Cloud Computing – the sixth phase of computing? Wait a minute…

Last week I attended an excellent seminar on Cloud Computing. Speakers included Bob Muglia (President of Server and Tools Business for Microsoft) and David Chappell. Both were excellent but it was Dave Chappell that really got me thinking, he was talking about how computing has changed in the past 50 years and how we are now entering the sixth phase of computing. He listed the phases as:

1. Mainframe
2. Server
3. Personal Computer
4. Laptop
5. Mobile Phone
6. Cloud Computing

He is an excellent speaker and I would highly recommend him, but I must confess to drifting for a minute or so at this point, thinking about virtualisation and why Dave did not include it in the list….

Read more of this post

Fake-Raid or not Fake-Raid, that is the question…

Last week I was building a cheap and cheerful file server using a software iSCSI target, a workstation and some off the shelf SATA disks. I have done it before with great results, but sadly my preferred iSCSI target vendor has recently stopped selling the low cost edition of their product and the new “entry level” is almost three times the cost – forcing me to re-examine the competition.

I will leave the comparison of other target vendors for another blog – this is more of a flashing red “Danger Will Robinson!” warning to others using workstation RAID configurations for such tasks so they don’t get caught out as well.

The workstation used was a Dell Precision 390, their top end enterprise level machine from a couple of years ago. It comes with an onboard Intel raid card capable of RAID0/RAID1 and RAID5 and I have used it with success on Windows platforms in the past. However while I was exploring other iSCSI vendors I tried to install a Linux based platform and discovered it was ignoring the RAID configuration and able to examine the individual disks.

There were five disks in total:

Read more of this post

Installing Windows from a Bootable USB stick

I was recently tasked with setting up a quick method for provisioning new physical servers/workstations. I have a Server2008 R2 AD forest with VMWare VSphere for virtual machine server infrastructure.

Virtual machines are provisioned via template images from the Virtual Center server, but with almost our entire infrastructure virtualised there are only a handful of physical machines to worry about. They are all workstations that will likely only be rebuilt once a year with most of the configuration done via group policy. With that in mind I didn’t want to use a dedicated deployment method such as Microsoft’s BDD (Business Desktop Deployment Services). The added infrastructure, image creation, image maintenance and overall setup just didn’t seem worth it for so few machines.

Its always best to keep things simple so with that in mind I chose a straight install from a bootable USB stick. The main reasons for this method were:

Read more of this post

No Drive Encryption? All your Data are belong to us!

Hopefully everyone is already aware of the benefits of using passwords to protect data held on computers, however passwords are all well and good until someone has physical access to the computer – at which point all your confidential data belongs to them whether they already know your password or not. It really isn’t difficult to bypass windows security once you have physical access.

Consider your laptop being stolen or accidently left on the train, perhaps it contained confidential client data? The sort of data that if “found” would cause significant embarrassment to your company, damage client relationships and on a personal note may put your job in jeopardy.

These days it is just not good enough for this data to be merely password protected. Given physical access to your computer a malicious person has numerous ways to gain access, such as booting from a Linux boot disk with tools to reset the local administrator password. Once they have administrative access on your machine the game is pretty much over – but that is outside of the scope of this blog. What I want to do here is talk about how to prevent someone from getting to that point by using full drive encryption to render those lost hard disks expensive paperweights.

There are many full drive encryption solutions out there, however for the purposes of this blog I will talk about Microsoft’s own BitLocker Solution. The main reason for this is its excellent Active Directory integration and that fact it comes built in (free!) to the windows client editions that business use (Vista:Business/Ultimate/Enterprise & Windows7:Professional/Ultimate/Enterprise).

Setting up Bitlocker is considerably easier with Windows7 than its Vista counterpart. With Vista you might remember a “Bitlocker Preparation Tool” that you needed to run and setup the drive partitions. The reason for this is the boot sector cannot be encrypted, it needs to sit on a separate unencrypted partition to allow the computer to know there is something to boot and prompt for the key. This is no-longer needed with Windows7 as it separates the boot sector onto its own partition by default (this is the small 100MB partition you might have noticed at OS installation). No data is held on this boot partition and it isn’t mounted in the operating system.

BitLocker works by encrypting/decrypting on the fly, meaning your drive is always encrypted apart from the items currently in use. The official performance impact of this is stated to be in the single digits, but in my experience it is generally around the 3-5% mark. Not really a noticeable hit considering the obvious security benefits.

Protection and Recovery Methods

Before you jump in and setup BitLocker, there are some important setup/recovery considerations:

The first choice you must make is what encryption method to use. This is dictated almost entirely on whether your computer has a TPM chip installed. Most recent enterprise grade laptops will have a TPM chip, but sadly the majority of small business grade laptops still lack it. Essentially it is a factory installed physical chip tied to the specific hardware in you machine that generates a complex encryption key from a simple pass code which is then entered to boot the drive. Removing the disk and placing it into another computer with a different TPM will result in a different encryption key being generated from the same pass code and prevent decryption. This is the easiest way to setup BitLocker and is both the most secure and Microsoft best practice.

If you don’t have a TPM then its not the end of the world, but you will need to make a few group policy changes to allow BitLocker encryption without it and use a USB stick to store the encryption key. This USB stick will need to be inserted at every boot/resume or the system will be unable to boot.

If you are anything like me, you are now imagining the problem scenarios:

1. The TPM enabled laptop hardware breaks.
2. The USB stick containing the encryption key is permanently lost/destroyed
3. That fateful morning when you get on the train ready to settle in to some work only to realise you have left the USB stick containing your decryption key on your desk.

Well the good news is that part of the best practice is to prevent any encryption from taking place until BitLocker can backup the recovery key to the associated computer account in Active Directory. The recovery key allows emergency drive decryption and in the event of a problem your system admin can provide you with recovery key (ie – read it to you over the phone if you are remote) so you can boot and regenerate your key to a new USB stick or to the current TPM hardware.

NOTE – This BitLocker tab is optional and for it to show up you will need to install the RSAT optional BitLocker management tools as shown below:

The good news is that if your laptop has been lost/stolen (or bad news if you have just misplaced your USB stick!) is that until this recovery key is entered your laptop is just a big paperweight and your data is secure. Congratulations

IMPORTANT – This sort of protection is very effective and definitely worth doing, however the obvious mistake is to leave the USB stick containing the key or a post-it with the TPM passcode in the bag with the laptop. If you have left your laptop on the train then there is a good chance the two are lost “together” and the protection you have put in place is null and void. Don’t do it! Personally I keep my USB key on my keyring which I keep on me at all times. For reference I have:

http://www.amazon.co.uk/Wink-micro-pico-Flash-Drive/dp/B002X556UE/ref=sr_1_1?ie=UTF8&s=electronics&qid=1272811631&sr=8-1

Go forth and encrypt!

Summary:

Good Points:

• Lost/stolen disks are paperweights and your data is secure.
• Excellent recovery options in the event of accidental loss of the USB stick or TPM hardware failure.

Bad Points:

• Small performance hit due to the on the fly decrypt/encrypt (official figures state single digits)
• If you don’t have a TPM (which most people won’t) then you will need to carry a USB stick.
• Losing the stick while on travels will result in a phone call to IT for your recovery key.
• Unable to use the Sleep function. Will have to use hibernate instead which takes a little longer.

Useful Links:

Microsoft best practice policy for Windows7: http://technet.microsoft.com/en-us/library/dd875532(WS.10).aspx

Live Migration Virtualisation for Small Companies! Part-1

I’ve been using virtualisation since the early days and can firmly remember running the MS Virtual Server 2005 Alpha builds on my production development hosts back in 2004. My company was only about 15 people at the time and every piece of hardware was a precious resource (naturally this is still the case!), so the ability to run lots of development environments on each was just too much to resist.

