Schulenburg-IT blog

WTF Broadcom? What are you doing with VMware

nospam@example.com (Beheerder) — Mon, 19 Feb 2024 22:30:00 +0100

Everybody expected some changes after Breadcom took over VMware for more than $69 billion and things are changing rapidly. After withdrawing the free ESXi version now the VMware Foundation licensing dramatically changes, with enormous effects for home labs and small end users! And I expect more changes coming in the near future, not all positive at best. Major changes in the field of EUC are on the horizon to this article and we should be deeply concerned about any possible license changes.

Hopefully Broadcom we see some light and will stop bullying customers, resulting in equivalent or better licensing conditions as a reliable partner should do.

S9Y sites hung after period of time

nospam@example.com (Beheerder) — Wed, 26 Jul 2023 21:30:00 +0200

Damn. Somewhere march this year I reïnstalled my Synology NAS migrating all the data as well as reïnstalled the webserver software S9Y. Somehow this went wrong and as of then the two sites hosted on the Synology NAS were most of the time not responding or very slow. Until now. I cleared up a few database files, removed a few plugins and altered all articles to 'Allow comment' to disabled. What were the steps:

Make sure you have a valid backup of the website and underlying database!
Install phpMyAdmin and open it
Connect to the database, in my case the MariaDB 10 database installed on the Synology NAS
Browse to the table serendipity_entries and execute the following command:
- UPDATE `serendipity_entries` SET `allow_comments` = 'false';
Browse to the table serendipity_referrers. In my case a lot of rubbisch was in it and I cleared all:
- DELETE FROM `serendipity_referrers`;
Check all installed Event Plugins. In my case, running S9Y 2.4.0, some Event Plugins weren't supported. I deactivated the plugins first, tested and after that I removed a lot of them.

After these actions the sites run fine, also after a few days!

BSOD screens when connecting to a Microsoft Wireless (WiDi) Display stick

nospam@example.com (Beheerder) — Fri, 10 Mar 2023 16:35:00 +0100

Since a few months were experiencing that Windows 10 or even Windows 11 workstations freezes and eventually BSOD after connecting to a Microsoft Wireless Display adapter. Not all workstations experience the same. Some of them just freeze and a hard reset is needed, others just freeze and show a BSOD with a very common DRIVER_POWER_STATE_FAILURE.

After extensive testing and a lot of expected and unexpected freezes and BSOD we found out that it might be the Intel Wireless driver according to this article. We created an Ivanti Automation job to rollback the Intel Wireless drivers to a more stable version 22.110 and it solves some of the issues but not all. We furthermore found out that changing the 802.11n/ac/ax Wireless Mode value to 802.11n improves stability (image below).

Please feel free to comment and help us with a better solution!

[2023-03-10] Microsoft indicated it as an Intel driver issue so they redirected uit to Intel. Intel states it doesn't support the protocol anymore. The soap continues.

Updates Windows 10 & 11 workstations causing DirectAcess to break after connection drop

nospam@example.com (Beheerder) — Wed, 09 Nov 2022 20:56:00 +0100

Is anyone aware of some Microsoft Windows 10 & 11 updates breaking DirectAccess? No? Well, at the moment there's not much to tell about it, except this Q&A article on the subject. It's clear multiple organisations are struck by this issue.

The following updates are causing the issue:

Windows 10: KB5018482, KB5019959 and KB5020953
Windows 11: KB5018427, KB5019509 (adds tabs to Explorer, taskbar overflow menu) and KB5019980

The solution for now is to rollback these updates and block them or revert them in WSUS. Another solution is to remove them by hand. Updating the DirectAccess server(s) with KB5019964 is not a solution!

On Sunday November 13 Microsoft released an article to disable / rollback the feature causing this issue. The KIR (Known Issue Rollback) article contains fixes starting Windows 10 20H2 and Windows 11 21H2. The article can be found here.

