博客园_空空的BLOG

RAID 1 or RAID 1+0 is recommended for the system volume in all host server architecture patterns.

RAID 1+0 is recommended for the data volumes in the Host Server Farm patterns.

Appendix H - Fibre Channel Storage Area Network

Fibre Channel storage area networks provide high speed, low latency connectivity to storage arrays. Host Bus Adapters (HBAs) are utilized by the host servers to connect to the Fibre Channel SAN via switches and directors. Fibre Channel SANs are typically used in concert with mid to high end storage arrays, which provide a multitude of features such as RAID, disk snapshots, multipath IO.

The following table show a comparison between the different connecting methods and the theoretical throughput that can be achieved by it. Some of these connection methods are for direct attached storage only and are showed here for comparative reason.

Architecture	Throughput (theoretical max Megabyte/sec)
iSCSI (Gigabit Ethernet)	125 MB/s
Fibre Channel (2 GFC)	212.5 MB/s
SATA (SATA II)	300 MB/s
SCSI (U320)	320 MB/s
SAS	375 MB/s
Fibre Channel (4 GFC)	425 MB/s

Table i: Comparison of Disk Controller throughput speeds

For performance and security reasons, it is strongly recommended that iSCSI SANs utilize dedicated NICs and switches that are separate from the LAN.

Direct attached storage or iSCSI SAN storage is recommended for the Single Host Server architecture pattern.
iSCSI or Fibre Channel SANs are recommended for the Two-Node Host Cluster pattern.
Fibre Channel SANs are recommended for the Host Server Farm pattern.

The disk controller interface determines the types of drives that can be utilized as well as the speed and latency of the storage I/O. The table below summarizes the most commonly utilized disk controller interfaces.

Architecture	Throughput (theoretical max Megabyte/sec)
iSCSI (Gigabit Ethernet)	125 MB/s
Fibre Channel (2 GFC)	212.5 MB/s
SATA (SATA II)	300 MB/s
SCSI (U320)	320 MB/s
SAS	375 MB/s
Fibre Channel (4 GFC)	425 MB/s

Table ii: Comparison of Disk Controller Interfaces

SATA II or SAS are recommended for the Single Host Server architecture pattern, with SAS being the preferred option.

iSCSI, 2 GFC Fibre Channel, or 4 GFC Fibre Channel are recommended for the Two-Node Host Cluster architecture pattern.

4 GFC Fibre Channel is recommended for the Host Server Farm architecture pattern.

Server 2008 R2 includes the first version of Windows Failover Clustering to offer a distributed file access solution. Cluster Share Volumes (CSV) in R2 is exclusively for use with the Hyper-V role and enables all nodes in the cluster to access the same cluster storage volumes at the same time. This enhancement eliminates the 1 VM per LUN requirement of previous Hyper-V versions. CSV uses standard NTFS and has no special hardware requirements, if the storage is suitable for Failover Clustering, it is suitable for CSV.

Because all cluster nodes can access all CSV volumes simultaneously, we can now use standard LUN allocation methodologies based on performance and capacity requirements of the workloads running within the VMs themselves. Generally speaking, isolating the VM Operating System I/O from the application data I/O is a good rule of thumb, in addition to application-specific I/O considerations such as segregating databases and transaction logs and creating SAN volumes that factor in the I/O profile itself (i.e., random read and write operations vs. sequential write operations).

CSV provides not only shared access to the disk, but also disk I/O fault tolerance. In the event the storage path on one node becomes unavailable, the I/O for that node will be rerouted via Server Message Block (SMB) through another node. There is a performance impact while running this state; it is designed for use as a temporary failover path while the primary dedicated storage path is brought back online. This feature can use the Live Migration network and further increases the need for a dedicated, gigabit or higher NIC for CSV and Live Migration.

CSV maintains metadata information about the volume access and requires that some I/O operations take place over the cluster communications network. One node in the cluster is designated as the coordinator node and is responsible for these disk operations. Virtual Machines, however, have direct I/O access to the volumes and only use the dedicated storage paths for disk I/O, unless a failure scenario occurs as described above.

Figure iii: CSV Volume Allocation

Appendix K - System Center Virtual Machine Manager R2 2008

Use Cluster Shared Volumes in Two-Node and Host Server Farm architecture patterns.
Allocate SAN LUNs and corresponding CSV volumes based on workload I/O requirements.
Use gigabit Ethernet or higher for all cluster communication networks, including the Private Cluster Heartbeat and Live Migration networks.

System Center Virtual Machine Manager 2008 R2 delivers simple and complete support for consolidating multiple physical servers within a virtual infrastructure, thereby helping to increase overall utilisation of physical servers. This is supported by consolidation candidate identification, fast Physical-to-Virtual (P2V) migration and intelligent workload placement based on performance data and user defined business policies. VMM enables rapid provisioning of new virtual machines by the administrator and end users using a self-service provisioning tool. Finally, VMM provides the central management console to manage all the building blocks of a virtualised data centre. Virtual Machine Manager 2008 also enables administrators and authorised users to rapidly provision virtual machines.

The VMM server is the hub of a VMM deployment through which all other VMM components interact and communicate. The VMM server runs the VMM service, which runs commands, transfers files, and controls communications with other VMM components and with all virtual machine hosts and VMM library servers, collectively referred to as managed computers. The VMM service is run through the VMM agents that are installed on the managed computers. By default, the VMM server is also the default library server.

The SQL Server database can be hosted on all versions of SQL Server from Microsoft SQL Server 2005 to Microsoft SQL Server 2008.System Center Virtual Machine Manager stores performance and configuration data, virtual machine settings, and other virtual machine metadata in a SQL Server database. For reporting, Virtual Machine Manager takes advantage of SQL Server Reporting Services through Operations Manager. Larger organisations can also configure VMM to work with a remote clustered SQL Server database and a storage-area network (SAN) or network-attached storage (NAS) system.

The virtualised data centre relies on the ability to find and maintain very large image files for virtual machines (known as virtual hard drives, or VHD files). Unlike a physical server, these virtual hard drives can be unintentionally lost or duplicated. VMM provides a complete library to help administrators quickly create new virtual machines. The library organises and manages all the - building blocks of the virtual data centre in a single interface, including:

Stored virtual machines
Virtual hard disks
CD/DVD software images, also called ISO files
Hardware configurations
Templates
Administrator Console

The graphical user-interface (GUI) allows administrators to effectively manage an environment of hundreds of virtual machines. The Virtual Machine Manager Administrator Console is built on the familiar System Center framework user interface so that administrators can quickly and easily become proficient at managing their virtual machines. The VMM Administrator Console is designed to manage large deployments with easy sorting, categorisation, search, and navigation features.

The Administrator Console integrates with System Center Operations Manager 2007 to provide insight into the physical environment as well as the virtual environment. With the ability to map the relationship of virtual and physical assets, IT administrators can more effectively plan hardware maintenance, for example.

For geographically disperse operations, distributed VMM library servers facilitate the quick transmission of assets to physical hosts at the edge of the organisation, enabling rapid creation and deployment of virtual machines in branch offices.

Delegated Management and Provisioning Web Portal

In addition to using the GUI administrator console and the Windows PowerShell command-line interface, administrator-designated end-users and others can access VMM by way of a Web portal designed for user self-service. This portal enables users to quickly provision new virtual machines for themselves, according to controls set by the administrator.

Appendix L – Hyper-V Overview

Microsoft Hyper-V was designed to minimize the attack surface on the virtual environment. The Hypervisor itself is isolated to a microkernel, independent of third-party drivers. Host portions of the Hyper-V activities are isolated in a parent partition, separate from each guest. The parent partition itself is a virtual machine. Each guest virtual machine operates in its own child partition.

These are the recommended security best practices on a Hyper-V environment, cumulative to the usual security best practices for physical servers:

Securing the communications between the Hyper-V server and its administrators and users.

Figure iv: Hyper-V Environment

Appendix M – Hardware Architecture

Hyper-V Management Server

Server Architecture

2 x Xeon Quad Core Processors x64

32 GB of RAM

2 x 150 GB (300GB) RAID 1 OS Partition with Array - SAS RAID Controller

Local or External Storage (ISCSI/FC)

Up to 4 x 1GBps Network ports (Management/Virtual/External and potentially ISCSI Networks)

Table iv: Management Host Server Architecture

Note: Optionally, the virtual management servers can be installed on individual physical servers (running Hyper-V) where necessary to allow for more scaling of resources.

The Virtualised Management Servers which will be used have the following resource requirements:

Hyper-V Cluster Nodes

Server Architecture

2 x Xeon Quad Core Processors x64

48GB of RAM

2 x 150 GB (300GB) RAID 1 OS Partition with Array - SAS RAID Controller

Optional 2GBps FC HBA (if using FC SAN)

External Storage (ISCSI/FC) – 5TB

Up to 3 x 1GBps Network ports (Management/Virtual/Live Migration/ Heartbeat and potentially ISCSI Networks) Minimum required is 2.

Table v: Cluster Host Server Architecture

Disk Storage

The Hyper-V host servers should utilise local storage for the operating system and the paging file.

The drives utilised by the operating system should be configured as RAID 1.

HBA/ISCSI Interface

Each server should be fitted with either a separate ISCSI network adapter or a single channel FC HBA to connect to the SAN.

Virtual Machine Storage

In Hyper-V R2, the performance of Dynamically Expanding disks has increased dramatically and are now viable options for production use, GPC-POC will use Dynamically Expanding disks for Virtual Hard Disks. This will reduce storage oversubscription and fragmentation.

In addition, the underlying storage should use Clustered Shared Volumes to store the Virtual Machines.

Quick Migration

All virtual machines that will be hosted on the Hyper-V infrastructure will be able to take advantage of the Quick migration feature. This will enable entire workloads to be moved between hosts in the event of planned downtime without service loss.

No guest modifications are needed or required and furthermore, Live Migration is also guest OS agnostic. The guest OS has no knowledge of a Live Migration and there are no restrictions as to what guest OS or workload can be migrated.

Operating System Version

The GPC-POC will utilise Microsoft Windows Server 2008 R2 Enterprise or Datacenter editions as these support the memory and processing needs of large-scale, mission-critical applications.

Note: To be managed by the SCVMM server, it is necessary for the Cluster nodes to be part of the same Domain and as such the Cluster can only be built after the Management Servers are in place.

Cluster Host Server Overview

Figure iv: Cluster Host Server Overview

Appendix N – References

For Deployment Scenario more details please refer to the link http://www.microsoft.com/downloads/details.aspx?FamilyID=fef38539-ae5a-462b-b1c9-9a02238bb8a7&displaylang=en and download a file VMM08R2_VMMSSPDocumentation.zip for more information.
Failover clustering documents http://technet.microsoft.com/en-us/library/cc732181(WS.10).aspx#BKMK_Install
Build SCVMM & SQLVM http://technet.microsoft.com/en-us/library/cc764289.aspx
SQL 2008 Install http://technet.microsoft.com/en-us/library/bb500469(SQL.100).aspx
http://technet.microsoft.com/en-us/library/ms143506(SQL.100).aspx
Exchange 2010 SP1 download link http://technet.microsoft.com/en-us/evalcenter/dd185495.aspx
RDP Gateway http://technet.microsoft.com/en-us/library/dd560672(WS.10).aspx
Unified Access Gateway http://technet.microsoft.com/en-us/library/dd857385.aspx
For Deployment Scenario more details please refer to the link http://www.microsoft.com/downloads/details.aspx?FamilyID=fef38539-ae5a-462b-b1c9-9a02238bb8a7&displaylang=en and download a file VMM08R2_VMMSSPDocumentation.zip for more information.
Lab Configuration excel sheet

1.2 About this Document 1

微软私有云POC部署文档

2011-10-08T05:40:00Z

Table of Contents

1 Summary 1

1.1 Introduction 1

1.3 Intended Audience 1

1.4 Document Scope 1

1.5 Constraints and Assumptions 1

1.6 Known Issues 2

2 High-Level POC Architecture 3

3 High-Level Scenarios 4

3.1 Sequence Diagram for Iaas & SaaS 4

4 Deployment Scenarios 5

5 Solution Design 6

5.1 Server Physical Infrastructure 7

5.1.1 Server Physical Machine Table 7

5.1.6 Remote Desktop Gateway Server (IBMH1) 8

5.1.7 Remote Desktop Gateway Server (IBMH2) 9

5.1.8 LENH1 9

5.2 Server Virtual Infrastructure 9

5.2.2 Active Directory Server (DC1, DC3 & DC5) 10

5.2.3 System Center Virtual Machine Manager Server (SCVMM1) 11

5.2.4 System Center Operations Manager Server (SCOM01) 11

5.2.5 System Center Self Service Portal Server (SSP-V2) 11

5.2.6 Exchange CAS/HUB Server (CH1 and CH2) 12

5.2.7 Exchange Mailbox Server (MBX1, MBX2 & MBX3) 12

5.2.8 Hyper-V Server Cluster 12

5.3 Implementation of Design 12

5.4 Private Cloud Network 12

5.4.1 Network Architecture 14

5.5 Storage 15

5.6 Backup and Restore 15

5.7 Security Considerations 15

5.7.1 End User Access to the solution 15

5.7.2 Host Operating System Configuration 15

6 Deploying GPC-POC 17

6.1 Redmond Workflow 17

6.2 Customer Workflow 18

6.3 Passwords 19

6.4 iSCSI Target Host Setup 20

6.5 Build R2 Hyper-V Core hosts 27

6.6 iSCSI Client Setup 29

6.7 Build DC VMs 35

6.8 Setting up Dcpromo 39

6.9 Failover Clustering 57

6.10 Build SCVMM & SQL VM 60

6.11 SQL 2008 Install 69

6.12 Installing System Centre Virtual Machine Manager 2008 R2 79

6.13 Individual SCVMM Install 101

6.14 DIT-SC Install 119

6.14.1 System Requirements: Single-Machine Deployment Scenario 119

1. Hardware Requirements 119

2. Software Requirements 119

6.14.2 System Requirements: VMMSSP Website Component 120

3. Hardware Requirements 120

4. Software Requirements 120

6.14.3 System Requirements: VMMSSP Server Component 121

5. Hardware Requirements 121

6. Software Requirements 121

6.14.4 System Requirements: VMMSSP Database Component 122

7. Hardware Requirements 122

8. Software Requirements 122

6.14.5 Installing the Virtual Machine Manager Self-Service Portal 122

6.15 Exchange Installation 125

6.16 Exchange Configuration 139

6.17 Document Information 143

6.17.1 Terms and Abbreviations 143

Appendix A – Hyper-V Host Server Farm Pattern 144

Appendix B – Host Cluster patterns 145

 No Majority – Disk Only 145

 Node Majority 145

 Node and Disk Majority 145

 Node and File Share Majority 145

Appendix C – Network Architecture 147

Appendix D - Processor Architecture 148

Appendix E – Memory Architecture 149

Appendix F - Drive types 150

Appendix G - Disk Redundancy Architecture 151

Appendix H - Fibre Channel Storage Area Network 152

Appendix I - Disk Controller or HBA Interface 153

Appendix J - Cluster Shared Volumes 154

Appendix K - System Center Virtual Machine Manager R2 2008 156

Virtual Machine Manager Server 156

Microsoft SQL Server Database 156

VMM Library Servers 156

Administrator Console 156

Delegated Management and Provisioning Web Portal 157

Appendix L – Hyper-V Overview 158

Appendix M – Hardware Architecture 159

Hyper-V Management Server 159

Hyper-V Cluster Nodes 159

Disk Storage 159

Quick Migration 160

Operating System Version 161

Cluster Host Server Overview 161

Appendix N – References 162

Summary
Introduction

The GPC-POC is a self-contained virtualised management infrastructure which can be deployed in a suitable environment to show the use of Microsoft Technologies in provisioning and managing Virtual Machines. This document covers the deployment details to allow the technical personnel involved in deployment the solution to understand what components are involved and how they are configured.

The GPC-POC Deployment Guide provides the information you need to prepare for and deploy the Virtual Machine Manager Self-Service Portal (VMMSSP, or the self-service portal) in your datacenter.

About this Document

This document is for Govt. Private Cloud (GPC) and provides a deployment scenario for self-service portal component guide.

Intended Audience

The intended audience of this document is the technical personnel engaged in implementing the GPC solution within their own environment.

Document Scope

The scope of this document is concerned with Microsoft technologies only.

Constraints and Assumptions

The server and storage hardware required for the GPC-POC environment is as specified by the hosting partner provided it meets the minimum requirements as defined in this document.

There are also a lot of related conditions and technologies that will have an impact on the GPC-POC working. Some of those assumptions are listed in the table below:

Assumptions	Explanation
Physical environment	It is assumed that a server environment exists with enough floor space, power, air conditioning, physical security etc.
Stable network	It is assumed that the local and wide area network infrastructure which includes physical components switches, routers, cable etc. And the logical components like routing, broadcasts, collisions etc. Are stable and under control. Having an unstable network can result in unexpected behavior.
Namespace	Maintain Isolated / Unique Namespace
Network Support	Failover / Router / Configuration needs to be performed by IT staff.
Constraints	Explanation
DHCP Required	DHCP is required for VM Provisioning
Network Bandwidth	1 GB network bandwidth
Multiple VLANS / NICS	Multiple VLANS / NICS required for Clustering, Live Migration and Heartbeat
iSCSI Hardware	Required 500 GB – 1 TB on iSCSI

Table 1: Constraints and Assumptions

Known Issues

No limitations on the number of VMs that a user can request. Potential future enhancement.
Cannot remote control a Linux machine currently (as there is no RDP connectivity). Potential to implement a telnet/X-Windows session instead in the future.
No automatic SCOM agent install for provisioned Linux machines. Potential future enhancement to include the agent in the source.

High-Level POC Architecture

Figure 1: High Level POC Architecture

POC is intended to be delivered on harddrive for installation at customer site with limited hardware investment.
It's only require 6-8 physical machines
Goal is to demonstrate IaaS & SaaS scenarios for Private Cloud deployment environment.
The POC uses a Windows iSCSI server instead of a SAN for portability reasons. iSCSI is a storage protocol used to connect to a network device that moves storage-related data. It allows clients to send SCSI commands to remote, consolidated storage targets (or disk arrays) in the same way the client can interact with a locally attached disk. A common misconception is that you can connect iSCSI over your existing LAN infrastructure.

High-Level Scenarios

High-Level Showcase Scenarios (10-15)
IaaS (Dynamic Datacenter)	SaaS (Exchange)
1. New tenant (organization) sign-up	1. New tenant (organization) sign-up
2. New environment provisioning request	2. New tenant services configuration
3. Virtual machine request	3. Tenant admin set-up
4. Virtual machine template setting	4. New user (mailbox) addition
5. Virtual machine provisioning	5. Distribution list management rights assignment
6. Reporting	6. Charge back reporting

Sequence Diagram for Iaas & SaaS

Figure 2: Sequence Diagram for Iaas & SaaS

Following are the sequence diagram steps

Business Group Customer requested for Emailbox setup for the department / organization.
Request goes to IT Aministrator of the department / organization. IT Admin enters the New Machine request through Website Form.
It goes to Data Center Admin approval for VMs aqquision. Once approved, approval mail sent to IT Adminstrator.
IT Administrator request for the VM Servers.
IT Administrator configure and installs the Exchange on VM Servers.
IT Administrator Provision and Add Tenant and Mailbox for users.
Finally the request gets completed and mail been send to BG Customer to utilize the services.
Report gets generated based on the service(space, bandwidth, etc..) usage and charge back to the department based on the usage.
1. Deployment Scenarios

This guide steps you through the deployment process for the self-service portal. It includes the following sections:

Deployment Scenarios for the Self-Service Portal Components. Describes the two primary deployment scenarios.
Environmental Prerequisites. Specifies the prerequisites that affect resources beyond the computers that will run the self-service portal components, including security recommendations.
Self-Service Portal System Requirements. Lists the system requirements for the self-service portal components in each of the deployment scenarios.
Installing the Virtual Machine Manager Self-Service Portal. Provides the steps to install the self-service portal components in each deployment scenario.
Uninstalling the Self-Service Portal Components. Provides the steps to uninstall the self-service portal components in each deployment scenario.
Next Steps: Configuring the Self-Service Portal. Provides information about the guides and other resources to use to complete the post-deployment tasks that prepare the self-service portal for normal operation.

After you complete the procedures in this guide, continue to the Virtual Machine Manager 2008 R2 VMMSSP Datacenter Administration Guide (included in the self-service portal documentation package) for information about configuring the self-service portal and setting up services for business units. For more details please refer to the link http://www.microsoft.com/downloads/details.aspx?FamilyID=fef38539-ae5a-462b-b1c9-9a02238bb8a7&displaylang=en and download a file VMM08R2_VMMSSPDocumentation.zip for more information.

Solution Design

Figure 3: Hyper-V cluster Nodes with Virtual Machine

The sections below covers the detailed configuration for the GPC-POC Infrastructure Environment.

Server Physical Infrastructure
1. Server Physical Machine Table

Base OS Server Name	Assigned Machine	Bits	RAM	CPU	Disks	Virtual Switch "Public"	Virtual Switch "Hyper-V & Exchange Replication"	Purpose
HPB1 (HPV1)	HP Blade 1	x64	64 GB	Quad Core	2 X 150 GB (300 GB)	Gigabit Ethernet External NIC1 10.1.1.x VLAN1 Corp or VPN	Gigabit Ethernet External NIC2 10.1.2.x VLAN2 Lab internal	Hyper-V (cluster) DDC (SQL, DIT-SC, SCCM, SCOM, SCVMM + Library) Exchange CAS + Hub
HPB2 (HPV2)	HP Blade 2	x64	64 GB	Quad Core	2 X 150 GB (300 GB)	Gigabit Ethernet External NIC1 10.1.1.x VLAN1 Corp or VPN	Gigabit Ethernet External NIC2 10.1.2.x VLAN2 Lab internal	Hyper-V failover for HPV1
HPB3 (HPV3)	HP Blade 3	x64	32 GB	Quad Core	2 X 150 GB (300 GB)	Gigabit Ethernet External NIC1 10.1.1.x VLAN1 Corp or VPN	Gigabit Ethernet External NIC2 10.1.2.x VLAN2 Lab internal	Hyper-V (cluster) DAS (273GB - RAID5) Exchange DAG
HPB4 (HPV4)	HP Blade 4	x64	32 GB	Quad Core	2 X 150 GB (300 GB)	Gigabit Ethernet External NIC1 10.1.1.x VLAN1 Corp or VPN	Gigabit Ethernet External NIC2 10.1.2.x VLAN2 Lab internal	Hyper-V (cluster) DAS (273GB - RAID5) Exchange DAG
IBMH1	IBM 3850 + 2 Fusion IO cards	x64	16 GB	Quad Core Intel Xeon Series 7400	2 X 650 GB Fusion IO	Gigabit Ethernet External NIC1 10.1.1.x VLAN1 Corp or VPN	N/A	Hyper-V Dual NIC gateway host for remote access AD+DNS until Lenovo server is made available
IBMH2	IBM 3850	x64	12 GB	Quad Core Intel Xeon Series 7400		Gigabit Ethernet External NIC1 10.1.1.x VLAN1 Corp or VPN	N/A	iSCSI
LENH1	Lenovo RD210	x64	8 GB			Gigabit Ethernet External NIC1 10.1.1.x VLAN1 Corp or VPN	N/A	Server missing hard drive and won't be available before week of June 21. AD+DNS

Table 2: Server Physical Machine Table

For more details on the lab configuration, please refer the Excel sheet attached in the Appendix N

HPV1

Following are the services installed on HPV1 VM Server

Hyper-V (cluster)
DDC (SQL, DIT-SC, SCCM, SCOM, SCVMM + Library)
Exchange CAS + Hub

HPV2

Following are the services installed on HPV2 VM Server. It's Hyper-V failover for HPV1

Hyper-V (cluster)
DDC (SQL, DIT-SC, SCCM, SCOM, SCVMM + Library)
Exchange CAS + Hub

HPV3

Following are the services installed on HPV3 VM Server

Hyper-V (cluster)
DAS (273GB - RAID5)
Exchange DAG

HPV4

Following are the services installed on HPV3 VM Server

Hyper-V (cluster)
DAS (273GB - RAID5)
Exchange DAG

Remote Desktop Gateway Server (IBMH1)

The Remote Desktop Gateway Server provides Secure Remote Desktop access to the Virtual Machines provisioned by the end-users.

Access Rights – Administrators and Department Users
Machine Access – Note: This is set to allow access to all machines in the environment initially but can be limited as required.

Note: The Remote Desktop Gateway Server currently uses a self-signed certificate which will need to be installed into the Trusted Root store on all potential client machines in order to allow connectivity. Alternatively, this certificate can be replaced by another which already has a Trusted Root certificate installed on the end-user machines.

Remote Desktop Gateway Server (IBMH2)

The Remote Desktop Gateway Server provides Secure Remote Desktop access to the Virtual Machines provisioned by the end-users.

Access Rights – Administrators and Department Users
Machine Access – Note: This is set to allow access to all machines in the environment initially but can be limited as required.

Note: Hyper-V Dual NIC gateway host for remote access. May host AD+DNS if Lenovo is not available.

LENH1

Following are the services installed on LENH1 VM Server

Active Directory and DNS

Server Virtual Infrastructure
1. Virtual Management Servers

The Virtualised Management Servers are pre-configured as follows and any changes to the configuration will impact on other VM Server setting:

Management Server	Machine Name	VM Network	External IP	IP Address
Active Directory Server	DDC1-DC01	Internal	192.75.183.35	10.1.1.120 Contoso.gov
Active Directory Server	DDC1-DC02	Internal	192.75.183.30	10.1.1.121 Contoso.gov
Active Directory Server	DDC1-DC03 (Failover)	Internal	192.75.183.35	10.1.1.122 Contoso.gov
SCVMM SQL Server	DDC1-SCVMM01	Internal	192.75.183.30	10.1.1.180 Ops.contoso.gov
SCOM Server	DDC1-SCOM01	Internal	192.75.183.30	10.1.1.181 Ops.contoso.gov
Remote Desktop Gateway Server	DDC1-IBMH	Internal	192.75.183.34	10.1.1.109 Contoso.gov
Exchange Server	DDC1-MBX1	Internal	192.75.183.32	10.1.1.220 Resource.gov
Exchange Server	DDC1-MBX2	Internal	192.75.183.33	10.1.1.221 Resource.gov
Exchange Server	DDC1-MBX3	Internal	192.75.183.33	10.1.1.222 Resource.gov

Table 3: VM Servers Configuration table

For more details on VM Server configuration, please refer the Excel sheet attached in the Appendix N

New Virtual Machines

All new Virtual Machines will be built on the Host Cluster and be attached to External Network 1 (the Virtual Machine Network). They will also receive a DHCP address from the AD Server.

Active Directory Server (DC1, DC3 & DC5)

Base OS Server Name	Physical Host Machine	Bits	RAM	CPU	Disks	Virtual Switch "Public"	Virtual Switch "Hyper-V & Exchange Replication"	Purpose
DC1	IBMH2	x64	12 GB	Quad Core Intel Xeon Series 7400		Gigabit Ethernet External NIC1 10.1.1.x VLAN1 Corp or VPN	N/A	Hyper-V Dual NIC gateway host for remote access May host AD+DNS if Lenovo is not available
DC3	IBMH2	x64	12 GB	Quad Core Intel Xeon Series 7400		Gigabit Ethernet External NIC1 10.1.1.x VLAN1 Corp or VPN	N/A	Hyper-V Dual NIC gateway host for remote access May host AD+DNS if Lenovo is not available
DC5	IBMH2	x64	12 GB	Quad Core Intel Xeon Series 7400		Gigabit Ethernet External NIC1 10.1.1.x VLAN1 Corp or VPN	N/A	Hyper-V Dual NIC gateway host for remote access May host AD+DNS if Lenovo is not available

Table 4: Virtual Machine with Active Directory

The Active Directory Server holds all the domain accounts for the management servers plus it hosts the following services required for the proper operation of the solution:

DNS
DHCP
- Address Lease Range – 192.75.183.30-192.75.183.150
- Scope Options:
  - Router – 192.75.183.30
  - DNS Servers – 192.75.183.34
  - DNS Domain Name – DDC1.LOCAL

System Center Virtual Machine Manager Server (SCVMM1)

Base OS Server Name

Assigned Machine

Bits

RAM

CPU

Disks

Virtual Switch "Public"

Virtual Switch "Hyper-V & Exchange Replication"

Purpose

HPB1 (HPV1)

HP Blade 1

x64

32 GB

Quad Core

2 X 150 GB

(300 GB)

Gigabit Ethernet

External

NIC1

10.1.1.x

VLAN1

Corp or VPN

Gigabit Ethernet

External

NIC2

10.1.2.x

VLAN2

Lab internal

Hyper-V (cluster)

DDC (SQL, DIT-SC, SCCM, SCOM, SCVMM + Library)

Exchange CAS + Hub

HPB2

(HPV2)

HP Blade 2

x64

32 GB

Quad Core

3 X 150 GB

(300 GB)

Gigabit Ethernet

External

NIC1

10.1.1.x

VLAN1

Corp or VPN

Gigabit Ethernet

External

NIC2

10.1.2.x

VLAN2

Lab internal

Hyper-V failover for HPV1

Table 5: Virtual Machine with SCVMM, Exchange & SCOM

The System Center Virtual Machine Manager is installed into the management network as a virtual machine; this instance manages the Hyper-V host servers and virtual machines. In addition, the administrator console and failover clustering toolset are installed for management of the server infrastructure. The Self-Service Portal is also implemented with role specific administration, as this functionality is used for accessing the provisioned virtual machines.

The Library holds a number of sysprepped images and hardware templates:

Name	Type	Notes
Server 2008 R2 Ent (x64)	Template	Virtual Machine Template for Windows 2008 R2 Enterprise Edition

Table 6: Hardware Template

System Center Operations Manager Server (SCOM01)

Please refer the above Table 3. The System Center Operations Manager is installed for providing a means of consolidated health monitoring across both the management servers and the provisioned virtual machines.

Additional Management Packs installed:

Exchange? (TBD)

System Center Self Service Portal Server (SSP-V2)

The Web Portal Server host the end-user interface to the GPC-POC .

Internal Web URL: http://Ops.contoso.gov/

Exchange CAS/HUB Server (CH1 and CH2)

The Client Access Server (CAS) role basically accepts connections from a variety of clients to allow them access to the Exchange Server infrastructure. To some extent, the CAS role has some similarities to the old front-end (FE) servers in Exchange 2010.

The Exchange 2010 Hub Transport Server role is responsible for all messaging transport inside your organization. In cases where Exchange 2010 Edge Transport Servers are deployed, the Hub Transport role hands off Internet-bound messages to the Edge Transport role for processing; it also takes inbound messages that the Edge Transport server has accepted from the Internet.

Note: CH1 is Primary and CH2 is failover server.

Exchange Mailbox Server (MBX1, MBX2 & MBX3)

Give users bigger and even more reliable mailboxes. With a unified solution for high availability, disaster recovery and backup, as well as vastly improved IO efficiency, larger and less expensive disks are now legitimate storage solutions. Users will have greater access to mission critical email and spend less time managing their inbox.

High availability can now be added without reinstalling servers, and now all aspects of administration are handled within Microsoft Exchange. Administrators can configure a database availability group of up to 16 mailbox servers for automatic, database-level recovery from failures. Sub 30-second failover times and the ability to switch between database copies when disks fail dramatically improve an organization's uptime. Also improving uptime is the new Online Mailbox Move feature. This feature gives users nearly continuous access to their communications even while their mailbox is being relocated.

Note: MBX1 and MBX2 are Primary and MBX3 is failover server.

Hyper-V Server Cluster

The virtualisation platform onto which new virtual machines are provisioned consists of a multi-node Windows Server 2008 R2 cluster leveraging a shared storage area network (SAN) array with a Node and Disk Majority cluster. Each node of the cluster runs Windows Server 2008 R2 Enterprise Edition Hyper-V. Each active node in the cluster hosts and runs the virtual machines.

In the event of a failure of one of the nodes or planned maintenance, cluster failover occurs. The virtual machine guest(s) are failed over to the remaining nodes in the site boundary. If resiliency against the failure of active nodes is desired, then the surviving nodes must be able to take on the entire load of the failing nodes. The recommended approach is to have each node be physically identical and size the load on each node so that it achieves the above rules.

Implementation of Design

The GPC-POC is based on a set of virtualised Management servers which provide the necessary support infrastructure for provisioning of virtual machines. Not included, but required is a Hyper-V Cluster (minimum 2-nodes) which can be managed from the included SCVMM Server. This then provides the location for new virtual machines to be provisioned onto via the web portal.

Private Cloud Network

The Network design has to accommodate the virtualised networking requirements for both the management server infrastructure and the provisioned virtual machines. Therefore, to simplify the portability of the solution we have chosen to implement a private IP addressing scheme for the management servers. This means that access to them is only via the host server unless specific routes are added.

Figure 4: GPC-POC Network Overview

In addition, the physical management server(s) and the host cluster must both be on the same VLAN such that the virtual SCVMM and AD Servers can manage the host cluster and new virtual machines can be provisioned to it.

Network Architecture

The Hyper-V servers within the environment will be connected to a number of different networks.

Each of the Cluster servers will be configured with up to 5 Networks:

Management Network
Virtual Machine Network
Potentially an ISCSI network (if using an ISCSI SAN)

Optional

Cluster Heartbeat network
Live Migration Network (may be shared with Cluster Heartbeat Network if needed)

The Management connection is dedicated to the host itself for network I/O and management.

Optional:

The Cluster heartbeat connection is used by all the cluster nodes to ascertain if all nodes within the cluster are responding and operational.
The Live migration network is used to failover virtual machines to alternate nodes in the cluster configuration with no loss of service to the end user.

The Virtual Machine network is dedicated to the guest virtual machines.

The ISCSI Network is used for connection to the ISCSI SAN (if used).

Figure 5: Cluster Node Network Overview

Storage

The Storage design can be kept as simple as possible – either a FC/ISCSI connection is needed and enough disk space to cater for the potential number of virtual machines is required for the host cluster.

Backup and Restore

As this is purely a , Virtual machines will not be backed up.

Security Considerations
1. End User Access to the solution

Access to the solution for end-users is via RDP / UAG. It is assumed that the hosting environment is deployed in a secure lab, behind an external Firewall (to the GPC-POC servers).

RDP Gateway Server: - Remote Desktop Gateway (RD Gateway), formerly Terminal Services Gateway (TS Gateway), is a role service in the Remote Desktop Services server role included with Windows Server® 2008 R2 that enables authorized remote users to connect to resources on an internal corporate or private network, from any Internet-connected device that can run the Remote Desktop Connection (RDC) client. The network resources can be Remote Desktop Session Host (RD Session Host) servers, RD Session Host servers running RemoteApp programs, or computers and virtual desktops with Remote Desktop enabled. RD Gateway uses the Remote Desktop Protocol (RDP) over HTTPS to establish a secure, encrypted connection between remote users on the Internet and internal network resources.

For more reference please see

http://technet.microsoft.com/en-us/library/dd560672(WS.10).aspx

Unified Access Gateway - Forefront Unified Access Gateway (UAG) allows you to provide access to published RemoteApps and Remote Desktops, by integrating a Remote Desktop Gateway (RD Gateway) to provide an application-level gateway for RDS services and applications. Previously, RDS was published by tunneling Remote Desktop Protocol (RDP) traffic from the endpoint to RDS servers using the Socket Forwarding component; tunneled traffic was not controlled or inspected, and client endpoints required installation of the Socket Forwarding endpoint component.Note: As this is a pure solution, the security of the environment will need to be reviewed against the requirements of the environment into which it is being deployed and as such firewall rules and further security lockdown measures may be required.
For more reference please see
http://technet.microsoft.com/en-us/library/dd857385.aspx
1. Host Operating System Configuration

Keep the management operating system up to date with the latest security updates.
Use a separate network with a dedicated network adapter for the management operating system of the physical Hyper-V computer.
Secure the storage devices where you keep virtual machine resource files.
Harden the management operating system using the baseline security setting recommendations described in the Windows Server 2008 R2 Security Compliance Management Toolkit.
Configure any real-time scanning antivirus software components installed on the management operating system to exclude Hyper-V resources.
Do not use the management operating system to run applications.
Do not grant virtual machine administrators permission on the management operating system.
Use the security level of your virtual machines to determine the security level of your management operating system.

Deploying GPC-POC
Redmond Workflow

Build iSCSI Target host
Build 2008 R2 Data Center Hyper-v hosts
1. Create Virtual Switches with Hyper-V Manager

Virtual Switch Name	Type	NIC	Network	Physical Swtich	Connectivity
Public	External	NIC1	10.1.1.x	VLAN1	Corp or VPN connectivity
Replication	External	NIC2	10.1.2.x	VLAN2	Lab internal
Hyper-V Failover Cluster	External	NIC2	10.0.0.x	VLAN2	Lab internal

Table 7: Virtual Switches

Connect iSCSI volume to the Hyper-V host that will be running the DC1 VM
Build DC1 VM (...or physical host)
Copy the Exported Virtual Machine contents of just DC1,
1. from external USB drive to a local folder on the Hyper-v host,
2. such as C:\GPC Lab\Exported Virtual Machines
3. (you can skip this if you want to save time...use Hyper-v Mgr to import directly from USB drive)
Hyper-v Manager import of DC1 VM from the local C: drive
1. (or if you want to save some time, from the USB drive)
2. Just make sure that the DC1 VM is imported to a local directory on the Hyper-v host
Configure contoso.gov
Install Failover Clustering Feature on hosts
User Hyper-v Manager to create virtual switch for Clustering, on all hosts
Use the Failover Cluster Manager MMC snap-in to
1. Create a hyper-v cluster with the physical hosts
2. Enable CSV
3. Create a CSV disk
4. Copy
Build SCVMM & SQL VM
1. iSCSI Initiator
2. Connect to E: drive
3. Install SQL
4. Install SCVMM
5. Create another CSV disk for the SCVMM Library
6. ***due to a storage issue, we were not able to get all the ISO images copied to the external USB drive, so you will need to copy them to this CSV disk
7. Create Exchange Template
8. Create CAS/HT Template
9. Create DC Template
10. Create Client Templates
Use SCVMM or Hyper-v Manager to import remaining VMs onto the appropriate hosts
1. Spread the 3 MBX VMs across the HPV hosts, and DO NOT enable Live Migration for these VMs
2. Spread the remaining VMs across the HPV hosts with Live Migration enabled

Customer Workflow

Base OS Server Name	Assigned Machine	Bits	RAM	CPU	Disks	Virtual Switch "Public"	Virtual Switch "Hyper-V & Exchange Replication"	Availability Date	Purpose
HPB1	HP Blade 1	x64	64 GB	Quad Core	2 X 150 GB (300 GB)	Gigabit Ethernet External NIC1 10.1.1.x VLAN1 Corp or VPN	Gigabit Ethernet External NIC2 10.1.2.x VLAN2 Lab internal	Now	Hyper-V (cluster) DDC (SQL, DIT-SC, SCCM, SCOM, SCVMM + Library) Exchange CAS + Hub
HPB2	HP Blade 2	x64	64 GB	Quad Core	2 X 150 GB (300 GB)	Gigabit Ethernet External NIC1 10.1.1.x VLAN1 Corp or VPN	Gigabit Ethernet External NIC2 10.1.2.x VLAN2 Lab internal	Now	Hyper-V failover for HPV1
HPB3	HP Blade 3	x64	32 GB	Quad Core	2 X 150 GB (300 GB)	Gigabit Ethernet External NIC1 10.1.1.x VLAN1 Corp or VPN	Gigabit Ethernet External NIC2 10.1.2.x VLAN2 Lab internal	Now	Hyper-V (cluster) DAS (273GB - RAID5) Exchange DAG
HPB4	HP Blade 4	x64	32 GB	Quad Core	2 X 150 GB (300 GB)	Gigabit Ethernet External NIC1 10.1.1.x VLAN1 Corp or VPN	Gigabit Ethernet External NIC2 10.1.2.x VLAN2 Lab internal	Now	Hyper-V (cluster) DAS (273GB - RAID5) Exchange DAG
IBMH1	IBM 3850 + 2 Fusion IO cards	x64	16 GB	Quad Core Intel Xeon Series 7400	2 X 650 GB Fusion IO	Gigabit Ethernet External NIC1 10.1.1.x VLAN1 Corp or VPN	N/A	June 16 for Fusion IO cards	iSCSI
IBMH2	IBM 3850	x64	12 GB	Quad Core Intel Xeon Series 7400		Gigabit Ethernet External NIC1 10.1.1.x VLAN1 Corp or VPN	N/A	Now	Hyper-V Dual NIC gateway host for remote access May host AD+DNS if Lenovo is not available
LENH1	Lenovo RD210	x64	8 GB			Gigabit Ethernet External NIC1 10.1.1.x VLAN1 Corp or VPN	N/A	June 16 or later	AD+DNS

Table 8: Hardware Configuration

For more details on the Lab configuration, please refer the Excel sheet attached in the Appendix N

Passwords

Domain	User Account	Password
Scvmm-sql-1	Local Administrator	1DDCgpclab
Dc1	Domain Administrator	1GPClab
	Domain Labadmin	1GPCcontoso
Hpv5	Local Administrator	1GPCcontoso
Sccm-scom1	Local Administrator	1GPCcontoso
DC3	OPS Administrator	1GPClab 1GPCcontoso
CAS1
Domain	User Account	Password
CONTOSO	Clusteradmin	1GPCcontoso

Table 9: Passwords

Figure 6: - Removed by purpose. Please create the User Accounts as per the above Table 10

Figure 7: Removed by purpose. Please create the User Accounts as per the above Table 10

iSCSI Target Host Setup

Install iSCSI target software on designated host

Figure 6: iSCSI Software Setup-1

Figure 7: iSCSI Software Setup-2

Right click on iSCSI Target and select "Create an iSCSI Target"

Figure 8: iSCSI Software Setup-3

Figure 9: iSCSI Software Setup-4

Get the IQN of the Hyper-v host that will initially build the contents of the iSCSI volume, which will later be used for the Cluster Shared Volume

Figure 10: iSCSI Software Setup-5

On the iSCSI Target Host, paste the IQN identifier of the Hyper-v hosts that we will use to offload the contents of the external USB drive

Figure 11: iSCSI Software Setup-6

Figure 12: iSCSI Software Setup-7

Create virtual disk for iSCSI target, Right click on gpc-storage or select from Actions pane on the right and Select "Create Virtual Disk for iSCSI Target"

Figure 13: iSCSI Software Setup-8

Or you can select "Devices", Right click, and select "Create Virtual Disk"

Figure 14: iSCSI Software Setup-9

Figure 15: iSCSI Software Setup-10

Figure 16: iSCSI Software Setup-11

This is a 1GB quorum disk for clustering

Figure 17: iSCSI Software Setup-12

Figure 18: iSCSI Software Setup-13

Build R2 Hyper-V Core hosts

Figure 19: Build R2 Hyper-V Core hosts - 1

Figure 20: Build R2 Hyper-V Core hosts - 2

Figure 21: Build R2 Hyper-V Core hosts - 3

iSCSI Client Setup

Figure 22: iSCSI Client Setup - 1

Figure 23: iSCSI Client Setup - 2

Copy the IQN of the client VM or host, which will be pasted into the iSCSI Target host configuration

Figure 24: iSCSI Client Setup - 3

Log into the iSCSI target host

Figure 25: iSCSI Client Setup - 4

Go to the "Advanced" tab, and paste in the IQN of the Client VM or host

Figure 26: iSCSI Client Setup - 5

Go back to the client and run the iSCSI Initiator program again

Figure 27: iSCSI Client Setup – 5

Type in the IP address or FQDN of the iSCSI Target host, and click "Quick Connect"

Figure 28: iSCSI Client Setup - 6

You should see this:

Figure 29: iSCSI Client Setup - 7

Use the Server Manager tool to navigate to Storage/Disk Management. Find the volume and bring it online, You should see the volume (E: in this case) in the Computer window

Build DC VMs

Follow the Hyperv manager steps below to build the DC1 VM

Figure 30: Build DC VMs - 1

Figure 31: Build DC VMs - 2

Figure 32: Build DC VMs - 3

Figure 33: Build DC VMs - 4

Figure 34: Build DC VMs - 5

Figure 35: Build DC VMs - 6

Figure 36: Build DC VMs - 7

Install Windows Server 2008 R2 Datacenter Edition on all Virtual Machines for this PoC

Setting up Dcpromo

Set up a Domain Controller on Windows Server 2008.

Figure 37.1: Dcpromo - 1

To use the command, click on Start > Run > and then write dcpromo > Click OK

Figure 37.2: Dcpromo - 2

The system will start checking if Active Directory Domain Services ( AD DS) binaries are installed, then will start installing them. The binaries could be installed if you had run the dcpromo command previously and then canceled the operation after the binaries were installed.

Figure 37.3: Dcpromo - 3

The Active Directory Domain Services Installation Wizard will start, either enable the checkbox beside Use Advanced mode installation and Click Next , or keep it unselected and click on Next

Figure 37.4: Dcpromo - 4

The following table lists the additional wizard pages that appear for each deployment configuration when you select the Use advanced mode installation check box.

