0026#34; file=\u0026#34;//D:/myproject/Bicep/Shared/./Main-Shared.azuredeploy.bicep\u0026#34;\u0026gt; \u0026lt;failure/\u0026gt; \u0026lt;/testcase\u0026gt; \u0026lt;/testsuite\u0026gt; \u0026lt;/testsuites\u0026gt; Looking at the task documentation, we can see several problems:\nThe task imports the name attribute as the name of the test. It doesn\u0026rsquo;t understand the file attribute of the testcase element It needs the error message to be a message attribute on the failure element. We need to transform the XML generated by the node task - moving the data around. It needs to look like this:\n\u0026lt;?xml version=\u0026#34;1.0\u0026#34; encoding=\u0026#34;utf-8\u0026#34;?\u0026gt;\u0026lt;testsuites tests=\u0026#34;2\u0026#34; failures=\u0026#34;2\u0026#34; errors=\u0026#34;0\u0026#34; skipped=\u0026#34;0\u0026#34;\u0026gt; \u0026lt;testsuite name=\u0026#34;My suite\u0026#34; tests=\u0026#34;2\u0026#34; failures=\u0026#34;2\u0026#34; errors=\u0026#34;0\u0026#34; skipped=\u0026#34;0\u0026#34;\u0026gt; \u0026lt;testcase name=\u0026#34;no-hardcoded-location\u0026#34;\u0026gt; \u0026lt;failure message=\u0026#34;Ln 39 A resource location should not use a hard-coded string or variable value. Please use a parameter value, an expression, or the string \u0026#39;global\u0026#39;. Found: \u0026#39;uksouth\u0026#39; [https://aka.ms/bicep/linter/no-hardcoded-location] //D:/repos/tuServFakeExternalSystems/Bicep/Shared/Modules/KeyVault.azuredeploy.bicep\u0026#34; /\u0026gt; \u0026lt;/testcase\u0026gt; \u0026lt;testcase name=\u0026#34;BCP104\u0026#34;\u0026gt; \u0026lt;failure message=\u0026#34;Ln 53 The referenced module has errors.\u0026#34; /\u0026gt; \u0026lt;/testcase\u0026gt; \u0026lt;/testsuite\u0026gt; The failure message combines the values of what were name and file, and what was classname is now name.\nTo get the desired output, I decided to use XSLT.\nI actually asked Bing Copilot to generate the XSLT for me, because I hate writing XSLT. Not relevant to this article, but pretty cool - it got it right on the first go!\n\u0026lt;?xml version=\u0026#34;1.0\u0026#34; encoding=\u0026#34;UTF-8\u0026#34;?\u0026gt; \u0026lt;xsl:stylesheet version=\u0026#34;1.0\u0026#34; xmlns:xsl=\u0026#34;http://www.w3.org/1999/XSL/Transform\u0026#34;\u0026gt; \u0026lt;!-- Copy all nodes and attributes by default --\u0026gt; \u0026lt;xsl:template match=\u0026#34;@*|node()\u0026#34;\u0026gt; \u0026lt;xsl:copy\u0026gt; \u0026lt;xsl:apply-templates select=\u0026#34;@*|node()\u0026#34; /\u0026gt; \u0026lt;/xsl:copy\u0026gt; \u0026lt;/xsl:template\u0026gt; \u0026lt;!-- If a failure element exists within a testcase element, set the value of the message attribute of the failure element to the contents of the name attribute of the testcase element concatenated with the file attribute of the testcase element --\u0026gt; \u0026lt;xsl:template match=\u0026#34;testcase/failure\u0026#34;\u0026gt; \u0026lt;xsl:copy\u0026gt; \u0026lt;xsl:attribute name=\u0026#34;message\u0026#34;\u0026gt; \u0026lt;xsl:value-of select=\u0026#34;concat(../@name, \u0026#39; \u0026#39;, ../@file)\u0026#34; /\u0026gt; \u0026lt;/xsl:attribute\u0026gt; \u0026lt;/xsl:copy\u0026gt; \u0026lt;/xsl:template\u0026gt; \u0026lt;!-- Set the value of the name attribute of the testcase element to the value of the classname element of that testcase element --\u0026gt; \u0026lt;xsl:template match=\u0026#34;testcase/@name\u0026#34;\u0026gt; \u0026lt;xsl:attribute name=\u0026#34;name\u0026#34;\u0026gt; \u0026lt;xsl:value-of select=\u0026#34;../@classname\u0026#34; /\u0026gt; \u0026lt;/xsl:attribute\u0026gt; \u0026lt;/xsl:template\u0026gt; \u0026lt;!-- Remove the classname attribute from the testcase element --\u0026gt; \u0026lt;xsl:template match=\u0026#34;testcase/@classname\u0026#34; /\u0026gt; \u0026lt;!-- Remove the file attribute from the testcase element --\u0026gt; \u0026lt;xsl:template match=\u0026#34;testcase/@file\u0026#34; /\u0026gt; \u0026lt;/xsl:stylesheet\u0026gt; A few lines of PowerShell apply the transform to the xml file created by the node module. My task now looks like this:\n- task: AzureCLI@2 displayName: \u0026#39;Lint Bicep files\u0026#39; inputs: azureSubscription: $(azureServiceConnection) scriptType: \u0026#39;ps\u0026#39; scriptLocation: \u0026#39;inlineScript\u0026#39; useGlobalConfig: true inlineScript: | #az bicep install $output = bicep lint ${{parameters.bicepFile}} --diagnostics-format sarif $output | Out-File -FilePath $(Build.SourcesDirectory)\\bicep.sarif -encoding ascii npx -y sarif-junit -i $(Build.SourcesDirectory)\\bicep.sarif -o $(Build.SourcesDirectory)\\bicep-tmp.xml $xslt_file = new-object xml $xslt_file.Load(\u0026#34;$(Build.SourcesDirectory)\\DevOpsPipelines\\junit.xsl\u0026#34;) $xslt = new-object System.Xml.Xsl.XslCompiledTransform $xslt.Load($xslt_file) $xslt.Transform(\u0026#34;$(Build.SourcesDirectory)\\bicep-tmp.xml\u0026#34;, \u0026#34;$(Build.SourcesDirectory)\\bicep.xml\u0026#34;) Our imported test results now look much better:\nJUnit test results showing correctly in Azure DevOps Conclusion # What I thought was going to be a quick job turned into a series of mysteries to solve, but the end result is what I need:\nUse Bicep linting to validate my files and import the results into my Azure DevOps pipeline run as Test Results. Work on a Windows build agent (I also needed to run on a private agent) with no text format issues. Avoid the AZ CLI bug that results in no output from bicep lint. Transform the results to display in a meaningful way in Azure DevOps. Hopefully this post will save others time and pain!\n","date":"5 February 2024","externalUrl":null,"permalink":"/posts/importing-bicep-lint-output-as-test-results-in-azure-devops-pipelines/","section":"Blog","summary":"Bicep is a great improvement over ARM Templates but doesn’t remove the need to validate our code at build time. I could continue to use the ARM-TTK and validate the generated template, but bicep has it’s own built in rules. Getting build errors in a way that can provide meaningful information in my CI/CD tooling is an interesting challenge.","title":"Importing bicep lint output as test results in Azure DevOps pipelines","type":"posts"},{"content":"","date":"6 August 2022","externalUrl":null,"permalink":"/tags/application-insights/","section":"Tags","summary":"","title":"Application-Insights","type":"tags"},{"content":"If you have an application, instrumenting it with something like Application Insights to emit useful data is something I cannot espouse the benefits of enough. As a service, however, Application Insights can offer other benefits, such as Availability Tests to tell you if the application is accessible to your users.\nThe default approach to availability tests is to create cloud-based probes that regularly call your application from different regions of the globe to make sure it responds and assess how long those responses take. But what if your application is on premises, and is not accessible from the outside world (or is in the cloud, but secured from general access)?\nIn this situation, you can create custom availability tests that send data to the Application Insights\u0026rsquo; ingestion endpoint. There is a good deal of documentation on how to this in code with the SDK, and even using PowerShell, referencing the .Net assemblies to create the appropriate objects and call methods to transmit data. I really wanted to avoid that if possible, and simply send data directly to the ingestion API.\nAs with all these things, it\u0026rsquo;s not well documented\u0026hellip;\nThe frustration of documentation # The SDKs for Application Insights are well documented. The raw APIs are not. However, there is documentation on the basic telemetry objects that at least gives us information on what basic data we need.\nFor everything else, there is Fiddler!\nThis post stands on the shoulders of a random thread I found on either the Stack Overflow or Microsoft forums. Annoyingly, I didn\u0026rsquo;t bookmark it, and in true internet fashion I have never been able to find it since. So whilst I had to repeat the investigative work some kind person had already done, I must give credit where it\u0026rsquo;s due and note that this path was trodden before me.\nIn order to see what information we transmit to the ingestion endpoint, I used Fiddler to monitor and inspect the HTTPS traffic that our existing instrumentation sends to the telemetry service. We cover most of the bases - customEvents, customMetrics, traces, requests, and exceptions. However, our existing code does not send availability telemetry.\nTo figure out the AvailabilityData object I referred to the online documentation for Application Insights\u0026rsquo; classes.\nBuild the PowerShell object and send to AppInsights # The PowerShell script calls a web url and then parses the results in order to send the AvailiabilityData payload to Application Insights.\nThe code below is the first part of the script, taking parameters for the Application Insights\u0026rsquo; connection string, a host header for the site I am calling and an FQDN for the host I want to send the request to.\nIn our application, we have several websites hosted with IIS that use host headers, and we have several servers, each of which hosts those sites, which are then load balanced. I need to check that each separate instance of each site is functioning. To do that, the code uses invoke-webrequest to call the FQDN provided to direct the request to the right server, adding a host header to ensure we call the correct website.\nThat call is in a try-catch so that we can grab any exception generated on a failure. I could send that exception to the ingestion endpoint as a separate payload, using the operationId (which we generate as a new GUID for each test) to correlate it to the failed test, but I don\u0026rsquo;t need that for the job at hand.\nWe also have a stopwatch which provides us with the duration of the test.\n[CmdletBinding()] param ( [Parameter(Mandatory = $true)] [string] $ConnectionString, [Parameter(Mandatory = $true)] [string] $HealthCheckTargetHeader, [Parameter()] [string] $HealthCheckTargetFQDN ) $InstrumentationKey = $ConnectionString.Split(\u0026#39;;\u0026#39;)[0].split(\u0026#39;=\u0026#39;)[1] $IngestionEndpoint = $ConnectionString.Split(\u0026#39;;\u0026#39;)[1].split(\u0026#39;=\u0026#39;)[1].trim(\u0026#39;/\u0026#39;) if (!$HealthCheckTargetFQDN) { $HealthCheckTargetFQDN = $HealthCheckTargetHeader } $OperationId = (New-Guid).ToString(\u0026#34;N\u0026#34;); $BaseDataSuccess = $false $Stopwatch = [System.Diagnostics.Stopwatch]::New() $Stopwatch.Start() $OriginalErrorActionPreference = $ErrorActionPreference Try { $ErrorActionPreference = \u0026#34;Stop\u0026#34; # Run test $Response = Invoke-WebRequest -Method \u0026#34;GET\u0026#34; -uri \u0026#34;https://$HealthCheckTargetFQDN\u0026#34; -Headers @{ \u0026#34;Host\u0026#34; = $HealthCheckTargetHeader } -UseBasicParsing $Success = $Response.StatusCode -eq 200; # End test $BaseDataSuccess = $Success $BaseDataMessage = \u0026#39;passed\u0026#39; } Catch { # Submit Exception details to Application Insights $BaseDataMessage = $_.Exception.Message } Finally { $Stopwatch.Stop() $BaseDataDuration = $Stopwatch.ElapsedMilliseconds $BaseDataTimestamp = [DateTimeOffset]::UtcNow $ErrorActionPreference = $OriginalErrorActionPreference } The second part of the script takes the results of the web call and creates a custom powershell object that matches the required object structure, then converts that to json so we get the payload to send, and then invoke-webrequest calls the ingestion URL with that payload.\nI\u0026rsquo;m including some custom properties to help me process the availability data in my own analytics queries. The Tag of ai.cloud.roleInstance ensures that I also have the cloud_roleInstance field in the data which is also useful for cusom queries.\nOtherwise, each test needs a name (I use the host header of the site I\u0026rsquo;m calling), a pass/fail success field, a location for where the test was executed (for the default tests this would be a region but I use the server name which is the same as cloud_roleInstance), the duration of the test (how long did the web call take) and a message (intended to contain the error if the test failed).\n$tags = New-Object PSObject Add-Member -InputObject $tags -NotePropertyName ai.cloud.roleInstance -NotePropertyValue $runLocation $properties = New-Object PSObject Add-Member -InputObject $properties -NotePropertyName Target -NotePropertyValue $HostHeader Add-Member -InputObject $properties -NotePropertyName UrlPath -NotePropertyValue $UrlPath Add-Member -InputObject $properties -NotePropertyName Host -NotePropertyValue $runLocation Add-Member -InputObject $properties -NotePropertyName Source -NotePropertyValue $runLocation $metrics = New-Object PSObject # Add-Member -InputObject $properties NoteProperty propName \u0026#39;propValue\u0026#39; $basedata = New-Object PSObject Add-Member -InputObject $basedata -NotePropertyName ver -NotePropertyValue 2 Add-Member -InputObject $basedata -NotePropertyName name -NotePropertyValue $Name Add-Member -InputObject $basedata -NotePropertyName id -NotePropertyValue $OperationId Add-Member -InputObject $basedata -NotePropertyName runLocation -NotePropertyValue $runLocation Add-Member -InputObject $basedata -NotePropertyName success -NotePropertyValue $BaseDataSuccess Add-Member -InputObject $basedata -NotePropertyName message -NotePropertyValue $BaseDataMessage Add-Member -InputObject $basedata -NotePropertyName duration -NotePropertyValue $BaseDataDuration Add-Member -InputObject $basedata -NotePropertyName properties -NotePropertyValue $properties Add-Member -InputObject $basedata -NotePropertyName metrics -NotePropertyValue $metrics $data = New-Object PSObject Add-Member -InputObject $data -NotePropertyName baseType -NotePropertyValue \u0026#39;AvailabilityData\u0026#39; Add-Member -InputObject $data -NotePropertyName baseData -NotePropertyValue $basedata $body = New-Object PSObject Add-Member -InputObject $body -NotePropertyName name -NotePropertyValue \u0026#39;Microsoft.ApplicationInsights.Event\u0026#39; Add-Member -InputObject $body -NotePropertyName time -NotePropertyValue $($BaseDataTimestamp.ToString(\u0026#39;o\u0026#39;)) Add-Member -InputObject $body -NotePropertyName iKey -NotePropertyValue $InstrumentationKey Add-Member -InputObject $body -NotePropertyName tags -NotePropertyValue $tags Add-Member -InputObject $body -NotePropertyName data -NotePropertyValue $data # Convert the object to json $sendbody = ConvertTo-Json -InputObject $body -Depth 5 Write-Output \u0026#34;Sending data to ApplicationInsights\u0026#34; Invoke-WebRequest -Uri \u0026#34;$IngestionEndpoint/v2/track\u0026#34; -Method \u0026#39;POST\u0026#39; -UseBasicParsing -body $sendbody Application Insights Payloads # Included below are the other payload types I\u0026rsquo;ve tried, courtesy of Fiddler and the wider internet.\nEvent JSON payload # { \u0026#34;name\u0026#34;: \u0026#34;Microsoft.ApplicationInsights.Event\u0026#34;, \u0026#34;time\u0026#34;: \u0026#34;2022-08-06T00:00:00.0000000Z\u0026#34;, \u0026#34;iKey\u0026#34;: \u0026#34;[MyInstrumentationKey]\u0026#34;, \u0026#34;tags\u0026#34;: { }, \u0026#34;data\u0026#34;: { \u0026#34;baseType\u0026#34;: \u0026#34;EventData\u0026#34;, \u0026#34;baseData\u0026#34;: { \u0026#34;ver\u0026#34;: 2, \u0026#34;name\u0026#34;: \u0026#34;SampleEvent\u0026#34;, \u0026#34;properties\u0026#34;: { \u0026#34;property1\u0026#34;: \u0026#34;value 1\u0026#34;, \u0026#34;property2\u0026#34;: \u0026#34;value 2\u0026#34;, \u0026#34;property1\u0026#34;: \u0026#34;value 3\u0026#34; } } } } Message JSON payload # For the payload below, severityLevel is an integer field. The following table shows the integer values and corresponding text labels:\nseverityLevel Label 0 Verbose 1 Information 2 Warning 3 Error 4 Critical { \u0026#34;name\u0026#34;: \u0026#34;Microsoft.ApplicationInsights.Event\u0026#34;, \u0026#34;time\u0026#34;: \u0026#34;2022-08-06T00:00:00.0000000Z\u0026#34;, \u0026#34;iKey\u0026#34;: \u0026#34;[MyInstrumentationKey]\u0026#34;, \u0026#34;tags\u0026#34;:{ }, \u0026#34;data\u0026#34;: { \u0026#34;baseType\u0026#34;: \u0026#34;MessageData\u0026#34;, \u0026#34;baseData\u0026#34;: { \u0026#34;ver\u0026#34;: 2, \u0026#34;message\u0026#34;: \u0026#34;Simple Trace Log Message\u0026#34;, \u0026#34;severityLevel\u0026#34;: 2, \u0026#34;properties\u0026#34;: { \u0026#34;property1\u0026#34;: \u0026#34;value 1\u0026#34;, \u0026#34;property2\u0026#34;: \u0026#34;value 2\u0026#34;, \u0026#34;property1\u0026#34;: \u0026#34;value 3\u0026#34; } } } } Metric JSON payload # { \u0026#34;name\u0026#34;: \u0026#34;Microsoft.ApplicationInsights.Event\u0026#34;, \u0026#34;time\u0026#34;: \u0026#34;2022-08-06T00:00:00.0000000Z\u0026#34;, \u0026#34;iKey\u0026#34;: \u0026#34;[MyInstrumentationKey]\u0026#34;, \u0026#34;tags\u0026#34;: { }, \u0026#34;data\u0026#34;: { \u0026#34;baseType\u0026#34;: \u0026#34;MetricData\u0026#34;, \u0026#34;baseData\u0026#34;: { \u0026#34;ver\u0026#34;: 2, \u0026#34;metrics\u0026#34;: [ { \u0026#34;name\u0026#34;: \u0026#34;BasicMetric\u0026#34;, \u0026#34;kind\u0026#34;: \u0026#34;Measurement\u0026#34;, \u0026#34;value\u0026#34;: 42 } ], \u0026#34;properties\u0026#34;: { \u0026#34;property1\u0026#34;: \u0026#34;value 1\u0026#34;, \u0026#34;property2\u0026#34;: \u0026#34;value 2\u0026#34;, \u0026#34;property1\u0026#34;: \u0026#34;value 3\u0026#34; } } } } Exception JSON payload # { \u0026#34;name\u0026#34;: \u0026#34;Microsoft.ApplicationInsights.Event\u0026#34;, \u0026#34;time\u0026#34;: \u0026#34;2022-08-06T00:00:00.0000000Z\u0026#34;, \u0026#34;iKey\u0026#34;: \u0026#34;[MyInstrumentationKey]\u0026#34;, \u0026#34;tags\u0026#34;: { }, \u0026#34;data\u0026#34;: { \u0026#34;baseType\u0026#34;: \u0026#34;ExceptionData\u0026#34;, \u0026#34;baseData\u0026#34;: { \u0026#34;ver\u0026#34;: 2, \u0026#34;handledAt\u0026#34;: \u0026#34;UserCode\u0026#34;, \u0026#34;properties\u0026#34;: { \u0026#34;property1\u0026#34;: \u0026#34;value 1\u0026#34;, \u0026#34;property2\u0026#34;: \u0026#34;value 2\u0026#34;, \u0026#34;property1\u0026#34;: \u0026#34;value 3\u0026#34; }, \u0026#34;exceptions\u0026#34;: [ { \u0026#34;id\u0026#34;: 12345678, \u0026#34;typeName\u0026#34;: \u0026#34;System.Exception\u0026#34;, \u0026#34;message\u0026#34;: \u0026#34;My exception message\u0026#34;, \u0026#34;hasFullStack\u0026#34;: true, \u0026#34;parsedStack\u0026#34;: [ { \u0026#34;level\u0026#34;: 0, \u0026#34;method\u0026#34;: \u0026#34;Console.Program.Main\u0026#34;, \u0026#34;assembly\u0026#34;: \u0026#34;Console, Version=1.0\u0026#34;, \u0026#34;fileName\u0026#34;: \u0026#34;/MyApp/program.cs\u0026#34;, \u0026#34;line\u0026#34;: 1 } ] } ] } } } AvailabilityTest JSON payload # { \u0026#34;name\u0026#34;: \u0026#34;Microsoft.ApplicationInsights.Availability\u0026#34;, \u0026#34;time\u0026#34;: \u0026#34;2022-08-06T00:00:00.0000000Z\u0026#34;, \u0026#34;iKey\u0026#34;: \u0026#34;[MyInstrumentationKey]\u0026#34;, \u0026#34;tags\u0026#34;: { }, \u0026#34;data\u0026#34;: { \u0026#34;baseType\u0026#34;: \u0026#34;AvailabilityData\u0026#34;, \u0026#34;baseData\u0026#34;: { \u0026#34;ver\u0026#34;: 2, \u0026#34;name\u0026#34;: \u0026#34;SampleAvailability\u0026#34;, \u0026#34;duration\u0026#34;: \u0026#34;timespan\u0026#34;, \u0026#34;runlocation\u0026#34;: \u0026#34;UK\u0026#34;, \u0026#34;success\u0026#34;: true, \u0026#34;message\u0026#34;: \u0026#34;error message\u0026#34;, \u0026#34;properties\u0026#34;: { \u0026#34;property1\u0026#34;: \u0026#34;value 1\u0026#34;, \u0026#34;property2\u0026#34;: \u0026#34;value 2\u0026#34;, \u0026#34;property1\u0026#34;: \u0026#34;value 3\u0026#34; }, \u0026#34;metrics\u0026#34;: [ { \u0026#34;name\u0026#34;: \u0026#34;BasicMetric\u0026#34;, \u0026#34;kind\u0026#34;: \u0026#34;Measurement\u0026#34;, \u0026#34;value\u0026#34;: 42 } ] } } } ","date":"6 August 2022","externalUrl":null,"permalink":"/posts/calling-application-insights-api-using-powershell/","section":"Blog","summary":"If you have an application, instrumenting it with something like Application Insights to emit useful data is something I cannot espouse the benefits of enough. As a service, however, Application Insights can offer other benefits, such as Availability Tests to tell you if the application is accessible to your users.","title":"Calling Application Insights API using Powershell","type":"posts"},{"content":"BizTalk 2020 allows you to connect it to an Application Insights instance, where it will send tracking data as customEvents so you see what\u0026rsquo;s going on. However, getting it working in an environment where security is important and the network team want to open the fewest paths through the firewall as possible is an exercise in patience. This blog post is as much aide memoire for me as an information post for you.\nAnnoying GUIs 101 # The first issue you\u0026rsquo;ll come across is the dialog for connecting BizTalk to Application Insights. It has a text box, so you expect to be able to simple paste your InstrumentationKey in there and call it done, right? Wrong! This part of the documentation isn\u0026rsquo;t kidding when it makes you step through a whole bunch of stages, and that\u0026rsquo;s where the first issues kick in.\nI suppose it makes sense - you can either configured telemetry into Application Insights or into Event Hubs, and the GUI lets you do both. In the background it puts the config into an SSO Application (which you can\u0026rsquo;t see or edit), so why bother with the useless text box?\nThe problem here is that you need to authenticate against Azure AD, then it lists your subscriptions, and then the resource groups, and finally the Application Insights instance. That means talking to both the Azure AD authentication services and the Azure Admin API. The good news is that you can turn that access off once configured.\nWhither goes my data? # The second issue is that BizTalk doesn\u0026rsquo;t appear to find the appropriate ingestion endpoint for the App Insights instance. This is the part that really consumed my time. I\u0026rsquo;m assuming that it reads the IngestionKey from the instance in Azure but not the connection string. In our customer\u0026rsquo;s environment we had AppInsights deployed to UK South and opened firewall ports for the address range in the UK (more on that in a bit) but no data flowed. After a while poking around with their team and their hardware edge device, I decided to build a lab so I could figure out what was happening.\nTo do that, I downloaded pfSense and create a virtual machine that could sit between my BizTalk test rig and the internet. That allowed me to replicate the rules my customer had already created, monitor the traffic flowing from BizTalk and find the correct (and smallest) list of Azure services and addresses I needed to open access for.\nTo figure out the rules we needed, our initial work had begun with the Azure Monitor IP Address documentation. The networks team at my customer told me their device automatically updated address blocks from the Azure json file that you can find referenced on that page. I needed to download the file in order to create my firewall rules.\nTo cut to the chase, the end result of my investigations shows that BizTalk is sending it\u0026rsquo;s telemetry to North Europe, even though the AppInsights instance is in UK South. To find that, I began by including the UK South monitor addresses in my rule. When that failed I went big and included all the monitor addresses globally, which worked. Checking the connections showed me that it was talking to an address in the North Europe range, so I could then restrict to just that address range.\nWhat does this mean # If you are in a regulated environment or your customer is keen on security and restricting where data flows, this is a Big Thing. For my customer, having data flowing out to Dublin then back across the Azure network to UK South is acceptable, but it limits what we can send. For some customers this kind of behaviour would be a show-stopper.\nUltimately, the BizTalk team need to update their code to use the cConnection string for the Application Insights instance. That clearly denotes the ingestion endpoint, which is most definitely in the same region as the instance. With the best will in the world, however, this can only be done within their update cycle so it\u0026rsquo;s unlikely to be quick (yes, I have passed all my investigations and findings to the team and in fairness to them they use the AppInsights SDK and followed the recommended practices in place when they wrote the code).\n","date":"6 August 2022","externalUrl":null,"permalink":"/posts/firewall-rules-for-biztalk-2020-application-insights-telemetry/","section":"Blog","summary":"BizTalk 2020 allows you to connect it to an Application Insights instance, where it will send tracking data as customEvents so you see what’s going on. However, getting it working in an environment where security is important and the network team want to open the fewest paths through the firewall as possible is an exercise in patience. This blog post is as much aide memoire for me as an information post for you.","title":"Configuring BizTalk 2020 Application Insights telemetry behind a firewall","type":"posts"},{"content":"","date":"6 August 2022","externalUrl":null,"permalink":"/tags/powershell/","section":"Tags","summary":"","title":"Powershell","type":"tags"},{"content":"","date":"22 September 2018","externalUrl":null,"permalink":"/tags/azure-stack/","section":"Tags","summary":"","title":"Azure-Stack","type":"tags"},{"content":"Microsoft Azure Stack is a truly unique beast in terms of the capabilities it can bring to an organisation, and the efficiencies it can bring to a project that spans Public Cloud and on-premises infrastructure through it’s consistency with public Azure.\nWe’ve been using Stack in anger for a customer project for a year now and have learned several things about development and testing, and how to configure the ASDK to be an effective tool to support the project. This post will summarise those learnings and how I deploy the ASDK so you may mirror our approach for your own projects.\nLearning 1: Cloud-consistent, but not quite # Azure Stack is great in that you use the exact same technologies to develop and deploy as its big brother. However, there are some nuances that we’ve hit. Stack lags behind Azure in API versions and provides a subset of Resource Providers. Whilst it is possible to configure your Azure subscription to the same API versions as Stack using policies, that’s not a guarantee of compatibility. In our project a partner org has been using Azure with those policies applied, but they still managed to update the language-specific SDKs for Storage beyond those supported by Stack. You need to be very watchful about version support, and our experience is that there is no replacement for using Stack as part of your pre-production testing effort.\nLearning 2: Performance may vary # This one is obvious, if you think about it. Stack is built on different infrastructure than Public Azure because we don’t get things like FPGA-accelerated networking, for example. That means you need to performance test your stuff on Stack or you may be upset that it doesn’t meet the stats you got from Azure. Don’t get me wrong – we’ve put some very big load on both single-box ASDK and multi-node MAS during our project, but stuff like VM provisioning times, network performance and storage read/write times are different than production Azure and if your solution relies on this stuff you need to load test on your target environment.\nLearning 3: Identity, identity, identity # Stack can be configured in connected or disconnected modes and that is a big, fundamental different you need to be aware of. In connected mode you use Azure AD for a single source of identity across your Stack and Azure subscriptions. With disconnected mode you are using ADFS to connect Stack to an Active Directory. The key difference is if you are using Service Principals – in disconnected mode you can only do certificate authentication. This is supported on Azure but not the default. Our approach has been (since our project is disconnected) to do all our dev in an ASDK for absolute confidence of compatibility but with careful governance you could use public Azure. The key difference is that with the ASDK you create a service principal using PowerShell and the certificate gets created at that point for you to extract. With public Azure you need to create the cert first and provide it when creating and service principal.\nLearning 4: ‘D’ is for Demo, not Dev; at least out-of-the-box # The ASDK is a wonderful thing. It’s easy to download and deploy a single-node version of Stack for testing. However, the installer delivers the system in a bubble. To use it you have to RDP into the host to access the portal and mess around with VPNs. Connecting to your CI/CD tool of choice (we use VSTS) is hard verging on impossible and at the very least active use for development is impractical.\nYou also have to content with the fact that the ASDK is built on evaluation media, and that you can’t upgrade it from version to version. I have no argument as to why this is – you shouldn’t be able to use the dev kit as a cheap way of getting Stack into your prod environment, but it means that if you want to use the ASDK for development you need to roll your sleeves up a bit… More on that in a moment.\nLearning 5: Matt McSpirit Rocks! # For a long time I kept thinking that I should collect the ragtag bunch of PowerShell I used to deploy our ASDK each month into something resembling a usable solution and publish it. Then Matt McSpirit released ConfigASDK and I no longer needed to! If you use ASDK at all, then you need Matt’s Script because it makes post-install configuration an absolute breeze!\nEffective Deployment 1: Hacking the Installer # We now have more than one ASDK and I need to rebuild each one pretty much monthly. That means streamlining the process. To do that, I convert the downloaded VHD to a WIM and we import it into our Config Manager deployment so I can use PXE to easily reimage the servers. Once that’s done I can clear down the storage spaces left over from the previous install and rebuild. I need the ASDKs to be on our network, so I assign a /16 network range for each Stack as well as assigning an IP on our main subnet to the host. I also modify the deployment scripts so I can use a custom region and external DNS suffix which allows us to access the ASDKs over DirectAccess – handy for when we’re working on site with our customer.\nTo do all this I loosely follow the documentation to deploy using PowerShell.\nReconfigure Network Ranges # The networking for the ASDK is all configured from the OneNodeCustomerConfigTemplate.xml file that is in c:\\CloudDeployment\\Configuration. I simply open that file and replace all occurances of 192.168. with my own /16 IPv4 range (e.g. 10.1.). That will give you an ASDK with several address ranges and importantly, a full /24 block of IP addresses for services (storage endpoints, Public IP Addresses, etc) that can sit on your network.\nYou’ll need to configure your own network to publish the route into that /16 address range, with an IP address on your own network the gateway address – we’ll assign this to the VM in stack that does the networking during the installation.\nReconfigure Region and ExternalDomainSuffix # When you deploy AzureStack it will create an AD called Azurestack.local that the infrastructure VMs will join, including the host. You will also find that the portal, admin portal and services are published on a DNS domain of local.azurestack.external. In that domain, ‘local’ is the region and ‘azurestack.external’ is the external domain suffix. Understandably, for a dev/demo deployment these are not exposed to you as things you can change. However, changing them is actually pretty easy when you know where to look.\nWhen you run the InstallAzureStackPOC.ps1 command, it actually calls the DeploySingleNode.ps1 script that is in c:\\clouddeployment\\setup and if you open that script you’ll find that there are parameters called RegionName and ExternalDomainSuffix and both these params have default values. Simply open that file in an editor and change them. Line 143 contains the $RegionName parameter with a default of ‘local’ so I change that to be the name of my ASDK host; line 130 contains the $ExternalDomainSuffix parameter with a default of ‘azurestack.local’ so I change that to stack..\nThis approach means that I end up with all the ASDKs within stack.mydomain.local, with the name of the host being the region – that’s a good logical approach as far as I and my team are concerned!\nNow, doing that isn’t quite all you need to do. Just like with the network routing requirement, you have to get the DNS requests to the Azure Stack DNS or nothing will work. If you follow my approach for the network address range, then the next step is to create some delegated subdomains in your internal DNS. We are using Windows Server and our internal DNS is linked to our AD, so the steps are as follows:\nOpen the DNS console on your DC. Within your internal domain, create a HOST record for the stack DNS. I normally call mine stackdns. because I have more than one. Assuming you’re done the neworking changes like me, the IP address for that is \u0026lt;your /16 subnet\u0026gt;.200.67 (e.g. 10.1.200.67). Within your internal domain create a subdomain of your internal domain called ‘stack’. Within that stack subdomain, right-click and select New Delegation. In the dialog that pops up enter the name you specified as the RegionName and then when asked for a DNS FQDN enter the hostname you just registered. If you are using App Services you also need to create a delegation for their domain – .cloudapp.. Simply create another subdomain within stack called cloudapp and then repeat the previous step to register the delegation. Once you’ve configured your internal network and DNS, then modified the config file and script you can perform the installation. When doing so, make sure that in the parameters of the InstallAzureStackPOC.ps1 you specify the NatIPv4Address parameter as the IP address you set in your routing configuration to be the IP address you used in your network router configuration.\nEffective Deployment 2: Removing the NAT # This bit hasn’t changed since the preview releases and I follow the notes on the AzureStack blog post. Once the ASDK install completes I simply run a short script that contains the powershell at the end of that post to remove the NAT, at which point that VM sits on my internal network with the IP address I set in the deployment and have configured in my router and traffic just flows.\nEffective Deployment 3: ConfigASDK # Matt’s ConfigASDK script is excellent, an I use this to configure our ASDKs post-install. The script will deploy additional resource providers for you (SQL, MySQL and AppServices), install handy utils on the host and pull down a bunch of marketplace offerings you’ll find helpful. For our project we are not using the SQL and MySQL RPs so I skip those, along with the host customisation part.\nNow, Matt’s script is built with the Stack team and as such doesn’t currently support the hacks for region and external DNS. I have a fork of the repo in my GitHub where I have added the RegionName and ExternalDomainSuffix params to Matt’s script, but that may not be up to date so you should look at what I’ve done and proceed with caution. I had to put a bunch of code in to replace what were understandably-fixed URLs. However, once I’d done that all Matt’s code worked as expected.\nUsual disclaimers apply – use my version of Matt’s script at your own risk. make sure you understand the implications of what I’m describing here before you do this on your own network!\nPost-Deployment Configuration Tips # Once you’ve got your ASDK up and running there are still a couple of things you should tweak for a happier time, particularly if you batter the thing as much as we do in terms of creation and deletion of resources and load testing.\nXrp VM RAM # Something you can do with ASDK but not with MAS is get at the VMs that form the fabric of Stack. In an ASDK these are not resilient and are smaller in config than their production counterparts. Our experience is that one of them does not have enough RAM configured by default. The AzS-Xrp01 VM is create with 8192MB of RAM. We see it’s demand climb well beyond this in use and as it does, you may see storage failure messages when trying to create accounts, access the storage APIS or blades in the portal. I give it another 4GB – increasing it to 12288MB in total and that seems to sort it. You don’t need to turn off the VM to do this – just go into Hyper-V Manager and increase the amount.\nApp Services ScaleSets # As of 1808 you can do this in the portal rather than through PowerShell. When App Services is installed there are a number of VM scalesets created that contain the VMs that host the App Hosting Plans. The thing is, the App Services team don’t know what you need, so the deploy with a single Shared worker tier VM and none in the other tiers. You need to go into the portal and change the instance count to an appropriate number for your project. I normally scale back Shared to zero and set the Small scaleset to a reasonable number based on the project. I also set the Management scaleset to to two instances. I’ve found that makes for a more reliable system, again, because we tend to batter our ASDK during development.\nParting thoughts # Please remember that the approach I describe here is not the way the Stack team expect you to deploy an ASDK. You need to have a reasonable understanding of networking and DNS to know the implications of what I change in my approach to deployment. Also bear in mind that Stack releases monthly updates so if you’re reading this in a year’s time, stuff might have changed so be careful.\nAzure Stack is a very powerful solution for a very specific set of customer requirements – it’s not designed to be something everybody should use and you need to remember that. If you do have requirements that fit, hopefully this post will help you configure your ASDK to be a useful component in your development approach.\n","date":"22 September 2018","externalUrl":null,"permalink":"/posts/deploying-the-asdk-for-effective-development-use/","section":"Blog","summary":"Microsoft Azure Stack is a truly unique beast in terms of the capabilities it can bring to an organisation, and the efficiencies it can bring to a project that spans Public Cloud and on-premises infrastructure through it’s consistency with public Azure.\n","title":"Deploying the ASDK for effective development use","type":"posts"},{"content":"A pull request for Chris Gardner\u0026rsquo;s WebApplicationProxyDSC is now inbound after a frustrating week of trying to automate the configuration of ADFS and WAP on a Server 2016 lab.\nWith Server 2016, the PowerShell commands to configure the ADFS and WAP servers include switches to specify a non-default port. I need to do this because the servers are behind a NetNat on a server hosting several labs, so port 443 is not available to me and I must use a different port.\nThis should be simple: Specify the SSLPort switch on the Install-ADFSFarm command and the HttpsPort on the Install-WebApplicationProxy command. However, when I do that, the WAP configuration fails with an error that it cannot read the FederationMetadata from the proxy.\nI tried all manner of things to diagnose why this was failing and in the end, the fix is a crazy hack that should not work!\nThe proxy installation, despite accepting the custom port parameter, does not build the URLs correctly for the ADFS service, so is still trying to call port 443. You can set these URLs on a configured WAP service using the Set-WebApplicationProxyConfiguration command. However, when you run this command with no configured proxy, it fails.\nOr so you think\u0026hellip;\nOn the ADFS Server:\nInstall-AdfsFarm specifiying the CertificateThumbprint, Credential, FederationServiceDisplayName, FederationServiceName and SSLPort params On the WAP Server:\nInstall-WebApplicationProxy specifiying the HttpsPort switch, CertificateThumbprint, FederationServiceName and FederationServiceTrustCredential params. Set-WebApplicationProxyConfiguration specifying the ADFSUrl, OAuthAuthenticationURL and ADFSSignOutURL parameters with the correct URLs for your ADFS server (which include the port in the Url). Re-run the command in step 1. Despite the fact that step 2 says it failed, it seems to set enough information for step 3 to succeed. My experience, however, is that only doing steps 2 and 3 does not work. Weird!\nAs a side note, testing this lot is a lot easier if you remember that the idpinitiatedsignon.aspx page we all normally use for testing ADFS is disabled by default in Server 2016. Turn it on with Set-AdfsProperties -EnableIdPInitiatedSignonPage $true\n","date":"24 August 2018","externalUrl":null,"permalink":"/posts/configure-server-2016-adfs-and-wap-with-custom-ports-using-powershell/","section":"Blog","summary":"A pull request for Chris Gardner’s WebApplicationProxyDSC is now inbound after a frustrating week of trying to automate the configuration of ADFS and WAP on a Server 2016 lab.\nWith Server 2016, the PowerShell commands to configure the ADFS and WAP servers include switches to specify a non-default port. I need to do this because the servers are behind a NetNat on a server hosting several labs, so port 443 is not available to me and I must use a different port.\n","title":"Configure Server 2016 ADFS and WAP with custom ports using Powershell","type":"posts"},{"content":"","date":"24 August 2018","externalUrl":null,"permalink":"/tags/desired-state-configuration/","section":"Tags","summary":"","title":"Desired-State-Configuration","type":"tags"},{"content":"","date":"24 August 2018","externalUrl":null,"permalink":"/tags/dsc/","section":"Tags","summary":"","title":"Dsc","type":"tags"},{"content":"","date":"24 August 2018","externalUrl":null,"permalink":"/tags/windows-server/","section":"Tags","summary":"","title":"Windows Server","type":"tags"},{"content":"","date":"24 August 2018","externalUrl":null,"permalink":"/tags/windows-server-2016/","section":"Tags","summary":"","title":"Windows-Server-2016","type":"tags"},{"content":"","date":"2 March 2017","externalUrl":null,"permalink":"/tags/azure-resource-manager/","section":"Tags","summary":"","title":"Azure Resource Manager","type":"tags"},{"content":" Using Lability, DSC and ARM to define and deploy multi-VM environments # Configuration as code crops up a lot in conversation these days. We are searching for that DevOps Nirvana of a single definition of our environment that we can deploy anywhere.\nThe solution adopted at Black Marble by myself and my colleagues is not quite that, but it comes close enough to satisfy our needs. This document details the technologies and techniques we adopted to achieve our goal, which sounds simple, right?\nI want to be able to deploy a collection of virtual machines to my own computer using Hyper-V, to Dev/Test Labs in Azure, and to Azure Stack, using the same description of those virtual machines and their configuration.\nDefining Our Platforms # Right now, we use Lab Manager (part of Team Foundation Server) at Black Marble to manage multi-VM environments for testing, hosted on a number of servers managed by System Center Virtual Machine Manager. Those labs are composed of virtual machines that can also be deployed to a developer’s workstation.\nThe issue is that those environments are pre-built – the machines are configured and the environment saved as a whole. They must be patched when a new lab is created from the stored ‘template’ VMs and adding a new machine to the lab is a pain.\nLab Manager itself is now a end-of-life, so we are looking at alternatives (including Azure Stack – see below).\nMicrosoft Azure # We already use Azure to host virtual machines. However, even with the lower cost Dev/Test subscription type, running lots of machines in the public cloud can get very expensive.\nAzure Dev/Test Labs helps to mitigate this cost issue somewhat by providing a governance wrapper. I can create a Lab and apply rules, such as what types of virtual machine can be created, and automatically shut down running VMs at a set time to limit costs.\nWithin Azure we use Azure Resource Templates, which are JSON declarations of the services we require, to deploy our virtual machines. Once running, we have extensions that can be injected into a VM and used to execute scripts to configure them. With Windows servers, that means using the Desired State Configuration (DSC) extension.\nDev/Test labs allows me to connect to a Git repository of artefacts. Those artefacts could be items I wish to install into a VM, but they can also be ARM templates to deploy complex environments of multiple VMs. Those ARM templates can then apply DSC configuration definitions to the VMs themselves.\nMicrosoft Azure Stack # Stack is coming soon. Right now, you can download a Technical Preview that runs on a single machine. Stack is aimed at organisations that have stuff they cannot put in the public cloud, for whatever reason, but want a consistent approach to their development that can span private and public cloud. The final form of Stack is expected to be similar to the current Cloud Platform Solution (CPS), which is way out of my budget. However, the POC runs on a server very close in specification and price point to my existing Lab Manager-controlled servers.\nStack aims to deliver parity with its public cloud older brother. That means that I can use the same ARM templates I use in Azure to deploy my IaaS services on Stack. I have the same DSC extension to inject my configuration, too.\nWhat I don’t have right now on Stack (and it’s unclear what the final product will bring, so I won’t speculate) are the base operating system images that are provided by Microsoft in Azure. I can, however, create my own images and upload them to the internal Stack equivalent of the Azure Marketplace.\nHyper-V # On our desktops, laptops, and servers we use Hyper-V, Microsoft’s virtualisation technology. This offers some parity with Azure – it uses the same VHD disk file format, for example. I don’t get the same complex software-defined-networking but I still get virtual switches to which I can connect machines, and they can be private, internal, or external.\nPrivate switches do what they say on the tin: They are a bubble within which my VMs can communicate with each other but not with the outside world. I can, therefore, have multiple identical bubbles all using the same IP address ranges without issue.\nExternal switches are connected directly to a network adapter on the host. That’s really useful if I need to host servers that deliver services to my organisation, as I need to communicate with them directly. This is great on servers, and is useful on developer workstations with physical NICs. On laptops, however, it gets tricky if you’re using a WiFi network. Those were never designed with VMs in mind, and the way Windows connects an external switch to a wireless adapter is, quite frankly, a horrible kludge and I’ve always found it terribly unreliable.\nInternal switches create a new virtual NIC on the host so it can communicate directly with VMs on the network. In Windows 10, we can use an internal switch alongside a NetNat, which allows Windows 10 to provide network address translation for the virtual network. This gives us a setup like your home internet – VMs can communicate out but there are no direct inbound connection allowed (yes, I know you can create NAT publishing rules too, but that’s not a topic for here).\nOne cool thing about a NetNat is that if you carefully define your IP address ranges, a single NetNat can pass traffic into the networks generated by multiple virtual switches. This allows me to have multiple environments that can coexist on separate subnets.\nLability # I’ve saved this until last because it’s sort of the secret sauce in what we’ve been working on. I stumbled on Lability totally by chance, and random internet searching. It’s an open source solution to defining and deploying VMs on Windows using DSC to declare both the configuration of the environment (the VMs and their settings) and the VMs themselves (the guest OS configuration).\nLability was created by a chap called Iain Brighton and he deserves a great deal of credit for what he’s built.\nWith Lability, I can use the same DSC configurations that I created for my Azure deployments. I can use the same base VHD images that I need for my Azure Stack Deployments. Lability uses a DSC PowerShell file (.ps1), which can include configurations for multiple nodes – each of the VMs in our environment. It then uses a PowerShell Data file (.psd1) to declare the configuration of the VMs themselves (CPU, RAM, virtual switch etc) as well as pass in configuration details to the DSC file.\nIf you look at the Lability repo on GitHub you will find links to some excellent articles by people who have used Lability and take you through setting up your Lability Host (your computer) and your first environment.\nIdentifying Differences # Applying DSC # Lability and the Azure DSC extension work in a subtly but importantly different manner. When you create a DSC configuration, you write a PowerShell configuration which imports DSC Resources that will do the actual configuration work and you call those resources with specified values that declare the state of the configuration you want. Within that PowerShell file you can put functions that figure out some of those values.\nWhen you execute the PowerShell configuration, it runs through that script and generates a MOF file. That file is submitted to the DSC engine on the machine that you are configuring and used to pass parameters into the DSC Resources that are going to execute commands to apply your configuration.\nWhen you use the DSC extension in Azure, it installs the necessary DSC resources on the VM and executes the PowerShell file on that machine, generating the MOF which is then applied.\nWhen you use Lability, the PowerShell file is executed on the host machine and outputs the MOF files – you do this manually before executing a Lability command to create a new lab. Lability then takes care of injecting the MOF and the required DSC resources into the virtual machine, where the configuration is applied.\nThis is a critical difference! If you look at the examples in the Azure Quickstart Repo, all the DSC is written assuming that it is executed on the host, and uses PowerShell functions to do things like finding the network adapter, or the host IP address etc. If you look at the examples used in Lability labs, the data file provides many of those pieces of information. If you run the PowerShell from an Azure QuickStart template you’ll have some crazy failures, because all those functions execute on the host and therefore get totally incorrect information to pass to the configuration code.\nAdditionally, none of the Azure examples use a data file to provide configuration data. You might think this is because the data file is not supported. However, this is not true – you can pass a data file in using the DSC extension. Lability makes heavy use of that data file to define our environment.\nNetworking # In Azure, you cannot set a static IP address from within the VM itself. The networking fabric hands the machine its IP address via DHCP. You can set that IP to be static through the Azure fabric, but not through the VM. That might mean that we don’t know the IP address of a machine before we deploy it.\nWith Lability, we declare the IP address of the VM in the DSC data file. We could use a DHCP server running on the host, and I do just that myself, but it’s more stuff to install and manage, and for our approach to labs right now we’ve stuck to declaring address in the DSC data file.\nWe also have additional stuff to think about in Azure – public IP addresses, Network Security Groups and possibly User Defined Routing that controls how (and if) we allow inbound traffic from the internet onto our network, what can talk to what and on which ports within our network, and whether we want to push all traffic through appliances for security.\nAzure API Versions # When you write an ARM template to define and deploy your services, each of the resources in that template is defined against a versioned API. You specify which API version you are using in the template, and different resource providers have different versions.\nAzure Stack dos not have all the same versions of the various APIs that are in Azure. Ironically, whilst I have had to make few changes to existing ARM templates in terms of their content in order to successfully use them on Stack, I’ve had to change almost every API version referenced in them. Having said that, I am finding that the API versions I reference for Stack by and large work unchanged if I throw the template at Azure.\nDeclaring Specific Goals # We’ve discussed our target platforms and talked about how those differ in terms of our deployment configurations. Let’s talk about what our aims were as we embarked on our project to manage VM labs:\nAll labs should deploy from greenfield. One of our biggest pain points with our old approach was that our labs were built as a collection of VMs. We couldn’t change the name of the AD domain; changing IP address was complex; adding new VMs was painful; patching a ‘new’ environment could take hours.\nWe were very clear that we wanted to create all new labs from base media which we would try to keep current for patches (at least within a few months) and would allow us to create any number of machines and environments. There should be one configuration for each guest VM, which would be used everywhere. We were very clear that we would create one DSC configuration for each role that we needed (for example, a Domain Controller or an ADFS server) and that configuration would be used whether we were creating a lab on a local machine, in Azure or Azure Stack. Maintain a distinction between a virtual machine configuration and an environment configuration. We are building a collection of virtual Lego with our VM configurations. Our teams can combine those Lego bricks into environments that may be project specific. There should be a configuration for those environments. We should never alter an existing configuration for a new environment – we should create a new configuration using the existing one as a base (for example, we need additional roles on our DC for some reason). Take a common approach with Lability and Azure, whilst accepting we have to maintain two sets of resources.\nOur approach to Azure environments is already modular. We have templates for VMs that are combined into environments through Nested Deployments. This would not change. Our VM definitions would encompass a DSC configuration and an ARM template. Our environments would include both a DSC data file and an ARM template. Manage and automated the creation of base media. We would need a variety of base VHD files, analogous to the existing marketplace images in Azure: Windows Server (numerous versions), SQL Server, SharePoint, etc. Each of these must be created using scripts so they could be periodically rebuilt to achieve our goal of avoiding time consuming patching of new environments. In short, we would need an Image Factory. Setup and use should be straightforward. We need our developers to be able to install all the tooling and get a new lab up and running quickly. We need easy integration with Azure Dev/Test Labs, etc. This would need some process automation around the build and release of the VM configurations and anything else we would create as part of the project. Things You Will Need # If you want to build the same Lab solution as we did you’re going to need a few things:\nGit Repository. All the code and configurations we create are ultimately stored in a central Git Repo. We are using Visual Studio Team Services, as it’s our chosen source control platform.\nWhy Git? Two reasons: First of all, it allows us to easily deploy our solution to a developer workstation by simply cloning the repo. Second, Azure DevTest Labs needs a Git Repo to store Artifacts (our ARM templates) for deployment of environments. Build/Release automation. When we commit to our shared repo, our Build server executes some PowerShell to create deployment artifacts for Azure. It creates Zip archives from our configurations to be used with the DSC extension. It makes no sense to create these by hand and waste space in our repo. Our Release pipeline then automatically pushes our artifacts to an Azure storage account that can be accessed by our developers as a single, central store for VM configurations. Private PowerShell Repository. We use ProGet to provide a local Nuget/PowerShell/NPM etc repository. We had this in place before we started this project, but it has proved invaluable. The simple reason is that we want to publish DSC Resources or easy consumption and installation by our team. You be surprised at how many times we’ve hit a bug in a DSC resource which has been fixed in the source code repo but a new version has not yet been published. Maintaining our own repository allows us to publish our own versions of DSC resources (and in some case our own bespoke resources). A server to host your Image Factory. I’m not going to spend time documenting this part of our solution. Far cleverer people than I have written about this and we followed their guidance. You need somewhere to host your images and run the scripts on a schedule to build new ones. Our builds run overnight and we place images on a Windows fileshare. An Azure subscription. If you want to use the same configuration for on-prem and cloud, saying that you need and Azure sub seems a little obvious. However, we are using nested deployments. These use resources that must be accessible to the Azure fabric at deploy time, and the easiest way to do that is to use Azure Storage. You’ll also need a subscription to host your DevTest lab if that’s your preferred approach. Note that you could have multiple subscriptions – our devs can use their MSDN Azure Benefit to host environments within their own DevTest lab, whilst the artefact store is on a corporate subscription and the artefact repo is in our VSTS. A code editor that understands PowerShell, DSC and ARM. I prefer Visual Studio and the Azure SDK, but Visual Studio Code is an equally powerful tool for creating and managing the files we are going to use. Managing our VMs and Environments # After much thought, we came up with a standard folder structure and approach to our VM and environment configurations and the supporting scripts needed to deploy them.\nIn our code repo we have a the following folder structure:\nEnvironments This folder contains a series of folders, one per environment.This folder is specified as that containing environment templates when the shared repo is connected to an Azure DevTest Lab \\Environment\\MyEnv1 An environment folder contains three files: \\Environment\\MyEnv1\\MyEnv1.psd1 The psd1 data file must share the same name as the folder. This contains all the configuration settings for all VMs in our environment and is used by Lability and the VM DSC configs \\Environment\\MyEnv1\\azuredeploy.json For DevTest labs, the environment template used in Azure must be named azuredeploy.json. This template calls a series of other templates to deploy the virtual network and VMs to Azure \\Environment\\MyEnv1\\metadata.json This file is read by DevTest labs and provides a name and description for our environment \\VMs This folder contains subfolders for each of our component Virtual Machines. \\VMs\\MyVM1 A VM folder contains at least two files: \\VMs\\MyVM1\\MyVM1.ps1 The ps1 configuration file must share the same name as the folder. It contains the DSC PowerShell to apply the configuration to the guest VM \\VMs\\MyVM1\\MyVM1.json The json file shares the folder name for consistency. It is called by the azuredeploy.json environment template to create the VM in Azure and Azure Stack \\Modules The Modules folder contains shared code of various types \\Modules\\Scripts The scripts folder contains PowerShell scripts to install and configure our standard Lability deploy, wrapper the Lability create and remove commands and perform build and release tasks. \\Modules\\Template The template folder holds common ARM templates that create standard elements shared between environments and called by the azuredeploy.json \\Modules\\DSC This folder is used during the build process. All the DSC resources needed in an environment are downloaded to this folder. A script parses the VM DSC configurations called by an environment and creates Zip files to be uploaded into Azure storage that contain the correct DSC resources and DSC PowerShell for an environment Wrapper Scripts for Lability # Lability is great but is built to work in a certain way. We have three scripts that perform key functions for our deployment.\nInstall Script # Our installation script performs the following function:\nCreates the C:\\Virtualisation base folder we use to store VMs and the Lability working files. Sets the default Hyper-V locations for Virtual Machines and Virtual Hard disks to c:\\Virtualisation Creates a new Internal Virtual Switch (named in accordance to our convention) and sets the IP address on the NIC created on the host to the required one. Our first switch creates a network of 192.168.254.0/24 and the host gets 192.168.254.1 as it’s IP address. Creates a new NetNat with an internal address prefix of 192.168.224.0/19. This will pass traffic into and out of up to thirty /24 subnets starting at 192.168.224.0/24, up to 192.168.254.0/24. We decided to work from the top down when creating new networks. Makes sure that the Nuget package provider is installed and registers our ProGet server as a new PowerShell repository. We then remove the default PowerShellGallery registration and make sure our repo is trusted. Check to see if Lability is installed and if not, we install it using Install-Module. Set the following Lability defaults using the Set-LabHostDefault command:\nConfigurationPath: c:\\Virtualisation\\Configuration\nIsoPath: c:\\Virtualisation\\ISOs\nParentVhdPath: c:\\Virtualisation\\MasterVirtualHardDisks\nDifferencingVhdPath: c:\\Virtualisation\\VMVirtualHardDisks\nModuleCachePath: c:\\Virtualisation\\Modules\nResourcePath: c:\\Virtualisation\\Resources\nHotfixPath: c:\\Virtualisation\\Hotfix\nRepositoryUri: \u0026lt;the URI of our ProGet Server, e.g. https://proget.mycorp.com/nuget/PowerShell/package\u0026gt; Set the default virtual switch for Lability environments to our newly created one using the Set-LabVMDefault command. Register our VHD base media by calling another script which loads a standard configuration data file. This is separate so we can perform this action independently. Set the Lability default media to our Windows Server 2012 R2 standard VDH using the Set-LabVMDefault command. Initialise Lability using our configuration with the Start-LabHostConfiguration command. Once the install script has completed we have a fully configured host ready to deploy Lability labs.\nDeploy-LocalLab script # Lability has a Start-LabConfiguration command which reads the psd1 configuration data file for an environment and creates the VMs. Before running that, however, you need to execute the PowerShell DSC scripts to generate the MOF files for each VM. Lability injects those, and the DSC resources, into the VMs. A second command, Start-Lab boot the VMs themselves, respecting boot order and delays that can be declared in the config file.\nThis is great unless you have a complex lab and need lots of DSC resources to make it work. Our wrapper script does the following, taking an environment name as a parameter:\nReads the psd1 data file for our environment from the correct folder to identify the DSC resources we need (they are listed for Lability). It installs these resources so we can execute the PowerShell configuration scripts and generate the MOFs. Reads the psd1 data file to identify the VMs we are deploying. Based on the Role information in that file it will execute each of the configuration ps1 files from the VMs folder hierarchy, passing in the psd1 data file. The resultant MOFs get saved in the Lability configuration folder (c:\\Virtualisation\\Lability). Execute the Start-LabConfiguration command passing in the configuration data file. If we specify a -Start switch, the script starts the lab with the Start-Lab command. Remove-LocalLab script # Our remove script takes the name of our environment as a parameter. It does the following:\nIdentifies the VMs in the lab using the Get-LabVM command, passing in the psd1 data file. Check to see if any are running and if they are call the Stop-Lab command. Executes the Remove-LabConfiguration command, passing in the psd1 data file for the environment. Virtual Machine Configuration # We’ve challenged ourselves to only use Desired State Configuration for our VMs. This has been a big change from our previous approach to Azure VMs, which mixed DSC with custom PowerShell scripts deployed with a separate Azure VM extension. This has raised four issues we had to solve:\nThe list of DSC Resources is growing but not all-encompassing. There are many areas where no DSC modules exist. To overcome this, we have used a mix of SetScript code contained within a DSC configuration (which has some limitations) and bespoke DSC modules hosted in our ProGet repository. Existing Published DSC resources may contain bugs. In many cases code fixing those bugs has been supplied as pull requests but may be undergoing review, and sometimes no new release of the resource has been created. We now have our own separate code repository for DSC resources (including our own) where we keep these and we publish versions to our own repository. When a new official version including the fixes is released it will supersede our own. There are some good DSC resources out there on GitHub that aren’t published to the PowerShell gallery. We publish these into our own repository for access. Azure executes the DSC on the target VM to generate the MOF. Lability executes it on the host machine. That and other differences means that we have wrapper code to switch the config sections, mostly based on an input parameter named IsAzure. When called from the Azure DSC extension we specify that parameter and on a Lability host we don’t. I realise that purists will argue that this means we don’t really have a single configuration. I would counter that I have a single configuration file and therefore one thing to maintain. I don’t see any issue with logic inside that config deciding what happens. Sample Configuration # Let’s illustrate our approach with an extract from a configuration. The code below is part of our DomainController config.\nThe config accepts some parameters. EnvPrefix is used to generate names within the environment. In Azure we use it to prefix our Azure resources. Within the environment it’s used to create things like the AD domain name. IsAzure tells the config whether it is being executed on the host or on the target VM inside Azure.\nYou’ll notice that we specify the DSC module versions. There are a few reasons why we do this – because some of the DSC resources are unofficial we want to make sure they come from our repository, and the way Lability downloads DSC resources from our ProGet Server means we need to specify a version number. Either way, we benefit from increased consistency – there have been some breaking changes between versions with the official DSC resources in the PowerShell Gallery!\nIf we’re in Azure we do things like find the network adapter through code and we don’t specify network addresses. We use the IsAzure parameter to wrapper this stuff in If blocks.\nThe configuration values come from the psd1 data file, regardless of whether we deploy to Azure or locally. We do this to enforce consistency. Even though we probably could have the Azure config self-contained in the script, we don’t.\nConfiguration DomainController { param( [ValidateNotNull()] [System.Management.Automation.PSCredential]$Credential, [string\\]$EnvPrefix, [bool\\]$IsAzure = $false, [Int]$RetryCount = 20, [Int\\]$RetryIntervalSec = 30 ) Import-DscResource -ModuleName @{ModuleName=\u0026#34;xNetworking\u0026#34;;ModuleVersion=\u0026#34;3.2.0.0\u0026#34;} Import-DscResource -ModuleName @{ModuleName=\u0026#34;xPSDesiredStateConfiguration\u0026#34;;ModuleVersion=\u0026#34;6.0.0.0\u0026#34;} Import-DscResource -ModuleName @{ModuleName=\u0026#34;xActiveDirectory\u0026#34;;ModuleVersion=\u0026#34;2.16.0.0\u0026#34;} Import-DscResource -ModuleName @{ModuleName=\u0026#34;xAdcsDeployment\u0026#34;;ModuleVersion=\u0026#34;1.1.0.0\u0026#34;} Import-DscResource -ModuleName @{ModuleName=\u0026#34;xComputerManagement\u0026#34;;ModuleVersion=\u0026#34;1.9.0.0\u0026#34;} $DomainName = $EnvPrefix + \u0026#34;.local\u0026#34; Write-Verbose \u0026#34;Processing Configuration DomainController\u0026#34; Write-Verbose \u0026#34;Processing configuration: Node DomainController\u0026#34; node $AllNodes.where({$_.Role -eq \u0026#39;DomainController\u0026#39;}).NodeName { Write-Verbose \u0026#34;Processing Node: $($node.NodeName)\u0026#34; if ($IsAzure -eq $true) { #Find the first network adapter $Interface = Get-NetAdapter | Where-Object Name -Like \u0026#34;Ethernet\\*\u0026#34; | Select\\-Object \\-First 1 $InterfaceAlias = $($Interface.Name) } LocalConfigurationManager { RebootNodeIfNeeded = $true; AllowModuleOverwrite = $true; ConfigurationMode = \u0026#39;ApplyOnly\u0026#39; CertificateID = $node.Thumbprint; DebugMode = \u0026#39;All\u0026#39;; } #ignore this is in Azure if ($IsAzure -eq $false) { # Set a fixed IP address if the config specifies one if ($node.IPaddress) { xIPAddress PrimaryIPAddress { IPAddress = $node.IPAddress; InterfaceAlias = $node.InterfaceAlias; PrefixLength = $node.PrefixLength; AddressFamily = $node.AddressFamily; } } } #ignore this is in Azure if ($IsAzure -eq $false) { # Set a default gateway if the config specifies one if ($node.DefaultGateway){ xDefaultGatewayAddress DefaultGateway { InterfaceAlias = $node.InterfaceAlias; Address = $node.DefaultGateway; AddressFamily = $node.AddressFamily; } } } # Set the DNS server if the config specifies one if ($IsAzure -eq $true) { if ($node.DnsAddress){ xDNSServerAddress DNSaddress { Address \\= $node.DnsAddress; InterfaceAlias \\= $InterfaceAlias; AddressFamily \\= $node.AddressFamily; } } } else { if ($node.DnsAddress){ xDNSServerAddress DNSaddress { Address = $node.DnsAddress; InterfaceAlias = $node.InterfaceAlias; AddressFamily = $node.AddressFamily; } } } } #End configuration DomainController } Sample Data File # Below is a sample data file for an environment containing a Domain Controller and single domain-joined server. Note that the data file contains a mix of data to be processed by the DSC configuration and Lability-specific information that defines the environment, including VM settings and the required DSC resources. When we deploy the lab locally, Lability processes the file to create the Virtual Machines and their hard disks (and create new virtual switches if we declare them). When we deploy in Azure this information is ignored – we can safely use the same data file in both situations.\n# Single Domain Controller Lab @{ AllNodes = @( @{ # DomainController NodeName = \u0026#34;DC\u0026#34;; Role = \u0026#39;DomainController\u0026#39;; DSdrive = \u0026#39;C:\u0026#39;; #Prevent credential error messages PSDscAllowPlainTextPassword = $true; PSDscAllowDomainUser = $true; # Networking IPAddress = \u0026#39;192.168.254.2\u0026#39;; DnsAddress = \u0026#39;127.0.0.1\u0026#39;; DefaultGateway = \u0026#39;192.168.254.1\u0026#39;; PrefixLength = 24; AddressFamily = \u0026#39;IPv4\u0026#39;; DnsConnectionSuffix = \u0026#39;lab.local\u0026#39;; InterfaceAlias = \u0026#39;Ethernet\u0026#39;; # Lability extras Lability_Media = \u0026#39;BM_Server_2012_R2_Standard_x64\u0026#39;; Lability_ProcessorCount = 2; Lability_StartupMemory = 2GB; Lability_MinimumMemory = 1GB; Lability_MaximumMemory = 3GB; Lability_BootOrder = 0; Lability_BootDelay = 600; }; @{ # MemberServer NodeName = \u0026#34;SR01\u0026#34;; Role = \u0026#39;MemberServer\u0026#39;; DSdrive = \u0026#39;C:\u0026#39;; #Prevent credential error messages PSDscAllowPlainTextPassword = $true; PSDscAllowDomainUser = $true; # Networking IPAddress = \u0026#39;192.168.254.3\u0026#39;; DnsAddress = \u0026#39;192.168.254.2\u0026#39;; DefaultGateway = \u0026#39;192.168.254.1\u0026#39;; PrefixLength = 24; AddressFamily = \u0026#39;IPv4\u0026#39;; DnsConnectionSuffix = \u0026#39;lab.local\u0026#39;; InterfaceAlias = \u0026#39;Ethernet\u0026#39;; # Lability extras Lability_Media = \u0026#39;BM_Server_2012_R2_Standard_x64\u0026#39;; Lability_ProcessorCount = 2; Lability_StartupMemory = 2GB; Lability_MinimumMemory = 1GB; Lability_MaximumMemory = 3GB; Lability_BootOrder = 1; }; ); NonNodeData = @{ OrganisationName = \u0026#39;Lab\u0026#39;; Lability = @{ EnvironmentPrefix = \u0026#39;Lab-\u0026#39;; DSCResource = @( @{ Name = \u0026#39;xNetworking\u0026#39;; RequiredVersion = \u0026#39;3.2.0.0\u0026#39;;} @{ Name = \u0026#39;xPSDesiredStateConfiguration\u0026#39;; RequiredVersion = \u0026#39;6.0.0.0\u0026#39;;} @{ Name = \u0026#39;xActiveDirectory\u0026#39;; RequiredVersion = \u0026#39;2.16.0.0\u0026#39;;} @{ Name = \u0026#39;xAdcsDeployment\u0026#39;; RequiredVersion = \u0026#39;1.1.0.0\u0026#39;;}@{ Name = \u0026#39;xComputerManagement\u0026#39;; RequiredVersion = \u0026#39;1.9.0.0\u0026#39;;} ); } }; }; Azure DSC Extension # Our Azure deployment uses the configuration and data file to configure the VM. The JSON for the DSC extension is shown below. Notice the following:\nThe modulesUrl setting specifies a Zip file that contains the DSC resources and configuration ps1 file. We create these zip files as part of our build process and upload them to an Azure storage account.\nThe configurationFunction setting specifies the name of the ps1 file to execute and the configuration within that we want to apply (a single file can contain more than one configuration, although ours don’t).\nWe pass in the EnvPrefix variable and set the IsAzure value to 1 so our configuration executes the right code.\nThe dataBlobUri within protectedSettings is our psd1 data file. The extension treats this as containing sensitive information – things held in this section are not displayed in any output from Azure Resource Manager.\nIn fairness, whilst at the moment we create JSON specific to each VM, I plan to refactor this to be common code that takes parameters rather than having an ARM template for each VM’s DSC.\n{ \u0026#34;name\u0026#34;: \u0026#34;[concat(parameters(\u0026#39;envPrefix\u0026#39;),parameters(\u0026#39;vmName\u0026#39;),\u0026#39;/\u0026#39;,parameters(\u0026#39;envPrefix\u0026#39;),parameters(\u0026#39;vmName\u0026#39;),\u0026#39;dsc\u0026#39;)]\u0026#34;, \u0026#34;type\u0026#34;: \u0026#34;Microsoft.Compute/virtualMachines/extensions\u0026#34;, \u0026#34;location\u0026#34;: \u0026#34;[parameters(\u0026#39;VirtualNetwork\u0026#39;).Location]\u0026#34;, \u0026#34;apiVersion\u0026#34;: \u0026#34;[parameters(\u0026#39;ApiVersion\u0026#39;).VirtualMachine]\u0026#34;, \u0026#34;dependsOn\u0026#34;: [], \u0026#34;tags\u0026#34;: { \u0026#34;displayName\u0026#34;: \u0026#34;DomainController\u0026#34; }, \u0026#34;properties\u0026#34;: { \u0026#34;publisher\u0026#34;: \u0026#34;Microsoft.Powershell\u0026#34;, \u0026#34;type\u0026#34;: \u0026#34;DSC\u0026#34;, \u0026#34;typeHandlerVersion\u0026#34;: \u0026#34;2.1\u0026#34;, \u0026#34;autoUpgradeMinorVersion\u0026#34;: true, \u0026#34;settings\u0026#34;: { \u0026#34;modulesUrl\u0026#34;: \u0026#34;[concat(parameters(\u0026#39;artifactsLocation\u0026#39;), \u0026#39;/Environments/\u0026#39;, parameters(\u0026#39;envConfig\u0026#39;),\u0026#39;/\u0026#39;,parameters(\u0026#39;envConfig\u0026#39;),\u0026#39;.zip\u0026#39;, parameters(\u0026#39;artifactsSasToken\u0026#39;))]\u0026#34;, \u0026#34;configurationFunction\u0026#34;: \u0026#34;DomainController.ps1\\\\DomainController\u0026#34;, \u0026#34;properties\u0026#34;: { \u0026#34;EnvPrefix\u0026#34;: \u0026#34;[parameters(\u0026#39;EnvPrefix\u0026#39;)]\u0026#34;, \u0026#34;Credential\u0026#34;: { \u0026#34;userName\u0026#34;: \u0026#34;[parameters(\u0026#39;adminUsername\u0026#39;)]\u0026#34;, \u0026#34;password\u0026#34;: \u0026#34;PrivateSettingsRef:adminPassword\u0026#34; }, \u0026#34;IsAzure\u0026#34;: 1 } }, \u0026#34;protectedSettings\u0026#34;: { \u0026#34;dataBlobUri\u0026#34;: \u0026#34;[concat(parameters(\u0026#39;artifactsLocation\u0026#39;), \u0026#39;/Environments/\u0026#39;, parameters(\u0026#39;envConfig\u0026#39;), \u0026#39;/\u0026#39;, parameters(\u0026#39;envConfig\u0026#39;),\u0026#39;.psd1\u0026#39;, parameters(\u0026#39;artifactsSasToken\u0026#39;))]\u0026#34;, \u0026#34;Items\u0026#34;: { \u0026#34;adminPassword\u0026#34;: \u0026#34;[parameters(\u0026#39;adminPassword\u0026#39;)]\u0026#34; } } } } We don’t include the DSC extension within the ARM template that deploys the VM because by doing so we can sequence the deployment of configuration to deal with dependencies between servers.\nAzure ARM Templates # The approach we take to deploying VMs in Azure has been consistent for some time now. My ResourceTemplates Repo in GitHub uses nested templates to deploy a three-server environment and we use exactly the same approach here. Our ‘master template’ is stored in the environment folder and it calls nested deploys for each VM, VM DSC extension and supporting stuff such as virtual networks. The VM and DSC templates are stored in the VM folder with the DSC config, and the supporting templates are in our Modules\\Templates folder since they are shared.\nConclusion # This has been a very long article without a great deal of code in it. I hope this explains how we approach our environment definition and deployment. I plan to do more posts that document more specific elements of a configuration or an environment.\nUltimately, I’m not sure that the goal of a single definition that covers multiple platforms and both host and guest configurations exists. However, I think we’ve got pretty close with our solution and it has minimal rework involved, particularly once you have built up a good library of VM configs that you can combine into an environment.\nI should also point out that we are not installing apps – we are deploying a platform onto which our developers and testers can then install the applications they develop. This means that we keep the environments quite generic. Deployment of apps is still scripted (and probably uses VSTS Release Management) but is not included in the configurations we build. Having said that, there is nothing stopping a team extending the DSC to deploy their applications and thus build a more bespoke definition.\nI’ve spoken to quite a few people about what we’ve done over the past few weeks and, certainly within the Microsoft space many people want to do what we have done, but few were aware that tooling such as Lability and DSC were available to get it done. I hope this goes some way to plugging that gap.\n","date":"2 March 2017","externalUrl":null,"permalink":"/posts/define-once-deploy-everywhere-sort-of/","section":"Blog","summary":"Using Lability, DSC and ARM to define and deploy multi-VM environments # Configuration as code crops up a lot in conversation these days. We are searching for that DevOps Nirvana of a single definition of our environment that we can deploy anywhere.\n","title":"Define Once, Deploy Everywhere (Sort of...)","type":"posts"},{"content":"","date":"2 March 2017","externalUrl":null,"permalink":"/tags/hybrid-cloud/","section":"Tags","summary":"","title":"Hybrid-Cloud","type":"tags"},{"content":"","date":"2 March 2017","externalUrl":null,"permalink":"/tags/lab-manager/","section":"Tags","summary":"","title":"Lab-Manager","type":"tags"},{"content":"","date":"2 March 2017","externalUrl":null,"permalink":"/tags/lability/","section":"Tags","summary":"","title":"Lability","type":"tags"},{"content":"As part of the work I have been doing around generating and managing lab environments using Lability and DSC, one of the things I needed to do was change the permissions on a certificate template within a DSC configuration. Previously, when deploying to Azure, I used the PSPKI PowerShell modules within code executed by the Custom Script extension. I was very focused on sticking with DSC this time, which ruled out PSPKI. Whilst there is a DSC module available to configure Certificate Services itself, this does not extend to managing Certificate Templates.\nNobody seemed to have done exactly this before. I used the following links as references in creating the code:\nGet Effective template permissions with PowerShell by Vadims Podans\nDuplicate AD Object Without Active Directory PS Tools\nAdd Object Specific ACEs using Active Directory PowerShell\nUsing Scripts to Manage Active Directory Security\nThe script finds the WebServer template and grants the Enroll extended permission to the Domain Computers AD group. This allows me to use xCertificate in the DSC configuration of domain member servers to request new certificates using the WebServer template.\nHere is the code I include in my DSC configuration. $DomainCreds is a PSCredential object for the domain admin ( I create the AD domain in an earlier step using xActiveDirectory).\n#Enable Enroll on WebServer certificate template Script EnableWebServerEnroll { DependsOn = \u0026#34;[xAdcsCertificationAuthority]CertAuth\u0026#34; PsDscRunAsCredential = $DomainCreds GetScript = { return @{ \u0026#39;Result\u0026#39; = $true} } TestScript = { #Find the webserver template in AD and grant the Enroll extended right to the Domain Computers $filter = \u0026#34;(cn=WebServer)\u0026#34; $ConfigContext = ([ADSI]\u0026#34;LDAP://RootDSE\u0026#34;).configurationNamingContext $ConfigContext = \u0026#34;CN=Certificate Templates,CN=Public Key Services,CN=Services,$ConfigContext\u0026#34; $ds = New-object System.DirectoryServices.DirectorySearcher([ADSI]\u0026#34;LDAP://$ConfigContext\u0026#34;,$filter) $Template = $ds.Findone().GetDirectoryEntry() if ($Template -ne $null) { $objUser = New-Object System.Security.Principal.NTAccount(\u0026#34;Domain Computers\u0026#34;) # The following object specific ACE is to grant Enroll $objectGuid = New-Object Guid 0e10c968-78fb-11d2-90d4-00c04f79dc55 ForEach ($AccessRule in $Template.ObjectSecurity.Access) { If ($AccessRule.ObjectType.ToString() \\-eq $objectGuid) { If ($AccessRule.IdentityReference -like \u0026#34;*$($objUser.Value)\u0026#34;) { Write-Verbose \u0026#34;TestScript: WebServer Template Enroll permission for Domain Computers exists. Returning True\u0026#34; return $true } } } } return $false } SetScript = { #Find the webserver template in AD and grant the Enroll extended right to the Domain Computers $filter = \u0026#34;(cn=WebServer)\u0026#34; $ConfigContext = ([ADSI]\u0026#34;LDAP://RootDSE\u0026#34;).configurationNamingContext $ConfigContext = \u0026#34;CN=Certificate Templates,CN=Public Key Services,CN=Services,$ConfigContext\u0026#34; $ds = New-object System.DirectoryServices.DirectorySearcher([ADSI]\u0026#34;LDAP://$ConfigContext\u0026#34;,$filter) $Template = $ds.Findone().GetDirectoryEntry() if ($Template -ne $null) { $objUser = New-Object System.Security.Principal.NTAccount(\u0026#34;Domain Computers\u0026#34;) # The following object specific ACE is to grant Enroll $objectGuid = New-Object Guid 0e10c968-78fb-11d2-90d4-00c04f79dc55 $ADRight = [System.DirectoryServices.ActiveDirectoryRights]\u0026#34;ExtendedRight\u0026#34; $ACEType = [System.Security.AccessControl.AccessControlType]\u0026#34;Allow\u0026#34; $ACE = New-Object System.DirectoryServices.ActiveDirectoryAccessRule -ArgumentList $objUser,$ADRight,$ACEType,$objectGuid $Template.ObjectSecurity.AddAccessRule($ACE) $Template.commitchanges() Write-Verbose \u0026#34;SetScript: Completed WebServer additional permission\u0026#34; } } } ","date":"2 March 2017","externalUrl":null,"permalink":"/posts/setting-enroll-permissions-on-adcs-certificate-template-using-dsc/","section":"Blog","summary":"As part of the work I have been doing around generating and managing lab environments using Lability and DSC, one of the things I needed to do was change the permissions on a certificate template within a DSC configuration. Previously, when deploying to Azure, I used the PSPKI PowerShell modules within code executed by the Custom Script extension. I was very focused on sticking with DSC this time, which ruled out PSPKI. Whilst there is a DSC module available to configure Certificate Services itself, this does not extend to managing Certificate Templates.\n","title":"Setting Enroll Permissions on ADCS Certificate Template using DSC","type":"posts"},{"content":"Recently I have been helping a number of organisations automate the deployment of their applications to Azure and came across a couple of scenarios that were not documented: Deploying an App Services web site with slots and SQL connection string settings, and the creation of a SQL Elastic Pool. Of those, the SQL Elastic Pool I found to be written up already by Vincent-Philipe Lauzon and all credit to him - my template draws on his excellent article.\nThe Web slots and configuration, however, I didn\u0026rsquo;t find. There are templates that deploy a web site, and some that deploy configuration settings into that web site (indeed, creating a new Web+SQL template through Visual Studio does just that). However, I could find none that deployed slots and none that added the config to the slot.\nYou can find the full template in my GitHub Repo. The template code to deploy a slot and associated config is shown below. This sits in the nested resources bock within the website resource, for reference.\nThe trick with the config, as it turns out, is the resource type. If you examine the connectionStrings node within a slot through Resource Explorer you will see it reported as Microsoft.Web/sites/config. However, if you click the PowerShell tab for the same note you will see the type reported as Microsoft.Web/sites/slots/config. Make sure that the resource name matches the config section (i.e. connectionStrings - or appsettings, etc).\n{ \u0026#34;apiVersion\u0026#34;: \u0026#34;2015-08-01\u0026#34;, \u0026#34;name\u0026#34;: \u0026#34;[concat(variables(\u0026#39;website\u0026#39;).websiteName, \u0026#39;/\u0026#39;, variables(\u0026#39;website\u0026#39;).slotName)]\u0026#34;, \u0026#34;type\u0026#34;: \u0026#34;Microsoft.Web/Sites/slots\u0026#34;, \u0026#34;location\u0026#34;: \u0026#34;\\[resourceGroup().location]\u0026#34;, \u0026#34;dependsOn\u0026#34;: [ \u0026#34;[concat(\u0026#39;Microsoft.Web/Sites/\u0026#39;, variables(\u0026#39;website\u0026#39;).websiteName)]\u0026#34; ], \u0026#34;tags\u0026#34;: { \u0026#34;displayName\u0026#34;: \u0026#34;Slot\u0026#34; }, \u0026#34;properties\u0026#34;: { }, \u0026#34;resources\u0026#34;: [ { \u0026#34;apiVersion\u0026#34;: \u0026#34;2015-08-01\u0026#34;, \u0026#34;name\u0026#34;: \u0026#34;[concat(variables(\u0026#39;website\u0026#39;).websiteName, \u0026#39;/\u0026#39;, variables(\u0026#39;website\u0026#39;).slotName, \u0026#39;/connectionStrings\u0026#39;)]\u0026#34;, \u0026#34;type\u0026#34;: \u0026#34;Microsoft.Web/Sites/slots/config\u0026#34;, \u0026#34;location\u0026#34;: \u0026#34;[resourceGroup().location\\]\u0026#34;, \u0026#34;dependsOn\u0026#34;: [ \u0026#34;[concat(\u0026#39;Microsoft.Web/Sites/\u0026#39;, variables(\u0026#39;website\u0026#39;).websiteName, \u0026#39;/slots/\u0026#39;, variables(\u0026#39;website\u0026#39;).slotName)\\]\u0026#34; ], \u0026#34;tags\u0026#34;: { \u0026#34;displayName\u0026#34;: \u0026#34;SlotConnectionStrings\u0026#34; }, \u0026#34;properties\u0026#34;: { \u0026#34;DefaultConnection\u0026#34;: { \u0026#34;value\u0026#34;: \u0026#34;[concat(\u0026#39;Data Source=tcp:\u0026#39;, reference(concat(\u0026#39;Microsoft.Sql/servers/\u0026#39;, variables(\u0026#39;sqlServer\u0026#39;).name)).fullyQualifiedDomainName, \u0026#39;,1433;Initial Catalog=\u0026#39;, variables(\u0026#39;sqlServer\u0026#39;).stagingDbname, \u0026#39;;User Id=\u0026#39;, parameters(\u0026#39;sqlAdminLogin\u0026#39;), \u0026#39;@\u0026#39;, variables(\u0026#39;sqlServer\u0026#39;).name, \u0026#39;;Password=\u0026#39;, parameters(\u0026#39;sqlAdminPassword\u0026#39;), \u0026#39;;\u0026#39;)\\]\u0026#34;, \u0026#34;type\u0026#34;: \u0026#34;SQLServer\u0026#34; } } } ] } ","date":"18 January 2017","externalUrl":null,"permalink":"/posts/creating-website-slots-and-sql-elastic-pools-using-azure-resource-templates/","section":"Blog","summary":"Recently I have been helping a number of organisations automate the deployment of their applications to Azure and came across a couple of scenarios that were not documented: Deploying an App Services web site with slots and SQL connection string settings, and the creation of a SQL Elastic Pool. Of those, the SQL Elastic Pool I found to be written up already by Vincent-Philipe Lauzon and all credit to him - my template draws on his excellent article.\n","title":"Creating Website Slots and SQL Elastic Pools using Azure Resource Templates","type":"posts"},{"content":"The new NAT virtual switch that can be created on Windows 10 for Hyper-V virtual machines is a wonderful thing if you\u0026rsquo;re an on-the-go evangelist like myself. For more information on how to create one, see Thomas Maurer\u0026rsquo;s post on the subject.\nThis post is not about creating a new NAT switch. It is, however, about _re_creating one and the pitfalls that occur, and how I now run my virtual environment with some hack PowerShell and a useful DHCP server utility.\nProblems Creating Nat Switch? Check Assigned IP Addresses # I spent a frustrating amount of time this week trying to recreate a NAT switch after deleting it. Try as I might, every time I executed the command to create the new switch it would die. After trial and error I found that the issue was down to the address range I was using. If I created a new switch with a new address range everything worked, but only that one time: If I deleted the switch and tried again, any address range that I\u0026rsquo;d used would fail.\nThis got me digging.\nI created a new switch with a new address range. The first thing I noticed was that I had a very long routing table. Get-netroute showed routes for all the address ranges I had previously created. That let me to look at the network adapter created by the virtual switch. When you create a new nat switch the resulting adapter gets the first IP address in the range bound to it (so 192.168.1.0/24 will result in an IP of 192.168.0.1). My adapter had an IP address for every single address range I\u0026rsquo;d created and then deleted.\nObviously, when the switch is removed the IP configuration is being stored by windows somewhere. When a new switch is created all that old binding information is reapplied to the new switch. I\u0026rsquo;m not certain whether this is related to the interface index, name or what, since when I remove and re-add the switch on my machine it always seems to get the same interface index.\nA quick bit of PowerShell allowed me to rip all the IP addresses from the adapter at once. The commands below are straightforward. The first allows me to find the adapter by name (shown in the Network Connections section of control panel) - replace the relevant text with the name of your adapter. From that I can find the interface index, and the second command gets all the IPv4 addresses (only IPv4 seems to have the problem here) and removes them from the interface - again, swap your interface index in here. I can then use PowerShell to remove the VMswitch and associated NetNat object.\nGet-NetAdapter -Name \u0026#34;vEthernet (NATSwitch)\u0026#34; Get-NetIPAddress -InterfaceIndex 13 -AddressFamily IPv4 | Remove-NetIPAddress Once that\u0026rsquo;s done I can happily create new virtual switches using NAT and an address range I\u0026rsquo;ve previously had.\nUsing DHCP on a NAT switch for ease # My next quest was for a solution to the IP addressing conundrum we all have when running VMs: IP addresses. I could assign each VM a static address, but then I have to keep track of them. I also have a number of VMs in different environments that I want to run and I need external DNS to work. DHCP is the answer, but Windows 10 doesn\u0026rsquo;t have a DHCP server and I don\u0026rsquo;t want to build a VM just to do that.\nI was really pleased to find that somebody has already written what I need: DHCP Server for Windows. This is a great utility that can run as a service or as a try app. It uses an ini file for configuration and by editing the ink file you can manage things like address reservations. Importantly, you can choose which interface the service binds to which means it can be run only against the virtual network and not a use issues elsewhere.\nThere\u0026rsquo;s only one thing missing: DNS. Whilst the DHCP serer can run it\u0026rsquo;s own DNS if you like, it still has a static configuration for the forwarder address. In a perfect world I\u0026rsquo;d like to be able to tell it to had my PCs primary DNS address to clients requesting an IP.\nEnter PowerShell, stage left\u0026hellip;\nUsing my best Google-fu I tracked down a great post by Lee Homes from a long time ago about using PowerShell to edit ini files through the old faithful Windows API calls for PrivateProfileString. I much prefer letting Windows deal with my config file than write some complex PowerShell parser.\nI took Lee\u0026rsquo;s code and created a single PowerShell module with three functions as per his post which I called Update-Inifiles.psm1. I then wrote another script that used those functions to edit the ini file for DHCPserver.\nIt\u0026rsquo;s dirty and not tested on anything but my machine, but here it is:\nimport-module C:\\\\src\\\\Update\\-IniFiles.psm1 $dnsaddr = (Get\\-DnsClientServerAddress -InterfaceIndex (get-netroute -DestinationPrefix 0.0.0.0/0)[0].ifIndex -AddressFamily IPv4).ServerAddresses[0] if ($dnsaddr.Length -gt 0) { Set-PrivateProfileString \u0026#34;C:\\\\Program Files\\\\DHCPSrv\\\\dhcpsrv.ini\u0026#34; GENERAL DNS_0 $dnsaddr } else { Set-PrivateProfileString \u0026#34;C:\\\\Program Files\\\\DHCPSrv\\\\dhcpsrv.ini\u0026#34; GENERAL DNS_0 8.8.8.8 } The second line is the one that may catch you out. It gets the DNS server information for the interface that is linked to the default IPv4 route. On my machine there are multiple entries returned by the get-netroute command, so I grab the first one from the array. Similarly, there are multiple DNS servers returned and I only want the first one of those, too. I should really expand the code and check what\u0026rsquo;s returned, but this is only for my PC - edit as you need!\nJust in case I get nothing back I have a failsafe which is to set the value to the Google public DNS server on 8.8.8.8.\nNow I run that script first, then start my DHCP server and all my VMs get valid IP information and can talk on whatever network I am connected to, be it physical or wireless.\n","date":"8 April 2016","externalUrl":null,"permalink":"/posts/notes-from-the-field-using-hyper-v-nat-switch-in-windows-10/","section":"Blog","summary":"The new NAT virtual switch that can be created on Windows 10 for Hyper-V virtual machines is a wonderful thing if you’re an on-the-go evangelist like myself. For more information on how to create one, see Thomas Maurer’s post on the subject.\n","title":"Notes from the field: Using Hyper-V Nat Switch in Windows 10","type":"posts"},{"content":"","date":"8 April 2016","externalUrl":null,"permalink":"/tags/windows-10/","section":"Tags","summary":"","title":"Windows-10","type":"tags"},{"content":"This is a post so I don’t forget how I fixed access to one of our environments yesterday, and hopefully it will be useful to some of you.\nWe have a good many pretty complex environments deployed to our lab hyper-V servers, controlled by Lab manager. Operations such as starting, stopping or repairing those environments can take a long, long time, but this time we had one that was quite definitely stuck. The lab view showed the many servers in the lab with green progress bars about halfway across but after many hours we saw no progress. The trouble is, at this point you can’t issue any other commands to the environment from within the Lab Manager console – it’s impossible to cancel the operation and regain access to the environment.\nNormally in these situations, stepping from Lab Manager to the SCVMM console can help. Stopping and restarting the VMs through SCVMM can often give lab manager the kick it needs to wake up. However, this time that had no effect. We then tried restarting the TFS servers to see if they’d got stuck, but that didn’t help either.\nAt this point we had no choice but to roll up our sleeves and look in the TFS database. You’d be surprised (or perhaps not) at how often we need to do that…\nFirst of all we looked in the LabEnvironment table. That showed us our environment, and the State column contained a value of Repairing.\nNext up, we looked in the LabOperation table. Searching for rows where the DataspaceId column value matched that of our environment in the LabEnvironment table showed a RepairVirtualEnvironment operation.\nIn the tbl_JobSchedule table we found an entry where the JobId column matched the JobGuid column from the LabOperation table. The interval on that was set to 15, from which we inferred that the repair job was being retried every fifteen minutes by the system. We found another entry for the same JobId in the tbl_JobDefinition table.\nStarting to join the dots up, we finally looked in the LabObject database. Searching for all the rows with the same DataspaceId as earlier returned all the lab hosts, environments and machines that were associated with the Team Project containing the lab. In this table, our environment row had a PendingOperationId which matched that of the row in the LabOperation table we found earlier.\nWe took the decision to attempt to revive our stuck environment by removing the stuck job. That would mean carefully working through all the tables we’d explored and deleting the rows, hopefully in the correct order. As the first part of that, we decided to change the value of the State column in the LabEnvironment table to Started, hoping to avoid crashing TFS should it try to parse all the information about the repair job we were about to slowly remove.\nImagine our surprise, then, when having made that one change, TFS itself cleaned up the database, removed all the table entries referring to the repair environment job and we were immediately able to issue commands to the environment again!\n","date":"17 March 2016","externalUrl":null,"permalink":"/posts/unblocking-a-stuck-lab-manager-environment-the-hard-way/","section":"Blog","summary":"This is a post so I don’t forget how I fixed access to one of our environments yesterday, and hopefully it will be useful to some of you.\nWe have a good many pretty complex environments deployed to our lab hyper-V servers, controlled by Lab manager. Operations such as starting, stopping or repairing those environments can take a long, long time, but this time we had one that was quite definitely stuck. The lab view showed the many servers in the lab with green progress bars about halfway across but after many hours we saw no progress. The trouble is, at this point you can’t issue any other commands to the environment from within the Lab Manager console – it’s impossible to cancel the operation and regain access to the environment.\n","title":"Unblocking a stuck Lab Manager Environment (the hard way)","type":"posts"},{"content":"I came across Net Writer some months ago, when it\u0026rsquo;s creator, Ed Anderson blogged about how he\u0026rsquo;d taken the newly-released Open Live Writer code and used it in his just-started Universal Windows Platform (UWP) app for Windows 10. In January it only supported blogger accounts, which meant that I was unable to use it. However, I checked again this weekend and discovered that it now supports a wide range of blog software including BlogEngine.net that powers blogs.blackmarble.co.uk.\nI\u0026rsquo;m writing this post using the app. It\u0026rsquo;s great for quick posts (there\u0026rsquo;s no plugin support so posting code snippets is tricky) and most importantly, it works on my phone! That\u0026rsquo;s the big win as far as I\u0026rsquo;m concerned. I\u0026rsquo;ve been hankering for the ability to easily manage my blog form my phone for a long time and now I can.\nYou can find Net Writer in the Windows Store and learn more about it at Ed\u0026rsquo;s blog.\n","date":"13 March 2016","externalUrl":null,"permalink":"/posts/net-writer-a-great-uwp-blog-editor/","section":"Blog","summary":"I came across Net Writer some months ago, when it’s creator, Ed Anderson blogged about how he’d taken the newly-released Open Live Writer code and used it in his just-started Universal Windows Platform (UWP) app for Windows 10. In January it only supported blogger accounts, which meant that I was unable to use it. However, I checked again this weekend and discovered that it now supports a wide range of blog software including BlogEngine.net that powers blogs.blackmarble.co.uk.\n","title":"Net Writer: A great UWP blog editor","type":"posts"},{"content":"","date":"13 March 2016","externalUrl":null,"permalink":"/categories/opinion/","section":"Categories","summary":"","title":"Opinion","type":"categories"},{"content":"I’ve had a number of people ask me if I can share the templates I use in my Resource Template sessions at conferences. It’s taken me a while to find the time, but I have created a repo on GitHub and there is a new Visual Studio solution and deployment project with my code.\nOne very nice feature that this has enabled me to provide is the same ‘Deploy to Azure’ button as you’ll find in the Azure Quickstart Templates. This meant a few changes to the templates – it turns out that Github is case sensitive for file requests, for example, whilst Azure Storage isn’t. The end result is that you can try out my templates in your own subscription directly from Github!\n","date":"26 February 2016","externalUrl":null,"permalink":"/posts/my-resource-templates-from-demos-are-now-on-github/","section":"Blog","summary":"I’ve had a number of people ask me if I can share the templates I use in my Resource Template sessions at conferences. It’s taken me a while to find the time, but I have created a repo on GitHub and there is a new Visual Studio solution and deployment project with my code.\n","title":"My Resource Templates from demos are now on GitHub","type":"posts"},{"content":"This post is an aide memoir so I don’t have to suffer the same annoyance and frustration at what should be an easy task.\nI’ve now switched to my Surface Pro 3 as my only system, thanks to the lovely new Pro 4 Type Cover and Surface Dock. That meant that I needed the Remote Server Administration Tools installing. Doing that turned out to be much more of an odyssey that it should have been and I’m writing this in the hope that it will allow others to quickly find the information I struggled to.\nThe RSAT tools download is, as before, a Windows Update that adds the necessary Windows Features to your installation. The trouble is, that download is EN-US only (really, Microsoft?!). If, like me, you used the EN-GB media to install you’re in a pickle.\nRunning the installed appears to work – it proceeds with no errors, albeit rather quickly – but the RSAT features were unavailable. I already had a US keyboard on my config (my pro keyboard is US), but that was obviously not enough. I added the US language, but still couldn’t get the installer to work.\nI got more information on the problem by following the steps described in a TechNet article on using DISM to install Windows Updates. That led me to a pair of articles on the SysadminTips site about the installation problem, and how to fully add the US language pack to solve it.\nIt turns out that the EN-GB media doesn’t install the full US-EN language pack files, so when you add the US language it doesn’t add enough stuff into the OS to allow the RSAT tools. Frankly, that’s a mess and I hope Microsoft deal with the issue by releasing multi-language RSAT tools.\n","date":"13 November 2015","externalUrl":null,"permalink":"/posts/installing-windows-10-rsat-tools-on-en-gb-media-installed-systems/","section":"Blog","summary":"This post is an aide memoir so I don’t have to suffer the same annoyance and frustration at what should be an easy task.\nI’ve now switched to my Surface Pro 3 as my only system, thanks to the lovely new Pro 4 Type Cover and Surface Dock. That meant that I needed the Remote Server Administration Tools installing. Doing that turned out to be much more of an odyssey that it should have been and I’m writing this in the hope that it will allow others to quickly find the information I struggled to.\n","title":"Installing Windows 10 RSAT Tools on EN-GB Media-Installed Systems","type":"posts"},{"content":"Over the past few posts on this blog I’ve been documenting the templates I have been working on for Black Marble. In a previous sequence I showed how you can use nested deployments to keep your templates simple and still push out complex environments. The problem with those examples is that they are very fixed in what they do. The templates create a number of virtual machines on a virtual network, with static IP addresses for each machine.\nThis works well for that deployment, where I have complete control. However, one of my aims is to create a series of templates for virtual machines that my developers can combine themselves to create environments that may be very different in makeup to my original. For example, what if the dev needs more servers? What if they only realise after pushing out four web servers that they need a domain controller? If I can’t guarantee the number or sequence of my servers I can’t use static address on creation.\nThe answer to this problem is actually really simple and uses the same approach as I described previously when reconfiguring a virtual network to alter the DNS address. I deploy a new virtual machine where the virtual nic for that machine requests a dynamic IP address. I then use a nested deployment to reconfigure that same nic, setting the address type to static and specifying the IP address that it was just given as the intended address. This means that I no longer care what order the Azure fabric creates the virtual machines in. That one key change over my previous template approach has halved the deployment time as I can now create all machines in parallel (the bit that takes the most time) and then configure in sequence as needed.\nThe markup to do this is very straightforward. First we create our nic:\n{ \u0026#34;name\u0026#34;: \u0026#34;[concat(parameters(\u0026#39;envPrefix\u0026#39;),parameters(\u0026#39;vmName\u0026#39;),\u0026#39;nic\u0026#39;)]\u0026#34;, \u0026#34;type\u0026#34;: \u0026#34;Microsoft.Network/networkInterfaces\u0026#34;, \u0026#34;location\u0026#34;: \u0026#34;[parameters(\u0026#39;VirtualNetwork\u0026#39;).Location]\u0026#34;, \u0026#34;apiVersion\u0026#34;: \u0026#34;2015-06-15\u0026#34;, \u0026#34;dependsOn\u0026#34;: [], \u0026#34;tags\u0026#34;: { \u0026#34;displayName\u0026#34;: \u0026#34;DomainControllerNic\u0026#34; }, \u0026#34;properties\u0026#34;: { \u0026#34;ipConfigurations\u0026#34;: [ { \u0026#34;name\u0026#34;: \u0026#34;ipconfig1\u0026#34;, \u0026#34;properties\u0026#34;: { \u0026#34;privateIPAllocationMethod\u0026#34;: \u0026#34;Dynamic\u0026#34;, \u0026#34;subnet\u0026#34;: { \u0026#34;id\u0026#34;: \u0026#34;[concat(parameters(\u0026#39;VirtualNetworkId\u0026#39;),\u0026#39;/subnets/\u0026#39;,parameters(\u0026#39;VirtualNetwork\u0026#39;).Subnet1Name)]\u0026#34; } } } ] } } You can see that I have set privateIPAllocationMethod to Dynamic.\nThe we call a nested deployment from our template, passing the IP address of the nic as a parameter. That template will redefine the settings of the nic, so it’s important we pass in all the information we need. If I miss something, that setting will be removed from the nic, so it’s important to be careful here. Notice that I use the reference keyword to access the privateIPAddress address property of the nic.\n{ \u0026#34;name\u0026#34;: \u0026#34;SetStaticIP\u0026#34;, \u0026#34;type\u0026#34;: \u0026#34;Microsoft.Resources/deployments\u0026#34;, \u0026#34;apiVersion\u0026#34;: \u0026#34;2015-01-01\u0026#34;, \u0026#34;dependsOn\u0026#34;: [ \u0026#34;[concat(parameters(\u0026#39;envPrefix\u0026#39;),parameters(\u0026#39;vmName\u0026#39;),\u0026#39;nic\u0026#39;)]\u0026#34;, \u0026#34;[concat(parameters(\u0026#39;envPrefix\u0026#39;),parameters(\u0026#39;vmName\u0026#39;))]\u0026#34;, \u0026#34;Microsoft.Insights.VMDiagnosticsSettings\u0026#34; ], \u0026#34;properties\u0026#34;: { \u0026#34;mode\u0026#34;: \u0026#34;Incremental\u0026#34;, \u0026#34;templateLink\u0026#34;: { \u0026#34;uri\u0026#34;: \u0026#34;[concat(parameters(\u0026#39;_artifactsLocation\u0026#39;), \u0026#39;/SetStaticIP.json\u0026#39;, parameters(\u0026#39;_artifactsLocationSasToken\u0026#39;))]\u0026#34;, \u0026#34;contentVersion\u0026#34;: \u0026#34;1.0.0.0\u0026#34; }, \u0026#34;parameters\u0026#34;: { \u0026#34;VirtualNetwork\u0026#34;: { \u0026#34;value\u0026#34;: \u0026#34;[parameters(\u0026#39;VirtualNetwork\u0026#39;)]\u0026#34; }, \u0026#34;VirtualNetworkId\u0026#34;: { \u0026#34;value\u0026#34;: \u0026#34;[parameters(\u0026#39;VirtualNetworkId\u0026#39;)]\u0026#34; }, \u0026#34;nicName\u0026#34;: { \u0026#34;value\u0026#34;: \u0026#34;[concat(parameters(\u0026#39;envPrefix\u0026#39;),parameters(\u0026#39;vmName\u0026#39;),\u0026#39;nic\u0026#39;)]\u0026#34; }, \u0026#34;ipAddress\u0026#34;: { \u0026#34;value\u0026#34;: \u0026#34;[reference(concat(parameters(\u0026#39;envPrefix\u0026#39;),parameters(\u0026#39;vmName\u0026#39;),\u0026#39;nic\u0026#39;)).ipConfigurations[0].properties.privateIPAddress]\u0026#34; } } } } Within the template called by my nested deployment object I use the incoming parameters to reconfigure the nic. I need to change the privateIPAllocationMethod setting to static and pass in the IP address from my parameters.\n{ \u0026#34;name\u0026#34;: \u0026#34;[parameters(\u0026#39;nicName\u0026#39;)]\u0026#34;, \u0026#34;type\u0026#34;: \u0026#34;Microsoft.Network/networkInterfaces\u0026#34;, \u0026#34;location\u0026#34;: \u0026#34;[parameters(\u0026#39;VirtualNetwork\u0026#39;).Location]\u0026#34;, \u0026#34;apiVersion\u0026#34;: \u0026#34;2015-05-01-preview\u0026#34;, \u0026#34;dependsOn\u0026#34;: [], \u0026#34;tags\u0026#34;: { \u0026#34;displayName\u0026#34;: \u0026#34;DomainControllerNic\u0026#34; }, \u0026#34;properties\u0026#34;: { \u0026#34;ipConfigurations\u0026#34;: [ { \u0026#34;name\u0026#34;: \u0026#34;ipconfig1\u0026#34;, \u0026#34;properties\u0026#34;: { \u0026#34;privateIPAllocationMethod\u0026#34;: \u0026#34;Static\u0026#34;, \u0026#34;privateIPAddress\u0026#34;: \u0026#34;[parameters(\u0026#39;ipAddress\u0026#39;)]\u0026#34;, \u0026#34;subnet\u0026#34;: { \u0026#34;id\u0026#34;: \u0026#34;[concat(parameters(\u0026#39;VirtualNetworkId\u0026#39;),\u0026#39;/subnets/\u0026#39;,parameters(\u0026#39;VirtualNetwork\u0026#39;).Subnet1Name)]\u0026#34; } } } ] } } Finally, in my virtual machine template I pass the IP address back up the chain as an output so I can use it in other templates if needed (for example, to reconfigure the vNet DNS property with the IP address of my domain controller).\n{ \u0026#34;name\u0026#34;: \u0026#34;[parameters(\u0026#39;nicName\u0026#39;)]\u0026#34;, \u0026#34;type\u0026#34;: \u0026#34;Microsoft.Network/networkInterfaces\u0026#34;, \u0026#34;location\u0026#34;: \u0026#34;[parameters(\u0026#39;VirtualNetwork\u0026#39;).Location]\u0026#34;, \u0026#34;apiVersion\u0026#34;: \u0026#34;2015-05-01-preview\u0026#34;, \u0026#34;dependsOn\u0026#34;: [], \u0026#34;tags\u0026#34;: { \u0026#34;displayName\u0026#34;: \u0026#34;DomainControllerNic\u0026#34; }, \u0026#34;properties\u0026#34;: { \u0026#34;ipConfigurations\u0026#34;: [ { \u0026#34;name\u0026#34;: \u0026#34;ipconfig1\u0026#34;, \u0026#34;properties\u0026#34;: { \u0026#34;privateIPAllocationMethod\u0026#34;: \u0026#34;Static\u0026#34;, \u0026#34;privateIPAddress\u0026#34;: \u0026#34;[parameters(\u0026#39;ipAddress\u0026#39;)]\u0026#34;, \u0026#34;subnet\u0026#34;: { \u0026#34;id\u0026#34;: \u0026#34;[concat(parameters(\u0026#39;VirtualNetworkId\u0026#39;),\u0026#39;/subnets/\u0026#39;,parameters(\u0026#39;VirtualNetwork\u0026#39;).Subnet1Name)]\u0026#34; } } } ] } } ","date":"1 November 2015","externalUrl":null,"permalink":"/posts/convert-new-vms-dynamic-ip-address-to-static-with-azure-resource-templates/","section":"Blog","summary":"Over the past few posts on this blog I’ve been documenting the templates I have been working on for Black Marble. In a previous sequence I showed how you can use nested deployments to keep your templates simple and still push out complex environments. The problem with those examples is that they are very fixed in what they do. The templates create a number of virtual machines on a virtual network, with static IP addresses for each machine.\n","title":"Convert new VM’s dynamic IP address to static with Azure Resource Templates","type":"posts"},{"content":"","date":"1 November 2015","externalUrl":null,"permalink":"/categories/events/","section":"Categories","summary":"","title":"Events","type":"categories"},{"content":"Unlike most of my recent posts this one won’t have code in it. Instead I want to talk about concepts and how you should look long and hard at your templates to optimise deployment.\nIn my previous articles I’ve talked about how nested deployments can help apply sensible structure to your deployments. I’ve also talked about things I’ve learned around what will successfully deploy and what will give errors. Nested deployments are still key, but the continuous cycle of improvements in Azure means I can change my information somewhat around what works well and what is likely to fail. Importantly, that change allows us to drastically improve our deployment time if we have lots of virtual machines.\nI’d previously found that unless I nested the extensions for a VM within the JSON of the virtual machine itself, I got lots of random deployment errors. I am happy to now report that situation has improved. The result of that improvement is that we can now separate out the extensions deployed to a virtual machines from the machine itself. That separates the configuration of the VM, which for complex environments almost certainly has a prescribed sequence, from the deployment of the VM, which almost certainly doesn’t.\nTo give you a tacit example, in the latest work at Black Marble we are deploying a multi-server environment (DC, ADFS, WAP, SQL, BizTalk, Service Bus and two IIS servers) where we deploy the VMs and configure them. With my original approach, hard-fought to achieve a reliable deploy, each VM was pushed and fully configured in the necessary sequence, domain controller first.\nWith our new approach we can deploy all eight VMs in that environment simultaneously. We have moved our DSC and Custom Script extensions into separate resource templates and that has allowed some clever sequencing to drastically shorten the time to deploy the environment (currently around fifty minutes!).\nWe did this by carefully looking at what each step was doing and really focusing on the dependencies:\nThe domain controller VM created a new virtual machine. The DSC extension then installed domain services and certificate services and created the domain. The custom script then created some certificated. The ADFS VM created a new virtual machine. The DSC extension then joined that server to the domain. The custom script then copied the certificate from the DC and configured ADFS. The WAP VM created a new virtual machine. The DSC extension then joined that server to the domain. The custom script then copied the certificate from the DC and configured the proxy for the configured ADFS service. Hopefully you can see what we saw: Each machine had three phases of configuration and the dependencies were different, giving us three separate sequences:\nThe VM creations are completely independent. We could do those in parallel to save time. The DSC configuration for the DC has to be done first, to create the domain. However, the ADFS and WAP servers have DSC that are independent, so we could do those in parallel too. The custom script configurations have a definite sequence (DC – ADFS – WAP) and the DC script depends on the DC having run it’s DSC configuration first so we have our certificate services. Once we’ve identified our work streams it’s a simple matter of declaring the dependencies in our JSON.\nTop tip: It’s a good idea to list all the dependencies for each resource. Even though the Azure Resource Manager will infer the dependency chain when it parses the template, it’s much easier for humans to look at a full list in each resource to figure out what’s going on.\nThe end result of this tinkering? We cut our deployment time in half. The really cool bit is that adding more VMs doesn’t add much time to our deploy as it’s the creation of the virtual machines that tends to take longest.\n","date":"1 November 2015","externalUrl":null,"permalink":"/posts/optimising-iaas-deployments-in-azure-resource-templates/","section":"Blog","summary":"Unlike most of my recent posts this one won’t have code in it. Instead I want to talk about concepts and how you should look long and hard at your templates to optimise deployment.\n","title":"Optimising IaaS deployments in Azure Resource Templates","type":"posts"},{"content":"","date":"1 November 2015","externalUrl":null,"permalink":"/tags/speaking/","section":"Tags","summary":"","title":"Speaking","type":"tags"},{"content":"Within a few days of each other I spoke about Azure Resource Templates at both DDDNorth 2015 and Integration Mondays run by the Integration User Group. I’d like to thank all of you who attended both and have been very kind in your feedback afterwards.