• Standardised Desktop

• Password Policy

• IE Settings

• IPv6

• Bitlocker

• etc

My colleague was offering a different viewpoint saying that many policies would increase the login time for users and was less efficient. He recommended consolidating my multiple policies into a small number of policies directed to specific target groups such as:

• Servers

• Workstations

• Laptops

• etc

Naturally a discussion ensued and while I can see the logic of both, in my mind the separated policies being able to linked to multiple OUs (allowing a change to be made in a single location) and the simpler administrative view with separated policies was preferable. On the other hand, what was this doing to our logon times and how would it scale to a large scale corporate environment?

The answer is simple; it really doesn’t make that much of a difference. There are the obvious gotcha’s and tweaks to help GPO processing, but at the end of the day the primary factor is what you are doing, not how many policies you are using. Let me explain:

Make sure Login/File/Application Servers can cope: You can spend all the time you want optimizing GPO to run with maximum efficiency, but if the Global Catalog servers processing the login are overloaded and can’t cope with the requests then its pointless. In the same way, if you are using GPO to pull a file/application from a server which is under heavy load then your efforts will again be wasted. The vast majority of slow logins are because of slow access times to network resources during the login – not the optimisation of your policies. To help this make sure that servers needed in the login process are able to cope with requests quickly (using methods such as multiple GC servers and DFS to split the load on Fileservers)…. then worry about GPO optimisation.

Disable What you don’t need: There are always two parts to the GPO – User and Computer configuration. Each policy will check both parts for settings and apply the contents, if you are only using User based settings in a policy and the Computer section is empty, then disable the Computer section so the client doesn’t waste time checking it.

To do this, go to the details page on the policy properties:

ACL Filtering Vs Good AD Structure:  One of the most important things you can do for efficient GPO processing and troubleshooting is make sure you have a good AD structure and getting it wrong is the road to ruin. Keep it simple and separate things out so appropriate policies can be applied without having to resort to WMI/ACL filtering. While you can use these methods to filter policies to only apply for specific account groups, it will generally have a negative impact on performance. It is great in theory, but the actual processing of ACL/WMI filters, expanding groups, checking permissions, etc all takes time and can create quite a delay if used in multiple locations. That’s not to say don’t ever use it – in the right place it can be very useful, but it should not be used to try and compensate poor AD design. If using it make sure the servers set to expand those security groups can cope with the task otherwise be prepared to wait!

CSE Processing: Once you have ensured that your AD has good structure, your login servers (and referenced file/application servers) can cope with the request volume and you are not using excessive filtering on policies the next most important thing is CSE processing.

As a very brief summary, every client has a number of agents to process different areas of policy settings. These are called Client Side Extensions (CSE):

• Gptext.dll (Scripts, IP Security, QoS, Wireless Network Policies)
• Fdeploy.dll (Folder Redirection)
• Scecli.dll (Security Settings)
• dskquota.dll (Disk Quotas)
• Ledkcs32.dll (IE Maintenance)
• appmgmts.dll (Software Installation)
• Userenv.dll (Administrative Templates, Software Restriction Policies, Public Key Policies)

For every CSE registered with WinLogon, each is checked to see if it should be running (ie – Slow Link Detection, background processing, etc) and then in turn, each CSE deemed active for the current policy application looks at every GPO in the list presented to it (the list is provided by processing the AD LSDOU structure and ACL/WMI filtering for the computer/user) in turn checking each policy’s enabled Computer/User containers for CSE GUIDs indicating it should be applied.

Summary

Less time worrying about the number of policies and more time thinking about correct AD structure, avoiding unnecessary use of ACL/WMI filtering, making sure response times of login/file/application servers are fast and how many policies have active CSE settings in them.

If you really do want to worry about the CSE processing, from what I have read 20 policies each focused on an individual CSE will give better performance than 20 policies each referencing multiple CSEs. So instead of focusing on tasks such as “Standardised Desktop” or categories such as “Workstation” – it is likely better off focusing on CSE categories such as “Folder Redirection”, “Software Installation”, etc. However that may well be the most efficient, but in my mind that would be even harder to administer…. so I’ll be sticking with my original way of doing things and focusing on optimising everything else.

