This topic describes how to configure role-based access control for virtual machines in Hyper-V. You use Authorization Manager (also known as AzMan) to provide role-based access control for Hyper-V. For more information, see the following topics in this guide: To implement role-based access control, you must first define your scope and then organize operations into groups to accomplish tasks. You assign tasks to roles, and then assign users or groups to the role. Any user assigned to a role can then perform all of the operations in all of the tasks that are assigned to the role. There are four general steps to setting up role-based access control for Hyper-V: - Define the scope according to your organizational needs. For example, you can define the scope by geography, organizational structure, function (developer/test or production), or Active Directory Domain Services. For a sample script to create the scopes, see http://go.microsoft.com/fwlink/?LinkId=134074.
- Define the tasks. In Authorization Manager, you cannot change or create new operations. However, you can create as many tasks as you want and then combine these into role definitions. For example tasks that you can use in your role definitions, see Example Authorization Manager Tasks and Operations.
- Create roles. For example, if you want to create an “IT Monitor” role that you can use to view properties of a virtual machine but not interact with the virtual machine, create a new task in Authorization Manager called “Monitor Virtual Machine”, with the following operations:
- Read Service Configuration
- View External Ethernet Ports
- View Internal Ethernet Ports
- View LAN Endpoints
- View Switch Ports
- View Switches
- View Virtual Switch Management Service
- View LAN Settings
- Assign users or groups to roles.
For example, assume you have two sets of virtual machines where one set belongs to the Human Resources department and the other set belongs to the Finance department. You want the virtual machine administrators for Human Resources to have full control over the virtual machines for that department, but to have no control over the virtual machines in Finance. You want the same arrangement for the virtual machine administrators for Finance—no access to the virtual machines in Human Resources. To accomplish this, you would define one role called “Departmental Virtual Machine Administrator”, define the appropriate tasks, and then assign each administrator to the “Departmental Virtual Machine Administrator” role assignment in the specific scope. You would scope the virtual machine administrators for Human Resources to the virtual machines in Human Resources and the virtual machine administrators for Finance to the virtual machines in Finance. Then, you assign the virtual machines to their respective scopes. Read the rest of the step by step instructions: Configure Hyper-V for Role-based Access Control Hyper-V security best practices - Use a Server Core installation of Windows Server 2008 for the management operating system. A Server Core installation provides the smallest attack surface and reduces the number of patches, updates, and restarts required for maintenance. For detailed information and installation guidance, see the Server Core Installation Option of Windows Server 2008 Step-By-Step Guide (http://go.microsoft.com/fwlink/?LinkId=134202).
For more information about enabling the Hyper-V role on a server running a Server Core installation, see Install the Hyper-V Role on a Server Core Installation of Windows Server 2008. .gif) Note
There is no way to upgrade from a Server Core installation to a full installation of Windows Server 2008. If you need the Windows user interface or a server role that is not supported in a Server Core installation, install a full installation of Windows Server 2008.To remotely manage Hyper-V on a Server Core installation, use the Hyper-V management tools for Windows Server 2008 and Windows Vista Service Pack 1 (SP1). For more information, see article 952627 (http://go.microsoft.com/fwlink/?LinkID=122189) and article 950050 (http://go.microsoft.com/fwlink/?prd=12079) in the Microsoft Knowledge Base. For more information about configuring tools for remote management of Hyper-V, see Install and Configure Hyper-V Tools for Remote Administration. - Do not run any applications, such as antivirus programs, in the management operating system—run all applications on virtual machines. By keeping the management operating system free of applications and running a Windows Server 2008 core installation, you will need fewer updates to the management operating system because nothing needs software updates except the Server Core installation, the Hyper-V service components, and the small (approximately 600 KB) hypervisor.