\nAs promised, this post contains the useful links from my final slide.\nI’ve already written posts on much of the content covered in my talk. However, since I’m currently sat on a transatlantic flight you can expect a series of posts to follow this on topics such as objects in templates, outputs and references.\nIf you missed my Integration Monday session, the organisers recorded it and you can watch it online.\nAzure PowerShell 1.0 Preview\nhttps://azure.Microsoft.com/en-us/blog/azps-1-0-pre/\nAzure QuickStart Templates\nhttps://github.com/Azure/azure-quickstart-templates\nhttp://azure.microsoft.com/en-us/documentation/templates/\nARM Template Documentation\nhttps://msdn.microsoft.com/en-us/library/azure/dn835138.aspx\nAzure Resource Explorer\nhttps://resources.azure.com/\n“Azure Resource Manager DevOps Jumpstart”\nhttps://www.microsoftvirtualacademy.com/en-US/training-courses/azure-resource-manager-devops-jump-start-8413\n","date":"1 November 2015","externalUrl":null,"permalink":"/posts/useful-links-from-the-art-of-modern-azure-deployments/","section":"Blog","summary":"Within a few days of each other I spoke about Azure Resource Templates at both DDDNorth 2015 and Integration Mondays run by the Integration User Group. I’d like to thank all of you who attended both and have been very kind in your feedback afterwards.\n","title":"Useful links from The ART of Modern Azure Deployments","type":"posts"},{"content":"Over the past few weeks I’ve been refactoring and improving the templates that I have been creating for Black Marble to deploy environments in Azure. This is the first post of a few talking about some of the more advanced stuff I’m now doing.\nYou will remember from my previous posts that within an Azure Resource Template you can define parameters and variables, then use those for the configuration values within your resources. I was finding after a while that the sheer number of parameters and variables I had made the templates hard to read and understand. This was particularly true when my colleagues started to work with thee templates.\nThe solution I decided on was to collect individual parameters and variables into objects. These allow structures of information to be passed into and within a template. Importantly for me, this approach significantly reduces the number of items listed within the variables and parameters sections of my template, making them easier to read and understand.\nCreating objects within the JSON is easy. You can simply declare variables within a hierarchy in your JSON. This is similar to using arrays, but each property can be individually references. Below is a sample from the variables section of my current deployment template:\n\u0026ldquo;VirtualNetwork\u0026rdquo;: { \u0026ldquo;Name\u0026rdquo;: \u0026ldquo;\n\\[concat(parameters('envPrefix'), 'network')\\]\u0026rdquo;, \u0026ldquo;Location\u0026rdquo;: \u0026ldquo;\n\\[parameters('envLocation')\\]\u0026rdquo;, \u0026ldquo;Prefix\u0026rdquo;: \u0026ldquo;192.168.0.0/16\u0026rdquo;, \u0026ldquo;Subnet1Name\u0026rdquo;: \u0026ldquo;Subnet-1\u0026rdquo;, \u0026ldquo;Subnet1Prefix\u0026rdquo;: \u0026ldquo;192.168.1.0/24\u0026rdquo; }, When passing this into a nested deployment I can simply push the entire object via the parameters block of the nested deployment JSON:\n\u0026ldquo;parameters\u0026rdquo;: { \u0026ldquo;VirtualNetwork\u0026rdquo;: { \u0026ldquo;value\u0026rdquo;: \u0026ldquo;\n\\[variables('VirtualNetwork')\\]\u0026rdquo; }, \u0026ldquo;StorageAccount\u0026rdquo;: { \u0026ldquo;value\u0026rdquo;: \u0026ldquo;\n\\[variables('StorageAccount')\\]\u0026rdquo; } }\nWithin the target template I declare the parameter to be of type Object:\n\u0026ldquo;VirtualNetwork\u0026rdquo;: { \u0026ldquo;type\u0026rdquo;: \u0026ldquo;object\u0026rdquo;, \u0026ldquo;metadata\u0026rdquo;: { \u0026ldquo;description\u0026rdquo;: \u0026ldquo;object containing virtual network params\u0026rdquo; } }\nThen to reference an individual property I specify it after the parameter itself using dot notation for the hierarchy of properties:\n\u0026ldquo;subnets\u0026rdquo;: \\[ { \"name\": \"\\[parameters('VirtualNetwork').Subnet1Name\\]\u0026quot;, \u0026ldquo;properties\u0026rdquo;: { \u0026ldquo;addressPrefix\u0026rdquo;: \u0026ldquo;\n\\[parameters('VirtualNetwork').Subnet1Prefix\\]\u0026rdquo; } } ]\nThe end result is a much better structure to my templates, where I am passing blocks of related information around. It’s easier to read, understand and debug.\n","date":"1 November 2015","externalUrl":null,"permalink":"/posts/using-objects-in-azure-resource-templates/","section":"Blog","summary":"Over the past few weeks I’ve been refactoring and improving the templates that I have been creating for Black Marble to deploy environments in Azure. This is the first post of a few talking about some of the more advanced stuff I’m now doing.\n","title":"Using Objects in Azure Resource Templates","type":"posts"},{"content":"As you work more with Azure Resource Templates you will find that you need to pass information from one resource you have created into another. This is fine if you had the information to begin with within your variables and parameters, but what if it’s something you cannot know before deploy, such as the dynamic IP address of your new VM, or the FQDN of your new public IP address for your service?\nThe answer is to use References to access properties of other resources within your template. However, if you need to get information between templates then you also need to look at outputs.\nA crucial tool in this process is the Azure Resource Explorer (also now available within the Azure Portal – click Browse and look for Resource Explorer) because most often you will need to look at the JSON for your provisioned resource in order to find the specific property you seek.\nIn the JSON below I am passing the value of the current IP address of the NIC attached to a virtual machine into a nested template as a parameter.\n\u0026ldquo;ipAddress\u0026rdquo;: { \u0026ldquo;value\u0026rdquo;: \u0026ldquo;\n\\[reference(concat(parameters('envPrefix'),parameters('vmName'),'nic')).ipConfigurations\\[0\\].properties.privateIPAddress]\u0026rdquo; }\nThe markup looks complex but isn’t really. The concat bit is building the name of the resource, which I do based on parameters within the resource template. Basically, you specify reference in the same way as you would variable or parameter. You then need to provide the name of the resource you want to reference (the concat markup here, but it could just be ‘mynic’) and then the property you want, using dot notation to work your way down the object tree.\nI’ve used the example above for a reason because it covers all the bases you might hit:\nWhen you look at the JSON for the deployed resource you will see a properties section (just as you do in your template). You don’t need to include this in your reference (i.e. mynic., not mynic.properties.). My nic can have multiple IP assignments – ipConfigurations is an array – so I am using \\[0\\]to look in the first item in that array. Within the ipConfiguration is another properties object. This time I need to include it in the markup. Within the properties of the ipConfiguration is an attribute called privateIPAddress, so I specify this. It is important to remember that I can only use reference to access resources defined within my current template.\nSo what if I want to pass a value back out of my current template to the one I called it with? That’s what the Outputs section of my template is for, and by and large everything in there will be a reference to a property of a resource the current template has deployed. In the code below I am passing the same IP address back out of my template:\n\u0026ldquo;outputs\u0026rdquo;: { \u0026ldquo;ipAddress\u0026rdquo;: { \u0026ldquo;value\u0026rdquo;: \u0026ldquo;\n\\[reference(concat(parameters('envPrefix'),parameters('vmName'),'nic')).ipConfigurations\\[0\\].properties.privateIPAddress]\u0026rdquo;, \u0026ldquo;type\u0026rdquo;: \u0026ldquo;string\u0026rdquo; } }\nWithin my parent template I access that output by using the reference keyword again, this time referencing an output from the template resource. In the example below I am passing the IP address from my domain controller template into another nested deployment that will reconfigure my virtual network.\n\u0026ldquo;parameters\u0026rdquo;: { \u0026ldquo;VirtualNetwork\u0026rdquo;: { \u0026ldquo;value\u0026rdquo;: \u0026ldquo;\n\\[variables('VirtualNetwork')\\]\u0026rdquo; }, \u0026ldquo;DNSaddress\u0026rdquo;: { \u0026ldquo;value\u0026rdquo;: \u0026ldquo;\n\\[reference('DomainController').outputs.ipAddress.value\\]\u0026rdquo; } }\nNote that this markup requires me to specify .value on the end of the reference to pass the information correctly.\nReferences and outputs are important because they allow you to pass information between resources and nested deployments. They allow you to keep your variable count low and understandable, and your templates small and well defined with nested deployments for complex environments.\n","date":"1 November 2015","externalUrl":null,"permalink":"/posts/using-references-and-outputs-in-azure-resource-templates/","section":"Blog","summary":"As you work more with Azure Resource Templates you will find that you need to pass information from one resource you have created into another. This is fine if you had the information to begin with within your variables and parameters, but what if it’s something you cannot know before deploy, such as the dynamic IP address of your new VM, or the FQDN of your new public IP address for your service?\n","title":"Using References and Outputs in Azure Resource Templates","type":"posts"},{"content":"Part One of this series covered the project itself and the overall template structure. Part Two went through how I deploy the Domain Controller in depth. Part Three talks about deploying my ADFS server and in this final part I will show you how to configure the WAP server that faces the outside world.\nThe Template # The WAP server is the only one in my environment that faces the internet. Because of this the deployment is more complex. I’ve also added further complexity because I want to be able to have more than one WAP server in future, so there’s a load balancer deployed too. You can see the resource outline in the screenshot below:\nwap template json The internet-facing stuff means we need more things in our template. First up is our PublicIPAddress:\n{ \u0026#34;name\u0026#34;: \u0026#34;[variables(\u0026#39;vmWAPpublicipName\u0026#39;)]\u0026#34;, \u0026#34;type\u0026#34;: \u0026#34;Microsoft.Network/publicIPAddresses\u0026#34;, \u0026#34;location\u0026#34;: \u0026#34;[parameters(\u0026#39;resourceLocation\u0026#39;)]\u0026#34;, \u0026#34;apiVersion\u0026#34;: \u0026#34;2015-05-01-preview\u0026#34;, \u0026#34;dependsOn\u0026#34;: [ ], \u0026#34;tags\u0026#34;: { \u0026#34;displayName\u0026#34;: \u0026#34;vmWAPpublicip\u0026#34; }, \u0026#34;properties\u0026#34;: { \u0026#34;publicIPAllocationMethod\u0026#34;: \u0026#34;Dynamic\u0026#34;, \u0026#34;dnsSettings\u0026#34;: { \u0026#34;domainNameLabel\u0026#34;: \u0026#34;[variables(\u0026#39;vmWAPpublicipDnsName\u0026#39;)]\u0026#34; } } } This is pretty straightforward stuff. The nature of my environment means that I am perfectly happy with a dynamic IP that changes if I stop and then start the environment. Access will be via the hostname assigned to that IP and I use that hostname in my ADFS service configuration and certificates. Azure builds the hostname based on a pattern and I can use that pattern in my templates, which is how I’ve created the certs when I deploy the DC and configure the ADFS service all before I’ve deployed the WAP server.\nThat public IP address is then bound to our load balancer which provides the internet-endpoint for our services:\n{ \u0026#34;apiVersion\u0026#34;: \u0026#34;2015-05-01-preview\u0026#34;, \u0026#34;name\u0026#34;: \u0026#34;[variables(\u0026#39;vmWAPlbName\u0026#39;)]\u0026#34;, \u0026#34;type\u0026#34;: \u0026#34;Microsoft.Network/loadBalancers\u0026#34;, \u0026#34;location\u0026#34;: \u0026#34;[parameters(\u0026#39;resourceLocation\u0026#39;)]\u0026#34;, \u0026#34;dependsOn\u0026#34;: [ \u0026#34;[resourceId(\u0026#39;Microsoft.Network/publicIPAddresses\u0026#39;,variables(\u0026#39;vmWAPpublicipName\u0026#39;))]\u0026#34; ], \u0026#34;properties\u0026#34;: { \u0026#34;frontendIPConfigurations\u0026#34;: [ { \u0026#34;name\u0026#34;: \u0026#34;[variables(\u0026#39;LBFE\u0026#39;)]\u0026#34;, \u0026#34;properties\u0026#34;: { \u0026#34;publicIPAddress\u0026#34;: { \u0026#34;id\u0026#34;: \u0026#34;[resourceId(\u0026#39;Microsoft.Network/publicIPAddresses\u0026#39;,variables(\u0026#39;vmWAPpublicipName\u0026#39;))]\u0026#34; } } } ], \u0026#34;backendAddressPools\u0026#34;: [ { \u0026#34;name\u0026#34;: \u0026#34;[variables(\u0026#39;LBBE\u0026#39;)]\u0026#34; } ], \u0026#34;inboundNatRules\u0026#34;: [ { \u0026#34;name\u0026#34;: \u0026#34;[variables(\u0026#39;RDPNAT\u0026#39;)]\u0026#34;, \u0026#34;properties\u0026#34;: { \u0026#34;frontendIPConfiguration\u0026#34;: { \u0026#34;id\u0026#34;: \u0026#34;[variables(\u0026#39;vmWAPLbfeConfigID\u0026#39;)]\u0026#34; }, \u0026#34;protocol\u0026#34;: \u0026#34;tcp\u0026#34;, \u0026#34;frontendPort\u0026#34;: \u0026#34;[variables(\u0026#39;rdpPort\u0026#39;)]\u0026#34;, \u0026#34;backendPort\u0026#34;: 3389, \u0026#34;enableFloatingIP\u0026#34;: false } }, { \u0026#34;name\u0026#34;: \u0026#34;[variables(\u0026#39;httpsNAT\u0026#39;)]\u0026#34;, \u0026#34;properties\u0026#34;: { \u0026#34;frontendIPConfiguration\u0026#34;: { \u0026#34;id\u0026#34;: \u0026#34;[variables(\u0026#39;vmWAPLbfeConfigID\u0026#39;)]\u0026#34; }, \u0026#34;protocol\u0026#34;: \u0026#34;tcp\u0026#34;, \u0026#34;frontendPort\u0026#34;: \u0026#34;[variables(\u0026#39;httpsPort\u0026#39;)]\u0026#34;, \u0026#34;backendPort\u0026#34;: 443, \u0026#34;enableFloatingIP\u0026#34;: false } } ] } } There’s a lot going on in here so let’s work through it. First of all we connect our public IP address to the load balancer. We then create a back end configuration which we will later connect our VM to. Finally we create a set of NAT rules. I need to be able to RDP into the WAP server, which is the first block. The variables define the names of my resources. You can see that I specify the ports – external through a variable that I can change, and internal directlym because I need that to be the same each time because that’s what my VMs listen on. You can see that each NAT rule is associated with the frontendIPConfiguration – opening the port to the outside world.\nThe next step is to create a NIC that will hook our VM up to the existing virtual network and the load balancer:\n{ \u0026#34;name\u0026#34;: \u0026#34;[variables(\u0026#39;vmWAPNicName\u0026#39;)]\u0026#34;, \u0026#34;type\u0026#34;: \u0026#34;Microsoft.Network/networkInterfaces\u0026#34;, \u0026#34;location\u0026#34;: \u0026#34;[parameters(\u0026#39;resourceLocation\u0026#39;)]\u0026#34;, \u0026#34;apiVersion\u0026#34;: \u0026#34;2015-05-01-preview\u0026#34;, \u0026#34;dependsOn\u0026#34;: [ \u0026#34;[concat(\u0026#39;Microsoft.Network/publicIPAddresses/\u0026#39;, variables(\u0026#39;vmWAPpublicipName\u0026#39;))]\u0026#34;, \u0026#34;[concat(\u0026#39;Microsoft.Network/loadBalancers/\u0026#39;,variables(\u0026#39;vmWAPlbName\u0026#39;))]\u0026#34; ], \u0026#34;tags\u0026#34;: { \u0026#34;displayName\u0026#34;: \u0026#34;vmWAPNic\u0026#34; }, \u0026#34;properties\u0026#34;: { \u0026#34;ipConfigurations\u0026#34;: [ { \u0026#34;name\u0026#34;: \u0026#34;ipconfig1\u0026#34;, \u0026#34;properties\u0026#34;: { \u0026#34;privateIPAllocationMethod\u0026#34;: \u0026#34;Static\u0026#34;, \u0026#34;privateIPAddress\u0026#34;: \u0026#34;[variables(\u0026#39;vmWAPIPAddress\u0026#39;)]\u0026#34;, \u0026#34;subnet\u0026#34;: { \u0026#34;id\u0026#34;: \u0026#34;[variables(\u0026#39;vmWAPSubnetRef\u0026#39;)]\u0026#34; }, \u0026#34;loadBalancerBackendAddressPools\u0026#34;: [ { \u0026#34;id\u0026#34;: \u0026#34;[variables(\u0026#39;vmWAPBEAddressPoolID\u0026#39;)]\u0026#34; } ], \u0026#34;loadBalancerInboundNatRules\u0026#34;: [ { \u0026#34;id\u0026#34;: \u0026#34;[variables(\u0026#39;vmWAPRDPNATRuleID\u0026#39;)]\u0026#34; }, { \u0026#34;id\u0026#34;: \u0026#34;[variables(\u0026#39;vmWAPhttpsNATRuleID\u0026#39;)]\u0026#34; } ] } } ] } } ```json Here you can see that the NIC is connected to a subnet on our virtual network with a static IP that I specify in a variable. It is then added to the load balancer back end address pool and finally I need to specify which of the NAT rules I created in the load balancer are hooked up to my VM. If I don’t include the binding here, traffic won’t be passed to my VM (as I discovered when developing this lot – I forgot to wire up https and as a result couldn’t access the website published by WAP!). The VM itself is basically the same as my ADFS server. I use the same Windows Sever 2012 R2 image, have a single disk and I’ve nested the extensions within the VM because that seems to work better than not doing: ```json { \u0026#34;name\u0026#34;: \u0026#34;[variables(\u0026#39;vmWAPName\u0026#39;)]\u0026#34;, \u0026#34;type\u0026#34;: \u0026#34;Microsoft.Compute/virtualMachines\u0026#34;, \u0026#34;location\u0026#34;: \u0026#34;[parameters(\u0026#39;resourceLocation\u0026#39;)]\u0026#34;, \u0026#34;apiVersion\u0026#34;: \u0026#34;2015-05-01-preview\u0026#34;, \u0026#34;dependsOn\u0026#34;: [ \u0026#34;[concat(\u0026#39;Microsoft.Network/networkInterfaces/\u0026#39;, variables(\u0026#39;vmWAPNicName\u0026#39;))]\u0026#34;, ], \u0026#34;tags\u0026#34;: { \u0026#34;displayName\u0026#34;: \u0026#34;vmWAP\u0026#34; }, \u0026#34;properties\u0026#34;: { \u0026#34;hardwareProfile\u0026#34;: { \u0026#34;vmSize\u0026#34;: \u0026#34;[variables(\u0026#39;vmWAPVmSize\u0026#39;)]\u0026#34; }, \u0026#34;osProfile\u0026#34;: { \u0026#34;computername\u0026#34;: \u0026#34;[variables(\u0026#39;vmWAPName\u0026#39;)]\u0026#34;, \u0026#34;adminUsername\u0026#34;: \u0026#34;[parameters(\u0026#39;adminUsername\u0026#39;)]\u0026#34;, \u0026#34;adminPassword\u0026#34;: \u0026#34;[parameters(\u0026#39;adminPassword\u0026#39;)]\u0026#34; }, \u0026#34;storageProfile\u0026#34;: { \u0026#34;imageReference\u0026#34;: { \u0026#34;publisher\u0026#34;: \u0026#34;[variables(\u0026#39;windowsImagePublisher\u0026#39;)]\u0026#34;, \u0026#34;offer\u0026#34;: \u0026#34;[variables(\u0026#39;windowsImageOffer\u0026#39;)]\u0026#34;, \u0026#34;sku\u0026#34;: \u0026#34;[variables(\u0026#39;windowsImageSKU\u0026#39;)]\u0026#34;, \u0026#34;version\u0026#34;: \u0026#34;latest\u0026#34; }, \u0026#34;osDisk\u0026#34;: { \u0026#34;name\u0026#34;: \u0026#34;[concat(variables(\u0026#39;vmWAPName\u0026#39;), \u0026#39;-os-disk\u0026#39;)]\u0026#34;, \u0026#34;vhd\u0026#34;: { \u0026#34;uri\u0026#34;: \u0026#34;[concat(\u0026#39;http://\u0026#39;, variables(\u0026#39;storageAccountName\u0026#39;), \u0026#39;.blob.core.windows.net/\u0026#39;, variables(\u0026#39;vmStorageAccountContainerName\u0026#39;), \u0026#39;/\u0026#39;, variables(\u0026#39;vmWAPName\u0026#39;), \u0026#39;os.vhd\u0026#39;)]\u0026#34; }, \u0026#34;caching\u0026#34;: \u0026#34;ReadWrite\u0026#34;, \u0026#34;createOption\u0026#34;: \u0026#34;FromImage\u0026#34; } }, \u0026#34;networkProfile\u0026#34;: { \u0026#34;networkInterfaces\u0026#34;: [ { \u0026#34;id\u0026#34;: \u0026#34;[resourceId(\u0026#39;Microsoft.Network/networkInterfaces\u0026#39;, variables(\u0026#39;vmWAPNicName\u0026#39;))]\u0026#34; } ] } }, \u0026#34;resources\u0026#34;: [ { \u0026#34;type\u0026#34;: \u0026#34;extensions\u0026#34;, \u0026#34;name\u0026#34;: \u0026#34;IaaSDiagnostics\u0026#34;, \u0026#34;apiVersion\u0026#34;: \u0026#34;2015-06-15\u0026#34;, \u0026#34;location\u0026#34;: \u0026#34;[parameters(\u0026#39;resourceLocation\u0026#39;)]\u0026#34;, \u0026#34;dependsOn\u0026#34;: [ \u0026#34;[concat(\u0026#39;Microsoft.Compute/virtualMachines/\u0026#39;, variables(\u0026#39;vmWAPName\u0026#39;))]\u0026#34; ], \u0026#34;tags\u0026#34;: { \u0026#34;displayName\u0026#34;: \u0026#34;[concat(variables(\u0026#39;vmWAPName\u0026#39;),\u0026#39;/vmDiagnostics\u0026#39;)]\u0026#34; }, \u0026#34;properties\u0026#34;: { \u0026#34;publisher\u0026#34;: \u0026#34;Microsoft.Azure.Diagnostics\u0026#34;, \u0026#34;type\u0026#34;: \u0026#34;IaaSDiagnostics\u0026#34;, \u0026#34;typeHandlerVersion\u0026#34;: \u0026#34;1.4\u0026#34;, \u0026#34;autoUpgradeMinorVersion\u0026#34;: \u0026#34;true\u0026#34;, \u0026#34;settings\u0026#34;: { \u0026#34;xmlCfg\u0026#34;: \u0026#34;[base64(variables(\u0026#39;wadcfgx\u0026#39;))]\u0026#34;, \u0026#34;StorageAccount\u0026#34;: \u0026#34;[variables(\u0026#39;storageAccountName\u0026#39;)]\u0026#34; }, \u0026#34;protectedSettings\u0026#34;: { \u0026#34;storageAccountName\u0026#34;: \u0026#34;[variables(\u0026#39;storageAccountName\u0026#39;)]\u0026#34;, \u0026#34;storageAccountKey\u0026#34;: \u0026#34;[listKeys(variables(\u0026#39;storageAccountid\u0026#39;),\u0026#39;2015-05-01-preview\u0026#39;).key1]\u0026#34;, \u0026#34;storageAccountEndPoint\u0026#34;: \u0026#34;https://core.windows.net/\u0026#34; } } }, { \u0026#34;type\u0026#34;: \u0026#34;Microsoft.Compute/virtualMachines/extensions\u0026#34;, \u0026#34;name\u0026#34;: \u0026#34;[concat(variables(\u0026#39;vmWAPName\u0026#39;),\u0026#39;/WAPserver\u0026#39;)]\u0026#34;, \u0026#34;apiVersion\u0026#34;: \u0026#34;2015-05-01-preview\u0026#34;, \u0026#34;location\u0026#34;: \u0026#34;[parameters(\u0026#39;resourceLocation\u0026#39;)]\u0026#34;, \u0026#34;dependsOn\u0026#34;: [ \u0026#34;[resourceId(\u0026#39;Microsoft.Compute/virtualMachines\u0026#39;, variables(\u0026#39;vmWAPName\u0026#39;))]\u0026#34;, \u0026#34;[concat(\u0026#39;Microsoft.Compute/virtualMachines/\u0026#39;, variables(\u0026#39;vmWAPName\u0026#39;),\u0026#39;/extensions/IaaSDiagnostics\u0026#39;)]\u0026#34; ], \u0026#34;properties\u0026#34;: { \u0026#34;publisher\u0026#34;: \u0026#34;Microsoft.Powershell\u0026#34;, \u0026#34;type\u0026#34;: \u0026#34;DSC\u0026#34;, \u0026#34;typeHandlerVersion\u0026#34;: \u0026#34;1.7\u0026#34;, \u0026#34;settings\u0026#34;: { \u0026#34;modulesURL\u0026#34;: \u0026#34;[concat(variables(\u0026#39;vmDSCmoduleUrl\u0026#39;), parameters(\u0026#39;_artifactsLocationSasToken\u0026#39;))]\u0026#34;, \u0026#34;configurationFunction\u0026#34;: \u0026#34;[variables(\u0026#39;vmWAPConfigurationFunction\u0026#39;)]\u0026#34;, \u0026#34;properties\u0026#34;: { \u0026#34;domainName\u0026#34;: \u0026#34;[variables(\u0026#39;domainName\u0026#39;)]\u0026#34;, \u0026#34;adminCreds\u0026#34;: { \u0026#34;userName\u0026#34;: \u0026#34;[parameters(\u0026#39;adminUsername\u0026#39;)]\u0026#34;, \u0026#34;password\u0026#34;: \u0026#34;PrivateSettingsRef:adminPassword\u0026#34; } } }, \u0026#34;protectedSettings\u0026#34;: { \u0026#34;items\u0026#34;: { \u0026#34;adminPassword\u0026#34;: \u0026#34;[parameters(\u0026#39;adminPassword\u0026#39;)]\u0026#34; } } } }, { \u0026#34;type\u0026#34;: \u0026#34;Microsoft.Compute/virtualMachines/extensions\u0026#34;, \u0026#34;name\u0026#34;: \u0026#34;[concat(variables(\u0026#39;vmWAPName\u0026#39;),\u0026#39;/wapScript\u0026#39;)]\u0026#34;, \u0026#34;apiVersion\u0026#34;: \u0026#34;2015-05-01-preview\u0026#34;, \u0026#34;location\u0026#34;: \u0026#34;[parameters(\u0026#39;resourceLocation\u0026#39;)]\u0026#34;, \u0026#34;dependsOn\u0026#34;: [ \u0026#34;[concat(\u0026#39;Microsoft.Compute/virtualMachines/\u0026#39;, variables(\u0026#39;vmWAPName\u0026#39;))]\u0026#34;, \u0026#34;[concat(\u0026#39;Microsoft.Compute/virtualMachines/\u0026#39;, variables(\u0026#39;vmWAPName\u0026#39;),\u0026#39;/extensions/WAPserver\u0026#39;)]\u0026#34; ], \u0026#34;properties\u0026#34;: { \u0026#34;publisher\u0026#34;: \u0026#34;Microsoft.Compute\u0026#34;, \u0026#34;type\u0026#34;: \u0026#34;CustomScriptExtension\u0026#34;, \u0026#34;typeHandlerVersion\u0026#34;: \u0026#34;1.4\u0026#34;, \u0026#34;settings\u0026#34;: { \u0026#34;fileUris\u0026#34;: [ \u0026#34;[concat(parameters(\u0026#39;_artifactsLocation\u0026#39;),\u0026#39;/WapServer.ps1\u0026#39;, parameters(\u0026#39;_artifactsLocationSasToken\u0026#39;))]\u0026#34;, \u0026#34;[concat(parameters(\u0026#39;_artifactsLocation\u0026#39;),\u0026#39;/PSPKI.zip\u0026#39;, parameters(\u0026#39;_artifactsLocationSasToken\u0026#39;))]\u0026#34;, \u0026#34;[concat(parameters(\u0026#39;_artifactsLocation\u0026#39;),\u0026#39;/tuServDeployFunctions.ps1\u0026#39;, parameters(\u0026#39;_artifactsLocationSasToken\u0026#39;))]\u0026#34; ], \u0026#34;commandToExecute\u0026#34;: \u0026#34;[concat(\u0026#39;powershell.exe -file WAPServer.ps1\u0026#39;,\u0026#39; -vmAdminUsername \u0026#39;,parameters(\u0026#39;adminUsername\u0026#39;),\u0026#39; -vmAdminPassword \u0026#39;,parameters(\u0026#39;adminPassword\u0026#39;),\u0026#39; -fsServiceName \u0026#39;,variables(\u0026#39;vmWAPpublicipDnsName\u0026#39;),\u0026#39; -adfsServerName \u0026#39;,variables(\u0026#39;vmADFSName\u0026#39;),\u0026#39; -vmDCname \u0026#39;,variables(\u0026#39;vmDCName\u0026#39;), \u0026#39; -resourceLocation \u0026#34;\u0026#39;, parameters(\u0026#39;resourceLocation\u0026#39;),\u0026#39;\u0026#34;\u0026#39;)]\u0026#34; } } } ] } The DSC and custom script extension are in the same vein as with ADFS. I can get the features on with DSC and then I need to configure stuff with my script.\nThe DSC Modules # As with the other two servers, the files copied into the VM by the DSC extension are common. I then call the appropriate configuration for the WAP server, held within my common configuration file. The WAP server configuration is shown below:\nconfiguration WAPserver { param ( [Parameter(Mandatory)] [String]$DomainName, [Parameter(Mandatory)] [System.Management.Automation.PSCredential]$Admincreds, [Int]$RetryCount = 20, [Int]$RetryIntervalSec = 30 ) Import-DscResource -ModuleName xComputerManagement, xActiveDirectory Node localhost { WindowsFeature WAPInstall { Ensure = \u0026#34;Present\u0026#34; Name = \u0026#34;Web-Application-Proxy\u0026#34; } WindowsFeature WAPMgmt { Ensure = \u0026#34;Present\u0026#34; Name = \u0026#34;RSAT-RemoteAccess\u0026#34; } WindowsFeature ADPS { Name = \u0026#34;RSAT-AD-PowerShell\u0026#34; Ensure = \u0026#34;Present\u0026#34; } xWaitForADDomain DscForestWait { DomainName = $DomainName DomainUserCredential= $Admincreds RetryCount = $RetryCount RetryIntervalSec = $RetryIntervalSec DependsOn = \u0026#34;[WindowsFeature]ADPS\u0026#34; } xComputer DomainJoin { Name = $env:COMPUTERNAME DomainName = $DomainName Credential = New-Object System.Management.Automation.PSCredential (\u0026#34;${DomainName}$($Admincreds.UserName)\u0026#34;, $Admincreds.Password) DependsOn = \u0026#34;[xWaitForADDomain]DscForestWait\u0026#34; } LocalConfigurationManager { DebugMode = $true RebootNodeIfNeeded = $true } } } As with ADFS, the configuration joins the domain and adds the required features for WAP. Note that I install the RSAT tools for Remote Access. If you don’t do this, you can’t configure WAP because the powershell modules aren’t installed!\nThe Custom Scripts # The WAP script performs much of the same work as the ADFS script. I need to install the certificate for my service, so that’s copied onto the server by the script before it runs an invoke-command block. The main script is run as the local system account and can successfully connect to the DC as the computer account. I then run my invoke-command with domain admin credentials so I can configure WAP, and once inside the invoke-command block network access gets tricky, so I don’t do it!\n# # WapServer.ps1 # param ( $vmAdminUsername, $vmAdminPassword, $fsServiceName, $adfsServerName, $vmDCname, $resourceLocation ) $password = ConvertTo-SecureString $vmAdminPassword -AsPlainText -Force $credential = New-Object System.Management.Automation.PSCredential(\u0026#34;$env:USERDOMAIN$vmAdminUsername\u0026#34;, $password) Write-Verbose -Verbose \u0026#34;Entering Domain Controller Script\u0026#34; Write-Verbose -verbose \u0026#34;Script path: $PSScriptRoot\u0026#34; Write-Verbose -Verbose \u0026#34;vmAdminUsername: $vmAdminUsername\u0026#34; Write-Verbose -Verbose \u0026#34;vmAdminPassword: $vmAdminPassword\u0026#34; Write-Verbose -Verbose \u0026#34;fsServiceName: $fsServiceName\u0026#34; Write-Verbose -Verbose \u0026#34;adfsServerName: $adfsServerName\u0026#34; Write-Verbose -Verbose \u0026#34;env:UserDomain: $env:USERDOMAIN\u0026#34; Write-Verbose -Verbose \u0026#34;resourceLocation: $resourceLocation\u0026#34; -Verbose \u0026#34;===================================\u0026#34; # Write an event to the event log to say that the script has executed. $event = New-Object System.Diagnostics.EventLog(\u0026#34;Application\u0026#34;) $event.Source = \u0026#34;tuServEnvironment\u0026#34; $info_event = [System.Diagnostics.EventLogEntryType]::Information $event.WriteEntry(\u0026#34;WAPserver Script Executed\u0026#34;, $info_event, 5001) $srcPath = \u0026#34;\u0026#34; + $vmDCname + \u0026#34;src\u0026#34; $fsCertificateSubject = $fsServiceName + \u0026#34;.\u0026#34; + ($resourceLocation.Replace(\u0026#34; \u0026#34;, \u0026#34;\u0026#34;)).ToLower() + \u0026#34;.cloudapp.azure.com\u0026#34; $fsCertFileName = $fsCertificateSubject + \u0026#34;.pfx\u0026#34; $certPath = $srcPath + \u0026#34;\u0026#34; + $fsCertFileName #Copy cert from DC write-verbose -Verbose \u0026#34;Copying $certpath to $PSScriptRoot\u0026#34; # $powershellCommand = \u0026#34;\u0026amp; {copy-item \u0026#39;\u0026#34; + $certPath + \u0026#34;\u0026#39; \u0026#39;\u0026#34; + $workingDir + \u0026#34;\u0026#39;}\u0026#34; # Write-Verbose -Verbose $powershellCommand # $bytes = [System.Text.Encoding]::Unicode.GetBytes($powershellCommand) # $encodedCommand = [Convert]::ToBase64String($bytes) # Start-Process -wait \u0026#34;powershell.exe\u0026#34; -ArgumentList \u0026#34;-encodedcommand $encodedCommand\u0026#34; copy-item $certPath -Destination $PSScriptRoot -Verbose Invoke-Command -Credential $credential -ComputerName $env:COMPUTERNAME -ScriptBlock { param ( $workingDir, $vmAdminPassword, $domainCredential, $adfsServerName, $fsServiceName, $vmDCname, $resourceLocation ) # Working variables # Write an event to the event log to say that the script has executed. $event = New-Object System.Diagnostics.EventLog(\u0026#34;Application\u0026#34;) $event.Source = \u0026#34;tuServEnvironment\u0026#34; $info_event = [System.Diagnostics.EventLogEntryType]::Information $event.WriteEntry(\u0026#34;In WAPserver scriptblock\u0026#34;, $info_event, 5001) #go to our packages scripts folder Set-Location $workingDir $zipfile = $workingDir + \u0026#34;PSPKI.zip\u0026#34; $destination = $workingDir [System.Reflection.Assembly]::LoadWithPartialName(\u0026#34;System.IO.Compression.FileSystem\u0026#34;) | Out-Null [System.IO.Compression.ZipFile]::ExtractToDirectory($zipfile, $destination) Import-Module .tuServDeployFunctions.ps1 $fsCertificateSubject = $fsServiceName + \u0026#34;.\u0026#34; + ($resourceLocation.Replace(\u0026#34; \u0026#34;, \u0026#34;\u0026#34;)).ToLower() + \u0026#34;.cloudapp.azure.com\u0026#34; $fsCertFileName = $workingDir + \u0026#34;\u0026#34; + $fsCertificateSubject + \u0026#34;.pfx\u0026#34; Write-Verbose -Verbose \u0026#34;Importing sslcert $fsCertFileName\u0026#34; Import-SSLCertificate -certificateFileName $fsCertFileName -certificatePassword $vmAdminPassword $fsIpAddress = (Resolve-DnsName $adfsServerName -type a).ipaddress Add-HostsFileEntry -ip $fsIpAddress -domain $fsCertificateSubject Set-WapConfiguration -credential $domainCredential -fedServiceName $fsCertificateSubject -certificateSubject $fsCertificateSubject } -ArgumentList $PSScriptRoot, $vmAdminPassword, $credential, $adfsServerName, $fsServiceName, $vmDCname, $resourceLocation The script modifies the HOSTS file on the server so it can find the ADFS service and then configures the Web Application Proxy for that ADFS service. It’s worth mentioning at this point the $fsCertificateSubject, which is also my service name. When we first worked on this environment using the old Azure PowerShell commands the name of the public endpoint was always .cloudapp.net. When I use the new Resource Manager model I discovered that is now ..cloudapp.azure.com. The is in our control – we specify it. The isn’t quite, and is the resource location for our deployment (converted to lowercase with no spaces). You’ll find that same line of code in the DC and ADFS scripts and it’s creating the hostname our service will use based on the resource location specified in the template, passed into the script as a parameter.\nThe functions called by that script are shown below:\nfunction Import-SSLCertificate { [CmdletBinding()] param ( $certificateFileName, $certificatePassword ) Write-Verbose -Verbose \u0026#34;Importing cert $certificateFileName with password $certificatePassword\u0026#34; Write-Verbose -Verbose \u0026#34;---\u0026#34; Import-Module .PSPKIpspki.psm1 Write-Verbose -Verbose \u0026#34;Attempting to import certificate\u0026#34; $certificateFileName # import it $password = ConvertTo-SecureString $certificatePassword -AsPlainText -Force Import-PfxCertificate –FilePath ($certificateFileName) cert:localMachinemy -Password $password } function Add-HostsFileEntry { [CmdletBinding()] param ( $ip, $domain ) $hostsFile = \u0026#34;$env:windirSystem32driversetchosts\u0026#34; $newHostEntry = \u0026#34;`t$ip`t$domain\u0026#34;; if ((gc $hostsFile) -contains $NewHostEntry) { Write-Verbose -Verbose \u0026#34;The hosts file already contains the entry: $newHostEntry. File not updated.\u0026#34;; } else { Add-Content -Path $hostsFile -Value $NewHostEntry; } } function Set-WapConfiguration { [CmdletBinding()] Param( $credential, $fedServiceName, $certificateSubject ) Write-Verbose -Verbose \u0026#34;Configuring WAP Role\u0026#34; Write-Verbose -Verbose \u0026#34;---\u0026#34; # $certificate = (dir Cert:LocalMachineMy | where { $_.subject -match $certificateSubject }).thumbprint $certificateThumbprint = (get-childitem Cert:LocalMachineMy | where { $_.subject -match $certificateSubject } | Sort-Object -Descending NotBefore)[0].thumbprint # install WAP Install-WebApplicationProxy –CertificateThumbprint $certificateThumbprint -FederationServiceName $fedServiceName -FederationServiceTrustCredential $credential } What’s Left? # This sequence of posts has talked about Resource Templates and how I structure mine based on my experience of developing and repeatedly deploying a pretty complex environment. It’s also given you specific config advice for doing the same as me: Create a Domain Controller and Certificate Authority, create an ADFS server and publish that server via a Web Application Proxy. If you only copy the stuff so far you’ll have an isolated environment that you can access via the WAP server for remote management.\nI’m still working on this, however. I have a SQL server to configure. It turns out that DSC modules for SQL are pretty rich and I’ll blog on those at some point. I am also adding a BizTalk server. I suspect that will involve more on the custom script side. I then need to deploy my application itself, which I haven’t even begun yet (although the guys have created a rich set of automation PowerShell scripts to deal with the deployment).\nOverall, I hope you take away from this series of posts just how powerful Azure Resource Templates can bee when pushing out IaaS solutions. I haven’t even touched on the PaaS components of Azure, but they can be dealt with in the same way. The need to learn this stuff is common across IT, Dev and DevOps, and it’s really interesting and fun to work on (if frustrating at times). I strongly encourage you to go play!\nCredits # As with the previous posts, stuff I’ve talked about has been derived in part from existing resources:\nThe Azure Quick Start templates were invaluable in having something to look at in the early days of resource templates before the tooling was here. PSPKI is a fantastic set of PowerShell modules for dealing with certs. The individual VM scripts are derived from work that was done in Black Marble by Andrew Davidson and myself to build the exact same environment in the older Azure manner without resource templates. ","date":"30 August 2015","externalUrl":null,"permalink":"/posts/complex-azure-odyssey-part-four-wap-server/","section":"Blog","summary":"Part One of this series covered the project itself and the overall template structure. Part Two went through how I deploy the Domain Controller in depth. Part Three talks about deploying my ADFS server and in this final part I will show you how to configure the WAP server that faces the outside world.\n","title":"Complex Azure Odyssey Part Four: WAP Server","type":"posts"},{"content":"","date":"30 August 2015","externalUrl":null,"permalink":"/series/complex-azure-template-odyssey/","section":"Series","summary":"","title":"Complex Azure Template Odyssey","type":"series"},{"content":"Part One of this series covered the project itself and the overall template structure. Part Two went through how I deploy the Domain Controller in depth. This post will focus on the next server in the chain: The ADFS server that is required to enable authentication in the application which will eventually be installed on this environment.\nThe Template # The nested deployment template for the ADFS server differs little from my DC template. If anything, it’s even simpler because we don’t have to reconfigure the virtual network after deploying the VM. The screenshot below shots the JSON outline for the template.\nadfs template json You can see that it follows the same pattern as the DC template in part two. I have a VM, a NIC that it depends on and which is attached to our virtual network, and I have VM extensions within the VM itself to enable diagnostics, push a DSC configuration to the VM and execute a custom PowerShell script.\nI went through the template construction in detail with the DC, so here I’ll simply show the resources code for you. The VM uses the same Windows Server base image as the DC but doesn’t need the extra disk that we attached to the DC.\n\u0026#34;resources\u0026#34;: [ { \u0026#34;apiVersion\u0026#34;: \u0026#34;2015-05-01-preview\u0026#34;, \u0026#34;dependsOn\u0026#34;: [], \u0026#34;location\u0026#34;: \u0026#34;[parameters(\u0026#39;resourceLocation\u0026#39;)]\u0026#34;, \u0026#34;name\u0026#34;: \u0026#34;[variables(\u0026#39;vmADFSNicName\u0026#39;)]\u0026#34;, \u0026#34;properties\u0026#34;: { \u0026#34;ipConfigurations\u0026#34;: [ { \u0026#34;name\u0026#34;: \u0026#34;ipconfig1\u0026#34;, \u0026#34;properties\u0026#34;: { \u0026#34;privateIPAllocationMethod\u0026#34;: \u0026#34;Static\u0026#34;, \u0026#34;privateIPAddress\u0026#34;: \u0026#34;[variables(\u0026#39;vmADFSIPAddress\u0026#39;)]\u0026#34;, \u0026#34;subnet\u0026#34;: { \u0026#34;id\u0026#34;: \u0026#34;[variables(\u0026#39;vmADFSSubnetRef\u0026#39;)]\u0026#34; } } } ] }, \u0026#34;tags\u0026#34;: { \u0026#34;displayName\u0026#34;: \u0026#34;vmADFSNic\u0026#34; }, \u0026#34;type\u0026#34;: \u0026#34;Microsoft.Network/networkInterfaces\u0026#34; }, { \u0026#34;name\u0026#34;: \u0026#34;[variables(\u0026#39;vmADFSName\u0026#39;)]\u0026#34;, \u0026#34;type\u0026#34;: \u0026#34;Microsoft.Compute/virtualMachines\u0026#34;, \u0026#34;location\u0026#34;: \u0026#34;[parameters(\u0026#39;resourceLocation\u0026#39;)]\u0026#34;, \u0026#34;apiVersion\u0026#34;: \u0026#34;2015-05-01-preview\u0026#34;, \u0026#34;dependsOn\u0026#34;: [ \u0026#34;[concat(\u0026#39;Microsoft.Network/networkInterfaces/\u0026#39;, variables(\u0026#39;vmADFSNicName\u0026#39;))]\u0026#34;, ], \u0026#34;tags\u0026#34;: { \u0026#34;displayName\u0026#34;: \u0026#34;vmADFS\u0026#34; }, \u0026#34;properties\u0026#34;: { \u0026#34;hardwareProfile\u0026#34;: { \u0026#34;vmSize\u0026#34;: \u0026#34;[variables(\u0026#39;vmADFSVmSize\u0026#39;)]\u0026#34; }, \u0026#34;osProfile\u0026#34;: { \u0026#34;computername\u0026#34;: \u0026#34;[variables(\u0026#39;vmADFSName\u0026#39;)]\u0026#34;, \u0026#34;adminUsername\u0026#34;: \u0026#34;[parameters(\u0026#39;adminUsername\u0026#39;)]\u0026#34;, \u0026#34;adminPassword\u0026#34;: \u0026#34;[parameters(\u0026#39;adminPassword\u0026#39;)]\u0026#34; }, \u0026#34;storageProfile\u0026#34;: { \u0026#34;imageReference\u0026#34;: { \u0026#34;publisher\u0026#34;: \u0026#34;[variables(\u0026#39;windowsImagePublisher\u0026#39;)]\u0026#34;, \u0026#34;offer\u0026#34;: \u0026#34;[variables(\u0026#39;windowsImageOffer\u0026#39;)]\u0026#34;, \u0026#34;sku\u0026#34;: \u0026#34;[variables(\u0026#39;windowsImageSKU\u0026#39;)]\u0026#34;, \u0026#34;version\u0026#34;: \u0026#34;latest\u0026#34; }, \u0026#34;osDisk\u0026#34;: { \u0026#34;name\u0026#34;: \u0026#34;[concat(variables(\u0026#39;vmADFSName\u0026#39;), \u0026#39;-os-disk\u0026#39;)]\u0026#34;, \u0026#34;vhd\u0026#34;: { \u0026#34;uri\u0026#34;: \u0026#34;[concat(\u0026#39;http://\u0026#39;, variables(\u0026#39;storageAccountName\u0026#39;), \u0026#39;.blob.core.windows.net/\u0026#39;, variables(\u0026#39;vmStorageAccountContainerName\u0026#39;), \u0026#39;/\u0026#39;, variables(\u0026#39;vmADFSName\u0026#39;), \u0026#39;os.vhd\u0026#39;)]\u0026#34; }, \u0026#34;caching\u0026#34;: \u0026#34;ReadWrite\u0026#34;, \u0026#34;createOption\u0026#34;: \u0026#34;FromImage\u0026#34; } }, \u0026#34;networkProfile\u0026#34;: { \u0026#34;networkInterfaces\u0026#34;: [ { \u0026#34;id\u0026#34;: \u0026#34;[resourceId(\u0026#39;Microsoft.Network/networkInterfaces\u0026#39;, variables(\u0026#39;vmADFSNicName\u0026#39;))]\u0026#34; } ] } }, \u0026#34;resources\u0026#34;: [ { \u0026#34;type\u0026#34;: \u0026#34;extensions\u0026#34;, \u0026#34;name\u0026#34;: \u0026#34;IaaSDiagnostics\u0026#34;, \u0026#34;apiVersion\u0026#34;: \u0026#34;2015-06-15\u0026#34;, \u0026#34;location\u0026#34;: \u0026#34;[parameters(\u0026#39;resourceLocation\u0026#39;)]\u0026#34;, \u0026#34;dependsOn\u0026#34;: [ \u0026#34;[concat(\u0026#39;Microsoft.Compute/virtualMachines/\u0026#39;, variables(\u0026#39;vmADFSName\u0026#39;))]\u0026#34; ], \u0026#34;tags\u0026#34;: { \u0026#34;displayName\u0026#34;: \u0026#34;[concat(variables(\u0026#39;vmADFSName\u0026#39;),\u0026#39;/vmDiagnostics\u0026#39;)]\u0026#34; }, \u0026#34;properties\u0026#34;: { \u0026#34;publisher\u0026#34;: \u0026#34;Microsoft.Azure.Diagnostics\u0026#34;, \u0026#34;type\u0026#34;: \u0026#34;IaaSDiagnostics\u0026#34;, \u0026#34;typeHandlerVersion\u0026#34;: \u0026#34;1.4\u0026#34;, \u0026#34;autoUpgradeMinorVersion\u0026#34;: \u0026#34;true\u0026#34;, \u0026#34;settings\u0026#34;: { \u0026#34;xmlCfg\u0026#34;: \u0026#34;[base64(variables(\u0026#39;wadcfgx\u0026#39;))]\u0026#34;, \u0026#34;StorageAccount\u0026#34;: \u0026#34;[variables(\u0026#39;storageAccountName\u0026#39;)]\u0026#34; }, \u0026#34;protectedSettings\u0026#34;: { \u0026#34;storageAccountName\u0026#34;: \u0026#34;[variables(\u0026#39;storageAccountName\u0026#39;)]\u0026#34;, \u0026#34;storageAccountKey\u0026#34;: \u0026#34;[listKeys(variables(\u0026#39;storageAccountid\u0026#39;),\u0026#39;2015-05-01-preview\u0026#39;).key1]\u0026#34;, \u0026#34;storageAccountEndPoint\u0026#34;: \u0026#34;https://core.windows.net/\u0026#34; } } }, { \u0026#34;type\u0026#34;: \u0026#34;Microsoft.Compute/virtualMachines/extensions\u0026#34;, \u0026#34;name\u0026#34;: \u0026#34;[concat(variables(\u0026#39;vmADFSName\u0026#39;),\u0026#39;/ADFSserver\u0026#39;)]\u0026#34;, \u0026#34;apiVersion\u0026#34;: \u0026#34;2015-05-01-preview\u0026#34;, \u0026#34;location\u0026#34;: \u0026#34;[parameters(\u0026#39;resourceLocation\u0026#39;)]\u0026#34;, \u0026#34;dependsOn\u0026#34;: [ \u0026#34;[resourceId(\u0026#39;Microsoft.Compute/virtualMachines\u0026#39;, variables(\u0026#39;vmADFSName\u0026#39;))]\u0026#34;, \u0026#34;[concat(\u0026#39;Microsoft.Compute/virtualMachines/\u0026#39;, variables(\u0026#39;vmADFSName\u0026#39;),\u0026#39;/extensions/IaaSDiagnostics\u0026#39;)]\u0026#34; ], \u0026#34;properties\u0026#34;: { \u0026#34;publisher\u0026#34;: \u0026#34;Microsoft.Powershell\u0026#34;, \u0026#34;type\u0026#34;: \u0026#34;DSC\u0026#34;, \u0026#34;typeHandlerVersion\u0026#34;: \u0026#34;1.7\u0026#34;, \u0026#34;settings\u0026#34;: { \u0026#34;modulesURL\u0026#34;: \u0026#34;[concat(variables(\u0026#39;vmDSCmoduleUrl\u0026#39;), parameters(\u0026#39;_artifactsLocationSasToken\u0026#39;))]\u0026#34;, \u0026#34;configurationFunction\u0026#34;: \u0026#34;[variables(\u0026#39;vmADFSConfigurationFunction\u0026#39;)]\u0026#34;, \u0026#34;properties\u0026#34;: { \u0026#34;domainName\u0026#34;: \u0026#34;[variables(\u0026#39;domainName\u0026#39;)]\u0026#34;, \u0026#34;vmDCName\u0026#34;: \u0026#34;[variables(\u0026#39;vmDCName\u0026#39;)]\u0026#34;, \u0026#34;adminCreds\u0026#34;: { \u0026#34;userName\u0026#34;: \u0026#34;[parameters(\u0026#39;adminUsername\u0026#39;)]\u0026#34;, \u0026#34;password\u0026#34;: \u0026#34;PrivateSettingsRef:adminPassword\u0026#34; } } }, \u0026#34;protectedSettings\u0026#34;: { \u0026#34;items\u0026#34;: { \u0026#34;adminPassword\u0026#34;: \u0026#34;[parameters(\u0026#39;adminPassword\u0026#39;)]\u0026#34; } } } }, { \u0026#34;type\u0026#34;: \u0026#34;Microsoft.Compute/virtualMachines/extensions\u0026#34;, \u0026#34;name\u0026#34;: \u0026#34;[concat(variables(\u0026#39;vmADFSName\u0026#39;),\u0026#39;/adfsScript\u0026#39;)]\u0026#34;, \u0026#34;apiVersion\u0026#34;: \u0026#34;2015-05-01-preview\u0026#34;, \u0026#34;location\u0026#34;: \u0026#34;[parameters(\u0026#39;resourceLocation\u0026#39;)]\u0026#34;, \u0026#34;dependsOn\u0026#34;: [ \u0026#34;[concat(\u0026#39;Microsoft.Compute/virtualMachines/\u0026#39;, variables(\u0026#39;vmADFSName\u0026#39;))]\u0026#34;, \u0026#34;[concat(\u0026#39;Microsoft.Compute/virtualMachines/\u0026#39;, variables(\u0026#39;vmADFSName\u0026#39;),\u0026#39;/extensions/ADFSserver\u0026#39;)]\u0026#34; ], \u0026#34;properties\u0026#34;: { \u0026#34;publisher\u0026#34;: \u0026#34;Microsoft.Compute\u0026#34;, \u0026#34;type\u0026#34;: \u0026#34;CustomScriptExtension\u0026#34;, \u0026#34;typeHandlerVersion\u0026#34;: \u0026#34;1.4\u0026#34;, \u0026#34;settings\u0026#34;: { \u0026#34;fileUris\u0026#34;: [ \u0026#34;[concat(parameters(\u0026#39;_artifactsLocation\u0026#39;),\u0026#39;/AdfsServer.ps1\u0026#39;, parameters(\u0026#39;_artifactsLocationSasToken\u0026#39;))]\u0026#34;, \u0026#34;[concat(parameters(\u0026#39;_artifactsLocation\u0026#39;),\u0026#39;/PSPKI.zip\u0026#39;, parameters(\u0026#39;_artifactsLocationSasToken\u0026#39;))]\u0026#34;, \u0026#34;[concat(parameters(\u0026#39;_artifactsLocation\u0026#39;),\u0026#39;/tuServDeployFunctions.ps1\u0026#39;, parameters(\u0026#39;_artifactsLocationSasToken\u0026#39;))]\u0026#34; ], \u0026#34;commandToExecute\u0026#34;: \u0026#34;[concat(\u0026#39;powershell.exe -file AdfsServer.ps1\u0026#39;,\u0026#39; -vmAdminUsername \u0026#39;,parameters(\u0026#39;adminUsername\u0026#39;),\u0026#39; -vmAdminPassword \u0026#39;,parameters(\u0026#39;adminPassword\u0026#39;),\u0026#39; -fsServiceName \u0026#39;,variables(\u0026#39;vmWAPpublicipDnsName\u0026#39;),\u0026#39; -vmDCname \u0026#39;,variables(\u0026#39;vmDCName\u0026#39;), \u0026#39; -resourceLocation \u0026#34;\u0026#39;, parameters(\u0026#39;resourceLocation\u0026#39;),\u0026#39;\u0026#34;\u0026#39;)]\u0026#34; } } } ] }, ] The DSC Modules # All the DSC modules I need get zipped into the same archive file which is deployed by each DSC extension to the VMs. I showed you that in part one. For the ADFS server, the extension calls the configuration module DSCvmConfigs.ps1\\\\ADFSserver (note the escaped slash) – the ADFSserver configuration within my single DSCvmConfigs.ps1 file that holds all my configurations. As with the DC configuration, this is based on stuff held in the SharePoint farm template on GitHub.\nconfiguration ADFSserver { param ( [Parameter(Mandatory)] [String]$DomainName, [Parameter(Mandatory)] [String]$vmDCName, [Parameter(Mandatory)] [System.Management.Automation.PSCredential]$Admincreds, [Int]$RetryCount = 20, [Int]$RetryIntervalSec = 30 ) Import-DscResource -ModuleName xComputerManagement, xActiveDirectory Node localhost { WindowsFeature ADFSInstall { Ensure = \u0026#34;Present\u0026#34; Name = \u0026#34;ADFS-Federation\u0026#34; } WindowsFeature ADPS { Name = \u0026#34;RSAT-AD-PowerShell\u0026#34; Ensure = \u0026#34;Present\u0026#34; } xWaitForADDomain DscForestWait { DomainName = $DomainName DomainUserCredential= $Admincreds RetryCount = $RetryCount RetryIntervalSec = $RetryIntervalSec DependsOn = \u0026#34;[WindowsFeature]ADPS\u0026#34; } xComputer DomainJoin { Name = $env:COMPUTERNAME DomainName = $DomainName Credential = New-Object System.Management.Automation.PSCredential (\u0026#34;${DomainName}$($Admincreds.UserName)\u0026#34;, $Admincreds.Password) DependsOn = \u0026#34;[xWaitForADDomain]DscForestWait\u0026#34; } LocalConfigurationManager { DebugMode = $true RebootNodeIfNeeded = $true } } } The DSC for my ADFS server does much less than that of the DC. It installs the Windows features I need (the RSAT-AD-PowerShell tools are needed by the xWaitForADDomain config), makes sure our domain is contactable and joins the server to it. Unfortunately there are no DSC resources around to configure our ADFS server at the moment and whilst I’m happy writing scripts to to that work, I’m less comfortable writing DSC modules right now!\nThe Custom Scripts # Once our DSC extension has joined the domain and added our features, it’s over to the customscript extension to configure the ADFS service. As with the DC, I copy down the script itself, a file with my own functions in and the PSPKI module.\n# # AdfsServer.ps1 # param ( $vmAdminUsername, $vmAdminPassword, $fsServiceName, $vmDCname, $resourceLocation ) $password = ConvertTo-SecureString $vmAdminPassword -AsPlainText -Force $credential = New-Object System.Management.Automation.PSCredential(\u0026#34;$env:USERDOMAIN$vmAdminUsername\u0026#34;, $password) Write-Verbose -Verbose \u0026#34;Entering Domain Controller Script\u0026#34; Write-Verbose -verbose \u0026#34;Script path: $PSScriptRoot\u0026#34; Write-Verbose -Verbose \u0026#34;vmAdminUsername: $vmAdminUsername\u0026#34; Write-Verbose -Verbose \u0026#34;vmAdminPassword: $vmAdminPassword\u0026#34; Write-Verbose -Verbose \u0026#34;fsServiceName: $fsServiceName\u0026#34; Write-Verbose -Verbose \u0026#34;env:UserDomain: $env:USERDOMAIN\u0026#34; Write-Verbose -Verbose \u0026#34;resourceLocation: $resourceLocation\u0026#34; Write-Verbose -Verbose \u0026#34;===================================\u0026#34; # Write an event to the event log to say that the script has executed. $event = New-Object System.Diagnostics.EventLog(\u0026#34;Application\u0026#34;) $event.Source = \u0026#34;tuServEnvironment\u0026#34; $info_event = [System.Diagnostics.EventLogEntryType]::Information $event.WriteEntry(\u0026#34;ADFSserver Script Executed\u0026#34;, $info_event, 5001) $srcPath = \u0026#34;\u0026#34; + $vmDCname + \u0026#34;src\u0026#34; $fsCertificateSubject = $fsServiceName + \u0026#34;.\u0026#34; + ($resourceLocation.Replace(\u0026#34; \u0026#34;, [System.String]::Empty)).ToLower() + \u0026#34;.cloudapp.azure.com\u0026#34; $fsCertFileName = $fsCertificateSubject + \u0026#34;.pfx\u0026#34; $certPath = $srcPath + \u0026#34;\u0026#34; + $fsCertFileName #Copy cert from DC write-verbose -Verbose \u0026#34;Copying $certpath to $PSScriptRoot\u0026#34; # $powershellCommand = \u0026#34;\u0026amp; {copy-item \u0026#39;\u0026#34; + $certPath + \u0026#34;\u0026#39; \u0026#39;\u0026#34; + $workingDir + \u0026#34;\u0026#39;}\u0026#34; # Write-Verbose -Verbose $powershellCommand # $bytes = [System.Text.Encoding]::Unicode.GetBytes($powershellCommand) # $encodedCommand = [Convert]::ToBase64String($bytes) # Start-Process -wait \u0026#34;powershell.exe\u0026#34; -ArgumentList \u0026#34;-encodedcommand $encodedCommand\u0026#34; copy-item $certPath -Destination $PSScriptRoot -Verbose Invoke-Command -Credential $credential -ComputerName $env:COMPUTERNAME -ScriptBlock { param ( $workingDir, $vmAdminPassword, $domainCredential, $fsServiceName, $vmDCname, $resourceLocation ) # Working Write-Verbose -Verbose \u0026#34;Entering ADFS Script\u0026#34; Write-Verbose -verbose \u0026#34;workingDir: $workingDir\u0026#34; Write-Verbose -Verbose \u0026#34;vmAdminPassword: $vmAdminPassword\u0026#34; Write-Verbose -Verbose \u0026#34;fsServiceName: $fsServiceName\u0026#34; Write-Verbose -Verbose \u0026#34;env:UserDomain: $env:USERDOMAIN\u0026#34; Write-Verbose -Verbose \u0026#34;env:UserDNSDomain: $env:USERDNSDOMAIN\u0026#34; Write-Verbose -Verbose \u0026#34;env:ComputerName: $env:COMPUTERNAME\u0026#34; Write-Verbose -Verbose \u0026#34;resourceLocation: $resourceLocation\u0026#34; Write-Verbose -Verbose \u0026#34;===================================\u0026#34; # Write an event to the event log to say that the script has executed. $event = New-Object System.Diagnostics.EventLog(\u0026#34;Application\u0026#34;) $event.Source = \u0026#34;tuServEnvironment\u0026#34; $info_event = [System.Diagnostics.EventLogEntryType]::Information $event.WriteEntry(\u0026#34;In ADFSserver scriptblock\u0026#34;, $info_event, 5001) #go to our packages scripts folder Set-Location $workingDir $zipfile = $workingDir + \u0026#34;PSPKI.zip\u0026#34; $destination = $workingDir [System.Reflection.Assembly]::LoadWithPartialName(\u0026#34;System.IO.Compression.FileSystem\u0026#34;) | Out-Null [System.IO.Compression.ZipFile]::ExtractToDirectory($zipfile, $destination) Write-Verbose -Verbose \u0026#34;Importing PSPKI\u0026#34; Import-Module .tuServDeployFunctions.ps1 $fsCertificateSubject = $fsServiceName + \u0026#34;.\u0026#34; + ($resourceLocation.Replace(\u0026#34; \u0026#34;, \u0026#34;\u0026#34;)).ToLower() + \u0026#34;.cloudapp.azure.com\u0026#34; $fsCertFileName = $workingDir + \u0026#34;\u0026#34; + $fsCertificateSubject + \u0026#34;.pfx\u0026#34; Write-Verbose -Verbose \u0026#34;Importing sslcert $fsCertFileName\u0026#34; Import-SSLCertificate -certificateFileName $fsCertFileName -certificatePassword $vmAdminPassword $adfsServiceAccount = $env:USERDOMAIN + \u0026#34;\u0026#34; + \u0026#34;svc_adfs\u0026#34; $adfsPassword = ConvertTo-SecureString $vmAdminPassword -AsPlainText -Force $adfsCredentials = New-Object System.Management.Automation.PSCredential ($adfsServiceAccount, $adfsPassword) $adfsDisplayName = \u0026#34;ADFS Service\u0026#34; Write-Verbose -Verbose \u0026#34;Creating ADFS Farm\u0026#34; Create-ADFSFarm -domainCredential $domainCredential -adfsName $fsCertificateSubject -adfsDisplayName $adfsDisplayName -adfsCredentials $adfsCredentials -certificateSubject $fsCertificateSubject } -ArgumentList $PSScriptRoot, $vmAdminPassword, $credential, $fsServiceName, $vmDCname, $resourceLocation The script starts by copying the certificate files from the DC. The script extension shells the script as the local system account, so it connects to the share on the DC as the computer account. I copy the files before I execute an invoke-command block that run as the domain admin. I do this because once I’m in that invoke-command block, network access becomes a real pain!\nAs you can see, this script doesn’t do a huge amount. Once in the invoke-command it unzips the PSPKI modules, imports the certificate it needs into the computer cert store and then calls a function to configure the ADFS service. The functions called by the script are below:\nfunction Import-SSLCertificate { [CmdletBinding()] param ( $certificateFileName, $certificatePassword ) Write-Verbose -Verbose \u0026#34;Importing cert $certificateFileName with password $certificatePassword\u0026#34; Write-Verbose -Verbose \u0026#34;---\u0026#34; Import-Module .PSPKIpspki.psm1 Write-Verbose -Verbose \u0026#34;Attempting to import certificate\u0026#34; $certificateFileName # import it $password = ConvertTo-SecureString $certificatePassword -AsPlainText -Force Import-PfxCertificate -FilePath ($certificateFileName) cert:localMachinemy -Password $password } function Create-ADFSFarm { [CmdletBinding()] param ( $domainCredential, $adfsName, $adfsDisplayName, $adfsCredentials, $certificateSubject ) Write-Verbose -Verbose \u0026#34;In Function Create-ADFS Farm\u0026#34; Write-Verbose -Verbose \u0026#34;Parameters:\u0026#34; Write-Verbose -Verbose \u0026#34;adfsName: $adfsName\u0026#34; Write-Verbose -Verbose \u0026#34;certificateSubject: $certificateSubject\u0026#34; Write-Verbose -Verbose \u0026#34;adfsDisplayName: $adfsDisplayName\u0026#34; Write-Verbose -Verbose \u0026#34;adfsCredentials: $adfsCredentials\u0026#34; Write-Verbose -Verbose \u0026#34;============================================\u0026#34; Write-Verbose -Verbose \u0026#34;Importing Module\u0026#34; Import-Module ADFS Write-Verbose -Verbose \u0026#34;Getting Thumbprint\u0026#34; $certificateThumbprint = (get-childitem Cert:LocalMachineMy | where { $_.subject -match $certificateSubject } | Sort-Object -Descending NotBefore)[0].thumbprint Write-Verbose -Verbose \u0026#34;Thumprint is $certificateThumbprint\u0026#34; Write-Verbose -Verbose \u0026#34;Install ADFS Farm\u0026#34; Write-Verbose -Verbose \u0026#34;Echo command:\u0026#34; Write-Verbose -Verbose \u0026#34;Install-AdfsFarm -credential $domainCredential -CertificateThumbprint $certificateThumbprint -FederationServiceDisplayName \u0026#39;$adfsDisplayName\u0026#39; -FederationServiceName $adfsName -ServiceAccountCredential $adfsCredentials\u0026#34; Install-AdfsFarm -credential $domainCredential -CertificateThumbprint $certificateThumbprint -FederationServiceDisplayName \u0026#34;$adfsDisplayName\u0026#34; -FederationServiceName $adfsName -ServiceAccountCredential $adfsCredentials -OverwriteConfiguration } There’s still stuff do do on the ADFS server once I get to deploying my application: I need to define relying party trusts and custom claims, for example. However, this deployment creates a working ADFS server that will authenticate users against my domain. It’s then published to the outside world safely by the Web Application Proxy role on my WAP server.\nCredit Where It’s Due # Same as before – I stand on the shoulders of others to bring you this stuff:\nThe Azure Quick Start templates were invaluable in having something to look at in the early days of resource templates before the tooling was here. PSPKI is a fantastic set of PowerShell modules for dealing with certs. The individual VM scripts are derived from work that was done in Black Marble by Andrew Davidson and myself to build the exact same environment in the older Azure manner without resource templates. ","date":"30 August 2015","externalUrl":null,"permalink":"/posts/complex-azure-template-odyssey-part-three-adfs-server/","section":"Blog","summary":"Part One of this series covered the project itself and the overall template structure. Part Two went through how I deploy the Domain Controller in depth. This post will focus on the next server in the chain: The ADFS server that is required to enable authentication in the application which will eventually be installed on this environment.\n","title":"Complex Azure Template Odyssey Part Three: ADFS Server","type":"posts"},{"content":"In part one of this series of posts I talked about the project driving my creation of these Azure Resource Templates, the structure of the template and what resource I was deploying. This post will go through the deployment and configuration of the first VM which will become my domain controller and certificate server. In order to achieve my goals I need to deploy the VM, the DSC extension and finally the custom script extension to perform actions that current DSC modules can’t. I’ll show you the template code, the DSC code and the final scripts and talk about the gotchas I encountered on the way.\nFurther posts will detail the ADFS and WAP server deployments.\nThe Template # I’ve already talked about how I’ve structured this project: A core template calls a collection of nested templates – one per VM. The DC template differs from the rest in that it too calls a nested deployment to make changes to my virtual network. Other than that, it follows the same convention.\ndc template json view The screenshot above is the JSON outline view of the template. Each of my nested VM templates follows the same pattern: The parameters block in each template is exactly the same. I’m using a standard convention for naming all my resources, so providing I pass the envPrefix parameter between each one I can calculate the name of any resource in the project. That’s important, as we’ll see in a moment. The variables block contains all the variables that the current template needs – things like the IP address that should be assigned or the image we use as our base for the VM. Finally, the resources section holds the items we are deploying to create the domain controller. This VM is isolated from the outside world so we need the VM itself and a NIC to connect it to our virtual network, nothing more. The network is created by the core template before it calls the DC template.\nThe nested deployment needs explaining. Once we’ve created our domain controller we need to make sure that all our other VMs receive the correct IP address for their DNS. In order to do that we have to reconfigure the virtual network that we have already deployed. The nested deployment here is an artefact of the original approach with a single template – it could actually be fully contained in the DC template.\nTo explain: We can only define a resource with a given type and name in a template once. Templates are declarative and describe how we want a resource to be configured. With our virtual network we want to reconfigure it after we have deployed subsequent resources. If we describe the network for a second time, the new configuration is applied to our existing resource. The problem is that we have already got a resource in our template for our network. We get around the problem by calling a nested deployment. That deployment is a copy of the network configuration, with the differences we need for our reconfiguration. In my original template which contained all the resources, that nested deployment depended on the DC being deployed and was then called. It had to be a nested deployment because the network was already in there once.\nWith my new model I could actually just include the contents of the network reconfiguration deployment directly in the DC template. I am still calling the nested resource simply because of the way I split my original template. The end result is the same. The VM gets created, then the DSC and script extensions run to turn it into a domain controller. The network template is then called to set the DNS IP configuration of the network to be the IP address of the newly-minted DC.\n{ \u0026#34;name\u0026#34;: \u0026#34;tuServUpdateVnet\u0026#34;, \u0026#34;type\u0026#34;: \u0026#34;Microsoft.Resources/deployments\u0026#34;, \u0026#34;apiVersion\u0026#34;: \u0026#34;2015-01-01\u0026#34;, \u0026#34;dependsOn\u0026#34;: [ \u0026#34;[concat(\u0026#39;Microsoft.Compute/virtualMachines/\u0026#39;, variables(\u0026#39;vmDCName\u0026#39;))]\u0026#34;, \u0026#34;[concat(\u0026#39;Microsoft.Compute/virtualMachines/\u0026#39;, variables(\u0026#39;vmDCName\u0026#39;),\u0026#39;/extensions/dcScript\u0026#39;)]\u0026#34; ], \u0026#34;properties\u0026#34;: { \u0026#34;mode\u0026#34;: \u0026#34;Incremental\u0026#34;, \u0026#34;templateLink\u0026#34;: { \u0026#34;uri\u0026#34;: \u0026#34;[concat(variables(\u0026#39;updateVNetDNSTemplateURL\u0026#39;), parameters(\u0026#39;_artifactsLocationSasToken\u0026#39;))]\u0026#34;, \u0026#34;contentVersion\u0026#34;: \u0026#34;1.0.0.0\u0026#34; }, \u0026#34;parameters\u0026#34;: { \u0026#34;resourceLocation\u0026#34;: { \u0026#34;value\u0026#34;: \u0026#34;[parameters(\u0026#39;resourceLocation\u0026#39;)]\u0026#34; }, \u0026#34;virtualNetworkName\u0026#34;: { \u0026#34;value\u0026#34;: \u0026#34;[variables(\u0026#39;virtualNetworkName\u0026#39;)]\u0026#34; }, \u0026#34;virtualNetworkPrefix\u0026#34;: { \u0026#34;value\u0026#34;: \u0026#34;[variables(\u0026#39;virtualNetworkPrefix\u0026#39;)]\u0026#34; }, \u0026#34;virtualNetworkSubnet1Name\u0026#34;: { \u0026#34;value\u0026#34;: \u0026#34;[variables(\u0026#39;virtualNetworkSubnet1Name\u0026#39;)]\u0026#34; }, \u0026#34;virtualNetworkSubnet1Prefix\u0026#34;: { \u0026#34;value\u0026#34;: \u0026#34;[variables(\u0026#39;virtualNetworkSubnet1Prefix\u0026#39;)]\u0026#34; }, \u0026#34;virtualNetworkDNS\u0026#34;: { \u0026#34;value\u0026#34;: [ \u0026#34;[variables(\u0026#39;vmDCIPAddress\u0026#39;)]\u0026#34; ] } } } } The code above is contained in my DC template. It calls the nested deployment through a URI to the template. That points to an azure storage container with all the resources for my deployment held in it. The template is called with a set of parameters that are mostly variables created in the DC template in accordance with the rules and patterns I’ve set. Everything is the same as the original network deployment with the exception of the DNS address which is to be set to the DC address. Below is the network template. Note that the parameter block defines parameters that match those being passed in. All names are case sensitive.\n{ \u0026#34;$schema\u0026#34;: \u0026#34;http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\u0026#34;, \u0026#34;contentVersion\u0026#34;: \u0026#34;1.0.0.0\u0026#34;, \u0026#34;parameters\u0026#34;: { \u0026#34;resourceLocation\u0026#34;: { \u0026#34;type\u0026#34;: \u0026#34;string\u0026#34;, \u0026#34;defaultValue\u0026#34;: \u0026#34;West US\u0026#34;, \u0026#34;allowedValues\u0026#34;: [ \u0026#34;East US\u0026#34;, \u0026#34;West US\u0026#34;, \u0026#34;West Europe\u0026#34;, \u0026#34;North Europe\u0026#34;, \u0026#34;East Asia\u0026#34;, \u0026#34;South East Asia\u0026#34; ], \u0026#34;metadata\u0026#34;: { \u0026#34;description\u0026#34;: \u0026#34;The region to deploy the storage resources into\u0026#34; } }, \u0026#34;virtualNetworkName\u0026#34;: { \u0026#34;type\u0026#34;: \u0026#34;string\u0026#34; }, \u0026#34;virtualNetworkDNS\u0026#34;: { \u0026#34;type\u0026#34;: \u0026#34;array\u0026#34; }, \u0026#34;virtualNetworkPrefix\u0026#34;: { \u0026#34;type\u0026#34;: \u0026#34;string\u0026#34; }, \u0026#34;virtualNetworkSubnet1Name\u0026#34;: { \u0026#34;type\u0026#34;: \u0026#34;string\u0026#34; }, \u0026#34;virtualNetworkSubnet1Prefix\u0026#34;: { \u0026#34;type\u0026#34;: \u0026#34;string\u0026#34; } }, \u0026#34;variables\u0026#34;: {}, \u0026#34;resources\u0026#34;: [ { \u0026#34;name\u0026#34;: \u0026#34;[parameters(\u0026#39;virtualNetworkName\u0026#39;)]\u0026#34;, \u0026#34;type\u0026#34;: \u0026#34;Microsoft.Network/virtualNetworks\u0026#34;, \u0026#34;location\u0026#34;: \u0026#34;[parameters(\u0026#39;resourceLocation\u0026#39;)]\u0026#34;, \u0026#34;apiVersion\u0026#34;: \u0026#34;2015-05-01-preview\u0026#34;, \u0026#34;tags\u0026#34;: { \u0026#34;displayName\u0026#34;: \u0026#34;virtualNetworkUpdate\u0026#34; }, \u0026#34;properties\u0026#34;: { \u0026#34;addressSpace\u0026#34;: { \u0026#34;addressPrefixes\u0026#34;: [ \u0026#34;[parameters(\u0026#39;virtualNetworkPrefix\u0026#39;)]\u0026#34; ] }, \u0026#34;dhcpOptions\u0026#34;: { \u0026#34;dnsServers\u0026#34;: \u0026#34;[parameters(\u0026#39;virtualNetworkDNS\u0026#39;)]\u0026#34; }, \u0026#34;subnets\u0026#34;: [ { \u0026#34;name\u0026#34;: \u0026#34;[parameters(\u0026#39;virtualNetworkSubnet1Name\u0026#39;)]\u0026#34;, \u0026#34;properties\u0026#34;: { \u0026#34;addressPrefix\u0026#34;: \u0026#34;[parameters(\u0026#39;virtualNetworkSubnet1Prefix\u0026#39;)]\u0026#34; } } ] } } ], \u0026#34;outputs\u0026#34;: {} } The VM itself is pretty straightforward. The code below deploys a virtual NIC and then the VM. The NIC needs to be created first and is then bound to the VM when the latter is deployed. The snippet has the nested resources for the VM extensions removed. I’ll show you those in a bit.\n{ \u0026#34;apiVersion\u0026#34;: \u0026#34;2015-05-01-preview\u0026#34;, \u0026#34;dependsOn\u0026#34;: [], \u0026#34;location\u0026#34;: \u0026#34;[parameters(\u0026#39;resourceLocation\u0026#39;)]\u0026#34;, \u0026#34;name\u0026#34;: \u0026#34;[variables(\u0026#39;vmDCNicName\u0026#39;)]\u0026#34;, \u0026#34;properties\u0026#34;: { \u0026#34;ipConfigurations\u0026#34;: [ { \u0026#34;name\u0026#34;: \u0026#34;ipconfig1\u0026#34;, \u0026#34;properties\u0026#34;: { \u0026#34;privateIPAllocationMethod\u0026#34;: \u0026#34;Static\u0026#34;, \u0026#34;privateIPAddress\u0026#34;: \u0026#34;[variables(\u0026#39;vmDCIPAddress\u0026#39;)]\u0026#34;, \u0026#34;subnet\u0026#34;: { \u0026#34;id\u0026#34;: \u0026#34;[variables(\u0026#39;vmDCSubnetRef\u0026#39;)]\u0026#34; } } } ] }, \u0026#34;tags\u0026#34;: { \u0026#34;displayName\u0026#34;: \u0026#34;vmDCNic\u0026#34; }, \u0026#34;type\u0026#34;: \u0026#34;Microsoft.Network/networkInterfaces\u0026#34; }, { \u0026#34;name\u0026#34;: \u0026#34;[variables(\u0026#39;vmDCName\u0026#39;)]\u0026#34;, \u0026#34;type\u0026#34;: \u0026#34;Microsoft.Compute/virtualMachines\u0026#34;, \u0026#34;location\u0026#34;: \u0026#34;[parameters(\u0026#39;resourceLocation\u0026#39;)]\u0026#34;, \u0026#34;apiVersion\u0026#34;: \u0026#34;2015-05-01-preview\u0026#34;, \u0026#34;dependsOn\u0026#34;: [ \u0026#34;[concat(\u0026#39;Microsoft.Network/networkInterfaces/\u0026#39;, variables(\u0026#39;vmDCNicName\u0026#39;))]\u0026#34; ], \u0026#34;tags\u0026#34;: { \u0026#34;displayName\u0026#34;: \u0026#34;vmDC\u0026#34; }, \u0026#34;properties\u0026#34;: { \u0026#34;hardwareProfile\u0026#34;: { \u0026#34;vmSize\u0026#34;: \u0026#34;[variables(\u0026#39;vmDCVmSize\u0026#39;)]\u0026#34; }, \u0026#34;osProfile\u0026#34;: { \u0026#34;computername\u0026#34;: \u0026#34;[variables(\u0026#39;vmDCName\u0026#39;)]\u0026#34;, \u0026#34;adminUsername\u0026#34;: \u0026#34;[parameters(\u0026#39;adminUsername\u0026#39;)]\u0026#34;, \u0026#34;adminPassword\u0026#34;: \u0026#34;[parameters(\u0026#39;adminPassword\u0026#39;)]\u0026#34; }, \u0026#34;storageProfile\u0026#34;: { \u0026#34;imageReference\u0026#34;: { \u0026#34;publisher\u0026#34;: \u0026#34;[variables(\u0026#39;windowsImagePublisher\u0026#39;)]\u0026#34;, \u0026#34;offer\u0026#34;: \u0026#34;[variables(\u0026#39;windowsImageOffer\u0026#39;)]\u0026#34;, \u0026#34;sku\u0026#34;: \u0026#34;[variables(\u0026#39;windowsImageSKU\u0026#39;)]\u0026#34;, \u0026#34;version\u0026#34;: \u0026#34;latest\u0026#34; }, \u0026#34;osDisk\u0026#34;: { \u0026#34;name\u0026#34;: \u0026#34;[concat(variables(\u0026#39;vmDCName\u0026#39;), \u0026#39;-os-disk\u0026#39;)]\u0026#34;, \u0026#34;vhd\u0026#34;: { \u0026#34;uri\u0026#34;: \u0026#34;[concat(\u0026#39;http://\u0026#39;, variables(\u0026#39;storageAccountName\u0026#39;), \u0026#39;.blob.core.windows.net/\u0026#39;, variables(\u0026#39;vmStorageAccountContainerName\u0026#39;), \u0026#39;/\u0026#39;, variables(\u0026#39;vmDCName\u0026#39;), \u0026#39;os.vhd\u0026#39;)]\u0026#34; }, \u0026#34;caching\u0026#34;: \u0026#34;ReadWrite\u0026#34;, \u0026#34;createOption\u0026#34;: \u0026#34;FromImage\u0026#34; }, \u0026#34;dataDisks\u0026#34;: [ { \u0026#34;vhd\u0026#34;: { \u0026#34;uri\u0026#34;: \u0026#34;[concat(\u0026#39;http://\u0026#39;, variables(\u0026#39;storageAccountName\u0026#39;), \u0026#39;.blob.core.windows.net/\u0026#39;, variables(\u0026#39;vmStorageAccountContainerName\u0026#39;),\u0026#39;/\u0026#39;, variables(\u0026#39;vmDCName\u0026#39;),\u0026#39;data-1.vhd\u0026#39;)]\u0026#34; }, \u0026#34;name\u0026#34;: \u0026#34;[concat(variables(\u0026#39;vmDCName\u0026#39;),\u0026#39;datadisk1\u0026#39;)]\u0026#34;, \u0026#34;createOption\u0026#34;: \u0026#34;empty\u0026#34;, \u0026#34;caching\u0026#34;: \u0026#34;None\u0026#34;, \u0026#34;diskSizeGB\u0026#34;: \u0026#34;[variables(\u0026#39;windowsDiskSize\u0026#39;)]\u0026#34;, \u0026#34;lun\u0026#34;: 0 } ] }, \u0026#34;networkProfile\u0026#34;: { \u0026#34;networkInterfaces\u0026#34;: [ { \u0026#34;id\u0026#34;: \u0026#34;[resourceId(\u0026#39;Microsoft.Network/networkInterfaces\u0026#39;, variables(\u0026#39;vmDCNicName\u0026#39;))]\u0026#34; } ] } }, \u0026#34;resources\u0026#34;: [] } ```json The NIC is pretty simple. I tell it the name of the subnet on my network I want it to connect to and I tell it that I want to use a static private IP address, and what that address is. The VM resource then references the NIC in the _networkProfile_ section. The VM itself is built using the Windows Server 2012 R2 Datacentre image provided by Microsoft. That is specified in the _imageReference_ section. There are lots of VM images and each is reference by publisher (in this case _MicrosoftWindowsServer_), offer (_WindowsServer_) and SKU (_2012-R2-Datacenter_). I’m specifying ‘latest’ as the version but you can be specific if you have built your deployment around a specific version of an image. They are updated regularly to include patches… There are a wide range of images available to save you time. My full deployment makes use of a SQL Server image and I’m also playing with a BizTalk image right now. It’s much easier than trying to sort out the install of products yourself, and the licence cost of the software gets rolled into the VM charge. We need to add a second disk to our VM to hold the domain databases. The primary disk on a VM has read and write caching enabled. Write caching exposes us to risk of corrupting our domain database in the event of a failure, so I’m adding a second disk and setting the caching on that to none. It’s all standard stuff at this point. I’m not going to describe the _IaaSDiagnostics_ extension. The markup for that is completely default as provided by the tooling when you add the resource. Let’s move on to the DSC extension. ```json { \u0026#34;type\u0026#34;: \u0026#34;Microsoft.Compute/virtualMachines/extensions\u0026#34;, \u0026#34;name\u0026#34;: \u0026#34;[concat(variables(\u0026#39;vmDCName\u0026#39;),\u0026#39;/InstallDomainController\u0026#39;)]\u0026#34;, \u0026#34;apiVersion\u0026#34;: \u0026#34;2015-05-01-preview\u0026#34;, \u0026#34;location\u0026#34;: \u0026#34;[parameters(\u0026#39;resourceLocation\u0026#39;)]\u0026#34;, \u0026#34;dependsOn\u0026#34;: [ \u0026#34;[resourceId(\u0026#39;Microsoft.Compute/virtualMachines\u0026#39;, variables(\u0026#39;vmDCName\u0026#39;))]\u0026#34;, \u0026#34;[concat(\u0026#39;Microsoft.Compute/virtualMachines/\u0026#39;, variables(\u0026#39;vmDCName\u0026#39;),\u0026#39;/extensions/IaaSDiagnostics\u0026#39;)]\u0026#34; ], \u0026#34;properties\u0026#34;: { \u0026#34;publisher\u0026#34;: \u0026#34;Microsoft.Powershell\u0026#34;, \u0026#34;type\u0026#34;: \u0026#34;DSC\u0026#34;, \u0026#34;typeHandlerVersion\u0026#34;: \u0026#34;1.7\u0026#34;, \u0026#34;settings\u0026#34;: { \u0026#34;modulesURL\u0026#34;: \u0026#34;[concat(variables(\u0026#39;vmDSCmoduleUrl\u0026#39;), parameters(\u0026#39;_artifactsLocationSasToken\u0026#39;))]\u0026#34;, \u0026#34;configurationFunction\u0026#34;: \u0026#34;[variables(\u0026#39;vmDCConfigurationFunction\u0026#39;)]\u0026#34;, \u0026#34;properties\u0026#34;: { \u0026#34;domainName\u0026#34;: \u0026#34;[variables(\u0026#39;domainName\u0026#39;)]\u0026#34;, \u0026#34;adminCreds\u0026#34;: { \u0026#34;userName\u0026#34;: \u0026#34;[parameters(\u0026#39;adminUsername\u0026#39;)]\u0026#34;, \u0026#34;password\u0026#34;: \u0026#34;PrivateSettingsRef:adminPassword\u0026#34; } } }, \u0026#34;protectedSettings\u0026#34;: { \u0026#34;items\u0026#34;: { \u0026#34;adminPassword\u0026#34;: \u0026#34;[parameters(\u0026#39;adminPassword\u0026#39;)]\u0026#34; } } } } I should mention at this point that I am nesting the extensions within the VM resources section. You don’t need to do this – they can be resources at the same level as the VM. However, my experience from deploying this lot a gazillion times is that if I nest the extensions I get a more robust deployment. Pulling them out of the VM appears to increase the chance of the extension failing to deploy.\nThe DSC extension will do different things depending on the OS version of Windows you are using. For my 2012 R2 VM it will install the necessary required software to use Desired State Configuration and it will then reboot the VM before applying any config. On the current Server 2016 preview images that installation and reboot isn’t needed as the pre-reqs are already installed.\nThe DSC extension needs to copy your DSC modules and configuration onto the VM. That’s specified in the modulesURL setting and it expects a zip archive with your stuff in it. I’ll show you that when we look at the DSC config in detail later. The configurationFunction setting specifies the PowerShell file that contains the function and the name of the configuration in that file to use. I have all the DSC configs in one file so I pass in DSCvmConfigs.ps1\\\\DomainController (note the escaped slash).\nFinally, we specify the parameters that we want to pass into our PowerShell DSC function. We’re specifying the name of our Domain and the credentials for our admin account.\nOnce the DSC module has completed I need to do final configuration with standard PowerShell scripts. The customScript Extension is our friend here. Documentation on this is somewhat sparse and I’ve already blogged on the subject to help you. The template code is below:\n{ \u0026#34;type\u0026#34;: \u0026#34;Microsoft.Compute/virtualMachines/extensions\u0026#34;, \u0026#34;name\u0026#34;: \u0026#34;[concat(variables(\u0026#39;vmDCName\u0026#39;),\u0026#39;/dcScript\u0026#39;)]\u0026#34;, \u0026#34;apiVersion\u0026#34;: \u0026#34;2015-05-01-preview\u0026#34;, \u0026#34;location\u0026#34;: \u0026#34;[parameters(\u0026#39;resourceLocation\u0026#39;)]\u0026#34;, \u0026#34;dependsOn\u0026#34;: [ \u0026#34;[concat(\u0026#39;Microsoft.Compute/virtualMachines/\u0026#39;, variables(\u0026#39;vmDCName\u0026#39;))]\u0026#34;, \u0026#34;[concat(\u0026#39;Microsoft.Compute/virtualMachines/\u0026#39;, variables(\u0026#39;vmDCName\u0026#39;),\u0026#39;/extensions/InstallDomainController\u0026#39;)]\u0026#34; ], \u0026#34;properties\u0026#34;: { \u0026#34;publisher\u0026#34;: \u0026#34;Microsoft.Compute\u0026#34;, \u0026#34;type\u0026#34;: \u0026#34;CustomScriptExtension\u0026#34;, \u0026#34;typeHandlerVersion\u0026#34;: \u0026#34;1.4\u0026#34;, \u0026#34;settings\u0026#34;: { \u0026#34;fileUris\u0026#34;: [ \u0026#34;[concat(parameters(\u0026#39;_artifactsLocation\u0026#39;),\u0026#39;/DomainController.ps1\u0026#39;, parameters(\u0026#39;_artifactsLocationSasToken\u0026#39;))]\u0026#34;, \u0026#34;[concat(parameters(\u0026#39;_artifactsLocation\u0026#39;),\u0026#39;/PSPKI.zip\u0026#39;, parameters(\u0026#39;_artifactsLocationSasToken\u0026#39;))]\u0026#34;, \u0026#34;[concat(parameters(\u0026#39;_artifactsLocation\u0026#39;),\u0026#39;/tuServDeployFunctions.ps1\u0026#39;, parameters(\u0026#39;_artifactsLocationSasToken\u0026#39;))]\u0026#34; ], \u0026#34;commandToExecute\u0026#34;: \u0026#34;[concat(\u0026#39;powershell.exe -file DomainController.ps1\u0026#39;,\u0026#39; -vmAdminUsername \u0026#39;,parameters(\u0026#39;adminUsername\u0026#39;),\u0026#39; -vmAdminPassword \u0026#39;,parameters(\u0026#39;adminPassword\u0026#39;),\u0026#39; -fsServiceName \u0026#39;,variables(\u0026#39;vmWAPpublicipDnsName\u0026#39;),\u0026#39; -tsServiceName \u0026#39;,variables(\u0026#39;vmTWAPpublicipDnsName\u0026#39;), \u0026#39; -resourceLocation \u0026#34;\\\u0026#39;, parameters(\u0026#39;resourceLocation\u0026#39;),\u0026#39;\\\u0026#34;\u0026#39;)]\u0026#34; } } } The module downloads the files I need which in this case is a zip containing the PSPKI PowerShell modules that I reference to perform a bunch of certificate functions, a module of my own functions and finally the DomainController.ps1 script that is executed by the extension. You can’t specify parameters for your script in the extension (and in fact you can’t call the script directly – you have to execute the powershell.exe command yourself) so you can see that I build the commandToExecute from using a bunch of variables and string concatenation.\nThe DSC Modules # I need to get the DSC modules I use onto the VM. To save my going mad, that means I include the module source in the Visual Studio solution. Over time I’ve evolved a folder structure within the solution to separate templates, DSC files and script files. You can see this structure in the screenshot below.\ndsc modules I keep all the DSC together like this because I can then simply zip all the files in the DSC folder structure to give me the archive that is deployed by the DSC extension. In the picture you will see that there are a number of .ps1 files in the root. Originally I created separate files for the DSC configuration of each of my VMs. I then collapsed those into the DSCvmConfigs.ps1 files and I simply haven’t removed the others from the project.\nMy DomainController configuration function began life as the example code from the three server SharePoint template on Github and I have since extended and modified it. The code is shown below:\nconfiguration DomainController { param ( [Parameter(Mandatory)] [String]$DomainName, [Parameter(Mandatory)] [System.Management.Automation.PSCredential]$Admincreds, [String]$DomainNetbiosName = (Get-NetBIOSName -DomainName $DomainName), [Int]$RetryCount = 20, [Int]$RetryIntervalSec = 30 ) Import-DscResource -ModuleName xComputerManagement, cDisk, xDisk, xNetworking, xActiveDirectory, xSmbShare, xAdcsDeployment [System.Management.Automation.PSCredential ]$DomainCreds = New-Object System.Management.Automation.PSCredential (\u0026#34;${DomainName}$($Admincreds.UserName)\u0026#34;, $Admincreds.Password) $Interface = Get-NetAdapter | Where Name -Like \u0026#34;Ethernet*\u0026#34; | Select-Object -First 1 $InteraceAlias = $($Interface.Name) Node localhost { WindowsFeature DNS { Ensure = \u0026#34;Present\u0026#34; Name = \u0026#34;DNS\u0026#34; } xDnsServerAddress DnsServerAddress { Address = \u0026#39;127.0.0.1\u0026#39; InterfaceAlias = $InteraceAlias AddressFamily = \u0026#39;IPv4\u0026#39; } xWaitforDisk Disk2 { DiskNumber = 2 RetryIntervalSec =$RetryIntervalSec RetryCount = $RetryCount } cDiskNoRestart ADDataDisk { DiskNumber = 2 DriveLetter = \u0026#34;F\u0026#34; } WindowsFeature ADDSInstall { Ensure = \u0026#34;Present\u0026#34; Name = \u0026#34;AD-Domain-Services\u0026#34; } xADDomain FirstDS { DomainName = $DomainName DomainAdministratorCredential = $DomainCreds SafemodeAdministratorPassword = $DomainCreds DatabasePath = \u0026#34;F:NTDS\u0026#34; LogPath = \u0026#34;F:NTDS\u0026#34; SysvolPath = \u0026#34;F:SYSVOL\u0026#34; } WindowsFeature ADCS-Cert-Authority { Ensure = \u0026#39;Present\u0026#39; Name = \u0026#39;ADCS-Cert-Authority\u0026#39; DependsOn = \u0026#39;[xADDomain]FirstDS\u0026#39; } WindowsFeature RSAT-ADCS-Mgmt { Ensure = \u0026#39;Present\u0026#39; Name = \u0026#39;RSAT-ADCS-Mgmt\u0026#39; DependsOn = \u0026#39;[xADDomain]FirstDS\u0026#39; } File SrcFolder { DestinationPath = \u0026#34;C:src\u0026#34; Type = \u0026#34;Directory\u0026#34; Ensure = \u0026#34;Present\u0026#34; DependsOn = \u0026#34;[xADDomain]FirstDS\u0026#34; } xSmbShare SrcShare { Ensure = \u0026#34;Present\u0026#34; Name = \u0026#34;src\u0026#34; Path = \u0026#34;C:src\u0026#34; FullAccess = @(\u0026#34;Domain Admins\u0026#34;, \u0026#34;Domain Computers\u0026#34;) ReadAccess = \u0026#34;Authenticated Users\u0026#34; DependsOn = \u0026#34;[File]SrcFolder\u0026#34; } xADCSCertificationAuthority ADCS { Ensure = \u0026#39;Present\u0026#39; Credential = $DomainCreds CAType = \u0026#39;EnterpriseRootCA\u0026#39; DependsOn = \u0026#39;[WindowsFeature]ADCS-Cert-Authority\u0026#39; } WindowsFeature ADCS-Web-Enrollment { Ensure = \u0026#39;Present\u0026#39; Name = \u0026#39;ADCS-Web-Enrollment\u0026#39; DependsOn = \u0026#39;[WindowsFeature]ADCS-Cert-Authority\u0026#39; } xADCSWebEnrollment CertSrv { Ensure = \u0026#39;Present\u0026#39; Name = \u0026#39;CertSrv\u0026#39; Credential = $DomainCreds DependsOn = \u0026#39;[WindowsFeature]ADCS-Web-Enrollment\u0026#39;, \u0026#39;[xADCSCertificationAuthority]ADCS\u0026#39; } LocalConfigurationManager { DebugMode = $true RebootNodeIfNeeded = $true } } } The .ps1 file contains all the DSC configurations for my environment. The DomainController configuration starts with a list of parameters. These match the ones being passed in by the DSC extension, or have default or calculated values. The import-dscresource command specifies the DSC modules that the configuration needs. I have to ensure that any I am using are included in the zip files downloaded by the extension. I am using modules that configure disks, network shares, active directory domains and certificate services.\nThe node section then declares my configuration. You can set configurations for multiple hosts in a single DSC configuration block, but I’m only concerned with the host I’m on – localhost. Within the block I then declare what I want the configuration of the host to be. It’s the job of the DSC modules to apply whatever actions are necessary to set the configuration to that which I specify. Just like in our resource template, DSC settings can depend on one another if something needs to be done before something else.\nThis DSC configuration installs the windows features needed for creating a domain controller. It looks for the additional drive on the VM and assigns it the drive letter F. It creates the new Active Directory domain and places the domain database files on drive F. Once the domain is up and running I create a folder on drive C called src and share that folder. I’m doing that because I create two certificates later and I need to make them available to other machines in the domain. More on that in a bit. Finally, we install the certificate services features and configure a certificate authority. The LocalConfigurationManager settings turn on as much debug output as I can and tell the system that if any of the actions in my config demand a reboot that’s OK – restart as and when required rather than waiting until the end.\nI’d love to do all my configuration with DSC but sadly there just aren’t the modules yet. There are some things I just can’t do, like creating a new certificate template in my CA and then generating some specific templates for my ADFS services that are on other VMs. I also can’t set file rights on a folder, although I can set rights on a share. Notice that I grant access to my share to Domain Computers. Both the DSC modules and the custom script extension command are run as the local system account. When I try to read files over the network that means I am connecting to the share as the Computer account and I need to grant access. When I create the DC there are no other VMs in the domain, so I use the Domain Computers group to make sure all my servers will be able to access the files.\nOnce the DC module completes I have a working domain with a certificate authority.\nThe Custom Scripts # As with my DSC modules, I keep all the custom scripts for my VMs in one folder within the solution. All of these need to be uploaded to Azure storage so I can access them with the extension and copy them to my VMs. The screenshot below shows the files in the solution. I have a script for each VM that needs one, which is executed by the extension. I then have a file of shared functions and a zip with supporting modules that I need.\ncustom scripts # # DomainController.ps1 # param ( $vmAdminUsername, $vmAdminPassword, $fsServiceName, $tsServiceName, $resourceLocation ) $password = ConvertTo-SecureString $vmAdminPassword -AsPlainText -Force $credential = New-Object System.Management.Automation.PSCredential(\u0026#34;$env:USERDOMAIN$vmAdminUsername\u0026#34;, $password) Write-Verbose -Verbose \u0026#34;Entering Domain Controller Script\u0026#34; Write-Verbose -verbose \u0026#34;Script path: $PSScriptRoot\u0026#34; Write-Verbose -Verbose \u0026#34;vmAdminUsername: $vmAdminUsername\u0026#34; Write-Verbose -Verbose \u0026#34;vmAdminPassword: $vmAdminPassword\u0026#34; Write-Verbose -Verbose \u0026#34;fsServiceName: $fsServiceName\u0026#34; Write-Verbose -Verbose \u0026#34;tsServiceName: $tsServiceName\u0026#34; Write-Verbose -Verbose \u0026#34;env:UserDomain: $env:USERDOMAIN\u0026#34; Write-Verbose -Verbose \u0026#34;resourceLocation: $resourceLocation\u0026#34; Write-Verbose -Verbose \u0026#34;===================================\u0026#34; # Write an event to the event log to say that the script has executed. $event = New-Object System.Diagnostics.EventLog(\u0026#34;Application\u0026#34;) $event.Source = \u0026#34;tuServEnvironment\u0026#34; $info_event = [System.Diagnostics.EventLogEntryType]::Information $event.WriteEntry(\u0026#34;DomainController Script Executed\u0026#34;, $info_event, 5001) Invoke-Command -Credential $credential -ComputerName $env:COMPUTERNAME -ScriptBlock { param ( $workingDir, $vmAdminPassword, $fsServiceName, $tsServiceName, $resourceLocation ) # Working variables $serviceAccountOU = \u0026#34;Service Accounts\u0026#34; Write-Verbose -Verbose \u0026#34;Entering Domain Controller Script\u0026#34; Write-Verbose -verbose \u0026#34;workingDir: $workingDir\u0026#34; Write-Verbose -Verbose \u0026#34;vmAdminPassword: $vmAdminPassword\u0026#34; Write-Verbose -Verbose \u0026#34;fsServiceName: $fsServiceName\u0026#34; Write-Verbose -Verbose \u0026#34;tsServiceName: $tsServiceName\u0026#34; Write-Verbose -Verbose \u0026#34;env:UserDomain: $env:USERDOMAIN\u0026#34; Write-Verbose -Verbose \u0026#34;env:UserDNSDomain: $env:USERDNSDOMAIN\u0026#34; Write-Verbose -Verbose \u0026#34;env:ComputerName: $env:COMPUTERNAME\u0026#34; Write-Verbose -Verbose \u0026#34;resourceLocation: $resourceLocation\u0026#34; Write-Verbose -Verbose \u0026#34;===================================\u0026#34; # Write an event to the event log to say that the script has executed. $event = New-Object System.Diagnostics.EventLog(\u0026#34;Application\u0026#34;) $event.Source = \u0026#34;tuServEnvironment\u0026#34; $info_event = [System.Diagnostics.EventLogEntryType]::Information $event.WriteEntry(\u0026#34;In DomainController scriptblock\u0026#34;, $info_event, 5001) #go to our packages scripts folder Set-Location $workingDir $zipfile = $workingDir + \u0026#34;PSPKI.zip\u0026#34; $destination = $workingDir [System.Reflection.Assembly]::LoadWithPartialName(\u0026#34;System.IO.Compression.FileSystem\u0026#34;) | Out-Null [System.IO.Compression.ZipFile]::ExtractToDirectory($zipfile, $destination) Import-Module .tuServDeployFunctions.ps1 #Enable CredSSP in server role for delegated credentials Enable-WSManCredSSP -Role Server -Force #Create OU for service accounts, computer group; create service accounts Add-ADServiceAccounts -domain $env:USERDNSDOMAIN -serviceAccountOU $serviceAccountOU -password $vmAdminPassword Add-ADComputerGroup -domain $env:USERDNSDOMAIN -serviceAccountOU $serviceAccountOU Add-ADComputerGroupMember -group \u0026#34;tuServ Computers\u0026#34; -member ($env:COMPUTERNAME + \u0026#39;$\u0026#39;) #Create new web server cert template $certificateTemplate = ($env:USERDOMAIN + \u0026#34;_WebServer\u0026#34;) Generate-NewCertificateTemplate -certificateTemplateName $certificateTemplate -certificateSourceTemplateName \u0026#34;WebServer\u0026#34; Set-tsCertificateTemplateAcl -certificateTemplate $certificateTemplate -computers \u0026#34;tuServComputers\u0026#34; # Generate SSL Certificates $fsCertificateSubject = $fsServiceName + \u0026#34;.\u0026#34; + ($resourceLocation.Replace(\u0026#34; \u0026#34;, \u0026#34;\u0026#34;)).ToLower() + \u0026#34;.cloudapp.azure.com\u0026#34; Generate-SSLCertificate -certificateSubject $fsCertificateSubject -certificateTemplate $certificateTemplate $tsCertificateSubject = $tsServiceName + \u0026#34;.northeurope.cloudapp.azure.com\u0026#34; Generate-SSLCertificate -certificateSubject $tsCertificateSubject -certificateTemplate $certificateTemplate # Export Certificates $fsCertExportFileName = $fsCertificateSubject + \u0026#34;.pfx\u0026#34; $fsCertExportFile = $workingDir + \u0026#34;\u0026#34; + $fsCertExportFileName Export-SSLCertificate -certificateSubject $fsCertificateSubject -certificateExportFile $fsCertExportFile -certificatePassword $vmAdminPassword $tsCertExportFileName = $tsCertificateSubject + \u0026#34;.pfx\u0026#34; $tsCertExportFile = $workingDir + \u0026#34;\u0026#34; + $tsCertExportFileName Export-SSLCertificate -certificateSubject $tsCertificateSubject -certificateExportFile $tsCertExportFile -certificatePassword $vmAdminPassword #Set permissions on the src folder $acl = Get-Acl c:src $acl.SetAccessRuleProtection($True, $True) $rule = New-Object System.Security.AccessControl.FileSystemAccessRule(\u0026#34;Domain Computers\u0026#34;, \u0026#34;FullControl\u0026#34;, \u0026#34;ContainerInherit, ObjectInherit\u0026#34;, \u0026#34;None\u0026#34;, \u0026#34;Allow\u0026#34;) $acl.AddAccessRule($rule) $rule = New-Object System.Security.AccessControl.FileSystemAccessRule(\u0026#34;Authenticated Users\u0026#34;, \u0026#34;FullControl\u0026#34;, \u0026#34;ContainerInherit, ObjectInherit\u0026#34;, \u0026#34;None\u0026#34;, \u0026#34;Allow\u0026#34;) $acl.AddAccessRule($rule) Set-Acl c:src $acl #Create src folder to store shared files and copy certs to it Copy-Item -Path \u0026#34;$workingDir*.pfx\u0026#34; c:src } -ArgumentList $PSScriptRoot, $vmAdminPassword, $fsServiceName, $tsServiceName, $resourceLocation The domain controller script is shown above. There are a whole bunch of write-verbose commands that output debug which I can see through the Azure Resource Explorer as the script runs.\nPretty much the first thing I do here is an invoke-command. The script is running as local system and there’s not much I can actually do as that account. My invoke-command block runs as the domain administrator so I can get stuff done. Worth noting is that the invoke-command approach makes accessing network resources tricky. It’s not an issue here but it bit me with the ADFS and WAP servers.\nI unzip the PSPKI archive that has been copied onto the server and load the modules therein. The files are downloaded to a folder that is in a structure including the version number of the script extension so I can’t be explicit. Fortunately I can use the $PSScriptRoot variable to workout that location and I pass it into the invoke-command as $workingDir. The PSKPI modules allow me to create a new certificate template on my CA so I can generate new certs with exportable private keys. I need the same certs on more than one of my servers so I need to be able to copy them around. I generate the certs and drop them into the src folder I created with DSC. I also set the rights on that src folder to grant Domain Computers and Authenticated Users access. The latter is probably overdoing it, since the former should do what I need, but I spent a good deal of time being stymied by this so I’m taking a belt and braces approach.\nThe key functions called by the script above are shown below. Held in my modules file, these are all focused on certificate functions and pretty much all depend on the PSPKI modules.\nfunction Generate-NewCertificateTemplate { [CmdletBinding()] # note can only be run on the server with PSPKI eg the ActiveDirectory domain controller param ( $certificateTemplateName, $certificateSourceTemplateName ) Write-Verbose -Verbose \u0026#34;Generating New Certificate Template\u0026#34; Import-Module .PSPKIpspki.psm1 $certificateCnName = \u0026#34;CN=\u0026#34; + $certificateTemplateName $ConfigContext = ([ADSI]\u0026#34;LDAP://RootDSE\u0026#34;).ConfigurationNamingContext $ADSI = [ADSI]\u0026#34;LDAP://CN=Certificate Templates,CN=Public Key Services,CN=Services,$ConfigContext\u0026#34; $NewTempl = $ADSI.Create(\u0026#34;pKICertificateTemplate\u0026#34;, $certificateCnName) $NewTempl.put(\u0026#34;distinguishedName\u0026#34;, \u0026#34;$certificateCnName,CN=Certificate Templates,CN=Public Key Services,CN=Services,$ConfigContext\u0026#34;) $NewTempl.put(\u0026#34;flags\u0026#34;, \u0026#34;66113\u0026#34;) $NewTempl.put(\u0026#34;displayName\u0026#34;, $certificateTemplateName) $NewTempl.put(\u0026#34;revision\u0026#34;, \u0026#34;4\u0026#34;) $NewTempl.put(\u0026#34;pKIDefaultKeySpec\u0026#34;, \u0026#34;1\u0026#34;) $NewTempl.SetInfo() $NewTempl.put(\u0026#34;pKIMaxIssuingDepth\u0026#34;, \u0026#34;0\u0026#34;) $NewTempl.put(\u0026#34;pKICriticalExtensions\u0026#34;, \u0026#34;2.5.29.15\u0026#34;) $NewTempl.put(\u0026#34;pKIExtendedKeyUsage\u0026#34;, \u0026#34;1.3.6.1.5.5.7.3.1\u0026#34;) $NewTempl.put(\u0026#34;pKIDefaultCSPs\u0026#34;, \u0026#34;2,Microsoft DH SChannel Cryptographic Provider, 1,Microsoft RSA SChannel Cryptographic Provider\u0026#34;) $NewTempl.put(\u0026#34;msPKI-RA-Signature\u0026#34;, \u0026#34;0\u0026#34;) $NewTempl.put(\u0026#34;msPKI-Enrollment-Flag\u0026#34;, \u0026#34;0\u0026#34;) $NewTempl.put(\u0026#34;msPKI-Private-Key-Flag\u0026#34;, \u0026#34;16842768\u0026#34;) $NewTempl.put(\u0026#34;msPKI-Certificate-Name-Flag\u0026#34;, \u0026#34;1\u0026#34;) $NewTempl.put(\u0026#34;msPKI-Minimal-Key-Size\u0026#34;, \u0026#34;2048\u0026#34;) $NewTempl.put(\u0026#34;msPKI-Template-Schema-Version\u0026#34;, \u0026#34;2\u0026#34;) $NewTempl.put(\u0026#34;msPKI-Template-Minor-Revision\u0026#34;, \u0026#34;2\u0026#34;) $NewTempl.put(\u0026#34;msPKI-Cert-Template-OID\u0026#34;, \u0026#34;1.3.6.1.4.1.311.21.8.287972.12774745.2574475.3035268.16494477.77.11347877.1740361\u0026#34;) $NewTempl.put(\u0026#34;msPKI-Certificate-Application-Policy\u0026#34;, \u0026#34;1.3.6.1.5.5.7.3.1\u0026#34;) $NewTempl.SetInfo() $WATempl = $ADSI.psbase.children | where { $_.Name -eq $certificateSourceTemplateName } $NewTempl.pKIKeyUsage = $WATempl.pKIKeyUsage $NewTempl.pKIExpirationPeriod = $WATempl.pKIExpirationPeriod $NewTempl.pKIOverlapPeriod = $WATempl.pKIOverlapPeriod $NewTempl.SetInfo() $certTemplate = Get-CertificateTemplate -Name $certificateTemplateName Get-CertificationAuthority | Get-CATemplate | Add-CATemplate -Template $certTemplate | Set-CATemplate } function Set-tsCertificateTemplateAcl { [CmdletBinding()] param ( $certificateTemplate, $computers ) Write-Verbose -Verbose \u0026#34;Setting ACL for cert $certificateTemplate to allow $computers\u0026#34; Write-Verbose -Verbose \u0026#34;---\u0026#34; Import-Module .PSPKIpspki.psm1 Write-Verbose -Verbose \u0026#34;Adding group $computers to acl for cert $certificateTemplate\u0026#34; Get-CertificateTemplate -Name $certificateTemplate | Get-CertificateTemplateAcl | Add-CertificateTemplateAcl -User $computers -AccessType Allow -AccessMask Read, Enroll | Set-CertificateTemplateAcl } function Generate-SSLCertificate { [CmdletBinding()] param ( $certificateSubject, $certificateTemplate ) Write-Verbose -Verbose \u0026#34;Creating SSL cert using $certificateTemplate for $certificateSubject\u0026#34; Write-Verbose -Verbose \u0026#34;---\u0026#34; Import-Module .PSPKIpspki.psm1 Write-Verbose -Verbose \u0026#34;Generating Certificate (Single)\u0026#34; $certificateSubjectCN = \u0026#34;CN=\u0026#34; + $certificateSubject # Version #1 $powershellCommand = \u0026#34;\u0026amp; {get-certificate -Template \u0026#34; + $certificateTemplate + \u0026#34; -CertStoreLocation Cert:LocalMachineMy -DnsName \u0026#34; + $certificateSubject + \u0026#34; -SubjectName \u0026#34; + $certificateSubjectCN + \u0026#34; -Url ldap:}\u0026#34; Write-Verbose -Verbose $powershellCommand $bytes = [System.Text.Encoding]::Unicode.GetBytes($powershellCommand) $encodedCommand = [Convert]::ToBase64String($bytes) Start-Process -wait \u0026#34;powershell.exe\u0026#34; -ArgumentList \u0026#34;-encodedcommand $encodedCommand\u0026#34; } function Export-SSLCertificate { [CmdletBinding()] param ( $certificateSubject, $certificateExportFile, $certificatePassword ) Write-Verbose -Verbose \u0026#34;Exporting cert $certificateSubject to $certificateExportFile with password $certificatePassword\u0026#34; Write-Verbose -Verbose \u0026#34;---\u0026#34; Import-Module .PSPKIpspki.psm1 Write-Verbose -Verbose \u0026#34;Exporting Certificate (Single)\u0026#34; $password = ConvertTo-SecureString $certificatePassword -AsPlainText -Force Get-ChildItem Cert:LocalMachineMy | where { $_.subject -match $certificateSubject -and $_.Subject -ne $_.Issuer } | Export-PfxCertificate -FilePath $certificateExportFile -Password $password } Making sure it’s reusable # One of the things I’m trying to do here is create a collection of reusable configurations. I can take my DC virtual machine config and make it the core of any number of deployments in future. Key stuff like domain names and machine names are always parameterised all the way through template, DSC and scripts. When Azure Stack arrives I should be able to use the same configuration on-prem and in Azure itself and we can use the same building blocks for any number of customer projects, even though it was originally built for an internal project.\nThere’s stuff I need to do here: I need to pull the vNet template directly into the DC template – there’s no need for it to be separate; I could do with trimming back some of the access rights I grant on the folders and shares that are unnecessary; you’ll also notice that I am configuring CredSSP which was part of my original attempt to sort out file access from within the invoke-command blocks and failed miserably.\nA quick round of credits # Whilst most of this work has been myself, bashing my head against the desk for a while, it is built upon code created by other people who need to be referenced:\nThe Azure Quick Start templates were invaluable in having something to look at in the early days of resource templates before the tooling was here. PSPKI is a fantastic set of PowerShell modules for dealing with certs. The individual VM scripts are derived from work that was done in Black Marble by Andrew Davidson and myself to build the exact same environment in the older Azure manner without resource templates. ","date":"30 August 2015","externalUrl":null,"permalink":"/posts/complex-azure-template-odyssey-part-two-domain-controller/","section":"Blog","summary":"In part one of this series of posts I talked about the project driving my creation of these Azure Resource Templates, the structure of the template and what resource I was deploying. This post will go through the deployment and configuration of the first VM which will become my domain controller and certificate server. In order to achieve my goals I need to deploy the VM, the DSC extension and finally the custom script extension to perform actions that current DSC modules can’t. I’ll show you the template code, the DSC code and the final scripts and talk about the gotchas I encountered on the way.\n","title":"Complex Azure Template Odyssey Part Two: Domain Controller","type":"posts"},{"content":"","date":"30 August 2015","externalUrl":null,"permalink":"/series/","section":"Series","summary":"","title":"Series","type":"series"},{"content":"I have spent a good deal of time over the last month or two building an Azure Resource Template to deploy a relatively complicated IaaS environment. In doing so I’ve hit a variety of problems along the way and I though that a number of blog posts were in order to share what I’ve learned. I will write a detailed post on certain specific servers within the environment shortly. This post will describe Azure Resource Template basics, problems I hit and some decisions I made to overcome issues. Further posts will detail my environment and specific solutions to creating my configuration.\nTooling # I started this project using Visual Studio 2013 and the Azure 2.5 .Net SDK. I am now using Visual Studio 2015 and the 2.7 SDK. The SDK is the key – the tooling has improved dramatically, although there are still things it doesn’t do that I would like it to (like proper error checking, for a start). You can find the SDKs on the Azure Downloads site. You will also need the latest Azure PowerShell module. It’s important to keep the SDK and PowerShell current. There is a big change coming in the PowerShell soon when the current situation of switching between service management commands and resource management commands will be removed. Debugging templates is extremely hard. It’s impossible without using Azure Resource Manager (https://resources.azure.com). This is a fantastic tool and you absolutely need to use it. Documentation # The Azure Resource Template documentation is growing steadily and should be your first point of reference to see how things are done. The Azure Quickstart Templates are a great source of inspiration and code if you are starting out. You need to be careful though – some of the samples I started with were clunky and a couple plain didn’t work. More importantly, they don’t necessarily reflect changes in the API. Adding resources should always be done through the tooling (more on that in a bit). If you just want to leap straight to the source code, it’s on GitHub. Getting Started With Your Deployment Project # Creating a new deployment project is pretty straightforward. In the New Project dialog in Visual Studio you will find the Azure Resource Group project type under Cloud within Visual C#.\nnew resouce project When you create a new Azure Resource Group project, the tooling helpfully connects to Azure to offer you a bunch of starting templates. If you want something that’s on the list, simply choose it and your template will be created pre-populated. If you want to start clean, as I normally do, choose Blank Template from the bottom of the list.\nnew project template The new project contains a small number of files. My advice is to ignore the Deploy-AzureResourceGroup.ps1 script. It contains some useful snippets, but only works if you run it in a very specific way. The ones you care about are the DeploymentTemplate.json and DeploymentTemplate.param.dev.json files.\nsolution explorer The DeploymentTemplate.json is (oddly) your template file where you detail your resources and stuff. The .param.dev.json file is a companion parameter file for the template, for when you want to run the deployment (more on that later).\nIf you open the deployment template you will see the new JSON Outline window appear.\njson outline I’ll come onto the contents of the template in a moment. For now let’s focus on the JSON Outline. It’s your friend for moving around your template, adding and remove resources. To add a new resource, click the little package icon with a plus on it, top left of the window.\nnew resource dialog When you click the icon, the tooling talks to Azure to get the latest versions of resources. The tooling here is intelligent. In the screenshot above you can see I’m adding a Virtual Machine. As a resource, this depends on things like a storage account (to hold the hard drive blobs) and a network. If you already have these defined in your template, they will be listed in the dropdowns. If not, or if you don’t want to use them, you can add new resources and the tooling will step you through answering the questions necessary to specify your resources.\nThe image below shows the JSON outline after I’ve added a new VM, plus the required storage and network resources. You can see that the tooling has added parameters and variables into the template as well.\njson outline with stuff You can build your template using only the tooling if you like. However, if you want to do something complex or clever you’re going to be hacking this around by hand.\nA Few Template Fundamentals # There are a few key points that you need to know about templates and the resources they contain:\nThere is a one to one relationship between a template and a deployment. If you look in the Azure Portal at a Resource Group you will see Last Deployment listed in the Essentials panel at the top of the blade.\nresource blade essentials Clicking the link will show the deployments themselves. The history of deployments is kept for a resource group and each deployment can be inspected to see what parameters were specified and what was done.\ndeployment history deployment details A resource in a template can be specified as being dependent on another resource in the same template. I have tried external dependencies – the templates fail. This is important because you have no control of the execution order of a template other than through dependencies. If you don’t specify any, Azure Resource Manager will try to deploy all the resources in parallel. This is actually a good thing – in the old world of Azure PowerShell it was hard to push out multiple resources in parallel. When you upload a template for deployment, Azure Resource Manager will parse it and work out the deployment order based on the dependencies you prescribe. This means that most deployments will be quicker in the new model.\nResources in a template must have unique names. You can only have one resource of a given type with a given name. This is important and has implications for how you achieve certain things.\nYou can nest deployments. What does that mean? You can call a template from another template, passing in parameters. This is really useful. It’s important to remember that template-deployment relationship. If you do nest these things, you’ll see multiple deployments in your Resource Group blade – one per template.\nIf a resource already exists then you can reconfigure it through your template. I’ve not tried this on anything other than a virtual network, but templates define the desired configuration and Azure Resource Manager will try to set it, even it that means changing what’s there already. That’s actually really useful. It means that we can use a nested deployment in our template to reconfigure something part way through our overall deployment.\nEverything is case-sensitive. This one just keeps on biting me, because I’m a crap typist and the tooling isn’t great at telling me I’ve mistyped something. There’s no IntelliSense in templates yet.\nDeploying Your Template to Azure # Right now, deploying your template means using PowerShell to execute the deployment. The New-AzureResourceGroup cmdlet will create a new Resource Group in your subscription. You tell it the name and location of the resource group, the deployment template you want to use, and the values for the template parameters. That last bit can be done in three different ways – take your pick:\nUsing the –TemplateParameterFile switch allows you to specify a JSON-format parameters file that provides the required values. PowerShell allows you to specify the parameters as options on the command. For example, if I have a parameter of AdminUsername in my template I can add the –AdminUsername switch to the command and set my value. You can create an array of the parameters and their values and pass it into the command. Go read up on PowerShell splatting to find out more about this. Being old, my preference is to use the second option – it means I don’t need to keep updating a parameters file and I can read the command I’m executing more easily. PowerShell ninjas would doubtless prefer choice number three!\nThe code below shows how I deploy my resource template:\n$ResourceGroupName = \u0026#34;tuservtesting1\u0026#34; $ResourceGroupLocation = \u0026#34;North Europe\u0026#34; $TemplateFile = \u0026#34;$pwd\\\\DeploymentTemplate.json\u0026#34; $envPrefix = \u0026#34;myenv\u0026#34; $adminUsername = \u0026#34;env-admin\u0026#34; $adminPassword = \u0026#34;MyPassword\u0026#34; $adminPassword = ConvertTo-SecureString $adminPassword -AsPlainText -Force $resourceLocation = \u0026#34;North Europe\u0026#34; $storageAccountType = \u0026#34;Standard\\_LRS\u0026#34; $artifactsLocation = \u0026#34;http://mystorage.blob.core.windows.net/templates\u0026#34; # create a new resource group and deploy our template to it, with our params New-AzureResourceGroup -Name $ResourceGroupName ` -Location $ResourceGroupLocation ` -TemplateFile $TemplateFile ` -storageAccountType $storageAccountType ` -resourceLocation $resourceLocation ` -adminUsername $adminUsername ` -adminPassword $adminPassword ` -envPrefix $envPrefix ` -_artifactsLocation $ArtifactsLocation ` -artifactsLocationSasToken $ArtifactsLocationSasToken ` -Force -Verbose I like this approach because I can create scripts that can be used by our TFS Build and Release Management systems that can automatically deploy my environments.\nStuff I’ve Found Out The Hard Way # The environment I’m deploying is complex. If has multiple virtual machines on a shared network. Some of those machines have public IP addresses; most don’t. I need a domain controller, ADFs server and Web Application Proxy (WAP) server and each of those depends on the other, and I need to get files between them. My original template was many hundreds of lines, nearly a hundred variables and half a dozen parameters. It tool over an hour to deploy (if it did) and testing was a nightmare. As a result, I’ve refined my approach to improve readability, testability and deployability:\nVirtual machine extension resources seem to deploy more reliably if they are within the Virtual Machine markup. No, I don’t know why. You can specify VM extensions at the same level in the template as your Virtual Machines themselves. However, you can choose to declare them in the resources section of the VM itself. My experience is that the latter reliably deploys the VM and extensions. Before I did this I would get random deployment failures of the extensions. Moving the VMs into nested deployments helps readability, testability and reliability. Again, I don’t know why, but my experience is that very large templates suffer random deployment failures. Pulling each VM and it’s linked resources has completely eliminated random failures. I now have a ‘master template’ which creates the core resources (storage account and virtual network in my case) and then nested templates for each VM that contain the VM, the NIC, the VM extensions and, if exposed to the outside world, load balancer and public IP.\nThere are pros and cons to this approach. Reliability is a huge pro, with readability a close second – there are far fewer resources and variables to parse. I can also work on a single VM at once, removing the VM from the resource group and re-running the deployment for just that machines – that’s saved me so much time! On the con side, I can’t make resources in one nested deployment depend on those in another. That means I end up deploying my VMs much more in sequence than I necessarily would have otherwise because I can only have one nested deployment depend on another. I can’t get clever and deploy the VMs in parallel but have individual extensions depend on each other to ensure my configuration works. The other con is I have many more files to upload to Azure storage so the deployment can access them – the PowerShell won’t bundle up all the files that are part of a deployment and push them up as a package. Even if you find something useful in a quickstart template, add the resources cleanly through the tooling and then modify. The API moves forwards and a good chunk of the code in the templates is out of date. The JSON tooling doesn’t do much error checking Copy and paste is your friend to make sure things like variable names match. The only way to test this stuff is to deploy it. When the template is uploaded to Azure, Resource Manager parses it for validity before executing the deployment. That’s the only reliable way to check the validity of the template. The only way to see what’s happening with any detail is to use Azure Resource Explorer. With a VM, for example, you can see an InstanceView that shows the current output from the deployment and extensions. I’ll talk more about this when I start documenting each of the VMs in my environment and how I got them working. ","date":"23 August 2015","externalUrl":null,"permalink":"/posts/an-introduction-to-azure-resource-templates/","section":"Blog","summary":"I have spent a good deal of time over the last month or two building an Azure Resource Template to deploy a relatively complicated IaaS environment. In doing so I’ve hit a variety of problems along the way and I though that a number of blog posts were in order to share what I’ve learned. I will write a detailed post on certain specific servers within the environment shortly. This post will describe Azure Resource Template basics, problems I hit and some decisions I made to overcome issues. Further posts will detail my environment and specific solutions to creating my configuration.\n","title":"An Introduction To Azure Resource Templates","type":"posts"},{"content":"Part Two | Part Three | Part Four\nOver the past month or two I’ve been creating an Azure Resource Template to deploy and environment which, previously, we’d created old-style PowerShell scripts to deploy. In theory, the Resource Template approach would make the deployment quicker, easier to trigger from tooling like Release Manager and make the code easier to read.\nThe aim is to deploy a number of servers that will host an application we are developing. This will allow us to easily provision test or demo environments into Azure making as much use of automation as possible. The application itself has a set of system requirements that means I have a good number of tasks to work through:\nWe need our servers to be domain joined so we can manage security, service accounts etc. The application uses ADFS for authentication. You don’t just expose ADFS to the internet, so that means we need a Web Application Proxy (WAP) server too. ADFS, WAP and our application need to use secure connections. We want to be able to deploy lots of these, so things like hostnames and FQDNs for services need to be flexible. That means using our own Certificate Services which we need to deploy. We need a SQL server for our application’s data. We’ll need some additional drives on this to store data and we need to make sure our service accounts have appropriate access. Our application is hosted in IIS, so we need a web server as well. Only servers that host internet-accessible services will get public IP addresses. We already had scripts to do this the old way. I planned to reuse some of that code, and follow the decisions we made around the environment:\nAll VMs would use standard naming, with an environment-specific prefix. The same prefix would be used for other resources. For example, a prefix of env1 means the storage account is env1storage, the network is env1vnet, the Domain Controller VM is env1dc, etc. The AD domain we created would use the prefix is it’s named (so env1.local). All public IPs would use the Azure-assigned DNS name for our services – no corporate DNS. The prefix would be used in conjunction with role when specifying the name for the cloud service. DSC would be used wherever possible. After that, custom PowerShell scripts would be used. The aim was to configure each machine individually and not use remote PowerShell between servers unless absolutely necessary. We’d also hit a few problems when creating the old approach, so I hoped to reuse the same solutions:\nThere is very little PowerShell to manage certificate services and certificates. There is an incredibly useful set of modules known as PSPKI which we utilise to create certificate templates and cert requests. This would need to be used in conjunction with our own custom scripts, so it had to be deployed to the VMs somehow. Azure Resources In The Deployment # Things have actually moved on in terms of the servers I am now deploying (only to get more complex!) but it’s easier to detail the environment as originally planned and successfully deployed.