window.dataLayer = window.dataLayer || []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config', 'UA-16803030-1');

Active Directory Authentication – Accountability in ESX / ESXi 4.1

As a part of TBL professional services datacenter practice, I perform many health and security checks on virtual infrastructures for clients. One of the common issues that I run into is the use of the default “root” account for administering ESX servers. This is an issue for two reasons:

  • The “root” account has a tremendous amount of power and the password for it is typically the same shared password on each ESX host.
  • If all administration is done with the “root” account there is no audit trail for accountability. It could have been Joe, Bob, or Sue that logged into the ESX host. You just don’t know.

Of course, most administration should be done through vCenter, but you still occasionally need to log into an ESX host directly. The solution to this that I have recommended in the past has been to create local user accounts coinciding with the Active Directory user name on each ESX host. Then do not use root unless absolutely necessary when performing administrative tasks directly on the host. However, this meant that the IT Administrators would need to manage user accounts in Active Directory and the local accounts on the ESX / ESXi hosts.

There has been a “less than ideal” solution to Active Directory authentication for quite a while (see Scott Lowe’s article). However, this solution was very laborious, involves the command line, and only worked on ESX Classic. Not ESXi.

With the release of vSphere 4.1, native Active Directory authentication is one of the many new features. Here’s how easy it is to implement once you have ESX installed.

  1. Connect to your ESX/ESXi server with the vSphere Client.
  2. Click on “Inventory” and highlight your ESX/ESXi server.
  3. Click on the “Configuration” tab.
  4. Navigate to “Software –> Authentication Services”
  5. Click on “Properties” on the right hand side.
  6. Change the “Directory Service Type” from “Local Authentication” to “Active Directory”
  7. Once you do that and enter in your Domain, click “Join Domain” and you will be prompted for appropriate credentials to join the domain.
  8. Click “OK” when you are done.

 

b32a89fc3fe59da7f97e0d5161682bd2

 

That’s it! Now you can have accountability controlled through Active Directory Authentication. Joe, Bob, and Sue can all use their respective Active Directory accounts for authentication. Accountability!

 

b7526b6a8ee694da6aecb6faa7a34f69

 

Permissions can now be added for Active Directory users and groups as well.

 

2ad89b1a177a280224ead207b4a7dafc

You can even use it with the vSphere CLI and the Direct Console User Interface (DCUI) on ESXi.

499e10ac868f1254e7260d133ef58c7a

Should you still need the local “root” account for emergencies, it will still be available to you. Otherwise, do your company a favor and maintain an audit trail for administrative actions on your infrastructure.

Here’s a New Term…

I try to read a lot of blogs, books, and articles that provide insights into what is going on in the market and how we in the technology business can help our clients best adjust to evolving economic, consumer, and technology changes. I’d love to claim credit for this new term and am a bit frustrated that I didn’t think of this before given some of the blog entries I have posted…

People speak and write of “the new normal”  when describing the horizon for our business and economic future. I read an article this week that described instead “The New Abnormal”.  The net of the article was that there really is no “normal” but that there is a new abnormal in consumer behavior that is odd (abnormal) given all we know about the state of our tepid economic recovery and the worries about profligate government spending. The new abnormal is characterized by families taking expensive vacations to exotic destinations and then worrying about saving money by eating out at McDonalds or shopping at Target…while at an exotic port of call. Further evidence of the new abnormal can be seen in the sales results of high end car companies like Mercedes and BMW who are reporting excellent sales volumes, while dollar stores are simultaneously thriving. I think on the way home I may swing by a Dollar Tree store to see how many new Mercedes and BMW’s are parked out front.

I have not sorted out the direct correlation of the New Abnormal for our business and for our clients yet, but it seems to me on the surface to be another pillar supporting the case for massive business agility. I hesitate to make yet another connection to cloud computing in all of this, as everything up to and including the rodents eating in my garden seem to be drivers for cloud computing. However, I think this underscores what we have discussed with our clients that the unpredictability of the future of markets and the economy has never been higher. Ironies in consumer behavior may not be a basis for an I/T infrastructure decision, however the schizophrenic nature of the economic cycle that drives such consumer behavior may be. We stand by our recommendations to our clients – optimize what you know, plan for what you anticipate, and prepare to be wrong. Therefore, make investments that are fluid, that can expand and contract with your infrastructure needs. The great news in all of this is that technology exists today to help you prepare for any economic outcome…and by any historical measure, that is indeed abnormal.

