Chris's questions

I'm trying to enable Change Block Tracking as per this VMWare KB article but the setting ctkEnabled is not being retained in the advanced options or being added to the vmx file.
The setting scsi0:0.ctkEnabled is being retained and I see a file vmname-ctk.vmdk in the datastore. I've verified that the vm doesn't have any snapshots but don't see any other suggestions in the KB (or google, of course.)

Edit:

The last comment on this community post. It's a slightly different circumstance, but suggests that there is an known bug editing these settings in the web-gui.

I extended a disk on a DB server (so we could temporarily restore a database) and I would like to shrink the volume back down now that the data has been deleted.

I deleted the data and shrank the disk within the OS which freed the space on the windows volume, but the space is not shown as released for the volume in the SAN management GUI. If you try to modify the volume size, it warns that the "new volume size is less than current use".

Is it possible to release the space on the SAN volume or am I stuck with it at this size?

Environment

The DB server is Windows server 2008 running on VMWare ESX 4.0

The disk to shrink is a mapped raw LUN, the volume is on a Equallogic PS6000 (firmware V5.0.7)

Since upgrading to Backup Exec 2012 we have been experiencing a significant increase in backup times. The data throughput is about where it was before, the problem seems to be random delays between each server's backup.

When the delay occurs, we'll see the snapshot creation event on the ESX host, then there is an indeterminate amount of time where nothing is happening, then we see the "Symantec Backup" event on the host and the IO starts between the media server and the SAN. The delays can happen at any time, with any server, and there can be more than one server which experiences a delay during any given backup.

The delays seem to be independent of VM server, their config or load, or the host load, or media server activity (this is the only backup job active at the time).

Yes, I've raised this issue with Symantec technical support; let's just say they've been less than helpful so far (I'll resist the temptation to rant). I'm just wondering if anyone else had seen, and hopefully resolved, this issue.

EDIT:
I've had some activity from Symantec support on this recently. No resolution as yet, but they are now maintaining a dialog

Systems Overview
Media server:

• HP ProLiant DL360 G5 (E5420, 6GB RAM)
• Tape Drive - Ultrium 1840 SAS
• 2 x 1Gb NICS for iSCSI to the SAN
• 2 x 1Gb NICS teamed for the network
• Windows 2008 R2
• Backup Exec 2012 with VMWare agent, and RAWS on the VM servers for GRT.

VMWare:

• VMWare vSphere 4.0

Storage:

• Equalogic PS6000
• Connection to ESX hosts & backup server via multipathed 1Gb

The backup was created by selecting the servers in vCenter so that it is one job backing up multiple servers sequentially.

Here is a visualization of the delays: The green areas are where the data is actually going from the SAN to media server (and are fairly consistent), the red areas are the delays where there is no activity.
Note: The shorter backup time of Utility1 on 1/12 was because it was cancelled. Also, there are more servers after these but are omitted for clarity.

The cabling between our patch panel and switches isn't a complete nightmare (like this), but is far from well organized. As we add new wall jacks, or office moves happen, cables get moved on the patch panel; in a given cable bundle, one cable may go to port 10, the other to 410.
The key problem, I think, is because we have fewer switch ports (336) than patch panel ports (480) and so can't neatly arrange and tie up the cables in groups at the patch panel end in a one to one relationship to the switches.

How can I improve the arrangement of the cables at the patch panel end when they go anywhere and everywhere? Am I missing some obvious trick here, or do I just have to lie back and think of England?

We have a problem with a specific website which our staff need to access via Internet Explorer on our Citrix server (running Win2K3).

When connecting via SSL (a requirement), the site is inaccessible because the certificate issuer's certificate is not in the Trusted Root Certification Authorities.

If I manually import the certificate chain (exported my PC), it works, but I'd rather not do that for each user: Is there a way I can import the certificate for all users?

I found this MS KB article which details importing certificates in to the Local Computer store to resolve a different issue; would that apply here?

I'm trying WinPE pre OS to boot laptops for ghost 11.5, and I need to set the NIC to 100_full for compatibility with the switch. I've found how to do this by modifying the inf files but there are multiple drivers which match the vendor ID of the laptop's NIC. Is there a way to determine which driver was (or will be) used by WinPE so that I only have to edit one inf file instead of all possible matches?

We have concerns about our staff using wireless hotspots to connect to our LAN. We use a VPN to connect to our network and they can then transfer data using a proprietary application. What little web browsing they do is directed to our proxy server and hence requires the VPN to be established first.

So my question is this: How do we best secure the laptop from the time they start it to the time they make the VPN connection?
They could be connected to an open, unsecured network for many minutes before starting the VPN.

Our concern is not so much sniffing of data (as data will only be sent over the VPN), but that someone could connect to the laptop and compromise it prior to the VPN connection.

Personal firewalls are an option, but they need to be effective without input from the user (and preferably centrally managed).

I'd be interested to know how others have approached this problem and what solutions they have found.

Update:

An implied part of this question that I didn't really ask is: Do you consider Windows firewall to be robust enough, with suitable policies, to block inbound access, or do you turn to third party solutions?