Ben Short

An Ask the DS Team TechNet blog post recently got a mention in one of the newsletters I received titled “Accelerating your IT Career“. The article has been around since September 2011.

The post is really interesting and some of the points made struck home, including the second one, as I could be considered that “expert” mentioned for a few things, as well as the point about ‘get a grip’ and the section on communication.

For all those who are working their way up in their career, I think this is an article that everyone should read and taker a step back to reflect on their personal position and whether the post highlights and home truths for you as well.

• Accelerating your IT Career

Its been a couple of months since I last posted, and it’s more because I have been just really busy with work more than anything, with not a lot of time spent on scripts. So instead I’ll post about some things I have been working on and people are welcome to do a Q&A in the comments forum:

WINS Decomission

Remember WINS? The NETBIOS name resolution service before DNS? Yea me either. It was however rather widespread throughout where I worked though, with the big problem being that the service was a window component that was installed but not managed as a service.

What I learnt about this was that ownership of WINS records are very important. where multiple WINS servers are replicating and one server is decommissioned, all the records associated with that server will remain active (at least that is what happened for me). As a result, there were some 60,000 WINS records in an environment with less than 9000 machines.

As a result there has been a project since December 2011 to remove WINS settings from all DHCP Scopes and manually removed from all Static IP hosts, and gradually decommission the WINS Service. The static IP removal was made much easier using my DNS & WINS Update script. In early March the job was complete, with only a couple of legacy servers having access to a WINS service on a machine. Only two machines out of the 9000 had issues raised, one of them being an NT4 (!) machine. Quite Successful.

Certificate Authority

My curiosity had been piqued as to why all certificates that had been created since September 2011 were all expiring on the same date. A little bit of investigation and my suspicions were confirmed – the CA Root Certificate is due to expire.

I’ve had to do a reasonable crash course in PKI and have found that when the CA was set up, it was set up as both the Root CA and the issuing CA – this is bad news. To make things even more difficult most of the information available on PKI and CA’s is surrounding OpenSSL, which does not help in a MS Certificate Services Environment. And it would seem that no-one can provide me the highly detailed information I want to know about how the Host Server <-> CA CSR <-> Root CA works in a Certificate Services Environment.

The short term fix has been to renew the Root CA – This is not the ideal solution, but a band-aid. I envisage the long-term solution will be to overhaul our CA Infrastructure with the assistance from someone who knows a lot more about PKI than I do.

Active Directory

Remarkably, we are still running our AD in 2003 mixed mode, over 12 months after the schema extensions were done to upgrade AD. As a result, I have decided to get our AD upgraded hopefully by the end of June. We are by no means a large AD site, with up to 20,000 user accounts and are sites are mostly “well connected”, yet we have 30 domain controllers. I have in recent weeks made inroads into reducing this number to less than 10.

I still have a little way to go – there are applications that are hard coded to a domain controller that need to be moved to a load balanced solution and replacing physical domain controllers, but I am hoping to have the AD in 2008 R2 native mode by the end of June.

Threat Management Gateway 2010

Work has started to replace the current ISA 2006 server that acts as a reverse proxy into our corporate network. This has required a crash course in TMG2o10, as many of us have not had anything to do with the ISA server since the person who looked after it left the team a couple of years ago. The importance of the system came to the fore when the ISA box decided to bind to a firewalled IP Address (long story, don’t ask) which meant it could no longer authenticate against AD.

So there you have it really – these are the major projects on the go, and along with the myriad of  smaller work I also need to do, there is not a lot of time left to write scripts that make people happy. If I come across something of particular interest, you can be sure I will post about it

The iLO PS Library has been updated to version 1.1.2. This release has minor bugfixes and a new function for parsing RIBCL output to obtain the CSR that is created. Latest version of the script can be downloaded of the iLO PS Page.

I have completely re-written the iLO SSL Signing Script in the last week to make use of the iLO PS Library. This has seen a reduction in script code, but more importantly with the assistance of Joe I’ve fixed a couple of significant bugs in the original script – The script will now work properly for iLO3 devices for example. Script can be downloaded from the PS Scripts Page.