Order Takeout or Spin Up Servers?

I had lunch with a local CIO today. This was an ideal event as there were no pending deals on the table, no crisis to mend, no specific “ask” from either party. It was simply lunch to catch up and discuss the ideas of the day. I love these types of meetings because when there is no pressing agenda to cover, the ideas flow. The only thing that might have lubricated the conversation further would have been a nice glass of 12 year old scotch…but we all eventually had to get back to work, so sobriety was a companion in our discussions….for better or worse:)

During our conversation, our lunch guest made the following comment…”it takes me longer to get Chinese takeout now days than it does to spin up a new server.” He elaborated on what made this possible, but the really interesting discussion revolved around what does this mean for business. It was his view, and I completely agree, that it is easy to get caught up in the tactics of virtualization – capital and operational cost savings, data center reclamation, energy savings, etc. Heck, I have written a couple of blog posts that speak to these tactics. He submitted that when we get wrapped around the axle about tactics, it is easy to miss the bigger opportunity with virtualization which is virtual operations. Virtualization can certainly cost justify itself on tactics, but more importantly, it can revolutionize your business operations and redefine what is possible. What if all of your servers and all of your desktops were no longer devices, but rather files – that can be accessed anywhere, anytime on a thin client, tablet device? What could you do with your business processes, worker productivity, customer satisfaction, business continuity? I don’t know the answer for your business specifically, but I can state with 100% certainty that it would make them better, and not just incrementally better, but lots better. 

Virtualization changes everything, it affects everything, and it can improve everything. Interesting conversations discuss how many servers or desktops you can consolidate in your operation and how many kilowatts and RU’s you can save in your data center. Innovative conversations ponder how virtualized servers, desktops, and storage can change the way you do business and set your operations, services, and value propositions well apart from your competitors. As I have posted before, the job of firms like TBL is not to sell you products, but to deliver ideas that have the potential to impact the nature of your operations and your business.

Ten years ago, when I ordered Chinese takeout, I could get it in about 45 minutes. Ten years ago when I wanted a new server, it might take me a month to get it up and running. Today, it still takes 45 minutes for takeout to arrive, but while waiting for my takeout, I can spin up 4 new servers and have them running before I tip the delivery person. How does this change your business? What are your competitors doing with this new technology? What new services could I deliver in this scenario? Virtualization and optimized operations….it’s what’s for dinner.

This Kind of Leverage Does Not Come Around Very Often

The exciting and also the maddening thing about working in the technology business is the frenetic pace of change and the rapidity with which new technology is introduced and then delivered to market. What technology is impactful for my business and what is merely interesting? I think a lot technology “innovation” falls in the latter category and may be nice to have in the organization some day…when I get around to it. However over the course of technology-time, there are a few product introductions that impel a business executive or technology leader to stop and consider whether this new technology represents an inflection in the market and/or a potential point of differentiation for my business. The CIUS introduced by Cisco may be one of those potential points of differentiation. http://www.cisco.com/en/US/products/ps11156/index.html?POSITION=SEM&COUNTRY_SITE=us&CAMPAIGN=HN&CREATIVE=Cius&REFERRING_SITE=Google&KEYWORD=cisco+cius

