Windows Server 8 & VMware Workstation

In a previous post I outlined installing Windows Server 8 Developer preview and all the current testing and screenshots have been done in a virtual box environment.

I also run VMware workstation and was running VMware workstation 7.1. I currently don't have a dedicated Hyper-V box at home but that will change in the future when I'm running Windows 8 as my desktop OS.

I tried installing Windows Server 8 on VMware 7.1




Initially it looked like it was going to start installing. Since Windows 8 was not an option I chose Windows 2008 R2 as the OS.






As you can see I also tried Windows 7 with no luck. I also tried other scenarios and they all didn't work. I figured this was a pre-beta release of Windows 8 so no big deal but I was a bit disappointed. If anyone has gotten this to work please comment.

On Septmember 14 VMware released Workstation 8

I decided to spend the $99 for the upgrade. Once I received the verification email I went to the download site and noticed there was only one executable for the full version and no upgrade version.

I wasn't sure if the full version would work or even let me download it. The VMware workstation team on twitter was really helpful and let me know to install the full version. It would uninstall 7.1 and then install 8.0 without losing any virtual machines. That worked fine so now the moment of truth would VMware workstation 8 support Windows Server 8 Developers Preview.

I started off with a typical install



This version still could not detect the OS but I'm guessing that will change in future release and as Windows 8 gets close to RTM.



I chose Windows Server 2008 R2 as my guest OS.




There is no license key for this version of Windows 8 so that is left blank.





I named my machine and set the location. I just use an external drive attached via USB 3.0. I would like a better storage system but I also don't want to break the bank.



I gave myself 40 GB and finished the process of configuring the virtual machine.





After reboot I was stuck in an endless loop telling me that the product key could not be read from the answer file. This had me worried as there is no product key



The endless loop was no fun so I shut the machine down and looked at the configuration again. I noticed the floppy drive there and I definitely don't need that. I removed the floppy drive





After removal of the floppy drive the installation proceeded with no issues.



There are some features such as cloning that I like in VMware that I don't get in Virtualbox but both are adequate for testing Windows 8 right now.

Thanks to the @vmw_workstation guys for their tips.

The normal caveat applies and that is that this is still a pre-beta release of Windows 8....but have fun.

Not sure if I'll be going to VMware workstation 9 down the road. I may have all Windows 8 boxes with Hyper-V by then :)

Windows Server 8 - Fine-Grained Password Policies

BACKGROUND

In the old days (Windows 2000 and Windows 2003) an Active Directory domain could only have one password and account lockout policy per domain for domain accounts.

The group policy with the password settings had to be linked at the domain level(common method people used was to set the policy in the default domain policy).

What options where there if you wanted a different policy for certain users or certain groups? For example what if you wanted service accounts to have a stricter policy? There were not many options. Organizations could try and create their own filter (not recommended) or use a third party tool (not native, not cheap, and needs plenty of testing).

In some cases organizations would create a new domain because they wanted different policies. I was never involved in a new domain just for a password policy but I've heard of it happening.

PASSWORD POLICIES IN WINDOWS 2008

Microsoft introduced a new feature in Windows 2008 called Fine Grained Password Policies (FGPP). The domain functional level has to be at Windows 2008 for this feature to work.

FGPP's allowed organizations to specify multiple password policies within a single domain. You can use fine-grained password policies to apply different restrictions for password and account lockout policies to different sets of groups and users in a domain.

The link above is a step by step guide for configuring FGPP's. There are also some other good FGPP references that I refer to.

• Sean's FGPP Walkthrough
  
• Florian's Windows Server 2008 And Its FGPP's
  
• Florian's How To Create FGPP Setting Objects
  

As you can see in Florian and Sean's great blog entries setting up fine-grained passwords was not the easiest thing to do. Admins had to use ADSI Edit to configure it and the entire process was not admin/user friendly.

There were some third party tools that could make this process easier but again that involved another tool.

WINDOWS SERVER 8 FGPP IMPLEMENTATION

As noted in my previous post there are a lot of improvements in Windows Server 8. Once again a feature is now exposed using the Active Directory Administrative Center (ADAC).