Microsoft took an interesting take on GPO best practice in a Jan2010 entry on the GPO team blog (http://blogs.technet.com/b/grouppolicy/archive/2010/01/25/gp-editorial-group-policy-best-practices.aspx) saying:

“The real best practice is to ‘go do work.’ “ 

That kind of says it all really – I think I’ll stop worrying about it

If you want to read more about how Group Policy works, microsoft have a nice explanation at: http://technet.microsoft.com/en-us/library/cc784268(WS.10).aspx

Yet, businesses large and small continue to plough all of their budget and resources into the production environment and the UAT, system testing and development environments are viewed as poor second cousins. The ‘pre-prod’ environments are cobbled together with bits of string and sticky-back-plastic – not to mention the plastic egg cartons!

There is a very good reason for ensuring that your environments all have the same hardware, sofware, build, o/s versions, database versions, etc… because if they don’t, then you have done ZERO infrastructure testing before you put your new application into production.

I saw a good example of where this can go horribly wrong about 10 years ago. In an effort to improve system performance on a trading platform, I was involved in a performance tuning exercise based around a Sybase database and we were looking at all the whizzy features to improve performance that everyone normally leaves well alone. We identified a few features, tested them out in development, system testing and eventually promoted them to UAT. All was going swimmingly and performance had improved by around 15%-20%.

When applied our changes to the production environment, it all went south. Performance on the trading database was around 400% worse! We had to back out our changes during the online day – carnage and red faces everywhere…

It turned out, that the UAT and PROD environments were identical – almost. We had changed the way the database did it’s scanning and read-ahead on the disk and the PROD environment was using a different RAID array from a different manufacturer than all the other environments. The RAID setup was otherwise the same, but the underlying hardware was different and reacted badly to our changes.

If you don’t have the luxury of a seperate integration environment, and your UAT infrastructure is different to your Production infrastructure, then you should care – very much…..

• MS best practice is to leave it turned on
• MS test all of their products with it turned on, so if you want the most compatible environment its probably better to leave it on.
• Disabling IPv6 means you lose features that are dependant on it, such as Homegroups – but there is nothing “essential” that will break.
• Disabling it can lead to faster network performance (marginal) as the OS will try and use IPv6 as default and fall back to IPv4 after a short timeout. a good example of this is DNS and DHCP as it will check the IPv6 versions first, wait for the timeout and then go to the IPv4 versions that you almost certainly use.
• Regardless of it being enabled/disabled, if want to make security the focus then you should block all IP protocol 41 and UDP 3544 traffic at the perimiter firewall – just to be sure no IPv6 traffic gets routed into the network.
• It is the future, although clearly not as immediate as everyone makes out. To be honest I wouldn’t be suprised to see IPv6 making more of an impact in the cloud environments over the next couple of years, but I don’t expect any local networks or businesses to migrate to it any time soon. Too much cost, not enough benefit.

Anyway back to the issue, essentially there are two ways of disabling:

1. Manually unticking the IPv6 protocol from the adapter
2. Setting a registry key to disable IPv6 across the system and all adapters

As I wanted to disable it system wide I went about using Group Policy client preferences to push a registry key out to the clients. I immediately came across the following TechNet article giving the required key and value:

http://support.microsoft.com/kb/929852

Unfortunately it didn’t work, so I looked again and then found more articles stating the key was correct but the value was not. In fact it seems no-one can agree as some state it as 0xff, some as 0×00 and others agree with the MS article of 0xFFFFFFFF. Each article claimed success and made no mention of the other values. Well I tried them all but no success – checking the protocol bindings on the adapters showed IPv6 still enabled and active:

After about half an hour of reboots, checking the key, trying all different values and generally getting a bit hacked off I decided it wouldn’t be the first time the UI had lied so decided to test the actual protocol using the Microsoft key of 0xFFFFFFFF – low and behold:

So it *is* disabled, it just doesn’t disable the protocol on the adapter…. genius

(For information, none of the other values work so ignore them – only the MS article value of 0xFFFFFFFF works. Some other values are available to disable specific IPv6 things, but 0xFF doesnn’t appear to do anything at all.)

