Password dump from a Hyper-V Virtual Machine´s memory

November 29th, 2013 2 comments

So earlier this week the twitter flow went bananas when Remko did a blog about how to extract the password in clear text from a VMware vmem file with the add-on from Benjamin, Mimikatz that extends the windebug.

I wanted to test if it works also in Hyper-V and it is not so much difference, the main difference is how to create the dump file and here I use the vm2dmp (thanks to Yusuf for supplying me with a vm2dmp.exe that works with 2012!!) with the right switches, in this case the VM is in saved state but you can also use snapshots or just the vsv and bin file.

Screen Shot 2013-11-29 at 16.33.16

And then when importing the dump into the windbg I can with the commands get the password for the user that was logged in on the Win 7 VM

Screen Shot 2013-11-29 at 15.26.19

I have tested this on a Windows 7 virtual machine and also on a Windows Server 2012 R2 virtual machine both running on Hyper-V 2012. This highlights the importance once more that it is crucial to make sure that only the right people have access to the virtualization hosts and the storage where the VM´s resides!

Categories: Hyper-V, Security, Virtualization, Win2012 Tags:

Experience on the V2V function in SC VMM 2012 R2

November 26th, 2013 1 comment

Last week I was at a customer and worked on setting up an new Hyper-V and SC VMM 2012 R2 environment and also connecting the VMM to their existing VMware. We configured the hosts with Bare-metal deploy and also configured logical switches in VMM. The setup and configuration with both VMM and Hyper-V was very smooth and it seems that they have worked a bit on the R2 release on that part :-)

When the environment was up and running we also connected it to the customers vSphere 5.0 environment.

In-the-box of the VMM 2012 R2 there is only V2V when moving machines from vSphere to Hyper-V, the P2V function has been removed and is only available in VMM 2012 SP1 and earlier, a microsoft blog has described a way to use a workaround with a VMM 2012 SP1 but that does require a Hyper-V 2012 host and you have to run two VMM servers during the conversion process.

We have tested several VM´s and noticed some disturbing issues in the V2V process.

for a reason unknown the target does not get the source number of vCPU´s and memory setting so a VM that had 4 GB RAM in vSphere would get a static setting of 512 MB RAM, and if it had 2 vCPU in vSphere it got 1 vCPU in Hyper-V.

 Screen Shot 2013-11-26 at 08.01.31

the next part was that the conversion created VHD´s on the new Hyper-V 2012 R2 and not VHDX for the converted virtual disks… At least it is fixed sized disks so we do not have to worry about partition alignment issues that is the case with the dynamic VHD´s.

And when we tried to migrate a VM with three virtual disks, the v2v process connected all of the to the IDE controllers and not as best practice, the data disks to SCSI… I changed it manually and successfully booted the VM.

Screen Shot 2013-11-22 at 11.29.59 at last we found another bug or something regarding the networking and the migrated VM..

Screen Shot 2013-11-25 at 16.26.06

And when the VM was migrated it looked like it was connected to the right network in VMM as you can see on the following screendump from the VM network properties in VMM.

Screen Shot 2013-11-22 at 11.39.22

but when the VM booted it did not connect to the correct network and I had to go into the Hyper-V manager and look at the VM configuration and there it showed as no VLAN, once I corrected the issue and checked the vlan id and correct vlan number the VM was on the right network.

Screen Shot 2013-11-22 at 11.38.51

The Microsoft Virtual Machine Converter (MVMC) that could be used with the MAT has not yet come in a new version that supports vSphere 5.1/5.5 and equally important, the Hyper-V 2012 R2 hosts.. With the MAT you can customise it to set and configure both network inside of the VM´s and also configure correct vlan settings in the VM´s network card based on what the vSphere is configured with.

Maybe I have just been unlucky but all of these issues with the VMM V2V makes it a less desired solution when migrating from VMware in a larger scale.

Categories: Hyper-V, SCVMM, Virtualization Tags:

MAP 9.0 Beta has been released

November 12th, 2013 No comments

This morning a new beta of the Microsoft Assessment and Planning toolkit has been released and now it is version 9.0

This beta release of the MAP Toolkit helps increase the agility and cost effectiveness of deploying the latest Microsoft technologies. It also enhances usage tracking to include accounting for Remote Desktop Services as well as Server and Cloud Enrollment licensed deployments. MAP 9.0 beta additionally helps organizations assess their environment for Office 2013 and Office 365, track usage of Windows Server 2012, Lync Server 2013, SharePoint Server 2013, Exchange Server 2013, System Center Configuration Manager 2012, and SQL Server 2012. The Windows Azure assessment report has also been updated to include the latest Azure sizing.

