A while ago I started this Q&A series of posts interviewing Aaron Parker (App-V MVP and reviewer of both of my App-V books); and continuing with this series, this time is turn for Rod Trent (myITforum.com owner and CEO).

Rod has been contributing to the IT community in several ways: Evangelizing technical communities, books and articles written, and of course engaging with the large System Center community around the globe with myITforum.com.

You can find more about Rod following him on Twitter: @rodtrent.

Here’s the Q&A:

1. To start with the interview, can you give us a quick synopsis about yourself, your experience and myITforum.com?

I’m a father or four children, ranging from 3 years old to 21 years old and my wife and I, Megan, just recently celebrated our 22nd wedding anniversary. I am a faithful, church-going Christian, an avid gadget fan, a die-hard old television show and cartoon buff, a health and exercise freak, a long-time evangelist of System Center products, and a part-time missionary to the Chinese people.

I have written many books, thousands of articles, and speak at various conferences and User Groups during the year, but my main, professional focus is evangelizing technical community on the web and in “real life”.

I have been in IT for over 25 years. I actually got my start as a computer salesman, moved on to managing a computer repair center, and then finally migrated IT in the early 1990’s, working for a large accounting firm. I have been blessed with a real aptitude to be able to just “fix things.” IT is the perfect industry for that. So, while I’ve kept the techie side, over the years, due to working with myITforum.com, I’ve also become a marketing person. myITforum.com flourishes through the way we highlight and interact with our sponsors. We don’t charge to be part of the community, instead our sponsors help offset our costs, allowing everything on myITforum.com to be free. We don’t believe that support, community, or content should ever have a price tag. So, while it was never an intention of mine to become a marketer, my experience over the last 10 years has been vast, and has served of sponsors well enough to continue building a strong and large community.

Way back in the SMS 1.x days, the product was barely supported by Microsoft itself. So a grass-root, community for SMS 1.x was started on an old, BackOffice support site called, Swynk.com. I ran the SMS section of the web site. I posted articles and tips for SMS since I worked with it daily in my job in a top Accounting Firm. SMS 1.x actually saved our lives at work, giving us the ability to manage desktops with only a handful of support people. So, I simply started sharing my knowledge online. After a few months of success, I was offered a section manager job that paid something like $15 per month and a free technology book.

Traffic and popularity continued to increase, and the community grew larger and larger. Then, at the SMS and Windows 2000 conference (what MMS was called prior to being the Microsoft Management Summit) I was told that Swynk.com was going to be sold to Internet.com. This created a huge issue, as the community cried out with the knowledge that it could, potentially, be broken up.

So, with a little ingenuity and a great set of industry contacts, myITforum.com was born. The community was offline for maybe, 2 months, and then we unveiled myITforum.com 1.0. myITforum.com has gone through numerous changes over the years, but the basic premise has remained. We just help people – and give folks a central location for support, education, training, networking, and giving honest, direct feedback on System Center products.

There’s much, much more to it than that, but that’s the basics. And, the basics work. myITforum.com now receives a little over 145,000 visitors a day, all looking for help and all looking to learn how to manage their environments.

As many probably know our success with myITforum.com and great partnership with Microsoft has led to additional opportunities to be able to reach out and provide community support services for various Microsoft conferences like TechEd and the Microsoft Management Summit. We always look forward to having the great opportunity to “communitize” boring, technical events, and give them that something special to make them memorable and extra valuable.

2. You’ve been really close to System Center evolution over the past years, what do you think about the 2012 editions of this suite? Having all products with the 2012 editions will make a difference in the market?

Pulling the products together is a smart idea, and should really prove gains for Microsoft. ConfigMgr has been the real winner for so long, with very little uptake for the other products. Hopefully, by bringing the products together, particularly from a licensing standpoint, will allow the other products to catch hold. It will be interesting to watch as customers try-out products they would not have before simply because the products are now part of the license agreement.

3. In the past there weren’t many companies that decided to implement the full System Center suite (SCCM, SCVMM, SCDPM, and SCOM) and chose other technologies or simply did not use any tool for specific tasks. Which are the challenges a company should take note in order to consider implementing this complete suite (including also Service Manager)?

Glad you mentioned Service Manager as part of the question. There are pieces of the System Center suite that still seem a bit convoluted and still beta-esque. Service Manager is one of those components. But, whether it’s Service Manager, or some other product, education is the key. Those that have been familiar with specific products, and the way they work, will need to get up to speed quickly, and understand how they can all work together. Orchestrator, in my opinion, is the glue between all of the products, and that may be the single most important piece to understand first.

4. Which are the products and features that you think CTOs and IT decision makers should pay attention the most in the System Center 2012 suite?

From a CTO and decision maker standpoint, I believe the provisioning of the private cloud will be one of the most important aspects. As shown at MMS 2012, you can provision a private cloud in less than 30 seconds. This enables IT organizations to save time, money, and provide SLA and support at unimaginable levels.

5. In the System Center 2012 suite, is there a feature or product that you think might be improved or a missing functionality that should be included in a R2?

I hate to keep harping on Service Manager, but additional functionality is needed to make it easier to work with. Also, in ConfigMgr, Microsoft has to somehow get past the Exchange connector function when supporting mobile devices.

6. Regarding companies’ investments in IT (hardware, services, products, human resources), how do you feel the next few years would be like? Is the cloud model taking over company’s strategies?

The Cloud is on the horizon, but from what I hear in real circles, Microsoft believes it’s closer than anyone else does. It makes sense that they believe this, though, since they are putting so much behind development and marketing of the Cloud from the Microsoft perspective. I believe Microsoft will be highly successful in the private cloud – as to when, that’s up to the customer to decide.

7. With thousands of companies using iPads, iPhones, Android phones and tablets and so on; to maintain compliance, availability and security onto these devices, which is the best approach for client device management?

In line with what I mentioned previously, ConfigMgr and even Windows Intune help to better manage devices like iOS and Android. In fact, Windows Intune may actually do it a bit better than ConfigMgr right now, but I fully expect those functions to show up in ConfigMgr over the life of the 2012 product. If a company wants to manage these devices right now from a full management perspective, they will still need to source a 3rd party; one that provides full integration with ConfigMgr. Odyssey Software (now part of Symantec) is still the best 3rd party solution available.

8. About virtualization and particularly VDI, do you think this trend regarding virtualizing desktops will increase significantly in the following years?

I definitely believe this will happen. In fact, I believe this will become so seamless and so common that it becomes part of normal operating procedure. Right now, VDI gives organizations the ability to not have to worry about compatibility issues with corporate software as they migrate to new technologies. In the very near future, possibly, this will lead to PC operating systems supplied solely from the cloud.

I hope you enjoyed this interview; I’ll get back soon enough with more Q&A sessions.

“Packt Microsoft Carnival” is a special offer released by Packt Publishing during May from which you can acquire several Microsoft’s titles with important discounts, including “Getting Started with Microsoft Application Virtualization 4.6” and “Microsoft Application Virtualization Advanced Guide”.

Packt’s Microsoft Carnival includes a variety of titles on App-V, BizTalk, SharePoint, SQL Server, Silverlight, .NET Framework stack, XNA, Forefront, System Center and more.

Packt has slashed the cover prices on its selected Microsoft titles by up to 30%. Some of the books include:

• Getting Started with Microsoft Application Virtualization 4.6
• Microsoft Application Virtualization Advanced Guide
• Microsoft SQL Server 2012 Performance Tuning Cookbook
• BizTalk Server 2010 Cookbook
• iPhone with Microsoft Exchange Server 2010: Business Integration and Deployment
• Microsoft System Center 2012 Endpoint Protection Cookbook
• Microsoft Data Protection Manager 2010

My two App-V books are also available in other stores, but the “Packt Microsoft Carnival” discount only applies in Packt Publishing site.

See also: Deploying Windows 8: Unattended Installation Using Windows Deployment Services (WDS) – Part I

In the first post of this series we’ve already reviewed the initial steps for preparing Windows Deployment Services (WDS), adding boot and clean Windows 8 images into the environment, an also how to capture a reference Windows 8 image for deployment. Now, it is time to take a deeper look into the unattended process for deployment.

In this post we will complete our step-by-step guide for unattended deployment of Windows 8 images: Understanding unattended deployment process, generating our own unattended/answer files, reviewing some examples and deploying a full Windows 8 image using our unattended files.

Understanding Unattended Files

The process of automated and silent deployment of an operating system, as well as for any application, depends on parameterizing correctly our setup. These parameters are stored in what we call unattended or answer files.

Starting in Windows Vista / Windows Server 2008 (these two have the same OS kernel), Microsoft improved the setup process of operating systems making it highly scalable and simpler. That’s why these unattended files are presented in an XML.

Using XML as unattended files makes sense since this markup language is used to structure, store, and transport information. Structure is a key term because Windows setup is composed by “configuration passes” which are basically the phases of a Windows installation; and the answer file can structure the information in an efficient manner to offer answers for each phase.

Reviewing Configuration Passes

As we said, the configuration passes represents the phases included in a Windows installation; those phases are basically the same since Windows Vista, even though several of its components have changed over time.

To understand a little bit more about the unattended files we are about to create, let’s review the configuration passes included:

1. windowsPE: In this phase we can find the configurations and parameters used in Windows Preinstallation environment (reviewed in Post I), for example handling the disk where we are going to install the OS.
2. offlineServicing: This configuration pass is used to apply updates, drivers, or language packs to a Windows image.
3. generalize: In this phase computer-specific information is removed from the Windows installation enabling you to capture and reapply the Windows image to different computers.
4. specialize: In this stage we can find several Windows configurations like enabling features, network settings and domain settings.
5. auditSystem: This phase is only used when we select to boot using audit mode. Settings apply here before a user logs onto the computer, for example to installing out-of-box drivers.
6. auditUser: This phase also runs when audit mode is selected in the boot process. Here are settings applied when a user logs onto the computer.
7. oobeSystem: In this configuration pass, settings are applied before the “Windows Welcome” message starts. Some options usually used are language or creating user accounts.

Here’s a short diagram, taken from Microsoft TechNet, to explain the configuration passes:

For more information, visit the following link: “How Configuration Passes Work”

Reviewing Unattended Files Best Practices

Before we jump into creating our own unattended files, let’s review some common best practices we need to know:

• Review and understand configuration passes: We need to have the installation phases clear as we explained above; understanding them will allow us to use the right components and settings.
• Always validate answer files: Windows System Image Manager (WISM) is the tool we are going to use to create our unattended files; this tool includes the option for “validation” which verifies that the settings we’ve configured are set correctly and there’s no inconsistency.
• If you have Windows Vista / Windows Server 2008 unattended files, do not try to use the same for Windows 7 or Windows 8: Even though all of them use XML files, there have been several changes in time. Take a look to the following link: “Changes in Unattended Setup Settings from Windows Vista and Windows Server 2008”.
• Don’t add unnecessary settings: Answer files could contain hundreds of settings, which translate in time to parse them and slow installation processes. Do not use unnecessary settings that could delay the OS deployment.
• When you are not sure about the setting value, try WISM help: All of components include a “help” option which describes the setting and provide some examples. If you are not sure what value to use or if you can leave the setting “empty”, check the help file to verify.
• Use separate answer files for separate images and architectures: It is not convenient to use same answer file to different OS architecture. Even though it is possible to include same settings for both architectures in the same file, it could lead us into deployment problems or failures.

6. Preparing Windows System Image Manager (WISM)

Windows System Image Manager (WISM) is included in the Windows Automated Installation Kit (AIK) as one of the tools offered to customize Windows OS deployments.

Using WISM we are going to be able, taking a selected OS image, to retrieve the configuration passes included and modify the settings available on each phase. To prepare it for creating our unattended files we only need a simple process:

6.1. Download and install Windows Automated Installation Kit (AIK).

6.2. Copy the “install.wim” file from Windows 8 media to a local folder (must be available to WISM for read/write operations).

