Vista Black Screen of Death and Altiris SVS

0
Filed under Altiris, HowTo, SVS, Vista

When we rolled out the HP 2730p tablets to Staff last year, we decided to try out the Altiris software virtualisation (SVS).

Since it came bundled with our Altiris purchase it seemed like the easiest choice for getting into software virtualisation. We had tried the demo for VMWare’s Thinapp but were discouraged by the pricing and had been impressed with demos if Microsoft App-V. Software virtualisation would let us have a much smaller SOE with just Vista, Office 2007 and the Adobe CS4 Master Collection, and have every other application installed as an SVS layer. This way we could reduce the time needed for imaging and control the application deployment through Altiris. We could also enable the web portal which would let Staff select which SVS layers they’d like deployed to their machine!

Since the 2730p machines have been imaged, we’ve had a few come back because Vista seems to hang on a black screen after the green progress bar on boot up

Vista Green Bars

The problem seems to be with a driver for SVS (fslx.sys) and after browsing the web for reasons why we’ve had this issue found that it may be a problem with one of the SVS packages we’ve deployed.

A thread on the Symantec forums details some of the SVS KSOD issues that people have had and found that troublesome SVS layers are the culprit. This thread confirmed our suspicions that we were having trouble with SVS packages that we’d made for applications like Skype and iTunes that have regular/frequent updates. The files in the SVS layer can’t be updated when there’s an update or patch for an application. With software virtualisation on the rise it would be handy if the application knew it was virtualised and would warn the user that new versions can’t be installed until the virtualised application is removed.

Anyway, here’s the fix:

· Boot the machine into Safe Mode

· Login as Admin

· Rename C:\Windows\system32\drivers\fslx.sys to C:\Windows\system32\drivers\fslx_old.sys

· Restart the machine

This will disable SVS and all the SVS layers. We’ve had some success with updating the SVS software to a slightly newer version, though, in most cases we’ve still had trouble after updating the SVS client. The best bet is to work out which SVS layer us causing the problem and disable it. Easier said than done.

We’re yet to decide if we’ll consider SVS for the 2010 Staff image. If we do, we’ll have to exclude applications like iTunes and Skype and try to avoid the black screen issues. We also need to decide if we’re going to move to Windows 7 for this image and whether it will be 32 or 64bit. Symantec have released the beta version of Symantec Workspace Virtualization,new version of SVS, which is compatible with 64bit Windows but it’s unlikely that the final version will be released in time for our internal testing.

Netbooks: Setting Student as Admin’s during deployment

0
Filed under Altiris, Code, HP, HowTo, Netbook, Scripting, VBS

3761637114_47d8ac8cf0 As part of our config for the Student Netbook SOE, we’re going to make each Student an Administrator on their netbook. We don’t want to make every student an administrator on the machines, because of the security/privacy issues that may arise. If every Student is an administrator then it’s possible for them to log onto another Students machine and look/edit/delete/copy their files.

When we unboxed the netbooks we attached our Asset tags (BGSID) and used the barcode scanner to grab the BGSID and Serial for each netbook and put them into Excel. We thought we could use this data and run a post imaging script from Altiris to set the student admin on each machine after they’re sysprep’d and before they’re given out to Students.

We created a SQL database with one table, see below. The image shows our test data, but we’re able to copy the BGSID’s and Serials from the spreadsheet to the database and assign a username for each netbook. The database also has a field for MachineName, which is blank initially and is populated when the script is run. Altiris automatically names the machines, according to the template we’ve specified, but we thought it would be handy to grab the machine name and store it next to the Serial as the machines are assigned to Students.
We can also be sneaky, and use the StudentUserName field to query AD and grab the Student’s firstname and surname to make sticky labels for their machine and maybe their bags too… will see

image001

‘______________________ Start SetStudentAdmin.vbs __________________________
‘Option Explicit

dim adoConn, adoRS, adoStrm
Set adoConn = CreateObject(”ADODB.Connection”)
Set adoRS = CreateObject(”ADODB.Recordset”)
Call GetBGSID

‘_______________________________________________________________________

Sub GetBGSID()

Dim NetBookSerial

winmgmt1 = “winmgmts:{impersonationLevel=impersonate}!//.”
Set SNSet = GetObject( winmgmt1 ).InstancesOf (”Win32_BIOS”)

for each SN in SNSet
NetBookSerial = SN.SerialNumber
Next

adoConn.Open “Provider=SQLOLEDB;Data Source=lumberjack;User ID=sa;Password=12345;Initial Catalog=Netbooks;”
adoRS.Open “select * from netbooks where (Serial = ‘” & NetBookSerial & “‘)”, adoConn, 1, 3

Set objWshNet = CreateObject(”WScript.Network”)
strDomain = objWshNet.UserDomain
strComputer = objWshNet.ComputerName
Set objGroup = GetObject(”WinNT://” & strComputer & “/Administrators,group”)

strUser = adoRS.fields.item(3)

Set objUser = GetObject(”WinNT://” & strDomain & “/” & strUser & “, user”)

If Not objGroup.IsMember(objUser.ADsPath) Then
objGroup.Add(objUser.ADsPath)
End If
adoRS.fields.item(4) = strComputer

adoRS.Update
adoRS.Close
adoConn.Close

End Sub
‘______________________ End SetStudentAdmin.vbs ___________________________

Netbook 2010 SOE

0
Filed under Netbook, Project

We’ve confirmed our SOE for the Student Netbooks for the 2010 pilot program. Nathan Hargreaves confirmed the final list yesterday. The image will be based on Windows 7 Professional with Office 2007 with:

Access
Acrobat Reader 9
Audacity
ClickView Player
Excel
Flash Player 10
Google Earth
Interactive Atlas CD 1.4
Internet Explorer 8
iTunes
Java Runtime Environment 6
Maths Dimensions 9
Office Live Addin
OneNote
Outlook
Photoshop Elements 8
PowerPoint
Premiere 8
Quicktime
Shockwave Player
Silverlight
Visio
VLC Player 1.0.3
Windows Media Player
Word

We’ve decided that the netbooks will added to our domain, which will let the Students use their AD username and password and will provide seamless authentication for web mail, internet access and home drives on he network. We’ll also be able to use EAP-TLS with machine certificates for authentication on the new N wireless network, and we can use Group Policies to set mapped drives, installed network printers and control power settings.

It’s much more work on our behalf to have these machines on the domain and a lot more testing to make sure that the Students get the user experience that they need on the netbooks but still have the same policies, settings and restrictions on our desktop machines. The Students will all be administrators on their netbooks and will be able to install applications and change settings as they like. Finding the balance between letting the Students have the control that they need to feel ownership over the device and controlling GPO settings to ensure a seamless experience on campus will be the trick with having a successful SOE.

Too Cool for School

0
Filed under HP, Netbook, Project

HP-Mini-5101-Bussiness-Netbook-left

Recently our Headmaster announced that the School was going to trial a 1:1 netbook program with out Year 9 Students. Currently our Students use desktops in Computer Labs and some class sets of notebooks with the same SOE that’s installed on our desktops. The move to netbooks will create new challenges for our Staff, especially with some of the requirements, most notably that Students will need to have administrator access to their netbooks.

The device that we’ve selected for the trial is the HP Mini 5101 which has the same spec’s as the other netbooks, except we’ve optioned these with the HD screen(1366×768) and a 6 cell battery. The SOE that we’re building for the trial includes Windows 7 Professional, Office 2007, Visio, Adobe Photoshop Elements and Premiere Elements. The SOE is pretty simple and the Students can add any other apps that they need when they’re handed over. The only problem with the software has been the Adobe licensing, which has been summed up by Rob Flavell on Learn | You | Good to perfection.

Since we’ve only ever had a notebook program for Academic Staff, we’ve been talking to colleagues at School’s with successful Student notebook programs to help work out a successful plan for Grammar. We want to the Students to feel ownership over the device which will help motivate them to look after their machines and reduce damage and support requests. However, we want the machines to be on the network, on the domain, and be able to push settings and updates out to the Student’s netbooks and ensure they have the correct printers installed, drive mappings and other group policy settings.

During the year we spoke to a School that has a notebook program for their Students(year 7-12) and their IT Staff have 3500 re-image jobs per year. This worked out to be 2 or 3 reimages for each machine in the School which is probably a full time job for someone! We’ve kept this in the forefront of our minds when planning the SOE for the netbooks even though we’re only deploying 150 machines for the pilot, we have to assume that the pilot will be a success and that before long we’ll have 600-700 netbooks to manage.

We’re dealing with the possible flood of reimaging requests with a two pronged attack. The SOE will have two partitions, one for the OS and one for Student data, and we’re working on an imaging method that the Students can run themselves. The dual partitions are setup with the Windows 7 users folder moved to the second partition and creating a junction/symbolic link to the new location, nice explanation from Scott Hanselman here. This setup allows us to reimage the partition with the OS and programs, and leave the data intact. Once we’re confident with the reimaging we won’t need to worry about backing up the Student’s data before reimaging their machine. The Student self imaging will work, at the moment, using a separate imaging VLAN and getting the Students to boot their machine from the network card and loading a custom Altiris WinPE boot image. We looked at options for imaging the netbooks from a hidden partition or via a USB HDD, but we need the imaging job to be initiated by Altiris so the computer will get the right name and settings etc during the sysprep process.

So that’s just the start, we’ve placed the order for the netbooks with HP and should have delivery before Christmas, and will need to have them finished and ready for the Students at the end of January. As we find problems or something interesting the image, netbook or how we’re supporting them, I’ll post here.

Exchange 2007 Edge Server Licence

0
Filed under Exchange, HowTo, PowerShell, Scripting, Server

Earlier this year we migrated our Exchange 2003 setup to Exchange 2007 and all was going well for a while. Until we had noticed that our Edge Server thought it was unlicensed, even though we’d entered all the licence info as part of the initial Exchange config. A quick search found this handy PowerShell command for setting, or resetting, the Product Key for our Edge Server. I’m still impressed with how much PowerShell can do in Exchange/Windows, its definitely worth investing the time to learn.

< Power Shell CMD >
[PS] C:\Windows\System32>get-ExchangeServer

Name                Site                 ServerRole  Edition     AdminDisplayVersion
—-                —-                 ———-  ——-     ————–
JACKAL             BGS                  Mailbox,… Standard    Version 8.1…
CARLOS            BGS                  ClientAc… Standard    Version 8.1…
EDGE                BGS                  Edge        Standard… Version 8.1…
ZORO               BGS                  ClientAc… Standard    Version 8.1…

[PS] C:\Windows\System32>set-ExchangeServer Edge -ProductKey xxxxx-xxxxx-xxxxx-xxxxx-xxxxx
[PS] C:\Windows\System32>get-ExchangeServer

Name                Site                 ServerRole  Edition     AdminDisplayVersion
—-                —-                 ———-  ——-     ————–
JACKAL             BGS                  Mailbox,… Standard    Version 8.1…
CARLOS            BGS                  ClientAc… Standard    Version 8.1…
EDGE                BGS                  Edge        Standard    Version 8.1…
ZORO               BGS                  ClientAc… Standard    Version 8.1…

[PS] C:\Windows\System32>

HP 2730p: machine is not in committed state

0
Filed under HP, Hardware, HowTo, Notebook, WTF

hp2730pA couple of weeks ago we ran into problems with our new fleet of 2730p Tablets where the machines weren’t booting into Vista. We had a version of the Black Screen of Death, KSOD, that was caused by something upsetting the Altiris SVS client on these machines. While we were troubleshooting the KSOD we tried  updating one of the machines with the latest drivers including the latest BIOS update for the machine from HP. After updating the BIOS to F.0A 31 Jul 2009, the machine rebooted and gave us this error as soon as the machine was powered on:

WARNING!!! – machine is not in committed state!

After some quick Googling I found others had the same issue after a BIOS update on various HP models. Resetting BIOS defaults and installing an older version didn’t make any difference.

Some people suggested running HPSetCfg 1.36, downloaded from here, or later to reset the serial and model number for the machine. This is a handy little tool from HP and runs from a bootable CD or USB stick, seemed to only want to work on FAT (not NTFS), and made the USB stick bootable with HPUSBFW.EXE. This worked nicely but did nothing to remove the Warning on boot….

http://forums13.itrc.hp.com/service/forums/questionanswer.do?admit=109447627+1251435425255+28353475&threadId=1338615