I don’t think the CIUS by itself is the point of differentiation for business. Rather, I think that it ties together multiple, strategic yet disparate technology initiatives into a rare “ah-ha!” moment for businesses is what makes the CIUS more than worth a look. While we are just getting the specs on CIUS (and we at TBL are scrambling to get one into our lab) on paper and through demonstrations, it looks like the glue that may bind several I/T investments together. The CIUS can be your desktop, your office, your phone, and your telepresence essentially in a device of similar size and demensions of an iPad. Designed for business, the CIUS will connect via any wireless protocol and also via carrier 3G and 4G networks. If I have a mobile workforce, if I have Cisco Unified Communications, if I am thinking about virtual desktops, if I am considering private cloud as means for service delivery for my business, then I just found a device that can serve as the “catcher” for most any technology I care to pitch to my end user community. One other cool thought about this device as a “desktop” of choice for the truly productive worker in 2011 and beyond – through VMware, I can provide secure, encrypted connectivity for the CIUS user without stressing or without having to use current remote access infrastructure. I can certainly leverage my current VPN infrastructure, but what if I want to get out of the remote access business and leverage the VMware tools instead? That might be cool. What if I was looking to have to refresh 500 laptops for salesman who log hundreds if not thousands of calls into my PC help desk for access, virus, and application issues? What if their “laptop” was a virtual image presented to a CIUS instead of a costly, support-heavy traditional device? And what if the CIUS could also give them high definition video capability? What is this device could “dock” and also be their desk phone? What if there were apps and connections I could write that delivered secure connections into my customized salesforce.com protal? This is starting to get pretty interesting. And the really cool part is that all the investments I made in Cisco UC, VMware, and Cloud Computing just got more valuable through a better access device.

I think this is where I am supposed to come up with an analogy to illustrate the fact that the CIUS leverages up most any investment you have made to your communications and applications infrastructure over the past 5 years…but one escapes me right now, so I will post a good one when it pops in my head, probably over the weekend cutting the grass.

Markets, Uncertainty, & Your Business

Unless you are in Las Vegas tossing dice in the craps pit or flipping cards at the blackjack table, most people, especially most business people don’t like risk and they detest uncertainty. In the Vegas example, risk is contained – limited to the size of my current bet and hopefully the depth of my good judgment. (On a personal aside, while I am not a big gambler I always calculate the value of my free drinks in my Vegas cash out reconciliation:))Uncertainty however, is not a concern in Las Vegas, because I know the rules and trust the system. While my returns are uncertain to be sure, the way the games are played are well known and understood. In short, risk and uncertainty in Vegas have a finite and measurable impact on my net worth.

There is a subtle but very important distinction between risk and uncertainty. Risk implies a risk/reward relationship. While there is a downside to something that might be considered risky, there is also a measurable upside – a return that should be commensurate with the downside risk. Boeing took tremendous risk when it embarked upon its project that would, in retrospect, completely outflank its competition with the then revolutionary Boeing 747. While there was clearly great risk (it almost bankrupted the company) there was also a very large upside which delivered strong financial returns to Boeing investors for several years.

Uncertainty on the other hand, is almost all downside. Uncertainty is looking in the abyss and seeing only darkness looking back. It is a driver of inaction and retreat. It is the one thing that business and markets almost universally detest. Uncertainty is manifest not in an inability to predict the future directions of the stock market or interest rates. Uncertainty is a fear in the fundamentals of the market and of the rules of the game.

I think this important to consider because as a nation and an economic community we are facing a potential stretch of uncertainty. We are not certain how all of the changes that have been enacted in the past 24 months are going to impact the rules of our markets and the players in our game. We can guess, but for the first time in a long time the influence of the government is totally unpredictable, the state of economic activity abroad is not reliable, and the impact of legislation both passed and proposed is not well understood and therefore uncertain.  

While all of this sounds a bit scarier than I intended, I think it may be reality for a while. I also think those of us in the technology business can help. The I/T industry is unique among industries competing for business investment because we help businesses and organizations invest in and optimize themselves. Our results and impacts can be pretty well quantified and predictable over time. I/T projects,in a time of great uncertainty, allow you to invest in what you know best…yourself, your business, and your colleagues.  From virtualization of servers and desktops to driving rich collaboration over your existing network, I/T can make what you do better, more efficient, and more adaptive to uncertain market conditions. While I am no market guru and certainly no predictor of economic direction, I feel comfortable in speaking with our clients about their investment strategies in their business, recommending that they look to optimize themselves beyond what was “best of breed” but a few short years ago. There is little uncertainty and little risk in driving costs out and productivity into your business or organization. That is what we do for a living at in the I/T industry and at TBL Networks.

While risk is inherent in any business activity and levels of market uncertainty will ebb and flow, we know that the drum beat of technology has been smaller, faster, cheaper for the past several decades. Instead of worrying over things we cannot control, take a hard look at optimizing the things you can control. Optimize your infrastructure to thrive in any market condition. While maybe not as much fun as an evening at the craps table, it is likely to yield better results that last for a longer time…and you don’t have to calculate the value your free drinks to figure out if you broke even:)

The Fight to Cure Cancer

While sometimes the phrase is used in a joking tone, when the phrase is appropriate, it really is great “when a plan comes together”.

A hallmark of TBL Networks is that we are power users of the solutions we recommend for our clients. Early in 2010, TBL was facing a decision about the compute platform of choice for the TBL enterprise. While there were less expensive options available in Cisco’s Unified Computing platform, deep down we knew that the B-Series chassis from Cisco was going to be a strategic platform for our clients, so we decided to make it the strategic platform for TBL. Running in our “T-Block” TBL has dual B-Series chassis that we use for TBL production and demo systems as well as a sizable sandbox for our clients to test their workloads on the Cisco B-Series. Even with these defined workloads, we found that we always  had unused compute capacity idling in our data center. Enter the World Community Grid. http://www.worldcommunitygrid.org/ 

The World Community Grid allows those with idle compute capacity to donate it for use in research projects ranging from cancer research to clean energy. Based on some personal connections at TBL, we have decided to focus our capacity primarily on the fight against cancer, but our capacity is available to all Community Grid projects when the cancer research teams are not sending work to TBL.

So what are the results to date? Leveraging our investments in VMware (remember the “plan coming together?”) TBL has built 40 virtual servers that are crunching numbers and providing results to a variety of cancer research teams. Additionally, TBL has provided processing power to projects fighting muscular dystrophy and AIDS. In a just under 2 weeks, through the convergence of tremendous compute capacity in the B-Series and virtualized server operations, TBL has provided over 200 “compute days” for the Community Grid which yields a multiplier of almost 14 compute days for every calendar day. At this sustained rate, at the end of 2010, TBL will have provided more than 7 years of computing power for the Community Grid and the effort to cure cancer. As we write this release and as you read it, 40 TBL virtual servers are crunching numbers in the fight against cancer. TBL is thrilled to have the opportunity to donate this capacity to researchers who we hope will someday end the scourge of cancer in our lifetime. It really is great when a plan comes together!

VMware Business Continuity Competency

TBL Networks is pleased to announce that it has achieved another competency with our strategic partner VMware. In our efforts to best serve the evolving needs of our clients, TBL has achieved the VMware Business Continuity Competency.  As virtualization becomes more and more pervasive in our clients operations, TBL sees the opportunity for our clients to optimize and energize their business continuity strategies. As one of only a few local firms holding this this certification, it is further evidence that TBL continues to invest in the leading edge skills and resources that help our clients operate in the most effective manner possible.

What do you expect from your I/T Vendors/Partners?

Maybe a better question is what should you expect from your I/T vendors and partners? Unfortunately for all of us who make a living selling and deploying technology-based solutions, expectations over time, thanks to over-zealous sales teams and over-reaching companies have boiled expectations down to “least common denominator” expectations that devalue what we do as professionals and frankly handcuff the value we deliver to our clients. Over the years I have heard comments from prospects and clients about what they want from their vendors and partners. It is easy stuff, almost silly stuff when you think about it. I have heard things like: “be responsive…do what you say you are going to do…be available when we need you…know something about our business before you make recommendations” Ouch! These aren’t very high hurdles to clear. However, for some they apparently represent the zenith of relationships with their technology vendors and deployment partners.

It pains me to see the bar for our industry set so low. On the surface it makes our jobs seem pretty trivial and frankly pretty easy. “Do what you say you are going to do?…know my business?” When these are the expectations from customers, it makes it pretty hard to elevate the conversations to something more impactful than being the low-cost provider of commodity products and services. I hate for all companies to get caught up in the short-sighted, self-serving actions of a few, but it appears to be where are today.

In my humble opinion, the expectations of good partner performance as noted above are not even worthy of discussions. They should be assumed. If we don’t do our homework before we show up on site, we should not be asked back. If we over promise and under deliver, we should be held accountable to meet our obligations…before we are shown the door.

The disappointing realization in shortcomings of these low expectations is that I/T is and should be incredibly relevant to most every business and organization today. There are tremendous efficiency opportunities and differentiating technologies today that can improve operational effectiveness while at the same time improving customer service and delivering new customer offerings. The value I/T can bring to every business and organization is far too impactful to be relegated to the lowly expectations of simply showing up on time.