If we don’t have the media available, we can still use the reference Windows 8 image we’ve uploaded in Post I. We need to use the “Export” option from WDS console.

6.3. Access Windows System Image Manager (WISM), “File” and “Select Windows Image” and select the WIM file we’ve copied or exported.

If WISM is not able to perform read/write operations to the file we selected we will receive an error message saying “Windows SIM was unable to generate catalog. Details: The specified image file did not contain a resource section”

6.4. Now we will have all the components available in the image. We are going to select several of these components and add those to the configuration passes.

Optionally we can use a “Distribution Share” in WISM; in here we can save drivers and other files to use them in the configuration passes.

7. Creating and Using WDSClientUnattend.xml

Here’s an example of WDSClientUnattend.xml for Windows 8.

Now that we have WISM ready to start creating answer files, we are going to start with the first one used by WDS: WDSClientUnattend.xml. In this file, we will configure all necessary components related to our first configuration pass: windowsPE.

The components we will need to add are the following:

• amd64_Microsoft-Windows-International-Core-WinPE_6.2.8250.0_neutral\SetupUILanguage
• x86_Microsoft-Windows-Setup_neutral\DiskConfiguration\Disk\CreatePartitions
• x86_Microsoft-Windows-Setup_neutral\DiskConfiguration\Disk\ModifyPartitions
• x86_Microsoft-Windows-Setup_neutral\WindowsDeploymentServices\ImageSelection\InstallImage
• x86_Microsoft-Windows-Setup_neutral\WindowsDeploymentServices\ImageSelection\InstallTo
• x86_Microsoft-Windows-Setup_neutral\WindowsDeploymentServices\Login\Credentials

7.1. To start adding them, in “Components” right-click on the selected one and use “Add Setting to Pass 1 windowsPE”.

7.2. After adding all of those mentioned, the WISM console should be looking like this.

Now we need to start editing this components and adding some values.

7.3. For example: Selecting “amd64_Microsoft-Windows-International-Core-WinPE_6.2.8250.0_neutral”, we need to configure the options for “InputLocale”, “SystemLocale”, “UILanguage”, “UILanguageFallback” and “UserLocale”. In my case I’m selecting all of them as “en-US”.

To understand the option we are selecting, we can right-click the setting in WISM and select “Help”. In there, we will find a complete description to understand the setting and in some cases a few examples to use in the answer file.

7.4. The rest of values that need to be added can be reviewed in the following table:

Here’s an example of WDSClientUnattend.xml for Windows 8.

Notes:

• When we use the “CreatePartitions” and “ModifyPartitions” components, we need to first right-click on this option, select “Insert New CreatePartition” and then we will receive the options to edit.
• Value used in “Filename” name must be the WIM file located in WDS. For example “install.wim”.
• Also, in “ImageGroup” and “ImageName” we must use the values used in WDS console.

7.5. After completing the settings values, we need to validate the answer file. Select “Tools” and “Validate Answer File”.

7.6. Verify that in the lower section, “Messages”, there’s no warning / error appearing.

7.7. Save the file and place it in “%drive%\RemoteInstall\WdsClientUnattend”. This particular file must be located in this folder, and should not be moved.

7.8. To configure the unattended file, access the WDS console and right-click the name of the server selecting “Properties”.

7.9. Select the “Client” pane. Since in this example we’ve used the x64 architecture, browse for the XML file in the selected section.

IMPORTANT: Using WDS we can only assign one WdsClientUnattend file at a time (considering the same architecture for all clients). And as we can see, these file contains the image file we are going to install, so every time we need to change the image, to use a full unattended installation we are going to need to manually change the unattended file.

8. Creating and Using AutoAttend.xml

Here’s an example of AutoAttend.xml for Windows 8.

Our second unattended file is dedicated to the Windows customization, as well as providing some important settings to the computer, for example: Product key, computer name, joining it to domain or workgroup, and so on.

Using this answer file we are going to focus in two configuration passes: 4 specialize and 7 oobeSystem. Let’s take a look to the components we are going to use:

Cycle 4: specialize

• amd64_Microsoft-Windows-UnattendedJoin_neutral\Identification\Credentials
• x86_Microsoft-Windows-Shell-Setup_neutral

Cycle 7: oobeSystem

• amd64_Microsoft-Windows-International-Core_neutral
• amd64_Microsoft-Windows-Shell-Setup_neutral\OOBE
• amd64_Microsoft-Windows-Shell-Setup_neutral\Themes
• amd64_Microsoft-Windows-Shell-Setup_neutral\UserAccounts\AdministratorPassword
• amd64_Microsoft-Windows-Shell-Setup_neutral\UserAccounts\LocalAccounts\LocalAccount\Password

8.1. Select “File”, “New Answer File” WISM to start creating the new unattended file.

8.2. Add the mentioned components to their particular cycles.

8.3. After it’s done, the WISM pane should look something like this.

8.4. Complete the settings using the values shown in the following table.

Here’s an example of AutoAttend.xml for Windows 8.

Notes:

• In “ProductKey” setting, the value must be entered using the “-“ as separator between 5 digits. For example: 6RH4V-HNTWC-JQKG8-RFR3R-36498
• When we add “LocalAccount” component, as we did for disk partitions, we need to right-click the component and select “Insert New LocalAccount”. In my example, I’m adding the “Admin” user in the Administrators group.

8.5. Validate the answer file. Take note that using these components, there will be some warnings generated that we can actually ignore.

For example, some components that is deprecated and no longer used in Windows images like “StartPanelLinks”.

8.6. Save the answer file and place it in any location available for WDS Server. This particular file does not have to be saved with any special name nor location.

8.7. To associate this file with the reference Windows 8 image, access the WDS console and select “Properties” in the install image we would like to use the unattended file.

8.8. In the lower section, select the option “Allow image to install in unattended mode” and select the file we’ve just created.

9. Deploying Windows 8 Using Unattended Files

Once we have completed the unattended files and associate them in Windows Deployment Services (WDS) console, the rest is really simple: Just turn on a client machine and start a PXE boot.

9.1. Start the PXE boot in any client machine.

9.2. Make sure you select the Windows PE for booting an installation and not the capture process.

9.3. Review that the steps are completing without any user intervention.

When the normal installation is finished, in “Finalizing your settings” stage all the customizations in the image will be performed.

9.4. After the process is done, we should see in our case the OS ready for account login using domain credentials.

Conclusions

As we can see, the processes involved for a fully unattended deployment of Windows 8 are really simple:

• Installing and configuring Windows Deployment Services (WDS) only requires a couple of wizards.
• Adding clean boot and install images for Windows 8 to WDS does not require any complexity, just by using Windows media we can complete it.
• Capturing a reference Windows 8 basically requires running sysprep and boot the machine using a capture boot image.
• To create our own unattended files using WISM, we have all the support we need in the same tool.

Taking these aspects into account, I think all IT departments should consider using an automated and unattended deployment for Windows operating systems. Using this free tools offered by Microsoft can improve IT processes efficiency in large amounts.

See also: Deploying Windows 8: Unattended Installation Using Windows Deployment Services (WDS) – Part I

See also: Deploying Windows 8: Unattended Installation Using Windows Deployment Services (WDS) – Part II

For a while now I’ve been preparing articles in this blog regarding deploying operating systems, and especially unattended deployments. I’ve started with Windows Vista deployments and the initial version of Windows Deployment Services (Post I, Post II and Post III); the moving forward with Windows 7 using also WDS (Post I and Post II), and also MDT 2010 adding Microsoft Office 2010 to the mix (Post I, Post II and Post III).

And of course, with the release of Windows 8 I had the necessity to prepare a new set, even though this new OS is just at “Consumer Preview” beta.

This set of posts is intended to provide step-by-step procedures to accomplish a full automated deployment of Windows 8 using WDS.

Overview of the Process

The main goal of this process we are going to review in detail is to provide an unattended deployment of Windows 8 using Windows Deployment Services (WDS).

In order to provide a complete guidance, we are going to capture an installed Windows 8 image, add it in WDS and then use this customized image to deploy it using unattended files.

In this set of posts we are going to examine:

1. Reviewing requirements.
2. Installing and configuring WDS Role.
3. Adding Boot and clean Windows 8 images to WDS.
4. Create a capture boot image in WDS.
5. Capture the Windows 8 reference machine.
6. Prepare Windows System Image Manager (WISM).
7. Manage first unattended file: WDSClientUnattend.xml
8. Manage second unattended file: AutoAttend.xml
9. Deploy Windows 8 using Unattended Files.

1. Reviewing Requirements

For the scenario we are going to review, here are the pre requisites we must fulfill in order to complete the unattended deployment of Windows 8:

• Active Directory and DNS server in place. The computer running WDS must be a member of an Active Directory.
• An active DHCP server on the network
• An NTFS partition on the server with the WDS role to store your OS images.
• Windows 8 media. To download it, access this link “Windows 8 Consumer Preview”.
• Windows Automated Installation Kit (WAIK). This is an optional component that we can use to create unattended files.

The WAIK version we are going to use is the version released for Windows 7, which is available in the following link: “The Windows® Automated Installation Kit (AIK) for Windows® 7”

2. Installing and Configuring WDS Role

The steps necessary for this are really simple and covered in this previous post of mine: “Deploying Windows 7 Using Windows Deployment Services (WDS): Step-by-Step – Part I”.

3. Adding Boot and Clean Windows 8 Images to WDS

These steps are also simple if you ever manage WDS. Let’s review them:

3.1. Access the WDS Console and right click in “Boot Images” and select “Add boot image”.

3.2. Select the Windows 8 media and locate “%drive%\sources\boot.wim”.

The “boot.wim” file is the Windows Preinstallation Environment (Windows PE), which is a minimalistic OS in charge of preparing the environment prior the installation. For more information about Windows PE, check the following link: “What is Windows PE?”

3.3. Select the name we are going to use to identify the image, in my case “WinPE – Windows 8 (x64)”.

3.4. Click “Next” in the following screen and wait until the process completes.

3.5. Once it’s completed, in the WDS console the new image will appear.

3.6. Now, for adding a clean Windows 8 install image, in the WDS console right-click “Install Images” and select “Add Install Image”.

3.7. Create a new image group; in my case I’m using “Windows8”.

3.8. Select the installation file available in Windows 8 media in the following path: “%drive%\sources\install.wim”.

The “install.wim” file is where all the Windows operating system files are stored and compressed for optimization. In this new version, the Windows 8 files we have available in the media correspond to the specific version of Windows we’ve downloaded. In the previous versions (Windows Vista and Windows 7) the size of “install.wim” was a little bit bigger since it contained files from several OS versions.

Also, in Windows 8, the compression algorithm for this file has change in order to optimize the download process for installation.

3.9. Click “Next” in the image selection window.

3.10. Also click “Next” in the following step to confirm the new image to be added.

3.11. Once we click “Finish”, we will see the new image added to Windows Deployment Services.

An important part of the OS life cycle in our environment is to distinguish the base images we are using. This base image does not only refer to the OS, it also includes the applications and basic configurations we add to the operating system.

Even though we don’t need to capture a reference Windows 8 image to accomplish an unattended deployment, we are going to take this scenario to understand a little bit more about the possibilities in WDS.

4. Create a Capture Boot Image in WDS

In order to be able to capture a Windows 8 image using WDS, we must convert a boot image into a “Capture Boot Image”.

This type of image is basically a Windows PE modified to be in charge of capturing a prepared Windows 8 image, instead of providing the environment for an installation. The steps are really simple:

4.1. Copy the “boot.wim” file located in Windows 8 media to a local folder in WDS. Alternatively we can “Export” the boot image we’ve added in WDS.

4.2. Right-click in the existing boot image in WDS and select “Create Capture Image”.

4.3. Select the image name, description, and the location of the “boot.wim” file copied in the first step.

4.4. We’ll receive a warning regarding the image we are about to modify: “Image File with the same name already exists. Do you want to append to the existing file?”

