Backup Exec 12 - upgraded and running

Okay, even this skeptic has to admit they're getting better. I upgraded my 11d server to version 12 this week.

Pros:
Now comes standard with Open file protection and the base level IDR option
New installer has a nicer layout
Win2k8 Support right off the bat
The new System Recovery agent looks cool and supports virtual machine conversions.

Cons:
Had a few hiccups getting the policy based jobs up and running again afterwards.

First off I like the new selection layout during the install. It breaks the modules up by what you're licensed for, then what you can eval, and then the stuff you can't even eval.


click for larger image

I went ahead and upgraded the antivirus to symantec endpoint prot 11 like it wanted. It also has a new antivirus integration but you have to install the full endpoint protection manager on the backup exec server. The upgrade itself went smoothly and I rebooted the server. Then I had to upgrade all the remote agents because it kept giving warnings about the old version.

As for my policy based backups, I had a few issues with the jobs not wanting to work - or cancel for that matter. So first I tried the old "Delete Jobs Created By Policy..." and recreating them but the Incremental parts kept failing. So I cancelled them and started the Full backup job part of the policy.



Once that finished successfully then the incrementals started working right again.
*Mental note to self, don't do upgrades in the middle of the week*

Overall I'm satisfied that Backup Exec is once again on the right track. The expanded feature set and those little extra UI tweaks really do help.

Separate VLANs for nortel ip phones and data

For this week's project, I decided to split up the network to give IP phone traffic it's own VLAN with the eventual goal of QoS and all that good stuff in mind. The first challenge of course was getting my Dell and Netgear routers to play together nicely which actually wasn't that bad. I already have a Layer 3 routing Switch from netgear (FSM7352S) in place which I previously configured to support routing between our existing network and an isolated vlan for the testing LAB. The plan was to use the i2002 and i2004 phones to use VLAN 20 and to pass through untagged packets to the PCs attached to them.

Steps:
1. Setup VLAN 20 on the switch.

2. Change the access mode of all the ports involved to 'General' which would allow them to handle traffic from multiple VLANs including the default 'VLAN 1'. Then make sure VLAN 20 is selected and set all ports to 'tagged'. When done, each port should still have a PVID of 1, be untagged for VLAN 1 and tagged for VLAN 20.

3. Changed the ports connecting my switches to TRUNK mode. On the ones where trunk mode was not available, I just set that port to be tagged for VLAN 20 and made sure the port was set to 'General' mode.

4. Turned on GVRP which I naively thought was a great feature that would propagate all my vlans to all my switches, solve all the world's problems, perform miracles, etc. Which to be truthful, it did advertise the VLANs and the other switches acknowledged their existense but I wasn't able to tag any ports on the switches that had dynamically received the VLAN info. I'm still not sure if that's a problem with the Dell switches or the monkey writing this blog.

5. Turned off GVRP and just setup VLAN 20 manually on all switches.

6. Tested that an IP phone on one switch in each building to make sure that VLAN 20 was routing properly.

7. I hard-coded a block of switch ports to 'Access Mode' with a PVID of 20 for the nortel BCM phone servers to lock them into VLAN 20. Then I set up one of the BCM servers to be a DHCP server for that VLAN and rebooted it to make sure changes took effect.

8. I setup option 191 and 128 on the win2k3 DHCP server on the Data lan with the high hopes that it would redirect the ip phones automatically to VLAN 20. Option 191 tells the phones to use VLAN X which in my case is 20 and option 128 is a string which tells the phones settings like the ip of the BCM, etc. HAHAHA, didn't work right - probably my fault. It seemed to get the right server address but just wasn't DHCP'ing on VLAN 20.

9. Manually went to each IP phone and set the server IP, and VLAN to 20.

10. Backed up all switch configurations.

Lo and behold, it all worked. All ip phones were able to DHCP to VLAN 20, and all PCs hooked up through them were able to DHCP to vlan 1. Now all my IP phones are isolated away from the data network. Next project will be QoS. Don't forget, anytime you add a new switch you'll need to configure VLAN 20 on it unless you've got GVRP working.

