Guest Reclaim Tool

Guest Reclaim reclaims dead space from NTFS volumes hosted on a thin provisioned SCSI disk. The tool can also reclaim space from full disks and partitions, thereby wiping off the file systems on it. As the tool deals with active data, please take all precautionary measures understanding the SCSI UNMAP framework and backing up important data.

Features

• Reclaim space from Simple FAT/NTFS volumes
• Works on WindowsXP to Windows7
• Can reclaim space from flat partitions and flat disks
• Can work in virtual as well as physical machines

Whats a Thin provisioned (TP) SCSI disks? In a thin provisioned LUN/Disk, physical storage space is allocated on demand. That is, the storage system allocates space as and when a client (example a file system/database) writes data to the storage medium. One primary goal of thin provisioning is to allow for storage overcommit. A thin provisioned disk can be a virtual disk, or a physical LUN/disk exposed from a storage array that supports TP. Virtual disks created as thin disks are exposed as TP disks, starting with virtual Hardware Version 9. 

What is Dead Space Reclamation? Deleting files frees up space on the file system volume. This freed space sticks with the LUN/Disk, until it is released and reclaimed by the underlying storage layer. Free space reclamation allows the lower level storage layer (for example a storage array, or any hypervisor) to repurpose the freed space from one client for some other storage allocation request. For example:

• A storage array that supports thin provisioning can repurpose the reclaimed space to satisfy allocation requests for some other thin provisioned LUN within the same array.
• A hypervisor file system can repurpose the reclaimed space from one virtual disk for satisfying allocation needs of some other virtual disk within the same data store.

GuestReclaim allows transparent reclamation of dead space from NTFS volumes.

System requirements

Thin provisioned (TP) SCSI disk

Space can be reclaimed on SCSI disks that advertise themselves as thin provisioned (TP) devices.

GuestReclaim queries the device for its TP status using standard SCSI primitives like reading the vital product data page (B0 vpd). GuestReclaim will issue SCSI Unmap commands to the underlying storage for reclaiming dead space.

Supported Operating Systems

• Desktop: XP onwards up to Windows 7
• Server: Until Windows 2008

Administrative Privileges
The tool needs to be executed with Administrator privileges.

Supported Filesystem NTFS only.

Download link

http://labs.vmware.com/flings/guest-reclaim

Instructions

The tool is provided as a standalone binary executable. Unzip the package, and it will contain a program. The tool needs to be executed with Administrator privileges.

Run GuestReclaim.exe from the command prompt. Use the --list option to list available thin provisioned disks on the system. If none show up, it means that the first 16 drives are not thin provisioned. Export an environment variableRECLAIM_DEBUG to see verbose output of the TP querying results.

New features in Windows Server 2012

Windows server 2012 has been released to the manufacturing. It will be available for general evaluation and purchase by all customers around the world on September 4 2012.

Here is the information on some of the new features in Windows Server 2012:-

Licensing

The Enterprise Licensing has been eliminated. There are only 4 license types in Windows 2012.  

• Datacenter edition for highly-virtualized private cloud environments.
• Standard edition for non-virtualized or lightly virtualized environments.
• Essentials edition for small businesses with up to 25 users running on servers with up to two processors.
• Foundation edition for small businesses with up to 15 users running on single processor servers.

Here is a comparison of various editions by server role.

Here is a summary of key features:-

Running instances

Running instances can exist either in a physical operating system environment (POSE) or a virtual operating system environment (VOSE).

Powershell

Windows Powershell has over 2300 commandlets as compared to 200 in Windows Server 2008

Task Manager

New Task Manager Window, shows more detailed information about each process/application

File System

New type of file system for File servers is called ReFS (Resilient File System). Max file size of 16 Exabytes and max volume size of 1 yottabytes (hardware restrictions still apply)

CPU and Memory limits

· There is no support for Itanium based processors
· Max logical processors: 640 (It was 256 in Windows Server 2008 R2)
· Max RAM: 4 TB (It was 2 TB in Windows Server 2008 R2)

Some new RDS features

a) Single Sign-On:  In Windows Server 2008 R2, it was possible to configure an RDS deployment so that users will need to enter their credentials only once when connecting to RemoteApps and hosted desktops. However, this configuration was very cumbersome. Windows Server 2012 dramatically simplified this by eliminating the need to use multiple certificates. It is also possible to use locally logged on domain credentials so that users connecting from managed devices can connect seamlessly without any credential prompts.
b) Email and web discovery of Remote Applications and desktops:  Users now can find the correct remote workspace to connect to by just providing their email address. This removes the requirement to remember a long website URL. In addition, Remote Desktop Web Access now supports other browsers such as Chrome, Firefox, and Safari.

Windows Update error

Sometimes when updating my old Windows XP or 2003 system with Windows update, I receive the following error message:-

"Network policy settings prevent you from using this website to get updates for your computer"

To resolve this error, do the following:-

1. Stop the Windows Automatic Update Service

2. Goto C:\Windows\System32 folder

3. Rename the "SoftwareDistribution" folder to "SoftwareDistribution_Old" or to some other name.

4. Check all the GPO policies related to Windows Update and make sure that they are (if any) set to "not defined"

5. Search through the registry and delete any keys with "NoWindowsUpdate" or "DisableWindowsUpdateAccess".

6. Start the Windows Automatic Update service.

Fix SSL Vulnerability Part 3 of 3: Using IIS Crypto tool to disable weak ciphers and protocols

As a webserver administrator/systems administrator, you must ensure that your webserver is using strong ciphers and protocols. Your webserver can easily be flagged for vulnerabilities if you use weak ciphers and protocols. Your webserver would then be not compliant with your organization's security policies and could be vulnerable to network security hacks. 

You may receive "Web Server Supports Weak SSL Encryption Certificates" message on your network security vulnerability report if you are using weak ciphers or protocols. Enforcing the 128-bit SSL keys might not be possible in all situations because keys distributed by some vendors use 40-bit. When configuring SSL communication, the recommendation is to use SSLv3 since it fixes most of the flaws found in SSLv2. There is no known attack for breaking SSLv3 security.

There are lot of other vulnerabilities associated with SSLv2 and TLS 1.0, TLS 1.1 protocols. If you search other places, you would find tons of ways to disable vulnerable protocols in Windows registry editor etc. I recently came across "IIS Crypto" software which helps disable weak ciphers and protocols through a GUI interface.

To enable/disable the protocols/ciphers, click the "PCI" or "FIPS 140-2" button and then manually check/uncheck the protocols and ciphers that you want to enable. A restart of the Operating System is required before the settings can come into effect.

Fix SSL Vulnerability Part 2 of 3: How to ensure which protocol your server is using?

To check the protocol that your web server is using for https type traffic, you would need to download and install "OpenSSL" utility on the computer from where you will be making connections to the web server.

Please see the instructions below to download and install "OpenSSL":-

1. Download "OpenSSL" from http://slproweb.com/products/Win32OpenSSL.html

2.As of June 11th 2012, you can download either "Win32 OpenSSL v1.0.1c Light" (for 32-bit Windows) or "Win64 OpenSSL v1.0.1c Light" (for 64-bit Windows)

3. It is recommended that you download and install the "Visual C++ 2008 Redistributables" as well before installing "OpenSSL" binaries. Please install the 32-bit or 64-bit version depending upon your OS type.

4. Once the "C++" and "OpenSSL" binaries are installed on the computer you should be ready to test the protocol that your webserver is using.

i. Open cmd on the computer where you installed "OpenSSL"

ii. Change path to the OpenSSL\bin directory

iii. Type the command: "openssl s_client -ssl2 -connect SERVERNAME:443" where SERVERNAME is the hostname (or FQDN) or IP address of your webserver and port 443 is your default https port.

iv. If your webserver does not support SSLv2, then you should receive output similar to this:-


openssl s_client -ssl2 -connect SERVERNAME:443
CONNECTED(00000003)
458:error:1407F0E5:SSL routines:SSL2_WRITE:ssl handshake failure:s2_pkt.c:428:


v. If your webserver does support SSLv2, then you would receive an output with the certificate key and lot of other information.

In the next post, I will demonstrate how to disable SSLv2 and other vulnerable protocols.

Fix SSL Vulnerability Part 1 of 3: SSL and TLS introduction

Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are required for secure data communication over the internet. TLS and SSL encrypt the network communication using various parameters that are decided during the initial client-server handshake. These protocols help to prevent eavesdropping and to securely identify the web server with which the connection is being made thereby making your data transactions over the internet (such as bank account access, online purchase at amazon.com, e-bay.com or other such sites, donations to an organization using credit card/bank account, household utility account access, etc) more secure.