Group Policy in Windows Server 2012: Using Remote GPUpdate

If someone calls to say their computer doesn’t work quite right, the first thing you might have them do is run gpupdate /force to ensure they have the latest policy applied to their system. Now, you have the power to reach out and force a gpupdate without needing to be at the computer, remote in, or ask the user do it themselves.

The way remote gpupdate works is this: It creates a task through task scheduler. The task will execute within the next 10 minutes, which runs the GPUpdate locally on the machine. This will work on Vista and beyond.

Because this feature uses a remote connection, in order to use it you will need the following firewall rules enabled on clients.

· Remote Scheduled Tasks Management (RPC)

· Remote Scheduled Tasks Management (RPC-EPMAP)

· Windows Management Instrumentation (WMI-In)

Once you have these firewall rules applied to your clients, there are two ways you can invoke a remote Group Policy update.

Remote GP Update Wizard

From the GPMC, right click on an OU that contains computer objects.

Click the “Group Policy Update” option.

This will run a gpupdate /force on all computers in the OU, and any subOUs. Computer policy will be refreshed for each computer, and user policy will be refreshed for any and all users currently logged into those computers.

The “success” and “failure” headers indicate how many computers were contacted and had the event planted on the computer. It does not indicate that those computers have already run gpupdate – just that they have successfully scheduled the update for some time in the next 10 minutes. In this case, I intentionally sabotaged one of my clients to demonstrate what failure looks like – you see an error code and a description, and you can “Save” your results to a .csv file to review what computers succeeded and did not succeed in receiving the task.

Powershell

The other option is to use Group Policy’s new PowerShell cmdlets. The Invoke-gpupdate cmdlet is part of the Group Policy Powershell Module that is installed when you install the Group Policy Management Feature on a machine.

This cmdlet gives you more flexibility with how Group Policy is updated. You can use all of the gpupdate parameters you may be familiar with, plus you can use the new remote GP update functionality to target one computer – or write a script that targets many computers.

An example of the most basic use of invoke-gpupdate:

Import-module groupPolicy

Invoke-gpupdate computername

The completion of this cmdlet will put a task on the computer that will execute a gpupdate /force

http://www.microsoft.com/en-us/news/presskits/bing/2012Searches.aspx

Hi this is Yang Cao again, program manager on the Windows Server 2012 Essentials team. Today’s topic is about one of my favorite features in Windows Server 2012, Storage Spaces. If you Bing “Storage Spaces + Windows Server 2012” you’ll get over 400 million results (you’ll get even more results if you Bing “Storage Spaces + Windows 8” because this feature is available in both server and client). So in today’s post, I’ll try not to duplicate the other 400 million pages. I won’t repeat the definition of Storage Spaces, storage pools, thin provisioning, or resiliency. I won’t even insert the many screen shots of how to create a storage space. You can find all this information in this fabulous blog post in the Building Windows 8 blog: Virtualizing storage for scale, resiliency, and efficiency.

Instead, I will talk about why small business users would love Storage Spaces, and how Windows Server 2012 Essentials makes Storage Spaces creation and management simpler.

Why would small business users love Storage Spaces?

When you are starting or running a small business, one question you might ask yourself is, how do I store data in a flexible, reliable, and affordable way? Maybe you just went through the pain of replacing a smaller disk with a larger one (not flexible enough). Maybe you are a little concerned with the critical data stored on an old disk (not reliable enough). Maybe you are looking at different solutions that might offer similar benefits, but would eat up your next year’s IT budget (not affordable enough)…

Why small business users would love Storage Spaces:

1. It is flexible. You can add disks of any kind or size into a storage pool, and then create one large virtual disk. Later on when your business and data grows, you can add more disks to seamlessly expand the storage capacity.

2. It is reliable. You can select the desired level of resiliency when creating your virtual disk, such as mirroring. For example, with at least two copies of the data being available on at least two different physical disks, you gain business continuity even if one of the physical disks fails.

3. It is affordable. No need to pay for another storage solution, no need to purchase special hardware controllers, enclosures, or drives, and no need to retire and abandon old drives.

Working with Storage Spaces in Windows Server 2012 Essentials

Storage Spaces meets small business users’ requirements for storage, so then the next question is, how can small business users make Storage Spaces “just work”? The Windows Server 2012 Essentials Dashboard is a portal designed for small business administrators to perform daily management tasks. We integrated some common Storage Spaces tasks into the Dashboard so that administrators can continue using the same portal to configure, use, and manage Storage Spaces.

Configure

To make Storage Spaces easier to configure, Windows Server 2012 Essentials integrates the Storage Spaces control panel UI into the system, and provides an entry point from within the Dashboard (Storage -> Hard Drives -> Advanced: Manage Storage Spaces). Compared to Server Manager, the control panel UI simplifies the settings while still providing the most important configuration options, such as Name, Resiliency Type, and Size.

Use

After a storage space is created, working with it in the Dashboard is very similar to other hard drives. You can create a server folder on a storage space, move a server folder to a storage space, or view the properties of a storage space. When you select a storage space, you can see more information about the resiliency type and the underlying storage pool in the Details Pane.

Manage

You can use a storage space as if it were a normal hard drive, and any warnings or errors will be displayed in the Alert Viewer in the Dashboard. Most commonly, you’ll see a low storage pool capacity alert. This alert appears when the underlying physical disk’s free capacity is running low. To solve this, you could either delete files to free up more space on the disk, or you could add a new disk to expand the storage pool. The UI from the Alert Viewer guides you through the task of adding a disk to the storage pool.

That’s it!

Summary:  Learn how to use Windows PowerShell to view contents of a VBScript file.

 How can I use Windows PowerShell to easily view the contents of a VBScript file, such as SLMGR.VBS? I do not know the path to the file.

 You do not need to know the path to the file. Use the Windows PowerShell Get-Command cmdlet to find the script (listed, incidentally, as an application) and pipe the results to Get-Content, as shown here.

Get-Command -Name slmgr.vbs | Get-Content | more

You can find the path to all of these types of VBScripts by using a wild card for the name, as shown here.

Get-Command -Name *.vbs -CommandType application | select path

Some of the Hyper-V MVPs are currently running “The Great Big Hyper-V Survey of 2012”.  You can read about it here:

• http://www.hyper-v.nu/archives/hvredevoort/2012/11/extension-to-december-1st-of-the-great-big-hyper-v-survey-of-2012/
• http://www.aidanfinn.com/?p=13814

This is not a survey that is run by Microsoft – but I would encourage you to go and participate.  The MVPs who run these surveys have done a great job of analyzing and publishing the results at the end of the day – and it is really interesting to see what everyone is doing with Hyper-V.

Cheers,
Ben

In this post, I'm providing a reference to the most relevant content related to Windows Server 2012 that is related to the File Server, the SMB 3.0 features and its associated scenarios like Hyper-V over SMB and SQL Server over SMB. It's obviously not a complete reference (there are new blog posts every day), but hopefully this is a useful collection of links for Windows Server 2012 users.

Summaries of SMB 3.0 features in Windows Server 2012

• Overview of SMB 3.0 in WIndows Server 2012 [Video] [TechEd]
• SNIA Tutorial: SMB Remote File Protocol (including SMB 3.0) (SNW Fall 2012)
• Windows Server 2012: Which version of the SMB protocol (SMB 1.0, SMB 2.0, SMB 2.1 or SMB 3.0) you are using on your File Server?
• Windows Server 2012, File Servers and SMB 3.0 – Simpler and Easier by Design
• Windows Server Blog - Taking Server Application Storage to Windows File Shares
• List of all video recordings related to SMB 3.0 from TechEd North America

Articles on File Storage for Application Servers (Hyper-V over SMB, SQL Server over SMB)

• Hyper-V over SMB [Video] [TechEd]
• SQL Server over SMB [Video] [TechEd]
• Hyper-V over SMB: Remote File Storage Support in Windows Server 2012 Hyper-V (SNW Fall 2012 Presentation)
• Test Hyper-V over SMB configuration with Windows Server 2012 - Step-by-step Installation using PowerShell
• Windows Server 2012 Scale-Out File Server for SQL Server 2012 - Step-by-step Installation
• Overview of Hyper-V over SMB from the SNW Spring 2012 Conference 

Articles on SMB Transparent Failover and SMB Scale-Out

• SMB Transparent Failover – making file shares continuously available
• File Server for Scale-Out application data
• Deep dive on Transparent Failover and Scale-Out [Video] [TechEd]
• Understand and Troubleshoot Scale-out File Servers in Windows Server "8" Beta

Articles on SMB Direct (SMB over RDMA) and SMB Multichannel

• SMB Multichannel and NIC Teaming [Video] [TechEd] (SMB Multichannel covered on the second half)
• SMB Direct (SMB over RDMA) and Cluster-in-a-box [Video] [TechEd] (SMB direct covered on the second half)
• The basics of SMB Multichannel, a feature of Windows Server 2012 and SMB 3.0
• High Throughput File Servers with SMB Direct, Using the Three Flavors of RDMA network adapters (SNW Fall 2012 Presentation)
• Deploying Windows Server 2012 with SMB Direct (SMB over RDMA) and the Chelsio T4 cards using iWARP – Step by Step
• Deploying Windows Server 2012 with SMB Direct (SMB over RDMA) and the Mellanox ConnectX-3 using 10GbE/40GbE RoCE – Step by Step
• Deploying Windows Server 2012 with SMB Direct (SMB over RDMA) and the Intel NetEffect NE020 card using iWARP – Step by Step
• Deploying Windows Server 2012 with SMB Direct (SMB over RDMA) and the Mellanox ConnectX-2/ConnectX-3 using InfiniBand – Step by Step

Articles on Failover Clustering related to File Server Clusters

• How to Enable CSV Cache - Used by Scale-out File Servers
• How to Configure an Alias for a Clustered SMB Share with Windows Server 2012
• Draining Nodes for Planned Maintenance with Windows Server 2012

Articles on other SMB 3.0 features and capabilities

• The basics of SMB PowerShell, a feature of Windows Server 2012 and SMB 3.0
• The built-in SMB PowerShell aliases in Windows Server 2012 and Windows 8
• Windows Server 2012 and SMB 3.0 – VSS for SMB File Shares
• A developer's view on VSS for SMB File Shares
• Episode 20 of "From End to Edge and Beyond" covers SMB Encryption in Windows Server 2012 and SMB 3.0
• Windows PowerShell Reference Sheet for File and Storage Services in Windows Server   “8”   Beta
• SMB Management API

Windows Server File Server Tips

• Switch to the High Performance power profile
• Make sure your network interfaces are RSS-capable
• Use multiple subnets when deploying SMB Multichannel in a cluster
• Disable 8.3 Naming (and strip those short names too)
• Continuous Availability does not work with volumes using 8.3 naming or NTFS compression
• Enable CSV Caching on Scale-Out File Server Clusters
• Avoid loopback configurations for Hyper-V over SMB
• Run the File Services Best Practices Analyzer (BPA)
• Use PowerShell to find the free space on the volume behind an SMB file share
• New per-share SMB client performance counters provide great insight

Private Cloud Solution Architecture

• Windows Server 2012 and SMB 3.0 demos at TechEd showcase File Server with multiple storage configurations and technologies
• Cloud Datacenter Network Architecture in the Windows Server  “8”  era
• Cloud Datacenter Storage Approaches in the Windows Server 2012 era
• Building Your Cloud Infrastructure: Converged Data Center with File Server Storage
• Let’s Build a Cloud… With PowerShell! - Part 1: Deployment and Configuration

TechNet Radio (includes Video) with Bob Hunt and Jose Barreto

• Road to TechEd 2012 - File Storage Support in Windows Server 2012 (June 4th 2012)
•  Windows Server 2012 Hyper-V over SMB (August 31st 2012)
• Windows Server 2012 - How to Scale-Out a File Server and use it for Hyper-V (September 5th 2012)
• Hyper-V over SMB: Step-by-Step Installation using PowerShell (September 16th 2012)
• SMB Multi-channel Basics for Windows Server 2012 and SMB 3.0 (October 8th 2012)
• SQL Server over SMB 3.0 Overview (October 23rd 2012)

Knowledge Base articles (Support KBs) about Windows Server 2012 SMB 3.0

• New SMB 3.0 features in the Windows Server 2012 file server
• Some SMB  share properties are only available in updated tools
• File Server Cluster names longer than 15 chars are not supported 
• SMB connections fail with error "Invalid Signature"

Protocol Documentation

• [MS-SMB2]: Server Message Block (SMB) Protocol Versions 2 and 3 Specification (Windows 8)
• [MS-SMBD]: SMB2 Remote Direct Memory Access (RDMA) Transport Protocol Specification
• [MS-FSRVP]: File Server Remote VSS Provider Protocol Specification
• [MS-SWN]: Service Witness Protocol Specification

Older posts and videos

• Windows Server Blog - SMB 2.2 is now SMB 3.0. Great overview of SMB 3.0 scenarios and features
• Storage and Continuous Availability Enhancements in Windows Server 8
• High-Performance, Continuously Available File Share Storage for Server Applications
• SMB 3 Security Enhancements in Windows Server 2012 (Includes SMB Encryption)
• Windows Server 2012 Beta - Test cases for Hyper-V over SMB (includes PowerShell examples)
• Windows Server 2012 Beta - Hyper-V over SMB - Quick Provisioning a VM on an SMB File Share
• Enabling Hyper-V Remote Management - Configuring Constrained Delegation For SMB and Highly Available SMB
• System Center 2012 CTP for Windows Server  “8”  Beta support - Includes support for  Hyper-V over SMB
• Fast and Efficient File Servers for Server Applications. Covers SMB Multichannel and SMB  Direct.
• Preliminary performance results with Windows Server 2012 Beta and SMB Direct (SMB over RDMA)
• Overview of SMB Direct, SMB Multichannel and SMB Scale-Out from the SNW Spring 2012 Conference
• Application Compatibility and API Support for SMB 2.2, CSVFS, and ReFS
• Windows 8 SMB 2.2 File Sharing Performance
• Windows Server 8  -  Storage Changes [Video] -  Thomas  Pfenning talks about Storage and Availability in Windows Server 2012
• New Server form factors, Continuous  Availability [Video] - John Loveall shows the new Cluster-in-a-box systems.
• Microsoft Management Summit keynote [Video] - Brad Anderson on System Center 2012 and Windows Server 2012
• How Microsoft Secures Sensitive Data Using File Classification Infrastructure [Video] - Nir Ben Zvi  talks about FCI
• SNIA’s Storage Developer Conference - SDC 2011 content (slides and videos) now available for download
• Links to //build/ sessions on Storage, Networking and Hyper-V - Links to //Build to both videos and PowerPoint files

-------

Change tracking:

• 04/24/2012: Original post
• 05/01/2012: Update: Added links to two SNW Spring 2012 presentation
• 05/03/2012: Update: Added links to protocol documentation, blog post on SMB Encryption and private could blog post 
• 05/18/2012: Update: Added links to SDC presentations, plus blogs on basics of SMB PowerShell and SMB PowerShell
• 06/13/2012: Update: Added 3 new blog post, one new KB article, one new video link
• 08/02/2012: Update: Additional blog posts and links to TechEd recordings
• 08/26/2012: Update: Two additional blog posts
• 11/27/2012: Update: Added 10 file server tips, SNW Fall 2012 presentations, TechNet Radio links. Moved older posts down.

Summary: Microsoft Scripting Guy, Ed Wilson, talks about using Windows PowerShell to detect the power state on his laptop and to set the appropriate power plan.

Microsoft Scripting Guy, Ed Wilson, is here. This evening in Oslo, Norway, the Scripting Wife and I are attending the Microsoft Technology User Group meeting. The meeting runs from 18:00 until 20:00 (CET). Interestingly enough, the lows in Oslo and in Charlotte, North Carolina, are about the same. The big difference is the 30-degree temperature between high and low in Charlotte. Oh well, and the other big difference is a bit of snow! WOO HOO!!!

Detect power state by using PowerShell

To detect whether or not my laptop is running on battery, I can query the Win32_Battery WMI class. This WMI class is in the Root\CimV2 WMI namespace and has been around since forever. There is nothing special about this class. The only thing is to ensure that my laptop actually populates information in the class—and that the information is reliable.

In the past, I have had laptops in which the Win32_Battery WMI class did not populate at all when the laptop was plugged into electricity; it only became available when the laptop ran on battery. There is another WMI class—Win32_Portablebattery. This WMI class also derives from Cim_Battery, but it provides a bit more information than Win32_Battery. On the other hand, Win32_Battery provides information about recharge status. The differences are shown here.

PS C:\> $b = Get-CimClass win32_battery

PS C:\> $p = Get-CimClass win32_portablebattery

PS C:\> Compare-Object $b.CimClassProperties.name $p.CimClassProperties.name

InputObject                                SideIndicator

-----------                                -------------

CapacityMultiplier                         =>

Location                                   =>

ManufactureDate                            =>

Manufacturer                               =>

MaxBatteryError                            =>

BatteryRechargeTime                        <=

ExpectedBatteryLife                        <=

The battery is discharging

If the laptop runs on the battery, the BatteryStatusreports 1, which means that “The battery is discharging.” The other conditions are a bit more complicated. The following chart details the meaning of the status of the battery.

For my purpose, I use the value like a Boolean—1 means ”on battery,” everything else means “plugged in” (at least for my script). Here is how I obtain the battery status.

(Get-CimInstance win32_battery).batterystatus

Set the appropriate power plan

To set the power plan on my laptop, I use the Win32_PowerPlan WMI class (see yesterday’s article) and I call the Activate method. All I really need to do is to add a bit of logic, then retrieve the appropriate power plan, and activate it. I decided, right now, that I will use Power Saverif the battery is discharging (1), High Performanceif the battery is fully charged (3) and Balanced, if the battery is any other status. The script is a simple If / ElseIF / Else type of construction. Here is the code.

SetPowerSaverPlan.ps1

If ((Get-CimInstance win32_battery).batterystatus -eq 1)

  {

   $p = Get-CimInstance -Name root\cimv2\power -Class win32_PowerPlan `

    -Filter "ElementName = 'Power Saver'"      

    Invoke-CimMethod -InputObject $p -MethodName Activate }

Elseif ((Get-CimInstance win32_battery).batterystatus -eq 3)

  {

   $p = Get-CimInstance -Name root\cimv2\power -Class win32_PowerPlan `

    -Filter "ElementName = 'High performance'" 

    Invoke-CimMethod -InputObject $p -MethodName Activate }

Else

 {

   $p = Get-CimInstance -Name root\cimv2\power -Class win32_PowerPlan `

    -Filter "ElementName = 'Balanced'"  

    Invoke-CimMethod -InputObject $p -MethodName Activate }

What I do not know, yet, is how often the script will select High Performance. This is because, with the Windows Battery Conditioning technology, the battery does not always fully charge. At times, for example, on my laptop, the battery stops charging at 98 percent or so—and I do not know if THAT condition reports as fully charged (3).Therefore, after a bit of testing, I may eliminate the ElseIf condition, and do a simple If / Else and use the Else condition to set the full power plan.

If I want to check to see what power plan gets applied as a result of the above script, I can do a simple query to check for the active power plan, as shown here.

Get-CimInstance -Name root\cimv2\power -Class win32_PowerPlan  -Filter "isactive = true" |

  Select-Object elementname

Well, that is about it for now. We have a lot of stuff to do and to see here in Oslo before the user group meeting this evening.

Join me tomorrow when I will talk about changing the power plan on servers running Windows Server 2008 R2 and Windows Server 2012.

I invite you to follow me on Twitter and Facebook. If you have any questions, send email to me at scripter@microsoft.com, or post your questions on the Official Scripting Guys Forum. See you tomorrow. Until then, peace.

Ed Wilson, Microsoft Scripting Guy

At Microsoft, we have been on a transformative journey to cloud computing and we have been working with customers every step of the way. Millions of customers have embraced the cloud and we are excited to share the news that we’ve reached a major milestone in cloud scale computing.  Since the inception of the authentication service on the Windows Azure platform in 2010, we have now processed 200 BILLION authentications for 50 MILLION active user accounts. In an average week we receive 4.7 BILLION authentication requests for users in over 420 THOUSAND different domains. This is a massive workload when you consider others in the industry are attempting to process 7B logins per year, Azure processes close to that amount in a week.

See the full story at http://blogs.msdn.com/b/windowsazure/archive/2012/11/27/windows-azure-active-directory-processes-200-billion-authentications-connecting-people-data-and-devices-around-the-globe.aspx.

Another change we made in Windows Server 2012 is in the Resultant Set of Policy reports. In previous versions of Server, you had to look at the results report, and the event log, and the tracing logs to find all the information you needed about why policy did or did not apply. Now, we’ve consolidated most of that information right into the results report to make troubleshooting Group Policy easier.

The biggest change we made is to the Summary section.

Here’s what the summary section used to look like:

And here’s what it looks like now:

As you can see, we summarized important information that was previously difficult to find, like loopback mode, slow link detection, and GPOs with enforce (or have block inheritance enabled)

We also added information to the computer/user details. Now we show how long client side extensions take to process, the last time an extension processed and detailed event log information from the latest pass of policy.

We also added more detail to the report, including sorting information by GPO, showing where the GPOs were linked, and reporting on modifiers like “enforced” or “disabled”.

How you run the GP results report hasn’t changed. If you choose to run it from the GPMC against a remote client, the client needs the following firewall ports opened:

· Remote Event Log Management (NP-In)

· Remote Event Log Management (RPC)

· Remote Event Log Management (RPC_EPMAP)

· Windows Management Instrumentation (WMI-In)

Running it this way against a downlevel client still gets you the new format and most of the new information.

The command line GP results functionality still works. You can run gpresult.exe /h out.html on a client machine to have the report created as out.html. However, this will only get you the new format and information when it’s run on a Windows “8” machine.

[Today’s post comes to us courtesy of Duncan Chalmers, release manager for Windows Server Essentials]

Hello everyone. I’d like to update you on three additional add-on software that are now available for Windows Server 2012 Essentials. We have added the Health Report add-in, made available the System Center Management Packs, and updated the My Server for Windows Phone app:

• Health Report Add-In for Windows Server 2012 Essentials
• Windows Server 2012 Essentials Management Pack
• Windows Phone Marketplace, for the latest version of the My Server for Windows Phone app

Please read the other postings on this Blog for more details about each of these cool new add-on software for Essentials.

Summary: Learn how to use Windows PowerShell to determine if a laptop is running on battery.

 How can I use Windows PowerShell to determine if my laptop is running on battery?

Use the Win32_Battery WMI class and look for a BatteryStatus of 1—this means the battery is discharging (in use). Here is an example using either the Get-WmiObject or the Get-CimInstance cmdlets.

Get-WmiObject Win32_Battery

Get-CimInstance Win32_Battery

You may be asking yourself, “What does infrastructure status have to do with Group Policy”. Well, group policy depends on other technologies to ensure that policy settings are replicated throughout your environment so that end users / computers will get the settings that you configure.

And when you’ve run into problems you start wondering: did replication finish? Are there errors? And if there are, how am I supposed to see what errors have happened?

Since you are a GP admin and not necessarily an AD/DFSR admin, you only want to know that all of the replication that is supposed to be happening for Group Policy Objects is happening. In Windows Server 2012 we have added a feature that will tell you just this.

The feature is called Infrastructure Status and you can find it in the GPMC results pane for each domain object. Simply click the domain that you are interested in and in the result pane you will see a new tab labeled “Status”. This “status” tab will show the status of GPO replication (for both SYSVOL and AD) of all GPOs across your entire domain.

If you suspect you have a replication problem with a single GPO, to speed up your troubleshooting, you can check the infrastructure health status for that GPO. To see the status, open the Group Policy Objects node and select the GPO listed under that node.

Note: The infrastructure health status is not available when you click on GPO links displayed under the domain and OU nodes.

Initially, the Status tab will not have any information about replication status. Once you hit “detect now”, the GPMC contacts all domain controllers in your domain and collects information about Group Policy Object(s) from AD and SYSVOL. It uses a “baseline” domain controller to compare GPO information against GPO information from all other domain controllers. The baseline domain controller defaults to the DC that the GPMC is connected to but can be changed by clicking Change.

The first level of information will show the number of domain controllers that have GPO information “In Synch” with the baseline domain controller and the number of domain controllers that have GPO information that is “In Progress”. Domain controllers that are “In Synch” have all of the same GPO information as the baseline DC. Domain controllers that are “In Progress” do not have all of the same GPO information as the baseline DC. This may mean that there is a problem with GPO replication but it also may mean that replication just has not converged yet. For those DCs that are “In Progress” additional details are provided which explain exactly what is not in sync. The following is the list of reasons a DC can be “In Progress”:

Within the details of each of the errors a link is provided to help you further investigate why the DC is not In Sync.

Group Policy can be very difficult to troubleshoot and we hope that this feature allows you to find and resolve GP related replication issues more quickly.