For more information on option 191, 128, and IP Phone settings, I found some Very helpful posts on McNamara's blog.

Option 128:
http://michaelfmcnamara.blogspot.com/2007/10/dhcp-options-voip.html
Option 191:
http://michaelfmcnamara.blogspot.com/2007/10/dhcp-options-voip-part-2.html
and Ip phone settings:
http://michaelfmcnamara.blogspot.com/2007/10/nortel-i2002i2004-internet-telephone.html
(I went with Partial DHCP because I still haven't gotten the Full to work yet.)

Vista command prompt eccentricies, elevation/run as administrator and path fun

First thing I like to do with the command prompt shortcut is to reduce the number of steps needed to open it and set it to have a unique font color so it's easier to track which command prompts are elevated and which aren't. To start, make a copy of the command prompt shortcut and rename it to something like "Elevated CMD". Then go into properties and click on the advanced button. Then check the box for "Run as Administrator".



Then click on the Colors tab and set a Screen Text color like Green, purple, whatever works for you.



Then just save your new shortcut.

Now for some fun things about command prompts in Vista. If you're using an elevated command prompt you can't change drives to mapped network resources. You can still access them by UNC but not by drive letter. And if you're using a non-elevated command prompt you can access network drives by drive letter but you don't get the same PATH variable as an elevated command prompt. So you have to manually run programs like Powershell from the full path. (C:\Windows\System32\WindowsPowerShell\v1.0>" So until I can crack this one, I've just got a batch file that I run that just contains:
path = %path%;C:\Windows\System32\WindowsPowerShell\v1.0

I can see how some of these annoyances are part of making it more secure but it can be a pain for power users or powershell coders to get up and running.

Vista - Admin tools (adminpak.msi) lost but now found

So you've gone and upgraded your desktop to Vista and tried to install ye olde adminpak.msi only to find that it don't work. To add insult to injury, for the past year there was no hope in sight for fixing this sad state. Fear not, Microsoft has released the RSAT package. (Remote System Administration Tools) which will allow you to use Admin tools from a Vista box with SP1 and is compatible with 2k3, and 2k8 servers!

Download 32 bit version:
http://www.microsoft.com/downloads/details.aspx?FamilyId=9FF6E897-23CE-4A36-B7FC-D52065DE9960&displaylang=en

Download 64 bit version:
http://www.microsoft.com/downloads/details.aspx?FamilyId=D647A60B-63FD-4AC5-9243-BD3C497D2BC5&displaylang=en

*Note:
After installing, it'll add a help file to your local admin tools and you'll be wondering where the tools are. If you read the help file, it'll tell you to go into Programs and Features -> Turn Windows features on or off and check the box for "Remote Server Administration Tools"

Separate wallpapers for dual monitors in vista

You know, I really thought they'd have this feature built into Vista. It just seems like one of those nifty GUI things they need to keep up with Mac...

Here's where DisplayFusion comes in. The basic version is free and will allow you to choose a different wallpaper image for each monitor. The app is pretty small (currently consuming 796K in RAM) and is really easy to use. Once installed, just launch it and it'll show up as an icon in the taskbar tray.



Go into the settings and then choose a monitor, then a background color (if needed) and the image you want to display on that monitor. Repeat for second monitor.



Download it here: http://www.binaryfortress.com/displayfusion/

Head's up - Win2k3 SP2 may cause networking issues

There's a lot of buzz going around about problems being caused by SP2. By default it turns on a lot of features like TCP/IP Offloading (TOE), and Receive-side Scaling (RSS) which can play havok on older network cards and apparently some newer boxes as well. There's a really good write-up on the problem from the exchange team at http://msexchangeteam.com/archive/2007/07/18/446400.aspx
which goes into detail on what is happening. If you've got anything weird going on with your servers since applying SP2, there's a good chance it's because of this.

