The other day, I posted here with some tips and a really basic overview of setting up an RDS gateway and session host. While this worked for the first site, I ran into some trouble when trying to make it work in my own office. As I was troubleshooting, our sales guy called and said that his Outlook Anywhere wasn’t working. Related? Hmm…

Went into the IIS console on the RDS Gateway/Exchange server. The Rpc folder was set to allow Basic authentication but not Windows auth. Enabled Windows auth, IISRESET, problem solved… for now.

So the bug? Here goes.

Create two users: give one permission to use the RDS gateway and but don’t give them permission to login to the RDS Session Host. Give the other permission to only login to the Session Host but not use the gateway. The first user is misconfigured, but this is a common mistake that is very easy to make by failing to put your user in the right group. On the session host, add a link to an app, any app. I used Wordpad for my test. Now from an external system, login to your RDS Web Access page as the first user and follow the RDP link on the page to try launching that remote app. What happens? You click the Options button and see an error that the user doesn’t have permission to login to the server, as if they were RDP’ing directly into the server. Click OK, click Switch User, and login as your user who is not allowed to access from the outside. You just broke in.

In the real-world, this requires two things to be exploited: your first user is misconfigured and your second user knows their password. This isn’t that impossible, though; after all, I found this in the first place because I misconfigured a test user — it’s easy to put someone in the wrong group, not test, and give them their login info. If the two users are friendly, it’s totally reasonable to think that one might mention it to the other. There should be an option on the session host to immediately terminate sessions for users who cannot login when using a web app. The error message should be shown to the user from their desktop, not the server’s login screen!

FOLLOWUP: http://blog.subvertallmedia.com/2011/03/25/rds-setup-for-n00bz-followup/

A client of ours, a non-profit with two old Citrix servers, is finally taking our advice to get some new equipment in there. We got a used by still very good server from another client, maxed out the RAM, and today I installed Server 2008 R2 Enterprise and Hyper-V. I offered two scenarios: one in which we use Server 2008 R2 VMs with RDS, the other in which we P2V their existing Windows Server 2003 machines. The first solution is obviously the better choice but with old programs, you can’t be too sure what will and won’t work, so I had to test them out. I also hadn’t configured an RDS farm before and wanted to make sure that they wouldn’t lose the easy accessibility offered by way of a web portal.

The basic details really aren’t worth getting into, nor am I going into a whole explanation of what RDS is and how it differs from TS. Use Google, dude. If you want to configure RDS, there are tons of great blog posts that will walk you through it. What might help you, though, is a really brief walk-through of the key components. I mean, knowing how to do something is great but it’s hard to find directions if you don’t know where you’re going. This would have saved me quite a bit of time but I have to admit that it was kind of fun to dig through it and figure out exactly how it all worked together. So… here we go.

The equipment: one physical box running Server 2008 R2 Enterprise Edition, one Hyper-V machine also running 2008 R2 Enterprise. The Hyper-V host, against best practices, is also my web-facing RDS Gateway machine. Yeah, I know, shouldn’t do that, shut up — the server, while better than what they had, is still sort of old, RAM is at a premium, and I don’t want to waste resources on another VM. Once I have proven that all of their apps will work in Hyper-V, I will build a second RDS virtual machine.

The goal: web-based login to remote desktop. I also wanted their key apps available as remote apps so they don’t need to login to a full desktop. We needed multiple RDS machines available with automatic load balancing. Simplicity is key.

Shit you need to know! (For my scenario.)

First, some basic definitions.

The remote desktop server, formerly known as the terminal server, AKA the machine where all the apps actually run, is now the Remote Desktop Session Host.

The web-accessible portal is the Remote Desktop Web Access.

The load-balancing component is the Remote Desktop Connection Broker.

The component that allows external users to access RDS resources behind your firewall is the Remote Desktop Gateway.

So with all that said, how does one do this? It’s not all that hard.

First of all, both machines need to be in a domain. In my test environment, I was trying to do it in a workgroup. Once your roles are installed, you need to add your machine accounts to a few different local groups, so the Session Host needs to go in the Broker’s “Session Broker Computers” group and your broker needs to go in the “TS Web Access Computers” group on your RDS session host. This can’t be done unless you’re in a domain! In my case, I complicated things dramatically by joining both machines to the domain over a VPN. This caused a snag at a later point but we’ll get to that soon.

Next, I installed different RDS roles on both machines. On my web-facing machine, I installed the Connection Broker, Gateway, and Web Access components. On the RDS host, I installed only the Remote Desktop Session Host role. At this point, you can add the machines to the proper local groups. Knowing this ahead of time doesn’t really matter because the configuration tools do a very good job of telling you to do that, so pay attention to error messages.

Make sure everything is registered properly in DNS. If you want to use an RDS farm, you need to register it in DNS, one entry with the name of your choice for each RDS Session Host. In my case, I had one RDS Session Host with plans to add more so I only created one DNS entry for the farm but when I add my second server, I will need a second DNS entry.