On a similar note, the iLO bulk update script for mass configuration has also been updated to use the iLO Library. The result being that the output from the reports is in an object format that is much easier to manipulate in Powershell. Once again, you can obtain on the PS Script Page.

Hot on the heals of the iLO Library, I am pleased to release the Dell iDRAC Powershell Library. This is a script that you “dot include” in the beginning of any script you are writing so that you can have access to the functions.

The library is a wrapper for the Dell RACADM DRAC Tool (check out the Third Party Utils on the Powershell Scripts page to get) which is much like the CPQLOCFG.exe tool for HP.

What I find interesting is that the Dell tool is really well written for applying configuration, but can be a little obtuse about the results it returns (strings mainly), which is the opposite of the HP Tool who use XML for configuration and results information – where I find the XML for configuration a bit obtuse, but excellent for reporting…

Anyway, If you are managing a large number of Dell servers with iDRAC Interfaces in a windows environment, you may wish to take a look at this powershell library – it may be quite handy!

Click here for the Library Page

Well it appears that people rather liked the iLO Powershell Library I released last week. Now having had the weekend to relax, and time to start rewriting code to make use of it I have released a 1.1 release of the library to address some of the issues and add some additional functionality.

• Functions now have aliases to be more powershell-like. E.g Mod-iLO, Get-iLOVersion etc. Please use these instead of function names. I will be renaming the functions at a later date. The original 1.0 functions will remain as aliases for backward compatibility, but with a depreciated warning.
• New Function to Parse the RIBCL output from Mod-iLO Function. This can be used for report generation/actions.
• New Function to generate Custom Error Messages for use inline with the Parse-RIBCL* functions. Useful for exception handling.

The updated Library can be found on the iLO PS Library Page 

Happy new year everyone.

I’m pleased to release version 1.0 of the Powershell iLO Library. This script incorporates many of the pieces of code used in my scripts in a format that can be included in your own iLO related powershell code. More importantly I have made a number of improvements to the code, mainly around ensuring most functions return an object or array of objects for better result manipulation in PS. It will also mean that I can update the reusable code in one place for my scripts, instead of updating 9 scripts.

This is such a big thing for me, I have created it’s own page.

For those who dabble in powershell and have HP Servers to maintain, I think this may really be of interest to you.

Get it here:

iLO Powershell Library

Over the last week I have been having a lot of fun getting my hands dirty with the Dell Repository Manager, which is a way to store and deploy Dell firmware and drivers. One thing that did drive me a little crazy though was that no matter what I did, exporting an update bundle to an SUU from my local created repository resulted in the error “The remote name could not be resolved”.

As it turned out the error is actually a .NET Error message referring to being unable to resolve DNS. It would appear then that the Repository application is therefore treating the local repository as a network location.

Armed with this knowledge, I then did some digging around on the Dell Enterprise Technology Centre and found that the Dell Repository Manager gets it’s network settings (proxy etc) from the system (via Internet Explorer). I was on to something!. Opened IE, removed the proxy settings and restarted the application. It Worked! I was then able to make my own bundles from the local repository!

So there you have it. If you are having trouble exporting bundles to SUU packages due to the above errors, it may be worthwhile to check your proxy settings.

We’re finally getting rid of WINS at work. Remarkably we still have some production applications that require it, but that is being worked on. In the meantime I am working at removing WINS settings from DHCP Scopes and from servers where we know WINS is not required.

While DHCP scopes are easy to update, static assignment on servers aren’t. Theres no magic GPO you can set and be damned if you do it by hand for over 500 servers. Thankfully WMI as we have previously seen will allow a scriptable way to update network adaptor properties.

So I have written a script to do automate the process. The script uses Quest AD Management cmdlets for Powershell.

Download the script here

How to run the script follows

This is my first adventure in using command line parameters instead of arguments, and I am rather happy with the results.

The script run without any parameters should provide basic usage information. The -server parameter can be run for a single server or with wildcards. it will then run against computers matching the details in AD. Run without any further parameters, this script will generate a report of matching machines, DNS Settings, WINS Settings and whether DHCP is enabled. The report will also list any servers that it was unable to ping, or contact by WMI.

the -DNSServers and -WINSServers parameters are as they sound – usually a comma separated list of the primary and secondary DNS. -WINSServers can also be run with a value of ‘delete’ to remove WINS Settings.