I have upgraded my 8.5 to 9.0 Beta

Screen Shot 2013-11-12 at 10.32.58

and when going from the 8.5 to 9 you can upgrade the database, if you have a MAP version 7 there is no possibility to upgrade to 8.5 or 9.

Screen Shot 2013-11-12 at 10.33.10

If you want to get the beta you can sign up at the connect site at this link.

Categories: Uncategorized Tags:

Bug in VMM 2012 SP1 disconnect VM nic after cold migration?

November 9th, 2013 1 comment

Yesterday I was at a customer and working on configure their off site Hyper-V cluster. I was setting up live migration settings to be able to do shared nothing live migrate the VM´s between the data centers. I was  setting up kerberos authentication and also delegation in the active directory but did not think of the 10 hours (600 minutes) time that a kerberos ticket could live and got some errors regarding constrained delegation, as it says if reading a bit more carefully in this technet page on how to configure live migration outside of clusters  :”A new kerboros ticket has been issued. ”, I did not think of this at first and checked the hosts settings and the active directory objects twice :-P but it did not work and I did not think of the time….  If you want to purge the kerberos tickets you can use the klist command line tool.

Well during the error search I had to test to do a cold migration from SC VMM between the clusters and that looked like no problem at all. It should also be said that both clusters was configured with the same logical network, vm networks, logical switch and uplink so it was the same conf! SC VMM have been updated with the latest CU 4.

When the VM had been migrated i started it and tried to ping the IP address but got no response.. strange I thought, looked in VMM on the properties on the VM and it said that the network card was connected:

Screen Shot 2013-11-08 at 14.42.38

But still inside the VM it said not connected,

Screen Shot 2013-11-09 at 08.33.35

And then going into the Hyper-V manager and looking at the VM´s properties from there I could also see that it was not connected. I did a VM refresh also in VMM but it did not change the connection status on the VM object to reflect the status as the screen dump below from the properties in the Hyper-v Manager:

Screen Shot 2013-11-08 at 14.42.09

Once I connected it to the (logical) virtual switch on the host with Hyper-V Manager it started to respond to ping of course.

I will continue to exam this further and maybe it has been fixed in the VMM 2012 R2.

 

Categories: Hyper-V, SCVMM, Virtualization, Win2012 Tags:

New free Windows Server 2012 R2 book released

November 8th, 2013 No comments

Today Microsoft Press released a free book about the features in Windows Server 2012 R2 written by Mitch Tulloch and the Windows Server Team. The book goes through the new features in the latest release and gives you as an IT PRO an oversight and quickly get familiar with the different areas of improvement from the 2012 to R2.

Screen Shot 2013-11-08 at 19.16.00

The book can be downloaded at this link 

The book starts with the Cloud OS vision that is all about mobility and that microsoft already with the 2012 release described, the possibility to move between the different clouds.

Screen Shot 2013-11-08 at 19.15.41

Categories: Win2012 Tags:

VMware to Hyper-V Migration with Netapp shift and MAT

November 4th, 2013 No comments

I have been doing some seminars and presentations on the subject of migration from VMware. My latest seminars was with my colleague Kristian Nese and we were in Stockholm, Oslo and Trondheim talking about the cloud os, the new features in Hyper-V 2012 R2 and System Center VMM 2012 R2 and also migration and the different tools. After the summer camp at Microsoft I did a blog post about my customisations of the MAT that was running with MVMC and my way to solve the IP addresses and after my blog post there have come an updated version of the MAT that do handle the NIC.

If you plan to do a migration and just happens to be one of the lucky guys that have a Netapp box with Data ONTAP 8.2 in Cluster Mode in your VMware environment you can use the MAT for shift that can be found on the gallery. It utilizes the NetApp Data ONTAP PowerShell toolkit and the features in the Netapp storage that converts the vmdk files to vhdx right in the storage and boy do that save migration time as you do not have to move loads of data for your large VM´s over the network and then convert them at the target. As the Netapp software is so intelligent it does not write over the old data and you can quite easily go back if you find any issues after the migration.

