Using Poolmon to find kernel memory leaks...

Just so it's easier for me to find, here is the technet site that covers all the Support Tools

http://technet2.microsoft.com/WindowsServer/en/Library/eb0d5bd1-89c3-4ee7-975f-596b2e37e3aa1033.mspx

I was going to post up some stuff about using Poolmon and Memsnap, but you might as well just read the overview, syntax and example pages for these tools from the Technet site! Just make sure you enable gflags first on a Windows 2000 box, which requires a reboot before it becomes active. It's on by default in 2003.

I will add some small things... so when you've identified and offending tag, if the tag name isn't in pooltag.txt then open %windir%\System32\Drivers and do a search within files for the tag name. So thats search for files named '*' containing text 'tag'... or you could use findstr /m /l tag *.sys too I guess.

Also, while poolmon.exe comes with the Support Tools, pooltag.txt actually comes with both the Resource Kit and WinDbg. It's not a static file, so your best bet is to go with the most recent version, which is usually WinDbg. You'll find it in the /triage subdirectory.

Speaking of WinDbg, here is the symbol search path I always use (and lose - that's why it's going up here!)

C:\Windows\symbols\2000BASE;C:\Windows\symbols\2000SP4;
C:\Windows\symbols\2000SP4U1;C:\Windows\symbols\2003BASE;
C:\Windows\symbols\2003SP1;
SRV*C:\Windows\symbols\download*http://msdl.microsoft.com/download/symbols

Hmmm I'm gonna have to do something about this stylesheet eh!

Remove Removed Devices...

One of the most annoying errors IMHO is the one that you get when you change out a NIC (or remove a NIC from a VM) and try to reuse the IP address on the same machine.

So to get rid of that, first set the following machine environment variable:

DEVMGR_SHOW_NONPRESENT_DEVICES

... and give it a value of 1

I'll seriously consider adding this to the next SOE I work on, probably with a

setx DEVMGR_SHOW_NONPRESENT_DEVICES 1 -m

This will allow you to see the removed devices in Device Manager when you go into the View menu and tick 'Show Hidden Devices'

Miscellanea...

A bunch of stuff I need from time to time, but am never sure where to find it...

First, some XP reg tweaks I like to use...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoSimpleStartMenu"=dword:00000001

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"CascadeControlPanel"="YES"
"StartMenuAdminTools"=dword:00000001

Now how to silent install MSDE 2000... drop a setup.ini with the following entries into the same directory as setup.exe:

[Options]
SAPWD="AStrongPassword"
DATADIR="D:\MSDE\Data\"
TARGETDIR="D:\MSDE\Bin\"
;INSTANCENAME=AnInstanceName
;SECURITYMODE=SQL
;DISABLENETWORKPROTOCOLS=0

Run setup and reboot when it's finished.

And if you wanted to setup SQL 2000 server unattended style, you would first create the sqlsetup.iss using the SQL Server setup program (Advanced install option - it drops the resulting file into %windir%) and then fire off a:

start /wait setupsql.exe -s -f1 %windir%\sqlsetup.iss -sms

Installing anything is always best done via script, like IIS. First create a file with the following contents:

[Components]
iis_common=On
iis_inetmgr=On
iis_www=On
iis_ftp=Off
iis_htmla=Off
iis_doc=Off
iis_pwmgr=Off
iis_smtp=Off
iis_smtp_docs=Off
iis_nntp=Off
iis_nntp_docs=Off
iisdbg=Off
;For IIS 5 Frontpage Extensions, uncomment below
;Fp=Off
;For IIS 6 Frontpage Extensions, uncomment below
;fp_extensions=Off
[InternetServer]
PathWWWRoot=D:\Inetpub\wwwroot
;PathFTPRoot=D:\Inetpub\ftproot

Save it to, say, the root of C, and if it was named iisunattend.txt, shell out and run:

sysocmgr /i:%windir%\inf\sysoc.inf /u:c:\iisunattend.txt

Renaming the 'My Computer' and 'My Network Places' to something more meaningful is always useful. In a shell script,

:: Set 'My Computer' to be %username% on %computername%
echo.
echo Modifying My Computer name...
reg.exe ADD HKCR\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D} /v LocalizedString /t REG_EXPAND_SZ /d "%%UserName%% on %%ComputerName%%" /F

:: Set 'My Network Places' to be %userdomain%
echo.
echo Modifying My Network Places name...
reg.exe ADD HKCR\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D} /v LocalizedString /t REG_EXPAND_SZ /d "%%UserDomain%%" /F

Also useful is setting files without an extension to open with Notepad. In a shell script:

:: Set files with no extensions to open with Notepad
echo.
echo Setting file association for files with no extension...
REG ADD HKCR\.\shell\open\command\ /ve /t REG_SZ /d "notepad.exe %%1" /F

ANd to illustrate why shell scripting in Windows 2000/XP/2003 bites the fat one, here is what you would have to do if you wanted to execute something and then parse the single line of returned output:

for /f "usebackq tokens=*" %%i in (`plink -ssh -l -pw nixhost.corp cat /tmp/afile.tmp`) do (if "%%i"=="something" GOTO :DOSOMETHING)


Glad I can use VBScript for anything more complicated than a for statement.