Configure your servers to look in the right places. Because I was using a Connection Broker in a farm, I needed my Session Host to know this. Remote Desktop Session Host Configuration, then “Member of a farm in RD Connection Broker” under the “Edit settings” heading in the middle of the screen. Your RD Connection Broker is the internal DNS name of the machine with that role; your farm name is the internal DNS name that you created. It will not check if these are accurate so don’t mess it up!

The web-facing server needed a bit more work. In “Remote Desktop Connection Manager,” add your farm as a RemoteApp Source. I wasn’t using Virtualization Hosting so none of that stuff really mattered. The RD Gateway server can be set to automatically detect or a static entry — I used a static entry. Licensing is rather self-explanatory. Make sure to specify your RD Web Access servers on this screen as well — it wants an internal name though I have a hunch that your external name would work if you were doing everything through a single server.

Configuring the Web Access component is a breeze, just enter your broker or stand-alone server address in the web portal. I ran into a snag here because of my whole domain-over-VPN nonsense. There is a service, “Remote Desktop Connection Broker,” that will not start if your machine cannot authenticate with the domain. In my case, I was logging in using the VPN, but the service already failed at that point and I didn’t realize it! Because of that, the Web Portal did not want to accept a server address and the error message was vague. The solution was to ensure the VPN was connected and then start the service, at which point it worked perfectly. Don’t forget to forward 80, 443, and 3389 to this server!

You need to configure RemoteApp settings or your web portal won’t show anything accessible. Simple thing here: open RemoteApp Manager and make sure to go into “RD Session Host Server Settings,” “RD Session Host Server” tabm and add in your farm name and click “Show a remote desktop connection to this RD Session Host Server in RD Web Access.” If you want web apps available, you do that from the RemoteApp manager as well.

Finally, you need to do some basic configuration on your gateway server. The Remote Desktop Gateway Manager is pretty easy to figure out if you want a very basic setup, probably the easiest part of this whole thing. Right-click the server in the left-hand column, go to “SSL Certificate” tab, and do what you need to do. For my testing purposes, I used a self-signed cert but would never do this for a production server because it requires the cert installed as a trusted authority on each client machine. Creating the self-signed cert is done right from this window, which is quite convenient. You also need to go to the Server Farm tab and specify the internal name of your RD Gateway. It does verify the name so make sure you’re connected to your domain using your VPN… (grumble grumble…).

Seriously, that’s it. It took me all day to figure this crap out. I realize that this was hastily written and quite vague but it’s short enough and covers enough ground that it might save someone some time. I know that it would have saved me a few hours! It’s a very cool feeling to connect over the net to your new RDS Web Access server and launch MS Word through the browser, knowing that it’s using the gateway to access resources that aren’t publicly available to the web. Good luck!

In the studio today with AshenCult, a new Philadelphia black metal band. To say that I’m excited about this is kind of an understatement; I can count the number of black metal bands in the city on one hand so for a new one to appear out of nowhere is just awesome. For me to record their first release, even better. A lot of the area bands are very punky and AshenCult is no exception — they love putting punk beats over traditional melodic black metal riffs, like if Immortal had gone to Drexel. Still, even with the heavy punk influence, it’s 100% black metal, a good hybrid of Dissection-ish melody and early American ugliness.

Today marks my first session using Reaper instead of Cubase. I had been using Cubase 5 but it was just not playing well some of my plugins. Reaper, on the other hand, does everything perfectly, costs a praction of the price, is community-focused, and has so many features that Cubase didn’t… After years using Cubase, it’s going to take some time to get used to. I had to install Reaper 4 Alpha and then do a lot of hotkey changes just to get some really basic editing functionality going but now that that’s done, I’m feeling good. I’m sure I’ll have more to say as I get deeper into it.

I never thought I’d be one of those guys who gets excited about RAM upgrades or service packs but, well, there I was, counting down the days to July 16 when Microsoft put SP1 on TechNet. It goes live to the world next week. SP1 doesn’t offer much in the way of new features for most people but one in particular was of great interest to me: Dynamic RAM for Hyper-V. I have a large number of Hyper-V machines, a few of which are clustered, and a couple are highly-utilized. Since processor and HD utilization will adjust based on need, RAM becomes the issue because as soon as you allocate those 2 or 4 or 8 or more GB to your virtual machine and start it up, that RAM is gone, regardless of how much it’s actually using. No more. Awesome.

Normally, I’d wait a little bit to install the update on production servers but one of my networks, a client with a cluster of virtual terminal servers, is using almost all 24GB of their RAM. This update is a big help and will save them quite a bit of money over adding more RAM. I first installed SP1 on my office desktop and it went in without a hitch. One guy in the office tried installing it on his desktop and it kept bombing out. Still, the need was there, so I moved all resources over to one node of the cluster, installed the SP, rebooted, and all was well. It was when I tried the second node that the problem started.

The SP seemed to install correctly. After reboot, it said the update failed and it rolled back, rebooted, and presented me with the most generic of errors. It said the service pack failed, “Element not found.” Might have been ELEMENT_NOT_FOUND. A message saying “Error not found” and a link to a MS KB at the bottom gave a boring, nonspecific troubleshooting guide: SFC /SCANNOW, running the Windows System Update Readiness Tool, and doing an in-place upgrade (AKA repair install). First two didn’t help, third was not a viable option.