Deployment configuration	Advanced mode installation wizard pages
New forest	Domain NetBIOS name
New domain in an existing forest	On the Choose a Deployment Configuration page, the option to create a new domain tree appears only in advanced mode installation. Domain NetBIOS name Source Domain Controller
Additional domain controller in an existing domain	Install from Media Source Domain Controller Specify Password Replication Policy (for RODC installation only)
Create an account for a read-only domain controller (RODC) installation	Specify Password Replication Policy
Attach a server to an account for an RODC installation	Install from Media Source Domain Controller

The Operating System Compatibility page will be displayed, take a moment to read it and click Next

Figure 37.5: Dcpromo - 5

Choose Create a new domain in a new forest, Click Next

Figure 37.6: Dcpromo - 6

Enter the Fully Qualified Domain Name of the forest root domain inside the textbox, click Next

Figure 37.7: Dcpromo - 7

If you selected Use advanced mode installation on the Welcome page, the Domain NetBIOS Name page appears. On this page, type the NetBIOS name of the domain if necessary or accept the default name and then click Next.

Figure 37.8: Dcpromo - 8

Select the Forest Functional Level, choose the level you desire and click on Next. Make sure to read the description of each functional level to understand the difference between each one.

Figure 37.9: Dcpromo - 9

In the previous step, If you have selected any Forest Functional Level other than Windows Server 2008 and clicked on Next , you would then get a page to select the Domain Functional Level. Select it and then click on Next

Figure 37.10: Dcpromo - 10

In the Additional Domain Controller Options page, you can select to install the Domain Name Service to your server. Note that the First domain controller in a forest must be a Global Catalog that's why the checkbox beside Global Catalog is selected and it cannot be cleared. The checkbox is also selected by default when you install an additional domain controller in an existing domain, however you can clear this checkbox if you do not want the additional domain controller to be a global catalog server. The first domain controller in a new forest or in a new domain can not be a Read Only Domain Controller (RODC), you can later add a RODC but you must have at least one Windows Server 2008 Domain Controller.

I want to set my DC as a DNS Server as well, so I will keep the checkbox beside DNS Server selected and click on Next

Figure 37.11: Dcpromo - 11

If the wizard cannot create a delegation for the DNS server, it displays a message to indicate that you can create the delegation manually. To continue, click Yes

Figure 37.12: Dcpromo - 12

Now you will have the location where the domain controller database, log files and SYSVOL are stored on the server.
The database stores information about the users, computers and other objects on the network. the log files record activities that are related to AD DS, such information about an object being updated. SYSVOL stores Group Policy objects and scripts. By default, SYSVOL is part of the operating system files in the Windows directory

Either type or browse to the volume and folder where you want to store each, or accept the defaults and click on Next

Figure 37.13: Dcpromo - 13

In the Directory Services Restore Mode Administrator Password (DSRM) page, write a password and confirm it. This password is used when the domain controller is started in Directory Services Restore Mode, which might be because Active Directory Domain Services is not running, or for tasks that must be performed offline.
Make sure that you memorize this password when you need it. I know many administrators forgot it when they most needed it !!

Figure 37.14: Dcpromo - 14
Make sure the password meet the password complexity requirements of the password policy, that is a password that contains a combination of uppercase and lowercase letters, numbers, and symbols. else you will receive the following message :

Figure 37.15: Dcpromo - 15

Summary page will be displayed showing you all the setting that you have set . It gives you the option to export the setting you have setup into an answer file for use with other unattended operations, if you wish to have such file, click on the Export settings button and save the file.

Figure 37.16: Dcpromo - 16

DNS Installation will start

Figure 37.17: Dcpromo - 17

Followed by installing Group Policy Management Console, the system will check first if it is installed or not.

Figure 37.18: Dcpromo - 18

Configuring the local computer to host active directory Domain Services and other operations will take place setting up this server as a Domain Controller

Figure 37.19: Dcpromo - 19

Figure 37.20: Dcpromo - 20

Figure 37.21: Dcpromo - 21

Figure 37.22: Dcpromo - 22

Figure 37.23: Dcpromo - 23

Active Directory Domain Services installation will be completed, click Finish, then click on Restart Now to restart your server for the changes to take effect.

Figure 37.24: Dcpromo - 24

Figure 37.25: Dcpromo - 25

Once the server is booted and you logon to it, click on Start > Administrative Tools , will notice that following have been installed :
1. Active Directory Domains and Trusts
2. Active Directory Sites and Services
3. Active Directory Users and Computers
4. ADSI Edit
5. DNS
Group Policy Management

Figure 37.26: Dcpromo - 26

Failover Clustering

http://technet.microsoft.com/en-us/library/cc732181(WS.10).aspx#BKMK_Install

Starting with HPV5

Figure 38: Failover Clustering- 1

Notice Features Summary does not have Failover Clustering

Figure 39: Failover Clustering- 2

Figure 40: Failover Clustering- 3

Starting the cluster configuration with HPV3, First need to create a virtual network switch with External connectivity to the 10.0.0.x network

Figure 41: Failover Clustering- 4

Figure 42: Failover Clustering- 5

Figure 43: Failover Clustering- 6

Figure 44: Failover Clustering- 7

Build SCVMM & SQL VM

Recommended: 4 GB RAM, 2 cores, 40 GB HDD

http://technet.microsoft.com/en-us/library/cc764289.aspx

Figure 45: Build SCVMM & SQL VM- 1

System Requirements: Installing VMM on a Single Computer

http://technet.microsoft.com/en-us/library/cc764289.aspx

Figure 46: Build SCVMM & SQL VM- 2

Figure 47: Build SCVMM & SQL VM- 3

Figure 48: Build SCVMM & SQL VM- 4

Figure 49: Build SCVMM & SQL VM- 5

Figure 50: Build SCVMM & SQL VM- 6

Figure 51: Build SCVMM & SQL VM- 7

Figure 52: Build SCVMM & SQL VM- 8

Figure 53: Build SCVMM & SQL VM- 9

Figure 54: Build SCVMM & SQL VM- 10

Figure 55: Build SCVMM & SQL VM- 11

Figure 56: Build SCVMM & SQL VM- 12

Figure 57: Build SCVMM & SQL VM- 13

Figure 58: Build SCVMM & SQL VM- 14

Figure 59: Build SCVMM & SQL VM- 15

Figure 60: Build SCVMM & SQL VM- 16

Figure 61: Build SCVMM & SQL VM- 17

SQL 2008 Install

http://technet.microsoft.com/en-us/library/bb500469(SQL.100).aspx

http://technet.microsoft.com/en-us/library/ms143506(SQL.100).aspx

Installed SQL 2008 Enterprise:

Copy all of the SQL Server 2008 Enterprise bits from \\products ( you can get it from MSDN as well)
You will need to install .Net Framework 3.5 via Role Manager prior to installing SQL:

Figure 62: SQL 2008 Install – 1

Figure 63: SQL 2008 Install – 2

Figure 64: SQL 2008 Install – 3

Figure 65: SQL 2008 Install – 4

Figure 66: SQL 2008 Install – 5

Might as well install the "Web Server (IIS) Support", since it will be needed for the other management tools:

Figure 67: SQL 2008 Install – 6

Figure 68: SQL 2008 Install – 7

Figure 69: SQL 2008 Install – 8

Figure 70: SQL 2008 Install – 9

Figure 71: SQL 2008 Install – 10

Figure 72: SQL 2008 Install – 11

Figure 73: SQL 2008 Install – 12

Run the SQL setup:

Figure 74: SQL 2008 Install – 13

It may take a couple of minutes, but you will eventually get the SQL install wizard:
Click on "Installation"
Click on "New SQL Server stand-alone installation or add features to an existing installation"

Figure 75: SQL 2008 Install – 14

Figure 76: SQL 2008 Install – 15

Figure 77: SQL 2008 Install – 16

Figure 78: SQL 2008 Install – 17

Figure 79: SQL 2008 Install – 18

Figure 80: SQL 2008 Install – 19

Figure 81: SQL 2008 Install – 20

Installing System Centre Virtual Machine Manager 2008 R2

Below is the screenshots and instructions for getting SCVMM up and running. My installation was performed in a lab environment with Widows 2008 Server R2 providing the Hyper-V functionality so that the hypervisor can have access to the virtualisation extensions of the processor (i.e. hyper-v will work). I've then created two virtual machines, scvmmdc as a domain controller and scvmm to run SCVMM and control hyper-v on machine as a host. True, it's now what you would expect to see in production but it does give you an idea of how to install the software.

The first thing you will note is that I'm not installing a full install to a clustered sql server and, equally, I have not clustered SCVMM to make it highly available both of these things being best practice for a full multi host production environment. You can, of course, get away without doing either of these things in production as you can still control clustered hyper-v from the built in server administration tools, it's just that you won't have access to SCVMM if your single server is not up and running. So, the more physical hosts you have, the "better" practice it is to provide high availability for SCVMM.

The first thing to note after installing the setup disk is that the very first link gives you access to the SCVMM help file which gives excellent advice as to sizing the solution, supported SQL, required software etc (the Setup Overview link).

Figure 82: Prepare to Install Screen

Straight from that guide, the software requirements are:

Software requirement	Notes
A supported operating system	For more information, (generally 2003 SP2 and later).
Windows Remote Management (WinRM)	This software is included in Windows Server 2008 and the WinRM service is set to start automatically. If the WinRM service is stopped, the Setup Wizard starts the service.
Microsoft .NET Framework 3.0	This software is included in Windows Server 2008. If this software has been removed, the Setup Wizard automatically adds it (i.e. no need to download unless you want the latest version – always patch afterwards though).
Windows Automated Installation Kit (WAIK) 1.1	If this software has not been installed previously, the Setup Wizard automatically installs it (i.e. no need to download unless you want the latest version – always patch afterwards though).

Table 2: Software Requirements

If you use the same computer for your VMM server and your VMM database, you must install a supported version of Microsoft SQL Server.

Supported versions of SQL are

SQL Server 2008 Express Edition
SQL Server 2008 (32-bit and 64-bit) Standard Edition
SQL Server 2008 (32-bit and 64-bit) Enterprise Edition
SQL Server 2005 Express Edition SP2
SQL Server 2005 (32-bit and 64-bit) Standard Edition SP2
SQL Server 2005 (32-bit and 64-bit) Enterprise Edition SP2

If you do not specify a local or remote instance of SQL then the Setup Wizard will install SQL Server 2005 Express Edition SP2 on the local computer. The Setup Wizard also installs SQL Server 2005 Tools and creates a SQL Server instance named MICROSOFT$VMM$ on the local computer. To use SQL Server 2008 for the VMM database, SQL Server Management Tools must be installed on the VMM server. If you use Express Edition then SCVMM will not allow reporting and the database size is limited to 4GB.

After reading the pre-requisites we can prepare the server and domain to host SCVMM. The domain needs to be at Windows 2003 domain level as a minimum. Equally, if the SCVMM server is to host the self service portal then IIS needs to be installed and configured. For Windows 2003 this is a simple matter of installing the Application Server role. For Windows 2008 and above add the Web Server (IIS) role and ensure the following role services are selected:

Static Content
Default Document
Directory Browsing
HTTP Errors
ASP.NET
.Net Extensibility
ISAPI Extensions
ISAPI Filters
Request Filtering
IIS 6 Metabase Compatibility
IIS 6 WMI Compatibility

We can then check the server for suitability for hosting SCVMM. This can be done locally or form a remote machine but whichever machine is being used for this task, that machine needs to have the Microsoft Baseline Configuration Analyzer installed which can be downloaded from http://go.microsoft.com/fwlink/?LinkId=97952. Once the MBCA has been installed we can then click the link for the VMM Configuration Analyzer. This will allow you to download the analyzer tool to your local machine and pre-check the machine for suitability for hosting SCVMM.

When starting the Analyzer tool from the start menu we have the following choices (SCVMM is the name of my lab machine). The tool should really be run in the context of an account that is a domain administrator in order that the tool can accurately check the domain level.

Figure 83: Prepare to Install SCVMM

After clicking Scan and waiting a short while you will be presented with a report for which you will need to correct any errors.

Once all errors are resolved we can move onto installing the SCVMM software. Simply click on "SCVMM Server" under the setup section of the welcome screen. Setup will extract some temporary files and then begin the installation routine. Read and accept the license terms if you agree with them and wish to proceed.

Figure 84: Prepare to Install SCVMM

I recommend that you participate in the customer experience program if you wish to see Microsoft improve their software for you and all other users.

Figure 85: Prepare to Install SCVMM

Complete the User registration details according to your corporate standards.

Figure 86: Prepare to Install SCVMM

Complete the prerequisites check and, if passed, click on Next.

Figure 87: Prepare to Install SCVMM

Select where to install the software binaries.

Figure 88: Prepare to Install SCVMM

As I don't have a separate SQL server in my lab I chose to install SQL Express locally on my server.

Figure 89: Prepare to Install SCVMM

I created a new folder called "Library" and changed the path for the library share to used that new location. In the normal course of events I would usually put this on a drive other than C to allow for growth.

Figure 90: Prepare to Install SCVMM

While it is a best practice to change the port numbers used (one for security and two, because you have to uninstall and reinstall SCVMM if you want to change the ports later) I have left them at their defaults for my lab. Similarly, it is a security best practice to leave the service account as the system account. A network account should be used if SCVMM is being installed in a clustered environment where SCVMM is itself clustered.

Figure 91: Prepare to Install SCVMM

At the summary of settings page click on Install to proceed.

Figure 92: Prepare to Install SCVMM

The software and pre-requisite software will then be installed.

Figure 93: Prepare to Install SCVMM

Finally, once the installation has completed select Close to check for any SCVMM updates.

Figure 94: Prepare to Install SCVMM

This will have installed SCVMM server. Next, we need to install the Administrators Console. After any required patching, reboot the server and start setup from the CD once more and select VMM Administrator Console in the setup section. Once again temporary files will be extracted and the installation process will begin. As before, we first read and accept the license agreement if we want to proceed.

Figure 95: Prepare to Install SCVMM

There is no need to join the Customer Experience Improvement Program as this screen will pick up the choice made when installing SCVMM server (this choice is available if installing the administrative console onto an administrators workstation).

Figure 96: Prepare to Install SCVMM

Complete the prerequisites check and, if passed, click on Next.

Figure 97: Prepare to Install SCVMM

Select the installation location and click on Next.

Figure 98: Prepare to Install SCVMM

Next, we assign the port that we want the console to use to communicate with the SCVMM Server. This is the port that you assigned when installing SCVMM Server above. The port setting that you assign for the VMM Administrator Console must identically match the port setting that you assigned for the VMM Administrator Console during the installation of the VMM server or communication will not occur.

Figure 99: Prepare to Install SCVMM

On the Summary of Settings page, if all settings are fine then click on Install.

Figure 100: Prepare to Install SCVMM

The installation will then proceed.

Figure 101: Prepare to Install SCVMM

Once again, click on Close and check for any updates to the software.

Figure 102: Prepare to Install SCVMM

Once any updates have been installed and the server has been rebooted we can proceed to install the optional VMM Self-Service Portal. The Self Service Portal allows identified users to create and manage virtual machines within a Hyper-V or VMWare environment where SCVMM is managing VMWare hosts. To begin the install simply click on the VMM Self-Service Portal link under the Setup section of the welcome page. Once again temporary files will be extracted and the installation process will begin. As before, we first read and accept the license agreement if we want to proceed.

Figure 103: Prepare to Install SCVMM

Complete the prerequisites check and, if passed, click on Next (remember, IIS must have been installed to install this service).

Figure 104: Prepare to Install SCVMM

We can then choose where to install the application binaries. Here, I have chosen the default location for my lab. In a production environment I would move these to a drive other than C.

Figure 105: Prepare to Install SCVMM

Next we tell the installation what port we would like users to connect to the self-service portal over. Generally this is port 80 but if another web site is being hosted on the server then we can either select a different port or, more usually, set a different host / web address to be used by the solution by way of host headers. If port 80 is already in use (by the default web site for example) then we receive the error message below.

Figure 106: Prepare to Install SCVMM

I've used the hostname selfservice and registered this in my DNS servers as a host (A) record to enable clients to find the site. Additionally, we once again have to connect to our SCVMM server and need to enter the port number chosen earlier for connections. We can then click on Next to move to the next screen.

Figure 107: Prepare to Install SCVMM

On the Summary page we can now select Install if we are happy with all of our settings.

Figure 108: Prepare to Install SCVMM

Once again we click on Close and check for any updates to the software.

Figure 109: Prepare to Install SCVMM

Once the installation is complete we can once again check for any updates and reboot the server to ensure that all services start cleanly (checking the event log for any issues on startup).

Once restarted you can take time if necessary to harden your self-service portal environment by deploying SSL (to encrypt traffic), using integrated logon (to prevent users having to enter passwords) and disabling unwanted ISAPI filters. The full guide on recommended hardening measures can be found at http://go.microsoft.com/fwlink/?LinkId=123617.

If you have followed these steps you should now have a fully functional SCVMM server which can be connected to your Hyper-V or VMWare servers. Connecting to Hyper-V couldn't be simpler. When you add a virtual machine host or library server that is in an Active Directory domain, SCVMM remotely installs an SCVMM agent on the Hyper-V host. The SCVMM agent deployment process uses both the Server Message Block (SMB) ports and the Remote Procedure Call (RPC) port (TCP 135) and the DCOM port range. You can use either SMB packet signing or IPSec to help secure the agent deployment process. You can also install SCVMM agents locally on hosts, discover them in the SCVMM Administrator Console, and then control the host using only the WinRM port (default port 80) and BITS port (default port 443). Even though we do not need to install the Local Agent manually as all of our servers reside in a domain I run through the procedure for installation below. First we insert the SCVMM disc into our hyper-v server (or map a drive to it) and start the setup routine and then click on Local Agent under setup. The installation of the Local Agent will then begin.

Figure 110: Prepare to Install SCVMM

Accept the terms of the agreement to continue.

Figure 111: Prepare to Install SCVMM

Select the installation path.

Figure 112: Prepare to Install SCVMM

Change the ports the Hyper-V server will use to connect to the SCVMM server to those set earlier when SCVMM was installed.

Figure 113: Prepare to Install SCVMM

Our server is not sitting in a DMZ – if it were we could encrypt traffic between the Hyper-V server and SCVMM.

Figure 114: Prepare to Install SCVMM

You can then continue to Install the Agent

Figure 115: Prepare to Install SCVMM

Click on Finish when completed.

Figure 116: Prepare to Install SCVMM

Next we need to start the SCVMM Admin console on the SCVMM server by double clicking the link created on your desktop or by using the link in the Start menu.

Figure 117: Prepare to Install SCVMM

From the Outlook like interface we can select the Hosts section and from there we can create a new host group if we have a number of physical Hyper-V or VMWare hosts we would like to control. For our purposes we'll just use the All Hosts group. On the right hand side (Actions column) we can select Add Host.

Figure 118: Prepare to Install SCVMM

In my lab the Hyper-V server is part of my domain as it would have to be if we were running a Hyper-V cluster and so we select the first choice and enter the domain administrator credentials to allow SCVMM access to the Hyper-V host.

Figure 119: Prepare to Install SCVMM

Next, type in the name of the physical server running Hyper-V or browse for it in Active Directory. Note: Hyper-V does not need to be installed on the host at this point – if it is not then SCVMM will install and activate the role on the target server and reboot it.

Figure 120: Prepare to Install SCVMM

Add the host machine to a host group.

Figure 121: Prepare to Install SCVMM

Add a default path where Virtual Machines should be created on this host. When you add a stand-alone Windows Server-based virtual machine host as we are doing here to Virtual Machine Manager (SCVMM), you can add one or more virtual machine default paths, which are paths to folders where SCVMM can store the files for virtual machines that are deployed on the hosts. However, For a Hyper-V or VMWare cluster the default path is a shared volume on the cluster that SCVMM automatically creates when you add the host cluster. When you are adding the host cluster, you cannot specify additional default paths in the Add Host Wizard.

Figure 122: Prepare to Install SCVMM

We then get asked to confirm the settings and can select to add our host.

Figure 123: Prepare to Install SCVMM

Once added a job will auto-run to add the host followed by a further series of jobs to add in any already configured Virtual Machines running on that host into SCVMM.

Figure 124: Prepare to Install SCVMM

You should now be able to control your Hyper-V host using SCVMM and configure the self-service portal for your users.

Individual SCVMM Install
1. Log into the SCVMM-SQL-1 virtual machine as:

ops\labadmin

1GPCcontoso

Software has been copied to the local harddrive

Local Disk (C:) \GPC Lab\Virtual Machine Manager 2008 R2

Run setup.exe
Install VMM Server first...

Figure 125: SCVMM Install – 1

Figure 126: SCVMM Install – 2

Figure 127: SCVMM Install – 3

Figure 128: SCVMM Install – 4

Figure 129: SCVMM Install – 5

Figure 130: SCVMM Install – 6

Figure 131: SCVMM Install – 7

Figure 132: SCVMM Install – 8

Figure 133: SCVMM Install – 9

Install VMM Administrator Console…..

Figure 134: SCVMM Install – 10

Figure 135: SCVMM Install – 11

Figure 136: SCVMM Install – 12

Figure 137: SCVMM Install – 13

Figure 138: SCVMM Install – 14

Figure 139: SCVMM Install – 15

Figure 140: SCVMM Install – 16

Figure 141: SCVMM Install – 17

Figure 142: SCVMM Install – 18

Figure 143: SCVMM Install – 19

Figure 144: SCVMM Install – 20

Figure 145: SCVMM Install – 21

Figure 146: SCVMM Install – 22

Enter E:\GPC Virtual Machines for the default path and Enter the remaining defaults for adding the host

Figure 147: SCVMM Install – 23

DIT-SC Install
1. System Requirements: Single-Machine Deployment Scenario

As described previously, the single-machine deployment scenario requires installing all three VMMSSP components on a computer that is running the VMM Administrator Console and SQL Server 2008.

Hardware Requirements

The following table provides the minimum and recommended hardware requirements for a single–machine deployment.

Table 6. Required Hardware for a Single–Machine Deployment Scenario

Hardware Component	Minimum	Recommended
RAM	2 GB	4 GB
Available hard disk space	50 GB	50 GB

Software Requirements

Before you install the VMMSSP website component, install and configure the following software on the computer.

Table 7. Required Software for a Single-Machine Deployment Scenario

Software	Comments
Operating System: Windows Server® 2008 R2	Windows Server 2008 R2 Enterprise Edition and Windows Server 2008 R2 Datacenter Edition are supported.
Windows Server Internet Information Services (IIS) 7.0	You must add the Web server role (IIS) and then install the following role services: Static Content Default Document ASP.NET .NET Extensibility ISAPI Extensions ISAPI Filters Request Filtering Windows Authentication IIS 6 Metabase Compatibility Turn off Anonymous authentication. For more information, see Configure Windows Authentication in the IIS documentation. Use IIS v6.0 compatibility mode.
Microsoft .NET Framework 3.5 SP1	Download from Microsoft Download Center: Microsoft .NET Framework 3.5 Service Pack 1
Windows PowerShell™ 2.0	Important If your extensibility scripts require specific Windows PowerShell snap-ins, install them when you install the VMMSSP server component.
Microsoft Message Queuing (MSMQ)	You must install the Message Queuing Server feature of MSMQ. This feature is the core component of Message Queuing, which enables you to perform basic Message Queuing functions. For more information, see What is Message Queuing? Note In Windows Server 2008 R2, you install and uninstall Message Queuing by using the Add Features Wizard available in Server Manager.
VMM 2008 R2 Administrator Console	For more information about installing the VMM 2008 R2 Administrator Console, download and read the Virtual Machine Manager Deployment Guide.
SQL Server 2008	SQL Server 2008 Enterprise (64-bit) and SQL Server 2008 Standard (64-bit) versions are supported.

System Requirements: VMMSSP Website Component

This section lists the hardware and software required for the VMMSSP website component if you install it on a dedicated Web server.

Hardware Requirements

The following table provides the minimum and recommended hardware requirements for the VMMSSP website component.

Table 8. Required Hardware for the VMMSSP Website Component

Hardware Component	Minimum	Recommended
RAM	2 GB	4 GB
Available hard disk space	50 MB	2 GB

Software Requirements

Before you install the VMMSSP website component, install and configure the following software on the Web server.

Table 9. Required Software for the VMMSSP Website Component

Software	Comments
Operating System: Windows Server 2008 R2	Windows Server 2008 R2 Enterprise Edition and Windows Server 2008 R2 Datacenter Edition are supported.
Windows Server Internet Information Services (IIS) 7.0	You must add the Web server role (IIS) and then install the following role services: Static Content Default Document ASP.NET .NET Extensibility ISAPI Extensions ISAPI Filters Request Filtering Windows Authentication IIS 6 Metabase Compatibility Turn off Anonymous authentication. For more information, see Configure Windows Authentication in the IIS documentation. Use IIS v6.0 compatibility mode.
Microsoft .NET Framework 3.5 SP1	Download from Microsoft Download Center: Microsoft .NET Framework 3.5 Service Pack 1

System Requirements: VMMSSP Server Component

This section lists the hardware and software required for the VMMSSP server component if you install it on a computer that is dedicated to the self-service portal and the VMM Administrator Console.

Hardware Requirements

The following table provides the minimum and recommended hardware requirements for the VMMSSP server component.

Table 10. Required Hardware for the VMMSSP Server Component

Hardware Component	Minimum	Recommended
RAM	2 GB	4 GB
Available hard disk space	50 MB	2 GB

Software Requirements

Before you install the VMMSSP server component, install and configure the following software on the computer that will run the server component.

Table 11. Required Software for the VMMSSP Server Component

Software	Comments
Operating System: Windows Server 2008 R2	Windows Server 2008 R2 Enterprise Edition and Windows Server 2008 R2 Datacenter Edition are supported.
Microsoft .NET Framework 3.5 SP1	Download from Microsoft Download Center: Microsoft .NET Framework 3.5 Service Pack 1
Windows PowerShell 2.0	Important If your extensibility scripts require specific Windows PowerShell snap-ins, install the snap-ins with the server component. For information about extending the self-service portal with scripts, see the Virtual Machine Manager 2008 R2 VMMSSP Extensibility Guide.
Microsoft Message Queuing (MSMQ)	You must install the Message Queuing Server feature of MSMQ. This feature is the core component of Message Queuing, which enables you to perform basic Message Queuing functions. For more information about the Message Queuing Server feature, see What is Message Queuing? Note In Windows Server 2008 R2, you install and uninstall Message Queuing by using the Add Features Wizard available in Server Manager.
VMM 2008 R2 Administrator Console	Install the VMMSSP server component on a computer that already has the VMM Administrator Console installed. For more information about installing the VMM 2008 R2 Administrator Console, see the Virtual Machine Manager Deployment Guide.

System Requirements: VMMSSP Database Component

This section lists the hardware and software required for the VMMSSP database component if you install it on a dedicated SQL Server computer.

Hardware Requirements

The following table provides the minimum and recommended hardware requirements for the VMMSSP database component.

Table 12. Required Hardware for the VMMSSP Database Component

Hardware Component	Minimum	Recommended
RAM	2 GB	4 GB
Available hard disk space	50 GB	50 GB

Software Requirements

Before you install the VMMSSP database component, install and configure the following software on the SQL Server computer.

Table 13. Required Software for the VMMSSP Database Component

Software	Comments
Operating System: Windows Server 2008 R2	Windows Server 2008 R2 Enterprise Edition and Windows Server 2008 R2 Datacenter Edition are supported.
SQL Server 2008	SQL Server 2008 Enterprise (64-bit) and SQL Server 2008 Standard (64-bit) versions are supported.

Installing the Virtual Machine Manager Self-Service Portal

The Self-Service Portal Setup wizard installs all three of the self-service portal components.

You can install all three components together on a single physical computer or virtual machine by running the Setup wizard once. You can also install the VMMSSP website component and the server component separately on a single computer or virtual machine. When you install the VMMSSP server component, the VMMSSP database component installs automatically. When you install the VMMSSP website component, it connects to that database. You can distribute the self-service portal components across three physical computers or virtual machines by running the Setup wizard twice: once on the computer that will run the server component, and once on the computer that will run the VMMSSP website component. Before installing any component, ensure that the computer meets the minimum hardware requirements and that all prerequisite software is installed. For more information about hardware and software requirements, see "Self-Service Portal System Requirements."

Important Before you can begin using the self-service portal, you must create a service role for self-service portal users in VMM. In the VMM Administrator Console, create a service role named Self Service Role. For more information, see How to Create a Self-Service User Role in the Virtual Machine Manager documentation. The ConnectVM virtual machine action will not work till this step is completed.

Important You must have administrator permissions on the computers on which you intend to install the self-service portal components. You also must be a member of the local Administrators group on the computer running SQL Server.

To install the VMMSSP server component and database component

Note This procedure assumes that you have a separate database server available, running SQL Server 2008 Enterprise Edition or Standard Edition.

Download the SetupVMMSSP.exe file and place it on each computer on which you want to install self-service portal components.
To begin the installation process, on the computer on which you are installing the server component, right-click SetupVMMSSP.exe, and then click Run as administrator.
On the Welcome page, click Install.
Review and accept the license agreement, and then click Next.
Click VMMSSP server component, and then click Next.
On the Check Prerequisites for the Server Component page, wait for the wizard to complete the prerequisite checks, and then review the results. If any of the prerequisites are missing, follow the instructions provided. When all of the prerequisites are met, click Next.
Accept or change the file location, and then click Next.
Use the following steps to configure the VMMSSP database.
1. In Database server, type the name of the database server that will host the new VMMSSP database (or that hosts an existing database).
2. Click Get Instances to get the SQL Server instances available in the database server. In SQL Server instance, select the SQL Server instance that manages the new (or existing) database.
3. In Port, type the port number that the SQL Server instance uses for incoming and outgoing communication. If you leave the Port value blank, the Setup wizard sets the value to the default port 1433.
4. Under Credentials, click the type of authentication that the database will use for incoming connections (Windows authentication or SQL Server authentication).
  If you clicked SQL Server authentication, type the user name and password of a SQL Server account to use for accessing the database.
5. If you want the self-service portal to create a new database (for example, if you are running the Setup wizard for the first time), click Create a new database.
  Important If you are installing the self-service portal for the first time you must select the option to create a new database.
  Note The self-service portal database name is DITSC, and cannot be changed.
6. If you want the self-service portal to use an existing database, click Connect to an existing database. The DITSC database is selected, and cannot be changed.
7. When you finish configuring the self-service portal database, click Next.
Type the user name, password, and domain of the service account for the VMMSSP server component. Click Test account to make sure that this account functions. When finished, click Next.
For more information about considerations and requirements for the server account, see the "Service Accounts" section.
Enter the settings to configure the server component. These settings include the port numbers of the two WCF endpoints. When finished, click Next.
The VMMSSP server component uses the TCP endpoint port to listen for client requests. The WCF service uses the HTTP endpoint port for publishing the self-service portal service metadata. The metadata will be available using HTTP protocol with a GET request. For more information about WCF endpoints, see the Fundamental Windows Communication Foundation Concepts topic in the MSDN Library.
In the Datacenter administrators box, type the names of the accounts that you want to be able to administer the self-service portal. In the self-service portal, these users will be members of the DCIT Admin user role and have full administrative permissions.
For more information about the DCIT Admin user role, see the "Accounts and Groups for the Self-Service Portal User Roles" section earlier in this document.
Type the name of the datacenter with which the self-service portal will interact. When finished, click Next.
The datacenter name is stored in the VMMSSP database and can be used for reporting purposes. It is not used anywhere in the VMMSSP website.
On the Install the Server Component page, review the settings that you selected, and then click Install. When the installation finishes, click Close.

To install the VMMSSP website component

Note This procedure assumes that you have already placed the downloaded file on all computers on which you plan to install the self-service portal.

To begin the installation process, on the computer on which you are installing the VMMSSP website component, right-click SetupVMMSSP.exe, and then click Run as administrator.
On the Welcome page, click Install.
Review and accept the license agreement, and then click Next.
Click VMMSSP website component, and then click Next.
On the Check Prerequisites for the VMMSSP Website Component page, wait for the wizard to complete the prerequisite checks, and then review the results. If any of the prerequisites are missing, follow the instructions provided. When all of the prerequisites are met, click Next.
Accept or change the file location, and then click Next.
You can use this setting to install the component on a computer other than the one running the Setup wizard.
Use the following steps to configure the IIS website for the self-service portal. For information about the IIS website properties required to configure the portal, see Understanding Sites, Applications and Virtual Directories on IIS 7.
Note For information about the application pool identity required to configure the VMMSSP website component, see "Service Accounts" earlier in this document.
1. In Web site name, type the name that IIS will use for the self-service portal.
2. In Port number, type the port number that IIS will use for the self-service portal.
3. In Application pool name, type the name of the application pool that you have configured for the self-service portal to use.
4. Click Application pool identity, and then click the name of the account that you have configured for the application pool to use.
5. When you finish configuring the IIS properties for the self-service portal, click Next.
Use the following steps to configure the VMMSSP database.
1. In Database server, type the name of the database server that hosts the database that you configured for the VMMSSP server component.
2. To see a list of the SQL Server instances associated with the specified database server, click Get Instances. In SQL Server instance, select the SQL Server instance that manages the new (or existing) VMMSSP database.
3. In Port, type the port number that the SQL Server instance uses for incoming and outgoing communication. If you leave the Port value blank, the Setup wizard sets the value to the default port 1433.
4. Under Credentials, click the type of authentication that the database uses for incoming connections (Windows authentication or SQL Server authentication).
  If you clicked SQL Server authentication, type the user name and password of a SQL Server account to use for accessing the database. Make sure that this account information matches the information you configured when you installed the VMMSSP server component.
5. Click Connect to an existing database. DITSC is selected, and cannot be changed.
6. When you finish configuring the database, click Next.
Enter the settings to configure how the VMMSSP website communicates with the VMMSSP server component. These settings include the host name of the WCF server (the machine running the VMMSSP server component) and the TCP endpoint port number to communicate with the server component. When finished, click Next.
On the Install the Web Portal Component page, review the settings that you selected, and then click Install. When the installation finishes, click Close.
Important If you have not done so already, in the VMM Administrator Console, create a service role named Self Service Role. For more information, see How to Create a Self-Service User Role in the Virtual Machine Manager documentation. The ConnectVM virtual machine action will not work till this step is completed.

Exchange Installation

Virtual Machine Host Configuration - Redmond

A single forest (exchange.gov) has been created, and all the 2 CAS/HT & 3 MBX VMs have been put in that domain. You can access them, by RDP over our corp network into 10.197.215.143 as DDC-JUMP\Administrator. The password is 1GPCcontoso, which is the password for everything in the lab. The desktop for the local Admin user has RDP session saved for each CH1,2 and MBX1,2,3 VMs. You can login either local admin or exchange domain admin.

Some additional information for Exchange install:

Servers	IP Configuration
Exchange forest DC:	DC5 (10.1.1.124)
Primary DNS Server:	10.1.1.124
Secondary DNS Server:	10.1.1.122
MBX Replication IPs:	MBX1 10.1.2.220 MBX2 10.1.2.221 MBX3 10.1.2.222
DAG	DAG1 10.1.1.201

Table 10: Exchange Servers Configuration

Figure 148: Virtual Machine Host Configuration - Redmond

Virtual Machine Host Configuration - GPC

Figure 149: Virtual Machine Host Configuration - GPC

Installing Exchange Server 2010 begins with installing and preparing the operating system. Exchange Server 2010 can be installed only on Windows Server 2008 Standard Edition or Enterprise Edition. If you plan on trying out database availability groups and mailbox database copies, you will need to use the Enterprise Edition of Windows Server 2008. For more information about the requirements for Exchange Server 2010, see Exchange 2010 System Requirements.

Once the operating system has been installed, several pre-requisites must be installed. These include:

Operating system components, including RSAT-ADDS (needed on server that will perform schema updates), Web-Server, Web-Metabase, Web-Lgcy-Mgmt-Console, Web-ISAPI-Ext, NET-HTTP-Activation, Web-Basic-Auth, Web-Digest-Auth, Web-Windows-Auth, Web-Dyn-Compression, RPC-over-HTTP-proxy, Web-Net-Ext and Net-Framework. You can install all of these components at one time (e.g., for the Mailbox, Client Access and/or Hub Transport Server roles) by running the following command:

ServerManagerCmd -i RSAT-ADDS Web-Server Web-Metabase Web-Lgcy-Mgmt-Console Web-ISAPI-Ext NET-HTTP-Activation Web-Basic-Auth Web-Digest-Auth Web-Windows-Auth Web-Dyn-Compression RPC-over-HTTP-proxy Web-Net-Ext -Restart

For more information about the prerequisites for Exchange 2010, including those for the Edge Transport server role, see Exchange 2010 Prerequisites.

You might have noticed that Failover-Clustering is not listed as a pre-requisite. There is a feature in Exchange Server 2010 called a database availability group that does use Windows failover clustering technologies. However, thanks to another Exchange Server 2010 feature called incremental deployment, you no longer install failover clustering before installing Exchange. If you decide to use a database availability group, you simply create one, and then add Mailbox servers to it. When you add a Mailbox server to a DAG, we install the Windows failover clustering feature and automatically create a cluster for you. So while you do need to have Exchange installed on an operating system that supports Windows failover clustering, you do not install the failover clustering feature manually, or ahead of time, and you don't manually create a cluster. It makes deploying highly available mailbox databases quick and easy.

Exchange Server 2010 also supports installing the above pre-requisites by using an Answer File with ServerManagerCmd, and answer files are included in the Scripts folder. To use them, you run ServerManagerCmd -ip <Name of File>. For example:

ServerManagerCmd -ip Exchange-CAS.XML

I recommend that you don't use the XML Answer Files for Exchange-Typical or Exchange-MBX as is, because in the Beta build it mistakenly includs the Failover-Clustering feature, which does not need to be installed before Exchange is installed. This is a remnant from the Answer Files we had in Exchange 2007 that we've since removed.

Next, are the software pre-requisites, which includes:

Microsoft .NET Framework 3.5
Windows Remote Management (WinRM) 2.0 CTP 3
Windows PowerShell 2.0 CTP 3
Update from KB 951725
Update from KB 950888
Update from KB 951116
Update from KB 952664
Update from KB 953290
Update from KB 958178

See Exchange 2010 Prerequisites for information about and links to other pre-requisites that might apply to your environment (e.g., for Edge Transport and Unified Messaging server roles, and for environments that use System Center Operations Manager).

Once the above pre-requisites have been installed, check Microsoft Update for any additional updates that might be needed. Make sure the system has been rebooted after installing any updates which require a reboot.

Now you're ready to install Exchange 2010. You can perform the installation using the GUI or command-line version of Setup. In this example, I'll use the GUI.

I'll start by launching Setup.exe from the AMD64 folder. This launches the Exchange 2010 splash screen:

Figure 150: Exchange Server 2010 Setup

As you can see, the Exchange 2010 splash screen is very similar to the one we had in Exchange 2007. Any needed pre-requisites which are detected, are greyed out, indicating they have been installed, and that you can proceed to the next step. In this case, I can proceed directly to Step 4: Install Microsoft Exchange.

I click that link and it launches the GUI version of Exchange Setup, beginning with a file copy process, and the initialization of Setup.

Figure 151: Exchange Server 2010 Setup

Once Setup is initialized and the file copy process has completed, the Introduction page appears:

Figure 152: Exchange Server 2010 Setup

I click Next, and the Language Files Location page appears:

Figure 153: Exchange Server 2010 Setup

I don't have any additional language files, so I'll leave the default setting of Continue setup without language files and click Next. The Language Pack Confirmation page appears:

Figure 154: Exchange Server 2010 Setup

I click Next, and the License Agreement page appears:

Figure 155: Exchange Server 2010 Setup

After reading the license agreement, I select I accept the terms in the license agreement and click Next. The Error Reporting page appears:

Figure 156: Exchange Server 2010 Setup

Error reporting is very helpful to us, which in turn is helpful to our customers, as it enables us to gather a minimal amount of diagnostic data to troubleshoot and resolve errors and crashes more quickly. So I am going to choose Yes (Recommended) and click Next. The Installation Type page appears:

Figure 157: Exchange Server 2010 Setup

Immediately, you might notice some differences from Exchange Server 2007. First, the Custom Exchange Server Installation option no longer lists any clustered mailbox server roles. That's because clustered mailbox servers don't exist in Exchange Server 2010. Exchange 2010 includes a new feature called Incremental Deployment. This feature enables to you configure high availability and site resilience for your mailbox database after Exchange has been installed.

Second, the default path for the Exchange Server installation is new and different. If I choose Custom Exchange Server Installation, the Server Role Selection page appears:

Figure 158: Exchange Server 2010 Setup

If I choose Typical Exchange Server Installation instead of Custom Exchange Server Installation and click Next, or once I've completed the Custom Exchange Server Installation choices and clicked Next, the Exchange Organization page appears:

Figure 159: Exchange Server 2010 Setup

I specify a name for my Exchange Organization, and then I click Next. The Client Settings page appears:

Figure 160: Exchange Server 2010 Setup

If the Exchange organization uses Outlook 2003 or earlier, or Microsoft Entourage, then a public folder database is needed so that those clients can access system data, such as Free/Busy information. In that case, you would select Yes on this page. Since my organization does not use Outlook 2003 or earlier, or Entourage, I can leave the default setting of No and click Next.

The Customer Experience Improvement Program (CEIP) page appears:

Figure 161: Exchange Server 2010 Setup

This program helps us improve our software by collecting data about how Exchange Server is used. I'll click Join the Exchange Customer Experience Improvement Program and specify an industry of Computer-Related Products/Services.

I click Next. The Readiness Checks page appears, and Setup automatically performs readiness checks for any installed language packs, as well as the selected server roles to be installed.

Figure 162: Exchange Server 2010 Setup

As you can see, the readiness checks don't take much time at all. Once all readiness checks have successfully passed, the Readiness Check page will look similar to this:

Figure 163: Exchange Server 2010 Setup

At this point, the system and server are ready for the installation to begin. I click Install to start the installation of Exchange 2010 Mailbox, Client Access and Hub Transport server roles, as well as the Exchange Management tools (Exchange Management Console and Exchange Management Shell).

While Setup is progressing, a Progress page will be appeared:

Figure 164: Exchange Server 2010 Setup

Once Setup has completed successfully, the Completion page will appear:

Figure 165: Exchange Server 2010 Setup

As you can see, installing Exchange 2010 is quick and easy. On my system, Setup took just under 10 minutes to complete.

I prefer to reboot the system before finalizing the installation. Uncheck the Finalize installation using the Exchange Management Console checkbox, and click Finish to complete the Setup process. This returns Setup to the splash screen. Click Close to close the splash screen, and when the Confirm Exit dialog appears:

Figure 166: Exchange Server 2010 Setup

Click Yes.

Then, reboot the server. OK, technically, you don't need to reboot the server, but I do anyway.

The installation of Exchange Server 2010 is now complete.

Exchange Configuration

Machine Names and associated IP addresses (all machines listed here are virtual unless otherwise noted):

Parent Domain
- DC1.Contoso.Gov (physical machine)
  - 10.1.1.120
  - Primary DNS for all servers
- DC3.Ops.Contoso.Gov
  - 10.1.1.122
  - Secondary DNS for all servers
Exchange Domain
- DC5.Resource.Gov
  - 10.1.1.124
- CH1.OPS.Contoso.Gov
  - 10.1.1.210
- CH2.OPS.Contoso.Gov
  - 10.1.1.211
- MBX1.OPS.Contoso.Gov
  - 10.1.1.220
  - 10.1.2.220 (Replication Network)
- MBX2.OPS.Contoso.Gov
  - 10.1.1.221
  - 10.1.2.221 (Replication Network)
- MBX3.OPS.Contoso.Gov
  - 10.1.1.222
  - 10.1.2.222 (Replication Network)

Other Names

Exchange Domain
- NLB1.OPS.Contoso.Gov
  - 10.1.1.200
- DAG1.OPS.Contoso.Gov
  - 10.1.1.201

Known Issues with Exchange 2010 SP1 DF7.5 build

Unable to access OWA after install

Scenario:

• Installed Partner Hosted Exchange on Windows Server 2008 R2

• Unable to navigate to OWA (eg. https://localhost/owa)

Error:

Workaround:

1. Open "IIS Manager" in the box

2. Expand "Sites" node in IIS Manager

3. Select "Default Web Site" under Sites

4. Select "ISAPI Filters" in Default Web Site

5. Remove "Microsoft.Exchange.AuthModuleFilter ISAPI Filter"

Then you should be able to access OWA now.

AD and DoMT should be deployed on separate boxes\If Isolated GAL is enabled, OAB should be deleted

To use Open Domain feature where GAL is hidden to user

• AD and CAS should be deployed on separate boxes

• Create a tenant (e.g. myOrg) without the following features in service plan

o <AddressListsEnabled>true</AddressListsEnabled>

o <OfflineAddressBookEnabled>true</OfflineAddressBookEnabled>

Use the following to hide GAL

o Get-GlobalAddressList -Organization myOrg | Set-GlobalAddressList -IsolationMode $true

Password change through OWA doesn't does not work after first logon unless "Group Policy" is changed

• Start > Administrative Tools > Group Policy Management > Forest > Domains > Group Policy Objects > Default Domain Policy > Right click to "Edit" and change the "Minimum password age" to 0 to allow immediate password change.

Default connectors should be created for mail delivery between tenants

• New-SendConnector –Name Test –AddressSpaces * -Smarthosts localhost -DnsRoutingEnabled $false

• Get-ReceiveConnector -Identity "<NetBiosName>\Default <NetBiosName>" | Set-ReceiveConnector -PermissionGroups "ExchangeUsers, ExchangeServers, ExchangeLegacyServers, AnonymousUsers"

Hosting Command Lets might not be available

We have 2 reports that hosting command lets are not available despite the fact that the /hosting switch is used for deployment.

While the Exchange Team is looking into the issue and how to fix it here is a workaround for the problem. Unfortunately it means if you ran into this issue you will have to redeploy Exchange as there is no easy way to retrofit the missing settings.

1. Build a new Lab without Exchange AD preparation run

2. install the first Exchange Role with the following commandline "setup /mode:install /roles:ca,HT /hosting /on:<ExchangeOrganizationName>", replace <ExchangeOrganizationName> with the name for the intended Exchange Organization

When you check the ExchangeSetup Log under the Install-ExchangeOrganization task you should see –IsPartnerHosted $true.

[02/27/2010 01:31:24.0103] [0] Setup will run the task 'Install-ExchangeOrganization'

[02/27/2010 01:31:24.0103] [1] Setup launched task 'Install-ExchangeOrganization -IsPartnerHosted $true

Should you see this or any related issue in your deployment please report it to the DL.

Pasted from <https://ea.microsoft.com/hosters/Lists/Known%20Issues%20with%20DF75/AllItems.aspx>

Installation / Configuration Steps

Software Required
- Windows 2008 R2 (forest / domain functional level)
  Create a user object svc-certauth and make a member of IIS_IUSRS group
- Windows 2008 Roles
  Active Directory Domain Services
  Active Directory Certificate Services
  Certification Authority
  Certification Authority Web Enrollment
  Online Responder
  Certificate Enrollment Web Service
  Certificate Enrollment Policy Web Service
  Enterprise CA
  DNS Server
  Create the following DNS records
  autodiscover.contoso.gov
  mail.contoso.gov
  casarray01.contoso.gov
  dag01.contoso.gov
- Windows Update after the installation of Prereqs
- Additional hotfixes:
  WCF Update
  http://go.microsoft.com/fwlink/?LinkId=183148
  Hotfix KB981002
  https://connect.microsoft.com/VisualStudio/Downloads/DownloadDetails.aspx?DownloadID=27127
  Hotfix KB979099 (Update for AD RMS)
  http://support.microsoft.com/?kbid=979099
  Microsoft Filter Pack
  http://www.microsoft.com/downloads/details.aspx?FamilyID=60c92a37-719c-4077-b5c6-cac34f4227cc&displaylang=en

Install and Configure Exchange 2010 SP1 Hosting Edition

Build a new Lab without Exchange AD preparation (Windows 2008 R2 dc's and OS)

Domain Functional Level	Windows 2008
Forest Functional Level	Windows 2008
Exchange Member Servers OS	Windows 2008 R2

Install the first Exchange Role with the following commandline
PowerShell Script

"setup /mode:install /roles:ca,HT /hosting /on:<ExchangeOrganizationName>"

When you check the ExchangeSetup Log under the Install-ExchangeOrganization task you should see –IsPartnerHosted $true.

[02/27/2010 01:31:24.0103] [0] Setup will run the task 'Install-ExchangeOrganization'

[02/27/2010 01:31:24.0103] [1] Setup launched task 'Install-ExchangeOrganization -IsPartnerHosted $true

Pasted from <https://ea.microsoft.com/hosters/Lists/Known%20Issues%20with%20DF75/AllItems.aspx>

Create a new Client Access Array

PowerShell Script

New-ClientAccessArray -FQDN casarray01.contoso.com -Name "casarray01.contoso.com" -Site "Toronto"

Create a certificate request

PowerShell Script

New-ExchangeCertificate -GenerateRequest -SubjectName "c=US, o=Contoso, cn=mail.contoso.gov" -DomainName cdautodiscover.contoso.gov, ecp.contoso.gov, mail.contoso.gov -PrivateKeyExportable $true

Get the thumbprint and enable the new cert with Get-ExchangeCertificate and Enable-ExchangeCertificate

Enable-ExchangeCertificate -Thumbprint 5867672A5F29B388C235E1235 -Services "IMAP, POP, IIS, SMTP"

Create a new Database Availability Group

PowerShell Script

New-DatabaseAvailablityGroup

Add mailbox servers to the DAG

PowerShell Script

Add-DatabaseAvailabilityGroupServer -Identity DAG01 -MailboxServer MBX1

Add-DatabaseAvailabilityGroupServer -Identity DAG01 -MailboxServer MBX2

Add-DatabaseAvailabilityGroupServer -Identity DAG01 -MailboxServer MBX3

Rename the default mailbox databases

PowerShell Script

Set-MailboxDatabase -Identity "Mailbox Database 0483463198" -Name MDB01

Set-MailboxDatabase -Identity "Mailbox Database 1593765178" -Name MDB02

Set-MailboxDatabase -Identity "Mailbox Database 2142150893" -Name MDB03

Add mailbox database copies

PowerShell Script

Add-MailboxDatabaseCopy -Identity MDB01 -MailboxServer MBX2

Add-MailboxDatabaseCopy -Identity MDB01 -MailboxServer MBX3

Add-MailboxDatabaseCopy -Identity MDB02 -MailboxServer MBX1

Add-MailboxDatabaseCopy -Identity MDB02 -MailboxServer MBX3

Add-MailboxDatabaseCopy -Identity MDB03 -MailboxServer MBX1

Add-MailboxDatabaseCopy -Identity MDB03 -MailboxServer MBX2

Configure the RPC Client Access Array

PowerShell Script

Set-MailboxDatabase -Identity MDB01 -RpcClientAccessServer casarray01.contoso.com

Set-MailboxDatabase -Identity MDB02 -RpcClientAccessServer casarray01.contoso.com

Set-MailboxDatabase -Identity MDB03 -RpcClientAccessServer casarray01.contoso.com

Document Information
1. Terms and Abbreviations

Abbreviation	Definition
SCVMM	System Center Virtual Machine Manager
SCOM	System Center Operations Manager
VMM	Virtual Machine Manager
WAN	Wide Area Network
SAN	Storage Area Network
SAS	Serial Attached SCSI
VHD	Virtual Hard disk
VSV	Virtual save state file
VSS	Volume shadow Copy Service

Table 11: Terms and Abbreviations

Appendix A – Hyper-V Host Server Farm Pattern

The Host Server Farm architecture pattern is illustrated below.

This pattern provides server consolidation and high availability on a greater scale.
Supports up to 16 nodes in a single cluster configuration.
Virtual machines can run on any node of the cluster.
In the event of a node failure, the virtual machines will be restarted automatically on any node that has the available capacity to host the failed resources.

Figure i: Hyper-V Server Farm pattern

Information

The Host Server Farm pattern provides high availability as well as better use of hardware since a single physical host can serve a passive node for up to 15 active nodes.

Appendix B – Host Cluster patterns

No Majority – Disk Only

The cluster has quorum if one node is available and in communication with a specific disk in the cluster storage. Only the nodes that are also in communication with that disk can join the cluster.

Microsoft Recommendations

This pattern is not recommended for High Availability as the disk can be a single point of failure.

Node Majority

Node Majority is a quorum model where each node that is available and in communication can vote. The cluster functions only with a majority of the votes, that is, more than half.

Microsoft Recommendations

This pattern is recommended in Failover Cluster deployments containing an odd number of nodes.

Node and Disk Majority

Microsoft Recommendations

This pattern is recommended in Failover Cluster deployments containing an even number of nodes.

Node and File Share Majority

Microsoft Recommendations

This pattern is recommended in Failover Cluster deployments containing an even number of nodes and for Multi-Site failover clusters.

Figure ii: Host Cluster Patterns

Appendix C – Network Architecture

Microsoft Recommendations

Use multiple NICs and multi-port NICs on each host server.

One NIC dedicated to the host machine only for management purposes
One NIC dedicated to the private Cluster Heartbeat network
One NIC dedicated to the Live Migration network
One or more NICs dedicated to the guest virtual machines (use 10 gpbs NICS for highest consolidation)
Two or more NICs dedicated to iSCSI with MPIO

Dedicate at least one NIC/Port on each host server for guest virtual machine network I/O. For maximum consolidation ratio, utilize one or more 10-Gigabit Ethernet NICs to virtual machine network I/O.

Warning

Microsoft does not support the use of NIC teaming software. Support for these third-party technologies must be provided by the vendor.

Appendix D - Processor Architecture

Windows Server 2008 R2 with Hyper-V requires x64 processor architecture from Intel or AMD, as well as support for hardware execute disable and hardware virtualization such as Intel VT or AMD-V.

Microsoft Recommendations

Appendix E – Memory Architecture

Microsoft Recommendations

For all host server architecture patterns, we recommend a minimum of 16 GB of RAM.

For Multi-Node Host Server Farm patterns, we recommend a minimum of 64 GB per server.

Appendix F - Drive types

SCSI

SATA

SAS

Fibre Channel

Microsoft Recommendations

Fibre Channel 15k RPM drives are recommended for Host Server Farm patterns.

If you are using a Fibre Channel SAN, ensure that the switch and director infrastructure is sized to handle the large amount of storage I/O that will be generated from the consolidated servers.

Appendix G - Disk Redundancy Architecture

RAID 1

RAID 5

RAID 1+0 (RAID 10)

RAID levels that are higher than 10 (1 + 0) may offer additional fault tolerance or performance enhancements. These levels generally are proprietary systems.

For more information about these types of RAID systems, contact your storage hardware vendor.

RAID 1 or RAID 1+0 is recommended for the system volume in all host server architecture patterns.

RAID 1+0 is recommended for the data volumes in the Host Server Farm patterns.

Appendix H - Fibre Channel Storage Area Network

Architecture	Throughput (theoretical max Megabyte/sec)
iSCSI (Gigabit Ethernet)	125 MB/s
Fibre Channel (2 GFC)	212.5 MB/s
SATA (SATA II)	300 MB/s
SCSI (U320)	320 MB/s
SAS	375 MB/s
Fibre Channel (4 GFC)	425 MB/s

Table i: Comparison of Disk Controller throughput speeds

For performance and security reasons, it is strongly recommended that iSCSI SANs utilize dedicated NICs and switches that are separate from the LAN.

Direct attached storage or iSCSI SAN storage is recommended for the Single Host Server architecture pattern.
iSCSI or Fibre Channel SANs are recommended for the Two-Node Host Cluster pattern.
Fibre Channel SANs are recommended for the Host Server Farm pattern.

Table ii: Comparison of Disk Controller Interfaces

Architecture	Throughput (theoretical max Megabyte/sec)
iSCSI (Gigabit Ethernet)	125 MB/s
Fibre Channel (2 GFC)	212.5 MB/s
SATA (SATA II)	300 MB/s
SCSI (U320)	320 MB/s
SAS	375 MB/s
Fibre Channel (4 GFC)	425 MB/s

SATA II or SAS are recommended for the Single Host Server architecture pattern, with SAS being the preferred option.

iSCSI, 2 GFC Fibre Channel, or 4 GFC Fibre Channel are recommended for the Two-Node Host Cluster architecture pattern.

4 GFC Fibre Channel is recommended for the Host Server Farm architecture pattern.

Figure iii: CSV Volume Allocation

Appendix K - System Center Virtual Machine Manager R2 2008

Use Cluster Shared Volumes in Two-Node and Host Server Farm architecture patterns.
Allocate SAN LUNs and corresponding CSV volumes based on workload I/O requirements.
Use gigabit Ethernet or higher for all cluster communication networks, including the Private Cluster Heartbeat and Live Migration networks.

Delegated Management and Provisioning Web Portal

Stored virtual machines
Virtual hard disks
CD/DVD software images, also called ISO files
Hardware configurations
Templates
Administrator Console

Appendix L – Hyper-V Overview

These are the recommended security best practices on a Hyper-V environment, cumulative to the usual security best practices for physical servers:

Securing the communications between the Hyper-V server and its administrators and users.

Figure iv: Hyper-V Environment

Appendix M – Hardware Architecture

Hyper-V Management Server

Server Architecture

2 x Xeon Quad Core Processors x64

32 GB of RAM

2 x 150 GB (300GB) RAID 1 OS Partition with Array - SAS RAID Controller

Local or External Storage (ISCSI/FC)

Up to 4 x 1GBps Network ports (Management/Virtual/External and potentially ISCSI Networks)

Table iv: Management Host Server Architecture

Note: Optionally, the virtual management servers can be installed on individual physical servers (running Hyper-V) where necessary to allow for more scaling of resources.

The Virtualised Management Servers which will be used have the following resource requirements:

Hyper-V Cluster Nodes

Server Architecture

2 x Xeon Quad Core Processors x64

48GB of RAM

2 x 150 GB (300GB) RAID 1 OS Partition with Array - SAS RAID Controller

Optional 2GBps FC HBA (if using FC SAN)

External Storage (ISCSI/FC) – 5TB

Up to 3 x 1GBps Network ports (Management/Virtual/Live Migration/ Heartbeat and potentially ISCSI Networks) Minimum required is 2.

Table v: Cluster Host Server Architecture

Disk Storage

The Hyper-V host servers should utilise local storage for the operating system and the paging file.

The drives utilised by the operating system should be configured as RAID 1.

HBA/ISCSI Interface

Each server should be fitted with either a separate ISCSI network adapter or a single channel FC HBA to connect to the SAN.

Virtual Machine Storage

In addition, the underlying storage should use Clustered Shared Volumes to store the Virtual Machines.

Quick Migration

Operating System Version

The GPC-POC will utilise Microsoft Windows Server 2008 R2 Enterprise or Datacenter editions as these support the memory and processing needs of large-scale, mission-critical applications.

Note: To be managed by the SCVMM server, it is necessary for the Cluster nodes to be part of the same Domain and as such the Cluster can only be built after the Management Servers are in place.

Cluster Host Server Overview

Figure iv: Cluster Host Server Overview

Appendix N – References

For Deployment Scenario more details please refer to the link http://www.microsoft.com/downloads/details.aspx?FamilyID=fef38539-ae5a-462b-b1c9-9a02238bb8a7&displaylang=en and download a file VMM08R2_VMMSSPDocumentation.zip for more information.
Failover clustering documents http://technet.microsoft.com/en-us/library/cc732181(WS.10).aspx#BKMK_Install
Build SCVMM & SQLVM http://technet.microsoft.com/en-us/library/cc764289.aspx
SQL 2008 Install http://technet.microsoft.com/en-us/library/bb500469(SQL.100).aspx
http://technet.microsoft.com/en-us/library/ms143506(SQL.100).aspx
Exchange 2010 SP1 download link http://technet.microsoft.com/en-us/evalcenter/dd185495.aspx
Lab Configuration excel sheet
RDP Gateway http://technet.microsoft.com/en-us/library/dd560672(WS.10).aspx
Unified Access Gateway http://technet.microsoft.com/en-us/library/dd857385.aspx

1 Executive Summary 1

私有云设计文档

2011-10-08T05:38:00Z

Table of Contents

1.1 Introduction 1

1.2 About this Document 1

1.3 Intended Audience 1

1.4 Document Scope 1

3 Constraints and Assumptions 2

4 Solution Design 3

4.1 Server Infrastructure 4

4.1.1 Active Directory Server (DDC1-DC01) 4

4.1.2 Firewall Server (DDC1-TMG01) 4

4.1.3 Remote Desktop Gateway Server (DDC1-TSG01) 5

4.1.4 Provisioning Server (DDC1-APF01) 5

4.1.5 Web Portal Server (DDC1-WEB01) 5

4.1.6 System Center Virtual Machine Manager Server (DDC1-SCVMM01) 6

4.1.7 System Center Operations Manager Server (DDC1-SCOM01) 7

4.1.8 Hyper-V Server Cluster 7

4.2 Network 8

4.3 Storage 9

4.4 Backup and Restore 9

4.5 Security Considerations 10

4.5.1 End User Access to the solution 10

4.5.2 Hyper-V 10

4.5.3 Host Operating System Configuration 10

5 Implementation of Design 11

5.1 Hardware Architecture 11

5.1.1 Hyper-V Management Server 11

5.1.2 Hyper-V Cluster Nodes 12

5.1.3 Disk Storage 12

5.1.4 Live Migration 12

5.1.5 Operating System Version 13

5.1.6 Cluster Host Server Overview 13

5.2 Network Architecture 14

5.2.1 Virtual Machine Networking 15

5.3 User Access 16

6 G-Cloud Demonstrator Web site 17

6.1 GCloud – Main Website 18

6.1.1 Web.Config 18

6.1.2 AvailableVMTypes.xml 18

6.2 VMM Service 19

6.2.1 Web.Config 19

6.2.2 APF.XML 19

6.3 Setting the Cost Center and SMTP Settings 20

6.3.1 Config.XML 20

6.3.2 SetParameters.ps1 21

6.3.3 Set Parameters Scheduled Task 21

7 Deploying G-Cloud Demonstrator 22

7.1 Known Issues 23

8 Document Information 24

8.1 Terms and Abbreviations 24

Appendix A – Hyper-V Host Server Farm Pattern 25

Appendix B – Host Cluster patterns 26

 No Majority – Disk Only 26

 Node Majority 26

 Node and Disk Majority 26

 Node and File Share Majority 26

Appendix C – Network Architecture 28

Appendix D - Processor Architecture 29

Appendix E – Memory Architecture 30

Appendix F - Drive types 31

Appendix G - Disk Redundancy Architecture 32

Appendix H - Fibre Channel Storage Area Network 33

Appendix I - Disk Controller or HBA Interface 34

Appendix J - Cluster Shared Volumes 35

Appendix K - System Center Virtual Machine Manager R2 2008 37

Virtual Machine Manager Server 37

Microsoft SQL Server Database 37

VMM Library Servers 37

Administrator Console 38

Delegated Management and Provisioning Web Portal 38

Table of Tables

Table 1: Assumptions 2

Table 2: Management Host Server Architecture 11

Table 3: Cluster Host Server Architecture 12

Table 4: Terms and Abbreviations 24

Table 5: Comparison of Disk Controller throughput speeds 33

Table 6: Comparison of Disk Controller Interfaces 34

Table of Figures

Figure 1: G-Cloud Demonstrator Network Overview 8

Figure 2: Cluster Host Server Overview 13

Figure 3: Cluster Node Network Overview 14

Figure 4: Hyper-V Server Farm pattern 25

Figure 5: Host Cluster Patterns 27

Figure 6: CSV Volume Allocation 36

Executive Summary
Introduction

The G-Cloud Demonstrator is a self-contained virtualised management infrastructure which can be implemented in a suitable environment to show the use of Microsoft Technologies in provisioning and managing Virtual Machines. This document covers the design and implementation details to allow the technical personnel involved in implementing the solution to understand what components are involved and how they are configured.

About this Document

This document provides a High Level overview of the Infrastructure Design for the G-Cloud Demonstrator Infrastructure.

Intended Audience

The intended audience of this document is the technical personnel engaged in implementing the G-Cloud Demonstrator solution within the Partners environment.

Document Scope

The scope of this document is concerned with Microsoft technologies only.

Constraints and Assumptions

The server and storage hardware required for the G-Cloud Demonstrator environment is as specified by the hosting partner provided it meets the minimum requirements as defined in this document.

There are also a lot of related conditions and technologies that will have an impact on the G-Cloud demonstrator working. Some of those assumptions are listed in the table below:

Assumption	Explanation
Physical environment	It is assumed that a server environment exists with enough floor space, power, air conditioning, physical security etc.
Stable network	It is assumed that the local and wide area network infrastructure which includes physical components switches, routers, cable etc. And the logical components like routing, broadcasts, collisions etc. Are stable and under control. Having an unstable network can result in unexpected behaviour.

Table 1: Assumptions

Solution Design

The G-Cloud Demonstrator is based on a self-contained domain environment consisting of a number of management servers to support a scalable Hyper-V cluster onto which the solution will provision multiple Virtual Machines:

The actual G-Cloud Demonstrator components in the handover consist only of the virtual machines making up the management servers. The associated Hyper-V Cluster needs to be created after the management servers are in place in the environment as it will need to be joined to the G-Cloud demonstrator domain.

The sections below covers the detailed configuration for the G-Cloud Demonstrator Infrastructure Environment.

Server Infrastructure
1. Active Directory Server (DDC1-DC01)

The Active Directory Server holds all the domain accounts for the management servers plus it hosts the following services required for the proper operation of the solution:

DNS
DHCP
- Address Lease Range – 192.168.1.30-192.168.1.150
- Scope Options:
KMS (Optional)

Firewall Server (DDC1-TMG01)

The Threat Management Gateway provides the secured end-user access to the Web Portal.

External Web URL: http://<external web ip address as per your environment>/GCloud

Firewall Rules Configured:

DDC1-WEB01 – Allows access to the G-Cloud Demonstrator Website from all addresses (internal and external) uses the "Web Listener" (see below)
DDC1-TSG01 – Allows access to Remote Desktop Gateway Server (DDC1-TSG01) in order for users to RDP into their Virtual machines.
Outbound Web Access – Allows all machine in the environment access to the external network. Note: This was a broad rule for the purposes of setup and should be restricted to allow on the DDC1-APF01 server outbound http/https access to Microsoft Update for WSUS Updates.
Note: The APF rules in the configuration are not required for the functioning of the solution and may be deleted.

Listeners Configured

Web Listener – Port 80 Listener on an External IP addresses (needs to be set as per your environment). Set to use "Basic Authentication"
Remote Desktop Gateway – Port 443 Listener on a specific External IP address (needs to be set as per your environment), uses the DDC1-TSG01 Cert which is also in the Trusted Root Store.

Web Chaining Rule – This will need to be updated with the details of your upstream proxy server.

Remote Desktop Gateway Server (DDC1-TSG01)

The Remote Desktop Gateway Server provides Secure Remote Desktop access to the Virtual Machines provisioned by the end-users.

Access Rights – Administrators and Department Users
Machine Access – Note: This is set to allow access to all machines in the environment initially but can be limited as required.

Provisioning Server (DDC1-APF01)

The Provisioning Server hosts the scripts and library for installing the server applications as part of the automated build solution.

Key Shares:

APFSrc – holds the library of applications used by the automated build

APFTree – holds the manifest files and scripts used by the automated build

In addition, WSUS is installed on this server to allow updates to be sent to all the machines in the environment.

Note: On first use, it is important to ensure the server has outbound web access to Microsoft Update and that a Synchronisation is run successfully.

Web Portal Server (DDC1-WEB01)

The Web Portal Server host the end-user interface to the G-Cloud Demonstrator.

Internal Web URL: http://ddc1-web01.ddc1.local/GCloud

Further info around the web site can be found in Section 6

System Center Virtual Machine Manager Server (DDC1-SCVMM01)

The Library holds a number of sysprepped images and hardware templates:

Name	Type	Notes
		
		
		
		
		
		
		
		
		
		
		
		
		
		

System Center Operations Manager Server (DDC1-SCOM01)

The System Center Operations Manager is installed for providing a means of consolidated health monitoring across both the management servers and the provisioned virtual machines.

Additional Management Packs installed:

SUSE and Red Hat Linux

Note: That although the Linux management packs are installed, the Linux Images provided as part of the Solution do not contain the SCOM Agent and so will not be automatically monitored. This feature may be provided at a later date.

Hyper-V Server Cluster

Network

Figure 1: G-Cloud Demonstrator Network Overview

Storage

The Storage design can be kept as simple as possible – either a FC/ISCSI connection is needed to the SAN and enough disk space to cater for the potential number of virtual machines is required for the host cluster.

Backup and Restore

As this is purely a demonstrator, Virtual machines will not be backed up.

Security Considerations
1. End User Access to the solution

Access to the solution for end-users is via a HTTP link over the Internet and through the TMG Server to the Web Portal. It is assumed that the hosting environment has an outer firewall limiting traffic reaching the DDC1-TMG01 Server.

Note: As this is a pure demonstrator solution, the security of the environment will need to be reviewed against the requirements of the environment into which it is being deployed and as such firewall rules and further security lockdown measures may be required.

Hyper-V

These are the recommended security best practices on a Hyper-V environment, cumulative to the usual security best practices for physical servers:

Securing the communications between the Hyper-V server and its administrators and users.

Host Operating System Configuration

Keep the management operating system up to date with the latest security updates.
Use a separate network with a dedicated network adapter for the management operating system of the physical Hyper-V computer.
Secure the storage devices where you keep virtual machine resource files.
Harden the management operating system using the baseline security setting recommendations described in the Windows Server 2008 R2 Security Compliance Management Toolkit.
Configure any real-time scanning antivirus software components installed on the management operating system to exclude Hyper-V resources.
Do not use the management operating system to run applications.
Do not grant virtual machine administrators permission on the management operating system.
Use the security level of your virtual machines to determine the security level of your management operating system.

Implementation of Design

The G-Cloud Demonstrator is based on a set of virtualised Management servers which provide the necessary support infrastructure for provisioning of virtual machines. Not included, but required is a Hyper-V Cluster (minimum 2-nodes) which can be managed from the included SCVMM Server. This then provides the location for new virtual machines to be provisioned onto via the web portal.

Hardware Architecture
1. Hyper-V Management Server

The recommended server configuration for the Hyper-V Management Server is:

Server Architecture

2 x Xeon Quad Core Processors

48GB of RAM

2 x 73 GB RAID 1 OS Partition with Array - SAS RAID Controller

Optional 2GBps FC HBA (if using FC SAN)

Local or External Storage (ISCSI/FC) – 200GB

Up to 4 x 1GBps Network ports (Management/Virtual/External and potentially ISCSI Networks)

Table 2: Management Host Server Architecture

Note: Optionally, the virtual management servers can be installed on individual physical servers (running Hyper-V) where necessary to allow for more scaling of resources.

The Virtualised Management Servers which will be used have the following resource requirements:

Management Server	Machine Name	Memory	CPUs	Disk Size(s)
Active Directory Server	DDC1-DC01	2GB	2	1 x 60GB
SCVMM Server	DDC1-SCVMM01	4GB	2	1 x 60GB 1 x 100GB
SCOM Server	DDC1-SCOM01	4GB	2	1 x 60GB
Web Portal Server	DDC1-WEB01	2GB	2	1 x 60GB
Provisioning Server	DDC1-APF01	2GB	2	1 x 60GB 1 x 200GB
Remote Desktop Gateway Server	DDC1-TSG01	1GB	2	1 x 60GB
Firewall Server	DDC1-TMG01	1GB	2	1 x 60GB

Hyper-V Cluster Nodes

The recommended server specification for each cluster node is:

Server Architecture

2 x Xeon Quad Core Processors

48GB of RAM

2 x 73 GB RAID 1 OS Partition with Array - SAS RAID Controller

Optional 2GBps FC HBA (if using FC SAN)

External Storage (ISCSI/FC) – 5TB

Up to 5 x 1GBps Network ports (Management/Virtual/Live Migration/ Heartbeat and potentially ISCSI Networks)

Table 3: Cluster Host Server Architecture

Disk Storage

The Hyper-V host servers should utilise local storage for the operating system and the paging file.

The drives utilised by the operating system should be configured as RAID 1.

HBA/ISCSI Interface

Each server should be fitted with either a separate ISCSI network adapter or a single channel FC HBA to connect to the SAN.

Virtual Machine Storage

In Hyper-V R2, the performance of Dynamically Expanding disks has increased dramatically and are now viable options for production use, G-Cloud Demonstrator will use Dynamically Expanding disks for Virtual Hard Disks. This will reduce storage oversubscription and fragmentation.

In addition, the underlying storage should use Clustered Shared Volumes to store the Virtual Machines.

Live Migration

All virtual machines that will be hosted on the Hyper-V infrastructure will be able to take advantage of the live migration feature. This will enable entire workloads to be moved between hosts in the event of planned downtime without service loss.

Operating System Version

The G-Cloud Demonstrator will utilise Microsoft Windows Server 2008 R2 Enterprise or Datacenter editions as these support the memory and processing needs of large-scale, mission-critical applications.

Note: To be managed by the SCVMM server, it is necessary for the Cluster nodes to be part of the same Domain and as such the Cluster can only be built after the Management Servers are in place.

Cluster Host Server Overview

Figure 2: Cluster Host Server Overview

Network Architecture

The Hyper-V servers within the environment will be connected to a number of different networks.

Each of the Cluster servers will be configured with up to 5 Networks:

Management Network
Virtual Machine Network
Cluster Heartbeat network
Live Migration Network (may be shared with Cluster Heartbeat Network if needed)
Potentially an ISCSI network (if using an ISCSI SAN)

The Management connection is dedicated to the host itself for network I/O and management.

The Cluster heartbeat connection is used by all the cluster nodes to ascertain if all nodes within the cluster are responding and operational.

The Live migration network is used to failover virtual machines to alternate nodes in the cluster configuration with no loss of service to the end user.

The Virtual Machine network is dedicated to the guest virtual machines.

The ISCSI Network is used for connection to the ISCSI SAN (if used).

Figure 3: Cluster Node Network Overview

Virtual Machine Networking
1. Virtual Management Servers

The Virtualised Management Servers are pre-configured as follows:

Management Server	Machine Name	Host Network	VM Network	IP Address
Active Directory Server	DDC1-DC01	External Network 1	Internal	192.168.1.2
SCVMM Server	DDC1-SCVMM01	External Network 1	Internal	192.168.1.5
SCOM Server	DDC1-SCOM01	External Network 1	Internal	192.168.1.4
Web Portal Server	DDC1-WEB01	External Network 1	Internal	192.168.1.6
Provisioning Server	DDC1-APF01	External Network 1	Internal	192.168.1.3
Remote Desktop Gateway Server	DDC1-TSG01	External Network 1	Internal	192.168.1.7
Firewall Server	DDC1-TMG01	External Network 1 External Network 1	DDC1 LAN External	192.168.1.1 <External facing IP>

Note: External Network 1 corresponds to the Virtual Machine Network in the Network Architecture

New Virtual Machines

All new Virtual Machines will be built on the Host Cluster and be attached to External Network 1 (the Virtual Machine Network). They will also receive a DHCP address from the AD Server.

User Access

The following user accounts have been created in the domain:

Domain\Username	Password
	
	
	
	

And these have all been added to the following group:

DDC1\Department Users

In SCVMM a new Self Service User Role has been created "Department Self Service Users" and the three department users have been added to this new role. The following rights have then been assigned:

Scope – All Hosts
VM Permissions – All Actions
Create VM – No rights
Store VM – No rights

On the TMG server, a Web Portal rule has been created to allow HTTP access for the users through to the DDC1-WEB01.ddc1.local server.

G-Cloud Demonstrator Web site

On top of the G-Cloud Demonstrator infrastructure is the actual Web Site for provisioning and managing virtual machines. The capability being provided is as follows:

Managing Virtual Machines – the following options are available for managing machines:

Start
Stop
De-Provision/Remove
Connect to machine

Provisioning Virtual Machines – the following roles may be provisioned:

Windows Server 2003 Base OS
Windows Server 2008 R2 Base OS
Red Hat Linux Base OS
Windows Server 2008 R2 plus IIS Role
Windows Server (supported version for Dynamics CRM)
Windows Server (supported version for MOSS 2007)
Windows Server 2008 R2 Base OS with Visual Studio 2010

Note: All Windows Servers have the username and password set to the following:

Username: Administrator
Password: Dynamic01!

Any Linux machines have the username and password set to:

Username: root
Password: pass@word1

GCloud – Main Website

The GCloud website uses two configuration files which can be found in the following directory:

C:\inetpub\wwroot\GCloud

Web.Config

In the Web config file the following parameter which needs to be set for the proper functioning of the GCloud website as it designates the directory in which the log files are placed such that the Task Scheduler based "" task can collect the Cost Center and email address information for assigning to the virtual machine and initiating a notification email to the end-user once the machine provisioning is complete.

</appSettings>

AvailableVMTypes.xml

In the GCloud Website directory there is also a file called AvailableVMTypes.xml, this can be changed to dynamically change the options found when attempting to provision a Virtual Machine through the GCloud demonstrator portal.

<?xml version="1.0" encoding="utf-8" ?>

<AvailableVMTypes>

<VMType Name="Windows Server 2003 Base OS" Template="Server 2003 Ent SP2 (x86)" apfId="MS-BASE"/>

<VMType Name="Windows Server 2008 R2 Base OS" Template="Server 2008 R2 Ent (x64)" apfId="MS-BASE"/>

<VMType Name="Windows Server 2008 R2 plus IIS Role" Template="Server 2008 R2 Ent (x64)" apfId="MS-IIS"/>

<VMType Name="Windows Server (supported version for Dynamics CRM)" Template="Server 2008 R2 Ent (x64)" apfId="MS-DYN4"/>

<VMType Name="Windows Server (supported version for MOSS 2007)" Template="Server 2008 R2 Ent (x64)" apfId="MS-MOSS2007"/>

<VMType Name="Windows Server 2008 R2 plus Dev 10" Template="Server 2008 R2 Ent (x64)" apfId="MS-DEV2010"/>

<VMType Name="Red Hat Linux Base OS" Template="Redhat 5.3 (x64)" apfId=""/>

</AvailableVMTypes>

VMM Service

The VMM Service uses two configuration files which can be found in the C:\inetpub\wwroot\VMMService directory:

Web.Config

In the Web config file the following parameters are set for the proper functioning of Remote Control and the operation of the VMM Service itself:

</appSettings>

<endpoint address="http://ddc1-web01.ddc1.local/VMMService/VMMService.svc"

binding="basicHttpBinding" bindingConfiguration="BasicHttpBinding_IVirtualMachineManagerService"

contract="VMMService.IVirtualMachineManagerService" name="BasicHttpBinding_IVirtualMachineManagerService" />

</client>

APF.XML

In the VMMService directory you will find a file called apf.xml which defines the details needed by the Provisioning engine:.

<MASTERAPF>

<CORELAB>

<DistUsr>APF_Source</DistUsr>

<DistPwd>Stimper12!</DistPwd>

<DistDom>DDC1</DistDom>

<APFSource>\\DDC1-APF01.DDC1.LOCAL\APFSrc</APFSource>

<APFTree>\\DDC1-APF01.DDC1.LOCAL\APFTree</APFTree>

<CompGrp>DDC1APF</CompGrp>

</CORELAB>

</MASTERAPF>

Setting the Cost Center and SMTP Settings

A Powershell Script to set the Cost Center correctly in VMM and configure the SMTP settings is located on DDC1-WEB01.DDC1.LOCAL. The script can be found in the following location:

D:\Scripts\SetParameters

In this folder there are two files:

Config.xml
SetParameters.ps1

Config.XML

Config.xml holds the following configuration settings:

</CONFIG>

Note: This config file is used by the SetParameters.ps1 script and should remain in the same directory as the script file.

If you wish to use the SMTP functionality you will need to specify the following values:

SMTP Server – FQDN or IP address of SMTP Server or SMTP Relay – Currently DDC1-WEB01 is setup as a SMTP relay Server. To change the relay options locate the following:

Internet Information Services (IIS) Manager – SMTP E-mail (From features View) and specify your SMTP Credentials

If your SMTP Relay requires authentication then you must fill in the following field values:

Domain
Username
Password
Mailfrom – The email address the e-mail will be sent from
EmailBcc – Email address to Bcc for archiving and Email verification

There are 2 fields at the bottom of the config file for controlling the use of email and security:
1. EmailFunctionality – toggles between two values
  1. No – EmailFunctionality is Disabled (Current Default)
  2. Yes – EmailFunctionality is Enabled
2. EmailCreds – also toggles between two values
  1. No – Email credentials is not required (Current Default)
  2. Yes – Email credentials are required and will use values Domain, Username and Password from the configuration file.
1. SetParameters.ps1

The SetParameters script does the following:

Locates the Log directory that's stores created Virtual Machines from the GCloud Solution (Default is set to C:\Logs)
Maps a drive to the APF Build Server so that it can gather build Status information.
Gathers specific Variable information which includes:

Virtual Machine Name($VMName)
Email Address($Username)
Virtual Host($VMHost)
Cost Center Code($CC)
Build($Build)

Copies the log file to the GCloud log directory.
Checks to see if the build is a linux build
1. If a Linux build has been specified then the StartJob Function is called
Uses the VM Name to check the status of the build from the build Server
1. Tests the path to make sure the machines log file exists, if it doesn't script ends.
2. If the path is true it then checks the status of the machine and looks for the tag "LogoffAtEnd"
  1. If LogoffAtEnd exists the StartJob Function is called
The StartJob Function sets the cost center code for the specified Virtual Machine:
1. Once set it deletes the log entry from the current build.
2. If the Job completes successful the SendEmail function is called.
3. Loops the script in case there is more than 1 entry.
1. Set Parameters Scheduled Task

The script above runs as a Scheduled tasks on DDC1-WEB01.DDC1.LOCAL running under the DDC1\SVC_ProEng Account. The script currently runs every 15 minutes looking for log files in the log folder.

Deploying G-Cloud Demonstrator

To deploy the G-Cloud Demonstrator into a new environment please follow the steps below:

Provision one or more Windows 2008 R2 Hyper-V Host Servers to host the Virtual Management Servers.
Ensure all these servers are on the same network and can communicate over a physical management network adapter.
Next, create a Virtual Machine Network on each Hyper-V Host Server linked to a separate network adapter attached to the same VLAN called "External Network 1"
Import the Virtual Management Servers into the Hyper-V Host Servers (as appropriate)
Start up the machines and ensure that they come up ok and can communicate with each other over the network.

Note: All Administrator Account Passwords are set to "Dynamic01!"

Build a new Hyper-V Cluster:
1. Build at least two new Servers with Windows 2008 R2 Enterprise/Datacenter Edition
2. Connect the networking up such that the following minimum connections are available:
  1. Management Network
  2. Heartbeat/Live Migration Network
  3. Adapter for Virtual Machine Network with a Virtual Network Name of "External Network 1"
3. Join these servers to the DDC1 domain.
4. Attached Storage to these servers.
5. Cluster these machines.
6. Create one or more Cluster Storage Volumes using the SAN storage
Add the Cluster in DDC1-SCVMM01 so that it can be managed by SCVMM – Note: Ensure the Cluster is added into a new Host Group.
Change the following configuration elements:
1. DDC1-DC01 – Change the domain admin password
2. All Management Servers – Change the local Administrator password
3. DDC1-TMG01 – Check the access rule for external users and configure appropriately. Also change the web chaining rule to talk to your upstream proxy server.
4. DDC1-APF01 – Run WSUS and synchronise the updates to make them available to the machines in the environment.
5. DDC1-WEB01 – Change configuration files to reflect the environment – e.g. SMTP host, etc..
User Accounts – either use existing DeptA/B/C accounts or rename appropriately
Remote Desktop Gateway – this is currently setup to use a local certificate but in order to use that to connect you need to import it into the clients local Trusted Root Certificate Authority store. An alternate solution is to create another cert (with the correct computer name) from an existing Trusted Root Authority.
Connect to http://ddc1-web01.ddc1.local/gcloud - from within the environment and check the website is up and running correctly. Then attempt the same from outside the DDC1 environment.

Known Issues

No limitations on the number of VMs that a user can request. Potential future enhancement.
Cannot remote control a Linux machine currently (as there is no RDP connectivity). Potential to implement a telnet/X-Windows session instead in the future.
No automatic SCOM agent install for provisioned Linux machines. Potential future enhancement to include the agent in the source.
All Virtual machines are provisioned on same network and as such users can see all other machines on the network (but do not have logon access). Potential future enhancement to build VMs into separate VLANs but needs consideration of management infrastructure.

Document Information
Terms and Abbreviations

Abbreviation	Definition
SCVMM	System Center Virtual Machine Manager
SCOM	System Center Operations Manager
VMM	Virtual Machine Manager
WAN	Wide Area Network
SAN	Storage Area Network
SAS	Serial Attached SCSI
TMG	Threat Management Gateway
VHD	Virtual Hard disk
VSV	Virtual save state file
VSS	Volume shadow Copy Service

Table 4: Terms and Abbreviations

Appendix A – Hyper-V Host Server Farm Pattern

The Host Server Farm architecture pattern is illustrated below.

This pattern provides server consolidation and high availability on a greater scale.
Supports up to 16 nodes in a single cluster configuration.
Virtual machines can run on any node of the cluster.
In the event of a node failure, the virtual machines will be restarted automatically on any node that has the available capacity to host the failed resources.

Figure 4: Hyper-V Server Farm pattern

Information

The Host Server Farm pattern provides high availability as well as better use of hardware since a single physical host can serve a passive node for up to 15 active nodes.

Appendix B – Host Cluster patterns

No Majority – Disk Only

The cluster has quorum if one node is available and in communication with a specific disk in the cluster storage. Only the nodes that are also in communication with that disk can join the cluster.

Microsoft Recommendations

This pattern is not recommended for High Availability as the disk can be a single point of failure.

Node Majority

Node Majority is a quorum model where each node that is available and in communication can vote. The cluster functions only with a majority of the votes, that is, more than half.

Microsoft Recommendations

This pattern is recommended in Failover Cluster deployments containing an odd number of nodes.

Node and Disk Majority

Microsoft Recommendations

This pattern is recommended in Failover Cluster deployments containing an even number of nodes.

Node and File Share Majority

Microsoft Recommendations

This pattern is recommended in Failover Cluster deployments containing an even number of nodes and for Multi-Site failover clusters.

Figure 5: Host Cluster Patterns

Appendix C – Network Architecture

Microsoft Recommendations

Use multiple NICs and multi-port NICs on each host server.

One NIC dedicated to the host machine only for management purposes
One NIC dedicated to the private Cluster Heartbeat network
One NIC dedicated to the Live Migration network
One or more NICs dedicated to the guest virtual machines (use 10 gpbs NICS for highest consolidation)
Two or more NICs dedicated to iSCSI with MPIO

Dedicate at least one NIC/Port on each host server for guest virtual machine network I/O. For maximum consolidation ratio, utilize one or more 10-Gigabit Ethernet NICs to virtual machine network I/O.

Warning

Microsoft does not support the use of NIC teaming software. Support for these third-party technologies must be provided by the vendor.

Appendix D - Processor Architecture

Windows Server 2008 R2 with Hyper-V requires x64 processor architecture from Intel or AMD, as well as support for hardware execute disable and hardware virtualization such as Intel VT or AMD-V.

Microsoft Recommendations

Appendix E – Memory Architecture

Microsoft Recommendations

For all host server architecture patterns, we recommend a minimum of 16 GB of RAM.

For Multi-Node Host Server Farm patterns, we recommend a minimum of 64 GB per server.

Appendix F - Drive types

SCSI

SATA

SAS

Fibre Channel

Microsoft Recommendations

Fibre Channel 15k RPM drives are recommended for Host Server Farm patterns.

If you are using a Fibre Channel SAN, ensure that the switch and director infrastructure is sized to handle the large amount of storage I/O that will be generated from the consolidated servers.

Appendix G - Disk Redundancy Architecture

RAID 1

RAID 5

RAID 1+0 (RAID 10)

RAID levels that are higher than 10 (1 + 0) may offer additional fault tolerance or performance enhancements. These levels generally are proprietary systems.

For more information about these types of RAID systems, contact your storage hardware vendor.

RAID 1 or RAID 1+0 is recommended for the system volume in all host server architecture patterns.

RAID 1+0 is recommended for the data volumes in the Host Server Farm patterns.

Appendix H - Fibre Channel Storage Area Network

Architecture	Throughput (theoretical max Megabyte/sec)
iSCSI (Gigabit Ethernet)	125 MB/s
Fibre Channel (2 GFC)	212.5 MB/s
SATA (SATA II)	300 MB/s
SCSI (U320)	320 MB/s
SAS	375 MB/s
Fibre Channel (4 GFC)	425 MB/s

Table 5: Comparison of Disk Controller throughput speeds

For performance and security reasons, it is strongly recommended that iSCSI SANs utilize dedicated NICs and switches that are separate from the LAN.

Direct attached storage or iSCSI SAN storage is recommended for the Single Host Server architecture pattern.
iSCSI or Fibre Channel SANs are recommended for the Two-Node Host Cluster pattern.
Fibre Channel SANs are recommended for the Host Server Farm pattern.

Table 6: Comparison of Disk Controller Interfaces

Architecture	Throughput (theoretical max Megabyte/sec)
iSCSI (Gigabit Ethernet)	125 MB/s
Fibre Channel (2 GFC)	212.5 MB/s
SATA (SATA II)	300 MB/s
SCSI (U320)	320 MB/s
SAS	375 MB/s
Fibre Channel (4 GFC)	425 MB/s

SATA II or SAS are recommended for the Single Host Server architecture pattern, with SAS being the preferred option.

iSCSI, 2 GFC Fibre Channel, or 4 GFC Fibre Channel are recommended for the Two-Node Host Cluster architecture pattern.

4 GFC Fibre Channel is recommended for the Host Server Farm architecture pattern.

Figure 6: CSV Volume Allocation

Appendix K - System Center Virtual Machine Manager R2 2008

Use Cluster Shared Volumes in Two-Node and Host Server Farm architecture patterns.
Allocate SAN LUNs and corresponding CSV volumes based on workload I/O requirements.
Use gigabit Ethernet or higher for all cluster communication networks, including the Private Cluster Heartbeat and Live Migration networks.