\nStorage Account. Needed for the hard drives of the multiple virtual machines. Virtual Network. A single subnet for all VMs. Domain Controller NetworkInterface. Will attach to the virtual network. Virtual Machine. Requires an additional virtual hard disk to store domain databases. Diagnostics Extension. Will enable the diagnostics on the Azure VM so we can see things like CPU and disk access through the Azure Portal. DSC Extension. Will do as much configuration as we can, declaratively. It will add the ADDS and ADCS roles and create the domain. CustomScriptExtension. Will deploy PowerShell scripts to perform additional configuration. It will create certificate templates and generate certs for services. ADFS Server NetworkInterface. Will attach to the virtual network. Virtual Machine. Diagnostics Extension. Will enable the diagnostics on the Azure VM so we can see things like CPU and disk access through the Azure Portal. DSC Extension. Add the ADFS role and domain-join the VM. CustomScriptExtension. Will configure ADFS – copying the cert from the DC and creating the federation service. WAP Server NetworkInterface. Will attach to the virtual network. Public IP Address. Will publish the WAP service to the internet. Load Balancer. Will connect the server to the public IP address, allowing us to add other servers to the service later if needed. Virtual Machine. Diagnostics Extension. Will enable the diagnostics on the Azure VM so we can see things like CPU and disk access through the Azure Portal. DSC Extension. Will do as much configuration as we can, declaratively. CustomScriptExtension. Copy the cert from the DC and configure WAP to publish the federation service hosted on the ADFS server. SQL Server NetworkInterface. Will attach to the virtual network. Virtual Machine. Requires an additional virtual two hard disks to store DBs and logs. Diagnostics Extension. Will enable the diagnostics on the Azure VM so we can see things like CPU and disk access through the Azure Portal. DSC Extension. It turns out the DSC for SQL is pretty good. We can do lots of configuration with it, to the extent of not needing the custom script extension. Web Server NetworkInterface. Will attach to the virtual network. Virtual Machine. Diagnostics Extension. Will enable the diagnostics on the Azure VM so we can see things like CPU and disk access through the Azure Portal. DSC Extension. Will do as much configuration as we can, declaratively. CustomScriptExtension. Will deploy PowerShell scripts to perform additional configuration. WAP Server 2 NetworkInterface. Will attach to the virtual network. Public IP Address. Will publish the web server-hosted services to the internet. Load Balancer. Will connect the server to the public IP address, allowing us to add other servers to the service later if needed. Virtual Machine. Requires an additional virtual hard disk to store domain databases. Diagnostics Extension. Will enable the diagnostics on the Azure VM so we can see things like CPU and disk access through the Azure Portal. DSC Extension. Will do as much configuration as we can, declaratively. CustomScriptExtension. Will deploy PowerShell scripts to perform additional configuration. Environment-specific Settings # The nice thing about having a cookie-cutter environment is that there are very few things that will vary between deployments and that means very few parameters in our template. We will need to set the prefix for all our resource names, the location for our resources, and because we want to be flexible we will set the admin username and password.\nAn Immediate Issue: Network Configuration # Right from the gate we have a problem to solve. When you create a virtual network in Azure, it provides IP addresses to the VMs attached to it. As part of that, the DNS server address is given to the VMs. By default that is an Azure DNS service that allows VMs to resolve external domain names. Our environment will need the servers to be told the IP address of the domain controller as it will provide local DNS services essential to the working of the Active Directory Domain. In our old scripts we simple reconfigured the network to specify the DC’s address after we configured the DC.\nIn the Resource Template world we can reconfigure the vNet by applying new settings to the resource from our template. However, once we have created the vNet in our template we can’t have another resource with the same name in the same template. The solution is to create another template with our new settings and to call that from our main template as a nested deployment. We can pass the IP address of the DC into that template as a parameter and we can make the nested deployment depend on the DC being deployed, which means it will happen after the DC has been promoted to be the domain controller.\nDeployment Order # One of the nicest things about Resource Templates is that when you trigger a deployment, the Azure Resource Manager parses your template and tries to deploy the resources as efficiently as possible. If you need things to deploy in a sequence you need to specify dependencies in your resources, otherwise they will all deploy in parallel.\nIn this environment, I need to deploy the storage account and virtual network before any of the VMs. They don’t depend on each other however, so can be pushed out first, in parallel.\nThe DC gets deployed next. I need to fully configure this before any other VMs are created because they need to join our domain, and our network has to be reconfigured to hand out the IP address of the DC.\nOnce the DC is done, the network gets reconfigured with a nested deployment.\nIn theory, we should be able to deploy all our other VMs in parallel, providing we can apply our configuration in sequence which should be possible if we set the dependencies correctly for our extension resources (DSC and customScriptExtension).\nConfiguration for VMs can be mostly in parallel except: The WAP server configuration depends on the ADFS server being fully configured.\nAttempt One: Single Template # I spent a long time creating, testing and attempting to debug this as a single template (except for our nested deployment to reconfigure the vNet). Let me spare you the pain by listing the problems:\nThe template is huge: Many hundreds of lines. Apart from being hard to work with, that really slows down the Visual Studio tooling. Right now a single template with lots and lots of resources seems unreliable. I could use an identical template for multiple deployments and I would get random failures deploying different VMs or get a successful deploy with no rhyme or reason to it. Creating VM extension resources with complex dependencies seems to cause deployment failures. At first I used dependencies in the extensions for the VMs outside of the DC to define my deployment order. I realised after some pain that this was much more prone to failure than if I treated the whole VM as a block. I also discovered that placing the markup for the extensions within the resources block of the VM itself improved reliability. A single deployment takes over an hour. That makes debugging individual parts difficult and time-consuming. Attempt Two: Multiple Nested Deployments # I now have a rock-solid, reliable deployment. I’ve achieved this by moving each VM and it’s linked resources (NIC, Load Balancer, Public IP) into separate templates. I have a master template that calls the ‘children’ with dependencies limited to one or more of the other nested deployments. The storage account and initial vNet deploy are part of the master template.\nThe upside of this has been manifold: Each template is shorter and simpler with far fewer variables now each only deploys a single VM. I can also choose to deploy a single ‘child’ if I want to, within an already deployed environment. This allows me to test and debug more quickly and easily.\nProblem One: CustomScriptExtension # When I started this journey there was little documentation around and Resource Manager was in preview. I really struggled to get the CustomScriptExtension for VMs working.All I had to work with were examples using PowerShell to add VM extensions and they were just plain wrong for the Resource Template Approach. Leaning on the Linux equivalent and a lot of testing and poking got things sorted and I’ve written up how the extension currently works.\nProblem Two: IaaSDiagnostics # Right now, this one isn’t fixed. I am correctly deploying the IaaSDiagnostics extension into the VMs, and it appears to be correctly configured and working properly. However, the VM blades in the Azure Portal are adamant that diagnostics are not configured. This looks like a bug in the Portal and I’m hoping it will be resolved by the team soon.\nConfiguring the Virtual Machines # That’s about it for talking about the environment as a whole. I’m going to write up some of the individual servers separately as there were multiple hurdles to jump in configuring them. Stay tuned.\n","date":"23 August 2015","externalUrl":null,"permalink":"/posts/complex-azure-template-odyssey-part-one-the-environment/","section":"Blog","summary":"Part Two | Part Three | Part Four\nOver the past month or two I’ve been creating an Azure Resource Template to deploy and environment which, previously, we’d created old-style PowerShell scripts to deploy. In theory, the Resource Template approach would make the deployment quicker, easier to trigger from tooling like Release Manager and make the code easier to read.\n","title":"Complex Azure Template Odyssey Part One: The Environment","type":"posts"},{"content":"","date":"23 August 2015","externalUrl":null,"permalink":"/tags/conference/","section":"Tags","summary":"","title":"Conference","type":"tags"},{"content":"I’ve never been to Sweden, so I’m really looking forward to September, when I’ll be speaking at CloudBurst. Organised by the Swedish Azure User Group (SWAG – love it!), this conference is also streamed and recorded and the sessions will be available on Channel 9. The list of speakers and topics promise some high-quality and interesting sessions and I urge you to attend if you can, and tune in to the live stream if you can’t.\nI’ll be spending an hour telling you about Azure Resource Templates: What they are, why you should use them, and I’ll show the work I’ve been doing as an example of a complex deployment.\n","date":"23 August 2015","externalUrl":null,"permalink":"/posts/speaking-at-cloudburst-in-september/","section":"Blog","summary":"I’ve never been to Sweden, so I’m really looking forward to September, when I’ll be speaking at CloudBurst. Organised by the Swedish Azure User Group (SWAG – love it!), this conference is also streamed and recorded and the sessions will be available on Channel 9. The list of speakers and topics promise some high-quality and interesting sessions and I urge you to attend if you can, and tune in to the live stream if you can’t.\n","title":"Speaking at CloudBurst in September","type":"posts"},{"content":"Documentation for using the customScriptExtension for Virtual Machines in Azure through Resource Templates is pretty much non-existent at time of writing, and the articles on using it through PowerShell are just plain wrong when it comes to templates. This post is accurate at time of writing and will show you how to deploy PowerShell scripts and resources to an Azure Virtual Machine through a Resource Template.\nThe code snippet below shows a customScriptExtension pulled from one of my templates.\n{ \u0026quot;type\u0026quot;: \u0026quot;Microsoft.Compute/virtualMachines/extensions\u0026quot;, \u0026quot;name\u0026quot;: \u0026quot;\\[concat(variables('vmADFSName'),'/adfsScript')\\]\u0026quot;, \u0026quot;apiVersion\u0026quot;: \u0026quot;2015-05-01-preview\u0026quot;, \u0026quot;location\u0026quot;: \u0026quot;\\[parameters('resourceLocation')\\]\u0026quot;, \u0026quot;dependsOn\u0026quot;: \\[ \u0026quot;\\[concat('Microsoft.Compute/virtualMachines/', variables('vmADFSName'))\\]\u0026quot;, \u0026quot;\\[concat('Microsoft.Compute/virtualMachines/', variables('vmADFSName'),'/extensions/ADFSserver')\\]\u0026quot; \\], \u0026quot;properties\u0026quot;: { \u0026quot;publisher\u0026quot;: \u0026quot;Microsoft.Compute\u0026quot;, \u0026quot;type\u0026quot;: \u0026quot;CustomScriptExtension\u0026quot;, \u0026quot;typeHandlerVersion\u0026quot;: \u0026quot;1.4\u0026quot;, \u0026quot;settings\u0026quot;: { \u0026quot;fileUris\u0026quot;: \\[ \u0026quot;\\[concat(parameters('\\_artifactsLocation'),'/AdfsServer.ps1', parameters('\\_artifactsLocationSasToken'))\\]\u0026quot;, \u0026quot;\\[concat(parameters('\\_artifactsLocation'),'/PSPKI.zip', parameters('\\_artifactsLocationSasToken'))\\]\u0026quot;, \u0026quot;\\[concat(parameters('\\_artifactsLocation'),'/tuServDeployFunctions.ps1', parameters('\\_artifactsLocationSasToken'))\\]\u0026quot; \\], \u0026quot;commandToExecute\u0026quot;: \u0026quot;\\[concat('powershell.exe -file AdfsServer.ps1',' -vmAdminUsername ',parameters('adminUsername'),' -vmAdminPassword ',parameters('adminPassword'))\\]\u0026quot; } } } \\] } The most important part is the commandToExecute. The documentation tells you to simply list the PowerShell script (something.ps1) you want to run. This won’t work at all! All the extension does is shell whatever you put in commandToExecute. The default association for .ps1 is notepad. All that will do is run up an instance of our favourite text editor as the system account, so you can’t see it.\nThe solution is to build a command line for powershell.exe, as you can see in my example. I am launching powershell.exe and telling it to load the AdfsServer.ps1 script file. I then specify parameters for the script within the command line. There is no option to pass parameters in through the extension itself.\nThe fileUris settings list the resources I want to push into the VM. This must include the script you want to run, along with any other supporting files/modules etc. The markup in my example loads the files from an Azure storage account. I specify the base url in the _artifactsLocation parameter and pass in a SaS token for the storage in the parameter _artifactsLocationSasToken. You could just put a url to a world-readable location in there are drop the access token param.\nThe dependsOn setting allows us to tell the extension to wait until other items in the resource template have been deployed. In this case I push two other extensions into the VM first.\nBe aware that the process executed by the extension runs as the system account. I found very quickly that if I wanted to do anything useful with my PowerShell, I needed to use invoke-command within my script. To do that I need the admin credentials, which you can see pass into the command line as parameters.\n","date":"23 August 2015","externalUrl":null,"permalink":"/posts/using-the-customscriptextension-in-azure-resource-templates/","section":"Blog","summary":"Documentation for using the customScriptExtension for Virtual Machines in Azure through Resource Templates is pretty much non-existent at time of writing, and the articles on using it through PowerShell are just plain wrong when it comes to templates. This post is accurate at time of writing and will show you how to deploy PowerShell scripts and resources to an Azure Virtual Machine through a Resource Template.\n","title":"Using the customScriptExtension in Azure Resource Templates","type":"posts"},{"content":"Susan Smith has posted an interesting DevOps article on the TechNet UK blog. Hidden away in a footnote is a link to recordings and slide decks for the DevOps track at Future Decoded, including my own session. Both the video and my deck are available for you to view online or download.\n","date":"27 January 2015","externalUrl":null,"permalink":"/posts/my-future-decoded-session-is-now-online/","section":"Blog","summary":"Susan Smith has posted an interesting DevOps article on the TechNet UK blog. Hidden away in a footnote is a link to recordings and slide decks for the DevOps track at Future Decoded, including my own session. Both the video and my deck are available for you to view online or download.\n","title":"My Future Decoded session is now online","type":"posts"},{"content":"website-header-22[1] I’m excited to be speaking at the Techorama conference in Belgium this May. Richard spoke last year (and is doing so again) and came back raving about the great time he had, so I’m really looking forward to it. Go on, take a look at the site (the agenda is steadily filling out) and register!\n","date":"27 January 2015","externalUrl":null,"permalink":"/posts/speaking-at-techorama-2015/","section":"Blog","summary":"website-header-22[1] I’m excited to be speaking at the Techorama conference in Belgium this May. Richard spoke last year (and is doing so again) and came back raving about the great time he had, so I’m really looking forward to it. Go on, take a look at the site (the agenda is steadily filling out) and register!\n","title":"Speaking at Techorama 2015","type":"posts"},{"content":"","date":"20 January 2015","externalUrl":null,"permalink":"/tags/events/","section":"Tags","summary":"","title":"Events","type":"tags"},{"content":"Block out your diary from February 3rd until February 5th. The great guys at Microsoft DX are running another TechDays Online event and it’s absolutely worth your time. I had the absolute pleasure to be involved last year and will again this year, both in front of and behind the camera.\nFor those who don’t know about the event, TechDays Online is three days (and one evening, this year) of technical content delivered by MVPs and Microsoft evangelists across a broad range of topics. Whilst you watch the sessions, streaming live through the power of the internet, you can ask questions in the chat channel. Some of those questions may find their way to the speaker during the session, but all will be picked up by a team of experts backstage, fuelled by caffeine and sugar.\nEach day covers a different topic area and is lead by one of the DX team. Tuesday is led by Ed Baker and is around Devices and managing a mobile first world. I’ll be talking about Azure Active Directory, Robert is doing a session on Internet of Things and we are joined by a great line up of MVPs. Tuesday evening is An evening with Office 365; Wednesday sees Andrew Fryer curating The Journey to the cloud-first world; finally on Friday, Martin Beeby is in the chair for Multi-device cross platform development. Richard is involved in that final day.\nContent on Tuesday is more relevant for IT pros, Wednesday is a mix of IT Pro and developer content and Thursday is aimed at developers. Having said that, I learned something useful across all the days of the last event and I’d urge you to tune in for all three. Hook a PC up to a screen in the office and stream it in the background for everyone if you can’t dedicate time – you won’t regret it!\nIn addition to presenting sessions, I will be on the chat stream across all three days, chipping in where I can.\nOh, and did I mention that Mary Jo Foley will be there too?\nThere’s still plenty of time to register at http://aka.ms/techdays2015 so what are you waiting for?\n","date":"20 January 2015","externalUrl":null,"permalink":"/posts/get-informed-with-techdays-online-2015/","section":"Blog","summary":"Block out your diary from February 3rd until February 5th. The great guys at Microsoft DX are running another TechDays Online event and it’s absolutely worth your time. I had the absolute pleasure to be involved last year and will again this year, both in front of and behind the camera.\n","title":"Get informed with TechDays Online 2015","type":"posts"},{"content":"We’re only half way through January and this year is already busy. I am really excited to be speaking at SQLBits this year!\nSQLBits is a conference that various members of the Black Marble team attend regularly and rave about. It’s the event if you want to gain knowledge and insight into all aspects of databases and data management, reporting, BI and more. Microsoft are a platinum sponsor of the event this year and a whole heap of big names are flying in to present.\nWhy am I, an Azure MVP, speaking at SQLBits? I’ll be talking about virtual networks and virtual machines in Azure. Whilst not directly DB-related, it’s an important topic these days when designing the architecture for your application. Yes, there is the Azure SQL service, but that’s not always the right choice. Sometimes you want to run your DB on a VM. Sometimes you might even want to access data held securely within your organisation, even if your application is in the cloud. As a DB guy, knowing what options are available to you when designing your solution is important.\nThe Azure community and the SQL community shouldn’t be separate. Cloud is all pervading, but is not a universal fix all. Hopefully sessions like mine can make connections between the two groups for the benefit of all.\nDid I mention how big SQLBits is? Go take a look at the agenda, packed full of great content. The run, don’t walk, to the registration page.\nSee you there!\n","date":"20 January 2015","externalUrl":null,"permalink":"/posts/speaking-at-sqlbits-2015/","section":"Blog","summary":"We’re only half way through January and this year is already busy. I am really excited to be speaking at SQLBits this year!\nSQLBits is a conference that various members of the Black Marble team attend regularly and rave about. It’s the event if you want to gain knowledge and insight into all aspects of databases and data management, reporting, BI and more. Microsoft are a platinum sponsor of the event this year and a whole heap of big names are flying in to present.\n","title":"Speaking at SQLBits 2015","type":"posts"},{"content":"It’s January, which can only mean one thing. It’s time for the annual Black Marble Tech Update. If you’re an IT or development manager, come along to hear the stuff you need to know about Microsoft’s releases and updates last year and what we know so far about what is coming this year.\nTech Updates are hard work to prepare for, but they’re quite exhilarating to present. In the morning, myself, Andy and Andrew will run through the key moves and changes in the Microsoft ecosystem to help IT managers with their strategic planning: What’s coming out of support, what’s got a new release due; in short, what do you need to pay attention to for your organisation’s IT.\nIn the afternoon Robert, Richard and Steve will be covering what’s important to know in the Microsoft developer landscape and this year they are joined by Martin Beeby from the Microsoft DX team.\nYou can find the Tech Update on our website as two events (IT Managers in the morning, Developers in the afternoon). Feel free to register for the one that most interests you. Most people stay for the whole day and leave with their heads buzzing.\n","date":"20 January 2015","externalUrl":null,"permalink":"/posts/want-to-know-whats-going-on-come-to-the-black-marble-tech-update/","section":"Blog","summary":"It’s January, which can only mean one thing. It’s time for the annual Black Marble Tech Update. If you’re an IT or development manager, come along to hear the stuff you need to know about Microsoft’s releases and updates last year and what we know so far about what is coming this year.\n","title":"Want to know what’s going on? Come to the Black Marble Tech Update","type":"posts"},{"content":"I’ve posted before about helping out at the IT Camps run by the Microsoft DX team. I’m a fervent supporter of them – they are hands-on days of technical content run by great people who know their stuff and, importantly, they are run around the country.\nNext week will see me in Manchester with Ed Baker for the latest instalment. The current series of campus are two days with the first being around Mobile Device Management and the second around extending your datacentre into Azure. I’ll be there for day two to be Ed’s wingman as we take attendees through hands-on labs around virtual machines and talk about virtual networks, Azure Active directory and pretty much anything else Azure-related we get asked about.\nEd and Andrew really enjoy running the camps – they are a great way to talk to you, the customer, about how you use Microsoft’s services. I’m not backwards in coming forward with feedback about what works and what doesn’t in the MS stack and you shouldn’t be either. Unlike regular events, these are technical days for technical people by technical people and that’s what makes them so rewarding to attend and so satisfying to run. Those of us that are involved want the camps to continue and that means people like you need to turn up, enjoy the day and give feedback.\nGo read more about them, get registered and come along. And you don’t even have to travel south to do it!\nSee you there.\n","date":"20 January 2015","externalUrl":null,"permalink":"/posts/why-you-should-attend-a-microsoft-it-camp/","section":"Blog","summary":"I’ve posted before about helping out at the IT Camps run by the Microsoft DX team. I’m a fervent supporter of them – they are hands-on days of technical content run by great people who know their stuff and, importantly, they are run around the country.\n","title":"Why you should attend a Microsoft IT Camp","type":"posts"},{"content":"I am now going to speaking on the DevOps track at Future Decoded. I’ll be channelling Richard to talk about how our dev-release pipeline is constructed at Black Marble and how the various Microsoft tools that we use could be swapped out for alternatives in a heterogeneous environment.\nWhilst this isn’t an area that I usually speak around, it’s something that I am very involved in as Richard and I constantly look to improve our internal practices around development, test and deployment. Big thanks to Susan Smith for inviting me to participate.\nIf you haven’t come across Future Decoded yet, take a look. It spans a number of days, with the final day being the multi-track technical conference that I will be speaking at, along with such luminaries as Jonathan Noble and the usual DX suspects like Andrew Fryer and Ed Baker.\nHope to see you there!\n","date":"6 November 2014","externalUrl":null,"permalink":"/posts/speaking-on-devops-at-future-decoded/","section":"Blog","summary":"I am now going to speaking on the DevOps track at Future Decoded. I’ll be channelling Richard to talk about how our dev-release pipeline is constructed at Black Marble and how the various Microsoft tools that we use could be swapped out for alternatives in a heterogeneous environment.\n","title":"Speaking on DevOps at Future Decoded","type":"posts"},{"content":"Robert unexpectedly (gotta love him!) gave me a surprise present in the form of a Microsoft Surface Pro 3. I’ve now been using it for a week and I thought it was time to put my thoughts into words.\nYou’ll pry it out of my cold, dead hands # Overall, this is a fantastic bit of kit and it’s the device I have used most at home, for meetings and even sometimes at my desk. The only reason it hasn’t replaced my stalwart ThinkPad X220T is that it has neither the memory nor the storage to run the virtual machines I still need. It’s light, comfortable to hold, has great battery life and the screen is gorgeous.\nSpecs – good enough? # The model I have is the core i5 with 8Gb of RAM and a 256Gb SSD. It’s quick. It also has ample storage for my needs once I remove VMs from the equation. It’s true – Visual Studio hasn’t been installed yet, but I know from conversations with Robert that I am not space-poor.\nIt’s quick to boot up – quick enough that I rarely bother with the connected standby and usually shut down fully. It has handled all of my Office-centric tasks without pause, from Word through PowerPoint to the ever-present OneNote. The screen is a pin sharp 2160x1440 which is easy to read when typing (although there are a few apps that appear a little blurry from the display scaling), although as with many other devices, the glossy glass screen can suffer from reflections in very bright sunlight.\nI’m also very happy with the keyboard. I’m typing this post in my front room, sat on the sofa with the Pro on my lap. The revised ‘any-position’ kickstand makes it much more comfortable than the Surface and Surface Pro – neither of which I would have endured this process with. The new ‘double fold’ design of the type cover makes it less sit at a better angle than its predecessors. Yes, it still flexes on a single hinge when on my lap, but it does feel more stable than before.\nThe track pad is also much improved. I now have a collection of covers – touch, type and power, along with the new type cover. The power cover is great fgor battery life but the track pad was an abomination. This one is just fine – it feels good to touch, with enough resistance to the surface texture, and the buttons have a responsive click to them.\nShape and size # The first thing you notice about the Pro 3 is the size of it. It’s no thicker than my original RT and half the thickness of the original Pro. It’s also a different shape, and I think it’s that which makes all the difference. No longer 16:9, the device is very comfortable to use in portrait mode – much better than the Pro, although I tended to use that in portrait too. When you aren’t wanting to type, you naturally stand it on the short edge. Microsoft obviously expects that – the Windows button is on the right hand edge as you look at the tablet when using the type cover.\nIt’s also really light. Much lighter than the Pro, and it even feels lighter than the RT. I suspect the thickness of the glass helps a great deal, but it’s pretty impressive when you think that they’ve packed the same power as the Pro in to half the weight, half the thickness and managed to increase the battery life at the same time.\nBattery Life # I’ve not run exhaustive battery tests, but I can report that I have charged the surface about three times during the week. It lasts all night when reading web pages, using the twitter app and other Windows Store applications; it quite happily ran through a four hour meeting with a copy of Word open (try doing that on a generation 1 Pro) so, thus far I’m impressed. I haven’t yet tried to last a full working day on a charge, though.\nThe Stylus # I was concerned when Microsoft switched from the Wacom technology used by the older Surface Pro to the new Ntrig active pen. I have been very pleasantly surprised, however. The inking experience is wonderful. The pen has a very soft feel to it – very unlike the Dell Venue 8 Pro and better even than the Wacom. I do miss being able to erase by flipping the pen, but having used the two-button Dell pen for six months now the switch wasn’t an issue. The accuracy of writing is great. Supposedly the distance between the LCD display and the surface of the glass has been reduced and I must say that the feel of writing is good – the lines I draw feel closer to the pen tip than the Dell, certainly.\nMy one little niggle # I only have one problem, and to be fair it’s pretty minor. One of the things I use the original Pro for is pulling photos off the SD card from my Canon EOS 450D. The new Pro, with it’s better screen would be great for that task. Except I can’t, because the SD card slot present on the Pro has gone, replaced by a MicroSD slot in the same place as on the RT. It makes sense for space, but it’s a bit of a pain. Time to try using a MicroSD card with adapter in my camera, I guess – I don’t really want to carry a USB adapter.\nYou’d think that I’d miss a physical ethernet port (I don’t – I can use a USB one if I need to ) or bemoan the single USB 3 port (if I’m stuck, my USB 3 ethernet dongle is also a hub, and how often do I need to use more than one USB device, since this thing has a keyboard and track pad!), but it’s the SD card which is the only thing I’ve wished had been present.\nA panoply of devices # I’ll admit to being a device fiend. I now have an original Surface RT, a generation one Surface Pro and a Dell Venue 8 Pro. Of those, the RT has been used rarely since I got the Dell, although the Pro was something I would turn to regularly at home to work on, being larger than the Dell and lighter than the X220T (although with the Power Cover on, we could debate that).\nSince I got the Pro 3, I haven’t touched anything else. As I said, I still use the X220T, because I have no alternative. Yes, I could run VMs in Azure or on our Hyper-V server, but the neither work without an internet connection and it’s quick and easy to roll forwards and backwards between checkpoints when VMs are on your own machine.\nThe fact that I haven’t touched the Dell is perhaps the saddest part of this. I find myself reaching for the Pro 3 every time. I am still using OneNote rather than typing or using paper, but the Pro 3 is nicer to write on than the Dell. Whether I will still use the Dell for customer meetings, where the size means I can leave my usual rucksack of equipment behind I have yet to find out, but it’s a telling change.\nDig a little deeper – enterprise ready? # Pretty much the first thing I did with the new device was wipe it clean. We have a Windows 8.1 image at Black Marble that we usually push out with SCCM. I grabbed that image, downloaded the Surface Pro driver pack from Microsoft and used dism to install the drivers into the image. I then deployed that image onto the Pro via USB.\nInstallation was completely painless, even including the automated installation of some firmware updates that were included in the driver pack. All devices were detected just fine and the end result is a Surface Pro 3 with our Enterprise image, domain-joined and hooked up to our DirectAccess service so I can work anywhere.\nI have installed Office, but I will admit to not having used Outlook on this yet. Much of my usage has been in tablet mode and I prefer the Windows 8.1 Mail app over Outlook without the keyboard and trackpad. Office 2013 is not yet fully touch-friendly, whatever they try to tell you.\nYou know what would make it perfect? # You can see this coming, can’t you? Sure, I could get more storage and horsepower with the top-of-the-line model, but there is no point. The only reason I would need those is if I could have my one wish – 16Gb of RAM.\nIt’s s terrible thing – no Ultrabooks come with 16Gb of RAM. I don’t need a workstation replacement (like the W530s our consultants use) as I don’t run the number or size of VMs they do. But I, like Richard, do run VMs for demos and working on projects. 8Gb doesn’t cut it. 16Gb would be fine. I firmly believe that there is a market for a 16Gb ultrabook. Or a 16Gb Pro 3. In all honesty, I think I’d be happy with this as my one device, if I could solve the RAM problem. I think that says it all, really.\n","date":"26 July 2014","externalUrl":null,"permalink":"/posts/a-week-with-the-surface-pro-3/","section":"Blog","summary":"Robert unexpectedly (gotta love him!) gave me a surprise present in the form of a Microsoft Surface Pro 3. I’ve now been using it for a week and I thought it was time to put my thoughts into words.\n","title":"A week with the Surface Pro 3","type":"posts"},{"content":"","date":"26 July 2014","externalUrl":null,"permalink":"/tags/surface-pro/","section":"Tags","summary":"","title":"Surface-Pro","type":"tags"},{"content":"Richard and I have been busy this week. It started with a conversation about automating the installation of new build servers. Richard was looking at writing PowerShell to install and configure the TFS build agent, along with all the various SDKs that we use across all out projects. Our current array of build servers have all been built by hand and each has a different set of SDKs to build specific project types. Richard’s aim is to make a single, homogenous build server configuration so we can then scale out for capacity much more quickly than before.\nEnter, stage left, SCVMM. For my part, I’ve been looking at what can be done with VM Templates and, more importantly, service templates. It seemed to me that creating a Build Server service in SCVMM with a standard template would allow us to quickly and easily add and remove servers to the group.\nThere isn’t much written about the application/script side of SCVMM server templates, so I thought I’d write up my part.\nNote: I’m not a System Center specialist. We use Config Manager, Virtual Machine Manager and Data Protection Manager at Black Marble for our own services rather than being a System Center partner.\nDividing up the problem space # Our final template uses a single PowerShell script to perform the configuration and installation work. Yes, I could have created steps in the service template to install each of the items Richard’s script deployed, but we decided against that. The reasoning is relatively simple: It’s much easier to modify the PowerShell script to add, remove or change the stuff that gets deployed. It’s hard to do that with SCVMM, as far as I can tell.\nHowever, during testing I discovered that if I added windows roles and features through the template it was faster than when the various installers Richard called in his script triggered the feature addition.\nThe division of labour, then, became the following:\nSCVMM Tasks:\nVM Template is created for the target OS. The VM template is configured to automatically join the new machine to our domain and place the machine in the correct OU. It also sets the language correctly. More on that later. Service Template is created for a Build Servers service. It’s a single tier service that has a minimum of one machine and a maximum of twenty (that maximum is a bit on an arbitrary value on my part). The service template adds the roles and features to the machine definition and runs two script application blocks: The first simply runs xcopy to pull the contents of a folder on a share to the local PC. I do this because running a power shell PowerShell script from a network share doesn’t work – in an interactive session you are prompted before the script executes because it’s from an untrusted location and I haven’t worked out how to suppress the prompt yet. The second application executes powershell.exe and feeds in the full path to Richard’s PowerShell script, newly copied onto the local disk. Step 1: VM Template # There’s a wealth of information about creating VM templates in the internet, so I’m not going to cover this in depth. I did, however, want to pull out a couple of things I discovered along the way.\nI installed my base VM with the UK English regional settings. When SCVMM converted that into a template via sysprep, the resulting machine comes up in English US, which is really annoying. Had I been paying attention, I would have noticed that we already had an unattend.xml file to correct this, which I could have referenced in the VM template settings. However, I found a much more interesting way to address the issue (which of course led me down another rabbit hole).\nA bit of research led me to a very interesting post by Gunter Danzeisen. In it he shows how to use powershell to modify an unattendsettings property of the VM template within System Center. This is at the same time both irritating and enlightening.\nIt’s irritating, because I am truly fed up of ‘hidden’ functionality in products that causes me pain. The VM Template clearly allows me to specify an unattend.xml file, so why have an internal one as an object property. Moreover, why not simply document it’s existence and let me modify that property – why do I need two different methods which then makes me constantly wonder which gets priority.\nIt’s enlightening, because I can modify that property really easily – it’s simply a collection of name/value pairs that marry against the unattend.xml settings.\nThere is a bit of snag with this approach, however, which I’ll come onto in a little while.\nAnyway, back to the plot. I followed Gunter’s advice and used PowerShell to set the language values of the internal unattend. I then decided to use the same approach to see if I could add other settings – specifically the destination OU for the server when added to AD.\nThe PowerShell for the region settings is below:\n$template = Get-SCVMtemplate | where {$\\_.Name -eq \u0026#34;My VM Template\u0026#34;} $settings = $template.UnattendSettings $settings.add(\u0026#34;oobeSystem/Microsoft-Windows-International-Core/UserLocale\u0026#34;,\u0026#34;en-GB\u0026#34;) $settings.add(\u0026#34;oobeSystem/Microsoft-Windows-International-Core/SystemLocale\u0026#34;,\u0026#34;en-GB\u0026#34;) $settings.add(\u0026#34;oobeSystem/Microsoft-Windows-International-Core/UILanguage\u0026#34;,\u0026#34;en-GB\u0026#34;) $settings.add(\u0026#34;oobeSystem/Microsoft-Windows-International-Core/InputLocale\u0026#34;,\u0026#34;0809:00000809\u0026#34;) Set-SCVMTemplate -VMTemplate $template -UnattendSettings $settings For reference, removing a setting is easy – simply reference the name of the setting when calling the remove method:\n$settings.remove(\u0026#34;oobeSystem/Microsoft-Windows-International-Core/UserLocale\u0026#34;) I then set the destination OU with the following setting:\n$settings.add(\u0026#34;specialize/Microsoft-Windows-UnattendedJoin/Identification/MachineObjectOU\u0026#34;,\u0026#34;OU=FileServers,DC=mydomain,DC=local\u0026#34;) The Snag # There is a problem with this approach. If you use an unattend.xml file, you can override that setting when you add the VM template to your service template. However, whilst I could find the unattendsettings property of the VM when referenced by the template, I couldn’t modify it.\nIf we access the Service Template object with:\n$svctemplate = Get-SCServiceTemplate | where {$_.name -eq \u0026#34;TFS Build Service\u0026#34;} We get an object that contains one or more ComputerTierTemplates (depending on how many tiers you gave your service). Each of those has a VMTemplate object that holds the information from our original VMTemplate, and therefor has our unattendsettings.\n$svctemplate.ComputerTierTemplates\\[0\\].VMTemplate.UnattendSettings So, we can grab those settings and modify them. Great. The trouble is, I haven’t found a way to update the stored configuration. Set-SCServiceTemplate doesn’t let me stuff the settings back in the same was as Set-SCVMTemplate does, and you can’t use the latter with a reference to the VMTemplate child of our template.\nNow, I decided that I would create a copy of my original VM template just for Build Servers, so I could set a different target OU for the servers. In hindsight, I’m not sure whether this is better than overlaying unattend.xml files, and I haven’t experimented with how the unattend.xml might interact with the unattendsettings yet either. If you try, please let me know how you get on.\nStep 2: Service Template # Once I’d got my VM Template sorted, the next step was to create a service. There’s a pretty nice design surface for these that allows you to pick a ‘starter’ template with the right number of tiers, although it’s dead easy to add a new tier.\nI started with the Single Machine template, which gave me a single tier. You then need to drag a VM template from a list of available templates onto the tier. The screenshot below shows my single tier Service. The VM template has a single NIC and is configured to connect to my Black Marble network.\nimage The light blue border on the large box (the service tier) indicates it’s selected. That will show the tier properties at the bottom of the design window. In here I have set a minimum and maximum number of servers that can be deployed in the tier.\nimage Notice also the availability set option – if I needed to ensure that VMs in this service were spread across multiple hosts for resilience I could tick this option. I don’t care where build servers get deployed (they go onto our Lab VM hosts and are effectively ‘disposable’) so I have left this alone.\nOpen the properties of the tier (right-click or choose View All Properties in the property pan) and a dialog opens with machine properties. In here I have configured the roles and features for the build server (I deliberately haven’t set these in the VM Template so I can have fewer, more general VM templates).\nimage Also in here are the Application Configuration settings that cause the VM to run Richard’s PowerShell. The first is a simple one that references cmd.exe to run xcopy. All the settings on this are default.\nimage The second app runs Powershell.exe and passes in a file parameter. This was a source of much frustration – I wanted to use the –ExecutionPolicy parameter to ensure the script ran successfully but if I added this (as the first parameter, –File has to be the last one) the whole command failed. As it happens I set the execution policy in Group Policy for all the Build Servers but I like the belt and braces approach.\nThe biggest point here is the timeout setting. Richard’s script can take an hour or so to run, so the timeout is a BIG number. The first few times I deployed the script task failed because of this, although in reality the script itself was still running happily and completed fine.\nimage I have changed the advanced settings for this script, though. To make debugging a little easier (the VM is a black box whilst deploying, so it’s tricky to see what’s going on) I have directed standard output and standard errors to a file. I’ve also turned off the options to automatically ‘detect’ failures through watching output, error and exit codes. Richard’s script can be run repeatedly with no ill-effect, so I’ve left the restart option to restart the script. That means that if I restart the deployment job from SCVMM if it fails, the script will be run.\nimage Once the service template is created, I deployed the service with a single server. We then added a second server by scaling out the tier.\nimage We can do this via the SCVMM console, or using the virtualmachinemanager PowerShell module:\n$serviceInstance = Get-SCService -Name \u0026#34;TFS Build Servers\u0026#34; $computerTier = Get-SCComputerTier -Service $serviceInstance | where { $_.Name -eq \u0026#34;TFS Build Server\u0026#34; } New-SCVirtualMachine -ComputerTier $computerTier -Name \u0026#34;Build03\u0026#34; -Description \u0026#34;\u0026#34; -ReturnImmediately -ComputerName \u0026#34;Build03\u0026#34; -StartAction \u0026#34;NeverAutoTurnOnVM\u0026#34; -StopAction \u0026#34;SaveVM\u0026#34; Lessons Learned # It’s been an interesting process overall. I think we’ve made the right choice in using a single, easily modifiable powershell script to do the heavy lifting here. Yes, I could have created Application Profiles in SCVMM for each of the items Richard installed, but it would have been harder to make changes (and things like the Azure SDK are updated faster than I can blink!).\nI’m still considering whether my choice of adding the domain location to the unattendsettings in the VM template object was a good choice or not. I’m happy that the language settings should go in there – we never change those. I need to experiment with how adding an unattend.xml file affects the settings in the template object.\nService Templates are a great way to go. When you think about it, most of our IT systems tend to be service-focused. Using service templates for things like SharePoint or CRM are a no brainer, but also things like web servers, where we have a number of relatively heterogeneous VMs that host internal web services or sites. Services in SCVMM collect those VMs into manageable groups that can be easily spread across multiple hosts for resilience if required. It’s also much easier to find VMs in services than in a very long list of hosts!\nIn terms of futures, I’m interested in where Desired State Configuration will take us. Crafting the necessary elements for this project would be extremely complicated with DSC right now, but when all the ducks are in order it should make life much, much easier, and DSC is certainly on my learning list.\n","date":"17 July 2014","externalUrl":null,"permalink":"/posts/automating-tfs-build-server-deployment-with-scvmm-and-powershell/","section":"Blog","summary":"Richard and I have been busy this week. It started with a conversation about automating the installation of new build servers. Richard was looking at writing PowerShell to install and configure the TFS build agent, along with all the various SDKs that we use across all out projects. Our current array of build servers have all been built by hand and each has a different set of SDKs to build specific project types. Richard’s aim is to make a single, homogenous build server configuration so we can then scale out for capacity much more quickly than before.\n","title":"Automating TFS Build Server deployment with SCVMM and PowerShell","type":"posts"},{"content":"","date":"17 July 2014","externalUrl":null,"permalink":"/tags/sharepoint/","section":"Tags","summary":"","title":"SharePoint","type":"tags"},{"content":"This is a relatively quick post. There’s a fair bunch of stuff written about creating columns in SharePoint 2013 that use Managed Metadata termsets. However, some of it is a pain to find and then some. I have had to deal with two frustrating issues lately, both of which boil down to poor sharepoint documentation.\nWictor Wilén wrote the post I point people at for most stuff on managed metadata columns, but this time the internet couldn’t help.\nFirst of all, I wanted to create a custom column which used a termset to hold data. This is well documented. However, I wanted to allow fill-in choices and could I make that work? My termset was open, my xml column definition looked right, but no fill-in choice. Update the column via the web UI and I could turn fill-in on and off with no problem. In the end, I examined the column with PowerShell before and after the change. It turns out (and this is not the only place they do it) the UI stays the same, but the settings changed in the background are different. For metadata columns the FillInChoice property is ignored – you must add a custom property called Open:\n\u0026lt;?xml version=\u0026#34;1.0\u0026#34; encoding=\u0026#34;utf-8\u0026#34;?\u0026gt; \u0026lt;Elements xmlns=\u0026#34;http://schemas.microsoft.com/sharepoint/\u0026#34;\u0026gt; \u0026lt;Field ID=\u0026#34;{b7406e8e-47aa-40ac-a061-5188422a58d6}\u0026#34; Name=\u0026#34;FeatureGroup\u0026#34; DisplayName=\u0026#34;Feature Group\u0026#34; Type=\u0026#34;TaxonomyFieldType\u0026#34; Required=\u0026#34;FALSE\u0026#34; Group=\u0026#34;Nimbus\u0026#34; ShowField=\u0026#34;Term1033\u0026#34; ShowInEditForm=\u0026#34;TRUE\u0026#34; ShowInNewForm=\u0026#34;TRUE\u0026#34; FillInChoice=\u0026#34;TRUE\u0026#34;\u0026gt; \u0026lt;Customization\u0026gt; \u0026lt;ArrayOfProperty\u0026gt; \u0026lt;Property\u0026gt; \u0026lt;Name\u0026gt;TextField\u0026lt;/Name\u0026gt; \u0026lt;Value xmlns:q6=\u0026#34;http://www.w3.org/2001/XMLSchema\u0026#34; p4:type=\u0026#34;q6:string\u0026#34; xmlns:p4=\u0026#34;http://www.w3.org/2001/XMLSchema-instance\u0026#34;\u0026gt;{b7406e8e-47aa-40ac-a061-5188422a58d6}\u0026lt;/Value\u0026gt; \u0026lt;/Property\u0026gt; \u0026lt;Property\u0026gt; \u0026lt;Name\u0026gt;Open\u0026lt;/Name\u0026gt; \u0026lt;Value xmlns:q5=\u0026#34;http://www.w3.org/2001/XMLSchema\u0026#34; p4:type=\u0026#34;q5:boolean\u0026#34; xmlns:p4=\u0026#34;http://www.w3.org/2001/XMLSchema-instance\u0026#34;\u0026gt;true\u0026lt;/Value\u0026gt; \u0026lt;/Property\u0026gt; \u0026lt;Property\u0026gt; \u0026lt;Name\u0026gt;IsPathRendered\u0026lt;/Name\u0026gt; \u0026lt;Value xmlns:q7=\u0026#34;http://www.w3.org/2001/XMLSchema\u0026#34; p4:type=\u0026#34;q7:boolean\u0026#34; xmlns:p4=\u0026#34;http://www.w3.org/2001/XMLSchema-instance\u0026#34;\u0026gt;false\u0026lt;/Value\u0026gt; \u0026lt;/Property\u0026gt; \u0026lt;/ArrayOfProperty\u0026gt; \u0026lt;/Customization\u0026gt; \u0026lt;/Field\u0026gt; \u0026lt;Field Type=\u0026#34;Note\u0026#34; DisplayName=\u0026#34;FeatureGroupTaxHTField0\u0026#34; StaticName=\u0026#34;FeatureGroupTaxHTField0\u0026#34; Name=\u0026#34;FeatureGroupTaxHTField0\u0026#34; Group=\u0026#34;Nimbus\u0026#34; ID=\u0026#34;{164B63F0-3424-4A9B-B6E4-5EC675EF5C75}\u0026#34; Hidden=\u0026#34;TRUE\u0026#34; DisplaceOnUpgrade=\u0026#34;TRUE\u0026#34;\u0026gt; \u0026lt;/Field\u0026gt; \u0026lt;/Elements\u0026gt; Whilst we’re on the subject, if you want metadata fields to be correctly indexed by search, the hidden field MUST follow the strict naming convention of TaxHTField0.\nWhen using the content by search web part, what gets indexed by search is the text of the term in the column within the content type. However, if you enter a search query wanting to match the value of the current page or item what gets pushed into the search column is the ID of the term (a GUID), not the text. It is possible to match the GUID against a different search managed property, but that only gets created if you name your hidden field correctly. Hat-tip to Martin Hatch for that one, in an obscure forum post I have not been able to find since.\n","date":"17 July 2014","externalUrl":null,"permalink":"/posts/sharepoint-2013-creating-managed-metadata-columns-that-allow-fill-in-choices/","section":"Blog","summary":"This is a relatively quick post. There’s a fair bunch of stuff written about creating columns in SharePoint 2013 that use Managed Metadata termsets. However, some of it is a pain to find and then some. I have had to deal with two frustrating issues lately, both of which boil down to poor sharepoint documentation.\n","title":"SharePoint 2013: Creating Managed Metadata Columns that allow Fill-In Choices","type":"posts"},{"content":"","date":"17 July 2014","externalUrl":null,"permalink":"/tags/sharepoint-2013/","section":"Tags","summary":"","title":"Sharepoint-2013","type":"tags"},{"content":"","date":"17 July 2014","externalUrl":null,"permalink":"/tags/system-center/","section":"Tags","summary":"","title":"System-Center","type":"tags"},{"content":"","date":"17 July 2014","externalUrl":null,"permalink":"/tags/team-foundation-server/","section":"Tags","summary":"","title":"Team-Foundation-Server","type":"tags"},{"content":"","date":"17 July 2014","externalUrl":null,"permalink":"/tags/tfs/","section":"Tags","summary":"","title":"Tfs","type":"tags"},{"content":"One of the things we learn early in our SharePoint careers was not to manually edit the web.config files of a web application. SharePoint involves multiple servers and has its own mechanisms for managing web.config updates.\nPreviously, I’ve created xml files with web.config modifications and copied those to each WFE. Those changes are merged into the initial web.config by SharePoint.\nI’ve always been vaguely aware of there being a better way, but never needed to track it down from an IT point of view. Last week, however we wanted to change a setting to enable blobcache on the servers hosting a particular web application so decided to use the opportunity to figure out a ‘best way’ to do this.\nEnter, stage left, the SPWebConfigModification class (note, that link is to SharePoint 2010, but SP2013 works the same way).\nWe can create a collection of configuration changes that get applied by SharePoint via a timer job. That collection is generated through code and is persistent – we can add and remove changes over time, but they are stored in the farm config and will get applied each time we add a new server or update the web application IIS files.\nA search of the web turned up an article by Ingo Karstein that had the right approach but brute forced everything by referencing SharePoint DLLs directly. A bit of experimentation showed that we didn’t need to do this – SharePoint PowerShell has everything we need.\nSample code is below. The code will first enumerate the collection of SPWebConfigurationModifications for our web application and remove any that have the same owner value as our script uses. It then adds a new modification to set the value of an attribute (the blobcache ‘enabled’ setting) to true. More modifications can be added into the script and these will be added to the collection. The mods are applied by SharePoint in sequence.\nIt needs some tidying but it works well. Read the documentation on how the modifications work carefully – it’s possible to work with an element or an attribute and you can add and remove stuff. Remember that other solutions may be adding modifications as well – make sure you don’t remove those.\nAs always, this stuff is provided ‘as is’ and I am not responsible for the damage you can wreak on your SharePoint farm. Test first and make sure you understand what this code does before using on production.\n# Load SharePoint PowerShell PSSnapIn and the main SharePoint .net library Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue #set a few variables for the script $owner = \u0026#34;NimbusPublishingModifications\u0026#34; $webappurl = \u0026#34;https://share2013.proj.local/\u0026#34; #Get the web application we want to work with $webapp = get-spwebapplication $webappurl #get the Foundation Web Application Service (the one that puts the content web apps on servers) $farmservices = $webapp.Farm.Services | where { $_.TypeName -eq \u0026#34;Microsoft SharePoint Foundation Web Application\u0026#34; } #get the list of existing web config modifications for our web app $existingModifications = @(); $webapp.WebConfigModifications | where-object { $_.Owner -eq $owner } | foreach-object { $existingModifications = $existingModifications + $\\_} #remove any modofications that match our owner value (i.e. strip out our old mods before we re-add them) $existingModifications | foreach-object{ $webapp.WebConfigModifications.Remove($\\_) } #create a new web config modification $newModification = new-object \u0026#34;Microsoft.SharePoint.Administration.SPWebConfigModification\u0026#34; $newModification.Path = \u0026#34;configuration/SharePoint/BlobCache\u0026#34; $newModification.Name = \u0026#34;enabled\u0026#34; $newModification.Sequence = 0 $newModification.Owner = $owner $newModification.Type = 1 #for the enum value \u0026#34;SPWebConfigModification.SPWebConfigModificationType.EnsureChildNode\u0026#34; $newModification.Value = \u0026#34;true\u0026#34; #add our web config modification to the stack of mods that are applied $webapp.WebConfigModifications.Add($newModification) $webapp.Update() #trigger the process of rebuildig the web config files on content web applications $farmServices.ApplyWebConfigModifications() ","date":"1 July 2014","externalUrl":null,"permalink":"/posts/safely-modify-sharepoint-2013-web-config-files-using-powershell/","section":"Blog","summary":"One of the things we learn early in our SharePoint careers was not to manually edit the web.config files of a web application. SharePoint involves multiple servers and has its own mechanisms for managing web.config updates.\n","title":"Safely modify SharePoint 2013 Web.Config files using PowerShell","type":"posts"},{"content":"My X220 is a stalwart machine. It’s built like a tank and can be upgraded in a numb of ways. Mine now has 16Gb of RAM and two SSDs which allow me to run multi-VM environments for development and demo. Unfortunately, however, there is no USB 3 on the laptop. That’s a pain if I need to copy stuff on and off via USB, or run VMs from a USB 3 pod.\nI’ve tried adding USB 3 before – I bough a Startech ExpressCard 54 with two ports. That singularly failed to work – the card is detected but the system either fails to recognise connected devices, or sees them yet can’t access them.\nWhilst at Build I was involved in a conversation with the Kinect product team. They said that when using the Kinect with Windows they had issues with USB 3, and it boiled down to chipset issues, where the manufacturer hadn’t implemented something quite in accordance with spec. This spurred me to look for another ExpressCard, carefully looking for a different chipset.\nEnter, stage left, Targus. not a name I’d associate with this kind of periperal, but careful reading of their specs showed their card to be a totally different chipset from the Startech device.\nI ordered mine from Amazon. It arrived the next day, plugged in and simply worked. It’s an ExpressCard 34, so only one port. However, it puts out enough power to run my Western Digital USB 3 pod without needing to use the included cable to draw additional power from another USB port. I get the same transfer speed from the disk as my colleagues USB 3-equipped W540 laptops, so I really can’t argue.\nThe one thing I did add was a 34-54 adapter (from Startech, ironically) to plug the hole left in my ExpressCard 54 slot.\nWith the current move to ultrabooks I can see no real replacement device for my X220 – a sealed unit with no more than 8Gb and a single drive doesn’t come close to my needs, and a 15” luggable workstation is just too heavy. Hopefully I can keep tweaking the X220 for a while yet.\n","date":"8 June 2014","externalUrl":null,"permalink":"/posts/adding-usb-3-to-my-lenovo-x220-tablet/","section":"Blog","summary":"My X220 is a stalwart machine. It’s built like a tank and can be upgraded in a numb of ways. Mine now has 16Gb of RAM and two SSDs which allow me to run multi-VM environments for development and demo. Unfortunately, however, there is no USB 3 on the laptop. That’s a pain if I need to copy stuff on and off via USB, or run VMs from a USB 3 pod.\n","title":"Adding USB 3 to my Lenovo X220 Tablet","type":"posts"},{"content":"Lets get the disclaimer out of the way first: What I’ve done is absolutely unsupported by Microsoft. Just because it works for me does not guarantee it will work for you and I am not in any way recommending that you follow my lead!\nI use a great many virtual machines for both customer work, internal projects and just tinkering. My ThinkPad X220T is tricked out with extra RAM and two SSDs. Space is still an issue, though, and I can’t squeeze any more storage into my little workhorse.\nWindows Server 2012 introduced Data Deduplication – a fantastic feature that is saving us huge amounts of disk space on our SCVMM library. I’d love to be able to use that on Windows 8.1 Sadly, Microsoft didn’t see fit to enable the feature.\nThere are a good many people out there who thought like I do and some of them decided to to figure out how to get data deduplication working on Windows 8.1. I’m not going to repeat those instructions here – I will instead post a link to the best of the articles I read before taking the leap, that of Mike Bijl.\nHaving installed and enabled the Data Deduplication feature I enabled dedupe on my D drive – a 500Gb Crucial M500 SSD. Note that you cannot dedupe your OS partition – you need OS and data volumes to get anywhere with this process. I started with about 12Gb of free space, gobbled up by ISO files and VHDs of installed VMs. Those dedupe beautifully, and I now have 245Gb of free space.\nHave I encountered any problems yet? No. All my VMs run fine. I have a scheduled dedupe job running at noon to keep things tidy that has given no problems so far.\nIt is important to reiterate Mike’s point, however: If you enable dedupe on a volume and reinstall Windows 8.1 you will not be able to access any data on the drive until you re-enable dedupe (or stick the volume in a Windows Server 2012 or 2012 R2 machine). I’m happy with that – it’s no big deal for me. I would not, however, allow any of our developers to do this on their workstations, for example.\nDoing all this, however, has got me thinking… Homegroup support is missing from Server 2012 and 2012 R2. I wonder if the same process might be used to enable features in the opposite direction…?\n","date":"8 June 2014","externalUrl":null,"permalink":"/posts/enabling-data-deduplication-on-my-windows-8-1-laptop/","section":"Blog","summary":"Lets get the disclaimer out of the way first: What I’ve done is absolutely unsupported by Microsoft. Just because it works for me does not guarantee it will work for you and I am not in any way recommending that you follow my lead!\n","title":"Enabling Data Deduplication on my Windows 8.1 Laptop","type":"posts"},{"content":"","date":"8 June 2014","externalUrl":null,"permalink":"/tags/lenovo-x220-tablet/","section":"Tags","summary":"","title":"Lenovo-X220-Tablet","type":"tags"},{"content":"Microsoft UK have been running technical events around the UK for a couple of years now, and it’s a great thing. Too many events are focused in the south of England and there are lots of IT pros north of the M25!\nStarting on Monday, the latest series of events kicks off. The People-Centric IT roadshow content is being delivered by MVPs from across the UK and Ireland. Covering hot-topics like Bring Your Own Device (BYOD) and information security, the sessions will talk about using the appropriate tooling from across the Microsoft stack to address these real-world problems.\nYou should think about attending if you want to learn more about:\nUsing System Center and Intune for managing desktops, operating systems and devices. Managing desktop and application delivery with VDI Using technologies like DirectAccess, Work Folders and Dynamic Access Control to give easy and secure access to data. Using Active Directory Federation Services as part of your identity portfolio. As always, the more people support these roadshows, particularly outside London, the more Microsoft will deliver similar events.\nMore information about each of the days can be found on the event pages, here:\n11th June 2014 – Edinburgh\n12th June 2014 – Sunderland\n13th June 2014 – Birmingham\n16th June 2014 – Bristol\n17th June 2014 – Reading\nThe Sunderland event is being supported by our good friends at NEBytes, too!\n","date":"8 June 2014","externalUrl":null,"permalink":"/posts/microsoft-people-centric-it-roadshow/","section":"Blog","summary":"Microsoft UK have been running technical events around the UK for a couple of years now, and it’s a great thing. Too many events are focused in the south of England and there are lots of IT pros north of the M25!\n","title":"Microsoft People-centric IT Roadshow","type":"posts"},{"content":"Richard and I spend a good deal of time talking about Lab Manager and our environments. I’ve written here before about our migration to the latest versions of the various components of Lab and both Richard and I have delivered sessions at user groups and conferences.\nRichard was in Belgium last week for Techorama, after which he was asked about the specifics of our setup. Between us, we came up with a diagram of our Lab Environment and Richard recently posted that to his blog. Hopefully some of you will find it useful.\n","date":"8 June 2014","externalUrl":null,"permalink":"/posts/our-tfs-lab-management-infrastructure/","section":"Blog","summary":"Richard and I spend a good deal of time talking about Lab Manager and our environments. I’ve written here before about our migration to the latest versions of the various components of Lab and both Richard and I have delivered sessions at user groups and conferences.\n","title":"Our TFS Lab Management Infrastructure","type":"posts"},{"content":"It’s a busy week. I’m speaking at the [Black Marble-hosted GWAB2 event](http://www.blackmarble.co.uk/events.aspx?event= Global Windows Azure Bootcamp 2) this Saturday, along with Steve Spencer and Andy Westgarth. Richard and Robert will also be on hand which means between us we should be able to cover questions on much of the newly re-monikered Microsoft Azure.\nI’ll be running through IaaS, Azure AD and looking at hybrid cloud solutions from an IT perspective while Steve and Andy talk through the other platform services from a developer point of view.\n","date":"26 March 2014","externalUrl":null,"permalink":"/posts/getting-ready-for-global-windows-azure-bootcamp-2/","section":"Blog","summary":"It’s a busy week. I’m speaking at the [Black Marble-hosted GWAB2 event](http://www.blackmarble.co.uk/events.aspx?event= Global Windows Azure Bootcamp 2) this Saturday, along with Steve Spencer and Andy Westgarth. Richard and Robert will also be on hand which means between us we should be able to cover questions on much of the newly re-monikered Microsoft Azure.\n","title":"Getting ready for Global Windows Azure Bootcamp 2","type":"posts"},{"content":"Last week I moved our SCVMM from 2012 with service pack 1 to 2012 R2. Whilst the actual process was much simpler than I expected, we had a pretty big constraint imposed upon us by Lab Manager that largely dictated our approach.\nOur SCVMM 2012 deployment was running on an aging Dell server. It had a pair of large hard drives that were software mirrored by the OS an we were using NIC teaming in Server 2012 to improve network throughput. It wasn’t performing that well, however. Transfers from the VMM library hosted on the server to our VM hosts were limited by the speed of the ageing SATA connectors and incoming transfers were further slowed by the software mirroring. We also had issues where Lab manager would timeout jobs whilst SCVMM was still diligently working on them.\nOur grand plan involves migrating our VM hosts to Server 2012 R2. That will give us better network transfers of VMs and allow generation 2 VMs on our production servers (also managed by SCVMM). To get there we needed to upgrade SCVMM, and to do that we had to upgrade our Team Foundation Server. Richard did the latter a little while ago, which triggered the process of SCVMM upgrade.\nOur big problem was that Lab is connected extremely strongly to SCVMM. We discovered just how strongly when we moved the SCVMM 2012. If we changed the name of the SCVMM server we would have to disconnect Lab from SCVMM. That would mean throwing away all our environments and imported machines, and I’m not going through the pain of rebuilding all that lot ever again.\nI desperately wanted to move SCVMM onto better tin – more RAM, more cores and, importantly, faster disks and hardware mirroring. That led to a migration process that involved the following steps:\nInstall Server 2012 R2 on our new server. Configure storage to give an OS drive and a data drive for the SCVMM library. Install the SCVMM pre-requisites on the new server. Using robocopy, transfer the contents of the SCVMM library to the new server. This needed breaking into blocks as we use data deduplication, and our library share contents are about three times the size of the drive! We could repeat the robocopy script and it would transfer any updated files. Uninstall SCVMM 2012 from the old server, making sure to keep the database as we do so. Change the name of the old server, and it’s IP address. Change the name of the new server to that of the old one, and change the IP address. Install SCVMM 2012 R2 onto the new server. Almost all of that worked perfectly. When installing SCVMM onto the new server I wanted to use an existing share for the library, sat on drive d: and called MSCVMMLibrary. Setup refused, saying that the server I was installing to already had a share of that name, but on drive c:. Very true – for various reasons the share was indeed on the c: drive, albeit with storage on a separate partition attached with a mount point.\nWhat to do – I couldn’t remove the existing share as I didn’t have SCVMM installed. I didn’t want to roll back either, as the steps were painful enough to deter me. So I looked in the SCVMM database for the share.\nSure enough, there is a table in there that lists the paths for the library shares for each server (tbl\\IL\\LibraryShare). There was a row with the name of my SCVMM server and a c:\\mscvmmlibrary path for the share. I changed the ‘c’ to a ‘d’ and reran setup. It worked like a charm.\nNow, I would not recommend doing what I did, but in the Lab Manager scenario, removing and re-adding that share causes all kinds of trouble as the resources in the library are connected to lab environments. I haven’t had any problems post-upgrade, so it looks like I got away with it. Sadly, this is just another in a long list of issues with the way Lab Manager interacts with SCVMM.\n","date":"20 March 2014","externalUrl":null,"permalink":"/posts/migrating-to-scvmm-2012-r2-in-a-tfs-lab-scenario/","section":"Blog","summary":"Last week I moved our SCVMM from 2012 with service pack 1 to 2012 R2. Whilst the actual process was much simpler than I expected, we had a pretty big constraint imposed upon us by Lab Manager that largely dictated our approach.\n","title":"Migrating to SCVMM 2012 R2 in a TFS Lab Scenario","type":"posts"},{"content":"","date":"20 March 2014","externalUrl":null,"permalink":"/tags/visual-studio/","section":"Tags","summary":"","title":"Visual-Studio","type":"tags"},{"content":"","date":"9 March 2014","externalUrl":null,"permalink":"/series/creating-azure-virtual-networks-using-powershell-and-xml/","section":"Series","summary":"","title":"Creating Azure Virtual Networks Using Powershell and XML","type":"series"},{"content":"This is part 4 of a series of posts building powershell functions to create and modify Azure Virtual Networks. Previous posts have covered functions to create virtual networks and then delete them. In this part, I’m going to show you functions that will define local networks and configure site-site VPN connectivity between a local and virtual network.\nNext on my list is to create functions to delete the local networks and remove the site-site connections. Then I really must look at functions to edit the configuration.\nAdding the functionality for local networks also meant that I had to modify the get-azureNetworkConfig function to create the LocalNetworkSites xml node if it does not already exist, ready to hold our local network definitions.\nThe Functions # get-azureNetworkConfig # This is an update to the function shown in part 2.\nfunction get-azureNetworkXml { $currentVNetConfig = get-AzureVNetConfig if ($currentVNetConfig -ne $null) { [xml]$workingVnetConfig = $currentVNetConfig.XMLConfiguration } else { $workingVnetConfig = new-object xml } $networkConfiguration = $workingVnetConfig.GetElementsByTagName(\u0026#34;NetworkConfiguration\u0026#34;) if ($networkConfiguration.count -eq 0) { $newNetworkConfiguration = create-newXmlNode -nodeName \u0026#34;NetworkConfiguration\u0026#34; $newNetworkConfiguration.SetAttribute(\u0026#34;xmlns:xsd\u0026#34;,\u0026#34;http://www.w3.org/2001/XMLSchema\u0026#34;) $newNetworkConfiguration.SetAttribute(\u0026#34;xmlns:xsi\u0026#34;,\u0026#34;http://www.w3.org/2001/XMLSchema-instance\u0026#34;) $networkConfiguration = $workingVnetConfig.AppendChild($newNetworkConfiguration) } $virtualNetworkConfiguration = $networkConfiguration.GetElementsByTagName(\u0026#34;VirtualNetworkConfiguration\u0026#34;) if ($virtualNetworkConfiguration.count -eq 0) { $newVirtualNetworkConfiguration = create-newXmlNode -nodeName \u0026#34;VirtualNetworkConfiguration\u0026#34; $virtualNetworkConfiguration = $networkConfiguration.AppendChild($newVirtualNetworkConfiguration) } $dns = $virtualNetworkConfiguration.GetElementsByTagName(\u0026#34;Dns\u0026#34;) if ($dns.count -eq 0) { $newDns = create-newXmlNode -nodeName \u0026#34;Dns\u0026#34; $dns = $virtualNetworkConfiguration.AppendChild($newDns) } $localNetworks = $virtualNetworkConfiguration.GetElementsByTagName(\u0026#34;LocalNetworkSites\u0026#34;) if ($localNetworks.count -eq 0) { $newlocalNetworks = create-newXmlNode -nodeName \u0026#34;LocalNetworkSites\u0026#34; $localNetworks = $virtualNetworkConfiguration.AppendChild($newLocalNetworks) } $virtualNetworkSites = $virtualNetworkConfiguration.GetElementsByTagName(\u0026#34;VirtualNetworkSites\u0026#34;) if ($virtualNetworkSites.count -eq 0) { $newVirtualNetworkSites = create-newXmlNode -nodeName \u0026#34;VirtualNetworkSites\u0026#34; $virtualNetworkSites = $virtualNetworkConfiguration.AppendChild($newVirtualNetworkSites) } return $workingVnetConfig } add-azureVnetLocalNetworkSite # Add-azureVnetLocalNetworkSite takes three parameters: networkName is the name for the new local network; addressPrefix is the network prefix for the local network and vpnGatewayAddress is the ip address of the local VPN gateway that will establish the vpn tunnel. The function checks that the local network does not already exist and then creates the appropriate XML.\nfunction add-azureVnetLocalNetworkSite { param ( [string]$networkName, [string]$addressPrefix, [string]$vpnGatewayAddress ) #check if the network already exists $siteExists = $workingVnetConfig.GetElementsByTagName(\u0026#34;LocalNetworkSite\u0026#34;) | where {$_.name -eq $networkName} if ($siteExists.Count -ne 0) { write-Output \u0026#34;Local Network Site $networkName already exists\u0026#34; $newNetwork = $null return $newNetwork } #get the parent node $workingNode = $workingVnetConfig.GetElementsByTagName(\u0026#34;LocalNetworkSites\u0026#34;) #add the new network node $newNetwork = create-newXmlNode -nodeName \u0026#34;LocalNetworkSite\u0026#34; $newNetwork.SetAttribute(\u0026#34;name\u0026#34;,$networkName) $network = $workingNode.appendchild($newNetwork) #add new address space node $newAddressSpace = create-newXmlNode -nodeName \u0026#34;AddressSpace\u0026#34; $AddressSpace = $network.appendchild($newAddressSpace) $newAddressPrefix = create-newXmlNode -nodeName \u0026#34;AddressPrefix\u0026#34; $newAddressPrefix.InnerText = $addressPrefix $AddressSpace.appendchild($newAddressPrefix) #add the new vpn gateway address $newVpnGateway = create-newXmlNode -nodeName \u0026#34;VPNGatewayAddress\u0026#34; $newVpnGateway.InnerText = $vpnGatewayAddress $network.AppendChild($newVpnGateway) #return our new network $newNetwork = $network return $newNetwork } add-azureVnetSiteConnectivity # add-azureVnetSiteConnectivity takes two parameters: networkName is the name of the virtual network and localNetworkName is the name of the local network. It checks to make sure both are defined before creating the appropriate XML to define the connection. In order for the site-site VPN configuration to be applied, the virtual network must have a subnet named GatewaySubnet, so the function checks for that too. I already have a function to create subnets so I can use that to create the subnet. The function also currently specifies a type of IPSec for the connection as no other options are currently available for site-to-site vpn connections.\nfunction add-azureVnetSiteConnectivity { param ( [string]$networkName, [string\\]$localNetworkName ) #get our target network $workingNode = $workingVnetConfig.GetElementsByTagName(\u0026#34;VirtualNetworkSite\u0026#34;) | where {$_.name -eq $networkName} if ($workingNode.Count -eq 0) { write-Output \u0026#34;Network $networkName does not exist\u0026#34; $newVnetSiteConnectivity = $null return $newVnetSiteConnectivity } #check that the network has a GatewaySubnet $subNetExists = $workingNode.GetElementsByTagName(\u0026#34;Subnet\u0026#34;) | where {$_.name -eq \u0026#34;GatewaySubnet\u0026#34;} if ($subNetExists.count -eq 0) { write-Output \u0026#34;Virtual network $networkName has no Gateway subnet\u0026#34; $newVnetSiteConnectivity = $null return $newVnetSiteConnectivity } #check that the local network site exists $localNetworkSite = $workingVnetConfig.GetElementsByTagName(\u0026#34;LocalNetworkSite\u0026#34;) | where {$_.name -eq $localNetworkName} if ($localNetworkSite.count -eq 0) { write-Output \u0026#34;Local Network Site $localNetworkSite does not exist\u0026#34; $newVnetSiteConnectivity = $null return $newVnetSiteConnectivity } #check if the gateway node exists and if not, create $gateway = $workingNode.GetElementsByTagName(\u0026#34;Gateway\u0026#34;) if ($gateway.count -eq 0) { $newGateway = create-newXmlNode -nodeName \u0026#34;Gateway\u0026#34; $gateway = $workingNode.appendchild($newGateway) } #check if the ConnectionsToLocalNetwork node exists and if not, create $connections = $workingNode.GetElementsByTagName(\u0026#34;ConnectionsToLocalNetwork\u0026#34;) if ($connections.count -eq 0) { $newConnections = create-newXmlNode -nodeName \u0026#34;ConnectionsToLocalNetwork\u0026#34; $connections = $gateway.appendchild($newConnections) } #check to make sure our local site reference doesn\u0026#39;t already exist $localSiteRefExists = $workingNode.GetElementsByTagName(\u0026#34;LocalNetworkSiteRef\u0026#34;) | where {$_.name -eq $localNetworkName} if ($localSiteRefExists.count -ne 0) { write-Output \u0026#34;Local Site Ref $localNetworkName already exists\u0026#34; $newVnetSiteConnectivity = $null return $newVnetSiteConnectivity } #add the local site ref $newVnetSiteConnectivity = create-newXmlNode -nodeName \u0026#34;LocalNetworkSiteRef\u0026#34; $newVnetSiteConnectivity.SetAttribute(\u0026#34;name\u0026#34;,$localNetworkName) $vNetSiteConnectivity = $connections.appendchild($newVnetSiteConnectivity) $newConnection = create-newXmlNode -nodeName \u0026#34;Connection\u0026#34; $newConnection.SetAttribute(\u0026#34;type\u0026#34;,\u0026#34;IPsec\u0026#34;) $vNetSiteConnectivity.appendchild($newConnection) #return our new subnet $newVnetSiteConnectivity = $vNetSiteConnectivity return $newVnetSiteConnectivity } Using the functions # These functions modify an XML configuration that needs to be held in an object named $workingVnetConfig. Part 2 of this series showed how they can be loaded from a powershell file and called. Get-azureNetworkXml is required to get the XML configuration object. The functions here can then be used to remove items from that configuration, then save-azureNetworkXml will push the modified configuration back into Azure.\n","date":"9 March 2014","externalUrl":null,"permalink":"/posts/creating-azure-virtual-networks-using-powershell-and-xml-part-4-local-networks-and-site-site-connectivity/","section":"Blog","summary":"This is part 4 of a series of posts building powershell functions to create and modify Azure Virtual Networks. Previous posts have covered functions to create virtual networks and then delete them. In this part, I’m going to show you functions that will define local networks and configure site-site VPN connectivity between a local and virtual network.\n","title":"Creating Azure Virtual Networks using Powershell and XML Part 4: Local networks and site-site connectivity","type":"posts"},{"content":"I also need to give credit to the Office 365 support team over this. They were very quick in their response to my support incident, but I was quicker!\nWhilst working on an Office 365 site for a customer today I had a moment of blind panic. The site is using custom branding and I was uploading a new version of the master page to the site when things went badly wrong. The upload appeared to finish OK but the dialog that was shown post upload was not the usual content type/fill in the fields form, but a plain white box. I left it for a few minutes but nothing changed. Unperturbed, I returned to the mater page gallery… Except I couldn’t. All I got was a white page. No errors, nothing. No pages worked at all – no settings pages, no content pages, nothing at all.\nAfter some screaming, I tried SharePoint designer. Unfortunately, this was disabled (it is by default) and I couldn’t reach the settings page to enable it. I logged a support call and then suddenly remembered a recent post from Gary Lapointe about a release of some powershell tools for Office 365.\nThose tools saved my life. I connected to the Office 365 system with :\nConnect-SPOSite -Credential \u0026ldquo;\u0026rdquo; -url \u0026ldquo;\u0026rdquo;\nSuccess!\nFirst of all I used set-spoweb to set the masterurl and custommasterurl properties of the failed site. That allow me back into the system (phew!):\nSet-SPOWeb -Identity \u0026ldquo;/\u0026rdquo; -CustomMasterUrl \u0026ldquo;/_catalogs/masterpage/seattle.master\u0026rdquo;\nOnce in, I thought all was well, but I could only access content pages. Every time I tried to access the masterpages libary or one of the site settings pages I got an error, even using Seattle.master.\nFortunately, Gary also has a command that will upload a file to a library, so I attempted to overwrite my corrupted masterpage:\nNew-SPOFile -List \u0026ldquo;https://.sharepoint.com/_catalogs/masterpage\u0026rdquo; -Web \u0026ldquo;/\u0026rdquo; -File \u0026ldquo;\u0026rdquo; –Overwrite\nOnce I’d done that, everthing snapped back into life.\nThe moral of the story? Keep calm and always have PowerShell ISE open!\nYou can download Gary’s tools here and instructions on their use are here.\nBig thanks, Gary!\n","date":"7 March 2014","externalUrl":null,"permalink":"/posts/gary-lapointe-to-the-rescue-using-his-office-365-powershell-tools-to-recover-from-a-corrupted-masterpage/","section":"Blog","summary":"I also need to give credit to the Office 365 support team over this. They were very quick in their response to my support incident, but I was quicker!\nWhilst working on an Office 365 site for a customer today I had a moment of blind panic. The site is using custom branding and I was uploading a new version of the master page to the site when things went badly wrong. The upload appeared to finish OK but the dialog that was shown post upload was not the usual content type/fill in the fields form, but a plain white box. I left it for a few minutes but nothing changed. Unperturbed, I returned to the mater page gallery… Except I couldn’t. All I got was a white page. No errors, nothing. No pages worked at all – no settings pages, no content pages, nothing at all.\n","title":"Gary Lapointe to the rescue: Using his Office 365 powershell tools to recover from a corrupted masterpage","type":"posts"},{"content":"","date":"7 March 2014","externalUrl":null,"permalink":"/tags/office-365/","section":"Tags","summary":"","title":"Office-365","type":"tags"},{"content":"In my previous post I talked about what was involved in creating an Azure network configuration using Powershell. In this post I’ll cover where I’ve got so so far, which is a series of functions that do the following:\nContact Azure and get the current network configuration. Convert that to sensible XML and if it’s empty, create the basic structure. Create a new virtual network, checking to see if one with the same name already exists. Add a subnet to a virtual network, checking to see one with the same address prefix or name doesn’t already exist. Add a DNS reference to a virtual network, making sure the DNS is defined first. Create a DNS. Put the configuration back into Azure to be applied. Still on my to-do list are removing networks and other elements, and modifying existing networks.\nThe Function Code # The end result so far is a powershell script that can be loaded to give a number of new functions:\nGet-azureNetworkXml # get-azureNetworkXml runs the get-AzureVNetConfig command. It takes the XMLConfiguration from that command and puts it into a new XML object. If there is no configuration, it creates a new xml object. It then checks to see if the main XML elements are present and, if not, creates them.\nWhilst this function returns an object, I need to make sure (right now) that the variable nme I use for that is $workingVnetConfig as other functions reference it. I’m not currently passing the XML object into each function. I probably should, but that tidying comes later.\nfunction get-azureNetworkXml { $currentVNetConfig = get-AzureVNetConfig if ($currentVNetConfig -ne $null){ [xml]$workingVnetConfig = $currentVNetConfig.XMLConfiguration } else { $workingVnetConfig = new-object xml } $networkConfiguration = $workingVnetConfig.GetElementsByTagName(\u0026#34;NetworkConfiguration\u0026#34;) if ($networkConfiguration.count -eq 0) { $newNetworkConfiguration = create-newXmlNode -nodeName \u0026#34;NetworkConfiguration\u0026#34; $newNetworkConfiguration.SetAttribute(\u0026#34;xmlns:xsd\u0026#34;,\u0026#34;http://www.w3.org/2001/XMLSchema\u0026#34;) $newNetworkConfiguration.SetAttribute(\u0026#34;xmlns:xsi\u0026#34;,\u0026#34;http://www.w3.org/2001/XMLSchema-instance\u0026#34;) $networkConfiguration = $workingVnetConfig.AppendChild($newNetworkConfiguration) } $virtualNetworkConfiguration = $networkConfiguration.GetElementsByTagName(\u0026#34;VirtualNetworkConfiguration\u0026#34;) if ($virtualNetworkConfiguration.count -eq 0) { $newVirtualNetworkConfiguration = create-newXmlNode -nodeName \u0026#34;VirtualNetworkConfiguration\u0026#34; $virtualNetworkConfiguration = $networkConfiguration.AppendChild($newVirtualNetworkConfiguration) } $dns = $virtualNetworkConfiguration.GetElementsByTagName(\u0026#34;Dns\u0026#34;) if ($dns.count -eq 0) { $newDns = create-newXmlNode -nodeName \u0026#34;Dns\u0026#34; $dns = $virtualNetworkConfiguration.AppendChild($newDns) } $virtualNetworkSites = $virtualNetworkConfiguration.GetElementsByTagName(\u0026#34;VirtualNetworkSites\u0026#34;) if ($virtualNetworkSites.count -eq 0) { $newVirtualNetworkSites = create-newXmlNode -nodeName \u0026#34;VirtualNetworkSites\u0026#34; $virtualNetworkSites = $virtualNetworkConfiguration.AppendChild($newVirtualNetworkSites) } return $workingVnetConfig } Save-azureNetworkXml # Save-azureNetworkXml gets passed our XML object, writes it out to a file in the temp dir and then calls set-AzureVNetConfig to load the file and send it to Azure.\nfunction save-azureNetworkXml($workingVnetConfig) { $tempFileName = $env:TEMP + \u0026#34;\\\\azurevnetconfig.netcfg\u0026#34; $workingVnetConfig.save($tempFileName) notepad $tempFileName set-AzureVNetConfig -configurationpath $tempFileName } Add-azureVnetNetwork # Add-azureVnetNetwork is called with three parameters: networkName, affinityGroup and addressPrefix. It will add a new VirtualNetworkSite element, with the name and affinity group as attributes. It checks to make sure the affinity group exists first. It then creates the address prefix within the network.\nfunction add-azureVnetNetwork { param ( [string]$networkName, [string]$affinityGroup, [string]$addressPrefix ) #check if the network already exists $networkExists = $workingVnetConfig.GetElementsByTagName(\u0026#34;VirtualNetworkSite\u0026#34;) | where {$\\_.name -eq $networkName} if ($networkExists.Count -ne 0) { write-Output \u0026#34;Network $networkName already exists\u0026#34; $newNetwork = $null return $newNetwork } #check that the target affinity group exists $affinityGroupExists = get-AzureAffinityGroup | where {$_.name -eq $affinityGroup} if ($affinityGroupExists -eq $null) { write-Output \u0026#34;Affinity group $affinityGroup does not exist\u0026#34; $newNetwork = $null return $newNetwork } #get the parent node $workingNode = $workingVnetConfig.GetElementsByTagName(\u0026#34;VirtualNetworkSites\u0026#34;) #add the new network node $newNetwork = create-newXmlNode -nodeName \u0026#34;VirtualNetworkSite\u0026#34; $newNetwork.SetAttribute(\u0026#34;name\u0026#34;,$networkName) $newNetwork.SetAttribute(\u0026#34;AffinityGroup\u0026#34;,$affinityGroup ) $network = $workingNode.appendchild($newNetwork) #add new address space node $newAddressSpace = create-newXmlNode -nodeName \u0026#34;AddressSpace\u0026#34; $AddressSpace = $Network.appendchild($newAddressSpace) $newAddressPrefix = create-newXmlNode -nodeName \u0026#34;AddressPrefix\u0026#34; $newAddressPrefix.InnerText=$addressPrefix $AddressSpace.appendchild($newAddressPrefix) #return our new network $newNetwork = $network return $newNetwork } Add-azureVnetSubnet # Add-azureVnetSubnet takes three parameters: networkName, subnetName and addressPrefix. It makes sure the network exists, that the subnet doesn’t, and that the address prefix is not already used in the same network. It then adds the subnet to the network.\nfunction add-azureVnetSubnet { param ( [string]$networkName, [string]$subnetName, [string]$addressPrefix ) #get our target network $workingNode = $workingVnetConfig.GetElementsByTagName(\u0026#34;VirtualNetworkSite\u0026#34;) | where {$_.name -eq $networkName} if ($workingNode.Count -eq 0) { write-Output \u0026#34;Network $networkName does not exist\u0026#34; $newSubnet = $null return $newSubnet } #check if the subnets node exists and if not, create $subnets = $workingNode.GetElementsByTagName(\u0026#34;Subnets\u0026#34;) if ($subnets.count -eq 0) { $newSubnets = create-newXmlNode -nodeName \u0026#34;Subnets\u0026#34; $subnets = $workingNode.appendchild($newSubnets) } #check to make sure our subnet name doesn\u0026#39;t exist and/or prefix isn\u0026#39;t already there $subNetExists = $workingNode.GetElementsByTagName(\u0026#34;Subnet\u0026#34;) | where {$_.name -eq $subnetName} if ($subNetExists.count -ne 0) { write-Output \u0026#34;Subnet $subnetName already exists\u0026#34; $newSubnet = $null return $newSubnet } $subNetExists = $workingNode.GetElementsByTagName(\u0026#34;Subnet\u0026#34;) | where {$_.AddressPrefix -eq $subnetName} if ($subNetExists.count -ne 0) { write-Output \u0026#34;Address prefix $addressPrefix already exists in another network\u0026#34; $newSubnet = $null return $newSubnet } #add the subnet $newSubnet = create-newXmlNode -nodeName \u0026#34;Subnet\u0026#34; $newSubnet.SetAttribute(\u0026#34;name\u0026#34;,$subnetName) $subnet = $subnets.appendchild($newSubnet) $newAddressPrefix = create-newXmlNode -nodeName \u0026#34;AddressPrefix\u0026#34; $newAddressPrefix.InnerText = $addressPrefix $subnet.appendchild($newAddressPrefix) #return our new subnet $newSubnet = $subnet return $newSubnet } Add-azureVnetDns # Add-azureVnetDns takes two parameters: dnsName and dnsAddress. It then creates a new DnsServer element for that DNS.\nfunction add-azureVnetDns { param ( [string]$dnsName, [string]$dnsAddress ) #check that the DNS does not exist $dnsExists = $workingVnetConfig.GetElementsByTagName(\u0026#34;DnsServer\u0026#34;) | where {$_.name -eq $dnsName} if ($dnsExists.Count -ne 0) { write-Output \u0026#34;DNS Server $dnsName already exists\u0026#34; $newDns = $null return $newDns } # get our working node of Dns $workingNode = $workingVnetConfig.GetElementsByTagName(\u0026#34;Dns\u0026#34;) #check if the DnsServersRef node exists and if not, create $dnsServers = $workingNode.GetElementsByTagName(\u0026#34;DnsServers\u0026#34;) if ($dnsServers.count -eq 0) { $newDnsServers = create-newXmlNode -nodeName \u0026#34;DnsServers\u0026#34; $dnsServers = $workingNode.appendchild($newDnsServers) } #add new dns reference $newDnsServer = create-newXmlNode -nodeName \u0026#34;DnsServer\u0026#34; $newDnsServer.SetAttribute(\u0026#34;name\u0026#34;,$dnsName) $newDnsServer.SetAttribute(\u0026#34;IPAddress\u0026#34;,$dnsAddress) $newDns = $dnsServers.appendchild($newDnsServer) #return our new dnsRef return $newDns } Add-azureVnetDnsRef # Add-azureVnetDnsRef takes two parameters; networkName and dnsName. It makes sure the network exists and that the DNS exists before adding a DnsServerRef element for the DNS to the network.\nfunction add-azureVnetDnsRef { param ( [string]$networkName, [string]$dnsName ) #get our target network $workingNode = $workingVnetConfig.GetElementsByTagName(\u0026#34;VirtualNetworkSite\u0026#34;) | where {$_.name -eq $networkName} if ($workingNode.count -eq 0) { write-Output \u0026#34;Network $networkName does not exist\u0026#34; $newSubnet = $null return $newSubnet } #check if the DnsServersRef node exists and if not, create $dnsServersRef = $workingNode.GetElementsByTagName(\u0026#34;DnsServersRef\u0026#34;) if ($dnsServersRef.count -eq 0) { $newDnsServersRef = create-newXmlNode -nodeName \u0026#34;DnsServersRef\u0026#34; $dnsServersRef = $workingNode.appendchild($newDnsServersRef) } #check that the DNS we want to reference is defined already $dnsExists = $workingVnetConfig.GetElementsByTagName(\u0026#34;DnsServer\u0026#34;) | where {$_.name -eq $dnsName} if ($dnsExists.Count -eq 0) { write-Output \u0026#34;DNS Server $dnsName does not exist so cannot be referenced\u0026#34; $newDnsRef = $null return $newDnsRef } #check that the dns reference isn\u0026#39;t already there $dnsRefExists = $workingNode.GetElementsByTagName(\u0026#34;DnsServerRef\u0026#34;) | where {$_.name -eq $dnsName} if ($dnsRefExists.count -ne 0) { write-Output \u0026#34;DNS reference $dnsName already exists\u0026#34; $newDnsRef = $null return $newDnsRef } #add new dns reference $newDnsServerRef = create-newXmlNode -nodeName \u0026#34;DnsServerRef\u0026#34; $newDnsServerRef.SetAttribute(\u0026#34;name\u0026#34;,$dnsName) $newDnsRef = $dnsServersRef.appendchild($newDnsServerRef) #return our new dnsRef return $newDnsRef } Create-newXmlNode # Create-newXmlNode is called by all the other functions. It creates a new node in the XML object then hands it back to the calling function for modification and appending it to the relevant parent node.\nfunction create-newXmlNode { param ( [string]$nodeName ) $newNode = $workingVnetConfig.CreateElement($nodeName,\u0026#34;http://schemas.microsoft.com/ServiceHosting/2011/07/NetworkConfiguration\u0026#34;) return $newNode } Using the functions # Assuming all our functions are in a powershell file called Create-AzureNetwork.ps1, using the new functions is pretty straightforward. We load the functions from file (there is a space between the first . and the .\\ in the first line. We can then call the functions.\nNote that I use a variable called $workingVnetConfig here – that’s important, as we don’t pass the XML into each function, but rather use the way powershell handles variables which means that having defined it here, it’s available to all the functions when called.\n. .\\Create-AzureNetwork.ps1 $workingVnetConfig = get-azurenetworkxml add-azureVnetNetwork -networkName \u0026#34;Mynetwork\u0026#34; -affinityGroup \u0026#34;MyAzureAffinity\u0026#34; -addressPrefix \u0026#34;10.0.0.0/8\u0026#34; add-azureVnetSubnet -networkName \u0026#34;Mynetwork\u0026#34; -subnetName \u0026#34;subnet-1\u0026#34; -addressPrefix \u0026#34;10.0.0.0/11\u0026#34; add-azureVNetDns -dnsName \u0026#34;test1\u0026#34; -dnsAddress \u0026#34;10.0.0.1\u0026#34; add-azureVnetDnsRef -networkName \u0026#34;Mynetwork\u0026#34; -dnsName \u0026#34;test1\u0026#34; save-azurenetworkxml($workingVnetConfig) It’s not the most elegant of code, I’ll admit, but it does what it says on the tin. All I have to do now is add functions to remove items from our network configuration, then add functions to modify existing items.\n","date":"4 March 2014","externalUrl":null,"permalink":"/posts/creating-azure-virtual-networks-using-powershell-and-xml-part-2-powershell-functions/","section":"Blog","summary":"In my previous post I talked about what was involved in creating an Azure network configuration using Powershell. In this post I’ll cover where I’ve got so so far, which is a series of functions that do the following:\n","title":"Creating Azure Virtual Networks using Powershell and XML Part 2: Powershell functions","type":"posts"},{"content":"This is part three of a series of posts about using powershell to script the creation, deletion and (hopefully) modification of Azure Virtual Networks. In part 1 I went through the key steps with some rough code. Part 2 showed the much tidier functions I’ve now written to create virtual network elements. This is part 3, and I will present functions to remove elements. Hopefully I will manage to get the modification functions to work which be a fourth installment!\nI’m not going to go through how to use the new functions in this part – I covered that before. I’m simply going to present the new functions that perform the following actions:\nRemove an entire virtual network definition. Remove a DNS definition. Remove a single subnet from a virtual network. Remove a DNS registration from a virtual network. The big thing I learned when writing this code is that if I used the RemoveAll method on an xml node in my configuration xml object, it didn’t actually remove the node itself but only the attributes and child nodes. This left empty elements (such as ) that confused Azure. The solution was to call the RemoveChild method on the parent node of the one I wanted rid of, specifying my target node.\nThe Functions # Delete-azureVnetNetwork # Delete-azureVnetNetwork takes one parameter: networkName. It makes sure the network exists, then removes the appropriate VirtualNetworkSite node and all it’s children.\nfunction delete-azureVnetNetwork { param ( [string]$networkName ) #check that the network already exists $network = $workingVnetConfig.GetElementsByTagName(\u0026#34;VirtualNetworkSite\u0026#34;) | where {$_.name -eq $networkName} if ($network.Count -eq 0) { write-Output \u0026#34;Network $networkName does not exist\u0026#34; $removeNetwork = $null return $removeNetwork } #remove the node and children $network.ParentNode.RemoveChild($network) #return true as we deleted the node $removeNetwork = $true return $removeNetwork } Delete-azureVnetSubnet # Delete-azureVnetSubnet takes two parameters: networkName and subnetName. It checks to make sure both exist, then removes the appropriate Subnet element from the specified network.\nfunction delete-azureVnetSubnet { param ( [string]$networkName, [string]$subnetName ) #check that the network exists $network = $workingVnetConfig.GetElementsByTagName(\u0026#34;VirtualNetworkSite\u0026#34;) | where {$_.name -eq $networkName} if ($network.Count -eq 0) { write-Output \u0026#34;Network $networkName does not exist\u0026#34; $removeSubnet = $null return $removeSubnet } #check to make sure our subnet name exists $subNet = $network.GetElementsByTagName(\u0026#34;Subnet\u0026#34;) | where {$_.name -eq $subnetName} if ($subNet.count -eq 0) { write-Output \u0026#34;Subnet $subnetName does not exist in network\u0026#34; $removeSubnet = $null return $removeSubnet } #remove the node and children $subNet.ParentNode.RemoveChild($subNet) #return true as we deleted the node $removeSubnet = $true return $removeSubnet } Delete-azureVnetDnsRef # Delete-azureVnetDnsRef takes two parameters: networkName and dnsName. It checks to make sure both the network and the DNS reference within it exist, then removes the appropriate DnsServerRef element from the specified network.\nfunction delete-azureVnetDnsRef { param ( [string]$networkName, [string]$dnsName ) #check that the network exists $network = $workingVnetConfig.GetElementsByTagName(\u0026#34;VirtualNetworkSite\u0026#34;) | where {$_.name -eq $networkName} if ($network.Count -eq 0) { write-Output \u0026#34;Network $networkName does not exist\u0026#34; $removeDnsRef = $null return $removeDnsRef } #check that the dns reference is there $dnsRef = $network.GetElementsByTagName(\u0026#34;DnsServerRef\u0026#34;) | where {$_.name -eq $dnsName} if ($dnsRef.count -eq 0) { write-Output \u0026#34;DNS reference $dnsName does not exist\u0026#34; $removeDnsRef = $null return $removeDnsRef } #remove the node and children $dnsRef.ParentNode.RemoveChild($dnsRef) #return true as we deleted the node $removeDnsRef = $true return $removeDnsRef } Delete-azureVnetDns # Delete-azureVnetDnsRef takes one parameter: dnsName. It checks to make sure that the DNS is not referenced by any virtual networks and that the DNS exists, then removes the appropriate DnsServer element.\nfunction delete-azureVnetDns { param ( [string]$dnsName ) #check that the dns isn\u0026#39;t referenced in any networks $dnsRef = $workingVnetConfig.GetElementsByTagName(\u0026#34;DnsServerRef\u0026#34;) | where {$_.name -eq $dnsName} if ($dnsRef.count -ne 0) { write-Output \u0026#34;DNS $dnsName is referenced in networks\u0026#34; $removeDns = $null return $removeDnsRef } #check that the DNS exists $dns = $workingVnetConfig.GetElementsByTagName(\u0026#34;DnsServer\u0026#34;) | where {$_.name -eq $dnsName} if ($dns.Count -eq 0) { write-Output \u0026#34;DNS Server $dnsName does not exists\u0026#34; $removeDns = $null return $removeDns } #remove the node and childre $dns.ParentNode.RemoveChild($dns) #return true as we deleted the node $removeDns = $true return $removeDns } Using the functions # These functions modify an XML configuration that needs to be held in an object call $workingVnetConfig. My previous post showed how they can be loaded from a powershell file and called. Get-azureNetworkXml is required to get the XML configuration object. The functions here can then be used to remove items from that configuration, then save-azureNetworkXml will push the modified configuration back into Azure.\n","date":"4 March 2014","externalUrl":null,"permalink":"/posts/creating-azure-virtual-networks-using-powershell-and-xml-part-3-powershell-functions-for-deletion/","section":"Blog","summary":"This is part three of a series of posts about using powershell to script the creation, deletion and (hopefully) modification of Azure Virtual Networks. In part 1 I went through the key steps with some rough code. Part 2 showed the much tidier functions I’ve now written to create virtual network elements. This is part 3, and I will present functions to remove elements. Hopefully I will manage to get the modification functions to work which be a fourth installment!\n","title":"Creating Azure Virtual Networks using Powershell and XML Part 3: Powershell functions for deletion","type":"posts"},{"content":"I’ll be honest, I expected this task to be easier than it is. What I’m working on is some powershell that we might use as part of automated build processes that will create a new Virtual Network in an Azure subscription. What I’m after is to add a new network to the existing configuration.\nThere aren’t many powershell commands for Azure virtual networks. The two we need to use are get-azureVnetConfig and set-azureVnetConfig.\nGet-azureVnetConfig when run generates xml that details the configuration of all virtual networks within the current Azure subscriptions. Set-azureVnetConfig takes an xml configuration and modifies the entire virtual networking configuration to match that described in the file.\nMy original plan of simple powershell to add a new virtual network went quickly out of the window, then. My second thought was to grab the xml configuration, manipulate it using powershell, then stuff it back into Azure. That plan was hindered by the fact that the set-azureVnetConfig command insists on reading the configuration from a file on disk, so I can’t just hand it my XML object, created by manipulating the output of get-azureVnetConfig.\nI’m still working on this – I now have a script with some tidy functions to do repetitive tasks. This post is simply going to outline the first bit of heavy lifting I’ve had to do in order to solve enough problems that I can get a config, add stuff to it and reload it into Azure.\nThe steps below don’t create all the configuration we will want, but it creates all the configuration we need to add a new network.\n1. Get the current Azure Config # This bit is easy:\n$currentVNetConfig = get-AzureVNetConfig That gives us an object which contains the XML configuration. We need to get just the XML out, so:\n[xml]$workingVnetConfig = $currentVNetConfig.XMLConfiguration 2. Find the VirtualNetworkSites element # The networks I want to create are all held in the VirtualNetworkSites element, each one in a VirtualNetworkSite element. I can create new VirtualNetworkSite elements, but I need to grab the element in which to create them first:\n$virtNetCfg = $workingVnetConfig.GetElementsByTagName(\u0026quot;VirtualNetworkSites\u0026quot;)\n3. Add a new Virtual Network # To add a new network we need to add a new VirtualNetworkSite element. I hit a snag with this, in that I kept getting a spurious xmlns attribute on the element that caused set-azureVnetConfig to spit out the file as invalid. It turns out that in order to avoid this, we have to specify the XML namespace URI when we create the new element. That’s the second parameter on the CreateElement method, below.\nCreating the element itself is a two-stage process: First we create a new element inside our XML object, then we put that element in the right place by calling appendchild on the intended parent element. In addition, we need to add a couple of attributes to that element, specifying the name of the network and the affinity group it will sit in:\n$newNetwork = $workingVnetConfig.CreateElement(\u0026#34;VirtualNetworkSite\u0026#34;,\u0026#34;http://schemas.microsoft.com/ServiceHosting/2011/07/NetworkConfiguration\u0026#34;) $newNetwork.SetAttribute(\u0026#34;name\u0026#34;,\u0026#34;myVirtualNetwork\u0026#34;) $newNetwork.SetAttribute(\u0026#34;AffinityGroup\u0026#34;,\u0026#34;MyAffinityGroup\u0026#34;) $Network = $virtNetCfg.appendchild($newNetwork) 4. Add an address space # This is a similar process. I need an AddressSpace element and within that sits an AddressPrefix element. That element needs text that tells Azure the IP address space to use, and that’s added by setting the innerText property.\n$newAddressSpace = $workingVnetConfig.CreateElement(\u0026#34;AddressSpace\u0026#34;,\u0026#34;http://schemas.microsoft.com/ServiceHosting/2011/07/NetworkConfiguration\u0026#34;) $AddressSpace = $Network.appendchild($newAddressSpace) $newAddressPrefix = $workingVnetConfig.CreateElement(\u0026#34;AddressPrefix\u0026#34;,\u0026#34;http://schemas.microsoft.com/ServiceHosting/2011/07/NetworkConfiguration\u0026#34;) $newAddressPrefix.InnerText=\u0026#34;10.0.0.0/8\u0026#34; $AddressSpace.appendchild($newAddressPrefix) 5. Add a subnet # Virtual networks need subnets. There is a Subnets element that contains multiple Subnet elements, each of which has an AddressPrefix element.\n$newSubnets = $workingVnetConfig.CreateElement(\u0026#34;Subnets\u0026#34;,\u0026#34;http://schemas.microsoft.com/ServiceHosting/2011/07/NetworkConfiguration\u0026#34;) $Subnets = $Network.appendchild($newSubnets) $newSubnet = $workingVnetConfig.CreateElement(\u0026#34;Subnet\u0026#34;,\u0026#34;http://schemas.microsoft.com/ServiceHosting/2011/07/NetworkConfiguration\u0026#34;) $newSubnet.SetAttribute(\u0026#34;name\u0026#34;,\u0026#34;Subnet-1\u0026#34;) $Subnet = $Subnets.appendchild($newSubnet) $newAddressPrefix = $workingVnetConfig.CreateElement(\u0026#34;AddressPrefix\u0026#34;,\u0026#34;http://schemas.microsoft.com/ServiceHosting/2011/07/NetworkConfiguration\u0026#34;) $newAddressPrefix.InnerText=\u0026#34;10.0.0.0/11\u0026#34; $Subnet.appendchild($newAddressPrefix) 6. Write out to a file and then use that file # $tempFileName = $env:TEMP + \u0026#34;\\\\azurevnetconfig.netcfg\u0026#34; $workingVnetConfig.save($tempFileName) set-AzureVNetConfig -configurationpath $tempFileName Next Steps # If you don’t have any Azure networks defined then get-azureVnetConfig will give you nothing. That means that more XML needs to be generated for a new network configuration. I’m working on a more expansive script right now and I’ll post that when I get something meaningful to show.\n","date":"3 March 2014","externalUrl":null,"permalink":"/posts/creating-azure-virtual-networks-using-powershell-and-xml/","section":"Blog","summary":"I’ll be honest, I expected this task to be easier than it is. What I’m working on is some powershell that we might use as part of automated build processes that will create a new Virtual Network in an Azure subscription. What I’m after is to add a new network to the existing configuration.\n","title":"Creating Azure Virtual Networks using Powershell and XML","type":"posts"},{"content":"This is really a follow-up to my earlier post about tips with SharePoint publishing customisations. Composed looks have been a part of a couple of projects recently. In the first, a solution for on-premise, we used code in a feature receiver to add a number of items to the Composed Looks list. In the second, for Office 365, a bit of research offered an alternative approach with no code.\nWhat are Composed Looks # A composed look is a collection of master page, colour scheme file, font scheme file and background image. There is a site list called Composed Looks that holds them, and they are shown in the Change the Look page as the thumbnail options you can choose to apply branding in one hit.\nIn order to get your new composed look working there are a few gotchas you need to know:\nWhen you specify a master page in your composed look, there must be a valid .preview file with the same name. This file defines the thumbnail image – if you look at an existing file (such as seattle.preview or olso.preview) you will find html and styling rules, along with some clever token replacement that references colours in the color scheme file. A composed look must have a master page and colour scheme (.spcolor) file, but font scheme and background image are optional. When using sites and site collections, files are split between local and root gallery locations: The Composed look List is local to the site – it doesn’t inherit from the parent site. Master pages go in the site Master Page Gallery. Spcolor, sptheme and image files go in the site collection master page gallery. If any of the files you specify in your composed look don’t exist (or you get the url wrong), the thumbnail won’t display. If any of the files in your composed look are invalid, the thumbnail won’t display. If your master page exists but has no .preview file, the thumbnail won’t display. Diligence is important!\nAdding Composed Looks using Elements.xml # In researching whether this was indeed possible, I came across an article by Tom Daly. All credit should go to him – I’ve simply tidied up a bit around his work. I already knoew that it was possible to create lists as part of a feature using only the elements.xml, and to place items in that new list. I hadn’t realised that adding items to an existing list also works.\nIn Visual Studio 2013 the process is easy – simply add a new item to your project, and in the Add New Item dialog select Office/SharePoint in the left column and Empty Element in the right. Visual Studio will create the new element with an Elements.xml ready and waiting for you.\nTo create our composed looks we simply edit that elements.xml file.\nFirst we need to reference our list. As per Tom’s post, we need to add a ListInstance element to our file:\n\u0026lt;ListInstance FeatureId=\u0026#34;{00000000-0000-0000-0000-000000000000}\u0026#34; TemplateType=\u0026#34;124\u0026#34; Title=\u0026#34;Composed Looks\u0026#34; Url=\u0026#34;_catalogs/design\u0026#34; RootWebOnly=\u0026#34;FALSE\u0026#34;\u0026gt; \u0026lt;/ListInstance\u0026gt; That xml points to our existing list, and the url is a relative path so will reference the list in the current site for our feature, which is what we want.\nNow we need to add at least one item. To do that we need to add Data and Rows elements to hold however many Row elements we have items:\n\u0026lt;ListInstance FeatureId=\u0026#34;{00000000-0000-0000-0000-000000000000}\u0026#34; TemplateType=\u0026#34;124\u0026#34; Title=\u0026#34;Composed Looks\u0026#34; Url=\u0026#34;_catalogs/design\u0026#34; RootWebOnly=\u0026#34;FALSE\u0026#34;\u0026gt; \u0026lt;Data\u0026gt; \u0026lt;Rows\u0026gt; \u0026lt;/Rows\u0026gt; \u0026lt;/Data\u0026gt; \u0026lt;/ListInstance\u0026gt; Then we add the following code for a single composed look:\n\u0026lt;Row\u0026gt; \u0026lt;Field Name=\u0026#34;ContentTypeId\u0026#34;\u0026gt;0x0060A82B9F5D2F6A44A6A5723277B06731\u0026lt;/Field\u0026gt; \u0026lt;Field Name=\u0026#34;Title\u0026#34;\u0026gt;My Composed Look\u0026lt;/Field\u0026gt; \u0026lt;Field Name=\u0026#34;_ModerationStatus\u0026#34;\u0026gt;0\u0026lt;/Field\u0026gt; \u0026lt;Field Name=\u0026#34;FSObjType\u0026#34;\u0026gt;0\u0026lt;/Field\u0026gt; \u0026lt;Field Name=\u0026#34;Name\u0026#34;\u0026gt;My Composed Look\u0026lt;/Field\u0026gt; \u0026lt;Field Name=\u0026#34;MasterPageUrl\u0026#34;\u0026gt;~site/_catalogs/masterpage/MyMasterPage.master, ~site/_catalogs/masterpage/MymasterPage.master\u0026lt;/Field\u0026gt; \u0026lt;Field Name=\u0026#34;ThemeUrl\u0026#34;\u0026gt;~sitecollection/_catalogs/theme/15/MyColorTheme.spcolor, ~sitecollection/_catalogs/theme/15/MyColorTheme.spcolor\u0026lt;/Field\u0026gt; \u0026lt;Field Name=\u0026#34;ImageUrl\u0026#34;\u0026gt;\u0026lt;/Field\u0026gt; \u0026lt;Field Name=\u0026#34;FontSchemeUrl\u0026#34;\u0026gt;\u0026lt;/Field\u0026gt; \u0026lt;Field Name=\u0026#34;DisplayOrder\u0026#34;\u0026gt;1\u0026lt;/Field\u0026gt; \u0026lt;/Row\u0026gt; There are two parts to the url fields – before the comma is the path to the file and after the comma is the description shown in the list dialog. I set both to the same, but the description could be something more meaningful if you like.\nNote that the master page url uses ~site in the path, whilst the theme url uses ~sitecollection. Both of these will be replaced by SharePoint with the correct paths for the current site or site collection.\nNote also that I have only specified master page and colour theme. The other two are optional, and SharePoint will use the default font scheme and no background image, respectively. The colour theme would appear to be mandatory because it is used in generating the thumbnail image in conjunction with the .preview file.\nThe DisplayOrder field affects where in the list of thumbnails our composed look appears. The out-of-the-box SharePoint themes start at 10 and the current theme is always 0. If more than one item has the same DisplayOrder they are displayed in the same order as in the composed looks list. Since I want my customisations to appear first I usually stick a value of 1 in there.\nI have removed a couple of fields from the list that Tom specified, most notably the ID field, which SharePoint will generate a value for and (I believe) should be unique, so better to let it deal with that than potentially muck things up ourselves.