Active Directory Users and Computers not showing all tabs in Windows 10 build 1511

Issue:
Missing tabs in AD Users and Computers (dsa.msc) in Windows 10 build 10586 (1511). Also unable to perform certain actions in AD Users and Computers.

Cause:
Problem is with the latest RSAT KB

Solution:

• Start > Type Features, Click "Turn Windows features on or off"
• Uncheck Remote Server Administration Tools, Click OK.
• Open administrative command prompt and run:

wusa /uninstall /kb:2693643 /norestart

• Reboot the computer
• In "Turn Windows features on or off", "Remote Server Administration Tools" should no longer be available. 
• Download and install the old RSAT version from 

https://drive.google.com/file/d/0B-meMiJiVDGATkpyS3J0Q29yZ1U/view?usp=sharing

Credit: jletellier on SpiceWorks

Mirror: https://www.dropbox.com/s/h9u963vz4t0w1b4/Windows10RSAT_100105850.msu?dl=0

• Check RSAT is now ticked in "Turn Windows features on or off"
• Run dsa.msc
• Check version in Help > About AD Users and Computers - should now be 10.0.10585.0 and should now show all tabs.

Reference: SpiceWorks Thread

PowerShell DSC Extension in Azure Resource Manager - PowerShell Method

Here are the steps I took to get the PowerShell DSC Extension for Azure Virtual Machines working using the PowerShell publishing method. In another post, I'll go through the JSON template method.

First, create an Azure VM using whichever method you prefer. I used the portal for simplicity. Most of my settings won't affect this, but for completeness, the settings I used for my VM are as follows:

Image: Windows Server 2016 Datacenter
Deployment Model: Resource Manager
Name: MyCoolVM
Disk Type: HDD
User name: Dave
Password: hunter2
Resource Group (New): DSC-Test-Resources
Location: North Europe
Size: A1 Basic
Settings Tab: All defaults except monitoring disabled.
Storage Account Name: dsctestresourcesdisks871

After creation, I opened the VM's network security group and added an inbound rule to allow port 80. I also added a DNS alias to the machine's public IP.

Once the VM is set up, open a text editor and create the following example DSC file:

In the same folder, make a deployment script as follows: 



The first command will publish the DSC configuration into a Zip file in your Azure storage account and return a predictable URL. The resulting blob will not be public.

Mine ended up here, but you can see the format which appears to use the normal blob URI and the powershell-dsc container:
https://dsctestresourcesdisks871.blob.core.windows.net/windows-powershell-dsc/dsc-webserver.ps1.zip

A few seconds after the second command executes, you can see the new extension in your VM in the portal.

The status will move from (unavailable), to Transitioning, to Provisioning succeeded (or failed.)

If you click the extension you can get more details on the process, you can view the entire log from this blade.

And here is the finished web server:

Start to finish, including manual creation of the VM, this process took about 20 minutes.

If you use additional non-standard DSC resources, the PowerShell publish command will include the modules in the uploaded Zip file which is super handy.

References:
Introduction to the Azure Desired State Configuration extension handler

HP Data Protector Backups using Compellent PowerShell snapshots

There are three main steps in this setup:

1. Setup snapshot / scripting host server (in my case this is a virtual machine with iSCSI network connections) 
2. PowerShell Scripts 
3. HP DP configuration

Prerequisites: 

• Snapshot Host machine which is connected to the iSCSI network. 
• Compellent Enterprise Manager Server setup and configured. 

Step 1 – Configure the Snapshot Server for storage access to the Compellent Array 

Configure the Compellent Enterprise Manager Server 

Add the snapshot / scripting server in Compellent enterprise manager using the “Create Server” wizard. 

Get the IQN of the snapshot server: 

Enter Server Name, Windows 2012 MPIO for multi path and the IQN of the server from the iSCSI control panel applet into the Create Server wizard 

On the snapshot server: 

• Install the Windows MPIO feature: 

           Add-WindowsFeature Multipath-IO 

• Click Start, Type MPIO and click the MPIO icon 
• Click “Discover Multi-Paths”  
• Tick add support for iSCSI and click Add 
• Reboot the machine if required 

• Open the iSCSI Control Panel Applet (iscsicpl) on the snapshot / scripting server and enter the target addresses of the SAN. 
• Click connect on each of the discovered targets that appear, ensure enable MPIO is ticked for each. 
• Click volumes and devices and “Auto Configure” 
• There should be a single device showing in the volume list which is the Compellent 

The server should now show as connected in the Compellent Enterprise Manager: 

Step 2 – Configure the PowerShell Scripts on the Scripting / Snapshot Server 

To download the Dell Compellent PowerShell Cmdlets you need to get a Dell Co-Pilot account configured here: 

https://customer.compellent.com/login.aspx?item=%2fdefault&user=extranet%5cAnonymous&site=customerportal  

Once I my account was approved, I was able to login, navigate to the Knowledge Centre, then software. From here I downloaded Dell Storage PowerShell SDK v2.2.1. I have provided the link but it will need registration to download. 

https://kc.compellent.com/Pages/Download.aspx?DocID=2835  

Download and unzip the PowerShell modules to an appropriate location. I use: 

C:\ Scripts\DellStoragePowerShellSDK_v2_2_1_362 

You will need to get a serial number from your controller, this can be found in Enterprise Manager under the hardware tab, then click a controller and the “Index” is the serial required. 

My scripts are available for download on GitHub and can be used with the following syntax: 

C:\Scripts\CompellentSnapAttach.ps1 -scSn "00000" ` 

    -serverName "scriptserver.lan" -Credential $Credentials ` 

    -port 3033 -TargetVolume "My Volume" ` 

    -managementHostName "managementserver.lan"  

The port shown is the default data collection port for the Compellent management server. 

Credentials can be saved using the PowerShell and SecureString method as in the blog post here. 

Step 3 – Configure HP Data Protector to execute PowerShell scripts pre and post backup 

On the Scripting server 

Create .bat files containing the required pre and post code in C:\Program Files\Omniback\Bin 

My scripts are as follows 

AttachGoldImages.bat 

powershell.exe -File "C:\Scripts\AttachGoldImages.PS1" 

DetachGoldImages.bat 

powershell.exe -File "C:\Scripts\DetachGoldImages.PS1" 

In Data Protector Manager 

Open the backup specification and go to the Options tab 

Click the Advanced button in ‘Backup Specification Options’ 

Enter the filenames of the .bat files created earlier. The “On Client” box should be the scripting server that the .bat files are located on. 

Once all of these steps are complete, the scripting server can now mount an iSCSI replay, perform the backup and then remove the replay from both the scripting server and the Compellent array. 

Hardware Planning for Skype for Business 2015 Enterprise

I've been looking through the MS hardware and virtualisation guides for Skype for Business 2015 (and Lync 2013) and put together some notes to try to translate some of the best practices.

There aren't many corners that can be cut when setting this up and the hardware requirements are pretty large. The smallest enterprise set up that Microsoft details is for 10,000 seats. Microsoft won't support a configuration with hardware less than recommended which makes the hardware requirements for an organisation with under 10,000 seats seem even higher.

Most of the notes are bullet points taken from the Lync 2013 virtualisation guide, but I have put a section at the bottom to try and translate the official 2015 hardware requirements. The disk IO and capacity requirements are also listed here.

References

Lync Server 2013 Virtualization 
Capacity Planning Doc 
Lync Server 2013 Stress Testing Guide 
2015 Hardware Specifications 
RAID IOPS Calculator 


MS Assumptions in 2013 virtualisation guide

• 10k users on 3 Front Ends 
• Shared resource techniques, including processor over subscription, memory over commitment, and I/O virtualisation, cannot be used because of their negative impact on Lync scale and call quality.

General Information

• Need to do own testing with LSS – A must - Lync Server 2013 Stress Testing Guide 
• There is a section (virtualisation guide) on KHIs (Key Hardware Indicators) which should be checked during testing.
• No vMotion / Live Migrate – VMs can only be moved while powered off. 
• Mixing physical and virtual in the same pool (lync role) is not supported 
• Each server in the pool must have identical resources 
• Physical servers must be fully redundant (ie PSU, RAID) 
• Using a lower specification of server should be done with caution and it is highly recommended to use Stress and Performance tools to verify the final solution. Support will not do anything unless HW specs are met.

CPU

• Disable Hyperthreading 
• 1:1 vCPU to pCPU 
• Host must support nested page tables and extended page tables (NPT and EPT) 
• Disable NUMA spanning 
• MS Config uses 8 x HPDL560 G8, 4x E5-4650 (8c/16t) 2.70 Ghz 
• 6-10 percent overhead for VMs in guide.
• Microsoft guide does not account for NUMA home nodes at all, therefore spanning VMs across NUMA nodes or CPUs should not be an issue. (They have 12-core VMs on hosts with 8-core Intel CPUs, therefore the VM must span NUMA)

Memory

• No over commitment 
• No Dynamic Memory (or VMware ballooning - must reserve all)
• MS Config uses 8 x HPDL560 G8, 128 GiB (8 * 16 GiB)

Networking

• Must Use VMQ (Virtual Machine Queue) 
• Physical NIC segregation between Host and Guest communication.
• SR-IOV is recommended.
• MS Config uses 8x HPDL560 G8 with 4x 1 Gb NIC 
• Each host must have at least 1 dedicated NIC for lync workload.
• Lync server media workload can reach over 500 Mbps. 
• If more than 1 VM on a host size NIC accordingly, consider 10 GbE or multiple 1 GbE ie. 3x1Gb NICs Teamed. 
• Synthetic NICs in guest are preferred, also use physical NIC offloads if available.
• Legacy NIC not supported in Lync media workloads.
• Use only IPv4 -OR- IPv6 on a NIC

