Out of Topic - Captain Ed Freeman

Hi all,
I had to post this. I found about it from my dad. Thanks Dad. Made me happy to be an American.

You're a 19 year old kid. You are critically wounded and dying in the jungle somewhere in the Central Highlands of Viet Nam. It's November 11, 1967. LZ (landing zone) X-ray. Your unit is outnumbered 8-1 and the enemy fire is so intense from 100 yards away, that your CO (commanding officer) has ordered the MedEvac helicopters to stop coming in. You're lying there, listening to the enemy machine guns and you know you're not getting out. Your family is half way around the world, 12,000 miles away, and you'll never see them again. As the world starts to fade in and out, you know this is the day. Then - over the machine gun noise - you faintly hear that sound of a helicopter. You look up to see a Huey coming in. But.. It doesn't seem real because no MedEvac markings are on it. Captain Ed Freeman is coming in for you. He's not MedEvac so it's not his job, but he heard the radio call and decided he's flying his Huey down into the machine gun fire anyway. Even after the MedEvacs were ordered not to come. He's coming anyway. And he drops it in and sits there in the machine gun fire, as they load 3 of you at a time on board. Then he flies you up and out through the gunfire to the doctors & nurses & safety. And, he kept coming back!! 13 more times!! Until all the wounded were out. No one knew until the mission was over that the Captain had been hit 4 times in the legs and left arm. He took 29 of you and your buddies out that day. Some would not have made it without the Captain and his Huey.

Medal of Honor Recipient, Captain Ed Freeman, United States Air Force, died last Wednesday at the age of 70, in Boise, Idaho

May God Bless and Rest His Soul.

I bet you didn't hear about this hero's passing, but we've sure seen a whole bunch about the thugs Michael Brown & Trayvon Martin.

Read about him here: http://en.wikipedia.org/wiki/Ed_Freeman
And here: http://www.snopes.com/politics/military/freeman.asp
And here: http://www.truthorfiction.com/rumors/e/ed-freeman.htm#.VQHvsfzF8wo

Shame on you American Media!!!

Dynamic RDP files for Thin Client sessions

This is horribly formatted. to be corrected later.

OVERVIEW

OK, So today's interesting task is to create multiple RDS conenction files based on a list stored on the server. We can then update this list as needed. Multiple conenctions will be created automagically on the thin client's public desktop at login.

PROBLEM
There are many different thin and thick clients that will connect.
We don't know the resolution of each.
Some have two monitors, some don't
Some users like FULL screen, others like it windowed so they can see the client task bar and switch between sessions.
Not all monitors are the same resolution.

I'm sure there are more problems but the rest are social problems and not addressed in this context.

START OF SOLUTION
-Research
OK, so I violently attacked the internet with a barrage of search terms. looking for the quick and easy answer. Some reusable code that could be modified and used for my task at hand.

So the NEXT choice....yea, the search didn't go well. I do have to give credit to a number of sites with some good information. These are helping me on my way to an ultimate solution. See the bottom for the links.

PROGRESS
So I started off by just editing the RDP files with notepad++ and changing the values. I got some great conenction files this way. Some variants were:
- RDP to an RDS Farm that uses load balancing, so you need to provide credentials first to that you only enter login info once.
- RDP to any server but go to the server FIRST so that you can authenticate at the server. Great for testing window settings and untimately for sysadmins who are too impatient to wait for the "securing remote conenction" to scroll for what seems like an eterninty.
- Windowed vs. full screen for each of these.

That was greeat. Boss loved it, should have stopped there taken the gold coin and moved on. nope.

I then found some code that created multiple RDS Connection files with powershell and a CSV File. I thought I was golden at that point. Now I could create these little gems and if later I wanted to add some, I could add it to the CSV File and BANG users would have new connections without having to reimage the stupid thin clients to add a single icon.

I got that working. Trimmed back on some features, added other features. Found out that some of the RDP options in the connection file have SPACES and others DO NOT. Very annoying.

So for my purposes I have three categories of settings in the file. 1) standard for all, 2) standard for this install, and 3) variable by conenction.

