The “Microsoft Application Virtualization Advanced Guide” represents my second App-V book; the previous one “Getting Started with Microsoft Application Virtualization 4.6” was developed a year ago with the basic guidance and step-by-step to get IT administrators started with App-V. This new book is currently available for pre-order in Packt Publishing website (paperback and eBook versions) and hopefully soon enough in Amazon’s (including a Kindle edition).

This advanced book will cover the necessary guidelines and step-by-steps processes to dominate App-V. Starting with detailed description of its architecture, including some rare advanced topics, and moving through the instructions to implement those advanced guidelines. Here’s an overview of the areas we will cover:

• Perform sequencing in complex environments including scenarios where App-V is normally not supported.
• Deploy applications in complex scenarios, including the use of Providers Policies to enforce licensing and other company’s policies.
• Get hands on in how to implement the scripting process within App-V applications and also review how to use App-V command lines.
• Troubleshoot App-V, covering the installation process of this platform, but also normal sequencing issues and deployment problems delivering applications.
• Scale-up App-V implementations by using failover and load balanced scenarios.
• Review App-V integration with VDI (Virtual Desktop Infrastructure) and Remote Desktop Services.
• Integrate App-V with System Center Configuration Manager (SCCM) 2012.
• Understand the new approach appearing in SCVMM 2012 with Server App-V to virtualize servers’ applications.
• Examine 3rd party tools available in App-V to complement your implementation.

Note: We will not cover the topics reviewed in the “Getting Started” book. This version assumes that we’ve already implemented and used Microsoft App-V; presumes that we are looking to optimize our implementation and learn advanced concepts.

And as an exclusive note, here are the chapter’s names to be included in this book:

1. Taking a Deep Dive into App-V.
2. Sequencing in Complex Environments.
3. Deploying Applications in Complex Environments.
4. Handling Scripting and App-V Command Lines.
5. Troubleshooting App-V.
6. Scaling Up App-V Implementations.
7. Integrating App-V with Virtual Desktop Infrastructure (VDI).
8. Integrating App-V with System Center Configuration Manager (SCCM) 2012.
9. Integrating Server App-V with Private Clouds.
10. Appendix A: Reviewing App-V Microsoft and 3rd Party Tools.

In this book, which will contain approximately 450 pages total, I had the great pleasure to work again with Packt Publishing and the same crew of App-V experts that made important contributions in my first book: Aaron Parker, Kevin Kaminski and Nick Källén.

Stay tuned for more news about the book and hopefully a new giveaway copy to all my blog readers! :)

I’ve had the great pleasure to present in October, once again, in one of the main Microsoft events in Argentina, Code Camp 2011. This time with two new tracks: “Desktop of the Future” and “Standardizing Windows Server 2008 R2 images”.

As I mentioned earlier in older posts of mine, Code Camp is an event organized and developed by Microsoft Academics which is held in some important universities of Buenos Aires, this time the selected institution was, as a few years back, Universidad Abierta Interamericana (UAI).

The event contains over 50 tracks presented by students and professionals not only as IT but also as developers. Some of the main topics this year were: Windows Azure, Cloud Computing, SQL Server 2012, Mango and Windows Phone, XBOX and Kinect, VDI, Deployment solutions and so on.

Regarding my topics, the tracks were focused on Virtual Desktop Infrastructure (VDI) integrated with App-V; and a deep dive into Microsoft Deployment Toolkit (MDT) to automate Windows Server’s deployments.

Desktop of the Future

I’ve presented this session (the original Spanish name: “El Escritorio del Futuro”) with Emiliano Estevez, friend and colleague of mine in Algeiba IT where he works as the Services Director.

This track introduces Virtual Desktop Infrastructure (VDI) technology as a result for some current demands in today’s business. By reviewing some of the basic concepts of VDI, we’ve completed the main steps to prepare the Virtual Desktops infrastructure in our company using Hyper-V and Remote Desktop Services (RDS).

We’ve also introduced App-V as the main solution to optimize application management in virtual desktops scenarios, and also with the highly important “Shared Cache” feature to save a lot of money in storage. And finally we had a quick glance about Server App-V, the new technology included in SCVMM 2012 to virtualize server’s applications.

The presentation can be downloaded from this link.

Standardizing Windows Server 2008 R2 Images

This track (the original Spanish name: “Estandarizando Servidores Windows Server 2008 R2”) was presented with another colleague in Algeiba IT, Alejandro Barrionuevo, who’s working as an IT Consultant.

In this session, we’ve reviewed with Alejandro the main benefits of using Microsoft Deployment Toolkit (MDT) 2010, combined with other free tools, to standardize and automate the deployment for Windows Server 2008 R2 OS. We had a quick look about understanding the Solution Accelerators from Microsoft.

We had a detailed look about the process involved in this automation, including some practical demos about using MDT 2010 task sequences, scripts and also editing MDT files used in the deployment process for a complete automated deployment.

The presentation can be downloaded from this link.

I’m introducing a new set of articles in my blog: Interview sessions with some colleagues and technology geeks. In this first article I had the great opportunity to start a quick question and answer session with one of the geekiest App-V guys around the world: Aaron Parker.

Aaron made an important contribution in my App-V book “Getting Started with Microsoft Application Virtualization 4.6”, not only as an official reviewer but with his blog which contains several interesting articles about virtualization using a valuable approach.

You can find more about Aaron following him on Twitter: @stealthpuppy.

Here’s the Q&A session I had with Aaron:

1. To start with the interview, can you give us a quick synopsis about yourself and your experience?

I am a desktop and application virtualization and delivery architect currently working for Kelway in the UK. Previous to my current role I’ve been working on various application virtualization, user virtualization and desktop deployment projects around London. Before coming to the UK, I worked for various VARs in my native Australia where I was doing mostly Citrix XenApp and desktop deployments.

2. In all the experience you have regarding virtualization, how could you explain application virtualization for someone who had never heard about App-V or any other similar platform?

Application virtualization is really just another application deployment method. Where it differs from traditional deployment methods is its ability to make the desktop more dynamic rather than a monolithic blob that we’ve had to deal with in the past. Application virtualization allows us to deliver applications on demand and to users, where ever they are, rather than physical devices.

3. Why do you think that application virtualization did not appear massively just yet in organizations?

Many organisations still look at desktop deployment the old way, i.e. create a static, monolithic SOE, and have failed to recognise the benefits in approaching desktop virtualisation in layers. Small organisations that are still using imaging products such as Symantec Ghost and have stuck with OEM licenses, may find that change can be costly – if their current approach works, why change?

It has also been disappointing to see a lack of support from application vendors for application virtualization in general. Companies such as Attachmate should be applauded for supporting their products under App-V. Momentum requires application vendors to do more than they have currently (which is next to nothing).

Note:
In case you are wondering why there are terms like “organizations” and “organisations” in the same text, this is regarding the American and British spelling differences; both are valid.

4. Can you name the top reasons of why application virtualization must be considered in any organization?

If you’re interested in creating a user-centric model of your computing resources (both hardware and software) then the desktop needs to be broken down into layers to make it dynamic. Application virtualization is just one of those layers. A dynamic desktop is more flexible and allows us to deliver applications based on identity and context.

5. Do you think that Virtual Desktop Infrastructure (VDI) + Application Virtualization represents the future of desktops?

In the short term – yes, But I also think that VDI (as in a hosted virtual desktop based on a Windows client OS) has limited use cases – it suits only 10 to 20% of users. Coming from an SBC background, I know that I can deliver a desktop from the data centre, cheaper, faster and more efficiently with SBC (TS, RDS, Citrix XenApp, Quest vWorkspace etc).

In the long term – no. Windows as we know it today won’t be around forever. It will evolve along with new application architectures that will render today’s desktop model obsolete.

6. With all the possibilities regarding application virtualization (App-V, ThinApp, XenApp, and so on), do you think that there’s one among all that stands out or depends on each scenario?

Absolutely depends on your scenario – the choice of application virtualization product is often not a technical one (as much as we’d like it to be).

7. Regarding Microsoft’s App-V, which are the features included in the latest version that you like the most?

The 4.6 SP1 Sequencer has some great features around sequencing workflow, recommendations before sequencing, displaying what was excluded post sequencing and sequencing templates. These features help to produce better quality packages.

8. Even though there’s no official word from Microsoft, which are the features that you think may (or want to) include the App-V 5.0 version?

I would like to see isolation as something that we could turn off and on. Isolation of a virtual application is great for the majority of cases; however being able to remove isolation as a per-package behaviour would allow use to virtualise many more applications.

I hope you enjoyed this article and I’m pretty sure I’ll get back with some more interviewers and Q&A sessions.

Not so much for a recent, but still I think represents as great news: The App-V book, “Getting Started with Microsoft Application Virtualization 4.6” is available in Kindle version, in Amazon site of course.

So for all those geek Kindle owners (I’m not one, unfortunately) there’s a chance to take a great look to my App-V book using Amazon’s device.

And seems that the availability of the Kindle version also keeps pushing the popularity of the book, since in Amazon.com is ranked as a top seller book in Microsoft section.

#83 in Amazon.com:

Also in Amazon.co.uk (#58):

Starwind released recently a new version of their iSCSI SAN solution, Starwind 5.7. It includes several new features that scale up this already great SAN solution, providing some important improvements regarding performance, monitoring and usability for IT administrators.

Some of the improvements included:

• Re-worked and re-designed completely from the scratch all-new HA (high-availability) engine 2x-3x faster compared to previous versions.
• Quality of Service (QoS) options added.
• Data de-duplication with variable block size (512 byte – 256 KB) to save on storage especially in hypervisor scenarios.
• Performance monitor included in Starwind console.
• Snapshot manager.
• Targets and servers can be arranged in groups.
• Event notification in system tray.

Within this post we’ll review some of the newest features included, testing them in some scenarios. Here’s what we are going to do:

1. Reviewing Starwind iSCSI SAN 5.7 installation

2. Reviewing improvements in Starwind management console.

3. Reviewing usability and GUI new features.

4. Configuring HA and synchronization priority.

You can download Starwind iSCSI SAN software using this link, previous registration required.

For a detailed step-by-step of creating and configuring a Windows Server 2008 R2 cluster using Starwind check my previous article: Five Easy Steps to Configure Windows Server 2008 R2 Failover Cluster using Starwind iSCSI SAN.

Reviewing Starwind iSCSI SAN 5.7 Installation

As any other version of this solution, the installation steps are pretty simple. Just completing the wizard we’ll have it ready to use it.

We can also install the components separately, in case we want to remotely manage the iSCSI platform.