Standard Disclaimer: This script is provided as-is and I take no responsibility or liability for any damage this script may cause in your environment

I guess this one is due for an update

Last week some helpful engineers came down to try and work out why our servers were misbehaving as they were unable to reproduce the problem in their lab.

After a bit of work, they were able to reproduce the bug on the lab machine as well as our local. It would appear that there is a bug in the LifeCycle Controller Firmware version 1.5.0.671. which only manifests itself when more than one power supply has power applied to it at the time of boot. The fault does not appear if only one power supply is powered on at boot.

Quite an interesting albeit annoying bug for very few people. For possibly 99% of people out there, they either won’t be using the unified server configurator for deployment, won’t have version 1.5.0.671 of LCC firmware installed, find the ‘lag’ an annoyance but not a showstopper, don’t have a R910 server, or are building with only 1 PSU active so won’t see the bug.

The good news is that now its a reproducable bug, it’ll get fixed. Theres nothing worse than a bug that is specific to certain machines

It’s been a long time since I have posted. One reason for that is that I haven’t gotten out much and have not been particularly inspired of late. The other reason is I am going through the family 35mm slide collection and picking out important events in Tasmania which they have captured on film.

I’ve attempted to annotate where possible, and they are on my Flickr stream, that seems a more appropriate place for them. The set will be gradually updated as I identify more photos.

Click here to visit the Moments in Tasmanian History Photoset

Happy new Year!

Photo taken from Rosny Point foreshore in Hobart, Tasmania. One of my favourite spots for fireworks display.

Nothing like a road trip to end the year. My girlfriend and I had been planning to visit Bridestowe Lavender Farm earlier in December but as time slipped away from us as Christmas approached, we decided to visit during our holidays. This turned out to be a good move as we arrived at the farm when the lavender was in full bloom and near harvest. As you can see above, the fields were a sea of mauve.

What perhaps surprised me most was that the lavender plants have a short lifecycle. I’ve had lavender plants at home for years, but many of the plants at the farm are probably less than 5 years old. Below is the “Tourist Photo”.

If you get the opportunity to visit the Bridport area of Tasmania, I strongly recommend visiting the Lavender farm, particularly around December when the lavender blooms.

The Sydney to Hobart Yacht Race has been run and won for another year (well nearly, still waiting for the outcome of a protest that is still in session at the time of writing this. This year saw a number of happy differences from last year:

• A close race between two maxis up the Derwent River.
• Large Gennaker sails being used – the wind was coming from the south.
• Wild Oats XI did not cross the line first again.
• An Evening Finish.

As you can tell I wasn’t particularly keen on yet another S2H where the favourite wins again, so it was refreshing to see LOYAL come across the line first. What a nice way to end the year in photography.

I even managed to take some video of the finish:

This year has seen me significantly wind back my photographic activities as I found myself spread across too many interests.

The year was kicked off by a trip along the upper Huon River via Judbury. This is rapidly becoming a tradition.

February was a flurry of activity with the Hobart Regatta and Wooden Boat Festival. This was followed by visiting Bonorong Park in March and a trip to Bruny Island to act as a tourist guide.

April saw the Autumn Festival in New Norfolk, and I got interested in taking long exposure photos of planes at night. Sometimes the photos didn’t come out as I wanted. This was also the first year that I had attended an ANZAC Day march and service.

I visited Bonorong Park again, but it took until June to get the photos up. I finally managed to get a good photo of the Russell Falls at Mt field and reflected on a conversation I had about whether a photo location causes IP infringement.

All of this though paled in comparison to highlight of the year – a 2 week trip to Taiwan. I took heaps of photos but they were mainly on my iPhone as I quickly found the heat of summer to hot to carry around photo gear. I did however get some nice photos of sunsets and light domes.

After getting back, I slowed down a lot. With all the new photos, I was having trouble organising them on my iDevices, so optimised my Aperture library for iDevices.