Storage

• Fixed / Pass Through disks (NOT Dynamic) - VHDX format 
• VM storage must be dedicated to VMs (ie. Don't use hypervisor system drive for VMs) 
• VM Checkpoints not supported 
• 'be aware' of contention between VMs 
• MS Config uses 4 * 300 GiB RAID 1 local system drives 
• MS Config uses 8 * Drive Enclosures with 12 600 GiB SAS 15k drives each (96 drives) 
• Each physical host has 1 x 600 GB array and 3 x 1.2 TB arrays each with 700 read and 350 write IOPS 
• VM: IDE for boot disk, SCSI for all other attached drives 
• ISCSI for data drives supported 
• Normal best practice for OS and binaries on OS drive, DBs and data on data drives 
• Implement MPIO for back end storage

Software (OS)

• Hypervisor – 2012R2, 2012, 2008R2, or SVVP tested platform 
• All Lync Server workloads supported in VM 
• Use VM Templates – Sysprep cannot be applied after Lync installation 
• Guest OS – 2012R2, 2012, 2008 R2 required

DR

• Front end pools in both sites, both active, both pools must be phys or virt (not mixed) 
• Admin can fail over from one site to the other 
• Both pools should handle all users

SQL

• SQL HA using SQL Mirroring + witness is recommended. Checking the 2015 hardware requirements, SQL AlwaysOn is also supported and is likely the best choice for a 2015 deployment.
• See below for supported SQL Server versions.

Supported Versions

• MS SQL 2014 Ent or Std with CU6.
• MSSQL 2012 Ent or Std with latest SP.
• MSSQL 2008 R2 Ent or Std with latest SP.
• Mirroring, Clustering and HA all supported, mirroring only in the Topology Builder.
• Active/Passive only, do not use passive for anything else.

Hypervisor Considerations

• Place VMs in the same application tier on different hosts for HA.
• Lync Server 2013 can be deployed on Windows Server 2012 Hyper-V and later technology, or any third-party hypervisor that has been validated under the SVVP. (implies 2016 is supported -- need to check with MS to be sure.) 
• Resource allocations not explicitly required unless oversubscribed - Seems an absurd statement since you cannot over commit?
• If you deploy AV on host, ensure exclusions are in place (doesn't detail exclusions.) 
• Disable virtual CD/DVD ROM 
• Lync unable to use HA or DR capabilities of Hypervisor (SRM, Hyper-V Replica)

Microsoft Virtualisation Guide VM to Host Placement

Skype for Business 2015 Hardware Requirements (Per VM)

Front End, Back End, Standard Edition and Persistent Chat

Microsoft Specification	Translation	Comment
64-Bit dual, hex-core 2.26 Ghz	12 Core
32 gigabytes (GB)	32 GB
8 * 10k rpm "with 72 GB free" --or— SSD with similar performance 2 in RAID1 6 in RAID10	232 IOPS, 72 GB 697 IOPS, 216 GB	Lync 2013 doc suggests 66/33 read/write IO profile (700/350 iops per LUN)
1 dual-port 1 Gbps NIC –or— 2 single NIC Teamed with single MAC	1 Gbps redundant	Doesn't say how teaming to be done, so NFT only seems appropriate
OS	2012R2 or 2012	Specific KBs are required, see MS hardware spec site

Edge, Standalone Mediation, Video Interop and Directors

Microsoft Specification	Translation	Comment
64-Bit dual, quad-core 2.26 Ghz	12 Core
16 gigabytes (GB)	32 GB
4 * 10k rpm "with 72 GB free" --or— SSD with similar performance 2 in RAID1 + 2 in RAID1	232 IOPS, 72 GB 232 IOPS, 72 GB	Lync 2013 doc suggests 66/33 read/write IO profile (700/350 iops per LUN)
1 dual-port 1 Gbps NIC –or— 2 single NIC Teamed with single MAC	1 Gbps redundant	Doesn't say how teaming to be done, so NFT only seems appropriate
OS	2012R2 or 2012	Specific KBs are required, see MS hardware spec site

Disk calculations are based on using 72 GB 10,000 RPM drives as detailed in the Microsoft Spec.

2 x 72 GB drives in RAID 1 gives: 72 GB capacity and 232 mixed total IOPS.

6 x 72 GB drives in RAID 1 gives: 216 GB capacity and 697 IOPS.

See the IO calculator linked for details.

You can see the guidelines are pretty detailed and once you translate them they become quite clear. Once the hypervisor servers and VMs are built, I plan to post a script to configure as per best practices.