Martin's questions

The %SystemRoot% environment variable contains the path to the Windows directory. (e.g. c:\windows)

SystemRoot is not configured in Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment, it is automagically set.

Now, typically on Windows 10 this directory has the caseing C:\Windows on NTFS disk.

After a script test(*) broke, we noticed:

• With same OS version Windows 10 (LTSC 1809 17763.3887)
• Some boxes use %SystemRoot% == C:\WINDOWS (all uppercase, despite the directory on-disk being C:\Windows)
• Some boxes use %SystemRoot% == C:\Windows (case of dir on disk)
• We cross checked with ProcessExplorer: The casing difference is already present in the environment block of the wininit.exe process, so it's not overridden somewhere.

Q:

Is the base for the value of SystemRoot read from any specific registry key?

What could explain this difference?

(*): To be clear, the test was broken anyway - thou shall not rely on path casing on Windows.

Our internal Apache instance on a Windows server is regularly filling up the disk with C:\Apache24\logs\ssl_request.log.yyyy-MM-dd.log logs.

They seem to be rotated, although their sizes vary (200 - 700MB).

I see no value in these logs for this internal server. Can I disable them?

I found no entry in the httpd.conf - only for the error and access logs.

I have a Windows 7 machine that has the file ucrtbase.dll of Universal C Runtime installed in the version 10.0.10586.1412.

However, the latest official MS Update I can find patching this file for Windows 7 is KB3118401, which contains this file in version 10.0.10586.9.

Given this Windows-7 machine, how can I find out which Update KB installed this specific version of ucrtbase.dll?

I would like to solve this problem generically, because we have issues with Windows system DLLs from time to time: In our development dep we have 5 different Visual Studio Versions and so it happened from time to time that one dev would have a newer version of some System32 dll and we weren't even sure where it came from.

Things I've tried:

• Correlating the update installation list with the file creation date.
  Unfortunaltely the Hotfix history only seems to be keeping the date, and on the date this file was created on disk, I seem about a 100 KB fixes installed. (Expected bulk install of fixes at this date.)
• Searching through %WINDIR%\WindowsUpdate.log - timestamps start after suspected install
• Googling: No luck. I only find KB3118401 and KB999226 (an older version).
• Looking at the WinSxS folder name of said file.
  • E.g. the WinSxSfolder for the 64 bit version is amd64_microsoft-windows-ucrt_31bf3856ad364e35_6.1.7601.23303_none_0a7a73e149361a18 - I haven't found how this could help.

Reference: Jenkins Users :: Jenkins on Windows: Java + JRE (version) confusion

Which Java version should I run Jenkins with (on Windows)? Should I use the included JRE of the Windows master? Should I use the last 1.6 release? Should I just run it on a current 1.7 version? (Note that I'm running the stand-alone version.)

All I could find on the Jenkins pages was: To run Jenkins, minimally you need to have JRE 1.5 or later.

Aside: My Windows server(s) are still 32bit 2k3, but what do you run Jenkins with on 64 bit platform? 32bit or 64bit JVM?

Note that this question is only about the JRE (or JDK) I use to run the Jenkins instance(s) with. I'm not concerned with the JDK used to build Java programs.

I'm not sure whether this sounds stupid or lazy, but I'm really not sure.

I have a problem with the performance of a VM setup (2008R2-64bit Hyper-V running a 2003R2-32bit Windows server) and I'd like to see whether the disk is the problem.

I want to time a C++ build. It will take x minutes on the real hardware and x+y minutes on the single VM running on this same hardware. (And, y is way too large, hence this question.) I guess I would want to run perfmon during each build and time some counters and then compare the results.

• Should I run perfmon on the host or on the guest (for the build in the VM)?
• Which counter(s) should I look at?
• Should I consider anything besides perfmon?

We have recently started moving our C++ build server(s) from real machines into VMs. (MS Hyper-V)

We have some performance issues that I've currently no idea how to address. We have:

• Test-Box - this is a piece of desktop workstation hardware my co-worker used to set up the VM before we moved it to the actual server hardware
• Srv-Box - this is the server hardware
• Test-Box-Real - This is Windows running directly on the Test-Box HW
• Test-Box-VM - This is Windows in a Hyper-V VM on the Test-Box HW
• Srv-Box-Real- This is Server2008R2 running on the Srv-Box HW.
• Srv-Box-VM- This is Windows running in a Hyper-V VM on the Srv-Box HW, i.e. on Srv-Box-Real.

Now, the problem is that we compared Build times between Test-Box-Real and Test-Box-VM and they were basically equal (within about 2%).

Then we moved the VM to the Srv-Box machine and what we saw there is that we have a significant performance degradation between Srv-Box-Real and Srv-Box-VM, that is, where we saw no differences on the Test HW we now do see major differences in performance on the actual Server HW. (Builds about ~~ 50% slower inside the VM.)

I should add that both the Test-Box and the Srv-Box are only running this one single VM and doing nothing else.

I should also note that the "Real" OS is Win2008R2(64bit) and the VM hosted OS is Wind2003R2(32bit).

Hardware specs:

• Srv-Box:

  • Intel XEON E5640 @ 2.67Ghz (This means 8 cores with hyperthreading on the Real system and "only" 4 cores on the VM, since Hyper-V doesn't allow for hyperthreading, but number of cores doesn't seem to explain the problem here.)
  • 16GB RAM (we have 4GB assigned to the VM)
  • Virtual DELL RAID 1 (2x 450GB HUS156045VLS600 Hitachi 15k SAS drives)

• Test-Box:

  • Intel XEON E31245 @ 3.3GHz
  • 16GB RAM
  • WD VelociRaptor 600GB 10k RPM SATA

Note again that I'm only concerned with the differences between Srv-Box-Real and Srv-Box-VM (high) vs. the differences seen btw. Test-Box-Real and Test-Box-VM (low).

Why would one machine have parity when comparing VM vs Real performance and the other (server grade HW no less) would have a large disparity? (Both being XEON CPUs ...)

We are looking into virtualizing our C++ Build server(s).

_{The main reason being that our current toolchain that we use in addition to the build itself in Visual Studio only runs properly on Windows XP (or 2003Server), and the secondary reason being administrative ease (just clone an image and be ready to run on a different HW.}

In the end, the setup would/should most probably be one VM per hardware box, because sharing hardware just doesn't make sense for a C++ build, because it will max out CPU and disk anyway.

A colleague has done some preliminary tests on his developer workstation, and they're just horrible:

He measured the following build times for a full build of our Visual C++ 8 (Visual Studio 2005) solution:

• Desktop/Native with Windows 7 : ~16 min
• Vmware Workstation with virtual disk, guest is Windows XP : ~1h21min (500% !!!)
• Vmware WS with direct access to a dedicated physical disk and limited to 4 cores : ~42min (260% !!)

With these timings, we certainly won't go virtual!

We're now asking ourselves whether we made any wrong assumptions with our measurements.

• Did we mess up any settings to get such horrible slowdown for the C++ build?
• Should we have tested ESX(i)(?) instead of Workstation?
• Should we expect anything else from MS Hyper-V? (Because our IT would prefer that.)

Related questions that did not really fully help:

• Relative performance of VMWare Player, Workstation, Server and ESX?
• Extremely poor performance with VMWare hosted build server

Is it possible to use a single VM image to run many guests, where each guest is a Windows Server OS _{(specifically Windows 2003R2 to begin with, we would evetually migrate to 2008R2 or whatever's up to date then)}, having installed exactly the same applications and same windows settings (hence the wish for a single image) but only differing in a few configuration files, and computername, IP-address, etc.

Edit Note: Windows Server isn't strictly a must for us. We could run the guests/nodes as XP or Win7 and it would also work.

So essentially I would like the guests to share a common "OS + app service" where all patches to the OS and applications only need to be administered once.

Each guest should however appear as a single separate server on the network (computername in the Domain, etc.) and each guest could have very slight configuration differences. (For eaxmple some guests would run service X and Y, and other guests would run service X and Z.)

Is this possible with any virtualization solution? What hardware is needed? What vendors support this? Is it a good idea after all (for Servers)?

Background: This is for our build server farm. Each build node should be exactly the same anyway, except for it's "identity" (computername, etc.) to make it accessible from the master build node. (And the master build node would be identical with but a few minor differences wrt. the build automation software.)

_{After a few comments and answers and thinking, I hope I can now add a}

TL;DR : If I want full performance^(a) and (simple) HW failure redundancy, does it make any sense to go for a virtualization solution with more than one guest per hardware-box?

_{(a) -> parallel C++ builds with expected (very) high CPU and disk utilisation}

Let's start with saying that I'm a total noob wrt. to server virtualization. That is, I use VMs often during development, but they're simple desktop machine things for me.

Now to my problem: We have two (physical) build servers, one master, one slave running Jenkins to do daily tasks and build (Visual C++ Builds) our release packages for our software. As such these machines are critical to our company, because we do lot's releases and without a controlled environment to create them, we can't ship fixes. _{(And currently there's no proper backup of these machines in place, because they do not hold any data as such - it just would be a major pain to setup them again should they go bust. (But setting up backup that I'd know would work in case of HW failure would even be more pain, so we have skipped that until now.))}

Therefore (and for scaling purposes) we would like to go virtual with these machines.

Outsourcing to the cloud is not an option, not at all, so we'll have to use on-premises hardware and VM hosts.

Each Build-Server (master or slave) is a fully configured (installs, licenses, shares in case of the master, ...) Windows Server box. I would now ideally like to just convert the (two) existing physical nodes to VM images and run them. Later add more VM slave instances as clones of the existing ones.

And here begin my questions:

• Should I go for one VM per one hardware-box or should I go for something where a single hardware runs multiple VMs?
  • That would mean a single point of failure hardware wise and doesn't seem like a good idea ... or??
  • Since we're doing C++ compilation with Visual Studio, I assume that during a build the hardware (processor cores + disk) will be fully utilized, so going with more than one build-node per hardware doesn't seem to make much sense??
• Wrt. to hardware options, does it make any difference which VM software we use (VMWare, MS, Virtualbox, ... ?) (We're using Windows exclusively for our builds.)

As stated above, I'm starting to think it doesn't make sense to go for more than one guest per hardware-box performance wise. Are there other considerations?

Regarding budget: We have a normal small company (20 developers) budget for this. ;-) That is, if it's going to cost a few k$ it's going to cost. If it's free - the better. I strongly prefer solutions where there's no multi-k$ maintenance costs per year.

After I have installed Jenkins (on Windows), the program folder contains, among others, two files:

• identity.key (28 lines)

  -----BEGIN RSA PRIVATE KEY-----
  MIIEow......
  ...
  -----END RSA PRIVATE KEY-----
  

• secret.key (64 characters)

  d6....38
  

(I've already asked on the Jenkins mailing list, but didn't get any response there.)

Can anyone explain what these two files are used for by Jenkins/Hudson?

I'm specifically interested whether:

• I need to backup them?
• they are machine specific, i.e. if I need to do anything about these files when moving the Jenkins/Hudson server to a different machine.

I'm trying to get Jenkins to authenticate users via our active directory groups.

If I insert users they are correctly looked up. If I insert group names, they are not found.

Edit: Through trial & error I have found out that the authentication via the groups does in fact work, that is, once I add the group KS-Soft to the list, users in this group can log in. However, in the list where the users and group names are entered, Jenkins tries to display an icon for whether it's a user or a group. The user icon is displayed correctly, but the group icon is always an error icon.

So it would appear that Jenkins can authenticate users via group membership, but it fails to verify whether a given group name string exists in the directory. Is this technically even possible? (Maybe just the icon display is messed up.)

The Jenkins settings are as follows: (note: mydomain and com user names are different, the rest are exact values)

Server  : ldap://ks-dc01.mydomain.com:389
root DN : dc=mydomain,dc=com
User Search Base : ou=KSUser
User Search Filter : userPrincipalName={0}
Group search base : ou=KSGroups
Manager DN : CN=Placeholder Martin,OU=Benutzer,OU=KSUser,DC=mydomain,DC=com
Manager Password : *****

With this setup, I enter the user [email protected] into the list and Jenkins then can look up this user and I can log in.

However, I cannot get Jenkins to resolve the Group Names. I use AD Explorer to confirm my groups are in fact below OU=KSGroups.

I have one group here displayed as CN=KS-Soft in AD Explorer and it has a memberattribute that lists all the users I'm interested in. _{(The user [email protected] is listed as CN=Placeholder Martin,OU=Benutzer,OU=KSUser,DC=mydomain,DC=com in this attibute.})

I have tried these string for the group:

• KS-Soft
• [email protected]
• ROLE_KS-Soft and [email protected] as per this thread

Note that the Jenkins help has the following to say on the Group search base:

One of the searches Jenkins does on LDAP is to locate the list of groups for a user.

This field determines the query to be run to identify the organizational unit that contains groups. The query is almost always "ou=groups" so try that first, though this field may be left blank to search from the root DN.

If login attempts result in "Administrative Limit Exceeded" or similar error, try to make this setting as specific as possible for your LDAP structure, to reduce the scope of the query. If the error persists, you may need to edit the WEB-INF/security/LDAPBindSecurityRealm.groovy file that is included in jenkins.war. Change the line with: groupSearchFilter = "(| (member={0}) (uniqueMember={0}) (memberUid={1}))"; to query only of the field used in your LDAP for group membership, such as: groupSearchFilter = "(member={0})"; Then restart Jenkins and retry the login.

I have tried both values in this file and neither works.

We have a Windows 2008R2 server that runs our build scripts.

At the moment, it is not possible to fix our scripts so that they could run without elevation. _{Please don't bother. It is currently more viable to risk breaking the machine or opening a security hole than to fix all the 3rd party apps the scripts are using.}

I have found 2 Local Sec Policy options that I thought I might use:

User Account Control: Admin Approval Mode for the Built-in Administrator account

and

User Account Control: Run all administrators in Admin Approval Mode

The second one basically switches UAC off completely, so all admin accounts will always run anything run with full elevation. (If I understand correctly.)

The first one though got my interest: Apparently the built-in admin account has the ability (its default) to always run anything fully elevated.

Is it somehow possible to enable this setting for a domain user account, so that we can run our scripts as this user, circumventing UAC completely for the scripts, but keeping UAC for all human interaction with the server?

Note: the base problem for me is to be able to access a network share that I (Win 7 admin user) have set up when I run an elevated program. Normally the elevated program will not have access to my non-elevated network shares.

According to Microsoft the registry setting EnableLinkedConnections will allow elevated processes to access the network share of the currently logged in (non-elevated) explorer process.

This explanation makes some sense:

[...] When you’re a member of the Administrators group and you log in, your account is busted down to a non-privileged user by UAC. This running context is completely separate from the context you get when you right-click Command Prompt and launch as an administrator. As you’ll probably have noticed, network drives connected in one context are not visible in the other. [...]

This forum thread asks about the vulnerabilities opened by this setting. The answer given links to an article about disabling UAC prompts (or so I understand).

The question now is, what does the registry setting EnableLinkedConnections do or allow on a Windows 7 system, given that we are not running in a domain environment.

Edit: One thing that I'm specifically interested in is whether this setting only affects the (visibility of) network drives or whether it has any other implications.