There have been a couple of things I have been to, including the RTBG Spring Festival and a trip to Lake Pedder that took me past the Sentinel Ranges, but some of the other photos I just haven’t had time to upload.

So that was the year that was. Happy Christmas and a safe new year to all, and I’ll catch you next year.

I’ve always maintained that trying to capture the colour and how immense the mountains are in Tasmania’s south west is ridiculously challenging. No photo could possibly do duty to the unique colours and textures and size of the peaks. This photo taken on a recent trip to Lake Pedder however is my new favourite of the Sentinel Range, taken near the old Lake Pedder track.

Captured in the mid afternoon, the weather ensured the sun was not bright enough to cause the deep contrasts I have normally experienced at this location, and at the same time the weather was good enough for the peaks not to be covered in rain clouds.

Every year the Royal Tasmanian Botanical Garden holds a festival to celebrate Spring, featuring food, wine, entertainment and of course the gardens. This festival used to be known as the Tulip festival but in recent years the tulips have been flowering earlier and as a result usually finish blooming by the time the festival comes around.

This has been the first time I have taken the camera out since visiting Taiwan, and suffered some challenges including forgetting an all important step-up ring for the filters I had taken with me. oops!

It was great to see the apples were still in blossom as my tree at home has finished (and I am rather looking forward to the fruit!). I often lament about how much I would like to spend vast sums of cash on my garden and get it up to a quality level I am happy with.

During lunch I sat underneath the shade of a golden elm tree as the temperatures were getting up there. it was nice to look at the sky through the tree.

It was perhaps a little early to visit the conservatory, with many of the orchids not yet in flower.

Overall, it was a fun day out, and I wasn’t the only one enjoying it.

The Dome of Light at Formosa Boulevard Station is part of Kaohsiung’s fledgling subway system, which opened barely 3 years ago. Even with an ultra wide lens open to it’s widest, I was unable to capture full dome – to do this I would have had to have stood back a fair way and this would have meant not being able to see the fantastic detail in the dome.

The dome is a popular place for wedding photos – and you can see a happy couple having their photo taken centre bottom of the photo.

It is no secret that I am a fan of all things Apple. I have at some point owned nearly every product line Apple has made in the last 10 years. It is also no secret that since 2008 I have been using Aperture for all my photo management and adjustments. To move back to PC (and therefore Adobe Lightroom) whilst not impossible would be a time consuming and tedious project.

However, Aperture interacting with the iPhone and iPad was not something I thought particularly hard about up until the last 6 months, by which point my library structure in Aperture is causing some pain. Seriously, it has taken me three years to realise how I should be using the library as opposed to how I am. This is going to be a lengthy post about all things Aperture Library.

My Current Library

I think the best way to look at this is to show you my current library. It looks a little bit like as you see on the left  and generally all the sections in the library follow this format.

In the past, as I do not actually take that many photos in a year, the best thing to do seemed to be to sort everything into a date format structured by folders. If there was a particular set of photos I had taken, I would create a manual album for them.

You’ll note that the albums have a year date next to them. Theres a reason for this – and quite simply it is a case of having far too many albums to be able to easily identify them on the iDevice.

And as it turns out, my concept of albums and projects is flawed. This is particularly apparent when you start looking at the photos on an iPad.

Albums and Projects – The Future

Lets start with Projects. Projects are the ‘Events’ seen on iDevices and in iPhoto. What they should be used for is the collection of photos relating to one particular event. They should also have a distinctly unique name within your library. They should also not be so long that you need to scroll the screen in AP3 or open the project on the iDevice to work out the photos. This is something I now plan on going back to my collection and doing.

Example of project names:

• Taiwan-2011
• SnugFalls-2009

Conclusion

So as you can see, making the decision to care about how the data in the Aperture library is stored can make a significant impact to how it syncs with iDevices. It is only now that I have decided to car enough to investigate it to realise how I should be using Aperture, and as a result another piece of the puzzle goes into place in my quest for data management. Hopefully people will find this information useful.

One of these days I will complete my post of AP3 Metadata. Metadata has been another dark art to me but something that is gaining in importance with large digital libraries.