After making my way to the end of that thread on itrc.hp.com I looked at the AMT settings. Checking the AMT settings in the BIOS showed that it was greyed out and not able to be enabled? Thinking that the machine needed a firmware update for the AMT to go with the BIOS update, I attempted to install the 4.1.1.1028 version from the HP site. This should have been the version that was on the machine, Dec 2008, since the machines were purchased in early 2009. The AMT update failed installation so I started the hunt for the AMT Branding Tool that was mentioned in the thread above and found here

This is straight from allaboutmicrosoft.net:

Swapped MB on a HP Elitebook 6930P and need get the serial number into BIOS.
At boot I get a message stating “Warning. Machine is not in committed state. Invalid serial number”, but when entering BIOS there is no way for me to enter it. Read on HP forums that I need HP SetConfig Utility 1.36 to do this, but I can’t find it anywhere. Does anyone have this program or maybe another solution that could help me?

Solution: Machine is not in committed state

use this tool. run it from a bootable flash drive.  read the readme.txt inside the archive.
http://www.naturatek.com/files/amtool.zip

I downloaded the AMT tool and copied it to the bootable USB stick that I’d used before. Because I copied the files to their own folder I had to run Brand.bat from the command line, should have run from autoexec.bat. The Tool checks the current settings and prompts you to see if you’d like to make changes

VPro Uncommitted
Descriptor Unlocked
Management Engine disabled
Flash Protection Override disabled
****************************************

Do you want to enable or disable AMT now [Y, N]?

The text above is copied from the readme.txt that comes with the AMT tool, but is essentially the same as what I saw at the command line. After selecting Y to enable AMT, there was another prompt or two, followed by a reboot. On boot up the warning message was gone and entering the BIOS showed that the AMT was now enabled and I could change the AMT settings etc too!

SMTP: Data 421 Message Rejected

0
Filed under HowTo

This morning we noticed some strange issues with email’s and delays in messages arriving. A quick check of the Exchange SMTP queues and the Mail Marshal queue found nothing, none of our messages were sitting on a server waiting to be delivered. I checked the queues 30min later and the Mail Marshal queue had blown out and had 80 messages from 70 domains waiting to be sent?!

MM_Mail_Queue_sml

A quick look at the mail history in Mail Marshal revealed the SMTP error, Data 421 Message rejected!

MM_Mail_History_sml

A quick search in Google found that the clever people on the Whirlpool forum had the problem solved. Dangermouze had found that the issue was with the Bigpond mail servers and their anti-spam settings. This started to make sense… a few weeks ago we added a secondary Internet connection to our Sonicwall firewall and configured the load balancing for the outgoing web requests. We had some issues with emails trying to go out on the new internet connection and failing because there was no reverse DNS and secondary MX server configured yet for that connection. Our workaround was to set the mail.bigpond.com server as our forwarding SMTP server which seemed to fix the problem, the Sonicwall would use our Telstra ADSL2 connection to send to this address and wouldn’t attempt to send mail on the Cable connection!

Word is that if too many emails are sent via the Bigpond mail server in a short period of time, they will temporarily block forwarding email from your address for 20min or so, then let you try again. This appears to be a restriction on the Bigpond Home ADSL plans, generally, BigPond Members can’t send more than 20 emails in 10 minutes and they can only be sent using the BigPond mail servers. however we’re on a Business Broadband connection, and appear to have the same limitation.

Dangermouze’s Telnet test to Bigpond SMTP

heres the a ‘telnet mail.bigpond.com 25′ session
220 oaamta03ps.mx.bigpond.com esmtp server ready wed,6 feb 2008 22:32
helo
250 oaamta03ps.mx.bigpond.com
mail from: ***@bigpond.net.au
421 message rejected

The telnet session confirms that Bigpond is the source of the 421 message rejection, not the destination server or an RBL type service.

We may have to confirm out Bigpond settings with our account manager….

iTunes -9808

0
Filed under HowTo, WTF

I came across an interesting problem today while trying to subscribe to a podcast through iTunes where iTunes threw up an error (-9808) saying an unknown error had occurred.

9808

I’ve used iTunes on this machine (Vista SP1) a fair bit and have had no issues with downloading podcasts before, however, I was logged in as a test user and wasn’t using my normal user account. Some quick checking found that it wasn’t our Internet Content Filter causing the problem, but did find this message in our ISA firewall log:

Failed Connection Attempt
Log type:
Web Proxy (Forward)
Status: 995 The I/O operation has been aborted because of either a thread exit or an application request.
Destination: External (17.250.237.19:443)
Request: buy.itunes.apple.com:443
Filter information: Req ID: 1b5d88f0; Compression: client=No, server=No, compress rate=0% decompress rate=0%
Protocol: SSL-tunnel

Searching for status 995 and ISA in Google didn’t bring up any useful results, but a search for iTunes and 9808 bought up a a heap of results. Turns out this is a reasonably common problem and found the solution at soccerislife8 and disabled Check for server certificate revocation in Internet Explorer.

9808 IE Setting

After some more research it seems that updating to the latest version of iTunes won’t fix the problem?!

Apple_SSL

Checking Apple’s SSL Certificate in IE shows that its valid so its a still a mystery. I’m not impressed that I’ve had to disable security features in my browser for the sake of iTunes

ProCurve – Front-Panel Security & Authentication

0
Filed under HP, HowTo, Network, ProCurve

I was looking for some ProCurve documentation on AAA security and stumbled across the Hardening ProCurve Switches White Paper and found a few nice things to add to our ProCurve config.

Password Clear Protection – Front-Panel Securitylogo_procurve_networking_by_hp
ProCurve devices utilize the Reset and Clear buttons on the front panel to help users reset the switch configuration to factory default or to reset the console password. This capability creates a security risk anywhere it’s impossible to  prevent physical access to the switch. ProCurve makes it possible to disable this functionality to protect from malicious use of these features.

There are two components to front-panel security: “password clear” and “factory reset.” Both must be disabled to fully secure the device.

In the switch’s default mode, a malicious user can utilize the front-panel clear button to reset a console password stored locally on the switch. To disable this feature, issue the command:

ProCurve Switch(config)# no front-panel-security password-clear

The other capability built into ProCurve switches is the ability to reset the switch configuration to the factory default mode:

ProCurve Switch(config)# [no] front-panel-security factory-reset

Executing this command prevents reset of the switch configuration by use of the front-panel Reset and Clear buttons.

It’s critical to understand that disabling these features severely restricts administrator options if the password is lost or forgotten. Before making these changes, users are strongly encouraged to review all considerations outlined in the Access and Security Guide for your model.
wireless_edge_services_zl_module
Authentication – Server-Supplied Privilege Level
Login privilege level instructs the switch to accept the authenticating user’s command level (manager or operator) that is supplied by the server. This allows manager-level users to skip the login context and proceed immediately to enable context, thus eliminating the need for a manager-level user to login twice.

To allow the switch to accept the privilege level provided by the server, use the following configuration command:

ProCurve Switch(config)# aaa authentication login privilege-mode

To supply a privilege level via RADIUS, specify the “Service-Type” attribute in the user’s credentials.
• Service-Type = 6 allows manager-level access
• Service-Type = 7 allows operator-level access
• A user with Service-Type not equal to 6 or 7 is denied access
• A user with no Service-Type attribute supplied is denied access when privilege mode is enabled

- The Radius Authentication for switch access sounds interesting. If our Staff are using their network credentials to access the switch config, or contractors that are working on the network, we can easily enable/disable their access to the switches without hassle and letting everyone know the Manager/Operator passwords

HP 2710p Battery issues resolved

0
Filed under HP, Hardware, Notebook

Just over 12 months ago we purchased 55 HP 2710p Tablets with Vista Business for our Teaching Staff. The machines have generally been pretty good but we had some unsolvable battery issues that we couldn’t solve ourselves and eventually opened a support case with HP to try and rectify. We had various problems with batteries not holding much, or any charge and some machines that wouldn’t recognise their battery at all and would only work with the AC adapter connected to the power. If we swapped batteries around between machines they would start to work normally again and the battery would charge and be usable, however, it wouldn’t be long before the machine would have battery issues again.