Anyway, in my book if you disable the protocol then the UI should be updated, otherwise admins will get all confused when they don’t know the key is there something doesn’t work. Checking the protocol bindings will show everything active….. 

This is the highest level of partnership and is awarded based on a combination of competence and expertise in specialist areas as well as numerous customer testimonies. Less than 5% of partners are able to achieve this status and we are very pleased to be able to offer our customers such high levels of service.

Director and Founder Jonathan Barnes said:

“This achievement underlines the on-going  commitment of Zymbian to deliver value in alliance with proven technical excellence. Coupled with our other strategic partnerships, this strengthens our ability to deliver the optimal solution for our customers, and grant them the confidence of knowledge that they are working with premium technical specialists. I am especially proud of the excellent customer feedback and look forward to building on this success.”

In addition to being a Microsoft Gold Partner, Zymbian is also partnered with such companies as VMWare, Oracle, Fortinet, Datacore and more.

A new customer referral out of the blue, direct from Microsoft looking for archiving for online exchange, only 5 licenses so the sales guys don’t flutter an eyebrow, but we are here to help, and this should be a rudimentary task, the service details are:

£3 PCM per seat (min 12 months) plus the optional cost for archiving data that already exists on a volume basis.
This archives the data for 10 years satisfying all current compliance regulations.
It can also capture IM and Bloomberg messaging.
It is described and available on the MS website, surely click and add and away you go? Not quite….

FROM MS website

1. Contact your Microsoft Partner and request EHA activation. (that’s us!!)
2. The following steps will be performed for your company:
   Your partner will contact Microsoft Online Services Technical Support. Etc. (Easy ..)
   Technical Support will create EHA credentials for your service administrator, a special contact which contains the journal address for your archived e-mail, and a new distribution list called ArchivingGroup. Etc…  (in theory… see below)

As a MS partner and a fully-fledged BPOS provider this should be straight forward, not this time. Archiving is part of the BPOS family isn’t it ?
Not really – an estranged cousin perhaps, it is effectively classed as a third party solution so is not available from the standard BPOS console.  

So the reality was

1. Follow the obvious paths – verify on our own BPOS test systems, but nothing obvious there. Surely this is straight forward ?
2. Speak to MS, confirm this is not archiving for a hosted solution from an on-site Exchange server – which is Exchange hosted services, specifically archiving – but Exchange hosted archiving for Online services. So no confusion there.
   1. Tech support, – “you need customer service” to discover how to order this online.
   2. customer service “ you need licensing” to be able to purchase this.
   3. licensing “no not this kind of licensing, you need Volume licensing, you need tech support” to show you how to do this.
   4. tech support (hang on!) – “customer services”, feeling dizzy.
   5. be placed in limbo/engaged tone/loose the will to live/have to do some real work.
   6. Finally have a very helpful customer support lady (Thanks Joanne)  confirm I need to speak to an official Microsoft reseller. We are a Partner, but not a reseller and cannot provide this service directly. So no benefit in that regard.
   7. Speak to our preferred reseller (well 3 actually before anyone has the answer to allow me to confidently direct the client to them). It must be sold straight to the customer, and in selling the service the ticket for setup is automatically created directly with the customer. So no partner benefit here either
   8. Speak to the customer, apologies for the delay, discover he has spoken to 20 other companies to try and resolve this without success and he is happy to have finally found someone capable of providing a solution.
   9. We are happy that we have delivered said solution, albeit for zero business benefit and several hours on the phone, but we now know for next time.

So the outcome, a standard partner cannot provide the service, most MS support personnel are unaware the archiving solution falls between two camps.

So unless you are a Volume reseller you must pass this on. Exposing your customer to a new provider/supplier and putting your reputation at risk, while enabling a software solution you cannot control.

