App-V 4.6 SP1: Management Server Installation and Configuration

In this blog we have evaluated Microsoft Application Virtualization 4.6 SP1 and given the detailed step by step procedure to set up the infrastructure. The blog is divided into 3 parts:-
App-V 4.6 SP1: Management Server Installation and Configuration
Installing App-V Management Server
Windows Domain Controller
·         Windows Server® 2008 or Windows Server 2008 R2 with Active Directory Domain Services and Microsoft DNS



Microsoft Application Virtualization Management Server
·         Windows Server 2008 (32-bit or 64-bit) or Windows Server 2008 R2 (64-bit)
·         IIS 7.0
·         Microsoft .NET Framework 2.0 or higher
·         Microsoft SQL Server 2008 R2 Express Edition
o   Note: Using SQL Server 2008 R2 Express Edition is not a supported configuration for a production environment of Microsoft Application Virtualization. The Express Edition was chosen to facilitate the setup of this trial environment only. 
All of the computers must be members of a common domain. You can use virtual machines on a single physical computer that meets the system requirements of this trial.

 

Install the App-V Management Server

1.       Using an account with local administrator privileges, extract and run the setup executable for Microsoft Application Virtualization Management Server.
2.       On the Welcome page, click Next.

3.       Read and accept the license agreement, and then click Next.

4.       On the Microsoft Update page, click Next.

5.       On the Registering Information page, type a Name and Organization in the corresponding boxes and then click Next.

6.       On the Setup Type page, choose Custom install and then click Next.

7.       On the Custom Setup page, choose default all selection and then click Next.

8.       On the Configuration Database page, click the Server drop-down list and then select the list entry for this server “\SQLEXPRESS” or “local”. Click Next.

9.       On the next Configuration Database page, choose Create a new database and then click Next.

10.       On the Connection Security Mode page, click Next.

11.       On the TCP Port Configuration page, click Next.

12.       On the Administrator Group page, type the name of the AppV Adminis group and then click Next.

13.       On the Default Provider Group page, type the name of the App-V users group AppV Users, and then  click Next.

14.       On the Content Path page, accept the default location of the Microsoft Application Virtualization Management Server content folder by clicking Next.

15.       The wizard now has all the information it needs to perform the installation. Click Install.

16.       After the installation wizard completes, click No.  Restart the server.  Verify if the Application Virtualization Management Server service is started after the reboot. 

Share the content folder

1.       Open Windows Explorer.
2.       Browse to C:\Program Files\Microsoft System Center App Virt Management Server\App Virt Management Server\content and share the content folder. Ensure that Read access to this folder is given to Everyone, and Full Control is given to the AppV Administrators group.
Note: If you are using a 64-bit operating system version, the folder will be under C:\Program Files (x86)\Microsoft System Center App Virt Management Server\App Virt Management Server\content.

Publishing the Default Application

Go to the App-V Management Server:
Note: The account you are using to log on to the App-V Management Server computer must be a member of the App-V Administrators group “AppV Administrators” that you created in Active Directory.
1.       Click Start | Administrative Tools | Application Virtualization Management Console. 

2.       In the App-V Management Console, click Actions | Connect to Application Virtualization System.

3.       In the Configure Connection dialog box, deselect the Use Secure Connection check box.

4.       In the Web Service Host Name field, type the FQDN of your management server, and then click OK.

5.       In the console tree, right-click the server node and click System Options….
6.       On the General tab, in the Default Content Path textbox, enter the UNC path to the content share you created on the server during installation, \\\content.
Note: Use the FQDN for the server name so that the client can resolve the name correctly.

7.       Click OK.
8.       In the console tree, expand the server node in the left pane, and then click Applications.

9.       In the details pane, click Default Application and then, in the Actions pane, click Properties.
10.     In the properties dialog, next to the OSD Path box, click Browse.
11.     In the Open dialog, type \\\content and press Enter. You must use the actual server name here. 
Important: Ensure that the values in both the OSD Path and Icon Path boxes are in UNC format, (for example, \\\content\DefaultApp.ico), and point to the content folder you created when installing the server. Do not use localhost or a file path containing a drive letter such as C:\Program Files\..\..\content.

12.       Select the DefaultApp.osd file and click Open.
13.       Perform the previous steps to configure the icon path.