Finally, here's an example of how you can use subinacl to grant the local Users group the necessary registry and service permissions to run perfmon remotely:

echo Granting Users Read access to Perlib registry key...
echo.
subinacl /subkeyreg "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Perflib" /grant=Users=R
subinacl /subkeyreg "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurePipeServers\winreg" /grant=Users=R

echo Granting Users Full Control of sysmonlog service...
echo.
subinacl /service sysmonlog /grant=Users=F

echo All operations completed!
echo.

That's about it for now... I'll no doubt make more of these kinds of posts so I can easily access them if necessary.

AJAX-Schmajax

I find it rather amusing (actually reminiscient might be more accurate) to see the flurry around AJAX. In particular, the number of companies that are springing up out of nowhere with 'AJAX desktops', 'AJAX Office' and 'AJAX messaging'. Feels like I'm back in 99. TechCrunch does a rather good job of following these developments.

The delivery of 'web services' does not mean 'something delivered via a web browser'. Hopefully people will pick up on that sooner rather than later. Java developers have been there for some time already. The notion of Web 2.0 is exciting, but people are getting too wrapped up in the browser paradigm. Javascript, SOAP and XML are cool, but I've yet to see a compelling interface delivered via a web browser that didn't use Flash or Java. Most remind me of Windows 3.11 with pastel colours.

It's easy to see that the infrastructure illiterati pushing these AJAX based services are so wrapped up in the world of web development, they never stopped to take a look at what other technologies enable delivery of rich client applications over minimal bandwidth to a platform agnostic client (which can be as simple as a java applet running in a browser or an ActiveX control). I am of course talking about the ICA protocol and it's derivative on the Windows platform, RDP.

There is so much amazing technology that has gone into the development of these 2 protocols, and so may years of serious improvements, I am sure that if the developers working on AJAX actually took a minute to understand them, they'd possibly pack up their AJAX shops right now and start writing real rich server based apps with little client footprint.

Just take a look at the seamless application publishing Microsoft will be delivering with Longhorn server. This is something Citrix has offered for maybe 10 years, but they see the writing on the wall - Citrix has re-invented itself as an access and identity management company for good reason. They know what the 800 pound gorilla of the software industry is capable of.

So just in time for the end of 2005, here is my prediction of where we'll end up sometime late 2006/ early 2007:

1) All these AJAX offerings will either have disappeared, be losing vast amounts of other peoples money or offering subscription based services for which people will quickly ask themselves 'why am I paying for this?'.

2) Microsoft will bury them with seamless office application delivery via Terminal Services, probably using the live.com portal as a launchpad.

For those of you not in the infrastructure space, Microsoft already has a rich corporate messaging client that is completely browser based and offers integration across their product suite (Office, Exchange, Sharepoint, ASP.NET) that the others could only dream of.

For those who doubt my predictions about the delivery of real applications over minimal bandwidth, check out this video on Channel9.msdn.com - http://channel9.msdn.com/Showpost.aspx?postid=118318

And Merry Xmas / Happy New Year :-)

Microsoft coming good with the licensing...

I've always maintained that if Microsoft really want to take the fight to Linux, all they would need to do would be drop some prices and fix up their confusing and at times insulting corporate licensing scheme. And it looks like this may happen, if the trend in the non-enterprise space is anything to go by.

Take the new Visual Studio 2005 Express Editions - all 'free for one year'. I'm still not sure what that means... whether it's 'download within the first year and it's free forever' or 'download and use it for free for one year from install date'. Either way, it's a good thing.

And the new 'virtual' licensing scheme. Buy 2003 R2 Enterprise, and run up to 4 virtual instances for no extra cost whatsoever. Microsoft have even graciously stipulated that it doesn't matter what virtual platform it's sitting on as well.

Speaking of their virtual platform, the new licensing for Virtual Server 2005 R2 is another example of taking the fight to the competition - $99 for the standard edition, which will run on up to 4 CPUs, and $199 which will run on an unlimited number of CPUs. I'm sure this will result in some more competitive pricing from EMC. It's not like they don't rip us off enough with their hardware already.

I have been a huge fan of VMWare for years, and while VirtualPC 2004 sucks teh pensi, I must say I'm tempted to run some comparisons at work between ESX Server and Virtual Server 2005 R2. I'm sure my company is like most - we are looking at using virtualisation to provide development / proof of concept environments and doing some hardware consolidation for some old boxes still running NT4. We are not even considering running high I/O production servers in a virtual environment. Obviously, in functional testing or proof of concept environment, performance is a non-issue. And with regards to migrating off old hardware, I'd be surprised if there was any noticable performance degradation when moving an NT4 application server off old P2/P3 based hardware with 1GB of RAM to sharing a dual Opteron box with 8GB of RAM with another 4-7 virtual machines. Regardless of what the virtual platform is - VMWare still recommend that you assign 800M of RAM and a dedicated NIC to the ESX service console. Windows Server 2003 running Virtual Server don't need any more resources than that.

I'll be looking very closely at both products in the next few weeks. If the performance differences justify the additional expense and infrastructure requirements to run ESX Server properly (ie full SAN backend, dedicated machine running Virtual Center, vmotion etc etc) then I'll happily never look at the Microsoft product again. But I have a hunch it won't turn out that way... I'll be sure to post my findings.