Delegated Management and Provisioning Web Portal

Stored virtual machines
Virtual hard disks
CD/DVD software images, also called ISO files
Hardware configurations
Templates
Administrator Console

1.2 About this Document 1

微软私有云POC部署文档

2011-10-08T05:37:00Z

Table of Contents

1 Summary 1

1.1 Introduction 1

1.3 Intended Audience 1

1.4 Document Scope 1

1.5 Constraints and Assumptions 1

2 High-Level POC Architecture 2

3 High-Level Scenarios 3

3.1 Sequence Diagram for Iaas & SaaS 3

4 Deployment Scenarios 4

5 Solution Design 5

5.1 Server Physical Infrastructure 6

5.1.1 Server Physical Machine Table 6

5.1.6 Remote Desktop Gateway Server (IBMH1) 7

5.1.7 Remote Desktop Gateway Server (IBMH2) 8

5.1.8 LENH1 8

5.2 Server Virtual Infrastructure 8

5.2.2 Active Directory Server (DC1, DC3 & DC5) 9

5.2.3 System Center Virtual Machine Manager Server (SCVMM1) 10

5.2.4 System Center Operations Manager Server (SCOM01) 10

5.2.5 System Center Self Service Portal Server (SSP-V2) 10

5.2.6 Exchange CAS/HUB Server (CH1 and CH2) 11

5.2.7 Exchange Mailbox Server (MBX1, MBX2 & MBX3) 11

5.2.8 Hyper-V Server Cluster 11

5.3 Implementation of Design 11

5.4 Private Cloud Network 11

5.4.1 Network Architecture 13

5.5 Storage 14

5.6 Backup and Restore 14

5.7 Security Considerations 14

5.7.1 End User Access to the solution 14

5.7.2 Host Operating System Configuration 14

6 Deploying GPC-POC 15

6.1 Redmond Workflow 15

6.2 Customer Workflow 16

6.3 Passwords 17

6.4 iSCSI Target Host Setup 19

6.5 Build R2 Hyper-V Core hosts 27

6.6 iSCSI Client Setup 29

6.7 Build DC VMs 36

6.8 Failover Clustering 39

6.9 Build SCVMM & SQL VM 43

6.10 SQL 2008 Install 52

6.11 SCVMM Install 62

6.12 DIT-SC Install 80

6.13 Build Win7 Client 80

6.14 Exchange Deployment 81

6.15 Known Issues 89

6.16 Document Information 89

6.16.1 Terms and Abbreviations 89

Appendix A – Hyper-V Host Server Farm Pattern 90

Appendix B – Host Cluster patterns 91

 No Majority – Disk Only 91

 Node Majority 91

 Node and Disk Majority 91

 Node and File Share Majority 91

Appendix C – Network Architecture 93

Appendix D - Processor Architecture 94

Appendix E – Memory Architecture 95

Appendix F - Drive types 96

Appendix G - Disk Redundancy Architecture 97

Appendix H - Fibre Channel Storage Area Network 98

Appendix I - Disk Controller or HBA Interface 99

Appendix J - Cluster Shared Volumes 100

Appendix K - System Center Virtual Machine Manager R2 2008 102

Virtual Machine Manager Server 102

Microsoft SQL Server Database 102

VMM Library Servers 102

Administrator Console 102

Delegated Management and Provisioning Web Portal 103

Appendix L – Hyper-V Overview 104

Appendix M – Hardware Architecture 105

Hyper-V Management Server 105

Hyper-V Cluster Nodes 105

Disk Storage 105

Quick Migration 106

Operating System Version 107

Cluster Host Server Overview 107

Appendix N – References 108

Summary
Introduction

The GPC-POC Deployment Guide provides the information you need to prepare for and deploy the Virtual Machine Manager Self-Service Portal (VMMSSP, or the self-service portal) in your datacenter. Before you follow the instructions in this guide.

About this Document

This document is for Govt. Private Cloud (GPC) and provides a deployment scenario for self-service portal component guide.

Intended Audience

The intended audience of this document is the technical personnel engaged in implementing the GPC solution within their own environment.

Document Scope

The scope of this document is concerned with Microsoft technologies only.

Constraints and Assumptions

The server and storage hardware required for the GPC-POC environment is as specified by the hosting partner provided it meets the minimum requirements as defined in this document.

There are also a lot of related conditions and technologies that will have an impact on the GPC-POC working. Some of those assumptions are listed in the table below:

Assumption	Explanation
Physical environment	It is assumed that a server environment exists with enough floor space, power, air conditioning, physical security etc.
Stable network	It is assumed that the local and wide area network infrastructure which includes physical components switches, routers, cable etc. And the logical components like routing, broadcasts, collisions etc. Are stable and under control. Having an unstable network can result in unexpected behaviour.
Need to add more Constraints or Assumptions

Table 1: Constraints and Assumptions

High-Level POC Architecture

Figure 1: High Level POC Architecture

POC is intended to be delivered on harddrive for installation at customer site with limited hardware investment.
It's only require 6-8 physical machines
Goal is to demonstrate IaaS & SaaS scenarios for Private Cloud deployment environment.
The POC uses a Windows iSCSI server instead of a SAN for portability reasons. iSCSI is a storage protocol used to connect to a network device that moves storage-related data. It allows clients to send SCSI commands to remote, consolidated storage targets (or disk arrays) in the same way the client can interact with a locally attached disk. A common misconception is that you can connect iSCSI over your existing LAN infrastructure.

High-Level Scenarios

High-Level Showcase Scenarios (10-15)
IaaS (Dynamic Datacenter)	SaaS (Exchange)
1. New tenant (organization) sign-up	1. New tenant (organization) sign-up
2. New environment provisioning request	2. New tenant services configuration
3. Virtual machine request	3. Tenant admin set-up
4. Virtual machine template setting	4. New user (mailbox) addition
5. Virtual machine provisioning	5. Distribution list management rights assignment
6. Reporting	6. Charge back reporting

Sequence Diagram for Iaas & SaaS

Figure 2: Sequence Diagram for Iaas & SaaS

Following are the sequence diagram steps

Business Group Customer requested for Emailbox setup for the department / organization.
Request goes to IT Aministrator of the department / organization. IT Admin enters the New Machine request through Website Form.
It goes to Data Center Admin approval for VMs aqquision. Once approved, approval mail sent to IT Adminstrator.
IT Administrator configure and installs the Exchange on VM Servers.
IT Administrator Provision and Add Tenant and Mailbox for users.
Finally the request gets completed and mail been send to BG Customer to utilize the services.
Report gets generated based on the service(space, bandwidth, etc..) usage and charge back to the department based on the usage.
1. Deployment Scenarios

This guide steps you through the deployment process for the self-service portal. It includes the following sections:

Deployment Scenarios for the Self-Service Portal Components. Describes the two primary deployment scenarios.
Environmental Prerequisites. Specifies the prerequisites that affect resources beyond the computers that will run the self-service portal components, including security recommendations.
Self-Service Portal System Requirements. Lists the system requirements for the self-service portal components in each of the deployment scenarios.
Installing the Virtual Machine Manager Self-Service Portal. Provides the steps to install the self-service portal components in each deployment scenario.
Uninstalling the Self-Service Portal Components. Provides the steps to uninstall the self-service portal components in each deployment scenario.
Next Steps: Configuring the Self-Service Portal. Provides information about the guides and other resources to use to complete the post-deployment tasks that prepare the self-service portal for normal operation.

Solution Design

Figure 3: Hyper-V cluster Nodes with Virtual Machine

The sections below covers the detailed configuration for the GPC-POC Infrastructure Environment.

Server Physical Infrastructure
1. Server Physical Machine Table

Base OS Server Name	Assigned Machine	Bits	RAM	CPU	Disks	Virtual Switch "Public"	Virtual Switch "Hyper-V & Exchange Replication"	Purpose
HPB1 (HPV1)	HP Blade 1	x64	32 GB	Quad Core	2 X 150 GB (300 GB)	Gigabit Ethernet External NIC1 10.1.1.x VLAN1 Corp or VPN	Gigabit Ethernet External NIC2 10.1.2.x VLAN2 Lab internal	Hyper-V (cluster) DDC (SQL, DIT-SC, SCCM, SCOM, SCVMM + Library) Exchange CAS + Hub
HPB2 (HPV2)	HP Blade 2	x64	32 GB	Quad Core	3 X 150 GB (300 GB)	Gigabit Ethernet External NIC1 10.1.1.x VLAN1 Corp or VPN	Gigabit Ethernet External NIC2 10.1.2.x VLAN2 Lab internal	Hyper-V failover for HPV1
HPB3 (HPV3)	HP Blade 3	x64	32 GB	Quad Core	4 X 150 GB (300 GB)	Gigabit Ethernet External NIC1 10.1.1.x VLAN1 Corp or VPN	Gigabit Ethernet External NIC2 10.1.2.x VLAN2 Lab internal	Hyper-V (cluster) DAS (273GB - RAID5) Exchange DAG
HPB4 (HPV4)	HP Blade 4	x64	32 GB	Quad Core	5 X 150 GB (300 GB)	Gigabit Ethernet External NIC1 10.1.1.x VLAN1 Corp or VPN	Gigabit Ethernet External NIC2 10.1.2.x VLAN2 Lab internal	Hyper-V (cluster) DAS (273GB - RAID5) Exchange DAG
IBMH1	IBM 3850 + 2 Fusion IO cards	x64	16 GB	Quad Core Intel Xeon Series 7400	2 X 650 GB Fusion IO	Gigabit Ethernet External NIC1 10.1.1.x VLAN1 Corp or VPN	N/A	iSCSI + Remote Desktop Gateway
IBMH2	IBM 3850	x64	12 GB	Quad Core Intel Xeon Series 7400		Gigabit Ethernet External NIC1 10.1.1.x VLAN1 Corp or VPN	N/A	Hyper-V Dual NIC gateway host for remote access May host AD+DNS if Lenovo is not available
LENH1	Lenovo RD210	x64	8 GB			Gigabit Ethernet External NIC1 10.1.1.x VLAN1 Corp or VPN	N/A	AD+DNS
LENH2	Lenovo RD 210	x64						This box will not be available to GPC

Table 2: Server Physical Machine Table

HPV1

Following are the services installed on HPV1 VM Server

Hyper-V (cluster)
DDC (SQL, DIT-SC, SCCM, SCOM, SCVMM + Library)
Exchange CAS + Hub

HPV2

Following are the services installed on HPV2 VM Server. It's Hyper-V failover for HPV1

Hyper-V (cluster)
DDC (SQL, DIT-SC, SCCM, SCOM, SCVMM + Library)
Exchange CAS + Hub

HPV3

Following are the services installed on HPV3 VM Server

Hyper-V (cluster)
DAS (273GB - RAID5)
Exchange DAG

HPV4

Following are the services installed on HPV3 VM Server

Hyper-V (cluster)
DAS (273GB - RAID5)
Exchange DAG

Remote Desktop Gateway Server (IBMH1)

The Remote Desktop Gateway Server provides Secure Remote Desktop access to the Virtual Machines provisioned by the end-users.

Access Rights – Administrators and Department Users
Machine Access – Note: This is set to allow access to all machines in the environment initially but can be limited as required.

Remote Desktop Gateway Server (IBMH2)

The Remote Desktop Gateway Server provides Secure Remote Desktop access to the Virtual Machines provisioned by the end-users.

Access Rights – Administrators and Department Users
Machine Access – Note: This is set to allow access to all machines in the environment initially but can be limited as required.

Note: Hyper-V Dual NIC gateway host for remote access. May host AD+DNS if Lenovo is not available.

LENH1

Following are the services installed on LENH1 VM Server

Active Directory and DNS

Server Virtual Infrastructure
1. Virtual Management Servers

The Virtualised Management Servers are pre-configured as follows and any changes to the configuration will impact on other VM Server setting:

Management Server	Machine Name	VM Network	External IP	IP Address
Active Directory Server	DDC1-DC01	Internal	192.75.183.35	10.1.1.120 Contoso.gov
Active Directory Server	DDC1-DC02	Internal	192.75.183.30	10.1.1.121 Contoso.gov
Active Directory Server	DDC1-DC03 (Failover)	Internal	192.75.183.35	10.1.1.122 Contoso.gov
SCVMM SQL Server	DDC1-SCVMM01	Internal	192.75.183.30	10.1.1.180 Ops.contoso.gov
SCOM Server	DDC1-SCOM01	Internal	192.75.183.30	10.1.1.181 Ops.contoso.gov
Remote Desktop Gateway Server	DDC1-IBMH	Internal	192.75.183.34	10.1.1.109 Contoso.gov
Exchange Server	DDC1-MBX1	Internal	192.75.183.32	10.1.1.220 Resource.gov
Exchange Server	DDC1-MBX2	Internal	192.75.183.33	10.1.1.221 Resource.gov
Exchange Server	DDC1-MBX3	Internal	192.75.183.33	10.1.1.222 Resource.gov

Table 3: VM Servers Configuration table

Note: External Network 1 corresponds to the Virtual Machine Network in the Network Architecture

New Virtual Machines

All new Virtual Machines will be built on the Host Cluster and be attached to External Network 1 (the Virtual Machine Network). They will also receive a DHCP address from the AD Server.

Active Directory Server (DC1, DC3 & DC5)

Base OS Server Name	Physical Host Machine	Bits	RAM	CPU	Disks	Virtual Switch "Public"	Virtual Switch "Hyper-V & Exchange Replication"	Purpose
DC1	IBMH2	x64	12 GB	Quad Core Intel Xeon Series 7400		Gigabit Ethernet External NIC1 10.1.1.x VLAN1 Corp or VPN	N/A	Hyper-V Dual NIC gateway host for remote access May host AD+DNS if Lenovo is not available
DC3	IBMH2	x64	12 GB	Quad Core Intel Xeon Series 7400		Gigabit Ethernet External NIC1 10.1.1.x VLAN1 Corp or VPN	N/A	Hyper-V Dual NIC gateway host for remote access May host AD+DNS if Lenovo is not available
DC5	IBMH2	x64	12 GB	Quad Core Intel Xeon Series 7400		Gigabit Ethernet External NIC1 10.1.1.x VLAN1 Corp or VPN	N/A	Hyper-V Dual NIC gateway host for remote access May host AD+DNS if Lenovo is not available

Table 4: Virtual Machine with Active Directory

The Active Directory Server holds all the domain accounts for the management servers plus it hosts the following services required for the proper operation of the solution:

DNS
DHCP
- Address Lease Range – 192.75.183.30-192.75.183.150
- Scope Options:
  - Router – 192.75.183.30
  - DNS Servers – 192.75.183.34
  - DNS Domain Name – DDC1.LOCAL

System Center Virtual Machine Manager Server (SCVMM1)

Base OS Server Name

Assigned Machine

Bits

RAM

CPU

Disks

Virtual Switch "Public"

Virtual Switch "Hyper-V & Exchange Replication"

Purpose

HPB1 (HPV1)

HP Blade 1

x64

32 GB

Quad Core

2 X 150 GB

(300 GB)

Gigabit Ethernet

External

NIC1

10.1.1.x

VLAN1

Corp or VPN

Gigabit Ethernet

External

NIC2

10.1.2.x

VLAN2

Lab internal

Hyper-V (cluster)

DDC (SQL, DIT-SC, SCCM, SCOM, SCVMM + Library)

Exchange CAS + Hub

HPB2

(HPV2)

HP Blade 2

x64

32 GB

Quad Core

3 X 150 GB

(300 GB)

Gigabit Ethernet

External

NIC1

10.1.1.x

VLAN1

Corp or VPN

Gigabit Ethernet

External

NIC2

10.1.2.x

VLAN2

Lab internal

Hyper-V failover for HPV1

Table 5: Virtual Machine with SCVMM, Exchange & SCOM

The Library holds a number of sysprepped images and hardware templates:

Name	Type	Notes
Server 2008 R2 Ent (x64)	Template	Virtual Machine Template for Windows 2008 R2 Enterprise Edition

Table 6: Hardware Template

System Center Operations Manager Server (SCOM01)

Additional Management Packs installed:

Exchange? (TBD)

System Center Self Service Portal Server (SSP-V2)

The Web Portal Server host the end-user interface to the GPC-POC .

Internal Web URL: http://Ops.contoso.gov/

Exchange CAS/HUB Server (CH1 and CH2)

Note: CH1 is Primary and CH2 is failover server.

Exchange Mailbox Server (MBX1, MBX2 & MBX3)

Note: MBX1 and MBX2 are Primary and MBX3 is failover server.

Hyper-V Server Cluster

Implementation of Design

Private Cloud Network

Figure 4: GPC-POC Network Overview

Network Architecture

The Hyper-V servers within the environment will be connected to a number of different networks.

Each of the Cluster servers will be configured with up to 5 Networks:

Management Network
Virtual Machine Network
Potentially an ISCSI network (if using an ISCSI SAN)

Optional

Cluster Heartbeat network
Live Migration Network (may be shared with Cluster Heartbeat Network if needed)

The Management connection is dedicated to the host itself for network I/O and management.

Optional:

The Cluster heartbeat connection is used by all the cluster nodes to ascertain if all nodes within the cluster are responding and operational.
The Live migration network is used to failover virtual machines to alternate nodes in the cluster configuration with no loss of service to the end user.

The Virtual Machine network is dedicated to the guest virtual machines.

The ISCSI Network is used for connection to the ISCSI SAN (if used).

Figure 5: Cluster Node Network Overview

Storage

Backup and Restore

As this is purely a , Virtual machines will not be backed up.

Security Considerations
1. End User Access to the solution

Access to the solution for end-users is via RDP Gateway Server. It is assumed that the hosting environment is deployed in a secure lab, behind an external Firewall (to the GPC-POC servers).

Note: As this is a pure solution, the security of the environment will need to be reviewed against the requirements of the environment into which it is being deployed and as such firewall rules and further security lockdown measures may be required.

Host Operating System Configuration

Keep the management operating system up to date with the latest security updates.
Use a separate network with a dedicated network adapter for the management operating system of the physical Hyper-V computer.
Secure the storage devices where you keep virtual machine resource files.
Harden the management operating system using the baseline security setting recommendations described in the Windows Server 2008 R2 Security Compliance Management Toolkit.
Configure any real-time scanning antivirus software components installed on the management operating system to exclude Hyper-V resources.
Do not use the management operating system to run applications.
Do not grant virtual machine administrators permission on the management operating system.
Use the security level of your virtual machines to determine the security level of your management operating system.

Deploying GPC-POC
Redmond Workflow

Build iSCSI Target host
Build 2008 R2 Core Hyper-v hosts
1. Create Virtual Switches with Hyper-V Manager

Virtual Switch Name	Type	NIC	Network	Physical Swtich	Connectivity
Public	External	NIC1	10.1.1.x	VLAN1	Corp or VPN connectivity
Replication	External	NIC2	10.1.2.x	VLAN2	Lab internal
Hyper-V Failover Cluster	External	NIC2	10.0.0.x	VLAN2	Lab internal

Table 8: Virtual Switches

Connect iSCSI volume to the Hyper-V host that will be running the DC1 VM
Build DC1 VM (...or physical host)
Copy the Exported Virtual Machine contents of just DC1,
1. from external USB drive to a local folder on the Hyper-v host,
2. such as C:\GPC Lab\Exported Virtual Machines
3. (you can skip this if you want to save time...use Hyper-v Mgr to import directly from USB drive)
Hyper-v Manager import of DC1 VM from the local C: drive
1. (or if you want to save some time, from the USB drive)
2. Just make sure that the DC1 VM is imported to a local directory on the Hyper-v host
Configure contoso.gov
Install Failover Clustering Feature on hosts
User Hyper-v Manager to create virtual switch for Clustering, on all hosts
Use the Failover Cluster Manager MMC snap-in to
1. Create a hyper-v cluster with the physical hosts
2. Enable CSV
3. Create a CSV disk
4. Copy
Build SCVMM & SQL VM
1. iSCSI Initiator
2. Connect to E: drive
3. Install SQL
4. Install SCVMM
5. Create another CSV disk for the SCVMM Library
6. ***due to a storage issue, we were not able to get all the ISO images copied to the external USB drive, so you will need to copy them to this CSV disk
7. Create Exchange Template
8. Create CAS/HT Template
9. Create DC Template
10. Create Client Templates
Use SCVMM or Hyper-v Manager to import remaining VMs onto the appropriate hosts
1. Spread the 3 MBX VMs across the HPV hosts, and DO NOT enable Live Migration for these VMs
2. Spread the remaining VMs across the HPV hosts with Live Migration enabled

Customer Workflow

Base OS Server Name	Assigned Machine	Bits	RAM	CPU	Disks	Virtual Switch "Public"	Virtual Switch "Hyper-V & Exchange Replication"	Availability Date	Purpose
HPB1	HP Blade 1	x64	32 GB	Quad Core	2 X 150 GB (300 GB)	Gigabit Ethernet External NIC1 10.1.1.x VLAN1 Corp or VPN	Gigabit Ethernet External NIC2 10.1.2.x VLAN2 Lab internal	Now	Hyper-V (cluster) DDC (SQL, DIT-SC, SCCM, SCOM, SCVMM + Library) Exchange CAS + Hub
HPB2	HP Blade 2	x64	32 GB	Quad Core	3 X 150 GB (300 GB)	Gigabit Ethernet External NIC1 10.1.1.x VLAN1 Corp or VPN	Gigabit Ethernet External NIC2 10.1.2.x VLAN2 Lab internal	Now	Hyper-V failover for HPV1
HPB3	HP Blade 3	x64	32 GB	Quad Core	4 X 150 GB (300 GB)	Gigabit Ethernet External NIC1 10.1.1.x VLAN1 Corp or VPN	Gigabit Ethernet External NIC2 10.1.2.x VLAN2 Lab internal	Now	Hyper-V (cluster) DAS (273GB - RAID5) Exchange DAG
HPB4	HP Blade 4	x64	32 GB	Quad Core	5 X 150 GB (300 GB)	Gigabit Ethernet External NIC1 10.1.1.x VLAN1 Corp or VPN	Gigabit Ethernet External NIC2 10.1.2.x VLAN2 Lab internal	Now	Hyper-V (cluster) DAS (273GB - RAID5) Exchange DAG
IBMH1	IBM 3850 + 2 Fusion IO cards	x64	16 GB	Quad Core Intel Xeon Series 7400	2 X 650 GB Fusion IO	Gigabit Ethernet External NIC1 10.1.1.x VLAN1 Corp or VPN	N/A	June 16 for Fusion IO cards	iSCSI
IBMH2	IBM 3850	x64	12 GB	Quad Core Intel Xeon Series 7400		Gigabit Ethernet External NIC1 10.1.1.x VLAN1 Corp or VPN	N/A	Now	Hyper-V Dual NIC gateway host for remote access May host AD+DNS if Lenovo is not available
LENH1	Lenovo RD210	x64	8 GB			Gigabit Ethernet External NIC1 10.1.1.x VLAN1 Corp or VPN	N/A	June 16 or later	AD+DNS
LENH2	Lenovo RD 210	x64						N/A	This box will not be available to GPC

Table 9: Hardware Configuration

Passwords

Domain	User Account	Password
Scvmm-sql-1	Local Administrator	1DDCgpclab
Dc1	Domain Administrator	1GPClab
	Domain Labadmin	1GPCcontoso
Hpv5	Local Administrator	1GPCcontoso
Sccm-scom1	Local Administrator	1GPCcontoso
DC3	OPS Administrator	1GPClab 1GPCcontoso
CAS1
DDC-Jump 192.168.0.100	OPS Administrator	1GPCcontoso
DDC-AD1 192.168.0.110	CONTOSO labadmin	1Csltgap
Domain	User Account	Password
CONTOSO	Clusteradmin	1GPCcontoso

Table 10: Passwords

Figure 6: Lab Admin Properties

Figure 7: Administator Properties

iSCSI Target Host Setup

Install iSCSI target software on designated host

Figure 8: iSCSI Software Setup-1

Figure 9: iSCSI Software Setup-2

Right click on iSCSI Target and select "Create an iSCSI Target"

Figure 10: iSCSI Software Setup-3

Figure 11: iSCSI Software Setup-4

Get the IQN of the Hyper-v host that will initially build the contents of the iSCSI volume, which will later be used for the Cluster Shared Volume

Figure 12: iSCSI Software Setup-5

On the iSCSI Target Host, paste the IQN identifier of the Hyper-v hosts that we will use to offload the contents of the external USB drive

Figure 13: iSCSI Software Setup-6

Figure 14: iSCSI Software Setup-7

Create virtual disk for iSCSI target, Right click on gpc-storage or select from Actions pane on the right and Select "Create Virtual Disk for iSCSI Target"

Figure 15: iSCSI Software Setup-8

Or you can select "Devices", Right click, and select "Create Virtual Disk"

Figure 16: iSCSI Software Setup-9

Figure 17: iSCSI Software Setup-10

Figure 18: iSCSI Software Setup-11

This is a 1GB quorum disk for clustering

Figure 19: iSCSI Software Setup-12

Figure 20: iSCSI Software Setup-13

Build R2 Hyper-V Core hosts

Figure 21: Build R2 Hyper-V Core hosts - 1

Figure 22: Build R2 Hyper-V Core hosts - 2

Figure 23: Build R2 Hyper-V Core hosts - 3

iSCSI Client Setup

Figure 24: iSCSI Client Setup - 1

Figure 25: iSCSI Client Setup - 2

Copy the IQN of the client VM or host, which will be pasted into the iSCSI Target host configuration

Figure 26: iSCSI Client Setup - 3

Log into the iSCSI target host

Figure 27: iSCSI Client Setup - 4

Go to the "Advanced" tab, and paste in the IQN of the Client VM or host

Figure 28: iSCSI Client Setup - 5

Go back to the client and run the iSCSI Initiator program again

Figure 28: iSCSI Client Setup – 5

Type in the IP address or FQDN of the iSCSI Target host, and click "Quick Connect"

Figure 29: iSCSI Client Setup - 6

You should see this:

Figure 30: iSCSI Client Setup - 7

Use the Server Manager tool to navigate to Storage/Disk Management. Find the volume and bring it online, You should see the volume (E: in this case) in the Computer window

Build DC VMs

Follow the Hyperv manager steps below to build the DC1 VM

Figure 31: Build DC VMs - 1

Figure 32: Build DC VMs - 2

Figure 33: Build DC VMs - 3

Figure 34: Build DC VMs - 4

Figure 35: Build DC VMs - 5

Figure 36: Build DC VMs - 6

Figure 37: Build DC VMs - 7

Install Windows Server 2008 R2 Datacenter Edition on all Virtual Machines for this PoC
1. Failover Clustering

http://technet.microsoft.com/en-us/library/cc732181(WS.10).aspx#BKMK_Install

Starting with HPV5

Figure 38: Failover Clustering- 1

Notice Features Summary does not have Failover Clustering

Figure 39: Failover Clustering- 2

Figure 40: Failover Clustering- 3

Starting the cluster configuration with HPV3, First need to create a virtual network switch with External connectivity to the 10.0.0.x network

Figure 41: Failover Clustering- 4

Figure 42: Failover Clustering- 5

Figure 43: Failover Clustering- 6

Figure 44: Failover Clustering- 7

Build SCVMM & SQL VM

Recommended: 4 GB RAM, 2 cores, 40 GB HDD

http://technet.microsoft.com/en-us/library/cc764289.aspx

Figure 45: Build SCVMM & SQL VM- 1

System Requirements: Installing VMM on a Single Computer

http://technet.microsoft.com/en-us/library/cc764289.aspx

Figure 46: Build SCVMM & SQL VM- 2

Figure 47: Build SCVMM & SQL VM- 3

Figure 48: Build SCVMM & SQL VM- 4

Figure 49: Build SCVMM & SQL VM- 5

Figure 50: Build SCVMM & SQL VM- 6

Figure 51: Build SCVMM & SQL VM- 7

Figure 52: Build SCVMM & SQL VM- 8

Figure 53: Build SCVMM & SQL VM- 9

Figure 54: Build SCVMM & SQL VM- 10

Figure 55: Build SCVMM & SQL VM- 11

Figure 56: Build SCVMM & SQL VM- 12

Figure 57: Build SCVMM & SQL VM- 13

Figure 58: Build SCVMM & SQL VM- 14

Figure 59: Build SCVMM & SQL VM- 15

Figure 60: Build SCVMM & SQL VM- 16

Figure 61: Build SCVMM & SQL VM- 17

SQL 2008 Install

http://technet.microsoft.com/en-us/library/bb500469(SQL.100).aspx

http://technet.microsoft.com/en-us/library/ms143506(SQL.100).aspx

Installed SQL 2008 Enterprise:

Copy all of the SQL Server 2008 Enterprise bits from \\products ( you can get it from MSDN as well)
You will need to install .Net Framework 3.5 via Role Manager prior to installing SQL:

Figure 62: SQL 2008 Install – 1

Figure 63: SQL 2008 Install – 2

Figure 64: SQL 2008 Install – 3

Figure 65: SQL 2008 Install – 4

Figure 66: SQL 2008 Install – 5

Might as well install the "Web Server (IIS) Support", since it will be needed for the other management tools:

Figure 67: SQL 2008 Install – 6

Figure 68: SQL 2008 Install – 7

Figure 69: SQL 2008 Install – 8

Figure 70: SQL 2008 Install – 9

Figure 71: SQL 2008 Install – 10

Figure 72: SQL 2008 Install – 11

Figure 73: SQL 2008 Install – 12

Run the SQL setup:

Figure 74: SQL 2008 Install – 13

It may take a couple of minutes, but you will eventually get the SQL install wizard:
Click on "Installation"
Click on "New SQL Server stand-alone installation or add features to an existing installation"

Figure 75: SQL 2008 Install – 14

Figure 76: SQL 2008 Install – 15

Figure 77: SQL 2008 Install – 16

Figure 78: SQL 2008 Install – 17

Figure 79: SQL 2008 Install – 18

Figure 80: SQL 2008 Install – 19

Figure 81: SQL 2008 Install – 20

SCVMM Install
1. Log into the SCVMM-SQL-1 virtual machine as:

ops\labadmin

1GPCcontoso

Software has been copied to the local harddrive

Local Disk (C:) \GPC Lab\Virtual Machine Manager 2008 R2

Run setup.exe
Install VMM Server first...

Figure 82: SCVMM Install – 1

Figure 83: SCVMM Install – 2

Figure 84: SCVMM Install – 3

Figure 85: SCVMM Install – 4

Figure 86: SCVMM Install – 5

Figure 87: SCVMM Install – 6

Figure 88: SCVMM Install – 7

Figure 89: SCVMM Install – 8

Figure 90: SCVMM Install – 9

Install VMM Administrator Console…..

Figure 91: SCVMM Install – 10

Figure 92: SCVMM Install – 11

Figure 93: SCVMM Install – 12

Figure 94: SCVMM Install – 13

Figure 95: SCVMM Install – 14

Figure 96: SCVMM Install – 15

Figure 97: SCVMM Install – 16

Figure 98: SCVMM Install – 17

Figure 99: SCVMM Install – 18

Figure 100: SCVMM Install – 19

Figure 101: SCVMM Install – 20

Figure 102: SCVMM Install – 21

Figure 103: SCVMM Install – 22

Enter E:\GPC Virtual Machines for the default path and Enter the remaining defaults for adding the host

Figure 104: SCVMM Install – 23

DIT-SC Install

Shopping List:	VM/host	RAM	Disk	OS	Software/Roles/Features
	1VM	4GB	50GB	Server 2008 R2	VMM 2008 R2 Admin Console
					SQL Server 2008 Enterprise x64
					IIS 7.0 (windows web server role)
					ASP .NET 2.0
					.NET Framework 3.5 SP1
					IIS v6.0 Compatibility Mode
					Windows Authentication (NTLM or Kerberos) TURN OFF Anonymous authentication
					Use Domain Account as service account for server component
					Message Queuing (MSMQ)

Table 11: DIT-SC Configuration

Build Win7 Client

Figure 105: Build Win7 Client – 1

Exchange Deployment

Virtual Machine Host Configuration - Redmond

Some additional information for Exchange install:

Servers	IP Configuration
Exchange forest DC:	DC5 (10.1.1.124)
Primary DNS Server:	10.1.1.124
Secondary DNS Server:	10.1.1.122
MBX Replication IPs:	MBX1 10.1.2.220 MBX2 10.1.2.221 MBX3 10.1.2.222
DAG	DAG1 10.1.1.201

Table 12: Exchange Servers Configuration

Figure 106: Virtual Machine Host Configuration - Redmond

Virtual Machine Host Configuration - GPC

Figure 107: Virtual Machine Host Configuration - GPC

Exchange Configuration

Machine Names and associated IP addresses (all machines listed here are virtual unless otherwise noted):

Parent Domain
- DC1.Contoso.Gov (physical machine)
  - 10.1.1.120
  - Primary DNS for all servers
- DC2.Contoso.Gov
  - 10.1.1.121
  - Secondary DNS for all servers
Exchange Domain
- DC3.OPS.Contoso.Gov
  - 10.1.1.122
- DC4.OPS.Contoso.Gov
  - 10.1.1.123
- CH1.OPS.Contoso.Gov
  - 10.1.1.210
- CH2.OPS.Contoso.Gov
  - 10.1.1.211
- MBX1.OPS.Contoso.Gov
  - 10.1.1.220
  - 10.1.2.220 (Replication Network)
- MBX2.OPS.Contoso.Gov
  - 10.1.1.221
  - 10.1.2.221 (Replication Network)
- MBX3.OPS.Contoso.Gov
  - 10.1.1.222
  - 10.1.2.222 (Replication Network)

Other Names

Exchange Domain
- NLB1.OPS.Contoso.Gov
  - 10.1.1.200
- DAG1.OPS.Contoso.Gov
  - 10.1.1.201

Known Issues with Exchange 2010 SP1 DF7.5 build

Unable to access OWA after install

Scenario:

• Installed Partner Hosted Exchange on Windows Server 2008 R2

• Unable to navigate to OWA (eg. https://localhost/owa)

Error:

Workaround:

1. Open "IIS Manager" in the box

2. Expand "Sites" node in IIS Manager

3. Select "Default Web Site" under Sites

4. Select "ISAPI Filters" in Default Web Site

5. Remove "Microsoft.Exchange.AuthModuleFilter ISAPI Filter"

Then you should be able to access OWA now.

AD and DoMT should be deployed on separate boxes\If Isolated GAL is enabled, OAB should be deleted

To use Open Domain feature where GAL is hidden to user

• AD and CAS should be deployed on separate boxes

• Create a tenant (e.g. myOrg) without the following features in service plan

o <AddressListsEnabled>true</AddressListsEnabled>

o <OfflineAddressBookEnabled>true</OfflineAddressBookEnabled>

Use the following to hide GAL

o Get-GlobalAddressList -Organization myOrg | Set-GlobalAddressList -IsolationMode $true

Password change through OWA doesn't does not work after first logon unless "Group Policy" is changed

Default connectors should be created for mail delivery between tenants

• New-SendConnector –Name Test –AddressSpaces * -Smarthosts localhost -DnsRoutingEnabled $false

• Get-ReceiveConnector -Identity "<NetBiosName>\Default <NetBiosName>" | Set-ReceiveConnector -PermissionGroups "ExchangeUsers, ExchangeServers, ExchangeLegacyServers, AnonymousUsers"

Hosting Command Lets might not be available

We have 2 reports that hosting command lets are not available despite the fact that the /hosting switch is used for deployment.

1. Build a new Lab without Exchange AD preparation run

When you check the ExchangeSetup Log under the Install-ExchangeOrganization task you should see –IsPartnerHosted $true.

[02/27/2010 01:31:24.0103] [0] Setup will run the task 'Install-ExchangeOrganization'

[02/27/2010 01:31:24.0103] [1] Setup launched task 'Install-ExchangeOrganization -IsPartnerHosted $true

Should you see this or any related issue in your deployment please report it to the DL.

Pasted from <https://ea.microsoft.com/hosters/Lists/Known%20Issues%20with%20DF75/AllItems.aspx>

Installation / Configuration Steps

Software Required
Windows 2008 R2 (forest / domain functional level)
Create a user object svc-certauth and make a member of IIS_IUSRS group
Windows 2008 Roles
Active Directory Domain Services
Active Directory Certificate Services
Certification Authority
Certification Authority Web Enrollment
Online Responder
Certificate Enrollment Web Service
Certificate Enrollment Policy Web Service
Enterprise CA
DNS Server
Create the following DNS records
autodiscover.contoso.gov
mail.contoso.gov
casarray01.contoso.gov
dag01.contoso.gov
Windows Update after the installation of Prereqs
Additional hotfixes:
WCF Update
http://go.microsoft.com/fwlink/?LinkId=183148
Hotfix KB981002
https://connect.microsoft.com/VisualStudio/Downloads/DownloadDetails.aspx?DownloadID=27127
Hotfix KB979099 (Update for AD RMS)
http://support.microsoft.com/?kbid=979099
Microsoft Filter Pack
http://www.microsoft.com/downloads/details.aspx?FamilyID=60c92a37-719c-4077-b5c6-cac34f4227cc&displaylang=en

Install and Configure Exchange 2010 SP1 Hosting Edition

Build a new Lab without Exchange AD preparation (Windows 2008 R2 dc's and OS)

Domain Functional Level	Windows 2008
Forest Functional Level	Windows 2008
Exchange Member Servers OS	Windows 2008 R2

Install the first Exchange Role with the following commandline

"setup /mode:install /roles:ca,HT /hosting /on:<ExchangeOrganizationName>"

When you check the ExchangeSetup Log under the Install-ExchangeOrganization task you should see –IsPartnerHosted $true.

[02/27/2010 01:31:24.0103] [0] Setup will run the task 'Install-ExchangeOrganization'

[02/27/2010 01:31:24.0103] [1] Setup launched task 'Install-ExchangeOrganization -IsPartnerHosted $true

Pasted from <https://ea.microsoft.com/hosters/Lists/Known%20Issues%20with%20DF75/AllItems.aspx>

Create a new Client Access Array

New-ClientAccessArray -FQDN casarray01.contoso.com -Name "casarray01.contoso.com" -Site "Toronto"

Create a certificate request

New-ExchangeCertificate -GenerateRequest -SubjectName "c=US, o=Contoso, cn=mail.contoso.gov" -DomainName cdautodiscover.contoso.gov, ecp.contoso.gov, mail.contoso.gov -PrivateKeyExportable $true

Get the thumbprint and enable the new cert with Get-ExchangeCertificate and Enable-ExchangeCertificate

Enable-ExchangeCertificate -Thumbprint 5867672A5F29B388C235E1235 -Services "IMAP, POP, IIS, SMTP"

Create a new Database Availability Group

New-DatabaseAvailablityGroup

Add mailbox servers to the DAG

Add-DatabaseAvailabilityGroupServer -Identity DAG01 -MailboxServer MBX1

Add-DatabaseAvailabilityGroupServer -Identity DAG01 -MailboxServer MBX2

Add-DatabaseAvailabilityGroupServer -Identity DAG01 -MailboxServer MBX3

Rename the default mailbox databases

Set-MailboxDatabase -Identity "Mailbox Database 0483463198" -Name MDB01

Set-MailboxDatabase -Identity "Mailbox Database 1593765178" -Name MDB02

Set-MailboxDatabase -Identity "Mailbox Database 2142150893" -Name MDB03

Add mailbox database copies

Add-MailboxDatabaseCopy -Identity MDB01 -MailboxServer MBX2

Add-MailboxDatabaseCopy -Identity MDB01 -MailboxServer MBX3

Add-MailboxDatabaseCopy -Identity MDB02 -MailboxServer MBX1

Add-MailboxDatabaseCopy -Identity MDB02 -MailboxServer MBX3

Add-MailboxDatabaseCopy -Identity MDB03 -MailboxServer MBX1

Add-MailboxDatabaseCopy -Identity MDB03 -MailboxServer MBX2

Configure the RPC Client Access Array

Set-MailboxDatabase -Identity MDB01 -RpcClientAccessServer casarray01.contoso.com

Set-MailboxDatabase -Identity MDB02 -RpcClientAccessServer casarray01.contoso.com

Set-MailboxDatabase -Identity MDB03 -RpcClientAccessServer casarray01.contoso.com

Configuring Hosted Exchange

Capture all steps with start-transcript in PowerShell
Snapshot the VMs (Domain Controllers and Exchange Servers)
Create Service Plans (copy existing service plan files to new names with descriptions)
- C:\Program Files\Microsoft\Exchange Server\V14\ClientAccess\ServicePlans
  - Copy the HostingAllFeatures_Sample.servicePlan to Police.servicePlan
  - Copy the HostingBusinessMAPI_Sample.servicePlan to Tourism.servicePlan
Edit the mailbox plans (if req'd) for each service plan
- Edit the serviceplan files created above, MailboxPlan section is near the bo
Add service plans to the service plan map
- Edit the ServicePlanHostingRemap.csv and add entries for Police and Tourism
  - Tourism,5,Tourism
  - Police,6,Police
Create Tenant Organizations
New-Organization -Name "police.ontoso.gov" -DomainName "police.contoso.gov" -Location "en-us" -ProgramId "Tourism" -OfferId "5"
New-Organization -Name "police.ontoso.gov" -DomainName "police.contoso.gov" -Location "en-us" -ProgramId "Police" -OfferId "6"
Create users
New-Mailbox -name "Pamela Erling" -alias "pamela" -Organization "police.contoso.gov" -UserPrincipalName pamela@police.contoso.gov
New-Mailbox -name "Patty Fisher" -alias "patty" -Organization "police.contoso.gov" -UserPrincipalName patty@police.contoso.gov
New-Mailbox -name "Tom Gregory" -alias "tom" -Organization "tourism.contoso.gov" -UserPrincipalName tom@tourism.contoso.gov
New-Mailbox -name "Ted Johnson" -alias "ted" -Organization "tourism.contoso.gov" -UserPrincipalName ted@tourism.contoso.gov
Check differences with Get-Mailbox
get-mailbox -organization police.contoso.gov
get-mailbox -organization tourism.contoso.gov
Logon to OWA

Known Issues

No limitations on the number of VMs that a user can request. Potential future enhancement.
Cannot remote control a Linux machine currently (as there is no RDP connectivity). Potential to implement a telnet/X-Windows session instead in the future.
No automatic SCOM agent install for provisioned Linux machines. Potential future enhancement to include the agent in the source.

Document Information
1. Terms and Abbreviations

Abbreviation	Definition
SCVMM	System Center Virtual Machine Manager
SCOM	System Center Operations Manager
VMM	Virtual Machine Manager
WAN	Wide Area Network
SAN	Storage Area Network
SAS	Serial Attached SCSI
VHD	Virtual Hard disk
VSV	Virtual save state file
VSS	Volume shadow Copy Service

Table 8: Terms and Abbreviations

Appendix A – Hyper-V Host Server Farm Pattern

The Host Server Farm architecture pattern is illustrated below.

This pattern provides server consolidation and high availability on a greater scale.
Supports up to 16 nodes in a single cluster configuration.
Virtual machines can run on any node of the cluster.
In the event of a node failure, the virtual machines will be restarted automatically on any node that has the available capacity to host the failed resources.

Figure i: Hyper-V Server Farm pattern

Information

The Host Server Farm pattern provides high availability as well as better use of hardware since a single physical host can serve a passive node for up to 15 active nodes.

Appendix B – Host Cluster patterns

No Majority – Disk Only

The cluster has quorum if one node is available and in communication with a specific disk in the cluster storage. Only the nodes that are also in communication with that disk can join the cluster.

Microsoft Recommendations

This pattern is not recommended for High Availability as the disk can be a single point of failure.

Node Majority

Node Majority is a quorum model where each node that is available and in communication can vote. The cluster functions only with a majority of the votes, that is, more than half.

Microsoft Recommendations

This pattern is recommended in Failover Cluster deployments containing an odd number of nodes.

Node and Disk Majority

Microsoft Recommendations

This pattern is recommended in Failover Cluster deployments containing an even number of nodes.

Node and File Share Majority

Microsoft Recommendations

This pattern is recommended in Failover Cluster deployments containing an even number of nodes and for Multi-Site failover clusters.

Figure ii: Host Cluster Patterns

Appendix C – Network Architecture

Microsoft Recommendations

Use multiple NICs and multi-port NICs on each host server.

One NIC dedicated to the host machine only for management purposes
One NIC dedicated to the private Cluster Heartbeat network
One NIC dedicated to the Live Migration network
One or more NICs dedicated to the guest virtual machines (use 10 gpbs NICS for highest consolidation)
Two or more NICs dedicated to iSCSI with MPIO

Dedicate at least one NIC/Port on each host server for guest virtual machine network I/O. For maximum consolidation ratio, utilize one or more 10-Gigabit Ethernet NICs to virtual machine network I/O.

Warning

Microsoft does not support the use of NIC teaming software. Support for these third-party technologies must be provided by the vendor.

Appendix D - Processor Architecture

Windows Server 2008 R2 with Hyper-V requires x64 processor architecture from Intel or AMD, as well as support for hardware execute disable and hardware virtualization such as Intel VT or AMD-V.

Microsoft Recommendations

Appendix E – Memory Architecture

Microsoft Recommendations

For all host server architecture patterns, we recommend a minimum of 16 GB of RAM.

For Multi-Node Host Server Farm patterns, we recommend a minimum of 64 GB per server.

Appendix F - Drive types

SCSI

SATA

SAS

Fibre Channel

Microsoft Recommendations

Fibre Channel 15k RPM drives are recommended for Host Server Farm patterns.

If you are using a Fibre Channel SAN, ensure that the switch and director infrastructure is sized to handle the large amount of storage I/O that will be generated from the consolidated servers.

Appendix G - Disk Redundancy Architecture

RAID 1

RAID 5

RAID 1+0 (RAID 10)

RAID levels that are higher than 10 (1 + 0) may offer additional fault tolerance or performance enhancements. These levels generally are proprietary systems.

For more information about these types of RAID systems, contact your storage hardware vendor.

RAID 1 or RAID 1+0 is recommended for the system volume in all host server architecture patterns.

RAID 1+0 is recommended for the data volumes in the Host Server Farm patterns.