                           

14.       Click the Access Permissions tab, and confirm that the App-V Users group is granted access to the application.
15.       Click the Shortcuts tab, and then click Publish to User’s Desktop.
16.       Click OK to accept the changes for the default application.
17.       Open Windows Explorer, and go to the content directory.
18.       Double-click the DefaultApp.osd file, and open it with Notepad.
19.       Change the HREF to the following:
CODEBASEHREF=”RTSP://:554/DefaultApp.sft”.
 
20.       Close the DefaultApp.osd file and save changes.

DaRT 7.0 Installation Step by Step Guide

Step by Step Guide to Install and Run DaRT

We’re going to install DaRT on an administrator’s workstation running Windows 7 x 86 Enterprise edition and then use it to troubleshoot computers running Windows 7 that fail to boot properly. Begin by copying DaRT installer files on Windows 7 Machine.

Installing DaRT 7.0 and Windows Debugging Tools

Clicking on DaRT 7.0 (32-bit) installer launches the Setup wizard shown next. Click Next.

Click I Agree to accept the license agreement.
Click Next on the Microsoft Update screen.
Select the installation path and Click Next.
Proceed through the wizard, performing the type of install you choose.
Select the tools you want to install and Click Next.
Click Install to begin the installation.
Click Finish.

After DaRT is installed on your workstation, you should install the Windows Debugging Tools so you can access these tools when using DaRT to troubleshoot Windows 7 x86 Enterprise edition computers that won’t boot. Select the suitable download file for windows software development kit. After Clicking the Download button on the above page, the Windows SDK Setup Wizard begins.
Only select Debugging Tools for Windows and Click Next.

After installation of the Debugging Tools is finished, the All Programs group of your Start menu should look something like this.

At this point you’re now ready to create bootable DaRT media you can use to start an unbootable Windows-based computer to attempt to repair the computer.
Creating Boot Media

We’ll create a bootable DaRT CD we will use later for troubleshooting computers running Windows 7 x86 Enterprise edition that won’t start properly. Begin by launching the DaRD Recovery Image Wizard from your Start menu.
Click Next when the wizard appears.
Insert your Windows 7 x86 Enterprise product media in your DVD drive. Then on the Select Boot Image wizard page, click Browse and select your DVD drive.

On the Preparing Files wizard page, click Next.
The wizard will now expand the boot image from your Windows 7 product media.

On the Tool Selection page, you can select which tools are enabled for your local user from your bootable DaRT CD.
Here you can specify the Remote Connection Port, if any.

On the Crash Analyzer Wizard page, the wizard should have automatically found the Debugging Tools you installed previously on your workstation, so simply click Next on this page.
On the Standalone System Sweeper Definition Download page, we’ll leave the Yes option selected since we want the latest malware signature file on our DaRT CD.

On the Additional Drivers page, you can select .inf files for any drives you want to include on your DaRT CD. In most cases you won’t need to do this, but if you plan on using DaRT to troubleshoot Windows servers you may need to add mass storage drivers here. Also you may need to include network drivers for network boot. We’ll just leave this blank and click Next.

The Additional Files page lets you add files to your DaRT CD such as specialized troubleshooting utilities if you have any you want to include.

The next page shows the path to where the .iso file for your DaRT CD will be placed once it has been generated by the wizard. The default location is the desktop of the current user.
At this point, the DaRT boot image is created.

Once the .iso file has been created, the next page lets you burn the image to recordable CD media. This particular workstation I’m using doesn’t have a writable CD drive, which is why the option to burn the image is grayed out below.
The wizard now finishes.

DaRT70.iso Created on Desktop.
At this point you can copy DaRT70.iso file to another computer that had a writeable CD drive and burn the image to writable CD media. Now you are ready to use bootable DaRT CD to try and repair a Windows 7 computer that won’t boot properly.

SCCM 2007 R3 OSD Deployment

Through SCCM, OS can be deployed on multiple numbers of computers simultaneously. In SCCM, operating system can be deployed on machines using PXE boot method. This method is used to deploy OS on bare metal machines. OS deployment feature can be also used to upgrade an existing OS on the system. Multiple set of customised OS images can be created. As per the requirement, different OS images can be used for deploying on a particular set of computers.

In this section, the complete procedure for deploying OS is provided. Operating System deployment consists of the following configurations which have to be carried out as given below:-

· Installation of Pre-requisites for PXE boot method
· Installing PXE Service point role on SCCM server
· Creating a separate Collection for OS deployment
· Configuration of Boot Images
· Creating Computer Association for bare metal computers
· Capturing customised OS image from a reference computer
· Creating OS image package
· Creating Task Sequence for OS image
· Advertising Task Sequence on the Collection for deploying OS

2.1 Installation of Pre-requisites for PXE boot method

For machines on which OS has to be deployed through network boot method, the following pre-requisites are required to be installed and configured:-

· DHCP Service
· Windows Deployment Service (WDS)
· Configuring DHCP server
· Client machines should have network bootable LAN cards and PXE boot should be enabled in BIOS
DHCP server should be installed and a scope should be created for assignment of IP addresses. DHCP should be present on any one server in the network and should be properly configured.
NOTE: – Do not install WDS before installing and configuring DHCP server. Check whether DHCP is providing proper IP address to client machines in the network.

The next step is to install WDS on the SCCM server. WDS should be installed on the SCCM server only. Do not install WDS on any other server.

To start Server Manager, click: Start Menu -> All Programs -> Administrative Tools -> Server Manager. The Server Manager window opens.

  • Right click on Roles and select Add Roles.

  • Click on Next on the Roles Wizard window as shown above.

  • Select Windows Deployment Services and Click Next.

  • On WDS overview page click Next.

  • On Role Services page Select all and Cick Next.

  • On Confirmation Page. Select Install.

After rebooting the computer, go to Administrative Tools>Windows Deployment Services. WDS console will open as shown above.

NOTE: – Do not configure WDS server.

2.2 Installation of PXE Service point role

PXE Service point Role is already configured as above.

PXE service point is now installed and appears in the console as shown above.

2.3 Creating a new collection for OS deployment

Create a new collection for deploying OS in SCCM. The machines on which OS has to be installed should be moved in this collection. To create a new collection, Right click on Collections and select New Collection as shown below:-


  • In the New Collection Wizard, provide a name as ‘Kalina IT – Windows 7 Deployment’ for the new collection and click on Next.

  • Do not add or create any membership rules, since all the machines will be added manually to this collection.

  • Click on OK in the pop up window which appears on the screen as shown above.

  • Click on Next in the ‘Advertisement’ option window as shown above.

  • Keep default settings in the Security options and click on Next.
  • Click on Close to complete the wizard to create a new collection.
The new collection‘Kalina IT- Windows 7 Deployment’ is created and appears in the console as shown above.
The next step is to configure boot options in Operating System Deployment in SCCM. The boot files are present and configured in SCCM console. The boot files have to be updated to the distribution points.
After installation of PXE role a new distribution point gets created.
Boot images required for the client machines for booting and to connect to SCCM server for OS deployment are pre-configured in the SCCM server. The boot images have to be updated to the distribution points on the SCCM server. Go to Computer Management> Operating System Deployment> select Boot Images as shown below:-

  • Go to Boot Images>Boot image (x86)> select New Distribution Points as shown above.

  • In the New Distribution Points Wizard, click on Next in the welcome page

  • In Copy Package window, select the distribution points as shown above. The distribution point MUMBKCSCCM002is the default server distribution point and MUMBKCSCCM002\SMSPXEIMAGES$ is the new distribution point which gets created after installation of PXE service point role.

  • Click on Close to complete the wizard.

The distribution points are now configured and appear in the console.

Also check the package status after adding the distribution points. The package status should be ‘Installed’

2.5 Creating Computer Association

Computer association has to be created for bare metal computers on which the OS will be deployed. The information of the bare metal machines like MAC address and GUID should be provided to create computer association. The computer association creates the set of computers which will be assigned to a collection. The OS image will be deployed only on the collection in which these computers are present.

Create a csv file with the list of computer names and MAC addresses as on which the OS has to be installed and save it in a specific location as shown below:-

  • To create a computer association, in SCCM console go to Computer Management>Operating System Deployment> Computer Association as shown above.

  • Right click on Computer Association and select Import Computer Information as shown above.

  • In the Computer Information Wizard, select ‘Import computers using a file’ and click on Next.

Select the CSV file.

  • This will import the information and then click on Next.

  • In Data Preview window it will display the computer information as shown above. Click on Next to continue.

  • Click on Next after providing the collection as shown above.

Click on Next on the Summary window.

Click on Close to complete the Wizard.

Go to the collection ‘Kalina IT- Windows 7 Deployment’ and update the collection membership and it will display the computers as shown above. OS deployment will take place on this collection and only on the computers which are the members of this collection.

The next step is to configure a reference computer and capture the image. A reference computer is a machine installed with the OS and all the default applications used in the organisation. To capture the image of this reference computer, a new Build and capture Task Sequence Needs to be created.

2.6 Capturing Image of Reference Computer

To capture the image of a reference computer, a capture CD has to be created in SCCM. To create a capture CD follow the below given steps:-

  • In the New Task Sequence wizard, select ‘Build and Capture a reference operating image’ and click on Next.

  • Provide a name for the Task Sequence and click on Browse to select a ‘Boot Image’ and click on Next.

Here the boot image selected is for machines having x86 architecture.

  • In Install Windows, click on Browse to select the OS image package. Select to partition and format the target computer. Provide the product key and server licensing mode. You can also provide the local administrator’s password for the target machine as shown above. Then click on Next to continue.

  • In Configure Network window, select whether the target machines should join a Workgroup or Domain. Here it has been selected to join machines in workgroup ‘WORKGROUP’ as shown above.

  • In Install ConfigMgr tab, click on Browse and select the package for installing SCCM client agent.

NOTE: – You need to create a package in Software Distribution of SCCM for ConfigMgr client agent which is mandatory before creating a Task Sequence for OS deployment.

  • In State Migration window, since OS will be deployed on bare metal machines, remove all the check marks as shown above and click on Next.

  • In Include Updates tab, as the updates will be installed after the OS is deployed, select ‘Don’t install any software updates’as shown above and click Next.

  • In Install Software tab, you can select any other application package during the setup of OS otherwise click on Next to continue.

Click Next on System Preparation screen.

Click Next on Image Properties screen.

  • Assign the path for image to be captured. And give the account details.

Click on Next in the summary page.

Click on Close to complete the Task Sequence wizard.


The Task Sequence is created and will appear in the console as shown above. The next step is to advertise this Task Sequence on the‘Kalina IT – Windows 7 Deployment’ collection.

2.7 Creating OS Image Package

To create a package of the captured OS image, go to Computer Management>Operating System Deployment>Operating System Images as shown below.
Right click on Operating System Images and select Add Operating System Image as shown above.
The wizard will open and in the Data Source window click on Browse and provide the path for the captured OS image file as shown above and click Next to continue.








In the General tab, provide a Name and Version for the image package as shown above and click Next.

Click on Next in the summary window.

Click on Close to complete the wizard.
The OS image package is now created. Now you need to add and update the distribution point.
Right click on Distribution Points and select New Distribution Points as shown above.
Click on Next in the Welcome page of the wizard as shown above.
In the Copy Package window, select the default server distribution point as shown above. Select the default Server distribution point for OS deployment.
Click on Close to complete the wizard.
After adding the new distribution point, go to Package Status and check that the status should be ‘Installed’
Task Sequence is a set of rules or parameters used for deploying the OS. It consists of the information for pre-installation parameters required during the deployment of Operating System. To create a task sequence for the OS image package, go to Operating System Deployment>right click on Task Sequences>New> Task Sequence as shown below:-

In the New Task Sequence wizard, select ‘Install an existing image package’ and click on Next.
Provide a name for the Task Sequence and click on Browse to select a ‘Boot Image’ and click on Next.
Here the boot image selected is for machines having x86 architecture.
In Install Windows, click on Browse to select the OS image package. Select to partition and format the target computer. Provide the product key and server licensing mode. You can also provide the local administrator’s password for the target machine as shown above. Then click on Next to continue.
In Configure Network window, select whether the target machines should join a Workgroup or Domain. Here it has been selected to join domain ‘PRAZ.LOCAL’ as shown above.
In Install ConfigMgr tab, click on Browse and select the package for installing SCCM client agent.
NOTE: – You need to create a package in Software Distribution of SCCM for ConfigMgr client agent which is mandatory before creating a Task Sequence for OS deployment.
In State Migration window, since OS will be deployed on bare metal machines, remove all the check marks as shown above and click on Next.
In Include Updates tab, as the updates will be installed after the OS is deployed, select ‘Don’t install any software updates’ as shown above and click Next.
In Install Software tab, you can select any other application package during the setup of OS otherwise click on Next to continue.
Click on Next in the summary page.
Click on Close to complete the Task Sequence wizard.
The Task Sequence is created and will appear in the console as shown above. The next step is to advertise this Task Sequence on the‘Kalina IT – Windows 7 Deployment’ collection.
The Task Sequence which was created in the previous section should be advertised on a collection. To advertise the task sequence, right click on the Task Sequence and select Advertise as shown below:-
The OS will be deployed only after the Task Sequence is advertised on a particular collection. You need to be very careful during advertising the Task Sequence, since it will wipe out the complete disk and install a new Operating System on the machines.
In the General tab of New Advertisement Wizard, provide a name and for ‘Task Sequence’ option, click on Browse to select the Task Sequence. Then for ‘Collection’ option, click on Browse and select ‘OS Deployment’ collection on which the OS has to be deployed.
NOTE: –Make sure to check mark the option ‘Make this task sequence available to boot media and PXE’
If you do not check mark this option then the client machines will not receive the task sequence after booting through PXE boot option. Then click on Next to continue.
In the Schedule window, click on the flower (orange)button and a new window will open.
Select ‘Assign immediately after this event’ and click on OK to continue.
Keep the Priority option as ‘High’ and set the Program rerun behaviour as shown above.
In Distribution Points tab, select the options as shown above and click Next to continue.
In Interaction window, select ‘Show the task sequence progress’ and click Next to continue.
Keep default settings in Security page and click on Next as shown above.
Click on Next in the summary window.
Click on Close to complete the advertisement wizard.
The task sequence has been advertised on the Kalina IT – Windows 7 Deployment collection. The machines present in this collection only will receive the OS package. Go to ‘Advertisements’ in SCCM console and check that the task sequence has been advertised as shown below:-
Go to the client machines and enable the PXE boot option in BIOS. Boot one client machine through PXE boot option and check the installation of the OS. Once the OS gets installed successfully then you can deploy the image on multiple computers simultaneously.
NOTE: If OS has to be deployed across two different VLANs and if DHCP server is present in another VLAN then for OS deployment to work across VLANs you need configure the switch by adding the following commands as given below: –
ip helper-address pxeServerIPAddress
ip helper-address dhcpServerIPAddress
ip dhcp relay information trusted
A stand-alone Operating System media can be created for deploying OS image which can be done without connecting the client machines to the SCCM site server.
To create a stand-alone OS media right click on the task sequence created for an OS as shown below: –
Select ‘Create Task Sequence Media’ as shown above.
A new wizard will open. Select Stand-alone mediain select media type window as shown above.
In the Media Type option, select media size and provide the path to save the .iso file as shown above.
In Security option, remove the check mark to protect media with password and click on Next.
The next window will show the properties of the task sequence. Click on Next to continue.
In Distribution Points, select the distribution points which contain the OS image and also the boot images. Here select both the distribution points and click on the Add button.
After adding the distribution points click on Next to continue
Variables for the media are not required. Click on Next to continue.
Click on Next on the Summary window as shown above.
The media creation process will begin and this will take some time.
Click on Close to complete the creation of the OS stand-alone media.
Browse to the location of the .iso file. The Windows7x86.iso file here is ready. Burn this .iso file on a DVD and check with the installation of the Operating System. This DVD is a bootable DVD hence it can be used to deploy OS on new machines also.

————————————————————————————————————————-

Direct Access lab Issue

Troubleshooting DirectAccess Client Connectivity Problems
ISSUE: Cannot resolve intranet FQDNs (root cause)

When CLIENT1 is on the Internet, it uses encrypted IPsec tunnels to the DirectAccess server (EDGE1) to access the intranet DNS server (DC1) and intranet resources. If the IPsec tunnels cannot be successfully negotiated, CLIENT1 cannot resolve intranet names or connect to intranet resources.

In this troubleshooting scenario, you will configure the DirectAccess server to use the wrong root CA for IPsec authentication and then troubleshoot the results.


Break the configuration procedure

Follow these steps to configure the DirectAccess test lab for this troubleshooting scenario.