Clicking “Yes” will keep the original WinPE image and add the capture WinPE; if we click “No”, the entire image will be overwritten with the new capture WinPE.

Take note that we are not going to replace the boot image we’ve added earlier in WDS; in these steps we are going to generate a new one.

4.5. Complete the steps and select “Add image to the Windows Deployment Server now”.

4.6. Confirm the location of the new boot.wim file.

4.7. Insert the boot image name, in my case “Capture (x64)”.

4.8. Complete the wizard and the new boot image should be added to WDS.

5. Capture the Windows 8 Reference Machine

The capturing process of a Windows image is performed by using a tool provided by Microsoft “sysprep”. Sysprep is the component Microsoft provides in order to IT teams be able to scale OS implementations.

With sysprep we are able to “generalize” an OS by removing some particular characteristics in Windows and transforming this new “generalized” image in a prepared OS ready for a massive deployment. If the image is not generalized we will not be able to capture it using the image we’ve selected earlier.

By applying sysprep we’ll be able to remove some specific data from the OS installation, for example:

• Computer name
• Owner and Company name
• SID
• Domain or workgroup membership
• TCP/IP Settings
• Regional and keyboard settings
• Specific hardware drivers. This refers to specific computer hardware, like video or audio drivers. But if you only applied drivers used on the Windows installation, the same will apply for the deployment, but any other external driver installed will be unavailable.
• Any saved network connections (wireless networks saved)
• OS product key. This is an important note, since no matter if your product has been activated; the key is reset after this process.

But of course, there are other several components that will be kept to maintain this as a base image. For example:

• Programs and features installed.
• Local Users and Groups created.
• Product Keys used for programs installed. Meaning if you have Microsoft Office installed, the key used will remain as the same on the deployments.
• Windows updates installed
• User Profiles: Since all the profiles configuration are basically data stored on the Users folders, all that information will be uploaded within the image.
• Printers installed.

For more information about sysprep, take a look to the following link: “What Is Sysprep?”

The process of preparing the image requires only running a specific command line; let’s take a look to the steps:

5.1. Access the reference Windows 8 image.

5.2. In a command prompt, locate the following folder: “C:\Windows\system32\sysprep”.

5.3. Run “sysprep /oobe /generalize /shutdown” (alternatively the /reboot parameter can be used). This command line will generalize the OS removing the specific components mentioned above and shutdown after the process is completed.

We must remember that, since this OS is going to be generalized, the next the normal boot process occurs, it will appear as Windows was just installed. And, of course, prior to that we must capture this image and store it as our base Windows 8 image in WDS.

For more information about this generalize process, take a look to the following link: “Prepare to Capture an Image for Deployment (Generalize)”

5.4. Configure the reference machine to boot from network. Usually by using F12 in the start of the boot process we will be able to select the network card as the preferred boot option.

5.5. Boot from network in the reference machine. Since we have two boot images available in WDS, we should see something like this.

Select the capture image.

5.6. Once the capture image is loaded, a new wizard will appear.

5.7. Select the volume to capture “C:\” and select an image name and description.

If no drive is available to select, this means that the image was not generalized properly. The only volumes that can be captured are those generalized with sysprep.

5.8. Select a local path for the image location and optionally we can upload the image we are going to create to WDS; for that we need to use the WDS Server FQDN (we will be prompt for credentials) and selecting the image group.

If the image is not uploaded to WDS, we can still retrieve it later in this machine and import it manually to the server using the WDS console.

The capturing process will start and is going to take a while to prepare the reference WIM file.

With that, we’ve completed the steps to prepare our environment and the reference image is uploaded in WDS.

In the next post, we are going to take a deep dive into the unattended files: Understanding how they work, some best practices and of course generating our own for a complete unattended Windows 8 installation using WDS.

See also: Deploying Windows 8: Unattended Installation Using Windows Deployment Services (WDS) – Part II

In this second part of this series of posts, we are going to review some step-by-step processes about the integration of App-V with System Center Configuration Manager 2012 (SCCM), which is included in my book “Microsoft Application Virtualization Advanced Guide”.

The entire chapter can be downloaded for free in this link, where you can find more information about this integration.

Implementing SCCM and App-V Integration

And now, after reviewing all the benefits, requirements and considerations about the integration it is time to get our hands into the SCCM 2012 and App-V integration.

Distributing the App-V Client with SCCM 2012

Once the SCCM 2012 platform is installed and the client agents were deployed successfully, in this section we are going to review how to install the App-V Client in a given SCCM Collection.

In this example, we will use the “setup.exe” file which installs the pre-requisites in the same process. The file “setup.msi” can be used separately, but the pre-requisites must be installed also separately.

Distributing the App-V Client using SCCM is not necessary for the integration to take place; this is an optional step and should not be considered if the App-V Client is already installed in all clients.

Let’s review the process for adding and installing the App-V Client package:

1. Within “Software Library” pane, we have several options available. Since this “application” contains several files necessary to complete a successful installation; under “Application Management” right click “Packages” and select “Create Package”.

2. Specify the package name and enable the “This package contains source files” option.

3. In “Source Directory”, select the UNC path for the installation files.

One great improvement in SCCM usability is how we use the “Programs” assets, which are basically the command lines to be used for deploying packages or scripts.

Using SCCM 2012, soon as we try to add a package we will be asked to insert a new program (previously, this program had to be created separately).

4. In “Program Type”, select “Program for computers”.

5. Select the program command line and other parameters. Since I’m using the .exe file, the command line used is the following:

setup.exe /s /v"/qb-! SWICACHESIZE=\"6144\"

6. In “Requirements” we can configure several parameters prior to run this program; for example: The client platforms to be installed or the estimated disk space.

7. Complete the wizard.

8. Soon as the package is added, we can select the option “Deploy” in the SCCM 2012 console for that package.

9. In the “Deploy” option, we will receive a new wizard. The first option will let us select the “Collection” to be used for this deployment.

10. In “Deployment Settings” we can configure how to deploy this package: “Available” is used to let the package be available to the client and let the user decide when to install it; or “Required” which will automatically install the client.

11. In “Scheduling” we can configure the schedule options for this package to be installed. In my example I’m using “As soon as possible”.

12. In “User Experience” we can configure options about the possibilities each user receives when the installation or assignment is taking place.

13. In the next window, we will receive the options regarding the type of delivery methods: Streaming delivery or local delivery (download and execute).

a. “Download content from distribution point and run locally” represents the local delivery method.
b. “Stream content from distribution point” represents the streaming delivery.
c. Note also that we can configure a different type of delivery depending if the client is connecting from the same LAN or using a slow connection.

14. In “Summary” review the deployment settings for the package and finalize the deployment configuration.

Using the “Monitoring” pane we can review the current status of the deployment, including the “Completion Statistics” which retrieve a simple and easy report overview of the deployment without requiring running any specific report.

Also in this section we can modify the deployment properties configured recently for the same package.

Using Virtual Applications in SCCM 2012

Creating, handling and deploying virtual applications within SCCM 2012 has been simplified regarding what we needed to configured using SCCM 2007 R2. Virtual applications are supported by default without requiring any execution change in the platform.

Creating Virtual Applications

The concept of “Importing” virtual applications does not apply anymore in SCCM 2012; “creating” is the right word in this case. But the basic steps remain the same, to create a virtual application we need the basic component: The manifest (XML file).

Let’s review the step-by-step:

1. In “Software Library”, “Application Management”, right-click “Applications” and select “Create Application”.

2. Select the path for the application manifest using the UNC. In this example we will be using “Winamp” virtual application.

3. Complete the information about the application: Name, version, and so on.

4. Complete the wizard and the application will be added into SCCM.

Soon as the application is added we can configure its deployment using the same section in the console.

Deploying Virtual Applications

The deployment process of App-V packages is pretty much the same used in SCCM 2007, but some interesting options are added in the process.

Some of these new capabilities are not actually new but the usability of these features has been simplified in order to optimize our deployments. Some of the interesting capabilities are: Handling deployments types; or generating alerts depending on success and/or fail rate.

Let’s take a look at the deployment process in SCCM 2012 for virtual applications:

1. In the “Software Library” section, and using the applications list we can right-click the application we would like to deploy and select the option.

2. Select the “Collection” of devices where we would like to deploy this app, and also use the distribution point associated from which the clients will retrieve this application. In this example, “Distribution Point” is used with the SCCM 2012 Beta 2 installed “TESTDRIVEB2”.

3. In “Deployment Settings” we have the same options reviewed earlier, “Available” and “Required”.

4. In “Scheduling”, as seen before, we can define when this application will be available for deployment in client devices.

5. In “User Experience” we have similar options than the ones we’ve seen in the App-V Client package. In this section, we can configure to “Hide all notifications” for the users; this option is not selected as we will be reviewing the installation process in the client later.

6. Deploying software also includes the possibility to manage the alerts regarding this process. We can configure this deployment to elevate alerts for SCCM and/or System Center Operations Manager (SCOM).

In the SCCM section, we can configure the following options:

• Warning if deployment success rate is below selected percentage.
• Warning if deployment failure rate is below selected percentage.

And for SCOM, we must enable the option for generating alerts in Operations Manager. Enabling this option the SCCM client will communicate with the SCOM agent in the same machine to elevate this warning.

7. Review the “Summary” and complete the wizard.

Once the steps are completed, in “Software Library” section we can also review the “Deployment Types” records existing for the applications.

Double-clicking the deployment type, we will get the parameters configured earlier, plus a few more we should consider. Let’s take a look:

· In the “Content” tab, some of the options available:

• “Persist content in the client cache”: This option is used when we want to store this application in the cache and prevent an automatic deletion (which must be configured manually) for the files used.
• “Enable peer-to-peer content distribution”: This option is used for client machines to distribute the content with other client machines that are near. This parameter is not yet documented by Microsoft, so we cannot confirm about how does it works exactly.
• “Load content into AppV cache before launch”: Again, this option is not documented by Microsoft yet, but what we assume is that the package is loaded completely into App-V cache prior launch, instead that just the Feature Block 1.

• In the options below, as we reviewed earlier we can find the behavior of the delivery types: Streaming delivery or Local delivery (Download and Execute).

· In “Requirements” tab we can configure the dependencies about the deployment. In this case, there’s only selected an “Operating System”, but there are several other options like: Client’s memory, disk space, processor, existing registry path, and so on.

Here’s an example of creating a “Global Condition” (selecting a “Custom” requirement) to be included as a requirement in application deployment: Here, we will be using to be assessed by the client prior the deployment, if the file exists, the deployment continues.

As a reference, we will be using the “Program Files” App-V Client default installation folder, and selecting the App-V Client Management Console (“SftCMC.msc”).

· In “Dependencies” we can configure an existing application as a dependency to deploy the application.

· Each dependency can be configured with a selected “Priority”; this option is used with an “Auto Install” parameter. The application with higher priority will be installed first.

We cannot configure an existing SCCM package as a dependency. The only possibility is a previously added application.

Deployment Types

The “Deployment Types” are basically a deployment profile configured for an application. Using this option in SCCM we are can configure different parameters for an application deployment to take place.

Take note that these “Deployment Types” are used to set parameters in the process of deployment behavior, but not parameters into the application settings.

On every application we can have different deployment types configured by just right-clicking the application and selecting “Create Deployment Type”.

Within the wizard, we will get the chance to configure all the necessary parameters for deployment. Completing this option and having different “Deployment Types” we can be certain to fit each deployment process in every scenario.

Here are some examples:

• We might need different “Requirements” for 32-bit and 64-bit clients: The App-V Client installs on a different “Program Files” folder and adds different drivers in each case.
• For roaming users, we would like to use the Local Delivery (Download and Execute) for client machines; guaranteeing users to run when the application is loaded locally and not depending on a streaming server.

Deploying Applications in Clients

Once we have configured the application and the deployment process, we just need to wait that the package is deployed in the SCCM client.

SCCM 2012 includes “Software Center” for every client machine deployed, using “Software Center” we can retrieve the latest status of applications available and installed for the client machine; as well as information about each package.

In this example, the client machine shows the virtual applications which are already installed, as well as virtual applications available to installation. For those applications marked as “Available” we must manually select “Install” to complete its installation.

The installation of the package depends on the package size and the deployment parameters we’ve configured.

Since we had configured earlier for not suppressing notifications, we should receive all the messages about the deployment processes.

Also, we can review in the App-V Client console about the current applications deployed. We can verify that the package URL for each application deployed using SCCM must be directed to the local SCCM cache (default location in C:\Windows\ccmcache).

With those verifications, we can confirm that our SCCM + App-V integration is working properly for deploying applications.

If we need to troubleshoot virtual applications deployments, the SCCM clients also includes a log file dedicated for virtual apps. This log file can be found, as the rest of SCCM logs, in “C:\Windows\CCM\Logs\VirtualApp.log”.

With that, we’ve completed the App-V and SCCM 2012 integration review. Remember that the entire chapter can be downloaded in this link.

My second App-V book was finally published, “Microsoft Application Virtualization Advanced Guide” and as for my previous book, there’s one sample chapter available for download.

The chapter selected in this case is “Integrating App-V with System Center Configuration Manager 2012”, from where we review all that needs to be known about SCCM integration with virtual applications.

In these two posts I’m going to take a tour around that content as a quick overview and also some step-by-step guidance to accomplish this integration.

Understanding SCCM and App-V Integration

Integrating System Center Configuration Manager with App-V is a far much simpler with the new versions of these two platforms. Let’s review some of the benefits, considerations, delivery methods and components required.

Benefits of Integrating SCCM and App-V

There are several benefits we can review about using SCCM and App-V as an integrated platform instead of separate technologies. Let’s review some of the most important ones:

• Optimizing our Infrastructure: If we have already implemented SCCM in our environment, not integrating with App-V could translate into larger costs of management, troubleshooting, complexity and hardware; since you will need to implement Streaming Server functionality separately from Distribution Points. This role in Configuration Manager can fulfill the streaming process without acquiring big changes in our implementation.
• Improving client targeting: System Center Configuration Manager brings the possibility to deploy normal and virtual applications with an enhanced level of targeting, depending on collections and capabilities of the systems involved.
• Complementing App-V with SCCM assessments: App-V includes user targeting for their packages; integrating with Configuration Manager we can combine these possibilities with software metering, asset intelligence and wake-on-lan features for the virtual applications deployment.
• Virtual Applications delivery as a complement in Operating System Deployment: One of the most important features in SCCM is Operating System Deployment (OSD), which can be combined and scaled up with other features like Software Updates, software and hardware inventory, targeting for implementing operating system’s drivers, etc. Using App-V we can deliver applications as soon as the operating system is deployed, saving considerable time to deliver a ready-to-go operating system.
• Background delivery of App-V applications: In unstable or slow networks BITS protocol can be leveraged allowing application delivery as network connections permit. The SCCM client performs the download of the App-V application into the SCCM cache where it is then imported into the App-V cache. This offers much more flexible application delivery but comes with a storage penalty on the client. The application will exist in both the SCCM and App-V client cache and cannot be purged from the SCCM client cache. This means in this delivery model that there is at least a doubling of the storage required on the client for this delivery model.

Some Considerations about the Integration

SCCM does not provide the exact functionalities we can find in the native App-V components implemented. The idea of SCCM integration is to complement with the App-V platform. But, because of the Configuration Manager architecture, there are some considerations we should review.

Most of the integration features remain undocumented by Microsoft at the moment; but analyzing the infrastructure using the Beta and Release Candidate version of SCCM 2012 appears to maintain basic architecture definitions than from the previous version – SCCM 2007 R2/R3. Here are some of the considerations we can find so far:

• We must re-advertise an application when there’s an active upgrade: “Active Upgrade” is the process that we run in an App-V package to update the application using a service pack or any other of modification; the App­-V Full Infrastructure Model automatically delivers the new version to clients. SCCM does not handle updates in the same package as a delta that must be delivered to clients, so we will need to make a new advertisement every time there’s a virtual application update.
• Reduced reporting: App-V Full Infrastructure provides a very important set of reports we can execute and retrieve about our virtual application; Configuration Manager does not provide the same level of reporting. Using the “Local Delivery” as the preferred method for delivering applications it is not possible to report on how many times an application has been used.
• Targeting applications for Remote Desktop Services requires that users must logoff and logon in their sessions: This is not a limitation only for virtual applications, applies for all Configuration Manager Clients’ user targeted and /or user interaction with the SCCM client. The SCCM client only allows software distribution to the console session of a terminal server system (mstsc.exe /console). Therefore, if an application delivery is targeted to users that are using a remote session on the terminal services system; they will not be able to execute the advertisement.
• Asset Intelligence (in charge of reporting and inventory features) requires Feature Block 1 present in the virtual application streamed to clients: Asset Intelligence cannot inventory virtual applications applications that co-exist with the same version of an application installed locally. As we mentioned, virtual applications live within their own environment; making it possible for the same application working as installed locally and virtually deployed. If that’s the scenario, Asset Intelligence won’t inventory the App-V package.
• In order to use Dynamic Suite Composition (DSC) in virtual applications both interconnected packages must be advertised and registered with the App-V Client. That’s why using the delivery method Local Delivery (Download and Execute), later to be discussed, is the recommended option when we are using DSC.
  We can also use “Dependencies” in SCCM to guarantee that both packages can be delivered normally.

Components Involved

In this integration, we must understand which components are interacting in these two platforms:

• App-V Sequencer: The process of capturing it is the same and we don’t need to introduce any changes in that phase.
• SCCM Site Server: In charge of managing and handling the actions performed by the SCCM Distribution Points.
• SCCM Distribution Point: Storing and distributing the App-V applications.
• SCCM Client: Client agent agent that communicates with System Center Configuration Manager and receives the virtual applications.
• App-V Client: SCCM Client and App-V Client work together: The SCCM Client delivers the virtual application to the App-V Client Client, which has the responsibility of executing it.

Understanding Delivery Methods

Using SCCM to deploy virtual applications includes two types of delivery methods we can use to fit any specific scenario. These two delivery methods are the same that appeared in the App-V + SCCM 2007 integration.

The delivery methods remains the same, but SCCM 2012 adds some twists in the configurations that we can achieve, using some options that we are going to review later like “Persist content in the client cache” and “Enable peer-to-peer content distribution”.

Applying the different delivery methods will basically depend on the type of connectivity the client machine has with the SCCM distribution point; converting this integration into a highly scalable one since we can discriminate the type of user with a specific type of streaming delivery.

Let’s go through each type: Streaming delivery and Local delivery (Download and Execute).

Streaming Delivery

When using this delivery method, the App-V Client will be configured to receive applications using HTTP/HTTPS (Standard Distribution Point) or SMB (Branch Distribution Point) streaming.

This is how the delivery works in the streaming mode:

In this process we can evaluate the entire workflow in the Streaming Delivery from the moment the application is sequenced. These set of steps should be familiar to us if we already know and understand how a Streaming Server works with virtual applications, but note the following:

1. The App-V Client does not stream an application until one of the shortcuts of this application is double-clicked.
2. Once the streaming process started, the same behavior occurs at first: The Feature Block 1 is delivered from the SCCM Distribution Point to the App-V Client cache.
3. Once the application is running, the rest of the package is streamed down by the App-V Client.

The streaming delivery method must be considered when the clients and servers live in the same LAN; remember that the streaming process requires high-bandwidth connections. Another good example of using this method is when we have applications which are constantly updated, the updates occurs in the Distribution Point which delivers the new package to clients.

Avoid using this method when we have several offline users.

Local Delivery (Download and Execute)

The Local Delivery (download and execute) method explains itself; the initial task executed by the client is downloading the application, the complete package, and then executes it.

In this downloading process, the application is delivered to the SCCM client cache and then the SFT file is streamed from the SCCM clients’ cache into App-V clients’ cache. Basically the SCCM Client works as a local streaming server for the App-V Client.

This is how the delivery works in this mode:

In this process workflow we can see clearly how the SCCM Client is in charge of downloading the entire content of the package as soon as it’s advertised. But only when the user clicks on any of the shortcuts from the application, the App-V Client streams the application to the cache from the SCCM Client cache; and then it completes the launch process.

The application stays in App-V cache, ready to be launched, as long as the advertisements in Configuration Manager maintains.

The Local Delivery is the best approach when we are using slow networks between servers and clients, and of course for offline users; who can work normally with the application even when they are not connected to the network.

The Local Delivery also needs considerable amount of storage: Three times the size of the applications package: One for the SCCM Client; another for the App-V Client; and the third one is stored for calculating differentials when the application receives an update.

App-V Client and the “OverrideURL” Setting

As we reviewed, in both delivery methods the SCCM client streams down to the App-V client cache the applications published; to accomplish this, the App-V Client includes a new registry value “OverrideURL”.

This value can be changed to use an alternate server in charge of delivering the virtual applications. All this process is transparent for the user, the value is changed by the SCCM client and the streaming process is redirected to the Configuration Manager Distribution Point in charge of the delivery.

This is a simple diagram where we can see the interaction between the SCCM Client and the App-V Client.

Even though this concept appeared in the integration of App-V and SCCM 2007 R2, the basic functionality remains in this new version SCCM. Reviewing the deployment of App-V applications using SCCM we can confirm that the OverrideURL behavior is maintained, there’s an example of the Winamp virtual application (deployment reviewed later in this chapter) and the registry settings in the App-V Client.

The “OriginalURL” setting displays the configuration used in the OSD, and the “OverrideURL” use the SFT location in the SCCM Client cache.

Requirements for the SCCM + App-V Integration

In order to accomplish this smooth integration and without adding significant load into our operations, we must understand each of the requirements involved.

The requirements do not differ much from what we’ve seen earlier in SCCM 2007 R2, which is an important advantage if we already have this platform implemented and we are considering migrating to SCCM 2012.

The two important requirements we are going to analyze are: Platform requirements in SCCM 2012 and storage requirements for sizing the SCCM client cache.

SCCM 2012 Platform Requirements

Even though it could sound pretty obvious at this point, remember always that having a healthy environment in SCCM represents an important note before starting with changes in the environment.

Regarding System Center Configuration Manager 2012 components, the basic platform is needed:

· Primary Site.
· Site Server: A Site Server with the following roles installed:

• Site System.
• Site Server.
• Component Server.
• Distribution Point.
• Fallback Status Point.
• Management Point.
• Reporting Point.

· Distribution Points: At least one available and working with IIS and streaming enabled for BITS application delivery. This server will be in charge, of course, of the packages distribution.
· Clients: SCCM clients installed and working properly. We’ll review later in this chapter how to push clients’ agents in SCCM 2012.

For more information about Site System Servers and Site System Roles review the following link in Microsoft TechNet: “Fundamentals of Configuration Manager” http://technet.microsoft.com/en-us/library/gg682106.aspx.

Storage Requirements

These considerations depend primarily on the type of the delivery method chosen in the environment. As for the App-V environment, we must size the storage considering clients, App-V cache; and server, Distribution Points in SCCM. Here’s a general guideline about the storage requirements:

• SCCM Clients cache must be configured considering the full size of the App-V packages to be distributed.
• App-V Clients cache is recommended to size it considering the SCCM clients cache defined. The App-V client cache should be configured with free disk space threshold option, adding 1GB more to the SCCM client cache value.
  Using an SCCM Clients cache with 4GB, the App-V Client cache should be configured with a free disk space threshold of 9GB.
• SCCM Distribution Points should allocate space considering the size of the package multiplied by 3 . The triple sizing consideration, as said depends on the delivery method, current version of the package, upgrade version, App-V clients cache version, or differential files while constructing an upgraded version of the package.

In the next post we will continue evaluating the App-V and SCCM 2012 integration with the step-by-step processes to complete the integration.

Remember that the entire chapter “Integrating App-V with System Center Configuration Manager 2012” can be downloaded from this link.

Finally my second App-V book “Microsoft Application Virtualization Advanced Guide” has just been published and there’s one sample chapter available for download.

The sample chapter selected is “Integrating App-V with System Center Configuration Manager (SCCM) 2012” and can be downloaded from this link.

The book is available in the following stores:

• Packt Publishing
• Amazon.com (Kindle edition included)
• Amazon.co.uk (Kindle edition included)
• Barnes & Noble
• Safari Books Online

Book Overview

The “Microsoft Application Virtualization Advanced Guide” represents my second App-V book; the previous one “Getting Started with Microsoft Application Virtualization 4.6” was developed a year ago with the basic guidance and step-by-step to get IT administrators started with App-V. This advanced book will cover the necessary guidelines and step-by-steps processes to dominate App-V. Starting with detailed description of its architecture, including some rare advanced topics, and moving through the instructions to implement those advanced guidelines. Here’s an overview of the areas we will cover:

• Perform sequencing in complex environments including scenarios where App-V is normally not supported.
• Deploy applications in complex scenarios, including the use of Providers Policies to enforce licensing and other company’s policies.
• Get hands on in how to implement the scripting process within App-V applications and also review how to use App-V command lines.
• Troubleshoot App-V, covering the installation process of this platform, but also normal sequencing issues and deployment problems delivering applications.
• Scale-up App-V implementations by using failover and load balanced scenarios.
• Review App-V integration with VDI (Virtual Desktop Infrastructure) and Remote Desktop Services (RDS).
• Integrate App-V with System Center Configuration Manager (SCCM) 2012.
• Understand the new approach appearing in SCVMM 2012 with Server App-V to virtualize servers’ applications.
• Examine 3rd party tools available in App-V to complement your implementation.

Here are the chapter’s names to be included in this book:

1. Taking a Deep Dive into App-V.
2. Sequencing in Complex Environments.
3. Deploying Applications in Complex Environments.
4. Handling Scripting and App-V Command Lines.
5. Troubleshooting App-V.
6. Scaling Up App-V Implementations.
7. Integrating App-V with Virtual Desktop Infrastructure (VDI).
8. Integrating App-V with System Center Configuration Manager (SCCM) 2012.
9. Integrating Server App-V with Private Clouds.
10. Appendix A: Reviewing App-V Microsoft and 3rd Party Tools.

Also, I would like to share again some special thanks to the guys involved in this book as reviewers (the same geeky ones from the previous book) and of course Packt Publishing:

• PacktPublishing crew
• Aaron Parker
• Kevin Kaminski
• Nicke Källén

Explaining Server App-V

Taking a quick approach, Server App-V is a technology that enables the virtualization of server applications, removing the dependency of a server application in a specific Windows Server instance (whether that instance is running in a virtual machine on directly on hardware).

Server App-V represents an evolution of Desktop App-V. This technology includes other aspects in the application virtualization approach, which fits more accurately in servers platforms; for example:

• Server App-V works with a Virtual Environment, but this interacts with the operating system and vice-versa. For example: Virtual services are visible to the OS.
  This is particularly important since we can use monitoring tools, such as System Center Operations Manager, to monitor the functionality of our virtual server application.

• In the sequencing process of an application, Server App-V also detects and includes in the package, several additional components that Desktop App-V does not. The Local Users and Groups that the application might create, IIS applications, COM+ and DCOM components, WMI providers, performance counters and all other components Desktop App-V detects and includes within the package.

• Server App-V appears as a “Private Cloud” concept in the way to offer “Software as a Service” (SaaS) and/or “Platform as a Service” (PaaS). This is the ability to deploy software or a platform without requiring installing it.
  Even though we usually use the concept of “application” in the same way as “software”, the term “SaaS” in Server App-V does not represent the entire scope of the platform. Server App-V includes the possibility to provide “as a Service” platforms like database engines or in the near future Exchange or SharePoint.

• One of the main goals of Server App-V is to have a predictable and repeatable way to deploy server applications.
  Some of the common problems we usually find in organizations are that moving platforms from testing or pre-production to production is never an easy ride – often several inconsistencies might be found.

• Server App-V includes the possibility to separate the configuration of the server application, in order to accomplish scalability in the deployment process. This way, we can have the server application package with the configuration “A” deployed in one server and the server application package with the configuration “B” deployed in another server.

• Server App-V also handles state management operations. This is accomplishing by backing up the current state of an application and restoring it in a separate instance of the application.

• There’s no more streaming processes in Server App-V. Client agents still exist but the interaction with the Server App-V packages can include using just PowerShell Cmdlets or using System Center Virtual Machine Manager 2012.

Windows Azure represents Microsoft’s “Public Cloud”, from which we can use a remote platform to handle software (SaaS), services/platforms (PaaS) and infrastructure (IaaS).

At the moment, Windows Azure is available only to selected clients by a closed beta.

Server App-V is not compatible just yet with the worker roles in Windows Azure, but it will be in the near future.

Reviewing Applications Supported by Server App-V

In this current version, with System Center Virtual Machine Manager 2012 in Release Candidate, Server App-V is oriented to business applications (Dynamics and Web Apps mainly) but it is possible to include others.

Some of the features supported by Server App-V are the following:

• Windows Services: Server App-V includes the possibility to virtualize Windows Services in a different approach than the one we’ve seen in Desktop App-V. With Server App-V, the service is installed and placed in the OS as a normal installation of the server application. This way we can monitor it as any local service.
• Web applications hosted in IIS: We can virtualize web applications entirely (web sites, virtual directories and application pools) on IIS 6, IIS 7 and IIS 7.5.
• WMI: Server App-V Sequencer also captures the WMI providers and/or classes created during an installation.
• SQL Services Reporting Services: Even though SQL Server engine is not supported for virtualization, the applications that install SQL Services Reporting Services (SSRS) are supported.
• COM/DCOM/COM+ objects: These components are registered in the deployment process, this way other applications in the server can access them.
• Local users and Groups: If the application is creating users and/or groups during the installation, the Server App-V Sequencer captures it and maintains, including SID, for next deployments.

Some of the considerations about applications not supported are the following:

• We cannot capture Windows Server Roles. Deploying these kinds of roles is a task performed by SCVMM 2012.
  • We can virtualize Web Apps but we cannot virtualize IIS.
  • In IIS, it is supported to virtualize Web Apps and virtual directories.
  • “Web Deploy” tool is used in this process of deploying Web Apps. For more information about Web Deploy take a look to the following link: “Web Deploy 2.0” http://www.iis.net/download/webdeploy.
• SQL Server is not supported in this version. SQL Server Express is, but there’s no official guideline on how to capture it by Microsoft.
• Device drivers are still not supported in Server App-V.
• Not supported in this release but are priorities for next version: SharePoint and Exchange Server roles.

An important part of understanding Server App-V is to differentiate it from Desktop App-V; in the following section we will review the basics difference between these two platforms.

Differentiating between Server App-V with Desktop App-V

Server App-V and Desktop App-V work similarly, but there are some important differences between the two and we must understand them in order to analyze if Server App-V fits in our environment.

Quick Overview to the Sequencing Process in Server App-V

The sequencing process in Server App-V is quite similar to the process we already know in Desktop App-V. Prior to working with the Server App-V Sequencer, we must remember the basic differences we’ve talked about in the Desktop App-V experience: Isolation, Server App-V packages are not meant to co-exist in the same OS.

We must keep in mind that most of the common operations and best practices are included, like:

• Use the same base OS in the Server App-V Sequencer and client machines. This particular “best practice” appears as a default requirement in Server App-V.
  When a Server App-V application is sequenced, includes by default the roles and features enabled in the sequencer and set those as requirements for the Server App-V Clients.
  If we think about it, makes sense, since we are using server applications which interact with several OS components. Any OS inconsistency should lead us in Server App-V applications malfunctions.
• If possible, sequence your application to a Q:\ drive.
• Use Virtual Machines and snapshot capabilities with the Server App-V Sequencer. And, of course, always sequence a new application with a clean OS image.

Some Other Topics

In Chapter 9 of the “Microsoft Application Virtualization Advanced Guide” we will cover detailed topics and step-by-step processes included in Server App-V. Some additional concepts to review are the following:

• Enhanced details of supported applications in Server App-V.
• Understanding SCVMM concepts like Service Templates and Private Clouds.
• Reviewing Server App-V and SCVMM 2012 integration.
• Sequencing Server App-V applications, taking MySQL as an example.
• Customizing Server App-V packages.

• Deploying Server App-V applications, using SCVMM and PowerShell deployment.

The book is available for pre-order in Pack Publishing website.

I hope you enjoyed the article!

I want to share with the blogosphere some of the great consequences about writing a geeky blog. A few months ago, StarWind started a contest for the best article of the year regarding their iSCSI software. The prize was nothing else than an iPad 2, and I won with this article :)

There were some issues in receiving the article because some laws here in Argentina prohibit the importation of these products, but we’ve managed to get the iPad locally instead of shipping it and finally I have it in my hands.

Pretty cool stuff, indeed :)

Even though most of us writing technological blogs we never look to these contests or prizes as an objective, it is indeed motivating when you find in your path some acknowledgments.

Thank you StarWind!

The “Microsoft Application Virtualization Advanced Guide” represents my second App-V book; the previous one “Getting Started with Microsoft Application Virtualization 4.6” was developed a year ago with the basic guidance and step-by-step to get IT administrators started with App-V. This new book is currently available for pre-order in Packt Publishing website (paperback and eBook versions) and hopefully soon enough in Amazon’s (including a Kindle edition).

This advanced book will cover the necessary guidelines and step-by-steps processes to dominate App-V. Starting with detailed description of its architecture, including some rare advanced topics, and moving through the instructions to implement those advanced guidelines. Here’s an overview of the areas we will cover:

• Perform sequencing in complex environments including scenarios where App-V is normally not supported.
• Deploy applications in complex scenarios, including the use of Providers Policies to enforce licensing and other company’s policies.
• Get hands on in how to implement the scripting process within App-V applications and also review how to use App-V command lines.
• Troubleshoot App-V, covering the installation process of this platform, but also normal sequencing issues and deployment problems delivering applications.
• Scale-up App-V implementations by using failover and load balanced scenarios.
• Review App-V integration with VDI (Virtual Desktop Infrastructure) and Remote Desktop Services.
• Integrate App-V with System Center Configuration Manager (SCCM) 2012.
• Understand the new approach appearing in SCVMM 2012 with Server App-V to virtualize servers’ applications.
• Examine 3rd party tools available in App-V to complement your implementation.

Note: We will not cover the topics reviewed in the “Getting Started” book. This version assumes that we’ve already implemented and used Microsoft App-V; presumes that we are looking to optimize our implementation and learn advanced concepts.

And as an exclusive note, here are the chapter’s names to be included in this book:

1. Taking a Deep Dive into App-V.
2. Sequencing in Complex Environments.
3. Deploying Applications in Complex Environments.
4. Handling Scripting and App-V Command Lines.
5. Troubleshooting App-V.
6. Scaling Up App-V Implementations.
7. Integrating App-V with Virtual Desktop Infrastructure (VDI).
8. Integrating App-V with System Center Configuration Manager (SCCM) 2012.
9. Integrating Server App-V with Private Clouds.
10. Appendix A: Reviewing App-V Microsoft and 3rd Party Tools.

In this book, which will contain approximately 450 pages total, I had the great pleasure to work again with Packt Publishing and the same crew of App-V experts that made important contributions in my first book: Aaron Parker, Kevin Kaminski and Nick Källén.

Stay tuned for more news about the book and hopefully a new giveaway copy to all my blog readers! :)

I’ve had the great pleasure to present in October, once again, in one of the main Microsoft events in Argentina, Code Camp 2011. This time with two new tracks: “Desktop of the Future” and “Standardizing Windows Server 2008 R2 images”.

As I mentioned earlier in older posts of mine, Code Camp is an event organized and developed by Microsoft Academics which is held in some important universities of Buenos Aires, this time the selected institution was, as a few years back, Universidad Abierta Interamericana (UAI).

The event contains over 50 tracks presented by students and professionals not only as IT but also as developers. Some of the main topics this year were: Windows Azure, Cloud Computing, SQL Server 2012, Mango and Windows Phone, XBOX and Kinect, VDI, Deployment solutions and so on.

Regarding my topics, the tracks were focused on Virtual Desktop Infrastructure (VDI) integrated with App-V; and a deep dive into Microsoft Deployment Toolkit (MDT) to automate Windows Server’s deployments.

Desktop of the Future

I’ve presented this session (the original Spanish name: “El Escritorio del Futuro”) with Emiliano Estevez, friend and colleague of mine in Algeiba IT where he works as the Services Director.

This track introduces Virtual Desktop Infrastructure (VDI) technology as a result for some current demands in today’s business. By reviewing some of the basic concepts of VDI, we’ve completed the main steps to prepare the Virtual Desktops infrastructure in our company using Hyper-V and Remote Desktop Services (RDS).

We’ve also introduced App-V as the main solution to optimize application management in virtual desktops scenarios, and also with the highly important “Shared Cache” feature to save a lot of money in storage. And finally we had a quick glance about Server App-V, the new technology included in SCVMM 2012 to virtualize server’s applications.

The presentation can be downloaded from this link.

Standardizing Windows Server 2008 R2 Images

This track (the original Spanish name: “Estandarizando Servidores Windows Server 2008 R2”) was presented with another colleague in Algeiba IT, Alejandro Barrionuevo, who’s working as an IT Consultant.

In this session, we’ve reviewed with Alejandro the main benefits of using Microsoft Deployment Toolkit (MDT) 2010, combined with other free tools, to standardize and automate the deployment for Windows Server 2008 R2 OS. We had a quick look about understanding the Solution Accelerators from Microsoft.

We had a detailed look about the process involved in this automation, including some practical demos about using MDT 2010 task sequences, scripts and also editing MDT files used in the deployment process for a complete automated deployment.

The presentation can be downloaded from this link.

I’m introducing a new set of articles in my blog: Interview sessions with some colleagues and technology geeks. In this first article I had the great opportunity to start a quick question and answer session with one of the geekiest App-V guys around the world: Aaron Parker.

Aaron made an important contribution in my App-V book “Getting Started with Microsoft Application Virtualization 4.6”, not only as an official reviewer but with his blog which contains several interesting articles about virtualization using a valuable approach.

You can find more about Aaron following him on Twitter: @stealthpuppy.

Here’s the Q&A session I had with Aaron:

1. To start with the interview, can you give us a quick synopsis about yourself and your experience?

I am a desktop and application virtualization and delivery architect currently working for Kelway in the UK. Previous to my current role I’ve been working on various application virtualization, user virtualization and desktop deployment projects around London. Before coming to the UK, I worked for various VARs in my native Australia where I was doing mostly Citrix XenApp and desktop deployments.

2. In all the experience you have regarding virtualization, how could you explain application virtualization for someone who had never heard about App-V or any other similar platform?

Application virtualization is really just another application deployment method. Where it differs from traditional deployment methods is its ability to make the desktop more dynamic rather than a monolithic blob that we’ve had to deal with in the past. Application virtualization allows us to deliver applications on demand and to users, where ever they are, rather than physical devices.

3. Why do you think that application virtualization did not appear massively just yet in organizations?

Many organisations still look at desktop deployment the old way, i.e. create a static, monolithic SOE, and have failed to recognise the benefits in approaching desktop virtualisation in layers. Small organisations that are still using imaging products such as Symantec Ghost and have stuck with OEM licenses, may find that change can be costly – if their current approach works, why change?

It has also been disappointing to see a lack of support from application vendors for application virtualization in general. Companies such as Attachmate should be applauded for supporting their products under App-V. Momentum requires application vendors to do more than they have currently (which is next to nothing).

Note:
In case you are wondering why there are terms like “organizations” and “organisations” in the same text, this is regarding the American and British spelling differences; both are valid.

4. Can you name the top reasons of why application virtualization must be considered in any organization?

If you’re interested in creating a user-centric model of your computing resources (both hardware and software) then the desktop needs to be broken down into layers to make it dynamic. Application virtualization is just one of those layers. A dynamic desktop is more flexible and allows us to deliver applications based on identity and context.

5. Do you think that Virtual Desktop Infrastructure (VDI) + Application Virtualization represents the future of desktops?

In the short term – yes, But I also think that VDI (as in a hosted virtual desktop based on a Windows client OS) has limited use cases – it suits only 10 to 20% of users. Coming from an SBC background, I know that I can deliver a desktop from the data centre, cheaper, faster and more efficiently with SBC (TS, RDS, Citrix XenApp, Quest vWorkspace etc).

In the long term – no. Windows as we know it today won’t be around forever. It will evolve along with new application architectures that will render today’s desktop model obsolete.

6. With all the possibilities regarding application virtualization (App-V, ThinApp, XenApp, and so on), do you think that there’s one among all that stands out or depends on each scenario?

Absolutely depends on your scenario – the choice of application virtualization product is often not a technical one (as much as we’d like it to be).

7. Regarding Microsoft’s App-V, which are the features included in the latest version that you like the most?

The 4.6 SP1 Sequencer has some great features around sequencing workflow, recommendations before sequencing, displaying what was excluded post sequencing and sequencing templates. These features help to produce better quality packages.

8. Even though there’s no official word from Microsoft, which are the features that you think may (or want to) include the App-V 5.0 version?

I would like to see isolation as something that we could turn off and on. Isolation of a virtual application is great for the majority of cases; however being able to remove isolation as a per-package behaviour would allow use to virtualise many more applications.

I hope you enjoyed this article and I’m pretty sure I’ll get back with some more interviewers and Q&A sessions.

Not so much for a recent, but still I think represents as great news: The App-V book, “Getting Started with Microsoft Application Virtualization 4.6” is available in Kindle version, in Amazon site of course.

So for all those geek Kindle owners (I’m not one, unfortunately) there’s a chance to take a great look to my App-V book using Amazon’s device.

And seems that the availability of the Kindle version also keeps pushing the popularity of the book, since in Amazon.com is ranked as a top seller book in Microsoft section.

#83 in Amazon.com:

Also in Amazon.co.uk (#58):

Starwind released recently a new version of their iSCSI SAN solution, Starwind 5.7. It includes several new features that scale up this already great SAN solution, providing some important improvements regarding performance, monitoring and usability for IT administrators.

Some of the improvements included:

• Re-worked and re-designed completely from the scratch all-new HA (high-availability) engine 2x-3x faster compared to previous versions.
• Quality of Service (QoS) options added.
• Data de-duplication with variable block size (512 byte – 256 KB) to save on storage especially in hypervisor scenarios.
• Performance monitor included in Starwind console.
• Snapshot manager.
• Targets and servers can be arranged in groups.
• Event notification in system tray.

Within this post we’ll review some of the newest features included, testing them in some scenarios. Here’s what we are going to do:

1. Reviewing Starwind iSCSI SAN 5.7 installation

2. Reviewing improvements in Starwind management console.

3. Reviewing usability and GUI new features.

4. Configuring HA and synchronization priority.

You can download Starwind iSCSI SAN software using this link, previous registration required.

For a detailed step-by-step of creating and configuring a Windows Server 2008 R2 cluster using Starwind check my previous article: Five Easy Steps to Configure Windows Server 2008 R2 Failover Cluster using Starwind iSCSI SAN.

Reviewing Starwind iSCSI SAN 5.7 Installation

As any other version of this solution, the installation steps are pretty simple. Just completing the wizard we’ll have it ready to use it.

We can also install the components separately, in case we want to remotely manage the iSCSI platform.

Once installed, to get started we need to use the “Connect” option and as a reminder, the default credentials used in Starwind are:

User: root
Password: starwind

Reviewing Improvements in Starwind

The management console looks pretty much the same, but adding some interesting tweaks that will be very helpful for IT admins.

The first one is one of the most important ones, the “Performance” tab included. Within this window we can monitor in real time the performance in the current load of the server and targets.

We can retrieve the following graphics: CPU/RAM load (for a quick comparison), CPU load, RAM load, total IOPS and total bandwidth.

The second one is a really simple one, but very helpful. The possibility to create target groups, this lets us easily identify in our servers the right collection.

As a third improvement in the usability of this management console we have the Event notifications in system tray, with this tweak we can receive notification as soon as there is a change in the configuration and availability of our servers and targets.

Configuring HA and synchronization Priorities

As mentioned earlier, the main feature regarding performance changes is the one represented by including asynchronous mode for HA targets.

If you are taking your initial steps with Starwind you are probably wondering about HA targets and asynchronous options, let’s take a quick look about the definitions on each of these concepts:

What are HA (High Availability) Targets?

As we’ve reviewed in my previous chapter, creating clusters and provide high availability for a Windows Server service using Starwind is one of the main purposes of this solution and a very simple task to do. But Starwind also includes the possibility to apply high availability in the shared storage we are providing.

When we are creating our Starwind device (basically the LUN we are going to share among hosts) we can configure it as a “High Availability device”, which can be present in two different Starwind servers. In case the primary server fails, the second one (partner server) can still offer the device without affecting availability.

What about synchronization of the device?

When we are using HA devices, there are two shared disks: one in primary server and the other one in partner server. These are two different devices, meaning that they must be replicated and synchronized.

Here is when the synchronous/asynchronous mode appears.

If the replication is presented synchronous, every change (“write”) in the device must be replicated to the partner device to complete the operation. If we don’t have a good design or the bandwidth presented between these two is not a good one, the performance of HA targets reduces significantly.

Synchronous replication example (image taken from cisco.com):

If we are using asynchronous replication, the “write” operation does not have to wait for the replication between the two devices to be completed, improving performance.

Asynchronous replication example (image taken from cisco.com):

The use of synchronous or asynchronous replication must be carefully studied analyzing all factors.

Using HA devices and synchronization options

Creating a target requires only running a simple wizard (as seen in my previous chapter); using HA devices only differs in a few options:

1. Select the “Add target” option.

2. Select “Target Alias” and using “Hard Disk” to create our HA device.

3. Select “Advanced Virtual”.

4. Select “High Availability device” and click on “Next”.

5. Specify the partner server options by providing IP address (or FQDN), port, type of authentication and credentials.

6. In “Virtual Disk Parameters” complete the path for these two devices, primary and partner.

7. In “Data synchronization channel parameters” configure the synchronization interface, heartbeat interface and priority of each server.

8. Select the option “Clear virtual disks” if we are using devices we’ve just created.

Note that these options available here can be very helpful if we created a non-HA device and later we decide to convert it in HA.

9. Select the desired option in “HA device cache parameters”.

10. Complete the wizard and we’ll have our high available device ready.

Once completed the wizard, we get the chance to configure the synchronization options.

Where we can set the synchronization priorities: “Faster synchronization” represents the synchronous mode (waiting the replication to complete the operation) or “Faster client requests processing” represents the asynchronous mode.

The improvements regarding performance will vary depending on the environment we are using, but it could represent 2 or 3 times faster than previous implementations. Cheers to that!

Note:

There are some reports about slow performance in cluster environments using iSCSI, pass-through disks on Hyper-V hosts; this is a known issue in Windows Server 2008 R2 and there’s a Microsoft KB available to solve this problem: http://support.microsoft.com/kb/2020559

More Resources

Here are more resources you can find to take a deep dive in Starwind and Windows Server cluster solutions:

• Five Easy Steps to Configure Windows Server 2008 R2 Failover Cluster using Starwind iSCSI SAN
• Starwind Enterprise HA Data Sheet
• Starwind iSCSI SAN Software White Papers
• Starwind SAN Sizing Guide
• Starwind iSCSI SAN Software Manuals
• Microsoft TechNet: iSCSI Cluster Support: Frequently Asked Questions
• Microsoft TechNet: Understanding Requirements for Failover Clusters

Microsoft has just released as a public beta the newest version of Microsoft Deployment Toolkit (MDT) 2012 with a few important updates:

• Supporting System Center Configuration Manager (SCCM) 2012.
• Using Lite Touch Installation (LTI), great improvements in the client side look-n-feel.
• Also for LTI, behind-the-scenes enhancements for partitioning, UEFI (Unified Extensible Firmware Interface), and user state migration.
• Some minor bugs fixed.

MDT 2012 Requirements

Same as MDT 2010:

• Windows Automated Installation Kit (WAIK) 2.0. You can download it from here.
  Note: The download page indicates that the WAIK version is “1”; but don’t worry, the actual version is 2.0.
• MSXML 6.0
• PowerShell.
• .Net Framework 3.5 SP1. Available for download here.
  Note: Even though .Net Framework 2.5 SP1 is not a requirement for MDT 2010 installation; one of its features, User-Driven Installation (UDI), does requires the latest Microsoft Framework installed.

MDT 2012 Look-n-Feel

For what I’ve seen so far, the user experience of the Deployment Workbench console is pretty much the same.

Also, the “Help Topics” are the same used in MDT 2010. But don’t worry, this is completely normal in this Beta version.

MDT 2012 Beta 1 Download

The beta is available in this link from Microsoft Connect, and I’m pretty sure that I’ll be testing it soon enough.

To check my previous posts about step-by-step deployments using Microsoft Deployment Toolkit (MDT), please check the articles in MDT Category.

Cheers!

A few weeks ago I had the big pleasure to visit the US (New Jersey and New York), courtesy of a company which invited me to coach an App-V training course in their facilities. I had a wonderful experience and in this post I would like to share with you the technical and non-technical approach, experience and more I had in those 8 days.

The App-V training course and workshop intended to provide not only all the basic knowledge regarding App-V, but to also give a complete guidance and step-by-step process in App-V installation, deployment, sequence and maintenance.

The Request

The original request appeared in my inbox in 2010, the idea appeared simple right away, they’ve said:

“We are looking for an application virtualization solution for our main company app; we are very interested in App-V but we have no experience handling this technology. We need a complete overview of the platform, understand how to use it and apply it in our scenario”.

So, we’ve started talking about their expectations, getting a deeper understanding about the company app, the scenario where it should be deployed, etc.

App-V Training Course Program

After a bunch of e-mails and phone calls about getting all the information about the scenario, application involved, and general expectations, the training course program looks something like this:

Here’s a detailed look about each day approach:

Day 1 – Overview and Preparing the Environment

• Since the attendees had mix knowledge about general IT concepts, I decided to take a quick look about some key components: Active Directory, IIS, SQL Server, virtualization concepts, cloud service models, etc.
• Understanding App-V components, features, benefits and implementation models.
• Prepare the entire environment in the “hands-on” section of the day. Full-Infrastructure
• Reviewing automation techniques for deploying the App-V client.

Day 2 – Sequencing Applications

• Getting started with the sequencing process, understanding the phases involved and best practices.
• Sequence simple applications to understand sequencing.
• Deep review about company’s application: Environment, requirements, restrictions, integration with the OS and other applications, common use cases, etc.
• Start with the sequencing process of the company’s application.
• Publishing and deploying App-V packages to client machines.

Day 3 – Advanced Options in Sequencing

• Deeper look in the sequencing process. Handling Feature Block 1, security descriptors to protect some files within the App-V package.
• Troubleshooting applications sequencing and deployment process. Understanding log files and common errors.
• Reviewing Dynamic Suite Composition. Even though company’s application does not require any other package, the concept of interconnecting virtual apps is still important.
• Handling Active Upgrade. Reviewing different type of modifications in an existing package: Editing or upgrading.

Day 4 – Deployment Methods

• Reviewing how to size and selecting the environment for a desired App-V implementation.
• Understanding the RTSP/S and HTTP/S streaming. How to fit each in the desired scenario.
• Since the application usage required the scenario with users connecting from different geographic places to a same server, we’ve reviewed necessary steps for publishing App-V to External networks outside the organization.
• Step-by-step processes for implementing HTTP/S streaming.
• A complete Hands-On for App-V Standalone scenario.

Day 5 – App-V and RDS | Securing the Environment

• Understanding the Remote Desktop Services, RDS, role in Windows Server 2008 R2 (formerly known as Terminal Services).
• Reviewing RemoteApp. Similarities and differences with App-V; pros and cons; and understanding when RemoteApp is best suited.
• Hands-on using company’s application with RemoteApp.
• How to integrate App-V into an existing Remote Desktop Services scenario.
• Reviewing Virtual Desktop Infrastructure (VDI) scenarios, integration with App-V and the shared cache feature.

The Result

The result of the course / workshop was great, the attendees had the chance to understand and implement App-V in their scenario and I could interact with an interesting requirement and deployment.

[geekyComment] Not only I enjoyed preparing and coaching this App-V workshop [/geekyComment] thanks to the great hospitality I also had the chance to visit New York City and a bunch of touristic places.

Just hangin’ in Times Square :)

The contest ended in February, but I didn’t have the chance to publish the winner in my blog so I decided to take a moment and share with all blog readers the happy winner for the App-V book.

Ian Walters from Webster, NY received a few weeks ago the book and kindly is sharing with us a quick pic. Thank you Ian!

For all those who didn’t get the chance to win this time, remember that the book is still available in the following sites:

• Packt Publishing
• Amazon.com
• Amazon.co.uk
• Lehmans

Thank you all for participating!

GFI, in the variety of products that they offer, is always looking to provide some interesting security tools to facilitate our jobs as IT professionals. One of the most complete security platforms available is GFI LANGuard, which provides detailed network auditing options and security scanning for your organization.

With no large or complex requirements, GFI LANGuard gives us some nice features:

• Powerful network scanning options without the need of agents to deployments.
• Reviews and controls vulnerabilities, updates/service packs status (for operating systems and applications), TCP and UDP ports open, and hardware and software inventory.
• Remediation options for deploying updates and service packs, deploy applications and the possibility for removing unauthorized software from machines.
• Detect and deploy non-Microsoft software to protect the entire operating system.

GFI LANGuard Requirements

The requirements for installing GFI LANGuard for a mid-size company (10 to 500 computers to scan) are:

Hardware

• Processor: 2GHz
• Storage: 2GB.
• Memory: 2GB.

Software

• Operating System: Windows XP SP2 or higher. Including Vista, 7, Windows Server 2003 and Windows Server 2008.
• Supported databases: Microsoft Access (installed locally by default) and SQL Server 2000 or higher (SQL Server Express is supported). If you have a large environment, is highly recommended to use a SQL Server instance instead of the Microsoft Access.
• .NET Framework 2.0
• For target clients, WMI is required for Windows operating systems (available in Windows 2000 or higher) and SSH for UNIX/Linux machines.

Note: Windows 2000 SP4 is also supported but since this operating system is no longer supported by Microsoft, using it is not recommended.

Installation

As any other GFI product, the installation is a straightforward process.

1. Download the GFI LANGuard trial.

2. Run the installer and complete the wizard.

3. The only thing you should have available at this point is the account which you would like to use to execute operations on target machines. This account must have administrative privileges in the domain.

Scanning the Network

Once the software is installed, using it is pretty much intuitive. Let’s take a quick look about the scanning process:

1. Open GFI LANGuard console.

2. Select the type of scan you would like to use:

• Quick scan: Looks for high security vulnerabilities in OS. This can be changed according to the profile we choose.
• Full scan: Looks for all type of vulnerabilities.
• Custom scan: We can change the profile, credentials and other options used in the scan.
• Schedule scan: Schedule scans can set the time where the scans will be executed in a determined time period. Also you can select options for: Automatically deploy updates or un-install software; trigger e-mail notifications; etc.

3. A short two step wizard will show where you can select the scope of the scan: local computer, specific computer or the entire domain.

4. Select an alternative credentials for this scan and click on “Scan”.

5. Once the scan is completed, we can take a quick glance about the status of all machines by selecting “Analyze”.

6. Here we can evaluate the vulnerabilities, system patching status, ports open, hardware, software, etc.

Once we have the computers analyzed, we can easily switch to the “Remediate” console where in easy steps we can deploy missing patches, un-install software, etc.

Updates Deployment

With the scan process completed, we finally get to the fun part, the remediation process. Here we can execute tons of actions to solve the problems we found in the auditing process. One of the actions we would like to execute is definitely the updates deployment.

GFI LANGuard offers the possibility to deploy windows operating system updates, patches and service packs; and also 3^rd party software updates.

Let’s take a look at the process:

1. Access the “Remediate” console in GFI LANGuard.

2. For the Microsoft patches, select the option “Deploy Microsoft Patches”. These should be the same we can find in Windows Update.

3. Review the updates and mark on those you would like to deploy. By default, all are marked.

4. Review also “Deploy Microsoft Service Packs”.

5. In “Deploy non-Microsoft Patches” we can review updates for all other software which is left out by Windows Update.

6. We can also review and select previously installed updates for uninstallation.

7. Once we complete marking all of the updates, we can set to deploy those updates immediately or in a specific schedule.

Managing Software with GFI LANGuard

Another interesting aspect in GFI LANGuard is the options available for managing software in client machines. We can set to uninstall unauthorized applications in our network or deploy custom software to guarantee our machines are following the right baseline.

Adding Unauthorized Software

If we are looking to add unauthorized applications for automatically removing it, the process involved is the following:

1. Access “Configure” pane in GFI LANGuard console.

2. In applications inventory select the application you would to add as unauthorized software, right-click and select “Configure”.

3. A wizard will start that will let us select in which scanning profile will be marked as unauthorized. Complete the wizard.

Before completing this configuration we must validate the uninstall procedure to guarantee that GFI LANGuard can perform the removal.

4. Access auto-install validation and you should see the “Validation pending” status of the application; click “Validate”.

5. A new wizard will pop up to confirm the uninstall procedure. This process WILL NOT uninstall the application in the remote machine, will only validate the process.

6. Complete the wizard with the selected target machine.

Note: An important note about this process is that we must have the application installed in a target machine to be selected and get a validated removal.

Removing Applications in One Client

If we’ve discovered one application that we would like to instantly remove from a machine, we can do so in the “Remediate” pane.

1. Select “Uninstall Applications” and select those to remove.

2. We can uninstall the application immediately or we can schedule the uninstall process.

Deploying Custom Software

GFI LANGuard gives us the chance to use automated deployment process to install applications in our target machines:

1. Access “Remediate” pane and select “Deploy Custom Software”.

2. Select “Add” to put in the application you would like to deploy. Take note that you can add specific parameters to the applications, for example, to complete a silent installation.

3. Select the target computers you would like to deploy the software.

4. And finally select the deployment schedule, which can be immediate or in a specific date and time.

Other Features

GFI LANGuard also offers some other common tools which are present daily for must IT guys, here are some:

• DNS Lookup: This is a handy tool most of us use when we need to validate name resolution within our domain or using an external DNS server.
• Traceroute: When we are having connectivity problems, we can quickly verify in GFI LANGuard console the number of hops to reach it.
• Whois: Retrieves information from a particular IP or hostname.
• Enumerate computers or users: Retrieves the number of computers/users found in he domains and/or workgroups in our networks. In computer, it also shows the operating system on each computer.
• SNMP Auditing: Reports weak SNMP strings available in the network, using dictionary attacks (from file snmp-pass.txt).
• SNMP Walk: To probe your network nodes and retrieve SNMP information (for example, OID’s).
• SQL Server Audit: Test the passwords vulnerabilities of SQL accounts, including the “sa” account.

Conclusions

As a quick summary of this review:

Pros

• Using GFI LANGuard offers a simple way to audit our networks to observe vulnerabilities and easily solve this by deploying software and or packages.
• Integrates with UNIX/Linux machines to cover also heterogeneous environments.
• The possibility to deploy 3^rd party updates represents an important feature to guarantee protection even with non-Microsoft software.
• GFI LANGuard using scanning profiles lets us to scale up our auditing process, providing different options in our scans.
• We can optimize our time using auto remediation options in scheduled scans.

Cons

• Uninstalling applications requires software to be installed in at least one computer available to test the uninstallation process, which should require manual work every time we found an unauthorized application.
• Besides deploying software and updates, real time actions like stopping a malicious service or process detected is not possible. The only option available is using a Remote Desktop option.

Running periodically auditing processes in our network is not very common in organizations, using GFI LANGuard can simplify us this task to maintain a secure baseline in our environment.

Resources

Here are some additional resources for GFI LANGuard:

• GFI LANGuard system requirements.
• [PDF] GFI LANGuard Getting Started Guide.
• [PDF] GFI LANGuard Manual.
• [PDF] GFI LANGuard Scripting Manual.

As a celebration since my App-V Book: Getting Started with Microsoft Application Virtualization 4.6 has just been published, I want to give away a free paperback version among my blog readers.

Here’s the deal:

• All you need to do is email me at augusto@augustoalvarez.com.ar with the subject: “App-V Book”.
• Include in the email body your full name plus the address where you would like for us to send the copy.
• I’ll close up the contest on February 25. All the emails sent until that date will be included in the election, which will be completely random.
• I’ll notify the winner in the following days and we’ll ship a free copy of “Getting Started with Application Virtualization 4.6”.

For more information about the book and the free chapter available for download, check this last post of mine.

To avoid any problems, here are some disclaimers:

• Only one email by person will be included. Do not use different mail accounts to participate several times.
• Emails that don’t include person’s full name and address will not be considered valid.
• We’ll cover the expenses regarding shipment but we are not responsible for extra fees or taxes other countries may include in the package.

Remember that the book is available in the following stores: Packt Publishing; Amazon.com; Amazon.co.uk and Lehmans.

Good luck!

GFI VIPRE Antivirus is a powerful and simple solution for those companies looking for a centralized management platform against viruses and malware inside their organization. It also provides important capabilities for expansion and capabilities.

VIPRE Antivirus includes all the common configurations you would look in an enterprise antivirus solution and even more. The possibilities for scaling up the infrastructure are really important, handling different types of sites (could be the same used in Active Directory), and different types of policies applying within these sites.

Within these policies, there are also several configurations we can modify: Starting for discovering agents (by LDAP query, IP scope, subnets, etc.). But another important feature VIPRE includes is regarding performance, client machines will not feel the presence of this antivirus, even when a scanning is running.

Here’s a comparison of common antivirus and how they affect performance:

In this post will take a look about the installation and configuration process of this tool to understand a little bit more what we are talking about.

Components in GFI VIPRE

The suite works as a normal client-server platform, using of course client agents that are in charge of securing client operating systems. Here’s a quick overview about the components:

• VIPRE Site Service: Managing communication between VIPRE database and agents.
• VIPRE database: Maintaining configuration, quarantine and reporting data.
• Agents: Component installed on client machines that receives information from the policy we’ve configured for the targeted machine. The VIPRE Site Service deploys agents using a micro-installer.
• Console: Centrally managed console that can be installed on any machines you like and using VIPRE Antivirus we can set different types of roles inside our organization and sites; depending on the rights assigned, a user would have only the necessary features to execute in the console.
• Report viewer: Application included in the console to retrieve information and generate quite complete reports.

System Requirements

Fortunately this platform provides also flexibility in the requirements for its installation. Take a look:

VIPRE Server

For the server (console and VIPRE Site Service):

• OS: Windows XP SP3; Windows Server 2003 R2, Windows Vista SP2; Windows Server 2008 SP2; Windows Server 2008 R2; Windows 7.
  For all of those, 32 and 64-bit is supported.
• Memory: 512mb.
• Software: .NET Framework 3.5.1.

VIPRE Client

For client agents:

• OS: Windows 2000 SP4; Windows XP SP1+; Windows Server 2003 SP1+; Windows Vista SP1+; Windows Server 2008+; Windows 7.
  Again, for all those, 32 and 64-bit is supported.
• Supported E-Mail clients: Outlook 2000+, Outlook Express 5.0+, Windows Mail on Vista, SMTP/POP3 (Thunderbird, IncrediMail, Eudora, etc.)
• Memory: 512MB.

Communication between agents and server need a few exceptions in firewalls:

• TCP 1082 and 1086 for VIPRE service;
• TCP 135, 139 and 445 for WMI;
• TCP 80 for deploying agents.

For more information about requirements take a look to this link: http://www.gfi.com/business-antivirus-software/viprebusinesssystemrequirements.htm

Installation and Configuration Overview

As I was saying, the implementation process of GFI VIPRE represents a simple procedure; let’s take a look about the process for installing and configuring this platform:

1. Review requirements for server and client machines.
2. Define the type of machines and the behavior you would like to be present in the antivirus software, depending on the machine category.
   This will be represented in the policy we can configure for each category we decide (for example: mobile computers will have a more restrictive policy than the workstations).
3. Install GFI VIPRE Antivirus.
4. Create and configure system policies to apply agent machines.
5. Add agents and validate VIPRE installation. The platform provides the possibility for automated installation and of course manual.
6. Run a manual scan in agents to validate current health status of your clients. Automatic scans in agents can be configured but we can also trigger manual scans whenever we need.
7. Generate reports using Report Viewer.
8. Configure any additional sites and permissions for different type of users. We can have simple operators to the platform using the GFI VIPRE console.

Installing GFI VIPRE Antivirus

Once we’ve reviewed the pre-requisites for the installation, let’s review the step-by-step:

1. Download the free trial for GFI VIPRE Antivirus.

2. Double click the installer and a wizard will start.

3. The type of this installation in this case will be “Full Installation”.

If we use Advanced Installation we can configure an existing SQL Server instance (local or remote) to store the VIPRE Database. The Standard type installs SQL Express locally.

4. Since it does not require any complex configuration you can complete the installation wizard.

After the process completes, the “Database Configuration Wizard” will appear.

5. The first step is related to creating the site name. Since the database was just installed we are not able to change the connection to the SQL Server. Click on “Next”.

6. Create a SQL login to connect with the VIPRE database, just provide the password and click on “Next”.

7. The configuration process starts and it will be completed in a few seconds.

Once these two wizards are complete, we can start configuring our site (the different scopes where the agents will be located). We will run the configuration in the following step.

Configuring VIPRE options

Before creating a new policy for agents we will need to configure our site with some basic information.

The configuration wizard will appear just after we’ve configured the database, but we can set these options at any time just entering the VIPRE console. Here are some of the options we should take a look:

1. Access the “Site Properties” option in the console and the first thing we will see is product registration.

2. In “Agent Installation” we can add the user which will be used for installing the VIPRE agents, make sure this user has sufficient rights to perform the operations.

3. In “Advanced Settings” we can enable “Console Security” that will bring us the possibility to use different type of users to manage VIPRE site.

4. Enabling this option will also enable the options in “Role Administration”, where we can create these types of groups that can only have, for example, read access to the policies we define.

Creating and Configuring a Policy

After we’ve set the basic options in VIPRE console, we can start creating the policy that will apply in the current site.

The default policy created is completely passive, since it does not include enabled most of the options like Active Protection, e-mail security, remediation actions, etc. If we add agents in this policy we will probably not fulfill the security policies in our company.

We’ll take a look at the process for creating a new policy instead of modifying the existing one:

1. In the site name, right-click and select “Add Policy”.

2. Create the name of the policy. This policy will receive the template from the default one, so it will not contain important options enabled.

3. Once created, right click in the policy name and select “Policy Configuration Wizard”.

A new wizard will appear, from where we can set different and interesting options about the security profile we would like to introduce. Since the options here are quite many, I’ll name the most important ones to consider in this case.

4. “User Interaction”: I’m configuring in this case permissive options like “Allow users to remediate manual scans”.

5. “Balloon messages”: We can configure the options and the text the messages will appear in the client.

6. “Communication”: The possibility to integrate VIPRE Antivirus with Microsoft Security Center.

7. “Scanning”: The behavior and schedule for quick and deep scans in clients. Also the type of files included.

8. “Threat Remediation”: The default action taken when a remediation is needed.

9. “Active Protection”: Here we can configure if we prefer VIPRE Antivirus will scan the current files in use for the user. This option can be set in different levels; depending on the level of security we can decrease system performance.

10. “E-Mail Protection”: Options for securing the e-mail applications.

11. “Auto-Agent Installation Scope”: Here we can configure the scope this site will have automatically, meaning that all machines matching with the following options we set here will be included automatically and the VIPRE Agent can be installed silently.

In this example I’m using an LDAP Query, but we can also use machine lists, IP ranges and subnets. After configuring here the scope, remember to click “Resolve” that will translate the parameters into values.

12. Complete the configuration wizard.

There are some other options we can set that I did not mentioned here: Exclusion lists for scanning and active protection; automatically scan external drives (like USB) when they are connected and so on.

Adding and Scanning Agents

After we’ve completed the previous step and if we define the scope correctly we should receive in the VIPRE console the machine names in “Agents”.

In this case I’m using a simple computer:

1. Right-click in the computer name and click on “Install Agents” to check this client’s health ASAP.

2. If the communication ports are open as necessary, the installation process should start in a few seconds. After that, the balloon will appear notifying the presence of VIPRE agent and requesting a reboot.

3. Since we’ve configured VIPRE to connect with Windows Security Center, the first message appearing will be that the agent is turned off. Reboot the machine.

4. After the reboot we will get normal access in the VIPRE Agent since the policy we’ve set earlier allows users to interact with the local application.

5. Remotely we can execute several tasks, including quick or deep scans. We will try a quick scan.

6. Soon as we click in “Quick Scan”, the agent notifies locally that the scanning process has just started.

7. And, again, since the policy allows the interaction, we can verify the scanning process and details in the VIPRE agent window.

8. Once the scan is complete, you will also receive the notification in the VIPRE console.

Generating Reports

Reporting capabilities is a key factor in every type of technology, especially the ones representing a centrally managed service. Fortunately GFI VIPRE Antivirus it is not an exception.

Accessing the “Report Viewer” option in the console, we will receive an incredible set of variables we can configure to retrieve the reports in PDF format.

• Detailed lists of machines infected, threats present, severity, etc.
• List of agents scanned.
• And my favorite: Executive Summary. This report will fit perfectly in cases where you can send reports to upper-management in you company to evaluate a good summary.

This is an example of a complete report: Top 10 infected machines; top 10 threats; severity of threats; etc.

Take note also that we can schedule this reports, so we don’t need to generate these manually.

Conclusions

Here are some of the quick facts I found using this platform:

• Very detailed options to use with a centralized management. In security solutions, not all include the detailed and specific options we can configure centrally without accessing the client machines.
• Excellent possibilities for scaling up. Managing different sites, policies and permissions in the same environment solves a lot of normal implementation models.
• Simple and intuitive. You don’t need any experience handling similar type of platforms, with basic knowledge you’ll get this suite working normally.
• Complete reporting options included.

More Resources

Here are some extra resources you can find for this platform:

• Free trials GFI VIPRE Antivirus download.
• GFI VIPRE Antivirus general features.
• [PDF] VIPRE Enterprise Getting Started.
• [PDF] First Things to Consider When Installing VIPRE Enterprise Products.
• [PDF] VIPRE Enterprise Admin Configuration Guide.