john's questions

I'm sure this question will have been asked somewhere before. In fact I'm sure I've read about it before too, but I can find any resources to help me along my way.

What I'm trying to do is deploy a set of Hyper-V servers without having to do anything other than start the process. I can think of ways to configure everything through PowerShell and/or unattend.xml, except for the network adapters. The commands are available, but there's one significant problem:

How do I get Windows to consistently detect the correct adapter to assign each network to?

These are clustered Hyper-V hosts with multiple IP addresses and VLANs, and teamed adapters but my understanding is that Windows detects adapters in a random order. To script it, I need consistency. I can't assume that Local Area Connection 12 is always port 3 on card 2, for example. The same physical port on each cluster node will be connected to the same VLAN or aggregate.

• Do I have to go around and collect the MAC address of every port on every adapter and have some kind of lookup table in my scripts?
• Is there an attribute in WMI/registry that I can reference when configuring my adapters and teams?

We have Office 365 with a hybrid deployment. Our on-premise server is relaying email directly out to the web (not via EOP). domain-a.com is an accepted domain on our on-premise server; domain-b.com is not.

The issue we have had was that the on-premise server was a bit low on space on the C: volume and the transport server was rejecting emails with a from address of domain-b.com, but not domain-a.com. The error message received was:

send-mailmessage : Insufficient system storage. The server response was: 4.3.1 Insufficient system resources   
    At line:1 char:1                                                                                               
    + send-mailmessage -to [email protected] -Subject test -from [email protected]                       
    + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~                             
        + CategoryInfo          : InvalidOperation: (System.Net.Mail.SmtpClient:SmtpClient) [Send-MailMessage],SmtpException                                                                                                  
        + FullyQualifiedErrorId : SmtpException,Microsoft.PowerShell.Commands.SendMailMessage   

Once I had cleared down the log files in IIS, email was successfully relayed for both domains. What could be the explanation for this? I'm not sure where to start.

We have a volume serving up CIFS data, which seems to have a lot more snapshot data than the rest. I suspect that this is due to a higher rate of change, and that I could determine this using the snap delta command. But I'd also like to be able to look at the snapshot sizes and target a particular one based on its size too.

In the CLI and System Manager, when viewing the snapshots repeatedly over the space of a few minutes, the size gradually increases up to a point and then drops right back down again. By this I don't mean that the snapshots are increasing and decreasing in size, just the reported size. Ideally, I'd like to know what causes this to happen.

More importantly, though, how would I determine the actual size of a snapshot?

We have a NetApp Storage system presenting LUNs to a few Hyper-V clusters. When running a system performance trace (in perfmon) on a 2008 R2 there's a warning about a "high level of Split I/O". Reading up on split I/O I find that this is most likely caused by a fragmented drive.

I find it hard to believe that the drive is fragmented in the traditional sense, because everything is virtual (virtual hard disk on a LUN, on a volume, in an aggregate, on a storage system that writes anywhere it sees fit and de-duplicates that data also). So should I even be worried about this? I can't see any evidence of storage problems, such as excessive latency.

Incidentally, running a defrag analysis on one of our VMs shows ~50% fragmented data. I think I read somewhere that windows would automatically split I/O if it detected fragmentation above 20% is that true? The defrag task is disabled, so how would it know?

I've been looking at some performance issues on a clustered virtual machine in our organisation. Actually this problem seems to affect most of the virtual machines I have looked at. Both host and VM are 2008R2 with SP1.

I believe - from what I have read in various articles and advice I have been given - that I/O latency is the most important metric to be looking at. I've looked at this metric in three different places:

• LUN latency on the storage appliance
• Logical disk average sec/write and average sec/read on the Hyper-v host
• The same as above, but on the virtual machines themselves

This is in an effort to narrow down the source of any latency that might be happening. Sure enough, this is what I found....

What I'm seeing is what I would consider to be acceptable latency (3-15ms) on the LUNs, up to 20ms (still acceptable) on the Hyper-V host. When I look at the same metrics on a VM I'm seeing regular spikes of up to 300ms for up to 10 seconds at a time and an average of about 20-30ms.

This particular VM is a SQL server, but the same applies to non-SQL servers too. The relevant exceptions are added to our AV solution to avoid on-access scanning of DB files. Also, our VHDs are of a fixed size as opposed to dynamically expanding.

So for my question:

What are the likely causes of this latency, and/or what other metrics could I be using within the VM (or even on the Host) to narrow this down?

I've read this question, but the explanation of Symmetric NAT wasn't detailed enough.

Please could someone help me to understand the following paragraphs?

I read this about Symmetric NAT:

Each request from the same internal IP address and port to a specific destination IP address and port is mapped to a unique external source IP address and port, if the same internal host sends a packet even with the same source address and port but to a different destination, a different mapping is used. Only an external host that receives a packet from an internal host can send a packet back.

http://en.wikipedia.org/wiki/Network_address_translation#Types_of_NAT

And this about UDP Hole-punching:

UDP hole punching will not work with symmetric NAT devices (also known as bi-directional NAT) which tend to be found in large corporate networks. In symmetric NAT, the NAT's mapping associated with the connection to the well known STUN server is restricted to receiving data from the well-known server, and therefore the NAT mapping the well-known server sees is not useful information to the endpoint.

http://en.wikipedia.org/wiki/UDP_hole_punching

But I'm not really absorbing it. I get the feeling that it's telling me that (in a client-server application where the client initiates the communication) a server could not communicate back the other way unless it were explicitly permitted by the NAT device. I don't understand why that is what it's saying. If it's possible, could you simplify this description slightly for me?

We have an issue in our environment where a well-known remote support tool cannot be used by an equally well-known software vendor to provide support to us. The client is proxy-aware, but for some reson it thinks it might be a good idea not to use it and do something completely different via UDP on port 1153.

Often when I'm scripting, I will be trying out a command but will want to filter the results. In order to find out what I'm able to filter on I need to know what filterable attributes are going to be available.

For example, I want to get a list of installed features but need to filter by installed only. The Get-InstalledFeature CMDlet doesn't have an -InstalledOnly type flag, so i need to filter the results. To find out what I can filter on i'll do something like

(Get-InstalledFeature)[0] | fl

or

Get-InstalledFeature | Select -First 1 | fl

and will find that I can (intuitively, I should say) filter on Installed. The resulting command is

Get-InstalledFeature | ?  { $_.Installed }

Is there an easier way to find out the filterable properties? Or perhaps I could be working differently? Or maybe I should just shut up and be happy that it's already so easy!

Get-Help doesn't really help in this case as it doesn't tell me what I'm going to get back.

I currently use DISKSHADOW to remove shadow copies from our Hyper-V servers. To do this I have to log onto the server but psexec doesn't work.

psexec \\hyper-v-server diskshadow
DISKSHADOW> Error reading from console. Win32 error: 0x6
The handle is invalid.

I think vssadmin works doing the above, but I'd like to script this with PowerShell and slectively remove the shadow copies. Neither of these tools provide usable output in PowerShell.

I've done a bit of research but not found any way to query snapshots with PowerShell, either locally or remotely. I imagine doing this will involve use of the Get-WMIObject CMDlet to query the relevant info from WMI, but I can only find the Win32_ShadowCopy.Create() method.

EDIT: To be clear, what I would like are objects I can manipulate using PowerShell.

We're moving our relay from an Exchange 2003 server to an Exchange 2010 server. I was hoping the "Grant or deny relay permissions to specific users or groups" option would still be available in some form, but I can't find out how to do it. I've read up on recieve connectors and so far I can't get it to work. I have edited the security on the Recieve Connector to allow the following extended rights to the group and added computer accounts to that group:

• Accept Routing Headers
• Bypass Anti-spam
• Submit to Server
• Accept any Sender
• Accept any Recipient

Then I suddenly realised while testing... How would the receive connector resolve the permission to a particular AD object, maybe a reverse DNS lookup? What I'd like to know is if what I'm trying to achieve is possible, and how it would be possible.

I would rather not revert to an IP-based list as this is not as manageable, and I'm trying to avoid creating static IPs/reservations for a number of workstations that would otherwise not need them.

I recently switched jobs. By the time I left my last job our network was three years old and had been planned very well (in my opinion). Our address range was split down into a bunch of VLANs with the largest subnet a /22 range. It was textbook.

The company I now work for has built up their network over about 20 years. It's quite large, reaches multiple sites, and has an eclectic mix of devices. This organisation only uses VLANs for very specific things. I only know of one usage of VLANs so far and that is the SAN which also crosses a site boundary.

I'm not a network engineer, I'm a support technician. But occasionally I have to do some network traces for debugging problems and I'm astounded by the quantity of broadcast traffic I see. The largest network is a straight Class B network, so it uses a /16 mask. Of course if that were filled with devices the network would likely grind to a halt. I think there are probably 2000+ physical and virtual devices currently using that subnet, but it (mostly) seems to work. This practise seems to go against everything I've been taught.

My question is:

In your opinion and  From my perspective - What measurement of which metric would tell me that there is too much broadcast traffic bouncing about the network? And what are the tell-tale signs that you are perhaps treading on thin ice?

The way I see it, there are more and more devices being added and that can only mean more broadcast traffic, so there must be a threshold. Would things just get slower and slower, or would the effects be more subtle than that?

I am having a few issues with clients in remote sites and have narrowed it down to TCP connections not being accepted by/not reaching the WiFi adapter. Outgoing connections are fine, and over Ethernet there is no problem.

The adapter is in the Domain profile for firewall and the firewall is passive. I have determined this by looking at the Windows Firewall with Advanced Security management tool. I have enabled logging for dropped packets anyway and the log remains empty.

I have tried a multitude of troubleshooting steps, including: Stopping the firewall service, network traces on both the connecting client and the adapter that should be receiving connections, starting the laptop exclusively on on WiFi, updating drivers.

I am not using DNS to make connections, just the respective IP addresses (Ethernet and WiFi). Our network team assure me there are no ACLs in place to block connections on the access points or controllers. All that can be obtained from the Wireless adapter is a ping response, so I know it's working. The adapters are both in the same DHCP pool and acquire their addresses from a local DC.

I'm out of ideas.... Can you think of anything else I can try in order to isolate the cause of the problem? I'm arranging for a Windows XP laptop to be tested to rule Windows 7 out and will update the question if I have any luck with that.

EDIT:

I sent a windows XP laptop to the site with the remote AP and it's the same story. Very strange indeed.

The reason I ask is that I have been researching how to rename items once an offline files target has been changed. It seems that so far there are two options:

• CSCCMD.exe - Which appears to be a legacy utility from XP
• WMI - The method I chose to go for as it seems more recent

I have been trying to do it in PowerShell with the following command, but keep getting errors. Perhaps you could help me debug it:

Invoke-WmiMethod -Class WIN32_OfflineFilesCache -Name RenameItem -ArgumentList ("\\server1\Share\john\", "\\server2\Documents\john\", $false)

I've been getting various errors, including COMException and DirectoryNotFoundException, though I think I have dealt with the latter.

That I have found, there doesn't seem to be a useful set of CMDlets or command-line tools to work with offline files. Am I over-complicating the situation by not using CSCCMD and is there a vlid reason why I have to go and find it on the web?