Appendix H - Fibre Channel Storage Area Network

Architecture	Throughput (theoretical max Megabyte/sec)
iSCSI (Gigabit Ethernet)	125 MB/s
Fibre Channel (2 GFC)	212.5 MB/s
SATA (SATA II)	300 MB/s
SCSI (U320)	320 MB/s
SAS	375 MB/s
Fibre Channel (4 GFC)	425 MB/s

Table i: Comparison of Disk Controller throughput speeds

For performance and security reasons, it is strongly recommended that iSCSI SANs utilize dedicated NICs and switches that are separate from the LAN.

Direct attached storage or iSCSI SAN storage is recommended for the Single Host Server architecture pattern.
iSCSI or Fibre Channel SANs are recommended for the Two-Node Host Cluster pattern.
Fibre Channel SANs are recommended for the Host Server Farm pattern.

Table ii: Comparison of Disk Controller Interfaces

Architecture	Throughput (theoretical max Megabyte/sec)
iSCSI (Gigabit Ethernet)	125 MB/s
Fibre Channel (2 GFC)	212.5 MB/s
SATA (SATA II)	300 MB/s
SCSI (U320)	320 MB/s
SAS	375 MB/s
Fibre Channel (4 GFC)	425 MB/s

SATA II or SAS are recommended for the Single Host Server architecture pattern, with SAS being the preferred option.

iSCSI, 2 GFC Fibre Channel, or 4 GFC Fibre Channel are recommended for the Two-Node Host Cluster architecture pattern.

4 GFC Fibre Channel is recommended for the Host Server Farm architecture pattern.

Figure iii: CSV Volume Allocation

Appendix K - System Center Virtual Machine Manager R2 2008

Use Cluster Shared Volumes in Two-Node and Host Server Farm architecture patterns.
Allocate SAN LUNs and corresponding CSV volumes based on workload I/O requirements.
Use gigabit Ethernet or higher for all cluster communication networks, including the Private Cluster Heartbeat and Live Migration networks.

Delegated Management and Provisioning Web Portal

Stored virtual machines
Virtual hard disks
CD/DVD software images, also called ISO files
Hardware configurations
Templates
Administrator Console

Appendix L – Hyper-V Overview

These are the recommended security best practices on a Hyper-V environment, cumulative to the usual security best practices for physical servers:

Securing the communications between the Hyper-V server and its administrators and users.

Figure iv: Hyper-V Environment

Appendix M – Hardware Architecture

Hyper-V Management Server

Server Architecture

2 x Xeon Quad Core Processors x64

32 GB of RAM

2 x 150 GB (300GB) RAID 1 OS Partition with Array - SAS RAID Controller

Local or External Storage (ISCSI/FC)

Up to 4 x 1GBps Network ports (Management/Virtual/External and potentially ISCSI Networks)

Table iv: Management Host Server Architecture

Note: Optionally, the virtual management servers can be installed on individual physical servers (running Hyper-V) where necessary to allow for more scaling of resources.

The Virtualised Management Servers which will be used have the following resource requirements:

Hyper-V Cluster Nodes

Server Architecture

2 x Xeon Quad Core Processors x64

48GB of RAM

2 x 150 GB (300GB) RAID 1 OS Partition with Array - SAS RAID Controller

Optional 2GBps FC HBA (if using FC SAN)

External Storage (ISCSI/FC) – 5TB

Up to 3 x 1GBps Network ports (Management/Virtual/Live Migration/ Heartbeat and potentially ISCSI Networks) Minimum required is 2.

Table v: Cluster Host Server Architecture

Disk Storage

The Hyper-V host servers should utilise local storage for the operating system and the paging file.

The drives utilised by the operating system should be configured as RAID 1.

HBA/ISCSI Interface

Each server should be fitted with either a separate ISCSI network adapter or a single channel FC HBA to connect to the SAN.

Virtual Machine Storage

In addition, the underlying storage should use Clustered Shared Volumes to store the Virtual Machines.

Quick Migration

Operating System Version

The GPC-POC will utilise Microsoft Windows Server 2008 R2 Enterprise or Datacenter editions as these support the memory and processing needs of large-scale, mission-critical applications.

Note: To be managed by the SCVMM server, it is necessary for the Cluster nodes to be part of the same Domain and as such the Cluster can only be built after the Management Servers are in place.

Cluster Host Server Overview

Figure iv: Cluster Host Server Overview

Appendix N – References

For Deployment Scenario more details please refer to the link http://www.microsoft.com/downloads/details.aspx?FamilyID=fef38539-ae5a-462b-b1c9-9a02238bb8a7&displaylang=en and download a file VMM08R2_VMMSSPDocumentation.zip for more information.
Failover clustering documents http://technet.microsoft.com/en-us/library/cc732181(WS.10).aspx#BKMK_Install
Build SCVMM & SQLVM http://technet.microsoft.com/en-us/library/cc764289.aspx
SQL 2008 Install http://technet.microsoft.com/en-us/library/bb500469(SQL.100).aspx
http://technet.microsoft.com/en-us/library/ms143506(SQL.100).aspx
Exchange 2010 SP1 download link http://technet.microsoft.com/en-us/evalcenter/dd185495.aspx

1.1 Required Permissions 5

Hyper-V Cloud Accelerate Pilot Deployment Guide

2011-10-08T05:09:00Z

Table of Contents

1 Overview 5

1.2 Environmental Pre-Requisites 6

2 Installation 8

2.1 Initial Deployment 8

2.2 Customer Deployment 8

2.3 Active Directory Prerequisite Configurations 9

2.4 Mobile Hydration Toolkit Host 12

2.5 Hyper-V Host and Guest Installation 33

2.6 SQL Server 2008 SP1 CU10 Deployment 50

2.7 System Center Virtual Machine Manager 2008 R2 66

2.8 System Center Operations Manager 2007 R2 88

2.9 System Center Virtual Machine Manager Self-Service Portal 2.0 (SSP v2) 117

3 Management Agent Deployment, VMM Pro and VMM Reporting Setup 138

3.1 SCVMM Agents 138

3.2 Pro Tips and VMM Reporting 142

3.3 OpsMgr Agents 145

Appendix A: Active Directory Worksheet 151

Appendix B: Network Services Worksheets 152

Appendix C: User Account Worksheet 153

Appendix D: Groups Worksheet 154

Appendix E: Computer Account Worksheet 155

Appendix F: SQL Instance Worksheet 156

Appendix G: HVC Hydration Troubleshooting 157

Overview

The steps to perform the installation or restoration for the Hyper-V Cloud Accelerate Pilot environment are outlined in this document. The installation process is optimized for a prescriptive and targeted installation of the System Center products contained within the solution. It is not envisioned that the installation would utilize existing customer implementations of System Center products; it will rather utilize customized implementations to provide various areas of functionality to the overall solution. The following assumptions, permissions and prerequisites are provided.

The Hyper-V Cloud Accelerate Environment includes the following hosts and virtual machines:

Pilot Item	Required for
Hyper-V Host #1	Management VMs for the Pilot
Hyper-V Host #2	Pilot with required second host
Hyper-V Host #3	Pilot with optional third host
Hyper-V Host #4	Pilot with optional fourth host
Hyper-V Host #5	Pilot with optional fifth host
Hyper-V Host #6	Pilot with optional sixth host
Hyper-V Host #7	Pilot with optional seventh host
Hyper-V Host #8	Pilot with optional eighth host
SQL Server VM	SQL Server 2008 to support System Center product DB requirements
SCVMM VM	SCVMM installation
OpsMgr VM	OpsMgr installation and SQL reporting services installation
SSP VM	SSP v2, Windows SharePoint Services, and the SSP v2 Dashboard.

Required Permissions

Permissions required for performing installation:

Permissions needed	Required for
Local Administrator	Configuration of each component
Domain Administrator	Creation of required Active Directory objects (OU structure, users, groups, delegation)
SQL Server SysAdmin on all instances	Creating and connecting to databases

Environmental Pre-Requisites

As mentioned above, the solution utilizes custom installations of several System Center products. In order to perform these installations, the automation provided in the solution and the steps to be performed in this document assume several prerequisites are performed within the customer's environment.

Operating System and Component Software Requirements

All systems are built and configured using a customized installation of the Windows Server 2008 R2 operating system (operating system) known as the Mobile Hydration Toolkit. Once the Mobile Hydration Toolkit operating system is built, the actual component product installations are automated using a custom hydration wizard based on MDT. The HVC_Source repository is located at <insert partner download location>. Partners must use their own volume or enterprise agreement (EA) media to build the Mobile Hydration Toolkit and it is assumed that customers will require using their own media for many of the products. The media for the following products is required for the installation:

Windows Server 2008 R2 Hyper-V
Microsoft SQL Server 2008 SP1 with CU10
System Center Virtual Machine Manager 2008 R2
System Center Operations Manager 2007 R2 CU2
System Center Virtual Machine Manager Self Service Portal v2.0
Microsoft Windows SharePoint Services 3.0 SP2 x64
System Center Virtual Machine Manager Self Service Portal v2.0 Dashboard

The table below shows who is responsible for each piece of software and license:

Product	Media Type	Responsible Entity for License and Software
Windows Server 2008 R2	DVD	Partner and Customer
Microsoft SQL Server 2008 SP1 with Cumulative Update 10	DVD	Partner and Customer
System Center Operations Manager 2007 R2 with Cumulative Update 2	DVD	Customer
System Center Virtual Machine Manager 2008 R2	DVD	Customer
System Center Virtual Machine Manager Self Service Portal v2	Download	Customer
System Center Virtual Machine Manager Self Service Portal v2 Dashboard	Download	Customer
Microsoft Windows SharePoint Services 3.0 SP2 x64	Download	Customer

Table 1

Mobile Hydration Toolkit Hardware Requirements

In order to provide a reusable accelerator for hydration, a mobile component called the Mobile Hydration Toolkit is required to run on a single system. This system serves as a temporary repository within the customer environment to build and deploy the solution. As outlined in the Architecture guide, a Hyper-V Enabled Private Cloud requires a considerable amount of resources to run the System Center management products. Conversely, the Hydration Mobile Toolkit system is reusable and mobile in nature and should be run on a small workstation class system, laptop, or portable virtual machine that meets the minimum requirements listed below. The following hardware requirements are provided for the Mobile Hydration Toolkit host:

Hardware Component	Minimum Specifications
Processor	Dual-Core or dual processor system
RAM	4 GB
Hard Drive	80 GB Free Space
Network	1 GbE

Network Requirements

1 GbE network speeds are required. To support Windows Deployment Services installations using a Microsoft Deployment Toolkit (MDT), an existing Dynamic Host Configuration Protocol (DHCP) server is assumed to be available within the customer environment and is also assumed to not have the Windows Deployment Services role installed. The Hydration Mobile Toolkit server may not function as intended if the previous assumptions are not met. Additional DHCP scope options may be required to support Windows Deployment Services installations required for the hydration process. Additional information on Windows Deployment Services can be found on TechNet: http://technet.microsoft.com/en-us/library/cc771670(WS.10).aspx.

Installation

The installation and customization of the solution is mostly automated via MDT and scripting. The entire process needs to be completed at least once prior to any customer engagements. This is necessary in order to allow the consultant to become familiar with the process. The process is outlined as follows:

Initial Deployment

Partner environmental prerequisites are validated and remediated
Infrastructure is provisioned (servers, storage, and network)
Consultant Performs Active Directory Prerequisite Configurations of partners evaluation or demonstration environment
TEMP-WAIK computer is setup and used to create Mobile Hydration Toolkit ISO
Mobile Hydration Toolkit host (desktop, laptop, or VM) is built and configured using the HVC-HYDRATE ISO and light touch installation (LTI)
Mobile Hydration Toolkit host is joined to and configured for the environment (evaluation or demonstration)
Hydration of the Mobile Hydration Toolkit is completed
Management host is deployed using the Mobile Hydration Toolkit
Second host (optional) is deployed using the Mobile Hydration Toolkit
Management virtual machines are deployed using the Mobile Hydration Toolkit
Mobile Hydration Toolkit host is removed from test or evaluation environment and readied for reuse at next engagement (data wiped and ISO based LTI process repeated or snapshot rolled back if a portable VM is used)
1. Customer Deployment
Customer environmental prerequisites are validated and remediated
Infrastructure is provisioned (storage, network)
Consultant Performs Active Directory Prerequisite Configurations of customers Pilot environment
Mobile Hydration Toolkit host (desktop, laptop, or VM) is built and configured using the HVC-HYDRATE ISO and light touch installation (LTI) or restored from a saved VHD or Hyper-V snapshot.
Mobile Hydration Toolkit host is joined to and configured for the customer's Pilot environment
Hydration of the Mobile Hydration Toolkit is completed
Management host is deployed using the Mobile Hydration Toolkit
Second host (optional) is deployed using the Mobile Hydration Toolkit
Management virtual machines are deployed using the Mobile Hydration Toolkit
Mobile Hydration Toolkit host is removed from the customers Pilot environment and readied for reuse at next engagement (data wiped and ISO based LTI process repeated or snapshot rolled back if a portable VM is used)

1. Active Directory Prerequisite Configurations
  1. Creating The Required Active Directory Objects

Within the HVC_Source <insert partner download location here>, several files are provided to create the required service accounts, security groups, OU structure, and associated delegation to house the HVC solution. Depending on the scenario, this script may have to be run on a DC in the customer's environment. These files include:

HVCADPreReq.PS1 – PowerShell script to create all required objects in the target Active Directory instance
groups_domainlocal.csv, groups_global.csv and groups_universal.csv – Comma delimited files used to specify the names of the required security groups
Users.csv - Comma delimited file used to specify the names of the required service accounts

In order to run this script, the following steps must be followed:

From a tool such as Excel, edit the Users.csv groups_domainlocal.csv, groups_global.csv and groups_universal.csv files to contain the user and group object names determined in the design workshop. Default object names are included in the files and are referenced throughout this document. These files are located in the HVC_Source\HVC_Solution_Pack\DIST\HVCHydration\Applications\HVC AD Prereq Script\ folder. If no modifications to the defaults are required, the CSV files can be used as-is.
Identify the distinguished name (DN) of the OU or container in the target Active Directory environment where the OU structure will reside. For example, if the organization has an OU structure for similar installations called "Projects", the resulting DN would be "ou=Projects,dc=domain,dc=domain" and if the customer would like the HVC OU at the top of the domain, then "dc=domain,dc=domain" would be sufficient.
Login with a user that has Domain Admins membership or delegated rights to the OU that will host the new OU structure. Copy the HVC AD Prereq Folder to a local folder on the server where you are running the command. In this example, the folder has been copied to the root of C:\. From an elevated PowerShell command prompt, run the HVCADPreReq.PS1 script with the following arguments: -Domain – The NetBIoperating system domain name of the target Active Directory domain -BaseDN – The full DN of the source container or OU where the OU structure and associated objects will be placed Enter the password that will be used for ALL service accounts when prompted. Note: If the error below is received, your Execution Policy needs to be changed. "File ...HVCADPreReq.ps1 cannot be loaded because the execution of scripts is disabled on this system. Please see "get-help about_signing" for more details."	.\HVCADPreReq.ps1 –Domain CONTOSO –BaseDN "dc=contoso,dc=com"
The script will create all required objects and delegate the resulting OU structure to a group called HVC-Admins.

Mobile Hydration Toolkit Host
1. Creating the Reference Image and Mobile Hydration Toolkit Installation Media

The solution uses a custom unattended installation of Windows Server 2008 R2 utilizing custom media to support its automated processes. The goal of this build is to provide a starting point (reference image and Mobile Hydration Toolkit) for the solution and assist with initial setup of the envisioned Hyper-V Enabled Private Cloud host and virtual machine components. The build utilizes an unattended installation process to create the Mobile Hydration Toolkit server (HVC-HYDRATE) which can be used to develop subsequent MDT or Windows Deployment Services captured builds using the customer's media – which is a requirement in some customers. MDT and Hydration (the "toolkit") provide the necessary post-setup configuration installation files in order to instantiate the environment; this automation simply assists with the development of an MDT reference image.

The initial automation is built upon several design assumptions, including:

Windows Server 2008 R2 will be utilized for all components
The customer will either provide Windows Server media or utilize Volume Licensing media available at the Microsoft Volume Licensing (MLVS) download site
All required Premier Support Hyper-V hotfixes are to be installed as part of the base operating system
All Prerequisite configurations will be made to the operating system to prepare for an MDT or Windows Deployment Services capture

Creating the HVC Mobile Hydration Toolkit Operating System Media

The build utilizes a base Windows Server 2008 R2 Full Installation configuration. To create the image, the following elements are required:

Windows Server 2008 R2 source files
HVC_Source files, which includes
- Post-setup configuration scripts
- Unattended installation file
- Windows Server 2008 R2 Automated Installation Kit (AIK)

To create an unattended build, the following steps must be followed:

On TEMP-WAIK (the system where the build will be created) copy the folder HVC_Source\HVC_Solution_Pack\BIN\WAIK2.0\ to C:\WAIK2.0. Install the Windows AIK by running the appropriate Windows Installer file, e.g., C:\WAIK2.0\waikamd64.msi. Select the default options during the installation wizard.
On TEMP-WAIK, create a folder called "Distribution" at the root of the drive and a sub-folder called "HVC". Expand the contents of the Windows Server 2008 R2 DVD to a local directory called "WS2008R2_DVD_Staged". The full path should be: C:\Distribution\HVC\WS2008R2_DVD_Staged
Copy the WS2008R2_DVD_Staged\$OEM$ folder and its contents from the HVC_Source folder to the root of the expanded Windows Server 2008 R2 DVD folder (e.g., C:\Distribution\HVC\WS2008R2_DVD_Staged\$OEM$).
Copy the autounattend.xml file from the WS2008R2_DVD_Staged folder in the HVC_Source folder to the root of the C:\Distribution\HVC\WS2008R2_DVD_Staged folder.
From the system where the WAIK was installed, elevate a Command Prompt and run the following command to create a bootable Windows Server 2008 DVD: C:\HVC_Source\HVC_Solution_Pack\Create-HVCHydrateISO.cmd Once finished, the HVC-HYDRATE.ISO can be found in C:\Distribution\HVC.

From this point, the HVC Mobile Hydration Toolkit system (HVC-HYDRATE) can be installed. From this system, other portions of the HVC solution, including the HVC management products, can be deployed. Additional customer-specific customizations can be made in the resulting installation and captured in MDT and/or Windows Deployment Services.

Installing the HVC Mobile Hydration Toolkit (HVC-HYDRATE)

The Hyper-V Enabled Private Cloud environment runs all core services on Windows Server 2008 R2. An ISO of Windows Server 2008 R2 was created in the previous step. This image contains a customized build of Windows Server 2008 R2 and additional required configuration changes. The HVC_Source contains all required system provisioning automation, publically available source files, and pre-service pack patches for Hyper-V.

Insert the newly created HVC-HYDRATE DVD (or the ISO in virtual machine-based installs) in the server provided for the Mobile Hydration Toolkit (HVC-HYDRATE). Note: This is a destructive action and should only be performed if a system requires initial build or recovery.
After initial POST, when prompted, press any key to boot from DVD and enter in the Windows Setup interface.

The Install Windows dialog appears. At this point the Windows Server 2008 R2 installation will perform in an unattended fashion. No interaction on the part of the administrator is required to complete the base installation of the operating system. Allow the installation of the customized Windows Server 2008 R2 build to complete without interruption.
Once completed, the CTRL + ALT + DELETE dialog is displayed. Press the Ctrl + Alt + Delete keys simultaneously to initiate logon to the system.
At the logon dialog, confirm that the local Administrator account is identified. Type in the initial system password in the dialog box: Wh@tAreYou4? Click the Arrow, or click Enter to continue.
The system desktop appears. Wait for system startup to complete. Once completed, it is recommended that system naming is set properly (though this system will always be referred to as HVC-HYDRATE) on the system and that the default local admin password is changed in accordance to your policy. This may need to be updated each time the Mobile Hydration Toolkit is created and integrated into a new customer's Pilot production environment.
This process and the configuration steps to follow must be repeated for each engagement. In order to reduce the time needed for this process, you can maintain the ISO file created earlier and skip the TEMP-WAIK section for future build. If you chose to create HVC-HYDRATE as a VM, you can also utilize a snapshot or read-only differencing VHD to preserve this base installation state.

The following components and configurations are automatically added to the Mobile Hydration Toolkit:

Windows Deployment Services role
Microsoft .NET Framework feature
Windows Firewall configuration
BGInfo
PowerShell configuration

Once built, the resulting operating system will be utilized as a starting point for the HVC Hydration process.

Configuring the Mobile Hydration Toolkit

Now that the Mobile Hydration Toolkit is installed with the necessary components, it must be configured to support the HVC Hydration and operating system Provisioning processes.

Join HVC-HYDRATE to the existing Active Directory domain. (If this is for a customer engagement, then join the customer's AD domain). The computer account should be placed in the HVC\Servers OU created during the AD prerequisites steps. Logon to HVC-HYDRATE as a member of the Domain Admins group (to ensure local administrator access as well as the necessary rights to configure Windows Deployment Services as an authorized DHCP server in the domain).
Copy the contents of the WS2008R2_DVD_Staged folder to the C: drive of HVC-HYDRATE, e.g., C:\ WS2008R2_DVD_Staged.
Copy the contents of the HVC_Solution_Pack folder to the C: drive of HVC-HYDRATE, e.g., C:\HVC_Solution_Pack.
Open an elevated Command Prompt, change directory to C:\HVC_Solution_Pack, and run start.cmd.
Click Next on the welcome screen.
Enter the credentials of a domain service account that will be used to authenticate to the Hydration and Provisioning file shares (e.g., HVC-MDT-SVC). Click Next.
Click Begin to start the installation of the HVC Solution Pack. Click Yes to confirm.
The HVC Solution Pack will automatically install the Windows Automated Installation Kit (WAIK), Microsoft Deployment Toolkit (MDT), configure Windows Deployment Services, and configure MDT by adding the HVC Hydration and HVC Provision deployment shares. Note: The configuration is tied to the profile of the account you are logged on with when the process is implemented.
Click OK to the setup is complete message box.
Add the customer provided Windows Server 2008 R2 installation source files by copying them from the customer provided media to the HVC-HYDRATE location C:\ HVCProvision\Operating Systems\Windows Server 2008 R2 x64\ (this folder will already exist). The installation source files consist of all files and folders within the customer-provided Windows Server 2008 R2 media.
Add the customer provided application installation sources for SCVMM 2008 R2, and OpsMan 2007 R2 by copying them from the customer provided media to the HVC-HYDRATE location C:\ HVCHydration\Applications\INSTALL - <AppName>\Source (this folder will already exist for each application).
While all of the components are compatible and supported with Microsoft SQL Server 2008 R2, the SQL Server Hydration installation is based upon the SQL Server 2008 SP1 Cumulative Update 10. In order to create these integrated source files, the following steps must be followed:
Create the folder C:\SQLServer2008_FullSP1 on HVC-HYDRATE. Copy the original SQL Server 2008 x64 source media to C:\SQLServer2008_FullSP1 (you can exclude the x86 and IA64 folders).
Open an elevated Command Prompt and change directories to C:\HVCHydration\Applications\INSTALL-SQL2008SP1\ Run Slipstream_SQL2010_SP1_CU10.cmd
Click OK.
Click OK again.
Close the Command Prompt when copying completes.
Open the MDT Deployment Workbench (Start – All Programs – Microsoft Deployment Toolkit).
Select the Deployment Shares folder and then right-click the HVC Provision Deployment Share and select Properties.
On the General tab, in the Platforms Supported section, uncheck x86 and click OK.
In the next few steps, you may need to integrate customer required drivers, updates, and hotfixes into the deployment source. For more details on obtaining the required files please refer to http://support.microsoft.com/kb/323166. For more information on Windows Deployment Services please refer to http://technet.microsoft.com/en-us/library/cc772106(WS.10).aspx. For more information on Microsoft Deployment Toolkit please refer to http://technet.microsoft.com/en-us/solutionaccelerators/dd407791.aspx. For more information on Windows Automated Installation Kit please refer to http://technet.microsoft.com/en-us/library/dd349343(WS.10).aspx.
Add any hardware drivers to the Drivers node that may be required for the HVC Management host systems (primarily mass storage and network 64-bit drivers for either Windows PE or Windows Server 2008 R2).
Add any required Windows Server 2008 R2 updates (patches) to the Packages node, Server2008R2x64 folder. Updates can be integrated here, applied later using Windows Update, or integrated using the customer's existing patch management solution if one exists. No additional updates are required to complete hydration but a fully patched host should be the end result of whatever process is used with the customer.
Import the necessary Hyper-V updates from the HVC_ Source folder: Expand the HVC Provision Deployment Share and expand the Packages folder. Select and then right-click on the Hyper-V folder and select Import OS Packages.
Input or browse to C:\WS2008R2_DVD_Staged\$OEM$\$1\Control\HOTFIXES in the Package Source directory field and click Next.
Click Next.
Click Finish.
The Hyper-V folder should now contain the required hotfixes.
Right-click the HVC Provision Deployment Share and select Update Deployment Share.
Click Next to select the default options.
Click Next to begin.
Click Finish when complete.
The deployment share will update, generating the Lite Touch Windows PE image (C:\HVCProvision\Boot\LiteTouchPE_x64.wim). Note: Once completed, this image needs to be set to be the default boot image in Windows Deployment Services This process is covered in the next steps.
Open the Windows Deployment Services administrative console (Start – Administrative Tools – Windows Deployment Services).
Expand the server, right-click Boot Images and select Add Boot Image.
Enter C:\HVCProvision\Boot\LiteTouchPE_x64.wim and click Next.
Accept the default name and description values and click Next.
Click Next.
Click Finish when complete. Note that the default boot image is now listed pointing to the WIM created in the previous steps.
Add the domain group HVC-Admins to the local administrators group on HVC-Hydrate.

The Mobile Hydration Toolkit is now ready to provision and hydrate host and guest systems.

Note: An existing DHCP server is assumed to be available on the network. This DHCP server is also assumed to not have the Windows Deployment Services role installed. The HVC-HYDRATE Windows Deployment Services server may not function as intended if the previous assumptions are not met.

Hyper-V Host and Guest Installation
1. Provisioning Hyper-V Hosts

The next step is to provision the physical hardware that will support the Hyper-V hosts. Assuming the physical servers are prepared, the following steps will install Windows Server 2008 R2 using a lite-touch installation from the Mobile Hydration Toolkit server, including the necessary configurations for the management host.

Turn on the first physical server and, if needed, select the appropriate option to PXE boot to the network. The server should get an IP address from the DHCP server and then locate the Windows Deployment Services PXE service on HVC-HYDRATE. Press F12 for network services boot.
The system will download and boot to the Windows PE image.
Select the task sequence HVC HOST (LTI) and click Next.
Enter the computer name of this HVC Host (e.g., HVCHost1) and click Next.
Enter the existing Active Directory domain name and credentials to create the computer account. You may also enter the DN of OU in which you would like it created in (e.g., ou=server,ou=hvc,dc=contso,dc=com) Click Next.
Specify the appropriate time zone, and click Next.
Click Begin to start the unattended installation of Windows Server 2008 R2.
The installation process will run through a series of actions as the host operating system is installed and configured for Hyper-V.
After the operating system installation completes, the HVC Solution Pack process will continue to configure the Hyper-V host and will reboot several times as additional actions are completed.
Review the Deployment Summary upon completion and click Finish to close the deployment wizard. The server will now reboot.
Hyper-V Networking Information As part of the deployment process, a default virtual network is created on each host. This virtual network is bound to the first available physical network adapter in the host server, is assigned the name "public" and is configured as an external network. At least one network must be created in order for the solution to function. It will likely be necessary to create additional networks, modify or delete the default "public" network, and generally investigate the needs of the customer's specific network implementation. For details on how to configure these networks and for additional guidance, please refer to http://technet.microsoft.com/en-us/library/cc816585(WS.10).aspx

The following components and configuration are automatically added to the Hyper-V host:

Hyper-V role
- Default Virtual Network "Public"
Microsoft .NET Framework feature
Windows Firewall configuration
BGInfo
PowerShell configuration

Create Management Virtual Guests

From a tool such as Excel or Notepad, edit the HVCcreateMGMTVMs.csv file (found in C:\HVCHydration\Applications\HVC Create MGMT VMs\) to contain the following information:

Hostname or IP-Address of the server hosting the HVC Management guests.
Name of the Virtual Network the guests shall use to connect. This is required to match the host network. The Virtual Network Public is created by default on each Hyper-V host deployed using the HVC Hydration process. Adjust this value if necessary.
The server names as they should be named in HYPER-V.
The path to where the VHD files should be located. It is recommended that these VHD files be place on a dedicated group of disks separate from the Host operating system (Parent Partition). For more information on Hyper-V storage please refer to http://technet.microsoft.com/en-us/library/dd183729(WS.10).aspx
It is recommended that you leave the number of virtual processors and virtual memory as is but this can be adjusted if necessary as long as the minimum hardware requirements for each product are met.

The list should contain 4 servers.
Save the file.

Copy the folder C:\HVCHydration\Applications\HVC Create MGMT VMs\ and all contents to the root of the C:\ drive on the Hyper-V host server that will host all management VMs.

Logon on, using HVC-INSTALL-SVC credentials, to the Hyper-V server that will host the HVC management servers.

From an elevated PowerShell command prompt, change directories to C:\HVC Create MGMT VMs\ and run the script HVCCreateMGMTVMs.ps1.

Type in the credentials for HVC-INSTALL-SVC.

The script will run and create all the servers listed in the CSV file.

You can safely ignore the warning related to starting each VM. The VM will be started by the time you open the Hyper-V MMC in the next step.

Open the Hyper-V Manager and validate each of the newly created VMS.

Provisioning Management Virtual Machines

The following steps will install Windows Server 2008 R2 on the newly created virtual machines using a lite-touch installation from the Mobile Hydration Toolkit server, including the necessary configurations for the Management virtual machines.

In Hyper-V Manager, right-click one of the newly created VMs that will host the System Center management products and select Connect….
Click the green Reset button to restart the VM. Click Reset again on the alert pop-up.
Press F12 to PXE boot to the network. The VM will locate the Windows Deployment Services PXE service on HVC-HYDRATE and download the necessary boot files.
Next the VM will load the LiteTouch WIM.
Select the task sequence HVC FM GUEST (LTI) and click Next.
Enter the computer name of this HVC management virtual machine and click Next.
Enter the existing Active Directory domain name and credentials to create the computer account. You may also enter the DN of OU where you would like it created (e.g., ou=server,ou=hvc,dc=contso,dc=com) and click Next.
Specify the appropriate time zone and click Next.
Click Begin to start the unattended installation of Windows Server 2008 R2.
The installation process will run through a series of actions as the guest operating system is installed and configured.
After the operating system installation completes, the HVC Solution Pack process will continue to configure the VM and will reboot several times as additional actions are completed.
Review the Deployment Summary upon completion and click Finish to close the deployment wizard. The server will now reboot.
Shutdown the server and open Hyper-V Manager on the host.
Select the VM in Hyper-V manager and select Settings.
Select the Legacy Network Adapter, click remove, and then click OK. This adapter was only needed for network-based deployment. It is removed in favor of the synthetic network adaptor that is optimized for Hyper-V.
Power on the VM.
Repeat the above process to provision the three other remaining Management virtual machines (multiple installations can occur simultaneously).
Add the OpsMgr computer account to the OpsMgr Admins group (i.e., HVC-OM-Admins) and to the SQL Admins group (i.e., HVC-SQL-Admins)
The Management virtual machines are now ready to be hydrated.

The following components and configuration are automatically added to each virtual machine:

Microsoft .NET Framework feature
Windows Firewall configuration
BGInfo
PowerShell configuration

SQL Server 2008 SP1 CU10 Deployment
1. Overview

This section provides a high-level walkthrough on how to setup and implement the task sequence and scripts for deploying SQL Server 2008 SP1 with CU10 on the Management SQL VM in an automated manner.

Prerequisites

The following environment prerequisites must be met before proceeding.

Accounts

Verify that the following accounts have been created by the HVC Active Directory Object creation script:

User Name	Purpose
HVC-SQL-SVC	SQL Service Account
HVC-INSTALL-SVC	Install Account

Groups

Verify that the following security groups have been created by the HVC Active Directory Object creation script (Note: Members and member-of is automatically set by the provisioning or hydration processes):

Security Group Name	Group Scope	Members	Member-of
HVC-Admins	Universal	HVC-INSTALL-SVC and customers Administrators for the HVC solution	Buildin\Administrators Sysadmin role on all SQL instances
HVC-SQL-Admins	Universal	All HVC service accounts and customers SQL Administrators for the HVC solution	Buildin\Administrators
HVC-OM-Admins	Domain Local	OpsMgr service account and customers OpsMgr Administrators for the HVC solution	Sysadmin role on HVCSCOM instance
HVC-VMM-Admins	Global		Sysadmin role on MICROSOFT$VMM$ instance
HVC-SSP-Admins	Domain Local	SSP service account	Sysadmin role on HVCSSP instance Sysadmin role on HVCWSPS instance

Hydration Wizard Variables

The SQL Server hydration wizard will prompt you for the following values:

SQL Service Account Name
SQL Service Account Password
SQL Instance DATA Directory
SQL Instance LOG Directory
Application admin group name for each of the HVC management components (these groups, along with HVC-INSTALL-SVC are assigned to the sysadmin roles on the appropriate instance in SQL)
- VMM admin group name
- OpsMgr admin group name
- SSP admin group name
- SQL admin group name

Note: The SQL service account (e.g., HVC-SQL-SVC) is only used to start the SQL service for each instance. Later in this guide the "SQL Service Account" refers to the account used to connect to the SQL instance or database for each application. This will always be the service account for that specific application (e.g., HVC-VMM-SVC, HVC-OM-SDK-SVC, and HVC-SSP-SVC).

Creating the SQL Data and Log Drives

Logon to the Hyper-V host that is hosting the SQL VM as HVC-INSTALL-SVC and open the Hyper-V Manager console.
Select the SQL VM and open the VM Settings…
Select the SCSI Controller, select Hard Drive and click Add.
Click New.
Select Do not show this page again and then click Next.
Select Fixed size and click Next.
Enter a name and location for the new disk and click Next. This VHD will be the location for SQL log files. Be sure to place it on a physical volume with sufficient performance to handle the expected I/O of the SQL VM.
Specify a size for the new VHD of at least 40 GB and click Next.
Click Finish.
Click Apply.
Repeat the previous steps to create a second VHD that will be the location for SQL database files. Close the VM Settings.
Logon to the SQL server as HVC-INSTALL-SVC.
Open Disk Management.
Right-click on Disk 1 and select Online. Right-click on Disk 2 and select Online.
Right-click on Disk 1 and select Initialize Disk.
Leave both Disk 1 and Disk 2 selected, and click OK.
Right-click on the Unallocated space of Disk 1, and select New Simple Volume….
Select Next.
Accept the default volume size, and click Next.
Accept the default drive letter, and click Next. This drive letter will be provided for the path of the SQL Log files when running through the SQL Hydration wizard.
Adjust the volume label if desired, and click Next.
Click Finish.
Repeat the previous few steps on Disk 2 for the SQL Data volume.
Close Disk Management.

Installing the SQL Named Instances

The SQL Hydration process will perform the following: Install Application Server Role Install Web Server Role Update Builtin\Administrators membership Disable firewall for domain profile Install SQL Tools Install SQL Server with 4 instances (MICROSOFT$VMM$, HVCSCOM, HVCWSPS, HVCSSP) Refer to the Troubleshooting Appendix for complete details.
From an elevated Command Prompt, implement the hydration from the Mobile Hydration Toolkit server HVC-HYDRATE by running the following command: cscript.exe \\HVC-HYDRATE\HVCHydration$\Scripts\Hydration.vbs
The Hydration Wizard will appear. Click Next to continue.
Select the HVC Hydration task and click Next to continue.
From the available choices, select the checkbox for INSTALL-SQL 2008 SP1.
The dialog will expand to show the available options for SQL 2008 SP1 installation. Provide the following values, and click Next: SQL Service Account Name (e.g., HVC-SQL-SVC SQL Service Account Password SQL DATA and LOG directories SQL Administrator Group name (e.g., HVC-SQL-Admins) VMM Administrator Group name (e.g., HVC-VMM-Admins) OpsMgr Administrator Group name (e.g., HVC-OM-Admins) VMMSSP Administrator Group name (e.g., HVC-SSP-Admins)
Review the settings specified in the wizard and click Begin to start the installation.
When prompted, click Yes to begin the installation.
The installation will continue until all 4 SQL instances complete installation on the SQL server. Note: The process may take quite some time to complete. Do not interrupt the installation process even if you see no indication of progress.
Click Finish to close the deployment wizard.
Because the SQL service is running as a domain user it will not be able to dynamically create SPNs for each SQL instance. The next few steps will show the process of setting the SPN using the setspn.exe tool.	http://msdn.microsoft.com/en-us/library/ms191153.aspx
While still logged in as HVC-INSTALL-SVC, from an elevated Command Prompt, run the following command once for each of the four SQL instances: setspn –A MSSQLSvc/<FQDN>:<instancename> <accountname> Where: FQDN = the fully qualified domain name of the SQL server instancename = the name of the SQL instance accountname = the name of domain account used to run the SQL service e.g., setspn –A MSSQLSvc/SQL01.contoso.com:MICROSOFT$VMM$ contoso\hvc-sql-svc Instance Names: MICROSOFT$VMM$ HVCSCOM HVCSSP HVCWSPS
SQL hydration is now complete. Reboot the SQL server.

System Center Virtual Machine Manager 2008 R2
1. Overview

This section provides a high-level walkthrough on how to setup and implement the task sequence and scripts for deploying SCVMM 2008 R2 in a highly automated manner.

Pre-requisites

The following environment prerequisites must be met before proceeding:

Accounts

Verify that the following accounts have been created by the HVC Active Directory Objects creation script as outlined in the section above:

User Name	Purpose
HVC-VMM-SVC	Virtual Machine Manager Service Account

Groups

Verify that the following security groups have been created by the HVC Active Directory Objects creation script as outlined in the section above.

(Note: members and member-of is automatically set by the provisioning or hydration processes):

Security Group Name

Group Scope

Members

Member-of

HVC-VMM-Admins

Global

HVC-VMM-SVC

HVC-SSP-SVC

Builtin\Administrators

HVC-Admins

Universal

HVC-INSTALL-SVC

Builtin\Administrators

SQL Configuration

Verify that the SQL server instance MICROSOFT$VMM$ exists and that HVC-VMM-Admins, HVC-Admins, and HVC-INSTALL-SVC have been assigned the Sysadmin role to the instance.

Creating the VMM Library Share Drive

Logon to the Hyper-V host that is hosting the VMM VM as HVC-INSTALL-SVC and open the Hyper-V Manager console.
Select the VMM VM and choose the VM Settings….
Select the SCSI Controller, select Hard Drive and click Add.
Click New.
Select Fixed size and click Next.
Provide a name and location for the new disk, and click Next.
Specify a size for the new VHD of at least 200 GB, and click Next.
Click Finish.
Click Apply.
Close the VM Settings.
Logon to the VMM server as HVC-INSTALL-SVC.
Open Disk Management.
Right-click on Disk 1 and select Online.
Right-click on Disk 1 and select Initialize Disk.
Leave Disk 1 selected, and click OK.
Right-click on the Unallocated space of Disk 1 and select New Simple Volume….
Select Next.
Accept the default volume size, and click Next.
Accept the default drive letter, and click Next. This drive letter will be provided for the path of the VMM Library share when running through the VMM setup wizard.
Adjust the volume label if desired, and click Next.
Click Finish.
Close Disk Management.

Installing SCVMM

The SCVMM Hydration process will perform the following: Install SQL Tools Install VMM Client Install OpsMgr Operators Console Add VMM Administrators and VMM SSP Administrators domain groups to local Builtin\Administrators group Refer to the Troubleshooting Appendix for complete details.
Logon to the HVC VMM server as HVC-INSTALL-SVC. From an elevated Command Prompt, implement the hydration from the Mobile Hydration Toolkit server HVC-HYDRATE by running the following command: cscript.exe \\HVC-HYDRATE\HVCHydration$\Scripts\Hydration.vbs
The Hydration Wizard will appear. Click Next to continue.
Select the HVC Hydration task and click Next to continue.
From the available selections, select the checkbox for INSTALL- VMM 2008 R2.
The dialog will expand to show the available options for VMM 2008 R2 installation. Provide the following values and click Next: SQL Server Name (e.g., SQL01) SQL Service Account Name (e.g., HVC-VMM-SVC) SQL Service Account Password VMM Administrator Group name (e.g., HVC-VMM-Admins) VMM SSP Administrator Group name (e.g., HVC-SSP-Admins) VMM Library Share Path
Review the settings specified in the wizard and click Begin to start the installation.
When prompted, click Yes to begin the installation.
The installation will continue until SCVMM installation is complete. The process may take quite some time to complete. Do not interrupt the installation process even if you see no indication of progress.
Once the hydration wizard completes it will have installed SQL Server 2008 SP1 Tools, the VMM 2008 R2 Admin Console, and the OpsMgr 2007 R2 Operations Console. Click Finish.
From the same elevated Command Prompt, start the install of the SCVMM Server Component by running the following command: "\\hvc-hydrate\hvchydration$\Applications\INSTALL - VMM 2008 R2\Source\Setup.exe" Click SETUP -> VMM Server.
Accept the license agreement and click Next.
Select I don't want to use Microsoft Update and click Next.
Select No, I am not willing to participate and click Next.
Supply an appropriate User name and Company value, and click Next.
Click Next.
Click Next.
Select User a Supported Version of SQL Server, select Use the following credentials, select Create a new database, and input the values for these fields: SQL server name: The name of the VM running SQL. By default this is SQL01 User name and domain: The name of the VMM service account. By default this is HVC-VMM-SVC Password: The password for the account selected Select the VMM SQL instance name from the dropdown list. By default this is MICROSOFT$VMM$ Select Create a new database. Click Next.
Change the path for the VMM Library Share to point to the volume you created in the previous section. Click Change. Select the Library volume you created. Select Make New Folder and name the folder VMMLibrary. Click Ok. Click Next.
Click Next.
Click Install.
Install process will take several minutes.
Deselect the Check for latest Virtual Machine Manager updates, and click Close.
Click Exit to close the VMM setup splash screen.
From the same elevated Command Prompt, start the install of the SCVMM Server Component by running the following command: msiexec /update "\\hvc-hydrate\hvchydration$\Applications\INSTALL - VMM 2008 R2\Update\vmmServer64Update-OEM.msp" BOOTSTRAPPED=1
Click OK.
The application will install and close automatically when finished. You can confirm installation was successful by checking for MsInstaller Event ID 1035 in the Application Event Log.
Launch the SCVMM Admin Console. Click Connect.
Validate that the SCVMM Admin Console opens and connects to the server service without issue. Close the console.

System Center Operations Manager 2007 R2
1. Overview

This section provides a high-level walkthrough on how to setup and implement the task sequence and scripts for deploying OpsMgr 2007 R2 in a highly automated manner. OpsMgr is deployed with SQL Reporting Services installed locally but all databases on the remote SQL server.

Prerequisites

The following environment prerequisites must be met before proceeding:

Accounts

Verify that the following security groups have been created by the HVC Active Directory Object creation script as outlined in the section above:

User Name	Purpose
HVC-OM-Action	OpsMgr Action Account
HVC-OM-DWRD-SVC	OpsMgr Data Reader Account
HVC-OM-DWRT-SVC	OpsMgr DW Write Account
HVC-OM-SDK-SVC	OpsMgr SDK Account

Groups

Verify that the following security groups have been created by the HVC Active Directory Object creation script as outlined in the section above (Note: members and member-of is automatically set by the provisioning or hydration processes):

Security Group Name

Group Scope

Members

Member-of

HVC-OM-ADMINS

Global

HVC-OM-Action

HVC-OM-DWRD-SVC

HVC-OM-DWRT-SVC

HVC-OM-SDK-SVC

SCOM Administrators' privileged admin accounts

SCOMSERVER$ computer account

Builtin\Administrators

Sysadmin role on the OpsMgr SQL instance

HVC-OM-OPS

Global

SCOM Operators' privileged admin accounts

SQL Instance Configuration

Verify that the SQL server instance HVCSCOM exists and that HVC-OM-Admins, HVC-Admins, and HVC-INSTALL-SVC have been assigned the Sysadmin role to the instance.

Installation – Operations Manager Prerequisites and Reporting Server

The following steps must be completed in order to install the required prerequisites for Operations Manager 2007:

The Operations Manager Prerequisites and Reporting Server Hydration process will perform the following: Install II7 and .Net Install AJAX Extensions Install SQL Server Reporting Services Refer to the Troubleshooting Appendix for complete details.
Log on to the OpsMgr VM as HVC-INSTALL-SVC. From an elevated Command Prompt, implement the hydration from the HVC Mobile Hydration Toolkit server: cscript.exe \\HVC-HYDRATE\HVCHydration$\Scripts\Hydration.vbs
The Hydration Wizard will appear. Click Next to continue.
Click Next.
From the available choices, select the checkbox for INSTALL- OpsMgr 2007 R2.
Select Install Prerequisites on OpsMgr server, and click Next. There is no need fill out or change any of the other configuration variables at this point.
Review the settings specified in the wizard, and click Begin to start the installation.
When prompted, click Yes to begin the installation.
The installation will continue silently until the OpsMgr prerequisites complete its installation on the OpsMgr Server.
After the OpsMgr prerequisites complete, please complete the following SQL Server Reporting Services configuration:
Launch the Reporting Services Configuration Manager (Start->All Programs->Microsoft SQL Server 2008->Configuration Tools). Click Yes on the UAC alert.
In the Reporting Services Configuration Connection dialog box, accept the default entries and click Connect.
In the Reporting Services Configuration Manager, maximize the window.
Click the Database menu item on the left. In the details pane, click Change Database. The Report Server Database Configuration Wizard will then launch.
Select the Create a new report server database option. Click Next.
On the Database Server page, enter the SQL Server name and SQL instance name for OpsMgr (e.g., SQL01\HVCSCOM). Click Test Connection. When the Test Connection dialog states "Test Connection Succeeded", click OK. Click Next.
On the Database page, accept the default selections, and click Next.
On the Credentials page, accept the default selection of NT AUTHORITY\NETWORK SERVICE for the Service Credential, and then click Next.
On the Summary page, review the settings, and then click Next.
On the Progress and Finish page, review the results, and then click Finish.
In the Reporting Services Configuration Manager, click the Web Service URL menu item on the left. In the details pane, click Apply.
Click the Report Manager URL menu item on the left. In the details pane, click Apply.
*Optional:* Click the Email Settings menu item on the left. In the details pane, enter an email address in the Sender Address field and the FQDN of an outbound SMTP server in the SMTP Server field. Click Apply.
Click Exit to close the Reporting Services Configuration Manager.
Ensure that the OpsMgr server computer account has already been added to the Operations Managers Administrators security group (i.e., HVC-OM-Admins) and the SQL Admins security group (i.e. HVC-SQL-Admins), and then reboot the server.
Verify that the reboot of the OpsMgr server has completed. From another computer, open Internet Explorer and inspect the health of the Report Server and Report Manager by browsing to the following sites respectively: http://<OpsMgrServerName>/reportserver And http://<OpsMgrServerName>/reports
Close IE.

Installation – Operations Manager Databases

The following steps must be completed in order to install and configure the Operations Manager 2007 databases.

The Operations Manager Databases Hydration process will perform the following: Install OpsMgr Database on SQL server Install OpsMgr Data Warehouse on SQL server Refer to the Troubleshooting Appendix for complete details.
Logon to the SQL Server as HVC-INSTALL-SVC. From an elevated Command Prompt, implement the hydration from the HVC Mobile Hydration Toolkit server: cscript.exe \\HVC-HYDRATE\HVCHydration$\Scripts\Hydration.vbs
The Hydration Wizard will appear. Click Next to continue.
Click Next.
From the available choices, INSTALL – OpsMgr 2007 R2.
Type in the SQL server name and the SQL instance. Select Install OpsMgr Databases on SQL Server. Fill in the SQL Server and SQL Instance fields with the appropriate values for your environment (e.g., SQL01 and HVCSCOM). Fill in the Administrators Security Group field with the appropriate value for your environment (e.g., HVC-OM-Admins). Fill in the Management Group name with the appropriate value for you environment (e.g., HVC). Fill in the SQL Data Directory and SQL Log Directory with the appropriate values for your environment (e.g., F:\MSSQL\Data and E:\MSSQL\Data). Click Next.
Review the settings specified in the wizard and click Begin.
Click Yes.
The installation will continue silently until the OpsMgr DBs are created on the SQL Server. Click Finish. Log off the SQL server.

Installation – Operations Manager Roles

The following steps must be completed in order to install and configure the Operations Manager 2007 server roles.

The Operations Manager Roles Hydration process will perform the following: Install OpsMgr Server Roles Install OpsMgr Reporting Install OpsMgr CU 2 Configure OpsMgr (import management packs) Refer to the Troubleshooting Appendix for complete details.
Logon on to the OpsMgr server as HVC-INSTALL-SVC. From an elevated Command Prompt, implement the hydration from the HVC Mobile Hydration Toolkit server: cscript.exe \\HVC-HYDRATE\HVCHydration$\Scripts\Hydration.vbs
Click Next.
Click Next.
From the available choices, select INSTALL – OpsMgr 2007 R2.
Select Install and configure roles on OpsMgr. Provide the following values, and click Next: SQL Server (e.g., SQL01) SQL Instance (e.g., HVCSCOM) Administrator security group name (e.g., HVC-OM-Admins) Management Group (e.g., HVC) SQL DATA directory (e.g., F:\MSSQL\Data) SQL Log directory (e.g., E:\MSSQL\Data) OpsMgr Action service account name and password (e.g., HVC-OM-Action) OpsMgr SDK service account name and password (e.g., HVC-OM-SDK-SVC) OpsMgr DB Write Action service account name and password (e.g., HVC-OM-DWRT-SVC) OpsMgr Data Warehouse read service account name and password (e.g., HVC-OM-DWRD-SVC) Click Next.
Review the settings specified in the wizard and click Begin.
When prompted, click Yes to begin the installation.
The installation will continue silently until the OpsMgr roles are installed on the OpsMgr Server.
Create Service Principle Names for OpsMgr. Open an elevated Command Prompt and type : *setspn –A MSOMSdkSvc/<OpsMgrServerName.domainname> <DOMAIN>\<OpsMgrSDKServiceAccount>* (e.g., setspn -A MSOMSdkSvc/OpsMgr01.contoso.com Contoso\HVC-OM-SDK-SVC) And *setspn -A MSOMSdkSvc/<OpsMgrServerName> <DOMAIN>\<OpsMgrSDKServiceAccount>* (e.g., setspn -A MSOMSdkSvc/OpsMgr01 Contoso\HVC-OM-SDK-SVC)

Installation – Configure Operations Manager VMM Integration

The following steps must be completed in order to configure Operations Manager 2007 integration with SCVMM.

From an elevated Command Prompt, run the following command: "\\hvc-hydrate\hvchydration$\Applications\ INSTALL - VMM 2008 R2\Source\Setup.exe"
Click Configure Operations Manager.
Select I accept the terms of this agreement, and click Next.
Select I don't want to use Microsoft Update and click Next.
At the Customer Experience Improvement Program, click Next.
After the prerequisites have been checked and passed, click Next.
Select the default file location, and click Next.
Type in the VMM server name (e.g., Contoso\VMMGR01), and click Next.
Review the installation settings and click Install.
When the installation is complete, clear the checkbox in Check for the latest Virtual Machine Manager Updates. Select the checkbox Open the VMM Administrator Console when the wizard closes. Click Close.
Type in the VMM server name, and click Connect.
Select Administration. Choose System Center. Right-click on Operations Manager Server, and select Modify.
Type in the OpsMgr server name, and click OK.
When complete, close the VMM Administration console.

The OpsMgr installation, and the integration with VMM, is now complete. However, it is imperative for the delivery consultant(s) working with the customer to configure and tune the management packs in OpsMgr once the HVC management environment has been fully implemented. While the MPs that accompany the HVC solution have already been tuned, more configurations and tuning will need to be accomplished in the customer environment.

The OpsMgr 2007 R2 MP guide is especially important and its guidance should be implemented as soon as possible upon initial deployment. A typical example of an important configuration task would be configuring Run As accounts with privileged accounts that are unique to the customer's domain environment.

It is highly recommended that the delivery consultant first review the MP guides that are located in the same directory as its corresponding MP: <MDTDeploymentShare>\Applications\INSTALL - OpsMgr 2007 R2\MPs\. Custom MPs for overrides have also been imported and associated with each sealed or custom MP in a 1:1 manner and are annotated with a "- CUSTOM" suffix in the Operations Console.

System Center Virtual Machine Manager Self-Service Portal 2.0 (SSP v2)
1. Overview

This section provides high-level walkthrough on how to deploy SSP v2.

Pre-requisites

The following environment prerequisites must be met before proceeding:

Accounts

Verify that the following security groups have been created by the HVC Active Directory Object creation script as outlined in the section above:

User Name	Purpose
<DOMAIN>\ HVC-SSP-SVC	SSP v2 Account

Hydration Wizard Variables

The SSP Server hydration wizard will prompt you for the following values:

SSP Administrators Group name

Installation – SSP v2 Server and Portal

SSP provides user/tenant self-service functionality. The following steps need to be completed in order to install the SSP Server and Portal components.

The SSP Portal and Server Hydration process will perform the following: Install Web Server Role Install Message Queuing Feature Configure IIS Update Builtin\Administrators membership Install VMM Client Refer to the Troubleshooting Appendix for complete details.
Logon to the SSP server as HVC-INSTALL-SVC. From an elevated Command Prompt, implement the hydration from the HVC Mobile Hydration Toolkit server HVC-HYDRATE by running the following command: cscript.exe \\HVC-HYDRATE\HVCHydration$\Scripts\Hydration.vbs
The Hydration Wizard will appear. Click Next.
Select the HVC Hydration task, and click Next.
From the available choices, select INSTALL-VMM SSP v2, and click Next.
Provide the VMM SSP Administrators Group name (e.g., HVC-SSP-Admins). Click Next.
Review the details and click Begin.
Click Yes.
Click Finish.

From an elevated Command Prompt, implement SSP Setup from the HVC Mobile Hydration Toolkit server HVC-HYDRATE by running the following command: "\\hvc-hydrate\hvchydration$\Applications\INSTALL - VMM SSP v2\Source\SetupVMMSSP.exe"
Click Run on the Security Warning.
Click Install.
Accept the license and click Next.
Select VMMSSP server component and VMMSSP website component, and click Next.
Click Next.
Click Next.
Input the SQL Server name (e.g., SQL01). Click Get Instances…. Select HVCSSP from the SQL Server instance drop-down list, clear the SQL port (1433), and click Next.
Input the SSP service account name and password values (e.g., HVC-SSP-SVC). Click Test account. Verify the accounts tests with a green check mark Click Next.
Click Next.
Add the SSP Admins security group (e.g., CONTOSO\HVC-SSP-Admins) and click Next.
Use the SSP service account for the application pool's identity, and click Next.
Review the installation settings, and click Install.
Click Yes.
The installation finishes. Click Close.
Open IE and go to http://localhost. Verify the default SSP start page loads without error. Close IE.

Installation – SSP Dashboard

The SSP DashBoard extends the functionality of SSP by providing advanced dashboarding capabilities in conjunction with Windows SharePoint Services 3.0 SP2. The following steps need to be completed in order to install the SSP Dashboard component:

The SSP Dashboard Hydration process will perform the following: Install WSPS 3.0 SP2 Refer to the Troubleshooting Appendix for complete details.
From an elevated Command Prompt, implement the hydration from the HVC Mobile Hydration Toolkit server HVC-HYDRATE by running the following command: cscript.exe \\HVC-HYDRATE\HVCHydration$\Scripts\Hydration.vbs
The Hydration Wizard will appear. Click Next.
Select the HVC Hydration task, and click Next.
From the available choices, select INSTALL - WSPS 3.0 SP2.
Click Next.
Review the details, and click Begin.
Click Yes.
Click Finish.
Complete SharePoint Configuration. Click Start-> Administrative Tools-> SharePoint Products and Technologies Configuration Wizard
Click Yes.
Click Next.
Click Yes.
Select No, I want to create a new server farm. Click Next.
Input the SQL Server name and WSPS instance name (e.g., SQL01\HVCWSPS). Input the name and password for the SSP Service account (e.g., CONTOSO\HVC-SSP-SVC). Click Next.
Click Next.
Note the Central Administration URL with port number, and click Next.
SharePoint Configuration will process 9 tasks and then complete.
Click Finish.
Verify that the Central Administration site loads without errors. Close IE.
Log off of the SSP server and then log back on as the SSP service account (e.g., HVC-SSP-SVC).
From an elevated Command Prompt, implement the SSP Dashboard Setup from the HVC Mobile Hydration Toolkit server HVC-HYDRATE by running the following command: *msiexec /i "\\hvc-hydrate\hvchydration$\Applications\INSTALL - VMM SSP v2\Source\SetupVMMSSPDashboard.msi" /LV setup.log**
Click Next.
Accept the license and click Next.
Enter the SSP service account for the application pool identity (e.g., Contoso\HVC-SSP-SVC). Enter the SQL server name and the SSP SQL instance for the server name (e.g., HVCSQL\HVCSSP). Enter DITSC for the database name, and click Next.
Enter the SSP service account for the Site Owner Login (e.g., Contoso\HVC-SSP-SVC). Enter the email address value (e.g., hvc-ssp-svc@contoso.com). Enter the SharePoint database server name\instance name (e.g., HVCSQL\HVCWSPS). Adjust the port number (e.g., 12345 changed to 18888) for the Dashboard URL if needed, and click Next.
Click Install.
Click Finish.
Launch an elevated IE session (run as Administrator) and go to Error! Hyperlink reference not valid. (e.g., http://SSP01:12345) Verify that the Dashboard loads with no errors. Close IE.
SSP v2 and SSP v2 Dashboard Hydration are now complete.

Management Agent Deployment, VMM Pro and VMM Reporting Setup

SCVMM Agents

Once all of the systems required for management of the solution have been deployed, the VMM agent must be deployed to each host system. The following steps show the process of deploying the VMM agent to all hosts.

Logon to the VMM server as HVC-INSTALL-SVC.
Open the SCVMM Admin Console.
Select Add Host from the Actions list. Provide the password for HVC-INSTALL-SVC Click Next.
Input the name of the first host you want to add and click Add. Add any additional host server (i.e., HVCHost2, HVCHost3), and click Next.
Click Yes.
Click Next.
Input any additional locations where you will store virtual machine files (e.g., E:\VirtualMachines), and click Next.
Click Add Hosts.
The Jobs window will open and display the progress of the Add virtual machine host job. When the jobs completes, you can close the window.
You will now see the host listed in the All Hosts view and any virtual machines on the host in the Summary tab.
Continue on to configure Pro Tips and Enable VMM Reporting.

Pro Tips and VMM Reporting

With OpsMgr integration complete, Pro Tips and VMM reporting can be enabled and configured. The following steps show the process of completing these tasks.

In the SCVMM Admin Console, select Administration and then System Center.
Right-click Operations Manager Reporting URL, and select Modify.
Select the box Enable reporting and input the Reporting server URL (e.g., http://OPSMGR01/ReportServer) Click OK.
Once reporting is enabled successfully, the SCVMM Admin Console will have a section entitled Reporting just below Administration.
Select Administration and then General.
Right-click on PRO Settings, and click Modify.
Select Enable PRO tips. Click OK. This enables PRO tips at the "global" level. PRO tips still needs to be enabled and configured on a Host Group and possible Host and Guest level. This process is out of scope for this document but more information can be found in the Operations Guide and on TechNet at: http://technet.microsoft.com/en-us/library/cc764283.aspx

OpsMgr Agents

Once all of the systems required for management of the solution have been deployed, the OpsMgr agent must be deployed to each system. The following steps show the process of deploying the OpsMgr agent to all HVC hosts and guests.

Add the OpsMgr action account to the local admin group of all HVC hosts and virtual machines. This can be accomplished by adding the account to the HVC Administrators group in AD (i.e. HVC-Admins).
Logon to the OpsMgr server as HVC-INSTALL-SVC.
Open the OpsMgr Operations Console. Select the Action Configure Computers and Devices to Manage.
Select Windows Computers, and click Next.
Leave Advanced discovery selected, and click Next.
Select Browse for, or type-in computer names and click Browse. Select all HVC hosts and virtual machines. Click Next.
Click Discover.
Click Select All, and then click Next.
Click Finish.
When the tasks complete, click Close. Close the Operations Console.
Congratulations! Your deployment is complete. Please refer to the Operations Guide for details on using the Hyper-V Enabled Private Cloud solution.

Appendix A: Active Directory Worksheet

Component	Value
Active Directory FQDN
Active Directory NetBIoperating system Name
Domain Admin Account Name for Setup

Appendix B: Network Services Worksheets

Component	Value
Network (e.g., 192.168.1.0/24)
DHCP Server IP Address
DHCP Scope

Appendix C: User Account Worksheet

Component	Default Value	Selected Value
Install Account (cannot be changed)	HVC-INSTALL-SVC	HVC-INSTALL-SVC
MDT Service Account	HVC-MDT-SVC
SQL Service Account	HVC-SQL-SVC
SCVMM Service Account	HVC-VMM-SVC
OpsMgr Service (SDK) Account	HVC-OM-SDK-SVC
OpsMgr Action Account	HVC-OM-Action
OpsMgr Data Warehouse Reader	HVC-OM-DWRD-SVC
OpsMgr Data Warehouse Writer	HVC-OM-DWRT-SVC
SSP v2 Service Account	HVC-SSP-SVC

Appendix D: Groups Worksheet

Component	Default Value	Selected Value	Group Scope
SSP v2 Admins	HVC-SSP-Admins		Domain Local
OpsMgr Admins	HVC-OM-Admins		Domain Local
OpsMgr Operators	HVC-OM-Ops		Global
SQL Admins	HVC-SQL-Admins		Universal
SCVMM Admins	HVC-VMM-Admins		Global
HVC Admin	HVC-Admins		Universal

Appendix E: Computer Account Worksheet

Component	Default Value	Selected Value
Hyper-V Host 1	HVCHost1
Hyper-V Host 2	HVCHost2
Hyper-V Host 3	HVCHost3
Hyper-V Host 4	HVCHost4
Hyper-V Host 5	HVCHost5
Hyper-V Host 6	HVCHost6
Hyper-V Host 7	HVCHost7
Hyper-V Host 8	HVCHost8
SQL Virtual Machine	HVCSQL
SCVMM Virtual Machine	HVCVMM
OpsMgr Virtual Machine	HVCOPSMGR
SSP v2 Virtual Machine	HVCSSP

Appendix F: SQL Instance Worksheet

Fill out the following table prior to deploying the solution and reference these values when reqiured.

Component	SCVMM	OpsMgr	SSP v2	WSPS
SQL Instance Name
SQL Instance DATA Directory
SQL Instance LOG Directory

Appendix G: HVC Hydration Troubleshooting

Hydration is a Microsoft Consulting Services automation solution built upon the Microsoft Deployment Toolkit (MDT) 2010 Update 1 framework. It allows variables to be specified by the user before implementing an MDT task sequence to automate a product installation. The task sequence references WSF scripts that utilize the MDT ZTIUtility.vbs scripting library. Advanced knowledge of and experience with MDT and VBScript scripting will enhance the understanding of hydration and the ability to troubleshoot problems if they occur.

Hydration Execution
1. Logon to the target server as a user with administrative rights.
2. Elevate a Command Prompt.
3. Run the following command to start the Hydration Wizard
  cscript \\HVC-HYDRATE\HVCHydration$\Scripts\Hydration.vbs.
  1. On the Welcome screen, click Next.
  2. The single Hydration task sequence should be automatically selected; click Next.
  3. Select the component to install, and enter the values as necessary; click Next.
  4. Click Details to see the variables specified; click Begin to continue.
    1. Optionally, specify a custom configuration file name and click Export Configuration to write the values to the specified file for future use.
4. The task sequence should implement running the tasks for the selected component.
5. There's a known 60-second delay at the end of the process before the final summary window is displayed (the task sequence engine is attempting to cleanup runtime files). The process is complete when you see the final summary window.
6. The final summary window will change color depending upon the overall outcome:
  1. White: success
  2. Yellow: warning(s) during execution
  3. Red: errors during execution
Debugging Parameters

Append /debug:true to the command line to enable script debugging, which will write more verbose information into the hydration log files.

cscript \\HVC-HYDRATE\HVCHydration$\Scripts\Hydration.vbs /debug:true

The parameter /whatif:0 can also be appended to the command line not to implement anything but instead to run the process and dump logs with details of what it would have done. The zero parameter is used as the return code for anything it doesn't implement, so this will test everything working. Any integer (1, -1, 3010, etc.) can be used instead to test different return codes.

cscript \\HVC-HYDRATE\HVCHydration$\Scripts\Hydration.vbs /debug:true /whatif:0

Hydration Logs

C:\MININT\SMSOSD\OSDLOGS – runtime MDT log location, only there during hydration script execution
C:\Windows\Temp\DeploymentLogs – MDT copies from above after successful operation
%TEMP%\smsts.log – the task sequence engine log

Included with the solution is a simple PowerShell script (C:\HVCHydration\Scripts\Destroy-MDTLogs.ps1) that will delete all files in the above directories. MDT will append log files if they exist but it is best to start from scratch when retesting/rerunning the process. It also caches variables in the OSDLOGS directory (variables.dat) so it is best to clear those out so no remnants exist between runs. Some of the scripts will write unattended answer files to the OSDLOGS directory, so be careful about cleaning things up too soon when testing.

Application and Event Logs

Each application will log its installation process separate from the hydration logs.

SQL Server 2008

C:\Program Files\Microsoft SQL Server\100\Setup Bootstrap\Log\YYYYMMDD_hhmmss
- Detail.txt
- Summary_<ComputerName>_YYYYMMDD_hhmmss.txt
- Etc.
C:\MININT\SMSOSD\OSDLOGS\SQLSUPP.TXT (SQL Support Tools)
Event Viewer, Windows Logs: Application, e.g.,

Log Name: Application

Source: MsiInstaller

Date: 1/15/2011 4:08:14 PM

Event ID: 11707

Task Category: None

Level: Information

Keywords: Classic

User: HVC-Install-SVC

Computer: hvcsql.contoso.com

Description:

Product: Microsoft SQL Server 2008 Database Engine Services -- Installation completed successfully.

System Center Virtual Machine Manager 2008 R2

C:\ProgramData\VMMLogs\ServerSetup.log
C:\ProgramData\VMMLogs\ClientSetup.log
Event Viewer, Windows Logs: Application, e.g.,

Log Name: Application

Source: MsiInstaller

Date: 1/21/2011 9:14:57 AM

Event ID: 11707

Task Category: None

Level: Information

Keywords: Classic

User: HVC-Install-SVC

Computer: hvcvmm.contoso.com

Description:

Product: System Center Virtual Machine Manager Agent (x64) -- Installation operation completed successfully.

System Center Operations Manager 2007 R2

C:\MININT\SMSOSD\OSDLOGS
- INSTALL-AJAX Extensions-App.log
- INSTALL-OpsMgr2007-UI-MSI.log
- INSTALL-OpsMgr2007-DB-MSI.log
- INSTALL-OpsMgr2007-DW-MSI.log
- INSTALL-OpsMgr2007-RPT-MSI.log
- INSTALL-OpsMgr2007-SVR-MSI.log
%Temp%\KB979257-x64.log (CU2)
Event Viewer, Windows Logs: Application, e.g.,

Log Name: Application

Source: MsiInstaller

Date: 2/1/2011 1:42:17 PM

Event ID: 11707

Task Category: None

Level: Information

Keywords: Classic

User: HVC-Install-SVC

Computer: hvcscom.contoso.com

Description:

Product: System Center Operations Manager 2007 R2 -- Installation operation completed successfully.

Windows SharePoint Services

%Temp%\Microsoft Windows SharePoint Services 3.0 Setup(*).log
Event Viewer, Windows Logs: Application, e.g.,

Log Name: Application

Source: MsiInstaller

Date: 2/3/2011 10:04:11 PM

Event ID: 11707

Task Category: None

Level: Information

Keywords: Classic

User: HVC-Install-SVC

Computer: hvcwsps.contoso.com

Description:

Product: Microsoft Windows SharePoint Services 3.0 -- Installation operation completed successfully.

Windows Installer Verbose Logging

Most products utilize the Windows Installer service which can be configured to enable verbose logging by one of the two following methods:

Enable the Windows Installer Logging policy.
- Run the Local Group Policy Editor console (gpedit.msc)
- Navigate to Local Computer Policy, Computer Configuration, Administrative Templates, Windows Components, Windows Installer.
- Enable the Logging setting and configure the Logging option with the values "voicewarmup" (without the quotation marks).
Reference Microsoft Support Article KB314852 for instructions to directly modify the Windows Registry to enable Windows Installer verbose logging.

Advanced Execution

Individual scripts can be run outside of the Hydration/MDT framework. That works similar to the above, e.g.,

cscript "\\HVC-HYDRATE\HVCHydration$\Applications\INSTALL-SQL2008SP1\INSTALL-SQL2008SP1.wsf"

The same parameters hold true here (debug, whatif) but the catch is that the other environment variables populated by hydration do not exist in this context. However, you can explicitly present them to the script, e.g.,

cscript "\\HVC-HYDRATE\HVCHydration$\Applications\INSTALL-SQL2008SP1\INSTALL-SQL2008SP1.wsf" /debug:true /whatif:0 /SQL_ServiceAccountName:HVC-SQL-SVC /SQL_ServiceAccountPassword:Password1 /SQL_Data_Directory:D:\Data /SQL_Data_Directory:D:\Logs

Note: The required variables can be found primarily in the AppDescriptor.xml file for the application.

This will get complicated for a script with a lot of variables (like Operations Manager or Virtual Machine Manager) but it does allow for very fine-tuned testing of different scenarios without actually implementing the payload of the script with the whatif parameter.

Note: The scripts all check for the necessary source files (e.g., Source\setup.exe) and will fail if not there. They do not validate the size, version, or hash of the file, though, so a 0 KB file of the appropriate name will suffice for testing purposes.

AppDescriptor Variables

The following variables are defined in the AppDescriptor.xml for each of the specified applications:

SQL Server 2008 SP1

Name	Label	Type	Default Value
SQL_ServiceAccountName	SQL Service Account Name	Text	HVC-SQL-SVC
SQL_ServiceAccountPassword	SQL Service Account Password	Text
SQL_Data_Directory	SQL Instance DATA Directory	Text	F:\MSSQL\Data
SQL_Log_Directory	SQL Instance LOG Directory	Text	E:\MSSQL\Data
SQL_Admin_Group	SQL Administrator Group	Text	HVC-SQL-Admins
VMM_Admin_Group	VMM Administrator Group	Text	HVC-VMM-Admins
SCOM_Admin_Group	OpsMgr Administrator Group	Text	HVC-OM-Admins
SSP_Admin_Group	VMM SSP Administrator Group	Text	HVC-SSP-Admins

System Center Virtual Machine Manager 2008 R2

Name	Label	Type	Default Value
VMM_SQLServer	SQL Server Name	Hidden	HVCSQL
VMM_SQLInstance	SQL Instance	Hidden	MICROSOFT$VMM$
SQL_ServiceAccountName	SQL Service Account Name	Hidden	HVC-SQL-SVC
SQL_ServiceAccountPassword	SQL Service Account Password	Hidden
VMM_IndigoPort	VMM Indigo TCP Port	Hidden	8100
VMM_WSManPort	VMM WSMan TCP Port	Hidden	80
VMM_BitsPort	VMM BITS TCP Port	Hidden	443
VMM_InstallDir	Installation Directory	Hidden	C:\Program Files\Microsoft System Center Virtual Machine Manager 2008 R2
VMM_LibraryName	VMM Library Share Name	Hidden	MSSCVMMLibrary
VMM_LibraryPath	VMM Library Share Path	Hidden	C:\Virtual Machine Manager Library Files
VMM_LibraryDesc	VMM Library Share Description	Hidden	Virtual Machine Manager Library Files
VMM_Admin_Group	VMM Administrator Group	Text	HVC-VMM-Admins
SSP_Admin_Group	VMM SSP Administrator Group	Text	HVC-SSP-Admins

Note: The hidden values are for Virtual Machine Manager server installation that is currently not used. This functionality may be added in a future version.

System Center Operations Manager 2007 R2

Name	Label	Type	Default Value
SCOM_DB_SERVER	SQL Server	Text	HVCSQL
SCOM_DB_INSTANCE	SQL Instance	Text	SCOM
SCOM_Admin_Role_Group	Administrators security group	Text	HVC-OM-Admins
SCOM_Management_Group	Management Group	Text	HVC-FM1
SCOM_Phase	Install Prerequisites on OpsMgr server Install OpsMgr Databases on SQL cluster Install and configure roles on OpsMgr server	Radio	1 2 3
SCOM_DATA_DIR	SQL Data Directory	Text	E:\MSSQL\Data
SCOM_LOG_DIR	SQL Log Directory	Text	D:\MSSQL\Data
SCOM_Actions_User	Action Service Account Name	Text	HVC-OM-Action
SCOM_Actions_Password	Action Service Account Password	Text
SCOM_SDK_Account	SDK Service Account Name	Text	HVC-OM-SDK-SVC
SCOM_SDK_Password	SDK Service Account Password	Text
SCOM_DBWriteActions_User	DB Write Actions Service Account Name	Text	HVC-OM-DWRT-SVC
SCOM_DBWriteActions_Password	DB Write Actions Service Account Password	Text
SCOM_DataReader_User	Data Warehouse Read Service Account Name	Text	HVC-OM-DWRD-SVC
SCOM_DataReader_Password	Data Warehouse Read Service Account Password	Text

System Center Virtual Machine Manager Self-Service Portal v2

Name	Label	Type	Default Value
SSP_Admin_Group	VMM SSP Administrator Group	Text	HVC-SSP-Admins

Windows SharePoint Services

Name	Label	Type	Default Value
WSPS_SQLServer	SQL Server Name	Hidden	HVCSQL
WSPS_SQLInstance	SQL Instance	Hidden	HVCWSPS
WSPS_DatabaseName	SQL Database Name	Hidden	WSPS
SQL_ServiceAccountName	SQL Service Account Name	Hidden	HVC-SQL-SVC
SQL_ServiceAccountPassword	SQL Service Account Password	Hidden

Note: The hidden values are required for Windows SharePoint Services configuration that is currently not used. This functionality may be added in a future version.

Hydration Process

Hydration.vbs launches the Hydration Wizard.
Any saved values are loaded from Control\CustomSettings.ini.
When an application is selected it reads from the AppDescriptor.xml in the application source folder and loads any configuration items. If they are set to type Text they are displayed for user input. Configuration items of type Hidden are not displayed for user input but loaded into the environment for access by the task sequence and scripts.
The AppDescriptor.xml Component tag has attributes that are used elsewhere:
- The Name attribute populates the Install<Name> environment variable with value YES that is used as conditional logic in the task sequence and can be utilized in scripts as well, e.g., <Component Name="VMM2008R2" …> translates to the variable InstallVMM2008R2. In the Hyper-V Hydration task sequence the Virtual Machine Manager 2008 R2 group has the following condition on the Options tab: "If all conditions are true: Task sequence variable InstallVMM2008R2 equals YES." Therefore, when VMM is selected in the Hydration wizard only this section of the task sequence is implemented.
- The GUID attribute is set to be the same as the GUID of the associated MDT Application, e.g., <Component Name="VMM2008R2" Label="Virtual Machine Manager 2008 R2" GUID="{66cf661e-2f14-4082-a5d7-5bdafe2aac6b}"> has the same GUID as the "INSTALL – VMM 2008 R2" application in the Hydration Deployment Share of MDT.
At the end of the wizard the variables are written to Control\CustomSettings.ini.
Next the task sequence (defined by Control\HVCHYDRO\ts.xml) runs. See the section below on the specifics of what occurs for each component during the task sequence.
The task sequence engine reads in variables from Control\CustomSettings.ini so that they are available to the common environment.
Each of the task sequence groups associate with an application component in the Hydration wizard and the task sequence only implements the appropriate group by conditional logic based upon the specific environment variable Install<Name>=YES (as described above).
The task sequence includes one of two types of tasks:
- Install Roles and Features: an MDT task to install Windows Server 2008 R2 roles and/or features using the ServerManagerCmd.exe command line.
- Install Application: an MDT task to call a single "application" which in this instance references a WSF script in one of the Application source folders, e.g., command line "cscript INSTALL-SQL2008SP1.wsf" with working directory "Applications\INSTALL-SQL2008SP1."
The WSF scripts perform the bulk of the action including writing to script-specific log files at C:\MININT\SMSOSD\OSDLOGS\<ScriptID>.log. The <ScriptID> is defined in the first line of the script, e.g., <job id="Install-SQL2008"> yields Install-SQL2008.log.
The task sequence engine logs information to %Temp%\smsts.log (user's temporary directory)
After clicking Finish on the final summary window the OSDLOGS are moved to %WinDir%\Temp\DeploymentLogs.

Hydration Task Sequence Details
SQL Server 2008 SP1

Install Prerequisite Roles and Features
- Roles
  - Application Server
    - Web Server (IIS) Support
    - Distributed Transactions
      - Incoming Remote Transactions
      - Outgoing Remote Transactions
  - Web Server (IIS)
    - Web Server
      - Application Development
        ASP.NET
Install SQL 208 SP1 Support Tools (INSTALL-SQL2008SP1SupTools.wsf)
- Install SQL Support Tools (Source\PCU\x64\setup\1033\sqlsupport.msi)
Install SQL Server 2008 SP1 (INSTALL-SQL2008SP1.wsf)
- Add SQL Administrator domain group to local Administrators group
- Disable program compatibility script for SQL 2008
- Disable firewall domain profile
- Install SQL instances (Source\setup.exe…)
  - General settings for all instances
    - SQLSYSADMINACCOUNTS=BUILTIN\Administrators
    - Using service account for SQL & SQL Agent
    - Using custom Data and Log directories
  - Virtual Machine Manager instance
    - Instance name: Microsoft$VMM$
    - Features: SQLEngine, all tools, client connection components, and documentation
    - Sysadmins: VMM Administrators group, VMM SSP Administrators group
  - OpsMgr instance
    - Instance name: HVCSCOM
    - Features: SQLEngine
    - Sysadmins: OpsMgr Administrators group
  - VMM SSP instance
    - Instance name: HVCSSP
    - Features: SQLEngine
    - Sysadmins: VMM SSP Administrators group
  - Windows SharePoint instance
    - Instance name: HVCWSPS
    - Features: SQLEngine
    - Sysadmins: VMM SSP Administrators group
    - SQL Collation: Latin1_General_CI_AS_KS_WS
    - Enable Named Pipes

Virtual Machine Manager 2008 R2

Install SQL 2008 SP1 Tools Only (INSTALL-SQL2008SP1ToolsOnly.wsf)
- Install SQL Tools feature (Source\setup.exe /INSTANCENAME=MSSQLSERVER /FEATURES=Tools)
Install VMM 2008 R2 Client (INSTALL-VMM2008R2Client.wsf)
- Add VMM Administrators and VMM SSP Administrators domain groups to local Administrators group
- Create unattended answer file (OSDLOGS\VMMClient.ini)
- Install VMM client (Source\setup.exe /client…)
- Stop vmmagent service
- Install VMM 2008 R2 Admin Console hotfix rollup package KB982523 (Update\vmmClient64Update.msp)
Install OpsMgr 2007 R2 Operations Console (INSTALL-OpsMgr2007-UI.wsf)
- Install OpsMgr Console (Source\server\AMD64\MOM.msi ADDLOCAL=MOMUI,MOMMonadShell…)
- Install Cumulative Update (CU2\SetupUpdateOM.exe /amd64msp:KB979257-x64.msp…)

Operations Manager 2007 R2
OpsMgr Prerequisites

Install IIS7 and .NET
- Roles
  - Web Server (IIS)
    - Web Server
      - Common HTTP Features
        Static Content
        Default Document
        Directory Browsing
        HTTP Error
        HTTP Redirection
      - Application Development
        ASP.NET
        .NET Extensibility
        ASP
        ISAPI Extensions
        ISAPI Filters
      - Health and Diagnostics
        HTTP Logging
        Request Monitor
      - Security
        Windows Authentication
        Request Filtering
      - Performance
        Static Content Compression
    - Management Tools
      - IIS Management Console
      - IIS 6 Management Compatibility
        IIS 6 Metabase Compatibility
        IIS 6 WMI Compatibility
        IIS 6 Scripting Tools
        IIS 6 Management Console
- Features
  - .NET Framework 3.x Features
    - .NET Framework 3.x
Install AJAX Extension (INSTALL-AJAXExtensions.wsf)
- Install AJAX (Source\ASPAJAXExtSetup.msi)
Install SQL Server Reporting Services (INSTALL-SQL2008-RS.wsf)
- Disable program compatibility script for SQL 2008
- Install SQL Server Reporting Services (Source\setup.exe /configurationfile= ConfigurationFile-SSRS-x64.ini…)

OpsMgr Databases

Install OpsMgr Database (INSTALL-OpsMgr2007-DB.wsf)
- Add OpsMgr Administrators domain group to local Administrators group
- Install OpsMgr database (Source\server\AMD64\MOM.msi ADDLOCAL=MOMDB)
Install OpsMgr Data Warehouse (INSTALL-OpsMgr2007-DW.wsf)
- Install OpsMgr Data Warehouse (Source\Reporting\AMD64\Reporting2007.msi ADDLOCAL=MOMREPORTINGDB MOMREPORTINGDBNAME=OperationsManagerDW…)

OpsMgr Server

Install OpsMgr Server Roles (INSTALL-OpsMgr2007-SVR.wsf)
- Add OpsMgr Administrators domain group to local Administrators group
- Install OpsMgr (Source\server\AMD64\MOM.msi ADDLOCAL=MOMServer,MOMUI,MOMMonadShell,MOMWebConsole…)
- Reset IIS
- Update RSReportServer.Config file rights on SQL 2008 RS
Install OpsMgr Reporting (INSTALL-OpsMgr2007-RPT.wsf)
- Install OpsMgr Reporting (Source\Reporting\AMD64\Reporting2007.msi ADDLOCAL=MOMREPORTING…)
Install OpsMgr Cumulative Update 2 (INSTALL-OpsMgr2007-CU2.wsf)
- Install Cumulative Update (CU2\SetupUpdateOM.exe /amd64msp:KB979257-x64.msp…)
- Apply CU2 on the OpsMgr database (sqlcmd DiscoveryEntitySprocs.sql)
Configure OpsMgr (CONFIG-OpsMgr2007.wsf, CONFIG-OpsMgr2007.ps1), i.e., import OpsMgr management packs
- OpsMgr 2007 R2 + CU2
  - MPs\OpsMgr\Microsoft.SystemCenter.OperationsManager.2007.mp
  - MPs\OpsMgr\Microsoft.SystemCenter.OperationsManager.AM.DR.2007.mp
  - MPs\OpsMgr\Microsoft.SystemCenter.OperationsManager.Reports.2007.mp
  - CU2\ManagementPacks\Microsoft.SystemCenter.DataWarehouse.Report.Library.mp
  - MPs\OpsMgr\ODR.mp
  - MPs\OpsMgr\Operations.Manager.CUSTOM.xml
- Windows Server
  - MPs\WindowsServer\Microsoft.Windows.Server.Library.mp
  - MPs\WindowsServer\Microsoft.Windows.Server.2003.mp
  - MPs\WindowsServer\Microsoft.Windows.Server.2008.Discovery.mp
  - MPs\WindowsServer\Microsoft.Windows.Server.2008.Monitoring.mp
  - MPs\WindowsServer\Microsoft.Windows.Server.CUSTOM.xml
- Hyper-V
  - MPs\Hyper-V\Microsoft.Windows.HyperV.Library.mp
  - MPs\Hyper-V\Microsoft.Windows.HyperV.2008.Discovery.mp
  - MPs\Hyper-V\Microsoft.Windows.HyperV.2008.Monitoring.mp
  - MPs\Hyper-V\Microsoft.Windows.HyperV.CUSTOM.xml
- SQL 2008
  - MPs\SQL\Microsoft.SQLServer.Library.mp
  - MPs\SQL\Microsoft.SQLServer.2008.Discovery.mp
  - MPs\SQL\Microsoft.SQLServer.2008.Monitoring.mp
  - MPs\SQL\Microsoft.SQL.Server.CUSTOM.xml
- IIS 7
  - MPs\IIS\Microsoft.Windows.InternetInformationServices.CommonLibrary.MP
  - MPs\IIS\Microsoft.Windows.InternetInformationServices.2008.MP
  - MPs\IIS\Microsoft.Windows.InternetInformationServices.2003.MP
  - MPs\IIS\Microsoft.Windows.Internet.Information.Services.CUSTOM.xml

Windows SharePoint Services 3.0 SP2

Install WSPS 3.0 SP2 (INSTALL-WSPS3SP2.wsf)
- Install WSPS web front end (Source\setup.exe /config config.xml…)

VMM Self-Service Portal v2

Install Roles and Features
- Roles
  - Web Server (IIS)
    - Web Server
      - Common HTTP Features
        Static Content
        Default Document
      - Application Development
        ASP.NET
        .NET Extensibility
        ISAPI Extensions
        ISAPI Filters
      - Security
        Windows Authentication
        Request Filtering
    - Management Tools
      - IIS 6 Management Compatibility
        IIS 6 Metabase Compatibility
- Features
  - Message Queuing
    - Message Queuing Services
      - Message Queuing Server
      - Directory Service Integration
Install VMM SSP v2 (INSTALL-VMMSSPv2.wsf)
- Configure IIS authentication (appcmd)
  - enable windowsAuthentication
  - disable AnonymousAuthentication
- Add VMM SSP Administrators domain group to local Administrators group
Install VMM 2008 R2 Client (INSTALL-VMM2008R2Client.wsf)
- Create unattended answer file (OSDLOGS\VMMClient.ini)
- Install VMM client (Source\setup.exe /client…)
- Stop vmmagent service
- Install VMM 2008 R2 Admin Console hotfix rollup package KB982523 (Update\vmmClient64Update.msp)

3.3.2 为法规遵循和邮件保留所提供的邮件记录功能 10

Exchange邮件方案建议书

2011-10-08T04:59:00Z

邮件方案建议书

微软（中国）有限公司

2009年12月

目录

第3章邮件系统需求和建议解决方案 6

3.3.3 内置多引擎的反病毒防垃圾系统 10

3.3.4 消息传输和认证的安全性 13

第5章 Exchange 平台优势 18

5.1 技术优势 18

5.1.1 信息传输的安全控制 18

5.1.2 多种访问方式，一致的使用体验 19

系统建设目标
某某集团于2004年12月26日正式在某挂牌成立，由长期分散经营的某地省某地、某地、某地、某地等四大国有重点某某企业联手打造。组建后的某某集团总资产达到130亿元，以股份公司为核心层，存续企业为紧密层，以地方某资源为松散层，某资源总产量有望逐步达到1亿吨，销售收入200亿元，利税20亿元。某某自2004底组建以来，经营形式日益好转，经济效益快速攀升，已成为某地经济增长的最大亮点。
随着信息技术的不断进步和某某集团及其下属各分公司自身业务的不断发展进步，企业消息系统服务作为员工对内和对外交流的一项重要的方式，其稳定性、可靠性、及时性、安全性越来越受到某某集团及其下属各分公司信息管理部门领导的关注。企业消息服务系统的稳定性、可靠性、及时性、安全性将直接关系到公司日常工作的正常开展。另外，随着某某集团及其下属各分公司信息化建设的不断深入，业务系统的数量以及处理能力，处理效率都在不断提高，内部员工对电子化信息的依赖程度越来越高，这就迫切需要一个能够很好地与某某集团及其下属各分公司现有的业务和办公系统集成的企业消息系统，通过实现与内部办公系统以及其他系统的良好整合来方便员工对分布于各种系统中的业务和办公数据的访问，从而及时方便地处理相关工作，提高工作效率。某某集团及其下属各分公司现有的邮件系统提供的简单的邮件收发功能已经不能很好地满足某某集团及其下属各分公司的办公需求，因此迫切需要对现有的系统进行升级改造。
中国某某集团（以下简称某某）邮件平台的建设目标是为企业内部员工建设一个集即时消息、语言集成、音视频会议和文件传输功能在内的即时沟通平台，通过这个平台提供的状态呈现功能实现与企业现有的门户系统以及其他办公应用的集成，为企业员工提供一个安全、方便、可靠、集成、协作的及时的办公通信平台，提高日常办公效率，降低企业办公通信成本。
系统建设原则
1. 协议开放性
为了保证系统的开放性，某某邮件平台必须建立在相关标准协议的基础之上。系统需要提供对如SIP协议、XML, SOAP等工业标准的支持。同时也要制定并遵守必需的应用接口规范以利于各个业务系统与该平台的协作。基于工业标准的系统，反映了未来的发展趋势，同时也使得系统更容易与其他系统相整合。
1. 安全性
某某邮件平台必须使用系统平台的相关安全设置以及应用系统的安全性实现，确保满足整个系统的安全性要求。作为企业员工日常办公所必不可少的沟通和协作工具，实时沟通系统必须要确保不被非授权用户侵入。用户在系统上传递的信息不丢失，传输时数据不会被非法获取、篡改；系统能够确认发送和接收者的身份，信息传输能够被保存以便有需要时对其进行审计等等。
实时沟通平台的使用，不应该对企业IT系统的整体安全性造成负面影响。系统必须提供很好的病毒控制和垃圾信息防范机制。
1. 易用性
系统的操作应尽量简单，对操作提示、错误报告、监控信息反馈等要全面、详细，真正做到易学、易用、易培训，降低系统推广使用的成本。
1. 可用性
在系统结构设计上要充分考虑到系统运行的可用性，系统平台方面要考虑各种系统配置对稳定性的影响、尽量减少单点失败的可能性。平台的配置必须能够支持集群架构。
1. 易管理
某某邮件平台的管理要尽量简单，尽量少地让用户涉及到系统平台的管理工作，必要的管理任务也要提供相应的培训、帮助资料甚至操作引导界面来帮助用户顺利地完成必须管理任务。
为了简化管理和维护工作量，系统应能提供简单易用的管理工具供系统管理员进行维护管理使用。
1. 易维护
系统的结构设计要易于维护，组成系统的功能元素要具有一定的独立性，可以根据用户的需要进行替换而不影响或很少影响其他功能元素，并能够与其他功能元素协作共同完成用户的功能。
1. 易扩展
通信平台无论是在功能上，还是在通信协议规范上都应当易于扩展，以便适应今后各种通信业务的发展。一套好的通讯应用系统，应该不仅局限于内网使用，还应该允许用户从外网安全的使用。同时，它应该是一个可扩展，可开发的平台，能够与其他通讯系统互联。企业能够通过在此平台上开发出更多的应用，来最大化系统的价值。
该平台必须适应企业发展的需要，随着使用人员的增加而能方便地进行系统扩展。适应企业应用的可伸缩性和可扩展性。
邮件系统需求和建议解决方案
根据某某邮件平台的需求，微软公司提供了成熟的产品来支撑，企业级电子邮件 – Exchange Server 2010。
基于Exchange 2010的邮件系统，具有丰富的特性，满足企业的需求。
1. 客户端的体验
  1. 邮件客户端
Exchange 2010支持多种访问方式，一致的使用体验，用户可以通过Outlook客户端、Web浏览器、手机、普通电话来访问和管理自己的邮件、日程安排、任务和联系人。所有这些客户端，无论从用户界面、操作方式还是从提供的功能来看都和Outlook非常接近，这不仅为用户提供了良好的使用体验，同时也减轻了企业的系统维护和管理人员的培训工作量，同时支持POP3或者IMAP4客户端。

Outlook：使用Outlook可以获得最为强大和丰富的功能，包括本地缓存模式、本地的全球地址簿、共享日历、联系人等。无论在线还是脱机都可以正常工作。当用户在外出差时，还可使用Outlook无处不在功能在局域网外安全地连接Exchange服务器。
Web 浏览器（Outlook Web Access）：通过Web浏览器（如IE, FireFox, Safari）就可以直接访问Exchange服务器。Outlook Web Access提供了Outlook客户端的98％的功能，如收件人地址的自动完成功能、日程安排通过鼠标拖拽就可更改日程时间等。
智能掌上设备：无须额外服务器和服务，Exchange Server 2010 默认支持手机（如智能手机、Pocket PC等）实时获取和更新用户邮件、日程安排和联系人的信息。服务器一有新邮件抵达，立刻推送至手机上。多种智能手机如Windows Phone, iPhone, Palm, Nokia, Motorola, Samsung, Sonyericson等可以直接与Exchange邮件，日历，联系人和任务同步或通过Push mail技术推送到智能手机
普通电话：通过Exchange Server 2010新增的强大的统一消息功能，用户既可以在邮箱中接收到自己的语音留言和传真，还可以通过普通电话来访问自己的邮箱，让Exchange Server 2010依据邮件的编码选择合适的语言将邮件内容由文字转换成语音的方式，通过电话读给用户听。
POP3和IMAP4客户端：Exchange Server 2010支持传统的POP3和IMAP4客户端访问方式。

邮件搜索

在Outlook和OWA中，可以快速搜索邮箱的所有邮件，包括简单的关键字搜索和组合条件的搜索，也可以搜索本地个人文件中的邮件，方便使用者对信息的快速查找。

Web方式查看文档

包含在Outlook 2007 /Outlook Web Access 2010中，它能把多种文档格式——包括Microsoft Word，Microsoft Excel，Microsoft PowerPoint以及PDF文件——从它们原来的格式转换为HTML格式，这样即使客户端没有安装创建文档的应用软件，也可以在客户端浏览器中查看它们。这一功能使用户可以在几乎任何一台机器上获得高效的生产力并保证所查看文档的安全性，甚至是在公共计算机上，因为Outlook Web Access会在用户退出或会话超时时删除HTML文档。

日程管理功能

用户可以通过日程管理功能简化并自动化对人员与资源的日程安排。

日程助手：日程助手根据与会人员和资源的日程安排分析他们的忙闲状态，以颜色编码的用户界面显示全自动的为会议发起人建议举行会议的日期和时间。
日历助手运行在Exchange 2010服务器上，不需要任何最终用户的交互，它将收件人日历中的会议请求标记为临时请求，一直到用户提交该请求为止。同时，日历助手会删除同一个会议请求的历史版本，确保了您邮箱中的日历请求是最新版本的。
资源预定助手也运行在Exchange 2010服务器上，不需要任何最终用户的交换，它管理着资源的可用性并允许使用资源策略，如可用的小时数和日程权限。

通讯录管理

Exchange 的通讯录包括企业通讯录和个人通讯录，个人通讯录可以和手机同步并支持联机查找，如果用户不在个人通讯录中时。

邮件服务器
1. 用户管理

Exchange邮件系统通过稳定、开放、易于扩展的活动目录（Active Directory）提供目录服务和邮箱管理及验证。

活动目录可以实现用户管理，提供对用户、应用程序和设备的单一、一致性的管理点；加强终端安全性。并且向用户提供单一的网络资源登录，为管理员提供强大、一致性的工具以使他们能够管理为内部计算机用户、远程拨号用户以及外部客户提供的安全服务。活动域管理是实施服务器管理、终端管理的基础，也可以为企业内部的财务、人事、电子邮件、企业信息门户、办公自动化、防病毒系统等各种应用系统提供支持，是安全体系建设的基础。

Exchange Server 2010邮件系统与活动目录紧密集成，并且依赖活动目录完成其目录操作。活动目录可以为邮件系统提供邮箱信息、地址列表服务以及其他跟收件人相关的信息，同时邮件系统的配置信息也存储在活动目录中。通过活动目录的复制功能，可以将这些收件人相关信息和配置信息复制到各个活动目录域和站点中的域服务器，以供邮件系统就近访问。

可以说活动目录是邮件系统的安全系统，活动目录的安全机制保证了只有认证通过的用户才可以访问邮箱，并且只有认证通过的管理员才能更改邮件系统中他被授权可以更改的配置信息。

邮件系统内置活动目录访问模块，用于和活动目录通讯（LDAP请求）以及缓存活动目录的信息，通过共享访问和缓存机制，可以减少活动目录域控制器以及全局编目服务器的负载。邮件系统可以发现活动目录拓扑，确认域控制器和全局编目服务器，并且维持可用的域服务器列表。

地址簿信息存储在活动目录中，邮件系统也对Outlook客户端地址簿访问提供支持。

在消息传输过程中，邮件系统的SMTP Categorizer（SMTP分捡器）将根据消息头中包含的信息去查询活动目录，并且决定消息路由，即消息如何传递以及消息将被传递到何处。另外SMTP Categorizer通过查询活动目录，解析发件人、收件人，以及邮件组，并且将每个收件人和每个发件人的限制应用于消息。

邮件服务器

Exchange Server提供了一个全面的、可以运行在一台单独服务器上的企业消息系统，也可以安装到多台设备上的灵活的、模块化的系统可以在部署、管理和安全上获得重要的好处。

在Exchange Server 2010中，基于角色的部署功能进行了扩展，企业可以根据自身环境需求将预定义的角色指定给特定的服务器。这些预定义的角色使组织可以控制邮件流程，提高安全性以及在不同的服务器直接分配服务，如下图所示。

图1: Exchange Server 2010服务器角色

在Exchange Server 2010中，角色是预定义的并可以在安装过程中进行选择。安装过程中选择的角色确保了每台服务器上只安装必需的服务和组件。这一方法不仅简化了部署过程，也保证了随着时间的推移可以实现对Exchange的高效的管理和对硬件设备的高效利用。

客户端访问角色. 类似于早先版本的Exchange中的前端服务器，该服务器将Internet客户端的访问转到正确的邮箱服务器。
邮箱角色. 该角色存储着可以被复制和集群化的用户邮箱数据库。
中心传输角色. 该角色提供了对所有信息的内部路由——包括来自边缘服务器的信息，统一消息（UM）服务器的信息或在同一邮箱数据库上的两个用户之间的信息。中心传输角色也是对在组织内外传输的消息实施策略管理的地方。
统一消息角色. 该角色可以与交换机进行集成，以传输语音邮件和传真信息到Exchange邮箱中，并提供到Exchange Server的语音拨入功能。
边缘传输角色. 该服务器在您的内部网络之外，为Exchange提供企业自主管理的邮件安全，防病毒和反垃圾服务。企业外的过滤由Exchange Hosted Filtering提供，此部分内容稍后讨论。

邮件安全
1. 统一的高可用性

提高Exchange邮箱服务器可用性的一个方法（不再是唯一方法了）是使用Exchange群集技术。使用两个或多个节点组成一个Windows群集，由Exchange提供冗余服务器，这样如果一个节点或一个节点上的服务出现故障，其它节点可以进行接管并继续提供Exchange服务。Exchange群集技术中Exchange服务是冗余的，但Exchange邮箱数据库却不是。因此，Exchange群集技术是通过对Exchange服务增加冗余来提高可用性；

建立在之前Exchange 2007连续复制技术的投资之上，针对高可用性和灾难恢复的简化方式结合增强的维护工具，可帮助您实现新一级的可靠性并降低提供业务连续性的复杂程度。Exchange 2010新的高可用性体系结构建立在Exchange Server 2007中推出的本机复制功能之上，为高可用性和灾难恢复提供了简化的统一框架-数据库可用性组，一组邮箱服务器，使用连续复制以提供各种故障（磁盘级、服务器级、数据中心级）的自动恢复能力。因而大大延长了最终用户的正常运行时间，提高了管理员的自由度，并且降低了组织的资产和运行成本。

为法规遵循和邮件保留所提供的邮件记录功能

安全，法规遵循和邮件保留是邮件系统规则管理的核心。邮件记录是法规遵循的一个重要组成部分。某些管理规则需要具备对邮件组用户所收到的邮件进行审计的功能，该功能对于组织的内部策略或审计非常有用。Exchange Server 2010记录的邮件可以保存在Exchange数据库中，SharePoint站点或者可以发送到任何由第三方邮件记录公司使用的外部SMTP地址。在Exchange Server 2010中，可以通过设定记录范围来决定记录哪些邮件。设定的范围可以是单个邮箱、一个邮件分发组，一个数据库或者整个组织。语音邮件信息和未接来电提醒可以排除在记录之外。而且一份邮件记录的详细报告包括了诸如收件栏，发件栏，抄送栏，密送栏的信息和邮件组信息，以及其它元数据。

内置多引擎的反病毒防垃圾系统

对于用户自行管理和维护的病毒防护，反病毒软件提供商和客户可以从Exchange Server 2010提供的新的传输代理API中获益。通过该API，软件提供商可以编写反病毒代理来与Exchange内建的传输代理直接交互。因为信息是通过边缘传输服务器或中心传输服务器进入组织的，传输服务器可以调用反病毒代理来检查信息并过滤那些包含病毒的信息。
Exchange Server 2010还提供了一个全面的反病毒解决方案。Exchange Server的Forefront Security为Exchange边缘传输角色、中心传输角色和邮箱角色提供了全面的病毒保护功能。Exchange Server的Forefront Security使用带有内容过滤功能的多重扫描引擎，提供了层次化的保护来抵御带有病毒的信息。
支持Exchange Server 2010的防病毒厂家
- Symantec
- Trend Micro
- Kasperksy Lab
- GFI Software
- McAfee
Exchange Server 2010的反垃圾邮件功能提供了多层保护措施，以多种不同的方式来阻止垃圾邮件。
- 连接筛选通过在Exchange管理控制台中显示每个元素，改进了IP阻止列表、IP 允许列表、IP阻止列表提供程序和IP允许列表提供程序的配置和管理。
- 内容筛选使用Microsoft SmartScreen机器学习专利技术的Exchange智能邮件筛选器是内容筛选器的基本技术，它可评估入站邮件并确定邮件是否是合法、欺骗或垃圾邮件的可能性。
  除了扫描邮件内容，智能邮件筛选器合并从连接筛选、发件人筛选、收件人筛选、发件人信誉、发件人ID验证和Microsoft Office Outlook 2007电子邮戳验证中收集的数据，以便对给定邮件应用垃圾邮件可信度 (SCL)分级。您可以基于该SCL分级配置对邮件的操作。这些操作包括：
  - 传递到Outlook用户收件箱或垃圾邮件文件夹
  - 传递到垃圾邮件隔离邮箱
  - 拒绝邮件和不传递
  - 接受和删除邮件。服务器接受邮件并将其删除，而不是转发到收件人邮箱。
- Outlook 2007支持Outlook电子邮戳验证，其中涉及预解决计算问题的创建。将 Outlook电子邮戳验证和Exchange 2007/2010内容筛选一起使用时，可以帮助改进对不熟悉的发件人的邮件传递能力。垃圾邮件隔离垃圾邮件隔离为被标识为垃圾邮件的邮件和不应传递到组织内用户邮箱的邮件提供临时存储位置。垃圾邮件隔离功能在内容筛选处理期间是可用的。被标识为垃圾邮件的邮件在未送达报告 (NDR)中反转，并在组织内传递到垃圾邮件隔离邮箱。Exchange管理员可以管理传递到垃圾邮件隔离邮箱的邮件，也可以采取适当的操作，例如，删除邮件，或在反垃圾邮件筛选中允许标记为误判的邮件路由到他们的预期收件人。
  Exchange 2007/2010环境启用两层反垃圾邮件隔离功能。首先，管理员可以访问垃圾邮件隔离邮箱。通过使用Outlook，管理员可以访问垃圾邮件隔离邮箱来搜索邮件、将邮件发送到预期收件人或拒绝并删除邮件。具有管理员定义为边界线的 SCL分级的邮件可以被发送到Outlook中用户的垃圾邮件文件夹。将边界线邮件转换为纯文本以便获得额外保护，然后再将其发送到用户的垃圾邮件文件夹。
- 收件人筛选使用Microsoft Exchange EdgeSync服务，现在可以在边缘传输服务器角色中将收件人数据从企业 Active Directory 复制到 Exchange Active Directory 应用程序模式 (ADAM) 实例。这将为入站邮件启用收件人筛选代理来执行收件人查询，从而可以阻止发送到不存在的用户或仅内部通讯组列表的邮件。另外，在Exchange 2007/2010中，系统管理员可以在每个入站接收连接器上配置Tarpit间隔。
- 发件人 ID 发件人ID通过检查发件人IP地址并将该IP地址与发件人公共域名系统 (DNS) 服务器中的发件人ID记录进行比较，验证是否每个电子邮件都来自邮件声称来自的Internet域。发件人的公共DNS服务器上的发件人ID记录是发送方策略框架 (SPF) 记录。SPF定义IP地址，该IP地址被授权可为SPF记录驻留的域发送邮件。接收系统查询SPF记录并返回"Pass"状态时，接收系统有不会被合法发件人欺骗的更高保证。
  可以指定发件人ID代理如何处理临时错误，例如，执行SPF查询时出现的DNS故障。
- 发件人信誉发件人信誉使用专利Microsoft技术来计算未知发件人的可信度。发件人信誉从简单邮件传输协议(SMTP)会话、邮件内容、发件人ID验证和一般发件人行为收集分析数据，并创建发件人特征的历史记录。发件人信誉使用该知识来确定是否应该将发件人临时添加到阻止发件人列表中。
- IP 信誉服务由Microsoft提供的服务是仅为Exchange 2007（及其更高版本）客户提供的IP阻止列表。除了其他实时阻止列表服务，管理员可以选择实现并使用 IP信誉服务。
- Outlook垃圾邮件筛选器列表聚合该功能通过将Outlook 2003和Outlook 2007垃圾邮件筛选器列表传播到邮箱服务器和边缘传输服务器，可以帮助减少反垃圾邮件筛选的误报。

消息传输和认证的安全性

Exchange Server 2010使用SMTP在组织内部的Exchange服务器之间传输信息。所有在Exchange Server 2010组织内传输的信息缺省就是加密的。服务器与服务器间的传输使用传输层安全协议（TLS），Outlook的连接使用加密的远程过程调用（RPC），客户端访问（Outlook Web Access，微软® Exchange ActiveSync®和Web服务）使用SSL协议。这种方法阻止了欺骗并保护了信息的机密性。
Kerberos认证服务用来进行认证，简化的安全传输层协议用来进行加密。TLS在Exchange Server 2010中进行了简化，因为它使用自身指定的SSL认证。因为每一台Exchange服务器都自动配置了SSL证书，内部的Exchange服务器不仅能用SSL对信息进行加密，而且可以加密发送给外部SMTP服务器的消息进行加密，只要接收邮件的外部SMTP服务器也被配置为可以使用TLS收发信息即可。

邮件系统的管理
Exchange Server 2010的一个主要目标是使Exchange管理员的工作变得更简单和更高效。日复一日的维护，监控和故障排除工作在小型或大型组织中可能会成为一种负担。
1. 管理工具
Exchange Server 2010提供了新的工具和特性，旨在简化Exchange的管理，以满足服务等级协议（Service Level Agreements）的要求，并通过预先维护和监控避免问题的产生。

改进管理方式的工具：Exchange Server 2010引入了一个基于模块服务器角色的架构，以解决企业对于改变信息的需求。同样，Exchange Server 2010包含了一个新的图形化管理工具。Exchange管理控制台是一个基于Microsoft管理控制台(MMC)的工具，它反映了架构的变化，可以对服务器角色进行独立管理，可以实现新的管理模型，而无需管理组或路由组。
强大的脚本工具——Exchange管理外壳程序：Exchange管理控制台使用了一个功能强大的脚本技术，叫作Exchange管理外壳程序。Exchange管理外壳程序基于Windows PowerShellTM技术，它是一个命令行工具，您可以通过它操作功能强大的命令集，这些命令集由动词-名词对组成。通过PowerShell，您可以用最少的代码编写复杂的任务脚本或者在外壳程序提示符下交互式地执行任务。凭借外壳程序，您可以通过执行命令来访问并影响许多不同的资源，包括邮箱数据库，注册表以及Active Directory。
使用自动发现功能简化Outlook的配置：在过去，Outlook的profile设置比较困难，因为大多数用户都不知道用于解析他们profile的Exchange服务器的名字。有了新的自动发现功能，用户只需要记住他们的用户名，密码和电子邮件地址就可以配置Outlook profile。

角色管理

Exchange 2010的管理控制台利用远程PowerShell，管理员能够以受控的方式将任务委派给负责的用户，以满足组织的需求。统一消息经理、服务台人员或Exchange服务器管理员等特殊角色易于创建和管理，大大简化了Exchange的管理。

授予特定角色的人只能执行相应权限的任务，可以有效做到权利分派和控制。

备份功能

Exchange支持下列的数据库备份方法：

卷影复制服务：卷影复制服务可以在分钟级备份和恢复邮件数据。卷影复制服务是通过快照的技术实现快速备份和恢复数据。卷影复制时会建立不同时间点的副本。卷影复制备份操作其实备份的是该时间点的文件簇，因此可以在分钟内即可实现数据备份。邮件系统支持卷影复制备份和恢复。
Exchange支持下列的数据备份类型：
完全备份：完全备份是存档每个所选数据库和所有必需日志文件的完整备份。完成备份后，会删除早于启动备份时检查点的日志文件。
副本备份：副本备份是一种完整备份，且除了在备份完成时不删除日志文件外与完全备份完全相同。如果要在特定时间点保存邮件数据库的副本，则可以执行副本备份。
增量备份：增量备份是一种更改备份，它只存档自上次完全备份或增量备份以来的事务日志文件。完成备份后会删除早于检查点的日志文件。
差异备份：差异备份是一种更改备份，它只存档自上次完全备份或增量备份以来的事务日志文件。不删除事务日志。
Exchange Server备份和恢复的数据内容包括：
程序文件：程序文件包括操作系统和应用程序的程序文件。
系统状态：系统状态包括注册表、启动文件和COM+注册数据库。
目录存储数据：目录存储数据包括所有的组织对象、密码和属性信息。
邮件存储数据：邮件存储数据包括所有的邮件内容、索引、日志等内容。应支持对邮件系统特定数据库备份和恢复。如管理员可以按照时间设定不同的备份任务，如周一备份数据库一，周二备份数据库二等。

数据恢复

操作系统数据恢复：

当操作系统出现故障时，管理员可以从程序文件和系统状态数据最近的一次备份点恢复，将服务器的操作系统和应用程序快速恢复到备份时的状态。
目录服务数据恢复：
当目录服务出现故障时，管理员可以从目录服务数据最近的一次备份点恢复，将目录服务快速恢复到备份时的状态。
邮件数据恢复：
支持已删除项目保留：设置已删除项目的保留时间后，如14天，则在彻底删除邮件项目14天之内，用户可以通过Outlook客户端或者Outlook Web Access操作界面自行恢复已删除项目而无须管理员支持和干预。
支持已删除用户保留：设置已删除用户的保留时间后，如14天，则在彻底删除邮箱用户14天之内，管理员可以恢复该用户所有用户属性和邮箱，无须通过备份来恢复。
支持在多个邮箱数据库中分摊用户：通过将用户分布到更多的邮箱数据库中，可以降低单个数据库丢失产生的影响，并且在需要还原时可以更快地还原。
支持在不影响其他数据库用户的前提下，恢复数据库中单个用户的邮箱：当一个用户需要恢复其邮件时，可以在邮件服务持续提供服务的情况下，为单个用户恢复邮件数据，而不影响其它用户同时使用邮件服务。
支持通过备份数据恢复一个数据库中所有用户的数据。

系统配置建议
基于Exchange 2010构建的系统可以满足某某对邮件的众多要求，切实帮助某某提高员工的工作效率。与此同时，Exchange 2010还提供非常灵活的架构支持，不同企业可以针对自身需求采取不同的配置，包括支持高可用性的架构、支持灵活扩展的架构或者选择简单的架构，以最少的投入来获得最大的回报。
高可用性的配置屏蔽了单点故障，使得当一个服务器节点失效时，另外的可用的节点能够进行服务的接管。可伸缩性的配置可以保证当即时沟通平台的使用用户增加时，该平台应该具有良好的可伸缩性，能非常方便地进行扩展。
Exchange 2010 支持高可用配置，可以做到各个角色的高可用。如邮箱通过DAG群集，其它角色通过NLB 实现多台服务器的负载均衡。
1. 配置架构图
考录到某某用户规模，前期设计架构图如下：

下面对此配置架构进行简单的描述和说明：
1. 目录服务器
部署Windows sever 2008;Exchange 2010的用户帐号信息是存储在活动目录中的，因此部署Exchange 2010首先要部署活动目录服务。
1. 邮箱服务器
部署Exchange 2010 ; 实现邮件，日程安排，联系人管理等功能。
1. 客户端访问服务器
部署Exchange 2010, 实现客户端访问，邮件传输控制功能
1. 邮件边缘服务器
部署Exchange 2010;实现反病毒，防垃圾邮件功能，同时转发内部和外部网络的邮件信息。
1. 反向代理服务器
实现内部网络的发布，如Exchange 的移动访问，部署的服务器是微软的ISA 2006 版本.
Exchange 平台优势
1. 技术优势
  1. 信息传输的安全控制
严格的信息传输的安全控制需要从实时传输控制和事后安全审计两部分实现。实时传输控制要求邮件在传输到用户邮箱之前就能管理控制，使其满足行业或者机构的法规和政策。事后安全审计要求无论用户对其邮箱做了什么操作，其历史来往邮件应该都是可查的，而且必须有良好的方式查询多个用户的来往邮件是否有违反公司安全策略的记录。

Exchange的实时传输控制功能包括邮件传输加密、邮件传输规则控制、邮件关键词过滤、防病毒和反垃圾邮件。
Exchange的事后安全审计功能包括邮件记录留存、邮件记录管理和邮件归档。

邮件传输加密

邮件在机构内部传输过程中都是默认加密传输。无论是客户端到服务器，还是服务器之间的传输，都是通过加密的方式进行传输。管理员无需配置即可实现默认加密传输，邮件在传输过程中无需担心邮件内容被窥探。

Exchange Server 2010使用SMTP协议在组织内部的Exchange服务器之间传输信息。所有在Exchange Server 2010组织内传输的信息缺省就是加密的。服务器与服务器间的传输使用传输层安全协议（TLS），Outlook的连接使用加密的远程过程调用（RPC），客户端访问（Outlook Web Access，微软® Exchange ActiveSync®和Web服务）使用SSL协议。这种方法阻止了欺骗并保护了信息的机密性。
Kerberos认证服务用来进行认证，简化的安全传输层协议用来进行加密。

邮件传输规则控制

很多机构都会有如下的一些邮件传输策略：

防止不适当的内容进入或离开组织
筛选机密组织信息
控制不同部门或者不同用户之间的邮件来往
对特定个人发送或接收的邮件抄送给特定人员审计
在传递之前重定向入站和出站邮件以便进行检查
对通过组织的邮件应用免责声明

Exchange提供了邮件传输规则控制的功能，使得管理员可以设定特定的传输规则，便于在组织内部更好的控制邮件传输安全。

关键词过滤

Forefront Security for Exchange可以很容易地实现对特定关键词的筛选。当包含特定关键词时，执行特定的操作。关键词的过滤范围包括邮件标题、邮件正文和附件标题、附件正文。对于ZIP等文件，可以自动解压查看里面的文件，检查完后自动压缩成新的ZIP文件。

防病毒

建议采用Microsoft Forefront Security做为保护 Exchange 环境的解决方案。

Forefront Security 使用 Exchange VSAPI 与 Exchange 服务器紧密集成，以提供无缝的保护。它支持八个厂家的防病毒引擎在一个整合的环境中工作。通过使用多引擎，在新的病毒爆发时用户可得到多个病毒实验室的支持而不必只依靠一个实验室。Forefront Security支持9个防病毒引擎，可在单个服务器上可同时启用5个防病毒引擎。

反垃圾邮件

Microsoft Exchange Server 2010 默认提供的9个反垃圾邮件筛选器是按以下顺序进行应用：连接筛选，发件人筛选，收件人筛选，发件人 ID，内容筛选，发件人信誉，附件筛选。

邮件记录留存和归档

邮件记录是法规遵循的一个重要组成部分。某些管理规则需要具备对邮件组用户所收到的邮件进行审计的功能，该功能对于组织的内部策略或审计非常有用。丰富的信息展现方式

多种访问方式，一致的使用体验

在Exchange Server 2010强大的移动特性的支持下，用户可以通过Outlook客户端、Web浏览器、手机、普通电话、POP3或者IMAP4客户端来访问和管理自己的邮件、日程安排、任务和联系人。所有这些客户端，无论从用户界面、操作方式还是从提供的功能来看都和Outlook非常接近，这不仅为用户提供了良好的使用体验，同时也减轻了企业的系统维护和管理人员的培训工作量。

保证复杂网络环境下用户的使用体验

优化的握手协议和数据压缩能够减小网络数据流量，给窄带环境下的用户更流畅的使用体验；Outlook的Exchange缓存模式能够自动在离线/在线状态间切换，减少对用户工作的打断；Exchange Server 2010独有的Outlook无处不在功能使得企业不必部署VPN/RAS也能让外网（例如在家或出差）的用户能够使用Outlook安全地连接到位于企业内网的Exchange邮件服务器，而开放的端口仅仅是80/443（HTTP/HTTPS）。

手机直推邮件

无须额外服务器和服务，Exchange Server 2010默认支持手机（如智能手机、Pocket PC等）实时获取和更新用户邮件、日程安排和联系人的信息。服务器一有新邮件抵达，立刻推送至手机上。结合移动办公解决方案，管理人员可以摆脱计算机的束缚，直接在手机上批复公文。

统一消息

Exchange Server 2010不再只是存放邮件、日程信息和联系人，组织的语音留言和传真也都可以被Exchange Server 2010统一管理起来。用户只需要通过访问收件箱，就可以访问到邮件、日程安排、联系人、语音留言和传真。同时，Exchange Server 2010还是一个会听话并且能说话的邮件系统。用户可以通过普通电话来访问邮件系统，并语音控制它读取邮件或者日程安排。Exchange Server 2010会依据邮件的编码选择合适的语言将邮件内容由文字转换成语音的方式，通过电话读给用户听。

开放的集成平台

Exchange是一个开放的集成平台。Exchange可以和微软活动目录服务器无缝集成，直接使用微软活动目录的用户管理和用户验证功能。Exchange可以和SharePoint紧密集成，通过SharePoint的Web Parts功能，可以在SharePoint门户中通过简单的配置来访问邮件列表、日程和联系人等信息。另外，Exchange提供了丰富的Web Services接口，便于其它应用调用Exchange接口发送邮件或者阅读邮件。

与SharePoint门户集成

对于已经部署或者将要部署SharePoint门户的用户，无需开发，使用SharePoint门户自带的Web Parts组件就可以直接在SharePoint门户中内嵌邮件列表、日程和联系人等。Exchange和SharePoint门户实现了单点登录，即登录了SharePoint门户，无需再次输入密码，就可以访问SharePoint门户中内嵌邮件列表、日程和联系人等信息。

丰富的Web Services接口

从Exchange 2007起，Exchange服务器拥有一个新的服务集（也称为 Exchange Web服务），使开发人员能够使用标准HTTP与Exchange邮箱及内容进行交互。通过Exchange Web服务可以访问已通过身份验证用户的邮箱及其邮箱中的项目。

高级的容灾功能

Exchange提供了丰富的容灾功能。包括实时的服务切换和高级的备份恢复功能，尽可能的减少因为硬件故障而无法提供服务所造成的损失。

已彻底删除邮件恢复

Exchange支持已彻底删除项目的保留：设置已删除项目的保留时间后，如14天，则在彻底删除邮件项目14天之内，用户可以通过Outlook客户端自行恢复已删除项目，而无须管理员干预。

管理员可以针对不同级别的用户，设定不同的保留时间。如机构领导，可以设定较长的保留时间，如60天。领导彻底删除的邮件在60天之内，都可以直接通过客户端直接恢复，而无需管理员干预。对普通用户，可以只设定7天或者更短。

高级备份和恢复功能

Exchange支持高级的备份和联机恢复功能。备份方式包括：卷影复制服务：卷影复制服务可以在分钟级备份和恢复邮件数据。卷影复制服务是通过快照的技术实现快速备份和恢复数据。

高性能和可扩展平台
1. 多服务器角色，易于扩展

Exchange使用模块化多服务器角色。各个服务器角色可以合并安装，也可以单独安装。各服务器角色安装后，自动优化配置。同时，使用多服务器角色的部署架构，易于对架构进行扩展。

高性能的64位环境

通过64位环境的高内存，Exchange比32位环境性能提升4倍。

优化的路由算法

通过优化的路由算法，Exchange提高了邮件的传输速度。

易管理性
1. 改进管理方式的工具

Exchange Server 2010引入了一个基于模块服务器角色的架构，以解决企业对于改变信息的需求。同样，Exchange Server 2010包含了一个新的图形化管理工具。Exchange 管理控制台是一个基于Microsoft 管理控制台 (MMC) 的工具，它反映了架构的变化，可以对服务器角色进行独立管理，可以实现新的管理模型，而无需管理组或路由组。

强大的脚本工具——Exchange管理外壳程序

Exchange管理控制台使用了一个功能强大的脚本技术，叫作Exchange 管理外壳程序。Exchange 管理外壳程序基于Windows PowerShellTM技术，它是一个命令行工具，您可以通过它操作功能强大的命令集，这些命令集由动词-名词对组成。通过PowerShell，您可以用最少的代码编写复杂的任务脚本或者在外壳程序提示符下交互式地执行任务。凭借外壳程序，您可以通过执行命令来访问并影响许多不同的资源，包括邮箱数据库，注册表以及Active Directory。

内置多个管理工具

Exchange内置多个管理工具，如性能调优工具、队列查看器、邮件跟踪工具、最佳实践分析工具等，便于管理员管理系统。

客户端自动发现服务器

以往的Outlook客户端配置都需要知道服务器名称，造成管理员花费大量时间帮助用户安装客户端。有了新的自动发现功能，用户只需要记住他们的用户名，密码和电子邮件地址就可以自动配置Outlook。

其它优势

广泛的市场认可

Exchange在全球企业邮件市场中已经占有62％的市场份额（Gartner 2007年评估报告）。Exchange Server 2010于2009年11月份推出，它是被Gartner誉为设定企业邮件市场技术未来的高端产品。

Exchange在全球拥有近2亿的席位。全球财富500强企业中，80％以上的公司采用的是微软的Exchange服务器，如GE，西门子，中石油和中石化等。Korea.com共有300万用户在使用Exchange的邮箱。

清晰的产品路线图

作为微软最重要的的企业应用产品之一，微软对Exchange企业消息系统有着长期的承诺，Exchange产品线有着清晰明确的产品路线图，可以很好地保护用户投资。从96年的Exchange 4.0到今天的Exchange Server 2010，微软在持续不断的对Exchange产品进行改进。

成熟的技术社区

微软拥有大量的专业技术人员和众多的合作伙伴技术专家，可以为Exchange用户提供最为专业和有针对性的技术支持和服务咨询，确保用户无后顾之忧。

完善的客户支持体系

微软已经建立了完善的客户支持体系，从金牌合作伙伴，到微软售前支持部门，从微软咨询服务到全球技术支持中心。微软提供了完善的解决方案帮助客户建立和运维邮件系统。微软在全球众多Exchange用户的成功实施经验，可以更好的帮助客户规划整个邮件系统的建设，并为其良好运营提供中肯的建议。

Lync方案建议书

2011-10-08T04:57:00Z

Lync方案建议书

微软（中国）有限公司

2011年2月

修改记录

日期	版本/修改者	备注
2011/2/20

目录

第3章统一通信系统需求和建议解决方案 5

3.1 企业级即时消息系统 5

3.1.1 即时消息 5

3.1.2 网络会议 10

3.1.3 完整的企业级语音功能集。 18

3.1.4 协同办公与企业应用集成 24

4.1.2 即时消息会议服务器池 29

4.1.3 池数据库集群： 29

4.1.4 归档服务器 29

4.1.5 即时消息会议边缘服务器 29

系统建设目标

沟通是企业获得商业成功的关键因素。成功集成企业环境内的业务处理过程中所涉及的沟通和工具可以达到降低企业沟通和交流成本、提高沟通效率和充分利用企业信息资产的目标。而整合过程即包含对不同沟通方法和系统的集成。现实的情况却是一方面企业投入大量资金建成了各种用于为企业员工提供服务的沟通方式和工具，比如电话、传真、电子邮件（包括其他的相关的个人信息，比如日程安排、联系人信息以及任务安排数据等）、语音邮件、即时消息、音视频会议系统等；另一方面却是所有这些工具遵循着自己各自独立的发展路径，使用各自的通讯协议，彼此之间缺乏有效的集成手段。种类繁多的沟通工具和手段在为员工带来一定的沟通便利的同时也增加了员工使用沟通工具所需要的培训和学习成本，有时甚至会影响员工的沟通效果。

在新的工作环境下，员工希望更为简单方便地利用各种交流形式的需求导致了整合所有的沟通手段，让各种沟通手段"以人为中心"，而不是以一个个冷冰冰的设备为中心的想法越来越得到各级领导和信息主管部门的重视。

另外，对企业来说，即时消息、语音、音视频通信和即时文件传输的效率非常高。企业即时沟通作为当前和将来相当长一段时间的主流办公工具，集成了多种先进的信息沟通方式。它是一种比邮件更快捷、更具亲和力和交互性的沟通方式，相比手机，具有可记录性、费用低、数据形式的多样性等特点。它可以提供对文本、语音、图画、视频的良好支持。特别是它能与电子邮件、手机（电话）以及其他企业应用系统结合，将企业各类沟通手段作为平台提供给各类应用程序，使得企业可以轻松地打造具备方便沟通能力的现代办公的新平台。

杭州中烟统一通信平台的建设目标是为企业内部员工建设一个集即时消息、语言集成、音视频会议和文件传输功能在内的即时沟通平台，通过这个平台提供的状态呈现功能实现与企业现有的门户系统以及其他办公应用的集成，为企业员工提供一个安全、方便、可靠、集成、协作的及时的办公通信平台，提高日常办公效率，降低企业办公通信成本。

系统建设原则
协议开放性

为了保证系统的开放性，统一通信平台必须建立在相关标准协议的基础之上。系统需要提供对如SIP协议、XML, SOAP等工业标准的支持。同时也要制定并遵守必需的应用接口规范以利于各个业务系统与该平台的协作。基于工业标准的系统，反映了未来的发展趋势，同时也使得系统更容易与其他系统相整合。

安全性

统一通信平台必须使用系统平台的相关安全设置以及应用系统的安全性实现，确保满足整个系统的安全性要求。作为企业员工日常办公所必不可少的沟通和协作工具，实时沟通系统必须要确保不被非授权用户侵入。用户在系统上传递的信息不丢失，传输时数据不会被非法获取、篡改；系统能够确认发送和接收者的身份，信息传输能够被保存以便有需要时对其进行审计等等。

实时沟通平台的使用，不应该对企业IT系统的整体安全性造成负面影响。系统必须提供很好的病毒控制和垃圾信息防范机制。

易用性

系统的操作应尽量简单，对操作提示、错误报告、监控信息反馈等要全面、详细，真正做到易学、易用、易培训，降低系统推广使用的成本。

可用性

在系统结构设计上要充分考虑到系统运行的可用性，系统平台方面要考虑各种系统配置对稳定性的影响、尽量减少单点失败的可能性。平台的配置必须能够支持集群架构。

易管理

统一通信平台的管理要尽量简单，尽量少地让用户涉及到系统平台的管理工作，必要的管理任务也要提供相应的培训、帮助资料甚至操作引导界面来帮助用户顺利地完成必须管理任务。

为了简化管理和维护工作量，系统应能提供简单易用的管理工具供系统管理员进行维护管理使用。

易维护

系统的结构设计要易于维护，组成系统的功能元素要具有一定的独立性，可以根据用户的需要进行替换而不影响或很少影响其他功能元素，并能够与其他功能元素协作共同完成用户的功能。

易扩展

通信平台无论是在功能上，还是在通信协议规范上都应当易于扩展，以便适应今后各种通信业务的发展。一套好的通讯应用系统，应该不仅局限于内网使用，还应该允许用户从外网安全的使用。同时，它应该是一个可扩展，可开发的平台，能够与其他通讯系统互联。企业能够通过在此平台上开发出更多的应用，来最大化系统的价值。

该平台必须适应企业发展的需要，随着使用人员的增加而能方便地进行系统扩展。适应企业应用的可伸缩性和可扩展性。

统一通信系统需求和建议解决方案

根据杭州中烟统一通信平台的需求；整个平台包括邮件系统和即时消息系统两大模块，微软公司分别提供了成熟的产品来支撑。企业级电子邮件 – Exchange Server 2010；企业级即时消息 –Lync Server 2010。

企业级即时消息系统
为了最大化作为企业级的即时协作系统的作用，我们建议通过即时协作系统实现以下功能。通过和用户具体的情况的结合，即时沟通平台的各类应用可以采用分布式实施和部署的模式。根据微软公司长期致力于统一沟通系统产品研发和大量大型项目的实施经验，我们建议的即时沟通平台需要能实现如下功能：为办公人员实现即时通信、在线状态感知、与其他办公应用集成、语音集成以及视频/数据会议等功能。
微软公司于2010年推出的Lync Server2010及其客户端组件Lync 2010为用户提供了融即时消息、群组即时消息、状态呈现、多路音视频会议、Web协作会议和联机会议功能在内的即时协作产品，可以帮助企业实现各种沟通方式的整合，从而为员工带来全新的沟通体验，在提高沟通和协作效率的同时降低沟通成本，简化IT运维和管理难度及成本。基于Lync Server 2010，企业实时协作系统可以实现如下的功能：
1. 即时消息

在线状态感知

如果没有准确的用户在线状态信息，用户的很多沟通请求很可能是无效的。例如，在不知道对方状态的情况下，大量电话得到的是忙音或无人接听的状态，这大大降低了企业的整体工作效率,而且也会影响员工利用沟通工具的积极性。通过即时消息系统，用户可以向其他同事显示自己的状态，如离开、空闲、忙碌、请勿打扰等，其他同事由此可知他是否在座位上，是否合适与他进行即时沟通，由此能够避免浪费时间和打扰对方工作。

基于Lync Server2010的即时消息系统，提供了丰富的在线状态信息。如下表格

图标

状态文本

描述

有空

联系人联机，可参与对话

忙碌

接听电话

多方通话

在会议中

联系人联机，但正在从事其他活动。活动包括：

接听电话：联系人正在进行语音或视频对话。
多方通话：联系人正在使用电话、语音、视频和/或应用程序共享进行多方对话。
在会议中：Outlook 日历显示，联系人有预定的会议。

请勿打扰

联系人联机，但不希望被打扰。通过选择选项（从不显示任何通知到允许来自指定工作组的通知），用户可以采用"请勿打扰"模式指定隐私级别。

离开

联系人联机，但由于以下原因之一没空：

联系人的计算机空闲时间超过用户指定的时间段（默认情况下为 15 分钟）。
联系人的 Outlook 日历或外出时的助理程序指示该联系人不在办公室。
联系人临时没空。
联系人已将其状态手动设置为"离开"或"显示为离开"。

下班

联系人已经下班

脱机

联系人没有联机。显示此状态的原因有以下几种：

联系人尚未登录。
联系人已阻止用户查看其状态。

已阻止

用户已阻止相应的联系人。对于被阻止的联系人，用户显示为脱机状态。

状态未知

Lync Server 2010 无法确定联系人的状态。

企业通讯录
微软的Lync 2010能方便与企业的通讯录集成，充分利用企业通讯录中的用户信息。从联系人的查找、加载到实现直接点击的即时通信的呼叫等。
在实现与企业通讯录信息集成时，我们提供的方案能保证与企业通讯录信息的实时的更新，实现了在企业内不同应用之间的统一信息管理的理念。
联系人搜索及管理
Lync2010实现了与企业目录的集成。用户能够通过企业目录来进行人员信息的查找，并且将查找到的联系人加载到自己的联系人列表中。
另外，通过扩展还将能实现按照企业的组织架构来进行联系人的查询和加载。并且对于联系人的信息展现也是区别于公众即时消息应用的。为了方便企业办公的需求，而通过实名方式来展现联系人信息。
在Lync2010中，用户可以自己设定联系的人访问级别。处于不同的访问级别（同事，私人或是团队成员等）可以查看到的联系信息也会不同。例如，被列入公众级别的联系人就无法查阅该用户的移动电话和住宅电话等。