Note If you need to use the full version of Windows Server 2008 and run applications in the management operating system, then you should run an antivirus program there. You can use System Center Virtual Machine Manager (VMM) 2007 to convert your server to a virtual machine and run it on the virtualization server in a virtual machine. This process is called a physical-to-virtual (P2V) conversion in VMM. For more information about P2V, see Converting Physical Computers to Virtual Machines (http://go.microsoft.com/fwlink/?LinkId=134465). - Use the security level of your virtual machines to determine the security level of your management operating system. You should deploy virtual machines onto virtualization servers that have similar security requirements. For example, assume that you classify the level of risk and effort to secure your servers into three categories: “secure”, “more secure”, and “most secure”. You would put more compliance effort and control procedures into the most secure servers than on the secure servers. This would be true whether the server is physical or running on a virtual machine. If you deploy both secure and most secure virtual machines on the management operating system, then you should secure the virtualization server as a “most secure” server. For ease of management, deploy virtual machines with similar security levels on a virtualization server—do not mix virtual machines with different security requirements on the same host. This practice also allows you to move virtual machines among different hosts with the same level of security, for example using System Center Virtual Machine Manager host groups.
- Do not give virtual machine administrators permissions on the management operating system. According to the principle of least privilege, you should give administrators of a virtual machine (sometimes called department administrators or delegated administrators) the minimum permissions required. Managing the required permissions on all the objects associated with a virtual machine can be complex, and can lead to potential security issues if not handled properly. Role-based access control enables you to specify access control in terms of the organizational structure of a company—by creating a new object called a role. You assign a user to a role to perform a job function. Hyper-V uses Authorization Manager policies for role-based access control.
- Ensure that virtual machines are fully updated before they are turned on in a production environment. Because virtual machines are so much easier to move around and quicker to deploy than physical machines, there is a greater risk that a virtual machine that is not fully updated or patched might be deployed. To manage this risk effectively, use the same methods and procedures to update virtual machines as you use to update physical servers. For example, if you allow the use of automatic updates using Windows Update, Microsoft System Center Configuration Manager, or another software distribution method, ensure that virtual machines are updated and/or patched before they are deployed.
You can use maintenance hosts and quick migration in Hyper-V to accomplish this. A maintenance host is a host computer that you can dedicate for patching stored resources and for staging virtual machines before you move them into your production environment. For more information about maintenance hosts, see Planning for Hosts (http://go.microsoft.com/fwlink/?LinkId=134482). For information about using quick migration to move virtual machines to a maintenance host, see Hyper-V Step-by-Step Guide: Testing Hyper-V and Failover Clustering (http://go.microsoft.com/fwlink/?LinkId=134481). .gif) Tip
To update the virtual machines before they are turned on, you can use the Offline Virtual Machine Servicing Tool. For more information, see Offline Virtual Machine Servicing Tool Executive Overview (http://go.microsoft.com/fwlink/?LinkId=134478). - Ensure that your virtual machines have integration services installed. The accuracy of timestamps and audit log entries is important for forensics and compliance. Although integration services provide performance and other benefits, they also ensure that time is synchronized between virtual machines and the management operating system. This synchronization makes sure that time is consistent with the physical location of the virtual machine in the event that virtual machines are migrated between data centers in different time zones or virtual machines are restored from previous snapshots.
- Use a dedicated network adapter for the management operating system of the virtualization server. By default, “NIC0” is for the management operating system. Use this for managing the server running Hyper-V and do not expose it to untrusted network traffic. Do not allow virtual machines to use this network adapter. Use one or more different dedicated network adapters for virtual machine networking. This allows you to apply different levels of networking security policy and configuration for your virtual machines. For example, you can configure networking so that the virtual machines have different networking access than your management operating system, including the use of virtual local area networks (VLANs), Internet Protocol Security (IPsec), Network Access Protection (NAP) and Microsoft Forefront Threat Management Gateway. In addition, if your virtual machines use too much bandwidth, a dedicated network adapter for the management operating system allows you to access the virtualization server and take action on the virtual machines to correct the situation. For more information about configuring networking, see Configuring Virtual Networks.
For more information about NAP, see http://go.microsoft.com/fwlink/?LinkID=117804. For information about Microsoft Forefront Threat Management Gateway and Microsoft Forefront “Stirling”, see http://go.microsoft.com/fwlink/?LinkId=134452. - Use BitLocker Drive Encryption to protect resources. BitLocker Drive Encryption works with features in server hardware and firmware to provide secure operating system boot and disk drive encryption, even when the server is not powered or operating. This helps protect data if a disk is stolen and mounted on another computer for data mining. BitLocker Drive Encryption also helps protect data if an attacker uses a different operating system or runs a software hacking tool to access a disk.