Building Clouds have a blog post and Migration Mark has done a funny movie that can be watched on Youtube that explains the procedure and how fast it is!

Hope to start a project really soon with a Netapp customer :-)

Categories: Hyper-V, Virtualization, VMware Tags:

Convert to generation 2 on a VM in Hyper-V 2012 R2 with Powershell

October 30th, 2013 No comments

I have done blog posts about why you should create your new VM´s with Windows Server 2012 instead of 2008 R2 or older even if you were not able to create them with the generation 2 at that time as the Windows 2012 R2 was not released back then.

I also did a blog post how to use a third party product to do the migration from generation 1 to 2 with Double Take Move software.

Now I found John Howards script that he has made public that does the migration from generation 1 to 2 :-) He also has a blog series about generation 2 VM´s that is definitely worth the time to check out.

I got an error when running it though and it seems that it does not work so good with the partition on the gen 1 virtual disk..  It appears that when I have created my virtual machine with the Convert-WindowsImage.ps1 script that only creates one partition the row in the script that checks for $partitions.length fails and I could not get it to continue but when I commented that away I got my first conversion on the way :-)

Screen Shot 2013-10-30 at 20.40.59

And here you can se in the PowerShell ISE my alteration  :-)

Screen Shot 2013-10-30 at 22.15.58

Now I am sure that John and his team will work and distribute new versions with correct error checking and I am truly glad that they have released this so I could test it right now anyway :-) !!

Here is my VM in generation 1

Screen Shot 2013-10-30 at 21.50.07

And here is the converted VM,

Screen Shot 2013-10-30 at 22.21.34

And here you can see that during the conversion that I have two disks attached to my server and that the one at the bottom has got some new partitions for the gen 2 UEFI boot process

Screen Shot 2013-10-30 at 22.15.03

Happy converting and making generation 2 VM´s your standard in Hyper-V

Categories: Hyper-V, Powershell, Virtualization, Win2012 Tags:

SC VMM 2012 SP1 UR4 – fixes the Cluster resource bug

October 29th, 2013 No comments

I have on my blog done a post about how the VMM 2012 Sp1 not updated the cluster resource when doing Live Storage migration from one CSV volume to another in a Hyper-V cluster and now in the Update Release 4 of VMM 2012 SP1 they have finally fixed it!

Here you can see the Issue 13 that has been fixed

Screen Shot 2013-10-29 at 23.08.44

Also as in Issue 15 there was stuff left after a canceled or failed migration

Screen Shot 2013-10-29 at 23.09.00

One thing that could have been a wish was that they in this UR would have added the Windows 2012 R2 as an operating system, you can run Windows 2012 R2 as virtual machines in your 2012 Hyper-V but not assign the right OS on the properties on the VMM 2012 Sp1 :-(

vmmos

In Hyper-V this does not have an impact for the successful boot as in VMware VM´s where you set the best matching OS for the boot process to work flawlessly. In Hyper-V it uses the same BIOS for all your VM´s and this list is something for VMM and the database.

Categories: SCVMM, Virtualization, Win2012 Tags:

Strange Creation Date on Hyper-V 2012 R2 VM

October 29th, 2013 1 comment

I have some VM´s on my new Windows 2012 R2 host that have a strange creation date on the properties.

The VM´s have been created on different times and it was a customer that noticed it.

quite fun as there was not computers or even Hyper-V invented in the 17 century or was it? ;-)

Here is my lab/demo VMM 2012 R2 virtual machine and as you can see it is created the 1 of january 1601

WOWAn

 

and here is the other virtual machine, a windows 8 template

Screen Shot 2013-10-29 at 21.59.33

 

I have not been able to reproduce it now with either PowerShell or via the GUI, If you have seen the same issue please comment the post :-)

Categories: Win2012 Tags:

Updated download script for evaluation VHD for SysCtr 2012 R2

October 23rd, 2013 No comments

Now when the evaluation VHD´s have been updated with the release of the System Center R2 that was released last week I have updated my download script so you easily can get all the files at a convenient place with PowerShell and the BITS engine.

Good luck in your evaluation of the System Center 2012 R2 suite :-)

 

Categories: Powershell, SysCtr Tags: