Password dump from a Hyper-V Virtual Machine´s memory

So earlier this week the twitter flow went bananas when Remko did a blog about how to extract the password in clear text from a VMware vmem file with the add-on from Benjamin, Mimikatz that extends the windebug.

I wanted to test if it works also in Hyper-V and it is not so much difference, the main difference is how to create the dump file and here I use the vm2dmp (thanks to Yusuf for supplying me with a vm2dmp.exe that works with 2012!!) with the right switches, in this case the VM is in saved state but you can also use snapshots or just the vsv and bin file.

Screen Shot 2013-11-29 at 16.33.16

And then when importing the dump into the windbg I can with the commands get the password for the user that was logged in on the Win 7 VM

Screen Shot 2013-11-29 at 15.26.19

I have tested this on a Windows 7 virtual machine and also on a Windows Server 2012 R2 virtual machine both running on Hyper-V 2012. This highlights the importance once more that it is crucial to make sure that only the right people have access to the virtualization hosts and the storage where the VM´s resides!

Experience on the V2V function in SC VMM 2012 R2

Last week I was at a customer and worked on setting up an new Hyper-V and SC VMM 2012 R2 environment and also connecting the VMM to their existing VMware. We configured the hosts with Bare-metal deploy and also configured logical switches in VMM. The setup and configuration with both VMM and Hyper-V was very smooth and it seems that they have worked a bit on the R2 release on that part 🙂

When the environment was up and running we also connected it to the customers vSphere 5.0 environment.

In-the-box of the VMM 2012 R2 there is only V2V when moving machines from vSphere to Hyper-V, the P2V function has been removed and is only available in VMM 2012 SP1 and earlier, a microsoft blog has described a way to use a workaround with a VMM 2012 SP1 but that does require a Hyper-V 2012 host and you have to run two VMM servers during the conversion process.

We have tested several VM´s and noticed some disturbing issues in the V2V process.

for a reason unknown the target does not get the source number of vCPU´s and memory setting so a VM that had 4 GB RAM in vSphere would get a static setting of 512 MB RAM, and if it had 2 vCPU in vSphere it got 1 vCPU in Hyper-V.


Screen Shot 2013-11-26 at 08.01.31

the next part was that the conversion created VHD´s on the new Hyper-V 2012 R2 and not VHDX for the converted virtual disks… At least it is fixed sized disks so we do not have to worry about partition alignment issues that is the case with the dynamic VHD´s.

And when we tried to migrate a VM with three virtual disks, the v2v process connected all of the to the IDE controllers and not as best practice, the data disks to SCSI… I changed it manually and successfully booted the VM.

Screen Shot 2013-11-22 at 11.29.59

 at last we found another bug or something regarding the networking and the migrated VM..

Screen Shot 2013-11-25 at 16.26.06

And when the VM was migrated it looked like it was connected to the right network in VMM as you can see on the following screendump from the VM network properties in VMM.

Screen Shot 2013-11-22 at 11.39.22

but when the VM booted it did not connect to the correct network and I had to go into the Hyper-V manager and look at the VM configuration and there it showed as no VLAN, once I corrected the issue and checked the vlan id and correct vlan number the VM was on the right network.

Screen Shot 2013-11-22 at 11.38.51

The Microsoft Virtual Machine Converter (MVMC) that could be used with the MAT has not yet come in a new version that supports vSphere 5.1/5.5 and equally important, the Hyper-V 2012 R2 hosts.. With the MAT you can customise it to set and configure both network inside of the VM´s and also configure correct vlan settings in the VM´s network card based on what the vSphere is configured with.

Maybe I have just been unlucky but all of these issues with the VMM V2V makes it a less desired solution when migrating from VMware in a larger scale.

MAP 9.0 Beta has been released

This morning a new beta of the Microsoft Assessment and Planning toolkit has been released and now it is version 9.0

This beta release of the MAP Toolkit helps increase the agility and cost effectiveness of deploying the latest Microsoft technologies. It also enhances usage tracking to include accounting for Remote Desktop Services as well as Server and Cloud Enrollment licensed deployments. MAP 9.0 beta additionally helps organizations assess their environment for Office 2013 and Office 365, track usage of Windows Server 2012, Lync Server 2013, SharePoint Server 2013, Exchange Server 2013, System Center Configuration Manager 2012, and SQL Server 2012. The Windows Azure assessment report has also been updated to include the latest Azure sizing.

I have upgraded my 8.5 to 9.0 Beta

Screen Shot 2013-11-12 at 10.32.58

and when going from the 8.5 to 9 you can upgrade the database, if you have a MAP version 7 there is no possibility to upgrade to 8.5 or 9.

Screen Shot 2013-11-12 at 10.33.10

If you want to get the beta you can sign up at the connect site at this link.

Bug in VMM 2012 SP1 disconnect VM nic after cold migration?

Yesterday I was at a customer and working on configure their off site Hyper-V cluster. I was setting up live migration settings to be able to do shared nothing live migrate the VM´s between the data centers. I was  setting up kerberos authentication and also delegation in the active directory but did not think of the 10 hours (600 minutes) time that a kerberos ticket could live and got some errors regarding constrained delegation, as it says if reading a bit more carefully in this technet page on how to configure live migration outside of clusters  :”A new kerboros ticket has been issued. “, I did not think of this at first and checked the hosts settings and the active directory objects twice 😛 but it did not work and I did not think of the time….  If you want to purge the kerberos tickets you can use the klist command line tool.

Well during the error search I had to test to do a cold migration from SC VMM between the clusters and that looked like no problem at all. It should also be said that both clusters was configured with the same logical network, vm networks, logical switch and uplink so it was the same conf! SC VMM have been updated with the latest CU 4.

When the VM had been migrated i started it and tried to ping the IP address but got no response.. strange I thought, looked in VMM on the properties on the VM and it said that the network card was connected:

Screen Shot 2013-11-08 at 14.42.38

But still inside the VM it said not connected,

Screen Shot 2013-11-09 at 08.33.35

And then going into the Hyper-V manager and looking at the VM´s properties from there I could also see that it was not connected. I did a VM refresh also in VMM but it did not change the connection status on the VM object to reflect the status as the screen dump below from the properties in the Hyper-v Manager:

Screen Shot 2013-11-08 at 14.42.09

Once I connected it to the (logical) virtual switch on the host with Hyper-V Manager it started to respond to ping of course.

I will continue to exam this further and maybe it has been fixed in the VMM 2012 R2.


New free Windows Server 2012 R2 book released

Today Microsoft Press released a free book about the features in Windows Server 2012 R2 written by Mitch Tulloch and the Windows Server Team. The book goes through the new features in the latest release and gives you as an IT PRO an oversight and quickly get familiar with the different areas of improvement from the 2012 to R2.

Screen Shot 2013-11-08 at 19.16.00

The book can be downloaded at this link 

The book starts with the Cloud OS vision that is all about mobility and that microsoft already with the 2012 release described, the possibility to move between the different clouds.

Screen Shot 2013-11-08 at 19.15.41

VMware to Hyper-V Migration with Netapp shift and MAT

I have been doing some seminars and presentations on the subject of migration from VMware. My latest seminars was with my colleague Kristian Nese and we were in Stockholm, Oslo and Trondheim talking about the cloud os, the new features in Hyper-V 2012 R2 and System Center VMM 2012 R2 and also migration and the different tools. After the summer camp at Microsoft I did a blog post about my customisations of the MAT that was running with MVMC and my way to solve the IP addresses and after my blog post there have come an updated version of the MAT that do handle the NIC.

If you plan to do a migration and just happens to be one of the lucky guys that have a Netapp box with Data ONTAP 8.2 in Cluster Mode in your VMware environment you can use the MAT for shift that can be found on the gallery. It utilizes the NetApp Data ONTAP PowerShell toolkit and the features in the Netapp storage that converts the vmdk files to vhdx right in the storage and boy do that save migration time as you do not have to move loads of data for your large VM´s over the network and then convert them at the target. As the Netapp software is so intelligent it does not write over the old data and you can quite easily go back if you find any issues after the migration.

Building Clouds have a blog post and Migration Mark has done a funny movie that can be watched on Youtube that explains the procedure and how fast it is!

Hope to start a project really soon with a Netapp customer 🙂