HP Support got us to run the Battery Check and Health Check on some effected machines as well as machines that hadn’t had any battery issues and send them the .XML files that were generated for their engineers to check. We also sent them the .nfo System Info files from MSINFO32.exe for these machines.

hpbc
C:\Program Files (x86)\Hewlett-Packard\HP Battery Check\hpbc.exe

hphc
C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc.exe

Running these two applications generates two logs files that are stored under HP Active Support
C:\Program Files (x86)\Hewlett-Packard\HP Active Support\Logs

Battery Check Results: HealthCheckBC.xml

   1: <?xml version="1.0"?>
   2: <HC_BCheck Generated="17/10/2008 11:25:39 AM">
   3:   <Battery>
   4:     <HealthStatus SerialNumber="2CE7412ZL5">Test Passed</HealthStatus>
   5:     <TestResult>0</TestResult>
   6:     <DesignCapacity>4000</DesignCapacity>
   7:     <FullChargeCapacity>3791</FullChargeCapacity>
   8:     <RemainingCapacity>1163</RemainingCapacity>
   9:     <StorageCapacity>98.9473684210526</StorageCapacity>
  10:     <MaxError>0</MaxError>
  11:     <CycleCount>1</CycleCount>
  12:     <Temperature>23</Temperature>
  13:     <TerminalVoltage>11077</TerminalVoltage>
  14:     <Current>0</Current>
  15:     <DesignVoltage>11100</DesignVoltage>
  16:     <BatteryManufactureName>HP                </BatteryManufactureName>
  17:     <Status>128</Status>
  18:     <CellVoltage1>0</CellVoltage1>
  19:     <CellVoltage2>3688</CellVoltage2>
  20:     <CellVoltage3>3700</CellVoltage3>
  21:     <CellVoltage4>3700</CellVoltage4>
  22:     <BatteryACPower>1</BatteryACPower>
  23:     <BatterySupportedCount>2</BatterySupportedCount>
  24:     <SerialNumber>00577 2008/04/10</SerialNumber>
  25:     <satId>00577</satId>
  26:     <ManufactureDate>04/10/2008</ManufactureDate>
  27:     <Source>1</Source>
  28:     <Table>0</Table>
  29:     <SubTable>0</SubTable>
  30:     <InWarranty>False</InWarranty>
  31:     <WarrantyID>12ZL5-18100-18287-2CE74-00000-01</WarrantyID>
  32:   </Battery>
  33: </HC_BCheck>

HP Health Check Results: HealthCheckAC.xml

   1: <?xml version="1.0"?>
   2: <HC_ACheck AC_Server="h20397.www2.hp.com" Generated="25/08/2008 12:13:32 PM" HealthStatus="Poor">
   3:   <ISSUE GUID="10007315-0281-0514-8344-020194660001">
   4:     <STATUS>Detected</STATUS>
   5:     <QA>True</QA>
   6:     <URLRESULT>
   7:     </URLRESULT>
   8:     <FREEINFO>
   9:       <CATEGORY>Maintenance</CATEGORY>
  10:       <PERSISTANT value="always" timestamp="" />
  11:       <ALERT>Please update HP Health Check by clicking on REPAIR and following the instructions.</ALERT>
  12:       <SYMPTOM>HP Health Check update available.</SYMPTOM>
  13:       <SEVERITY>Alert</SEVERITY>
  14:     </FREEINFO>
  15:   </ISSUE>
  16:   <ISSUE GUID="10007315-0281-0514-8344-020194660047">
  17:     <STATUS>Detected</STATUS>
  18:     <QA>True</QA>
  19:     <URLRESULT>
  20:     </URLRESULT>
  21:     <FREEINFO>
  22:       <CATEGORY>Security</CATEGORY>
  23:       <PERSISTANT value="always" timestamp="" />
  24:       <ALERT>There is a critical security update available for HP Quick Launch Button software. This update removes a security vulnerability by disabling HP Info Center.  Click the GREEN button to apply the security update.</ALERT>
  25:       <SYMPTOM>HP Quick Launch Buttons security update available.</SYMPTOM>
  26:       <SEVERITY>Alert</SEVERITY>
  27:     </FREEINFO>
  28:   </ISSUE>
  29: </HC_ACheck>

The Health Check managed to find that the machine’s were missing an update for the HP Quick Launch buttons, but didn’t find that there was an updated BIOS available for the 2710p. The HP Health check seems to be pretty good at finding updates for HP software and drivers, but not so good at finding and recommending firmware updates. The issue has been resolved by updating to the latest BIOS, which for us was F.13, F.14 is now available. All machines that had experienced battery problems have now received the BIOS update, and have not had any problems with batteries holding their charge or not being detected since then.

WordPress Loves AJAX