Windows 11 22H2 cannot connect to Windows Server 2012R2 printserver

nospam@example.com (Beheerder) — Tue, 27 Sep 2022 13:02:00 +0200

Anyone already updated to Windows 11 build 22H2 and experiences printer issues, in perticular connecting to printqueues on a Windows Server 2012R2 server (connecting to a Windows Server 2022 printserver just works fine)? We did! The errors we saw were 1801 and Operation could not be completed (error 0x00000709) but in no way we could connect to the Windows Server 2012R2 printserver. We tested with Windows 11 build 21H2 and the printqueues were connected just fine on that build. After some digging we came across this site where the policy differences were explained between Windows 11 21H2 and Windows 11 22H2. After some testing only one policy made the difference:

Configure RPC connection settings: Enabled
- Protocol to use for outgoing RPC connections: RPC over named pipes
- Use authentication for outgoing RPC connections: Default

We've changed this setting in the global GPO and, after a gpupdate /force, everything works like expected!

Moving from MariaDB 5 to MariaDB 10 on a Synology using S9Y as a CMS

nospam@example.com (Beheerder) — Thu, 04 Nov 2021 21:23:00 +0100

Today I tried to move my two MariaDB 5 website databases towards the MariaDB 10 database, which is the only supported database on the latest Synology 7 version. First of all you have to export and import the used databases and users from MariaDB 5 to MariaDB 10 following this great Synology KB article. Be aware of the database users for the databases, keep the accounts and password equal on both MariaDB databases! Since MariaDB 10 uses a stronger password policy, change the database users passwords on both MariaDB versions and in the application, in my case S9Y.

After the database copy I altered the default port of the old MariaDB 5 to a dummy port number and the MariaDB 10 to the default port 3306. I stopped the MariaDB 5 service and within the used PHP configurations I then changed these values:

mysql.default_socket: /run/mysqld/mysqld10.sock
mysql.default_port: 3306

After these changes my websites, this one and a family site, ran just fine using MariaDB 10! After waiting for a while the old MariaDB 10 can be uninstalled on Synology.

Snow Software License Manager via SSO/ADFS

nospam@example.com (Beheerder) — Thu, 04 Nov 2021 21:08:00 +0100

Snow Software License Manager is a great tool to manage your Software Assets (it's in the name), see where the risks are and so on. Authentication can be don to a build-in user database or to your Active Directory, but what if you wnt to implement MFA (Multi Factor Authentication)?

Snow is capable to use several third party Federated Authentication providers, such as ADFS, Azure AD or SalesForce, but the description of how to lacks some clearance how to do this. I've been strugling to implement the ADFS integration for some time and at last I secceeded. This manual should help you to do the basic settings.

The manual is for a SSL secured Snow url!

First of all, follow the manual provided by Snow. It will help you to understand some settings but won't get you to the end, Follow the steps below to get it working!
I'll assume to be snow-url the url you'll access the Snow License Manager and adfs-url the url you'll have your local ADFS server(s) running
Create a new snow.saml.config.xml in the SLM's Web directory with the following content:
- <?xml version="1.0"?>
- <Configuration>
- <ServiceProvider Name="https://snow-url"
- AssertionConsumerServiceUrl="https://snow-url/federatedsecurity/saml/signin"
- LocalCertificateThumbprint = "certificate-thumbprint"
- />
- <Profiles>
- <Profile Name="http://adfs-url/adfs/services/trust"
- SignAuthnRequest="false"
- SignLogoutRequest="false"
- WantSAMLResponseSigned="false"
- WantAssertionSigned="false"
- WantAssertionEncrypted="false"
- WantLogoutResponseSigned="false"
- SingleSignOnServiceBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
- SingleSignOnServiceUrl="https://adfs-url/adfs/ls/"
- SingleLogoutServiceUrl="https://adfs-url/adfs/ls/?wa=wsignout1.0"
- PartnerCertificateFile="Certificates\adfs-signing.cer"
- />
- </Profiles>
- </Configuration>
Some caveats:
- The certificate-tumbprint at LocalCertificateThumbprint is the thumbprint used for the certificate used to secure your Snow url
- The PartnerCertificateFile is the signing certificate of the ADFS server(s)
Copy the ADFS signing certificate to the Certificates subfolder relative to the SLM's Web folder
Make changes to the web.config, appSettings part, in the SLM Web folder (make a backup of this file for rollback purposes)
- <add key="UseWindowsAuthentication" value="false" />
- <add key="UseFederatedAuthentication" value="true" />
- <add key="SamlConfigFile" value="snow.saml.config.xml" />
Export the XML file used to create the ADFS trust using the following URL:
- https://snow-url/federatedsecurity/saml/export
- Change SingleLogoutService, SingleLogoutService and AssertionConsumerService to reflect your own Snow url as described in the manual:
  - Change both TODO: URL of SLO service endpoint entries to https://snow-url/federatedsecurity/saml/signout
  - Change TODO: URL of assertion consumer service endpoint to https://snow-url/federatedsecurity/saml/signin
Import the altered XML into the ADFS configuration to create a Relying Party Trust and add the correct Claim Issuance Policy. Add a ‘Send LDAP Attributes as Claims’ Claim rule, attribute store Active Directory, with the following claim types:
- User Principal Name âº Name ID
- E-Mail-Addresses âº E-Mail Address
- Given-Name âº Given Name
- Surname âº Surname
If requested, add the appropriate ADFS Access Control Policy to enforce MFA
Reset IIS using an elevated promt and iisreset
Add a new user to Snow using Snow Management and Configuation Center (SMACC). The User Name thould be the UPN of the AD user.

