Part 2: Setup WinDBG as a server to solve BSOD

Part 1: Setup WinDBG as a server to solve BSOD -- What is WinDBG?

Part 2: Setup WinDBG as a server to solve BSOD -- Download and install WinDBG.

Part 3: Setup WinDBG as a server to solve BSOD -- Configuring WinDBG

Part 4: Setup WinDBG as a server to solve BSOD -- Troubleshooting if dump file is not generating

Part 5: Setup WinDBG as a server to solve BSOD -- Setting up as WinDBG as a Server

Part 2: Dowanload and install WinDBG.

WinDBG is a part of Windows drivers kit (619MB ISO) also called WDK and Windows Software Development Kit (SDK), Here I am using  SDK to download. go to http://msdn.microsoft.com/en-us/windows/hardware/hh852363 and download sdksetup.exe file.

Downloaded file is just a 701 kb in size, before starting installation make sure your internet connection is working as it will download component and required softwares from internet, You must be a administrator to install this file, right click and run as administrator

Installation will start downloading Microsoft .net framework 4 and setup it to proceed, which will be downloaded from internet, (if you have already installed .net 4 it will not download), check I accept the Microsoft .NET Framework license terms and click Accept & Install.  

It will take time depending on your internet speed.

Once installation completes, It will ask you where to store setup package files on the server (I am choosing this option incase in future if I need to install WinDBG on another server, and don't have to download it again), I have created Temp folder under C drive and store all the setup files, and will manually do installation once download finished. Click next to proceed.

I am keeping defaults here and clicking next.

 Select Debugging tools for windows and deselect other selection. Now you will see it will be downloading 115 MB of data, this is why I chose SDK (around 250 MB) over windows drivers kit WDK (619.8 MB). Click download to start it.

Once the download completes you are ready to install WinDBG, open c:\temp folder (backup or copy c:\temp folder to central location in case if you need to install the same on another computer, no need to download it again) and run sdksetup.exe (you must be an administrator to install it) or right click and click run as administrator.

I am keeping all the defaults and pressing next

As we are not going to install .net framework 4.5 SDK you can ignore warning and press next.

Accept the license agreement

Start installation by pressing Accept.

All you have done now. Windbg is downloaded and installed successfully, all you need to do is configure it.

Download  full PDF of this article from http://kunaludapi.weebly.com.

Part 1: Setup WinDBG as a server to solve BSOD

Setup WinDBG as a server

Part 1: Setup WinDBG as a server to solve BSOD -- What is WinDBG?

Part 2: Setup WinDBG as a server to solve BSOD -- Download and install WinDBG.

Part 3: Setup WinDBG as a server to solve BSOD -- Configuring WinDBG

Part 4: Setup WinDBG as a server to solve BSOD -- Troubleshooting if dump file is not generating

Part 5: Setup WinDBG as a server to solve BSOD -- Setting up as WinDBG as a Server

Have you ever faced BSOD (Blue screen of death) problem on your system and ever want a root cause why it is happening, well I will try here to solve the problem.

Note: for your information, I will not suggest you  to use your daily using systems or production environment, Her I have done all tests and labs on my virtual environment. I won't be responsible for any damage.

In this demo I am using 2 windows 2008 64 bit VM and 1 windows 7 VM which is set up on vmware workstation.

Part1:  What is WinDBG?

What is BSOD?

System OS crashed or halted by unrecoverable error.

What are these errors?

This could be (Faulty/incompatible) Hardware, outdated BIOS & firmware, (buggy) softwares, (could include (buggy/out dated) Drivers, incompatible patch).

How can I determine what is causing error? And what softwares are used?

WinDBG is a free debugger tool, which reads dump file.

What is dump file?

Whenever system is crashed it create dump file, and this dump file has all the answer. It contains data, (Memory Map) that was in the memory when system crashed, you can use it as a point in time to see what was in memory when system crashed.

 

 There are 3 types of dump files which are used for analyses:  

• Complete memory dump saved in %SystemRoot%\MEMORY.DMP,
• Kernel memory dump saved in %SystemRoot%\MEMORY.DMP
• Small memory dump (64 KB) saved  %SystemRoot%\Minidump

* %systemroot% is path equal to "C:\windows" for windows 2003 and later operating system.

Read Microsoft KB on for detailed information about memory dump files http://support.microsoft.com/kb/254649

You can configure windows settings which dump file you want to generate

Simply Go to start, right click computer, choose properties

Click "Advance system settings"

 Click on setting  under Startup and Recovery.

 Create a "Dump" folder under C drive, Here I am changing the path of each memory dump file path to C:\Dump, for better management and easy portability of dump files Rather than keeping default.

If you have more than 2 GB of ram you will not able to see complete memory dump in drop down list. By default system will create Kernel memory dump file, you can use drop down list and select which dump file you want to create.  

Select small memory dump (256 KB) and set dump file location to c:\dump\minidump.

Download  full PDF of this article from http://kunaludapi.weebly.com.

Get HyperV working inside vmware workstation 8

How do you get HyperV working inside vmware workstation 8?

I purchased new AMD FX series (FX-6100) CPU, I installed Windows 2008 R2 on VMware workstation then installed Hyper-V role inside it, but I failed to start VM because it was saying you need to enable AMD-V technology or it is missing, I enabled the feature in BIOS and in virtual machine settings itself. 

But I was still facing below error when tried to start VM on Hyper-V manager.

After some googling on internet I found very useful article to run HyperV inside Vmware Workstation.

Source:

http://virtualizedgeek.com/2011/09/16/nested-win8-hyperv/

followed the steps and done the necessary changes in .VMX file, added hypervisor.cpuid.v0 = "FALSE" and tried starting VM again (Shutdown windows 2008 R2 VM and then changed settings), again the same above error, I tried reinstalling and  installing all the things again, (OS, vmware workstation, VM), after frustrating 2-3 hours same error again and again. Tried many softwares to determine whether my CPU support all the virtualization features or not, everything was green

Sources

http://www.grc.com/securable.htm

http://support.amd.com/us/Pages/dynamicDetails.aspx?ListID=c5cd2c08-1432-4756-aafa-4d9dc646342f&ItemID=177

http://www.cpuid.com/softwares/cpu-z/versions-history.html

from every above softwares (inside VM and on desktop) it was clearly showing my CPU is suitable for Hyper-v. I went to microsoft site to check what are the requirements for HyperV and found solution.

http://support.microsoft.com/kb/2517374

There is a AVX feature in new CPUs (Intel and AMD) which is not supported by HyperV. to check this feature you can use tool from Coreinfo (from Microsoft Sysinternals)  or CPUID.

There is a * (star) in front of the features (instructions) means it is present and supported and - (dash) means they are not supported or not present.

To disable AVX run command from (in VM where you installed windows 2008 r2) CMD "bcdedit /set xsavedisable 1" or install patch http://support.microsoft.com/hotfix/KBHotfix.aspx?kbnum=2517374&kbln=en-us. Either run patch or run command.

source:

http://support.microsoft.com/kb/2568088

 In my case I ran only above command inside the VM, didn't install patch.

After all the settings done. I felt like piece of cake.

vSphere 5.0 Hardening Guide - Public Draft

I found very good documentation on vSphere 5 Hardening. You can download the same from below location.

http://communities.vmware.com/docs/DOC-19056

Unable to connect to vcenter inventory service...

 

You will face above issue If the actual host name or domain name of the vCenter Server machine does not match the name that was entered at installation, the service does not work. When the host name or domain name of the vCenter Server machine changes after you install vCenter Server, update the configuration information of the inventory service. by restarting vCenter Inventory Service

---

After restarting vcenter Inventory Service

 

 

You might face another issues as well if you dont fulfill below requirement while installation as metioned in my earlier blog

Installation- vsphere web client(server)

---

http://kunaludapi.weebly.com

 

Installation Vsphere Web Client (Server)

One of the new and cool features in VMware vSphere 5.0 is vSphere web client (server), which is provided in vSphere 5.0 media. It allows you to use different type of internet browsers and operating systems to connect to vsphere 5.0 servers, Sit anywhere in your office on any PC which give the freedom that you don’t need to install vpshere client (if that pc doesn’t have installed), vsphere web client is also best for VPN use.

Only limitations with vSphere Web client is plug-ins such as Update Manager, SRM etc. Currently you can’t add new datacenters and add new host or folders to it, No maps view and other some of the features, however other functionality are available monitoring, VM administration etc, to read more on this I will suggest you to check http://blog.mwpreston.net/2011/12/19/thevsphere-web-client/ 

I personally think there is a possibility as time will go vSphere web client will become more mature and replace vsphere client in future eventually.

Vsphere web client (server ) software requirement
The following browsers are supported for the vSphere Web Client:
Microsoft Internet Explorer 7 and 8
Mozilla Firefox 3.6 or later

The vSphere Web Client requires the Adobe Flash Player version 10.1.0 or later to be installed with the appropriate plug-in for your browser.

You can install vcenter web client (server), either on vCenter server or any other server with connectivity to vcenter server, here I am installing it on vcenter server.
Insert vsphere5.0 vcneter media, Media will autorun or you can go to media and run installer manually if it doesn't autorun.

Select Vmware vSphere web client (server) and press install, Once you install it with default settings.
Now if you directly try to open vsphere web client in browser you will get below error. Need to register vcenter server in vcenter web client.

On the server Go to Start>>Vmware vSphere webclinet>>vSphere Administration Application or open below link in web browser to configure (register vcenter server in web client(server))

https://localhost:9443/admin-app
(Localhost is where you have installed vsphere web client)

Click register vcenter vCenter Server as below screenshot.

 

In next screen provide information like vcenter servername or IP and administrator username and password. and web client server name or IP where you have install we client server, in my case I have installed web client server on vcenter server. 

After providing information and clicking register it will start registering. Make sure all your DNS entries are configured currect (Reverse DNS also).

You get successfully connected to vcenter server, which show certificate warning, you can check install this certificate box and ignore it. so it won't bug you next time. (if you have configured Certificate Authority you can use the same).

Next screen shows your have successfully registered vCenter server.

Now its time to check web client. Open below link in supported browsers
https://vspherewebclientserver:9443/vsphere-client

 Install below activex which is published by vmware for better enhanced experience.

Choose server where you want to log in, enter vcenter server credentials,  and you are done, press login.

 Firsts screen after login.

http://kunaludapi.weebly.com

Reset IBM IMM (Integrated Management Module) also called IBM RSA

Useful links: 
Find iLo, Drac, IMM/RSA, CIMC IP and MacAddress on esxi (vCenter)
Reset the remote console (DRAC/ILO/RSA)
 

You might have faced issue with IBM IMM (Integrated Management Module) also called IBM RSA that IP address or IMM name (simmilar to host name) is pinging but you are not able to open webpage. It is painful in the situation when you want to perform reboot, any firmware upgrade, to check server os status from remote location, To sort out you need to reset (restart) IBM IMM not server.

follow below steps to reset IBM.

Open command prompt (you can use putty as well, here I will demostrate with Microsoft command prompt)

Start >> run >> cmd

Type Telnet appending by your IBM IMM IP address or IMM name press enter.

Telnet xxx.xxx.xxx.xxx

or

Telnet IMM_name

Enter user login (userID) and password.

Now on next screen type resetsp and press enter  to reboot IBM IMM as below screenshot.

resetsp

It will loose connection for 1 or 2 min.

Open IBM IMM ip in web browser, and its done.

Powershell -- Enable/disable LAN card

***************************************************************************

$network = get-wmiobject win32_networkadapter | where-object {$_.netconnectionID -like "*IBM USB*"}

$network.disable() ##use enable() to enable card.

***************************************************************************

How did I find above script.

Above script is not much great, anyone can find it, but here I am posting it for beginners, who have some foundation knowledge but don't know where to begin, so here are some of the pointers. I even posted how I went wrong and how I corrected myself. 

Here i go.