1) Standard for all
session bpp:i:32
compression:i:1
audiocapturemode:i:0
videoplaybackmode:i:1
connection type:i:2
disable wallpaper:i:1
allow font smoothing:i:0
allow desktop composition:i:0
disable full window drag:i:1
disable menu anims:i:1
disable themes:i:0
disable cursor setting:i:0
bitmapcachepersistenable:i:1
audiomode:i:0
redirectprinters:i:1
redirectcomports:i:0
redirectsmartcards:i:1
redirectclipboard:i:1
redirectposdevices:i:0
redirectdirectx:i:1
drivestoredirect:s:
autoreconnection enabled:i:1
authentication level:i:2
prompt for credentials:i:0
negotiate security layer:i:1
remoteapplicationmode:i:0
alternate shell:s:
shell working directory:s:
gatewayhostname:s:
gatewayusagemethod:i:4
gatewaycredentialssource:i:4
gatewayprofileusagemethod:i:0
promptcredentialonce:i:1
use redirection server name:i:0

2) Standard for this install
keyboardhook:i:1
displayconnectionbar:i:1
pinconnectionbar:i:0
NOTES: We wanted the connection bar to be available, but not pinned, and we wanted ALL Windows shortcut keys to go to the remote sessions. That way you could use ALT-TAB in a windowed session or a full screen session.

3) Variable by connection
screen mode id:i:2
desktopwidth:i:1680
desktopheight:i:1050
winposstr:s:0,3,0,0,800,600
enablecredsspsupport:i:1
full address:s:server-farm
username:s:DOMAIN\
NOTES: For these, the screen mode id HAS SPACES IN IT. Don't forget that it can be frustrating. and a 2 is full screen 1 is windowed.
Desktop height and width are the dimentions of the remote session, NOT the window that is created. More on that later.
WinPosStr is a funky option but can vary based on session.
full address - this hard codes the server into the conenction easy for users to click and connect.
username - so there is also a Domain option, but I couldn't get it to work. If you have a set of thin clients that are on a workgroup conecting to domain servers, you want to make it easy for the users to default the domain to the domain of the server you are conencting to. Just put the domain and the backslash in there and you are good to go. Since I'm using a csv file I put the backslash in in the code, not in teh CSV file.
enablecredsspsupport - 1 says "Get my credentials now.", 0 says "Connect me as fast as possible and I'll authenticate when I get there." 1 is good for RDS 2008/2012 farms with load balancing. 0 is great for sysadmins and impatient people.

so, most of these variables are easy to set. I created a CSV File that had:
Server, ServerName, Resolution, Login, Domain
server-farm, Accounting, Full, Farm, conteso-acct
server-farm, Accounting, Window, Farm, conteso-acct
DC-001, Domain Ctlr 1, Full, Single, conteso-admin
DC-002, Domain Ctlr 2, Full, Single, conteso-admin
, RDP Full, Full, Single,
, RDP Window, Window, Single,

the last two are for admins that don't know where they are going, but need some basic settings ready to go. They know the server and the domain they are connecting to and just want to choose windowed or full screen. The rest should be fairly obvious, feel free to comment if they aren't and I'll make some notes.

So now I can read in a file, create the RDS Conenction files, and update it without reimaging the thin clients.

Code for this is here:

Now came the tough part. For the windowed sessions I have to maximize the area. RDP will not let you resize the session once you are connected, that's why you pay Citrix $300+ per user for XenDesktop. With that, you can resize on the fly. Yay for you. I'll go buy desktops instead, it's cheaper.

SIDENOTE: Have you seen the new Intel Nuc It's smaller than the Wyse Thin Clients and works great!!

So when I needed to dynamically size the windowed sessions, I needed to get the available size of the screen Minus the taskbar and any window borders. I found a site with some window size collection info. That got me on the WMI Win32 path. So I created this section.

$rdpW = 0
$rdpH = 3000
foreach ($desktop in $desktops) {
if ($rdpH -gt $desktop.ScreenHeight) { $rdpH = $desktop.ScreenHeight }
$rdpW += $desktop.ScreenWidth
}
[int]$rdpH *= .93
[int]$rdpW *= .98

I resized the window to be less than the width and height to fit without scroll bars.