It is also worth noting journaling can be enabled with other third party vendors, but again a new supplier, unknown SLA’s technologies, and messing with a live mail system so why would you without significant diligence to protect the customer ?

Incorporation into the standard offering options would be simple for clients, partners and support teams, or have we missed something?

If you are experiencing the same problem I hope this helps shortcut to a solution

I went into the printer properties:

selected the ports tab and found the port I wanted to change:

Now, as I have done many times in the past I clicked “Configure Port” ready to enter the new IP only to be met with: “An error occurred during port configuration. Access is denied.”

Its the same for deleting the port. That seems very much like a UAC related error with me not being elevated, no worries I’ll just elevate myself – easy. Not quite, the run as administrator isn’t on the printer context menu:

and the normal trick of holding down Shift while right clicking doesn’t give additional options either.

Anyway, lets skip past the next 15mins of blank looks at the screen and I’ll give you the magic rune needed here, its annoyingly simple and looks like it will take you to the same dialog, but it is actually subtly different.

When you highlight the printer the explorer task bar context changes offering you options specific to that object. Click on the “Print Server Properties” button on the explorer task bar:

This takes you to an almost identical menu as the printer properties but has the all important elevate button on the ports page allowing you to make the change:

Hope that helps someone, it caught me out

Lots of good informational videos, case studies, whitepapers, etc. No registration required.

But anyway, I have just finished my latest round of research, searching the owners forums, etc and have parted with my hard earned money once again. I have a shiny new Sony Vaio Z-Series: http://www.sony.co.uk/product/vn-z-series and first impressions are excellent, which is unusual for me.

In the past I have always gone for power over portability, have never bought anything smaller than 17” (weighing around the 4kg mark) and they have always been “pimped” out with the highest specs possible. They have not really been laptops as such, more portable desktop PCs with a TFT strapped to the top!

This little ZSeries laptop is 13” and defies belief in many ways. First of all it is the lightest laptop I have ever seen weighing in at just 1.4kg – yet the specifications would have me believe I am still using one of my 17” monster laptops:

• Latest Core i7 processor? .
• 8GB RAM?
• 1920×1080 Screen?
• Discrete 1GB NVidia 330m dedicated graphics card for performance?
• Onboard Intel graphics for battery life?
• Multi-touch track pad?
• Fingerprint Reader, TPM chip, Internal DVD ROM, Internal 3G card? 3x USB?
• 6 hour battery life?

EDIT – Forgot to mention the cooling, it gets warm at the back left corner (by ESC key) and apart from that runs really cool

But the real beauty of this laptop is the disk setup. Solid state of course, but Sony have done their normal thing of designing a proprietary format that is neither interchangeable or upgradable. At first glance I was rolling my eyes and thinking how pointless it was, but closer inspection didn’t take long to convince me.

Essentially they have done on their hard disk what Intel/AMD are doing on their processors with multiple cores. In the same space as a standard 2.5” laptop disk they have crammed a total of FOUR SSDs and used an Intel raid controller to RAID0 them for performance. SSDs are quick these days, but think of having FOUR all working together!

The benchmarks are nothing short of amazing and despite its size it feels like the quickest PC I have ever used, notice I said PC there not just laptop. Some benchmarks are:

I ran this test a total of five times, each time the results were almost identical. It really is that quick! For comparison I ran the same benchmark on a Dell XPS1330 with a standard 300GB 5.4k 2.5” laptop disk:

See what I mean! Sure the RAID0 means there is technically more chance of a failure, but its not like the old spindle ways – there are no moving parts and the failure rates of SSDs are much, much lower. For this level of performance I’m happy to take my chances.

All that is left is to congratulate Sony on a machine nothing short of amazing! Well done and I’m sure other vendors will follow suit shortly! But for now, if it is performance you are looking for and don’t mind paying a premium – look no further.

NOTE – There are some complications of using RAID with SSD disks because of the TRIM functionality, but its not that much of a big deal and I’ll cover it in detail with a future article.

In the past I have used a Product called “SanMelody Lite” from Datacore. Their full SanMelody product has been proven in many large scale environments and the “Lite” version was essentially a starter pack costing $199, limited to 2 targets, 2TB of storage and none of the enterprise features such as thin provisioning, snapshots, etc – which was very reasonable for the cost.

Sadly when I tried to purchase a new licence last week I discovered they had discontinued it and in its place is a package costing $950, limited to 3TB and containing features that while useful are frankly unneeded for my deployment. I phoned Datacore to see why Lite was discontinued and was told they didn’t sell enough, make of that what you will I suppose…

Anyway, with that gone I decided to check the latest offerings from other Vendors. The two main ones I looked into were:

• Starwind
• OpenFiler

Each has their own advantages/disadvantages, Openfiler is open-source, free and contains some nice enterprise features by default including HA, snapshots and thin provisioning. StarWind has limitations on the number of concurrent connections on their base packages and if you want more then a couple of servers to use the target then you are immediately looking at the $1000 mark just like Datacore. Both Datacore and Starwind come with 1 year of support, if you want support for Openfiler then that is possible but isn’t free and will cost around $300 for a couple of hours support time to be used as you need it.

In an effort to keep costs down I originally decided to test Openfiler first, I installed it in a VM to do some functional testing and all seemed acceptable. However once I installed on actual hardware and did some performance testing I began to realise it probably wasn’t quite up to what I needed., the performance figures were approx 50% what my old Datacore servers were getting.

At first I thought it was a configuration error so I spent time investigating, rebuilding the server, changing the write-through/write-back settings and trying to resolve it but couldn’t make it any better.

For background on the performance testing:

Hardware:

• Host: Dell Precision 390 (1.8Ghz, 2GB)
• OS Disks: 2x 250GB (RAID1)
• Data Disks: 3x 1TB (RAID5)
• iSCSI Network: 1000MB Wired LAN

Testing:
• I did two passes on each vendor to make sure the figures were accurate and not spiked.
• Two types of tests were completed. The first for a 100MB file and the second for a 1000MB file.
• For Datacore and Openfiler I actually built the system, tested it then rebuilt the system from scratch and tested it again just to be sure the differences were not an OS anomaly.
• All disk setups were as they are expected to be used (Raid5) and tested over an un-contended 1GB LAN.

The results of testing are as follows:

OpenFiler

:

Starwind

:

Datacore:

As you can see, the DataCore solution is clearly the best at what it does. The write speeds are fairly consistent across the board, but the difference in read speeds is quite incredible considering the same hardware setup for all three. I plan on doing some more in depth testing in the future, but in the meantime I think these results are very interesting. Its the age old “you pay for what you get” argument. If you don’t need the performance and just need a functional solution for lab testing then Openfiler should be fine, but based on this testing I couldn’t recommend it for heavy load or production environments. Starwind is comparable to Datacore on some of the benchmarks, but given they cost essentially the same and have the same feature set, I know which vendor would get my hard earned money.

Hope that helps someone.

Whilst on a client site a few days later I had intermittent issues with Wi-Fi connectivity. The laptop initially discovered and connected to their public Wi-Fi, but a few hours later dropped off. The following day, Windows couldn’t even detect their Wi-Fi SSID. Puzzling….

As I didn’t have any LAN Manager or Wi-Fi catcher installed I couldn’t blame that. I moved my attention to Kaspersky Internet Security (KIS) assuming that, as it ties into the NIC, was throwing a spanner ion the works. With KIS disabled I was able to detect and connect to Wi-Fi. KIS re-enabled the connection maintained.

With the problem successfully bodged I went to a meeting thinking I’d at least found the culprit. On return to my desk, no Wi-Fi!

Tinkering continued for a further 2 or 3 minutes until, out of anger more than anything, I removed the device drivers and rebooted. Once logged on, Windows 7 discovered the WLAN card, installed its driver and connected to Wi-Fi in seconds.

That was a week ago and no issues since. The lesson learned; Windows 7 rocks. Just trust it to work it’s magic and only install drivers when it can’t do it for you.