Alasdair C-S's questions

I can't see how to grant Kerberos Constrained Delegation for a service identified by a Managed Service Account.

I have a Windows 2008 R2 functional level single domain single forest, two 2008 R2 SP1 DCs, newly built.

I have installed my new SQL Server 2012 instance on server "SQL-01" to run in a Managed Service Account, "MsaSqlServer".

All good so far.

The Managed Service Account has attributes: cn=MsaSqlServer sAMAccountName=MsaSqlServer$ servicePrincipleName=MSSQLSvc/SQL-01.fasttrac.local,MSSQLSvc/SQL-01.fasttrac.local:1433

I now have an IIS Website on server APP-02 (in the same domain). I can set up constrained delegation in ADUC quite easily on the Delegation tab of the Properties dialog for the webserver, APP-02, for e.g. file access to a file server, by clicking add, finding the file server and selecting the "cifs" service type. However, I want to have delegation for SQL Server, so I click Add, find the SQL server, SQL-01, and there's no SQL or MSSQLSvc or similar service. That's normal, because the MSSQLSvc SPN is registered to the the account that SQL Server runs as, and it would only appear on the computer account if it ran as Local System. With SQL 2008 running under a normal domain user account, I simply enter that domain user name and select the MSSQLSvc SPN and off we go, however I can't get the "Select Users or Computers" box to find my Managed Service Account (with or without the $ suffix).

I think I can get the required effect by hacking the msDS-AllowedToDelegateTo attribute of the web server (APP-02) AD object directly and adding "MSSQLSvc/MsaSqlServer" and "MSSQLSvc/MsaSqlServer.domain.local", but I don't know whether to include the training $ (i.e. "MSSQLSvc/MsaSqlServer$") and really, I though the GUI should work. Does anyone know what I should do?

Background

One of my clients is an IT-dependent workflow-driven law firm with about 50 seats. They have been audited by one of their clients (an FSA regulated mortgage lender) and told that their single-site is a threat to business continuity. I have proposed that we partition their business into two bits:

1. Client-side - PCs, monitors, chairs, desks, LAN switches and router and firewall

2. Server-side - The Virtual Machines running Active Directory, Exchange, SQL, SharePoint and other line-of-business apps, "robot" worker machines and Remote Desktop Services (around 14 VMs in total)

The idea is that we can store equipment and put arrangements in place to quickly reproduce at least a reduced-capacity client-side environment at an alternative location, or even have users connect from their homes if required.

The Server-side represents a greater challenge, as it includes services published from their (currently ADSL, soon to be 100 Mbps fibre) IP connection and about 3TB data, not including backups. I have proposed that we move the entire server-side environment out of their current self-hosted on-site server rooms and into a hosted facility. I still want the same level of privacy - this has to be firewalled off from the internet except for the small number of published services, and they would be best served from a web-server VM in a DMZ.

Currently there are two server rooms, each containing one node of a replicated SAN and one Hyper-V cluster host. Coupled with redundant fibre-channel and Ethernet links this means the system will keep running even if a whole server room is lost. I want the hosted server-side environment to be similarly resilient to single data-centre loss.

Basically, I want the security, availability and control I get from local self-hosting, but in the cloud, with geopraphical diversity of at least 30 km. I also don't really want to be buying kit and racking it myself and worrying about hardware lifespan and replacement, backups etc.

Questions

1. Is the replicating SAN and Hyper-V Cluster something I should try to replicate in the data-centre, or do large hosters & cloud providers have other ways of ensuring availability?

2. It looks like Amazon AWS has all the bits necessary (EC2, EBS, S3, VPC, VPN etc), but only one EU data centre. What kind of availability can I expect? E.g. If they have a major outage in their Ireland datacentre (imagine an aircraft landing on it, for example), what will happen to the services hosted there? And what about general reliability issues?

3. Can this be done at all using Windows Azure, Rackspace Cloud, or any other cloud service provide?

Thanks for considering my question.

I look after a network with 11 x new HP v1910 24-port 1GB switches and 2 x HP 4204vl 1GB Chassis switches. I'm looking for software to enable me to:

1. Map the network graphically - there are a lot of fibre and copper LACP links
2. Provide a single view of the state of the network - I'd like to see the current MSTP trees
3. Enable the devices to be managed from a single interface, as 13 separate tabs in the browser plus telnet logins is a pest
4. Monitor and record sFlow and RMON data for historic purposes
5. provide alerts for e.g. LACP state change or MSTP reconfiguration

We have Microsoft System Center Essentials 2010, but I can't seem to get a single network diagram with it. I've looked on here: http://www.slac.stanford.edu/xorg/nmtf/nmtf-tools.html but I drowned in excess choice.

Windows-based solutions strongly preferred. Free solutions ideal, but not essential.

Scenario

I'm building a high-end workstation for a software developer. The plan is to install Hyper-V Server 2008 R2 SP1 on the internal disk, and create a Windows 7 Ent x64 VM in a VHD on a second disk. This second disk is an SSD in an externally accessible caddy.

Under normal use, the developer will boot Hyper-V, and then use remote control (initially the Hyper-V remote, but moving on to RDP) from the host to the locally running guest, and it should all work like a vanilla Windows 7 workstation. However, we also have a laptop with support for two harddrives, and I will replicate the setup there, so when going on a site visit, we plan for the developer to takes his SSD out of his workstation, put it in the laptop and Viola - there's his development environment.

Question

Can we run RemoteFX on this workstation so that both the server (RemoteFX in Hyper-V) and client (MSTSC) parts of RemoteFX are running on this "workstation"? If so, do I need two graphics adapters, and do they have to be identical? The objective is to provide accelerated video etc. for the Windows 7 VM under normal use.