It is my firm belief that what you should expect from your technology vendors and deployment partners is a flow of ideas. I/T is our job. It is what we do for a living. It is what we know better than anyone in the world. It is our job to dream on your behalf and present our ideas and our supporting evidence of how our ideas will positively impact your business and your operations…not some generic business case pulled off a vendor website. I am not against the generic business case as a baseline for a discussion. However, if we are doing our job right, it is a short leap for us to take our ideas and customize them for your business, delivering original content and new ideas and let you decide if we are on the right track. I tell my sales team, in 25 years in this business, I have never had a client get upset with me for bringing them a new idea for their business – even if they did not implement our suggestions. New ideas that are founded in good business logic, supported by an understanding of our client’s business, and wrapped in our enthusiasm and passion is our business and IMHO is what our clients should expect from their technology partners. That should be the baseline expectation. Then the shootout between competing firms is who has the best ideas and the most impactful strategy. The expectation of clients in our industry ought to be much more about who “gets my business and has most creative strategy” instead of who showed up on time.

What I did over Summer Vacation

TBL recognizes that for K-12 Information Technology Teams, “summer vacation” is really the “summer busy season” when major projects that cannot be done during the academic year are stuffed into a 90 day window.

This summer is looking to be especially busy, especially for schools with PC labs. Microsoft is withdrawing support for Windows 2000 and XP SP2 on July 13th, 2010. Making matters worse, many PC lab workstations are not capable of running the software in the suggested upgrade to Windows 7.

Are you looking at a refresh of your PC lab this summer? If so…STOP! There is a better way and a better use of your scarce capital and human resources, both over the coming summer as well as in the coming academic years.

TBL is currently working with schools who are going to break the cycle of the PC Refresh and virtualize their lab infrastructure. We are going to make sure that this next “refresh” of the PC lab, creates a better learning tool for students, a less administration intensive work environment for I/T staff, and extends the capital investment for your school well beyond that of normal I/T assets.

Through Virtualization, TBL Networks can help you:

  • Extend the life of existing or new PC Lab Assets well beyond a traditional 5 year cycle
  • Eliminate the stress and non-productive work associated with “Patch Tuesday”
  • Create a more consistent, better performing learning environment for students
  • Drive costs out of PC Lab Operations

Before you spend another nickel on your PC Lab, TBL Networks can perform an assessment for you to size a virtualized PC Lab environment that will bring your PC Labs under centralized control, unifying the student experience.
Please feel free to Contact TBL Networks to schedule a free consultation to discuss how virtualizing your PC Labs can make for a great “summer vacation”.

David Rayner – 804-822-3645 drayner@tblnetworks.com

Stop the Madness

“Stop the madness” has been a marketing moniker for several campaigns over the years, most notably in the 1980s during the Reagan administration as a slogan to drive an anti-drug message to kids. It has also been used to peddle diet strategies among other less altruistic endeavors. It seems to me that this phrase may be applicable to the I/T business as well. Maybe we aren’t stopping the madness, but maybe we can “break the cycle” instead; a cycle which can certainly be expensive and maybe even maddening if repeated enough times.

Technology refreshes have been a part of the technology business since its inception. Smaller, cheaper, faster systems have replaced existing ones as Moore’s Law has worked its magic over the past 40 years. However, a refresh is not a refresh. That is, all refreshes are not created equal. Some refreshes are really upgrades to core systems. Existing systems have run out of capacity, response times are suffering, more/better cycles are added as workloads grow in scale and complexity. Such a refresh is probably properly categorized as a “good” refresh. Business is growing, transactions are increasing, services are expanding, so more capacity is needed. A refresh that is not quite as good, nor seen as positively by those who control the purse strings are the desktop refreshes and some WINTEL server refreshes. Typically, these refreshes are driven by the hardware assets’ incompatibility with new software. Rarely is the asset out of processing capacity, in fact as we all know, non virtualized servers and desktops rarely run at more than a fraction of their processing capability. Yet, the refreshes of these systems march dutifully on year after year in our industry.