Losing a physical disk is a more significant risk in scenarios with small and medium businesses, as well as remote offices, where physical security of the server may not be as rigorous as in an enterprise data center. However, using BitLocker Drive Encryption makes sense for all comptuers. You should use BitLocker Drive Encryption on all volumes that store virtual machine files too. This includes the virtual hard disks, configuration files, snapshots, and any virtual machine resources, such as ISO images and virtual floppy disks. For a higher level of security that includes secure startup, BitLocker Drive Encryption requires Trusted Platform Module (TPM) hardware. For more information about TPM management, see the Windows Trusted Platform Module Management Step-by-Step Guide (http://go.microsoft.com/fwlink/?LinkId=134227).
For more information on how to configure BitLocker Drive Encryption to help protect your server and the virtual machines running on it, see Windows Server 2008 Hyper-V and BitLocker Drive Encryption (http://go.microsoft.com/fwlink/?LinkID=123534).
Also see Windows BitLocker Drive Encryption Frequently Asked Questions (http://go.microsoft.com/fwlink/?LinkId=134228) and the BitLocker Repair Tool (http://go.microsoft.com/fwlink/?LinkId=134229) Planning for Hyper-V Security Good guidance on Hyper-V backups...both host and guest based backups. Understanding backup options and considerations The backup integration service and the Hyper-V Volume Shadow Copy Service (VSS) writer provide the mechanism for backing up virtual machines as well as system-wide settings that apply to Hyper-V. To implement the backup and recovery scenarios discussed in this section, you must use a backup application that is compatible with the Hyper-V VSS writer. If you want to use Windows Server Backup, you must add a registry key to register the Hyper-V VSS writer. For more information, see http://go.microsoft.com/fwlink/?LinkID=133354. There are two basic methods you can use to perform a backup. You can: - Perform a backup from the server running Hyper-V. Using this method to perform a full server backup is the recommended method because it captures more data than the other method. If the storage is compatible with Hyper-V and the Hyper-V VSS writer, you can perform a full server backup that helps protect all of the data required to fully restore the server. The data included in such a backup includes the configuration of virtual machines and virtual networks, snapshots associated with the virtual machines, and virtual hard disks used by the virtual machines. As a result, using this method can make it easier to recover the server if you need to, because you will not have to recreate virtual machines or system-wide settings such as virtual networks.
- Perform a backup from within the guest operating system of a virtual machine. This method is useful when you need to back up data from storage that is not supported by the Hyper-V VSS writer. See the following sections for details about storage considerations.
Storage considerations As you plan your backup strategy, consider the compatibility between the storage and backup solutions: - Virtual hard disks. These offer the best compatibility and can be stored on many types of physical media. For more information about the types of storage you can use with Hyper-V, see Hardware Considerations.
- Network-based storage. You should use network-based storage such as shared folders with caution. If the network-based storage is unavailable when a backup is attempted, the backup will fail.
- Physical disks that are directly attached to a virtual machine (sometimes referred to as “pass-through disks”). These disks cannot be backed up by the Hyper-V VSS writer. As a result, this type of disk will not be included in any backup performed by a backup program that uses the Hyper-V VSS writer. In this situation, you would need to use some other process to back up the physical disk.
- Storage accessed from a virtual machine by using an Internet SCSI (iSCSI) initiator within the guest operating system. This storage will not be included in a backup of the physical computer. In this scenario, you must use another process to back up the data from the iSCSI-based storage before you perform a full server backup. For example, you could run a backup of the data on the iSCSI storage from a backup application running in the guest operating system.
- iSCSI-based storage. This storage is supported for backup by the Hyper-V VSS writer when the storage is connected through the management operating system and the storage is used for virtual hard disks.
For more information about deploying storage for Hyper-V, see Implementing Disks and Storage. Understanding online and offline backups Whether a backup is performed online or offline depends on whether the backup can be performed without downtime. You can perform an online backup with no downtime on a running virtual machine when all of the following conditions are met: - Integration services are installed and the backup integration service has not been disabled.
- All disks being used by the virtual machine are configured within the guest operating system as NTFS-formatted basic disks. Virtual machines that use dynamic disks or the FAT32 file system prevent an online backup from being performed.
- Volume Shadow Copy Service must be enabled on all volumes used by the virtual machine with a specific configuration. Each volume must also serve as the storage location for shadow copies of the volume, and that mapping must be available to the Hyper-V VSS writer. For example, the shadow copy storage for volume C: must be located on C:.
If an online backup cannot be performed, then an offline backup is taken. This type of backup results in some degree of downtime. A variety of factors can affect the time required to take an offline backup. If the virtual machine is running or paused, it is put into a saved state as part of the offline backup process. After the backup is completed, the virtual machine is returned to its existing state. Understanding the restore process The restore process is straightforward as long as the recommendations outlined in the previous sections were followed when the backups were created. To restore when all components of your backup set are supported by the Hyper-V VSS writer, have all the media and equipment available and then perform a restore of the entire system or the virtual machine, depending on your circumstances. The Hyper-V VSS writer treats Hyper-V as an application that can be backed up. This means that you can recover individual virtual machines. However, you cannot use this method to recover only a portion of a virtual machine. To restore when your backup set includes media that is not supported by the Hyper-V VSS writer, you must perform an additional step. First, perform a restore of the entire system or the virtual machine, depending on your circumstances. Then, restore the unsupported media from within the guest operating system. .gif) Note
If you attempt to restore a virtual machine while it is running, it is turned off and deleted before the backed version of the virtual machine is restored. Note If you restore a virtual machine from an online backup, when you start the virtual machine you may receive a message that the operating system was not shut down properly. You can ignore this message. Considerations about clustered virtual machines If you plan to cluster virtual machines, there are additional factors that you need to consider when planning to backup and restore those virtual machines. Before you attempt to back up or restore clustered virtual machines, consider the following: - Take the virtual machine offline before you run a backup or restore a virtual machine. For more information about taking a clustered virtual machine offline, see http://go.microsoft.com/fwlink/?LinkID=129063.
- Apply a hotfix to prevent failure of a full server backup on a node when a directory path used by a virtual machine cannot be resolved. When the hotfix applied, a directory path that cannot be resolved will prevent only the virtual machine that uses the directory path from being backed up. However, when the hotfix is not applied, an unresolvable directory path will cause the entire backup operation to fail. For more information, see http://go.microsoft.com/fwlink/?LinkId=133348.
- Several factors can affect backup and recovery operations when a virtual machine is clustered. The following tables identify the factors you need to consider and the action you need to take to perform the backup or recovery operation. The information in both tables assumes that you will run the backup or recovery operation on node 1.
Read the rest on Technet @> Planning for Backup 11/19/2008 From Limiting bandwidth on a specific Web site: To limit bandwidth on a specific Web site (on Windows Server 2003) 1. Open IIS Manager (click Start, click Administrative Tools, and then click Internet Information (IIS) Manager). 2. Navigate to the Web Sites node under the local computer, select the specific Web site, right-click the node, and then click Properties. 3. Select the Performance tab. 4. Under Bandwidth throttling, select Limit the total network bandwidth available for all Web sites on this server, and then specify the maximum bandwidth in kilobytes per second (the default is 1024). You cannot specify a bandwidth lower than 1024
kilobytes per second. 5. Click OK. Another option is to use BITS to throttle the download. This is a client side setting so group policy will have to be refreshed in order for this setting to be seen. From To set BITS bandwidth limitations: To set BITS bandwidth limitations 1. Start the Group Policy Object Editor (click Start, click Run, and then type gpedit.msc). 2. Expand Computer Configuration, then Administrative Templates, then Network, then Background Intelligent Transfer Service. 3. Open the Maximum network bandwidth that BITS uses (BITS 2.0) or Maximum network bandwidth for BITS background transfers (BITS 3.0) setting. 4. Set the transfer rate in kilobits per second that you want BITS to use (the default is 10). 5. Set the times at which you want to limit the bandwidth (the default is 8:00 A.M. to 5:00 P.M.). 6. Set the limitations to be used outside of the designated time (the default is Use all available unused bandwidth, but you may select another limitation). 7. Click OK. ======== Read the complete article @> The WSUS Support Team Blog : More on throttling WSUS downloads 11/13/2008This was the solution to a long standing issue to why VMM 2008 (Beta and RTM) would not P2V a SharePoint server for a customer of mine which had an SSL certificate on 443. VMM2008 will block P2V on source machines with an SSL cert registered on 443. To change the default port used by VMM, please follow these precise steps. 1. Go to Regedit->HKLM\Software\Microsoft\Microsoft System Center Virtual Machine Manager Server\Settings
2. Create a new DWORD reg entry named “P2VBITSTcpPort” and give it a decimal value of say 3043 or any other port that is not being used on the host machine.