用户可以利用"技能搜索"功能，根据来自 SharePoint 的信息在组织内查找所需的专业知识或仅查找具有相同兴趣的人们。通过"技能搜索"，用户可以使用描述技能集、专业知识、兴趣领域或组从属关系的关键字来搜索专家，并获得满足条件的同事列表。随后，用户可以使用状态信息来选择与合适的同事取得联系的最佳方式。
联系人分组
用户可以采用多种方式对他们的联系人分组，包括用户定义的分组、组织定义的分组、联系人可用性、联系人联机状态或带标记的联系人。联系人可以按显示名称的字母顺序排序，而不按联机状态排序，这样即可使用联系人列表作为地址薄。
联系人卡片
经过直观地重新设计的联系人卡片包含多项新功能，适用于各个联系人、通讯组、个人组和自动程序。相同的卡片可以在所有 Microsoft Office 应用程序中使用。只要任何 Office 应用程序中显示了联机状态，用户就可以查看一个悬停的卡片，其中包含图片、备注和通信选项。这扩展了新联系人卡片，提供关于该联系人的更多相关信息，包括个人备注和位置。悬停的卡片提供了与人们联系的轻松方式，它在所有 Office 应用程序之间的用户界面是一致的，这意味着用户无论使用何种应用程序都具有类似的体验和信息集。
个人通讯录
个人通讯录中可以包括非企业内部用户，实现的功能与企业通讯录相同。在通信录信息管理时，我们的Lync2010能实现与Outlook联系人进行用户信息同步。
发送即时消息
对于紧急事务的处理，通过利用作为异步沟通系统的e-Mail往往效率不高，几个邮件来回往往会花上几个工作日的时间。而通过即时消息系统，员工可以利用它接触线上的同事，迅速讨论与工作有关的事项，不需要打电话和写电子邮件，从而节省了沟通所需要的时间和不必要的通讯费。如果遇到不在联系人列表中的用户，也可以通过即时消息的客户端Lync2010来迅速查找定位到用户，根据对方状态，来决定是否给对方发送即时消息。即时消息的发送，是可以和多人同时进行的。
远程用户连接
对于大规模的企业，可能经常会有大量用户出差到办公室以外的地方，要想充分利用企业建设的即时沟通系统，必须能够让这些用户即使出差在外也能够方便地访问位于企业内部的即时沟通系统。Lync Server2010提供边缘服务器角色，可以让用户即使身在外网环境也可以方便，安全地接入企业内部即时消息系统。在Lync Server 2010 Edge Server的支持下，员工只需要具有互联网连接（不需要使用VPN）就可以和在企业内部一样使用即时通讯系统，与其他同事如常联络，从而打破地域对用户的利用沟通手段的限制。
与外部即时消息连通功能
即时消息服务平台同时还提供与外界即使消息服务连通的功能，企业内部员工可以通过自己的企业即时消息服务与外界的客户、供应商和朋友进行沟通。Lync 2010的用户目前可以实现和MSN、AOL和YAHOO通等基于互联网的即时消息系统的互联互通。
1. 网络会议
会议功能在过去通过工作负荷（语音、应用程序共享、Web 会议和视频会议）来评估和获得。Lync Server 2010 希望移除这些壁垒，使用类似于单一工作负荷解决方案的功能实现高效率和成本节省。
Lync Server 2010 提供了一种统一会议体验，转变了用户合作、协作和通信的方式。新功能、统一的客户端和简化的操作都促进了采用，有助于用户无需大量培训就能提高效率。熟悉的客户端体验与深入集成 Outlook 2010 相结合，简化了会议的计划和加入。使用 Lync Server 2010，所有信息员工可以使用全部会议工具。这些工具不必为特殊活动或场景保留，或者限制于特定的物理空间。Lync Server 2010 的音频和视频功能可以可靠地和从具有网络连接的任何位置运行。此外，通过减少差旅支出以及依靠第三方会议解决方案，统一会议可以帮助企业实现显著的成本节省。
使用 Lync Server 2010 统一会议，用户可以实时协作、共享信息和协调他们的工作。音频、视频以及文档、桌面和应用程序的共享都整合到了易于使用的 Lync 2010 客户端中，可以按需或在典型的工作流上下文中访问。例如，无需切换应用程序，用户可以使用音频以及甚至视频将简单的 IM 讨论升级为多方应用程序共享会议。所有参与方都可以看到和编辑演示文稿、文档和其他内容，无需交换电子邮件。
计划、管理和参加会议
集成到 Outlook 2010 中的联机会议工具使组织者能够计划一场会议或通过一次单击启动一次临时会议，使参与者能够轻松参加会议。参与者可以放在一个"会议厅"中，有助于会议组织者控制访问。会议名单清楚地显示了参与者的职位和姓名。Web 客户端扩展将丰富的会议功能扩展到没有桌面 Lync 2010 客户端的与会者。
与 Outlook 的集成支持单击计划。预定义的会议属性无需任何修改即可满足大部分用户需求；对于特殊需求，会议类型和准入策略可由组织者设置。简化的会议 URL 更容易记住，方便通信。所有会议加入链接都以http://开始，这使它们更加简短且更不容易被电子邮件客户端截断，还使这些链接在需要时可以启动 Web 客户端。简单 URL 的第一部分是您的外部完全限定域名，它的后面可以是易记的单词，比如"meet"。
从 Outlook 会议提醒中单击加入会议，这是另一个简单的省时途径。Lync 2010 Phone Edition 用户也可以通过单击加入会议。
在要求身份验证时，未通过验证的用户不再需要断开并重试。他们被转移到大厅，在这里等待领导的接受或拒绝，或者超时并断开连接。未验证的 PSTN 拨入用户会被提示记住他们的名称。记录的名称表示会议中未验证的用户。
与会者可以从主要的 Web 浏览器加入，以获得会议呼叫、来宾用户支持、PSTN 拨出音频以及Microsoft Windows®、Mac 和 Linux 上的桌面共享等功能。Web 客户端体验还支持高保真度显示、文件上传和下载、演示文稿查看、白板、大厅和演示者访问控制。
一旦被允许参加会议，拨入用户即可使用按键式电话键盘选择命令。拨入会议领导可以全部静音、锁定或解锁会议，以及打开或关闭进入和退出公告。所有拨入会议参与者都可以通过按键式命令来收听帮助、设置私人名单或将自己静音。
音频会议
音频会议是许多企业的一种基本需求，在内部部署之后能提供巨大的成本节省机会。Lync Server 2010 提供了一种传统音频桥接服务用户很熟悉的用户体验，包括带有按键式呼叫控制命令的 PSTN 拨入服务。与此同时，它还整合了只有集成的统一通信平台上才具备的强大会议计划、加入和管理功能。
一次单击从 Outlook 2010 设置
只需一次单击，用户即可从 Outlook 计划一次电话会议（参见 <图片编号>）。会议时间、位置和与会者等详细信息采用熟悉的 Outlook 模板。此外，电话会议的具体信息，比如拨入号码、会议 ID和个人标识号 (PIN) 提醒，会自动填充。

多级身份验证实现了更安全的会议
为了帮助确保仅授权人员参与电话会议，Lync Server 2010 提供了多个呼叫设置选项：

开放式验证：仅通过 Active Directory 验证的参与者可以加入电话会议。
封闭式验证：仅通过 Active Directory 验证且包含在电话会议参与者列表上的参与者可以加入电话会议。
匿名：具有正确会议 ID 和参与者密码的任何人都可以加入电话会议。

Active Directory 集成

通过 Lync 2010 和 Lync 2010 Phone Edition 加入会议的用户已通过了 Active Directory 的验证。无需输入 PIN 或密码。对于通过 Lync 2010 加入会议的用户，也无需输入会议 ID。用户真正体验到了一种更加简单的"单击加入会议"体验。

更好地控制音频会议

Lync Server 2010 改善了用户体验，提供 Lync 2010 界面来进行呼叫管理，而不是要求用户记住双音多频(Dual Tone Multi Frequency, DTMF) 编码来实现电话静音等功能。

当电话会议有很多参与者时，识别音频会议的当前发言人或找到噪音来源尤其困难。Lync Server 2010 使用了一种爆星来确定谁在会议中发言。

这个指示符使识别发言人或供会议领导对在自己电话上制造通信噪音的参与者进行静音变得

非 PC 用户的拨入号码、领导和参与者密码

非 PC 用户可以采用多种方法加入基于 Lync Server 2010 的电话会议：

通过访问号码拨入：要加入电话会议，用户拨入一个访问号码，访问会议桥，然后输入会议 ID 和一个可选的密码；对于更加安全的会议，用户还可以输入 PIN 来供 Active Directory 验证。如果他们拨入电话会议，会议领导也将需要他们的 PIN。
使用 Lync 2010 Phone Edition 设备：要加入会议，用户拨入会议访问号码，访问会议桥，并输入一个会议 ID；因为 Lync 2010 Phone Edition 设备已经通过 Active Directory 验证，所以无需输入 PIN。

会议助理支持多种语言

每个访问号码支持多种语言。当拨入会议时，访问号码中提供了关于默认语言的提示。但是，如果没有响应，服务器会提供其他语言作为选择。然后所有与服务器的交互会使用选定的语言进行。

英语-美国
英语-英国
英语-澳大利亚
简体中文
繁体中文
葡萄牙语-巴西
韩语-韩国
西班牙语-墨西哥
西班牙语-西班牙
法语-加拿大
法语-法国
德语-德国
意大利语-意大利
日语-日本

视频会议
随着组织越来越分散和移动化，视频会议正变得越来越重要，因为它提供了支持有效建立团队的更加个性化的体验。复杂的接口、高成本和有限的功能阻碍了许多员工对视频会议的采用。Lync Server 2010 简化了用户体验，将视频整合到统一客户端中，这样，可以无缝和轻松地计划视频会议或自然地升级到视频会议。为了提供最逼真的通信体验，Lync Server 2010 支持各种视频会议选项。
无缝过渡到视频
Lync 2010 使得只需一次单击即可将视频添加到标准的电话呼叫中。借助对音频和视频设备的增强支持，用户可以在数分钟内设置一次视频呼叫（参见 <图片编号>）。这是改进同事和客户间协作的一种简单方式。

全景视图和活动发言人检测
Lync 2010 可以显示会议室或其他地方的全方位的视频场景（参见 <图片编号>）。当视频或 Web 会议有多个参与者时，活动发言人将显示在视频窗口中（参见 <图片编号>）。Lync Server 2010 检测谁在发言，然后向所有参与者发送合适的视频流。
<图片编号>

支持高清晰度视频
在高端计算机上运行 Lync 2010 的用户之间的对等呼叫中，支持高清晰度视频（分辨率为 1270 x 720，长宽比为 16:9）和 VGA 视频（分辨率为 640 x 480；长宽比为 4:3）。一次对话中每个参与者看到的清晰度可能不同，具体取决于每个用户各自的硬件的视频功能。会议中不支持高清晰度和 VGA 视频。
IT 管理员可以设置策略来在客户端上限制或禁用高清晰度或 VGA 视频，具体取决于计算机性能、网络带宽和摄像机能否提供需要的分辨率。这些策略通过带内配置来实施。
与重要视频会议合作伙伴的互操作性
Lync Server 2010 不仅支持 Lync 2010 端点之间的实时视频会议，还支持 Lync 2010 端点与来自第三方硬件供应商（比如 TANDBERG 和 Polycom）的端点之间的视频会议。这种互操作性使用户能够利用他们现有的视频会议硬件投资，同时通过极少的增量投资和用户培训将视频会议功能扩展到其他用户。在使用熟悉的工具（比如 Outlook 或 Lync 2010）计划会议和确定参与者可用性时，用户可以使用 Polycom 和 TANDBERG 视频会议硬件。
应用程序共享和 Web 会议
通过将 Web 会议和应用程序共享集成到简化的 Lync 2010 客户端，Lync Server 2010 提供了每个人都可使用的高度可访问和可靠的工具。与音频和视频会议相结合，得到的是一场易于主持的高度逼真且能提供充分信息的会议。
白板
白板是一个空白页面，允许演示者使用注释工具绘图、添加文本和突出显示信息。例如，组织者可以迅速创建一个流程图来演示一个点、插入一个白板，然后使用注释工具绘制矩形、线条和其他图形。幻灯片可以保存供未来的会议使用。此外，新的增强增加了剪切和粘贴、使用右键单击菜单、线属性（粗细、端点等）、对象属性（颜色、填充、大小等）、改进的文本工具以及流程图工具。用户可以直接在 Lync 2010 中开始一场白板会议，以共享创意或图表。对白板的更改和更改者的身份会自动显示。
Web 幻灯片
网站的 URL 可以与会议参与者共享，然后他们可以通过嵌入在控制台中的浏览器查看该网站。Web 幻灯片使演示者可以将他们的观众带到 Internet 上任何活动的网站，以浏览和查看联机信息。每个参与者都可以独立地单击链接、填写表格或使用交互式媒体。通过输入网站的地址 (URL)，比如 http://www.microsoft.com/，组织者可以迅速轻松地将 Web 幻灯片添加到演示文稿中。预览功能使演示者可以在向观众展示之前看到页面。
桌面和应用程序共享
此功能允许演示者从 Lync 2010 向远程参与者实时广播任何视觉元素、应用程序、网页、文档、软件或他们桌面的部分。应用程序共享允许与会者关注鼠标移动和键盘输入。演示者可以选择共享整个屏幕，或者仅共享一部分以使观众将注意力集中在关键信息上。通过共享他们的桌面，演示者能够在来自任何位置的交互式产品或软件演示中与他们的观众互动。
应用程序共享允许演示者共享对他们桌面上的软件的控制，而不会错过参与者的反馈或文本问题。会议参与者可以请求控制，演示者可以迅速将控制权授予任何参与者。演示者可以自定义颜色深度和屏幕分辨率，以更好地配合具有不同桌面性能的参与者。
记录会议
使用 Lync 2010 统一客户端，用户可以在会议进行时实时创建会议记录，包括演示的内容、音频和视频。
会议可靠性和性能改进
会议功能可以从前端服务器角色分离到一个新的服务器角色"音频/视频 (A/V) 会议服务器"中，以实现更好的可伸缩性和性能。您可以选择是合并 A/V 会议和前端服务器池还是保持分离。此外，改进的数据会议服务器（作为前端服务器的一部分运行）设计提供了更出色的会议和协作体验。
1. 完整的企业级语音功能集
Lync Server 2010 提供独立的语音产品来增强或代替传统的 PBX 系统，并且无需 VPN 连接就能通过 Internet 接入，进而将上述功能扩展到办公室之外。这包括常见的呼叫功能，例如

呼叫应答、呼叫前转、呼叫转接、呼叫保留、呼叫转移、呼叫释放和呼叫预占，以及适用于北美地区的增强的 9-1-1 呼叫功能*，而且支持现有设备和合作伙伴提供的更广泛的 IP 或
USB 用户使用设备范围。该解决方案设计通过呼叫准入控制、分支机构*和数据还原的可扩展选项来支持更高的可用性。
拨出呼叫
使用 Microsoft Lync 2010 作为他们的桌面客户端的用户，可以从许多不同位置使用他们的企业电话号码拨出和接听呼叫。用户可以在企业 VoIP 网络或 PBX 上呼叫同事，并在企业外部网络上使用传统电话号码呼叫联系人。
单击从 PC 呼叫
呼叫可以从 Lync 2010 中的联系人名单或在显示了状态信息的其他应用程序中发起。
同时振铃
一个传入呼叫将同时为用户所有的活动 Lync Server 2010 端点振铃。用户也可以指定一个额外的 PSTN 号码同时振铃。这使用户能够随时在最方便的设备上应答呼叫，包括在他们家里和使用手机。
传入呼叫
用户会同时在所有活动的 Lync Server 2010 端点上收到传入呼叫提醒，在 IP 电话上通过可自定义的铃声提醒，在 PC 上通过类似于即时消息的通知提醒。通知包括呼叫方的名称（当呼叫方名称包含在企业目录或用户的联系人名单中时），允许用户应答呼叫或动态地将它重定向到语音邮件或另一个号码。用户还可以使用即时消息回复来自其他 Lync Server 2010 用户的呼叫。
同时管理多个呼叫
当正在对话时，用户可以应答其他的传入呼叫或发起传出呼叫，现有的活动呼叫将自动转换为保持状态。每次呼叫都通过一个独立的 Lync 2010 会话窗口处理，使用 Lync 2010 呼叫处理功能单独控制。Lync 2010 的主窗口包括当前会话列表，以方便导航。
将呼叫从工作电话转移到手机或其他人
呼叫可以通过两种方式从一个用户转移到另一个用户。第一个选择只有一步，用户选择要将呼叫转移到的用户，呼叫将直接转移到该用户。第二个选择是协商性的，一位用户首先与他想要转移呼叫的目标用户沟通，然后单击一个按钮完成转移。用户也可以将呼叫转移到他们的设备之一，比如移动电话或家庭电话。例如，这使用户能够在外出时将呼叫从他们的桌面电话转移到移动电话，而无需放弃对话。

与其他 Lync 2010 用户之间更丰富的通信功能

当与另一个 Lync 2010 用户对话时，用户拥有比传统电话呼叫更多的选择。使用 Lync 2010，用户可以向呼叫添加文本、视频或桌面共享。

此外，由于使用了宽带编解码器，Lync 2010 用户之间的音频比人们过去熟悉的来自传统 PSTN、手机和 IT 电话系统的音频更加自然和清晰。这种高质量的音频可以在较低的带宽上使用（大约 28 kb/秒），使其成为了从企业网络内部、在差旅途中或从家庭 PC 呼叫时的理想选择。

更安全的访问
Lync 2010 和其他 Lync Server 2010 端点使用了一种智能化、自适应的媒体堆栈来确保高质量的通信，即时是在类似 Internet 这样的非托管网络上。此外，端点默认会分别使用 TLS 和 SRTP 对信号和媒体加密，消除了对 VPN 连接的需求。这些功能使用户能够在访问 Internet 的任何地点自信且轻松地使用企业语音和其他通信。
灵活的呼叫转移
灵活的呼叫转移选项使用户能够配置众多的呼叫转移选项，支持同时为移动电话和家庭电话振铃，重定向未应答的呼叫等。这是帮助用户在工作时间保持联系的一种便捷方式。
呼叫转移设置为用户提供了以下选项：

将呼叫转移到另一个号码、人或语音邮件
在其他号码上同时振铃，包括团队成员的号码
使用 Lync Server 2010 助理指定一个代理来代表他们接听和发起呼叫
将在指定时间内未应答的呼叫重定向到另一个号码、联系人或语音邮件

请勿打扰
企业语音提供了一种可靠的呼叫转移和请勿打扰功能，它们与 Lync 2010 的富状态模型相集成，使用户能够更好地掌控他们的时间和工作日。例如，如果用户手动将他或她的状态设置为请勿打扰，Lync 2010 会自动将不是来自团队成员的所有呼叫转移到语音邮件。
呼叫授权
管理员能够灵活地控制谁被授权进行电话呼叫，所以他们可以允许某些用户发起某些呼叫（例如国际电话）。
呼叫上下文
与使用 Lync 2010 进行的其他对话一样，语音呼叫可以标记为高优先级或使用一个主题进行标记，当另一个Lync 2010 用户收到呼叫时将看到该主题。
呼叫日志
如果启用，一个日志会保存在 Outlook 2010 中的"对话历史记录"文件夹中，记录用户的所有传入和传出呼叫。如果在呼叫期间使用了 Microsoft OneNote® 来记录笔记，那么用户可以单击一个按钮切换到 OneNote 笔记。
统一消息
Lync 2010 和 Lync Server 2010 集成了 Microsoft Exchange Server 2010 中的统一消息功能。用户可以从主 Lync 2010 窗口或通过查看屏幕底部通知区域中的图标来了解他们是否有新语音邮件。Lync Server 2010 还能够动态或静态地将呼叫转移到 Exchange 统一消息，并允许用户连接到统一消息服务来更改他们的问候语或访问其他语音功能。
呼叫委派
委派功能支持用户将呼叫处理委派给一个或多个助手。当代理应答呼叫时，会通知管理人员呼叫已由谁应答。代理可以代表用户执行多个任务，包括筛选私人呼叫，拨出呼叫和发起会议。团队呼叫支持用户使他或她的传入呼叫同时向同事的电话振铃，可用于提供类似于群组呼叫代接、直接部门呼叫和桥接线路外观的功能。对指定用户的代理或团队呼叫联系人的数量没有实际限制。与需要管理员参与设置和更改的传统方法不同，委派和团队呼叫都可以由用户管理。
工作组呼叫排队和路由
管理员可以创建和配置一个或多个响应组来排队呼叫并智能地将其路由到目标代理。常使用包括IT 服务台、人力资源热线和其他内部、非正式的联系中心。响应组可以包含交互式语音响应，具有自动语音识别和合成功能。他们可以基于代理状态和标准路由算法（包括顺序、并行、最长空闲和循环）将呼叫路由给代理。除了包括夜间服务、优先级排队、延迟通知、拦截处理、直接部门呼叫、统一呼叫分配和中继全部应答分机的智能寻线，还可以配置响应组来执行各种传统功能。最重要的是，可以免费包含它。
Enhanced 9-1-1
对于北美用户，Lync Server 2010 支持 Enhanced 9-1-1 服务，使用了一种类似于 National Emergency Number Association (NENA) i2 Architecture for Enhanced 9-1-1 Services 的方法。在发生紧急事件时，IP 用户分机的物理位置信息会在一个会话初始协议 (SIP) 呼叫设置消息中发送到一个 Enhanced 9-1-1 服务提供方，并有服务提供商将呼叫路由到适当的公共安全应答点 (PSAP)。这一体系结构允许客户将 Enhanced 9-1-1 服务扩展到所有用户（包括移动用户和固定电话用户），通过消除在每个地点配置地方应急中继并维护基于运营商 PS ALI 的 IP 分机数据库，降低拥有成本。
随处访问
Lync Server 2010 通过 Internet 将丰富的呼叫功能扩展到远程和移动用户。呼叫媒体和信号分别使用安全实时传输协议 (SRTP) 和传输层安全性 (TLS) 加密，无需硬件和软件 VPN。优化的端点采用了一种自适应媒体堆栈，而可变比特率 RTAudio 编解码器智能地使用可用带宽在良好管理的网络（比如局域网）上提供卓越的质量，在非托管网络（比如 Internet ）上提供不错的质量。Lync Server 2010 还支持传统的编解码器，比如 G.711、G.722 和 G.723.1，以实现与传统 VoIP 解决方案的互操作性。
呼叫准入控制
管理员可以选择为在受限的网络链接上承载的 Lync Server 2010 语音和视频流量设置限制，指定在提供的会话超出限制之后要执行的操作。操作可以包括通过备用路径路由会话，或者拒绝会话。单独的语音和视频路由允许管理员对这些媒体类型设定不同的优先级，为各种媒体类型指定首选的和备用的路由。Lync Server 2010 呼叫准入控制是网络不可知的，不需要任何具体的供应商网络需求或设置。
与现有电话服务基础结构的互操作性
Lync Server 2010 使用标准和发布的接口来与现有基础结构进行互操作。与 IP PBX 系统和公用电话交换网 (Public Switched Telephone Network, PSTN) 互连的网关和 SIP 选项允许公司随时将用户迁移到 Lync Server 2010 企业语音，同时最大化现有投资的回报并最小化干扰。针对网关、IP PBX 系统和 SIP 中继提供商的 Microsoft 统一通信开放互操作性计划 (Microsoft Unified Communications Open Interoperability Program) 旨在确保客户能够使用 Microsoft 统一通信软件无缝地体验合格产品和服务的设置、支持和使用。
分支机构自存活设备
Lync Server 2010 与第三方可分支机构自存活设备（Survivable Branch Appliances）合作，在 WAN 或数据中心出现故障时，提供本地呼叫服务和 PSTN 连接。
1. 协同办公与企业应用集成
文件传输功能
用户可以通过即时消息软件，快速进行文件传送，从而减轻电子邮件系统的传输和存储负荷。邮件系统往往对邮件的附件大小有严格的限制，大文件会被拒绝发送。而对于较大的文档，如果通过MSN传输，由于通过互联网，往往速度很慢，并且是不安全的。通过部署在企业内的即时消息系统进行传输，不仅速度较快，而且又能够通过加密协议安全地将文件直接投递到对方的硬盘。
桌面共享
用户可以通过Lync2010 共享桌面信息给他人，快速实现多人之间协作。用户可以直接发起或者在一个已有的IM或者音视频会议中发起。
利用Lync2010提供的功能，办公人员可以通过桌面终端实现点对点和多点的即时消息（会议）、应用共享、电子白板等功能。通过协作的能力，能实现客户桌面应用的远程维护。
利用Lync2010提供的功能，办公人员可以通过桌面终端实现点对点和多点的即时消息（会议）、应用共享、电子白板等功能。通过协作的能力，能实现客户桌面应用的远程维护。
与企业现有应用集成
微软的即时协作系统可以与企业最常用的办公软件Office集成，这就大大提高了用户的办公效率，从而提高已有系统的投资回报。例如，用户在编辑Word文档时，就能看到相关人员的在线状态信息，并与相关用户联系，协同编辑文档。另外，在现有的B/S或C/S应用系统中，集成用户状态信息和即时消息能力，也将大大提高办公效率。
比如，在门户的应用中集成用户的在线状态信息，将基于工作流的审批任务与即时通信平台集成，在即时通信系统的客户端上及时地收到待审批任务，并及时处理审批的需求。
与即时的通知应用进行集成，通过即时通信的平台实现分组的实时通知功能，包括系统管理员的各种管理告警通知以及各种紧急任务的及时通知。该通知功能实现了存储转发的模式，即在用户脱机的时候能将通知的内容进行存储，当用户再次联机时能立刻发送通知信息。
与现有应用的集成功能，包括与Word, Excel和Outlook等办公应用的集成功能，以及与各种其他办公业务应用在任务和通知等层面的集成功能是微软即时通信平台区别与我们的竞争对手的特点，通过集成充分地实现了即时通信的应用价值。
语音导航应用
将沟通方式和能力嵌入到业务流程之中。经过改进的全新客户端 API 允许开发人员直接调用受支持的、随时可用的代码段，将Lync 功能嵌入到基于 Microsoft Windows®和 Microsoft Silverlight® 的应用程序中。改进的服务器端 API 可以更加轻松地通过即时消息或电话发送信息和提醒、查找专家、实现Web 会话，并使用查询响应机器人和 IVR 提供自动化的自助服务。
与现有应用的集成功能，包括与Word, Excel和Outlook等办公应用的集成功能，以及与各种其他办公应用在任务和通知等层面的集成功能是微软即时通信平台区别与我们的竞争对手的特点，通过集成充分地实现了即时通信的应用价值。
1. 安全保障
即时消息保留
本地保留
通过与Outlook /Exchange 的整合，即时消息的内容可以保存用户的邮箱中，方便用户统一管理信息。
通讯内容存档
如果没有存档机制，用户很可能使用即时沟通工具进行大量与工作无关的聊天。而如果有了对通讯内容进行存档这个监督机制，员工就不会随意用它来进行聊天，也不会随意谈论一些敏感话题，而是主要用来进行与日常工作相关的沟通，从而达到充分利用企业投资的目的。
通过对内容的存档功能，能够保存与业务相关的即时通信信息，方便关键通信信息的保存。
1. 信息加密传输
基于Lync 的沟通内容，包括即时消息，网络会议， VoIP ，全部采用TLS加密，确保信息的安全。企业管理员可以强制所有用户端是使用加密传输。
1. 系统日志
Lync 具有丰富的服务器端日志和客户端日志，以及排错工具，可以保住部署、跟踪调试客户端和服务器的故障。
1. 管理策略
Lync 分客户端策略和服务器端策略，根据企业管理需求，可以分别设定用户的特定功能，如能否使用即时消息，能否发送文件，能否使用会议功能以及网路带宽的限制。
1. 与现有系统的集成
1. 与Polycom集成
微软/Polycom基于在线状态的一体化整体解决方案，可以保证系统中的各种设备兼容、协调稳定工作。二者的结合为用户提供了全面、先进、满足用户各个方面需求的整体解决方案。
微软/Polycom基于在线状态的一体化协作系统是一个符合最新国际标准，基于TCP/IP协议的开放的多媒体音视频协作系统。它综合了各种视频、音频和数据协作的先进技术于一身，在现有的网络上开展多媒体应用，适合视频会议、远程讨论交流、远程培训等会议应用，真正实现了多网合一。同时，本系统充分考虑了网络的扩展性，以适应网络的中长期发展。在网络结构、网络应用、网络管理、系统性能等各个方面均能适应未来多媒体应用的发展，最大限度的保护了用户的投资。
Microsoft Lync Server 2010 和 Microsoft Lync打造了一个依托于状态服务的一体化 IM,会议和企业话音的通讯基础架构。而 Polycom 则通过广泛的高清语音和视频终端产品，把这种用户体验延伸到了更广阔的空间。在 Polycom 解决方案中，实现了 CX 系列电话、HDX 系列视频会议系统、RPX 和 TPX 远程呈现套装产品与Lync的集成。
具体架构如下：

支持的集成场景

即点即呼功能：在 Microsoft Lync客户端中点击鼠标，即可呼叫 Polycom CX 电话、HDX 终端以及 RPX/TPX 系统，实现点对点通话。
微软Lync客户端通过参加Polycom RMX的会议室，实现多点会议视频。
Polycom 视频终端具备状态感知（Presence-aware）能力。
所有产品均会在Lync 上进行注册和身份验证，并使用即时消息、语音或视频来实现彼此之间的无缝通讯，通讯过程中还具备状态指示功能。
通过即时消息、语音和视频等媒介进行无缝通讯。

集成功能示例

终端好友列表：Polycom的视频终端可以注册到微软的Lync服务器上，像微软的UC软件一样显示好友列表和在线状态。在Lync客户端可以看到HDX高清视频会议终端和CX700电话的状态，在发起呼叫前获知终端是否可以接受呼叫。

Polycom视频会议终端可以看到Lync客户端的在线状态并可以通过联系人列表进行视频呼叫。

RMX虚拟会议室出现在Lync/OCS联系人列表上，用户点击即可加入多点通话。这样，商业用户就可以在PC和高品质视频终端上轻松开展协作，并保持与各方随时沟通。

点击呼叫：用户无需输入IP地址或视频号码，可以直接点击微软Lync/OCS的客户端或Polycom视频终端的好友列表发起呼叫，实现Polycom CX电话、HDX终端以及RPX/TPX系统直接的即时通讯。

任意互通：Polycom视频终端能够与微软Lync/OCS即时通讯软件实现音视频任意互通。

点对点互通：

Lync/OCS客户端能够与Polycom HDX进行音视频呼叫

PolycomCX700电话可以实现与Lync/OCS和Polycom HDX的语音通话

简单的多方会议

Lync/OCS客户端可以通过拨打RMX2000虚拟会议室加入多方会议；Polycom RMX 2000可以召集多台Polycom终端和Lync/OCS客户端加入同一会议

统一目录：另外Polycom的管理系统支持与微软的AD目录服务器集成，为企业用户提供统一的帐户管理。

系统版本

系统	版本
Microsoft Lync	2010
Polycom RMX	(2000, 4000) v4.0.1
Polycom HDX Series	4000+, v2.5.0.3
Polycom TPX/RPX	TPX HD 206M, RPX HD200, 400
Polycom CX Series	All

与电话系统集成

与电话系统的集成，Lync 2010可以通过Lync和企业已有的电话系统进行互联，将企业用户的的电话和电话会议延伸到电脑终端上，从而帮助用户更方便地利用企业已有的投资开展日常工作。

与Office系统集成

与Outlook的集成，可以在Outlook中通过察看联系人的在线状态、发起多种联系方式，可以和Outlook的日历集成，反映忙闲信息，同时将在线状态自动设置为适当的状态，可以和Outlook的OOF信息集成

与Word/Excel的集成，可以通过内置的智能标签反映联系人的在线状态和发起多种联系方式

与门户系统集成

与Windows Share point Service的集成，可以通过现成的成员Web部件反映网站用户的在线状态、发起多种联系方式，在文档库等应用和列表中，都已集成了联系人在线状态显示和联系方式发起的功能。

与其它业务系统集成

与业务系统的集成，通过微软提供的Presence控件将联系人的在线状态嵌入企业应用、通过RTC API使得企业应用系统可以通过SIP和相应的联系人通讯、通过Lync2010的客户化将业务系统的Web界面嵌入Lync标贴中，Lync2010也可将当前的用户SIP ID传递给应用系统
通过Lync中机器人的功能实现与其他办公应用系统的集成。包括实现各种通知功能以及与审批通知任务的集成。

系统配置建议

基于Lync2010构建的系统可以满足某某对统一通讯的众多要求，切实帮助某某提高员工的工作效率。与此同时， Lync 2010还提供非常灵活的架构支持，不同企业可以针对自身需求采取不同的配置，包括支持高可用性的架构、支持灵活扩展的架构或者选择简单的架构，以最少的投入来获得最大的回报。

高可用性的配置屏蔽了单点故障，使得当一个服务器节点失效时，另外的可用的节点能够进行服务的接管。可伸缩性的配置可以保证当即时沟通平台的使用用户增加时，该平台应该具有良好的可伸缩性，能非常方便地进行扩展。

Lync 2010支持企业池的概念，所谓企业池就是在一个服务器池中放置多台Lync服务器，从而可以更好地支持用户的扩展。一个Lync企业服务器池能支持最多达10万的用户。当用户更多时，可以通过扩展多服务器池来支持。这种可扩展的架构也是企业选择企业级的即时通信平台需要重点考虑的问题。

配置架构图

考录到某某用户规模，前期设计架构图如下：

下面对此配置架构进行简单的描述和说明：

部署Windows sever 2008;Exchange 2010 和Lync 2010系统的用户帐号信息是存储在活动目录中的，因此部署Exchange 2010 和Lync2010首先要部署活动目录服务。

即时消息会议服务器池

部署Lync2010服务器，实现即时消息、音频视频会议、网络会议以及VoIP通话等系统服务。

池数据库集群

部署SQL 2008；存放Lync 的用户联系人状态，以及归档数据等，

归档服务器

部署Lync 2010 ; 实现即时消息的归档保留功能。

即时消息会议边缘服务器

部署Lync 2010,;外部用户，要访问内部即时消息系统，可以通过部署在DMZ区中部署的Lync边缘服务器，由它来转发请求。外部用户无需VPN,就可以安全访问内部即时消息系统。Lync边缘服务器是和外部即时消息服务进行通讯的服务器角色。

反向代理服务器

实现内部网络的发布，如Exchange 的移动访问， Lync 的会议访问等，部署的服务器是微软的TMG 2010版本.

中介服务器

部署Lync2010;负责与VoIP 网关连接，做编码转换，可以与FrontEnd 部署在一台服务器上。

容量规划

毫无疑问，微软的Lync 2010为企业提供了功能强大的实时协作工具，通过利用Lync 2010，用户可以极大地提高自己的工作效率，因此，规划和部署一个满足企业要求的Lync 2010协作环境对企业来讲非常重要。不同的企业对实时协作系统有不同的要求，基于不同的用户模型，系统对物理设备和网络环境的需求也会各不相同，本节的内容基于以下的用户模型考虑---那就是所有用户都需要能够使用即时消息、Web会议、音视频会议以及语音集成功能。

规划结构	服务器数量	支持的最大用户数
标准版Lync 2010服务器	1台标准版Lync 2010服务器（可选） 1台归档服务器	5,000
企业版池：集中部署	4台企业版Lync 2010前端服务器运行所有服务 1台后端SQL Server （可选）1台归档服务器	30,000
企业版池：扩展配置（中等性能的后端SQL服务器）	4台前端Lync 2010服务器 2台Lync 2010 Web会议服务器 2 Lync 2010音频/视频会议服务器 2台IIS服务器 2台后端SQL服务器（可选）1台归档服务器	50,000
企业版池：扩展配置（高性能的后端SQL服务器）	8台前端Lync 2010服务器 4台Lync 2010 Web会议服务器 4台Lync 2010音频/视频会议服务器 2台IIS服务器 2台后端SQL服务器（可选）2台归档服务器	125,000

边缘服务器拓扑设计基于如下的假定：总用户数的10%的企业用户需要从企业外部网络连接到部署在企业内网的Lync 2010服务器。具体设计时可以参考下表确定边缘服务器的规划：

规划架构	支持的用户连接数
独立的Access Edge Server	15,000
独立的Web Conferencing Edge Server	3,000
独立的A/V Edge Server	1,500并发音频/视频会话
集中部署的Access Edge & Web Conferencing Edge Server	Access Edge Server: 5,000 Web Conferencing Edge Server: 1,500
集中部署的Access Edge, Web Conferencing Edge & A/V Edge Servers	Access Edge Server: 5,000 Web Conferencing Edge Server: 1,000 A/V Edge Server: 500并发音频/视频会话注：为了保证用户的音频/视频会议体验，我们建议部署单独的A/V Edge Server

通常情况下我们建议为有外部用户访问请求的实时沟通环境部署Lync 2010的Director角色。

网络带宽需求

音视频需求
为了保证达到良好的效果，我们建议为每路音频流提供45Kbps的带宽资源，为每路视频信号预留150至250Kbps的带宽资源。
注：Lync 2010提供丰富的策略用于控制多方音视频会议所带来的带宽压力，我们可以根据不同用户的情况降低他们所使用的视频会议的分辨率或者干脆禁用部分用户的视频功能。

Web协作会议需求

应用共享大概为50Kbps，会议内容下载根据上载的内容量而定。

软件配置

下面的配置表是软件配置建议

序号		软件产品名称	数量	ERP价格（人民币：元）	小计（人民币：元）	备注
统一沟通平台	1	Lync Server 2010标准版
	2	Lync Server 2010企业版
	3	Lync Standard Cal				按实际用户数购买
	4	Lync Conference Cal
	5	Lync Plus Cal
	6	Lync 2010
	7	SQL 2008 标准版
合计

硬件配置

具体的硬件的配置的情况，取决于对系统的性能要求。在总行服务器按从高可用性配置来进行配置和部署。具体的配置情况如下：

序号	服务器	数量	CPU core	内存	备注
1	Lync 服务器		8	8G
2	Lync Edge服务器		4	8G	连接外网使用
3	SQL数据库		16	16G
4	Lync 归档服务器		4	4G
7	电话语音网关
8	硬件负载均衡器				如果要靠可用，此为建议选项。推荐使用F5

Lync平台的优势
可靠性

采用高容错性、可靠和基于业界标准的目录服务做为用户验证和用户信息存储，使得用户管理和处理的可靠性有了有力的保障
采用企业级的数据库SQL Server作为信息存储，SQL Server支持高可用性设计的集群服务，使得后台的数据存储和管理的可靠性大大提高
支持前后端服务器结构，前端服务器通过负载均衡提高可用性

安全性

服务器之间强制采用加密的MTLS通道，通讯有很高的安全性
客户端与服务器端之间可选高安全性的MTLS协议
通过前端服务器和后端服务器分布式部署，使得存有用户数据的后端数据库不需要暴露在外网，提高了安全性

可扩展性

Lync企业版服务器池，可以使多台服务器共同承担负载，使得系统能力可以随同用户需求一同无缝增长。

附：Lync部分国内客户名单

中石油
中石化
中国工商银行
国家开发银行
上海烟草
四川烟草

1.1应用Office Communications Server 2007 R2更新 3

从ocsR2迁移到LYNC

2011-10-08T04:52:00Z

一、准备迁移 3

1.2运行最佳实践工具 4

1.3、备份系统和数据 4

1.4、配置客户端和迁移 5

二、部署Lync Server 2010 池 5

2.1、Lync Server 2010 池体系架构 5

2.2 部署Lync Server 2010 池 6

四、迁移Exchange UM相关设置 20

4.1迁移Exchange UM联系人对象 20

4.2 运行 ExchUCUtil.ps1 Windows PowerShell 脚本 22

4.3、使用OCSUmUtil工具检查um联系人状态 22

6.1、使用DBIMPEXP备份用户数据 25

6.2、移动所有用户到LYNC池 26

6.4另类迁移 29

准备迁移

1.1应用Office Communications Server 2007 R2更新

在您迁移到 Microsoft Lync server 2010服务器之前必须将更新应用于您的 Microsoft Office Communications Server 2007 R2 环境中。下面列出了所需的更新。

有关Office Communications Server 2007 R2 更新有关的最新信息请参阅Office Communications Server 2007 R2 and Clients资源更新中心

Microsoft Office Communicator 2007 R2

http://go.microsoft.com/fwlink/?LinkId=204763

Microsoft Office Live Meeting 2007

http://go.microsoft.com/fwlink/?LinkId=204764

Microsoft Office Live Meeting Conferencing Add-In

http://go.microsoft.com/fwlink/?LinkId=204765

Office Communications Server 2007 R2

http://go.microsoft.com/fwlink/?LinkId=204766

Microsoft Office Communicator 2007 R2 Phone Edition

http://go.microsoft.com/fwlink/?LinkId=204767

1.2运行最佳实践工具

我们建议您在客户端上安装此工具，Office Communications Server 2007 R2管理工具也要安装在客户端上，以便最佳实践工具可以收集一套完整的数据，来确定是否符合微软的最佳部署。

Office Communications Server 2007 R2最佳实践工具下载地址，http://go.microsoft.com/fwlink/?linkid=144315.

1.3、备份系统和数据

在您开始迁移到 Microsoft Lync server 2010 之前我们强烈建议您执行完整的系统备份和Office Communications Server 2007 R2服务器上的所有数据信息，以便您可以回滚到 Microsoft Office Communications Server 2007 R2您现有的系统。多个工具和程序可用于备份和还原数据，详细信息请参阅，http://technet.microsoft.com/en-us/library/dd572319(office.13).aspx

1.4、配置客户端和迁移

本主题包含迁移到 Microsoft Lync server 2010之前应采取的客户端部署步骤。这些配置更改应该Microsoft Office Communications Server 2007 R2上。有关详细信息，请参阅规划客户端迁移规划文档，以下是相关步骤：

应用Office Communications Server 2007 R2的最新更新
在Microsoft Office Communications Server 2007 R2上，使用客户端版本筛选器允许使用最新客户端更新的版本来登陆
在Microsoft Office Communications Server 2007 R2上，使用客户端版本筛选器组织Lync客户端来登陆。以下列出了Lync的客户端版本

客户端	用户代理标头	版本号
Lync 2010	OC	4...*
Lync web app	CWA	4...*
Lync2010 Phone Edition	OCPhone	4...*
Lync 2010 Attendee	AOC	4...*

二、部署Lync Server 2010 池

2.1、Lync Server 2010 池体系架构

下图显示Lync池参考拓扑。 Lync server 2010 与现有的 Office Communications Server 2007 R2 安装在一起。用户连接到Office Communications Server 2007 R2池上，所有的工作流负载在这台服务器上。

在合并拓扑后几个测试用户将迁移到 Lync server 2010 服务器上,测试用户可以继续跟Office Communications Server 2007 R2上的用户通讯。

下表列出了在此拓扑中使用的各种服务器角色的完全限定的域名。只做参考:

服务器角色	OCS2007 R2 FQDN	Lync 2010 FQDN
标准版前端	SE-R2.CONTOSO.NET	LYNC-SE.CONTOSO.NET
边缘服务器	EDGE-R2.CONTOSO.NET	LYNC-EDGE.CONTOSO.NET
Director	DIR-R2.CONTOSO.NET	LYNC-DIR.CONTOSO.NET
中介	MEDSVR01.CONTOSO.NET	LYNC-SE.CONTOSO.NET（前端合并）

2.2 部署Lync Server 2010 池

部署完Lync Server 2010 池以后您将合并Office Communications Server 2007 R2的池拓扑信息和配置设置。该Lync Server池与您的Office Communications Server 2007 R2共存。共存只是一种临时的状态，直到您移动所有的用户到Lync池。您应该在您的企业环境中部署相同功能和负载。

1、在您部署LYNC服务器时，您可以选择部署一个企业版或者标准版。

2、在选择配置服务器角色页面，您必须选择配置 Lync server 2010中介服务器。当合并一个ocs拓扑结构与 Lync server 2010时，我们要求您首先配置 Lync server 2010中介服务器，您可以决定部署一个独立的服务器或跟Lync的前端部署在一起.

3、在部署过程中不要选择部署边缘服务器这是您在迁移以后阶段的功能。

2.3验证池共存

在Office Communications Server 2007 R2管理工具中验证池

打开Office Communications Server 2007 R2管理工具
展开林，展开标准版，点击服务器名称
在右面查看服务在正常运行

在Lync server控制面板中验证池

1、打开Lync server控制面板

2、单击拓扑

3、验证您部署的服务器在池中

验证Lync 服务运行正常

1、在Lync服务器上，打开管理工具-服务

查看服务运行正常。

2.4、验证客户端配置

1、找一个Office Communications Server 2007 R2服务器上的测试用户，添加一个Lync上的一个用户，并发送消息，发现这时联系人状态是不可用的，消息也无法到达

2、分别登陆ocs与Lync客户端，在客户端上方输入一个电话号码，发现只有ocs客户端的用户能匹配正规表达式，Lync客户端无法匹配。

三、合并拓扑

3.1、安装WMI向后兼容包

运行拓扑生成器合并向导之前，您必须安装WMI向后兼容性软件包。如果在合并拓扑时，不安装WMI向后兼容性软件包，你将收到以下错误。

导航到光盘\SETUP\AMD64\SETUP\下面
找到OCSWMIBC.MSI右键安装

3.2使用拓扑生成器合并拓扑

拓扑生成器是 Microsoft Lync server 2010推出的新工具。通过拓扑生成器，您可以创建、编辑，和发布 Lync server 2010部署拓扑。此外，合并功能允许您从您以前的ocs环境中导入信息，并将其集成到一个整合的视图。

1、打开拓扑生成器，右键Lync2010，选择合并ocs2007或ocs2007 r2拓扑。

2、出现向导后，点击下一步

3、点击添加边缘服务器

4、选择ocs2007r2边缘服务器

5、选择单一边缘服务器

6、填写边缘服务器的相关

7、发布成功

8、完成拓扑合并

3.3导入策略

使用Import-CsLegacyConfiguration命令将ocsr2中的语音、会议、远程访问等相关策略导入到Lync服务器中。

3.4、验证拓扑合并

1、分别登陆OCS客户端和LYNC客户端，并添加对方发送消息，看是否能够通信

2、在LYNC客户端上键入一个电话号码，看是否能够匹配。

四、迁移Exchange UM相关设置

4.1迁移Exchange UM联系人对象

1、使用Get-CsExUmContact命令，查询UM联系人对象

2、使用"xiaoxi" | Move-CSLegacyUser –Target pool.winos.cn –Verbose命令将um的联系人对象移动到LYNC的池中

4.2 运行 ExchUCUtil.ps1 Windows PowerShell 脚本

在Exchange 服务器上，然后运行 ExchUCUtil.ps1 Windows PowerShell 脚本。此脚本将：

授予Lync 服务器读取域服务UM 对象的权限

创建统一消息 IP 网关

创建统一消息查寻组。

4.3、使用OCSUmUtil工具检查um联系人状态

在LYNC服务器上打开OCSUmUtil工具，查看UM联系人状态是否正常

五、迁移响应组到Lync池

5.1、迁移原有响应组到目标池

在ocs服务器上响应组有2个

使用命令Move-CsRgsConfiguration -Source se-r2.contoso.net -Destination lync-se.contoso.net将原池中的响应组迁移到LYNC池

5.2、验证LYNC池中的响应组

打开LYNC控制面板，点击相应组，点击工作流，查看原池中的响应组已经迁移到了目标域

六、迁移所有用户到LYNC池

6.1、使用DBIMPEXP备份用户数据

在ocsr2服务器上，使用DBIMPEXP工具将用户数据备份到一个路径下

打开备份完成的xml，验证没有问题

6.2、移动所有用户到LYNC池

打开LYNC控制面板，添加筛选器Legacy USER，筛选出旧池中的用户。

点击ACTION，在下拉列表中选择移动所有用户到池

选择LYNC的池，点击ok

用户已经移动到了LYNC池下面

用户登陆LYNC客户端，原有的组也都保留，迁移完成后，还需要在LYNC池中核对语音策略等信息，然后做进一步的测试。到此迁移结束。

6.4另类迁移

如果我的ocsr2服务器想升级成LYNC但是我只有一台服务器，还是想从原有的服务器上来进行升级。方法如下：

备份用户数据
卸载ocs服务器
安装新的LYNC服务器
为用户启用LYNC用户
将数据导入到LYNC服务器上

因为之前我已经做过用户的备份了，在这我就不演示如何备份了，这时王洋用户中一个组也没有，但是在备份之前是有一个用户的。

将数据导入到LYNC服务器中

重新登陆LYNC客户端，发现原来备份的组信息已经还原到了。