Think about the desktop or server refresh process and more importantly, the results to the business. Assume I have 500 desktops in my organization that cannot run Windows 7. Further assume that as an organization I would like to be able to run the newest version of Windows in my organization. Just using some internet pricing for a midrange desktop and no peripherals, I will spend roughly $ 599 per desktop or $ 299,500 for new hardware. Adding in new software licensing costs, labor costs to build, install, and deploy each new machine and my refresh costs are pushing $ 500,000 and possibly beyond.

Consider the real world activity and realities behind this process. I have twisted my CFO’s arm for $ 300-500K to fund the products needed to refresh my desktops, I have deployed my scarce I/T resources to build and install 500 new desktops. At the end of the day what is different about my business and the experience of my end users? Well, the organization is out of pocket a lot of money….and well….my users have new desktops that can run the latest software versions….at least until the time comes when they cannot.

At this point I would ask you how long your organization has been in the desktop technology business. 20 years? So, if your firm is on a 3 year refresh cycle you have gone through this process 6 times, and you are getting ready for a 7th. If you are on a 5 year refresh cycle you have gone through this process 4 times….the process being – beg for funding, buy new gear, build and install new systems, have it run at a fraction of its processing capacity for the duration of its useful life, reach a point where you want to provide new hardware, go to step #1. Wash, rinse, repeat. Remember the reference phrase in the introductory paragraph?

The good news is, through the miracle of technology advancements, there is a better way. Desktop virtualization is not new, but it has matured to the point where it is a viable, and I would submit, an optimal strategy for managing your technology refresh cycles. Management tools, bandwidth optimizing protocols, and very strong, inexpensive desktop technology makes virtualizing the desktop well worth a look when you are facing your next desktop refresh. Want to run Windows 7? Great, install it on your server in your data center and push it to your virtual desktops. The reality of the virtual desktop I like the most is that in the virtual world you create a “reusable unit” in the virtual machine or desktop that lives on regardless of the underlying hardware. What I further like is that I can either keep older “out of date” desktops in place until they roll over and expire or place very inexpensive thin devices for my users that have a useful life well beyond a new desktop because the thin workstations cannot, nor will they ever run Windows 7, Windows 8, or Windows 14. They are presentation devices driven by the virtualized assets running in your data center…where they belong. Have you ever had an end user PC crash and find out that their last successful back up was sometime last year? Let me rephrase that, have you ever had an end user PC crash when the last successful backup was not sometime last year? What is the value of having all of your desktop images served, managed, and backed up by your professionals in the data center…from the data center. When was the last time a virus infected a desktop and was suddenly infecting every machine on your network and crunching the CEO’s laptop as he prepared for the quarterly earnings call with Wall Street? More great news here, when a virtual machine gets infected and goes haywire, guess what you do? You kill it and simply restart it…it cannot spread its infection to the rest of our users, saving them time and you lots of headaches and remediation cycles. I know that no one talks about infections that raged through their enterprise, but when you have some “alone time” think about how nice it would have been to deal with one infection on one virtual machine instead of remediating 500 desktops, plus all the laptops that got infected as well.

Virtualized infrastructure is not a panacea. Taken in a vacuum the cost justification may not meet your hurdle rate when compared to doing “the refresh” one more time. However, when I think about the number of times I have had to do a refresh, and the ancillary costs associated with this process as well as the future costs of having to wash, rinse, repeat all over again in 36 months, virtualizing these assets makes more and more sense.

I would suggest trying this on for size. When your next PC refresh (or server refresh) is on the horizon, when you go ask for the money to fund the project, before the CFO says something to the effect of “didn’t we just buy every one new PC’s? Why are we spending $ 500k again?” submit to him/her that your are asking to fund a refresh one more time, but this time you are going to break the traditional refresh cycle. This time you are going to deploy desktop assets that don’t care about Windows, that can be depreciated over a longer period of time. You are going to create a “desktop” that leverages the investments in your data center. Your new desktops are not going to infect their neighbors. Your new desktops have a virtual image that lives beyond the asset life of the underlying hardware. You are going to stop the madness of the refresh cycle. My bet is that you will get your project funded, and might even get a “nice job” as you walk out the door with your approval. Now THAT would be madness☺