3. Go to system services (services.msc) and restart Virtual Machine Manager service. Read the complete article @> Virtualization: Revolution of the evolving datacenter : How to change default P2V port A weird issue happened to me when installing SQL 2008 on a 4-Node cluster Windows 2008 x64 cluster. After having issues installing from an extracted ISO, I had to manually install .Net framework 3.5 and Windows Installer 4.5 hotfixes from the redist directory of the SQL install. Thought I was in the clear, when 2 of the 4 nodes wouldn't let me install SQL 2008 failing with an "Invalid SKU" error. The solution found on Microsoft's site was: The solution to adding second time is add the additional node(s) with command line from the SQL 2008 source files: setup.exe /q /ACTION=AddNode /INSTANCENAME="<Insert Instance Name>" /SQLSVCACCOUNT="<SQL account used on other nodes>" /SQLSVCPASSWORD="<password for SQL account>" /AGTSVCACCOUNT="<SQL Server Agent account used on other nodes>", /AGTSVCPASSWORD="<SQL Server Agent account password>" Reference: https://connect.microsoft.com/SQLServer/feedback/ViewFeedback.aspx?FeedbackID=363036 11/12/2008Using Group Policy, you can allow standard users (non administrator users) to add printers in Windows Vista without requiring a IT staff involvement. -
In the navigation pane, open the following folders: Local Computer Policy, Computer Configuration, Administrative Templates, System, Device Installation. -
In the details pane, double-click Allow non-administrators to install drivers for these device setup classes. -
Click Enabled, and then click Show. -
In the Add Item dialog box, type the GUID for the device setup class that applies to your device. Ensure that you include the curly brace characters on either side of the value. For printers the following class ID's -
-
{49ce6ac8-6f86-11d2-ble5-0080c72e74a2} -
{4d36e979-e325-11ce-bfc1-08002be10318} -
{4658ee7e-f050-11d1-b6bd-00c04fa372a7} -
{4d36e97a-e325-11ce-bfc1-08002be10318} -
Click OK to save your changes. You can repeat steps 5 and 6 for other devices. -
Click OK to save the completed list, and then click OK to save the policy setting. 
Reference: http://technet.microsoft.com/en-us/library/cc770453.aspx Streamlined Communications Today, users face the challenge of managing their communications across many devices and applications, which negatively impacts productivity. Office Communications Server 2007 R2 streamlines the way users manage communications, enabling them to find and communicate with the right person, from whichever applications they use most. New call management capabilities let receptionists and team assistants take a large volume of incoming calls and quickly route them to the intended recipients with a simple click, while delegation features allow executives to completely hand over the management of their phone calls to their assistants. New desktop-sharing capabilities allow users on Windows, Macintosh, and Linux platforms to collaborate with one another at the same time they talk to each other using enhanced audio conferencing features. The Group Chat feature lets organizations set up searchable, topic-based chat rooms that persist over time, allowing geographically distributed teams to better collaborate with one another while preserving organizational knowledge. Operational Flexibility and Control IT environments are very complex and create extra administrative overhead for IT administrators. IT is also called upon to deliver on imperatives like cost control, security, integration with existing infrastructure, and managing compliance requirements. Office Communications Server 2007 R2 allows IT administrators to meet these challenges effectively by giving them the ability to provide flexible communications solutions to users and by delivering the tools they need to help manage secure, compliant communications. The new on-premise audioconferencing capability puts IT in control of their audioconferencing infrastructure while saving potentially millions of dollars in audioconferencing costs. The Single Number Reach feature allows IT to log business calls placed by users from cellular phones for accounting purposes while helping to ensure that the same dialing rules that apply to calls made by users from their work phone also extend to their cellular calls. The new video monitoring capabilities allow IT to monitor the quality of video calls and conferences on their network, while support for SIP-trunking does away with the need to manage expensive on-premise gateways. Extensible Communications Platform One of the biggest advantages of having a software-based communications infrastructure is that businesses can embed communications capabilities into existing line-of-business applications and use communications and workflow capabilities to automate business processes, which saves money, saves time, and improves customer service. Office Communications Server 2007 R2 delivers an extensible communications platform that works with an organization’s existing messaging and telephony infrastructure and can adapt to changing business needs. The new Agent Dashboard for Microsoft Dynamics CRM built using the published platform APIs in Office Communications Server 2007 R2 gives call center agents the ability to see presence information and the ability to click to communicate right from within the Microsoft Dynamics CRM screens. Additionally, software developers can automate business processes with instant messaging (IM) and e-mail workflows using such familiar development tools as Microsoft Visual Studio 2008. Read the whole press release @> Microsoft Office Communications Server 2007: What's New 11/11/2008Great news for Direct Connect with the need for a hardware gateway. Cisco Call Manager 4.x is now supported for integration with Exchange UM. That's right you can now integrate your CCM without upgrading to your infrastructure saving lots of money and including new features like: - Embedded Auto Attendants
- IVR for integration with Calendar and Contacts
- Single Message Store reducing licensing and infrastructure cost
- Single Directory which reduces administration overhead.