\nDeploying the Composed Look # Once we’ve created our elements.xml, getting the items deployed to our list is easy – simply create a feature and add that module to it. There are a few things I want to mention here:\nTom suggests that the declarative approach does not create items more than once if a feature is reactivated. I have not found this to be the case – deactivate and reactivate the feature and you will end up with duplicate items. Not terrible, but worth knowing. You need a site level feature to add items to the composed looks list. As some of the things that list item references are at a site collection level, I suggest the following feature and module structure: Site Collection Feature Module: Theme files, containing .spcolor, .spfont and background image files. Deploys to _catalogs/Theme/15 folder. Module: Stylesheets. Deploys to Style Library/Themable folder or a subfolder thereof. Module: CSS Images. Deploys to Style Library/Themable folder or a subfolder thereof. Separating images referenced by my CSS is a personal preference as I like tidy VS projects! If you have web parts or search display templates I would put those in the site collection feature as well. Site Feature Module: Master pages. Contains .master and associated .preview files. Deploys to _catalogs/masterpage folder. Module: Page layouts. Contains .aspx layout files. Deploys to _catalogs/masterpage folder. Module: Composed Looks: Contains the list items in our elements.xml file. Deploys to Composed Looks list. ","date":"28 February 2014","externalUrl":null,"permalink":"/posts/declaratively-create-composed-looks-in-sharepoint-2013-with-elements-xml/","section":"Blog","summary":"This is really a follow-up to my earlier post about tips with SharePoint publishing customisations. Composed looks have been a part of a couple of projects recently. In the first, a solution for on-premise, we used code in a feature receiver to add a number of items to the Composed Looks list. In the second, for Office 365, a bit of research offered an alternative approach with no code.\n","title":"Declaratively create Composed Looks in SharePoint 2013 with elements.xml","type":"posts"},{"content":"","date":"8 February 2014","externalUrl":null,"permalink":"/tags/nebytes/","section":"Tags","summary":"","title":"Nebytes","type":"tags"},{"content":"I’m pleased to have been asked to speak at NEBytes again – a great user group that meets in Newcastle. I’ll be speaking about customising SharePoint 2013 using master pages, themes and search templates, along the same lines as my recent blog post.\nIt will be an unusual one for me, as I will spend most of the session inside Visual Studio showing how to create and deploy the customisations that can deliver really powerful solutions without needing to resort to writing code (other than for deployment).\nThe event on the 19th is in partnership with SUGUK and the other session of the night sounds really interesting too: Building social sharepoint apps using Yammer.\nI’ve said before that I always enjoy visiting NEBytes. If you’re in the Newcastle area and are a developer or IT Pro I strongly recommend you find out more about them and consider attending.\nSee you there.\n","date":"8 February 2014","externalUrl":null,"permalink":"/posts/speaking-at-nebytes-on-february-19th/","section":"Blog","summary":"I’m pleased to have been asked to speak at NEBytes again – a great user group that meets in Newcastle. I’ll be speaking about customising SharePoint 2013 using master pages, themes and search templates, along the same lines as my recent blog post.\n","title":"Speaking at NEBytes on February 19th","type":"posts"},{"content":"","date":"5 February 2014","externalUrl":null,"permalink":"/tags/dell-venue-8-pro/","section":"Tags","summary":"","title":"Dell-Venue-8-Pro","type":"tags"},{"content":"You will recall from my earlier post how much I like my Dell Venue 8 Pro and how disappointed I was that the stylus was on back-order until March.\nImagine my surprise, then, when a package arrived at the beginning of this week with a shiny new stylus in it!\nWP_20140205_14_29_06_Raw As you can see from the picture, it works just great with OneNote (and it’s desktop big brother).\nThe only niggle I feel obliged to point out right at the start is that the stylus requires a battery, which is an extremely obscure AAAA type. I can pick them up on Amazon, certainly, but I’ve never seen them anywhere else! I shall be ordering a pack ASAP as I have no idea yet how long I can expect the battery to last.\nThe stylus itself is comfortable to hold, perhaps actually helped by the battery as it is held at the nib-end. There is a button on the stylus that allows for left- and right-button clicks. Pressure sensitivity works well, although without the variation of the Wacom stylus that both my Surface Pro and X220T have. Palm rejection also works well enough for me to comfortable rest my hand on the tablet whilst writing.\nI have been testing the tablet for taking handwritten notes in OneNote and then converting to text in OneNote desktop and it works better than I’d hoped. Ink-to-text is almost totally accurate, providing I remember to write in cursive rather than my usual block-capital scrawl.I really do believe that this was the purpose 8 inch Windows tablets fit best and nothing else really comes close to giving me a seamless workflow from note to document, coupled with the light weight, small size and flexibility to run desktop apps if I need to.\nIn addition to OneNote I have played with a marvellous app called Drawboard which allows you to create and annotate PDF files. It’s a really great Windows Store app that does what it sets out to do really well. Between those two I can both create content and review other people’s content very easily.\nI said in my earlier post that there is nothing currently available that offers the functionality of the Venue 8 Pro and using it with a stylus really underlines that for me. I would look at the Asus VivoTab Note 8 as a possible alternative, but for serious business users I would not consider any competition that did not offer a ‘proper’ active stylus rather than the soft and saggy capacitive ones.\nMy only conundrum now is whether or not to get the folio case…\n","date":"5 February 2014","externalUrl":null,"permalink":"/posts/using-the-dell-venue-8-pro-stylus/","section":"Blog","summary":"You will recall from my earlier post how much I like my Dell Venue 8 Pro and how disappointed I was that the stylus was on back-order until March.\nImagine my surprise, then, when a package arrived at the beginning of this week with a shiny new stylus in it!\n","title":"Using the Dell Venue 8 Pro Stylus","type":"posts"},{"content":"","date":"3 February 2014","externalUrl":null,"permalink":"/tags/design/","section":"Tags","summary":"","title":"Design","type":"tags"},{"content":"I’ve been hat-swapping again since just before christmas (which explains the lack of Azure IaaS posts I’m afraid). I’ve been working on a large SharePoint 2013 project, most lately on customising a number of elements around publishing. Getting those custom elements into SharePoint from my solution raised a number of little snags, most of which were solved by the great internet hive mind. It took me a long time to find some of those fixes, however, so I thought I’d collect them here and reference the original posts where appropriate.\n1. Overwrite existing files reliably # This has long been an old chestnut for as long as I have been working in SharePoint. Your solution deploys a file to the masterpage gallery or style library. You deploy an updated version and none of your changes are visible because SharePoint hasn’t replace the file with your new version. In previous versions careful use of things like ‘ghostable’ in library in the elements.xml when you deployed the file helped – files that are ghostable generally seem to be updated, unless you manually edit the file, thus ‘unghosting’ it.\nIn SharePoint 2013, however, we appear to have a new property that we can specify in our elements.xml for deployable files, ReplaceContent:\n\u0026lt;File Path=\u0026quot;myfile.aspx\u0026quot; Url=\u0026quot;myfile.aspx\u0026quot; Type=\u0026quot;GhostableInLibrary\u0026quot; ReplaceContent=\u0026quot;TRUE\u0026quot; /\u0026gt;\nAs far as I can tell, this does what it says on the tin. Overwrites existing files by default.\n2. Provision Web Parts into page layouts safely as part of a feature # This is one I’d never personally tried before. I’ve seen many people struggling, pasting web part code into a masterpage or page layout and having problems during deployment. The way to do it (the ‘right’ way as far as I can know) is to use the feature to do it. When you list your masterpage or page layout in the elements.xml you can add a property that deploys a web part, AllUsersWebPart:\n\u0026lt;File Path=\u0026#34;myfile.aspx\u0026#34; Url=\u0026#34;myfile.aspx\u0026#34; Type=\u0026#34;GhostableInLibrary\u0026#34; ReplaceContent=\u0026#34;TRUE\u0026#34; \u0026gt; \u0026lt;AllUsersWebPart WebPartZoneID=”TopZone” WebPartOrder=”0”\u0026gt; \u0026lt;![CDATA[ ]]\u0026gt; \u0026lt;/AllUsersWebPart\u0026gt; Simply specify the name of the web part zone in your page and it will be added during the deploy. The webpartorder setting should allow you to define where it appears. When adding multiple webparts I have had more success setting that to zero for each web part and just getting the order right. As you might have guessed, for multiple web parts, add multiple AllUsersWebPart sections.\nBut where’s the web part, I hear you cry! In that CDATA block, paste the XML for your web part. Getting that is easy – simply export the web part from SharePoint and paste the resulting XML straight in there. There are a couple of tweaks you may need to apply that I’ll list next.\n3. Substitute ~ for ~ in paths within web parts in CDATA blocks # This one stumped me for a while and I was fortunate to come across a post by Chris O’Brien that solved it for me. I was trying to add a custom Content By Search web part to a page. That web part had custom control and display templates specified, which reference the current site collection in their path (~sitecollection/_catalogs). The problem is that the tilda gets stripped out by SharePoint when the page is deployed, breaking the setting.\nThe solution turns out to be one of those typical off the wall ‘I would never have thought of that!’ solutions that crop up all the time with SharePoint: Swap the ~ character for it’s XML entity reference: ~.\n\u0026lt;property name=\u0026quot;GroupTemplateId\u0026quot; type=\u0026quot;string\u0026quot;\u0026gt;~sitecollection/_catalogs/masterpage/Display Templates/Content Web Parts/MyTemplate.js\u0026lt;/property\u0026gt;\n4. Use to include content in the Content Editor web part in CDATA blocks # Export a Content Editor web part and you will see that the HTML content that is displayed within it is in the Content element, wrapped in a CDATA block. The problem is that when deploying this web part into the page using the technique above you can’t nest a CDATA block within a CDATA block.\nThe solution? Change the CDATA wrapper to be the element. The snag? I have found that I need to swap the \u0026lt; and \u0026gt; symbols for their HTML entity counterparts: \u0026lt; and \u0026gt;.\n\u0026lt;Content xmlns=\u0026quot;http://schemas.microsoft.com/WebPart/v2/ContentEditor\u0026quot;\u0026gt;\u0026lt;value\u0026gt;\u0026amp;lt;h2\u0026amp;gt;?My Content\u0026amp;lt;/h2\u0026amp;gt;\u0026lt;/value\u0026gt;\u0026lt;/Content\u0026gt;\n5. Provision Search Display Templates as draft and publish them with a feature receiver # This one is a bit contentious, as far as I can tell. I derived my (simple) approach from an article by Waldek Mastykarz. The crux of the matter is this: You can either edit the HTML part of a search display template or the javascript. The ‘correct’ way is another matter though. If you have publishing features enabled then when you save and publish the HTML file, SharePoint generates the javascript file with a triggered event receiver. If you don’t have publishing enabled, as far as I can tell only the javascript files are there and the event receiver doesn’t appear to be enabled.\nSo… which way to jump? Well, in my case I am creating customisations that depend on publishing features, so I decided to deploy just the HTML file and let SharePoint generate the javascript. If I needed to use these things without publishing I may have extracted the javascript from my development sharepoint and deployed that.\nThe first part to my simple approach is to deploy the files as draft using the options available to me in elements.xml:\n\u0026lt;File Path=\u0026quot;MyTemplate.html\u0026quot; Url=\u0026quot;MyTemplate.html\u0026quot; Type=\u0026quot;GhostableInLibrary\u0026quot; Level=\u0026quot;Draft\u0026quot; ReplaceContent=\u0026quot;TRUE\u0026quot; /\u0026gt;\nI then use a fairly simple function that is called by the feature receiver on activition, once per file:\npublic static void CheckInFile(SPWeb web, string fileUrl) { // get the file SPFile file = web.GetFile(fileUrl); // depending on the settings of the parent document library we may need to check in and/or (publish or approve) the file if (file.Level == SPFileLevel.Checkout) file.CheckIn(\u0026#34;\u0026#34;, SPCheckinType.MajorCheckIn); if (file.Level == SPFileLevel.Draft) { if (file.DocumentLibrary.EnableModeration) file.Approve(\u0026#34;\u0026#34;); else file.Publish(\u0026#34;\u0026#34;); } } If you look at the original article, the solution suggested by Waldek is jolly clever, but much cleverer that I needed for a couple of display templates.\n6. Make your masterpages appear in ‘Change the look’ with a preview file # In the new SharePoint 2013 world site admins have a great deal of flexibility over how their site looks. I wanted to enable users of my custom masterpages to continue to use the theming engine – selecting their own colours and fonts – but to keep the custom masterpage I had built. Again, it’s actually really easy. Simply deploy a .preview file with the same name as your masterpage (e.g. mymaster.master and mymaster.preview). The .preview is actually a clever combination od setting, html and css that allows you to specify the default colour pallete file (.spcolor) and font file (.spfont) as well as draw a little preview of your page. I was lucky on that last one, as my look was the same as the default, so I simply copied seattle.preview.\nI could go a step further in that I can create a Composed Look that would show my layout as a tile in the Change My Look UI, but that involves adding items to a SharePoint list and was more than I needed for this particular project. I will need to do that for my next one, however…\n","date":"3 February 2014","externalUrl":null,"permalink":"/posts/six-tips-when-deploying-sharepoint-2013-masterpages-page-layouts-and-display-templates/","section":"Blog","summary":"I’ve been hat-swapping again since just before christmas (which explains the lack of Azure IaaS posts I’m afraid). I’ve been working on a large SharePoint 2013 project, most lately on customising a number of elements around publishing. Getting those custom elements into SharePoint from my solution raised a number of little snags, most of which were solved by the great internet hive mind. It took me a long time to find some of those fixes, however, so I thought I’d collect them here and reference the original posts where appropriate.\n","title":"Six tips when deploying SharePoint 2013 masterpages, page layouts and display templates","type":"posts"},{"content":"","date":"3 February 2014","externalUrl":null,"permalink":"/tags/web-development/","section":"Tags","summary":"","title":"Web-Development","type":"tags"},{"content":"","date":"27 January 2014","externalUrl":null,"permalink":"/tags/blogengine-net/","section":"Tags","summary":"","title":"Blogengine-Net","type":"tags"},{"content":"I sadly miss Twitter Notify, the plugin for Windows Live Writer that would tweet when I published a new post. Fortunately, there are a couple of plugins for BlogEngine.Net that purport to do the same thing. I’ve just deployed SocialPublish to our server. Configuration is a bit fiddly, and I’m not sure yet how well it will work with our multi-tennant structure. This is my first post after activation so I’m keen to see if it tweets when I publish!\nUpdate: well, the first test failed. I\u0026rsquo;m going to use this post for testing and we\u0026rsquo;ll see if I can make it work!\nUpdate: it turns out that the plugins uses the Twitterizer library to do the heaving lifting. The version of twitterizer2.dll in the plugin zipfile was too old and didn\u0026rsquo;t work with the new Twitter API. We grabbed the latest source from the twitterizer github repository, compiled the dll and replaced the one from the plugin package and it now works fine!\nUpdate: It looks like the plugin only tweets when you first publish a post, as opposed to if you unpublish/republish. Not a big problem, but worth knowing.\nUpdate: Bit.ly integration also works, but you need to get the Legacy API key that can be found in the Advanced tab of your bit.ly settings.\n","date":"27 January 2014","externalUrl":null,"permalink":"/posts/blogengine-net-automatically-tweeting-on-new-posts/","section":"Blog","summary":"I sadly miss Twitter Notify, the plugin for Windows Live Writer that would tweet when I published a new post. Fortunately, there are a couple of plugins for BlogEngine.Net that purport to do the same thing. I’ve just deployed SocialPublish to our server. Configuration is a bit fiddly, and I’m not sure yet how well it will work with our multi-tennant structure. This is my first post after activation so I’m keen to see if it tweets when I publish!\n","title":"BlogEngine.Net automatically tweeting on new posts","type":"posts"},{"content":"venu8prohq Some time ago I wrote about how disappointed I was with the Acer W3 tablet. I really wanted that small form factor device, but the Acer fell short in pretty much every regard. Late last year Dell launched the Venue 8 Pro – the first of the new generation of 8” Windows tablets out of the gate. I sat on the fence for a while, looking at community comments on the the device, then finally ordered one after speaking to Simon May about his impressions of it.\nOverall, I think it’s great. In this post I will go through the good and the bad, but overall I’d still be happy recommending it to others, with a perhaps couple of caveats. Competitors are now starting to appear, but the Dell still holds its own, I think. I’ll also mention a few tips that I have found along the way that will help you get the most from your own Venue 8.\nSize and shape # The Dell is smaller than the Acer W3 in every axis, and lighter. I find it comfortable to hold in one hand, fingers on one edge and thumb on another. I don’t have huge hands, by any stretch. The back is covered with a lightly ribbed, rubberised material which makes the device easy to grip and comfortable to hold.\nThere is no Windows button/key on the front of the device. Dell has placed a hardware button on the top right of the device as you hold it in portrait mode, with the power and volume buttons down the right hand edge. In theory this sounds off, but in practice I find it works well. Placing a button on the front suggests which way you should hold the device – I’ve commented before on how Surface compares to iPad in the way the button placement indicates preferred orientation. The Dell is a device you naturally want to use in portrait mode for tasks like browsing,email and twitter. Watch a video, though and you will probably switch to landscape. The Windows button on the Venue 8 works just fine in either orientation and you don’t accidentally catch it with a finger (as I do with my Surface and Surface Pro when in portrait sometimes).\nPorts, Connectivity and Charging # This is another area where the Dell might polarise views. There is no external display connector. That’s a little frustrating, as in all other ways the Dell would make a great device to carry and present from if needed. It does support Miracast, and I have tested it with my trusty Netgear Push2TV so you can output to a TV or projector, as long as that device has HDMI input for the Miracast adapter. In practice, however, Miracast and portrait fails horribly. Don’t try to mirror your display because it just doesn’t work. Extend is OK, but that really limits use to presenting.\nIs this really a problem, though? Most places I present only offer a VGA connector, even in this day and age. The number of expensive adapters I carry around for Surface, Surface 2 and my trusted X220T is too numerous to consider. That actually means that I don’t try to present form anything but the X220T, which has both displayport and vga output. Until the world catches up with digital inputs a tiny tablet is not going to be a viable ‘only device I carry’.\nI previously lambasted the Acer for needing a separate charger rather than using USB. Here the Venue 8 Pro wins, sort of… The Dell comes with a small charger and USB to micro-usb cable to charge the device. Fantastic! I thought, and immediately tried plugging into a USB port on my X220T. No dice.\nIt turns out that this is not uncommon. The Dell charger has shorted to pins of the USB connector. Unless the tablet detects that when a cable is connected, it won’t charge. The solution, then, turned out to be a simple three-quid cable from Amazon, originally intended for a Samsung tablet, that allows you to switch between ‘data’ and ‘charge’ mode and when connected in line with a standard cable enables charging from a standard USB port. Also useful to know is that the Surface Pro adapter, with it’s built-in USB charging, has the pins shorted and will charge the Dell.\nDon’t think about plugging in USB peripherals and charging at the same time, however. I also picked up a USB OTG hub, which I can happily connect to the Dell, attach a USB device such as keyboard or thumbdrive and also plug in the charging cable. The Dell refuses to switch to charging mode, however, and I have not found any existing cable/hub on sale that might address this problem.\nLast but not least is a Micro-SD slot. I bought the 32Gb version of the Venue 8 Pro (the 64Gb one weren’t shipping pre-christmas) and am quite happy with it, but have added an SD card to hold stuff like music for long train journeys.\nScreen # The display is lovely. No buts. A crisp, clear 800x1280 IPS panel that’s easy to read in ways that the W3 never was. It’s an interesting talking point in the current ‘higher is better’ resolution war – I’m really not sure that I’d notice much improvement if it were, say, full HD or even higher.\nI must point out, however, that the as-shipped Venue 8 Pro suffers from a fairly annoying auto-brightness behaviour due to a too-aggressive setting in software. Dell have an update that fixes this. I’ll come back to that…\nI use the Venue 8 for web browsing, reading on the Kindle app and doing light work such as email and reading documents. For that, it’s great. The screen is sharp and clear and text is readable without being too small. It does well in daylight, although the glass is quite reflective so it suffers in direct or very bright light\nPerformance # A quad-core Atom Z3740D powers the Venue 8 pro. It’s a zippy little thing – more than enough for everyday use of store apps and Office. It also makes a reasonable fist of games – Project Spark runs ok (although the back gets a bit hot!), although Halo: Spartan Assault is unplayable due to it not understanding the screen resolution. 2Gb of RAM isn’t enough for running VMs and heavy photoshop work but it’s more than enough for Store apps and Office.\nWhat I hadn’t realised until checking up whilst writing this post, is that the CPU is a 64-bit-capable one that also supports virtualisation. Having recently installed Windows 8.1 Enterprise x86 on mine (see later), I may now have to try again with Windows 8.1 Enterprise x64…\nNetworking # No physical network (you expected that, right?) But both 2.4Ghz and 5Ghz wireless for great flexibility between range and speed. Plug a USB ethernet adapter in and it will happily use that, if you need to.\nTouch and Stylus # venue8stylus Now comes the rub. One of the biggest reasons I bought the Venue 8 pro was because it offered an active stylus rather than the largely useless capacitive ones most tablets are stuck with. The Dell does not use the largely ubiquitous Wacom digitiser, however. This is new technology from Synaptics.\nThe stylus, and the debate surrounding it, was why I held off from buying the tablet in the first place. Early users posted scathing reviews of the stylus performance when inking in OneNote (my primary use case). Dell quickly issues firmware updates for the digitiser that improved things and this gave me the confidence to move forward. However, as I write this post my stylus, originally due the first week in December, is now not due until late March. I understand that Dell suspended shipment whilst they addressed design issues.\nI find this all very disappointing. Dell stole a march on the competition when they were first out of the gate with the Venue 8 Pro, but it’s clear that the new technology they adopted was not necessarily ready for prime-time. I like the Venue 8 Pro enough even without the stylus that I have no intention of ditching it, but it is currently unable to fulfill my primary use case.\nBattery Life # It lasts all day. For my actual use, which is intermittent and currently tends to be consuming information via web/email/etc I charge it every three days or so. I’m very happy with that. The datasheet says something like 9 hours and I have to say I think that’s pretty accurate.\nThe Competition # I have been very surprised that in the months since launch, only one vendor has announced anything that comes close to the Venue 8 Pro. Acer now has the W4 – aiming to right the wrongs of the W3; Lenovo announced a business-focused 8 inch tablet with a full HD scree resolution. Neither, however, has a usable stylus. Only the Asus Vivotab Note 8 offers the same size, performance and an active digitizer (a wacom, this time) and it’s not expected to ship until March. Providing they can sort their stylus issues I think the Venue 8 Pro is still the one I’d recommend to users like me.\nThe Use Case # Simon May posted an interesting article the other day where he compared choosing the size of device to choosing the size of notepad. I want to be able to use the Dell in meetings to take notes. In all-day workshops where I’m taking lots of notes I will use my Surface Pro and it’s great. For sales meetings, however, I want something smaller and lighter and the Dell fits the bill. I’d love to reach the point where my everyday back is small and light because I only have the 8 inch tablet in it, along with a small charger. If I’m presenting then I’ll take my X220T and for workshops I’ll take the Surface Pro. The Dell is perfect for conference trips, too. I’m hoping that once I get my stylus the Dell will prove a reliable workhorse that may finally replace my trusty moleskin notebooks.\nEnterprise Use # The Venue 8 Pro ships with Windows 8.1 (or 9.1 Pro if you go for the fully tricked out 64Gb with SIM slot version). With Workplace Join, new in Windows 8.1 and Server 2012 R2, I could get some of the enterprise access I want, but to get things like Direct Access I need to reinstall with Windows 8.1 Enterprise. Rather than blog on the process for that, I will simply point you at a great set of instructions to do this ‘the right way’. As you can guess, I now have 8.1 Enterprise on my Dell, with full secure access to all the systems I need.\nSummary: Great Device, Rushed to Market # Everything about the design of the Venue 8 Pro reflects well on Dell. Lots of things about the implementation, however, do not. Since launch, Dell has released a number of updates to fix problems with the auto-brightness of the screen and the sensitivity of the touch screen and stylus. Whilst most of the specs are in line with the other 8” tablets – memory, storage, CPU – the choice of Synaptics’ technology for the screen and stylus is one where I think more testing was needed. Almost certainly the choice was made because of cost – I’ll bet Synaptics did Dell a great deal to be first adopter compared to the cost of the Wacom digitiser. However, the customer does seem to be paying the price for lack of testing, as shown by the suspension of stylus shipments.\nIf you don’t want or need a stylus, I can recommend the Dell Venue 8 Pro without hesitation. If, like me, you are a OneNote user looking for that perfect size of device to take notes then you need to sit on the fence until March. At that point, hopefully Dell will have sorted it’s problems with the stylus and a careful comparison with the Asus device can be made.\n","date":"26 January 2014","externalUrl":null,"permalink":"/posts/living-with-the-dell-venue-8-pro/","section":"Blog","summary":"venu8prohq Some time ago I wrote about how disappointed I was with the Acer W3 tablet. I really wanted that small form factor device, but the Acer fell short in pretty much every regard. Late last year Dell launched the Venue 8 Pro – the first of the new generation of 8” Windows tablets out of the gate. I sat on the fence for a while, looking at community comments on the the device, then finally ordered one after speaking to Simon May about his impressions of it.\n","title":"Living with the Dell Venue 8 Pro","type":"posts"},{"content":"","date":"26 January 2014","externalUrl":null,"permalink":"/tags/tablet/","section":"Tags","summary":"","title":"Tablet","type":"tags"},{"content":"","date":"5 November 2013","externalUrl":null,"permalink":"/tags/azure-network/","section":"Tags","summary":"","title":"Azure-Network","type":"tags"},{"content":"I’ve been building demo environments for Tech.Days Online for the past few days. I had been blogging as I built, but then I hit problems and time pressure meant I had to pause my series on building the hybrid network. I will pick up the remainder of those posts in the near future but in the meantime, I want to give you all the heads up on one of my problems.\nWhen I came to install the directory synchronisation tool on my azure-hosted dirsync server I couldn’t get the configuration wizard to run. It kept telling me that the domain admin user I entered (the domain administrator!) was not a valid domain account. I tried removing the machine from the domain and re-adding it first to no avail, and then started looking at domain replication.\nThere were no errors in the event log, save for one solitary warning on each DC about time. DCDIAG spat out huge lists of errors on both servers. Repadmin refused to admit that the domain controllers knew about each other.\nSo, for ref, I was seeing:\nRPC errors when trying to talk between domain controllers.\nDNS servers were not synchronising.\nDCDIAG on one server threw up range of errors:\nEventID: 0x80000B46 related to kerberos.\nEventID: 0x00001695 relating to failed registration of DNS addresses in the domain.\nEventID: 0x00001695 relating to failed registration of DNS addresses in the ForestDNSZones subdomain.\nEventID: 0x00001695relating to failed registration of DNS addresses in the DomainDNSZones subdomain.\nEventID: 0x0000168E relating to failed registration of the DNS record _ldap._tcp.ForestDnsZones.\nEventID: 0x0000271A relating to a failed DCOM registration.\nThe solution was to fix time on the domain. I ran through a number of articles on the subject, and at the back of mind was a recollection that time can drift when running in a VM.\nIn the end I followed the settings in this TechNet article. I set both domain controllers to sync time with an NTP source (time.windows.com) and ten left the whole thing to settle for an hour or so while we went for food. When I came back the domain had settled.\nSadly, my dirsync box was a casualty of the conundrum. Because I removed it from the domain while AD sync was not working I had a broken trust relationship. I removed it for the domain again, rejoined it and everything worked just fine.\nAs always, hopefully this will save somebody some time and grief when doing the same thing as I was.\n","date":"5 November 2013","externalUrl":null,"permalink":"/posts/dealing-with-ad-sync-issues-in-an-azure-hybrid-deployment/","section":"Blog","summary":"I’ve been building demo environments for Tech.Days Online for the past few days. I had been blogging as I built, but then I hit problems and time pressure meant I had to pause my series on building the hybrid network. I will pick up the remainder of those posts in the near future but in the meantime, I want to give you all the heads up on one of my problems.\n","title":"Dealing with AD sync issues in an Azure hybrid deployment","type":"posts"},{"content":"","date":"5 November 2013","externalUrl":null,"permalink":"/tags/windows-server-2012-r2/","section":"Tags","summary":"","title":"Windows-Server-2012-R2","type":"tags"},{"content":"","date":"4 November 2013","externalUrl":null,"permalink":"/series/building-an-azure-iaas-and-on-premise-hybrid-environment/","section":"Series","summary":"","title":"Building an Azure IaaS and On-Premise Hybrid Environment","type":"series"},{"content":"This is part 2 of a series of posts bout building a hybrid network connecting Windows Azure and on-premise. For more background on what the goals are, and for information on how to create the Azure Network and connect the VPN tunnel between on-premise and cloud see part 1.\nCreating a DC on our Azure Network # I’m going to create a new VM on Azure using the VM gallery. One important point when doing this is that you should add a second drive to the VM for domain controllers. This is down to how read/write caching works on the primary drive (it’s enabled) which means there is a risk that a write operation may make it to the cache but not to the drive in the event of a failure. This would cause problems with AD synchronisation and for that reason we add a seond drive and disable caching on it so we can use it to host the AD database.\nBefore we create the new machine it’s a good idea to create a storage account. If we leave Azure to do it the account gets the usual random name. I prefer order and convention in these things, so I’ll create one myself.\nstorage 1 When you create a storage account, Azure now creates a container within it named vhds and it uses that to hold the virtual hard disks for your VMs.\nWe can now create a virtual machine using the VM Gallery.\nnew vm 1 The Virtual Machine creation wizard will appear and show the numerous VM templates we can start from. I want a Server 2012 R2 DC so I’m going to choose Windows Server 2012 R2 Datacenter from the list.\nnew vm 2 The next screen allows us to set the VM name. This is also used for the Azure Endpoint and must be unique within Azure. We can also choose a size for the VM from the available Azure VMs. This is a lab so I’m happy with a small VM. In production you would size the VM according to your AD.\nWe also need to provide a username and password that Azure will configure when it deploys the VM. We’ll use that to connect to the machine in order to join it to the domain.\nnew vm 3 The next screen asks for a whole bunch of information about where the new VM will be placed and what networks it will be connected to. The wizard does a pretty good job of selecting the right defaults for most settings.\nI created two subnets in my virtual network so I could have an internal and external subnets. The DC shouldn’t have connections from outside our network so it’s going on subnet-1.\nnew vm 4 The final screen allows us to configure the ports that will be available through the Azure endpoints. If we remove these then we will only be able to connect to the new VM via our internal network. That’s exactly what I want, so I will click the big X at the right hand side of each endpoint to remove it.\nnew vm 5 When we click the final button Azure will show us that our new VM is provisioning.\nnew vm 6 Once the VM is running you can click on it to view the dashboard. You will see from mine that the new VM has no public IP address and that it has been give an internal IP address of 172.16.1.4 – on the Azure network I created earlier. The first server that you connect to a virtual network subnet in Azure will always get .4 as it’s address; the second gets .5, etc. An important point to note here is that if a virtual machine is deallocated (when you shut it down from the Azure portal it will do this) the DHCP-given IP address is released and another server could get that address. It’s important to be careful about the order you start machines in for this reason.\nvm dash I haven’t added a second hard disk to the VM, so that’s our next step. At the bottom of the dashboard there is an Attach button that allows us to add an empty disk to the VM.\nattach disk 1 In the screen that appears we can give our new disk a name and size and, importantly, set the type of caching we want on the disk. As I mentioned, everything I have read and heard tells me that caching on the disk holding the AD database should be turned off.\nnew disk 1 Now we’ve got the second disk attached, the next step is to make an RDP connection to our new server. We can do that from one of the machines on our on-premise network just by entering the ip address of the Azure-hosted server into the Remote Connection dialog.\nRemember to use the credentials you set when you created the VM: e.g. azureucdc\\builduser\nrdp connection 1 The first thing we need to do is bring the additional disk online, create a volume and assign a drive letter. I’ve used S for sysvol.\ndc add disk Next, we need to join the server to our AD domain, which will need a reboot. After that we can add the Active Directory Domain Services role in order to promote the server to be a domain controller. It’s important when doing this to set the paths for the AD databases to the second drive (S in my case)\nazure dcpromo Once we’ve got our new DC and DNS up and running, we should configure our Azure network so it knows the IP address of our new DNS and hands it to other servers in our network.\nTo do that we register the DNS with Azure first.\nazure dns 2 Next we modify the configuration of our Azure virtual network to add the new DNS. The DNS addresses are handed out in the order they are specified in the Azure network, so I’ve removed the on-premise DNS then added first the one hosted in Azure and then the on-premise one.\nazure dns 3 We now have a functioning Azure network with services that will support any other machines we host there even if the VPN link goes down.\nWe’ll need some more VMs for our other services to support our connected Azure ADFS. We’ll deal with those in part 3.\n","date":"4 November 2013","externalUrl":null,"permalink":"/posts/building-an-azure-iaas-and-on-premise-hybrid-environment-part-2-dc-and-servers-in-the-cloud/","section":"Blog","summary":"This is part 2 of a series of posts bout building a hybrid network connecting Windows Azure and on-premise. For more background on what the goals are, and for information on how to create the Azure Network and connect the VPN tunnel between on-premise and cloud see part 1.\n","title":"Building an Azure IaaS and on-premise hybrid environment Part 2: DC and servers in the cloud","type":"posts"},{"content":"I’ve been meaning to build a test lab to kick the tyres of Windows Azure Networks for a while. Two things combined together to make me get it done, however: First was the need to build exactly that for a customer as part of proof-of-concepts; the second was an invitation to present at Tech.Days Online on the subject.\nI’ve built and rebuilt said lab a few times now. I am about to build it again in order to have a demo environment for Tech.Days and I though it would be a good opportunity to blog the steps involved.\nI had planned this as one blog post, but it’s going to end up as a series of posts just because of sheer length. In this post I’m going to describe the environment and walk through creating the Azure network and connecting it to my on-premise network.\nConstraints # Let’s get the big problem out of the way first: In order to do this you need a static, world-routable IP address. You have to have something at your end that will act as one end of a site-to-site VPN tunnel and that will only work if you have an IP that doesn’t randomly change.\nThe second issue is the bit of equipment you need to get that VPN working. The easiest is a Windows Server 2012 or 2012 R2 machine, or equipment from Juniper or Cisco which means you should be able to use one of the configuration scripts provided by Microsoft. After that, you’re on your own. I’ve already blogged about getting the connection working with a SonicWall. In theory, anything that supports IKEv2 connections can probably be made to work, but you’ll need to have a good understanding of the technology.\nThe third issue revolves around whether you are using trial subscriptions of things like Windows Azure and Office 365. I have an MSDN subscription to Azure, so it’s not going to vanish quickly, although I can burn through my MSDN credit quite quickly with this lab. If you are using a trial you need to be aware that you might hit problems. In this post I’m not going to touch Office 365, although I am going to get single sign-on working with Azure AD. The reason for that is I don’t want to connect my Azure AD to an Office 365 trial subscription that will vanish in a few short weeks.\nWhat are we building? # I wanted to build a meaningful test of what Azure Networks could do for me. I turns out that it’s also something that interests a good many of my customers and colleagues in the industry:\nCreate a Windows Azure virtual network and connect that to my on-premise network. Place a domain controller into the Azure network. Build a server in the Azure network to run Dirsync and push my domain users into Azure AD (step one of single sign-on for Office 365 as well) Build an ADFS server in the Azure network and connect it to Azure AD (step two of single-sign on for Office 365) Build an ADFS Proxy (or a Server 2012 Web Proxy) for internet-access to the federated sign-on mechanism (also needed for Office 365) What aren’t we doing? # We’re not going to look at Azure Backup in this post. We already use Azure for backup at Black Marble as part of our DPM configuration. There is also a simpler backup client for Windows Server. I’ll blog on those separately.\nWhy would we want to do this? # I have had many conversations about the practicality of moving virtualised servers from an on-premise environment into Azure. For many organisations this can work out cheaper that running their own tin. A hybird approach allows those VMs to me moved across over time and is important to enable testing.\nDescription of my rig # I am lucky in that I have a small number of static IP addresses through the internet provision at Black Marble. For my previous builds of this lab I added a USB network adapter to my laptop to connect to the outside world. For this build I am using a server hosted at Black Marble. Why? I need both ends of the lab to be running for my Tech.Days talks and it’s very hard to get a static world-routable IP at the event.\nVery importantly, however, none of this lab will be connected to my main networks. I will create an internal Hyper-V network for the on-premise end of the lab and a second Hyper-V network that will connect to the outside world. The Hyper-V host will not be connected to any of these networks.\nOn my laptop I have Windows 8.1 and built all the VMs as Generation 2 virtual machines. My server, however, runs Server 2012 so the VMs are Generation 1. Does this matter? Not a bit, but I like the simplicity of the generation 2 virtual machines more than generation 1.\nOn-Premise VMs # For my on-premise network I have two virtual machines:\nPremUCDC\nRole: Domain Controller, DNS\nOS: Windows Server 2012 R2\nCPU: 2 core\nRAM: Dynamic, min 512MB, max 2048MB\nDisk: 120Gb Dynamic\nNetwork: I adapter on internal network\nOnce the OS has been installed I will add the Active Directory Domain Services role and promote the server to be a domain controller.\nFor this lab I am using an internet-registered domain and I will use that as the AD domain suffix. This is an important point: If you create an AD forest with a .local suffix then you will have to jump through some more hoops to get single sign-on with Azure AD working.\nPremUCRRAS\nRole: Remote Access/VPN\nOS: Windows Server 2012\nCPU: 2 core\nRAM: Dynamic, min 512MB, max 2048MB.\nNetworking: I adapter on internal network; I adapter on internet-facing network\nI’ve tried Server 2012 R2 for the RRAS server a couple of times and I have not yet managed to get the VPN connection working, so this lab will use Server 2012.\nI won’t add any roles to this server. Once I’ve configured my Azure network I will use the configuration script from Microsoft to add the necessary roles and configure the VPN link.\nMy on-premise network will use the 192.168.0.0 non-routable address space. I will then use 172.16.0.0 for my Azure network address space.\nAzure Network # We need to create a new network in Azure to hold our VMs and we need to tell Azure what our on-premise network looks like, and what DNS servers we already have.\nWe start by creating a new Local Network in Windows Azure:\nnew internal network We will be asked what to call the new network and we are also asked to provide the IP address of the machine at the on-premise end of the VPN tunnel.\ninternal network 1 Next, we are asked to specify what address spaces we have on our on-premise network. This is important as it will be used for routing traffic between Azure and our on-premise networks.\nAs I said earlier, my on-premise network uses the 192.168 address space. I configure the Azure local network as 192.168.0.0/16. I can still subnet that network down on-premise (and I will).\ninternal network 2 Now we’ve defined what our on-premise network looks like we need to register our DNS servers. We need to do this so that Azure can hand them out via DHCP and machines on the Azure network will then be able to communicate with our on-premise network systems.\nnew dns Our on-premise network has a single DNS – PremUCDC, 192.168.1.1\nnew dns 2 Now we can define our Azure network\nnew internal network First we give it a name, and we need to associate it with an affinity group.\nazure network 1 Next, we associate the new network with the DNS server we added earlier\nazure network 2 We know we want to connect our on premise network so next we select the Configure site-to-site VPN option. Azure will helpfully add the local network we configured earlier.\nazure network 3 The next step is to define our address range and subnets on Azure. I’ve chosen to create 172.16.0.0/24 so I can subnet that down. I want two subnets – 172.16.1.0/24 and 172.16.2.0/24. I’ll add the gateway subnet in a moment.\nazure network 4 The gateway subnet is that one that has the internal IP address of the VPN endpoint in Azure. I want that to be 172.16.254.0/24.\nazure network 5 The network will take a little while to create. Once it’s done we need to create a Gateway that will provide our VPN connection.\nThe dashboard for the new network will look something like the image below and we can click the button at the bottom to create our gateway. There are two options for the gateway – static or dynamic routing. Four the lab I’m using dynamic routing.\ngateway 1 Creating a gateway can take up to fifteen minutes so this is a good time for a coffee break.\nOnce the gateway is provisioned your dashboard will update to show you the IP address of the Azure end of the VPN and metrics for data in and out. I’ve removed the last two octets of my gateway address in the screenshot.\ngateway 2 To bring up the connection to on-premise we need to configure our RRAS server. Conveniently, we can click the Download VPN Device Script link to grab some powershell to do that for us.\nThe VPN scripts are also available for a range of Cisco and Juniper devices. Simply select the appropriate options in the menus and download the script you need. You will need to edit the scripts to set a number of parameters before running them.\ngateway 3 Before we make those script changes we need to know the shared secret that is used in the VPN handshaking. To find that, click the Manage Key button at the bottom of the dashboard.\nThe shared key will be displayed. Copy it to clipboard and save it somewhere.\ngateway 4 Next, we need to edit the powershell script to add the parameters.\nAs a side note, why the guys at Microsoft didn’t put a variable block at the top of the script to make this easier I don’t know. Search and replace it is, then…\nvpnscript 1 There are a number of edits we need to make:\nReplace \u0026lt;SP_AzureGatewayIpAddress\u0026gt; with the large IP address that’s on the Azure network dashboard. This applies to lines 75, 80, 81 and 87. Replace \u0026lt;SP_AzureVnetNetworkCIDR\u0026gt; with the Azure network address range (172.16.0.0/16 in my lab) Replace \u0026lt;SP_PresharedKey\u0026gt; with the key we access through Manage Key. I usually leave line 87 commented out and run the command manually after the configuration is complete.\nCopy that script onto the VM that’s going to be the RRAS server. I’m assuming that you’ve already joined it to the domain and configured the network adapters for internal and internet connections.\nIn order to run the script we will need to modify the execution policy on the server to allow unsigned scripts.\nThe command for this is set-executionpolicy unrestricted\nNow run the powershell script to configure the VPN connection. The script will add the necessary roles to the server and configure the vpn connection.\nvpnscript 2 Once the script is run, assuming you don’t need to restart the server it’s time to bring up the connection.\nWe need to enable the Azure gateway first by clicking the Connect button on the dashboard. Once that’s done, execute the last line of the powershell script (connect-s2svpninterface …).\nWe should be able to see the state of the connection from both the RRAS server and the Azure dashboard. On the RRAS server, open the Routing and Remote Access console.\nThe VPN is listed in Network Interfaces and the connection status should be Connected.\nvpn state 1 The Azure Network dashboard should also show that the connection has been made.\nvpn state 2 Next steps… # Now we’ve got our VPN connected the next step is to create a new VM on Azure, join it to our domain and promote it to be a DC and DNS server.\nOnce that’s done there are more VMs to create in order to configure single sign-on with Azure AD, which also needs to be configured to use the internet-registered DNS domain.\nWith the VMs in place we can configure directory synchronisation and then configure ADFS for single-sign on.\nEach of these will be covered in later articles in this series.\n","date":"3 November 2013","externalUrl":null,"permalink":"/posts/building-an-azure-iaas-and-on-premise-hybrid-environment-part-1-the-plan-and-azure-network-connection/","section":"Blog","summary":"I’ve been meaning to build a test lab to kick the tyres of Windows Azure Networks for a while. Two things combined together to make me get it done, however: First was the need to build exactly that for a customer as part of proof-of-concepts; the second was an invitation to present at Tech.Days Online on the subject.\n","title":"Building an Azure IaaS and on-premise hybrid environment Part 1: The plan and Azure Network Connection","type":"posts"},{"content":"I am with a customer this week, building a test Azure Network+IaaS/Azure AD/Office 365 environment. We struggled to get the site-site VPN connection up for a while and there wasn’t a great deal on the greater internet to help, save for a couple of posts in a discussion forum by the marvellous Marcus Robinson. We finally got it working when we found a tech note from SonicWall, published just a few days ago on the 7th October.\nIt turns out that we had created a gateway on Azure that used dynamic routing (I had a working lab environment using Server 2012 RRAS done that way). In SonicWall terms, that is not a site-site VPN and as we had configured appliance for one of those were completely adrift. When we deleted the Azure gateway and created a static routing one everything worked.\nFor anyone embarking down this road with a SonicWall device I can report that when we followed the instructions everything appeared to connect just fine. The tech note is available on the SonicWall site for all to enjoy.\n","date":"28 October 2013","externalUrl":null,"permalink":"/posts/connecting-azure-network-site-site-vpn-to-a-sonicwall-appliance/","section":"Blog","summary":"I am with a customer this week, building a test Azure Network+IaaS/Azure AD/Office 365 environment. We struggled to get the site-site VPN connection up for a while and there wasn’t a great deal on the greater internet to help, save for a couple of posts in a discussion forum by the marvellous Marcus Robinson. We finally got it working when we found a tech note from SonicWall, published just a few days ago on the 7th October.\n","title":"Connecting Azure Network Site-Site VPN to a SonicWall Appliance","type":"posts"},{"content":"I’ve been supporting the great team of evangelists at Microsoft with their UK Tech.Days events for some time now. I am chuffed to bits that they have asked me to contribute to the fantastic UK Tech.Days Online event. If you haven’t heard about it, go look at the agenda right now! Three days of great content on the latest technologies covering client, server, cloud and dev. The whole thing will be streamed live thanks to the wonder of the internet and includes a live interview with Steve Ballmer.\nI am doing a session with the marvellous Steve Plank on the technologies that enable you to move your on-premises VMs into Azure and then a solo session on Windows Azure Backup – something we use already at BM as part of our DPM configuration. Sandwiched between those will be one where Steve covers the kind of automation you can achieve with PowerShell for Windows Azure.\nRobert is also involved – I believe he is speaking during the very first session of day 1, on Windows 8.1.\nIt’s a privilege to be involved in Tech.Days Online and I’m really looking forward to it. Go register and I look forward to answering all your great questions on the day!\n","date":"26 October 2013","externalUrl":null,"permalink":"/posts/speaking-at-uk-tech-days-online-2013/","section":"Blog","summary":"I’ve been supporting the great team of evangelists at Microsoft with their UK Tech.Days events for some time now. I am chuffed to bits that they have asked me to contribute to the fantastic UK Tech.Days Online event. If you haven’t heard about it, go look at the agenda right now! Three days of great content on the latest technologies covering client, server, cloud and dev. The whole thing will be streamed live thanks to the wonder of the internet and includes a live interview with Steve Ballmer.\n","title":"Speaking at UK Tech.Days Online 2013","type":"posts"},{"content":"DDD North 2013 was a fantastic community conference but sadly I didn’t get chance to deliver my grok talk on Generation 2 virtual machines. A few people came up to me beforehand to say they were interested in the topic, and a few more spoke to me afterwards to ask if I would blog. I had planned to write a post anyway, but when you know it’s something people want to read you get a bit more of a push.\nThis post will cover two areas of Hyper-V in Windows 8.1 and Server 2012: Generation 2 virtual machines which are completely new and a number of changes that should apply to all VMs, be they gen 1 or gen 2. What I not going to cover, as it’s a post all of it’s own, is the new and improved software-defined-networking in hyper-v.\nGeneration Next # As you can see in the screenshot below, when creating a virtual machine in the Windows 8.1 and Server 2012 you are asked which generation of VM you want. The screen gives a brief and reasonable summary of what the differences are… to a point.\nimage Generation 1 virtual machines are a mix of synthetic and emulated hardware. This goes all the way back to previous virtualisation solutions where the virtual machine was usually a software emulation of the good old faithful Intel 440BX motherboard.\nThe emulated hardware delivered a high level of compatibility across a range of operating systems. Old versions of DOS, Windows NT, Netware etc would all fairly happily boot and run on the 440BX hardware. You didn’t get all the cleverness of a guest that knew it was inside a VM but it worked. PXE (network) boot was not possible on the implementation of the synthetic network adapter in Hyper-V. That meant that you had to use the emulated NIC if you wanted to do this. Virtual hard disks could be added to the virtual SCSI adapter whilst the machine was running, but not the IDE adapter. You couldn’t boot from a SCSI device, however, so many machines had to have drives on both devices. Emulated keyboard controllers and other system devices were also implemented for compatibility. Generation 2 virtual machines get rid of all that legacy, emulated hardware. From what I’ve read and heard, all the devices in a generation 2 VM are synthetic, software generated. This makes the VM leaner and more efficient in how it uses resources, and potentially faster as gen 2 VMs are much closer to the kind of hardware found in a modern PC.\nThere are three key changes in Gen as far as most users are concerned:\nSCSI disks are not bootable. There is no IDE channel at all; all drives (VHD or virtual optical drive) are now on the SCSI channel. This is far simpler than before. Synthetic network adapters support PXE boot. Gone is the old legacy network adapter. The system uses UEFI rather than BIOS. That means you can implement secure boot on a VM. Whilst this might sound unnecessary it could be of great interest to organisations where security is key. The drawback of gen 2 is that, right now, only Windows 8, Server 2012 and their respective new updated versions can be run as a guest in a gen 2 VM. I’m not sure that this will change in terms of Microsoft operating systems, but I do expect a number of Linux systems to be able to join the club eventually. I have done a good deal of experimentation here, with a large range of Linux distributions. Pretty much across the board I could get the installation media to boot but install failed because the hardware was unknown. What this means is that when Microsoft release new versions of the hyper-v kernel additions for Linux we should see support expand in this regard.\nThe screenshot below shows the new hardware configuration screen for a generation 2 virtual machine. Note the much shorted list of devices in the left hand column:\nimage Useful changes across generations # There have been some other changes that, in theory, span generations. More on that in a bit.\nDrives # When Server 2012/Windows 8 arrived, Microsoft added bandwidth management for VMs. That useful for IT pros who want to manage what resources servers can consume but it’s also jolly handy for developers who would like to try low bandwidth connections during testing. We can’t do anything about latency with this approach, but it’s nice to be able to dial a connection down to 1Mb to see what the impact is.\nServer 2012 R2/Windows 8.1 add a similar option for the virtual hard drive. We can now specify QoS for the virtual hard disks, in IoPs. The system allows you to set a minimum and maximum. It’s important to remember here that this does depend on the physical tin beneath your VM. I run two SSDs in my laptops now, but before that my VMs ran on a 5400rpm drive. Trying to set a high value for minimum IoPs wouldn’t get me very far here. What is more useful, however, is being able to set the maximum value so we can start to simulate slow drives for testing.\nAs with network bandwidth management, I think this is also a great feature for IT pros who need to manage contention between VMs and focus resource on key machines.\nThe screenshot below shows the disk options screen with QoS and more.\nimage Also new is the ability to resize a VHD that is attached to a running machine. This is only possible with disks attached to SCSI channels, so gen 2 VMs may get more benefit here. Additionally, VHDs can now be shared between VMS. Again, this is SCSI only but this is a really useful change because it means we can build clusters with shared storage hosted on VHDs rather than direct attached iSCSI or fibrechannel. The end result is to make more options available to the little guys who don’t have the resources for expensive tin. It’s also great for building test environments that need to mirror those of a customer – we do that all the time and it’s going to give us lots of options.\nNetworks # I already said that I’m not going to dive into the new software-defined-networking here. If terms like NVGRE get you excited then there are people with more knowledge of comms than I have writing on the subject. Suffice to say it looks really useful for IT pros but not really for developers, I don’t think.\nAlso not much use for developers but incredibly useful for developers is the new Protected Network functionality. The concept of this is really simple and so, so useful:\nImagine you have a two node cluster. Each node has a network connection for VMs, not shared by the host OS, and one for the OS itself that the cluster uses. Node 1 suddenly loses connectivity on the VM connection. What happens? Absolutely nothing with Server 2012 because the VMs are still running and nothing knows that the VMs no longer have connectivity. With Server 2012 R2/Windows 8.1 you can enable protect network for the virtual adapter. Now, the systems are checking connectivity to the VM and in our scenario all the VMs on node 1 will fail merrily over to node 2, which still has a connection.\nI know we will find this new feature useful on our clustered, production VM hosts. Again, this really helps smaller organisations get better resilience from simpler hardware solutions.\nThe screenshot below shows the advanced options for a network adapter with network protection enabled.\nimage Enhanced session mode # I said that, in theory, many of the new changes are pan-generation (and pan-guest OS). According to the documentation, enhanced session mode should work on more than just Windows 8.1 or Server 2012 FR2 guest operating systems. In practice, I have not found this to be the case, even after updating the VM additions on my machines to the latest version.\nIt is useful, however. When you enable enhanced session mode then, providing you have enabled remote desktop on the guest, this will be used to connect to the VM. Even if the guest has no network connection to the host OS, or even a network adapter!).\nThe screenshot below shows the option for enhanced session mode. This is enabled by default in Windows 8.1 and disabled by default in Server 2012 R2.\nimage When you have the option enabled you will see a new button on the right of the toolbar, as shown in the image below.\nimage That little PC with a plus symbol toggles the VM connection between old-style and the new, RDP-based connection. The end result is that you get more screen resolution choices, you can copy and paste properly between your host and the VM (no more paste keystrokes and you can copy files and documents!) and all the USB device pass-through from the host works too.\nFor developers working inside a VM this is is great – no more needing network connections to be able to RDP into a box. That means that you can run sensitive VMs, or multiple copies of a VM on multiple machines much more easily than before. If you enable the new connection mode on a VM, and restart it, when the VM begins to boot it connects in the old way, but as soon as it detects the RDP service on the guest you get a dialog asking you for the new resolution and it swtiches to the RDP style connection. It’s great.\nI’m hoping that there will either be updates for older Microsoft OS versions, or updated VM additions that will give a consistent result that I have no so far experienced. In theory, updates to the Linux kernel additions could also add this new connection type, but again, so far my experience is that it doesn’t work right now.\nSummary # To sum up then:\nGeneration 2 VMs – leaner, meaner and simpler all round but limited to the latest Microsoft desktop and server OS’. I can’t see a reason not to use them for the latest OS version. Disk QoS – should be really useful for dev/test when you need to simulate a slow drive. Great for IT pros to manage environments with a mix of critical and non-critical VMs. Online VHD resizing. There are so many times I’ve needed this on dev/test in the last few months alone. Shame it’s SCSI only so you can’t grow the OS disk on a gen 1 VM but you can’t have everything. Shared VHD. Another useful new option that will help building dev/test environments and will also be useful for smaller organisations who want to build things like virtualised clustered file servers using a cluster shared volume (CSV). Network protection. Great for IT pros running host clusters. Can’t see a use for devs. Enhanced session mode. Useful all round, especially for devs who want to easily work on a VM. Useful for IT pros who need to copy stuff on to running VMs, but so far my experience is mixed as it only works on Windows 8.1 and Server 2012 guests. Windows 8.1 is already on MSDN and TechNet so if you’re a dev or IT Pro with the right subscriptions, why aren’t you trying this stuff already? For everybody else, the 18th of this month sees general availability and I expect evaluation media will be available for you to play with.\n","date":"15 October 2013","externalUrl":null,"permalink":"/posts/generation-2-virtual-machines-on-windows-8-1-and-server-2012-r2-plus-other-nice-new-features/","section":"Blog","summary":"DDD North 2013 was a fantastic community conference but sadly I didn’t get chance to deliver my grok talk on Generation 2 virtual machines. A few people came up to me beforehand to say they were interested in the topic, and a few more spoke to me afterwards to ask if I would blog. I had planned to write a post anyway, but when you know it’s something people want to read you get a bit more of a push.\n","title":"Generation 2 Virtual Machines on Windows 8.1 and Server 2012 R2 plus other nice new features","type":"posts"},{"content":"","date":"15 October 2013","externalUrl":null,"permalink":"/tags/virtualisation/","section":"Tags","summary":"","title":"Virtualisation","type":"tags"},{"content":"","date":"15 October 2013","externalUrl":null,"permalink":"/tags/windows-8-1/","section":"Tags","summary":"","title":"Windows-8-1","type":"tags"},{"content":"I had a surprise exchange of text messages last night with Andy Westgarth. Sadly, one of the people who was to speak in one of the first session slots has had to pull out. Andy did the thing all the best conference organisers do – he called his friends! As a result, Richard and myself will be presenting a session about our experience with Lab Manager on Saturday morning.\nLab Manager is an interesting part of the development puzzle, allowing automated provisioning of environments that can then have software deployed to them and automated tests run against them. However, building a good Lab Manager environment (or machines to then be composed into an environment) is a very different task than the bare-metal scripting guerrilla devops approach that is very en-vogue right now. Richard and I will speak about how we run our Lab from both the perspective of the development/ALM specialist (that would be him!) and the IT guy (that would be me!).\nI’ve also been asked to take lots of photos at the event, so if you see me wandering around with my camera, smile and say hi!\n","date":"10 October 2013","externalUrl":null,"permalink":"/posts/unexpectedly-now-doing-a-session-at-ddd-north-2013/","section":"Blog","summary":"I had a surprise exchange of text messages last night with Andy Westgarth. Sadly, one of the people who was to speak in one of the first session slots has had to pull out. Andy did the thing all the best conference organisers do – he called his friends! As a result, Richard and myself will be presenting a session about our experience with Lab Manager on Saturday morning.\n","title":"Unexpectedly now doing a session at DDD North 2013","type":"posts"},{"content":"DDD North 2013 is almost upon us and I hope you’re all converging on Sunderland for what should be a great for devs. I’ll be helping out during the day, and I will also be doing a short Grok Talk on how Generation 2 Virtual Machines in Windows 8.1 and Server 2012 are new, different and cool. Come along and heckle, why don’t you?\n","date":"8 October 2013","externalUrl":null,"permalink":"/posts/grok-talking-at-dddnorth-2013/","section":"Blog","summary":"DDD North 2013 is almost upon us and I hope you’re all converging on Sunderland for what should be a great for devs. I’ll be helping out during the day, and I will also be doing a short Grok Talk on how Generation 2 Virtual Machines in Windows 8.1 and Server 2012 are new, different and cool. Come along and heckle, why don’t you?\n","title":"Grok talking at DDDNorth 2013","type":"posts"},{"content":"One of the most useful features of Windows 8.1 for me is the native support for Miracast (which is compatible with Intel Widi) for connecting to a wireless projector or display. Being able to wander around with my tablet whilst speaking is really handy.\nSadly, whilst this worked for a little while during the preview, everything stopped with no reason. Searching the internet hive mind suggested that a Windows Defender update during the preview release had borked it, but nobody could confirm.\nWhen the release media arrived on MSDN I upgraded my Surface Pro. Sadly, no joy with the Miracast feature. However, a new firmware update has been release by Microsoft (see Mr Thurrott for details) and that has fixed the issue. I suspect it’s actually a set of updated display drivers, as a connection could always be be made to the device but nothing would show on screen.\nThe Push2TV is a great little device – it’s tiny (a couple of inches long, about an inch wide and less than half an inch deep) and will draw power from a USB port on the TV or projector. I got it for testing but I’d really like to be able to use it at our events. The universality of Miracast support in Windows 8.1 might just let me do that.\nThis isn’t our first rodeo, however. Thanks to a recommendation from Messrs May and Fryer I also have a Belkin Screencast. I couldn’t get that working during the preview of Windows 8.1 at all. I will test that when I get some time. I personally prefer the Netgear, but the Belkin isn’t a bad device. It’s bigger and has a separate PSU, but the big difference for me is that the Belkin insists on fiddling with firmware updates via the Widi connection and it’s a bit of a pain, frankly. The Netgear is a much friendlier, manual update over normal wifi.\n","date":"8 October 2013","externalUrl":null,"permalink":"/posts/miracast-with-surface-pro-windows-8-1-release-and-netgear-push2tv/","section":"Blog","summary":"One of the most useful features of Windows 8.1 for me is the native support for Miracast (which is compatible with Intel Widi) for connecting to a wireless projector or display. Being able to wander around with my tablet whilst speaking is really handy.\n","title":"Miracast with Surface Pro, Windows 8.1 release and Netgear Push2TV","type":"posts"},{"content":"A quick tip, this one. I downloaded the latest firmware update to my Surface Pro this evening. It rebooted and promptly requested my bitlocker unlock code. I don’t keep those to hand – they’re stored in our Active Directory. Fortunately I had another laptop with DirectAccess so I could find the key. Be ready with your recovery key if you too have enabled bitlocker and perform firmware updates.\n","date":"6 October 2013","externalUrl":null,"permalink":"/posts/take-care-installing-firmware-updates-on-your-surface-pro-if-its-bitlocker-encrypted/","section":"Blog","summary":"A quick tip, this one. I downloaded the latest firmware update to my Surface Pro this evening. It rebooted and promptly requested my bitlocker unlock code. I don’t keep those to hand – they’re stored in our Active Directory. Fortunately I had another laptop with DirectAccess so I could find the key. Be ready with your recovery key if you too have enabled bitlocker and perform firmware updates.\n","title":"Take care installing firmware updates on your Surface Pro if it’s bitlocker encrypted","type":"posts"},{"content":"It’s autumn again, and that means event season is upon us once more. In the next few months I’m getting around a bit, so this post is a plug for the events I’m either attending or speaking at.\nOctober 1st is VMUG Leeds. I’m registered to attend, but chances are I’ll be spending much of the day helping the Microsoft guys run their hand-on lab. The agenda has some great-sounding sessions and I believe there are still spaces so why not register and come along. October 12th is DDDNorth in Sunderland. Perhaps unsurprisingly my Lab Manager session wasn’t voted in, but I’m sure that’s because the range of speakers and topics available to choose from during voting meant hard choice had to be made . As with last year, I’m helping out on the day but I’m also hoping to attend (heckle) some of the sessions. Black Marble should be there in force, as Richard, Steve and Gary are all speaking. Former BM staffer Iain Angus’ session looks interesting too! December 4th is the Black Marble [Architecture Forum in the North](http://www.blackmarble.co.uk/events.aspx?event=Architecture Forum in the North - 6). With so many great speakers lined up already I’m not sure if Linda will squeeze me in, but I’ll certainly be there to join in the discussion (and make sure the AV works!). January 29th is the Black Marble Annual Tech Update. I’ll be speaking in the [morning, IT-focused session](http://www.blackmarble.co.uk/events.aspx?event=Annual TechUpdate for Microsoft Technologies for the IT Pro). It’s hard work to prep for but great fun to deliver and the feedback we get is always really great so come along if you want to be informed about the Microsoft roadmap to help your planning process. The [afternoon session covers the development technologies](http://www.blackmarble.co.uk/events.aspx?event=Annual TechUpdate for Microsoft Technologies for Developers) too! Microsoft also have a new season of Tech.Days about to kick off, so keep an eye on their web site for details. ","date":"29 September 2013","externalUrl":null,"permalink":"/posts/being-allowed-out-in-public-forthcoming-events/","section":"Blog","summary":"It’s autumn again, and that means event season is upon us once more. In the next few months I’m getting around a bit, so this post is a plug for the events I’m either attending or speaking at.\n","title":"Being allowed out in public: Forthcoming events","type":"posts"},{"content":"In the world of DevOps it’s all about the scripts: I’ve seen some great work done by some clever people to create complex environments with multiple VMs all from scratch using PowerShell. That’s great, but unfortunately in the world of Lab Manager it just doesn’t work well at all.\nWe’ve begun the pretty mammoth task of generating a new suite of VMs for our Lab Manager deployment to allow the developers and testers to create multi-machine environments. I had hoped to follow the scripting path and create these things much more on the fly, but it wasn’t to be.\nI hope to document our progress over the next few weeks. This post is all about the aims and the big issues we have that make us take the path we are following.\nNeeds and Wants # Let’s start with our requirements:\nA flexible, multi-server environment with a range of Microsoft software platforms to allow devs to work on complex projects. All servers must be part of the same domain. All products must be installed according to best practice – no running SharePoint as local service here! Multiple versions of products are needed: SharePoint 2010 and 2013; CRM 4 and 2011; SQL 2008 R2 and 2012; Biztalk 2010 and 2013. ‘Flexible’ VMs running IIS or bare server 2008 R2/2012 are needed. No multi-role servers. We learned from past mistakes: Don’t put SQL on the DC because Lab Manager Network Isolation causes trouble. Environments must only consist of the VMs that are needed. Lab Manager should present these as available VMs that can be composed into an environment: No saving complete environments until they have been composed for a project. Developers want to be able to run the same VMs locally on their own workstations for development; Lab Environments are for testing and UAT but we need consistency across them all. That’s quite a complex set of needs to meet. What we decided to build was the following suite of VMs:\nDomain Controller. Server 2012. SQL 2012 DB server. Server 2012. SharePoint 2013 (WFE+APP on one box). Server 2012. Uses SQL 2012 for DB. Office Web Apps 2013. Server 2012. Azure Workflow Server (for SharePoint 2013 workflows). Server 2012. CRM 2011 Server. Server 2012. Users SQL 2012 for DB. Biztalk 2013 Server. Server 2012. Users SQL 2012 for DB. IIS 8 server. Server 2012. ‘Flexible’ Server 2012. For when you just want a random server for something. SQL 2008 R2 server. Server 2008 R2. SharePoint 2010 (WFE+APP+OWA on one box). Server 2008 R2. Uses SQL 2008 R2 for DB. CRM 4. Server 2008 R2. Uses SQL 2008 R2 for DB. Biztalk 2010. Server 2008 R2. Uses SQL 2008 R2 for DB. IIS 7.5 server. Server 2008 R2. ‘Flexible’ Server 2008 R2. In infrastructure terms we end up with a number of important elements:\nOur AD domain and DNS domain: .local. For SharePoint 2013 Apps we need a different domain. For ease this is apps..local. To ensure we can use SSL for our web sites we need a CA. This is used to issue device certs and web certs. For simplicity a wildcard cert (*..local) is issued. Services such as SharePoint web applications all get DNS registrations. Each service gets an IP address and these addresses are bound to servers in addition to their primary IPs. All services are configured to work on our private network. If we want them to work on the public network (Lab machines, excluding the DNS, can have multiple NICs and multiple networks) then we’ll deal with that once the environment is composed and deployed through Lab Manager. Problems and constraints # The biggest problem with Lab Manager is the way Network Isolation works. Lab asks SCVMM to deploy a new environment. If network isolation is required (because you are deploying a DC and member servers more than once through many copies of the same servers) then Lab creates a new Hyper-V virtual network (named with GUID) and connects the VMs to that. It then configures static addresses on that network for the VMS. It starts with the DC and counts up.\nMy experience is that trying to be clever with servers that are sysprepped and then run scripts simply confuse the life out of Lab. You really need your VMs to be fully working and finished right out of the gate. Unfortunately, that mans building the full environment by hand, completely, and then storing them all with SCVMM before importing each VM into Lab.\nThere are still a few wrinkles that I know we have to iron out,even with this approach:\nIn the wonderful world of the SharePoint 2013 app model we need subdomains and wildcard DNS entries. We also need multiple IP addresses on the server. Right now we haven’t tested this with lab. What we are hoping is that we can build our environment on the correct address space as Lab uses. It counts up from 1, so our additional IPs will count down from 254. What we don’t know is whether Lab will remove all the IP addresses from the NICs when it configures the machines. If it does, then we will need to have some powershell that runs to configure the VMs correctly. Since we don’t have to use all the VMs we have built in any given environment, DNS registration becomes important. Servers should register themselves with the DNS running on our DC, but we need to make sure we don’t have incorrect registrations hanging around. Both of these areas will have to be addressed during this week, so I’ll post an update on how we get on.\nConsistency is still key # Even though we can’t use scripts to create our environment from bare metal, consistency is still really important. We are, therefore, using scripts to ensure that we are following a set of fixed, replicable steps for each VM build. By leaving the scripts on the VM when we finished, we also have some documentation as to what is configured. We are also trying, where possible, to ensure that if a script is re-run it won’t cause havoc by creating duplicate configurations or corrupting existing ones.\nEach of our VMs has been generated in SCVMM using templates we built for the two base operating systems. That avoids differences in OS install and allows me to get a new VM running in minutes with very little involvement. By scripting our steps, should things go badly wrong we can throw away a VM and run through those steps again. It’s getting trickier as we move forward, though; rebuilding our SQL boxes once we have SharePoint installed would be a pain.\nFrustration begets good practice # In fact, one of the most useful things that has come out of this project so far is a growing set of robust powershell modules that perform key functions for us. They are things that we have scripted already, but in the past these have been scripts we have edited and run manually as part of install procedures. Human intervention meant we created simpler scripts. This week I have been shifting some of the things those scripts do into functions. The functions are much more complex, as they carefully check for success and failure at every step. However, the end result is a separation of the function that does the work and the parameters that change from job to job. The scripts will will create for any given installation now are simpler and are paired with an appropriate module of functions.\nDeciding where to spend time # Many will read this blog and raise their hands in despair at the time we are spending to build this environment. Surely the scripted approach is better? Interestingly, our developers would disagree. They want to be able to get a new environment up and running quickly. The truth is that our Lab/SCVMM solution can push a new multi-server rig out and have it live and usable far quicker than we could do with bare metal scripts. The potential for failure using scripts if things don’t happen in exactly the right order is quite high. More importantly, if devs are sat on their hands then billable time is being wasted. Better to spend the time up front to give us an environment with a long life.\nDev isn’t production, except it is, sort of… # The crux of this is that we need to build a production-grade environment. Multiple times. With a fair degree of variation each time. If I was deploying new servers to production my AD and network infrastructure would already be there. I could script individual roles for new servers. If I was building a throwaway test or training rig where adherence to best practice wasn’t critical then I could use the shortcuts and tricks that allow scripted builds.\nDevelopment projects run into difficulties when the dev environment doesn’t match the rigor of production. We’ve had issues with products like SharePoint, where development machines have run a simple next-next-finish wizard approach to installation. Things work in that kind of installation that fail in a production best practice installation. I’m not jumping for joy over the time it’s taking to build our new rigs, but right now I think it’s the best way.\n","date":"29 September 2013","externalUrl":null,"permalink":"/posts/building-environments-for-lab-manager-why-bare-metal-scripting-fails/","section":"Blog","summary":"In the world of DevOps it’s all about the scripts: I’ve seen some great work done by some clever people to create complex environments with multiple VMs all from scratch using PowerShell. That’s great, but unfortunately in the world of Lab Manager it just doesn’t work well at all.\n","title":"Building environments for Lab Manager: Why bare metal scripting fails","type":"posts"},{"content":"","date":"29 September 2013","externalUrl":null,"permalink":"/tags/windows-server-2008-r2/","section":"Tags","summary":"","title":"Windows-Server-2008-R2","type":"tags"},{"content":"","date":"29 September 2013","externalUrl":null,"permalink":"/tags/windows-server-2012/","section":"Tags","summary":"","title":"Windows-Server-2012","type":"tags"},{"content":"Thanks to all who attended the ReBuild and TechEd revisited event today. I promised that I would post the links from the final slide to this blog so you can all start evaluating Server 2012 R2 and System Center 2012 R2.\nDownload and evaluate the Preview software\nhttp://www.microsoft.com/en-us/server-cloud/evaluate/trial-software.aspx\nRefer to additional Windows Server 2012 R2 resources\nhttp://www.microsoft.com/en-us/server-cloud/windows-server/windows-server-2012-r2.aspx\nWindows Server 2012 R2 on TechNet\nhttp://www.Microsoft.com/technet\nRefer to additional System Center 2012 R2 resources\nhttp://www.microsoft.com/en-us/server-cloud/system-center/system-center-2012-r2.aspx\nSystem Center marketplace\nhttp://systemcenter.pinpoint.microsoft.com\nServer and Cloud Blog\nhttp://blogs.technet.com/server-cloud\n","date":"25 September 2013","externalUrl":null,"permalink":"/posts/links-from-presentation-on-server-2012-r2/","section":"Blog","summary":"Thanks to all who attended the ReBuild and TechEd revisited event today. I promised that I would post the links from the final slide to this blog so you can all start evaluating Server 2012 R2 and System Center 2012 R2.\n","title":"Links from presentation on Server 2012 R2","type":"posts"},{"content":"","date":"31 August 2013","externalUrl":null,"permalink":"/categories/general/","section":"Categories","summary":"","title":"General","type":"categories"},{"content":"I’ve been mulling this blog post for a while. Those of you who know Black Marble will have seen that we all believe very strongly in encouraging young people to take up computing and put time into sharing our knowledge and expertise. I thought it was worth sharing how I got to where I am today, which would not have been possible without the help and encouragement of three key people who worked with technology. There’s a message in the story though, about how we need to help the next generation of computing professionals in the same way.\nTo an extent this post is as a result of an event that Steve, Richard and I took part in shortly after I returned from the Build conference. One of our local schools ran a STEM event and invited Black Marble to join in. If, like me, STEM means nothing to you, it stands for Science, Technology, Engineering and Maths and you can find more at the National STEM Centre website. At that event, Steve took our Gadgeteer kits and led a series of hands-on sessions that combined hardware and software to build quick but cool projects. Richard and I decided to run the Agile Hour activity with a number of groups of children across a range of ages. The end result, hopefully, was that those kids went away with a mixture of enthusiasm for the craft courtesy of Steve, and an understanding that it isn’t all sitting in front of a keyboard all day – teamwork and communication are key skills – thanks to Richard and myself and an exercise about mining cheese on the moon…\nAnyway, I’ll come back to encouraging others in a little while. Back to how I got started…\nKey influence one: My upper school form tutor # I am of that age where computing grew around me. When Sinclair launched the ZX81 I was nine. A friend of mine had one and I remember writing programs with him. As I got older I was lucky enough that my middle school had a BBC model B that I could use, and I got an Amstrad CPC 6128 which I loved and tinkered with. None of those, however, bore much resemblance to the modern PC.\nWhen I started at upper school, my form tutor was a maths teacher. He was also the computer studies teacher, and the one who rand all the school’s computer systems – staff (what there was of it) and student. In our classroom, down one side, was a line of Commodore PETs which we used in our classes. They didn’t last long though, because soon after I arrived they PETs were replaced by Research Machines Nimbus RM186s, running a hacked-around version of Windows (the 80186 CPU wasn’t fully compatible with the 8086).\nMy tutor knew how enthusiastic I was and encouraged me. Myself and Andrew started to help him with those computers. He allowed us to install software with him and explained how they worked. As those RM186 PCs were replaced with 286 and 386 and then (wow!) 486 machines he let us configure them, rebuild them and learn how they worked. We weren’t allowed to touch the Netware server that appeared in the corner, but we were allowed to store our file son it. We were even allowed, on occasion, to use the modem and connect to some of the dial-up bulletin boards that were around at the time.\nAll of this meant that by the time I left school to go to University I could build a PC from scratch, install DOS and Windows (I go all the way back to Windows 1!) and other apps and configure the system to get the most RAM and install and configure the drivers needed for networking. I could program in BASIC and write DOS batch files and I had a healthy respect both for the technology and the people that ran it. PCs weren’t things you played games on, they were tools that I used to word process, publish school magazines, draw artwork and crunch numbers.\nThe important point here is that most of my computing experience was gained outside of lessons – before school started, during breaks and lunchtimes and after school. All of that was because my form tutor was prepared to encourage me in what was effectively his own time and I am grateful for that.\nHe also had a fantastic stereo system in our classroom and got me into prog rock played loud, but that’s another story.\nKey influence number two: The University server guy # In truth, the number of people in the Computer Centre at the University of Bradford who I owe much to is too long to list – from the coms guy that introduced me to everyone, to the Director that gave me first a summer job and then my first full time job on graduation. However, the one that deserves the medal was the chap who was responsible for the Netware servers and student computer clusters.\nIt was an opportunity that would be hard to give anyone now, as networks store more sensitive information and the risk of abuse is so high that it’s hard to gain trust. In my first few weeks of University, however, there were very few desktop PCs in service and staff computing was in its infancy.\nI was incredibly fortunate that my enthusiasm allowed me to drop into the offices of the staff and talk to them about computers. We talked about what they were doing, and what I was doing. I listened to their problems and would try to solve them – on my equipment and in my time. I was invited to accompany the network guys as they strung Thin Ethernet cables and learned how all that worked, with T-pieces and terminators, network segments and bridges. I learned about the new twisted pair cables and data sockets and hubs and routers. I even learned how to install servers – Netware 3.11 at the time – and got involved in building the new infrastructure.\nMy mentor was a patient man who had little time to experiment. He would get into work early to avoid traffic and hoped to use the quiet time to catch up on work and plan and prepare. He was certainly not prepared for the enthusiastic young man who would bound into his office at 8 in the morning jabbering about how he’d managed to get Microsoft NetBeui drivers installed over the top of Novell’s driver stack and get Windows 3.11 talking both workgroup protocols and server protocols and wasn’t it just so fantastic and could show him if he could just move this kit over here and rewire this bit of the office over here…\nBut again, I was encouraged. I was most certainly tolerated and over time my enthusiasm was channelled into creating and managing services. I worked in the Computer Centre during my holidays – sometimes paid; sometimes not. It gave me incredible opportunities to learn and experience desktop computing on a large scale. It gave me an understanding of what providing a service meant, and how systems had to be resilient and supportable and documented. It also gave me a huge amount of incredibly valuable experience for when I would finally hit the job market.\nIt was such a wonderful place to be that, on graduation, I managed to get a job at the University. I left to Join Black Marble, where the experience I had learned running services of hundreds of desktop PCs and dozens of servers of varying flavours (Netware, Solaris, Linux, Windows desktop and server) has been invaluable.\nKey influence number three: Robert # Which brings me to the third big player in getting me where I am today: Robert Hogg. I’ve not named my other two mentors simply because I can’t ask their permission and I respect them too much too simply throw their names around. As MD of Black Marble, Robert’s my manager. It’s hard not to name him, and I’m sure he won’t mind.\nMost people who know Robert, and certainly those who have know him a long time, know him as Boss. I first met him when I was a student. Boss had built the first few Netware servers at the uni, and had then moved into management of the new Sun Solaris servers and workstations when they were installed, during the summer of the year I joined the university as an undergrad. The poor man I tormented every morning took over the role Boss had previously occupied, so in a way it’s all his fault.\nIt was Boss, along with the server guy, who persuaded me not to ditch my management degree at the end of the first year and switch to computing. They could teach me the computing bit, they said, but the management stuff would be really useful to my career.\nBoss is like me – he likes to play and experiment with computers. Unlike me, he’s a developer. I’d argue that he’s probably the reason I don’t try to code. He patiently explained stacks and pointers to me many years ago, and through him I learned that whilst I’m a solid infrastructure guy, and I understand development, I am not a ninja coder and will never be. Boss has always encouraged my experimentation with technology and it’s that which brings the variety that keeps me so engaged with what I do.\nYou have much to learn, grasshopper # I believe that it’s important to stress the differences in my three mentors as much as their similarities. I think that each of their qualities is important in how I was encouraged and how we now need to encourage others:\nMy maths teacher was supportive of my interest in something new. He allowed me to play, but set boundaries that gave me respect for what might happen if I broke stuff. He showed me computers as wonderful tools, not playthings and inspired me to discover what they could do. My university mentor gave me focus. He forced me to understand the implications and repercussions of my actions. He praised my innovations that helped and stopped those that would cause problems before they moved near to production systems. He taught me how different systems could and should be integrated to deliver IT as a supporting service to others. Boss constantly reminds me how computing should be fun. That we should always be experimenting and learning because that’s what makes life interesting and because that’s how we continue to develop computing for other people. Sadly, it’s hard to offer today’s young people the same kind of opportunity that I had. IT systems are now all-pervasive and store sensitive data and are critical for the functioning of our schools, universities and companies. Whilst you can still buy components and build your own computer, it’s not like the old days where we fiddled with switches and jumpers and needed to know about interrupts and memory address ranges when plugging things together.\nI think that has taken some of the magic away, and that makes it more difficult to show how interesting computing can be. That said, wonderful new technology like gesture-based computing shows how things are still cool; it’s just that things are less accessible than they used to be.\nSensei # That’s where we come in. As IT professionals and developers it is our responsibility to help those interested in our field. By taking part in STEM events at schools, attending and speaking at user groups, getting involved with the Imagine Cup or just helping our own children, nieces, nephews and friends children we can give the next generation the same encouragement that we got.\nHopefully reading about how much I was helped by my mentors will inspire you to help someone else. Go on – you know you want to!\n","date":"31 August 2013","externalUrl":null,"permalink":"/posts/i-wouldnt-be-where-i-am-today-how-encouraging-kids-in-computing-is-important/","section":"Blog","summary":"I’ve been mulling this blog post for a while. Those of you who know Black Marble will have seen that we all believe very strongly in encouraging young people to take up computing and put time into sharing our knowledge and expertise. I thought it was worth sharing how I got to where I am today, which would not have been possible without the help and encouragement of three key people who worked with technology. There’s a message in the story though, about how we need to help the next generation of computing professionals in the same way.\n","title":"I wouldn’t be where I am today… How encouraging kids in computing is important","type":"posts"},{"content":"This is one of those posts to save me searching the web every time I need to install .Net 3.5 on a Windows 8 (and now 8.1) system. If the automated installation via add/remove features fails then you need the correct DISM command.\nFor those who have not yet encountered it, DISM allows you to perform actions on Windows image files in a process called Offline Servicing. However, it also allows you to perform the same functions online – on your current windows system.\nThere is a handy TechNet post on the various ways of installing .Net 3.5 on Windows 8. It’s a useful reference.\nFor those, like me, who just want the quick steps:\nGrab your Windows 8 media – USB stick, mounted ISO or DVD. Open an Administrator-level command prompt. Type: Dism /online /enable-feature /featurename:NetFx3 /All /LimitAccess /Source:x:\\sources\\sxs Where x is the drive letter of your source media. Watch the installation progress. Job done. ","date":"31 August 2013","externalUrl":null,"permalink":"/posts/installing-net-3-5-onto-windows-8-and-8-1-using-dism/","section":"Blog","summary":"This is one of those posts to save me searching the web every time I need to install .Net 3.5 on a Windows 8 (and now 8.1) system. If the automated installation via add/remove features fails then you need the correct DISM command.\n","title":"Installing .Net 3.5 onto Windows 8 and 8.1 using DISM","type":"posts"},{"content":"yoga My wife’s desktop computer is eight years old. In fairness, it was good kit at the time, and the dual core, 64-bit AMD CPU and it’s four gigabytes of RAM are still more than enough to run her apps today. But the disks are slow and, frankly, it’s just getting tired. Time to get a new one…\nI had no real preference whether we replaced the old computer with a new traditional-style desktop and screen, or an all-in one, or a convertible or even a tablet. The only thing I was firm about was that we should get a computer with touch, whatever the form factor. It’s not that my wife loves touch (in truth, I’m not sure she does…) but that’s the way we’re all headed and I wanted to make sure we got something that would last.\nThere aren’t many places in the UK to buy a computer if you’re not sure what you want and you need to look, feel, touch and play with the various options so we trotted off to our nearest big chain PC store. We wandered up and down the aisles and my wife examined a number of laptops, desktops and more. We left to get a coffee and consider, and she decided on the IdeaPad Yoga.\nSolid pedigree # We’ve been buying Lenovo kit for the office for a while now. ThinkPads are built like tanks and keep on trucking, but they’re not the most beautiful of devices. However, I strongly believe that of all the OEMs building PCs right now, Lenovo are the only one who really grok the principles behind Windows 8 and have embraced those principles with lovely, functional design. At work the sales team use Twists, and Robert has a Helix. Lovely devices all. The Yoga is cut from the same cloth. From the packaging to the design to the materials it’s made from, the Yoga oozes quality and thoughtful design.\nThe outer casing is coated with something that makes it feel more like some kind of fabric. It’s grippy and easy to hold and carry. The inner surface around the keyboard is soft and rubbery. It’s great when holding the Yoga in tablet form but it’s also comfortable when typing. The keyboard is of the same Lenovo quality as my laptop, albeit with the now standard chiclet type of keys and the trackpad is big and accessible. It’s a very comfortable machine to use.\nPowerful enough # The model we got in the end has an Intel Core i5 CPU and four gigabytes of RAM. That’s plenty of power for what my wife needs and should still be enough a few years from now. The SSD inside ensures that storage is quick enough to make the whole thing feel snappy and responsive. It isn’t exactly overflowing with ports, and expansion isn’t much of an option but those aren’t high on the list. There is a single USB 3 port on one side, another USB 2 port on the other and an HDMI port. An SD card slot rounds off the list.\nA novel form factor # The thing that stands out when you see the Yoga is that double hinge which allows the screen to fold all the way back to transform the Yoga into a slate. I was dubious at first about the keyboard being exposed and how that would feel to hold, but I can’t say it’s bothered me. The keyboard is disabled as the screen moves past the point where the laptop is fully flat so you can’t accidentally press keys.\nThe design also allows the Yoga a neat party trick that Lenovo call ‘tent mode’ where you fold the screen back but not all the way. The result is a stable inverted V which allows the Yoga to stand freely – great for watching videos.\nA better than average screen # One of the things that attracted me to the Yoga in the store was that, unlike almost every other touch-enabled (and non-touch, for that matter) laptop, it didn’t have a 1366x768 screen. That resolution is fine on my Surface RT, and I put up with it on my work X220 tablet, but on a screen bigger than ten or twelve inches its annoying and when you work with Office or other desktop apps, as my wife does, the extra real-estate makes a difference. Her desktop had, until one of them died, two 1600x1200 21” LCD screens. The Yoga has an impressive resolution of 1600x900 so she wouldn’t lose much desktop space. It’s also a lovely, crisp display. It’s a glossy screen, so it suffers with reflection in bright sunlight as all glossy screens do, but it’s lovely to use.\nSolid battery life # Windows reckons the battery is good for around 6 hours or so. Evidence so far supports that. What more can I say?\nStrength in flexibility # The form factor is a big win. I’ve watched as my wife has folded the screen back to use the Yoga in tablet mode and read on the Windows 8 Kindle app; I’ve seen her use it tent mode to watch YouTube and BBC iPlayer videos; she uses it as a laptop all over the house. Finally, she uses it with a second monitor and separate keyboard and mouse, with her scanner and one of our printers plugged in via USB.\nAdding peripherals: The Lenovo USB 3 dock # My wife was insistent that she needed to be able to use any new computer to perform the tasks she did on the desktop. That means scanning photos and manipulating the resulting images, word processing and more. She wanted to keep the remaining 21” screen and like the idea of having a desktop keyboard and mouse for when she wanted to work at her desk. The Yoga doesn’t have enough ports to support all the peripherals she needed, and having lots of cables to connect is a pain.\nEnter, stage left, the Lenovo ThinkPad USB Dock.\ndock front dock back A single USB 3 connection to the Yoga gives five USB 3 ports for peripherals, an audio output jack, ethernet and two DVI ports. The accompanying software is needed to enable everything except the USB: DisplayLink for the DVI, USB audio and USB ethernet. I had the thing connected and working in less than five minutes and it just worked. With one cable to plug or unplug from the Yoga it transforms into a docked laptop with attached keyboard, mouse, scanner, monitor, speakers and physical ethernet for speedy transfer of data to and from our home server. It works quite happily other systems as well – it’s not limited to Lenovo PCs. Want to use your Surface Pro – no problem!\nOverall # All in all I’m very impressed with the Yoga. My wife likes it and is happy with the choice she made. I think it’s good value for the cost and well specified too. Standout features are the quality and resolution of the screen, the always-reliable Lenovo keyboard and the innovative, flexible hinged form factor.\nI can also heartily recommend the ThinkPad dock as a companion device for any USB 3-equipped laptop.\n","date":"31 August 2013","externalUrl":null,"permalink":"/posts/life-with-a-lenovo-ideapad-yoga-13/","section":"Blog","summary":"yoga My wife’s desktop computer is eight years old. In fairness, it was good kit at the time, and the dual core, 64-bit AMD CPU and it’s four gigabytes of RAM are still more than enough to run her apps today. But the disks are slow and, frankly, it’s just getting tired. Time to get a new one…\n","title":"Life with a Lenovo IdeaPad Yoga 13","type":"posts"},{"content":"","date":"31 August 2013","externalUrl":null,"permalink":"/tags/windows-8/","section":"Tags","summary":"","title":"Windows-8","type":"tags"},{"content":"","date":"13 August 2013","externalUrl":null,"permalink":"/tags/directaccess/","section":"Tags","summary":"","title":"Directaccess","type":"tags"},{"content":"I finally got time to upgrade my Surface Pro to Windows 8.1 Enterprise. One of the things I most want to test is DirectAccess, as I live and die by this on my main laptop. However, despite the computer object for my machine being in the group that the DA group policies are applied to, no DA settings appeared.\nTIP: On Windows 8.1, use Get-DAClientExperienceConfiguration in a PowerShell window to check your settings.\nIt turned out the policy wasn’t being applied because of the default Windows Server 2012 option of creating a WMI filter to only apply the Direct Access group policy to laptops. That filter had a bunch of Windows version statements in it.\nTo fix:\nOpen the Group Policy Management tool (on your DC or laptop with remote admin tools installed).\nFind the group policy object “DirectAccess Client Settings”\nAt the bottom of the policy is WMI Filtering. You will see a filter called “DirectAccess – Laptop only WMI Filter”\nClick the button to the right to open the filter. You should see something like the panel below. Click Edit Filter[\nimage Select the second entry. Click Edit.\nimage The original filter text is:\nSelect * from Win32_OperatingSystem WHERE (ProductType = 3) OR (Version LIKE '6.2%' AND (OperatingSystemSKU = 4 OR OperatingSystemSKU = 27 OR OperatingSystemSKU = 72 OR OperatingSystemSKU = 84)) OR (Version LIKE '6.1%' AND (OperatingSystemSKU = 4 OR OperatingSystemSKU = 27 OR OperatingSystemSKU = 70 OR OperatingSystemSKU = 1 OR OperatingSystemSKU = 28 OR OperatingSystemSKU = 71))\nWindows 8.1 is version 6.3.x, so you need to change the filter toread as follows (edits highlighted in red):\nSelect * from Win32_OperatingSystem WHERE (ProductType = 3) OR ((Version LIKE '6.2%' OR Version LIKE '6.3%') AND (OperatingSystemSKU = 4 OR OperatingSystemSKU = 27 OR OperatingSystemSKU = 72 OR OperatingSystemSKU = 84)) OR (Version LIKE '6.1%' AND (OperatingSystemSKU = 4 OR OperatingSystemSKU = 27 OR OperatingSystemSKU = 70 OR OperatingSystemSKU = 1 OR OperatingSystemSKU = 28 OR OperatingSystemSKU = 71))\nGive AD a few minutes to catch up then run gpupdate /force in a command prompt on your laptop. If you run the powershell again, you should see a full complement of DA settings. The network panel takes a few minutes to catch up, but you should soon see your DirectAccess connection listed.\n","date":"13 August 2013","externalUrl":null,"permalink":"/posts/editing-windows-server-2012-group-policies-for-direct-access-with-windows-8-1-enterprise-preview/","section":"Blog","summary":"I finally got time to upgrade my Surface Pro to Windows 8.1 Enterprise. One of the things I most want to test is DirectAccess, as I live and die by this on my main laptop. However, despite the computer object for my machine being in the group that the DA group policies are applied to, no DA settings appeared.\n","title":"Editing Windows Server 2012 Group Policies for Direct Access with Windows 8.1 Enterprise Preview","type":"posts"},{"content":"Windows 8.1 Enterprise preview was released a week or two ago. Being on holiday prevented me trying it out until I returned to the office. Everyone has different methods for installing Windows 8/8.1 on a Surface Pro. It’s actually pretty simple. Windows 8 can be done in the same way as I list here. However, you will need to download the Surface Pro Driver pack from Microsoft – Windows 8 doesn’t automatically find all the hardware; Windows 8.1 does.\nThe first thing you need is a set of USB installation media that the Surface can read. Sadly, the Windows 7 ISO utility form Microsoft doesn’t create UEFI-bootable media. Enter stage left Rufus – a magnificent tool!\nGrab your downloaded ISO file, find a nice fast USB3 drive that’s at least 4Gb in size and start the tool. Use the settings as in the screenshot, below. Select your ISO and hit go.\nimage Once you’ve got your media you need to boot your Surface Pro from it. There are different notes on the internet about this. Some tell you to boot the machine whilst holding down the volume up button to enter the BIOS and change the secure boot options.\nYou don’t need to do this.\nInstead, with your Pro switched off, plug in your USB drive. Hold down the volume down button and press the power button. keep the volume down button held down until you see the Surface start to boot from your USB setup volume. That’s all there is to it.\nOnce your Surface Pro has started setup you should be on familiar ground. Choose to do a full install, not an upgrade. However, when setup shows you a long list of partitions and asks where to install Windows, pause.\nYou can scrub the drive and install clean. If you do that, you lose all the nice original install of Windows 8 that you can fall back to when you stuff your machine. If you just install to the OS partition, you can use Windows’ really nice refresh my PC function to restore the original factory image.\nIf you want to install clean, go ahead. If, like me, you want to be more gentle, select Drive 0 partition 4. On my Surface Pro it was around 110.2Gb. Select the option to format the partition and then choose that for your installation.\nAfter that, setup will chug for a few minutes, your Surface Pro will reboot and presto! A new Windows 8.1 install.\nIt too a reboot or two for all the devices to populate on my Pro, but at no point did I need to hunt down drivers. It all just works! Lovely.\nNext stop, domain join to my domain and then bitlocker the hard drive and check out DirectAccess!\n","date":"13 August 2013","externalUrl":null,"permalink":"/posts/installing-windows-8-1-enterprise-on-surface-pro/","section":"Blog","summary":"Windows 8.1 Enterprise preview was released a week or two ago. Being on holiday prevented me trying it out until I returned to the office. Everyone has different methods for installing Windows 8/8.1 on a Surface Pro. It’s actually pretty simple. Windows 8 can be done in the same way as I list here. However, you will need to download the Surface Pro Driver pack from Microsoft – Windows 8 doesn’t automatically find all the hardware; Windows 8.1 does.\n","title":"Installing Windows 8.1 Enterprise on Surface Pro","type":"posts"},{"content":"","date":"8 July 2013","externalUrl":null,"permalink":"/tags/acer-iconia-w3/","section":"Tags","summary":"","title":"Acer-Iconia-W3","type":"tags"},{"content":"As you may have seen from my recent tweets, I was fortunate enough to attend //Build again this year in lovely San Francisco. In what appears to be an emerging tradition, conference attendees received not one, but two Windows 8 tablets: A 128Gb Microsoft Surface Pro with Type Cover, and an Acer Iconia W3 with keyboard dock.\nMany column inches have been dedicated to the Microsoft device, which I won’t bother repeating. The Acer, however, is a different story.\nI will run through my thoughts in detail. For those in a hurry I will say this: I would never pay for money for the Acer. I agree with Paul Thurrott’s sentiment when he said “The W3 is disappointing enough that I’m probably not going to review it.”\nSize and Weight # WP_20130708_006 WP_20130708_007 It was the size of the Acer that initially got me excited when Steve Ballmer announced that we’d receive the tablet. My Surface RT has been a regular fixture in my rucksack since I got it, but it’s bit big when all I want to do is browse the web or review some documents in a cramped railway carriage or aeroplane. We acquired an iPad Mini for testing work in the office and I was hoping for something similar, but running Windows.\nIn this regard, I have to say the Acer delivers. It’s about the same size as one of my trusty Moleskine notebooks. It’s definitely portable. Technically, it fits in a cargo pocket of my jeans, but I’d never be mad enough to walk around like that! It’s too big for the inside pocket of my jacket, though.\nIt’s a bit thick for my liking, compared to the iPad. It’s no thinner than my Surface RT. It’s not that much lighter, either, which I’m less enthused about, but not so heavy that I’d worry about carrying it around.\nOverall: Positive\nPower Connection # Failure number one: What idiot at Acer decided that this tablet should have a separate charging brick rather than use USB? It’s a small tablet. I’m travelling light and I want to use the tiny charger from my phone, or plug in to my laptop to charge. I don’t want to carry another charging brick around. Points in Acer’s favour for making it a very small brick – no bigger than the Surface RT charger – but many points lost for it being there at all.\nOverall: Negative\nBuild Quality # It’s cheap and plasticky. No VaporMg or machined aluminium here. Honestly, I could live with that. What I can’t live with is the way the screen bubbles around my fingers when I hold the tablet in my hand (and I’m not squeezing hard, either).\nOverall: Negative\nCamera # Front and back shooters are very poor quality two megapixel shooters. Why bother?\nOverall: Negative\nWifi # Wireless is incredibly frustrating. I can understand that Acer were aiming at a price point with the W3 but seriously, 2.4Ghz only – no 5Ghz? more importantly the antenna appears to be shockingly awful. I struggle at home where my old iPhone 3G works fine, my trusty Dell Mini 9 works fine and all my new kit (Surface, Surface RT, Thinkpad X220T etc) work just fine. For most of //Build the Acer failed to access the internet whilst at the conference and struggled in my hotel room.\nOverall: Negative\nScreen # I could forgive just about everything if the W3 had a good screen. On a small device it is imperative that the display is clear and crisp. Oh dear.\nWP_20130708_004 The resolution is 1280x800. That makes the pixels quite small. It would be OK if the screen was clear but it has a coating that scatters the light coming from the screen, giving a mottled appearance. The photo above looks like it’s poor quality – that mottling is the screen, not the camera! It’s pretty much unreadable for any period of time, and it’s not possible to increase the scaling of the screen other than in desktop mode. I was looking forward to using this with Kindle to read books and documentation. Ah well…\nOverall: Shockingly negative\nSpec # The W3 is an Intel SOC device so it has an Atom CPU with 2Gb of RAM and a 5-point touch screen. I like that it can run 32-bit Windows desktop apps. I would like it better if I felt it was as quick as the Surface RT. In fairness, it’s quick enough for what I’d use it for. The fact that I can put Windows 8 Enterprise on it and domain join it if I so desire is a big plus. Note that it has no TPM chip, however, so I can’t bitlocker it.\nOverall: Positive\nPorts # Actually, for a small device there’s a good selection of ports on this thing: Micro-USB (which I thought was for charging until I found the charger), micro-hdmi, headphone jack and a micro-SD card slot.\nHowever (you didn’t think this would end well, did you?) the headphone socket is on the bottom of the tablet, if you are in portrait mode. That’s a pain if you want to watch video or, like me, be foolish enough to want to read an eBook whilst listening to music and rest the tablet on my leg, or somewhere comfortable.\nNot only that, but the speakers are on that edge too. If I’m holding the tablet comfortably, I am invariably blocking the speakers. They’re not great anyway, but I’d like to hear something!\nKeyboard Dock # I took the keyboard out of the dock. I tried the keys – they’re not bad. I look at the battery compartment (AAA batteries, if I recall correctly. I stopped caring after I noted it needed batteries and wasn’t rechargable), noted the lack of physical connectors to secure the tablet in place or charge it, noted the strange compartment at the back into which the tablet clips and then put the keyboard back in the box.\nIn fairness, you don’t buy an eight inch tablet for it’s keyboard. I’m sure there are elegant solutions to the small tablet keyboard question. This isn’t it.\nOverall: Negative\nSummary # If we were looking for an anti-pattern for tablet design, this would be it. If this is the vanguard of the Windows 8.1 small tablet charge then I hope the next wave are better. There’s nothing here that would make me choose it over an iPad Mini or a Nexus 7.