 

Get-WmiObject

Gets instances of Windows Management Instrumentation (WMI) classes or information about the available classes

I usually use Get-WmiObject to query hardware information, after putting series of below wrong command,

c:\get-wmiobject | where-object {$_.name -like "*network*"}

c:\get-wmiobject list | where-object {$_.name -like "*network*"}

Got my mistake where I am wrong and ran below command. which gave me huge list of classes (objects)

c:\>get-wmiobject –list

c:\>get-wmiobject -list | where-object {$_.name -like "*network*"} #To find only network related classes/objects

Tried first object, win32_networkadapter (I thought this will be the same object as I want, where I can find network adapter information) and ran   

c:\>get-wmiobject win32_networkadapter

Ran series of command to find network adapter name “IBM USB”  but no success.

c:\>get-wmiobject win32_networkadapter | ft –auto

c:\>get-wmiobject win32_networkadapter | where-object {$_.name -like "*IBM USB*"} # * used as a wild card

Ran get-member to list properties and method for win32_networkadapter class.

c:\>get-wmiobject win32_networkadapter | get-member

But still I was not sure where can I find property containing “IBM USB” and tried some of the properties

c:\>get-wmiobject win32_networkadapter | ft name

c:\>get-wmiobject win32_networkadapter | ft systemname

I got an idea, and exported all the properties in csv file, after lots of spelling mistakes and wrong commands I successfully captured data.

c:\>get-wmiobject win32_networkadapter | ft * | exprot-csv -path test.csv # Spelling mistakes (exprot-csv)

c:\>get-wmiobject win32_networkadapter | ft * | export-csv -path test.csv # Ft command not needed here

c:\>get-wmiobject win32_networkadapter | export-csv -path test.csv #success

I opened test.csv file and found NetconnectionID is the property where I can find desired network adapter (This is the only column contains "IBM USB"), again did some more mistakes, and I was getting either null data or errors.

c:\>get-wmiobject win32_networkadapter | where-object {$_.netconnectID -like "*IBM USB*"}

c:\>get-wmiobject win32_networkadapter | where-object {$_.netconnectID -match "*IBM USB*"}

c:\>get-wmiobject win32_networkadapter | where-object {$_.netconnectID -match "*IBM USB*"} # spelling mistake ($_.netconnectID)

Ran below corrected command and compared Macaddress from powershell console and network adapter GUI, both were same.

c:\>get-wmiobject win32_networkadapter | where-object {$_.netconnectionID -like "*IBM USB*"} 

To find out how to enable or disable this network card ran get-member.

c:\>get-wmiobject win32_networkadapter | where-object {$_.netconnectionID -like "*IBM USB*"} | get-member

 Final Script as below, saved networkadapter details in variable called "nic" then tried it with Disable() to check and it worked, to enable card use enable() method. once you enable or disable verify it from network connections in control panel.

c:\> $nic = get-wmiobject win32_networkadapter | where-object {$_.netconnectionID -like "*IBM USB*"}

c:\>$nic.disable()

When running this script open network connections and you can check results.

***Have a nice scripting***

 

Export get-member data to csv file

Each time I was running get-member to get properties or method i was getting huge list, and searching through required property or method or reading definition was a headache in Powershell console.    
If you export all data to CSV it is convenient to make note and preserve your findings, command in CSV files.

************************************************************************
$process = get-process
$properties= $process | get-member
$properties | export-csv -path c:\scripts\test1.csv
************************************************************************

Earlier I was running below script to get data exported to CSV file, but every time I required to format data (Open CSV; copy all contents to notepad, then rename notepad extension .txt to .csv)

************************************************************************
#Open test.csv; copy all contents to notepad, then rename notepad extension .txt to .csv
$process = get-process
$properties= $process | get-member
foreach ($prop in $properties) {$final += “`n” + $prop.name + ", " + $prop.membertype + ", " +  $prop.definition}
$final | out-file c:\scripts\test.csv
************************************************************************

It seems that when I extract data from $properties ($prop) it goes into string format. I am trying to figure it out. Once I get solution I will post it.
Currenlty I am reading Master-PowerShell | With Dr. Tobias Weltner, Free to download as a PDF. It is really a great source to self study.