winposstr:s:0,3,0,0,800,600 <<--- data-blogger-escaped-5000="" data-blogger-escaped-absolute="" data-blogger-escaped-and="" data-blogger-escaped-as="" data-blogger-escaped-bottom="" data-blogger-escaped-br="" data-blogger-escaped-can="" data-blogger-escaped-coordinates.="" data-blogger-escaped-far="" data-blogger-escaped-huge="" data-blogger-escaped-i="" data-blogger-escaped-if="" data-blogger-escaped-in="" data-blogger-escaped-left="" data-blogger-escaped-like="" data-blogger-escaped-of="" data-blogger-escaped-really="" data-blogger-escaped-right="" data-blogger-escaped-set="" data-blogger-escaped-so="" data-blogger-escaped-something="" data-blogger-escaped-tell="" data-blogger-escaped-the="" data-blogger-escaped-this="" data-blogger-escaped-to="" data-blogger-escaped-top="" data-blogger-escaped-window="" data-blogger-escaped-you="">
LINKS
http://technet.microsoft.com/en-us/library/ff393699(v=ws.10).aspx
http://windows7tips.com/environment-variables-windows-vista-7.html
http://technet.microsoft.com/en-us/library/ee791847(v=WS.10).aspx
http://powershell.com/cs/media/p/858.aspx
http://technet.microsoft.com/en-us/library/ff730964.aspx
http://social.technet.microsoft.com/wiki/contents/articles/665.how-to-set-the-monitor-for-a-remote-desktop-session-in-a-multi-monitor-setup.aspx
http://archive.everydaynerd.com/search?q=rdp
http://blogs.msdn.com/b/powershell/archive/2008/09/14/rdp-file-generation-use-of-here-strings.aspx
http://computerperformance.co.uk/powershell/powershell_wmi_classes.htm - mainly a rabit hole. I got distracted and started to learn too much about WMI calls.

vCheck Powershell script - LOVE IT!!!

So I came across vCheck by Alan Renouf recently. It is a great utility. He has made it extensible by making plugins available. You can create custom monitoring scripts for any part of vSphere, or infact any other system that you can use Powershell with.

I'm working on adding performance graphs to the utility. I'd like to have both vCenter and NetApp graphs. vCenter Operations manager is nice, but it is a bit clumsy and slow. You can't set defaults, so you have to click through window after window to get where you want.

vCheck has a -config option where you can set the default values for each plugin and the global variables. You can set it up in a scheduled task and have it run at night and e-mail you a daily report.

I've been thinking about a plugin that will know the difference between a daily report and a weekly report and select different plugins for each.

Go check it out. The more we get involved in it, the more we can find other useful plugins for our unique equipment.

PowerCLI extremely slow startup

I found that when I open PowerShell ISE and try to run my PowerCLI scripts, there is a HUGE delay in getting the snapin loaded. I don't mean a long delay like a user would say "there's a long delay" I mean like an IT Professional says there is a log delay.

How to get the Firmware Version of your hardware

If you are looking to see if the Firmware on your ESXi 5.0 host is upto date, you need to find out what it is right now, so try these commands for the basic items.

1. In ESXi 5.0, run this command:
   
   # esxcli network nic list
2. or this still works

# esxcfg-nics -l

1. You will get something like this:

Name    PCI         Driver Link Speed    Duplex MAC Address
vmnic0  00:02:04.00 ACME   Up   1000Mbps Full   01:23:45:67:89:AB
vmnic1  00:02:05.00 ACME   Up   1000Mbps Full   01:23:45:67:78:AC

Now use the ethtool command to get the info:

# ethtool -i vmnic0

driver: ACME
version: 1.2.3a-1vmw
firmware-version: 7.8.9
bus-info: 0000:02:04.00

For HBAs: Check this link out Get Firmware Version

To obtain the driver version of a Host Bus Adapter on an ESX/ESXi host:

1. Obtain the driver type that the Host Bus Adapter is currently using:
   
   # esxcfg-scsidevs -a
   
   This will produce an output similar to:
   
   vmhba0  ata_piix          link-n/a  ide.vmhba0                              (0:7.1) Intel Corporation Virtual Machine Chipset
   vmhba1  mptspi            link-n/a  pscsi.vmhba1                            (0:16.0) LSI Logic / Symbios Logic LSI Logic Parallel SCSI Controller
   vmhba32 ata_piix          link-n/a  ide.vmhba32                             (0:7.1) Intel Corporation Virtual Machine Chipset
   
   Note: The second column shows the driver that is configured for the HBA.
2. Use the following command to see what driver version is being used:
   
