VMware: Cannot connect from vCenter Webclient to VDP Appliance

March 26, 2013 Michael Albert Leave a comment

Hi,

the license of VMware vSphere 5.1 includes the diskbased Backup Solution VDP(vSphere Data Protection). So I’ve decited to try the appliance (Version 5.1 Timestamp 2012-10-02) whether these meets our requirements.

Before I started, I ensured that

The DNS forward and reverse resolution of the choosen name and IP address is possible.
The User, who manage the backup, have vCenter Administrator rights.
all prerequisites are fulfilled

Downloading and installing of the appliance works as expected. The Appliance is properly registered in the vSphere Webclient but I can’t start the VDP Frontend within.

Error: Could not connect to the requested VDP appliance. Would you like to be directed to the VDP configuration screen to throubleshoot the issue.

But whats wrong? I’m currently logged on to the Webclient with my Domain Login. When I’m using SSO Administrator admin@system-domain Login the VDP Frontends starts,
also another Domain Login can connect. Something in the chain Windows Domain, Single Sign On, vCenter and VDP Appliance fails.
Continue reading VMware: Cannot connect from vCenter Webclient to VDP Appliance →

Windows Scripts

Windows: Script to get the NetBIOS Name of an Active Directory Domain

March 25, 2013 Michael Albert Leave a comment

Hi,

just a short post :-). A powershell script to get the NetBIOS Name of an Active Directory Domain


###############################################################################
# Gets the NetBIOS Domain
# Author Michael Albert michlstechblog.info
# License: GPL v2
###############################################################################
[reflection.assembly]::LoadWithPartialName("System.DirectoryServices.Protocols")|Out-Null

if($args.count -ne 1){
    Write-Warning " Start script with fqdn as parameter"
    Write-Warning (" for example: "+$myInvocation.myCommand.name+" yourdomain.com")
    exit 1
}
$sDomainName=$args[0]
# Get AD Root
$oRootDSE = [ADSI]"LDAP://RootDSE"
$sConfig = $oRootDSE.Get("configurationNamingContext")
# AD Object AD Root
$oADSearchRoot=New-object System.DirectoryServices.DirectoryEntry("LDAP://CN=Partitions," + $sConfig)
# Search for Netbiosname of the specified domain
$sSearchString="(&(objectclass=Crossref)(dnsRoot="+$sDomainName+")(netBIOSName=*))"
$oSearch=New-Object directoryservices.DirectorySearcher($oADSearchRoot,$sSearchString)
$sNetBIOSName=($oSearch.FindOne()).Properties["netbiosname"]
# Print out
Write-Host "Domain NetBIOS Name:" $sNetBIOSName

Have fun :-)!

Michael

VMware

VMware vCenter: Howto add an Active Directory Domain as SSO Identity Source and using system session credentials

March 19, 2013 Michael Albert 6 Comments

Attention: If plan a update to VMware vSphere/vCenter 5.1.0 Update 1. Currently this version contains a bug which prevents User from Login. VMware is working on an Fix. See KB2050941

=> Bug is solved in 5.1.0 Update 1a

Hi everybody,

since VMware vCenter 5.1 a new service SSO, the Single Sign On Service, handles the authentication for all logons. The advantage is that multiple authentication sources are possible. For example Local User and groups, OpenLDAP Directory Services and of course Microsofts Active Directory.

This post is related to vCenter Version 5.1.0b and describes how to add an Active Directory Domain as Identity source and get this running by using the “Reuse session” Authentication Type. The last one is the tricky part :-).

Let us start. Start the vSphere WebClient with a login which owns the appropriate rights, for example admin@system-domain or any other user who owsn has the SSO administrator privileges, and navigate to Administration/Sign On and Discovery/Configration. In the default configuration two identity sources are added by default. The SSO database and the user management of the local server.

To add an Active Directory as identity source the following informations are required

The Domain fully qualified domain name
The Domains NetBIOS Name
At least one domain controller
The Base DN for the users and groups

The attached powershell script GetSSOParameters.ps1 should determine this for your domain. You must start the script with the fully qualified domain name as parameter. Try it!
PS c:\>GetNetBiosDomainName.ps1 yourdomain.com Basic Config for VMware SSO Identity source NAME: YOURDOMAIN Primary Server: ldap://domaincontroller1.yourdomain.com Secondary Server: ldap://domaincontroller2.yourdomain.com BaseDN Users: DC=yourdomain,DC=com Domain: yourdomain.com Domain Alias: YOURDOMAIN BaseDN Groups: DC=yourdomain,DC=com
If you have the necessary information you can add the Identity source. See Screenshot below. First try to add by specifing a Username and a password which have the rights to query the Active Directory

VMware SSO Identity Source with "Password" option — VMware SSO Identity Source with “Password” option

Press the Test Connection Button and normally this return that the connection is successfully established. Continue reading VMware vCenter: Howto add an Active Directory Domain as SSO Identity Source and using system session credentials →

miscellaneous

Script to get a list of computers connected to a Avocent KVM switch

March 14, 2013 Michael Albert 1 Comment

Hello,

in his office, a customer have a few Avocent KVM switches to control some client computers in a remote room. He ask me about the possibility to get a list of all computers connected to these boxes, because he do not want to maintain any list by hand.

I research the documention but there is no (scripting) interface from which I could get such a list. SSH is only for connecting serial consoles, SNMP offers no OIDs for such a case.

Because of the costs, DSView isn’t a option. The only way seems to be to extracting the list by reading the Webfrontend HTML output. Let us do this 🙂

I wrote a script in powershell, at least version 2 is needed to handle selfsigned SSL certificates, which do the following:

Login to the Webfronted with https and SSL encryption by System.Net.HTTPWebRequest class to get the authentification cookie
Get the Device HTML page by .NET class System.Net.Webclient and using Authentification cookie
Save HTML do a temporary file
Open the file with Internet Explorer
Get the URL to start a KVM session, computername and portnumber by DOM

Script details

Define the User, Password, protocol and the devices:

# KVM User
[string]$sUser="Admin"
# KVM Password
[string]$sPassword="YourPassword"
# Protocol
[string]$sProtocol="https"
# Your Devices
[String[]]$aAvocentDevices=@("Console1.domain.local","Console2.domain.local")

Built HTTP POST text and disable SSL certificate warnings
Continue reading Script to get a list of computers connected to a Avocent KVM switch →

Windows knowhow

Windows Update and Windows Search do not work

March 12, 2013 Michael Albert Leave a comment

Hi,

a good friend of mine came to me last week because some services of Windows Vista on his notebook did not run as expect. In detail:

Windows Search service starts but terminates
- EventID 7034: The Windows Search service terminated unexpectedly. It has done this 4 time(s).
  Windows search terminates after start
- EventID 7024: The Windows Search service terminated with service-specific error 2147749155 (0x80040D23)
- EventID 1006: The Windows Search Service has failed to create the new search index. Internal error <4, 0x8004117f
- EventID 9000: The Windows Search Service cannot open the Jet property store.
Windows Update service starts, but do not work, some errors are logged in C:\Windows\WindowsUpdate.log
- 45c DtaStor FATAL: Failed to initialize datastore, error = 0xC8000247
- 45c AU FATAL: Failed to get session from datastore, error = 0xC8000247
- 45c AU FATAL: Failed to Unserialize from data store, error = 0xC8000247
No Windows Update File could installed by double clicking a msu File.
Cryptocraphic service do not run as expected:
- Signature for Windows builtin programs cannot be verified, for example mmc.exe. Error Message:
  “Do you want the following program to allow changes to this computer?“
  
  UAC Message: builtin executables could not verified.
- Cause: The folder c:\windows\system32\catroot2 is empty or/and some errors are logged in file C:\Windows\System32\catroot2\dberr.txt:
  CatalogDB: 21:39:37 28.02.2013: JetInit Corruption
  CatalogDB: 21:39:37 28.02.2013: catdbsvc.cpp at line #747 encountered JET error -583
  CatalogDB: 21:39:37 28.02.2013: catdbsvc.cpp at line #961 encountered JET error -583
  CatalogDB: 21:39:37 28.02.2013: catdbsvc.cpp at line #6636 encountered JET error -583
- EventID 257: The following information was included with the event: -583 the message resource is present but the message is not found in the string/message table

It seems that all services which uses the Window Jet Database engine are affected.

Solution

Continue reading Windows Update and Windows Search do not work →

Michls Tech Blog