After these steps Snow with SSO and MFA should work, at least it does for me.

Local login is still possible via https://snow-url/pages/login.aspx?ForceLocalLogon=true

Important!

Be aware of the codepage you use saving the snow.saml.config.xml and web.config! If saved with the wrong codepage SSO & MFA won't work. If this is the case, copy the content of these files to a new Notepad (or Notepad++) windows and save it with the same names in a different location. If created, rename the old files and copy the newly created ones.

VMware vCenter Server Appliance patch 7.0.1

nospam@example.com (Beheerder) — Mon, 12 Oct 2020 15:07:00 +0200

I was somewhat troubled after updating the VMware vCenter Server Appliance (VCSA) from 7.0.0 to 7.0.1. I do have an appliance backup configured using SMB which ran fine for VCSA 7.0.0, but after installing the critical patch 7.0.1 the backup didn't work anymore. What suprised me that after installing the critical patch teh VCSA didn't request a reboot..

Don't trust the update, reboot! It solved the SMB backup in blink of an eye instead of contacting VMware support, calls, etc.

So, just my 2 cents, reboot after each patch or update, just to be on the safe side!

Veeam SureBackup: LDAP check

nospam@example.com (Beheerder) — Fri, 09 Oct 2020 21:27:00 +0200

Veeam Backup & Restore is, as said before, a great package to use for backups in virtual environments. But the most important part of backups is to be able to restore! A great feature of Veeam Backup & Restore is, if you have the correct license, the SureBackup functionality with which you can check if the backups would run if restored. The basic checks available within Veeam Backup and Restore would cover a lot but what if you would like to go deeper? For instance, if you would like to check if the Active Directory server would reply on a query? Or, if you would want to know if data on a share is readable. For this you can create your own SureBackups checks!

In my case I would like to query the Active Directory server for a specific user and see if it exists, but you don't want the user hard-coded in the script but add it to the SureBackup check. I create a batch file in the directory '%ProgramFiles%\Veeam\Backup and Replication\Backup' woth the name Query-ADuser.bat:

@echo off
powershell.exe -noninteractive -noprofile -command "& {%SureBackup%\Query-ADUser.ps1 %1 %2 } -ExecutionPolicy RemoteSigned"
exit /b %errorlevel%

The powershell script mentioned contains the following code:

# Query-ADUser.ps1
Param
    (
    [string] $DomainController,
    [string] $UserName
    )
$result = [bool] (Get-ADUser -Filter { SamAccountName -eq $UserName } -Server $DomainController -ErrorAction SilentlyContinue)

if( $Result -eq $False)
    {
    write-host ("Error 1, User '" + $UserName + "' does not exist or is not found.")
    $host.SetShouldExit(1)
    exit
    }
else
    {
    exit
    }

Be sure you put the Powershell script in the location mentioned in the batchfile! The last file to create is the file QueryADUser.xml in the directory '%ProgramFiles%\Veeam\Backup and Replication\Backup\SbRoles'. It can be a copy of another file from thet directory, but make sure to alter the Id (should be unique among the other files), Name (twice) and TestScriptFilePath (te reflect the location and name of the batch file):

<?xml version="1.0" encoding="utf-8" ?>
<SbRoleOptions>
    <Role>
        <SbRole>
            <Id>4CD87CC4-A9B6-4de2-979B-E8F741231234</Id>
            <Name>Query AD Account</Name>
        </SbRole>
    </Role>
    <Options>
        <SbVerificationOptions>
            <ActualMemoryPercent>100</ActualMemoryPercent>
            <MaxBootTimeoutSec>300</MaxBootTimeoutSec>
            <AppInitDelaySec>120</AppInitDelaySec>
            <TestScripts>
                <TestScripts>
                    <TestScript>
                        <Name>Query AD Account</Name>
                        <Type>Custom</Type>
                        <TestScriptFilePath>%ProgramFiles%\Veeam\Backup and Replication\Backup\Query-ADUser.bat</TestScriptFilePath>
                        <Arguments>%vm_ip% UserName</Arguments>
                    </TestScript>
                </TestScripts>
            </TestScripts>
            <HeartbeatEnabled>True</HeartbeatEnabled>
            <PingEnabled>True</PingEnabled>
        </SbVerificationOptions>
    </Options>
</SbRoleOptions>

After these three steps you should be able to add the Query AD Account check to your Veeam SureBackup job!

VMware vCenter Server Appliance update

nospam@example.com (Beheerder) — Sat, 19 Sep 2020 20:28:00 +0200

Here at work we are running VMware. On most of the hosts it is version 6.7, on some it's 6.5. The reason not to run 6.7 everywhere? Basically it's the hardware which isn't supported by the hardware vendor HPE. But since some time version 7 of VMware vCenter Server and ESXi is out there we wanted to upgrade. From lessons learned in the past I knew to check some stuff first:

Does the hardware support this version 7? The vCenter Server Applance version 6.7 itself is a VM, running on an ESXi host, which should be able to upgrade to version 7.0. As said before, some of the HPE hardware does support 6.7 and also 7.0 (the HPE Proliant Gen9 servers and higher) but two ESXi servers will remain on 6.5 because the are HPE Proliant Gen8 servers and HPE does not provide a OEM VMware 7.0 image

The backup software is also an item to check. We are running Veeam Backup & Restore 10 and the latest patch level does support version 7.0 of vCenter Server Appliance and ESXi, older patch levels or version of Veeam B&R won't

Check the integration with your storage vendor! Mine was a HPE 3Par which didn't cause an issue but you never know!

Check your cores! When upgrading socket licenses VMware transforms them to new 7.0 licenses but when activating them on a ESXi host you'll see only 32 cores are licensed. If more cores are present you'll have to buy additional core licenses to be compliant. In my case two HPE Proliant Gen10 servers have 36 cores so..

VMware did an awesome job for the migration which went smooth for the vCenter Server Appliance as well for the ESXi hosts, so a big thank you to all the engineers & developers at VMware!

Microsoft Ignite Tour 11 and 12 march 2020 Amsterdam RAI

nospam@example.com (Beheerder) — Sat, 29 Feb 2020 22:52:00 +0100

Yeah, I'm going! Two years ago I also had the opportunity to go and this year I planned my schedule a bit full so I have more than one choice whenever sessions aren't interesting as I thought reading the summary!

I'm really looking forward to this and when everything turns out fine I also use this to visit a dear friend living in Hoofddorp!

SUSE Linux Enterprise Server for SAP Applications Installation

nospam@example.com (Beheerder) — Thu, 16 Jan 2020 21:24:00 +0100

Many companies nowadays still use SAP R/3 for ERP purposes. At the firm I'm working this was also the case. A few months ago the decision was made to migrate to SAP S/4HANA, the latest SAP version equiped with many enhancements and, last but not least, an in-memory database which should mean faster queries and performance!

My job was to provide the technical infrastructure for migration and the SAP S4HANA servers and since it was a hard job for me to find an installation manual for the proper SAP S/4HANA server installation here's my 2 cents.

Requirements:

Suitable hardware. Best practices and recommendations can be found here and here

SUSE Linux Enterprise Server for SAP Applications license (this link). You'll need at least one 2-socket license per SAP S/4HANA server

Installation steps:

In my situation the SAP S/4HANA servers must be installed on VMware vSphere 6.7 servers, upgraded to the latest version, so the description is based on that.

Create a new Virtual Machine with the following specs to start with. At a later stage additional VMware Paravirtual SCSI Controllers and disks will be added for SAP S/4HANA purposes.
- Guest OS: Linux, SUSE Linux Enterprise Server (x64)
- CPU: 8 devided over 2 sockets
- Memory: it depends, in my case it was 256GB
- SCSI Controller: VMware Paravirtual
- Disks:
  - 50GB (SCSI 0:0)
  - 30GB (SCSI 0:1)
  - 30GB (SCSI 0:2)
- Network: VMXNET 3

Boot the Virtual Machine and mount the downloaded SUSE Linux Enterprise for SAP Applications image.

Select the correct language, keyboard layout and product to install. For a SAP server choose SUSE Linux Enterprise Server for SAP Applications

Continue reading "SUSE Linux Enterprise Server for SAP Applications Installation"

Updating to Serendipity 2.3.1

nospam@example.com (Beheerder) — Wed, 28 Aug 2019 07:46:00 +0200

Hi everyone!

Yesterday I've updated this blog website (and one other) from Serendipity version 2.1.5 to Serendipity version 2.3.1 and man-oh-man, was I glad I did have an older backup of the environment somewhere! After updating several issues arose from Java errors to plan 403 and 500 messages.. I tried several solutions, like applying the update again, changing PHP versions and settings, but nothing helped. I ended up with a backup made in June this year with Serendipity version 2.1.4, copying the update 2.3.1 to that location and running the update again. Now it ran smooth, this article is the proof :)

This shows, once again, the importance of a backup before upgrading or updating!

VMware Cross vCenter Workload Migration Utility

nospam@example.com (Beheerder) — Tue, 02 Jul 2019 08:13:00 +0200

Here at work we were still running a Windows vCenter Server with embedded PSC. It was connected to a Microsoft SQL 2008 instance and since SQL 2008 is EOL this year I first thought it would be advisable to migrate the database to a newer Microsoft SQL version (yeah I know, why not implementing a VCSA). Although I have descriptions for almost everything and Keepass for all sorts of passwords, I wasn't able to migrate the databases. How to get rid of the old Microsoft SQL 2008?

The solution was quite simple. I've installed a new VMware vCenter Server Appliance, exported and imported all the distributed switches and moved all servers and stuff towards the new VCSA (VM down, attach it on the new VCSA, VM up and remove it from inventory on the old vCenter Server). I did it manually but later I discovered it should also be possible using the Cross vCenter Workload Migration Utility fling.. If I onley knew this earlier in the process..

Updating VMware vCenter Server 6.5.0 to 6.7.0 fails to start service vmware-autodeploy-waiter

nospam@example.com (Beheerder) — Wed, 05 Dec 2018 19:00:00 +0100

This week I updated my Windows Server 2008 R2 based VMware vCenter Server installation. It's an installation with an embedded PSC, so the installation tool place on one Windows Server 2008 R2 server. On forehand I created a consistant VMware snapshot and database backups, in case upgrade should go wrong.

Man oh man, was I glad I made the snapshot and backups! During the installation all seems fine until step 5 of 5, importing data and starting the services. This error occurred:

After contacting VMware support it turns out that somehow services were disabled for VMware vCenter. I cannot remember doing this but Ok, how to fix the issue. To check which services are running and which are not, follow these steps:

Open a command prompt as Administrator

Go to the directory %VMWARE_CIS_HOME%\bin (mind the drive!)

Execute service-control --status --all

You will see that certain services are not started, these should be checked if these are disabled or just set manually. To check this, follow these steps:

Go to https://vcenterserver:9443/

Log on as an administrator

Go to Administration, System Configuration, Services

Check all services to be at least automatic or manual

After checking all VMware vCenter Server services I restarted the installation and everything went as expected.

Let me finish by saying thanks to VMware support for helping me!