   # vmkload_mod -s HBADriver |grep Version
   Taking the the mptspi driver as an example:
   
   # vmkload_mod -s mptspi |grep Version
   Version: Version 4.00.37.00.30vmw, Build: 721907, Interface: 9.0, Built on: May 18 2012
   
   From the above output you can see the driver version is 4.00.37.00.30vmw
3. To check to see what driver is recommended for that card we need to get the VID (Vendor Id), DID (Device Id), SVID (Sub-Vendor Id) and SDID (Sub-Device Id)
   
   # vmkchdev -l |grep vmhba1
   000:16.0 1000:0030 15ad:1976 vmkernel vmhba1
   In the above cases the VID=1000, DID=0030, SVID=15ad, SDID=1976
4. You can now search the VMware Compatibility Guide for VID (Vendor Id), DID (Device Id), SVID (Sub-Vendor Id) and SDID (Sub-Device Id) or in some cases you may need to do a text search here to narrow down the particular card. You can check the version of the ESX/ESXi with following command

# vmware -v

Prevent Admins from Doing Stuipd Things in vCenter

Role Based Access Controls, or RBAC is very useful in vCenter. I know many of you simply have your own vCenter server, it's only you and you aren't good at sharing. We all have kindergarten issues.

But it the real world you try and fork off as much of your own work on other people in your organization as you can. In this vein, you now have to realize that not everyoen is as smart or careful as you.

RBAC provides a granular role for each set of users. Think of the roles you may have:
- Close Support (Help Desk)
- System Admins
- Application Admins
- SuperUsers
- Root Admins

Close support is your "on the ground" people that have great proceedures that you have written up so that they can fix 75% of the basic problems without escalating to 2nd level tech support. (You did make proceedure guides for all your basic processes, right?) You may want close support to:
 - View server status
 - View server performance
 - Reboot a server
 - Power on/off a server

But you probably don't want them changing the number of vCPUs, changing memory, mounting other vmdk file to the server, deleteing the server, or creating a WoW server on your network.

System Admins may be assigned to all VMs at a hardware level. But for data security reasons, you may not want them adding existing disks to a server. They can create new VMs, but maybe only from a template. Creating from a template keep them from allocating too much space, or connecting a VM to the wrong network (Port group/VLAN). Using Templates and Customization Specifications, you can require them to provision new VMs only from templates and ask only for a few items when deploying the template. The rest would be hard coded into the template and the specification.


To do this you need a couple of roles created. We'll call them:

• CustomizationAccess
• DeployTemplate

For Deploy template we need several permissions.

• Datastore
• • Browse Datastore
  • Allocate Space (for vSphere 4.0)
• Virtual Machine
• Configuration
• Add new disk
• Interaction
• Select ALL options
• Inventory

• Create

Provisioning

• Customize
• Deploy Template

Resource

• Assign Virtual Machine to Resource Pool

For CustomizationAccess you will need

• Virtual machine
• Provisioning
• Modify customization specification
• Read customization specification

That is IT. Now you will assign the CustomizationAccess role at the vCenter level. That's top of the top. So go to Host and Clusters and right click on Your vCenter server name it will have the icon below next to it.

Choose Add Permission and select the CustomizationAccess role. Choose the group or groups that you want to have access and add the permission.
Now we have to give that group access to their resources. We will assume the group is called Tech. Assign the role DeployTemplate at the following locations.

• Hosts and Clusters
• Datacenter
• Resource Pool - Tech
• VMs and Templates
• Datacenter
• Folder - Tech
• Datastores
• Datacenter
• Folder - Tech

This will give them access to the resources that they need to deploy the VMs.

Pro Tip:

If you have DRS enabled on the cluster, but you have it set to MANUAL, then the VM will NOT be able to be powered up by the Tech Group. It will NOT show an error, it will just silently fail and stay off.

Adding a program to All Users Start Menu in Vista or Server 2008

OK, this is annoying. In 2008, they have moved the All Users Start menu deep into the directory structure.

Look in:
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\

There you will find the various folders that are common to all users. You can create new folders and organized them however you'd like. For things Like Putty or TCPView, simply hold shift and control down to drag a shortcut into the folder of choice. Please, Clean up your descriptions before you leave the folder. Leaving the ".exe - shortcut" after the file name is so Level 1 tech support.

Remember "Only YOU can prevent PEBKAC Errors"