\nIt’s a crying shame that a device handed out to showcase the new small-device experience with Windows 8.1 should be so awful as to potentially discourage me from ever using a small device with Windows 8.1! The new OS has some great features. The Acer W3 should be allowed to die quietly where it can do no harm.\nHopefully Lenovo will deliver a decent eight inch tablet soon. Or Microsoft will launch a Surface Mini… Please…?\nOverall: Avoid. I couldn’t honestly recommend this to anybody. Ever.\n","date":"8 July 2013","externalUrl":null,"permalink":"/posts/the-acer-iconia-w3-an-object-lesson-in-how-not-to-design-a-tablet/","section":"Blog","summary":"As you may have seen from my recent tweets, I was fortunate enough to attend //Build again this year in lovely San Francisco. In what appears to be an emerging tradition, conference attendees received not one, but two Windows 8 tablets: A 128Gb Microsoft Surface Pro with Type Cover, and an Acer Iconia W3 with keyboard dock.\n","title":"The Acer Iconia W3: An object lesson in how NOT to design a tablet","type":"posts"},{"content":"Right now I am putting the finishing touches to my deck for an event Black Marble are running at Cardinal Place next week. As many of you will know, for the past ten years we have run the annual Tech Update covering moves and changes across the entire Microsoft spectrum of products. Until now that has only taken place in Leeds but for the first time we are taking that show on the road.\nOn Monday 20th May Robert and I will present our Tech Update for Public Sector. Everything you need to know about the Microsoft family for executive planning, as current as we can be. I always enjoy presenting at Cardinal Place and I’m looking forward to it.\nAs luck would have it, the following day is the Microsoft Management Summit recap, also at Cardinal Place. I’m attending rather than presenting for a change, so if you’re on the cloud track say hi!\n","date":"14 May 2013","externalUrl":null,"permalink":"/posts/tech-update-for-public-sector/","section":"Blog","summary":"Right now I am putting the finishing touches to my deck for an event Black Marble are running at Cardinal Place next week. As many of you will know, for the past ten years we have run the annual Tech Update covering moves and changes across the entire Microsoft spectrum of products. Until now that has only taken place in Leeds but for the first time we are taking that show on the road.\n","title":"Tech Update for Public Sector","type":"posts"},{"content":"On Wednesday 15th May 2013, Black Marble travels north, as Steve Spencer and I will both present sessions for the great guys at NEBytes.\nWhilst Steve covers fun hardware and software dev using Gadgeteer, I will be talking about our experiences with TFS 2012 Lab and SCVMM 2012.\nIf you have seen some of my earlier posts, our migration to the latest and greatest was interesting, to say the least. I learned a great deal about how SCVMM and Lab talk to each other and I will be running through how we built our environment and the things we learned that could save you pain as you follow in our footsteps.\nI always enjoy speaking at NEBytes and I’m looking forward to seeing everyone next week!\n","date":"8 May 2013","externalUrl":null,"permalink":"/posts/speaking-at-nebytes-about-tfs-2012-lab-and-scvmm-2012/","section":"Blog","summary":"On Wednesday 15th May 2013, Black Marble travels north, as Steve Spencer and I will both present sessions for the great guys at NEBytes.\nWhilst Steve covers fun hardware and software dev using Gadgeteer, I will be talking about our experiences with TFS 2012 Lab and SCVMM 2012.\n","title":"Speaking at NEBytes about TFS 2012 Lab and SCVMM 2012","type":"posts"},{"content":"I’ve just had a really infuriating half an hour trying to figure out why I couldn’t get the keypad to appear during a call on my Lumia 920. When I took my phone away form my ear the screen stayed black. Pushing the power button made the display switch on and then immediately switch off. Power cycling and even resetting made no difference.\nA close examination showed that the small round circle next to the speaker slot at the top of the phone display was full of dust. Exactly how this happened I am not sure – you’d expect that bit to be sealed, wouldn’t you.\nFive minutes with a compress air cannisted blowing into the speaker slot and headphone jack socket later I had managed to blow the gunk out of the proximity sensor an as if by magic, the keypad works like it should again.\n","date":"5 March 2013","externalUrl":null,"permalink":"/posts/fixing-a-dodgy-proximity-sensor-on-my-nokia-lumia-920/","section":"Blog","summary":"I’ve just had a really infuriating half an hour trying to figure out why I couldn’t get the keypad to appear during a call on my Lumia 920. When I took my phone away form my ear the screen stayed black. Pushing the power button made the display switch on and then immediately switch off. Power cycling and even resetting made no difference.\n","title":"Fixing a dodgy proximity sensor on my Nokia Lumia 920","type":"posts"},{"content":"As you’ve probably seen, our Lab Manager/SCVMM 2008 R2 upgrade to SCVMM 2012 SP1 was not the smoothest in the world. The end result was a clean lab manager and SCVMM install, but a raft of virtual machines that had previously been part of environments.\nIn tidying up, Richard and I learned a few things about picking apart VMs that were once part of an environment such that a new environment could be built form the wreckage.\nThere are two approaches to getting what you need: Firstly, you could simply compose the existing virtual machines into a new environment without storing in, and deploying from SCVMM. Secondly, you could pull the VMs back into SCVMM such that you could build a new environment.\nDon’t forget to fix the networks # If you want to use the running VMs you will need to make sure that you have recreated any private network generated by Lab Manager. These are all helpfully listed in the XML configuration file of the VMs. They are normally named Lab__NI so are easy to find in the file. On the hyper-v host, using hyper-v manager you will need to create a new private virtual network with the name you just found. You should then attach the synthetic network adapter of your VMs (not the legacy network adapter) to this private network. If you have a DC, and you told Lab Manager it was a DC, then you are likely to need to hook its legacy adapter to the private network as well.\nScenario 1: Pull existing machines into an environment # The big problem you are likely to find here is that whilst you have imported the VMs onto your hyper-v server and SCVMM can see the machines just fine, Lab Manager refuses to show them to you.\nThe reason for this is that Lab Manager believes the VMs are currently part of an environment, just not one it currently has. It therefore hides the VMs from you. It turns out that this is pretty straightforward to fix. In the notes field of the running VM settings you will see a block of XML. That is read by Lab Manager to identify the VMs in environments. Simply delete that xml and the machine will now show up in Lab Manager as being available to compose into an enviroment.\nScenario 2: Get the VMs back into SCVMM to build a new environment and deploy it. # This is a trickier situation and one which needs to follow the steps I talked about in my previous post about building VMs for Lab Manager.\nThe problem here is not just the XML, but that Lab Manager has probably mangled the hardware settings of the VM as well. You will need to tidy each VM before storing it in SCVMM ready for Lab Manager:\nRemove the XML from the notes field. Remove the legacy network adapter. Configure the network adapter within windows to use an IP address and DNS handed to it from DHCP. Delete any snapshots. Make sure you cleanly shut down the VM – don’t save it! If you follow those steps you can store the VMs back into SCVMM then build a new environment from the stored VMs. If this still gives you trouble then you should export the VMs from hyper-v, reimport them as a copy to get a new unique ID and then push those into SCVMM.\nSo far this has worked just fine for us with Richard working his magic in Lab Manager whilst I fix up VMs in hyper-v and SCVMM.\n","date":"5 March 2013","externalUrl":null,"permalink":"/posts/fixing-lab-manager-environments-with-brute-force/","section":"Blog","summary":"As you’ve probably seen, our Lab Manager/SCVMM 2008 R2 upgrade to SCVMM 2012 SP1 was not the smoothest in the world. The end result was a clean lab manager and SCVMM install, but a raft of virtual machines that had previously been part of environments.\n","title":"Fixing Lab Manager environments with brute force","type":"posts"},{"content":"","date":"5 March 2013","externalUrl":null,"permalink":"/tags/nokia-lumia/","section":"Tags","summary":"","title":"Nokia-Lumia","type":"tags"},{"content":"As you will have read on both mine and Richard’s blogs, we have recently upgraded our Lab environment and it wasn’t the smoothest of processes.\nHowever, as always it has been a learning experience and this post is all about building VM environments that can be sucked into Lab and turned into a Lab environment that can be pushed out multiple times.\nNote: This article is all about virtual machines running on Windows Server 2012 that may have been built on Windows 8 and are managed by SCVMM 2012 SP1 and Lab Manager/TFS 2012 CU1. Whilst the things I have found in terms of prepping VMs for Lab Manager are likely to be common to older versions, your mileage may vary.\nApproaches to building environments # There are a number of approaches to building multi-machine environments that developers can effectively self-serve as required:\nThe ALM Rangers have a VM Factory project on Codeplex which aims to deliver scripted build-from-scratch on demand. SCVMM has templates for machines that are part-built and stored after running sysprep. Orchestrator can then be used to deploy templates and run scripts to wire them together. Lab Manager allows you to take running VMs and group them together into an environment. It stores all the VMs in SCVMM and when requested, generates new VMs by copying the ones from the library. Trouble at ‘mill # There are also a number of problems in this space that must balance the needs of IT pros with the needs of developers:\nDevelopers are an impatient bunch. They will request the environment at the last minute and need it deployed as quickly as possible. This doesn’t necessarily work well with complete bare-metal scripted approaches. Developers would also prefer some consistency – if they have to remember one set of credentials it’s probably too much. Use different accounts and passwords and machine names for all your environments and it can get trick. Developers love to use the Lab Manager and Test Manager tooling. This delivers great integration with the Team Project in Team Foundation Server. IT Pros need to deal with issues caused by multiple machines with the same identities sharing a network. This is especially true of domain controllers. IT pros would like to keep the number of snapshots (SCVMM checkpoints) to a minimum, especially when memory images are in play as well. IT pros would prefer the environments used by the developers to match the way things are installed in the real world. This is less critical for the actual development environment but really important when it comes to testing. This tends to lead to requirements for additional DNS entries and multiple user accounts. This is especially true if you are building SharePoint farms properly. How IT pros would do it… # Let’s use one of our environments as an example. We have a four server set:\nThe Domain Controller is acting as DNS and also runs SQL Server. It doesn’t have to do the latter, but we were trying to avoid an additional machine. Reporting services and analysis services are installed and reporting services is listening on a host header with a DNS CNAME entry for it. An IIS server allows for deployment of custom web apps. A CRM 2011 server is using the SQL instance on the DC for its database and reporting services functions. The CRM system itself is published on another host header. A SharePoint 2010 server is using the SQL instance as well. It has separate web applications for intranet and mysites and each is published on a separate host header. If we were building this without lab manager then we would give the machines two NICs. One would be on our network and the other on a private network. On the DC we unbind the nasty windows protocols from our network. Remote desktop is enabled on all machines for the devs to access it.\nLab Manager complicates matters however. It is clever enough to understand that we might need to keep DC traffic away from our network and has a mechanism to deliver this, called Network Isolation. How it actually goes about that is somewhat problematic, however.\nBasically, Lab Manager wants to control all the networking in the new environment. To do that it adds new network adapters to the VMs and it uses those new adapters to connect to the main network. It expects a single adapter to be in the original VM, which it connects to a new private network that it creates.\nDid I mention that IT pros hate GUIDs? Lab Manager loves them. Whilst I can appreciate that it’s the best way to generate unique names for networks and VMs it’s a complete pain to manage.\nAnyway, it’s really, really easy to confuse Lab Manager. Sadly, if the IT pro builds what they consider to be a sensible rig, that will confuse Lab Manager right away. The answer is that we need to build our environment the right way and then trim it in readiness for the Lab Manager bit.\nBuilding carefully # I would build my environment on my Windows 8 box. I create a private network and use that as a backbone for the environment. I assign fixed IP addresses to each server on that network. Each server uses the DC as its DNS. That way I can ensure everything works during build. I also add a second NIC to each box that is connected to my main network. I carefully set the protocols that are bound to that NIC. Both of those network adapters are what lab manager calls ‘synthetic’ – they are the native virtualised adapter hyper-v uses, not the emulated legacy adapter.\nI carefully make sure that all host header-required DNS entries are created as CNAMEs that point to the host record for the server I need. This is important because all the IP addresses will change when Lab Manager takes over.\nI may make snapshots as I build so I can move back in time if something goes wrong.\nWhen built, I will probably store my working rig so I can come back to it later. I will then change the rig, effectively breaking it, in order to work with Lab Manager.\nThe Lab Manager readiness checklist # Lab Manager will fail if there is more than a single network adapter. It must be a synthetic adapter, not a legacy one. The adapter should be set to use DHCP for all its configuration – address and DNS. Install, but do not configure the Visual Studio Test Agent before you shut the machines down. We’ve seen Lab fail to install this many times, but if it’s already there it normally configures it just fine. Delete all the snapshots for the virtual machine. Whilst Lab Manager can cope with snapshots, both it and SCVMM get confused when machines are imported with different configurations in the snapshots from the final configuration. It will stop Lab Manager in its tracks. Make sure there is nothing in the notes field of the VM settings. Both Lab Manager and SCVMM shove crap in there to track the VM. If anybody from either team is listening, this is really annoying and gets in the way of putting notes about the rigs in there. Lab Manager shoves XML in there to describe the environment. Make sure there are no saved states. Your machines need to be shut down properly when you finish, before importing into SCVMM. The machines need to boot clean or they will get very confused and Lab Manager may struggle to make the hardware changes. Make sure you export the machines – don’t just copy the folder structure, even though its much easier to do. Next, get it into SCVMM # There is a good reason to export the VMs. It turns out that SCVMM latches on to the unique identifier of the VM (logical, if you think about it). The snag with this is that you can end up with VMs ‘hiding’. If I copy my set of four VMs to an SCVMM library share I can’t have a copy running as well. Unless you do everything through SCVMM (and for many, many reasons I’m just not going to!) you can end up with confusion. This gets really irritating when you have multiple library shares because if you have copies of a VM in more than one library, one will not appear in the lists in SCVMM. There are good reasons why I might want to store those multiple copies.\nBack to the plot. SCVMM won’t let us import a VM. We can construct a new one from a VHD but I have yet to find a way to import a VM (why on earth not? If I’ve missed something please tell me!). So, we need to import our VMs onto a server managed by SCVMM. We have a small box for just this purpose – it’s not managed by Lab Manager but is managed by our SCVMM so I can pull machines from it into the library.\nImport the VMs onto your host using Hyper-V manager. Make sure you create sensible folder structures and names for them all. Once they are imported make sure you close hyper-v manager. I have seen SCVMM fail to delete VM folders correctly because hyper-v manager seems to have the VHD open for some reason.\nIn SCVMM, refresh the host you’ve just imported the VMs to. You should see them in the VM list. I tend to refresh the VMs too, but that’s just me. Start the VMs and let SCVMM get all the information from them like host name etc. I usually leave them for a few minutes, then shut them down cleanly from the SCVMM console.\nNow we know SCVMM is happy with them, we can store the VMs in the SCVMM library that Lab Manager uses. You should see them wink out existence on the VM host once the store is complete.\nCreate the Lab environment # At this point the IT guys can hand over to the people managing labs. In our case that’s Richard. He can now compose a new environment within Lab Manager and pull the VMs I have just stored into his lab. He tells the lab that it needs to run with network isolation and identifies the DC.\nWhat Lab Manager will then do is deploy a new VM through SCVMM using the ones I built as a source. It will then modify the hardware configuration of the VMs, adding a legacy network adapter. It also configures the MAC address of the existing synthetic adapter to be static.\nA new private virtual network is created on the target VM host. It’s really hard to manage these through SCVMM so if Lab ever leaves them hanging around I delete them using hyper-v manager. The synthetic adapters in the VMs are connected to the private network while the legacy adapters are connected to the main network.\nExactly why they do it this way I’m not sure. Other than needing legacy adapters for PXE boot (which this isn’t doing) I can’t see why we’re using legacy adapters. I am assuming the visual studio team selected them for a good reason, probably around issuing commands to the VMs, but I don’t know why.\nWhen the environment is started, Lab will assign static IP addresses to the NICs attached to the private network. All ours seem to be 192.168.23.x addresses. It will also set the DNS address to be that which has been assigned to the DC in the lab. The legacy adapters will be set to DHCP for all settings. The end result is a DC that is only connected to the private network and all other machines connected to both private and main networks.\nOnce the environment is up, Lab Manager should configure the test agent and you’re off. The new lab environment can then be stored in such a way as to allow multiple copies to be deployed as required by the devs.\n","date":"5 March 2013","externalUrl":null,"permalink":"/posts/things-to-remember-when-building-virtual-machines-for-a-lab-manager-environment/","section":"Blog","summary":"As you will have read on both mine and Richard’s blogs, we have recently upgraded our Lab environment and it wasn’t the smoothest of processes.\nHowever, as always it has been a learning experience and this post is all about building VM environments that can be sucked into Lab and turned into a Lab environment that can be pushed out multiple times.\n","title":"Things to remember when building virtual machines for a lab manager environment","type":"posts"},{"content":"","date":"5 March 2013","externalUrl":null,"permalink":"/tags/windows-phone/","section":"Tags","summary":"","title":"Windows-Phone","type":"tags"},{"content":"Richard has posted a group effort article on his blog about our System Center 2008 R2/Lab Manager upgrade to System Center 2012 SP1/Lab Manager. All did not go swimmingly…\nI have more helpful notes that I am writing up myself and will post over the next few days around the steps to fix virtual machines that are part of an environment and tips on building complex multi-machine rigs for lab manager.\n","date":"4 March 2013","externalUrl":null,"permalink":"/posts/notes-from-the-field-on-our-scvmmlab-manager-environment-upgrade/","section":"Blog","summary":"Richard has posted a group effort article on his blog about our System Center 2008 R2/Lab Manager upgrade to System Center 2012 SP1/Lab Manager. All did not go swimmingly…\nI have more helpful notes that I am writing up myself and will post over the next few days around the steps to fix virtual machines that are part of an environment and tips on building complex multi-machine rigs for lab manager.\n","title":"Notes from the field on our SCVMM/Lab Manager environment upgrade","type":"posts"},{"content":"","date":"5 February 2013","externalUrl":null,"permalink":"/tags/imagine-cup/","section":"Tags","summary":"","title":"Imagine-Cup","type":"tags"},{"content":"We had a great time at the Imagine Cup North East Hackathon this weekend. Black Marble turned out in force with myself, Steve, Richard, Robert, Linda, Josh and Riccardo all helping out. Andy Westgarth and the guys at Sunderland Software City had done a solid job on the organisation and we were well looked after.\nThere were nine teams there in total, from a wide range of Universities and Colleges in the Newcastle/Sunderland area. I was impressed by their ideas and their tenacity in defending those ideas against a barrage of questions from myself and others. I was also taken by the range of ages we had. Some of the teams were A-level and college students, whilst others were in various years of their university degree courses. Even if they don’t make it through to the national finals this year, the younger teams will gain great experience and can enter again next year and beyond.\nLinda has uploaded photos that myself and Josh took during the hackathon to the Black Marble Facebook page and you can find tweets with the #ICNE hashtag.\nI’d like to give a big thanks to Finlay Mann for his help over the weekend. Unfortunately, the speaker lined up to run the User Experience workshop was unwell, so I stepped into the breach with Finlay. With no preparation and no slides we managed to cover the subject well, with lots of examples from our own experience.\nThanks are also due to Dan, Liam and Colin from last years winning North East teams who, along with Riccardo and Josh did sterling work answering questions and helping teams with technical issues all through the night when us oldies had gone to get some sleep!\nGary Short delivered a great session on presentation skills, which is an area where I still feel universities badly let down their students. We were also grateful for mentors from Sage and Ubisoft who gave their time, ran workshops and spoke to teams over the weekend.\nHopefully we will make it back up north for the NEBytes session in March where the teams are invited to attend and practice their presentations for the regional final. All the teams that took part in that last year said how useful it was to receive comments, constructive criticism and questions from the user group attendees.\nOverall it was a thoroughly enjoyable day and I’d like to give a hearty congratulations to the attending teams, whose ideas I watched develop and grown over the course of the event and who presented those ideas well to the group at the end of a very tiring hackathon. Well done all!\n","date":"5 February 2013","externalUrl":null,"permalink":"/posts/notes-from-the-north-east-imagine-cup-hackathon-2012/","section":"Blog","summary":"We had a great time at the Imagine Cup North East Hackathon this weekend. Black Marble turned out in force with myself, Steve, Richard, Robert, Linda, Josh and Riccardo all helping out. Andy Westgarth and the guys at Sunderland Software City had done a solid job on the organisation and we were well looked after.\n","title":"Notes from the North East: Imagine Cup Hackathon 2012","type":"posts"},{"content":"It’s a busy week this week and I’m really looking forward to being involved with the Imagine Cup Hackathon for the North East Region this Friday and Saturday (1st and 2nd February).\nBlack Marble have a long history of supporting the UK Imagine Cup teams and it’s great to be able to continue that support. We’ll be in The Life Science Centre, Newcastle upon Tyne in force this week. Steve Spencer, Richard Fennell, Robert Hogg and myself will be accompanied by Riccardo Viglianisi and Josh Whittle from Black Marble.\nWe’ll be proving help and support to teams from the North East alongside Andy Westgarth, MVP and founder of NEBytes, who has worked hard alongside Sunderland Software City and Steve Spencer to promote the Imagine Cup across north eastern schools, universities and colleges. We’ll also be joined by Black Marble event regular Gary Short and members of last year’s North Eastern Region winning teams.\nThat makes a total of five Microsoft MVP’s, hopefully five members of last years winning teams and other enthusiastic supporters (that would be me!). If you are already involved in the Imagine Cup in the North East we’ll see you there. If not, head over to the Imagine Cup site, or see if your university, college or school is already involved for more information on how to take part. You can register to attend the hackathon on its eventbrite page.\n","date":"27 January 2013","externalUrl":null,"permalink":"/posts/looking-forward-to-the-imagine-cup-hackathon/","section":"Blog","summary":"It’s a busy week this week and I’m really looking forward to being involved with the Imagine Cup Hackathon for the North East Region this Friday and Saturday (1st and 2nd February).\n","title":"Looking forward to the Imagine Cup Hackathon","type":"posts"},{"content":"Our good friends in the UK TechDays team have announced another raft of events in their fantastic IT Camps series. I’m hoping to be there for at least on of them and if you’re at all interested in Windows 8 or System Center 2012 I cant recommend them highly enough.\nNo slides, no marketing – just technical content, demo driven with as much audience participation as they can manage. Everyone I’ve spoken to at previous camps has enjoyed them and learned a great deal.\nI’ll be helping with the server camp in York on the 5th of March and you might see me at other camps too.\nEnough of the gushing plug, here are the dates and venues, with links so you can register:\nDate Event Location 12th February 2013 Windows 8 Glasgow 13th February 2013 Windows Server 2012 - Virtualising Servers Glasgow 14th February 2013 Windows 8 Camp Glasgow 19th February 2013 System Center 2012 Manchester 21st February 2013 System Center 2012 Birmingham 5th March 2013 Windows Server 2012 – Virtualising Servers York 6th March 2013 System Center 2012 York 17th April 2013 Windows 8 Southampton If you want to know more about forthcoming Techdays keep an eye on the main events page.\n","date":"27 January 2013","externalUrl":null,"permalink":"/posts/more-uk-techdays-on-system-center-2012-and-windows-8/","section":"Blog","summary":"Our good friends in the UK TechDays team have announced another raft of events in their fantastic IT Camps series. I’m hoping to be there for at least on of them and if you’re at all interested in Windows 8 or System Center 2012 I cant recommend them highly enough.\n","title":"More UK TechDays on System Center 2012 and Windows 8","type":"posts"},{"content":"It’s the start of a new year and my engagement diary is filling rapidly. Once again I am covering a wide range of topics for an equally broad audience which is something I really enjoy.\nJanuary 15th will find me in Manchester at a Microsoft event for Fire Services. I’m giving an overview of Windows Azure PaaS and IaaS services and how they might be used to complement as well as replace existing IT systems. January 30th is the annual Black Marble Tech Update. For our tenth year we have changed the format slightly. The morning will be focused on IT and the afternoon on Development. IT Managers attending the morning session will hear myself, Andy Dawson and Andy Davidson run through the recent releases and upcoming changes to Microsoft product and service offerings in order to help with strategic planning for the coming year. The afternoon session will be similar, but for Development Managers.\nFind out more on the Black Marble web site. March 5th is the next UK Techdays IT Camp that I will be helping out at. This one is in York and will cover Windows Server 2012 and Hyper-V.\nFind out more on the UK Techdays events page. March 6th takes me to London where Robert Hogg and I will deliver a Tech Update for the Public Sector at Cardinal Place. Also this year Black Marble are pleased to be involved with the Microsoft Imagine Cup once more. Teaming up with Andy Westgarth and our friends in Sunderland, we are running an Imagine Cup Hackathon on Friday 1st and Saturday 2nd February, where a number of us will be on hand to give teams from the region help and advice on development and technical matters, but also presentation techniques, business plan and other areas important to success.\nFind out more on the Imagine Cup site.\n","date":"14 January 2013","externalUrl":null,"permalink":"/posts/upcoming-presentations/","section":"Blog","summary":"It’s the start of a new year and my engagement diary is filling rapidly. Once again I am covering a wide range of topics for an equally broad audience which is something I really enjoy.\n","title":"Upcoming presentations","type":"posts"},{"content":"This is a relatively quick post, largely because I was not able to record the details of the error messages we saw in the farm before we fixed them.\nOn a recent engagement we were investigating problems with a SharePoint 2013 farm that had been installed for our customer by a third party. There were a number of issues that we worked through but I wanted to record this one for the community.\nThe user profile service in the farm was not responding. Attempts to manage the service resulted in an error page. In addition, the user profile synchronisation service was stuck in the starting state. Documentation suggested that both had been configured during installation and checked to be working.\nWe ran through a number of checks to no avail. Then I started looking at how the farm topology was configured.\nThe distributed cache service had been stopped on the two web front end servers and the two app tier servers in the farm. Two additional SharePoint servers were in the farm, but had no services at all on them, other than the distributed cache. As an experiment we started the cache service on the other servers and the user profile service sprang into life. The synchronisation service also started without error.\nI haven’t had chance to attempt to recreate this issue and check whether there was a server-to-server communication issue or whether the distributed cache service actually needs to be running on the servers that host the user profile service and user profile synchronisation service, but if you have strange service issues with 2013, check your cache topology!\n","date":"14 January 2013","externalUrl":null,"permalink":"/posts/user-profile-service-failures-caused-by-distributed-cache-on-sharepoint-2013/","section":"Blog","summary":"This is a relatively quick post, largely because I was not able to record the details of the error messages we saw in the farm before we fixed them.\nOn a recent engagement we were investigating problems with a SharePoint 2013 farm that had been installed for our customer by a third party. There were a number of issues that we worked through but I wanted to record this one for the community.\n","title":"User profile service failures caused by Distributed Cache on SharePoint 2013","type":"posts"},{"content":"I seem to have been doing a lot of presenting lately, and the next few weeks are similarly busy. As a one-stop shop to plug them all, here is a list of upcoming events I will be presenting, co-presenting or supporting:\nVMUG Leeds, 25th October 2012\nI am co-presenting with the marvellous Andy Fryer on a range of content around Windows Server 2012 and Hyper-V. It’s the first time I’ve attended a VMUG so I’m looking forward to it! Windows 8 IT Pro Camp Leeds, 13th November 2012\nThe rolling thunder of IT Camps is back in Leeds for a day with Windows 8. Andy Fryer and Simon May should be there, with myself and Andrew Davidson chipping in and helping things to run smoothly. The last Leeds camp on Server 2012 was fully booked and really well received by attendees and presenters alike, so make sure you book for what should be a great day. [What’s New in SharePoint 2013](http://www.blackmarble.com/events.aspx?event=Whats New in SharePoint 2013), 21st November 2012\nWhen Andy gets back from the SharePoint conference we will make sure that we give you the latest information at the first of this year’s Black Marble events. [Architecture Forum in the North](http://www.blackmarble.com/events.aspx?event=Architecture Forum in the North 5), 5th Dec 2012\nBlack Marble are once again running the well received Architecture Forum and I will be speaking, once more with Andy Fryer, about how Windows Server 2012 can facilitate pragmatic cloud architectures with a mix of on-premise, hosted private cloud and public cloud hosting. [The Tenth Annual Tech Update](http://www.blackmarble.com/events.aspx?event=The Tenth Annual Technical Update - AM), 30th January 2013\nSee in the new year with our famous Tech Update. This year we’ve split the day into two, focused on IT Managers and Business Decision Makers in [the morning](http://www.blackmarble.com/events.aspx?event=The Tenth Annual Technical Update - AM) and Developers and Technical Decision Makers in [the afternoon](http://www.blackmarble.com/events.aspx?event=The Tenth Annual Technical Update - PM). I also have a raft of invite-only events I’ll be speaking at over the next few months. As always, please come and say hi and feel free to ask questions!\n","date":"22 October 2012","externalUrl":null,"permalink":"/posts/many-upcoming-speaking-engagements/","section":"Blog","summary":"I seem to have been doing a lot of presenting lately, and the next few weeks are similarly busy. As a one-stop shop to plug them all, here is a list of upcoming events I will be presenting, co-presenting or supporting:\n","title":"Many upcoming speaking engagements","type":"posts"},{"content":" I’m really excited to be presenting at a one day event on Windows 8 application design in Dublin on Wednesday 26th September. I’m excited because Bill Buxton is delivering the keynote at the event and I’m a big fan.\nI’m delivering a session snappily titled ‘From 8 to 88 inches: designing for everyone’ and I’ll be talking about the challenges posed by the incredible variety of devices Windows 8 will be used with.\nIf you are attending the event, come up and say hi. It will do me good to chat, because the event is being streamed live! I’ve never presented to the entire planet before, so I’m unusually nervous about it!\nIt promises to be a great event, and I’m pleased to be involved with our friends from Microsoft Ireland, with whom the Black Marble irregulars have run many events on a wide range of topics over the past few years.\n","date":"22 September 2012","externalUrl":null,"permalink":"/posts/speaking-at-designing-beautiful-windows-apps-in-dublin/","section":"Blog","summary":" I’m really excited to be presenting at a one day event on Windows 8 application design in Dublin on Wednesday 26th September. I’m excited because Bill Buxton is delivering the keynote at the event and I’m a big fan.\n","title":"Speaking at Designing Beautiful Windows Apps in Dublin","type":"posts"},{"content":"More and more of our projects include a stipulation from the client that any web sites must work on the tablet devices of senior management. Up until recently that was exclusively iPads, but we are now seeing more Android devices out there. I wanted to find a straightforward way for us to test on such devices, preferably without needing to build up a collection of expensive physical kit.\nI read with interest Ben Armstrong’s post about running Android 2.2 (Froyo) in a VM using a build from the Android x86 project. I started my journey by replicating his steps, so I won’t document any of that here, other than to note that the generic x86 build you need is now a deprecated one, so I had to hunt a little to find what I needed.\nCreating the VM was a doddle. However, once I’d got things up and running I hit a snag: The sites I needed to test were hosted on SharePoint and required authentication. The web browser on the Android 2.2 build steadfastly refused to present a logon dialog for any sites. I could rework my test sites with anonymous access or forms-authentication but that didn’t fill me with enthusiasm. I wondered, then, if a later Android version might be my salvation.\nThat in itself led to a long time spent digging around the corners of the internet: The Android x86 project has a number of Ice Cream Sandwich builds but all are targetted at various types of hardware device and whilst all had support for wifi, none had support for ethernet. Since I can’t present a wifi device within the Hyper-V VM I had to look elsewhere.\nThe build I finally used was one I found at tabletsx86.org – an Android 4 build with experimental ethernet support.\nI ran through a number of installations as I edged my way through the different options each time I found that a choice I’d made prevented me from making some essential tweak. To save you all the effort, I’ve documented the steps here. Since I was a complete Android novice I’ve taken the approach of showing screenshots of every step for other novices like myself.\nStep 1: Getting things installed # The Virtual Machine we need to create doesn’t have to be powerful. However, we are running an OS that is not Hyper-V aware, so we can’t just go with the defaults.\nI created a machine with 512Mb of RAM and a single processor. I started with a 16Gb virtual disk as the hard drive but after a few passes I increased that to 32 to give me some headroom should I want to install apps later. The important step, however, is that you need to add a Legacy Network Adapter and remove the standard virtual adapter that Hyper-V will add.\nhyper-v settings Once you’ve got your VM built, insert the ISO for the Android 4 build into the DVD drive and boot the machine.\nSelect the option to install Android to the hard disk of the machine.\nscreen1 On the next screen choose Create/Modify partitions\nscreen2 In the partition editor, left and right cursor keys will move between the menu items; enter will select. Choose New to create a new partition.\nscreen3 You want to create a new primary partition\nscreen4 The utility defaults to the full size of the disk. Simply hit enter to confirm that.\nscreen5 Now we have our partition we need to mark it as bootable.\nscreen6 And finally we need to write the changes out to disk.\nscreen7 Now we have our partition we can exit the utility to continue the installation.\nscreen8 The installer will now show our new partition and allow us to select it as the target for the installation.\nscreen9 We then need to choose what format to use for the installation. I used ext3. I did try NTFS once, thinking that I could easily transfer files onto the system, but when I attached the VHD windows failed to recognise the file system, so I went back to Ext3, figuring I’d simply transfer stuff over the network.\nscreen10 Unsurprisingly, the installer asks for confirmation of the format.\nscreen11 Then it shows progress as it formats.\nscreen12 Next you need to install the Grub bootloader. Honestly, I’ve not tried without this, but I modify the bootloader options later so unless you want to plough your own furrow, install Grub.\nscreen13 The default option at the next step is to install the system directory as read only. I discovered very quickly that some of the things I might need to fiddle with are in that system directory so I’ve chosen to make it writable.\nscreen14 Now the installation occurs.\nscreen15 Once the installation is complete you should choose to create a fake SD card. I learned the hard way that if you don’t, saving stuff in your Android web browser won’t work.\nscreen16 Sadly the largest size we can create is 2Gb, which conveniently is the default.\nscreen17 Once again we get a progress bar whilst the SD card image is created.\nscreen18 Now we’re all done and we get the option to reboot. Note that you can’t eject the installation media yet – it’s locked, so you’ll have to reboot.\nscreen19 When the VM reboots you’ll be back at the first screen, allowing to choose to install or run the live CD. Turn the VM off so you can eject the media.\nAt this point the installation is done. You have a shiny new Android VM running Ice Cream Sandwich.\nStep 2: The Android wizard # This isn’t difficult at all, other then you need to remember that when you click on the VM to capture the mouse, it’s really emulating your finger. That means that you need to click and drag in drop down menus. I also discovered that the right mouse button seems to act as the hardware back button. Clicking the mouse is equivalent to tapping with your finger.\nI set the language to UK English as my first step.\nscreen21 Then the wizard will burble for a little while.\nscreen22 I chose to automatically set the time. Think grey outlines of check boxes are hard to see when they are on a black background!\nscreen23 The next step allows you to use your Google account to keep settings an stuff. I’m building a VM that will be generic and used by lots of people so I skip this one.\nscreen24 I am happy to use location services though – we want to use this thing for testing, after all.\nscreen25 Again, because this is a build for lots of users I’ve put the company in as the owner name. Note that even though we chose United Kingdom as the location, the keyboard setting is for a US keyboard.\nscreen26 Next we get an obligatory screen where we agree to stuff…\nscreen27 …and we’re done.\nscreen28 The system helps you through how to use it. The import bits are the icons at the bottom. The upward pointing outline of an arrow in the middle brings you back to the home screen.\nscreen29 A handy tip # This thing feels a lot like Linux to me. Conveniently, pressing alt+f1 will switch to a console screen. Alt+left arrow and alt+right arrow will switch between consoles and the graphical UI.\nInside the console you can use familiar tools like ping and nslookup. It’s not a full-fat linux box, mind you. The two commands I find myself using most in the console are reboot and halt. Odd that there’s no way to cleanly shutdown – no shutdown command or even an old school init 0!\nA couple of minor hiccups # Having got my VM up and running and gone through the startup wizard in Android there were a few things not quite right. First of all the screen resolution was too low at only 800x600. Step forward my very rusty Linux experience and my much less rusty internet research expertise!\nMore worryingly, when I boot the machine it doesn’t always pick up the correct DNS settings. Research showed that to be much more interesting. Strangely, things worked at home but not in the office. Research showed that it was to do with the DHCP responses being different on the two networks: The office network was not responding to the request for DHCP option 119 – domain suffix search order. Fixing that solved the problem (but that’s another can of worms and I’ll write up a separate post about that one!).\nStep 3: Setting the screen resolution # This one turned out to be quite easy, although it involves using Vi, which is a text editor whose arcane commands I have very limited knowledge of.\nThe first thing we need to do is find information about what display modes are available. To do this we boot the VM and use the options available to modify the boot parameters. Be aware that when you boot the VM the Grub screen only shows for a few seconds before the first option is booted automatically. When you see the screen below, hit the ‘a’ key to easily append options to the boot command.\nscreen30 When you hit ‘a’ you will be presented with the boot command to edit. Options on the command line are separated by spaces. Add a new one: vga=screen31 Hit the enter key and the OS will boot. You will see a black screen with a number of options on it. Hit enter again at this screen in order to view the display modes available to us.\nscreen32 From the list of available modes, choose the one you want to use. The system is waiting for you to type in the three character hex code for the mode you wish to use. For 1024x768 at 32 bit, for example, enter 318\nscreen33 Assuming all works correctly you will see Android running in your chosen resolution. Sadly, it’s not permanent yet. I’ve also become paranoid enough that before I edit the bootloader options permanently I like to try what I’m going to do first.\nReboot the system and hit ‘a’ to append boot options. This time we want to specify the display option we want to use. Just to bend your head a little, the boot option needs the decimal equivalent of the hex value that the display modes screen showed us. For Our 1024x768x32, the hex was 318. The decimal is 792, so we append vga=792 to the boot options.\nscreen34 When Android boots, you should see it in 1024x768 once more:\nscreen35 Now we need to make the change permanent. To do that we need to edit the configuration file that the Grub bootloader uses.\nTo do that we need to reboot the system in debug mode.\nBoot the system and use the cursor keys to select the second option on the boot menu.\nscreen36 The system will boot to a command shell:\nscreen37 Once you’re in the command prompt, typing clear will clear the screen and get rid of the boot messages. Then you need to enter the following commands:\ncd /\nmount –o remount,rw /mnt\ncd /mnt/grub\nvi menu.lst\nWhat does that lot do? The part of the filesystem that stores the bootloader is attached as read-only. The mount command effectively detaches and reattaches that part of the filesystem so we can modify it. The files we want are in the grub folder within mnt. Finally, we open the text editor Vi to change the file.\nVi is a bit arcane, although extremely powerful. For help with the commands look at online tutorials, like the one hosted by Washington University.\nOnce we’re in the config file we are going to add the vga=792 option to the end of the default boot command. I’ll tell you what Vi commands I use to get the job done – note that they are not necessarily the best ones, they just work for me. I know about half a dozen Vi commands and they allow me to get by. If I want to do something clever I have to look it up!\nscreen38 In Vi, the cursor keys allow you to move around the file. Pressing escape tells Vi to listen for commands. Move down to the start of the first line of the first boot section (the first occurrence of ‘kernel’). Press Esc then ‘o’. That should give you a new line after kernel.\nscreen39 Now use the cursor keys to navigate to the end of that first ‘kernel…’ line and you should be able to type ‘ vga=792’\nscreen40 Now we want to get rid of that extra line. Move the cursor to the start of it and hit Esc then dd (escape then hit ‘d’ twice).\nFinally we save the file. Esc+:wq is the command to write out the file and quit.\nscreen41 You should now find yourself back at the command prompt. Type reboot –f to reboot the system.\nYou should now find that by default your Android VM boots into your chosen resolution.\nA quick side note # If you don’t have control over your own DHCP server you can use the following command to poke the dns into life:\nsetprop net.dns1 x.x.x.x where x.x.x.x is the IP address of your DNS. You can also add a second with net.dns2.\nYou can also give the VM more memory with no issues – mine now runs with 1024Mb. I’ve also added a second CPU core as an experiment which works but I’m not sure it’s any quicker.\n","date":"18 June 2012","externalUrl":null,"permalink":"/posts/a-virtual-ice-cream-sandwich-android-4-x86-in-a-hyper-v-vm/","section":"Blog","summary":"More and more of our projects include a stipulation from the client that any web sites must work on the tablet devices of senior management. Up until recently that was exclusively iPads, but we are now seeing more Android devices out there. I wanted to find a straightforward way for us to test on such devices, preferably without needing to build up a collection of expensive physical kit.\n","title":"A Virtual Ice Cream Sandwich: Android 4 x86 in a Hyper-V VM","type":"posts"},{"content":"If you’ve seen my recent blog post on making Android work in Hyper-V you will have seen my problems around DNS resolution when in the office. That turned out to be down to the DHCP options being handed back by our Server 2008 R2 box. Or rather, it was what wasn’t being handed back to the client that was the problem.\nLinux (and Apple OSX, as it turns out) both want a response to option 119, which defines the domain suffix search order. Windows does not request this option and the windows DHCP server does not offer the option at all.\nThere are a few locations on the web that talk around this but none properly document the process of adding the custom option to your DHCP server and more importantly, exactly how to encode the response (thanks go to Matt for describing that one in enough detail!).\nWhat option 119 looks like # Option 119 hands back a byte array that encodes the domain suffix. The trouble is, it’s not a simple matter of turning text into ascii hex values. There is a structure to it.\nOur domain is blackmarble.co.uk. I found a handy web site that sped up the process of getting the hex of that.\nblackmarble.co.uk0x620x6c0x610x630x6b0x6d0x610x720x620x6c0x650x2e0x630x6f0x2e0x750x6b The client expects the full domain to be split (get rid of the separating periods), with each section prefixed by it’s length (e.g. 11 blackmarble 2 co 2 uk) and then the whole string is null terminated.\n\u0026nbsp;blackmarble\u0026nbsp;co\u0026nbsp;uk\u0026nbsp;0x0b0x620x6c0x610x630x6b0x6d0x610x720x620x6c0x650x020x630x6f0x020x750x6b0x00 Adding the option to Server 2008 R2 # To add the DHCP option to Windows Server 2008 R2 you need to add a new option to the IPV4 section. Select ‘Set Predefined Options’ from the context menu on the IPV4 heading beneath the name of the server in the DHCP console.\ndhcp option menu In the dialog that appears, click the Add button.\ndhcp options add Enter the name for new option. It needs to be of type Byte and make sure you check the array option; the Code is 119 and you can add a description if you want to.\ndhcp add new option Once you’ve defined the option you can add it either to the main Server Options section, a scope or an individual address reservation.\n119 server options Each of the hex values you worked out (see my examples) needs to be added in turn to create the full byte array.\nHopefully this pulls all the necessary information into one handy reference and it saves somebody else the confusion I experienced.\n","date":"18 June 2012","externalUrl":null,"permalink":"/posts/adding-dhcp-option-119-domain-search-list-to-windows-server-2008-r2/","section":"Blog","summary":"If you’ve seen my recent blog post on making Android work in Hyper-V you will have seen my problems around DNS resolution when in the office. That turned out to be down to the DHCP options being handed back by our Server 2008 R2 box. Or rather, it was what wasn’t being handed back to the client that was the problem.\n","title":"Adding DHCP Option 119 (Domain Search List) to Windows Server 2008 R2","type":"posts"},{"content":"A short while ago I replaced my trusted by heavy Acer laptop with a Lenovo x220 tablet. After a couple of months running windows 8 I’m ready to put my thoughts into words.\nIf you’ve landed on this post looking for notes on Windows 8 drivers for the x220, skip to the end. UPDATE 12/06/2012 – added some points to the Windows 8 section.\nA painful purchase # Nothing could have prepared me for the deeply unpleasant experience of actually purchasing my new tablet. The Lenovo UK site is shockingly bad at providing the information and options you need. Examples include (some of which bit me!):\nConfusing information about specification and options. I still don’t actually know whether I have USB 3 or not – the product page suggests yes; the lack of identified hardware suggests not. Appalling lack of detail on options and accessories. I ordered the docking base – there was only one choice. Nowhere did it say that I could have one with an optical drive. If I want to get a DVD now, it’s another £130! Confusing information on critical choices. I still don’t understand the screen choices. I think I messed up on this – all the notes said five-point multitouch but Windows reckons I have only two-point. I got the standard screen because nothing I read said I needed anything but that. This is the one that might well bite me, so be careful! However, on the plus side I was lucky enough to get a honking great discount off the final price thanks to lucky timing. The discount more than covered the cost of the extras I added post-purchase.\nA solid platform # What I did manage to do was some research before my purchase. Lenovo will only ship the x220 with up to 8Gb of RAM. If that had been the maximum I could stuff into the system, I would have walked away. In fact, it will work quite happily with 16Gb, installed in the form of two 8Gb SODIMMS. Mine are Corsair, from my local supplier, and it works just great. Coupled with the dual core with hyper-threading Core-i7 option I chose from Lenovo, this thing is quick and great for VMs.\nLess useful was the discovery that the x220 can only take 7mm drives. I had a 750Gb hybrid drive in the Acer that I wanted to use, so I order the x220 with the basic 320Gb drive. When I tried to fit the hybrid drive I found that I couldn’t.\nIt turns out that 7mm drives are actually quite hard to find in reasonable capacities, and I quickly learned that the 320 was definitely not fast enough and not really big enough. Step forward my second addition to basic spec – a 512Gb Crucial M4 solid state drive. That actually took some digging as well – the Crucial UK site denied the existence of any 7mm SSDs in their range. I got mine from Amazon in the end. What did we ever do before internet search engines?\nThe end result is a shockingly quick, light and flexible laptop that gives me over six hours of battery life and can comfortably run the battery of virtual machines I use for demo, customer work and testing.\nWould I recommend the x220? # In a word, definitely. Would I recommend the Lenovo web site to purchase it from? Probably not. If you can reach out to a product specialist for advice I would strongly suggest you do so. Not only that, but I type this the week after the x230 was announced, with Ivy Bridge and other new-tech goodies. Am I disappointed to have bought ‘too soon’? A little bit, but you can wait forever in this business – something shinier is always around the corner, and I needed something pretty urgently when I bought the x220.\nOverall, it’s good kit. It’s light, with a small, light power charger. It’s quick enough for development and running VMs – something I do a lot of. The convertible design means its ready for Windows 8 but doesn’t sacrifice that wonderful Lenovo keyboard for when I need to write documentation. The screen is bright and crisp, and whilst I would love more pixels (it’s only 1366x768) I’ve not been frustrated by lack of screen real estate.\nRunning Windows 8 on the x220 # My first install of Windows 8 was before Lenovo released their suite of beta drivers. More on those in a while. I started with a clean disk and installed Windows 8 Consumer Preview. Not unexpectedly, the bulk of the devices were located and installed by the OS – display, networking etc. However, the WWAN, bluetooth, tablet buttons and a few others were not found.\nI had to work through the drivers from Lenovo, installing pretty much everything including software. It’s irritating that there is no way to change the state of the wireless radios other than software. There’s a ‘flight-mode’ button on the x220 but everything else is controlled by the Lenovo apps. That means installing pretty much all the battery of crapware Lenovo ship in order to merely use the stuff the laptop ships with.\nHowever, once it was all installed I was very happy. The arsenal of Lenovo stuff meant that startup was slow, but once up it was quick. Hyper-V installed with no problems and the Windows 8 UI was lovely to use with the touch screen.\nWith hindsight, I should have left it like that. Except Lenovo released their beta drivers, and I decided to install them.\nTrue to form, disaster struck when I was on the other side of the world, in California. The fault manifested as a corrupted hard drive. The OS was beyond repair, so I had to salvage what data I could onto a pod that thankfully I always carry. With the help of others around me I managed to get a USB stick with Windows 8 CP on to rebuild. That night I spent a while in my hotel room fiddling with drivers again.\nIt ran, but it was flaky after that, so this week I decided to methodically rebuild and be sparing with the software.\nx220 driver step-by-step # I now have a solid, quick, tidy install of Windows 8 on my laptop. I only installed two pieces of Lenovo software in addition to the beta hardware drivers (and you could argue that one of those is a driver as well).\nUPDATE: I had some stability problems shortly after installing the Release Preview. Upgrading the firmware to the latest version fixed them.\nInstall the OS clean. Don’t mess around with upgrades – take off and nuke the site from orbit; it’s the only way to be sure! Get all the Windows Updates done first. You should find that takes care of the Conexant Audio driver and the Lenovo monitor driver. Download the drivers from the Lenovo Windows 8 beta drivers page that list the x220. Start with the Intel Rapid Storage driver and the chipset drivers, then install the rest. The Tablet Button drivers are important if you want to be able to rotate the screen. Download the latest version of Lenovo ThinkVantage Access Connections from the x220 support page. That’s the only way I’ve found to manage the wireless connections (especially my Ericsson WWAN card, for which there seems no other way to establish a 3G mobile data connection). What doesn’t work after this lot? Just the bluetooth, which refuses to install the drivers because it’s not enabled, but without the software won’t enable. Ah well. I can live with that for now.\nUPDATE: Upgrading the firmware reset the bluetooth status. Installing the Lenovo Hotkey Utility after everything else has now given me full control of all wireless radios. Whilst I was at it, I tracked down the last unknown device as being the power management interface. I installed the Power Management Driver (Note: not the Lenovo Power software, just the driver) and all is fine. With all the radios off I’m getting at least 6 hours if not more.\nNotice that I avoided the Lenovo Power Management (software), tablet menu, active protection and many other software utilities. My experience has been that they add very little whilst significantly slowing boot time.\n","date":"12 June 2012","externalUrl":null,"permalink":"/posts/tweaking-my-lenovo-x220-tablet-and-running-windows-8/","section":"Blog","summary":"A short while ago I replaced my trusted by heavy Acer laptop with a Lenovo x220 tablet. After a couple of months running windows 8 I’m ready to put my thoughts into words.\n","title":"Tweaking my Lenovo x220 Tablet and running Windows 8","type":"posts"},{"content":"WP_000140 Yesterday was great fun and I was really pleased to see so many Black Marble event regulars at the IT Camp. It was great to hear so many requests for more events like it in Leeds. We’re all keen to run more, but we need people to attend and give us feedback in order to be able to do that.\nI hope those of you who were there took away useful knowledge from the event. Andy and Simon were very keen that it should not be a day of PowerPoint and canned demos and we certainly delivered that. Did we have technical issues that meant we had to change plans on the fly? Sure! Certainly nobody we spoke to seemed to mind. All of us from Black Marble thought the concept for the day – one of interaction, audience participation and trying to build systems on the fly – should be fun and we thought it was.\nI believe that the TechNet UK folks were tweeting and posting links to some of the things we talked about yesterday but I thought it would do no harm to round some of them up here.\nWhen we were talking about configuring remote management of hyper-v servers I mentioned HVRemote. This is a script written by John Howard that has been really useful for Andy and myself in the past. John’s blog has lots of really useful information about hyper-v and management, although he’s not posted for a while now. Also a great source of information on hyper-v and virtualisation is Ben Armstrong (VPC-Guy). The Virtualisation Team Blog is a good place for product info, announcements and knowledge. Richard Fennell posts regularly on Lab Manager, which builds on Hyper-V and SCVMM to deliver great things for your dev and test teams. I thought either he or Andy had blogged about how we got Lab Manager 2010 working with a hyper-v cluster but it appears not. We’ll see if we can get something written up in that space. Core Configurator (currently at version 2.0) was something that was shown as a handy tool to control some of the settings on your Hyper-V server. The Microsoft iSCSI Target is a free download. The Virtualisation Team blogged on it’s release. For those of you who played with the Surface, we have some videos on YouTube of the Retail, Concierge and O7 game that were filmed at NRF 2012. I’m really looking forward to other camps. Andy and Simon want to keep the hands-on approach so you can look forward to playing with an installed SCVMM solution in the follow-up virtualisation camp, and the consumerisation of IT camp should be wild as we try to cover how IT pros can deal with the variety of devices that our staff (and our bosses) want to use!\nAs always, the page of details about the events is here!\n","date":"29 February 2012","externalUrl":null,"permalink":"/posts/it-camp-leeds-roundup/","section":"Blog","summary":"WP_000140 Yesterday was great fun and I was really pleased to see so many Black Marble event regulars at the IT Camp. It was great to hear so many requests for more events like it in Leeds. We’re all keen to run more, but we need people to attend and give us feedback in order to be able to do that.\n","title":"IT Camp Leeds Roundup","type":"posts"},{"content":"There’s a new term in town – Consumerisation of IT. All of us who work in IT should care about this because it’s going to have a deep impact on the approach many of us have taken when deploying services to our organisations.\nI don’t profess to be a thought leader on this topic, although I find it interesting that I have been dealing with the ‘problem’ here at Black Marble ever since we started up many moons ago. I may well post more about what we deliver in terms of services and solutions within the organisation later, but this article is intended to drive your attention to two important places.\nThe first is Simon May’s great article that briefly summarises some of the technology that’s already out there to help you embrace ‘unmanaged’ devices that want to access your services.\nThe second is to make you aware of the consumerisation-focused IT Camps that Simon May will be running, with the help of a few of the usual suspects (and myself). Simon’s plan is to take the same approach as we did at yesterday’s virtualisation camp – hand-on, grab the technology by the scruff of the neck and fasten together an example solution during the day. I’m really excited about this, because the area covers such a broad range of technologies, including Network Access Protection (NAP), Threat Management Gateway (TMG), Unified Access Gateway (UAG), Exchange, Forefront, System Centre and more. The first of those events is in Newcastle. Sadly I can’t make that one, but I will be at the Manchester event on May 9th. Take a look at the event series – there should be ones in a city near you. Register quick, though – they are filling fast.\n","date":"29 February 2012","externalUrl":null,"permalink":"/posts/my-boss-has-brought-his-ipad-consumer-devices-in-corporate-networks/","section":"Blog","summary":"There’s a new term in town – Consumerisation of IT. All of us who work in IT should care about this because it’s going to have a deep impact on the approach many of us have taken when deploying services to our organisations.\n","title":"My Boss has brought his iPad! Consumer devices in corporate networks","type":"posts"},{"content":"Andy and I are really pleased to be able to help our friends at Microsoft with their latest idea for engaging with IT Professionals. Next week (Tuesday 28th February) sees the first in a series of new IT Camps taking place in Leeds. The idea is to run a full day event that is very light on PowerPoint and heavy on the hands-on, roll up your sleeves and install things as a group.\nYou can find information about the series of camps online. The magnificent Simon May and Andrew Fryer from Microsoft will be leading the camps, with support from myself, Andy and a range of great IT Pro MVPs. For instance Jon Noble, PowerShell MVP and NEBytes organiser will be helping with the Newcastle event.\nTuesday’s camp is all about Virtualisation and promises to be both engaging and educational. You’ll also find Black Marble faces assisting with a Virtualisation camp in Manchester on April 25th and also in Manchester on May 9th where the subject will be on consumerisation of IT and how we can manage mobile and desktop devices securely.\nSee you there!\n","date":"24 February 2012","externalUrl":null,"permalink":"/posts/hands-on-microsoft-it-camps-well-be-there-and-you-should-too/","section":"Blog","summary":"Andy and I are really pleased to be able to help our friends at Microsoft with their latest idea for engaging with IT Professionals. Next week (Tuesday 28th February) sees the first in a series of new IT Camps taking place in Leeds. The idea is to run a full day event that is very light on PowerPoint and heavy on the hands-on, roll up your sleeves and install things as a group.\n","title":"Hands-on Microsoft IT Camps–we’ll be there and you should too!","type":"posts"},{"content":"If you call in at Black Marble you’ll see Nokia’s everywhere. They’re talking over the place. It takes me back… I remember when almost everybody I knew had some kind of Nokia or another. I started with the 5.1 on Orange, followed by a sequence of progressively smaller phones. Then came Series 60 and I walked away – I never liked the interface. I swapped to Sony Ericsson and the P800, P900 and P910. I moved to Windows Mobile for time, until I could stand it no more and swapped to an iPhone (much to the grumbling of folk round here!).\nI liked my iPhone – it was reliable, flexible and did what I wanted, when I wanted it to (until the last IOS revision, sadly). Windows Phone was tempting – the interface looked great and felt great, but the handsets just weren\u0026rsquo;t there. I tried an LG and hated it, and the HTCs are just too darned big.\nWhen the Lumia was announced I signed up on the Orange site well before release and I picked mine up on day 1. Now the iPhone is gathering dust (I thought I’d still use it for TomTom but even that has been usurped) and I can’t say I miss it.\nOverall I can heartily recommend the Lumia. There’s lots to like. There are some niggles but none that drive me crazy. Over the past two months it’s been reliable, usable and flexible – just like my iPhone was.\nThe Good # Size. Just right, actually. Marginally smaller than my iPhone 3GS, although perhaps a little fatter. Nicely contoured and fits well in the hand. Screen. Great. The AMOLED display is really crisp and clear. Sure, the iPhone 4 has a higher resolution but the standard 800x480 Windows Phone resolution is just fine thanks. Construction. The polycarbonate body feels nice in the hand. The phone is well put together – nothing rattles or wiggles where it shouldn’t and the curved gorilla glass front looks and feels the business. Camera. The Lumia takes better pics than my 3GS did. The LED flash is staggeringly bright when it goes off. I like the various modes that are available, such as night and sunset, and they have been useful more than once. I’d like to be able to use the camera app directly to take Hipstamatic-type pics without needing to post process in an app, though. Speed. It’s a pokey little thing. Apps run smoothly and quickly. The Bad # Charging. Battery life is on a par with the iPhone, so no complaints there, but if the battery runs completely flat I can only use the Nokia charger to revive it, and even then once or twice I’ve had to use the 10-second power button press reset to force the thing to charge. No issue with battery life though – the much discussed problem has never materialised for me. Touch. For the most part it’s great, but every now and then the touch screen can be a little over sensitive, or not sensitive enough – take your pick. This could be a calibration issue or something to do with the gorilla glass thickness, I don’t know. It doesn’t stop me using the phone but occasionally it niggles me when in a game. USB Port Cover. This is another one that’s been debated elsewhere. I like the overall design and that the port is protected, but frankly, it makes plugging the thing in a fiddly process. For somebody that has grown used to simply plonking his iPhone onto the dock connector of a raft of household electrical appliances it’s a bit irritating. The Apps # Nokia Drive. I like this, although in it’s current incarnation it’s no TomTom. I miss the lane guidance and I particularly miss the traffic updates. Supposedly the latter will arrive in an update, and it’s hard to complain when it’s free. Overall it works well and gets me where I need to go. XBOX Live. This is becoming a bit addictive. I have an XBOX (two, thanks to Orange and the Lumia offer) but I never used to pay so much attention to Achievements as I do now. XBOX Companion is funky; Halo Reach is handy and being able to see my gamer friends is great. There are some really good games available, and many of the most addictive I’ve found are free! I didn’t use the iPhone for gaming half as much as I do on the Nokia. Bing Get Me There. I had a number of London Underground and similar apps on the iPhone but they pale in comparison to Bing Get Me There. It’s fabulous, fully featured and free! I go to London regularly, but not regularly enough to be an old lag when it comes to navigating the tube. This is a great app! Missing in action… I had a raft of apps on the iPhone that I used regularly. Some have an equivalent on Windows Phone, but not all. I really miss Hipstamatic, and there are no apps that are its equal for Windows Phone. Others have third party apps but not first party, such as TripIt, which I find really helpful (Trip Hub steps up there). It’s getting better all the time, but it’s not yet at a point where I can match the variety of small but useful apps that I had on the iPhone. ","date":"16 January 2012","externalUrl":null,"permalink":"/posts/living-with-the-nokia-lumia-800/","section":"Blog","summary":"If you call in at Black Marble you’ll see Nokia’s everywhere. They’re talking over the place. It takes me back… I remember when almost everybody I knew had some kind of Nokia or another. I started with the 5.1 on Orange, followed by a sequence of progressively smaller phones. Then came Series 60 and I walked away – I never liked the interface. I swapped to Sony Ericsson and the P800, P900 and P910. I moved to Windows Mobile for time, until I could stand it no more and swapped to an iPhone (much to the grumbling of folk round here!).\n","title":"Living with the Nokia Lumia 800","type":"posts"},{"content":"","date":"16 January 2012","externalUrl":null,"permalink":"/tags/smartphones/","section":"Tags","summary":"","title":"Smartphones","type":"tags"},{"content":"Every now and again, whilst I’m away from the office, the gadget pixies visit my desk and leave something interesting for me to play with. It’s a bit like Bagpuss, except stuff works when it arrives and I can never get the guys to wake up when I need them too.\nThe last time this happened there was a tablet sitting on my desk. I like it enough to write about it.\nThe Stylistic is never going to win a beauty pageant. Which is a shame, because it has all the features that I usually bemoan the lack of in Windows Tablets. Most of them are designed for the consumer. That’s great, but I get involved in lots of projects these days where the end user wants the convenience of a tablet device but the demands of their IT department make them unusable.\nFor example, I once visited a site where the IT department had imaged the tablet we were to use and applied their standard group policies. They required a smart card for authentication and forced CTRL-ALT-DEL to logon. You can probably see the problem with that.\nIt wouldn’t phase the Stylistic.\nWP_000043 Stuff I like about it # Removable battery. I’ve played with this for a while now, and I can report that battery life is on a par with the other tablets I’ve played with – four to five hours. That’s good, but not a working day. Being able to carry a spare battery if I need it means that I can be away from a power outlet all day and not worry. Smart card reader. Two factor authentication on a tablet – fantastic! It’s just what enterprises need in order to support these kind of devices. As an IT manager I want to be able to apply group policies to these devices. They are extremely portable so I have to be sure that the data on them is secure. TPM Chip. I can bitlocker the drive on this thing properly. Shame the one I have to play with came with Windows 7 Professional on it. Be careful with this, though: I checked the product information and the TPM chip is an option on the device. I think that’s a mistake on Fujitsu’s part – most organisations won’t check and will probably order the wrong variant. Fingerprint Reader. Personally, I don’t like or trust fingerprint readers for authentication, but I like that I have the option. Matte screen. This is great! Virtually every windows tablet I have seen has a glossy screen. That’s great in the shop window and a real pain in the real world as I can’t see the screen for the reflections. The Stylistic has a matte screen and it’s incredibly easy to read and use. Stylus. It’s much easier to write notes using OneNote than type on a software keyboard. The digitiser on the Stylistic is a dual mode one that works with fingers and a stylus and I like it. Multi-touch. The touch digitiser on the Stylistic can handle four points. It may be able to handle more but I haven’t found any detailed information. Four is better than most windows tablets, however, which tend to deal with only two touch points. WP_000044 Stuff I don’t like about it # Stylus. Don’t get me wrong – the stylus is great. The fact that there is nowhere to put is is very annoying. It’s a nice stylus, but there’s no clip on it so I can’t treat it like a pen and keep it in my pocket, and there’s nowhere on the tablet to stow it away. Styling. From the front the Stylistic doesn’t look too bad. However, flip it over and it’s been hit with the ugly stick. I realise that Enterprise purchasing teams don’t care about looks but users do. Why can’t it be sleeker. Heck, I’d settle for it simply being all one colour! Fiddly buttons. There are lots of buttons down the side of the Stylistic. One brings up a software keyboard, but it’s not the standard Windows 7 one – it’s a nasty one from N-Trig that crashes a lot. One makes the screen rotate which I view as a bit surplus to requirements – why can’t I simply have a lock rotation button like every other tablet. With the stylistic I must fiddle with a tray app to turn auto-rotate on and off, then poke at the little button to rotate the screen if I have disabled the auto-rotate in an outstanding failure of ergonomic design. There’s also an ‘Alt’ button that I admit to not having figured out. Crazy Gestures. Why do all these tablet manufacturers insist on ‘improving’ Windows 7 with complex multi-touch gestures that nobody can remember and really aren’t useful. I don’t want crazy three- and four-finger gestures. Fortunately this is all software and I can turn it off. 32-bit Only. Why would you release a piece of kit these days that isn’t 64-bit capable? I appreciate that the tablet only has 2Gb of memory (which is enough for most people’s needs) but operating systems are moving steadily to 64-bit and I’d rather not be left behind. Overall: A Win # Most of the things I find annoying are implemented by software and I can turn them off. The fact that it’s a sexy as a house brick is of little importance to the enterprise market at which it is aimed. Overall the Stylistic has a raft of features that enterprise IT demands but doesn’t sacrifice the key elements of tablet design to deliver them. The Stylistic is not too heavy to hold, is a nice size and has good battery life for a Windows machine. As an enterprise tablet I think it’s a solid choice that supports all the security functionality I would want to enable for such a mobile device.\n","date":"14 December 2011","externalUrl":null,"permalink":"/posts/fujitsu-stylistic-q550-a-tablet-for-the-enterprise/","section":"Blog","summary":"Every now and again, whilst I’m away from the office, the gadget pixies visit my desk and leave something interesting for me to play with. It’s a bit like Bagpuss, except stuff works when it arrives and I can never get the guys to wake up when I need them too.\n","title":"Fujitsu Stylistic Q550: A Tablet for the Enterprise","type":"posts"},{"content":"This one threw me for a while and I could find nothing specific on the web. I wanted to use my Xbox 360 to watch video streamed from my Windows Home Server. Streaming is switched on by default, I hear you say. Why, yes it is, but each time I tried to connect the Xbox I received an error.\nThe solution? Enable the Guest account on the server. Do this with care – revoke it’s access to everything except the folders you want to stream unless you want to allow read access to everything on the server.\nOnce Guest was enabled and the access rights were applied the whole thing worked like a charm.\n","date":"9 December 2011","externalUrl":null,"permalink":"/posts/streaming-video-to-xbox-360-from-windows-home-server-2011/","section":"Blog","summary":"This one threw me for a while and I could find nothing specific on the web. I wanted to use my Xbox 360 to watch video streamed from my Windows Home Server. Streaming is switched on by default, I hear you say. Why, yes it is, but each time I tried to connect the Xbox I received an error.\n","title":"Streaming video to XBOX 360 from Windows Home Server 2011","type":"posts"},{"content":"","date":"9 December 2011","externalUrl":null,"permalink":"/tags/windows-home-server/","section":"Tags","summary":"","title":"Windows-Home-Server","type":"tags"},{"content":"","date":"9 December 2011","externalUrl":null,"permalink":"/tags/xbox-360/","section":"Tags","summary":"","title":"Xbox-360","type":"tags"},{"content":"One of our customers contacted us the other day with a problem. They wanted to put a view of a document library that was located in the top level site of a site collection onto the landing pages of all the second level sites in that collection. The customer had consulted the internet hive mind and found a blog post with instructions which had been diligently followed and yet whenever a user clicked ‘New’ on the ribbon bar an error occurred.\nAfter a bit of poking and prodding on my local test system I not only replicated the fault but also found the cure. Since none of the other sites on the internet that I found mentioned this, I thought I’d better write it up for the world.\nThe screenshot below shows you our goal. The ‘Main Site Shared Documents’ web part actually points to a document library that is in the site above the one we are in.\nGroup Site with external document library web part Step 1: Export the original list web part with SharePoint Designer 2010 # In order to place the view we need on our page we need a web part. To get that we have to edit the page of the view of our document library in SharePoint designer.\nNavigate to the view of your document library and in the ribbon part choose ‘Modify In SharePoint Designer (Advanced) from the drop down ‘Modify View’ menu.\nmodify view in designer Once you have the page open in SharePoint Designer, you need to select the XsltListViewWebPart that is showing the contents of the library.\nxsltlistviewwebpart With the web part selected you will be able to switch Designer’s ribbon to the Web Part tab and choose ‘To File’ from the Save Web Part panel. Saving to the Site Gallery won’t work – I tried and SharePoint complained every time I added the web part to a page.\nWhen you save the web part SharePoint Designer will throw up a dialog box:\nexport web part question You need to answer ‘Yes’ to this question because we want the web part to always point at our target document library, no matter where we use it.\nsave web part to file Step 2: Add the web part to your page # Edit your target page and add a web part to your intended zone. When the web part panel comes up, you will see ‘Upload a Web Part’ in small text beneath the Categories panel and clicking that will expand the control to give you a file browser.\nBrowse to the web part you saved from SharePoint Designer and then Upload the file. The web part picker will close at this point. Don’t panic!\nupload a web part Go through the steps to add a web part again and this time in the Categories panel you will have a new item at the top called Imported Web Parts. Select that and your web part will appear in the list so you can add it to the page.\nadd an imported web part Step 3: Change the toolbar setting on the web part # This is the important bit! When you add the new web part to your page everything appears to work fine. Documents from the document library open fine and clicking the ‘Add a new document’ link will open the upload dialog as they should. However, if you use the ribbon bar then you will notice very quickly that it is not the correct ribbon bar for the library – the items on the New menu will be wrong (if you have custom content types that’s easier to spot!) and trying to use the buttons will cause errors.\nThe solution to this conundrum turned out to be straightforward – simply change the toolbar setting of the web part. If you choose ‘Full Toolbar’ or ‘Show Toolbar’ you will see the erroneous behaviour; choose ‘Summary Toolbar’ or ‘No Toolbar’ and all will work fine.\nbroken menu with web part settings The setting shown above on the web part will give you a broken menu (the other web part on the page is a calendar, so I get appointments!)\nworking menu with web part settings The setting shown above works just fine.\n","date":"7 December 2011","externalUrl":null,"permalink":"/posts/displaying-a-sharepoint-2010-library-on-a-page-in-a-different-site-within-the-same-site-collection/","section":"Blog","summary":"One of our customers contacted us the other day with a problem. They wanted to put a view of a document library that was located in the top level site of a site collection onto the landing pages of all the second level sites in that collection. The customer had consulted the internet hive mind and found a blog post with instructions which had been diligently followed and yet whenever a user clicked ‘New’ on the ribbon bar an error occurred.\n","title":"Displaying a SharePoint 2010 library on a page in a different site within the same site collection","type":"posts"},{"content":"This article is all about preparation. It’s about the thinking and planning you need to do if you’re going to successfully build your wonderful, unique and striking website on the SharePoint platform.\nI’ve been helping customers implement SharePoint solutions for quite a while. Life gets interesting when those customers want to use SharePoint to host their public website or an intranet of published content. SharePoint is a great platform with a host of powerful features that make it a solid choice for large or complex websites, sites that have to deal with large volumes of traffic or simply sites that need real business processes wrapped around the publishing model. Much of my time in these scenarios is spent helping the customer prepare and plan, and I’d like to share some of my experience.\nWe’ve planned the site… # site plan How many times do you visit the customer and they greet you with an enthusiastic ‘We’ve planned the site and documented it for you’? I get twitchy when I hear that, because it usually involves me being handed a piece of paper that looks like the picture above. That would be great if it was a starting point, but many times the customer genuinely believes that’s all they need to tell me and the creative agency, and from that tiny post-it note our creative minds will issue forth the next great site on the web.\nSharePoint rewards attention to detail # You can’t treat SharePoint like an old web server and expect to get away with it. Treat a web site as a vague collection of folders with pages in that present content of some kind to the reader and you will quickly find yourself in a pit of despair. There are four areas that demand your attention – attend to these with diligence and the technical solutions will be much easier to determine.\nBefore you start, read Don’t make me think by Steve Krug and The Elements of Content Strategy by Erin Kissane. Both are quick reads that will help you immeasurably.\nContent Strategy # Content Strategy is all about identifying what content you have, describing it, identifying who owns it and what its lifecycle is. It’s about discerning the difference between a product datasheet, press release, case study and staff biography. In SharePoint terms, it’s all about content types. What information do we store and how? What columns constitute a press release, and is it based on an article page or an item?\nI find that full-service creative agencies that are used to writing copy, be it for print or the web will understand this already. Creative agencies that are more focused on visual design, be it for the web or otherwise tend to struggle with the concepts of content strategy. Once you’ve got them on board, however, their lives are much easier as well: Now we know that we have those four kinds of content then the creative agency can choose to design unique ways to display them.\nDesign # Knowing what the different kinds of content are will invariably help the creative guys. Now they know that they have to design ways to present each of the different kinds of content – a product page will look very different from the Chief Exec’s Blog. This will help you to answer SharePoint questions like how many masterpages and page layouts and will start to guide your thinking in terms of site structure.\nUser Experience # Not only do we want to know what the site looks like, we need to think about how users will interact with it. Do we want to use clever icons for navigation? Do we need to present content based on what we know about the user – age, gender, role, etc? We will almost certainly need to build something bespoke to deliver the user experience which means we need requirements so put plenty of detail into describing how things will be expected to work.\nInformation Architecture # There are some great books on IA out there. SharePoint places additional constraints on projects though: Perhaps our security needs mean that we must create separate site collections for content. Maybe we want radically different design for certain content which means different masterpages and separate sites. Certainly we should avoid simply pouring all our content into one large pot, but if we need to aggregate items on our homepage what implications does that have on our structure?\nMeasure twice, cut once # If all the steps above sound like a lot of planning then you’d be correct. However, convincing the customer to pay for a planning phase up front will save everyone time and money later. It’s important to make sure that the creative agency understands that the planning phase is critical to them as well – why rush off and design something beautiful when any of those four elements above may throw the whole design into disarray?\nThe SharePoint Solution # Each of the four areas influences one another and each in turn influences your SharePoint solution design. Technical and budgetary constraints in this area will undoubtedly cause you to revise your plans, but without the information gathered in those four areas of planning you won’t have enough detail to accurately specify and estimate the project, let alone deliver it successfully. In order to deliver, we as practitioners need to understand those four key areas, especially if our customers don’t.\nUseful Reading # Books you may find useful when tackling those four planning areas:\nDon’t make me think – Steve Krug The Elements of Content Strategy – Erin Kissane The Elements of User Experience: User-Centered Design for the Web – Jesse James Garrett Information Architecture for the World Wide Web: Designing Large-Scale Web Sites – Peter Morville \u0026amp; Louis Rosenfeld ","date":"7 December 2011","externalUrl":null,"permalink":"/posts/fundaments-of-planning-your-beautiful-sharepoint-web-site/","section":"Blog","summary":"This article is all about preparation. It’s about the thinking and planning you need to do if you’re going to successfully build your wonderful, unique and striking website on the SharePoint platform.\n","title":"Fundaments of planning your beautiful SharePoint web site","type":"posts"},{"content":"","date":"7 December 2011","externalUrl":null,"permalink":"/tags/sharepoint-2010/","section":"Tags","summary":"","title":"Sharepoint-2010","type":"tags"},{"content":"If you talk to those who know me about my pet hates in SharePoint, the search pages will come up every time. It’s not that I hate search itself – that’s great, but the minimal.master is just plain annoying. It makes the search centre a black hole into which you can fall but not navigate out of – there’s no navigation and the portal site connection doesn’t work.\nI’ve been meaning to get search working with a real master page (step forwards, v4.master) for a while and never got around to it. However, I needed to fix it for a demo and having done so I thought I’d document the steps involved for the world.\nTo set the scene, here are some screenshots of the default Enterprise Search Centre pages:\ndefault searchcentre default searchresults default peopleresults If you climb into site settings and change the Site Master Page to v4.master, this is what you get:\nv4 master search page That’s not very usable, is it. Moreover, if you click the breadcrumbs/portal site connection icon in the top bar you see the following:\nv4 master search page with search box That’s just barking mad, frankly. However, it does give us a solid clue as to how we go about fixing the page.\nStep 1: Fix the layout pages # I had a rummage around the search centre’s masterpage folder and found the cause of our problems. Some bright spark decided to use the PlaceHolderTitleBreadcrumb as the content area to put the search box in. That speaks more about the structure of the minimal.master page than the search layout pages, to be fair. It is most definitely not where it should be, however.\nUsing SharePoint Designer, open your Search Centre SharePoint site and look in the _catalogs\\masterpage folder. In there you will see three page layouts: SearchMain.aspx, SearchResults.aspx and ReopleSearchResults.aspx.\nsharepoint designer masterpages highlighted Let’s do SearchMain first – the site landing page. Right-click the file and choose Edit File in Advanced Mode\nStep 1a: Move the search box to the right place # Find the line that reads:\n\u0026lt;asp:Content ContentPlaceHolderID=\u0026quot;PlaceHolderTitleBreadcrumb\u0026quot; runat=\u0026quot;server\u0026quot;\u0026gt;\nYou want to cut the markup that is inside that content placeholder:\n\u0026lt;SharePoint:UIVersionedContent UIVersion=\u0026#34;3\u0026#34; runat=\u0026#34;server\u0026#34;\u0026gt; \u0026lt;ContentTemplate\u0026gt; \u0026lt;div style=\u0026#34;height:100%; width:100%;padding-left: 18px; padding-top: 50px; padding-bottom: 10px;\u0026#34;\u0026gt; \u0026lt;center\u0026gt; \u0026lt;div style=\u0026#34;width: 510px\u0026#34;\u0026gt; \u0026lt;SPSWC:ListBoundTabStrip ID=\u0026#34;Tab\u0026#34; runat=\u0026#34;server\u0026#34; PersistQueryString=\u0026#34;true\u0026#34; CSSClassNamePrefix=\u0026#34;ms-sctab\u0026#34; ListName=\u0026#34;\u0026lt;%$Resources:Microsoft.Office.Server.Search,SearchCenterOnet_SearchCenterListName%\u0026gt;\u0026#34; ResourceIdforListName=\u0026#34;$Resources:Microsoft.Office.Server.Search,SearchCenterOnet_SearchCenterListName\u0026#34; UnselectedTabTrimLength=\u0026#34;-1\u0026#34;\u0026gt;\u0026lt;/SPSWC:ListBoundTabStrip\u0026gt; \u0026lt;div style=\u0026#34;padding-top: 0px\u0026#34;\u0026gt; \u0026lt;/ContentTemplate\u0026gt; \u0026lt;/SharePoint:UIVersionedContent\u0026gt; \u0026lt;SharePoint:UIVersionedContent UIVersion=\u0026#34;4\u0026#34; runat=\u0026#34;server\u0026#34;\u0026gt; \u0026lt;ContentTemplate\u0026gt; \u0026lt;div class=\u0026#34;srch-sb-main\u0026#34;\u0026gt; \u0026lt;div class=\u0026#34;srch-sb-results4\u0026#34;\u0026gt; \u0026lt;div\u0026gt; \u0026lt;SPSWC:ListBoundTabStrip ID=\u0026#34;Tab1\u0026#34; runat=\u0026#34;server\u0026#34; CSSFileName=\u0026#34;Themable/search.css\u0026#34; PersistQueryString=\u0026#34;true\u0026#34; CSSClassNamePrefix=\u0026#34;ms-sctab\u0026#34; ListName=\u0026#34;\u0026lt;%$Resources:Microsoft.Office.Server.Search,SearchCenterOnet_SearchCenterListName%\u0026gt;\u0026#34; ResourceIdforListName=\u0026#34;$Resources:Microsoft.Office.Server.Search,SearchCenterOnet_SearchCenterListName\u0026#34; UnselectedTabTrimLength=\u0026#34;-1\u0026#34;\u0026gt;\u0026lt;/SPSWC:ListBoundTabStrip\u0026gt; \u0026lt;/div\u0026gt; \u0026lt;div class=\u0026#34;srch-sb-results6\u0026#34;\u0026gt; \u0026lt;/ContentTemplate\u0026gt; \u0026lt;/SharePoint:UIVersionedContent\u0026gt; \u0026lt;WebPartPages:WebPartZone runat=\u0026#34;server\u0026#34; AllowPersonalization=\u0026#34;false\u0026#34; FrameType=\u0026#34;TitleBarOnly\u0026#34; Title=\u0026#34;\u0026lt;%$Resources:Microsoft.Office.Server.Search,LayoutPageZone_TopZone%\u0026gt;\u0026#34; ID=\u0026#34;TopZone\u0026#34; Orientation=\u0026#34;Vertical\u0026#34; QuickAdd-GroupNames=\u0026#34;Search\u0026#34; QuickAdd-ShowListsAndLibraries=\u0026#34;false\u0026#34;\u0026gt;\u0026lt;ZoneTemplate\u0026gt; \u0026lt;WpNs0:SearchBoxEx runat=\u0026#34;server\u0026#34; __MarkupType=\u0026#34;xmlmarkup\u0026#34; WebPart=\u0026#34;true\u0026#34; __WebPartId=\u0026#34;{C00D0719-CF8A-47A2-9E31-FA3F6A38948F}\u0026#34; \u0026gt; \u0026lt;WebPart xmlns:xsi=\u0026#34;[http://www.w3.org/2001/XMLSchema-instance\u0026#34;](http://www.w3.org/2001/XMLSchema-instance\u0026#34;) xmlns:xsd=\u0026#34;[http://www.w3.org/2001/XMLSchema\u0026#34;](http://www.w3.org/2001/XMLSchema\u0026#34;) xmlns=\u0026#34;[http://schemas.microsoft.com/WebPart/v2\u0026#34;](http://schemas.microsoft.com/WebPart/v2\u0026#34;)\u0026gt; \u0026lt;Title\u0026gt;Search Box\u0026lt;/Title\u0026gt; \u0026lt;FrameType\u0026gt;None\u0026lt;/FrameType\u0026gt; \u0026lt;Description\u0026gt;Displays a search box that allows users to search for information.\u0026lt;/Description\u0026gt; \u0026lt;IsIncluded\u0026gt;true\u0026lt;/IsIncluded\u0026gt; \u0026lt;ZoneID\u0026gt;TopZone\u0026lt;/ZoneID\u0026gt; \u0026lt;PartOrder\u0026gt;1\u0026lt;/PartOrder\u0026gt; \u0026lt;FrameState\u0026gt;Normal\u0026lt;/FrameState\u0026gt; \u0026lt;Height /\u0026gt; \u0026lt;Width\u0026gt;800px\u0026lt;/Width\u0026gt; \u0026lt;AllowRemove\u0026gt;true\u0026lt;/AllowRemove\u0026gt; \u0026lt;AllowZoneChange\u0026gt;true\u0026lt;/AllowZoneChange\u0026gt; \u0026lt;AllowMinimize\u0026gt;true\u0026lt;/AllowMinimize\u0026gt; \u0026lt;AllowConnect\u0026gt;true\u0026lt;/AllowConnect\u0026gt; \u0026lt;AllowEdit\u0026gt;true\u0026lt;/AllowEdit\u0026gt; \u0026lt;AllowHide\u0026gt;true\u0026lt;/AllowHide\u0026gt; \u0026lt;IsVisible\u0026gt;true\u0026lt;/IsVisible\u0026gt; \u0026lt;DetailLink /\u0026gt; \u0026lt;HelpLink /\u0026gt; \u0026lt;HelpMode\u0026gt;Modeless\u0026lt;/HelpMode\u0026gt; \u0026lt;Dir\u0026gt;Default\u0026lt;/Dir\u0026gt; \u0026lt;PartImageSmall /\u0026gt; \u0026lt;MissingAssembly\u0026gt;Cannot import this Web Part.\u0026lt;/MissingAssembly\u0026gt; \u0026lt;PartImageLarge /\u0026gt; \u0026lt;IsIncludedFilter /\u0026gt; \u0026lt;ExportControlledProperties\u0026gt;true\u0026lt;/ExportControlledProperties\u0026gt; \u0026lt;ConnectionID\u0026gt;00000000-0000-0000-0000-000000000000\u0026lt;/ConnectionID\u0026gt; \u0026lt;ID\u0026gt;g_c00d0719_cf8a_47a2_9e31_fa3f6a38948f\u0026lt;/ID\u0026gt; \u0026lt;GoImageUrl xmlns=\u0026#34;urn:schemas-microsoft-com:SearchBoxEx\u0026#34;\u0026gt;/_layouts/images/gosearch30.png\u0026lt;/GoImageUrl\u0026gt; \u0026lt;GoImageUrlRTL xmlns=\u0026#34;urn:schemas-microsoft-com:SearchBoxEx\u0026#34;\u0026gt;/_layouts/images/gosearchrtl30.png\u0026lt;/GoImageUrlRTL\u0026gt; \u0026lt;GoImageActiveUrl xmlns=\u0026#34;urn:schemas-microsoft-com:SearchBoxEx\u0026#34;\u0026gt;/_layouts/images/gosearchhover30.png\u0026lt;/GoImageActiveUrl\u0026gt; \u0026lt;GoImageActiveUrlRTL xmlns=\u0026#34;urn:schemas-microsoft-com:SearchBoxEx\u0026#34;\u0026gt;/_layouts/images/gosearchrtlhover30.png\u0026lt;/GoImageActiveUrlRTL\u0026gt; \u0026lt;ShowAdvancedSearch xmlns=\u0026#34;urn:schemas-microsoft-com:SearchBoxEx\u0026#34;\u0026gt;true\u0026lt;/ShowAdvancedSearch\u0026gt; \u0026lt;DropDownModeEx xmlns=\u0026#34;urn:schemas-microsoft-com:SearchBoxEx\u0026#34;\u0026gt;HideScopeDD\u0026lt;/DropDownModeEx\u0026gt; \u0026lt;IsMysiteSearchBox xmlns=\u0026#34;urn:schemas-microsoft-com:SearchBoxEx\u0026#34;\u0026gt;false\u0026lt;/IsMysiteSearchBox\u0026gt; \u0026lt;TextBoxWidth xmlns=\u0026#34;urn:schemas-microsoft-com:SearchBoxEx\u0026#34;\u0026gt;368\u0026lt;/TextBoxWidth\u0026gt; \u0026lt;ShowPerferenceLink xmlns=\u0026#34;urn:schemas-microsoft-com:SearchBoxEx\u0026#34;\u0026gt;true\u0026lt;/ShowPerferenceLink\u0026gt; \u0026lt;ShowQuerySuggestions xmlns=\u0026#34;urn:schemas-microsoft-com:SearchBoxEx\u0026#34;\u0026gt;true\u0026lt;/ShowQuerySuggestions\u0026gt; \u0026lt;SearchBoxVisual xmlns=\u0026#34;urn:schemas-microsoft-com:SearchBoxEx\u0026#34;\u0026gt;SearchCenterDefault\u0026lt;/SearchBoxVisual\u0026gt; \u0026lt;AdvancedSearchPageURL xmlns=\u0026#34;urn:schemas-microsoft-com:SearchBoxEx\u0026#34;\u0026gt;/searchcentre/Pages/advanced.aspx\u0026lt;/AdvancedSearchPageURL\u0026gt; \u0026lt;SearchResultPageURL xmlns=\u0026#34;urn:schemas-microsoft-com:SearchBoxEx\u0026#34;\u0026gt;results.aspx\u0026lt;/SearchResultPageURL\u0026gt; \u0026lt;RegisterStyles xmlns=\u0026#34;urn:schemas-microsoft-com:SearchBoxEx\u0026#34;\u0026gt;true\u0026lt;/RegisterStyles\u0026gt; \u0026lt;ShouldTakeFocusIfEmpty xmlns=\u0026#34;urn:schemas-microsoft-com:SearchBoxEx\u0026#34;\u0026gt;true\u0026lt;/ShouldTakeFocusIfEmpty\u0026gt; \u0026lt;/WebPart\u0026gt; \u0026lt;/WpNs0:SearchBoxEx\u0026gt; \u0026lt;/ZoneTemplate\u0026gt;\u0026lt;/WebPartPages:WebPartZone\u0026gt; \u0026lt;/div\u0026gt; \u0026lt;/div\u0026gt; \u0026lt;SharePoint:UIVersionedContent UIVersion=\u0026#34;3\u0026#34; runat=\u0026#34;server\u0026#34;\u0026gt; \u0026lt;ContentTemplate\u0026gt; \u0026lt;/center\u0026gt; \u0026lt;/ContentTemplate\u0026gt; \u0026lt;/SharePoint:UIVersionedContent\u0026gt; \u0026lt;/div\u0026gt; That code needs to be pasted into the PlaceHolderMain content area, just after the markup to open the content area:\n\u0026lt;asp:Content ContentPlaceHolderID=\u0026quot;PlaceHolderMain\u0026quot; runat=\u0026quot;server\u0026quot;\u0026gt;\nSave the file and take a look, and you should see this:\nedited search centre 1 It’s not quite right – everything’s shifted to the left. We’ll come back to that because it’s not fixable by editing the layout pages.\nYou’ll also notice that there are no breadcrumbs at all so no portal connection.\nStep 1b: Fix the breadcrumbs # We’ll need to get the correct code for the breadcrumbs from another layout page. I grabbed it from the article page layout. It needs to go inside the PlacholderTitleBreadcrumb content area markup.\n\u0026lt;SharePointWebControls:VersionedPlaceHolder UIVersion=\u0026#34;3\u0026#34; runat=\u0026#34;server\u0026#34;\u0026gt; \u0026lt;ContentTemplate\u0026gt; \u0026lt;asp:SiteMapPath ID=\u0026#34;siteMapPath\u0026#34; runat=\u0026#34;server\u0026#34; SiteMapProvider=\u0026#34;CurrentNavigation\u0026#34; RenderCurrentNodeAsLink=\u0026#34;false\u0026#34; SkipLinkText=\u0026#34;\u0026#34; CurrentNodeStyle-CssClass=\u0026#34;current\u0026#34; NodeStyle-CssClass=\u0026#34;ms-sitemapdirectional\u0026#34;/\u0026gt; \u0026lt;/ContentTemplate\u0026gt; \u0026lt;/SharePointWebControls:VersionedPlaceHolder\u0026gt; \u0026lt;SharePointWebControls:UIVersionedContent UIVersion=\u0026#34;4\u0026#34; runat=\u0026#34;server\u0026#34;\u0026gt; \u0026lt;ContentTemplate\u0026gt; \u0026lt;SharePointWebControls:ListSiteMapPath runat=\u0026#34;server\u0026#34; SiteMapProviders=\u0026#34;CurrentNavigation\u0026#34; RenderCurrentNodeAsLink=\u0026#34;false\u0026#34; PathSeparator=\u0026#34;\u0026#34; CssClass=\u0026#34;s4-breadcrumb\u0026#34; NodeStyle-CssClass=\u0026#34;s4-breadcrumbNode\u0026#34; CurrentNodeStyle-CssClass=\u0026#34;s4-breadcrumbCurrentNode\u0026#34; RootNodeStyle-CssClass=\u0026#34;s4-breadcrumbRootNode\u0026#34; NodeImageOffsetX=0 NodeImageOffsetY=353 NodeImageWidth=16 NodeImageHeight=16 NodeImageUrl=\u0026#34;/_layouts/images/fgimg.png\u0026#34; HideInteriorRootNodes=\u0026#34;true\u0026#34; SkipLinkText=\u0026#34;\u0026#34; /\u0026gt; \u0026lt;/ContentTemplate\u0026gt; \u0026lt;/SharePointWebControls:UIVersionedContent\u0026gt; However, if you save the page and view it now you’ll get an error, because that markup references controls that the page doesn’t know about. In order to register them, we need to add a line into the section at the top of the page code that registers tag prefixes:\n\u0026lt;%@ Register Tagprefix=\u0026quot;SharePointWebControls\u0026quot; Namespace=\u0026quot;Microsoft.SharePoint.WebControls\u0026quot; Assembly=\u0026quot;Microsoft.SharePoint, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c\u0026quot; %\u0026gt;\nThe SearchMain.aspx layout page will now work with the v4.master selected.\nYou’ll notice, however, that the ribbon isn’t quite right. That’s because it’s actually in twice – one in the v4.master and once in SearchMain.\nStep 1c: Fix the ribbon # Find the following markup:\n\u0026lt;asp:Content ContentPlaceHolderID=\u0026quot;SPNavigation\u0026quot; runat=\u0026quot;server\u0026quot;\u0026gt;\nAfter that line you’ll see another that reads:\n\u0026lt;SharePoint:UIVersionedContent UIVersion=\u0026quot;4\u0026quot; runat=\u0026quot;server\u0026quot;\u0026gt;\nRight-click the tag and choose ‘select Tag’ from the context menu. Remove the highlighted code and you should be left with an empty SPNavigation content area. If you look at the page now, the ribbon works as it should.\nRun through the same steps with the other search pages. I’m a bit paranoid, so whilst I’m pretty sure the content of the PlaceHolderTitleBreadcrumb is the same for all the layout pages, I always copy and paste the code within the page itself, then add the breadcrumb code afterwards.\nYou should now have a Search Centre that looks like this:\nedited search centre 2 edited searchresults edited peopleresults Step 2: Fix the master page # I said that the annoying shift to the right couldn’t be fixed in the layout pages. We need to edit the master page for that (and/or the styles if you like, but the master page is quicker for just one site).\nRemember: Editing the v4.master page will prevent it being updated if Microsoft release SharePoint patches that include a new version, as we’ve modified the local copy in the site. If you want to be a good SharePoint admin, create a new master page for the search site!\nThis bit’s easy. Search for the line:\n\u0026lt;div class=\u0026quot;s4-ca s4-ca-dlgNoRibbon\u0026quot; id=\u0026quot;MSO_ContentTable\u0026quot;\u0026gt;\nEdit it to read:\n\u0026lt;div class=\u0026quot;s4-ca s4-ca-dlgNoRibbon\u0026quot; id=\u0026quot;MSO_ContentTable\u0026quot; style=\u0026quot;margin-left:0;\u0026quot;\u0026gt;\nAll we’ve done is added a local styling rule to override the ones in the main stylesheets and set the left margin on that element to zero.\nSave the master page and you should now get pages that look like this:\nedited search centre 3 [edited searchresults 2 [edited peopleresults 2 Still to do… # Before you all shout at me, I know that the breadcrumbs don’t display like they ought to. I need to look into that – I remember reading somewhere that they work differently on pages in a page library than elsewhere. I need to do some research and see if I can fix that. Hey – isn’t ditching the minimal.master enough for you?\nNext on the hit list – Access Services sites using minimal.master!\n","date":"12 May 2011","externalUrl":null,"permalink":"/posts/making-sharepoint-2010-search-pages-work-with-a-proper-master-page/","section":"Blog","summary":"If you talk to those who know me about my pet hates in SharePoint, the search pages will come up every time. It’s not that I hate search itself – that’s great, but the minimal.master is just plain annoying. It makes the search centre a black hole into which you can fall but not navigate out of – there’s no navigation and the portal site connection doesn’t work.\n","title":"Making SharePoint 2010 search pages work with a proper master page","type":"posts"},{"content":"A while ago I posted about a hidden feature that was needed if you want to use Managed Metadata columns in your SharePoint 2010 sites. We were doing some 2007-2010 migration work for a client recently that also involved exporting and importing sites and site collections to rework the content structure. Once we’d got the new structure sorted we discovered that content type replication was not occurring on the site collections we had imported. Some comparison of working and non-working SPSite properties with PowerShell later, we discovered that the culprit was the same hidden TaxonomyFieldAdded (ID 73ef14b1-13a9-416b-a9b5-ececa2b0604c) feature as I noted earlier. See my earlier post for instructions on enabling the feature.\nAs an addendum to my earlier post, which has code to enable the feature on a single site, Andy gave me the following snippet that will do it on all sites:\nGet-SPSite -limit ALL |foreach{ Enable-SPFeature \u0026quot;73ef14b1-13a9-416b-a9b5-ececa2b0604c\u0026quot; -url $_.URL }\nI don’t mind hidden features, per se, but when they’re not even logically named so I can associate them with their purpose, it’s annoying and time wasting. Why can’t we simply have a Content Type Subscriber feature that’s not hidden?\n","date":"4 April 2011","externalUrl":null,"permalink":"/posts/content-type-replication-not-working-on-imported-or-migrated-site-collections/","section":"Blog","summary":"A while ago I posted about a hidden feature that was needed if you want to use Managed Metadata columns in your SharePoint 2010 sites. We were doing some 2007-2010 migration work for a client recently that also involved exporting and importing sites and site collections to rework the content structure. Once we’d got the new structure sorted we discovered that content type replication was not occurring on the site collections we had imported. Some comparison of working and non-working SPSite properties with PowerShell later, we discovered that the culprit was the same hidden TaxonomyFieldAdded (ID 73ef14b1-13a9-416b-a9b5-ececa2b0604c) feature as I noted earlier. See my earlier post for instructions on enabling the feature.\n","title":"Content type replication not working on imported or migrated site collections","type":"posts"},{"content":"This one caused some consternation, I can tell you. As usual, the solution could be found on the great wide web, but it took some digging, so as usual I am repeating it here.\nAs part of a SharePoint migration we did recently, we replaced a SharePoint 2007 feature that the client was using (which added content types to libraries from a central list) with a mix of content type replication and PowerShell to add the content types to the libraries.\nThe code below scans through any site collections whose url begins with our $hostheader variable, then adds the list of content types to the Shared Document library in every web in the site collection. It’s a simple modification of some code on Phil Childs’ Get-SPScripts.com site and I take no credit for it – it’s all Phil’s work.\n# Specify name of the library to look for in each site # $hostheader = \u0026#34;http://mywebapp*\u0026#34; $lookForList = \u0026#34;Shared Documents\u0026#34; #find our site collections and run through each in turn # get all the site collections, then step into each site in each site collection # find the list with the name in the var lookforlist # then change content types on the list specified # # note - this will only find site collections where the url starts with the host header var # get-spsite where {$_.url -like $hostheader}| Get-SPWeb -Limit all | ForEach-Object { write-host \u0026#34;Checking site:\u0026#34;$_.Title #Make sure content types are allowed on the list specified $docLibrary = $_.Lists[$lookForList] if ($docLibrary -ne $null) { $docLibrary.ContentTypesEnabled = $true $docLibrary.Update() # Add site content types to the list # change the name in the quotes to the name of your content type # $ctToAdd = $site.RootWeb.ContentTypes[\u0026#34;Word Document\u0026#34;] $ct = $docLibrary.ContentTypes.Add($ctToAdd) write-host \u0026#34;Content type\u0026#34; $ct.Name \u0026#34;added to list\u0026#34; $docLibrary.Title # # Add second site content types to the list # change the name in the quotes to the name of your content type # $ctToAdd = $site.RootWeb.ContentTypes[\u0026#34;Excel Spreadsheet\u0026#34;] $ct = $docLibrary.ContentTypes.Add($ctToAdd) write-host \u0026#34;Content type\u0026#34; $ct.Name \u0026#34;added to list\u0026#34; $docLibrary.Title # # Add third site content types to the list # change the name in the quotes to the name of your content type # $ctToAdd = $site.RootWeb.ContentTypes[\u0026#34;PowerPoint Presentation\u0026#34;] $ct = $docLibrary.ContentTypes.Add($ctToAdd) write-host \u0026#34;Content type\u0026#34; $ct.Name \u0026#34;added to list\u0026#34; $docLibrary.Title # # Update the library object to commit changes # $docLibrary.Update() } else { write-host \u0026#34;The list\u0026#34; $lookForList \u0026#34;does not exist in site\u0026#34; $_.Title } } When we ran this through, however, whilst the content types were added correctly to the libraries, the New menu failed to list them.\nMuch (and I mean much!) digging revealed the cause to be down to a property in the library (spList.RootFolder.UniqueContentTypeOrder) that isn’t automatically set when we add the content types using code (which makes sense when you think about it…). However, all our fiddling with PowerShell failed to work. Adding a content type to the property (which is an array of content types) steadfastly refused to work.\nWe then found a post on the TechNet forums which appeared to give the answer in the form of C# code. We spent a long time on this, so to cut it short: You can’t simply add an item to the UniqueContentTypeOrder property – you have to set it to Null and rebuild it. The trouble is that in order to do that you have to stuff in an object that has an iList interface. Try as we might, we couldn’t create a PowerShell object that would allow us to store an array of ContentTypes and present the iList interface to the UniqueContentTypeOrder property to set the New menu values. Many people said that ArrayList or SortedList should do it, but they didn’t.\nIn the end, then I got our devs to knock up a rough and ready command line tool based on the code in the TechNet post. It’s really rough and ready, so I won’t post it here. Follow the posting and get your own tame devs to do the same. I only hope that this article becomes easier to find on the web to save you guys some time.\n","date":"4 April 2011","externalUrl":null,"permalink":"/posts/content-types-programmatically-added-to-sharepoint-libraries-not-appearing-on-new-menu/","section":"Blog","summary":"This one caused some consternation, I can tell you. As usual, the solution could be found on the great wide web, but it took some digging, so as usual I am repeating it here.\n","title":"Content Types programmatically added to SharePoint libraries not appearing on New menu","type":"posts"},{"content":"","date":"21 February 2011","externalUrl":null,"permalink":"/tags/avviso/","section":"Tags","summary":"","title":"Avviso","type":"tags"},{"content":" We’ve just put a video of the page templates and editing process up on the AvvisoSharePoint YouTube channel. Our plan is to add more videos over time to show the different things Avviso can do. Enjoy!\n","date":"21 February 2011","externalUrl":null,"permalink":"/posts/avviso-page-templates-and-editing-video/","section":"Blog","summary":" We’ve just put a video of the page templates and editing process up on the AvvisoSharePoint YouTube channel. Our plan is to add more videos over time to show the different things Avviso can do. Enjoy!\n","title":"Avviso Page Templates and Editing Video","type":"posts"},{"content":"avvisohead I am really chuffed to have been invited back to NEBytes for a follow-up to my last session on content publishing with SharePoint 2010. This time I’ll be demonstrating Avviso and talking about the thought processes that lead to its development, the problems we are trying to solve and where we’d like to go next.\nIf you’d like more information about Avviso, take a look at my recent post. To see more about NEBytes and their events, check out their web site.\n","date":"15 February 2011","externalUrl":null,"permalink":"/posts/demonstrating-avviso-at-nebytes-on-23rd-february-2011/","section":"Blog","summary":"avvisohead I am really chuffed to have been invited back to NEBytes for a follow-up to my last session on content publishing with SharePoint 2010. This time I’ll be demonstrating Avviso and talking about the thought processes that lead to its development, the problems we are trying to solve and where we’d like to go next.\n","title":"Demonstrating Avviso at NEBytes on 23rd February 2011","type":"posts"},{"content":" Frustrating errors with little or no explanation… # Once again I find myself wiring a blog post in order to save people the time we spent figuring out what was going on and getting help with our fault.\nWe have Microsoft Threat Management Gateway installed at our perimeter. The Exchange 2010 Edge Connector is also installed as our mail gateway, and finally Forefront Protection for Exchange (FPE) deals with mail scanning. There are some gotchas that can trip you up when installing that lot, which I suppose I should put in another post, but the overall result is that you can manage the email filters (spam, malware etc) from within TMG’s console. It’s a nice, unified management interface and a good solution. When it works…\nOur problem, when it occurred, was simple in its symptom – emails were being rejected by our email server. Emails were rejected that we didn’t think should be, and we fiddled with IP allow list settings in TMG for a while to no avail.\nLooking in the event logs we noticed that there were lots of messages with the event ID 31506 and description:\nForefront TMG detected changes in Microsoft Exchange Server or Microsoft Forefront Protection configuration, and reapplied the e-mail policy configuration on server .\nThere are quite a few people on the net with this error. One of the things they experienced, and we also saw, was that the Microsoft Forefront TMG Managed Control service was not running. Lots of messages suggested that restarting that service should do the trick. Lots of other messages also said that the service wouldn’t restart. We saw that too.\nClearing the IP block list is supposed to fix that fault. At first it did for us. To do this open the Exchange Management Shell on your TMG server and use the following powershell:\nget-ipblocklistentry will return a list, if there are any entries.\nremove-ipblocklistentry is the command to delete an item from the list, so get-ipblocklistentry | removeipblocklistentry –confirm:$false will get the block list, pipe the items through the remove command and delete them. The –confirm:$false tells the command just to get on with it and not prompt for confirmation.\nThe trouble was, whilst this worked, the solution was only temporary. We then tried something else (and promptly forgot about it, which will become important in a while).\nWe now found ourselves in a situation where the Microsoft Forefront TMG Managed Control service would not start. This time, whenever we tried to start the service we saw errors in the log with event id 31308 and description:\nThe Forefront TMG Managed Control service failed to initialize. Error information: Value does not fall within the expected range.\nNothing we could do would get this going. Again, people on the web suggested clearing the IP block list but doing so made no difference. We also saw the block list growing rapidly and incoming emails bounced off the spam filter, which we couldn’t disable because the TMG managed control service wouldn’t run.\nWe knocked up a quick powershell script to keep the wolves from the door and dug further. For those in the same boat, the following script simply clears the contents of the block list every 30 minutes and then sleeps.\nfor (;;) { write-host Clearing block list get-ipblocklistentry | remove-ipblocklistentry -Confirm:$False write-host Cleared block list. Now waiting 30 minutes... start-sleep -seconds 1800 } At this point I found a very obscure post talking about the original error we saw and that there is an ‘unofficial’ hotfix available via support. I’ve encountered these before and you have to log a support call to get them, because Microsoft want to make very sure that you are having the problem addressed by the fix. Usually these things get rolled into updates at a later date, once they’ve been through the full raft of testing needed to do so.\nThe hotfix is TMG-ISASE38387-UNOFFICIAL-AMD64-GLB and it was given to us by Microsoft Support in .exe and .msp flavours. Before you all get in touch, no I won’t give you the files. There’s a reason that the product support guys want you to log a call to get hold of this patch and not just install it randomly.\nI dutifully installed the hotfix. It made no difference (or so it appeared) – the Microsoft Forefront TMG Managed Control service still refused to start.\nIt was at this point that we had an epiphany. In our attempts to stop email bouncing we had added items to the IP allow list, but done so through the Forefont Protection for Exchange management console. Interestingly (and importantly), the entries we had added here were not appearing in the Exchange IP Allow list (found by using get-ipallowlistentry in the Management Shell). We removed these entries and tried again.\nThe service started!\nWe then configured the IP allow list in TMG and applied the configuration changes. This time, checking the IP allow list via the management shell returned the entries we were expecting. Our email system has been functioning correctly ever since. The hotfix resolved our original error and our realisation of our mistake corrected the second problem.\nImportant Points # The error, event id 31506, description “Forefront TMG detected changes in Microsoft Exchange Server or Microsoft Forefront Protection configuration, and reapplied the e-mail policy configuration on server .” is a known fault. An unofficial hotfix exists, TMG-ISASE38387-UNOFFICIAL-AMD64-GLB, which addresses the issue, but you MUST engage with Product Support to get it. I am told that the fully tested fix will be included in an update rollup for TMG which is due in February. Don’t make configuration changes via the Forefont Protection for Exchange Server Console if your are running in this integrated setup. As we found, entries to things like the IP Allow List (and I’m guessing IP Block List) will cause the Microsoft Forefront TMG Managed Control service to fail to start with an error, event id 31308 and description ”The Forefront TMG Managed Control service failed to initialize. Error information: Value does not fall within the expected range.”\nNote: We also found that entries added to the IP allow list in FPE didn’t get listed when using the get-ipallowlistentry PowerShell command in the Exchange Management Shell. If your Microsoft Forefront TMG Managed Control service does fail to start, check that you haven’t made configuration changes through FPE. The Exchange Management Console on TMG is clever enough to not let you make changes like this, but FPE isn’t. ","date":"26 January 2011","externalUrl":null,"permalink":"/posts/errors-with-tmg-exchange-edge-connector-fpe-resulting-in-rejected-emails/","section":"Blog","summary":"Frustrating errors with little or no explanation… # Once again I find myself wiring a blog post in order to save people the time we spent figuring out what was going on and getting help with our fault.\n","title":"Errors with TMG + Exchange Edge Connector + FPE resulting in rejected emails","type":"posts"},{"content":"","date":"26 January 2011","externalUrl":null,"permalink":"/tags/exchange/","section":"Tags","summary":"","title":"Exchange","type":"tags"},{"content":"","date":"26 January 2011","externalUrl":null,"permalink":"/tags/forefront-protection-for-exchange/","section":"Tags","summary":"","title":"Forefront Protection for Exchange","type":"tags"},{"content":"","date":"26 January 2011","externalUrl":null,"permalink":"/tags/threat-management-gateway/","section":"Tags","summary":"","title":"Threat Management Gateway","type":"tags"},{"content":"words and pictures logo Last week was really exciting for me and my colleagues here at Black Marble as the work we’ve been doing with a partner came to fruition. Words and Pictures are a communications agency based not far from us, and we’ve been working together on a great product that builds upon SharePoint 2010 to greatly improve content publishing.\nI’ll come to the product in a little while, but I’d like to talk about how we created it first, as it’s a great example of how working together within the Microsoft space can help companies build upon their strengths and overcome their weaknesses.\nA tale of two specialisms # I first encountered Words and Pictures at one of a series of events Black Marble ran to explain the Microsoft offerings that exist in the creative space, targeted at design and creative agencies. In the event we talked about a range of technologies, including Silverlight, web technologies and SharePoint, and how creative agencies could use those technologies to deliver the kind of vibrant material their clients were looking for. It was a good example of the evangelism we spend a fair amount of our time engaged in, and it was an interesting way for us to explore how we might use our technical skills to fill the gaps experienced by creative agencies.\nBlack Marble are, as I’m sure you know as readers of the blogs on this site, technical specialist. We are extremely good at delivering solutions to business problems by tailoring or even creating IT systems to meet our customers’ needs.\nWords and Pictures have turned out to be a kind of creative analogue of Black Marble. They are a well respected organisation that specialise in delivering great services for businesses centred around communications. Be it for an internal or external audience, Words and Pictures write, design and deliver a range of communication channels for their customers. Historically, this had been predominantly printed content of one form or another, but in today’s fast changing world their customers are starting to shift to digital delivery.\nA meeting of minds; clarity of vision # Words and Pictures got in touch with us directly because they thought that SharePoint 2010 might be a good content delivery platform for them to focus on as their customers shifted towards digital delivery. They had already had feedback from the organisations they supported that SharePoint was becoming an almost ubiquitous system across the panoply of Words and Pictures’ customers. This awareness, couple with the demonstrations we had given at our design event around what SharePoint could do for content publishing, had led them to believe that SharePoint was the right choice. Now they had lots of questions about whether it would do what they wanted.\nIn situations like this, where a client believes SharePoint is the right choice but is unsure how to proceed with implementation, I like to run a Vision Workshop with them. The idea is that we forget they ever mentioned SharePoint and instead talk about what they do as a business – their operations, problems, aims and aspirations. I can then reflect that back at them, matching SharePoint’s capabilities to their needs in the short, medium and long term.\nThe workshop at Words and Pictures was an eye-opener for me!\nI arrived at their very nice offices in a very nice part of Yorkshire and found myself in a room with the biggest whiteboard I’d ever seen. Over the course of the day, that whiteboard was filled, erased and re-filled with ideas, drawings and diagrams to illustrate the ideas, concepts and desire that Words and Pictures had. During that day a small number of very passionate specialists in journalism and content creation emptied their collective experience onto the wall and as I took more and more notes and thought more and more about how SharePoint might help, I became more and more convinced that something great could come out of this.\nA panoply of features # The vision workshop threw up a huge amount of information about how Words and Pictures needed to create, manage and publish digital content in the same manner as they currently managed their printed content. We quickly realised that if we extended SharePoint to match these needs, the solution we created would be useful to more than simply Words and Pictures. As we talked it through the idea of a content publishing framework that would sit on top of and extend the capabilities of SharePoint was born. Such a framework would bring SharePoint’s publishing model more in line with the processes used by both an agency like Words and Pictures and the Internal Communications teams within their client organisations. It could also greatly improve the services Black Marble were increasingly finding ourselves working on for customers in both intranet and external web publishing scenarios.\nA product is born # avviso logo Working closely together, building on all of our expertise, Words and Pictures and Black Marble have created Avviso. It was launched last week at events at Black Marble’s offices and Microsoft’s London offices. I was really enthused by the reception we received from the audience at both events. Avviso was met with a great deal of interest and enthusiasm which really made the development journey worthwhile.\nWords and Pictures came up with the name. For those who are curious:\nAn Avviso was a hand-written newsletter used to convey political, military, and economic news quickly and efficiently throughout Europe, and more specifically Italy, during the early modern era (1500-1700). In the beginning avvisi were very similar to letters written from one dignitary to another, but diverged from such letters in the sixteenth century with more standardized practices.\nI think it’s a great name. It’s both catchy and memorable, whilst at the same time meaningful and relevant to what the product does.\nSo what does it do? # Avviso contains a wealth of extensions to the SharePoint platform that enables better creation of rich, impactful published content: Crisp template-based pages as well as the ability to produce unique, vibrant designs; the ability to create features and article series; better categorisation and aggregation of content; richer content management for published pages. Importantly, we’ve only begun to tackle the list of ideas that came out of that original vision workshop, so there is a solid roadmap for new features that will be delivered through regular version updates.\nI’m not going to detail features here. There is a product website at avvisosharepoint.co.uk and if you want to know more, get in touch with us. We have more events planned for the new year, both in the north and south of the UK so we can offer you a chance to see it in the flesh.\nHere are some examples of the kind of pages Avviso can help you build, using some sample content from Words and Pictures.\nriverhomepage An intranet home page with aggregated content and rich multimedia.\nflintfocus An article with bespoke design applied\nfuturefeature A feature splash page, with links to articles in the feature\nchallengearticle An article built using a standard template\nThe London launch # The London launch event was at the Microsoft offices in Cardinal Place. Andy Holt, Creative Director of Words and Pictures, and myself were the presenters, ably assisted by Jon Eland, also from Words and Pictures. It was a great room and it was good to see so many enthusiastic attendees. We were lucky that it didn’t snow until the evening! Words and Pictures had designed some great bags and pamphlets for the guests and Black Marble made sure that chocolates were close at hand!\nI really enjoy presenting with Andy. We have a similar dynamic to how Andy Dawson and I present at Black Marble events, but at the same time our differing backgrounds of creativity and technology allow us to bounce off each other and really explain how Avviso works and what we’re trying to deliver.\njonprep andypresent avvisobags Lessons learned # I’ve learned a great deal from my experiences during the conception and creation of Avviso. I think one of the most important things has been to reinforce my thoughts about approaching SharePoint solutions. By ignoring SharePoint and focusing on what Words and Pictures needed as an organisation in terms of their process we were able to generate a rich wish-list of functionality that could then be matched against existing SharePoint features and inform what we would need to develop from scratch. The things that Words and Pictures described added so much to my understanding of the needs of content publishing that I can help other customers deliver better intranets, extranets and internet sites (hopefully using Avviso!).\nIgnore the technology. Talk about process, business needs, problems and goals. Teach and learn. Understand each other’s specialism and explain domain terminology. Concentrate on your area of expertise. Don’t try to second-guess each other’s approach to a problem. Draw lots of pictures and diagrams. Write lots of notes. Relationships are important. Build the team with individuals who can work well together. Time invested in getting to know each other is time well spent. ","date":"21 December 2010","externalUrl":null,"permalink":"/posts/avviso-a-content-publishing-framework-for-sharepoint-2010/","section":"Blog","summary":"words and pictures logo Last week was really exciting for me and my colleagues here at Black Marble as the work we’ve been doing with a partner came to fruition. Words and Pictures are a communications agency based not far from us, and we’ve been working together on a great product that builds upon SharePoint 2010 to greatly improve content publishing.\n","title":"Avviso: A Content Publishing Framework for SharePoint 2010","type":"posts"},{"content":" A sensible plan # This is a torrid tale of frustration and annoyance, tempered by the fun of digging through system commands and registry entries to try and get things working.\nWe’ve been restructuring our network at Black Marble. The old single subnet was creaking and we were short of addresses so we decided to subnet with network subnets for physical, virtual internal and virtual development servers, desktops, wifi etc. We don’t have a huge amount of network equipment, and we needed to put virtual servers hosted on hyper-v on separate networks so we decided to use VLANs.\nOur new infrastructure has one clever switch that can generate all the VLANs we need, link those VLANs to IP subnets and provide all the routing between them. By doing it this way we can present any subnet to any port on any switch with careful configuration and use of the 802.1Q VLAN standard. Hyper-V servers can have a single physical interface with traffic from multiple VLANs flowing across it to the virtual switch, with individual VMs assigned to specific VLANs.\nWe did the heavy lifting of the network move without touching our Hyper-V cluster, placing all the NICs of all the servers on the VLAN corresponding to our old IP subnet. We then tested VLANs over the virtual switch in Hyper-V using a separate server and made sure we knew how to configure the switch and Hyper-V to make it all work.\nThen we came to the cluster. Running Windows 2008 R2 Server Core.\nSince we built the cluster Andy and I have come to decide that if we ever rebuild it, server core will not be used. It’s just too darn hard to configure when you really need to, and this is one of those times.\nA tricky situation # Before we began to muck around with the VLAN settings, we needed to change the default gateway that the servers used. The old default gateway was the address of our ISA (now a shiny TMG) server. That box is still there, but now we have the router at the heart of the network, whose address is the new default gateway.\nTo change the default gateway on server core we need a command line tool. Enter Netsh, stage left.\nWe first need to list the interfaces so we know what we’re doing. IPConfig will list the interfaces and their IP settings. Old lags will no doubt abbreviate the netsh commands that we need next but I’ll write them out in full so they make sense.\nGive me a list of the physical network adapters and their connection status: netsh interface show interface\nShow me the IPV4 interfaces: netsh interface ipv4 show interface\nTo change the default gateway we must issue a set command with all the IP settings – just entering the gateway will not work as all the current settings get wiped first:\nnetsh interface ipv4 set address name=\u0026quot;\u0026lt;name\u0026gt;\u0026quot; source=static address=x.x.x.x mask=255.255.255.0 gateway=x.x.x.x\nWhere is the name shown in the IPV4 interface list, which will match the one shown in the ipconfig output that you want to change the gateway for. We’re using a class C subnet structure – your network mask may vary.\nIt’s worth pointing out that we stopped the cluster service on the server whilst we did this (changing servers one by one so we kept our services runnning).\nWe had two interfaces to change. Once corresponded to the NIC used to manage the server and the other corresponded to the one used by the virtual switch for Hyper-V. That accounted for two of the four NICs on our Sun X2200-M2’s, with the SAN iSCSI network taking a third. The SAN used a Broadcom, the spare was the other Broadcom and the others used each of the two nVidia NICs on the Sun (that will become important shortly).\nA sudden problem # Having sorted the IP networking our next step was to sort out the VLAN configuration. To do that we changed the switch port that the NIC hosting the hyper-V virtual switch was connected to from being an untagged member of only our server subnet VLAN to being a tagged member of that VLAN and a tagged member of the new VLAN corresponding to our subnet for virtual internal servers.\nThe next step was to set the VLAN id for a test VM (we could ignore the host as it doesn’t share the virtual switch – it has it’s own dedicated NIC).\nThe snag was, the checkbox to enable VLAN ids was disabled when we looking in Hyper-V manager, both for the virtual switch and for the NIC in the VM.\nSome investigation and checking of our test server showed that the physical network driver had a setting, Priority and VLAN, that needed to be set to enable priority and VLAN tagging of traffic, and that the default state was priority only. On full server that’s a checkbox in the driver setting. On server core…?\nSo, first of all we tried to find the device itself. Sadly, the server decided that remove management of devices from another server wasn’t going to be allowed, despite reporting that it should be. So we searched for command line tools.\nTo query the machine so it lists visible hardware devices: sc query type= driver (note the space before \u0026lsquo;driver\u0026rsquo;)\nThat will give you a list, allowing you to find the network device name.\nFor our server, that came back with nvenetfd – the nVidia NIC.\nTo use that name and find the file responsible: sc qc \u0026lt;device name\u0026gt; (in our case nvenetfd )\nThat returned the nvm62x64.sys driver file. Nothing about settings, but it allowed us to check the driver versions. Hold that thought, I’ll come back to it shortly.\nMeanwhile # We’d also been poking at the test server, looking at the NIC settings. Logic suggested that the settings should be in the registry – all we have to do was find them.\nI’ll save you the hunt:\nHKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Class\\{4D36E972-E325-11CE-BFC1-08002BE10318}\nThat key holds all the Network Adapters. There are keys beneath that are numbered (0000, 0001, etc). The contents of those keys enabled us to figure out which key matched which adapter. Looking at the test server and comparing it to the server- core hyper-v box we found a string value call *PriorityVlanTag which had a value of 3 on the test server (priority and vlan enabled) and 1 on the hyper-v box. We set the hyper-v box to 3. Nothing. No change. We rebooted. Still nothing.\nThen we noticed that in the key for the NIC there was a subkey: \\Ndi\\params. In there was a key called *PriorityVlanTag. In that key were settings listing the options that were displayed in the GUI settings dialog, along with the value that got set. For the nVidia the value was 2, not 3. We duly changed the value and tried again. Nothing.\nSo we decided to update the drivers. This brings us back to where I left us earlier with the sc command.\nTo update a driver on server core, you need to unpack the driver files into a folder and then run the following:\npnputil –i –a \u0026lt;explicit path to driver inf file\u0026gt;\nAfter failing to get any other drivers to install it looked like we had the latest version and the system was not letting go. So we did some more research on the internet (what did we ever do before the internet?).\nIt transpires, for those of you with Sun servers, that the nVidia cards appear not to support VLAN ids on traffic, despite having all the settings to suggest that they do.\nDarn.\nA way forward # Fortunately we have a spare broadcom on each of our hyper-v host servers. We are now switching the virtual switch binding from the nVidia to the broadcom on each of our servers. We didn’t even have to hack around with registry settings once we did that the VLAN id settings in Hyper-V simply sprang into life.\nThe moral of this story is that if you want to use VLAN id’s with Hyper-V and your server has nVidia network adapters (and certainly if it’s a Sun X2200-M2) then stop now before you lose your hair. You need to use another NIC, if you have one, or install one if you don’t. Hopefully, however, the command line tools and registry keys above will help other travellers who find themselves in a similar situation to ourselves.\n","date":"6 December 2010","externalUrl":null,"permalink":"/posts/server-core-hyper-v-and-vlans-an-odyssey/","section":"Blog","summary":"A sensible plan # This is a torrid tale of frustration and annoyance, tempered by the fun of digging through system commands and registry entries to try and get things working.\n","title":"Server Core, Hyper-V and VLANs: An Odyssey","type":"posts"},{"content":"","date":"6 December 2010","externalUrl":null,"permalink":"/tags/x2200-m2/","section":"Tags","summary":"","title":"X2200-M2","type":"tags"},{"content":"When migrating from SharePoint 2007 to 2010, no matter how hard you try there’s always the chance the the content database upgrade process will throw out errors about features being referenced that are not present in the farm. We have used Stefan Goßner’s WssAnalyzeFeatures and WSSRemoveFeatureFromSite (see his original article) to track down the references and exterminate them. It’s not the fastest thing on two legs though, and I have a fondness for having my SharePoint 2010 tooling in PowerShell because of the flexibility it gives me.\nHere then, with a big hat-tip to Stefan, is the PowerShell to replicate his functionality. We differ slightly, in that I wanted one command to purge both site- and web-referenced features in one shot rather than calling a command with a scope switch. I have two functions – get-spmissingfeatures takes a Site Collection url as a parameter and scans through site and web feature collections, listing any features with a null definition property. The second function, remove-spmissingfeatures takes the same url and this time finds and removes the errant features in one pass.\nGet-SpMissingFeatures:\nfunction get-spmissingfeatures([string]$siteurl) { $site = get-spsite $siteurl` foreach ($feature in $site.features) { if ($feature.definition -eq $null) { write-host \u0026#34;Missing site feature:\u0026#34; write-host $feature.DefinitionId write-host $feature.parent } } $webs = $site | get-spweb -limit all foreach ($web in $webs) { foreach ($feature in $web.features) { if ($feature.definition -eq $null) { write-host \u0026#34;Missing web feature:\u0026#34; write-host $web.url write-host $feature.DefinitionId write-host $feature.parent } } } } Remove-SPMissingFeatures:\nfunction remove-spmissingfeatures([string]$siteurl) { $site = get-spsite $siteurl` foreach ($feature in $site.features) { if ($feature.definition -eq $null) { write-host \u0026#34;Missing site feature:\u0026#34; write-host $feature.DefinitionId write-host $feature.parent $site.features.remove($feature.DefinitionId) } } $webs = $site | get-spweb -limit all foreach ($web in $webs) { foreach ($feature in $web.features) { if ($feature.definition -eq $null) { write-host \u0026#34;Missing web feature:\u0026#34; write-host $web.url write-host $feature.DefinitionId write-host $feature.parent $web.features.remove($feature.DefinitionId) } } } } ","date":"19 November 2010","externalUrl":null,"permalink":"/posts/powershell-to-find-missing-features-in-sharepoint-2010/","section":"Blog","summary":"When migrating from SharePoint 2007 to 2010, no matter how hard you try there’s always the chance the the content database upgrade process will throw out errors about features being referenced that are not present in the farm. We have used Stefan Goßner’s WssAnalyzeFeatures and WSSRemoveFeatureFromSite (see his original article) to track down the references and exterminate them. It’s not the fastest thing on two legs though, and I have a fondness for having my SharePoint 2010 tooling in PowerShell because of the flexibility it gives me.\n","title":"Powershell to find missing features in SharePoint 2010","type":"posts"},{"content":"We’re working on a solution at the moment that uses a custom site definition. For various reasons we stated with the Blank Site definition and worked from there. Our customisations include content types using custom columns that link to managed metadata term sets. We create all those through features – great! The tricky bit came when after deployment our managed metadata columns were greyed out. Examining the column we say an error telling us that the feature supporting the functionality was not activated.\nWhat feature?\nAfter quite a bit of hunting it turns out that there is a site collection feature called TaxonomyFieldAdded (ID 73ef14b1-13a9-416b-a9b5-ececa2b0604c) that is needed to allow the column to connect to the term set. The problem is that it’s a hidden feature so you can’t switch it on through the web site. Obviously we can enable it programmatically, but for anybody who has this problem (can’t connect a custom column to a term set) here is some simple PowerShell to enable it:\nget-spfeature | where {$_Id –eq “73ef14b1-13a9-416b-a9b5-ececa2b0604c”} | enable-spfeature –url \u0026lt;site collection url\u0026gt;\n","date":"11 November 2010","externalUrl":null,"permalink":"/posts/enabling-the-taxonomyfieldadded-feature-to-fix-managedmetadata-column-errors/","section":"Blog","summary":"We’re working on a solution at the moment that uses a custom site definition. For various reasons we stated with the Blank Site definition and worked from there. Our customisations include content types using custom columns that link to managed metadata term sets. We create all those through features – great! The tricky bit came when after deployment our managed metadata columns were greyed out. Examining the column we say an error telling us that the feature supporting the functionality was not activated.\n","title":"Enabling the TaxonomyFieldAdded feature to fix ManagedMetadata Column errors","type":"posts"},{"content":"On the 17th of November I’ll be keeping Richard company on the drive up to Newcastle to speak at the NEBytes user group. My session will be a shortened version of the Using SharePoint for Content publishing I will deliver at the Black Marble event on November 3rd. I will be showing what can be done with SharePoint 2010 when the brief is for a content publishing site, be it internet- or intranet-facing and I will talk about the things we have learned along the way whilst delivering such projects – things to avoid as well as things that work well.\nRichard is talking about using Typemock Isolator in testing, providing the developer half of the usual NEBytes Developer/IT Pro split. The guys at NEBytes put a huge amount of effort into the community and it will be great to see Andy et al again.\n","date":"2 November 2010","externalUrl":null,"permalink":"/posts/speaking-at-nebytes-in-november-on-sharepoint-for-content-publishing/","section":"Blog","summary":"On the 17th of November I’ll be keeping Richard company on the drive up to Newcastle to speak at the NEBytes user group. My session will be a shortened version of the Using SharePoint for Content publishing I will deliver at the Black Marble event on November 3rd. I will be showing what can be done with SharePoint 2010 when the brief is for a content publishing site, be it internet- or intranet-facing and I will talk about the things we have learned along the way whilst delivering such projects – things to avoid as well as things that work well.\n","title":"Speaking at NeBytes in November on SharePoint for Content Publishing","type":"posts"},{"content":"","date":"22 October 2010","externalUrl":null,"permalink":"/tags/acer-aspire-1420/","section":"Tags","summary":"","title":"Acer-Aspire-1420","type":"tags"},{"content":"This blog has been a very quiet place for a long time now, reflecting somewhat how busy I have been elsewhere. During this period of heavy work I have found a new friend in my Aspire 1420P. In some ways it’s sad – my trusty and reliable Dell Mini 9 has been neglected in favour of a younger, sexier model.\ntablet mode The 1420P is the production model Acer convertible tablet, a variant of which was given to all Microsoft PDC conference attendees last year. We have quite a few in the office; sadly I am the only person to have paid for theirs. However, I benefit greatly from the fact that mine has a UK keyboard with all the right keys in their correct and proper places.\nPersonally, I think you get quite a lot for your money. For about £400 I have a lightweight, highly portable machine with ample power to perform the daily chores I give to it. I will admit that the first thing I did upon taking it from its box was to add a further 2Gb or RAM to its shipping quota of 2Gb, but many will not find the need to do so.\nI thought long and hard before purchasing the 1420. I already have my workhorse laptop – the excellent TravelMate 6593 – which runs the things I need for the more technical aspects of my working life. However, it’s 15.4” frame weighs heavy when doing light work on the sofa in an evening, and it’s not great for casual web browsing.\nI was finding myself more and more using my iPhone for casual web browsing, email reading and research. It was far easier than having a laptop on my knee, browsing with the touchpad and keyboard. I was seriously considering an iPad – the slate form factor and extreme usability were attractive. I had an eye on the HP Slate so loudly trumpeted b Steve Ballmer before it vanished frustratingly from view.\nThere were two problems with the iPad approach: Firstly, being a Yorkshireman, I found the price a little steep for an iPhone on steroids; secondly, and not unrelated to my opinion of the price, it was not as functional and flexible as I wanted.\nThe 1420P meets my needs ably. For casual web browsing, research and email it spends most of its life in tablet form, running portrait mode as I browse the web using nothing but the touch screen. When I use it for document writing or bits of sysadmin work it turns easily back to a traditional notebook form factor.\nslate mode It’s not perfect. The techy in me wishes that the touch screen was more than a mere 2-point variety; it would be nice if the display was a higher resolution than the now ubiquitous 1366x768, but that’s possibly because I am spoiled by the magnificent 1650x1080 of my TravelMate; the lack of a docking station connector makes it less convenient for use as a workhorse office computer; and it suffers in comparison with the iPad in terms of user interface for touch alone (this isn’t really the fault of the hardware, I suppose).\nIt’s qualities far outweigh the shortfalls, however. It weights almost nothing, and I can comfortably get eight hours from a full charge which means that the charger (itself small and lightweight) becomes an optional extra for short trips. The glossy screen is bright and clear (although like all glossy screens it suffers in bright light) and does not suffer like the Dell Mini when browsing the web; the keyboard is comfortable and responsive to use and causes me no trouble when working on long documents; finally, and my favourite part, when in tablet mode it is comfortable to hold and natural to use.\nWhich brings me to something I find really significant about convertibles. When I’m in a meeting I hate using a laptop. I find that the screen immediately forms a barrier between participants and I hate thinking that behind that barrier the person could be doing something other than concentrating on the x7686meeting. I prefer to use a pen and paper as a result, but that means I need to transcribe notes later. The convertible 1420 allows me to switch to tablet mode and use OneNote and the stylus. I have all the benefits of a computer in front of me so I can access documents, email and other resources on demand, but the computer does not come between me and the other attendees. OneNote also allows me to quickly generate notes, tasks, actions and more without leaving the application.\nSpecification:\nSize 285 x 208.9 x 28.5 mm Weight 1.72kg Screen Resolution 1366x768 Multi-touch 2-point Processor Intel Celeron U2300 Memory 2Gb (upgraded to 4Gb) Hard drive 160Gb Price approx. £400 ","date":"22 October 2010","externalUrl":null,"permalink":"/posts/living-with-the-acer-aspire-1420p/","section":"Blog","summary":"This blog has been a very quiet place for a long time now, reflecting somewhat how busy I have been elsewhere. During this period of heavy work I have found a new friend in my Aspire 1420P. In some ways it’s sad – my trusty and reliable Dell Mini 9 has been neglected in favour of a younger, sexier model.\n","title":"Living with the Acer Aspire 1420P","type":"posts"},{"content":"User profile photos have changed in SharePoint 2010 in that they are now stored in a single image library in the MySite Host root site collection. They have also changed in that when you change the profile photo, SharePoint takes the file and creates three new images at specific sizes, then discards the file you gave it. These files have specific names to link them to the user account and come in small, medium and large flavours.\nWe’ve just delivered a solution to a customer that involved heavy customisation of the Profile page for users. This also involved replacing the large thumbnail version of the profile picture with one which met our size requirements.\nThe customer had a large group of image files all named in the pattern . which had been loaded in to SharePoint as profile pictures. We wanted a quick way to replace the large thumbnail with our own version.\nEnter Powershell, stage left. The script below is a little rough and ready but works great. It gets a directory listing, splits the filename and then looks up in AD to see if there’s a user that matches the filename (sans extension). If it finds a match it renames the file to match the pattern \u0026lt;SamAccountName\u0026gt;\\LThumb. to match the profile picture naming convention.\nAs I said, it’s a little rough and ready but I place here for the greater good. You need the ActiveDirectory powershell module to use this. It’s available on Server 2008 and above, and Windows 7 if you install the remote management tools.\nThe Active Directory Powershell Blog is a great resource for this stuff!\n#import-module ActiveDirectory if (-not (get-module -name activedirectory)) { write-host \u0026#34;This script requires the ActiveDirectory powershell modules to run\u0026#34; exit } $domain=\u0026#34;mydomain\u0026#34; $filesuffix = \u0026#34;LThumb\u0026#34; $files = get-childitem foreach ($file in $files) { $filesplit = $file.Name.split(\u0026#34;.\u0026#34;) $fullname = $filesplit[0] $fileext = $filesplit[1] write-host \u0026#34;Searching for:\u0026#34; $fullname $user = get-aduser -Filter { Name -eq $fullname } if ($user.SamAccountName -eq $Null) { write-host \u0026#34;Not Found!\u0026#34; } else { $newfilename = $domain+\u0026#34;_\u0026#34;+$user.SamAccountName+\u0026#34;_\u0026#34;+$filesuffix+\u0026#34;.\u0026#34;+$fileext write-host \u0026#34;Renaming:\u0026#34; $file.name \u0026#34;New name:\u0026#34; $newfilename rename-item $file.Name $newfilename } } ","date":"29 July 2010","externalUrl":null,"permalink":"/posts/powershell-script-to-rename-files-for-use-as-sharepoint-2010-user-profile-thumbnails/","section":"Blog","summary":"User profile photos have changed in SharePoint 2010 in that they are now stored in a single image library in the MySite Host root site collection. They have also changed in that when you change the profile photo, SharePoint takes the file and creates three new images at specific sizes, then discards the file you gave it. These files have specific names to link them to the user account and come in small, medium and large flavours.\n","title":"Powershell script to rename files for use as SharePoint 2010 User Profile thumbnails","type":"posts"},{"content":"","date":"9 June 2010","externalUrl":null,"permalink":"/tags/bcs/","section":"Tags","summary":"","title":"Bcs","type":"tags"},{"content":"Stepping along the path ploughed by Richard and Robert, I thought I’d try to order my thoughts on the BCS EGM through a blog post. Like Richard, I am (as I begin writing) uncertain as to my final leaning on this, although I have clear views on some of the issues.\nDemocracy In Action # One of the most important, in my view, is one which might be missed by many. Should the membership vote in favour of the Board of Trustees they are also strongly encouraged to change the bye-laws of the Royal Charter to stop this happening again.\nFor me, that is an atrocity and should not be allowed. That’s a strong word, so let me explain why.\nThe membership of the BCS is being swelled through the push for a higher profile. That’s a good thing, no doubt. However, two percent of an ever increasing membership base quickly becomes a large number of people. The time and effort involved in trying to marshal that many people to raise an object to how the BS is working effectively means that it will never happen. I believe that to be incredibly undemocratic.\nFurthermore, the kind of member who is likely to pay enough attention to the actions of the BCS to raise an objection is much more likely to have attained a higher level of membership, such as Fellow. There aren’t many of those about, and I’ll wager that there certainly aren’t enough to amount to two percent!\nArguably what we are currently experiencing is a good thing. A group of highly committed members have used the mechanisms embedded in the charter of our professional body to put the brakes on a process which they believe requires greater scrutiny by the whole membership. Should the EGM vote go against those members, they should still be commended for having the courage and commitment to the BCS that they fought to initiate the process at all.\nFor the good of the members # The purpose of a professional body such as the BCS is to provide those outside of our industry with a recognisable ‘Kite Mark’ of quality when it comes to engaging the services of IT practitioners. Everything else that the organisation does should revolve around that most important premise.\nIf we follow the line of reasoning which identifies the activities which must flow from the above aim we will quickly find ourselves in the heart of the current argument.\nAffirmation of Qualifications # Other professional bodies are extremely careful about how their members qualify for the professional qualifications they offer. This is a critical matter, in that it underpins the level of trust the outside world places on the body in question and its assertions as to the professionalism and trustworthiness of its members.\nIt worries me, therefore, that current implications suggest CITP seems to be a qualification along the lines of a Readers Digest competition – fill in the form, everybody must win!\nIt worries me even more because, as someone who is not a developer, the more rigorous path of CEng is not open to me. For IT professionals like me, the CITP must be a thorough assessment of the skill and integrity of the bearer or it becomes worthless.\nI say this as somebody who has achieved CITP status. When I went through the process the level of detail I had to provide was actually quite high, and references were needed from other members of the BCS who were already of Chartered status (CITP or CEng) or higher. Had I not worked in the industry for so long, with such a varied wealth of experience from different roles, I am not sure I would have made the grade. That is absolutely how it should be.\nThe very fact that there are those within the BCS who cast doubts as to the validity of the CITP status inherently means that there are doubts as to that validity and it is therefore of far less value. This is a rapidly accelerating downward spiral which has important ramifications for the body.\nPromotion of the Body and its role # There is no point having a professional body which underwrites the quality of practice in its industry if nobody is aware of it. For many years, working in IT, I dismissed the BCS as a group of fusty academics who were not in touch with the rapidly moving industry that I loved to be a part of. That the current BCS management have been striving to change that is to be applauded.\nIT is an still immature industry. With such immaturity and rapid change there will inevitably be crises. It is the role of the BCS to wade into all these and advise, mediate and in some cases dictate in line with the levels of professionalism it seeks to underwrite in the industry. It cannot perform that role if nobody is aware of its existence.\nAt the same time, however, the BCS is, in reality, somewhat of a toothless tiger. We do not work in an industry where lack of professional qualifications is a barrier to practice. Perhaps that is wrong, perhaps no; there are very clear arguments to be made in favour of both views.\nSacrificed on the alter of our own success # IT as an industry has a problem. Some aspects of it, one can argue, fall into a similar professional services area to those of the legal and accounting professions. You would never hire an unqualified and unregulated accountant, so why should you use IT professional services that are not similarly regulated.\nMany IT projects, particularly for large organisations and functions where lives are at stake, are held up as abject failures and stain the reputation of our industry. Would the threat of being cast out of the BCS and therefore being unable to continue to practice improve the level of conduct and professionalism of those involved in such projects? Who can say?\nAt the same time, however, ours is an area of extreme innovation at a pace so rapid as to be frightening. A prescriptive professional body might prevent such innovation (or at least force it outside the UK, which helps nobody). In areas such as the web, technology advances faster than any regulations could cope with, however responsive to change they might be.\nThat second situation demands a body more in line with the other engineering disciplines. They are looked upon to provide a guarantee of skill, knowledge, approach and practice to give confidence in those consuming the services of their practitioners.\nUltimately, the BCS has now reached a point where it does none of the above:\nThere is no regulation of our industry, so the BCS is not an institution which safeguards quality of practice. The CITP has little value in the eyes of many because they perceive it to be to easy to achieve and too little scrutinised. If the CITP is to easy, what does that say for the CEng awarded by the BCS? What good is self promotion if it merely promotes your own inadequacies? Where does this leave the BCS? I would seem to be approaching a bleak conclusion!\nSummation # It is clear that careful examination of the issues driving the actions which have led to the EGM takes us down an existential rabbit-hole. Let us then zoom out and ask some simple questions which might help us (I am not going to answer them – you must answer them for yourself and let that guide your vote):\nCan we find information that tells us what the current management are doing, not just in broad strokes that outline a strategy but in more detail as to the implementation of that strategy?\nIf the answer is yes, then we have the transparency which those who have called the EGM have implied does not exist. If not, then the arguments of the dissenters have obvious validity. Are we comfortable with management that, faced with a situation which is uncomfortable for them (the EGM) wishes to change the constitution of the organisation to prevent the situation ever occurring again. Conclusion # I think I have come to a conclusion during the course of writing this. What will happen after the vote? If the outcome does not meet my own convictions should I look to leave the BCS? If, as I appear to have concluded, I have low confidence in the CITP qualification I hold, should I remain a member of the body which awarded it?\nOddly, my opinion on this is clear. Yes. The pain within the BCS reflects the pain within the IT industry. That there should be a professional body within IT is clear. That the BCS is currently the only game in town is also clear. We should therefore continue to strive to make the BCS what it must be – the guarantor of quality and trust within the industry.\nYou can only affect change from within.\n","date":"9 June 2010","externalUrl":null,"permalink":"/posts/thoughts-on-the-bcs-egm/","section":"Blog","summary":"Stepping along the path ploughed by Richard and Robert, I thought I’d try to order my thoughts on the BCS EGM through a blog post. Like Richard, I am (as I begin writing) uncertain as to my final leaning on this, although I have clear views on some of the issues.\n","title":"Thoughts on the BCS EGM","type":"posts"},{"content":"","date":"8 June 2010","externalUrl":null,"permalink":"/tags/acer-travelmate-6593/","section":"Tags","summary":"","title":"Acer-Travelmate-6593","type":"tags"},{"content":"I thought I’d post this because so many like me might benefit from my experiment. We have a number of Acer TravelMate 6593 laptops here at Black Marble. They’re great machines – plenty of grunt, a lovely screen and most of the toys you could need in a laptop that’s used for a mix of IT admin, dev and technical sales (including demos). The only downside is that they only ship with up to 4Gb of memory, and Acer say it won’t take more.\nI’ve wondered about that for while – all the documentation I could find said that the system supported 4Gb SODIMMs in the two memory slots and the Intel chipset inside supports more than 4Gb of memory.\nThe cost of two 4Gb SODIMMs for experimentation always stopped me. However, the now lower price, combined with an absolute requirement to run the SharePoint 2010 IW virtual machines (which need 8Gb to fire up!) made me take the plunge.\nThe good news is that two DDR3 4Gb SODIMMs from Crucial arrived, were installed and worked first time. The system booted with no errors, Windows 7 (x64) recognised 8Gb of memory and a quick bit of partition shuffling later I had a dual-boot Windows 7/Server 2008 R2 + Hyper-V laptop. Marvellous.\nObviously, your TravelMate might not be as accommodating as mine, so make sure you check the returns policy on your RAM!\n","date":"8 June 2010","externalUrl":null,"permalink":"/posts/it-works-8gb-ram-in-my-acer-travelmate-6593/","section":"Blog","summary":"I thought I’d post this because so many like me might benefit from my experiment. We have a number of Acer TravelMate 6593 laptops here at Black Marble. They’re great machines – plenty of grunt, a lovely screen and most of the toys you could need in a laptop that’s used for a mix of IT admin, dev and technical sales (including demos). The only downside is that they only ship with up to 4Gb of memory, and Acer say it won’t take more.\n","title":"It works! 8Gb RAM in my Acer TravelMate 6593","type":"posts"},{"content":"","date":"1 May 2010","externalUrl":null,"permalink":"/tags/hp-touchsmart/","section":"Tags","summary":"","title":"Hp-Touchsmart","type":"tags"},{"content":"This one has been nagging at me for a long time. My grandmother has an HP TouchSmart TX2 tablet. It was bought with Windows Vista, but as with her main computer, I upgraded it to Windows 7.\nIt was a good plan – Windows 7 should make it perform better, and the touch capabilities of 7 are better than Vista. There was, however, a small matter of the N-Trig digitiser drivers not being great at point of release – something which would lead me down the wrong path over the problems I encountered.\nWindows 7 went onto the TX2 with no problems, except for the phone call I got soon after the rebuild – Mah Jong wouldn’t load, and Tinker (courtesy of Live) was crashing on startup.\nWeirdly, when I looked at the system, they all ran when I was logged in as an admin user. However, my standard user-level grandmother got errors. I played with UAC and discovered that having switched it off, rebooted, run the games, switched UAC back on and rebooted again, they worked.\nI told myself that it was something to do with the recently-installed N-Trig drivers not having configured things right (the last change to the system) and went away. Except things weren’t working…\nThe next time, I spent hours examining the system using Process Monitor and Process Explorer. I was thinking that file rights or registry rights would be the culprit, as the games still worked for the admin user. Sadly, I found no errors, no access denied messages, no failures at all. Still things didn’t work.\nI’d largely given it up as a bad job, until today, when I installed the Touch Pack. I thought that the additional games might be fun for my Grandmother to play. Had they worked… The newly installed games failed in the same way as Tinker – a shiny ‘program has stopped working’ message and nothing more.\nWhen I tried Bing Maps 3D, however, I got a different error. There in front of was a message about being unable to initialise the Direct 3D system, and so Maps 3d couldn’t load.\nAha! I thought. I downloaded the ATI graphics drivers for the Mobility Radeon 3200 and installed the latest set. No difference.\nSo I resorted to the hive-mind of the web again. This time I found a thread on a Microsoft forum talking about a problem with ATI drivers properly recognising the hardware at install time on the TX2. That sounded promising, and led me to the AMD support article. Unfortunately, installing the hotfix drivers still didn’t work.\nI then found another article on a Microsoft forum talking about a similar issue, fixed with a BIOS update. I hadn’t thought about a BIOS update for the TX2 – I tend not to think about that kind of thing when it’s not my PC. Sure enough, the TX2 had an older BIOS (version F.03) than the latest on the HP site – F.25.\nUpdating the BIOS still didn’t fix things, but I then reinstalled the ATI drivers supplied by the hotfix article and that did it. All the games worked, Tinker fired into life, and Bing Maps 3d started without a problem. before the driver reinstall I got a slightly more informative error from the games saying ‘A problem has occurred with the 3d driver’.\nSo, if you get the same problem, here is a quick summary:\nSymptoms:\nWindows 7-included games fail to load. Click the icon to fire them up and nothing happens. Microsoft Tinker dies on startup. Microsoft Touch Pack games die on startup. Bing Maps 3D says it failed to initialise Direct3D. System:\nHP TouchSmart TX2 tablet, model 1015ea Solution:\nUpdated BIOS to latest (F.25) Installed ATI hotfix drivers. ","date":"1 May 2010","externalUrl":null,"permalink":"/posts/solving-a-mystery-windows-7-games-wont-work-on-hp-touchsmart-tx2/","section":"Blog","summary":"This one has been nagging at me for a long time. My grandmother has an HP TouchSmart TX2 tablet. It was bought with Windows Vista, but as with her main computer, I upgraded it to Windows 7.\n","title":"Solving a mystery: Windows 7 games won’t work on HP TouchSmart TX2","type":"posts"},{"content":"","date":"1 May 2010","externalUrl":null,"permalink":"/tags/windows-7/","section":"Tags","summary":"","title":"Windows-7","type":"tags"},{"content":"True to form, you only discover something isn’t working when you’re in a desperate hurry. We use lots of Hyper-V VMs here at Black Marble and they are mostly running on our four node cluster. I use Failover Cluster Manager and this morning I couldn’t connect remotely to any of the Hyper-V VMs. I kept getting an error:\nVirtual Machine Connection:\nA connection will not be made because credentials may not be sent to the remote computer. For assistance, contact your system administrator.\nWould you like to try connecting again?\nA quick search suggested that the credssp settings on the host servers were broken. A quick test showed that they weren’t – the problem was local to my machine.\nThe only thing I had changed recently (try yesterday!) was to install SharePoint 2010 on my workstation. OK, I’ll be fair – that means a whole load of pre-requisites, so it’s not that simple!\nI decided to check my machine and look at the settings which had been suggested as being wrong on the hyper-v servers. Sure enough, my workstation now had the credssp elements and sure enough, they didn’t match the example I’d found.\nSo if you get the same problem, copy the text below into a .reg file and import it into your registry. It should fix the problem.\nWindows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Credssp\\PolicyDefaults] [HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Credssp\\PolicyDefaults\\AllowDefaultCredentials] \u0026#34;Hyper-V\u0026#34;=\u0026#34;Microsoft Virtual Console Service/*\u0026#34; [HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Credssp\\PolicyDefaults\\AllowDefaultCredentialsDomain] \u0026#34;Hyper-V\u0026#34;=\u0026#34;Microsoft Virtual Console Service/*\u0026#34; [HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Credssp\\PolicyDefaults\\AllowFreshCredentials] \u0026#34;Hyper-V\u0026#34;=\u0026#34;Microsoft Virtual Console Service/*\u0026#34; [HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Credssp\\PolicyDefaults\\AllowFreshCredentialsDomain] \u0026#34;Hyper-V\u0026#34;=\u0026#34;Microsoft Virtual Console Service/*\u0026#34; [HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Credssp\\PolicyDefaults\\AllowFreshCredentialsWhenNTLMOnly] \u0026#34;Hyper-V\u0026#34;=\u0026#34;Microsoft Virtual Console Service/*\u0026#34; [HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Credssp\\PolicyDefaults\\AllowFreshCredentialsWhenNTLMOnlyDomain] \u0026#34;Hyper-V\u0026#34;=\u0026#34;Microsoft Virtual Console Service/*\u0026#34; [HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Credssp\\PolicyDefaults\\AllowSavedCredentials] \u0026#34;Hyper-V\u0026#34;=\u0026#34;Microsoft Virtual Console Service/*\u0026#34; [HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Credssp\\PolicyDefaults\\AllowSavedCredentialsDomain] \u0026#34;Hyper-V\u0026#34;=\u0026#34;Microsoft Virtual Console Service/*\u0026#34; [HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Credssp\\PolicyDefaults\\AllowSavedCredentialsWhenNTLMOnly] \u0026#34;Hyper-V\u0026#34;=\u0026#34;Microsoft Virtual Console Service/*\u0026#34; ","date":"30 April 2010","externalUrl":null,"permalink":"/posts/unable-to-remote-control-hyper-v-vm-after-installing-sharepoint-2010-on-windows-7/","section":"Blog","summary":"True to form, you only discover something isn’t working when you’re in a desperate hurry. We use lots of Hyper-V VMs here at Black Marble and they are mostly running on our four node cluster. I use Failover Cluster Manager and this morning I couldn’t connect remotely to any of the Hyper-V VMs. I kept getting an error:\n","title":"Unable to remote control Hyper-V VM after installing SharePoint 2010 on Windows 7","type":"posts"},{"content":"Anybody who works will SharePoint will grumble if you mention DCOM activation permissions. No matter how hard we try, how many patches we install (or how hard we try to ignore it), granting activation and launch permissions to the SharePoint service accounts is like plugging a dike with water-soluble filler.\nOn Server 2008 R2 our job is made that much harder by the fact that, by default, even administrators can’t edit the security settings for the IIS WAMREG service (GUID {61738644-F196-11D0-9953-00C04FD919C1}, for when you see it in your application event log).\nThe fix is to change the default permissions on a registry key, which you can only do by taking ownership of the key. My only comment would be that those permissions were locked down for a good reason in Server 2008 R2 and it’s somewhat frustrating that we need to do this.\nAnyway, the key you are looking for is:\nHKEY\\CLASSES\\ROOT\\AppID\\{61738644-F196-11D0-9953-00C04FD919C1}\nTo change the ownership you need to click the Advanced button in the Permissions tab of the properties dialog, then select the Owner tab. I’d recommend changing the owner to the Administrators group rather than a specific user, and make sure the permissions for TrustedInstaller are the same after you finished as they were before you started.\nOnce done, you can edit the DCOM permissions for the IIS WAMREG service in the same way as on other versions of Server 2008.\n","date":"8 February 2010","externalUrl":null,"permalink":"/posts/fixing-sharepoint-2007-iis-wamreg-dcom-10016-activation-errors-on-server-2008-r2/","section":"Blog","summary":"Anybody who works will SharePoint will grumble if you mention DCOM activation permissions. No matter how hard we try, how many patches we install (or how hard we try to ignore it), granting activation and launch permissions to the SharePoint service accounts is like plugging a dike with water-soluble filler.\n","title":"Fixing SharePoint 2007 IIS WAMREG DCOM 10016 activation errors on Server 2008 R2","type":"posts"},{"content":" Exploring the new frontier # I’m writing this post whilst watching my Windows Home Server slowly copy data onto an external drive. I mention that not because of its pertinence, but to indicate why I found myself having time to join Facebook.\nThe other reason was the excellent session given by Eileen Brown at our most recent event. After Eileen had finished admonishing me for not taking my online presence (and therefore reputation) seriously enough I took the step of installing the Twitter Notify plugin for Live Writer so I could connect two of my online personas together.\nBut that wasn’t enough. I’ve had an online profile on LinkedIn for some time now, which I find very useful for business contacts. Ping.fm offered a very useful service of allowing effective cross-posting of status updates between my online services, so I signed up (on Elaine’s most excellent advice) and could then amplify the volume of my random thoughts across multiple networks.\nPerhaps foolishly, however, I didn’t stop there. I now have a Facebook profile. This has turned out to be almost my making and undoing, all at once. Suddenly I can see why people I know lose hours of their lives hooked into their online circle of friends. At the same time though, there are so many people out their on Facebook that I haven’t seen or spoken to in years and suddenly I have a mechanism which allows me to reconnect with them (with varying degrees of passive- or activeness, depending on both sides’ level of enthusiasm).\nThe Twitter Notify plugin has now been replaced by xPollinate – a Ping.fm plugin for Live Writer. Once more, projecting my voice across the vastness of cyberspace.\nAnd now I find myself wondering whether I’ve done the right thing. The cat is most forcefully out of the bag and no amount of persuasion will force it back in. I must now engage with these networks, spending time which I’m not certain I have commenting and posting and updating or my online personas will wither and die and fall back into the ocean of neglected accounts, blogs and other internet detritus.\nI remember when this was all fields # Sadly, I really am old enough to remember the internet before the web. I’m old enough to remember Compuserve being the big online realm. When I was an undergraduate at University, suddenly email was a fantastic way of communicating with my friends at other Universities – all connected to JANET (the UK Joint Academic Network, which itself connected to the Internet).\nBack then we couldn’t share much. Sure, you could attach things to emails, but you didn’t have much space in your mailbox and, frankly, there wasn’t much to send. We bounced messages back and forth to arrange meetings and social gatherings, and it was an invaluable tool for coursework!\nWhilst we had USENET (internet news groups, for those who haven’t encountered them) to allow online discussion, we didn’t have anything like the Blogs of today, which offer anybody a platform from which to voice their opinions.\nThe web, when it came, was exciting and fresh. Where I worked, at the University of Bradford, we had one of the first web sites in the UK, thanks to the enthusiasm of my colleagues in the Computer Centre. Over time, academics embraced the new tool as a way to push academic content out to their students.\nCertainly, you could lose hours of your life to these things, but there wasn’t the necessity to post stuff because, frankly, the internet wasn’t very big and most of the people on it were academics at other Universities.\nThe power of the web to promote yourself became apparent when I began to be involved in creating content for the web at the University. At that time, many of the sources of knowledge I was learning from were influential bloggers – using the new medium to put forward their ideas on how the web should be built. Many of them are still around today, but interestingly, many do not post with the frequency that they used to.\nThe trap of influence # It seems that the more you post, providing what you have to say is not complete rubbish, then the more people ask you to post more. I have seen many people for whom I have the utmost respect slowly fade away, citing pressures of time or growing workload. The problem is, our online voice is what builds our reputation and if we silence that voice our reputation fades along with it.\nThis is a conundrum for me. Frankly, I don’t post enough, either to this blog or any of my other online personas. I’d like to post more; I have lots to say (and some of it is more pertinent than this current stream of consciousness). In order to help build the reputation of Black Marble, I need to post more about the cool stuff we do and the great things we achieve as a company. The problem is, I also have a wife, and a life outside what I do for a living (which is already tightly combined with most of my hobbies and interests). How much of my time must I devote to activities connected to my work, even if some of those activities merge into my personal life (like Facebook) or are simply fun?\nPassive Engagement # Interestingly, Twitter really has connected me more with some of my friends. Nick Smith, a man for whom I have only respect, persuaded me during the last @Media conference in London last year that Twitter was a great way of keeping in contact with people. The most interesting thing about his argument was that it was an almost entirely passive means of communication, by which he meant that I could listen to his stream of tweets and thereby know what he was up to and choose to comment if I wished.\nIf you think about it, that’s pretty revelatory. I can’t think of any other means of keeping in touch which doesn’t involve effort from both parties, or risk upset if only one side makes an effort (such as letter writing, at which I was always appalling). To me, Twitter is a great informer, keeping me abreast of what my friends are doing, however remote.\nFacebook, by way of contrast, would seem to be something that is almost more demanding of my time and commitment than any of the pre-internet communication channels we had (telephone, letter, meeting down the pub), and provides such a rapid stream of communication with a hugely varying signal-to-noise ratio that I’m struggling to keep up already…\nNo answers, only questions… # I have no panacea for this. To be honest, this post is more an open question to anybody who reads my blog or notices my twittering or has found me on Facebook or LinkedIn: How do you do it? What advice can we offer one another in coping with the deluge of information of modern life and striking the balance between the demands of maintaining our online profile and enjoying the time with the friends it connects us to? Am I making a point which strikes a chord, or am I talking rubbish? You decide. Deluge my Facebook profile with comments; I can only try to keep up.\n","date":"31 January 2010","externalUrl":null,"permalink":"/posts/social-networking-the-double-edged-sword-of-maintaining-an-online-presence/","section":"Blog","summary":"Exploring the new frontier # I’m writing this post whilst watching my Windows Home Server slowly copy data onto an external drive. I mention that not because of its pertinence, but to indicate why I found myself having time to join Facebook.\n","title":"Social Networking: The double-edged sword of maintaining an online presence","type":"posts"},{"content":"Yesterday was the annual Black Marble Tech Update event, where we try to cover every product in the Microsoft arsenal in half a day, telling local businesses what’s coming and what deserves attention.\nWriting up the content of the presentations would be almost as exhausting as the research required for create them, but following a few conversations during breaks yesterday I decided that a short blog post on some of the technologies that deserve a closer look was merited.\nRather than hit you with lots, all at once, I’ll probably do a few posts, each with a small list of ‘homework’ for you.\nSo, the first few, in no particular order…\nDirect Access # This is a game-changer when it comes to enabling anywhere-access for mobile workers, and ties nicely in with my recent remote access post. In brief, the qustion behind this is “why should I trust my corporate network any more than the internet?” Once you’ve realised that the answer to that question should be a loud “I shouldn’t!” then Direct Access is the logical answer. In short, it assumes all networks are untrusted and therefore demands a secure connection between all computers at the protocol level (using IPSec). The anywhere access comes from using IPv6, which means that when I fire up my laptop in a hotel I can securely work just like I do in the office, including access to stuff like file shares.\nUAG # Unified Access Gateway (the latest version of IAG) builds on DirectAccess, making it easier to configure and manage. It also provides secure remote access for machines which you don’t trust. When you combine UAG with DirectAccess you end up with a comprehensive universal access solution for your infrastructure.\nSharePoint 2010 # There’s already a great deal of buzz around this. Architectural changes are great, but I firmly believe that the real game-changer is the way that social networking technologies have been absorbed into a business-solution in such a way that it can seriously benefit the way we store, use and find information. You just need to overcome your natural businessman fear of social networking and worker time-wasting and embrace the possibilities.\nOffice 2010 # One of my biggest issues with Office 2007, and the one I hear most often as a barrier to adoption was not the ribbon, but that the interface was not consistent across all of the applications. Office 2010 fixes that, making your transition much less painful when it comes to training. Couple that with the new web versions and excellent business functionality when combined with SharePoint and it becomes quite compelling. Of course, that’s without mentioning the improvements in Outlook like the new conversation view. You’ll prise Outlook 2010 out my cold, dead hands, I can tell you.\nForefront ‘Stirling wave’ # The big benefit in my opinion of the new codename Stirling wave of Forefront products is that they can be integrated with a control layer which allows behaviour seen by one to trigger remedial action by another (e.g. trigggering an AV scan of a desktop PC sending lots of emails). That hands-off rapid containment of potential issues is something which I think could be invaluable to large organisations.\n","date":"28 January 2010","externalUrl":null,"permalink":"/posts/new-and-coming-microsoft-technologies-you-need-to-look-at/","section":"Blog","summary":"Yesterday was the annual Black Marble Tech Update event, where we try to cover every product in the Microsoft arsenal in half a day, telling local businesses what’s coming and what deserves attention.\n","title":"New and coming Microsoft technologies you need to look at","type":"posts"},{"content":"We lost remarkably few days of productivity to the bad weather at Black Marble. That wasn’t because we were all intrepid, hardy types and all made it into the office. Far from it – some of us live in areas where they don’t grit very often and can’t make it to the main roads.\nAs you guessed from the title, the reason we came through the bad weather so well was because of our ability to work remotely. I thought I’d write a post about what we do – not because we have any wonderfully clever solution, but because lost time is lost money, and many people discard remote access out of hand.\nKeep it simple # I come at this from two sides: Firstly, complex solutions are hard to manage and are more likely to fail. Secondly, users don’t want to have to remember some peculiar incantation to access their stuff just because they are somewhere other than their desk.\nI have a simple approach; Anything the users do to access stuff on our company network should be what they do to access it when they aren’t on the company network. If I don’t allow remote access to that system (and I can’t think of any of those off the top of my head) then they should get some kind of access denied message; otherwise, they should be asked to authenticate and carry on.\nPick a protocol. Don’t pick lots. # To be fair, I’m in a strong position with this because of the portfolio of services I run. I don’t profess to be a network security ninja so I have very few rules in our firewall. Only one protocol is allowed in for remote access: https.\nHow can I do that? Well, SharePoint, Project Server and CRM are all very obviously web-based. Exchange has OWA and Outlook can connect using https as well. Even our remote desktop access is published using https, using Terminal Services Gateway. Since I’m using https outside the LAN, I use it inside as well. Why? Well, why trust my own network any more than the internet, and why make users remember a different URL when outside.\nA short list of the stuff we use # ISA Server 2006 sits at the edge of our network. I use it to publish out the various services. It’s very easy to manage and works beautifully. It’s about to be replaced, however, by Forefront Threat Management Gateway (TMG). My own plan is to move towards using DirectAccess and Unified Access Gateway (UAG) in the near future.\nOur SharePoint, Project Server and CRM systems all run on IIS. We have a wildcard certificate, which I would recommend to any small organisation wanting to publish web systems securely as they offer a much lower cost approach than getting specific certs for all the different URLs.\nOut Visual Studio Team Foundation Server (TFS), in both 2008 and 2010 flavours also works quite happily over https, and can be published out securely.\nTerminal Services Gateway allows me to connect to appropriate systems securely using RDP over HTTPS.\nWhat don’t we publish? # Perhaps unsurprisingly, none of our file shares are accessible from the outside world. However, since all our business data is in SharePoint or CRM (including documents), the stuff on the file shares is not needed and is mostly stuff like ISOs of software.\nHow easy is it? # If you keep things simple, remote access can be delivered securely and easily. ISA Server takes only a short time to install and configure if you stick to a very limited and straightforward ruleset.\nI would, however, urge you not to simply rush out and allow access to your systems without thinking: Security is essential and that means putting some thought into what you want to publish outside your corporate LAN and how you manage access and auditing.\nThe bottom line, though, is the effect that incidents like the recent bad weather can have on the company’s bottom line. Being able to work remotely doesn’t mean that your staff can do so on a whim, but it means that should they need to, they can do all the things they would normally do in the office without penalty. If you haven’t considered remote access solutions yet, perhaps now is the time to do so – before next winter and your workforce is stuck at home…\n","date":"24 January 2010","externalUrl":null,"permalink":"/posts/remote-working-solutions-or-how-i-learned-to-stop-worrying-and-love-the-snow/","section":"Blog","summary":"We lost remarkably few days of productivity to the bad weather at Black Marble. That wasn’t because we were all intrepid, hardy types and all made it into the office. Far from it – some of us live in areas where they don’t grit very often and can’t make it to the main roads.\n","title":"Remote working solutions (or how I learned to stop worrying and love the snow)","type":"posts"},{"content":"","date":"11 January 2010","externalUrl":null,"permalink":"/tags/microsoft-crm/","section":"Tags","summary":"","title":"Microsoft-Crm","type":"tags"},{"content":"","date":"11 January 2010","externalUrl":null,"permalink":"/tags/office-2010/","section":"Tags","summary":"","title":"Office-2010","type":"tags"},{"content":"I’ve been extremely busy over the past week creating demo systems and updating our own internal Black Marble systems. Part of that long list of tasks was to get around to testing the CRM 4 Outlook client with Outlook 2010.\nFor those who don’t know, you need the Update Rollup7 client if you want to use Outlook 2010 (and x86 Office only need apply). You can download a slipstreamed client installer from Microsoft.\nHowever, you may find that the client steadfastly refuse to install, telling you that it is unable to proceed due to a pending restart.\nThe solution to the problem can be found on the Microsoft forums:\nLook in the registry, in the Current User hive (HKEY\\Current\\User) for the user you’re trying to run setupclient.exe as. You will find a key in HKCU\\Software\\Microsoft named MSCRMClient. Create a new Dword value (32-bit if you’re on Windows 7 x64) called IgnoreChecks and set the value to 1.\nThis fixed it for me. Hopefully it will fix it for you too.\n","date":"11 January 2010","externalUrl":null,"permalink":"/posts/solve-pending-reboot-setup-show-stopper-for-crm-4-client-with-update-rollup-7/","section":"Blog","summary":"I’ve been extremely busy over the past week creating demo systems and updating our own internal Black Marble systems. Part of that long list of tasks was to get around to testing the CRM 4 Outlook client with Outlook 2010.\n","title":"Solve ‘pending reboot’ setup show stopper for CRM 4 Client (with Update Rollup 7)","type":"posts"},{"content":"","date":"11 January 2010","externalUrl":null,"permalink":"/tags/twitter/","section":"Tags","summary":"","title":"Twitter","type":"tags"},{"content":"Anybody who follows me on twitter will know that @rikhepworth is by no means a prolific tweeter. However, I do follow a number of people around the planet, and in addition to the ubiquitous Tweetie2 on my iPhone, I have found two clients to be useful and reliable.\nThe first is Tweetz, from Blue Onion Software. This is a great gadget for the Windows 7 desktop (or Vista Sidebar). The UI is simple and extremely usable (I love the way I can scroll the history for older tweets) and it makes posting a breeze.\nThe second reflects just how much I live by Outlook and the resulting ability to search and collate unread mails, blog posts and now tweets. Twinbox from TechHit allows you to tweet directly from Outlook and incoming tweets are collated by sender. No integration with the Office 2010 fluent UI but the add-in works, and there is a 64-bit version available as well.\n","date":"11 January 2010","externalUrl":null,"permalink":"/posts/twitter-clients-twinbox-and-tweetz/","section":"Blog","summary":"Anybody who follows me on twitter will know that @rikhepworth is by no means a prolific tweeter. However, I do follow a number of people around the planet, and in addition to the ubiquitous Tweetie2 on my iPhone, I have found two clients to be useful and reliable.\n","title":"Twitter clients: Twinbox and Tweetz","type":"posts"},{"content":" Prologue # This post is about assigning an SSL certificate to an IIS 7.5-hosted website which is not located in the Personal Certificate store. The steps shown are not SharePoint-specific, however. Hopefully this post will save you the large amount of time I spent hunting down the information on how to do this.\nThe usual background # I’ve been installing and configuring a SharePoint 2010 system that we can use here at Black Marble for our demo sessions. I hit a nasty wall just after lunch which turned out to be caused by the SSL certificate being used by the ISS web site hosting the SharePoint web services.\nI’d spent a while carefully wiring up the user profile service to our AD, getting synchronisation working and dealing with the creation of a new MySite host. That in itself is a fairly involved process right now, so when I hit errors I naturally assumed it was related to my work on the user profile service.\nWhen trying to manage the User Profile Service I was seeing errors that Central Administration could not access the service.\nThe automatic Health Analyzer in SharePoint was telling there was an error with the Security Token Service:\nThe Security Token Service is not available. The Security Token Service is not issuing tokens. The service could be malfunctioning or in a bad state. SPSecurityTokenService (SecurityTokenService)\nIn the Application Event Log I was seeing EventID 8306: An exception occurred when trying to issue security token: Could not establish trust relationship for the SSL/TLS secure channel with authority 'localhost:32844'..\nNaturally, I checked the bindings through IIS Manager to see what certificate was in use. An IIS self-issued certificate for the server was listed, which I though should have been valid…\nI looked in the Local Computer Certificate Store using the MMC snapin and I discovered a folder called SharePoint which had three certificate in it, all issued by the Sharepoint Root Authority:\nSharePoint Security Token Service SharePoint Security Token Service Encryption SharePoint Services That sounded interesting – perhaps one of these was the certificate which should be used and the configuration had got changed. The trouble now was how I assigned those certificates. IIS Manager only shows you the certificates in the Personal store – I couldn’t select the certificate I needed anywhere.\nBeing one to tinker before turning to the web I looked in applicationhost.config – the xml file which contains the configuration details for the IIS sites. It listed the protocol bindings but not the certificate. So I turned to Bing.\nThe first site of note was (of course) on IIS.Net – How to setup SSL on IIS 7.0\nThis listed a whole heap of things to do in order to set up SSL, but none of it told me how to assign a certificate from a specific store, at least without turning to WMI (and that wasn’t clear).\nI then found a detailed MSDN How To: Configure a Port with an SSL Certificate\nThis was really useful (if hard to find). It detailed how to configure a certificate using netsh. This required a key bit of information which I didn’t have – the certificate hash. However, the article linked to another, telling me that the has is in fact the Thumbprint attribute, accessible through the certificate MMC snapin (MSDN – How To: Retrieve the Thumbprint of a Certificate).\nI tried the appropriate netsh command and it failed. I then realised that when I queried the ssl bindings the certificate store name was listed, showing where cert was. There was no information in that article on how to specifiy this.\nBing to the rescue again. A non-MS site listing the parameters of the netsh add sslcert command.\nThe actual solution # In an elevated command prompt enter the following command to list the current SSL bindings:\nnetsh http show sslcert\nYou’ll get something that looks suspiciously like the image below. Note that there may be more than one binding listed; note also that the details below are for a working web services site.\nOutput from netsh http show sslcert You need to get some information for the SSL binding on port 32844, used by the SharePoint Web Services. The relevant section, as show above, will list the IP:Port as 0.0.0.0:32844. Mark and copy the the Application ID GUID. Interestingly, I’ve checked two different SharePoint 2010 installs on different servers and the Application ID is the same for both.\nYou also need to find the certificate hash (thumbprint) for the SharePoint Services Certificate. Load up MMC and add the certificate snapin, connecting to the Local Computer store. You should see a store named SharePoint with three certificates in, as per the image below:\nCertificate console showing SharePoint store Double-click the SharePoint Services certificate and select the Details tab. Scroll down and find the Thumbprint property and copy it’s contents to the clipboard.\nCertificate properties showing Thumbprint Paste the text into notepad and trim out the spaces before you use it in the commands below.\nI removed the SSL binding first using the command below, although I’m not sure if this step is necessary:\nnetsh http delete sslcert ipport=0.0.0:32844\nOnce that’s done, enter the command below, using the thumbprint from your certificate and (if it’s different) the correct appid for your website.\nnetsh http add sslcert ipport=0.0.0:32844 certhash=\u0026lt;thumbprint\u0026gt; appid={4dc3e181-e14b-4a21-b022-59fc669b0914} certstorename=SharePoint\nFinish off with another netsh http show sslcert to make sure the changes have been made, and then perform an iisreset, just to be sure.\nThe annoying bit # When you’ve done all this, don’t be fooled when you examine the bindings in IIS manager. If the certificate isn’t in the Personal store (i.e. IIS Manager doesn’t show it in the list) then the certificate is listed as Not Selected, which is very misleading. One to poke the guys in the IIS team about, I think.\n","date":"7 January 2010","externalUrl":null,"permalink":"/posts/reassigning-the-correct-ssl-certificate-to-sharepoint-2010-web-services-iis-site/","section":"Blog","summary":"Prologue # This post is about assigning an SSL certificate to an IIS 7.5-hosted website which is not located in the Personal Certificate store. The steps shown are not SharePoint-specific, however. Hopefully this post will save you the large amount of time I spent hunting down the information on how to do this.\n","title":"Reassigning the correct SSL certificate to SharePoint 2010 Web Services IIS Site","type":"posts"},{"content":"","date":"13 November 2009","externalUrl":null,"permalink":"/tags/berlin/","section":"Tags","summary":"","title":"Berlin","type":"tags"},{"content":"As you walk out of the U-bahn at Potzdamer Platz right now, you are faced with the most enormous advertisement you have ever seen. Well done HP and Windows 7 – subtle it most certainly is not!\nIMAGE_006 ","date":"13 November 2009","externalUrl":null,"permalink":"/posts/berlin-four-storeys-of-windows-7-goodness/","section":"Blog","summary":"As you walk out of the U-bahn at Potzdamer Platz right now, you are faced with the most enormous advertisement you have ever seen. Well done HP and Windows 7 – subtle it most certainly is not!\n","title":"Berlin: Four storeys of Windows 7 goodness","type":"posts"},{"content":"I’d love to say that I enjoyed the Legoland Experience in Berlin, located beneath the Sony Centre in Potzdamer Platz. I’d love to, but I can’t – I’ve been to a conference you know; none of this sightseeing malarky for me.\nHaving said that, whilst visiting the Mauerfall celebrations I stumbled upon the entrance, and I don’t often get the chance to post gratuitous pictures of Lego…\nIMAGE_036 IMAGE_037 IMAGE_038 As a complete aside, that night we also stumbled upon the European premier of 2012, with Amanda Peet and John Cusack on the red carpet at the Sony Centre, surrounded by photographers. Perhaps unfortunate, then, that all the crowds were elsewhere, walking along the lines of dominoes, drinking gluhwein.\n","date":"13 November 2009","externalUrl":null,"permalink":"/posts/berlin-legoland-experience/","section":"Blog","summary":"I’d love to say that I enjoyed the Legoland Experience in Berlin, located beneath the Sony Centre in Potzdamer Platz. I’d love to, but I can’t – I’ve been to a conference you know; none of this sightseeing malarky for me.\n","title":"Berlin: Legoland Experience","type":"posts"},{"content":"It’s becoming a tradition that every time I attend a conference or travel anywhere interesting I post at least a couple of places to eat. Perhaps ironically, none of the places I am about to post about serve cuisine that you could reasonable call German.\nIt’s true – we’ve done coffee and cake – that well known German tradition. In an evening, however, besides our hotel we have been to a Chinese, an oriental fusion place and a Portuguese and Spanish restaurant.\nA general warning to those eating out in Berlin – do not take for granted that the place you choose will take plastic – many don’t, and you should at least be prepared to pay cash.\nOf those, the fusion restaurant was the first place we ate - Coa. Situated right in Potzdamer Platz it was an obvious choice early in our stay as we wandered around the dominoes of Mauerfall.\nIf you like noodles, you’ll do just fine here. The cuisine is an interesting mix of Vietnamese, Thai, Chinese and Japanese. The surroundings are stylish, the service is friendly (and happy to converse in English) and the food is excellent. There is a great range of dishes from dim sum to noodles and everything we had was well prepared and tasty.\n","date":"13 November 2009","externalUrl":null,"permalink":"/posts/places-to-eat-in-berlin-coa/","section":"Blog","summary":"It’s becoming a tradition that every time I attend a conference or travel anywhere interesting I post at least a couple of places to eat. Perhaps ironically, none of the places I am about to post about serve cuisine that you could reasonable call German.\n","title":"Places to eat in Berlin: Coa","type":"posts"},{"content":"Lets get this straight right of the bat: Grenander is not a restaurant. Sure, it’s open in the evening and it does light meals (think: soup and a roll). However, it’s really a cafe (‘cafehaus and icecream’, says my receipt).\nCoffee and cake is a deep-seated German tradition. You really must indulge, but beware that this is no piffling, tiny piece of sponge cake we’re talking about – oh no. Coffee and cakes demands a huge, sumptuous piece of one of a range of marvellous gateaux. Picture a huge Black Forest Gateau (Schwarzwalder Kirschtorte) and you’re in the right place.\nRight across the road from the Wittenbergplatz, not far from KaDeWe, Grenander is easy to find and quite welcoming. It’s not very big, though, so you’d better hope it’s not busy.\nIMAGE_034 ","date":"13 November 2009","externalUrl":null,"permalink":"/posts/places-to-eat-in-berlin-grenander/","section":"Blog","summary":"Lets get this straight right of the bat: Grenander is not a restaurant. Sure, it’s open in the evening and it does light meals (think: soup and a roll). However, it’s really a cafe (‘cafehaus and icecream’, says my receipt).\n","title":"Places to eat in Berlin: Grenander","type":"posts"},{"content":"Anybody who knows me well will tell you that I am prone to waxing lyrical about Portugal. Whilst I haven’t been there for a good few years now, it was a regular destination for my family when I was younger and I have strong, fond memories of the place and its food.\nImagine my surprise then, when we found a Portuguese/Spanish restaurant just a few minutes away from our hotel. La Sepia is on Marburger Strasse, just off Ku’damme.\nCue a random mix from our blogger of broken German and broken Portuguese – all the staff we spoke to were native Portuguese, as far as I could tell.\nSadly, they only offer bacalhao a bras (Portuguese salt cod) during the day, but in addition to a range of tapas and a fabulous choice of fresh fish, a number of different dishes cooked in the traditional cataplana were on offer.\nThe cataplana is a traditional Portuguese cooking pot. Imagine a wok; now add another wok which closes against first on a hinge, like a clam. It clamps shut, making something a little bit like a pressure cooker.\nIMAGE_044 Tourists who visit the Algarve will have seen cataplana on the menus of many restaurants. Mostly, that means pork and clams, cooked in the cataplana. La Sepia offer this, of course, but also have other dishes. I plumped for monkfish, cooked in the cataplana. The dish is a bit like a stew – big chunks of monkfish, potatoes and other vegetables in a sauce which is a mixture of tomato and fish. Take it from me – it’s great. Just make sure you save some bread to mop up the sauce!\nIMAGE_043 A wide range of Portuguese wine fill a lengthy wine list. We settled on a nice Vino Verde – a light, slightly sparkling fresh white (literally translated to English as green wine). To finish, a bica – the strong Portuguese coffee which makes espresso look weak.\nOverall, a place I can heartily recommend. You can bet that I’ll try to make it back during the day for bacalhao a bras before we leave Berlin.\n","date":"13 November 2009","externalUrl":null,"permalink":"/posts/places-to-eat-in-berlin-la-sepia/","section":"Blog","summary":"Anybody who knows me well will tell you that I am prone to waxing lyrical about Portugal. Whilst I haven’t been there for a good few years now, it was a regular destination for my family when I was younger and I have strong, fond memories of the place and its food.\n","title":"Places to eat in Berlin: La Sepia","type":"posts"},{"content":"Mola is opposite the Wittenbergplatz U-bahn station, just along the Ku’damme from KaDeWe. It’s not the most sophisticated restaurant you’ll find, but it’s a wonderfully authentic Italian restaurant.\nIMAGE_039 The first thing you’ll notice is the marvellously jovial owner (at least I think he was the owner) who welcomes you in Italian. The next thing that you’ll notice is the large traditional pizza oven, with the pizza chef making fresh pizza by hand right in front of you.\nI wouldn’t pretend that the menu is sophisticated, but the pizzas are wonderfully tasty, authentic thin Italian pizzas. The staff are jolly, friendly and helpful and the overall atmosphere is welcoming and relaxed. They also serve Warsteiner. It’s going back a log way, but my childhood pen-friends in Hamm, in the west of Germany always used to maintain that Warsteiner was their favourite bier (much better than Krombacher, I recall).\n","date":"13 November 2009","externalUrl":null,"permalink":"/posts/places-to-eat-in-berlin-mola/","section":"Blog","summary":"Mola is opposite the Wittenbergplatz U-bahn station, just along the Ku’damme from KaDeWe. It’s not the most sophisticated restaurant you’ll find, but it’s a wonderfully authentic Italian restaurant.\nIMAGE_039 The first thing you’ll notice is the marvellously jovial owner (at least I think he was the owner) who welcomes you in Italian. The next thing that you’ll notice is the large traditional pizza oven, with the pizza chef making fresh pizza by hand right in front of you.\n","title":"Places to eat in Berlin: Mola","type":"posts"},{"content":"","date":"13 November 2009","externalUrl":null,"permalink":"/tags/places-to-eat/","section":"Tags","summary":"","title":"Places-to-Eat","type":"tags"},{"content":"Whilst TechEd this year has been rich with interesting content, most notably on SharePoint 2010, I’ve found it sadly thin on the ground when it comes to deep technical sessions. What exceptions to this rule there have been, however, were excellent and worthy of mention.\nMark Minasi delivered an explanation of Kerberos and its usage in Windows which was both extremely informative and wildly funny. His engaging delivery and use of cartoons, animations and humour made what could have been a dry subject all the more informative and memorable. If you can get hold of the recording, I would strongly urge you to watch.\nJohn Craddock went one better. His extremely deep coverage of DirectAccess and the IPv6 technologies which underpin it took two sessions, and has spawned a third, Q\u0026amp;A tomorrow morning which I shall be sure to attend. He gave a solid explanation of all the component technologies used by DirectAccess with an excellent demo rig to illustrate every step. After nigh-on three hours in his company I have come away with a much better understanding of the area, and an idea of how I can implement the technology in spite of the more readily available DA documentation implying that I can’t.\nOne or two of the Sharepoint sessions have been equally as useful – Joel Oleson and Todd Klindt on what you should look on your SQL server and how it’s configured to make your SharePoint perform better, and Todd again, along with his colleague Shane on upgrading from 2007 to 2010. Many others, however, were more marketing (and I learned a new word – markitechture – or should that be marchitecture?) than meat, which is a real shame.\nOverall, TechEd is still a great conference for content which covers a broad range of Microsoft technologies. I have to say that I enjoyed it – I just won an Xbox in the feedback ‘contest’! I think on balance I really have enjoyed it. Mark and John’s sessions alone make it worth the ticket price; I also look forward to Sanjay’s presentation on Microsoft BUI tomorrow. Part of me does wonder though – do I need to go to a ‘vertical’ conference like SharePoint 2009 for the deep content?\n","date":"12 November 2009","externalUrl":null,"permalink":"/posts/teched-2009-finding-technical-content/","section":"Blog","summary":"Whilst TechEd this year has been rich with interesting content, most notably on SharePoint 2010, I’ve found it sadly thin on the ground when it comes to deep technical sessions. What exceptions to this rule there have been, however, were excellent and worthy of mention.\n","title":"TechEd 2009: Finding technical content","type":"posts"},{"content":"","date":"12 November 2009","externalUrl":null,"permalink":"/tags/teched-emea-2009/","section":"Tags","summary":"","title":"Teched-Emea-2009","type":"tags"},{"content":"Monday night saw the official celebration of the twentieth anniversary of the historic events which saw the fall of the Berlin Wall and paved the way for German reunification.\nSadly, the night was cold and wet – the rain was falling in torrents as we made our way to Potsdamer Platz and walked towards the Brandenburg Gate. We managed to stand right next to one of the large screens on which proceedings were to be shown – next to the gate and near the dominoes which were to topple during the night.\nCold it may have been, but the atmosphere was warm and friendly, with people from all over the world joining the celebrations. Within a few feet of us were some French students, Americans from across the USA, Italians, Germans, and Yorkshiremen.\nThe evening was a great mix of culture and spectacle. We were treated to opera (with a distinguished-looking Placido Domingo), the Berlin Philharmonic with Daniel Barenboim conducting, Bon Jovi and some other most likely very popular German bands that I’d never heard of.\nThere were also plenty of speeches from German and other European leaders, along with Lech Walesa and Michael Gorbechev (sorry if I’ve mis-spelled either of those – I’m composing with no internet connection).\nThe whole event was punctuated by the toppling of dominoes, which turned out to be done in stages, and topped off with a fireworks display over the Brandenburg Gate.\nberlin mauerfall 006 berlin mauerfall 011 berlin mauerfall 013 berlin mauerfall 022 berlin mauerfall 044 berlin mauerfall 054 berlin mauerfall 093 berlin mauerfall 112 Once over, a sea of people flowed to the U- and S-Bahns. It’s a testament to the efficiency of Berlin public transport that the sea of people managed to quickly pile onto a succession of trains to be whisked away from Potsdamer Platz.\nIMAGE_042 Most definitely a night to remember.\n","date":"11 November 2009","externalUrl":null,"permalink":"/posts/20-jahre-mauerfall/","section":"Blog","summary":"Monday night saw the official celebration of the twentieth anniversary of the historic events which saw the fall of the Berlin Wall and paved the way for German reunification.\nSadly, the night was cold and wet – the rain was falling in torrents as we made our way to Potsdamer Platz and walked towards the Brandenburg Gate. We managed to stand right next to one of the large screens on which proceedings were to be shown – next to the gate and near the dominoes which were to topple during the night.\n","title":"20 Jahre Mauerfall","type":"posts"},{"content":"","date":"11 November 2009","externalUrl":null,"permalink":"/tags/berlin-mauerfall/","section":"Tags","summary":"","title":"Berlin-Mauerfall","type":"tags"},{"content":"As you may know, TechE d 2009 EMEA is in Berlin this year. You may also know that this year is the twentieth anniversary of the fall of the Berlin Wall. I’m here in Berlin, which means that I’ll try to blog what’s going on at TechEd. However, this post is all about the really cool idea Berlin has for the celebrations!\nWe arrived on Saturday and went out to Potsdamer Platz, not far from the Brandenburg Gate and German Parliament. We hadn’t heard about the 1000 dominoes, so we were really surprised and impressed.\nBerlin Wall line start The line begins at Potsdamer Platz (where there’s a really cool sledding slope, too) and snakes it’s way past the Brandenburg Gate to the new government buildings. Each domino is about 7 feet tall, and is uniquely decorated. Next to every domino is a small plaque telling you who did the artwork and, if your german is up to is, which mine isn’t quite, their thoughts about the piece. Some are truly startling, and they have been painted by everyone, from schoolchildren to artists to local companies and charities. On the 9th of November, the day the wall came down, those dominoes will be toppled.\nBelin wall You can follow the line all the way to the end, and there are thousands of people doing just that – all day and night. There are also wurst stalls, bier stands and stands selling gluhwein to ward off the cold. The atmosphere is absolutely fantastic!\nMauerfall These pictures don’t really do it justice – I took them with my phone on Saturday night. I have more taken with my EOS but I’ve not sorted them yet, and I wanted to get this post up.\nThe TV crews must be having a field day. There is an incredible amount of technical gear here – cameras on tripods; cameras on cranes; and one really cool camera on a wire track ready to chase the falling dominoes.\nThe Brandenburg Gate is all lit up and has big grandstands around it, ready for the festivities.\n![Brandenburg Gate(images/BrandenburgGate.jpg \u0026ldquo;Brandenburg Gate\u0026rdquo;)\nThe building where the line ends is this fabulous work of modern architecture housing the national library.\nNationalLibrary The big celebrations for Berlin Mauerfall are tonight. TechEd has carefully arranged it’s schedules so we have time to get there and join in. Here’s hoping the weather is good.\n","date":"9 November 2009","externalUrl":null,"permalink":"/posts/ich-bin-ein-berliner/","section":"Blog","summary":"As you may know, TechE d 2009 EMEA is in Berlin this year. You may also know that this year is the twentieth anniversary of the fall of the Berlin Wall. I’m here in Berlin, which means that I’ll try to blog what’s going on at TechEd. However, this post is all about the really cool idea Berlin has for the celebrations!\n","title":"Ich bin ein Berliner","type":"posts"},{"content":"For those of you who are confused by the title, Robert, our MD complained bitterly that the SharePoint Conference 2009 in Las Vegas only had Pepsi. I don’t know any geeks who like Pepsi, and a quick poll on twitter seemed to suggest that Robert and I aren’t alone. I just want to report that Berlin has restored my faith and has large fridges full of bottles of Coke. No Cherry Coke, however, so they don’t quite make a gold star.\nThis conference is HUGE. The conference centre is enormous. We arrived on Sunday by U-Bahn, which is to the north of the centre. It was a ten or fifteen minute walk to get from there to the north, where the entrance is. Fortunately, the S-Bahn station is at the north end. This morning was a bit like a football match – hundreds and hundreds of attendees streamed off two trains in the station and swarmed into the centre entrance. People were taking pictures in awe – incredible.\nBig it may be, but I must admit to being a little disappointed. There are few sessions that grab me. After last year, where Andy and I struggled to cover all the new and exciting stuff between us, this year has much less for me. The developer and IT events have been combined this year, and everything seems to lean more towards dev. I get the feeling also that the individual product conferences such as SharePoint and Project are taking over as the place to get great content as they can be more focused. Overall, I think that’s a shame. It’s hard to send guys to lots of conferences, and expensive. Being able to get deep technical content across a broad range of products was the great benefit of TechEd last year, with our IT guys out one week and the devs out the next.\nCompared to Barcelona, I have a few key points:\nIt’s a lot colder. The venue is much more organised (although it’s massive and sprawling) The venue catering seems better (food, drinks and fruit is readily available, which it wasn’t last year), although it would be better if it were closer to the session rooms. I have to make a good ten or fifteen minute round trip if I want to forage. The conference pack was better last year. it’s little things, like the session abstracts and pullout cards of session plans that fit easily in your badge holder. This year is not as good – the booklet I have, whilst it fits in my badge holder, requires me to constantly flick through. Most stuff is on the web, which is great if you have an internet connection, plenty of time, and something bigger than a netbook that can run full outlook. I have none of those, so I can’t use it at all. The system is horribly unusable on a netbook. Guess what nearly all the people I’ve met so far are carrying?! Did I mention that it was cold? Last night there were lines of Brass Monkeys all searching for their balls (and that’s not rude, it’s an english naval reference – go look it up!) The jury is still out on a city-versus-city comparison. Berlin is quite varied in many ways; Barcelona seemed more alive. Content so far is ok. I can’t be more excited as I’ve only been to two sessions. I can tell you, however, that Richard Riley is an excellent presenter and succinctly covered key points for IT Pros in SharePoint 2010. I’m going to a session by Joel Oleson next, and I’m looking forward to that – I have a great deal of respect for Joel’s expertise. Hopefully I will be able to post more later.\n","date":"9 November 2009","externalUrl":null,"permalink":"/posts/teched-europe-has-real-coke/","section":"Blog","summary":"For those of you who are confused by the title, Robert, our MD complained bitterly that the SharePoint Conference 2009 in Las Vegas only had Pepsi. I don’t know any geeks who like Pepsi, and a quick poll on twitter seemed to suggest that Robert and I aren’t alone. I just want to report that Berlin has restored my faith and has large fridges full of bottles of Coke. No Cherry Coke, however, so they don’t quite make a gold star.\n","title":"TechEd Europe has real Coke","type":"posts"},{"content":"We encountered a problem recently with a two server farm. One server was configured as index and query server. Both servers were delivering pages to users. If a user executed a search on the server which did not run the search services, the Search page returned an error, and we saw the following in the application log and SharePoint logs:\nEvent Type: Error Event Source: Office Server Search Event Category: Gatherer Event ID: 10032 Description: Could not create a database session. Context: Application \u0026#39;2bee214b-e0b9-413b-8d85-c71002287e99\u0026#39; Details: The database connection string is not available. (0xc0041228) Application 2bee214b-e0b9-413b-8d85-c71002287e99: The parent farm application root doesn\u0026#39;t exist or access denied. - File:d:\\office\\source\\search\\search\\searchdll\\resourcemanagerimpl.cpp Line:703 Application 2bee214b-e0b9-413b-8d85-c71002287e99: Database session creation error for resource type 0. - File:d:\\office\\source\\search\\search\\searchdll\\resourcemanagerimpl.cpp Line:555 After a great deal of investigation and assistance from the guys at Microsoft, we identified the fault. On the server which had no search services configured, we added the following registry keys, copied across from the server which was running index and query functions:\nHKLM\\SOFTWARE\\Microsoft\\Office Server\\12.0\\Search\\Applications\\\u0026lt;SEARCH APPLICATION GUID\u0026gt;\\ResourceManager Data=Server=sqlserver;Database=MOSSWEB_MYSITE_SSP_SEARCH;Trusted_Connection=yes;App=Windows SharePoint Services;Timeout=15 Server=sqlserver;Database=MOSSWEB_MYSITE_SSP_SERVICE;Trusted_Connection=yes;App=Windows SharePoint Services;Timeout=15\nWhere the Search Application GUID was the GUID from the error message, and the DB connection strings were copied over from the working server.\nThis resolved the problem, and now both servers deliver search results correctly.\nI’m posting this here because I found only two possible leads in all my searching, neither of which detailed the fault. Hopefully, as always, this will help somebody else.\n","date":"25 September 2009","externalUrl":null,"permalink":"/posts/sharepoint-search-gatherer-error-10032/","section":"Blog","summary":"We encountered a problem recently with a two server farm. One server was configured as index and query server. Both servers were delivering pages to users. If a user executed a search on the server which did not run the search services, the Search page returned an error, and we saw the following in the application log and SharePoint logs:\n","title":"SharePoint Search Gatherer Error 10032","type":"posts"},{"content":"UPDATE: Spence posted a great comment pointing out some issues with this post. Richard then restored our Community Server DB to a point in time before the post, so it’s been wiped. Post again, Spence, please, as I didn’t get chance to copy the text of the comment, I’m afraid.\nI’ve not been doing so well with blog posts lately. I have more than one currently in process but unposted, and I just can’t seem to get the time to finish them – so apologies, CSW, for not getting the article I promised up yet, but I am working on it.\nHowever, I needed to write up the work I did on our SharePoint at the end of last week, which I thought warranted being made available to a wider audience, so this a quick but hopefully helpful post.\nKerberos, Service Principal Names and Application Pool Identities # I’ve been migrating our SharePoint farm from Server 2003 to Server 2008, and because we now also use Microsoft CRM and a few other systems that require it, I’ve been configuring kerberos.\nIn theory, this should be simple: We always create service accounts in the AD for each web application to run as, so each of those accounts needs the correct SPN’s creating to match the web site.\nFor example, if our internal domain is mycorp.com and our SharePoint site is Portal running as the portalapp account, then I would register the SPNs of http/portal.mycorp.com and http/portal against the portalapp account using either adsiedit or setspn. I then make sure that the account is trusted for delegation, which I can do through the delegation tab in the account properties dialog in Active Directory Users and Computers. I also make sure that the servers running SharePoint are trusted for delegation to any service in the same way. UPDATE: Spence pointed out that this is completely unnecessary, see the comments, below.\nOnce I’ve done all that, I can enable Kerberos on the SharePoint web application through Central Administration. If you’ve never done that, the Authentication Providers option is in the Application Security section (usually the right hand column) in Application Management. Make sure you have the correct web application selected and choose the zone you want to configure (if you haven’t extended your web application, that’ll be default). In the Edit Authentication page, simply tick Integrated Windows Authentication and toggle the radio button beneath to Negotiate (Kerberos). Apply the changes, and we’re done.\nOr so you’d think…\nTo be fair, with Server 2003, that should be it. With Server 2008, however, things just didn’t seem to be working properly for me. So I consulted the Oracle (on a side note, I’m trying a new Oracle lately…).\nKernel-mode authentication. Great idea, shame about the configuration # It turns out the IIS 7 has changed the way it deals with authentication, in that it now executes authentication-related processes in kernel mode for security and performance. That’s all well and good, but it also transpires that because of that, it uses the Local System account for this, and that’s where we hit a snag: I’ve created the SPN’s on the wrong account – I would need to create them on the machine account for the hosting server. Except that won’t work if we’re using more than one server in our farm to host the web applications, because I can only set the SPN against a single account.\nIt turns out that there is a solution to this. Frustratingly, however, it can’t be done through IIS Manager (or at least, I couldn’t see a way – perhaps Andy Westgarth and the IIS boys can help me here?). Once again we need to edit the applicationHost.config file, just like we did for the bindings, previously:\nFinding the right section for this can be tricky. You’re looking for the \u0026lt;location\u0026gt; section for your site, which then has a \u0026lt;system.webServer\u0026gt; section within it. I search on the site name (for example, our web site in IIS is SharePoint – Portal) because the line should look something like:\n\u0026lt;location path=”SharePoint – Portal”\u0026gt; Scroll down until you find the section. In there you should see an section and beneath that, \u0026lt;windowsAuthentication\u0026gt;. It will probably say:\n\u0026lt;windowsAuthentication enabled=\u0026quot;true\u0026quot;\u0026gt; Edit that line to read:\n\u0026lt;windowsAuthentication enabled=\u0026quot;true\u0026quot; useKernelMode=\u0026quot;true\u0026quot; useAppPoolCredentials=\u0026quot;true\u0026quot;\u0026gt; You’ll need to do an IISReset after that, or at least I did.\nAm I the only person that thinks this should be a setting in the GUI somewhere – it’s such a fundamental issue if you’re using any kind of farm-based system (such as SharePoint or CRM) that I can’t believe it’s so hidden.\nUPDATE: Spence also pointed out that appcmd lets you configure this. I’ll post more when I’ve learned how to do it myself.\nAppcmd syntax and a hotfix # After Spence posted his comments I did more digging. The syntax for appcmd to make the change I describe above is:\nappcmd set config “SharePoint – Portal” /section:windowsAuthentication /useAppPoolCredentials:true /commmit:MACHINE/WEBROOT/APPHOST\nwhere you need to replace the stuff in quotes with the name of your site. You can get a list using appcmd:\nappcmd list site\nI also found a note about a hotfix related to this issue. If you see your server suffering from blue screens after configuring kerberos (I haven’t… yet) then this might help.\nFinally, Spence posted a link to a set of useful slides covering just this topic – thanks Spence, I bet those were three great sessions. Hopefully I’ve now corrected the errors you pointed out and this post is back to being helpful!\n","date":"6 July 2009","externalUrl":null,"permalink":"/posts/kerberos-for-sharepoint-on-server-2008-with-iis-7/","section":"Blog","summary":"UPDATE: Spence posted a great comment pointing out some issues with this post. Richard then restored our Community Server DB to a point in time before the post, so it’s been wiped. Post again, Spence, please, as I didn’t get chance to copy the text of the comment, I’m afraid.\n","title":"Kerberos for SharePoint on Server 2008 with IIS 7","type":"posts"},{"content":"","date":"6 July 2009","externalUrl":null,"permalink":"/tags/windows-server-2008/","section":"Tags","summary":"","title":"Windows-Server-2008","type":"tags"},{"content":"","date":"26 June 2009","externalUrl":null,"permalink":"/series/@media-2009/","section":"Series","summary":"","title":"@Media 2009","type":"series"},{"content":"I hadn’t really thought about it before, but Andy Budd has a very similar presentation style to my own. He’s incredibly enthusiastic and passionate about what he’s speaking about, and he wanders around waving his arms in an extremely animated way. Snap!\nThe topic of usability testing is an important one. I always try to impress upon our clients the need to see how the systems we build for them are used and tweak and fix accordingly. Andy’s approach to low-budget, formative testing to identify and solve usability issues during development as part of an agile approach struck a chord with me. I think that it’s important to have a dialog with ‘average’ users (i.e. not involved directly with development and therefore too close to a project to notice the problems) and to feed back into the development process what you find and the pain points you identify. Far better to find and fix during development than to force your product to fail testing or, even worse, to hit issues during rollout that hinder adoption.\nI really like Andy Budd – every time I come to @media he recognises me and says hi. He’s a guy who knows his stuff, but he takes time out for those around him, and he deserves your attention.\nThe last session before the Hot Topics panel was Robin Christopherson from AbilityNet. Every time I attend a session with Robin I learn as much from watching and listening to him present (in terms of how he does it) as I do from the content of his session. Robin is blind, and when things don’t go quite as expected on screen, he doesn’t always know. That gives a helpful insight for an able person as to the problems that impaired users might have. I now need to go to Opera Labs to investigate FingerTouch, which looks like a great improvement for my mobile browser of choice. It was also great to see examples of ARIA being used which was pretty inspiring.\n","date":"26 June 2009","externalUrl":null,"permalink":"/posts/media-day-2-afternoon/","section":"Blog","summary":"I hadn’t really thought about it before, but Andy Budd has a very similar presentation style to my own. He’s incredibly enthusiastic and passionate about what he’s speaking about, and he wanders around waving his arms in an extremely animated way. Snap!\n","title":"@media Day 2 - Afternoon","type":"posts"},{"content":"It’s a muggy day today. With thunderstorms expected, the morning air was thick as we walked over to the South Bank Centre.\nI found Douglas Crockford’s opening session thoughtful. It wasn’t what I was expecting – I had anticipated a focus more on methodologies and approaches to improving quality. instead, it was an interesting and sometimes humorous examination as to why quality in software is such a difficult area, with an informative walk through the history of software thrown in.\nMany of the things Douglas covered were topics we take very seriously at Black Marble: The problems described were ones we face and do our best to avoid through our practices every day.\nWhilst I got a great deal out of the talk, I was a little disappointed that it didn’t really address the question of how we ensure quality in web development when projects include coders and designers, markup and code, and the very different ways of thinking inherent in the creative processes for each.\nAfter the coffee break came Chris Wilson and a talk that wandered around the web as a platform and some of the issues in play. One statistic I found very interesting was taken from the deployment data for IE6 to IE7 upgrade versus Firefox upgrades. It took around 18 months to convert half of the IE6 userbase to IE7. By contrast, Firefox takes around two months to convert half it’s userbase to a new versino. That’s a powerful illustration of the differing kinds of user that make up the predominant force for each browser, and the kind of organisational inertia which affects the development and progression of Internet Explorer much more than competitive browsers.\nChris also gave some interesting insight into the legal quagmire surrounding font embedding on the web, following on in topical fashion from Mark Boulton’s empassioned delivery yesterday.\nLast up before lunch was the indomitable Molly Holzschlag. Ultimately, she was also joined on stage by ‘HTML5’ in a cowboy suit (don’t ask). It was interesting because I admit to not having had time to pay attention to HTML5 at all, and it sounds like a bit of a bun fight, to be honest. Yet more technologies to look at and learn… As usual, Molly’s enthusiastic delivery was infectious. I’m sure she must do a great job as an evangelist for Opera.\n","date":"26 June 2009","externalUrl":null,"permalink":"/posts/media-day-2-morning/","section":"Blog","summary":"It’s a muggy day today. With thunderstorms expected, the morning air was thick as we walked over to the South Bank Centre.\nI found Douglas Crockford’s opening session thoughtful. It wasn’t what I was expecting – I had anticipated a focus more on methodologies and approaches to improving quality. instead, it was an interesting and sometimes humorous examination as to why quality in software is such a difficult area, with an informative walk through the history of software thrown in.\n","title":"@media Day 2 - Morning","type":"posts"},{"content":"One of the reasons I enjoy conferences like @media is that I can be persuaded to change my mind on things. After a persuasive argument from Nick I’ve decided to alter my stance on twitter and give it a go for a while.\nA few others recently have suggested that I should sign up to the microblogging system even if I didn’t plan to use it, just to make sure I got the nickname I wanted and nobody else could use it. I’ve never really bought into that kind of approach, and sometimes I wonder if that is as key an indicator as to the lack of importance I have personally come to place in social networking tools. I’m old enough that my first instinct if I want to socialise is to pick up the phone and arrange a pint with a mate.\nAt significant part of that change in stance is due to a realisation that twitter provides an intriguing way for me to keep in touch with people like Nick in a way which doesn’t demand a response in the way that IM certainly does and email ought to. Twitter simply gives a commentary on Nick’s life as he decides to tell it and I can respond if I want to.\nExactly what I will tweet, I don’t know. Inanity in all it’s forms frustrates me, so I won’t be keying in anything that pops into my head at any time. However, there’s no point deciding to try something and not then using it. That means I’m likely to post either useful nuggets about the technologies I deal with, or my thoughts on bigger issues.\nA timely example of this came overnight with the domination of the news by the death of Michael Jackson. Twitter was being used this morning as an interesting barometer of the public response to the news: 15% of all tweets since the news have been about Jackson’s death. Apparently the previous high for a major event was 5%. I find that interesting from two angles: Firstly, that the twittering masses take such an interest in the event and more interestingly how the data is presented as an indicator of general interest.\nIn an effort to put some heart into my use of twitter I also downloaded a trial of Twikini. My first impressions are favorable, and I\u0026rsquo; may well post more on that later.\nFor now, if you want to find me on twitter, look for @rikhepworth and my usual cartoon head and shoulders mugshot.\n","date":"26 June 2009","externalUrl":null,"permalink":"/posts/joining-in-the-background-noise-i-am-now-on-twitter/","section":"Blog","summary":"One of the reasons I enjoy conferences like @media is that I can be persuaded to change my mind on things. After a persuasive argument from Nick I’ve decided to alter my stance on twitter and give it a go for a while.\n","title":"Joining in the background noise: I am now on Twitter","type":"posts"},{"content":"","date":"26 June 2009","externalUrl":null,"permalink":"/tags/media/","section":"Tags","summary":"","title":"Media","type":"tags"},{"content":"A set of conference posts wouldn’t be complete without a run down of the local culinary delights. We haven’t strayed far from the South Bank Centre for the past few days, but we’ve had a great variety of meals.\nWednesday night and Thursday lunchtime was Wagamamas. I love Wagamamas. There’s one in Leeds as well, and whilst Fuji Hero is perhaps more authentic, I just love the deserts at Wagamamas. I also have at least one of their recipe books, so I can try it at home! Busy though – we arrived just shy of seven in the evening of our arrival and the queue to get in didn’t really die down until after nine. The new teppanyaki soba is to be recommended.\nThursday night was Tapas at Las Iguanas – a latin-themed place. It was pretty good too, although if I’m honest I’ve had better tapas. It was really busy too – I guess that’s partly because it’s summer and the south bank is one of those places where people congregate, but be prepared to wait a while for a table.\nLunchtime today saw us in Ping Pong, a Dim Sum place down the stairs out back. That was great – a menu with loads of different dishes with helpful staff to walk you through ordering a range of really tasty dishes. We all thoroughly enjoyed it and I’d really recommend it as a slightly different experience, and great for lunch where you might not want a huge meal. I also thing it’s a great social experience, as you can all order a dish you like and get others to try it, with all the conversation that will provoke!\n","date":"26 June 2009","externalUrl":null,"permalink":"/posts/places-to-eat-on-the-south-bank-in-london/","section":"Blog","summary":"A set of conference posts wouldn’t be complete without a run down of the local culinary delights. We haven’t strayed far from the South Bank Centre for the past few days, but we’ve had a great variety of meals.\n","title":"Places to eat on the South Bank in London","type":"posts"},{"content":"Not providing lunch at the conference was perhaps a bit of a double edged sword. On the one hand, Wagamamas is just so close (mmm… chicken katsu curry); on the other hand, lots of people were nodding off in the warmth of the first session.\nWhich is a great shame, because Dan Rubin is a really good speaker (and singer, as it happens). His session was all about reflecting the real world in our user interfaces in order to make them much more usable. It was also about taking real items and using them in designs (such as real textures from scanned objects) because of the much better emotive affect that has with our users. It was pretty inspiring, even though at the end of the day everything he talked about should be common sense.\nAnd then… Mark Boulton. Wow! There’s a man who’s passionate about his specialism, and his specialism is typography. Even though it wasn’t a technical session I learned bucket loads of stuff during his session which talked around the area of, whilst not dipping into the how-to of embedding type with web pages in those browsers which support it. A very key point he raised had not occurred to me: to work successfully in the web environment, fonts must have more glyphs in them to cover multi-language issues, and must have lots of hinting information in them to work at varying sizes on the screen. The upshot of those needs is a big font, and that raises issues of download time, potentially rendering content in a default typeface then re-rendering when the embedded one loads and lots of other questions which I personally think underline the technology as being very young. I’m very interested to see how that all develops and I’m certain that Mark will be a big voice in the forthcoming discussions.\nNow we’re outside, enjoying the sun and, ironically, cooling off a little – it was quite warm in the Purcell Rooms. It’s hot out here too, but there’s a lovely cool breeze.\nOne of the things about blogging is that you can’t see the lovely cut scene. Imagine a fade to black. Our hero attends the final session. Fade back for the finale.\nJason Santa Maria does some really compelling work. He delivered a very eloquent session about approaching design, using grids, finding inspiration in lots of things, sketching through ideas and finally typography. It was a really good session for me.\nWhich is interesting, because I seem to have said that about all the sessions. I think there’s a great deal of mileage in the idea of a small conference with carefully picked presenters who deliver content which is all about areas of thought in an industry or subject area., Huge conferences mean you are pulled between different sessions in multiple tracks. I really like the simplicity of the small, one track conference where thought has been put in to the content and how it flows. that’s @media and that’s why I like it.\n","date":"25 June 2009","externalUrl":null,"permalink":"/posts/media-2009-day-1-afternoon/","section":"Blog","summary":"Not providing lunch at the conference was perhaps a bit of a double edged sword. On the one hand, Wagamamas is just so close (mmm… chicken katsu curry); on the other hand, lots of people were nodding off in the warmth of the first session.\n","title":"@media 2009 Day 1 - Afternoon","type":"posts"},{"content":"It’s good to see familiar faces once again here at @media. This year’s conference is around the same size as the first one in 2005 and it has a strangely familial feeling. Nick’s here as a volunteer ‘@mediator’ so he was manning the desk as we registered.\nA note at this point about the conference swag: aside from the very nice T-shirt, which strangely matches my normal style (Andy often refers to me as ‘Mister Taupe’), the conference bag is excellent! Made from coconut fibre, it hits all the marks for eco-friendliness, but it’s a very practical, messenger-style durable bag, and perfect for my Dell Mini, upon the keyboard of which I currently type. A bag I shall no doubt use a great deal in the future – no doubt the original aim. The whole look and feel of the conference this year is really good – sophisticated and earthy.\nIMAGE_059 Andy Clarke opened the conference with a rousing session about changing working practices in the design process. It was interesting, because it reminded me of the more agile approach we take to software development. I also love the feel of Andy’s sessions – they have a very distinctive visual style and draw on lots of things I remember from my youth.\nSimon Collinson followed with a great discussion of how his agency approach creative projects and some of the tools they use. I found it interesting that he disliked sprints so much, but on reflection, the creative process of web design is perhaps less naturally iterative than the software development projects for which we use Scrum. A few simple things struck me with the old ‘why didn’t I think of that’ and some elements that I can achieve for better interaction with our customers through innovative repurposing of existing tools that we already have and use.\nTaking us up to lunch was Jon Hicks. I really got a lot out of his session. Whilst icon design is not something I do much, it was interesting to see the thought processes and hear about some of the pitfalls when icons don’t have the universal meaning you as a designer think they do.\nSo far then, really good. I love the fact that this year has the same small, friendly feel of the very first @media. May it long continue.\n","date":"25 June 2009","externalUrl":null,"permalink":"/posts/media-2009-day-1-morning/","section":"Blog","summary":"It’s good to see familiar faces once again here at @media. This year’s conference is around the same size as the first one in 2005 and it has a strangely familial feeling. Nick’s here as a volunteer ‘@mediator’ so he was manning the desk as we registered.\n","title":"@media 2009 Day 1 - Morning","type":"posts"},{"content":"Lauren and I set off for London later to today. It’s @media time again and I’ve been looking forward to this for a while. As usual Patrick Griffiths has lined up a fantastic group of really inspirational speakers and, whilst smaller in the light of the current climate, I have no doubts that it will be useful.\nI’ve been to every @media since it started and I’ve always had a great time. If you have the time, I’d urge you to make this year the sell-out it’s been in the past!\n","date":"24 June 2009","externalUrl":null,"permalink":"/posts/see-you-at-media09-tickets-are-still-available/","section":"Blog","summary":"Lauren and I set off for London later to today. It’s @media time again and I’ve been looking forward to this for a while. As usual Patrick Griffiths has lined up a fantastic group of really inspirational speakers and, whilst smaller in the light of the current climate, I have no doubts that it will be useful.\n","title":"See you at @media09? Tickets are still available","type":"posts"},{"content":"Andy Westgarth and the guys at VBUG Newcastle very kindly invited me to speak about and demo some of what I consider to be key features in Windows 7 and Server 2008. If you read the blog and would like to see what I really look like, are interested in the topic of the talk or interested in VBUG in general, come along!\nThe venue is Newcastle University (a campus I’ve never visited before so I’m quite looking forward to that). For more information Andy has details on the VBUG site. In order to make sure the event doesn’t wither through lack of interest, please register yours on the VBUG site. To copy some of it here, however:\nTopic: Key features in Windows 7 and Server 2008 R2\nOverview:\nKey features in Windows 7 and Server 2008 R2. A look at the new features in Microsoft’s upcoming operating systems that will really make a difference to how we work. The session will a broad overview of new features with demos of the cooler ones to add an element of risk to proceedings. Come along if you want to learn more about technologies such as BranchCache, DirectAccess, Virtual XP Mode and more.\nLocation: Room 118, Claremont Tower, Newcastle University, Newcastle-upon-Tyne, NE1 7RU, GB\nPrice: FREE\n","date":"16 June 2009","externalUrl":null,"permalink":"/posts/speaking-at-vbug-newcastle-in-july/","section":"Blog","summary":"Andy Westgarth and the guys at VBUG Newcastle very kindly invited me to speak about and demo some of what I consider to be key features in Windows 7 and Server 2008. If you read the blog and would like to see what I really look like, are interested in the topic of the talk or interested in VBUG in general, come along!\n","title":"Speaking at VBUG Newcastle in July","type":"posts"},{"content":"","date":"16 June 2009","externalUrl":null,"permalink":"/tags/vbug/","section":"Tags","summary":"","title":"Vbug","type":"tags"},{"content":"As you probably guess, Richard and myself were in Seattle for a short conference last week. The evening entertainment on one night was a trip to Gameworks. If you like playing video games with your mates, going head-to-head at things like Sega Rally, then you’ll have a good time in Gameworks.\nI’m not the worlds greatest gamer, and I tend to struggle when it’s games that don’t use keyboard and mouse. Richard and I seemed to do best at the stand-up shooting games, the first of which was (to a non-hunting Brit) a hilarious hunting game where you had to blast moose with a pump action shotgun and avoid shooting cows.\nI’m guessing that it wasn’t a terribly popular game, as my paltry efforts at taking down wildlife got me a high score.\nImagine my surprise then, when the following morning’s pre-session rolling slides said the following:\n![Gameworks notables. \u0026ldquo;All Rambo Team\u0026rdquo;, Rik/Black Marble Limted (Extreme Hunting)](images/gameworksscores_thumb_61860CD5.png \u0026ldquo;Gameworks notables. \u0026ldquo;All Rambo Team\u0026rdquo;, Rik/Black Marble Limted (Extreme Hunting)\u0026rdquo;)\n","date":"8 June 2009","externalUrl":null,"permalink":"/posts/things-to-do-in-seattle-gameworks/","section":"Blog","summary":"As you probably guess, Richard and myself were in Seattle for a short conference last week. The evening entertainment on one night was a trip to Gameworks. If you like playing video games with your mates, going head-to-head at things like Sega Rally, then you’ll have a good time in Gameworks.\n","title":"Things to do in Seattle: Gameworks","type":"posts"},{"content":"On our arrival in Seattle, Richard and I had a great meal in Etta’s Seafood, which is not far along the road from Pike’s Market, heading out with the bay on your left. The food was excellent – fantastic chowder and a burger cooked just to your taste. A warning though – if you’re a wee slip of a lad like I am you may find the portions daunting. It was a friendly, charming place and great welcome to the city.\n","date":"7 June 2009","externalUrl":null,"permalink":"/posts/places-to-eat-in-seattle-ettas-seafood/","section":"Blog","summary":"On our arrival in Seattle, Richard and I had a great meal in Etta’s Seafood, which is not far along the road from Pike’s Market, heading out with the bay on your left. The food was excellent – fantastic chowder and a burger cooked just to your taste. A warning though – if you’re a wee slip of a lad like I am you may find the portions daunting. It was a friendly, charming place and great welcome to the city.\n","title":"Places to eat in Seattle: Etta’s Seafood","type":"posts"},{"content":"Tonight we ate in a place we’d seen recommended by Sara Ford in her blog: Marcella’s Cookery. A fantastic little New Orleans-style eatery run by the eponymous (and very friendly) Marcella and her husband, Anthony. The food was fabulous, well cooked and happily discussed by the chef himself. Between us we tried a number of dishes and all were excellent. Anthony (the chef) told us that he moved to Seattle after Hurricane Katrina and I think it’s Seattle’s gain – we had a great time and I can wholeheartedly recommend the place.\n","date":"7 June 2009","externalUrl":null,"permalink":"/posts/places-to-eat-in-seattle-marcellas-cookery/","section":"Blog","summary":"Tonight we ate in a place we’d seen recommended by Sara Ford in her blog: Marcella’s Cookery. A fantastic little New Orleans-style eatery run by the eponymous (and very friendly) Marcella and her husband, Anthony. The food was fabulous, well cooked and happily discussed by the chef himself. Between us we tried a number of dishes and all were excellent. Anthony (the chef) told us that he moved to Seattle after Hurricane Katrina and I think it’s Seattle’s gain – we had a great time and I can wholeheartedly recommend the place.\n","title":"Places to eat in Seattle: Marcella’s Cookery","type":"posts"},{"content":"Seattle 2009 008 We had a great night tonight. Our visit to Seattle coincided with three home games for the Mariners, and I went to my first baseball game tonight. Not only was it a fantastic match, going right down to the last pitch, but one of the batters obviously realised I was a baseball newbie and kindly hit me a ball as keepsake!\nSeattle 2009 010 ","date":"4 June 2009","externalUrl":null,"permalink":"/posts/things-to-do-in-seattle-baseball/","section":"Blog","summary":"Seattle 2009 008 We had a great night tonight. Our visit to Seattle coincided with three home games for the Mariners, and I went to my first baseball game tonight. Not only was it a fantastic match, going right down to the last pitch, but one of the batters obviously realised I was a baseball newbie and kindly hit me a ball as keepsake!\n","title":"Things to do in Seattle: Baseball","type":"posts"},{"content":"slide1 Richard’s an old hand in Seattle, so he suggested we ate breakfast at Lowell’s down at the Pike Place Market. I’m really glad he did – the eggs benedict were fantastic. We ate great food with a fantastic view of the bay. If you’re ever in Seattle I can wholeheartedly recommend that you try Lowell’s while you’re here.\n","date":"3 June 2009","externalUrl":null,"permalink":"/posts/places-to-eat-in-seattle-lowells/","section":"Blog","summary":"slide1 Richard’s an old hand in Seattle, so he suggested we ate breakfast at Lowell’s down at the Pike Place Market. I’m really glad he did – the eggs benedict were fantastic. We ate great food with a fantastic view of the bay. If you’re ever in Seattle I can wholeheartedly recommend that you try Lowell’s while you’re here.\n","title":"Places to eat in Seattle: Lowell’s","type":"posts"},{"content":"I’m in Seattle this week (just as a big heatwave has rolled in). As I type this I’m looking out from my room at the Westin over a great view of the bay. In the corner I hear my coffee brewing. None of your little kettles and sachets of instant coffee here. Look what I got:\nCoffee filter machine and Starbucks coffee That’s right, my very own coffee machine with Starbucks coffee. Nice!\nOf course, if I wanted a cup of tea I’d be stuck, but who drinks tea in Seattle?\n","date":"2 June 2009","externalUrl":null,"permalink":"/posts/uk-hotels-take-note-this-how-to-do-coffee-in-my-room/","section":"Blog","summary":"I’m in Seattle this week (just as a big heatwave has rolled in). As I type this I’m looking out from my room at the Westin over a great view of the bay. In the corner I hear my coffee brewing. None of your little kettles and sachets of instant coffee here. Look what I got:\n","title":"UK Hotels take note – this how to do coffee in my room!","type":"posts"},{"content":"NOTE: We use a wildcard SSL certificate which makes our life much easier when dealing with multiple hostnames. I have not tested this approach with multiple SSL certificates for specific sites.\nWe’ve been reconfiguring our SharePoint 2007 farm over the past couple of days and it’s now hosted on Windows Server 2008 and using NLB (network load balancing). The load balancer has been configured with a single public IP address and all our previous DNS CNAME registrations have been replaced with hostname A registrations pointing at the address. With our previous configuration we had multiple IP addresses on the server, one for each web application. Each IIS web site was then configured with a host header and ip address to allow for secure traffic over HTTPS.\nWith our new configuration, I didn’t want to specify an IP address on the web site. Handily, IIS 7 makes that scenario possible (and even relatively straightforward). The only snag is that you can’t configure the necessary bindings through the IIS Manager GUI. You can do it through an xml config file, however:\nLook in c:\\windows\\system32\\inetsrv\\config and edit the applicationHost.config file. Make sure you take a backup first! Find the \u0026lt;sites\u0026gt; section in the file. In there you will find a element for each IIS web site. Each of those has a \u0026lt;bindings\u0026gt; element with each port/protocol binding listed. Our main site looked like this: \u0026lt;bindings\u0026gt; \u0026lt;binding protocol=\u0026#34;https\u0026#34; bindingInformation=\u0026#34;*:443:\u0026#34; /\u0026gt; \u0026lt;/bindings\u0026gt;` and we changed it to look like this: `\u0026lt;bindings\u0026gt; \u0026lt;binding protocol=\u0026#34;https\u0026#34; bindingInformation=\u0026#34;*:443:**myhost.mydomain.com**\u0026#34; /\u0026gt; \u0026lt;/bindings\u0026gt; Repeat for each web application. If you have more than one web application on the same IP address using either http or https you need to configure a host header or you’ll have problems. Execute an iisreset. We now have all our content web applications, the SSP and the central administration web sites all running on a single IP address, many on the same port and using SSL.\nAs I said at the start of this post, we use a wildcard certificate which makes my initial IIS configuration easier. I haven’t tried multiple certificates, and I’m interested to know if that works or not.\n","date":"27 May 2009","externalUrl":null,"permalink":"/posts/configuring-iis-bindings-to-include-host-headers-with-https-on-windows-server-2008-for-sharepoint/","section":"Blog","summary":"NOTE: We use a wildcard SSL certificate which makes our life much easier when dealing with multiple hostnames. I have not tested this approach with multiple SSL certificates for specific sites.\n","title":"Configuring IIS Bindings to include host headers with https on Windows Server 2008 (for SharePoint)","type":"posts"},{"content":"I’ve been meaning to write this up for a while, simply because it’s not quite as straightforward as with Server 2005.\nTo configure incoming email on SharePoint when running on Server 2008 you’ll need to run through the following steps:\nInstall the SMTP feature\nOpen Server Manager. Click on Features in the left hand column then click add features in the right hand pane. Tick the SMTP Server check box and click install. Configure the SMTP Service in IIS Manager (version 7)\nStart Internet Information Services (IIS) Manager from Administration tools in the Start Menu. Once open, click the name of the web server to bring up the options in the centre panel. In the centre panel, right-click SMTP E-mail and select Open Feature from the menu.\nClick the option to ‘store e-mail in pickup directory’ and set the path to be c:\\inetpub\\mailroot\\Drop (that’s the default). Configure the SMTP Service in ISS Manager (version 7)\nStart Internet Information Services (IIS) 6.0 Manager from Administration tools in the Start Menu. Expand the server to show the SMTP service. In the ‘domains’ section, add any email domain aliases you need in there. Configure the other SMTP service settings just like you did with Server 2005. ","date":"27 May 2009","externalUrl":null,"permalink":"/posts/incoming-email-with-sharepoint-on-windows-server-2008/","section":"Blog","summary":"I’ve been meaning to write this up for a while, simply because it’s not quite as straightforward as with Server 2005.\nTo configure incoming email on SharePoint when running on Server 2008 you’ll need to run through the following steps:\n","title":"Incoming Email with SharePoint on Windows Server 2008","type":"posts"},{"content":"","date":"27 May 2009","externalUrl":null,"permalink":"/tags/project-server/","section":"Tags","summary":"","title":"Project-Server","type":"tags"},{"content":"I finally bit the bullet and decided to upgrade our SharePoint farm yesterday. I’d been holding off for a while because of time constraints and because of a known issue with Project Server, also part of our farm.\nI took careful steps to increment the farm from the SP1+Infrastructure update all the way through each CU up until the service pack. That all worked fine. It was when I tried SP2 I hit problems.\nThe first issue was that once I’d installed the WSS patch, the Sp2 patch refused to install. Rebooting the server then caused chaos as all my services complained that the SharePoint DB was the wrong version (too old, because I hadn’t run the config wizard yet).\nAndy and I spent a long time poking the server yesterday, and spent time building virtual machines to take over the farm as well. We finally knocked it on the head just shy of midnight and left the server in the state it was, trying to start the upgrade installer.\nWhen I got in this morning, the upgrade had installed. I’m guessing that the problems we were seeing were related to services starting and needing time to fail, and we simply hadn’t given them enough time to fail (mind you, the paranoid disk integrity check took a while…)\nMuch happier, I started the upgrade wizard. Which promptly failed. The logs showed the following:\n[WebApplicationSequence] [ERROR] [5/27/2009 7:48:09 AM]: Action 12.0.4.0 of Microsoft.SharePoint.Portal.Upgrade.WebApplicationSequence failed. [WebApplicationSequence] [ERROR] [5/27/2009 7:48:09 AM]: Feature \u0026#39;20477d83-8bdb-414e-964b-080637f7d99b\u0026#39; is not installed in this farm, and can not be added to this scope. [WebApplicationSequence] [ERROR] [5/27/2009 7:48:09 AM]: at Microsoft.SharePoint.SPFeatureCollection.AddInternal(Guid featureId, SPFeaturePropertyCollection properties, Boolean force, Boolean fMarkOnly) at Microsoft.SharePoint.SPFeatureCollection.Add(Guid featureId, Boolean force) at Microsoft.SharePoint.Portal.Upgrade.ActivatePublisingTimerJobsWebAppFeature.Upgrade() at Microsoft.SharePoint.Upgrade.SPActionSequence.Upgrade() [ActivatePublisingTimerJobsWebAppFeature] [12.0.4.0] [DEBUG] [5/27/2009 7:48:09 AM]: Begin Rollback() [ActivatePublisingTimerJobsWebAppFeature] [12.0.4.0] [DEBUG] [5/27/2009 7:48:09 AM]: End Rollback() [ActivatePublisingTimerJobsWebAppFeature] [12.0.4.0] [DEBUG] [5/27/2009 7:48:09 AM]: Begin Dispose() [ActivatePublisingTimerJobsWebAppFeature] [12.0.4.0] [DEBUG] [5/27/2009 7:48:09 AM]: End Dispose() [ActivatePublisingTimerJobsWebAppFeature] [12.0.4.0] [DEBUG] [5/27/2009 7:48:09 AM]: Elapsed time: 00:00:00.0312496. A quick dig with our old friend google turned up a couple of similar posts from Jukka on Moss and MySharePointofView so I had a look at the 12 hive and to my surprise found that there was no folder for the PublishingTimerJobs feature. I copied it from one of the new servers, already patched to SP2 and ran the command:\nstsadm –o installfeature –name PublishingTimerJobs\nThat succeeded. I then followed with the old favourite:\npsconfig –cmd upgrade –inplace b2b –force\nThat upgrade has just completed. No project-related errors, just success, so I add my experience to the collective.\n","date":"27 May 2009","externalUrl":null,"permalink":"/posts/sharepoint-service-pack-2-pains/","section":"Blog","summary":"I finally bit the bullet and decided to upgrade our SharePoint farm yesterday. I’d been holding off for a while because of time constraints and because of a known issue with Project Server, also part of our farm.\n","title":"SharePoint Service Pack 2 Pains","type":"posts"},{"content":"One of the most useful elements of the Virtual Windows XP feature in Windows 7 is that the VPC is easily replicated and you can have multiple virtual machines all publishing applications which run in their own sandboxes.\nCreate a new Virtual Machine\nCreate a Differencing Hard Disk from the Virtual Windows XP Base\nStart the VM and run through the setup wizard:\nAccept the Licence Agreement\nimage ]\nSet the keyboard and locale to your needs\nimage Give the PC a name and administrator password\nimage Set the time zone\nimage Wait while it configures networking…\nimage … and runs through the final steps, followed by a reboot.\nimage Configure the VPC for updates and user accounts:\nOn restart, choose an option for automatic updates\nimage You should now be logged in as administrator\nimage Open up Computer Management and enable the ‘User’ account, then reset the account password to something you know.\nimage image Enable Integration Features from the VPC Tools Menu\nimage Set the login account to the user account you just enabled.\nAccept the logon message to disconnect Administrator\nimage Configure the applications on the VPC:\nOnce you’re logged on as User, create a new shortcut in c:\\documents and settings\\all users\\start menu and wait a few minutes.\nimage You should see your start menu update with the new application shortcut\nimage Each virtual machine gets a folder in your start menu beneath Windows Virtual PC and the applications on each PC appear in there.\nOnce you’ve finished configuring your applications, log off your session on the virtual PC (don’t close the PC or shut it down)\nimage Then close the VPC down from the Action menu and choose Hibernate\nimage If you now start any of the applications that have appeared in your main computer’s Start menu, the VPC will fire up in the background and you application will appear on your desktop. This is a great way to create multiple VPCs with applications that might conflict with each other.\nThere is a catch, however. Windows Virtual PC requires hardware virtualisation support to work. In my opinion this is a mistake. Since the virtual machines use emulated hardware rather than accessing the machine hardware like Hyper-V VMs do, I can’t see the reasoning here. Virtual PC 2007 used the hardware virtualisation if it was available but didn’t force it on you, which was the correct approach. Lots of businesses will find this technology useful, but will discover that the majority of their computers won’t be able to use it. At that point, the solution may as well not exist, and I for one hope that Microsoft change their mind about hardware virtualisation support before Windows Virtual PC ships.\n","date":"26 May 2009","externalUrl":null,"permalink":"/posts/creating-a-new-virtual-pc-using-the-virtual-windows-xp-base-disk/","section":"Blog","summary":"One of the most useful elements of the Virtual Windows XP feature in Windows 7 is that the VPC is easily replicated and you can have multiple virtual machines all publishing applications which run in their own sandboxes.\n","title":"Creating a new Virtual PC using the Virtual Windows XP Base Disk","type":"posts"},{"content":"The title says it all. I’m currently building a virtual lab to test DirectAccess and every time I run newsid on windows server 2008 R2 the system bluescreens irrevocably on reboot. I’ve now switched to using sysprep to change the SID. Here’s hoping the sysinternals guys update what is undoubtedly one of the most useful tools around!\n","date":"8 May 2009","externalUrl":null,"permalink":"/posts/newsid-fails-on-windows-server-2008-r2/","section":"Blog","summary":"The title says it all. I’m currently building a virtual lab to test DirectAccess and every time I run newsid on windows server 2008 R2 the system bluescreens irrevocably on reboot. I’ve now switched to using sysprep to change the SID. Here’s hoping the sysinternals guys update what is undoubtedly one of the most useful tools around!\n","title":"NewSID fails on Windows Server 2008 R2","type":"posts"},{"content":"I’ve been using Windows 7 for a while now, but I’ve never needed to install the System Center Capacity Planner (Andy usually handles that side of our SharePoint engagements). He now has taken the plunge with Microsoft’s shiny OS and hit a problem: SCCP refused to install with an error message saying it was only supported on Windows XP (!)\nWe tried all sorts, and in the end I resorted to our old friend, Orca – the MSI editor shipped with the Windows SDK. Looking through the tables I found an entry in LaunchCondition specifying ‘VersionNT \u0026gt;=500 AND VersionNT \u0026lt;=600’\nOne quick hack later and it was looking for less than ‘700’ and the installer worked.\nimage Luckily, the SharePoint Planning installer needed no such hacking.\n","date":"31 March 2009","externalUrl":null,"permalink":"/posts/install-system-center-capacity-planner-2007-on-windows-7/","section":"Blog","summary":"I’ve been using Windows 7 for a while now, but I’ve never needed to install the System Center Capacity Planner (Andy usually handles that side of our SharePoint engagements). He now has taken the plunge with Microsoft’s shiny OS and hit a problem: SCCP refused to install with an error message saying it was only supported on Windows XP (!)\n","title":"Install System Center Capacity Planner 2007 on Windows 7","type":"posts"},{"content":"","date":"20 February 2009","externalUrl":null,"permalink":"/tags/dell-mini-9/","section":"Tags","summary":"","title":"Dell-Mini-9","type":"tags"},{"content":"You may remember that I ended my previous post with about 1.6Gb free on the 8Gb SSD of the Mini 9 after installing Windows 7.\nI still needed to install Office 2007, or at the very least Word and Excel for the ‘book to be useful. I therefore rummaged out another 16Gb SD card and revisited my earlier vista post about installing apps to an SD card. This time I simply let the card allocate a drive letter and installed Office to d:\\Program Files instead.\nThe trouble was, after installing Office I was down to about 400Mb free on the Dell’s SSD, despite installing the suite to the SD card. There are two reasons for this: Firstly, the common stuff goes into c:\\program files\\common files\\microsoft shared; secondly, the installer files are stored in c:\\windows\\installer.\nI then followed the steps in my post about moving installer files with Vista and created d:\\Windows\\Installer to hold the data. I’m now back to 1.3Gb free on the SSD. I have successfully installed a couple of apps (including some of the Wave 3 Live suite) following the change so I am pretty confident it works.\nI should point out at this juncture that after my previous post I received an email about junctions, Windows installer and Windows XP. That email warned me that performing the steps I documented with Windows XP was extremely dangerous and I should warn people against it. I did ask the mailer the reason why so I could post more detail, but I never got a response. The moral? Do this at your own risk, people.\nUltimately, I wouldn’t recommend the 8Gb SSD as a realistic option. The XP install shipped on it is compressed and slow. My Windows 7 solution is compressed (although not as slow as I had expected – it’s quite usable). Most importantly, once you’ve got the OS on, you’re a bit stuffed for anything else without resorting to hacks like the ones described here. I would say that 16Gb is a minimum, and depending on your needs a 32Gb SSD might be worth the money.\n","date":"20 February 2009","externalUrl":null,"permalink":"/posts/windows-7-on-the-8gb-ssd-mini-9-redux/","section":"Blog","summary":"You may remember that I ended my previous post with about 1.6Gb free on the 8Gb SSD of the Mini 9 after installing Windows 7.\nI still needed to install Office 2007, or at the very least Word and Excel for the ‘book to be useful. I therefore rummaged out another 16Gb SD card and revisited my earlier vista post about installing apps to an SD card. This time I simply let the card allocate a drive letter and installed Office to d:\\Program Files instead.\n","title":"Windows 7 on the 8Gb SSD Mini 9: Redux","type":"posts"},{"content":"","date":"20 February 2009","externalUrl":null,"permalink":"/series/windows-7-on-the-dell-mini-9/","section":"Series","summary":"","title":"Windows 7 on the Dell Mini 9","type":"series"},{"content":"In my previous post about getting Windows 7 onto the fantastic Dell Mini 9 I talked about solving things like the driver issues and antivirus. This time I’m going to cover how I installed Windows 7 onto the 8Gb SSD version of the Mini 9.\nInterestingly, Windows 7 will actually install in about 8Gb. However, when I tried to run through my previously documented steps, it told me that it did not recommend installing to a disk of less that 8303Mb. The Dell had about 7.5Gb free for the install as I wanted to leave the Dell system partition alone. When I tried to install the process reset partway through and I could not stop it doing it.\nSo I had a think. My final solution, in a nutshell, is the following:\nInstall to a VPC with a small disk but stop before the final step where it runs the OOBE (preparing to start for the first time…) Boot the VPC from another source and compress the contents of the disk. Create an image of the new disk and transfer that to the Dell. Complete the installation. The good news is – it works!\nSo, let’s run through that again and put a bit more detail into it.\nTo do this yourself you’ll need the following:\nThe drivers and software for the Dell Mini I listed in my previous post. The Windows 7 x86 install iso. The Windows 7 WAIK beta (to create WinPE media) Virtual PC 2007 It’s also easier to have Windows 7 running on the PC you’re going to use to host the VPC for reason which will become clear soon. Step 1: Create the VPC # I guess you don’t really need to limit the VPC to the same memory and disk as the Dell, but I did. Create a new VPC using the Vista template as the base. Set the memory to 1Gb and set the hard disk size to 8192Mb. While you’re at it, use the virtual disk wizard to create another VHD of the default size (16Gb, it’s more than enough) and call it something like ImageDisk. Don’t attach it to the virtual machine just yet.\nStep 2: Install Windows 7 from the ISO # Attach your Windows 7 ISO to the virtual machine and boot from it. Choose your language as normal and select the 8Gb disk to install to. Don’t disappear and leave the installer to it, however – you need to pay attention.\nThe installer will copy files and uncompress them. It then does a couple more steps and does a reboot. At this point, because I’m paranoid, I shut down the VPC and copied the VHD file.\nLet the VPC reboot. Again, pay attention. The installer carries on for a little while and then the system will restart. Again, shut the VPC down before it boots for a second time. Once again, I copied the VHD out of paranoia.\nStep 3: Compress the disk contents # There’s an irony here – the installer has just merrily uncompressed all your files and now you want to shrink them back down again. Ah, well…\nBoot the VPC from the installation CD. When you get the install screen up press Shift+f10 to open a command prompt.\nChange to the root of the c: drive and type the following:\nc:\\windows\\system32\\compact.exe /c /s /i\nThis will run through and compress all the files except hidden and system files like the page file and hibernate file. It takes a while, but it will take a heck of a lot less time on your VPC than it would if we tried this on the Dell.\nOnce it’s finished, type:\nc:\\windows\\system32\\shutdown /s /t 0\nor power off the VPC.\nStep 4: Create a Win PE disk # I’m not going to run through the process of creating a WinPE disk. Install the WAIK and follow the instructions. You should end up with an ISO file that can be used to boot the VPC. Make sure you copy imagex.exe onto it!\nStep 5: Image the VPC # We now need to create a .wim image of the installation we’ve partially completed. The easiest way to do that when using a VPC won Windows 7 is to mount a second VHD file and create the image on that. We can then attach the VHD to our Windows 7 host PC and copy off the image file.\nFirst of all, we need to partition and format the VHD we create to store the image. On your Windows 7 host computer, start Computer Management as an Administrator (type ‘com’ into the start menu, right click the computer management icon, chose ‘run as administrator’).\nRight-click on the Disk Management icon beneath Storage in the left hand pane and choose ‘Attach VHD’. Browse for your VHD file and click OK to mount it. You should see the new disk appear in the right hand panel.\nWe can do everything we need in Computer Management, but I find diskpart to be quicker. Open an administrative command prompt and type diskpart to fire it up.\nWe need to create a new partition. Computer Management helpfully tells us the number of our VHD so we can type that into diskpart. For example:\nselect disk 1\nThen to create a partition:\ncreate partition primary\nAnd then, being eclectic, I use Computer Management to quick format it as NTFS because it’s easier to right-click the disk and choose ‘Format’!\nNow we have a formatted partition, we can right-click the disk in computer management and detach the VHD. You can do that in Diskpart as well, I know…\nNow edit your VPC configuration and add the second VHD. Boot the VPC from the WinPE ISO you created and you will end up with a command prompt.\nThe next bit is easy:\nimagex /capture \u0026lt;drive letter of our system disk, hopefully c:\u0026gt; \u0026lt;drive letter of our big empty disk, possibly d:\u0026gt;\\Mini9.wim “Mini9”\nThe sytem will chug for a while and you will be left with a shiny wim file on the second VHD. Mine was about 2.7Gb.\nStep 6: Transfer the image onto the Dell # The easiest way to do this is to create a WinPE USB stick with your wim file on it as well. You’ll need to format your USB stick as NTFS and then xcopy the WinPE disk contents onto it. Make sure you use the /S (subdirectories), /H (copy hidden and system), /E (copy empty directories) and I usually tack on the /Y (don’t prompt) for a quiet life:\nxcopy \u0026lt;source drive\u0026gt;\\. \u0026lt;usb drive\u0026gt;\\ /s /h /e /y\nThen copy your .wim file on as well.\nI usually use the Windows 7 install media to delete the original OS partition from the Dell, simply because the UI is nicer than using diskpart. You may differ. If you follow the WAIK instructions and use the diskpart ‘clean’ command you risk losing the Dell partition as well.\nArmed with a nice empty Dell disk, boot from your USB WinPE disk.\nFirst we need to partition the disk:\ndiskpart list partition` \u0026lt;you need to remember the number of the big partition! I’m going to assume it’s 1 for now\u0026gt;\nselect partition 1 active format fs=ntfs assign exit And now you should have a nice big empty partition which you need to work out what drive letter WinPE has assigned (it may or may not be c:)\nTo put your image onto the disk use the following:\nimagex.exe /apply \u0026lt;usb disk path\u0026gt;\\Mini9.wim 1 \u0026lt;dell disk\u0026gt;:\\\nOnce again, site back and wait. When the imaging is completed you can shutdown the Dell, remove your USB stick and follow the same procedure as I talked about before to get your drivers installed.\nStill to do… # I haven’t sorted out applications yet. There’s only about 1.6Gb free on the disk after this process is completed. I am looking at using the SD card for applications in the same way as I talked about in my post about Vista and junctions.\n","date":"19 February 2009","externalUrl":null,"permalink":"/posts/windows-7-on-the-dell-mini-9-with-only-the-8gb-ssd/","section":"Blog","summary":"In my previous post about getting Windows 7 onto the fantastic Dell Mini 9 I talked about solving things like the driver issues and antivirus. This time I’m going to cover how I installed Windows 7 onto the 8Gb SSD version of the Mini 9.\n","title":"Windows 7 on the Dell Mini 9 with only the 8Gb SSD","type":"posts"},{"content":"The steps in this article were figured out with Windows 7. However, they should work just fine with Vista for anybody having the same issues. Note that whilst this is written for ATI hardware, it may be the case that NVidia gear suffers from the same problem and this solution should help.\nBackground first. I spent a while sorting our AV gear so I could use HDMI as the universal connection standard. At the heart of this is an AV receiver with a number of HDMI inputs and HDMI output to the TV.\nI spent a while looking at how to achieve audio output over HDMI for the Media PC we have. The previous model, which had given exemplary service, was built around a Shuttle SN41G2 chassis. With the graphics card it had, DVI was possible, and optical digital output, but it didn’t have the grunt to decode high definition video, so it needed replacing.\nAs I mentioned in a previous post, it’s replacement was a Hiper barebones built around the AMD 690G chipset which has HDMI output and, critically, will support audio over HDMI.\nI started the great process of connection and configuration simply – PC plugged directly into TV. In this configuration, I simply set the HDMI audio output device as the default output device and happily got sound from the TV and faultless video.\nThat was easy! I unplugged the PC from the TV, plugged it into the AV receiver and continued to get sound and video. Brilliant!\nReboot the PC, however, and the video gets crappy and the audio disappears.\nI did a great deal of digging and found a whole heap of discussion related to this issue on the fantastic AV Science Forum. The problem, it turns out, is widespread, and afflicts owners of ATI hardware the world over when connecting to AV receivers of all makes and models. The root cause seems to centre around the capabilities information passed down the HDMI connection when plugged into the AV receiver. For some reason, it seems to confuse the capabilities of the TV and receiver in such a way as to convince the PC that audio is not supported.\nThe solution, it turns out, is to create your own device driver .inf file which details correctly the capabilities of the TV and receiver and overrides the connection information.\nThe forums had much discussion involving registry hacking, copying and pasting of hex data into. inf files and much more. However, they also focused on a tool referred to in the forums as moninfo. A bit of googling later and it turns out they mean Monitor Asset Manager – a free utility from EnTech, makers of the mighty PowerStrip shareware tool.\nArmed with this mighty tool, the steps to success are as follows:\nConnect the PC to your TV (no AV receiver in the loop). I would reboot the PC to make sure it’s sensed everything correctly at the start of the process. Run Monitor Asset Manager. It will display all manner of information detailing the TV and its capabilities. Click the file menu and hit ‘Create INF…’ and give the file a sensible name (mytv.inf for example). Hit F5 to refresh the moninfo display. Make sure it refreshes correctly. You may need to click on different bits of the window to make sure focus is set correctly. Now comes the tricky part. Unplug the TV from the PC. You now need to connect the PC to the AV receiver, but making sure that the receiver is not connected to the TV. This means you won’t be able to see anything on screen so make sure you don’t accidentally switch focus away from moninfo. You can’t have any other displays attached either, as this will confuse the information moninfo sees. Working blind, hit F5 a few times to make sure the moninfo details are refreshed with the information from the receiver. Leaving the PC for a few minutes to make sure all the hardware connections have sorted themselves first is a good idea. Disconnect the PC from the receiver and reconnect to the TV so you can see what you’re doing. Don’t refresh moninfo! Repeat the process to create a new .inf file. Call it something like myreceiver.inf. The next part moninfo can do for you, but I did it myself to make sure I knew what was going on. Choosing ‘merge extension block with inf’ from the file menu should allow you to take a crucial bit of the sensed details from the AV receiver and combine them with the details in the tv inf file. I did by hand. Create copies of the mytv.inf and my.receiver.inf. Open myreceiver.inf. You will see a line which says\n;Extension bloc #1, e.g. , CEA-EXT, DID-EXT, etc.\nCopy the line beneath it which begins HKR, EDID_OVERRIDE,”1” to the clipboard. Open mytv.inf. Find the same line\n;Extension bloc #1, e.g. , CEA-EXT, DID-EXT, etc.\nReplace the line beneath it with the line from your clipboard. Save the .inf file as something else (mytvandreceiver.inf) You now have a device information file which will override the information received over the HDMI connection and convince your PC to support the output formats it should do – including sound!\nConnect your systems up how you actually want them – PC to receiver, receiver to TV and reboot the PC.\nIn Windows 7, to use the custom .inf file with your monitor, follow the steps below:\nRight-click the desktop and select Screen Resolution. Click the link on the right hand side of the dialog which says ‘Advanced Settings’ In the dialog that appears, select the Monitor tab and then click the Properties button. In the new dialog, select the Driver tab then click the Update Driver button. Select the option to ‘Browse my computer for driver software’. On the next screen, choose ‘Let me pick from a list of device drivers on my computer’. On the next screen, click ‘Have Disk’. In the file dialog, browse to the folder with your mytvandreceiver.inf file (this is much easier if it’s the only file in the folder) and select it. You should then see your device listed in the driver selection screen. Select it and click Next. You may need to confirm that you want to use the driver as it is not digitally signed. Once you’ve got the driver installed, reboot your PC. You should find that you get the decent picture and HDMI audio that you had when plugged into the TV.\nKudos to the guys on the AVS Forums who figured all this out. It was extremely frustrating until I found their sage advice.\n","date":"8 February 2009","externalUrl":null,"permalink":"/posts/achieving-hdmi-audio-output-with-ati-hardware-on-windows-7-and-vista/","section":"Blog","summary":"The steps in this article were figured out with Windows 7. However, they should work just fine with Vista for anybody having the same issues. Note that whilst this is written for ATI hardware, it may be the case that NVidia gear suffers from the same problem and this solution should help.\n","title":"Achieving HDMI audio output with ATI hardware on Windows 7 (and Vista)","type":"posts"},{"content":"","date":"8 February 2009","externalUrl":null,"permalink":"/tags/hdmi/","section":"Tags","summary":"","title":"Hdmi","type":"tags"},{"content":"","date":"8 February 2009","externalUrl":null,"permalink":"/tags/media-center/","section":"Tags","summary":"","title":"Media-Center","type":"tags"},{"content":"","date":"8 February 2009","externalUrl":null,"permalink":"/tags/vista/","section":"Tags","summary":"","title":"Vista","type":"tags"},{"content":"One of the things I am most impressed about with Windows 7 is the latest Media Center. As a result, I wanted to install the build 7000 beta release onto our media PC at home. However, I already have that working nicely with Windows Vista and, frankly, I didn’t want to have to repeatedly reinstall if the beta caused problems.\nThe solution seemed simple: install Windows 7 to a VHD file sitting on the Vista disk. Whilst at TechEd, Mark Russinovich had mentioned that he was running Windows 7 in exactly this way, so I was pretty confident it would work.\nMaybe that was my first mistake. Perhaps my second was trying Win7 x64, but when you have a 64-bit CPU why use anything less?\nSo, I started my quest with a 500GB hard disk which had a single partition, onto which Vista Ultimate x64 had already been installed. The disk had the thick end of 400GB free (there’s nothing installed but Vista and some codecs).\nI had planned to boot from USB (the install goes much quicker that way) but whilst the BIOS of the machine saw my USB stick as a drive, the boot menu didn’t want to let me boot from it. I could have spent a while messing, but for the time it takes these days to burn a DVD, I did that instead.\nSo… boot from DVD into Windows 7 setup. When the first screen appears, I hit shift+F10 to get a command prompt (that’s something I didn’t know until today, and I shall be remembering it, you can bet on that!).\nOnce inside the command prompt I execute the following sequence of commands to create the 100GB VHD file I want to install Win7 to:\ndiskpart create vdisk file=c:\\win7beta.vhd maximum=100000 Diskpart successfully created the virtual disk file select vdisk file=c:\\win7beta.vhd Diskpart successfully opened the virtual disk file attach vdisk Diskpart successfully attached the virtual disk file I then exited diskpart and the command prompt, and stepped through the install as normal by selecting a language, choosing to install, not upgrade, agreeing to the licence etc.\nI then got the familiar screen asking ‘Where do you want to install windows?’. This showed my a shiny new disk (listed as disk 5) which had 97.7GB of unallocated space.\nBuoyed with success, I selected the disk.\n‘Windows cannot be installed to this disk. The computer’s hardware may not support booting to this disk. Ensure that the disk’s controller is enabled in the computer’s BIOS menu’ said the installer.\nDarn!\nI didn’t have any drivers to hand that I knew were for the system I was installing to, and I couldn’t be bothered rummaging around the web for them when I didn’t know what the chipset was. So I decided to experiment a bit…\nMy thinking was this: Perhaps it’s because I had Vista underneath, or perhaps if I could get Windows 7 onto the machine in some other way, I might suck the drivers out of that install. I had some time, so why not experiment…\nI still wanted to keep my Vista installation, so why not clear some space on the hard disk to install to a new partition? I opened a new command prompt and started diskpart:\nSelect disk 0 select partition 1 Partition 1 is now the selected partition shrink desired=100000 Diskpart successfully shrunk the volume by: 98 GB I really like that diskpart will let you shrink partitions. The fact that I can tinker with my disk layout on the fly all from within Windows 7 installation is great!\nI exited the command prompt and refreshed the installation location screen. I now saw 97.7GB of unallocated space on disk 0, and chose that to install to. That ran through just exactly how you’d expect, with no issues.\nAt this point, however, as I watched the installation screen sitting on ‘Completing installation…’ I was thinking how doing this on a machine with no hard disk activity LED was not the best plan. Blinking lights are annoying when you’re trying to watch TV, but they’re really nice when you’re installing stuff!\nWindows 7 started OK and installed a few updates. I then checked the disk controller drivers. Windows 7 was reporting ‘Standard Dual Channel PCI IDE Controller’ times two, with two each of ‘ATA Channel 0’ and ‘ATA Channel 1’.\nBefore attempting to find more specific drivers, I decided to try again with the VHD installation. My reasoning was that Windows 7 would now have updated the bootloader on the system, and perhaps that had some involvement in whether or not I could successfully install to the VHD.\nYou may be thinking that I am now drifting into the realm of folly – I have a working Windows 7 installation on the system so why continue? The answer is that I hadn’t had chance to experiment with installing to VHD before this and I wanted to get as far as I could and learn as much as I could.\nBooting from the installation DVD again, I once more attached the VHD I had created on the vista drive and once more could not install. At this point, I wondered if the type of VHD had a bearing. I had failed to specify a type when I created the original VHD, meaning that it would have defaulted to being dynamic. Perhaps only VHD’s of type fixed would do the job. I therefore created a second VHD, of type fixed, called win7betafixed.vhd. Note to self – next time, choose a smaller size when testing stuff! After a good thirty minutes of staring at task manager reporting virtually no disk or CPU usage I decided that perhaps something was wrong and killed the process.\nI booted Windows 7 to create the VHD through the GUI. Interestingly, Win 7 hadn’t automatically assigned a drive letter to my Vista disk in the way that Vista itself always does with multiple partitions. This time the sound of disk access and the automatic installation of a Microsoft VHD HBA device gave me more confidence. It still took a long time though…\nI rebooted again and started the Win7 setup process. Once again I attached the VHD file, once again the installation routine saw the disk and once again it refused to install. At this point my frustration levels got the better of me. I will try this again on a different system, but I’m admitting defeat on the media PC.\nIf I have more success on other systems, or if I figure out exactly why I got nowhere with my media PC, I will let you know. My gut says that I need to find drivers for the disk controller to load during setup.\nFor ref, the PC is Hyper barebones media PC HMC-2K53A-A3) with an MSI K9AGM2, AMD 690G chipset motherboard and an AMD Athlon X2 4450e CPU.\n","date":"7 February 2009","externalUrl":null,"permalink":"/posts/windows-7-attempting-to-install-to-vhd-an-odyssey/","section":"Blog","summary":"One of the things I am most impressed about with Windows 7 is the latest Media Center. As a result, I wanted to install the build 7000 beta release onto our media PC at home. However, I already have that working nicely with Windows Vista and, frankly, I didn’t want to have to repeatedly reinstall if the beta caused problems.\n","title":"Windows 7: Attempting to install to VHD – an odyssey","type":"posts"},{"content":"Having just spent a long time examining the state of a new farm we’ve been working on for demonstrations, I would like to issue a warning…\nThe Problem: None of the ‘New…’ menu items in our document libraries would work – we were seeing the error message:\n\u0026lsquo;Edit Document\u0026rsquo; requires a Windows SharePoint Services-compatible application and Microsoft Internet Explorer 6.0 or greater.\nThe Solution: Correcting an error in the docicon.xml file which lives in c:\\program files\\common files\\microsoft shared\\web server extensions\\12\\TEMPLATE\\XML\nThe Cause: Adobe’s documentation for installation of the 64-bit iFilter. We copied and pasted the line from the documentation (yeah, I know, our mistake…) which reads:\n\u0026lt;Mapping Key=\u0026quot;pdf\u0026quot; Value=\u0026quot;pdf.gif\u0026quot;\u0026gt;\nNote the lack of the trailing slash, as required by XML the world over. The line should read:\n\u0026lt;Mapping Key=\u0026quot;pdf\u0026quot; Value=\u0026quot;pdf.gif\u0026quot; /\u0026gt;\nWith some luck this will help others – I spent a long time searching the internet to no avail.\n","date":"6 February 2009","externalUrl":null,"permalink":"/posts/sharepoint-2007-following-adobe-instructions-can-cause-problems/","section":"Blog","summary":"Having just spent a long time examining the state of a new farm we’ve been working on for demonstrations, I would like to issue a warning…\nThe Problem: None of the ‘New…’ menu items in our document libraries would work – we were seeing the error message:\n","title":"SharePoint 2007: Following Adobe Instructions Can Cause Problems","type":"posts"},{"content":"I\u0026rsquo;m using the Mini9 quite a lot lately, at least in part to fiddle with Windows 7. I decided it would be nice to be able to access our Hyper-V servers so I went looking for the management tools\u0026hellip;\nIt turns out that Windows 7 ships with the Hyper-V management snap-ins. No real surprise there as my understanding is that it also includes Hyper-V (although I\u0026rsquo;ve not managed to run it up on an x64 machine yet so I can\u0026rsquo;t verify that - it certainly isn\u0026rsquo;t available in x86). To get at them, you need to install the relevant bits of Windows through the \u0026lsquo;Turn Windows Features on or off\u0026rsquo; UI:\nMake sure the third item down is checked:\nOnce that\u0026rsquo;s installed, you can find the Hyper-V Management Console in Administrative Tools via Control Panel.\nBut it doesn\u0026rsquo;t work!\nJohn Howard wrote a very useful series of posts about solving this issue with Vista and Server 2008. It turns out that there is one bit which is still relevant in Windows 7. Setting COM Security via dcomcnfg still needs to be done:\nYou need to run dcomcnfg as an administrator to do this. Once in, browse through Component Services, Computers to see \u0026lsquo;My Computer\u0026rsquo;. Right-click and pull up Properties. In the COM Security tab you need to select Edit Limits in the Access Permissions section. Make sure that ANONYMUOS LOGON has Remote Access rights enabled.\nOnce that\u0026rsquo;s done, the Hyper-V management console will happily connect to remote servers.\nIt\u0026rsquo;s quite frustrating that the management tool installation does not do this, or if security is an issue, that there isn\u0026rsquo;t a more user friendly way (like an option in the snapin to help) to set the rights correctly.\n","date":"2 December 2008","externalUrl":null,"permalink":"/posts/managing-remote-hyper-v-servers-from-windows-7/","section":"Blog","summary":"I’m using the Mini9 quite a lot lately, at least in part to fiddle with Windows 7. I decided it would be nice to be able to access our Hyper-V servers so I went looking for the management tools…\n","title":"Managing Remote Hyper-V Servers From Windows 7","type":"posts"},{"content":" What better way to try Windows 7 then installing it on the Mini 9? Having read all the commentary about the smaller footprint of the new OS I couldn\u0026rsquo;t resist.\nIf you want to try this yourself, the procedure is exactly as if you were installing Vista. You will need the drivers folder from the Dell, along with the contents of the Program Files\\Wireless Select Switch folder from the XP install and the R192569.exe file from the ZIPFILES folder which is on the support CD I believe.\nInstalling Windows 7 is a pretty quick and easy process - much faster than Vista. Once installed, follow the same procedure as with Vista to install the hardware drivers from the drivers folder you copied, then run the R192569.exe installer to get the battery driver on. Finally, copy the Wireless Select Switch folder into c:\\program files and add an icon to your startup group which fires up the WLSS.exe program - that will allow you to toggle Bluetooth and wireless LAN on and off.\nOnce that\u0026rsquo;s done, follow the steps that Paul Thurrott has on WinSuperSite about enabling the \u0026lsquo;awesome bar\u0026rsquo; (does anybody else besides me hate that name?).\nI then installed AVG AntiVirus. The corporate version we have failed completely to install, so I turned to AVG Free. That installed fine, but complained at first about being unable to start the resident scanner. A couple of reboots and updates sorted that with no intervention from me and it now works fine.\nOffice and Live Writer are now installed and I have 4Gb free of my 16Gb SSD. I haven\u0026rsquo;t fiddled with performance tuning yet - the OS ticks over using about 550Mb of RAM. With Live Writer and Internet Explorer 8 running I have about 300Mb of RAM free.\nFirst impressions? Great! Quick, easy to install, UAC is improved, like the new Taskbar UI\u0026hellip; I now want to try out some of the other features such as Bitlocker To Go. I hope to get a Server 2008 R2 test environment running as well so I can try things like DirectConnect etc. If I make progress, I\u0026rsquo;ll post more.\nBottom line: Windows 7 - the OS the Mini 9 was built for.\n","date":"10 November 2008","externalUrl":null,"permalink":"/posts/windows-7-on-the-dell-mini-9/","section":"Blog","summary":" What better way to try Windows 7 then installing it on the Mini 9? Having read all the commentary about the smaller footprint of the new OS I couldn’t resist.\n","title":"Windows 7 on the Dell Mini 9","type":"posts"},{"content":"The last session of the day was just incredible. A surfer-dude with boundless energy wandering around the audience in shorts, cracking jokes and telling stories and every single one related in some way to his point. Steve Riley is a fantastic presenter, and his session - Do these ten things now or else get 0wned was a great session on security. Sadly, I don\u0026rsquo;t think it\u0026rsquo;s repeated or I would urge you all to attend the next viewing. If you have the chance to see Steve speak, grab it with both hands - especially if you are involved in any way with security or IT management.\n","date":"6 November 2008","externalUrl":null,"permalink":"/posts/tech-ed-emea-it-day-3-steve-riley/","section":"Blog","summary":"The last session of the day was just incredible. A surfer-dude with boundless energy wandering around the audience in shorts, cracking jokes and telling stories and every single one related in some way to his point. Steve Riley is a fantastic presenter, and his session - Do these ten things now or else get 0wned was a great session on security. Sadly, I don’t think it’s repeated or I would urge you all to attend the next viewing. If you have the chance to see Steve speak, grab it with both hands - especially if you are involved in any way with security or IT management.\n","title":"Tech Ed EMEA IT: Day 3 - Steve Riley","type":"posts"},{"content":"So, we\u0026rsquo;re on the penultimate day of TechEd EMEA and I have to say that exhaustion is starting to creep in. However, the day had a great start with sessions by Steve Riley and then Mark Russinovich.\nSteve was talking about security implications of virtulisation and his views were stimulating. He was talking in depth about what to consider when virtualising machines and why Microsoft took the architectural approach that they did for the Hyper-V stack when security was considered. I could post more, but I would urge you to go and find the video of the session when it\u0026rsquo;s available as Steve himself gave a much better delivery of the material than I ever could.\nNext up was Mark Russinovich, of sysinternals fame. I\u0026rsquo;ve been using tools produced by sysinternals for a long time, but almost always from the standpoint of figuring out how to make apps run with the least possible security. That means filemon and regmon, now replaced by Process Explorer. What Mark was showing was how to use ProcExp with some of his other tools to analyze why applications crash and how to drill right down into crash dump files to identify the offending code. It was a very cool presentation and his delivery was both engaging and amusing. If you get the chance to see him speak I would highly recommend it.\n","date":"6 November 2008","externalUrl":null,"permalink":"/posts/tech-ed-emea-it-day-4-guru-central/","section":"Blog","summary":"So, we’re on the penultimate day of TechEd EMEA and I have to say that exhaustion is starting to creep in. However, the day had a great start with sessions by Steve Riley and then Mark Russinovich.\n","title":"Tech Ed EMEA IT: Day 4 - Guru Central","type":"posts"},{"content":"","date":"6 November 2008","externalUrl":null,"permalink":"/tags/tech-ed-emea-it-2008/","section":"Tags","summary":"","title":"Tech-Ed-Emea-It-2008","type":"tags"},{"content":"","date":"6 November 2008","externalUrl":null,"permalink":"/series/teched-emea-it-2008/","section":"Series","summary":"","title":"TechEd EMEA IT 2008","type":"series"},{"content":"OK, MED-V is cool! Sadly, cool though it is, it\u0026rsquo;s not something we\u0026rsquo;ll use3 at BM, but in my previous lives doing large organisation IT, MED-V would have been a killer.\nIn a nutshell, it is this: create a Virtual PC image with your legacy OS and legacy App. Deploy that VPC to your users desktop so they can run your legacy app but let them run the app without needing to start the VPC and use two desktops.\nThat\u0026rsquo;s right - MED-V apps appear in the host OS Start Menu and fire up windows which, although using the appearance of the guest OS, are hosted straight on the desktop. Not only that, but they get task bar entries, and even tray icons!\nIt\u0026rsquo;s really well thought out - admins create the VPCs, publish them into a server infrastructure and publish the images and apps to users. The system takes care of versioning for the images and pushes them out to users which reduces the amount of data transferred.\nYou can allow roaming users to work remotely as well, but do clever things like setting a time limit, after which the virtual apps won\u0026rsquo;t work because the user needs to connect to the main system to get updates to the guest OS.\nIt\u0026rsquo;s great. It\u0026rsquo;s also not out yet. Beta 1 is expected Q1 2009, although they are looking for early access users. Release is projected for H1 2009. If you\u0026rsquo;re a big organisation and migration to Vista is a pain, MED-V may be for you, although it\u0026rsquo;s only available to SA customers, as far as I can tell.\nThe snags (there are always some, right?): Host OS is Vista Sp1 or XP SP2/3 32-bit only. Guest OS is Windows XP or Windows 2000 only.\nIt was a great session, and you definitely want to find out more about this.\n","date":"5 November 2008","externalUrl":null,"permalink":"/posts/tech-ed-emea-it-day-3-microsoft-enterprise-desktop-virtualisation-med-v/","section":"Blog","summary":"OK, MED-V is cool! Sadly, cool though it is, it’s not something we’ll use3 at BM, but in my previous lives doing large organisation IT, MED-V would have been a killer.\n","title":"Tech Ed EMEA IT: Day 3 - Microsoft Enterprise Desktop Virtualisation (MED-V)","type":"posts"},{"content":"We were in early today, looking forward to a session on SharePoint with Bill Engolish. Sadly, that was cancelled so Andy and I sat in on the Server 2008 R2 overview session presented by Iain McDonald. That was very interesing, and we learned a bit more about BranchCache. It doesn\u0026rsquo;t look like it will replace WAN accelerators like Riverbved, because it doesn\u0026rsquo;t appear to function at their low level. However, it does a similar thing at the file level. The client requests a file from the remote server, which instead replies with hashes. The client PC the requests those hashes from the local cache, improving performance. The cache itself is built on request so does not need to be pre-populated (which is good). I think WAN accelerators have nothing to fear from this, but for smaller organisations or ones which aren\u0026rsquo;t able to put the accelerators in (perhaps their servers are hosted, for example) BranchCache looks like a very promising technology.\nSomething I saw and got excited about is DHCP failover. We don\u0026rsquo;t suffer much with DHCP outage, but because the only way to sync up two DHCP servers is to export and import it\u0026rsquo;s very hard to do resilient services. DHCP failover should solve that, and it looks good.\nAlso, more on the \u0026gt;net on server core front. The key \u0026rsquo;takeaway\u0026rsquo; is that it is a subset of .Net 2, .Net 3 (WCF and WF, not WPF) and .Net3.5 (WF additions and Linq). That makes sense - why include elements related to the GUI. However, subset obviously means compatibility pitfalls and I am still very interested to see where this goes.\nWe spoke to a few guys on the IIS stand yesterday about SharePoint on IIS7. I need to talk to the SharePoint guys about the same thing. The IIS chaps were optimistic that what I wanted to do would work, but there had been no effort put into testing of the scenario as yet. As far as I am concerned, at the very least I want to be able to run my WFE servers as server core for security reasons. I\u0026rsquo;d really like to be able to deploy the app server roles to core as well, which falls in line with a single-purpose server, virtualised strategy.\nI\u0026rsquo;m writing this as I wait for the MED-V session to start. The brief intro to this given during the Windows 7 session made it sound exciting and I really hope to come away from this feeling energised. Whilst it\u0026rsquo;s been a solid conference so far, there\u0026rsquo;s not been much to give me a buzz - perhaps this is it. I\u0026rsquo;ll take notes and try to post my thoughts later.\n","date":"5 November 2008","externalUrl":null,"permalink":"/posts/tech-ed-emea-it-day-3-server-2008-r2/","section":"Blog","summary":"We were in early today, looking forward to a session on SharePoint with Bill Engolish. Sadly, that was cancelled so Andy and I sat in on the Server 2008 R2 overview session presented by Iain McDonald. That was very interesing, and we learned a bit more about BranchCache. It doesn’t look like it will replace WAN accelerators like Riverbved, because it doesn’t appear to function at their low level. However, it does a similar thing at the file level. The client requests a file from the remote server, which instead replies with hashes. The client PC the requests those hashes from the local cache, improving performance. The cache itself is built on request so does not need to be pre-populated (which is good). I think WAN accelerators have nothing to fear from this, but for smaller organisations or ones which aren’t able to put the accelerators in (perhaps their servers are hosted, for example) BranchCache looks like a very promising technology.\n","title":"Tech Ed EMEA IT: Day 3 - Server 2008 R2","type":"posts"},{"content":"Andy and I are now in a TMG preview demo. This looks really interesting - we spoke to the guys at ATE last night and saw a few items that I hope to see now in more detail. TMG is ISA Server vnext - codenamed \u0026lsquo;Nitrogen\u0026rsquo; and part of the \u0026lsquo;Stirling\u0026rsquo; next wave of Forefront.\nStirling family members exchange information to allow \u0026lsquo;dynamic response\u0026rsquo; - trigger actions from different forefront elements (client sec etc) based on alerts from other elements (eg mail scanner). That looks really powerful.\nNew in TMG is web client protection - threat protection. Scan downloaded files as they pass through for malware. This blocks download of malware and shows the user a message page. Finally - way to save some users from themselves!\nTMG can now also inspect ssl traffic! TMG encrypts between client and itself using it\u0026rsquo;s own certificate to the client, assuming the cert from the actual site is valid. Notably, if you enable https inspection you can make TMG tell the users - warn them, if you like - that their \u0026lsquo;secure\u0026rsquo; connection is being inspected. You can also exclude categories of sites from this inspection.\nFor large files, TMG will show the user a \u0026lsquo;comforting\u0026rsquo; page informing them that the file has been downloaded by TMG and is being scanned for malware.\nTMG inspects traffic and will try to detect if a download manager is being used. At that point the \u0026lsquo;comforting\u0026rsquo; page won\u0026rsquo;t be displayed. Interestingly, you can also block the download of encrypted zip files if you like - i.e. if TMG can\u0026rsquo;t scan it, don\u0026rsquo;t let it through.\nTMG can also now do URL filtering. This is category-based, so you can block categories of sites. The site lists can be acquired through an external service. Can override the https inspection for categories of sites as well - e.g. banking sites.\nThese are gathered into the heading of Web Access Policies, which cover URL filtering, https inspection and malware inspection.\nAlso interesting is the Intrusion Prevention Systems which allows TMG to detect and block exploits for vulnerabilities, even if the hotfix is not yet released (such as the sql worm, for example). The demo of this was really cool, albeit in a geeky kind of a way. The exploit protection uses signatures which will be dowloaded and deployed, and my understanding is that they are not limited to TMG.\nThe firewall can also now continue to run if the logging DB server goes away. TMG creates a log queue locally, continues to operate normally, and will update the DB when it comes back online. The log viewer also continues to work, albeit only accessing the local queued items.\nThis is all cool stuff. There\u0026rsquo;s lots more too, but the things I\u0026rsquo;ve mentioned here are of use to everyone, whereas some of the other stuff covered is certainly less applicable to us at BM because of the way we work. Another solid-looking new product that I would recommend anybody to look into, and particularly if you\u0026rsquo;re currently using ISA 2006.\n","date":"4 November 2008","externalUrl":null,"permalink":"/posts/teched-emea-it-day-2-threat-management-gateway/","section":"Blog","summary":"Andy and I are now in a TMG preview demo. This looks really interesting - we spoke to the guys at ATE last night and saw a few items that I hope to see now in more detail. TMG is ISA Server vnext - codenamed ‘Nitrogen’ and part of the ‘Stirling’ next wave of Forefront.\n","title":"TechEd EMEA IT: Day 2 - Threat Management Gateway","type":"posts"},{"content":"So, the first session of the day was an extremely well-attended overview of Windows 7 features. When they talk about evolution rather than revolution with regard to Windows 7, I think that\u0026rsquo;s accurate. It was very much about developing and extending the foundations of Vista.\nA few things stuck out, however. An almost throwaway comment about DirectConnect requiring IPSEC and IPv6 means that I must dig deeper, and that the technology, whilst cool, is almost totally useless to me, stuck behind two layers of NAT in a managed building. BranchCache was again mentioned with, again, no indication of how it works - more digging required.\nMost pertinent to me, however, was the development of Bitlocker. I am typing this as I sit in the room waiting for the deep dive session on Bitlocker enhancements to start. The key new feature in Windows 7 is the ability to encrypt removable drives using Bitlocker. Interestingly, admins can also use policies to enforce encryption, at which point unencrypted drives become read only. Backwards compatibility ensures that \u0026lsquo;Windows XP and Vista\u0026rsquo; can \u0026lsquo;read\u0026rsquo; data from the drives. I\u0026rsquo;m guessing they can\u0026rsquo;t write, and I\u0026rsquo;m also guessing (as it wasn\u0026rsquo;t mentioned) that non-windows systems need not apply.\nThat lack of cross platform (and now I\u0026rsquo;m talking about OSX and Linux) support may anger some, but for our company needs it\u0026rsquo;s irrelevant. We already ensure no customer or sensitive data is copied on removable storage, but being able to encrypt, and force the encryption of all removable media attached to systems I own will help be be able to guarantee that any data copied from our systems is stored securely.\nNOTE: Having now been to the deeper dive on Bitlocker, the current build of Windows 7 has no downlevel support. I\u0026rsquo;m really hoping this will change prior to launch (the presenter was carefully non-comittal, and probably rightly so at this stage). If it doesn\u0026rsquo;t the technology is a dead duck for us, as I can\u0026rsquo;t guarantee being able to get all our machines up to Windows 7 in a reasonable timeframe.\nAlso of interest to me were the developments in deployment technologies. I will try to attend the appropriate sessions on these too - the ability to add new drivers to wim and vhd files offline (and post-sysprep) could be a big benefit to use in extending the life of our system images, particularly as we look towards more automated provisioning of virtual machines from vhd and wim files onto varied hardware (especially when I get my hands on hyper-v in Windows 7!).\nOverall it was a very interesting session, albeit shallow. Windows 7 is exciting - not because it is new and cool, but almost precisely because it isn\u0026rsquo;t. It is to Vista what Windows 2000 was to NT4 and XP beyond - evolved, more stable, more trustworthy.\n","date":"4 November 2008","externalUrl":null,"permalink":"/posts/teched-emea-it-day-2-windows-7-feature-preview/","section":"Blog","summary":"So, the first session of the day was an extremely well-attended overview of Windows 7 features. When they talk about evolution rather than revolution with regard to Windows 7, I think that’s accurate. It was very much about developing and extending the foundations of Vista.\n","title":"TechEd EMEA IT: Day 2 - Windows 7 Feature Preview","type":"posts"},{"content":"So, the keynote was interesting. Much of the content I had seen before, but there were some demos that were interesting and a few snippets that made me take note.\nFor example, I had not understood that the acquisition of Kidaro will enable interaction between applications running within a virtual machine and the host desktop in ways that are not currently achievable. That the technology will ship as part of a new Desktop Optimisation Pack was news. I believe the technology is name MEDV - Microsoft Enterprise Desktop Virtualisation.\nSoftgrid was also mentioned as solid way to achieve application virtualisation - a technology that I have not previously had chance to play with, but which is most definitely on my To Do list - I think of a few specific practical uses for us. One of the \u0026lsquo;announcements\u0026rsquo; of the keynote was the RTM of Application Virtualisation 4.5 (I believe, the solution formerly known as SoftGrid). Critically, the team behind application virtualisation are working on virtualising the server applications. That has big implications for simplifying the deployment of new virtualised solutions and the stack of differencing disks and other VHDs needed.\nAlso of note - Server 2008 R2 includes the ability to live migrate virtual machines. What I did not know until today was that Server 2008 R2 M3 is available for download. I can feel some testing coming on\u0026hellip;\nOn the subject of virtualisation, the release of System Centre Virtual Machine Manager including support for Hyper-V was also \u0026lsquo;announced\u0026rsquo;. I believe we\u0026rsquo;ve been running that for about a week now and I am pretty impressed with it (we\u0026rsquo;re currently migrating our Virtual Server 2005 VMs to Hyper-V - I\u0026rsquo;ll post about that experience another time).\nWhat was new to me was the idea being worked on of using M - the modelling language launched as part of Oslo - to create models of systems which can then be provisioned using SCVMM. For the creation of development and test environments that sounds cool!\nAll of this is part of a concerted (if a little low-key, I thought) push to position Microsoft as the cost effective (read, cheaper!) solution for virtualisation and virtualisation management.\nA couple of enviro-quickies:\nMicrosoft is the largest commercial purchaser of servers in the world and is brining a new datacenter on-stream roughly once per quarter. Their new DC in Quincy, WA is built next to a hydro-electric dam to ensure a clean source of energy. The upcoming Dublin, Ireland DC will use natural air cooling, not air-con (and I\u0026rsquo;d love to hear more about that). Announcement quickies:\nSCOM 2007 R2 beta will be available for download at the end of November. Centro - Essentual Busines Server will be \u0026lsquo;announced\u0026rsquo; on November 12th. Identity Lifecycle Manager \u0026lsquo;2\u0026rsquo; RC is now available A key new feature in Server 2008 R2 is the availability of ASP.Net on Server Core. That has big implications for SharePoint and you can bet I will be talking to the guys from Microsoft about that one later!\nAlso interesting were a few new Server 2008 R2 features:\nDirectAccess - device can connect securely over internet without requiring VPN. We currently use ISA server but there are limitations. This might be handy\u0026hellip; Bitlocker to Go - encryption for USB drives (and other removable storage, I assume). Definitely interested in that one. BranchCache - branch office caching solution for data. Sounds like WAN acceleration a la Riverbed to me, and the demo did nothing to change that view. Does this mean the caching server has to be the gateway for the WAN? What does it support in terms of applications, protocols etc? Another one to discuss during the week. ","date":"3 November 2008","externalUrl":null,"permalink":"/posts/tech-ed-emea-it-2008-day-1-keynote/","section":"Blog","summary":"So, the keynote was interesting. Much of the content I had seen before, but there were some demos that were interesting and a few snippets that made me take note.\n","title":"Tech Ed EMEA IT 2008: Day 1 - Keynote","type":"posts"},{"content":"It\u0026rsquo;s an exercise in surreality. I\u0026rsquo;ve just walked through tunnels reminiscent of THX1138, to emerge in a wonderful blue-bathed auditorium, and they\u0026rsquo;re playing the Akira soundtrack (specifically the bit from just after the first nuclear explosion). Weird.\nAndy and I travelled all the way from Bradford, and the first guy we strike up conversation with\u0026hellip; is from Salford! What are the odds?\nAnyway, here\u0026rsquo;s a pic of the view from our seats. More after the keynote\u0026hellip; ","date":"3 November 2008","externalUrl":null,"permalink":"/posts/tech-ed-emea-it-day-1-waiting-for-the-keynote/","section":"Blog","summary":"It’s an exercise in surreality. I’ve just walked through tunnels reminiscent of THX1138, to emerge in a wonderful blue-bathed auditorium, and they’re playing the Akira soundtrack (specifically the bit from just after the first nuclear explosion). Weird.\n","title":"Tech ED EMEA IT: Day 1 - Waiting for the Keynote","type":"posts"},{"content":"It\u0026rsquo;s 7:25 AM. Andy and I are hoping to make a whistle-stop trip to the Cathedral before making it to the conference early enough to get good seats for the keynote.\nI thought I\u0026rsquo;d take a picture of the conference pack, especially since I\u0026rsquo;ve heard grumblings about the PDC bag. The TechEd pack looks pretty much identical to the pack the devs brought home last year, to me.\nHowever, when I opened the curtains I was greeted by a fantastic sunrise:\nHere\u0026rsquo;s hoping it\u0026rsquo;s going to be a fun-packed day!\n","date":"3 November 2008","externalUrl":null,"permalink":"/posts/teched-emea-it-day-1/","section":"Blog","summary":"It’s 7:25 AM. Andy and I are hoping to make a whistle-stop trip to the Cathedral before making it to the conference early enough to get good seats for the keynote.\n","title":"TechEd EMEA IT: Day 1","type":"posts"},{"content":"Ola! Andy and I are now in sunny Espana. Only it\u0026rsquo;s not sunny. Oh well\u0026hellip; However, true to form we started our trip, having registered at the conference centre, by eating hot dogs in a german fast food joint in a Spanish shopping centre! If you\u0026rsquo;re passing, Kurz \u0026amp; Gut does pretty good food.\nI\u0026rsquo;m also extremely impressed with the Metro system here in Barcelona. It\u0026rsquo;s my first time in the city, and the transport is pretty efficient, with a wonderful simple trip-based charging mechanism.\nThe only downside is that despite not travelling particularly far, we seem to have lost an entire day to travel. Up and out by 8:30am UK time, and we finally landed in the hotel here in Spain around 18:30 (17:30 UK time) - then we had to get across town to the conference centre.\nApparently, take-up on the shuttle service from the airport was low last year, so this year Microsoft didn\u0026rsquo;t bother. I can understand that, but at the same time it would have made our lives much easier, even if we would have needed to get from the conference centre to the hotel after registering. Perhaps that\u0026rsquo;s as much because we\u0026rsquo;re TechEd noobs - next year we\u0026rsquo;ll know where to go and how to get there, I guess.\nSo now we\u0026rsquo;re relaxing in the hotel bar, checking the conference schedules and noting the irony of how the prize-of-the-moment for all conference competitions is the Dell Mini 9 (I\u0026rsquo;m typing this on mine, and Andy stole Richard\u0026rsquo;s for the week!).\nAs I mentioned before, don\u0026rsquo;t be shy - if you\u0026rsquo;re in Barcelona at the moment and feel like being sociable, get in touch and we can try to meet up. Oh, and I hadn\u0026rsquo;t forgotten about Robert, but he\u0026rsquo;s effectively working!\n","date":"2 November 2008","externalUrl":null,"permalink":"/posts/teched-emea-it-day-0-greetings-from-barcelona/","section":"Blog","summary":"Ola! Andy and I are now in sunny Espana. Only it’s not sunny. Oh well… However, true to form we started our trip, having registered at the conference centre, by eating hot dogs in a german fast food joint in a Spanish shopping centre! If you’re passing, Kurz \u0026 Gut does pretty good food.\n","title":"TechEd EMEA IT: Day 0 - Greetings from Barcelona","type":"posts"},{"content":"Andy and I are travelling to Barcelona this weekend for TechEd EMEA IT. I’m really looking forward to some of the sessions on Hyper-V, SharePoint and Forefront.If you’re going to be there, feel free to drop us a line and say hi.\n","date":"31 October 2008","externalUrl":null,"permalink":"/posts/barcelona-bound/","section":"Blog","summary":"Andy and I are travelling to Barcelona this weekend for TechEd EMEA IT. I’m really looking forward to some of the sessions on Hyper-V, SharePoint and Forefront.If you’re going to be there, feel free to drop us a line and say hi.\n","title":"Barcelona-bound","type":"posts"},{"content":"I don’t visit the Mix community site often – historically, the content has been of little interest and infrequently updated. Imagine my surprise, then, to find a relaunched Mix Online with a new Microformats project – Oomph.\nIn short, it’s cool – a microformats extension for IE plus other goodies to help implement them, including a live writer plugin for creating hcards. Go check it out, and I’ll try to post more later…\n","date":"26 October 2008","externalUrl":null,"permalink":"/posts/mix-remixed/","section":"Blog","summary":"I don’t visit the Mix community site often – historically, the content has been of little interest and infrequently updated. Imagine my surprise, then, to find a relaunched Mix Online with a new Microformats project – Oomph.\n","title":"Mix Remixed","type":"posts"},{"content":"","date":"17 October 2008","externalUrl":null,"permalink":"/tags/netbook/","section":"Tags","summary":"","title":"Netbook","type":"tags"},{"content":"Flush with my success earlier in getting apps installed on the SD card now mounted as \u0026lsquo;c:\\SD Program Files\u0026rsquo; I installed a few things. I then hit a snag.\nWhen you install apps using an MSI, the installation files get cached by Windows Installer. Steadily, c:\\windows\\installer gets bigger and bigger, so whilst my apps were no longer taking up space, the install files were (and some of those are quite large).\nI now have an image of the Vista install so I\u0026rsquo;m becoming more cavalier. I wondered if I could move the Installer folder from c:\\windows onto my SD card by copying it into the mount point, but still get Windows Installer to work as though nothing had changed.\nSo, first I used Robocopy with the /SEC option to copy the installer folder tree over. Next, I deleted c:\\windows\\installer and created a directory junction which allows the moved content to still be accessed as c:\\windows\\installer.\nTo create a directory junction, use the mklink command with the /J switch to create the installer folder in c:\\windows and point it at \u0026lsquo;c:\\sd program files\\installer\u0026rsquo;.\nSo far, it\u0026rsquo;s working fine. I need to try a few more installs to be sure, though\u0026hellip;\n","date":"17 October 2008","externalUrl":null,"permalink":"/posts/vista-on-dell-mini-9-using-junctions-to-move-files-off-the-ssd/","section":"Blog","summary":"Flush with my success earlier in getting apps installed on the SD card now mounted as ‘c:\\SD Program Files’ I installed a few things. I then hit a snag.\nWhen you install apps using an MSI, the installation files get cached by Windows Installer. Steadily, c:\\windows\\installer gets bigger and bigger, so whilst my apps were no longer taking up space, the install files were (and some of those are quite large).\n","title":"Vista on Dell Mini 9: Using junctions to move files off the SSD","type":"posts"},{"content":"","date":"17 October 2008","externalUrl":null,"permalink":"/series/vista-on-the-dell-mini-9/","section":"Series","summary":"","title":"Vista on the Dell Mini 9","type":"series"},{"content":"I’m still trying new things with the Mini 9. I now have an image file that I can restore to the Mini which has my base install after running sysprep. The problem I have is storage space – the SSD isn’t quite big enough.\nSo, Richard wandered in this morning and handed me a 4Gb SD card to experiment with. The question: Can we use the SD card and install app onto it?\nOur initial finding was a big fat no. Visual Studio setup refused to install to ‘removable media’. Bearing in mind all we’d done at this point was stuff an SD card into the card slot I wasn’t too surprised.\nI fired up computer manager and went into disk admin. The partition on the SD card was FAT32, so we replaced that with an NTFS partition for a start.\nI then went into the drive properties and changed the Policy settings. By default the SD reader is set to allow instant removal. Changing that to enable write caching means I will have to use the tray icon to ‘Safely Remove Hardware’, but I think that’s the key setting to allow me to install apps. However, I wanted to make things a little more integrated, so I created a folder on the C: drive called ‘SD Program Files’ and used it as a mount point for the SD card.\nVisual Studio is now happily installing to the SD card.\nAs a 16Gb SD card is around twenty-five quid, this makes a reasonable approach to increasing storage space, assuming apps run reasonably quickly from the drive.\nThat’s the next test…\n","date":"17 October 2008","externalUrl":null,"permalink":"/posts/vista-on-the-dell-mini-9-installing-applications-on-an-sd-card/","section":"Blog","summary":"I’m still trying new things with the Mini 9. I now have an image file that I can restore to the Mini which has my base install after running sysprep. The problem I have is storage space – the SSD isn’t quite big enough.\n","title":"Vista on the Dell Mini 9: Installing applications on an SD card","type":"posts"},{"content":"Our second Mini 9 arrived in the office today. This one is for Andy and myself to use whilst out of the office. Richard has successfully upgraded his to XP Professional, so we had to try to push the bar out a little further – we’re running Vista Business.\nI have not spent any time tweaking or prodding yet. I used install media with SP1 included and obliterated the partition on the SSD, then installed the drivers from Dell where necessary, and a driver for the battery hardware that Vista itself suggested rather than the Dell solution.\nI have disabled System Restore to claw back some disk space, but even so, prior to installing the bits of Office 2007 we need (Word, Excel, PowerPoint, OneNote) I had around 7Gb free. That’s enough – we’re going to be using this for note taking and document writing, not heavy lifting.\nPerformance-wise, it’s quite nippy. Aero is disabled, and the sidebar is off (it’s a small screen, why waste bits of it?) and I have well over half the system ram available at idle. Right now I have no complaints at all.\nDepending on performance I may well look at upgrading the RAM to 2Gb, but in the short term I’m sure I have an SD card kicking around somewhere I could use for ReadyBoost, should the need arise.\nWhy Vista? UAC. Shocked? I probably would have been a few months ago, but in all seriousness, UAC means that it’s much easier to run with limited-rights user accounts and still be able to do admin-stuff if the need arises. You can’t do that with XP Pro.\n","date":"14 October 2008","externalUrl":null,"permalink":"/posts/getting-vista-on-the-dell-mini-9/","section":"Blog","summary":"Our second Mini 9 arrived in the office today. This one is for Andy and myself to use whilst out of the office. Richard has successfully upgraded his to XP Professional, so we had to try to push the bar out a little further – we’re running Vista Business.\n","title":"Getting Vista on the Dell Mini 9","type":"posts"},{"content":"I\u0026rsquo;ve been chipping away at this for a while now today, and I\u0026rsquo;ve learned a few things on the way:\nWhen Vista says it suggests installing the battery drivers for the system, don\u0026rsquo;t. The zip file it suggested I install broke power management. Patch the system fully as an admin user before logging in as a restricted user. It will save you hours of time. Sysinternals Diskmon doesn\u0026rsquo;t work with Vista - you need to run it as admin, and that certainly isn\u0026rsquo;t an option for my restricted users. Vista when hibernating just shows a black screen. That\u0026rsquo;s not very helpful the first time you try it, on a silent machine with no disk activity lights at all. think Vista takes longer to hibernate and come back from hibernation than XP, although coming back from sleep is much quicker than it\u0026rsquo;s older sibling. Overall, I\u0026rsquo;m still happy. I have Vista, Office 2007 and Live Writer and 3.5Gb of disk space free. With no serious hacking the Dell runs at around 50% memory usage witrh a browser and live writer running. I can live with that. Battery life appears OK. It\u0026rsquo;s 10:30 and I\u0026rsquo;ve been using the Dell since 8pm, thrashing the disk (as much as there is one) and the wi-fi, and I\u0026rsquo;m at 38% battery. That puts me on track for about four hours or so and I can live with that.\nIronically, having been using the Aspire One all weekend, the Dell keyboard is more annoying than I found it before I got the Acer. Comparing the two, however the Dell is a good inch narrower and a little lighter. If portability is critical then the Dell has the edge, although I\u0026rsquo;m starting to favour the Acer for ergonomics.\nTop tips, then:\nTry to use slipstream media - it saves a bit of tidying up. Turn off system restore to save a bit of disk space initially and quite a bit in the longer term. Keep the cruft at a minimum - additional windows components take up disk space, but shoving lots of apps on gobbles memory, which is quite tight with 1Gb of memory. I tried to install from a USB memory stick with Vista installation media on it and it didn\u0026rsquo;t work - a USB optical drive is the easiest way. Make sure you copy the drivers folder off the Min 9 before wiping the disk for Vista - you\u0026rsquo;ll need the drivers folder to install the appropriate system drivers before Windows can work it\u0026rsquo;s Update magic. The 16Gb SSD isn\u0026rsquo;t that big when you try installing Vista and Office. I\u0026rsquo;ve not reduced Vista\u0026rsquo;s footprint with tools like vlite, but they might help. Certainly, being hard on yourself is important - do you really need Microsoft Access on a netbook? The next step is to run the new Mini 9 with Vista in parallel with the XP Pro install on Richard\u0026rsquo;s and see which is the better long-term bet. Watch this space\u0026hellip;\n","date":"14 October 2008","externalUrl":null,"permalink":"/posts/vista-on-the-dell-mini-9-redux/","section":"Blog","summary":"I’ve been chipping away at this for a while now today, and I’ve learned a few things on the way:\nWhen Vista says it suggests installing the battery drivers for the system, don’t. The zip file it suggested I install broke power management. Patch the system fully as an admin user before logging in as a restricted user. It will save you hours of time. Sysinternals Diskmon doesn’t work with Vista - you need to run it as admin, and that certainly isn’t an option for my restricted users. Vista when hibernating just shows a black screen. That’s not very helpful the first time you try it, on a silent machine with no disk activity lights at all. think Vista takes longer to hibernate and come back from hibernation than XP, although coming back from sleep is much quicker than it’s older sibling. Overall, I’m still happy. I have Vista, Office 2007 and Live Writer and 3.5Gb of disk space free. With no serious hacking the Dell runs at around 50% memory usage witrh a browser and live writer running. I can live with that. Battery life appears OK. It’s 10:30 and I’ve been using the Dell since 8pm, thrashing the disk (as much as there is one) and the wi-fi, and I’m at 38% battery. That puts me on track for about four hours or so and I can live with that.\n","title":"Vista on the Dell Mini 9: Redux","type":"posts"},{"content":"You can’t say that things never change. I nipped out to Tesco last night for a few bits of shopping – you know, some beer, spices for cooking, etc – and came back with an Acer Aspire One. As you do…\nTo be fair, I have been looking at them closely, and Tesco are by far the cheapest place to get one. I picked up the 1Gb RAM, 120Gb HDD Linux model for about two hundred and fifty nicker, which I thought was pretty reasonable.\nSo, I hear you thinking, why did he just buy an Aspire One after singing the praises of the Dell Mini 9? The answer – this is for home use. Our home needs are different. We want something to use whilst researching our family tree; we need to be able to store scanned documents whilst out and about; run the family tree software and upload photos from a camera prior to pushing everything onto the Home Server back at home base. The Dell doesn’t have the storage for all that.\nAdd to that the keyboard on the Dell, which my wife really didn’t like and you have a good case for the Acer.\nOut of the box it looks lovely – we got the white model and it’s clean, shiny and sleek. It also comes with a slip-on pouch which will protect it whilst in a bag, something I’ve not seen amongst the competition. Like the Dell, it’s completely silent (I wasn’t expecting that, it having a hard drive which I though would hum gently) and quick to boot.\nI must say that I like the feel of it. I’m not so keen on the trackpad, whose buttons are located either side of the pad, rather than across the bottom, the de facto standard as far as I am concerned. It makes it harder to click with your thumb whilst tracking with a finger. The keyboard, though, is great. A full complement of keys and the same layout as my Travelmate meant I could type quickly and accurately with no learning curve, unlike the Dell. However, the keys are slightly smaller so if you have stubby fingers you might prefer the Dell.\nI was also impressed with the Linux OS and interface installed on the One. I’m almost sad to say that it will be replaced by XP – for the novice user it really is a clean, task-centric interface. If it didn’t have to run Windows applications I’d leave it alone – I really would.\nI don’t like the power charger. No sleek, compact charger like the Dell – it’s a standard laptop-style adapter, which means a cloverleaf power cord and a charger with a lead to connect to the laptop. The extra cables mean extra bulk and as a result I probably wouldn’t want to be carrying it around.\nWhich leads me to the battery. The OS reckoned it had two hours life available on a full charge. That’s not great, given what we need to use it for. However, the battery is only a three-cell, unlike the Dell’s four cell, which explains, whilst not justifying, the lower life. The upside is that I can get a six cell battery for around seventy quid, which by all accounts on the web increases the usage time significantly (I’ve seen figures like six hours being thrown around).\nOverall, I’m really pleased with it. It’s comfortable to use, wasn’t very expensive, looks the business and meets our needs almost perfectly. I think the larger battery will be an imminent purchase, and it will get an XP makeover, but it compares very favourably indeed with the Dell. I would probably suggest my colleagues got the Dell for business use (we need less storage and want to carry the charger around), but if my parents asked, I’d point them at the Acer.\nTime for the old pros and cons, then:\nPro\nSmall and lightweight. Beautiful to look at (at least, the white one is!). Good size hard disk for storage. Performance is good. Screen quality is great. Keyboard is better for home users (and it has all the function keys!). Linux environment is really good (if you’re happy with Linux and don’t want to install Windows apps). Con\nTrickier to upgrade than the Dell (no handy covers here – it’s a strip-down job). Shiny case is likely to be a fingerprint magnet. Standard hard drive means moving parts so a bit more fragile than the Dell. Battery life out of the box is uninspiring. ","date":"7 October 2008","externalUrl":null,"permalink":"/posts/first-thoughts-on-the-acer-aspire-one/","section":"Blog","summary":"You can’t say that things never change. I nipped out to Tesco last night for a few bits of shopping – you know, some beer, spices for cooking, etc – and came back with an Acer Aspire One. As you do…\n","title":"First thoughts on the Acer Aspire One","type":"posts"},{"content":"Colour me impressed. I managed well over four hours’ battery life today and found the Mini 9 a joy to use. I have encountered a snag, however, and it wasn’t one that I expected.\nYou see, I’m now sitting on the 21:30 train from London Kings Cross to Wakefield after having been in the big smoke for a day of meetings. I got onto an empty train and picked a seat with a table – I want to get some work done on the documents required after my meeting and I thought the space would be nice.\nGreat, except I’m on 17% battery charge as I wait for departure, and I can’t use the plug in the wall. As a result, I have switched seats to a cramped airline seat, also next to a plug.\nThe problem is, the charger I so complimented in my previous post is too deep to plug into the socket by the table. The power cable won’t bend and there’s only about an inch between the socket and the table. Not enough to use the Dell charger.\nSo I now sit with the Mini 9 on a fold-down tray, and it fits quite well, I must say. One could even say it was made for it.\nAnyway, the Mini performed like a champ. It was small enough not to get in the way during the meetings I had today, made no distracting noises as my other laptop is prone to do as it’s fans spin their merry dance, and just.. kept… working. Exactly what I asked it do do with no problems at all.\nI wonder if Richard will notice if I don’t give him it back…?\n","date":"30 September 2008","externalUrl":null,"permalink":"/posts/dell-mini-9-a-day-in-the-life/","section":"Blog","summary":"Colour me impressed. I managed well over four hours’ battery life today and found the Mini 9 a joy to use. I have encountered a snag, however, and it wasn’t one that I expected.\n","title":"Dell Mini 9: A Day In The Life","type":"posts"},{"content":"I’m down in London tomorrow, and rather than lug my laptop on the train I’ve borrowed Richard’s shiny new Mini 9.\nOverall, I’m quite impressed with it. I’m still not sure about the keyboard, even after a couple of hours typing away – the keys are small and some of them are smaller still, which makes typing an interesting experience. However, I’m sure I would get used to it with time. The thing is, a netbook is not aimed at being your everyday machine, so does a quirky keyboard become a barrier to use if that use is intermittent?\nMy wife saw it and immediately liked it for it’s size and weight. For a small, very capable device to use, for example, when down at the library researching our family tree the Mini 9 is a good fit. Long battery life (I’ve not charged it yet and I’ve racked up at least a couple of hours on about 50% charge) and robust design with no moving parts makes a good fit in a large handbag where you don’t want the charger.\nThe screen is nice and bright. I’ve not tried to use it outdoors yet, where I suspect the high gloss screen may be a disadvantage, but inside where I would use it most there is no issue with legibility. Resolution is tight at 1024x600, but you have to compromise somewhere. It will happily drive a second screen at higher resolution, however, so it may well find a place in my heart for roaming presentations at events. it’s also a perfect companion for conferences, at least for myself – not a dev needing the grunt of more power for Visual Studio work.\nI have successfully coupled my Touch Diamond with the Dell and can use my 3G data connection when there is no available WiFi and I think that works well. I’ve not tried using bluetooth, cool though it may be, as I see no point in crippling the battery life of both devices. How hard was the pairing? Easy – installed ActiveSync 4.5 and start the Internet Connection app on my phone. Less than five minutes to get going, including the ActiveSync download!\nMy one annoyance is not really Dell’s fault. XP Home is most definitely not a good fit for corporate use, and the spec isn’t good enough for Vista. As an IT admin, I want to enable domain membership and disk encryption and group policies. Being a Gold Partner means I could install XP Pro, but not everybody has that option. Microsoft have really got themselves in a hole over this one – on the one hand they can’t extend the life of XP Pro any longer, but Vista isn’t lean enough for this sector and they don’t want to forfeit the market to Linux. In the olden days, the OS would have been Windows CE, but the market has already learned that for mass market appeal users need to run their existing applications, and in that regard CE just doesn’t cut the mustard.\nI’ve not played much with the Acer Aspire one. I had a fiddle with one at the weekend (in Tescos, of all places) and I think being honest, the Acer has the edge for keyboard. However, the charger for the Dell is a bit like a phone charger on steroids, whereas the Acer has a traditional laptop-style cloverleaf cable and charger which is much bulkier and heavier to carry. Add to that the fact that to get XP you need to order the model with the standard hard drive and the lower battery life and I would probably choose the Dell over the Acer.\nCould I use the Mini 9 as my only computer whilst travelling? The answer to that is a qualified yes. Ask me again after I’ve tried it on the train to London and I’ll give you a definitive answer.\nSo, pros and cons, before I go away and order one for myself!\nPro\nSmall and lightweight No moving parts so less risk when travelling Performance is great (after we decompressed the hard disk!) Screen is excellent Con\nKeyboard is tricky. There are no separate function keys and even with the FN-key combination there’s no F11 or F12. Upgradeable, but… Getting hold of PCIe SSD disks isn’t that easy, and Dell have left out the antenna and other bits for the WWAN. Shiny case is sexy and impresses from a distance, but is a magnet for fingerprints. XP Home. Need I say more. ","date":"29 September 2008","externalUrl":null,"permalink":"/posts/first-thoughts-on-the-dell-mini-9/","section":"Blog","summary":"I’m down in London tomorrow, and rather than lug my laptop on the train I’ve borrowed Richard’s shiny new Mini 9.\nOverall, I’m quite impressed with it. I’m still not sure about the keyboard, even after a couple of hours typing away – the keys are small and some of them are smaller still, which makes typing an interesting experience. However, I’m sure I would get used to it with time. The thing is, a netbook is not aimed at being your everyday machine, so does a quirky keyboard become a barrier to use if that use is intermittent?\n","title":"First thoughts on the Dell Mini 9","type":"posts"},{"content":"You wait around for ages and then two come along, all at once! No sooner have I downloaded IE8 beta 2 than Google announce Chrome!\nI\u0026rsquo;ve been using IE8 for a few days and I\u0026rsquo;m quite impressed. I\u0026rsquo;ve just downloaded Chrome and I have to say, it\u0026rsquo;s a darn good browser. The feature I most wanted from any tab-based browser and one I\u0026rsquo;ve mentioned before in the context of IE is present in Chrome - tabs you can drag between windows.\nAnyway, I was planning to post in greater detail about IE8 and my take on the new beta 2. I think I might change tack a bit and play with Chrome as well. Don\u0026rsquo;t be fooled by some of the hype - some of the \u0026lsquo;cool features\u0026rsquo; are not unique to Chrome, but more choice in the browser market can only ever be a good thing for the end user.\nMy one worry when the first rumours started was that they might have created yet another render engine. It\u0026rsquo;s interesting that Google chose webkit rather than Gecko, given their existing close relationship with Firefox. However, having more than one webkit implementation on Windows is a real benefit for testing.\n","date":"2 September 2008","externalUrl":null,"permalink":"/posts/browsers-are-like-buses/","section":"Blog","summary":"You wait around for ages and then two come along, all at once! No sooner have I downloaded IE8 beta 2 than Google announce Chrome!\nI’ve been using IE8 for a few days and I’m quite impressed. I’ve just downloaded Chrome and I have to say, it’s a darn good browser. The feature I most wanted from any tab-based browser and one I’ve mentioned before in the context of IE is present in Chrome - tabs you can drag between windows.\n","title":"Browsers are like buses","type":"posts"},{"content":"","date":"2 September 2008","externalUrl":null,"permalink":"/tags/chrome/","section":"Tags","summary":"","title":"Chrome","type":"tags"},{"content":"","date":"2 September 2008","externalUrl":null,"permalink":"/tags/internet-explorer-8/","section":"Tags","summary":"","title":"Internet-Explorer-8","type":"tags"},{"content":"As you may remember from my earlier post and subsequent follow-up, we have been seeing an issue related to workflows and the Workflow History list in SharePoint 2007. As I\u0026rsquo;ve already mentioned, the case is with Microsoft and I also said that I would post updates as new information arrived. Today, more detail has emerged and, as promised, I am sharing.\nWhilst replicating the fault today we were having trouble - one of us had a SharePoint install that failed every time and the other had one which would not fail at all. Whilst looking at possible differences we realised that the failing site was a publishing site and the non-failing site was a team site.\nAfter some testing, I can now report that the fault I have described only occurs when the SharePoint Publishing site feature is enabled (note, the site feature, not the SharePoint Publishing Infrastructure site collection feature). If you\u0026rsquo;re not using a publishing site you have nothing to worry about from the problem we see.\n","date":"28 August 2008","externalUrl":null,"permalink":"/posts/workflow-and-sql-error-part-3/","section":"Blog","summary":"As you may remember from my earlier post and subsequent follow-up, we have been seeing an issue related to workflows and the Workflow History list in SharePoint 2007. As I’ve already mentioned, the case is with Microsoft and I also said that I would post updates as new information arrived. Today, more detail has emerged and, as promised, I am sharing.\n","title":"Workflow and SQL Error: Part 3","type":"posts"},{"content":"","date":"14 August 2008","externalUrl":null,"permalink":"/tags/netware/","section":"Tags","summary":"","title":"Netware","type":"tags"},{"content":"As part of a customer project I needed to create a Netware environment for testing. It\u0026rsquo;s been a little while since I did any netware management and I quite enjoyed it. I did, however, encounter a couple of gotchas which I thought I\u0026rsquo;d write up for the greater good.\nNetware OS # Installing the Netware OS was actually pretty straightforward. There are no integration services offered for Netware so from the outset I knew that I would need to use legacy hardware options in the virtual machine.\nI created a nice big dynamic virtual hard disk for the server because I will need to install GroupWise and a whole bunch of other services later. I attached this to the virtual IDE controller, gave the machine a single processor core as anything more needs integration services, and (critically!) added a legacy network adapter. Netware isn\u0026rsquo;t a huge memory hog, so I added 1Gb of RAM and off we went.\nI hit a snag at the point where the server tried to identify network drivers - it couldn\u0026rsquo;t find any, and I couldn\u0026rsquo;t see any in the list to load manually which matched the emulated hardware.\nThe solution turned out to be really simple: as you step through the installation screens there is an option to allow unsupported drivers. By default that is set to no. If you change it to yes, the installation recognises the network adapter as an old DEC and loads a driver which works.\nApart from that, I have experienced no difficulties with the server whatsoever, other than I have to run the machine connection window full screen to be able to switch between console screens.\nWindows Client # I will admit, this one drove me crazy for a while before my final epiphany. There is a Novell client for Windows Vista now available, but why build a Vista VPC when an XP one would need less horsepower?\nI dutifully grabbed an old Virtual PC VHD of our XP base install and fired it up.\nProblem number one: In order to install the integration services I need to first uninstall Virtual Server Additions. No sweat, thinks I, clicking the uninstall button. Nope - you get a nice message saying that setup can only run inside a virtual machine!\nSlightly surreal, I must say. I had to fire up the machine under Virtual PC and remove the additions, then copy the VHD back on the hyper-v server and start the system so I could install the integration services.\nProblem number two: Once I\u0026rsquo;d installed the Novell client I couldn\u0026rsquo;t get it to see the Netware server. Nothing I did would work - I strapped down every setting I could on the client to point it at the Netware machine but it refused to connect, although I could ping between the two quite happily.\nThe solution, when I finally figured it out (and I must admit it was pure chance that I thought to try it) was to remove the shiny new virtual network adapter and replace it with a legacy adapter. As soon as I did that, the Novell client could communicate quite happily with the server!\nThe situation would appear to be that the Novell client stack can\u0026rsquo;t communicate properly through the new virtualised driver provided by Hyper-V. Exactly why this should be, I have no idea, but it drove me wild for a good couple of hours today.\n","date":"14 August 2008","externalUrl":null,"permalink":"/posts/netware-6-5-on-hyper-v/","section":"Blog","summary":"As part of a customer project I needed to create a Netware environment for testing. It’s been a little while since I did any netware management and I quite enjoyed it. I did, however, encounter a couple of gotchas which I thought I’d write up for the greater good.\n","title":"Netware 6.5 on Hyper-V","type":"posts"},{"content":"","date":"14 August 2008","externalUrl":null,"permalink":"/tags/novell/","section":"Tags","summary":"","title":"Novell","type":"tags"},{"content":"","date":"14 August 2008","externalUrl":null,"permalink":"/tags/windows-xp/","section":"Tags","summary":"","title":"Windows-Xp","type":"tags"},{"content":"I\u0026rsquo;m not certain how many of you will find this useful, but I had a question about configuring the Touch Diamond to talk to Exchange which I regrettably failed to notice.\nIt\u0026rsquo;s an interesting point of debate, now I come to think of it. When I got my Diamond the first thing I did was confgigure ActiveSync directly on the device. Whilst I do connect to my laptop from time to time, I don\u0026rsquo;t actually have any real sync going on between the two, other than possible for OneNote and Notes. How many people out there still use Outlook to sync their phone information if Exchange Push is available?\nAnyway, back to the plot. To get this all going without using Windows Mobile Device Center or ActiveSync, grab your phone and go to Programs via the Start menu.\nIn Programs, find ActiveSync. In ActiveSync, select Menu and then choose Configure Server In Server address, enter the name of your Exchange server. This is the same as the hostname you use for OWA (e.g. mail.mycompany.com) If your server needs https rather than http, tick the option monikered \u0026rsquo;this server requires an encrypted (SSL) connection)' Tap Next and you will be asked to provide login information - username, password and the name of your Active Directory domain. Make sure \u0026lsquo;Save password\u0026rsquo; is ticked or the automatic sync won\u0026rsquo;t work and you\u0026rsquo;ll have to enter your password each time you trigger a manual sync. Tap Next once more and you will be able to select what gets synchronised. I have an unlimited data plan and I hate losing stuff, so I tick every box - Contacts, Calendar, E-mail and Tasks. If you\u0026rsquo;re being clever at this point, tapping Menu will allow you to get to the advanced options, where you can configure how conflicts are handled and what connection to use (normally this should be \u0026lsquo;Internet\u0026rsquo;) Tap Finish and the phone should sync. To make sure Push is enabled, where new items get sent to your device as they arrive you need to alter the Schedule, which is an option on the main Menu in ActiveSync. Pick your options to suit your preferences. I would stongly suggest that you make sure \u0026lsquo;use the above settings when roaming\u0026rsquo; is NOT ticked unless you have deep pockets!\nAs ever, I hope this helps somebody out there.\n","date":"1 August 2008","externalUrl":null,"permalink":"/posts/configuring-activesync-on-windows-mobile-for-exchange-push/","section":"Blog","summary":"I’m not certain how many of you will find this useful, but I had a question about configuring the Touch Diamond to talk to Exchange which I regrettably failed to notice.\n","title":"Configuring ActiveSync on Windows Mobile for Exchange Push","type":"posts"},{"content":"","date":"1 August 2008","externalUrl":null,"permalink":"/tags/htc-touch-diamond/","section":"Tags","summary":"","title":"Htc-Touch-Diamond","type":"tags"},{"content":"","date":"1 August 2008","externalUrl":null,"permalink":"/tags/project/","section":"Tags","summary":"","title":"Project","type":"tags"},{"content":"I find myself drawing the same diagram over and over again in meetings to explain how SharePoint sites relate to IIS web sites, how managed paths and alternate access mappings fit and why you need to extend the SharePoint web application if you want more than one authentication provider.\nAfter some of my colleagues pestered me to draw it again, I decided to create an electronic version, and since everybody seems to find it so useful I thought I\u0026rsquo;d post it here as well.\nRather than talk about it, I\u0026rsquo;m going to post it \u0026lsquo;blind\u0026rsquo; and invite comments from you, my enthusiastic audience as to how easy it is to understand and any errors or omissions there may be.\nWith a little luck, somebody will find it useful!\n","date":"1 August 2008","externalUrl":null,"permalink":"/posts/sharepoint-website-schematic/","section":"Blog","summary":"I find myself drawing the same diagram over and over again in meetings to explain how SharePoint sites relate to IIS web sites, how managed paths and alternate access mappings fit and why you need to extend the SharePoint web application if you want more than one authentication provider.\n","title":"SharePoint Website Schematic","type":"posts"},{"content":"Sometime ago we noticed an issue with My Tasks in Project Server. Certain users were unable to access My Tasks at all - they simply got a SharePoint error page.\nA little jiggery-pokery with callstack and custom errors later, we saw that the error referenced a GUID for a task. I then searched the Project Server Publishing DB for the task GUID and subsequently located the project to which it belonged. If I edited the project in MS Project and updated the server, removing the task assignment from the user, they could access my tasks.\nFor anyone who has a similar problem, here are the SQL queries you need:\nselect * from dbo.MSP_TASKS where TASK_UID=\u0026#39;\u0026lt;Task GUID\u0026gt;\u0026#39; select * from dbo.MSP_PROJECTS where PROJ_UID=\u0026#39;\u0026lt;Project GUID\u0026gt;\u0026#39; Most odd. So I logged a call with our friends in Microsoft Support.\nIt\u0026rsquo;s been parked for a while, but I received an email from support today advising me that the Infrastructure updates would help. Funnily enough, I\u0026rsquo;d already installed them (we keep our SharePoint farm as fully patched as we can), so that was almost all the way there.\nFinally, they provided a short SQL script to run against the Publishing DB. This would identify any tasks that were orphaned and correct the issue. Luckily, we had none!\nSELECT MP.PROJ_NAME, MAS.PROJ_UID, MAS.TASK_NAME, MAS.TASK_UID, MR.RES_NAME, MAS.RES_UID,MAS.ASSN_UID FROM MSP_ASSIGNMENTS_SAVED AS MAS INNER JOIN MSP_PROJECTS AS MP ON MAS.PROJ_UID=MP.PROJ_UID INNER JOIN MSP_RESOURCES as MR ON MAS.RES_UID=MR.RES_UID WHERE TASK_UID NOT IN(SELECT TASK_UID FROM MSP_TASKS_SAVED)` When I experienced the problem there were no hits in my old friend Google so hopefully this will help somebody, somewhere.\nHere are the links to the infrastructure updates for completeness. Remember to read the docs carefully on installing these babies!\nInfrastructure Update for Windows SharePoint Services 3.0 (KB951695)\nInfrastructure Update for Windows SharePoint Services 3.0 (KB951695), 64-bit edition\nInfrastructure Update for Microsoft Office Servers (KB951297)\nInfrastructure Update for Microsoft Office Servers (KB951297), 64-bit edition\nInfrastructure Update for Project 2007 (KB951547) - English\n","date":"1 August 2008","externalUrl":null,"permalink":"/posts/unable-to-access-my-tasks-in-project-web-access/","section":"Blog","summary":"Sometime ago we noticed an issue with My Tasks in Project Server. Certain users were unable to access My Tasks at all - they simply got a SharePoint error page.\n","title":"Unable to access My Tasks in Project Web Access","type":"posts"},{"content":"","date":"1 August 2008","externalUrl":null,"permalink":"/tags/windows-mobile/","section":"Tags","summary":"","title":"Windows-Mobile","type":"tags"},{"content":"My apologies to Craig, who posted a comment to my earlier post about our FBA problems and I didn\u0026rsquo;t notice until today.\nTo update you all on the situation, the fault is still with Microsoft and I have not yet received a hotfix.\nHowever, for anybody considering FBA in their deployment, I would not let this issue stop you. There are two reasons I say that:\nNormally with FBA you would extend the web application in question, having both FBA and Windows authentication available on the same content via different URLs. This makes your life easier with things like indexing and management. The workaround I detailed is a good temporary solution to the problem with only minimal impact on the user experience (in that certain options are offered which may not work too well in Office when using FBA). Hopefully this answer\u0026rsquo;s Craig\u0026rsquo;s question and assuages any doubts about the wisdom of deploying FBA in your SharePoint solution.\n","date":"30 July 2008","externalUrl":null,"permalink":"/posts/site-policies-and-fba-in-sharepoint-update/","section":"Blog","summary":"My apologies to Craig, who posted a comment to my earlier post about our FBA problems and I didn’t notice until today.\nTo update you all on the situation, the fault is still with Microsoft and I have not yet received a hotfix.\n","title":"Site Policies and FBA in SharePoint: Update","type":"posts"},{"content":"I said I\u0026rsquo;d post again once I\u0026rsquo;d had the Diamond a little while. It\u0026rsquo;s now been two weeks and I can honestly say I\u0026rsquo;m completely happy with it. Battery life for me is fine - I charge it about every three days and it chugs along with exchange push pretty much constantly. I am quite comfortable with the soft keyboard and I can honestly say I haven\u0026rsquo;t noticed any issues with the speed of the device either.\nI don\u0026rsquo;t usually go for silly little apps on my phone, but I couldn\u0026rsquo;t resist this one. It shows just what you can do with the accelerometer. The force is strong in this one!\n","date":"22 July 2008","externalUrl":null,"permalink":"/posts/life-with-a-diamond-nearly-two-weeks-on/","section":"Blog","summary":"I said I’d post again once I’d had the Diamond a little while. It’s now been two weeks and I can honestly say I’m completely happy with it. Battery life for me is fine - I charge it about every three days and it chugs along with exchange push pretty much constantly. I am quite comfortable with the soft keyboard and I can honestly say I haven’t noticed any issues with the speed of the device either.\n","title":"Life with a Diamond: nearly two weeks on","type":"posts"},{"content":"In my last post about the Diamond I said I would let you know what the battery life is. I therefore carefully refrained from giving it any charge over the weekend, even when connected to my PC.\nThat means that it received no power from 5.30pm on Friday until it died (which it did, eventually).\nAfter that time, exchange push carried on notifying me of email immediately on arrival until 8pm, after which it downshifted to checking every hour and continued like that for the rest of the weekend.\nWeather updates are whatever the phone does as default. I think that\u0026rsquo;s every four hours or so.\nOver the weekend I received a few calls and made a few. None were particularly long - a few minutes each. I also played a few games of teeter, and spent a good hour or so \u0026lsquo;playing\u0026rsquo; with Live Search and Diarist, writing a blog post whilst I was at it. I also spent a good thirty minutes with GPS enabled whilst I showed off Google Maps and Live Search, and browsed the web for maybe ten minutes in total.\nAll in all, it was more or less my usual pattern of use for the weekend. To give you a frame of reference, my TYTN would go on charge every night. It would make it through the weekend, just about, but only if I charged it on Friday night.\nThe Diamond died sometime overnight Sunday/Monday. When I picked it up this morning the battery was flat. It was alive at 11pm on Sunday, and I checked it at 8am this morning. Whilst that kind of life isn\u0026rsquo;t great, it\u0026rsquo;s not bad. It\u0026rsquo;s certainly on a par with my TYTN, which I have used happily for the past eighteen months. I\u0026rsquo;ve not yet spent a day away from the office, but I have two such days this week and I will let you know how I get on.\n","date":"14 July 2008","externalUrl":null,"permalink":"/posts/touch-diamond-battery-life/","section":"Blog","summary":"In my last post about the Diamond I said I would let you know what the battery life is. I therefore carefully refrained from giving it any charge over the weekend, even when connected to my PC.\n","title":"Touch Diamond Battery Life","type":"posts"},{"content":"I posted last week about a couple of issues we were experiencing with SharePoint. I made some traction on the Workflow History issue at the end of last week and the revelation was pretty far-reaching, so I\u0026rsquo;m posting again.\nIt turns out that the stuff I said about systemupdate was wrong\u0026hellip; up to a point.\nThere is a bug with systemupdate and triggering events, but it\u0026rsquo;s not the one we thought it was! It turns out that the behaviour we are seeing is correct - systemupdate is supposed to trigger events, just not update things like the modified by and last updated columns. It\u0026rsquo;s actually the behaviour within a workflow which is at fault, in that events aren\u0026rsquo;t being triggered when they should be.\nI had a chat with our developers about this and they told me that there are plenty of articles on the web suggesting that systemupdate is the way to update an item in a list without triggering events. Don\u0026rsquo;t do it! I was told by Microsoft that whilst the fault is not high on the list because there is a workaround (which I will list in a moment), it will be fixed. At that point, anybody who is using systemupdate expecting events not to fire will get a shock.\nThe MSDN documentation for system update is pretty clear:\nWhen you implement the SystemUpdate method, events are triggered and the modifications are reported in the Change and Audit logs, but alerts are not sent and properties are not demoted into documents.\nThe explanation as to why events don\u0026rsquo;t fire is:\nWhen you used in other places such as windows/console app, another workflow or webparts, you are not seeing the event trigger the workflow, this is due to the Workflow runs on separate threads from the main thread, so we cannot fire up the workflow and simply quit. Quitting an app before the async worker threads are finished causes those threads to simply abort, and in the case of workflow, nothing will appear to have happened.\nAnd the fix:\nCurrently, all standalone applications must call spsite.workflowmanager.Dispose(). This call waits for the threads to complete and causes workflow to go into an orderly shutdown.\nAnd the solution to the problem of wanting to not trigger events? Well, it looks like the method I described in my earlier post is the way to go.\n","date":"14 July 2008","externalUrl":null,"permalink":"/posts/workflow-and-sql-error-update/","section":"Blog","summary":"I posted last week about a couple of issues we were experiencing with SharePoint. I made some traction on the Workflow History issue at the end of last week and the revelation was pretty far-reaching, so I’m posting again.\n","title":"Workflow and SQL Error: Update","type":"posts"},{"content":"Richard\u0026rsquo;s little mobile blogging app is nice, but he isn\u0026rsquo;t that responsive to user requests (ie, mine!) so I thought I would see if anything else was out there.\nSadly, the answer appears to be \u0026rsquo;not really\u0026rsquo;\nHowever, I did come across Diarist, from Kevin Daly. Perhaps not surprisingly I am using it now. I must say that two thumb typing on the diamond keyboard is not bad, although nowhere near as fast as the real keyboard on the tytn.\nSo is diarist better than blogwriter? Well, it\u0026rsquo;s easier to add links and images\u0026hellip; Still no real formatting support though, which is a shame.\nTry it for yourself.\n","date":"12 July 2008","externalUrl":null,"permalink":"/posts/blogging-on-the-move-redux/","section":"Blog","summary":"Richard’s little mobile blogging app is nice, but he isn’t that responsive to user requests (ie, mine!) so I thought I would see if anything else was out there.\nSadly, the answer appears to be ’not really’\nHowever, I did come across Diarist, from Kevin Daly. Perhaps not surprisingly I am using it now. I must say that two thumb typing on the diamond keyboard is not bad, although nowhere near as fast as the real keyboard on the tytn.\nSo is diarist better than blogwriter? Well, it’s easier to add links and images… Still no real formatting support though, which is a shame.\nTry it for yourself.\n","title":"blogging on the move: redux","type":"posts"},{"content":"That might sound like a strange thing to say, but when my shiny new Touch Diamond, which I picked up from Orange this week, has no Orange branding or customisation of the UI. I hadn\u0026rsquo;t really noticed that until I went into the manual, where the screenshots are totally different from my phone. I was beginning to wonder if something had gone wrong with the setup process, when I saw this thread at XDA-Developers.\nGiven that the phone shipped the day before the iPhone, I suspect the comments in that thread are close to the money - not enough time to test the customisations.\nPersonally, I\u0026rsquo;m much happier with a generic HTC phone. For one thing, I always turn off the Orange stuff anyway if I can, and for another, it should mean that I can apply HTC updates to my device without having to wait for Orange to release them (if ever!)\nIn related news, I was as surprised as Pocket PC Thoughts when I read the PCPro review of the Diamond. I\u0026rsquo;m not experiencing the speed issues of which they speak, and if you look around you will see a number of articles where they say that HTC acknowledged the speed problem in early devices and had made software updates to the retail devices to address them. My diamond spent yesterday connected to my PC and charging, but I will keep it away from the charger until it dies from this point forward to see how long I get. Remember that I hav exchange push chugging along all the time, so it\u0026rsquo;s never simply idle.\nEven if you are worried about battery life (which I must admit, I was), then Expansys will shortly have the answer in the form of the extended battery!\nIn short then, still impressed with my new gadget!\n","date":"12 July 2008","externalUrl":null,"permalink":"/posts/my-orange-diamond-is-err-black/","section":"Blog","summary":"That might sound like a strange thing to say, but when my shiny new Touch Diamond, which I picked up from Orange this week, has no Orange branding or customisation of the UI. I hadn’t really noticed that until I went into the manual, where the screenshots are totally different from my phone. I was beginning to wonder if something had gone wrong with the setup process, when I saw this thread at XDA-Developers.\n","title":"My Orange Diamond is... err... black","type":"posts"},{"content":"","date":"12 July 2008","externalUrl":null,"permalink":"/tags/utilities/","section":"Tags","summary":"","title":"Utilities","type":"tags"},{"content":"Thanks to the advanced notice from Tracy and Matt\u0026rsquo;s blog, I picked up my HTC Touch Diamond yesterday from the Orange Store and it\u0026rsquo;s great!\n\u0026lsquo;But wait!\u0026rsquo; I hear you cry, \u0026lsquo;didn\u0026rsquo;t he go on about the experia x1 and how he wanted one?\u0026rsquo;\nWell, yes, I did. I admit it - I am fickle in my affections.Since I wrote that post, I have spent time considering what I want in a phone and size has become a significant factor. The Diamond is tiny, it really is. It\u0026rsquo;s not far from the size of my old Nokia 8910 and it\u0026rsquo;s lighter than that old warhorse.\nI also did a fair amount of homework. My TYTN had a keyboard. Could I live without it? Almost as soon as the Diamond appeared, the soft keyboard turned up on the web, so I tried it. I found that I was happy with the turn of speed I could manage with the new soft keyboard and I was happy that I could live without the physical one.\nI\u0026rsquo;m not going to write a review - there are plenty out there that go into more than enough detail. I will give you my opinions, though. I am a business user and the Diamond has to meet my needs as a connected business traveller. Does it do that?\nWell, I\u0026rsquo;ve never had a phone that was so easy to get started with. Turn it on, run through the Windows Mobile setup and then configure my exchange server. In less than five minutes I had all my contacts, emails, calendar and tasks on the new phone. Smooth, easy, no issues whatsoever. Brilliant!\nThe new UI makes it easy to preview new mails and the design is so slick it\u0026rsquo;s a pleasurable experience. A few swipes of my thumb and I can spin through new mails before I tap on the one I want to read. So much faster and easier than the old Touch home screen which took me a good few taps just to get into my inbox.\nThe same is true for SMS messages - it\u0026rsquo;s so quick to view the new message. If I want to reply it drops me into the old-style Windows Mobile UI, but many of the messages I get don\u0026rsquo;t need a reply.\nThe screen is fabulous. The extra resolution is so nice to have - text is much smoother and more readable. Then you open Opera (which is fantastic) and browse to a web page. When pages open, Opera zooms the view out so you see the whole page. The experience is really good, but then you look again and realise that you can actually read the text!\nI don\u0026rsquo;t have TomTom on the Diamond - I have a standalone TomTom and I don\u0026rsquo;t see the need to duplicate. However, the Diamond arrived with Google Maps installed so I did have a play. To be honest, the functionality offered will do what I need on my phone - where in the big city am I in relation to where I need to be.\nOne thing I find extremely useful - when I receive a call that\u0026rsquo;s not in my phone book, the Diamond asks me if I want to add the number to my contacts when I end the call. For somebody who gets regular calls from colleagues and customers whose numbers I want to quickly grab, that\u0026rsquo;s great!\nOverall, I would have no hesitation in recommending this phone to anybody. The only area I would urge you to think about is the keyboard. If you absolutely, positively need a real keyboard, wait until September and pick up the Touch Pro. If you don\u0026rsquo;t, you really won\u0026rsquo;t regret picking up a Diamond.\n","date":"11 July 2008","externalUrl":null,"permalink":"/posts/htc-touch-diamond-on-orange/","section":"Blog","summary":"Thanks to the advanced notice from Tracy and Matt’s blog, I picked up my HTC Touch Diamond yesterday from the Orange Store and it’s great!\n‘But wait!’ I hear you cry, ‘didn’t he go on about the experia x1 and how he wanted one?’\n","title":"HTC Touch Diamond on Orange","type":"posts"},{"content":"I need to update something like 300 web.config files today, with the same change in each. I turned to my old friend Google for his recommendations and up popped a magnificent free tool from Nodesoft.\nWhy magnificent? It\u0026rsquo;s advanced mode allows you to specify start and end tags and update everything in between. That\u0026rsquo;s fantastic for dealing with big chunks of web.config files! Better yet, give it a file mask and a path and it will run through the entire folder tree if you like. Update whole servers in seconds.\nI just wish I\u0026rsquo;d found it sooner\u0026hellip;\n","date":"5 July 2008","externalUrl":null,"permalink":"/posts/useful-net-search-and-replace-tool/","section":"Blog","summary":"I need to update something like 300 web.config files today, with the same change in each. I turned to my old friend Google for his recommendations and up popped a magnificent free tool from Nodesoft.\n","title":"Useful .Net Search and Replace tool","type":"posts"},{"content":"Received in an email today from the BCS:\nI am delighted to inform you that your application for Chartered IT Professional (CITP) status has been successful.\n","date":"3 July 2008","externalUrl":null,"permalink":"/posts/citp/","section":"Blog","summary":"Received in an email today from the BCS:\nI am delighted to inform you that your application for Chartered IT Professional (CITP) status has been successful.\n","title":"CITP","type":"posts"},{"content":"You may have noticed that I have disabled comments on my old posts. You may also have noticed that I have now disabled the Contact Me function on my blog.\nWhy? Comment spam, and more recently, a huge influx of spam via the contact form.\nI will try to find a solution via some kind of community server plugin. In the meantime, posting comments will be open for 14 days after I make a post and will then automatically switch off.\nMy apologies for the restrictions. I hope to re-enable at least the contact form once I have a solution.\n","date":"3 July 2008","externalUrl":null,"permalink":"/posts/comment-spam-and-contacting-me/","section":"Blog","summary":"You may have noticed that I have disabled comments on my old posts. You may also have noticed that I have now disabled the Contact Me function on my blog.\n","title":"Comment Spam and Contacting Me","type":"posts"},{"content":"Well done Richard, who has been given the accolade of Microsoft Most Valuable Professional for Visual Studio Team System.\n","date":"3 July 2008","externalUrl":null,"permalink":"/posts/congratulations-richard/","section":"Blog","summary":"Well done Richard, who has been given the accolade of Microsoft Most Valuable Professional for Visual Studio Team System.\n","title":"Congratulations Richard!","type":"posts"},{"content":"If you are using Forms Based Authentication and try to access Site Policies you may well find that you get an Access Denied response. If you do, this post will help you!\nI\u0026rsquo;ve been meaning to post this for a while because I\u0026rsquo;m sure it may help somebody. As usual, it\u0026rsquo;s been pushed back and back until now I finally have some time. I also have another, workflow-related post on another problem which will follow shortly.\nProblem Background # We have been working on a SharePoint solution which involves a large number of web applications, each of which is hosting an internet-facing site using SharePoint Publishing. Each of these web applications uses forms-based authentication (FBA) with the AD provider in order to provide a better user experience.\nWhy a large number of web application? The format of the required urls, and the number of urls per site led us down that path.\nWhy only FBA and not extend the web app to have one with FBA and one with windows auth? There are enough web applications already, and since we would almost never use the windows auth ones why load up the system?\nOne of the roles of these site is to allow end users to upload files. However, our customer wants the document library that is used for upload to automatically purge files after a given time.\nNo problem, site polices will do that\u0026hellip;\nThe Problem Itself # Unfortunately, when you authenticate as the site collection administrator, or a member of the site owners group, or a farm admin, you can\u0026rsquo;t access the Site Policies administration pages within the site collection hosted in the web application that uses FBA.\nWe spent a while checking group memberships and trying different users, and we established that toggling between FBA and windows auth would make the problem go away. We then called in the Microsoft Support guys and continued to investigate. Those guys deserve a mountain of praise as they carefully replicated the fault and kept us firmly in the loop whilst working on the call.\nUsing Gary Lapointe\u0026rsquo;s stsadm extensions we were able to examine the rights granted to the admin user when the site used FBA. The gl-enumeffectivebaseperms command showed interesting results.\nstsadm -o gl-enumeffectivebaseperms -url \u0026lt;url\u0026gt;\nFullMask\nstsadm -o gl-enumeffectivebaseperms -invert -url \u0026lt;url\u0026gt;\nUseClientIntegration, FullMask\nThe first command tells me what rights I have. The second tells me what rights I don\u0026rsquo;t. Note the confusion!\nIt turns out that when using FBA, the rights are not correctly applied for full control. The Microsoft team provided a workaround, in that enabling Client Integration fixes the application of rights. You either do this using stsadm to reset the authentication provider:\nstsadm -o authentication -rul \u0026lt;url\u0026gt; -type forms -membershipprovider \u0026lt;membership provider\u0026gt; -rolemanager \u0026lt;role manager\u0026gt; -enableclientintegration\nOr through the central admin. We have lots of sites, so we do it through the stsadm route.\nThe Long-Term Solution # I have been informed by Microsoft Support that this has now been logged as a bug with SharePoint and that they are working on a fix. As soon as I know more, I will post again.\n","date":"3 July 2008","externalUrl":null,"permalink":"/posts/problems-with-site-policies-and-fba-in-sharepoint-2007/","section":"Blog","summary":"If you are using Forms Based Authentication and try to access Site Policies you may well find that you get an Access Denied response. If you do, this post will help you!\n","title":"Problems with Site Policies and FBA in SharePoint 2007","type":"posts"},{"content":"When trying to view an item in a list which has workflows run against it, you get an error:\nSome part of your SQL statement is nested too deeply. Rewrite the query or break it up into smaller queries\nProblem Background # Trying to explain the exact nature of our configuration in this case would break many people\u0026rsquo;s heads. This, therefore, is a bit of a simplification.\nWe have a custom webpart which allows users to log an enquiry. We create an item in a list with the enquiry details, and send an email to the account responsible for dealing with those enquiries. A copy of the list item is created in another list (we\u0026rsquo;ll leave out the why and wherefore of that for now). The two copies must be kept in sync. More details on that later.\nThose enquiries must be closed within 30 minutes. If not, an escalation email is sent. An enquiry is closed if a particular column changes value. To ensure the two lists are kept in sync, when an item is changed a workflow is triggered. If the column we care about has changed we sync up the item in the other list.\nThe escalation process is a timer. It checks the items and sends emails. It updates a column with the time of the last email sent so we can repeat the process every 30 minutes.\nWhat we found was that the enquiries weren\u0026rsquo;t being closed for a few days and in that time we could then not access the enquiry item at all via the web interface (although datagrid view still worked!). We saw the error at the top of this post.\nThe Root of the Matter # This fault is currently with our Microsoft Support team and they are working through it. I do, however, have enough knowledge and understanding of why the fault occurred to explain it, and a few dirty hacks to avoid it.\nThe reason we can\u0026rsquo;t access the items is because when SharePoint pulls up the item for edit/view it checks the Workflow History for that item. If there are more than about 200 entries for that item in the Workflow History list, we get the SQL query error and boom! That\u0026rsquo;s the long and short of it.\nThe deeper question is why? More importantly, why do we have over 200 workflows running on the item?\nWorkflow History first. The Workflow History list is a hidden list which does exacly what it says on the tin. Items are created each time a workflow runs. It turns out that items in the Workflow History list have a time-to-live and that time is 60 days. That means that any item in the list will automatically be deleted after 60 days. With roughly a 200 item limit before you hit trouble that means about 3 workflows per list item per day is your maximum.\nPersonally, I think that is a scalability issue. I can envision a scenario where we might want to run that many workflows by design, perhaps more.\nBack to the plot. I suspect you\u0026rsquo;re sitting there thinking that in our case, having that many workflows run is bad design or a fault. Well, you\u0026rsquo;re not wrong, although you\u0026rsquo;re not quite right either.\nWe knew when we built the workflow that we had to avoid circular references and update the lists as little as possible. There is code to make sure that changes made by the workflow itself are not reflected back, and if the change is not the column we care about then the workflow exists cleanly.\nWe also knew that because the timer job updates a different column in the list item, that would trigger the change event on the list item, running the workflow. As a result the timer performs a system update on the list item which should not trigger events (and indeed does not when we have used the method elsewhere).\nWhat this means is that we actually have two problems:\nThe system update method when used in our timer is not working correctly and events on the list item are being triggered. This means that the workflow is running too often. The issue with Workflow History means that we very quickly hit the 200 item limit and meet our end with the SQL query error. A Legion of Dirty Hacks # As I write, these issues are with Microsoft Support who are ably working to resolve them. In the meantime, we have made the problem go away with two approaches, both of which I regard as dirty hacks.\nThe Workflow History Conundrum # Whilst investigating this problem I came across a discussion on the TechNet support forums. Ironically this was coming at the same problem but from a wholly opposite angle, whereby people wanted to keep items in the Workflow History list for longer!\nWhat I found in that list was a post by Fred Morrison containing a PowerShell script. I am re-posting it here for completeness in case the forum disappears, but all credit to Fred for this - I didn\u0026rsquo;t write it!\n# SPAdjustAutoCleanupDays.ps1 # Author: Fred Morrison, Senior Software Engineer, Exostar, LLC # # Purpose: Adjust SharePoint Workflow Association AutoCleanupDays value, where necessary # on all workflow associations for a specified List. # # Parameters: # siteName - The SharePoint Site to look at # listName - The SharePoint List to look at # newCleanupDays - The number of days to set the workflow association AutoCleanupDays value to, if not already set. # # Example call: SPAdjustAutoCleanupDays http://workflow2/FredsWfTestSite FredsNewTestList 180 # # following makes it easier to work with SharePoint and also means you have to run this script on the SharePoint server [void] [System.Reflection.Assembly]::LoadWithPartialName(\u0026#34;Microsoft.SharePoint\u0026#34;) | Out-Null # capture command line arguments $siteName = $args[0] # ex: http://workflow2/FredsWfTestSite/ $listName = $args[1] # ex: FredsNewTestList [int] $newCleanupDays = [System.Convert]::ToInt32($args[2]) # ex: 1096 Write-Host $siteName Write-Host $listName Write-Host $newCleanupDays # get a reference to the SPSite object $wfSite = New-Object -TypeName Microsoft.SharePoint.SPSite $siteName [Microsoft.SharePoint.SPWeb] $wfWeb = $wfSite.OpenWeb() Write-Host $wfWeb.ToString() # get a reference to the SharePoint list we wish to examine [Microsoft.SharePoint.SPList] $wfList = $wfWeb.Lists[$listName]; Write-Host $wfList.Title [Microsoft.SharePoint.Workflow.SPWorkflowAssociation] $wfAssociation = $null [Microsoft.SharePoint.Workflow.SPWorkflowAssociation] $a = $null [int] $assoCounter = 0 [string] $message = \u0026#39;\u0026#39; # Look at every workflow association on the SPList and make sure the AutoCleanupDays value is correctly set to the desired value for( $i=0; $i -lt $wfList.WorkflowAssociations.Count; $i++) { $a = $wfList.WorkflowAssociations[$i] [string] $assocName = $a.Name Write-Host $a.Name if ( $a.AutoCleanupDays -ne $newCleanupDays ) { $oldValue = $a.AutoCleanupDays $a.AutoCleanupDays = $newCleanupDays # save the changes $wfList.UpdateWorkflowAssociation($a) $message = \u0026#34;Workflow association $assocName AutoCleanupDays was changed from $oldValue to $newCleanupDays\u0026#34; } else { $message = \u0026#34;Workflow association $assocName AutoCleanupDays is already set to $newCleanupDays - no change needed\u0026#34; } Write-Host $message } Write-Host \u0026#39;Done\u0026#39; I simply ran that script on our system, setting the value for newCleanUpDays to 1. I waited a day and voila! All the list items were now accessible. Note that, as repeated in the forum discussion time and again, messing about with this is not a good idea. I simply have no choice right now.\nThe Timer Incident # It was all very well fixing the Workflow History list, but we really shouldn\u0026rsquo;t be seeing all those workflows in the first place. For some reason, our method of updating the list item from the timer, whilst being the official approach, triggered the workflow anyway.\nTo the rescue, a method we found on the blog of Paul Kotlyar. In that post, Paul talks about disabling event firing for the list item to ensure that no events get triggered. Why do I think this is a hack? Because the functionality is not normally found in workflows and timers - the method is part of SPEventReceiverBase.\nWhere Do We Go From Here? # Right now, I have support cases logged with Microsoft and engineers are working on the matter. We\u0026rsquo;ve already been via the SQL team, who looked at the original query that triggered the whole shebang, and they have returned an updated query for the SharePoint guys to look at. We also need to get to the bottom of a \u0026lsquo;correct\u0026rsquo; way of updating list items without triggering events. As soon as I get a resolution from Microsoft, I will let you know.\n","date":"3 July 2008","externalUrl":null,"permalink":"/posts/workflow-history-and-sql-error/","section":"Blog","summary":"When trying to view an item in a list which has workflows run against it, you get an error:\nSome part of your SQL statement is nested too deeply. Rewrite the query or break it up into smaller queries\n","title":"Workflow History and SQL Error","type":"posts"},{"content":"I\u0026rsquo;ve been far too busy lately and whilst there have been lots of things I wanted to post about, time has not been on my side. Before I start to forget some of the points I thought a quick post was in order.\n@media 2008 was great. Slides and audio are just filtering onto the blog now. A highlight for me was Indi Young\u0026rsquo;s talk on Mental Models. I now have her book on my desk (waiting for having the time to read it) and I\u0026rsquo;m excited about how the technique might interface nicely with the User Stories we use for feeding requirements into our Scrum development process. Also at @media, I managed to catch up with Nick, who was as insightful as ever. He\u0026rsquo;s on the lookout for a Cold Fusion developer, if anyone is interested. On the food front, if you\u0026rsquo;re down on the South Bank try Giraffe. Also not bad was the food at Auberge, not far from the IMAX. One interesting point is that there was a lot of talk about \u0026lsquo;agile methods\u0026rsquo; from the presenters, but I wasn\u0026rsquo;t getting the impression that there was actually a great deal of understanding as to what they really entail. We use Scrum at Black Marble, albeit with some pragmatism as there are some things you just can\u0026rsquo;t do when you\u0026rsquo;re not working on time and materials. I find that the increased level of dialogue between team members that Scrum gives improves the execution of the project no end. If you want to know more about Scrum, Ken Schwaber\u0026rsquo;s books are a good, quick read. On the smartphone front, the iPhone 3G looks nice, but given my company infrastructure, the Touch Diamond looks more so. Also, the Diamond is nice and small which is something I\u0026rsquo;ve been searching for in a smartphone for a while. Big nod of respect to Opera - I have a beta of 9.5 on my TYTN right now and it\u0026rsquo;s a very nice mobile browser. I\u0026rsquo;m looking forward to seeing what the polished product is like on the Diamond. I have yet to get chance to install it, but the beta Power Pack for Windows Home Server is available which addresses the data corruption bug. I have a single disk in mine right now and to be honest it\u0026rsquo;s not doing much other than backups, but I\u0026rsquo;d recommend one just for that - simple and straightforward image-based backups of all the PCs in the house. Great! ","date":"13 June 2008","externalUrl":null,"permalink":"/posts/catching-up/","section":"Blog","summary":"I’ve been far too busy lately and whilst there have been lots of things I wanted to post about, time has not been on my side. Before I start to forget some of the points I thought a quick post was in order.\n","title":"Catching Up","type":"posts"},{"content":"We try to dogfood here at Black Marble so I\u0026rsquo;m writing this on my HTC TYTN. How? With Richard\u0026rsquo;s new app\n","date":"29 April 2008","externalUrl":null,"permalink":"/posts/blogging-on-the-move/","section":"Blog","summary":"We try to dogfood here at Black Marble so I’m writing this on my HTC TYTN. How? With Richard’s new app\n","title":"Blogging On The Move","type":"posts"},{"content":"A big thanks to everybody who came to the Server 2008 launch event last week. Andy and myself had a great time presenting to such an enthusiastic crowd. In the end we ran long because of the amount of dialogue around the new features of Server 2008 and I hope everyone went away having got something useful.\nNow I need to reduce the two hours of material down to a perky 45 minutes for delivery at the VBug-hosted launch event on April 30th. Richard is there too, and Iain is also speaking, making up the triumvirate. It\u0026rsquo;s my first non-Black Marble community event and I\u0026rsquo;m quite looking forward to it.\n","date":"14 April 2008","externalUrl":null,"permalink":"/posts/community-launch-events/","section":"Blog","summary":"A big thanks to everybody who came to the Server 2008 launch event last week. Andy and myself had a great time presenting to such an enthusiastic crowd. In the end we ran long because of the amount of dialogue around the new features of Server 2008 and I hope everyone went away having got something useful.\n","title":"Community Launch Events","type":"posts"},{"content":"Just seen the sad news of the passing of Arthur C. Clarke. The world was better for his having been in it, and will not be the same without him.\n","date":"18 March 2008","externalUrl":null,"permalink":"/posts/hats-off-lads/","section":"Blog","summary":"Just seen the sad news of the passing of Arthur C. Clarke. The world was better for his having been in it, and will not be the same without him.\n","title":"Hats off, lads","type":"posts"},{"content":"Joel Spolsky has a biting and articulate article on the IE8 standards debate.\n","date":"18 March 2008","externalUrl":null,"permalink":"/posts/insightful/","section":"Blog","summary":"Joel Spolsky has a biting and articulate article on the IE8 standards debate.\n","title":"Insightful","type":"posts"},{"content":"I don\u0026rsquo;t know about you, but I always mean to gather various bits of knowledge into one place, but just like tidying my filing at home, I never quite get around to it. Fortunately for me, Chris O\u0026rsquo;Brien is a bit more organised and in my ever expanding blogroll today I saw a great article about really useful SharePoint controls to use in custom pages for that handy bit of functionality.\n","date":"17 March 2008","externalUrl":null,"permalink":"/posts/a-great-article-on-handy-sharepoint-controls/","section":"Blog","summary":"I don’t know about you, but I always mean to gather various bits of knowledge into one place, but just like tidying my filing at home, I never quite get around to it. Fortunately for me, Chris O’Brien is a bit more organised and in my ever expanding blogroll today I saw a great article about really useful SharePoint controls to use in custom pages for that handy bit of functionality.\n","title":"A great article on handy SharePoint controls","type":"posts"},{"content":"","date":"17 March 2008","externalUrl":null,"permalink":"/tags/html/","section":"Tags","summary":"","title":"Html","type":"tags"},{"content":"You know, the thing about RSS is that it\u0026rsquo;s a bit like the advent of the motor car - you miss things. Just as driving around means you don\u0026rsquo;t get to pass the time of day with folk, or discover that tiny little deli you\u0026rsquo;d never notice from the road, RSS dehumanises the web.\nFor example, I subscribe to the blog of my good friend Nick Smith. Since he hasn\u0026rsquo;t posted about his new redesign, I didn\u0026rsquo;t know about it. Which is a shame, because I like it - it puts me in mind of Tim Burton\u0026rsquo;s animations with it\u0026rsquo;s tendril-like curves.\nIt just shows that every now and then you need to get out and enjoy the scenery, before it\u0026rsquo;s not there any more.\n","date":"17 March 2008","externalUrl":null,"permalink":"/posts/taking-time-to-enjoy-the-scenery/","section":"Blog","summary":"You know, the thing about RSS is that it’s a bit like the advent of the motor car - you miss things. Just as driving around means you don’t get to pass the time of day with folk, or discover that tiny little deli you’d never notice from the road, RSS dehumanises the web.\n","title":"Taking time to enjoy the scenery","type":"posts"},{"content":"IE8 Activities look cool. They\u0026rsquo;re almost like favlets from where I stand, but they offer a very simple way for users to access online services and pass simple parameters.\nI decided I wanted to play, and we use SharePoint heavily here at Black Marble. The obvious thing to do was to create an activity which would allow the user to search for the selected text using SharePoint search.\nActivities are defined through XML. Essentially, you give it a name, an icon and define the actions that can be performed. There are execute and preview actions, but the small preview window doesn\u0026rsquo;t really lend itself to SharePoint search (I tried!).\nHere is the xml for our sharepoint search activity. Note that I\u0026rsquo;ve replaced our hostnames. I called this file SharePointSearch.xml\n\u0026lt;?xml version=\u0026#34;1.0\u0026#34; encoding=\u0026#34;UTF-8\u0026#34;?\u0026gt; \u0026lt;openServiceDescription xmlns=\u0026#34;http://www.microsoft.com/schemas/openservicedescription/1.0\u0026#34;\\\u0026gt; \u0026lt;homepageUrl\u0026gt;https://portal.blackmarble.co.uk\u0026lt;/homepageUrl\u0026gt; \u0026lt;display\u0026gt; \u0026lt;name\u0026gt;Find in Black Marble Portal\u0026lt;/name\u0026gt; \u0026lt;icon\u0026gt;https://portal.blackmarble.co.uk/\\_layouts/images/favicon.ico\u0026lt;/icon\u0026gt; \u0026lt;/display\u0026gt; \u0026lt;activity category=\u0026#34;find\u0026#34;\\\u0026gt; \u0026lt;activityAction context=\u0026#34;selection\u0026#34;\\\u0026gt; \u0026lt;execute action=\u0026#34;https://portal.blackmarble.co.uk/search/Pages/results.aspx\u0026#34;\\\u0026gt; \u0026lt;parameter name=\u0026#34;k\u0026#34; value\\=\u0026#34;{selection}\u0026#34; type=\u0026#34;text\u0026#34; /\u0026gt; \u0026lt;/execute\u0026gt; \u0026lt;/activityAction\u0026gt; \u0026lt;/activity\u0026gt; \u0026lt;/openServiceDescription\u0026gt; So what does that lot do? Well most of it seems pretty self explanatory. The key to the activitiy is in the section which defines the custom action. That has a url which IE8 will call and a list of parameters into which information is passed. A simple search in SharePoint uses the \u0026lsquo;k\u0026rsquo; parameter to pass in the search term, so I have set that here.\nSo now we have our file, how do we get it into the browser. Well, I copied the xml file into the LAYOUTS folder in the SharePoint installation folder on the hard disk of the server, which is reference via _layouts in a url. I then added a Content Editor web part onto one of my pages and pasted the code to add the action into the source view:\n\u0026lt;p\u0026gt;Search Portal easily from IE8 with our custom activity.\u0026lt;/p\u0026gt;\u0026lt;button onclick=\u0026#34;BLOCKED SCRIPTwindow.external.addService(\u0026#39;/_layouts/SharePointSearch.xml\u0026#39;)\u0026#34;\u0026gt;Add Portal Search Activity\u0026lt;/button\u0026gt; This simply shows a short paragraph and a button. When the user clicks the button, IE8 asks whether it should install the activity and hey presto, a new menu item appears under \u0026lsquo;More Activities\u0026rsquo; on the context menu. When I highlight text in my browser I can now quickly search our SharePoint for any relevant content.\n","date":"6 March 2008","externalUrl":null,"permalink":"/posts/searching-sharepoint-through-an-ie8-activity/","section":"Blog","summary":"IE8 Activities look cool. They’re almost like favlets from where I stand, but they offer a very simple way for users to access online services and pass simple parameters.\nI decided I wanted to play, and we use SharePoint heavily here at Black Marble. The obvious thing to do was to create an activity which would allow the user to search for the selected text using SharePoint search.\n","title":"Searching SharePoint through an IE8 Activity","type":"posts"},{"content":"I can\u0026rsquo;t spend much longer playing with IE8 or my wife will skin me. However, from my cursory browsing experience I\u0026rsquo;m worried. Either the devs have a good deal of work to do or I\u0026rsquo;m going to be very busy with CSS rules for a while.\nHere\u0026rsquo;s the University of Bradford site in IE8:\nAnd to try to compare apples with oranges, here it is in Firefox 3 beta 3:\nMore surprisingly, here is the Web Standards Project site in IE8:\nand again, in Firefox 3b3:\nApple.com, IE8:\nand Apple.com, Firefox 3b3:\nAs you can see, there are issues with the placement of some elements on each of these pages. I have not yet started to investigate why, but I am honestly surprised. Given the much-touted, \u0026lsquo;vastly-improved\u0026rsquo; web standards support I was not expecting the number of issues I have seen. Ironically, as usual, old style table layouts look great\u0026hellip;\nI\u0026rsquo;ll try to do more comprehensive testing tomorrow. Stay tuned.\n","date":"5 March 2008","externalUrl":null,"permalink":"/posts/ie8-rapid-fire-site-test/","section":"Blog","summary":"I can’t spend much longer playing with IE8 or my wife will skin me. However, from my cursory browsing experience I’m worried. Either the devs have a good deal of work to do or I’m going to be very busy with CSS rules for a while.\n","title":"IE8 Rapid Fire Site Test","type":"posts"},{"content":"Well, as expected, the public beta of IE8 appeared on the web pretty much straight after the Mix08 keynote mentioned it. I managed to grab it within mere moments and I now have it installed on my trusty laptop.\nAs announced only a day or two ago, it defaults to the new rendering mode, with a big toolbar button to toggle back to IE7 mode. I haven\u0026rsquo;t had time to test the browser with any sites yet, but I\u0026rsquo;ll try to do that in the next few days and maybe post again.\nWhat did strike me, though, was that there are developer tools right out of the box. Reminiscent of the Safari tools that let you view the page code, the IE dev tools are enabled with a simple icon on the toolbar. Once enabled, what you get is cool:\nA nice CSS/HTML view where you can see the elements and which style rules are being inherited by the element, along with the opportunity to enable/disable individual rules. Suddenly IE is no longer Firebug\u0026rsquo;s poor cousin.\nMore on for my developer colleagues, script debugging is also available. This will also come in jolly handy.\nThe new Favorites Bar I can take or leave- I just don\u0026rsquo;t browser like that. Underneath, it feels like the old links toolbar to me. Nothing to see here, move along.\nActivities look ike they may have legs, though, particularly in the corporate sector where they can guarantee the desktop browser. Being able to right click on the page, element or highlighted text and call functions from other web sites, such as searching for a term or cross-connecting business applications - I can see uses for that and I\u0026rsquo;ll be playing with this as soon as I can.\n","date":"5 March 2008","externalUrl":null,"permalink":"/posts/internet-explorer-8/","section":"Blog","summary":"Well, as expected, the public beta of IE8 appeared on the web pretty much straight after the Mix08 keynote mentioned it. I managed to grab it within mere moments and I now have it installed on my trusty laptop.\n","title":"Internet Explorer 8...","type":"posts"},{"content":"","date":"5 March 2008","externalUrl":null,"permalink":"/tags/mix08/","section":"Tags","summary":"","title":"Mix08","type":"tags"},{"content":"Before I joined Black Marble I had a succession of Sony Ericsson smartphones - the P800, P900 and finally a P910i. They were great - the size was good, the UI was good, the handwriting recognition was excellent (with a grafitti-style interface that meant I could really get a good turn of speed) and I could work most functions one handed with the fabulous Jog Dial. Please note that the jog dial was sadly emasculated with phones after the P910i when Sony Ericsson foolishly reduced it\u0026rsquo;s degrees of freedom to simply rolling back and forth and clicking.\nI currently have a Windows Mobile-powered Orange M3100 (the HTC TYTN). Don\u0026rsquo;t get me wrong - it\u0026rsquo;s good, but it\u0026rsquo;s no P910i. WIndows Mobile 5 can be uncooperative at times and Orange have not yet seen fit to release a mobile 6 upgrade. I like the keyboard a lot, but I haven\u0026rsquo;t taken to WinMob\u0026rsquo;s handwriting recognition like I did the Sony\u0026rsquo;s\nThere are good looking phones on the way, to be sure - Richard has his Touch Cruise on order and I must say I was tempted by one myself. Then today I saw two things which piqued my interest\u0026hellip;\nThe first was a snippet which suggested that Microsoft are in discussions with Nokia about the latter running Windows Mobile on future devices (I wish I could remember where I saw that to link). Interesting, I thought, but I can\u0026rsquo;t see that happening. Certainly, the iPhone has set the cat amongst the mobile-manufacturing pigeons but Nokia own a huge slice of Symbian and I just can\u0026rsquo;t see it myself.\nThe second thing, however, made me sit up and take notice. No rumour or gossip here - cold, hard facts and a device that people have touched. Sony Ericsson announced the XPERIA X1 and it looks lovely. There is more about it on Engadget and Engadget Mobile if you haven\u0026rsquo;t seen it. It looks nice. All the features I need in a polished offering with a VGA scree, decent camera, 3G et al. Sadly, no jog dial but there is a keyboard and the whole thing doesn\u0026rsquo;t seem too huge either - marginally smaller than the P800 in every axis.\nThe reason this is interesting (apart from the fact it\u0026rsquo;s so sexy) is that Sony Ericsson as a brand occupy a space that current WinMob devices don\u0026rsquo;t. Think of Sony Ericsson and you think of the Walkman phones and their bretheren - gadget phones that most certainly are not targetted at the business end of the market.\nThere are big numbers being thrown around by the marketing droids for this phone, but it\u0026rsquo;s clear that it will be going head to head with the iPhone. Perhaps in the US market the Sony Ericsson brand lacks the cachet of Apple, but in the European arean they are well-established and the X1 is a much better specified device in terms of matching the demands of the European market.\nSkipping back to something I said earlier, I would suggest that this announcement is evidence against Nokia releasing a WinMob device. Whilst Microsoft are very open about the fact that WinMob is a platform and anybody can build devices that run it, if I were Sony Ericsson I would want a clear run at the marketplace for my device and most certainly not want Nokia to come out with one very similar.\nI also think the interface is interesting. WinMob 7 it isn\u0026rsquo;t. Nor is it TouchFlo - the HTC UI layer that graces their latest devices. There\u0026rsquo;s good and bad to this, I think. On the one hand it shows how flexible a platform WinMob is that it can support two radically different (and undeniably sexy) top-level interfaces. On the other hand, once you push beneath the oh-so shiny surface, we\u0026rsquo;re still left with the standard WInMob interface. Whilst that\u0026rsquo;s not bad, it\u0026rsquo;s not the greatest UI for a device you want to operate with one hand at best and one hand plus a finger at worst. Does the flowering of many different eye-candy strewn UIs dilute the benefit of having a single OS underneath? Does it hinder usability by forcing users to learn each new UI? When Apple released the iPhone the one thing everybody agreed on was that they had a great UI. Just because you can put an elephant in a shiny suit and call it an astronaut does not make it so, and WinMob+UI-of-the-month feels a bit like that, to me.\nUltimately it depends where you sit. One man\u0026rsquo;s \u0026lsquo;great for manufacturers because it allows them to differentiate their offerings and tailor the their customers\u0026rsquo; is another man\u0026rsquo;s \u0026lsquo;why do you have to be different just for the sake of it - it makes it hard to use\u0026rsquo;.\nOne thing I will say - if anybody from Sony Ericsson is reading this, and they want an enthusiastic tester for the X1, sign me up!\n","date":"11 February 2008","externalUrl":null,"permalink":"/posts/the-xperia-x1-a-windows-mobile-device-that-i-could-really-get-excited-over/","section":"Blog","summary":"Before I joined Black Marble I had a succession of Sony Ericsson smartphones - the P800, P900 and finally a P910i. They were great - the size was good, the UI was good, the handwriting recognition was excellent (with a grafitti-style interface that meant I could really get a good turn of speed) and I could work most functions one handed with the fabulous Jog Dial. Please note that the jog dial was sadly emasculated with phones after the P910i when Sony Ericsson foolishly reduced it’s degrees of freedom to simply rolling back and forth and clicking.\n","title":"The XPERIA X1 - A Windows Mobile device that I could really get excited over","type":"posts"},{"content":"After sadly missing last year due to workload, I am excited to be able to attend @media 2008 in London along with Tom and Lauren from Black Marble. If you know me and you want to meet up please get in touch!\n","date":"10 February 2008","externalUrl":null,"permalink":"/posts/media-2008/","section":"Blog","summary":"After sadly missing last year due to workload, I am excited to be able to attend @media 2008 in London along with Tom and Lauren from Black Marble. If you know me and you want to meet up please get in touch!\n","title":"@media 2008","type":"posts"},{"content":"I\u0026rsquo;ve watched the debate with interest but not posted anything until now. The news of Internet Explorer 8 keeping it\u0026rsquo;s new rendering engine to itself unless you tell it otherwise caused a strong outpouring of opinion around the web.\nI must admit, my initial reaction mirrored that of many others - that it\u0026rsquo;s just plain wrong (although my good friend Nick\u0026rsquo;s posting took some concentration to ascertain his thoughts!). Why hold back on improved support for CSS; why hide the fact that the engine now passes ACID2?\nThen I thought for a bit, and tempered my view with the knowledge that the coming of IE7 caused much angst amongst companies because what worked in IE6 failed in IE7. Perhaps an additional switch to toggle this new rendering marvel on and off was a good idea. But surely, you\u0026rsquo;d want it to default to the shiny new engine\u0026hellip; wouldn\u0026rsquo;t you?\nI have now changed my mind. Why? Because at a recent event, after presenting for a while on upcoming Microsoft technologies including IE8, one of the attendees came up to chat. He worked for major financial organisation and was pressing for more information on the new browser. Would it really keep the rendering behaviour as previous versions by default? If so, that was great! Why? Because he was faced with many different divisions within his organisation, all of which had web-based applications and all of which cried foul over IE7 breaking their systems. This was still giving headaches with the rollout of IE7, and he was very keen on being able to convince his stakeholders that if they would just shoulder the pain of the version 6 to 7 transition, he could guarantee that there would be no more pain with future upgrades. This would mean that the IT department could push out the newer, more secure browsers without the battle.\nThere are many large organisations like that around the globe. Their strength in terms of buying power and opinion is what has led Microsoft to the solution we now see with IE8. Whilst purists may hate it, the truth is that IT Managers around the planet are smiling.\nWhich would you rather see - massive companies sticking to insecure browsers on their desktops because the investment in internal systems would be too large to allow movement, or a steady push forward in versions safe in the knowledge that there will be zero impact on existing investment?\nIf you\u0026rsquo;ve managed to avoid this issue entirely thus far, the ever thoughtful and tactful Eric Meyer has some excellent posts discussing the matter.\n","date":"10 February 2008","externalUrl":null,"permalink":"/posts/balancing-customer-needs-against-forward-motion-ie8/","section":"Blog","summary":"I’ve watched the debate with interest but not posted anything until now. The news of Internet Explorer 8 keeping it’s new rendering engine to itself unless you tell it otherwise caused a strong outpouring of opinion around the web.\n","title":"Balancing customer needs against forward motion: IE8","type":"posts"},{"content":"","date":"10 February 2008","externalUrl":null,"permalink":"/tags/css/","section":"Tags","summary":"","title":"Css","type":"tags"},{"content":"You know, one of these days I\u0026rsquo;ll find the time to properly redesign this blog. In the meantime, the excellent Kid Congo theme from the latest version of Community Server will suffice, albeit with the alteration of colours to match our corporate blue.\n","date":"10 February 2008","externalUrl":null,"permalink":"/posts/spring-cleaning/","section":"Blog","summary":"You know, one of these days I’ll find the time to properly redesign this blog. In the meantime, the excellent Kid Congo theme from the latest version of Community Server will suffice, albeit with the alteration of colours to match our corporate blue.\n","title":"Spring cleaning","type":"posts"},{"content":"Well, the keynote just ended and I needed to check email so I thought I\u0026rsquo;d do a quick post. A good chunk of the keynote had already been covered by yesterday\u0026rsquo;s partner-only sessions. However, Mike Angiulo publicly announced that the Office 2007 family Service Pack 1 will be available on December 11th, 2007. I guess that means we can tell the world! I\u0026rsquo;m surprised, actually, that I haven\u0026rsquo;t noticed this on any of the SharePoint blogs I frequent.\nAnyhoo\u0026hellip; We were given a short demo of Project 14. It has some useful new features that should make it easier to build a new project when you don\u0026rsquo;t have all the details - much more so than Project 2007. Much to Paul\u0026rsquo;s horror, however, Project 14 has a shiny ribbon bar! I guess that\u0026rsquo;s going to be a real love/hate thing. Personally, I quite like the ribbon bar, but I can understand why some folk think of it as burying functionality because not all the millions of toolbar icons are visible at once.\nAlso interesting is that Project Portfolio Server is being merged into Project Server with version 14. As someone who is new to the area of EPM this is a product which I am not familiar with, but merging functionality into a single system would seem to me to have serious benefits, not least in terms of having one less system to manage.\nI\u0026rsquo;m not going to blog every session I attend, but if I see something interesting I will post later. Right now, it\u0026rsquo;s time for the first \u0026lsquo;real\u0026rsquo; session of the day - a sysadmin chalk and talk.\n","date":"4 December 2007","externalUrl":null,"permalink":"/posts/emea-project-conference-keynote-thoughts/","section":"Blog","summary":"Well, the keynote just ended and I needed to check email so I thought I’d do a quick post. A good chunk of the keynote had already been covered by yesterday’s partner-only sessions. However, Mike Angiulo publicly announced that the Office 2007 family Service Pack 1 will be available on December 11th, 2007. I guess that means we can tell the world! I’m surprised, actually, that I haven’t noticed this on any of the SharePoint blogs I frequent.\n","title":"EMEA Project Conference: Keynote Thoughts","type":"posts"},{"content":"Finally, after all the excitement that Richard and Robert had in Seattle and Barcelona, I find myself in the Auditorium Hotel, Madrid for the EMEA Project Conference.\nAccording to the multilingual sales blurb in my room, the hotel is the largest in Europe, and I must say it\u0026rsquo;s very nice. We flew in yesterday and today is an MS Partner-only day before the conference itself kicks off tomorrow.\nProject Server is something we\u0026rsquo;re very interested in using ourselves, and it\u0026rsquo;s integration with SharePoint (MOSS/WSS) makes it an attractive solution to anybody who has already deployed MOSS for their corporate intranet, as we have.\nAlso on the agenda today is VSTS integration with Project Server, which I\u0026rsquo;m keen to see more on. Closing the loop between developer activity and project planning and monitoring can make a big difference to whether a project comes in on time and budget.\nI\u0026rsquo;m here for the SysAdmin track, whilst Paul and Jim cover the managerial and best practice side of things. I\u0026rsquo;ll do my best to blog on what I see, although it\u0026rsquo;s a pretty packed few days, ending in a good sprint from the end of the last session at 3:15 on Wednesday to make it to the airport in time for our 5:25 flight back to Blighty.\n","date":"3 December 2007","externalUrl":null,"permalink":"/posts/emea-project-conference-madrid/","section":"Blog","summary":"Finally, after all the excitement that Richard and Robert had in Seattle and Barcelona, I find myself in the Auditorium Hotel, Madrid for the EMEA Project Conference.\nAccording to the multilingual sales blurb in my room, the hotel is the largest in Europe, and I must say it’s very nice. We flew in yesterday and today is an MS Partner-only day before the conference itself kicks off tomorrow.\n","title":"EMEA Project Conference - Madrid","type":"posts"},{"content":"Well, it\u0026rsquo;s the end of day zero, the partner-only day here at the Madrid Project Conference. It\u0026rsquo;s been an interesting day. I\u0026rsquo;m not sure what I am allowed to say, but service pack 1 for Office 2007, which covers the desktop products, sharepoint, project server et al is very close to being available now. That was an interesting announcement, as we are looking at installing Project Server in Black Marble. I\u0026rsquo;d like to wait for SP1 - it makes sense - but because SharePoint will be patched at the same time I need to do some testing of our customisations first.\nMeanwhile, outside the conference, we managed to leave the hotel for a few hours this morning before the partner event. The part of Madrid we are in has an incredible amount of building work underway; all all the roads are dual carriageways with big cloverleaf junctions. A fifteen minute taxi ride to the local Shopping Centre would probably have been a ten minute walk, had we realised where the shopping centre was in relation to the hotel. Ah well!\nTomorrow, the conference starts in earnest and I am planning to follow the system administration track, leaving the project management stuff to Paul and Jim. There are some interesting sessions ahead\u0026hellip;\n","date":"3 December 2007","externalUrl":null,"permalink":"/posts/project-partner-day/","section":"Blog","summary":"Well, it’s the end of day zero, the partner-only day here at the Madrid Project Conference. It’s been an interesting day. I’m not sure what I am allowed to say, but service pack 1 for Office 2007, which covers the desktop products, sharepoint, project server et al is very close to being available now. That was an interesting announcement, as we are looking at installing Project Server in Black Marble. I’d like to wait for SP1 - it makes sense - but because SharePoint will be patched at the same time I need to do some testing of our customisations first.\n","title":"Project Partner Day","type":"posts"},{"content":"We\u0026rsquo;re back up north after Mix:UK 07 and I thought I\u0026rsquo;d follow up my earlier post with a few thoughts on the event and it\u0026rsquo;s content.\nBefore I do that, however, I need to give a cheer for our guys: Jonny performed incredibly in the Guiter Hero competition to be triumphant in front of his screaming supporters, and Sam, Mat, Tom and Jonny cleaned up the the goody-bagging stakes of the Swaggily Fortunes quiz!\nAnyway, back to the plot. Day two of the event had some good sessions. Kicking off the day with good humour was a pretty inspiring talk by Beau Amber of Metaliq. He apologised for not being awake, having not slept. He then showed the fruits of his sleepless night by demoing an iPhone built in Silverlight! It was a great session on what kinds of things you can do with Silverlight 1.0 and I look forward to his continued development of the Silverphone.\nNext up was Todd Landstad, who was infectiously enthusiastic about mobile devices. He was showing interesting stuff using tablet PC, Sideshow and a suit of UMPC devices. As an avid Engadget reader none of the devices came as a surprise, but it was a great demo on how a little lateral thinking can result in useful software for people on the move, and the things to consider when targeting mobile devices.\nNow it gets tricky. The next session was all about accessibility. It wasn\u0026rsquo;t bad, I have to say, and the guy running the session showed a couple of things I didn\u0026rsquo;t know about how to kick ASP.NET into generating some of the elements that are needed when doing accessible tables. The trouble is, that it was like watching a presentation from about five years ago. The points covered were all WCAG 1 level A, with little mention of level AA. More worryingly, the speaker referenced WCAG 1 but called it WCAG 2. He didn\u0026rsquo;t seem versed in current thoughts and best practices regarding semantic structure, skip links and access keys. He even admitted to using tables for layouts!\nI appreciate that he only had an hour, but I\u0026rsquo;m not convinced that anybody left the room really understanding what their obligations were or where to go to find out more.\nSo, if you were in the room and want to find out about accessbility here are a couple of links to get you started:\nAbilityNet - a UK organisation who give support and advice on accessibility. JuicyStudio - the site of Gez Lemon, who\u0026rsquo;s involved in WCAG 2 and knows his accessibility onions. Joe Clark - extremely passionate about accessibility across a broad spectrum of areas. Accessify - a community site founded by Ian Lloyd and a hub for accessibility discussion. Further Ahead - run by Derek Featherstone, who\u0026rsquo;s a really cool guy and knows his stuff. Overall I was at times impressed, inspired, disappointed and frustrated at Mix:UK, but I have to say that at all times the guys running the conference were helpful and organised and all the Black Marble posse had a great time.\n","date":"13 September 2007","externalUrl":null,"permalink":"/posts/mixuk-07-round-up/","section":"Blog","summary":"We’re back up north after Mix:UK 07 and I thought I’d follow up my earlier post with a few thoughts on the event and it’s content.\nBefore I do that, however, I need to give a cheer for our guys: Jonny performed incredibly in the Guiter Hero competition to be triumphant in front of his screaming supporters, and Sam, Mat, Tom and Jonny cleaned up the the goody-bagging stakes of the Swaggily Fortunes quiz!\n","title":"Mix:UK 07 Round-up","type":"posts"},{"content":"","date":"13 September 2007","externalUrl":null,"permalink":"/tags/mix07/","section":"Tags","summary":"","title":"Mix07","type":"tags"},{"content":"Well, it\u0026rsquo;s just after 3pm on day one of Mix:UK 07. I\u0026rsquo;m taking a break with a coffee so I thought I\u0026rsquo;d post.\nIt\u0026rsquo;s mixed bag down here (sorry - no pun intended). The technology is fantastic - the stuff that can be achieved with WPF and Silverlight is excellent. I\u0026rsquo;m still a little uncertain that usability has been sacrificed on the sacrificial alter of bling, however. To be fair, that\u0026rsquo;s more telling about the rapid-development nature of conference demos, where the wow-factor is more important, but I think it\u0026rsquo;s a very, very significant issue which should not be allowed to get lost in the excitement.\nSo, keynote was good, but a little patchy, with lots of people showing off their latest and greatest example of of WPF or Silverlight. The first session was really useful for me. I\u0026rsquo;ve done some XAML, but to watch a guy who really knows his way around Blend really helped gel things in my mind.\nMore interesting still, however, was the next session, where a great guy called Nathan Buggia from Live Search talked about SEO. It was a good session, with a lot of straight talk from a guy who works at a search engine about SEO, nicely pointing out some of the less honorable practices of SEO sharks. Overall his message was what I\u0026rsquo;ve said all along - build good, semantic pages with informative content and you\u0026rsquo;ll get good rankings. There\u0026rsquo;s a bit more to it than that, obviously, but that\u0026rsquo;s broadly it.\nWhat I did discover during that session, which I really ought to have seen before (I may even have seen it but not have it register), was the XML sitemap format, detailed at sitemaps.org. This can be pushed to the search engines to give them prior information, if you like. It doesn\u0026rsquo;t let you \u0026lsquo;fix\u0026rsquo; your results, but it can be used to give helpful hints to the search engine, particularly on refresh rates for changing pages or even just giving them the nod that things have changed. I will research this more thoroughly now - I may even manage a post on what I find.\nAnyway, I will sign off with an apology - sorry Nick, I\u0026rsquo;m in London and I haven\u0026rsquo;t called. Next time, I promise!\n","date":"11 September 2007","externalUrl":null,"permalink":"/posts/in-the-mix/","section":"Blog","summary":"Well, it’s just after 3pm on day one of Mix:UK 07. I’m taking a break with a coffee so I thought I’d post.\nIt’s mixed bag down here (sorry - no pun intended). The technology is fantastic - the stuff that can be achieved with WPF and Silverlight is excellent. I’m still a little uncertain that usability has been sacrificed on the sacrificial alter of bling, however. To be fair, that’s more telling about the rapid-development nature of conference demos, where the wow-factor is more important, but I think it’s a very, very significant issue which should not be allowed to get lost in the excitement.\n","title":"In the Mix","type":"posts"},{"content":"One of the last projects I was involved in before I left the University of Bradford to join Black Marble was a new design for the external web site of the institution. I\u0026rsquo;d pretty much finished the construction of the page layouts and styles before I left, but it\u0026rsquo;s only now that the site is about to go live. I\u0026rsquo;ve threatened a few people with a series of posts on how the site is constructed and although I\u0026rsquo;m not there any more it seems topical.\nIn this post I\u0026rsquo;ll give some background, describe the project and run through why things were done in a certain way. Over the next few posts I\u0026rsquo;ll cover the construction in more detail - what styling problems I hit and how they were fixed, and how the site tries to make use of things like microformats and opensearch.\nA Brand Refresh; A whole new look # The University\u0026rsquo;s external web site hasn\u0026rsquo;t really changed much in years. Having said that, in spite of not necessarily being the snappiest dresser on the block, it was always extremely easy to find what you were after. Back in early 2006 the marketing department were engaged in a \u0026lsquo;brand refresh\u0026rsquo; which to you and me means fiddling with the logo and corporate colours. Also to be included in the spruce-up was the web site.\nFor those of you who don\u0026rsquo;t know, my role at the University expanded to take in the web when one of my colleagues, who ran the web servers, left the organisation. I\u0026rsquo;ve always been passionate about web development (and I use that term advisedly) and I spent a fair amount of my time trying to expand the level of knowledge and appreciation of web standards, issues and technology throughout the university. It was because of this that I was asked if I could assist with the development of the new web site.\nThe design for the site was done by the same agency responsible for the brand refresh. It is extremely striking, and still in keeping with trying to make the site as navigable as possible. A meeting was had with the designer, the University\u0026rsquo;s Web Officer, the Head of Marketing and myself. In that meeting we agreed that the University would build the site itself from the designs created by the agency. This would allow us to make sure that we met our legal obligations in terms of Accessibility, and also ensure that the was knowledge and understanding within the organisation of how the site was built.\nA series of laudable aims # It was agreed that the site should meet a series of requirements from a technical perspective:\nIt should be a fully fluid design - not a thin sliver down the middle of your monitor but able to flow and take up as much space as allowed. It should work in all modern browsers, including mobile browsers such as Opera, and text-only browsers such as Lynx. It should be as accessible as possible, using accepted best-practice for ensuring users of assistive technologies would be able to get the most out of the site. It should attempt to include new technologies such as OpenSearch and Microformats if and where appropriate. Assigning roles # There were a number of areas that required work to make the new web site a reality. It was agreed that I would build the external homepage and a template for the content pages. I would not deal with site structure or content- those would be managed by the Web Officer and the marketing team.\nStarting Out # I started out with a series of visual comps given to me in PDF format. I began with the homepage and started to work out how to tackle taking the design and building the underlying HTML structure.\nI\u0026rsquo;m a bit of a luddite at heart, so I printed all the comps out at A3, got some large sheets of tracing paper and traced my initial wireframe, labelling the parts as I went.\nOnce I\u0026rsquo;d got a basic structure I then made some scribbled notes about how certain elements should function - using remote rollovers, for example.\nAfter that, I pulled the comps up in my bitmap editor (Corel PhotoPaint, if you care) and took some dimensions to inform the initial styling, and lifted the colour values from the design element to feed into the stylesheets.\nOnce I had my trusty paper notes to work from, I started to tackle the creation of the site. I code by hand - I hate GUI editors - so I did most of the work in HTML-Kit from Chami.com. I now tend to use Expression Web, although I dip into Dreamweaver occasionally and I suspect that I will use Visual Studio 208 more as the projects I work on at Black Marble tend to involve ASP.Net coders as well.\nIn my next post I\u0026rsquo;ll run through how the homepage was built and what hurdles the web browsers threw into my path along the way!\n","date":"27 August 2007","externalUrl":null,"permalink":"/posts/web-site-development-university-of-bradford-part-1/","section":"Blog","summary":"One of the last projects I was involved in before I left the University of Bradford to join Black Marble was a new design for the external web site of the institution. I’d pretty much finished the construction of the page layouts and styles before I left, but it’s only now that the site is about to go live. I’ve threatened a few people with a series of posts on how the site is constructed and although I’m not there any more it seems topical.\n","title":"Web site development: University of Bradford Part 1","type":"posts"},{"content":"After posting yesterday about useful tools for development I stumbled across another little gem of a utility. IE7Pro is much more of a usability-enhancing tool but it has a wonderfully handy tool nestling within - Save Current Tab As Image. If you need to do grabs of pages for documentation or presentations and the page is more than a single screen in length this will transform your life - no more cropping and stitching!\nIE7Pro also has a raft of features such as adblocking and mouse gestures, which I will admit to switching off immediately. However, it\u0026rsquo;s inline search (not quite Find As You Type, but pretty close) is jolly useful.\nGet IE7Pro\n","date":"26 July 2007","externalUrl":null,"permalink":"/posts/web-development-helpers-redux/","section":"Blog","summary":"After posting yesterday about useful tools for development I stumbled across another little gem of a utility. IE7Pro is much more of a usability-enhancing tool but it has a wonderfully handy tool nestling within - Save Current Tab As Image. If you need to do grabs of pages for documentation or presentations and the page is more than a single screen in length this will transform your life - no more cropping and stitching!\n","title":"Web development helpers: Redux","type":"posts"},{"content":"As web development gets more and more complex having the right tools to help you figure out what\u0026rsquo;s going on is essential. I thought I\u0026rsquo;d do a quick post on the ones I find most useful. In no particular order, then, here they are.\nVirtual PC\nThis one is a godsend, because as we all know, running multiple versions of Internet Explorer is hard. VPC, now available as a free download from Microsoft, allows me to run the numerous variants of IE our clients require me to test against.\nIf you just want IE6, Microsoft have a handy downloadable pre-built VPC:\nDownload Virtual PC\nDownload the Internet Explorer Compatibility VPC Image\nFirebug for Firefox\nNow imitated for other browsers, Firebug is fantastic. A clear and straightforward way to identify the bugs in your pages or styles, it allows you to easily identify which stylesheet rules are being applied and in what order, and to hack \u0026rsquo;em on the fly as you test your fixes. Add to that the ability to mangle the page and debug javascript and we have a winner.\nDownload Firebug\nChris Pederick\u0026rsquo;s Developer Toolbar for Firefox\nEven though Firebug is great, I still use Chris Pederick\u0026rsquo;s trusty developer toolbar for enabling and disabling styles, accessing the W3C validator and other stuff. Couldn\u0026rsquo;t live without it, in fact.\nGet Developer Toolbar\nNikhil Kothari\u0026rsquo;s Web Development Helper for IE\nBroadly offering the same level of information as Firebug, but without the ability to hack on the fly, this is a handy way of seeing what IE is doing with your page under the hood.\nGet Web Development Helper\nInspector for Safari (for Windows)\nI have a trusty Mac Mini that I use for checking Safari as well, but the advent of Safari for Windows has made my life easier, I must admit. How excited was I, then, to find that you get Inspector working with the Windows version. Again, loads of info about the page, although hacking on the fly. Instructions courtesty of David Barkol\u0026rsquo;s blog. A note - as I write this the latest nightly crashes horribly - I am using the nightly from the 21st June and it works well. At some point I will try later builds but right now a stable platform that I can enable easily and consistently is more important.\nEnable Web Inspector for Safari on Windows\nI\u0026rsquo;d love to hear from anybody who uses other cool tools that I may not have come across. I\u0026rsquo;m particularly interested in these kind of things for Opera.\n","date":"25 July 2007","externalUrl":null,"permalink":"/posts/web-development-little-helpers/","section":"Blog","summary":"As web development gets more and more complex having the right tools to help you figure out what’s going on is essential. I thought I’d do a quick post on the ones I find most useful. In no particular order, then, here they are.\n","title":"Web development little helpers","type":"posts"},{"content":"I spent a while knocking my head against a problem with a SharePoint server farm that\u0026rsquo;s worth posting about. It\u0026rsquo;s also worth a big hats-off to our Technical Support Coordinator at Microsoft Partner Support who dredged up the article that finally pointed us in the right direction.\nThe problem # I\u0026rsquo;ll post later about our approach to SharePoint installations, but I\u0026rsquo;ll summarise thus: We create multiple user accounts to the SharePoint services - a db access account, an installation account etc etc. In this instance we were building a three server setup - db server, web server, index server. The accounts were created first, logged in as a domain admin. I also installed SharePoint as the domain admin, but didn\u0026rsquo;t run the config wizard.\nI then logged in as our installation user, which has local admin rights to the two servers and dbcreator and securityadmin roles in the SQL server. I ran the config wizard on the web server and created the farm, specifying the db access account for (shock!) db access! The web server got to host the central admin site, which was tested and worked.\nBefore doing anything else I ran the config wizard on the second server and connected to the farm. At this point I had three servers listed in the Central Admin site, and it was time to configure services.\nAt this point we hit the snag - when I tried to configure the Office Server Search Service to run on the second server I got a SharePoint page telling me access was denied (\u0026lsquo;The request failed with HTTP status 401: Unathorised\u0026rsquo;. There was a similar error in the event log with an event ID of 1314, and we also found an event log error with ID 5000.\nI bashed my head against this for a while, checking user rights, group memberships and stuff. I checked the DCOM IIS WAMREG activation rights for the users that the app pools were running as and just in case did an aspnet_regiis -ga \u0026lt;username\u0026gt; for those accounts to ensure that all the .Net registrations and rights were correct. No success.\nI removed SharePoint and reinstalled the farm with the roles reversed. The fault moved to the other server. I confirmed that I could configure the service on the same server as the central admin site but never on the other server. I looked at the system registry, compared service configurations with a working system and tried manually hacking the config to no effect.\nIn the end I uninstalled everything, installed the farm clean and unconfigured and called in air support.\nThe fix # I can\u0026rsquo;t praise our support guy at Microsoft enough. He\u0026rsquo;s incredible - I emailed him and got a phone call within five minutes! We ran through the problem and he consulted his support resources. What he came back with took a few goes to make stick, but it worked, and in fixing SharePoint pointed to the root of the problem.\nThe solution is to edit the web.config for the Office Server Web Services site. On our system that file is in C:\\Program Files\\Microsoft Office Servers\\12.0\\WebServices\\Root. The original file looks like this:\n\u0026lt;?xml version=\u0026#34;1.0\u0026#34; encoding=\u0026#34;utf-8\u0026#34;?\u0026gt; \u0026lt;configuration\u0026gt; \u0026lt;configSections\u0026gt; \u0026lt;sectionGroup name=\u0026#34;microsoft.office.server\u0026#34; type=\u0026#34;Microsoft.Office.Server.Administration.OfficeServerConfigurationSectionGroup, Microsoft.Office.Server, Version=12.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c\u0026#34; \u0026gt; \u0026lt;section name=\u0026#34;sharedServices\u0026#34; type=\u0026#34;Microsoft.Office.Server.Administration.SharedServiceConfigurationSection, Microsoft.Office.Server, Version=12.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c\u0026#34; /\u0026gt; \u0026lt;/sectionGroup\u0026gt; \u0026lt;/configSections\u0026gt; \u0026lt;system.web\u0026gt; \u0026lt;authorization\u0026gt; \u0026lt;allow roles=\u0026#34;.\\WSS_ADMIN_WPG\u0026#34; /\u0026gt; \u0026lt;deny users=\u0026#34;*\u0026#34; /\u0026gt; \u0026lt;/authorization\u0026gt; \u0026lt;webServices\u0026gt; \u0026lt;protocols\u0026gt; \u0026lt;clear /\u0026gt; \u0026lt;add name=\u0026#34;AnyHttpSoap\u0026#34; /\u0026gt; \u0026lt;add name=\u0026#34;Documentation\u0026#34; /\u0026gt; \u0026lt;/protocols\u0026gt; \u0026lt;/webServices\u0026gt; \u0026lt;/system.web\u0026gt; \u0026lt;/configuration\u0026gt; The solution is to edit the \u0026lt;authorization\u0026gt; section, adding entries to grant access to the user accounts for installation and db access:\n\u0026lt;authorization\u0026gt; \u0026lt;allow roles=\u0026#34;.\\WSS_ADMIN_WPG\u0026#34; /\u0026gt; \u0026lt;allow users=\u0026#34;ondemand\\MOSSdba\u0026#34; /\u0026gt; \u0026lt;allow users=\u0026#34;ondemand\\MOSSsetup\u0026#34; /\u0026gt; \u0026lt;deny users=\u0026#34;*\u0026#34; /\u0026gt; \u0026lt;/authorization\u0026gt; However, the gotcha is that SharePoint puts the settings back - don\u0026rsquo;t do an IISreset; don\u0026rsquo;t recycle the app pool. Simply edit the file then go the page to configure the search service and it works. Once you\u0026rsquo;ve done that the service will start.\nI then found that I couldn\u0026rsquo;t get back into the page because the web.config got reset (grr), but that\u0026rsquo;s not important right now.\nThe cause # The key in all this is that the two users I added explicit rights for were members of the WSS_ADMIN_WPG group specified in the original file. This pointed at an issue with the domain - the server was failing to get a list of members for that group.\nThe servers themselves were built and managed by our customer\u0026rsquo;s hosting provider, so I passed the fault to them. They checked the systems and found a domain fault affecting synchronisation. Result!\n","date":"18 July 2007","externalUrl":null,"permalink":"/posts/sharepoint-problems-with-access-rights/","section":"Blog","summary":"I spent a while knocking my head against a problem with a SharePoint server farm that’s worth posting about. It’s also worth a big hats-off to our Technical Support Coordinator at Microsoft Partner Support who dredged up the article that finally pointed us in the right direction.\n","title":"SharePoint problems with access rights","type":"posts"},{"content":"Still no Windows Mobile 6 update for my Orange SPV M3100, but they did release an update to WM5 recently.\nInstalling said update turned out to be slightly trickier than I expected. I don\u0026rsquo;t know if anybody else has experienced the same problem, but a word to the wise - don\u0026rsquo;t try the update on Windows Vista!\nThe first part works OK - it connects to the device and interrogates it, but when it actually tries to connect and download the new firmware it fails.\nLuckily, I still have a PC at home running XP (Media Centre Edition, as it happens), so I installed Active Sync 4.5 and rant he update successfully on that.\nI\u0026rsquo;m surprised though - Vista\u0026rsquo;s nearly six months old now and there must be others with the same phone who don\u0026rsquo;t have the recourse to an old PC (!) to run the update.\n","date":"14 May 2007","externalUrl":null,"permalink":"/posts/updating-firmware-on-spv-m3100-htc-tytn/","section":"Blog","summary":"Still no Windows Mobile 6 update for my Orange SPV M3100, but they did release an update to WM5 recently.\nInstalling said update turned out to be slightly trickier than I expected. I don’t know if anybody else has experienced the same problem, but a word to the wise - don’t try the update on Windows Vista!\n","title":"Updating firmware on SPV M3100 (HTC TyTN)","type":"posts"},{"content":"I think I\u0026rsquo;ve mentioned before how I\u0026rsquo;ve been updating our IT infrastructure. Company growth has meant a need for expanded services. Add to that new versions of SharePoint and Exchange, mix in a need to run virtual servers for development and you have a need for more tin.\nOver the past six months I\u0026rsquo;ve expanded our domain to keep pace with our growing needs. The number of physical servers we have has increased, with a few more virtual servers for specific roles that I prefer to keep separate but which don\u0026rsquo;t really merit their own box.\nAs part of this growth, I added a second domain controller. Our existing DC was also running Exchange 2003, and this situation has caused me the most headaches in the sliding block puzzle of service upgrade and migration: We couldn\u0026rsquo;t demote the DC on our old server because of Exchange 2003, but I was reticent about putting in Exchange 2007 until I had redundancy of critical services (DC, DNS, etc).\nUpdating Domains, getting ready for Exchange # I will admit at this point that my knowledge of AD is not as deep as I would like, although it is increasing daily. That does mean, however, that I check before I leap - find articles on MSDN, TechNet and the wider blogosphere to find the pitfalls so I avoid pratfalls.\nSo, I read carefully about raising the functional level of the Forest and Domain when installing a 2003 R2 domain, made sure everything was patched and service packed before starting, read and re-read the instructions. When confident I had run through all the prerequisites I ran dcpromo to add my domain controller.\nI was then left with two servers, both of which had the necessary tools to mange AD, both of which were registered in DNS as DC\u0026rsquo;s, both of which appeared to be fine.\nNothing I read suggested that I needed to check anything else to make sure the process had completed\u0026hellip; (You can see where this is going, can\u0026rsquo;t you\u0026hellip;?)\nExchange 2007 - the big transition # Over the first weekend in April we transitioned from Exchange 2003 to Exchange 2007. Once again, I did my reading. I ran the Exchange Best Practice Analyser and made sure that our Exchange 2003 installation was in tip-top condition. I compared two or three different sets of instructions on how to run throughthe process, setting on one from an Exchange community site because of some extra little nuggets of insight it contained.\nThe transition went relatively smoothly. The new server went in, was configured correctly and the Exchange 2007 site was connected to the Exchange 2003 site. Mailboxes were transferred (we had a problem with one, but we fixed it) and clients were checked to have connected to the new server.\nOnce happy, we uninstalled the old Exchange, as per instructions.\nIt took a full day, but we were being careful and thorough. We thought it had gone fine.\nThe next step would be to remove our old DC from the AD and decommission the server. Being cautious, we wanted to test that things wouldn\u0026rsquo;t stop if we removed the old DC, so we unplugged the network cable\u0026hellip;\nChaos!\nEverything stopped - Exchange clients disconnected, logons stopped, everything!\nIs there a doctor in the house? # Stage one when hit with a problem - gather as much information as possible.\nWe looked at our systems, we checked logs, we watched the Outlook clients connecting to exchange. When we disconnected our old DC, nothing seemed to want to talk to the new DC. I checked the Exchange server settings and made sure the server was set to use the new DC for its configuration and all seemed fine.\nWe noticed an error that the clients couldn\u0026rsquo;t connect to Global Catalogue server, so I did some more reading, realised that the old DC was our global catalogue server and so followed the steps to change the role over to the new DC. Everything said it had worked, but nothing changed.\nI did some more reading about role masters and set the new DC to be the master for each role - at least I thought I did - through the AD users and groups tool. Still nothing.\nAt this point I decided that either I could spent days or weeks researching and prodding, or I could call in the cavalry. The support team we have access to as a Gold Partner are fantastic - I can never praise them enough - and sure enough I had people on the problem within an hour of logging the call.\nBecause we initially thought the problem was with our Exchange config, we dealt with a very efficient Exchange support guy. He worked methodically through the problem, and started to look deeper into our domain and DC\u0026rsquo;s as he zeroed in on it being a domain issue.\nAt this point, I encountered the AD support tools being used in anger for the first time. I passed the support guys dozens of log files. We also discovered what appeared to be the problem - my new DC wasn\u0026rsquo;t really a DC!\nThat last statement is a bit too simplistic. Our new DC was happily replicating the AD. It reported everything being fine when examined with replmon. Both DC\u0026rsquo;s agreed on their view of the world.\nWhat I didn\u0026rsquo;t know was that in addition to the AD replicas, a NETLOGON share is created on the new DC by dcpromo. I also did not know that this process had failed - at no point did anything tell me. Because there was no share, the server was not dealing with client requests correctly, which is why our systems had a fit when I unplugged the old DC.\nPeering into a deep, dark well # Having identified the fault, my exchange guy called in an AD specialist to assist. He ably worked through the fault. There are a sequence of steps to follow which will trigger a rebuild of the netlogon share. We worked through them. They didn\u0026rsquo;t work. We knew they didn\u0026rsquo;t work because the share wasn\u0026rsquo;t created. Apart from a couple of event log messages which I didn\u0026rsquo;t consider to be helpful, nothing told us what was wrong.\nHaving failed to rebuild the share on the new DC, my AD ninja looked at the old DC. He decided to rebuild the same share on the existing DC, the thinking being that the replication was failing because of a fault on the source, rather than the destination. In order to do this, the domain group policies would be destroyed and rebuilt as defaults.\nThis process took some time, but to cut a very long story short, it appears that our default group policy objects were corrupted, which was blocking the replication. By deleting them and rebuilding the sysvol directory structure on our original DC, then forcing a rebuild on the new DC, the AD was fixed.\nMy eternal gratitude to the Microsoft support guys. My point, long and meandering though the journey has been, is this: At no point did I see anything which suggested corruption of those objects. At no point did I see anything which suggested they were the cause of the replication fault.\nMy toolbox is missing! # In order to get the information the support guys needed, I had to install first the Support Tools from the installation media and then the resource kit tools downloaded via the web. Those tools should have been installed by default, or at least should have been added when I created my new DC.\nEven when I\u0026rsquo;d installed the tools, they didn\u0026rsquo;t really give me much information. Now, I will readily admit here that I am new to the tools, and continued reading will doubtless help me in this regard, but the key point is a simple one:\nI can\u0026rsquo;t see what\u0026rsquo;s going on!\nShhh\u0026hellip; say it quietly\u0026hellip; NDS # I supported IT solutions including Novell servers for fifteen years before joining Black Marble. In my previous role we had some thirty servers with a fairly complex, but well structured NDS directory. Over those years, we had some problems with replication and corruption, and every time we did, we started with the same procedure: We watched.\nWhat Active Directory is lacking, in my humble opinion, is an equivalent of the Novell DStrace tool. DSTrace allows you to watch the activity of your directory replicas. By careful use of the various options you can configure your servers to show you replication traffic, requests and responses and more. Colour coding allows you to spot errors and warnings and after a while you start to see patterns in the mass of text. If we had an NDS problem we could use DStrace to get a feel for the cause - you could see if there were corrupt objects which weren\u0026rsquo;t replicating between servers. You could even figure out which servers were right and wrong.\nOnce you\u0026rsquo;d seen the fault, the dsrepair tool allowed you to tackle it either with surgical precision or with heavy artillery. You could force a replication of an individual object, overwriting the corrupted copy by force, or use drastic measures like deleting a replica of the directory or a partition.\nWhere are those tools for active directory? If they exist, please tell me, because I\u0026rsquo;d like to get my hands on them. I can\u0026rsquo;t imaging dealing with huge installations of AD without that kind of toolset.\nA wishlist\u0026hellip; # What would I like to see then? I\u0026rsquo;m writing this post before I start rummaging around the web, and if I find examples of these tools I\u0026rsquo;ll post about them.\nA tool which checks the integrity of the directory and it\u0026rsquo;s objects, and identifies where replicas on different servers disagree. A tool that allows me to see all the AD traffic in real time - logging to a database might be useful, but just seeing the messages on screen would be a start. I want to be able to toggle different messages - errors, warnings, replication traffic, client requests and responses etc to get a feel for what works and what doesn\u0026rsquo;t. A tool to allow me to fix individual objects - to replace them from backup or to overwrite them with a copy from another replica (by far my preferred method). If this lot already exists then tell me. If there are good books on the subject then point me at them. I\u0026rsquo;ve found some support articles which are helpful, but not as much as I\u0026rsquo;d like. I\u0026rsquo;m not precious - if this all stems from a fundamental misunderstanding or lack of knowledge on my part I\u0026rsquo;m happy to admit my mistake. However, at this point I\u0026rsquo;m leaning more to it being an indication that AD still hasn\u0026rsquo;t matured to the level of NDS in terms of management and control.\n","date":"15 April 2007","externalUrl":null,"permalink":"/posts/analysing-active-directory/","section":"Blog","summary":"I think I’ve mentioned before how I’ve been updating our IT infrastructure. Company growth has meant a need for expanded services. Add to that new versions of SharePoint and Exchange, mix in a need to run virtual servers for development and you have a need for more tin.\n","title":"Analysing Active Directory","type":"posts"},{"content":"Douglas Coupland\u0026rsquo;s Jpod has been doing the rounds in the office of late. I enjoyed MicroSerfs, so approached Jpod with excitement.\nFrankly, I\u0026rsquo;m disappointed.\nIt\u0026rsquo;s not the writing - I \u0026rsquo;ve enjoyed pretty much all of his books. It\u0026rsquo;s not that the books are similar in approach and style (they are) but rather the contrast in the lives of the characters.\nOverall, MicroSerfs was optimistic. The characters in the book were using their talent to make the world a better place. The technology in Jpod is cynically created to make the most money. I finished MicroSerfs feeling good about what I do for a living; I\u0026rsquo;m stuggling through Jpod as it slowly destroys that feeling.\nLet\u0026rsquo;s set aside whether this contrast is intentional - I don\u0026rsquo;t want to discuss what Mr Coupland is trying to say. What I want to get across is something that I have felt for a while and which Jpod merely reinforced:\nThe IT industry is becoming more and more cynical.\nPerhaps this is a function of its age and maturity; perhaps it has more to do with the complexity of modern IT solutions; perhaps it is that we have accomplished so much so quickly that progress can only become harder and slower.\nWhen I started working, the University for which I worked was only just embracing desktop computers. I was involved in promoting desktop PCs and workgroup servers to departments and it was an exciting time. Throughout my career there, I was involved in the creation of new services that were intended to make people\u0026rsquo;s lives better, easier, simpler, more efficient, and I got a great deal of satisfaction from it.\nI still get satisfaction from delivering those kind of solutions, and I like to think that myself and my colleagues here at Black Marble still aim to make the world a better place through technology, in our own way.\nI\u0026rsquo;m less convinced that the rest of the world still feels that way. What do you think?\n","date":"15 April 2007","externalUrl":null,"permalink":"/posts/what-happened-to-the-idealists/","section":"Blog","summary":"Douglas Coupland’s Jpod has been doing the rounds in the office of late. I enjoyed MicroSerfs, so approached Jpod with excitement.\nFrankly, I’m disappointed.\nIt’s not the writing - I ’ve enjoyed pretty much all of his books. It’s not that the books are similar in approach and style (they are) but rather the contrast in the lives of the characters.\n","title":"What happened to the idealists?","type":"posts"},{"content":"","date":"15 April 2007","externalUrl":null,"permalink":"/tags/windows-server-2003/","section":"Tags","summary":"","title":"Windows-Server-2003","type":"tags"},{"content":"","date":"20 February 2007","externalUrl":null,"permalink":"/tags/ipmi/","section":"Tags","summary":"","title":"Ipmi","type":"tags"},{"content":"","date":"20 February 2007","externalUrl":null,"permalink":"/tags/smdc/","section":"Tags","summary":"","title":"Smdc","type":"tags"},{"content":"","date":"20 February 2007","externalUrl":null,"permalink":"/tags/x2100/","section":"Tags","summary":"","title":"X2100","type":"tags"},{"content":"In hindsight I should have thought of it, but even if I had, others got there first.\nYou may remember my problems with IPMI on our X2100 servers from an earlier posting. Today I had cause to revisit the matter, as we\u0026rsquo;re having terrible issues with the Nvidia RAID on one of our servers.\nThe lack of a Windows version of IPMItool is still a pain, but I am leagues closer to a usable solution now, thanks to Cygwin. The solution, it turns out, whilst somewhat laborious, is fairly straightforward. Simply build IPMItool under cygwin. Result!\nInstruction are available on the \u0026rsquo;net and the IPMItool man page is on Sourceforge.\nI can now query the SMDC board on my X2100s from Windows.\n","date":"20 February 2007","externalUrl":null,"permalink":"/posts/x2100-ipmi-redux-success/","section":"Blog","summary":"In hindsight I should have thought of it, but even if I had, others got there first.\nYou may remember my problems with IPMI on our X2100 servers from an earlier posting. Today I had cause to revisit the matter, as we’re having terrible issues with the Nvidia RAID on one of our servers.\n","title":"X2100 IPMI Redux - success!","type":"posts"},{"content":"I have yet to succeed in upgrading from Windows XP to Windows Vista. Each time it runs through to the completing upgrade phase, gets about halfway through that bit whereupon I get stuck in a reboot cycle.\nI have tried this now on three separate machines and two different installed partitions on one of them.\nTwo of the machines were Shuttle SN25G2 SFF boxes with Nforce 2 motherboards and the onboard nforce 2 (basically a geforce 2) video.\nOne of them was an Acer E360, an nforce 3 chipset box with an Nvidia 6600GT display card.\nOn the OS front, the Shuttles ran XP Pro SP2, fully patched; the Acer has the XP MCE that it came with, and an XP Pro SP2 install.\nI\u0026rsquo;m starting to wonder if the common denominator here is Nvidia. In spite of the fact that I spent a long time with my Acer stripping off drivers and applications and repeatedly trying the upgrade I have not managed a successful upgrade. Has anybody managed to upgrade an Nforce_x_ system?\nWhat I will say, having now lost days of my life to failed upgrades, is that the Upgrade Rollback feature of Vista is fantastic! A no messing, works every time, put it back to how you found it option that takes only a few minutes. Wonderful!\nSo, now I\u0026rsquo;m going to look into the recently-release Windows Easy Transfer Companion as a way to get my applications across onto Vista.\nWhy do I need to do that? Because Acer, like so many other manufacturers these days, provides no installation media for the applications they ship with the computer. Unless I want to shell out again for things like PowerDVD and NTI CD-Maker I need to either upgrade (been there, tried that), hack the cached installed files (also tried, and failed) or use a magic bullet (see above). I\u0026rsquo;ll let you know how I get on with that one.\n","date":"19 February 2007","externalUrl":null,"permalink":"/posts/vista-upgrade-attempts-4-success-0/","section":"Blog","summary":"I have yet to succeed in upgrading from Windows XP to Windows Vista. Each time it runs through to the completing upgrade phase, gets about halfway through that bit whereupon I get stuck in a reboot cycle.\n","title":"Vista Upgrade - attempts 4, success 0","type":"posts"},{"content":"On Saturday I got the email telling me that I\u0026rsquo;d been accepted onto the Home Server Beta 2. I\u0026rsquo;m excited about this product in a way that I haven\u0026rsquo;t been about new software solutions for a while.\nI\u0026rsquo;ve taken part in beta programmes before. I\u0026rsquo;ve been around a while, and as an IT pro you get desensitised after a while. Vista has some innovative features, but it\u0026rsquo;s evolutionm, not revolution.\nHome server is different.\nTo explain why, let me give you a bit of background: Being a geek, you\u0026rsquo;d expect my home to have a few PCs and you\u0026rsquo;d be right. I had a purge shortly after I got married, which reduced the number of active systems from eight (don\u0026rsquo;t ask!) to four - my home desktop, my wife\u0026rsquo;s home desktop, a media PC and a Mac Mini (which I use for web site testing and development). On top of that, we have a Netgear SC101 NAS box for shared storage, a networked printer and a photo printer attached to my wife\u0026rsquo;s PC.\nMy Grandmother has firmly embraced the information age. She has a desktop and a laptop. She sends emails all over the place and is slowly scanning all the photographs that the family has collected over the years. The desktop stays on all the time with a file share for the laptop.\nMy parents have a computer each. They also have a Netgear SC101 and a coulpe of printers. In addition, my father has a laptop.\nParticularly for my parents and grandmother, the Home Server will be a perfect match to requirements. A black box that can back up systems, is easy to manage and allows file and printer sharing - great!\nBeing the defacto tech support for my family, the opportunity to put one system in each home that can do automatic backups and store all the important files safely is extremely welcome. I\u0026rsquo;m looking forward to getting my Home Server beta up and running and if it works like the documentation suggests, there\u0026rsquo;ll be three customers lining up for a copy when it\u0026rsquo;s released.\n","date":"19 February 2007","externalUrl":null,"permalink":"/posts/windows-home-server-something-for-my-father/","section":"Blog","summary":"On Saturday I got the email telling me that I’d been accepted onto the Home Server Beta 2. I’m excited about this product in a way that I haven’t been about new software solutions for a while.\n","title":"Windows Home Server - something for my father","type":"posts"},{"content":"We\u0026rsquo;re slowly migrating services onto our new servers here at Black Marble. This morning we had one of those moments where significant amounts of wall kicking and teeth gnashing ensue.\nBasically, we forgot that if you enable 32-bit .net support on IIS 6 it disables 64-bit support - you can\u0026rsquo;t run 32 bit and 64 bit apps concurrently.\nWe spent a long time the other week getting our release version of SharePoint 2007 installed on one of our shiny Sun X2100 x64 servers. We expect the site to be quite large, so it made sense to run the x64 version of SharePoint.\nUnfortunately, when 32-bit .Net apps were enabled by mistake, SharePpint and the other 64-bit web apps all stopped. Removing .Net 1.1 and running the aspnet_iisreg -i command from the x64 .Net 2 framework folder got us back up and running, but SharePoint refused to allow anyone to login.\nFortunately the Central Admin site was still working, so I had a rummage. It looked like SharePoint was no longer talking to our AD, so I went to the Application Management site, and went to the Authentication Providers option in the Application Security section.\nIn here you can edit the settings for each Web Application. I went through each of ours, and clicked on the \u0026lsquo;Default\u0026rsquo; zone which is listed in the Web Application page.\nI didn\u0026rsquo;t need to change anything - simply hit the save button and SharePoint seemed to rewrite it\u0026rsquo;s settings. Once this was done, our SharePoint started talking to people again.\nNow, I don\u0026rsquo;t expect you to hit the same crazy situation as we did, but it\u0026rsquo;s nice to know that you can coax SharePoint back into life without restoring stuff from backup.\n","date":"5 February 2007","externalUrl":null,"permalink":"/posts/sharepoint-2007-on-x64-dont-try-to-run-32-bit-web-apps/","section":"Blog","summary":"We’re slowly migrating services onto our new servers here at Black Marble. This morning we had one of those moments where significant amounts of wall kicking and teeth gnashing ensue.\n","title":"SharePoint 2007 on x64 - don't try to run 32-bit web apps!","type":"posts"},{"content":"","externalUrl":null,"permalink":"/authors/","section":"Authors","summary":"","title":"Authors","type":"authors"}]