To configure DirectAccess to use the wrong root CA for IPsec authentication

1.       Connect CLIENT1 to the Corpnet subnet. Verify that CLIENT1 can reach DC1.
2.       On EDGE1, click Start, point to Administrative Tools, and then click DirectAccess Management. In the console tree of the DirectAccess snap-in, click the Setup node.
3.       Click Edit in Step 2. On the Connectivity page, click Next.
4.       On the Certificate Components page, under Select the root certificate to which remote client certificates must chain, click Browse.
5.       In the list of certificates, click Microsoft Root Authority, click OK, and then click Finish.
6.       Click Save, and then click Finish. In DirectAccess Review, click Apply.
7.       On CLIENT1, run an administrator-level Command Prompt.
8.       In the Command Prompt window, run the gpupdate command.
9.       Disconnect CLIENT1 from the Corpnet subnet, wait 30 seconds, and then connect it to the Internet subnet.
10.   From the Command Prompt window, run the ping app1 command. This command should display the Ping request could not find host app1 message.

Step-by-step troubleshooting

From the previous procedure, it appears that DC1, the intranet DNS server, is not resolving intranet names.

To troubleshoot this scenario

1.       On CLIENT1, from the Command Prompt window, run the netsh namespace show effective command. You should see the two DirectAccess NRPT rules.
2.       From the Command Prompt window, ping the IPv6 address listed in the .corp.contoso.com NRPT rule.
3.       From the Command Prompt window, use the nslookup -q=aaaa IntranetFQDNIntranetDNSServerIPv6Address command to resolve the fully qualified domain name (FQDN) for APP1 (app1.corp.contoso.com).
4.       You should not receive a response from DC1, which indicates a possible issue with creating the IPsec tunnels to EDGE1. The next step is to verify that CLIENT1 has established IPsec SAs with EDGE1.
5.       Click Start, type wf.msc, and then press ENTER.
6.       In the console tree, open Monitoring/Security Associations/Main Mode and Monitoring/Security Associations/Quick Mode. There should be no IPsec SAs.
7.       From the Command Prompt window, run the netsh advfirewall monitor show currentprofile command. This should display the Unidentified network in the public profile.
8.       On DC1, run an administrator-level Command Prompt.
9.       In the Command Prompt window, run the netsh –c advfirewall command.
10.   From the netsh advfirewall prompt, run the set store gpo=”corp.contoso.com\DirectAccess Policy-{3491980e-ef3c-4ed3-b176-a4420a810f12}” command.
11.   From the netsh advfirewall prompt, run the consec show rule name=”DirectAccess Policy-ClientToDnsDc” command. Note the value of Auth1CAName.
12.   From the netsh advfirewall prompt, run the exit command.
13.   From the Certificates (Local Computer)\Personal\Certificates node of the Certificates snap-in, obtain properties of the EDGE1.corp.contoso.com certificate. Click the Details tab and then click the Issuer field. Notice how the name of the CA differs from that for the Auth1CAName value in step 10.

This is the root cause of the problem. The connection security rules for DirectAccess connectivity require that the certificates being used for IPsec authentication chain a specific root CA. Because none of the certificates issued to EDGE1 and CLIENT1 chain to the Microsoft Root Authority, certificate authentication cannot complete and the IPsec tunnels needed to access the Intranet subnet cannot be established.

Correct the configuration procedure

Follow these steps to correct the configuration of the DirectAccess test lab for this troubleshooting scenario.

To configure DirectAccess to use the correct root CA for IPsec authentication

1.       Connect CLIENT1 to the Corpnet subnet. Verify that CLIENT1 can reach DC1.
2.       On EDGE1, run the DirectAccess Management snap-in, and then click the Setup node in the console tree.
3.       Click Edit in Step 2. On the Connectivity page, click Next.
4.       On the Certificate Components page, click Browse under Select the root certificate to which remote client certificates must chain.
5.       In the list of certificates, click corp-DC1-DA, click OK, and then click Finish.
6.       Click Save, and then click Finish. In DirectAccess Review, click Apply.
7.       On CLIENT1, run an administrator-level Command Prompt.
8.       In the Command Prompt window, run the gpupdate command.
9.       Disconnect CLIENT1 from the Corpnet subnet, wait 30 seconds, and then connect it to the Internet subnet.
10.   From the Command Prompt window, run the ping app1 command. This command should be successful.