Once installed, to get started we need to use the “Connect” option and as a reminder, the default credentials used in Starwind are:

User: root
Password: starwind

Reviewing Improvements in Starwind

The management console looks pretty much the same, but adding some interesting tweaks that will be very helpful for IT admins.

The first one is one of the most important ones, the “Performance” tab included. Within this window we can monitor in real time the performance in the current load of the server and targets.

We can retrieve the following graphics: CPU/RAM load (for a quick comparison), CPU load, RAM load, total IOPS and total bandwidth.

The second one is a really simple one, but very helpful. The possibility to create target groups, this lets us easily identify in our servers the right collection.

As a third improvement in the usability of this management console we have the Event notifications in system tray, with this tweak we can receive notification as soon as there is a change in the configuration and availability of our servers and targets.

Configuring HA and synchronization Priorities

As mentioned earlier, the main feature regarding performance changes is the one represented by including asynchronous mode for HA targets.

If you are taking your initial steps with Starwind you are probably wondering about HA targets and asynchronous options, let’s take a quick look about the definitions on each of these concepts:

What are HA (High Availability) Targets?

As we’ve reviewed in my previous chapter, creating clusters and provide high availability for a Windows Server service using Starwind is one of the main purposes of this solution and a very simple task to do. But Starwind also includes the possibility to apply high availability in the shared storage we are providing.

When we are creating our Starwind device (basically the LUN we are going to share among hosts) we can configure it as a “High Availability device”, which can be present in two different Starwind servers. In case the primary server fails, the second one (partner server) can still offer the device without affecting availability.

What about synchronization of the device?

When we are using HA devices, there are two shared disks: one in primary server and the other one in partner server. These are two different devices, meaning that they must be replicated and synchronized.

Here is when the synchronous/asynchronous mode appears.

If the replication is presented synchronous, every change (“write”) in the device must be replicated to the partner device to complete the operation. If we don’t have a good design or the bandwidth presented between these two is not a good one, the performance of HA targets reduces significantly.

Synchronous replication example (image taken from cisco.com):

If we are using asynchronous replication, the “write” operation does not have to wait for the replication between the two devices to be completed, improving performance.

Asynchronous replication example (image taken from cisco.com):

The use of synchronous or asynchronous replication must be carefully studied analyzing all factors.

Using HA devices and synchronization options

Creating a target requires only running a simple wizard (as seen in my previous chapter); using HA devices only differs in a few options:

1. Select the “Add target” option.

2. Select “Target Alias” and using “Hard Disk” to create our HA device.

3. Select “Advanced Virtual”.

4. Select “High Availability device” and click on “Next”.

5. Specify the partner server options by providing IP address (or FQDN), port, type of authentication and credentials.

6. In “Virtual Disk Parameters” complete the path for these two devices, primary and partner.

7. In “Data synchronization channel parameters” configure the synchronization interface, heartbeat interface and priority of each server.

8. Select the option “Clear virtual disks” if we are using devices we’ve just created.

Note that these options available here can be very helpful if we created a non-HA device and later we decide to convert it in HA.

9. Select the desired option in “HA device cache parameters”.

10. Complete the wizard and we’ll have our high available device ready.

Once completed the wizard, we get the chance to configure the synchronization options.

Where we can set the synchronization priorities: “Faster synchronization” represents the synchronous mode (waiting the replication to complete the operation) or “Faster client requests processing” represents the asynchronous mode.

The improvements regarding performance will vary depending on the environment we are using, but it could represent 2 or 3 times faster than previous implementations. Cheers to that!

Note:

There are some reports about slow performance in cluster environments using iSCSI, pass-through disks on Hyper-V hosts; this is a known issue in Windows Server 2008 R2 and there’s a Microsoft KB available to solve this problem: http://support.microsoft.com/kb/2020559

More Resources

Here are more resources you can find to take a deep dive in Starwind and Windows Server cluster solutions:

• Five Easy Steps to Configure Windows Server 2008 R2 Failover Cluster using Starwind iSCSI SAN
• Starwind Enterprise HA Data Sheet
• Starwind iSCSI SAN Software White Papers
• Starwind SAN Sizing Guide
• Starwind iSCSI SAN Software Manuals
• Microsoft TechNet: iSCSI Cluster Support: Frequently Asked Questions
• Microsoft TechNet: Understanding Requirements for Failover Clusters

Microsoft has just released as a public beta the newest version of Microsoft Deployment Toolkit (MDT) 2012 with a few important updates:

• Supporting System Center Configuration Manager (SCCM) 2012.
• Using Lite Touch Installation (LTI), great improvements in the client side look-n-feel.
• Also for LTI, behind-the-scenes enhancements for partitioning, UEFI (Unified Extensible Firmware Interface), and user state migration.
• Some minor bugs fixed.

MDT 2012 Requirements

Same as MDT 2010:

• Windows Automated Installation Kit (WAIK) 2.0. You can download it from here.
  Note: The download page indicates that the WAIK version is “1”; but don’t worry, the actual version is 2.0.
• MSXML 6.0
• PowerShell.
• .Net Framework 3.5 SP1. Available for download here.
  Note: Even though .Net Framework 2.5 SP1 is not a requirement for MDT 2010 installation; one of its features, User-Driven Installation (UDI), does requires the latest Microsoft Framework installed.

MDT 2012 Look-n-Feel

For what I’ve seen so far, the user experience of the Deployment Workbench console is pretty much the same.

Also, the “Help Topics” are the same used in MDT 2010. But don’t worry, this is completely normal in this Beta version.

MDT 2012 Beta 1 Download

The beta is available in this link from Microsoft Connect, and I’m pretty sure that I’ll be testing it soon enough.

To check my previous posts about step-by-step deployments using Microsoft Deployment Toolkit (MDT), please check the articles in MDT Category.

Cheers!

A few weeks ago I had the big pleasure to visit the US (New Jersey and New York), courtesy of a company which invited me to coach an App-V training course in their facilities. I had a wonderful experience and in this post I would like to share with you the technical and non-technical approach, experience and more I had in those 8 days.

The App-V training course and workshop intended to provide not only all the basic knowledge regarding App-V, but to also give a complete guidance and step-by-step process in App-V installation, deployment, sequence and maintenance.

The Request

The original request appeared in my inbox in 2010, the idea appeared simple right away, they’ve said:

“We are looking for an application virtualization solution for our main company app; we are very interested in App-V but we have no experience handling this technology. We need a complete overview of the platform, understand how to use it and apply it in our scenario”.

So, we’ve started talking about their expectations, getting a deeper understanding about the company app, the scenario where it should be deployed, etc.

App-V Training Course Program

After a bunch of e-mails and phone calls about getting all the information about the scenario, application involved, and general expectations, the training course program looks something like this:

Here’s a detailed look about each day approach:

Day 1 – Overview and Preparing the Environment

• Since the attendees had mix knowledge about general IT concepts, I decided to take a quick look about some key components: Active Directory, IIS, SQL Server, virtualization concepts, cloud service models, etc.
• Understanding App-V components, features, benefits and implementation models.
• Prepare the entire environment in the “hands-on” section of the day. Full-Infrastructure
• Reviewing automation techniques for deploying the App-V client.

Day 2 – Sequencing Applications

• Getting started with the sequencing process, understanding the phases involved and best practices.
• Sequence simple applications to understand sequencing.
• Deep review about company’s application: Environment, requirements, restrictions, integration with the OS and other applications, common use cases, etc.
• Start with the sequencing process of the company’s application.
• Publishing and deploying App-V packages to client machines.

Day 3 – Advanced Options in Sequencing

• Deeper look in the sequencing process. Handling Feature Block 1, security descriptors to protect some files within the App-V package.
• Troubleshooting applications sequencing and deployment process. Understanding log files and common errors.
• Reviewing Dynamic Suite Composition. Even though company’s application does not require any other package, the concept of interconnecting virtual apps is still important.
• Handling Active Upgrade. Reviewing different type of modifications in an existing package: Editing or upgrading.

Day 4 – Deployment Methods

• Reviewing how to size and selecting the environment for a desired App-V implementation.
• Understanding the RTSP/S and HTTP/S streaming. How to fit each in the desired scenario.
• Since the application usage required the scenario with users connecting from different geographic places to a same server, we’ve reviewed necessary steps for publishing App-V to External networks outside the organization.
• Step-by-step processes for implementing HTTP/S streaming.
• A complete Hands-On for App-V Standalone scenario.

Day 5 – App-V and RDS | Securing the Environment

• Understanding the Remote Desktop Services, RDS, role in Windows Server 2008 R2 (formerly known as Terminal Services).
• Reviewing RemoteApp. Similarities and differences with App-V; pros and cons; and understanding when RemoteApp is best suited.
• Hands-on using company’s application with RemoteApp.
• How to integrate App-V into an existing Remote Desktop Services scenario.
• Reviewing Virtual Desktop Infrastructure (VDI) scenarios, integration with App-V and the shared cache feature.

The Result

The result of the course / workshop was great, the attendees had the chance to understand and implement App-V in their scenario and I could interact with an interesting requirement and deployment.

[geekyComment] Not only I enjoyed preparing and coaching this App-V workshop [/geekyComment] thanks to the great hospitality I also had the chance to visit New York City and a bunch of touristic places.

Just hangin’ in Times Square :)

The contest ended in February, but I didn’t have the chance to publish the winner in my blog so I decided to take a moment and share with all blog readers the happy winner for the App-V book.

Ian Walters from Webster, NY received a few weeks ago the book and kindly is sharing with us a quick pic. Thank you Ian!

For all those who didn’t get the chance to win this time, remember that the book is still available in the following sites:

• Packt Publishing
• Amazon.com
• Amazon.co.uk
• Lehmans

Thank you all for participating!

GFI, in the variety of products that they offer, is always looking to provide some interesting security tools to facilitate our jobs as IT professionals. One of the most complete security platforms available is GFI LANGuard, which provides detailed network auditing options and security scanning for your organization.

With no large or complex requirements, GFI LANGuard gives us some nice features:

• Powerful network scanning options without the need of agents to deployments.
• Reviews and controls vulnerabilities, updates/service packs status (for operating systems and applications), TCP and UDP ports open, and hardware and software inventory.
• Remediation options for deploying updates and service packs, deploy applications and the possibility for removing unauthorized software from machines.
• Detect and deploy non-Microsoft software to protect the entire operating system.

GFI LANGuard Requirements

The requirements for installing GFI LANGuard for a mid-size company (10 to 500 computers to scan) are:

Hardware

• Processor: 2GHz
• Storage: 2GB.
• Memory: 2GB.