I started reading. Windows Vista introduced something called CBS, Component Based Servicing, which you can read about here. While certain notifications about Windows Updates are still held in windowsupdate.log, the details about what is happening is held in %SYSTEMROOT%\logs\CBS\cbs.log. This log is backed up and recreated every time you install hotfix for any other update.

After hours (and hours and hours) of troubleshooting, trying to figure out what was different between my nodes, I posted to Microsoft’s official forum, uploaded my CBS folder, and they gave me my answer. Turns out, a specific hotfix was missing files: this one. The Microsoft rep who gave me the answer quoted my log and gave the answer.

2011-02-17 12:41:18, Info                  CBS    Doqe:   q-uninstall: Inf: wvid.inf , Ranking: 2, Device-Install: 0, Key: 113, Identity: wvid.inf, Culture=neutral, Type=driverUpdate , Version=6.1.7600.16475 , PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=amd64, versionScope=NonSxS

2011-02-17 12:41:18, Info                  CBS    Perf: Doqe: Uninstall started.

2011-02-17 12:41:18, Info                  CBS    Doqe: [Forward] Uninstalling driver updates, Count 54

2011-02-17 12:41:19, Info                  CBS    DriverUpdateUninstallUpdates failed [HRESULT = 0x80070490 – ERROR_NOT_FOUND]

Files from the security update

MS10-010: Vulnerability in Windows Server 2008 Hyper-V could allow denial of service

are missing

That’s great and all but how did they come to that conclusion?

Identity: wvid.inf , Culture=neutral, Type=driverUpdate , Version=6.1.7600.16475

this tells me that the update causes the issue.

Yeah, but what from that says that the specific hotfix was the problem? How did they find that line in my 45MB+ log file?

google? look at the inf file version on the KB page:

http://support.microsoft.com/kb/977894

“ERROR_NOT_FOUND” must appear 100 times at least, so do references to wvid.inf. I asked for them to walk me through it, step by step.

I opened the Log file, and searched for Error so I found this line. I looked what the installer was doing and saw that it tries to remove the inf. I googled what the inf is and found this Hyper-V update.

Still doesn’t explain how they got to that specific error. I did look at it a bit and found that while there are hundreds of errors that look like this:

Failed to get session package state for package: Package_6_for_KB2482017~31bf3856ad364e35~amd64~~6.1.1.1 [HRESULT = 0x80070490 – ERROR_NOT_FOUND]

The one that he pointed out was unique and had no similar lines anywhere. It does make sense when you look at it: it tries to uninstall a hotfix, can’t find a file, and fails. But there are A LOT of errors in the file and you’d think that somewhere it would identify a critical failure and point to this as the cause for the entire service pack bombing out. I asked again whether they had a way of filtering out the ERROR_NOT_FOUND messages that didn’t matter VS those that did and didn’t get a response yet. I get this feeling that they just know what to look for and used CTRL + F until they found an error that didn’t look like the others.

With the KB identified, I had to find a way to uninstall it. Going through Add/Remove programs didn’t work, it tried to uninstall, rebooted and failed. Using WUSA /UNINSTALL /KB: seemed to work but, as I later learned, is not supported or, well, working. The end result was to search the registry for the KB, pull out every key, reinstall the hotfix, reboot, install the SP, and reboot. Success. But frustrating. Our company’s virtual host also failed its SP1 install though some of our VMs did not. Two other guys in the office installed it on their Windows 7 machines without difficulty. When I have some time, I’ll check out our VH’s log and see if I can apply this experience. Either way, I find it extremely frustrating that I had to do this much work to fix what should be a very simple process. If the Service Pack install made use of the Windows Event log, filtering errors would have been easy. If the error message given after the failure was more clear, I could have troubleshot effectively. If SFC /SCANNOW found missing files — since there WERE missing files — that would have helped. If the Windows System Update Readiness tool searched more thoroughly, that would have helped too. While the Microsoft rep was very knowledgeable and rather prompt, I shouldn’t have to resort to that in the first place. This Service Pack was made available to TechNet not three days ago and it failed our first 3 of 6 tests; another poster on the MS forum said that one of their cluster nodes also wouldn’t install it so he just wiped and reinstalled. This is unacceptable and does not bode well for Microsoft’s PR in the coming weeks.

Abserso is in the studio to record a new 7″. I was really impressed with these guys when Unrest played with them last year so I made a point to bug their bassist Dylan about recording down here. Really techy stuff, thrashy death metal. Awesome.

I’m very pleased with this recording so far. We’re on what should be the last take of guitars right now, bass and vocals tomorrow. This is the first time tracking with the Big Ben driving my converter and I’m shocked at the difference. Everything just sounds clearer and more real, all those things people talk about when they upgrade their conversion. I also got a new comp yesterday, a sampled SSL 4000 (I assume?) buss compressor for Nebula made by Analog in the Box, and the VTMM2 seems to be working since I reset my BIOS to fail-safe defaults. Google that stuff if you don’t know what it is and care. It’s all crucial for what I do.

Kill!