As the company expanded so did our virtualisation needs and a couple of years ago we purchased a shiny fibre channel Dell CX3 SAN along with 6 VMWare ESX 3.0 hosts. One of the major selling points of this was Live Migration, the ability to migrate a virtual machine from one physical host to another with no perceived downtime to the end user. Live Migration is a wonderful thing but it does have rather demanding hardware requirements in the form of shared storage, which can often put it out of reach of the majority of IT departments before they even start looking at the substantial cost of ESX licences.

Fast forward to today and things have changed somewhat, there are multiple vendors offering live migration and the pricing has shifted away from the hypervisor itself to the management solutions. As a result each vendor offers a free edition of their hypervisor with a cut down feature set:

VMWare has ESXi, basically just a bare metal hypervisor, it comes with VMWare’s over-commit memory management which is nice, but that’s about it. It is capable of centralised management and live migration – but to activate those features you need to apply a full licence to it… which removes the “Free” aspect of the product.

Microsoft’s latest free offering “HyperV Server2008 R2”, brings some interesting features to the table which I don’t think have been adequately publicised. In addition to the standard hypervisor features from the previous version, the R2 edition comes with failover clustering, including Live Migration! Suddenly Enterprise level virtualisation features are within the grasp of every IT department without needing to blow the budget. It is also possible to have centralised management via SCVMM 2008 R2 (like VMWare this requires a licence), but this is not a requirement for any of the features. For the purposes of this environment I have just been using the standard Server 2008 remote administration tools.

Of course the software is only half the battle as if you don’t have shared storage you’re still out of luck. A quick chat to my Dell account manager and a quote dropped into my mailbox for a entry level iSCSI SAN with about 8TB storage (RAID5), redundant power supplies,data paths, etc. Its a nice cheap solution and a bit of negotiation soon got it down to the <5k mark, but assuming you can live without redundancy and are not looking for performance then there is a cheaper option. Grab a desktop PC or old server, install a software iSCSI target, throw some high capacity cheap disks in it and you’ve got yourself a cheap SAN that is capable of serving Live Migration hosts. Its not pretty and won’t impress anyone with its performance, but it does the job.

Over the past few days I have built a test setup out of some spare hardware. It is essentially 4 HyperV Server2008 R2 hosts and a software SAN providing the shared storage. So far its working very well.

I’ll post back with how it was setup, what software/configurations are being used and any problems shortly…

Windows 7 Focus: Libraries (6801)

Ok, nice feature – but the Win-E key press now brings up the “Libraries” instead of “Computer”… which I think is going to annoy people before they even look at it I can imagine a legion of posters are currently navigating to the MS forums demanding they change it back, so lets leave them to it and move forward to talk about the feature and see if we like the change…

Pressing Win-E now displays:

Did the sky just fall? No? Good, lets continue Libraries are Windows 7′s approach to arranging your file system without actually having to physically move everything round. I must confess to not liking it much initially but it has definitely grown on me and I now find myself using it as my primary “go to” place. If you don’t like it at first, I suggest giving it some time as it is rather useful.

It works by having a series of logical containers that things are mapped to, kind of like the search folders that were removed from the original Longhorn builds. Each folder has a base folder it is associated and more folders can be added from both your local disks and around the network.

As an example lets look at the “Downloads” library. I normally use a folder on my laptop’s d:\ called “Applications” for dropping random downloads in so I don’t end up with rubbish all over my disk. I also have a more structured fileshare on the servers used as a repository for the whole company where I put the more useful downloads. I can add these locations to the library giving me:

The view you get when clicking on the downloads library is a combination of everything in the included folders. If you want a more specific view of one particular folder you can navigate down to it:

When saving things from the Internet, the default save location is the Downloads library:

Notice that it displays the root of the library and shows everything contained in the included folders, but you can still save directly to this folder. How do you know which of the included locations it will save the file to? Easy, it saves it to the “Default Save Location” which is set in the same place as you add/remove locations:

So in this case saving to the root of the Downloads Library saves the file to the physical D:\Applications folder, but it doesn’t matter really as it all shows up in the root library view anyway

Thats pretty much how they work so lets look at some of the others:

· The Music library is tied into WMP, so adding the my music folder D:\music adds the location straight into WMP.

· The Documents library means I can add my local work folder and my user space on the company network

· The Contacts/Communications have libraries included for Outlook to search email/contacts and I guess more will be added as time goes on to make this a one stop place to find things.

In case you are wondering, no – you are not just stuck with the default libraries as you can easily make your own to suit whatever need you have:

I like Libraries

Windows 7 Focus: Networking UI (6801)

Vista’s new Network Center wasn’t overly well received with the more experienced users due to the unnecessary amounts of mouse clicks to get to the more advanced areas they were used to. Its usability was also questionable as it was split into different views for all of the three most used actions of connect, disconnect and connection status. You could do everything direct from the Network Center, but it wasn’t very efficient having to load that window every time and the functionality was duplicated in different places:

Vista Disconnect:

Vista Connect:

Vista Network Center:

The Network Center is still present in Windows 7, however it has been simplified and supplemented with a new more efficient UI to do all the added as part of the system tray icon. Simply click the icon to display it:

This UI quickly shows the Wireless and Dialup/VPN connections available and lets you connect/disconnect with ease. Simply click on a network to display the connect/disconnect option depending on the current status:

Right click the network connection and you get the expected options:

Clicking Status takes you directly to the network status page ready for configuration:

Its quick and simple.

The main Network Center has been simplified, the functionality of the new UI is no longer duplicated here so it is easy to understand where you need to perform a specific action. I think the only time I use the Network Center now is to create my VPN connection on a clean install. Everything else can be configured quickly and easily using the system tray UI.

The one thing I don’t understand about the new UI is *why on earth* the LAN connections are not included, on the occasion I need to change the properties of a LAN connection I must still go through the following procedure:

1. Open System Tray UI

2. Open Network Center

3. Click Change Adapter Settings

4. Right click adapter

5. Click Properties/Status

Just unnecessary, especially considering the work is already done and all that needs to be done is just to add them into the UI. Wireless connections can get to the same point with three mouse clicks now, why penalise LAN connections? With any luck the LAN connections will be included in the UI shortly.

Windows 7 Focus: Virtualisation (6801)

Virtualisation will continue to play a large part in the Windows7/Server2008R2 releases. In Server2008 we got the Hypervisor (Hyper-V) which was great and I know many people moved from Vista to Server2008 to make use of it. The main reason for this move was the lack of a comparable in-house option for Vista. While VirtualPC2007 and Virtual Server 2005 R2 SP1 are available, they just don’t cut it anymore compared to the 3rd party offerings out there such as VMWare Workstation 6.5. The obvious missing feature is the ability to manage snapshots, but that is not the only thing.

Server2008 R2 will include Hyper-V Version2 and have things like:

Read more of this post

Windows 7: First Impressions – 6801

Setup

The majority of the setup procedure is directly inherited from Vista/Server2008 and continues to use the .WIM format – which is good as it works well and the existing tools to manage Vista/Server2008 installation images such as WAIK and ImageX should continue to be useful.

Just as Vista was easier to install compared to XP, 7 has been made even easier. XP forced you to constantly watch the installation progress for the dialogs (locale/networking/etc) which pause the install until answered. With Windows Vista you entered some information at the start, it installed and then you answered some more information at the end. While this was better, there were still two separate points to input significant amounts of information – which just seemed unnecessary. Anyway it seems someone has made this point to them as prior to installation the only thing Windows 7 asks is which partition to install onto. It then installs and asks all questions in one hit at the end. Much easier.

First Boot

The first thing you will notice when installing is that the installation background has changed. While it seems fairly trivial at this stage to worry about such a thing, past experience tells me how much the boot screen and background excites people so here they are, enjoy:

As soon as you log in you notice a distinct lack of clutter. Vista had too much enabled by default on the first login with the Welcome Centre, sidebar, gadgets, etc. Windows 7 has a much more simplistic (and welcomed!) approach of nothing. The following are two screens of first logins for Vista and 7:

Performance

As much as I like Vista and think it gets far more stick than it really deserves, I think we can all agree it isn’t the fastest thing in the world. It often seems to just sit there with plenty of free memory and CPU taunting you while it nails the disk for what seems like an eternity after you asked it to do some random simple task. I have one colleague in particular that I swear is going to lose it the next time Vista does this, I’m going to have to put a webcam on him because its going to be good viewing.

Anyway, Windows 7 performance is well…… fantastic! Back in October/November 2007 when Server2008 got to the final stages of its beta I started to use Server2008 on my primary workstation. One benefit of this was the Hypervisor, but the main reason was the fact it was so much faster than Vista. Whenever I go back to Vista from Server2008 now it is immediately obvious how much slower Vista is. The good news is that we now have the same effect with Windows 7 being faster than Server 2008.

If this is anything to go by, Windows 7 is going to be quick!

Explorer

Not going to go into the changes too much as they are not too significant and I’m not convinced it will look much like this in later releases, suffice to say its easier to use and a bit more polished:

Vista:

Windows 7:

Notice the more “explorer” view in the left navigation pane compared to Vista and the inclusion of Libraries (more on that later). Personally I never liked Vista’s way of just displaying the favourite links and the folder tree requiring an optional click to expand it up from the bottom, it was often the first thing I went for and it was never laid out quite how I wanted. Its a relatively minor change but makes a big difference, to me anyway.

Another similar change is the change of default state for “Save As” and such dialogs. In Vista they were minimised, something that did nothing but frustrate me as if you wanted to see where to save it other than a default location you needed to expand it. 7 thankfully no-longer has this behaviour and also defaults the save location to the new download library. I sense lots of saved mouse clicks every day.

Vista:

Windows 7:

The nasty black effect when maximising windows with the Aero Glass theme enabled is gone and you keep the glass effect. As it should always have been:

Window Docking

One of my favourite features of Windows 7 is the window docking feature. If I try and explain how much I like it I’m going to sound stupid, so just take my word for it. Its so simple its brilliant and whenever I’m not using 7 now I still find myself flicking windows around expecting them to dock… it was like second nature within the first 20mins of using it and I find it painful going back to Vista/2008 where it doesn’t exist. There is a little animation to let you know it is going to dock, but it only displays if you hold the window there long enough for it to display. This is nice because if you are not sure then you can hold it there and see the animation, but if you just want to dock and forget it is instant. To use it just:

· Drag a window to the top border of the screen to maximise across the whole screen

· Drag a window to the left border of the screen to maximise across the left half of the screen

· Drag a window to the right border of the screen to maximise across the right half of the screen

The stages of docking are:

1. Dragging the window to a screen border, this shows the “Ping” animation showing that you are about to dock a window:

2. Animation displays the screen area that window will dock to. The box starts from the point of the “ping” and expands to the screen space the window will dock to. I have docked it to the top border which uses the full screen, you can see the border around the edge of the desktop:

3. It docks the window when you let go of the mouse button. It just looks like a normal maximised window so I wont provide a screen of that as I think we know what that looks like. Once it is docked you have all the same normal options (minimise, etc) but you can also continue to dock in different ways, hold the mouse button down on the title bar again and just drag it to a new position, for example the right hand border which docks to the right side of the screen:

You get the idea. I find it really useful as I often have multiple applications that I want to see at the same time and not keep alt-tabbing between. Sure I could just resize the windows manually, but that requires effort and I’m lazy – which is why I like this so much. Flick a RSAT tool to the right, flick a Powershell window to the left and you’re off!

The big win with something like this would be the ability to configure instead of it just being locked as it is right now. The thing I would really like to see here is a docking configuration screen where you can assign different areas of the screen border to dock to different screen space. A good example of the configuration would be to allow two windows to dock on the left border instead of one. I have a 1920×1200 screen so I have the real estate and I want to make the best use of it. I would like to be able to assign the left border’s top half to dock to the top half only, leaving the bottom half free to dock something else. Something like:

Maybe the configuration screen could be accessed from a key press similar to Win-D for the desktop or Win-G for the gadgets? Perhaps the screen could fade like it does for UAC/Flip3D and get a simple drag drop where you want things to dock like:

Windows 7? Are you sure?

With the recent announcement that “Windows 7″ will be the final name, some people have applauded the simplicity while others have picked holes at whether it really is version “7″ or not. Technically the build numbers are still in the 6.1x range as it is a direct evolution of NT6′s Vista/Server2008, but personally I don’t think there is a justifiable need to artificially roll the build numbers up to NT7 and would be surprised to see it happen. The only possible issue might be if MS continue the new naming scheme with Windows “8″ as it could really be NT7 and that could get slightly confusing to people that regularly check the actual build version numbers for some reason. Does anyone plan to lose sleep over this? I certainly don’t.

Personally I like the name and applaud what they are trying to do – less fluff, less “WoW” and more focus on delivering a solid product.

There also appears to be some confusion on whether 7 is just Vista SP2, the answer is a resounding no. Vista SP2 is currently running in a separate beta program and will update both Vista and Server2008 using the same service pack. Windows 7 is a different entity.

Inbox Applications

While some of the inbox applications have received significant updates to their UI to fall inline with the new Ribbon design, others have been removed completely. There are also a couple of welcome newcomers.

The following shots show the new Ribbon UI for Paint, Calc and Wordpad applications:

·

·

Microsoft have *at last* included the ability to burn an ISO from a default installation! Its simple and functional, nothing fancy – but it does exactly what it says on the tin.

·

PowerShell V2 is now included by default in Windows 7 and it comes with a simple editor:

·

Another useful addition is the inclusion of a set of basic codecs to play DivX and Xvid so you can watch your favourite shows without installing any 3rd party codecs. Media Player has also been updated to look more in line with the OS

·

Worth noting quickly is that the sidebar in its current form has been removed from 7, so has the Welcome Centre. Gadgets are still present, but they now just reside on the desktop and can be moved anywhere. They will stick to any edge of the screen should you want them to.

Viewing the gadgets is now easier as the “Win-G” key combination now shows the gadgets instead of the sidebar. In Vista, if the gadgets were not docked in the sidebar they did now show and you had to tab through to display them.

Lastly, some of the bundled applications have been removed:

· Windows Mail

· Windows Photo Gallery

· Windows Movie Maker

This was done for three main reasons:

1. People were getting confused having both inbox packaged applications and the downloadable “Live” brand applications which seem to do the same role. A good example of this is the inbox “Windows Mail” and the “Windows Live Mail” – both are mail clients, look almost identical and both have a very similar feature set.

2. Anything that goes into Windows needs to go through a huge amount of testing and updating them is not a simple task. By removing them from the windows build users should get a better experience as they can be updated more frequently and Windows development is

3. Less applications installed by default for users that have no intention of ever using them.

Installing the “Live” applications is simple, just run a shortcut in the start menu and it starts a download to install the latest versions of the applications you choose from the web.

System Tray

The number of icons taking up space in the system tray has been reduced and only the core system ones are shown all the time by default:

When you install programs that have system tray icons they are not shown, to see them click the little up arrow:

If you are not happy with this default behaviour and want to permanently see some of them click “Customise” and a menu will appear:

Just choose the appropriate option for the icon you want. The options are:

· Show icon and notifications

· Hide icon and notifications

· Show only notifications

I like this new behaviour and find I can hide about 6/7 icons on an install with normal applications installed. Things like WLM/Skype/PowerISO are generally the only ones I show all the time as those are the ones I use most, but its down to personal preference at the end of the day.

Windows Update

In Vista you have to RightClick->ViewDetails an update to see the description, which makes finding what each update does unnecessarily difficult. In 7 the description field has been given a higher priority and its own screen space. Also the type field has been removed in favour of a clearer categorisation view on the left that shows Important/Recommended/Optional updates: