Windows 2008

Build

Best practice for VMs (take with a pinch of salt)

• http://communities.vmware.com/servlet/JiveServlet/downloadBody/12309-102-4-13348/vFiltered-windows2008best%20practices.pdf

Disable ASLR

Address space layout randomisation is a feature which involves randomly arranging the positions of key data areas, in order to mitigate memory snapshot image vulnerabilities (which is generally not a problem). There are suggestions that this can reduce reduce VMware's page sharing between VM's, increasing overall physical memory usage. However, its probably true that whilst memory page locations will be randomised, the VMkernel will still be able to match up identical pages between different OS instances.

HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\"MoveImages"=dword:00000000

Procedures

Sysprep

1. Start sysprep from C:\Windows\System32\sysprep\sysprep.exe
2. Leave action as Enter System Out-of-Box Experience (OOBE) and tick the poorly spelt Generalize tick-box, then hit OK
3. Sysprep will run and reboot the OS
   • You'll need to provide a new password, and any hostname and IP details will need updating

Memory Counters

Memory management in any OS can be a complex and confusing business, especially as meanings change with time, and the same counter can be called different things in different OS's from the same family.

The first thing to appreciate is that Windows 2008 likes to fill its memory up, in order to improve system performance (Unix like to do this too). For example, it will try to prefetch drivers etc into memory before they're actually required, and cache files that are being accessed.

In the virtual world this can cause concern for Virtual Infrastructure admins, as they see lots of machines, using lots of memory, even when they're not doing anything. But this isn't a problem. The VM's are merely trying make as a good a use of the available system resources as possible. If your ESX becomes congested, then it'll instruct VMTools to start inflating balloon drivers. The first thing that the OS will dump from memory is the unnecessary stuff that's been optimistically loaded into memory but isn't actually providing any worth. This is good, efficient system operation.

Total

Total physical memory available to the OS

Cached

This is data that has been cached into memory to improve IO times. For example, open files that are being read or written to.

Cached memory pages are broadly speaking either...

• Standby - loaded into memory ready for use, and can be immediately dropped if required
• Modified - loaded into memory and since modified, and can be flushed to disk if required

Data in the cache can be written to disk (or dropped) if the memory space is required for something else to make space. Data in the cache does not get paged out to disk, its only in memory in the first place to improve access times, therefore if there's no space for it in physical memory, there's no point writing it to virtual memory.

Available

Physical memory that is immediately available for use. Equal to Free plus Standby Cached.

This is memory that can be immediately written to if required, it may currently contain cache data, but this data can be dropped and overwritten (does not need to written to disk 1st).

If your system has a available memory (more than 100MB or so - but really dependant on the workload its sustaining) then its not experiencing physical memory constraints.

Free

Physical memory space that is completely free, its not been populated with data.

In Use

Found in Resource Monitor

Memory that is populated and can't be immediately used for something else. Equal to Total - Standby

Modified

Found in Resource Monitor

Cached memory that has been modified since it was originally loaded in. It can be freed up on demand, but will need to be written to disk before it can be re-used

Standby

Found in Resource Monitor

Cached memory that has not been modified and can be dropped. It can be immediately freed up on demand.

Commit

Memory that the OS has committed to providing, to an application, normally shown as committed / total . Total includes both physical and virtual memory.

An application can request an allocation of memory from the OS, for its own use, which the OS will set aside/reserve for it. When that allocation has been completed, that amount of memory has been committed.

Committed memory, needn't actually be populated with data, so needn't contribute to the amount in use. If you have no physical memory available, an application can still start and request an allocation. But that allocation will effectively be provided for by virtual memory.

Just because an application requests a large commit, and then doesn't populate it with data doesn't mean its misbehaving. Certain OS API calls will cause large Commits (eg MapViewOfFile), which means that have a decent amount of page file free is useful to ensure your system keeps running. I'd only consider reducing your page file to a small size on locked-down servers on which only certain thoroughly tested applications run.

Sources...

• http://blogs.technet.com/b/markrussinovich/archive/2008/11/17/3155406.aspx
• http://brandonlive.com/2010/02/21/measuring-memory-usage-in-windows-7/
• http://communities.vmware.com/thread/278778
• http://msdn.microsoft.com/en-us/library/windows/desktop/aa965225%28v=vs.85%29.aspx

Troubleshooting

Default Gateway Loss

Known bug in Windows 2008 SP2 causes the default gateway of a machine to disappear on reboot. Resolved by resetting the IP stack and re-entering the IP config

1. Record IP details
   • ipconfig/all > C:\ipconfig.txt
2. Reset the IP stack
   • netsh int ip reset
3. Restart server
4. Re-enter IP config
5. Reboot to confirm its held

There's a bugfix available from http://support.microsoft.com/kb/973243

Scheduled Tasks

• Error 2147943712
  • You're trying to save a task that wants to save credentials (maybe because you want the task to run even when the user is logged off), but credential saving has been disabled by a GPO.
• Error 2147943785
  • Logon failure: the user has not been granted the requested logon type at this computer. Grant the user log on as a batch job rights in Local Security Policy, User Rights Assignment

Extend Partition Fails

Disk looks to have extended in disk manager, but file manager/windows explorer still show the old size

1. Start diskpart from a command line
2. List the volumes, then select the appropriate one
   • list volume
   • select volume 2
3. Extend the volume
   • extend filesystem
4. If this fails, select the partition and extend
   • list partition
   • select volume 1
   • extend filesystem
5. This can sometimes throw up disk errors, in which case you'll need to a check disk on the affected partition (if there are open file handles you'll either need to stop the applications or schedule after a reboot, and reboot)
   • EG chkdisk d: /f
6. Then re-attempt the partition extension