To start open ADAC and navigate to the System container. From there navigate to the Passwords Settings Container and right click and select New > Password Settings






As you can see I named my Password Setting Object(PSO) and I set a precedence level. Precedence is used if there are multiple PSO's applied, the lower precedent will win. I'd try to limit the number of PSO's in a domain.



I've set the minimum length at 14 which is more stringent/strict compared to my normal domain policy which is 8 characters. I want the service accounts to have stronger passwords.



Next I'm going to select "Add" in the Directly Applies to box. In this example I am going to apply the PSO to a group named ServiceAccounts. I could have also selected user accounts here.



Once I'm done with creating and applying the PSO to the group I can verify that the password is set. I navigate to my Service account user that is a member of the ServiceAccount group. I right click and select "View resultant password settings"



The resultant password setting box is presented. It returns the Service Accounts PSO that I created.





There is also another option for user accounts. In ADAC you will notice a Password Settings pane.



PSOs can be directly assigned to user accounts. I'd recommend using groups when possible but the option is there.



So now the PSO is created in applied...but does it work. Can I still use an 8 character password for this account? If it worked correctly the 8 character password should no longer be accepted. I tried a 10 character complex password





Success Full Success!! It would be nice if the error message was more verbose. For example telling the user that they need a 14 character password based off the PSO settings.

One other area I think admins will continue to ask for is the ability to have a different password policy per OU (not just users and groups).

They can't get every feature into every release but this is a huge step forward. Nice job Microsoft AD Team! I think this will help organizations and now more folks will use FGPP. (just remember the domain functional level has to be at 2008 or higher)

Also remember this is a pre-Beta release so things can change. Having said that Steve Ballmer said over 500,000 copies have already been downloaded....the WIndows 8 buzz is on for sure :)

Windows Server 8 - Active Directory Recycle Bin

The active directory recycle bin was a welcome addition in 2008 R2. Prior to Windows 2008 R2 there were no easy ways to fully restore an AD object and keep all their attributes intact.

There was the system state/authoritative restore method
There was the tombstone reanimation method that didn't restore all the attributes but it was fast.
There were also some third party tools that could help.

So the options were not great and recovering deleted objects could be a pain. Admins rejoiced when they first heard of the AD recycle bin. The forest functional level had to be at Windows 2008 R2 but it was a major incentive to get there.

The AD recycle bin had to be enabled using Powershell and objects could only be restored using Powershell. Microsoft released a good AD recycle bin step by step guide for 2008 R2

Ned Pyle from the Microsoft AD team also had a great blog entry on the askds blog

The AD Recycle Bin: Understanding, Implementing, Best Practices, and Troubleshooting
Notice how to enable the feature and restore objects.

There were third party tools that put a GUI wrapper around the recycle bin but I'm referring to a native build.

So as you can see the AD Recycle Bin in 2008 R2 was very good step forward but it could be better. The Microsoft AD team heard the need for improving the feature and the feature has been improved.

It gets much better in Windows Server 8. The Active Directory Administrative Center (ADAC) has a lot of improvements and one of the big ones is being able to restore objects from the GUI. Powershell still works too but this will be easier for a lot of folks.




The AD Recycle Bin can now be enabled from ADAC



It can also be enabled by right clicking the domain and enabling it there





Warning alerting the user that once the Recycle Bin is enabled it can't be disabled...no turning back.

Note: In a production Windows Server 2008 R2 domain at Microsoft, the Active Directory Recycle Bin feature increased the size of the AD DS database by an additional 15 to 20 percent of the original database size.

I'm guessing those stats are still accurate and will update the blog if I find out anything new.



Once the enable recycle bin is chosen and the changes have replicated then the feature will work after a refresh of ADAC.





I have a test user with many attributes populated and a member of a group that I'm going to delete.




So now the user is deleted but how do I get it back. In ADAC I navigate to the Deleted Objects Node. As you can see the deleted user is there. I can right click and restore the object, restore to another location, locate parent, or view properties.




The deleted objects node in ADAC is the new hotness :)

As you can see I restored the object back to its original location and it is back with all attributes populated.



Anyone who has been in a pressure filled situation trying to get a user or object back in a hurry (especially if a VIP is involved) will really like this.

There will be follow ups to this post about other new features in ADAC and other test scenarios. Job well done Microsoft AD Team!!

Windows Server 8 - Active Directory DCPROMO error

UPDATE:  THIS HAS BEEN FIXED WITH THE RELEASE OF WINDOWS SERVER 8 BETA

In my previous post I went over installing my first Windows Server 8 box.

Since one of my skill sets is Active Directory my next step was to promote this box to become a domain controller.

As noted in the previous post this is an early pre-Beta release so there are going to be features that are not fully developed.

During dcpromo you can select your domain and forest functional levels.



Initially I was ready to go straight to Windows Server 8 levels and why not, it is a lab and we are all learning at this point.


Windows Server 8 Functional Levels selected

Before dcpromo completes a prerequisite check is conducted. As you can see I receive an error



The error is

The specified value '5' is not valid for the argument 'Domain level'

I then went back and changed the functional levels to 2008 R2

Once that is done the promotion did complete and I now have my first Windows Server 8 Domain Controller.



This is a known bug so no reason to report it up the Microsoft chain. Again...this is an early pre-Beta release.

Enjoy and have fun with your new Windows Server 8 Domain Controller :)

Installing Windows Server 8 Developer Preview

The Microsoft BUILD Conference is happening this week out in California.

Microsoft is using this conference to mainly talk about the next version of Windows which is Windows 8. There have been some leaked copies of Windows 8 but this week Microsoft released the first official release.

The release is a pre-beta released called the Developers Preview and it is not feature complete and still has some things that need to be fixed but it does give us an image to download and start testing and having fun with.

You can download the image from Microsoft.

I don't have a dedicated hyper-v box at home so I'm using VirtualBox I did try and install it using VMWare Workstation 7.1 but had errors. I may write another blog just on that experience. Again important to note again this is an early version.

If you are running Windows 7 you can also boot into Windows 8 and Scott Hanselman has a great blog entry on setting that up.

Guide to Installing and Booting Windows 8 Developer Preview off a VHD

I personally prefer virtual machines so that is the method I used.


So off we go for the screenshots of the install










Three Options to select from; for this initial install I'm going with the full install. Future posts will focus on the Server Core and Features On Demand versions.


Obligatory EULA which I fully read :)


Choose Custom (advanced installation)




I usually use around 40 GB for my virtual machines but you technically only need 32 GB of disk space. Additional information on the system requirements can be found here:

Windows Server 8 Developer Preview - System Requirements


The familiar installing Windows dialogue box. Glad some things don't change.




Getting close to being finished.



Enter a password





Moment of truth has arrived, initial screen for Windows Server 8. It gets me excited as I know I'll be spending years of my life using this OS but this is my first install.



There are two screens you will see when initially working with Windows 8. The first is the MetroUI that a lot of people have seen in previews on the Windows 8 blog and other sources. This is the tile interface


MetroUI GUI in Windows Server 8 Developers Preview

You can use the Windows Key to get to the more familiar desktop



It is a new OS with a lot of graphical changes that are going to take time to get used to it. For old timers over 35 like me the transition from NT to Windows 2000 was also dramatic. Remember going from server manager and user manager to AD Users and Computers.

I'm guessing there is a Group Policy to disable MetroUI and that will be a future posts but for now I'm leaving it on and getting used to it.

Group Policy for Beginners

I previously blogged about resources to learn more about Group Policy.

Microsoft released a 26 page document today titled

Group Policy for Beginners

Looks really good, and a great way for those new to group policy to start learning. I still recommend the books and links that I previously outlined.

I know not everyone that works with AD also does Group Policy work but a large majority do.

Thanks

Mike

Microsoft Premier Field Engineering Platform Reporting Tool

Microsoft has released an updated MPS Reports Tool.

Microsoft Premier Field Engineering Platform Reporting Tool

If you open a call with Microsoft you will often be told to upload the MPS reports. The reports can take a while to run to I always recommend running them before hand or as you are calling.