For all updated info on integration with Exchange UM check out the Telephony Advisor - http://technet.microsoft.com/en-us/library/cc164342.aspx#supPBXAudio The config notes for configuring Cisco Call Manager and Audiocodes via IP-to-IP SIP Trunking. from the notes....When Cisco CallManager Version 4.x is implemented alone (i.e., directly interfacing) with Exchange Server 2007, certain Exchange Server 2007 functionalities are not supported such as Auto-Attended, MWI, and T.38 fax transport mode. Therefore, Cisco CallManager version 4.x suffers feature limitations when operating with Exchange Server 2007. Upgrade to Cisco CallManager Version 6.x seems to resolve these issues, but the trade-off is an extremely costly investment. Read the complete article @> The Three UC Amigos : Exchange UM - Cisco Update | Edit in Browser | /_layouts/images/icxddoc.gif | /Blog/_layouts/formserver.aspx?XsnLocation={ItemUrl}&OpenIn=Browser | 0x0 | 0x1 | FileType | xsn | 255 | | Edit in Browser | /_layouts/images/icxddoc.gif | /Blog/_layouts/formserver.aspx?XmlLocation={ItemUrl}&OpenIn=Browser | 0x0 | 0x1 | ProgId | InfoPath.Document | 255 | | Edit in Browser | /_layouts/images/icxddoc.gif | /Blog/_layouts/formserver.aspx?XmlLocation={ItemUrl}&OpenIn=Browser | 0x0 | 0x1 | ProgId | InfoPath.Document.2 | 255 | | Edit in Browser | /_layouts/images/icxddoc.gif | /Blog/_layouts/formserver.aspx?XmlLocation={ItemUrl}&OpenIn=Browser | 0x0 | 0x1 | ProgId | InfoPath.Document.3 | 255 | | Edit in Browser | /_layouts/images/icxddoc.gif | /Blog/_layouts/formserver.aspx?XmlLocation={ItemUrl}&OpenIn=Browser | 0x0 | 0x1 | ProgId | InfoPath.Document.4 | 255 | | View in Web Browser | /_layouts/images/ichtmxls.gif | /Blog/_layouts/xlviewer.aspx?listguid={ListId}&itemid={ItemId}&DefaultItemOpen=1 | 0x0 | 0x1 | FileType | xlsx | 255 | | View in Web Browser | /_layouts/images/ichtmxls.gif | /Blog/_layouts/xlviewer.aspx?listguid={ListId}&itemid={ItemId}&DefaultItemOpen=1 | 0x0 | 0x1 | FileType | xlsb | 255 | | Snapshot in Excel | /_layouts/images/ewr134.gif | /Blog/_layouts/xlviewer.aspx?listguid={ListId}&itemid={ItemId}&Snapshot=1 | 0x0 | 0x1 | FileType | xlsx | 256 | | Snapshot in Excel | /_layouts/images/ewr134.gif | /Blog/_layouts/xlviewer.aspx?listguid={ListId}&itemid={ItemId}&Snapshot=1 | 0x0 | 0x1 | FileType | xlsb | 256 |
|
|