Software

• Operating System: Windows XP SP2 or higher. Including Vista, 7, Windows Server 2003 and Windows Server 2008.
• Supported databases: Microsoft Access (installed locally by default) and SQL Server 2000 or higher (SQL Server Express is supported). If you have a large environment, is highly recommended to use a SQL Server instance instead of the Microsoft Access.
• .NET Framework 2.0
• For target clients, WMI is required for Windows operating systems (available in Windows 2000 or higher) and SSH for UNIX/Linux machines.

Note: Windows 2000 SP4 is also supported but since this operating system is no longer supported by Microsoft, using it is not recommended.

Installation

As any other GFI product, the installation is a straightforward process.

1. Download the GFI LANGuard trial.

2. Run the installer and complete the wizard.

3. The only thing you should have available at this point is the account which you would like to use to execute operations on target machines. This account must have administrative privileges in the domain.

Scanning the Network

Once the software is installed, using it is pretty much intuitive. Let’s take a quick look about the scanning process:

1. Open GFI LANGuard console.

2. Select the type of scan you would like to use:

• Quick scan: Looks for high security vulnerabilities in OS. This can be changed according to the profile we choose.
• Full scan: Looks for all type of vulnerabilities.
• Custom scan: We can change the profile, credentials and other options used in the scan.
• Schedule scan: Schedule scans can set the time where the scans will be executed in a determined time period. Also you can select options for: Automatically deploy updates or un-install software; trigger e-mail notifications; etc.

3. A short two step wizard will show where you can select the scope of the scan: local computer, specific computer or the entire domain.

4. Select an alternative credentials for this scan and click on “Scan”.

5. Once the scan is completed, we can take a quick glance about the status of all machines by selecting “Analyze”.

6. Here we can evaluate the vulnerabilities, system patching status, ports open, hardware, software, etc.

Once we have the computers analyzed, we can easily switch to the “Remediate” console where in easy steps we can deploy missing patches, un-install software, etc.

Updates Deployment

With the scan process completed, we finally get to the fun part, the remediation process. Here we can execute tons of actions to solve the problems we found in the auditing process. One of the actions we would like to execute is definitely the updates deployment.

GFI LANGuard offers the possibility to deploy windows operating system updates, patches and service packs; and also 3^rd party software updates.

Let’s take a look at the process:

1. Access the “Remediate” console in GFI LANGuard.

2. For the Microsoft patches, select the option “Deploy Microsoft Patches”. These should be the same we can find in Windows Update.

3. Review the updates and mark on those you would like to deploy. By default, all are marked.

4. Review also “Deploy Microsoft Service Packs”.

5. In “Deploy non-Microsoft Patches” we can review updates for all other software which is left out by Windows Update.

6. We can also review and select previously installed updates for uninstallation.

7. Once we complete marking all of the updates, we can set to deploy those updates immediately or in a specific schedule.

Managing Software with GFI LANGuard

Another interesting aspect in GFI LANGuard is the options available for managing software in client machines. We can set to uninstall unauthorized applications in our network or deploy custom software to guarantee our machines are following the right baseline.

Adding Unauthorized Software

If we are looking to add unauthorized applications for automatically removing it, the process involved is the following:

1. Access “Configure” pane in GFI LANGuard console.

2. In applications inventory select the application you would to add as unauthorized software, right-click and select “Configure”.

3. A wizard will start that will let us select in which scanning profile will be marked as unauthorized. Complete the wizard.

Before completing this configuration we must validate the uninstall procedure to guarantee that GFI LANGuard can perform the removal.

4. Access auto-install validation and you should see the “Validation pending” status of the application; click “Validate”.

5. A new wizard will pop up to confirm the uninstall procedure. This process WILL NOT uninstall the application in the remote machine, will only validate the process.

6. Complete the wizard with the selected target machine.

Note: An important note about this process is that we must have the application installed in a target machine to be selected and get a validated removal.

Removing Applications in One Client

If we’ve discovered one application that we would like to instantly remove from a machine, we can do so in the “Remediate” pane.

1. Select “Uninstall Applications” and select those to remove.

2. We can uninstall the application immediately or we can schedule the uninstall process.

Deploying Custom Software

GFI LANGuard gives us the chance to use automated deployment process to install applications in our target machines:

1. Access “Remediate” pane and select “Deploy Custom Software”.

2. Select “Add” to put in the application you would like to deploy. Take note that you can add specific parameters to the applications, for example, to complete a silent installation.

3. Select the target computers you would like to deploy the software.

4. And finally select the deployment schedule, which can be immediate or in a specific date and time.

Other Features

GFI LANGuard also offers some other common tools which are present daily for must IT guys, here are some:

• DNS Lookup: This is a handy tool most of us use when we need to validate name resolution within our domain or using an external DNS server.
• Traceroute: When we are having connectivity problems, we can quickly verify in GFI LANGuard console the number of hops to reach it.
• Whois: Retrieves information from a particular IP or hostname.
• Enumerate computers or users: Retrieves the number of computers/users found in he domains and/or workgroups in our networks. In computer, it also shows the operating system on each computer.
• SNMP Auditing: Reports weak SNMP strings available in the network, using dictionary attacks (from file snmp-pass.txt).
• SNMP Walk: To probe your network nodes and retrieve SNMP information (for example, OID’s).
• SQL Server Audit: Test the passwords vulnerabilities of SQL accounts, including the “sa” account.

Conclusions

As a quick summary of this review:

Pros

• Using GFI LANGuard offers a simple way to audit our networks to observe vulnerabilities and easily solve this by deploying software and or packages.
• Integrates with UNIX/Linux machines to cover also heterogeneous environments.
• The possibility to deploy 3^rd party updates represents an important feature to guarantee protection even with non-Microsoft software.
• GFI LANGuard using scanning profiles lets us to scale up our auditing process, providing different options in our scans.
• We can optimize our time using auto remediation options in scheduled scans.

Cons

• Uninstalling applications requires software to be installed in at least one computer available to test the uninstallation process, which should require manual work every time we found an unauthorized application.
• Besides deploying software and updates, real time actions like stopping a malicious service or process detected is not possible. The only option available is using a Remote Desktop option.

Running periodically auditing processes in our network is not very common in organizations, using GFI LANGuard can simplify us this task to maintain a secure baseline in our environment.

Resources

Here are some additional resources for GFI LANGuard:

• GFI LANGuard system requirements.
• [PDF] GFI LANGuard Getting Started Guide.
• [PDF] GFI LANGuard Manual.
• [PDF] GFI LANGuard Scripting Manual.

As a celebration since my App-V Book: Getting Started with Microsoft Application Virtualization 4.6 has just been published, I want to give away a free paperback version among my blog readers.

Here’s the deal:

• All you need to do is email me at augusto@augustoalvarez.com.ar with the subject: “App-V Book”.
• Include in the email body your full name plus the address where you would like for us to send the copy.
• I’ll close up the contest on February 25. All the emails sent until that date will be included in the election, which will be completely random.
• I’ll notify the winner in the following days and we’ll ship a free copy of “Getting Started with Application Virtualization 4.6”.

For more information about the book and the free chapter available for download, check this last post of mine.

To avoid any problems, here are some disclaimers:

• Only one email by person will be included. Do not use different mail accounts to participate several times.
• Emails that don’t include person’s full name and address will not be considered valid.
• We’ll cover the expenses regarding shipment but we are not responsible for extra fees or taxes other countries may include in the package.

Remember that the book is available in the following stores: Packt Publishing; Amazon.com; Amazon.co.uk and Lehmans.

Good luck!

GFI VIPRE Antivirus is a powerful and simple solution for those companies looking for a centralized management platform against viruses and malware inside their organization. It also provides important capabilities for expansion and capabilities.

VIPRE Antivirus includes all the common configurations you would look in an enterprise antivirus solution and even more. The possibilities for scaling up the infrastructure are really important, handling different types of sites (could be the same used in Active Directory), and different types of policies applying within these sites.

Within these policies, there are also several configurations we can modify: Starting for discovering agents (by LDAP query, IP scope, subnets, etc.). But another important feature VIPRE includes is regarding performance, client machines will not feel the presence of this antivirus, even when a scanning is running.

Here’s a comparison of common antivirus and how they affect performance:

In this post will take a look about the installation and configuration process of this tool to understand a little bit more what we are talking about.

Components in GFI VIPRE

The suite works as a normal client-server platform, using of course client agents that are in charge of securing client operating systems. Here’s a quick overview about the components:

• VIPRE Site Service: Managing communication between VIPRE database and agents.
• VIPRE database: Maintaining configuration, quarantine and reporting data.
• Agents: Component installed on client machines that receives information from the policy we’ve configured for the targeted machine. The VIPRE Site Service deploys agents using a micro-installer.
• Console: Centrally managed console that can be installed on any machines you like and using VIPRE Antivirus we can set different types of roles inside our organization and sites; depending on the rights assigned, a user would have only the necessary features to execute in the console.
• Report viewer: Application included in the console to retrieve information and generate quite complete reports.

System Requirements

Fortunately this platform provides also flexibility in the requirements for its installation. Take a look:

VIPRE Server

For the server (console and VIPRE Site Service):

• OS: Windows XP SP3; Windows Server 2003 R2, Windows Vista SP2; Windows Server 2008 SP2; Windows Server 2008 R2; Windows 7.
  For all of those, 32 and 64-bit is supported.
• Memory: 512mb.
• Software: .NET Framework 3.5.1.

VIPRE Client

For client agents:

• OS: Windows 2000 SP4; Windows XP SP1+; Windows Server 2003 SP1+; Windows Vista SP1+; Windows Server 2008+; Windows 7.
  Again, for all those, 32 and 64-bit is supported.
• Supported E-Mail clients: Outlook 2000+, Outlook Express 5.0+, Windows Mail on Vista, SMTP/POP3 (Thunderbird, IncrediMail, Eudora, etc.)
• Memory: 512MB.

Communication between agents and server need a few exceptions in firewalls:

• TCP 1082 and 1086 for VIPRE service;
• TCP 135, 139 and 445 for WMI;
• TCP 80 for deploying agents.

For more information about requirements take a look to this link: http://www.gfi.com/business-antivirus-software/viprebusinesssystemrequirements.htm

Installation and Configuration Overview

As I was saying, the implementation process of GFI VIPRE represents a simple procedure; let’s take a look about the process for installing and configuring this platform:

1. Review requirements for server and client machines.
2. Define the type of machines and the behavior you would like to be present in the antivirus software, depending on the machine category.
   This will be represented in the policy we can configure for each category we decide (for example: mobile computers will have a more restrictive policy than the workstations).
3. Install GFI VIPRE Antivirus.
4. Create and configure system policies to apply agent machines.
5. Add agents and validate VIPRE installation. The platform provides the possibility for automated installation and of course manual.
6. Run a manual scan in agents to validate current health status of your clients. Automatic scans in agents can be configured but we can also trigger manual scans whenever we need.
7. Generate reports using Report Viewer.
8. Configure any additional sites and permissions for different type of users. We can have simple operators to the platform using the GFI VIPRE console.

Installing GFI VIPRE Antivirus

Once we’ve reviewed the pre-requisites for the installation, let’s review the step-by-step:

1. Download the free trial for GFI VIPRE Antivirus.

2. Double click the installer and a wizard will start.

3. The type of this installation in this case will be “Full Installation”.

If we use Advanced Installation we can configure an existing SQL Server instance (local or remote) to store the VIPRE Database. The Standard type installs SQL Express locally.

4. Since it does not require any complex configuration you can complete the installation wizard.

After the process completes, the “Database Configuration Wizard” will appear.

5. The first step is related to creating the site name. Since the database was just installed we are not able to change the connection to the SQL Server. Click on “Next”.

6. Create a SQL login to connect with the VIPRE database, just provide the password and click on “Next”.

7. The configuration process starts and it will be completed in a few seconds.

Once these two wizards are complete, we can start configuring our site (the different scopes where the agents will be located). We will run the configuration in the following step.

Configuring VIPRE options

Before creating a new policy for agents we will need to configure our site with some basic information.

The configuration wizard will appear just after we’ve configured the database, but we can set these options at any time just entering the VIPRE console. Here are some of the options we should take a look:

1. Access the “Site Properties” option in the console and the first thing we will see is product registration.

2. In “Agent Installation” we can add the user which will be used for installing the VIPRE agents, make sure this user has sufficient rights to perform the operations.

3. In “Advanced Settings” we can enable “Console Security” that will bring us the possibility to use different type of users to manage VIPRE site.

4. Enabling this option will also enable the options in “Role Administration”, where we can create these types of groups that can only have, for example, read access to the policies we define.

Creating and Configuring a Policy

After we’ve set the basic options in VIPRE console, we can start creating the policy that will apply in the current site.

The default policy created is completely passive, since it does not include enabled most of the options like Active Protection, e-mail security, remediation actions, etc. If we add agents in this policy we will probably not fulfill the security policies in our company.

We’ll take a look at the process for creating a new policy instead of modifying the existing one:

1. In the site name, right-click and select “Add Policy”.

2. Create the name of the policy. This policy will receive the template from the default one, so it will not contain important options enabled.

3. Once created, right click in the policy name and select “Policy Configuration Wizard”.

A new wizard will appear, from where we can set different and interesting options about the security profile we would like to introduce. Since the options here are quite many, I’ll name the most important ones to consider in this case.

4. “User Interaction”: I’m configuring in this case permissive options like “Allow users to remediate manual scans”.

5. “Balloon messages”: We can configure the options and the text the messages will appear in the client.

6. “Communication”: The possibility to integrate VIPRE Antivirus with Microsoft Security Center.

7. “Scanning”: The behavior and schedule for quick and deep scans in clients. Also the type of files included.

8. “Threat Remediation”: The default action taken when a remediation is needed.

9. “Active Protection”: Here we can configure if we prefer VIPRE Antivirus will scan the current files in use for the user. This option can be set in different levels; depending on the level of security we can decrease system performance.

10. “E-Mail Protection”: Options for securing the e-mail applications.

11. “Auto-Agent Installation Scope”: Here we can configure the scope this site will have automatically, meaning that all machines matching with the following options we set here will be included automatically and the VIPRE Agent can be installed silently.

In this example I’m using an LDAP Query, but we can also use machine lists, IP ranges and subnets. After configuring here the scope, remember to click “Resolve” that will translate the parameters into values.

12. Complete the configuration wizard.

There are some other options we can set that I did not mentioned here: Exclusion lists for scanning and active protection; automatically scan external drives (like USB) when they are connected and so on.

Adding and Scanning Agents

After we’ve completed the previous step and if we define the scope correctly we should receive in the VIPRE console the machine names in “Agents”.

In this case I’m using a simple computer:

1. Right-click in the computer name and click on “Install Agents” to check this client’s health ASAP.

2. If the communication ports are open as necessary, the installation process should start in a few seconds. After that, the balloon will appear notifying the presence of VIPRE agent and requesting a reboot.

3. Since we’ve configured VIPRE to connect with Windows Security Center, the first message appearing will be that the agent is turned off. Reboot the machine.

4. After the reboot we will get normal access in the VIPRE Agent since the policy we’ve set earlier allows users to interact with the local application.

5. Remotely we can execute several tasks, including quick or deep scans. We will try a quick scan.

6. Soon as we click in “Quick Scan”, the agent notifies locally that the scanning process has just started.

7. And, again, since the policy allows the interaction, we can verify the scanning process and details in the VIPRE agent window.

8. Once the scan is complete, you will also receive the notification in the VIPRE console.

Generating Reports

Reporting capabilities is a key factor in every type of technology, especially the ones representing a centrally managed service. Fortunately GFI VIPRE Antivirus it is not an exception.

Accessing the “Report Viewer” option in the console, we will receive an incredible set of variables we can configure to retrieve the reports in PDF format.

• Detailed lists of machines infected, threats present, severity, etc.
• List of agents scanned.
• And my favorite: Executive Summary. This report will fit perfectly in cases where you can send reports to upper-management in you company to evaluate a good summary.

This is an example of a complete report: Top 10 infected machines; top 10 threats; severity of threats; etc.

Take note also that we can schedule this reports, so we don’t need to generate these manually.

Conclusions

Here are some of the quick facts I found using this platform:

• Very detailed options to use with a centralized management. In security solutions, not all include the detailed and specific options we can configure centrally without accessing the client machines.
• Excellent possibilities for scaling up. Managing different sites, policies and permissions in the same environment solves a lot of normal implementation models.
• Simple and intuitive. You don’t need any experience handling similar type of platforms, with basic knowledge you’ll get this suite working normally.
• Complete reporting options included.

More Resources

Here are some extra resources you can find for this platform:

• Free trials GFI VIPRE Antivirus download.
• GFI VIPRE Antivirus general features.
• [PDF] VIPRE Enterprise Getting Started.
• [PDF] First Things to Consider When Installing VIPRE Enterprise Products.
• [PDF] VIPRE Enterprise Admin Configuration Guide.

My book “Getting Started with Microsoft Application Virtualization 4.6” has been finally published by Packt and the pre-order waiting game is over :)

This App-V book is available in the following stores and in the following links:

• Packt Publishing
• Amazon.com
• Amazon.co.uk
• Lehmans
• Bookware

Sample Chapter

Also, as a preview of this book, you can download a sample chapter for free!

Chapter 7: Managing Dynamic Suite Composition (DSC)

This chapter provides a complete overview and detailed procedure for using Dynamic Suite Composition in App-V 4.6. A complete explanation about DSC and how these virtual dependencies are being handled by App-V, naming also some considerations and restrictions about its implementation.

App-V Book Overview

As a quick overview of the book, here are some of the topics this book will provide:

• Understand App-V components and its architecture.
• Explore the new and important features of App-V 4.6.
• Set up App-V Management and Streaming Servers to facilitate the centralized management of applications.
• Install App-V Sequencer, Desktop Client, and Remote Desktop Services (Terminal Services) Client to set up the entire environment for application virtualization deployment.
• Prepare and configure different models and implementations of App-V.
• Sequence and publish simple applications, as well as highly complex applications such as Microsoft Office 2010.
• Understand and implement Dynamic Suite Composition (DSC) for interconnected virtual applications.
• Integrate App-V with System Center Configuration Manager (SCCM) to optimize the infrastructure.
• Secure the App-V Environment to ensure safe communication between the server and the clients.
• Install and configure App-V for Remote Desktop Services (Terminal Services) to simplify application deployment and integration.

For more information, check this previous post of mine.

More News Coming Soon

I’m hoping that within the following weeks I’ll giveaway one App-V book (paperback version) among blog readers, so stay tuned!

Also, I would like to share some special thanks included in this book but definitely worthwhile to mention them in this post:

• PacktPublishing crew
• Aaron Parker
• Kevin Kaminski
• Nicke Källén

Other posts in this series:

Deploying Windows 7 + Office 2010 Using Microsoft Deployment Toolkit (MDT) 2010 – Part I

Deploying Windows 7 + Office 2010 Using Microsoft Deployment Toolkit (MDT) 2010 – Part II

Now that we’ve reviewed in Post I of this series how we can complete the initial configurations in MDT 2010, added a clean Windows 7 image and the task sequence to deploy it; and in Post II we’ve imported Microsoft Office 2010 into MDT and configure it for a customized, silent and unattended; in this third part of this series we are going to work directly in the capture and deployment process.

We’ll review how to deploy Windows 7 to a machine, achieving in the same deployment the automated installation of Microsoft Office 2010 and right after that, also automated, capturing that operating system. With a new a customized Windows 7 image we will add it to MDT 2010 for later deployments.

The interesting part about having this customized image imported in Microsoft Deployment Toolkit 2010 is that it can be our base image for all of our users. If you have several type of users in your organization, I’m pretty sure you can find some applications all of these types of users share (Microsoft Office is a good example); using MDT you can deploy this base image plus adding in the Task Sequences the automated deployment of the applications for each user.

Deploying and Capturing Reference Image

Since we have already the Task Sequence created for deploying Windows 7 + Microsoft Office 2010, we only need to use the LiteTouch media created in the Deployment Share to run the deployment wizard.

In my case, I’m going to use the WIM file with a Windows Deployment Services (WDS) server already running in my environment; this way I don’t have to use any local media in the client machine, just using a network connection will do.

1. In the WDS console, right click “Boot Images” and select “Add Boot Image”.

2. Select the LiteTouchePE WIM files existing in the Deployment Share directory of our MDT 2010.

3. Complete the WDS wizard.

4. In the client machine, we can boot from network using F12.

5. Select the LiteTouch Pre-installation Environment (PE).

6. Once the boot image is loaded, we can see that the LiteTouch wizard appears. Select “Run the Deployment Wizard to install a new Operating System”.

7. Type in the domain credentials from which you have access to the Deployment Share created by MDT 2010.

8. Select the Task Sequence created. In my case there’s only one “Deploy Windows 7 Clean Image”. Click on “Next”.

9. Enter the computer name and click on “Next”. Since we are capturing it, the name here has no relevance; the sysprep process will wipe all this information.

10. Select “Join a workgroup” and click on “Next”. If you are going to capture this image, DO NOT SELECT “Join a domain”; if this option is selected the capture step is disabled.

11. Since we are not migrating any user data, select “Do not restore user data settings”, click on “Next”.

12. Select the options in “Language and other preferences”.

13. Select the “Time Zone”.

14. Select the option “Capture an image of this reference computer”, and specify the options for the location and name of the WIM file to be created. Click on “Next”.

Remember that the location can be any shared folder available in the network (the credentials inserted earlier must have read/write permissions to this folder).

15. Review the details and click on “Begin”.

With that, the Task Sequence starts running. The first step will format the hard drives for the operating system deployment.

The operating system installation will start next.

And after a new reboot, the Task Sequence completes the work with the operating system installed and with the user logged in; Microsoft Office 2010 64-bit starts the installation completely automated and silent.

The installation takes a few minutes, and if you want to verify the process completed successfully just access the Start Menu before the machine reboots again.

Before the reboot, the sysprep process starts running which will erase all of the specific information from this operating system related to the machine (computer name, Product Key, SID, etc.).

Once the computer is rebooted, the process for creating the WIM file for this operating system starts; and of course sending that file to the destination folder we’ve chosen.

That process can takes several minutes to complete so you just have to be patient.

Importing the Captured Image into MDT 2010

Once the image has been captured, the importation process is simpler:

1. Open the MDT Console, expand the MDT Deployment Share, right-click “Operating Systems” and select “Import Operating System”.

2. Select “Custom image file” and click on “Next”.

3. Specify the path of the captured WIM file and click on “Next”. Also I’m selecting the option “Move the files to the deployment share…” to optimize disk space.

4. Select “Setup and Sysprep files are not needed” and click on “Next”. Since we’ve already prepared this operating system, there’s no need to include these files.

5. Specify the name for the destination folder and click on “Next”. In my case, I’m using “Windows 7 Pro x64 + Office 2010”.

6. In the summary page click on “Next”.

7. And in confirmation click on “Finish”.

With that, the operating system is imported to MDT 2010.

Creating the Task Sequence for Deployment

We now have the customized operating system imported into MDT, now we just need to create the Task Sequence to deploy it. The procedure is even simpler and we should now be familiarized with the environment to complete it without any problem.

1. Right-click “Task Sequences” and select “New Task Sequence”.

2. Complete the Task Sequence data. Remember to use a different “Task sequence ID” than the selected earlier, in my case “WIN7OFFICE2010”.

3. Select “Standard Client Task Sequence” and click on “Next”.

4. Select the operating system we’ve imported “Windows 7 Pro x64 + Office 2010” (I’ve changed the name for a more friendly one). Click on “Next”.

5. You can specify the product key in this step. Click on “Next”.

6. Complete the “OS Settings” and click on “Next”.

7. Specify the Administrator password or you can skip it. The administrator password set (if we did it) in the image we’ve captured maintains even if we executed sysprep. Click on “Next”.

8. Review the “Summary” and again the process should take a few seconds, once its completed click on “Finish”.

Deploying the Reference Image

We have completed all the configuration steps, and the only thing missing is deploying this image to the client.

1. In a client machine, boot from the network and select the LiteTouchPE boot image we’ve added earlier.

2. Run the “Deployment Wizard” in the same way we’ve executed before.

3. Specify credentials. Click on “Next”.

4. Select the task sequence to deploy the reference image, in my case “Deploy Windows 7 x64 + Office 2010”. Click on “Next”.

5. Join the machine to the domain if you prefer to. Click on “Next”.

6. Since we are not migrating profiles, select “Do not restore user data and settings”. Click on “Next”.

7. Select Language and Time Zone. Click on “Next”.

8. Since the image already has Microsoft Office 2010 installed, there’s no need to install it again. Click on “Next”.

9. Click on “Begin” and the installation process will start.

The operating system will complete its installation in a few minutes.

With that we’ve completed the third part of this series, I’m hoping I’ll prepare a few more about automating even more the deployments and add a few more features in the scenario.

I hope you found this useful.

Other posts in this series:

Deploying Windows 7 + Office 2010 Using Microsoft Deployment Toolkit (MDT) 2010 – Part I

Deploying Windows 7 + Office 2010 Using Microsoft Deployment Toolkit (MDT) 2010 – Part II

Deploying Windows 7 + Office 2010 Using Microsoft Deployment Toolkit (MDT) 2010 – Part I

Deploying Windows 7 + Office 2010 Using Microsoft Deployment Toolkit (MDT) 2010 – Part III

After completing the first post of this series where we’ve installed and configured MDT 2010 Update 1, added a Windows 7 clean image to the Deployment Share and created the Task Sequence to deploy it; in this second part of “Deploying Windows 7 + Office 2010 using Microsoft Deployment Toolkit (MDT) 2010” we are going to work with Microsoft Office 2010 application.

In this post we will add Microsoft Office 2010 as an application in our Deployment Share, and configure the environment to achieve a silent and unattended installation for this suite.

The unattended possibilities for deploying applications in MDT always depend on the application we are using, fortunately Microsoft Office is highly prepared to accomplish this unattended installation, and with the possibility to customize it by easily selecting the features we would like to install in Config.xml answer file.

Adding Microsoft Office 2010 to MDT

Adding applications to Microsoft Deployment Toolkit 2010 requires only running a simple wizard which should not be any problem.

Note

We do need of course the Microsoft Office 2010 binaries, and since we would like to use the unattended possibilities complemented with MDT 2010, we are going to need the installation files we can find in the Office 2010 DVD.

The stand alone installer (for example: en_office_professional_plus_2010_x64_515489.exe) can be used but we cannot edit the properties in MDT console.

Let’s start with the wizard:

1. In the MDT console, expand the Distribution Share we’ve created right-click “Applications” and select “New Application”.

2. Select “Application with source files” and click on “Next”.

3. Complete the information for this new application and click on “Next”.

4. Select the source directory where we can find the “setup.exe” file.

In my case I’m using the DVD which contains the x86 and x64 versions, since we can only add one architecture at a time, you must select one sub folder. And considering we are deploying a 64-bit operating system, I’m going to install the 64-bit Microsoft Office 2010 version.

5. Specify the directory name to be stored, in my case “Microsoft Office 2010 x64”. Click on “Next”.

6. In “Command Line” type “setup.exe” for the installer file to be executed, the “Working directory” can be left with the default option.

7. In “Summary” review the options selected and click on “Next”.

The importation process will start and should not take much longer.

8. Once completed, click on “Finish”.

With the application added we can double click it to access its properties.

As you can see importing a Microsoft Office product includes a tab in the MDT properties called “Office Products” which contains options to simplify the unattended process.

Configuring Office 2010 Unattended Installation

Now that we have the application imported, we can configure a silent, unattended and customized installation of Microsoft Office 2010 within a few steps:

1. In the properties section, select the “Office Products” tab.

2. Select the following options and click on “Apply”:

“Office product to install”: The version you are using, in my case Professional Plus “ProPlus”.
“Office languages”: Language available, in my case “en-us”.
“Product Key”.
“Customer Name”.
“Display Level”: “None”. With this, in the installation process we won’t see any window running.
“Accept EULA”: Enabled.
“Always suppress reboot”: Enabled.

All these options are stored in one file: Config.xml; which is used of course as an answer file for the unattended installation for Office 2010. In this file we must also set the features we would like to install, and the type of installation.

For more information, take a look to this link: Config.xml file OptionState ID values for Office 2010.

3. Click on “Edit Config.xml” to view and edit the unattended installation file. You will see something like this:

We are going to edit this adding the features we would like to install. Here’s an example of the Config.xml file I’ll be using in this series, download it in this link.

I’m ignoring the lines with “<!—” since they are used for comments and examples.

<Configuration Product=”ProPlusr”>
<Display Level=”None” CompletionNotice=”No” SuppressModal=”No” AcceptEula=”Yes” />
<COMPANYNAME Value=”Augusto Alvarez” />
<Setting Id=”SETUP_REBOOT” Value=”Never” />
<AddLanguage Id=”match” />
<AddLanguage Id=”en-us” ShellTransform=”Yes” />
<PIDKEY Value=”xxxxxxxxxxxxxxxxxxxxxxxxx” />
<OptionState Id=”AccessFiles” State=”absent” Children=”force” />
<OptionState Id=”ExcelFiles” State=”Local” />
<OptionState Id=”GrooveFiles” State=”Absent” Children=”force” />
<OptionState Id=”OneNoteFiles” State=”Local” Children=”force” />
<OptionState Id=”OUTLOOKFiles” State=”Local” />
<OptionState Id=”PPTFiles” State=”Local” />
<OptionState Id=”PubPrimary” State=”Absent” Children=”force” />
<OptionState Id=”WORDFiles” State=”Local” />
<OptionState Id=”XDOCSFiles” State=”Absent” Children=”force” />
<OptionState Id=”SHAREDFiles” State=”Local” />
<OptionState Id=”TOOLSFiles” State=”Local” />
<OptionState Id=”EXCELFiles” State=”Local” />
</Configuration>

In this example the following features are being installed: Word, Excel, OneNote, Outlook, Office Tools (like Office Picture Manager, HTML source editor, etc.) and Shared Files. All of this is using the “Local” type of installation, which in this scenario is usually a better choice than “Install on first use”.

Adding Office 2010 to the Task Sequence

With the application imported and the unattended file in place, we just need to edit the Task Sequence we’ve created in the first post to use this application.

1. Expand the Distribution Share, “Task Sequences” and double click on the task sequence we’ve created earlier “Deploy Windows 7 Clean Image”.

2. In the last phase of the task sequence, “State Restore”, click on “Install Applications” and select “Install a single application” where you can select Office 2010 using the “Browse…”

With that, we have Microsoft Office 2010 64-bit added to MDT 2010 and configured for a customized and unattended installation within our Windows 7 deployment process.

In the next post, we will not only deploy this Windows 7 + Office 2010 but we will also prepare for an automated capture of this image and upload it to our MDT 2010.

Other posts in this series:

Deploying Windows 7 + Office 2010 Using Microsoft Deployment Toolkit (MDT) 2010 – Part I

Deploying Windows 7 + Office 2010 Using Microsoft Deployment Toolkit (MDT) 2010 – Part III

When there’s a no direct requirement about the business, people usually avoid the term “cluster” in their platform; mostly just because partial ignorance about the technology. For a long time, no matter if you were using open source platforms, Windows or any other, there was the believing that installing, configuring and maintaining a cluster is just a hard thing to do. The idea within this post is show you in a simple few steps, with no complex requirements, how to create a Windows Server 2008 R2 Failover cluster using another simple and effective solution as StarWind iSCSI SAN.

StarWind iSCSI SAN software represents one of the most popular solutions available in the market to create your own iSCSI shared storage (or Storage Area Network) without the need to acquire expensive hardware solutions. StarWind iSCSI SAN provides also the fastest solution to create, configure and maintaining these type of storage, having the chance to make available LUNs to any operating system capable of using an iSCSI initiator.

Let’s take a look about this step-by-step guide to create and configure a Windows Server 2008 R2 Failover Cluster, here are the steps involved:

1. Review and complete pre-requisites for the environment.

2. Install StarWind iSCSI SAN software.

3. Configure and create LUNs using StarWind iSCSI SAN.

4. Install Failover Cluster feature and run cluster validation.

5. Create Windows Server 2008 R2 Failover Cluster.

1. Review and complete pre-requisites for the environment

Requirements for clustering in Windows Server 2008 R2 changed significantly. You don’t longer need complex aspects for hardware to be compatible with Failover Cluster:

Requirements for Windows Server 2008 R2 Failover Cluster

Here’s a review of the minimum requirements to create a Windows Server 2008 R2 Cluster:

• Two or more compatible servers: You need hardware that is compatible with each other, highly recommended to always use same type of hardware when you are creating a cluster.
• A shared storage: This is where we can use StarWind iSCSI SAN software.
• Two network cards on each server, one public network (from which we usually access Active Directory) and a private for heartbeat between servers. This is actually an optional requirement since using one network card is possible but not suitable in almost any environment.
  When we are using iSCSI protocol for our shared storage Microsoft recommends three network cards on each host: Public network, private, and one dedicated to iSCSI communication from servers to the storage, which in our case will be represented by a server using StarWind iSCSI software.
• Windows Server 2008 R2 Enterprise or Datacenter Editions for hosts which will be part of the cluster. Always keep in mind that cluster is not supported in Standard Editions.
• All hosts must be member from an Active Directory domain. To install and configure a cluster we don’t need a Domain Admin account, but we do need a Domain account which is included in the local Administrators of each host.

Requirements for StarWind iSCSI SAN Software

Here are the requirements for installing the component which will be in charge of receiving the iSCSI connections:

• Windows Server 2008 or Windows Server 2008 R2
• 10 GB of disk space for StarWind application data and log files
• [Highly Recommended] 4 GB of RAM
• 1 Gigabit Ethernet or 10 Gigabit Ethernet.

You can download StarWind iSCSI SAN software using this link, previous registration required.

Optimize TCP/IP stack to improve iSCSI performance

Before using StarWind as iSCSI target it’s recommended you’d "accelerate" TCP/IP stack to make sure it runs at full speed.

1. Enable 9K Jumbo frames for your GbE network adapter.

2. Change the following TCP parameters in the registry: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]

GlobalMaxTcpWindowSize = 0×01400000 (DWORD)
TcpWindowSize = 0×01400000 (DWORD)
Tcp1323Opts = 3 (DWORD)
SackOpts = 1 (DWORD)

3. Reboot.

2. Install StarWind iSCSI SAN Software

Ok, after reviewing and completing the requirements for the environment we should start installing the StarWind iSCSI SAN software.

The product is available for download in this link, and you only need a previous registration first which will also generate the license key you need to register the product.

Installing StarWind iSCSI software is probably the easiest in all of these five steps, since you only need to complete a wizard to accomplish it.

2.1 After you’ve downloaded the installation file, just double click it and the wizard will start.

2.2 Follow the wizard normally as any installation. In the process you will find one of the interesting features about it: You can install the service separately from the console from which you can administer the StarWind iSCSI.

This way you can install the console on any machine compatible to access the server or servers with StarWind iSCSI and manage storage, permissions, etc. In this case, I’ll be selecting the full installation.

The next steps are pretty straight forward so you won’t have any problem. Once the final steps are completed you’ll get a warning about the iSCSI Service needed before installing the StarWind iSCSI Service.

You just need to access the “Services” console and set the service as started and automatic.

After you click install, the process only takes a few seconds and you will additionally see some drivers that will be installed on the operating system; click “Install”.

3. Configure and create LUNs using StarWind iSCSI SAN

With the program installed, using and configuring it won’t give us any trouble.

The StarWind iSCSI console is similar as any other console you may already use it. In the “General” screen we’ll find the summary information plus how to connect to local or remote StarWind host.

In the “Configuration” section we can find the common parameters to configure iSCSI StarWind, for example the “Network” options which enable the iSCSI communications (port 3260) on any of the network adapters identified.

If we are using a special LAN/VLAN to separate our iSCSI traffic as recommended, then we should only enable the IP address used for that purpose.

Now let’s get started with the StarWind configuration.

Configuring StarWind iSCSI

We are going to review the basic steps to configure the StarWind iSCSI to start hosting LUNs for our cluster; the initial task is to add the host:

3.1 Select the “Connect” option and type in the credentials to manage the iSCSI host. The defaults used by StarWind are: User “root”; Password “starwind”.

3.2 With the host added, we can start creating the storage that will be published through iSCSI: Right-click the server and select “Add target” and a new wizard will appear.

3.3 Select the “Target alias” from which we’ll identify the LUN we are about to create and then configure to be able to cluster. In my case I’m using a simple name “w2k8r2-clstr”, click on “Next”.

3.4 Since we are going to be using hard drives to present our storage, in “Storage Type” select “Hard Disk”, click on “Next”.

3.5 In “Device Type” please note that we can use physical as virtual drives to present to our clients using iSCSI. We are going to select “Basic Virtual”, from which we’ll create a file (.img) that will represent the LUN; click on “Next”.

3.6 Select “Image File device” and click on “Next”.

3.7 Since we are creating a new one, select “Create new virtual disk” and click on “Next”.

3.8 In the following screen, select the destination and size for the file we are creating. In my case, I’m using a separate drive where I’m going to save all of my LUNs.

3.9 In the following options leave selected “Asynchronous mode” for the LUN, which will enable multithreaded disk operations (recommended for NTFS file system) and check “Allow multiple concurrent iSCSI connections (clustering)” which, of course, will provide the possibility for several hosts to be able to connect to this image file; click on “Next”.

3.10 In the cache parameters, leave the default options selected “Normal (no caching)”; click on “Next”.

3.11 In the last screen, just click on “Finish” and we’ll have our LUN ready.

As optional and recommended review the options for “CHAP permissions” and “Access Rights”. Within these options we can configure all the parameters needed for secure environments.

Once we’ve completed this, we can access this file from a Windows Server 2008 R2 host.

Configure Windows Server 2008 R2 iSCSI Initiator

Each host must have access to the file we’ve just created in order to be able to create our Failover Cluster. On each host, execute the following:

3.12 Access “Administrative Tools”, “iSCSI Initiator”.

3.13 In the “Target” pane, type in the IP address used for the target host, our iSCSI server, to receive the connections.

In my case, I’ve created two LUNs available for the cluster.

3.14 Click on “Connect” to be authorized by the host to use these files.

Once we’ve connected to the files, access “Disk Management” to verify we can now use these files as storage attached to the operating system.

3.15 And as a final step, just using the first host in the cluster, put “Online” the storage file and select also “Initialize Disk”. Since these are treated as normal hard disks, the process for initializing a LUN is no different than initializing a physical and local hard drive in the server.

Now, let’s take a look about the Failover Cluster feature.

4. Install Failover Cluster feature and run cluster validation

Prior to configure the cluster, we need to enable the “Failover Cluster” feature on all hosts in the cluster and we’ll also run the verification tool provided by Microsoft to validate the consistency and compatibility of our scenario.

4.1 In “Server Manager”, access “Features” and select “Failover Cluster”. This feature does not need a reboot to complete.

4.2 Once installed, access the console from “Administrative Tools”. Within the console, the option we are interested in this stage is “Validate a Configuration”.

4.3 In the new wizard, we are going to add the hosts that will represent the Failover Cluster in order to validate the configuration. Type in the server’s FQDN names or browse for their names; click on “Next”.

4.4 Select “Run all tests (recommended)” and click on “Next”.

4.5 In the following screen we can see a detailed list about all the tests that will be executed, take note that the storage tests take some time; click on “Next”.

If we’ve fulfilled the requirements reviewed earlier then the test will be completed with no warning.

We can also have a detailed report about the results on each test.

5. Create Windows Server 2008 R2 Failover Cluster

At this stage, we’ve completed all the requirements and validated our configuration successfully. In the next following steps, we are going to see the simple procedure to configure our Windows Server 2008 R2 Failover Cluster.

5.1 In the “Failover Cluster” console, select the option for “Create a cluster”.

5.2 A similar wizard will appear as in the validation tool. The first thing to do is add the servers we would like to cluster; click on “Next”.

5.3 In the next screen we have to select the cluster name and the IP address assigned. Remember that in a cluster, all machines are represented by one name and one IP.

5.4 In the summary page click on “Next”.

After a few seconds the cluster will be created and we can also review the report for the process.

Now in our Failover Cluster console, we’ll get the complete picture about the cluster we’ve created: Nodes involved, storage associated to the cluster, networks and the events related to cluster.

We will close up our step-by-step guide here and open the clustering series for maybe a detailed explanation about type of Failover Clusters, including Multi-Site cluster which I had the chance to present on a Microsoft event here in Buenos Aires.

Conclusions

After reviewing the process to create clusters using StarWind iSCSI SAN software, here are some of the things I’ve noticed:

Pros

• StarWind iSCSI software is a simple tool to install and simpler to use and administer shared storage; not only for using it in a Failover Cluster, but for all scenarios when we need shared storage.
• If we have the proper environment for iSCSI, StarWind iSCSI can save us a lot of money comparing the costs of an enterprise hardware solution to use iSCSI.
• The tool provides also important differences with other similar in the market, for example, granularity of permissions we can achieve to guarantee a secure environment.

Cons

• Setting up the right environment for iSCSI using StarWind can represent a complex situation. There is no golden rule, this “right environment” depends on a proper sizing and planning about the scenario and the services we’ll be providing; but for scalable and powerful solution you would probably need SAS hard drives, 10gb network cards, possible NIC teaming and other configurations.
  Even though we are discussing this as a negative aspect, still is common sense to think about this complex scenario as a trade-off for an expensive hardware solution.
• The price seems very accessible for most companies, but StarWind removed the free version of this tool. I hope they can bring it back any time soon; fits perfectly when we want to make our own simple labs, or like in my case that I’ve used several times in presentations :)

More Resources

Here are more resources to look into for Windows Server 2008 R2 Failover Cluster and StarWind iSCSI Software:

• Understanding Requirements for Failover Clusters: http://technet.microsoft.com/en-us/library/cc771404.aspx
• iSCSI Cluster Support: Frequently Asked Questions: http://www.microsoft.com/WindowsServer2003/technologies/storage/iscsi/iscsicluster.mspx
• Creating a Cluster in Windows Server 2008: http://blogs.msdn.com/b/clustering/archive/2008/01/18/7151154.aspx
• StarWind iSCSI SAN: Quick Start Guide: http://www.starwindsoftware.com/starwind-iscsi-san-quick-start-guide
• StarWind SAN Sizing Guide: http://www.starwindsoftware.com/san-sizing-guide
• StarWind iSCSI SAN Software Manuals: http://www.starwindsoftware.com/technical-papers
• StarWind iSCSI SAN Software White Papers: http://www.starwindsoftware.com/white-papers
• iSCSI SAN Storage Videos and Webcasts: http://www.starwindsoftware.com/videos
• Windows Server 2008 Failover Clusters: Networking (Part 1): http://blogs.technet.com/b/askcore/archive/2010/02/12/windows-server-2008-failover-clusters-networking-part-1.aspx
• Simple Clustering with Hyper-V: http://technet.microsoft.com/en-us/magazine/2009.04.geekofalltrades.aspx?pr=blog

Finally the writing process is complete, and my App-V book is just around the corner: “Getting Started with Microsoft Application Virtualization 4.6”. The book is available for pre-order in Pack Publishing website and in Amazon.

An overview about what we will cover:

• Publish, deploy, and manage your virtual applications with App-V.
• Understand how Microsoft App-V can fit into your company.
• Guidelines for planning and designing an App-V environment.
• Step-by-step explanations to plan and implement the virtualization of your application infrastructure.

As an exclusive note, here’s the list of chapters that will be included (chapter’s name could vary in the final release.):

1. Introducing Application Virtualization in a Virtualized World.
2. Understanding App-V Architecture.
3. Preparing your App-V Environment and Installing App-V Management Server.
4. Deploying the App-V Sequencer, App-V Desktop Client and Streaming Server.
5. Taking the Initial Steps in the Sequencing Process.
6. Sequencing Complex Applications.
7. Managing Dynamic Suite Composition.
8. Integrating App-V with System Center Configuration Manager 2007 R2.
9. Securing your App-V Environment.
10. Reviewing App-V for Remote Desktop Services (Terminal Services).

Here’s also a summary about what you will learn in this book:

• Understand App-V components and its architecture.
• Explore the new and important features of App-V 4.6.
• Set up App-V Management and Streaming Servers to facilitate the centralized management of applications.
• Install App-V Sequencer, Desktop Client, and Remote Desktop Services (Terminal Services) Client to set up the entire environment for application virtualization deployment.
• Prepare and configure different models and implementations of App-V.
• Sequence and publish simple applications, as well as highly complex applications such as Microsoft Office 2010.
• Understand and implement Dynamic Suite Composition (DSC) for interconnected virtual applications.
• Integrate App-V with System Center Configuration Manager (SCCM) to optimize the infrastructure.
• Secure the App-V Environment to ensure safe communication between the server and the clients.
• Install and configure App-V for Remote Desktop Services (Terminal Services) to simplify application deployment and integration.

This book represents a lot of months of hard work and I’m hoping it will cover all of the common topics for any IT professional who wants to start working with Microsoft Application Virtualization, understanding the basic concepts, and receive the guidelines for installing, configuring and deploying the entire App-V environment, and of course achieve the abilities to master Application Virtualization in complex scenarios.

The book will be available in the paperback as well as in eBook version.

The official release date for the book is not available just yet, but you’ll be hearing the confirmation soon enough; including the special acknowledgements for a lot of people who I had the chance to work with in the writing process of this book.

For more information and pre-order, access the detailed description for “Getting Started with Microsoft Application Virtualization 4.6”.

As I mentioned a few days ago, I had the chance to present for the fourth time in a row in the most important academic event from Microsoft, here in Buenos Aires, Code Camp 2010.

As last year’s event, Code Camp 2010 had over 50 conferences running all day regarding not only IT stuff but also developing, gaming, software architecture, cloud computing, etc.

Here’s a short summary of my presentations: “Hyper-V en Windows Server 2008 R2 e interoperabilidad con Linux” (“Hyper-V R2 and interoperability with Linux”) and “Windows 7 Para todos” (“Windows 7 for Everyone”).

Hyper-V R2 and Linux

I presented this topic with another IT geek Guillermo Sanchez, where we started with an overview about hypervisors architecture, Hyper-V basics and then some interesting demos with Linux virtual machines.

The main idea in this presentation was talk about Hyper-V Integration Services working in Linux virtual machines: Benefits and how to install IS in SUSE Linux Enterprise Server (SLES) and Red Hat. Plus, some bonus features about virtual machines backups and interoperability with other platforms.

The presentation can be downloaded from this link.

Also, Guillermo posted the video on his blog.

Migrating Windows XP to Windows 7

The main idea of this conference was talk about how simple is migrating Windows XP machines to Windows 7 using Microsoft Deployment Toolkit (MDT) 2010, including also the migration of user profiles maintaining even Internet Explorer history.

We’ve started talking about common scenarios and problems we usually find in the migrating process of operating systems. Using the MDT 2010 console I had the chance to show the simple process for creating the necessary environment to achieve a migration: How to create a deployment share, import an operating system, create a task sequence, automate deployments with CustomSettings.ini and Bootstrap.ini, using MDT database.

And of course a live demo where we refreshed a Windows XP machine with a functional profile (My Documents, My Pictures, IE Favorites, etc) to a Windows 7 machine with the same profile imported.

The presentation can be downloaded from this link (Code Camp official site) or directly from here.

Once again I have the pleasure to present at the Microsoft’s academic event of the year: Code Camp 2010 (Buenos Aires). This year, also repeating with two more tracks: Hyper-V and interoperability with Linux; and Migrating Windows XP to Windows 7 with MDT 2010.

The event will take place in Universidad de Palermo (Mario Bravo 1050 – Buenos Aires), this Saturday, September 4th; starting at 9AM. The registration link can be found here.

Since the description is in Spanish, let me translate the abstract:

“Hyper-V en Windows Server 2008 R2 e interoperabilidad con Linux” (Hyper-V in Windows Server 2008 R2 and interoperability with Linux): Taking a review about using Linux virtual machines in Hyper-V; compiling and installing “Integration Services” for Linux and backing up virtual machines with Data Protection Manager 2010 (DPM). I’ll be presenting with Guillermo Sanchez.

“Windows 7 Para Todos” (Windows 7 For Everyone): Migrating Windows XP with Microsoft Deployment Toolkit 2010 (MDT 2010) within easy steps, maintaining all user’s configurations including Internet Explorer favorites.

Review Code Camp’s complete schedule here.

See you then!

A good backup solution and strategy in our organization is a key factor when we want to talk about continuity in our business. Unfortunately not all companies discuss this issue as an important matter.

Just to avoid the responsibility and the cost, I’ve seen organizations which decided not to implement a solution for backing up users’ data or just deciding using uncomfortable and ineffective strategies like “the user is responsible of maintaining their own backups”.

GFI provides another suite to simplify a lot of the work we usually have as IT guys: GFI Backup Business Edition. This software contains many features we usually look for in any number of platforms, and can lead us into a simple and efficient environment to maintain our company’s backup:

• Easy and straight-forward configuration and deployment.
• Centralized web-based administration interface
• Supporting file, web and SQL Servers.
• Email notifications about scheduled backup tasks.
• Supporting Windows Volume Shadow Copy Service (VSS).
• High encryption levels to protect the backups: 256-bit AES.

To understand a little bit more about the components involved in GFI Backup 2010, take a look to his graphic:

Also, for home users GFI provides a special suite; with very similar features and completely free for use. Take a look to it in GFI Backup Home Edition web site.

Ok, we can start working with this tool.

Requirements

GFI Backup 2010 does not require large capacities in hardware nor complex software configurations. The supported characteristics for server and clients are the same:

Operating System

Supported operating systems:

• Microsoft Windows 7 (x86 or x64)
• Microsoft Windows Server 2008 (x86 or x64)
• Microsoft Windows Vista (x86 or x64)
• Microsoft Windows Server 2003 Standard/Enterprise (x86 or x64)
• Microsoft Windows XP (x86 or x64)

Minimum Hardware

• Processor: Intel Pentium 4 or higher.
• Memory: 512mb or higher.

Communication

An important matter we should consider before implementing this solution are the necessary ports for the communication between the agents and server:

• TCP 5580
• TCP 5543

These ports can be customized in the installation process.

Installing GFI Backup 2010

The installation process, as any GFI product, simple and very intuitive:

1. Download the installer from GFI Backup 2010 Business Edition Site. A free registration is required.

2. Double click the installer, and follow the steps on the GFI Backup wizard.

The steps involved, as said, are simple and you should not have any problem at this stage.

3. In “Connection Settings” we can configure the HTTP/HTTPS ports used.

If the computer uses more than one IP, we should select it in this stage; since this is the only IP which will be reachable for GFI Backup agents.

4. In “Credentials” introduce the username and password which will be used for the installation of this tool.

5. Complete the installation.

Once the installation is completed, the “Startup Wizard” will appear; which will require two things: credentials for the backup console and credentials for the backup/restore tasks necessary for agents.

6. Complete the administrator console credentials and the following for client agents.

Once we login to the Backup console, we will see a centralized dashboard where we can check the status and reports about the backup environment.

Deploying GFI Backup Agents

For deploying GFI Backup client agents we have two basic possibilities: Group Policy deployment (recommended for a large number of users) and manual installation.

Any of the options involved will require the agent installer and XML file for the deployment. These can be found in “%ProgramFiles%\GFI\GFI Backup 2010 Administration Console\htdocs\agent”

Group Policy Deployment

As any software installation through group policy, the preferred is the MSI file we can find in the mentioned folder.

1. Copy the files to a shared folder accessible for client machines.

2. Create a new GPO using Computer Configuration > Policies > Software Installation.

Remember you will need to reboot the machines in order for the software to be installed.

Manual Installation

The manual installation only requires double clicking the agent installation file in the client machine, and following the wizard.

Configuring a Backup Task

Again, configuring a backup task can take just a few seconds in seven simple steps:

1. As said before, we have the possibility to backup files & folders or SQL Server databases. In this example we will use files and folders.

2. We can choose to store this backup by using Local or external drives, shared folder, FTP location, CD/DVD media or even tape backup.

A new wizard will appear which we can complete very easily.

3. Complete the backup task name.

4. Select the client computer we would to extract the backup.

5. Retrieve the source folder/files we are looking for. It could take a few seconds, depending on the connection we are using.

6. Select the destination for the backup.

7. This step contains several options about how the backup will be stored and secured: Creating a ZIP files or not; encryption level; incremental, differential or full backup; or using versioned backups.

8. The “Scheduler” options include several interesting we can apply in various scenarios: Running the backup on Windows startup or shutdown, for example.

9. Also other very interesting features are presented in “Pre & Post Actions”: What to do before and after the execution of the backup; verification of the files; etc.

At this point we can also configure the mail notifications about the backups.

10. Soon as the wizard completes, we can run the backup to verify everything is configured OK.

And monitor it in the “Reporting” area, where we can verify all the backup tasks status.

Configuring a Restore Task

If you thought the backup process was simple, just wait to take a look to the restore process; where we can also configure to restore files/folders or databases in the original location as well as an alternate.

1. Select the type of restore you would like to execute: Full or item-level.

2. Select the “Source” backup, where you can also mark the option “Restore to a different location”.

Other Options

By clicking on “Settings” in GFI Backup dashboard we can set some of the features we’ve discussed earlier:

• Using and configuring Volume Shadow Copy Service (VSS)
• Tasks priority.
• A central location for the backups.
• Product Updates.
• Etc.

Conclusions

Here’s a short summary of thoughts about this tool:

- No large or complex requirements for the installation. Supporting all common operating systems available, makes this tool really easy to find a place in our environment.

- Really simple to install and configure. We don’t need any experience with similar backup tools to configure and put this suite into production.

- Nice monitoring and reporting options. E-mails digest and the GFI Backup dashboard makes this tool very easy to maintain.

- As a con in this tool we can find the scope of the backups we can execute. There’s no possibility to retrieve system state backups or any other rather than files and databases.

- Another possibility not included is the option to deploy automatically client agents from the console, avoiding the use of Group Policies or manual installations.

Implementing a larger and complex backup solution could end up on making this vital task obsolete, with no people around it to maintain the health of the tasks and the backups itself. GFI Backup 2010 can simplify this providing a straight-forward solution which we can implement in just a few minutes. With no special configurations required for servers and clients can takes a lot of time for troubleshooting.

Deploying Windows 7 + Office 2010 Using Microsoft Deployment Toolkit (MDT) 2010 – Part II

Deploying Windows 7 + Office 2010 Using Microsoft Deployment Toolkit (MDT) 2010 – Part III

I’ve started (finally!) re-editing a set of posts created a while ago: “Microsoft Deployment Toolkit 2010 Beta 1: Using MDT to Prepare, Install and Capture Customized Windows 7 Images”: Part I, Part II and Part III. Within those posts we had the chance to review some step-by-step procedures to create customized images of Windows 7, including Microsoft Office 2007 and achieve an automatic deployment; using always the Beta version of Microsoft Deployment Toolkit 2010.

Now we are going to evaluate some interesting step-by-step procedures for automated deployment of Windows 7 + Microsoft Office 2010 using Microsoft Deployment Toolkit (MDT) 2010.

The current version of this free deployment tool is Microsoft Deployment Toolkit 2010 with Update 1. This latest update brings some nice improvements:

• Comprehensive tools and guidance to efficiently manage large-scale deployments of Microsoft Office 2010.
• A new User-Driven Installation (UDI) deployment method that utilizes System Center Configuration Manager. UDI lets end users initiate and customize an OS deployment on their PCs—via an easy-to-use wizard.
• Automatically detects the true supported platforms for drivers, reducing deployment issues.

As in the previous set of posts, using the final and latest version of MDT 2010, we will use the Lite Touch Installation (LTI) for the deployment of Windows 7. For the Zero Touch Installation of Windows 7 we can use Microsoft Deployment Toolkit 2010 with System Center Configuration Manager 2007 R2 SP2.

Note: Only using SCCM 2007 with SP2 is the supported platform for deploying Windows 7; prior this release, the environment is not supported to use Configuration Manager Operating System Deployment (OSD).

What We Are Going To Do?

These posts will represent a step-by-step procedure for the following tasks:

• · Install and configure Microsoft Deployment Toolkit 2010 – Update 1.
• · Create a Task Sequence and deploy clean Windows 7 images.
• · Adding and configuring Microsoft Office 2010 in MDT 2010 for deployment.
• · Creating and capturing a reference image of Windows 7 and Microsoft Office 2010.
• · Automatic deployment of the customized Windows 7 images with Microsoft Office 2010 installed.

Requirements

Before starting with any procedure we need to review the requirements for the environment. In my case I’ll be using:

• Active Directory and DNS infrastructure working and operational.
• DHCP configured with Windows Deployment Services (WDS).
• Windows Deployment Services (WDS) configured.
• Windows 7 source files.
• Microsoft Office 2010 installation files.

Note: This previous post of mine shows how WDS must be configured to work together with DHCP.

As in software and features necessary:

• Windows Automated Installation Kit (WAIK) 2.0. You can download it from here.
  Note: The download page indicates that the WAIK version is “1”; but don’t worry, the actual version is 2.0.

• · MSXML 6.0.
• · PowerShell.
• · .Net Framework 3.5 SP1. Available for download here.
  Note: Even though .Net Framework 2.5 SP1 is not a requirement for MDT 2010 installation; one of its features, User-Driven Installation (UDI), does requires the latest Microsoft Framework installed.

Here’s a message you will see when you try to run the UDI launcher:

MDT 2010 Installation

As for all the Microsoft Deployment Toolkit versions, the installation is a straight forward procedure: Just download, execute the installer and complete the installation wizard.

Once installed, we can access any of the components from the “Start Menu”.

One of the coolest options we can find in Microsoft Deployment Toolkit 2010 (and in most of Microsoft platforms) is the idea of designing the User Interface as places to find everything you need to know about what to do next.

“Getting Started”: All the steps involved to get MDT 2010 functional.

“Documentation”: All necessary links to start working with the tool.

Also another important section is “Components” where we can verify that all necessary requirements were installed (plus other optional installations).

Adding a Clean Image to MDT 2010

With the application installed, we can now start working directly with the operating system deployment. The configurations needed in MDT 2010 maintains as the Beta version and the older versions of the Deployment Toolkit.

The process is the following:

1. Create the distribution share.

2. Add operating system files to the distribution share.

3. Create a task sequence for the reference computer.

Creating the Distribution Share

1. In the MDT Console, right click on “Deployment Shares” and select “New Deployment Share”.

2. In the wizard, click on “Browse”.

3. Select a folder where you want to store all the binaries (applications, operating system, etc.) MDT will use. As a recommendation use a separate partition.

4. Click on “Next”.

5. Accept the name of the “Share Name” and click on “Next”.

6. In the next page we can add a short description for the distribution share. Click on “Next”.

7. Ensure that the option “Ask if an image should be captured” is checked and click on “Next”.

8. Another option we can select in this stage is if we are going to let users who are deploying an image can set the local administrator password. In large environment this is normally not recommended since not all users in charge of the deployment should be local administrators of the operating systems.

Click on “Next”.

9. Leave deselected also the option for “Ask user for a product key”. This option will be set in the task sequence of each operating system deployment. Click on “Next”.

10. Review the “Summary” page and click on “Next”.

11. Wait for the process to complete and click on “Finish”.

Once the process completes, we should see this in our MDT 2010 Management Console.

Adding Windows 7 Operating System

Once the deployment share is created, the next step is to add the files from the Windows 7 image. In my case I’ll be using a Windows 7 64bits image.

1. In “Deployment Shares”, expand the deployment share we’ve just created, right click “Operating Systems” and select “Import Operating System”.

2. Since this is a clean image from the Windows 7 media, select “Full set of source files” and click on “Next”.

3. I’m selecting the D:\ directory since I have attached the Windows 7 media in this drive. Click on “Next”.

4. Select the “Destination directory name” and click on “Next”.

5. In the “Summary” page click on “Next”.

6. Once the process is complete, click on “Finish”.

In my case, the images added will look like this in the MDT console.

Creating the Deployment Task Sequence

Now we have the distribution share with a clean image of Windows 7, we can create a task sequence to deploy the operating system.

1. In “Deployment Shares”, expand the deployment share created, right click “Task Sequences” and select “New Task Sequence”.

2. Insert a “Task Sequence ID”, I’m using “WIN7”. And a “Task Sequence name”, in my case “Deploy Windows 7 clean image”. Click on “Next”.

3. Accept the default option in “Template”: “Standard Client Task Sequence”. Click on “Next”.

4. Select the operating system to deploy. Since I have several options, I’ll be using “Windows 7 Professional”. Click on “Next”.

5. The “Product Key” section can be used to not specify a key at this point. Click on “Next”.

6. Complete the information about the registered user and click on “Next”.

7. In my case I’m also selecting the local Administrator password. Click on “Next”.

8. In the “Summary” page click on “Next”.

9. Once the process is complete we can click on “Finish”.

Note there’s an option of “View Script”, which we can use to retrieve an automated script to use for every time we want to create a similar Task Sequence (we only need to change the values used)

Once the Task Sequence is added, we should see something like this:

10. The process is completed once we update the Deployment Share. In the Deployment Share name, right click and select “Update Distribution Share”.

11. Leave selected the option for “Optimize the boot image updating process”. Click on “Next”.

12. Click on “Next” on “Summary”. This process can take a few minutes since it will be creating new files, including the boot images “LiteTouchPE_x86.iso” and “LiteTouchPE_x64” which can be used for the clean operating system deployment.

Within this process the Distribution Share is populated with several files which will be used in the operating system deployment. Even though we didn’t use the option, Microsoft Deployment Toolkit also includes the section for “Out-of-box Drivers”.

The drivers section includes a simple wizard where we can add device drivers into the operating system deployment. Using only the “.inf” files from these drivers, we can add the components directly; but always remember to use the “Update Distribution Share” once those are added; with that the drivers are injected automatically.

In the next post we will add Microsoft Office 2010 to MDT 2010, the Task Sequence involved and configuring this application for a silent install.

Stay tuned!

Other posts in this series:

Deploying Windows 7 + Office 2010 Using Microsoft Deployment Toolkit (MDT) 2010 – Part II

Deploying Windows 7 + Office 2010 Using Microsoft Deployment Toolkit (MDT) 2010 – Part III