I personally haven't run into problems on my exch 2k7 box with win2k3 x64 sp2 but I'm going to update my drivers now anyway just in case.

FS116P Desktop POE switch review

Sometimes you've just got more devices in a room than ports and whether it's temporary or not, you just can't get approval for more LAN drops. And to make matters worse, they're IP phones that run on POE (Power Over Ethernet). Now in your big network closets you can install those new big howling POE switches for your backbone but for a small room, a quiet switch will keep mad users from coming to your office with torches. (I just installed a 24 port Dell POE switch on the backbone last week and it would make an aircraft carrier deck seem quiet.)

Enter the Netgear FS116P - 16 port 10/100 with 8 ports of POE.
http://www.netgear.com/Products/Switches/DesktopSwitches/FS116P.aspx
It's a fanless desktop switch and out of the 4 I got for our small rooms, only 1 had a discernable buzz but it was faint and after being stuffed behind the printer stand wasn't really noticable. As far as performance goes, it works just like any run of the mill 10/100 desktop switch - not noticeable either way for end users. Only the first 8 ports are POE enabled but for smaller rooms that's really all you need. This switched worked fine with my Nortel i2002 phones and the Cisco 1131AG.

Exchange 2007 Powershell Script - Emails owners of all email distribution groups

Last year I posted a generic script to enumerate all members of all email groups. My department was tasked with finding a way to keep all email groups updated for all departments. My solution has 2 parts:

Part 1 is configuring the "Managed By" field in Active directory or exchange for all distrubtion groups and checking the box for 'Manager can update member list'. This allows email distribution group owners to modify membership through their Outlook client directly. (via the Address book interface.)

Part 2 consists of the following Powershell script which finds all Email Distribution Groups in the forest and then sends an email for every email distribution group to that groups owner. The emails contain the primary SMTP address for reference and a list of all members of that group for quick viewing and confirmation.

# Enumerates all members of all Distribution Lists in Exchange 2007
# and all owners.
# Script will then proceed to email each owner a list of all
# members of each group.
# Uses cmdlets from exch2007
#
# 3/14/08
# By: Gnawgnu

#first get all distributionlists
$dl = get-distributiongroup

#then enumerate through them all and get all group members.
foreach ($group in $dl) {

#build group data
$groupName = "Group Name: " + $group.name
$groupAddr = "Email Address: " + $group.PrimarySMTPAddress
write-host $groupName -foregroundcolor Green
$dlgm = get-distributionGroupMember $group.name.ToString()
$gOwner = get-user $group.ManagedBy.Name

#setup email - make sure to add to your whitelist for
#antispam if applicable.
$sender = "PickASMTPSenderEmailAddress"
write-host $sender
#get Email Address of group owner
$recipient = $gOwner.WindowsEmailAddress
write-host $recipient
$server = "YourSMTPServerGoesHere"
write-host $server
$subject = "Monthly Review required - Email Group: " + $group.Name.ToString()
write-host $subject
#Note: `r`n is a carriage return
$bText1 = "`r`nOwner:" + $group.ManagedBy.Name.ToString() + "`r`n"
$bText2 = $groupAddr.ToString() + "`r`n"
$bText3 = "group members: `r`n"
$bText4 = $dlgm | fl Name | out-String
$bText5 = "Please use your Outlook Client to make changes if needed.`r`n"
$bText6 = "If you are no longer the manager of this group, please notify IT.`r`n"

$body = $bText1 + $bText2 + $bText3 +$bText4 +$bText5
write-host $body.ToString()
$msg = new-object System.Net.Mail.MailMessage $sender, $recipient, $subject, $body

#send email
$client = new-object System.Net.Mail.SmtpClient $server
$client.credentials = [System.Net.CredentialCache]::DefaultNetworkCredentials
$client.Send($msg)

}