Uncategorized

I have read this question a lot over the years:

“….because ESXi 5.0 is the golden version for us that just works, and the uptime is well over 100+ days, do you think scheduled monthly reboots of hosts are worth it? “

I can ensure you there is no secret to it ,the latest ESXi version is 7.0 according to the supplier.

Now back to those 100+ uptime days :

To be able to reboot or shut down a host, you need these privileges.

• Host.Configuration.Maintenance
• Global.Log event

Always perform the following tasks before you reboot or shut down a host:

• Power off all virtual machines on the host.
• Place the host in maintenance mode.

The best practices recommended by VmWare in terms of ESXI reboot are :

Good question, there does not seem to be a best practice guide on VmwareDocs that can support this topic.

But what happens really if a host is up for a longer than 50 days so to say ( if you have 3000+ hosts of course you will need an army of people only for the Vmotions) ?

Well in the windows world services die, manual interventions create incidents, VM`s  can lag without a reason etc. So it is advisable to reboot the ESXI Once in a While.

At a former customer of mine with a fairly big ESX Infrastructure, there were already set maintenance windows and ESXI Hosts were rebooted every 90 days. The delay is subject of discussion, but as always it is better to have them rebooted and healthy, than up and half way dead.

Who has ESXI 5.0 in 2022?

Most people say no one and many say I don`t know. The second statement is quite scary actually.

But migrating from 5.0 to 7.0 seems such an easy next ,next,next task . Is it though ?

The short and painful answer is NO, because you can upgrade to ESXi 5.1, 5.5 or 6.0 and ultimately to 7.0 but think about it mathematically. Four upgrades equal 4 times the potential problems and maybe, just like I saw it in the middle of an upgrade in 2021 one ESXi died and took all the data with him (luckily most could be restore, but it was a huge effort).

So my personal short answer is Keep It Simple, upgrade directly to 7.0 with the prerequisites respected and a well put in place / tested recovery plan.

The upgrade scenarios are quite limitless, Test envirinement first and the rest after.

Divide hosts in two categories an define which one goes first.

Split Windows hosts from linux hosts and so on.

The Vmware infrastructure can be very strong and resilient but pushing it to it`s boundaries is a risk and like many Ransomware Infections have prooven it, it is better to manage risk than manage disaster!

An antivirus product is a program designed to detect and remove viruses and other kinds of malicious software from your computer or laptop. It includes some services that may help protect you against unauthorized programs, spyware (adware), rogue Trojans (“worms”) as well any security threat.

Malicious software – known as malware – is code that can harm your computers and laptops, and the data on them. Your devices can become infected by inadvertently downloading malware that’s in an attachment linked to a dubious email, or hidden on a USB drive, or even by simply visiting a dodgy website. Once it’s on your computer or laptop, malware can steal your data, encrypt it so you can’t access it, or even erase it completely. For this reason it’s important that you always use antivirus software, and keep it up to date to protect your data and devices. A good idea would be Windows Defender Advanced Threat Protection (at least from version 1706) on all your pc`s and not disable it.

Also a Managed Malware solution like Malwarebytes Enpoint Protection could deliver you qn email every time an abnormal behaviour occurs, or simply automatically quarantine the threat.

Now back to malware, you found a USB drive in the parking lot ? please by all means do not directly plug it in your computer or in any company pc ! Bring it to an automated Cleaning station for external devices (most companies have one) , have it checked and cleaned. Avaddon for example only needs a small contact with a device to inject it`s payload and spread it on all the infrastructure. I have seen a case of infection and it was nasty, it has almost closed the business.

Do I need antivirus products on my smartphone and tablet?

Yes you do, no matter what others say with you only install licensed/safe software on the G Store . No, you don`t , there are tones of dodgy apps on the G store that spy, damage and pollute your device, that is a known fact.

An unprotected phone or tablet is a open door for damaging payloads. I have seen several totally damaged (software wise ) phones to say , they need threat protection and Anti Concrete protection ( for some weird reason glass always breakes when falling on concrete).

There are many splendid products on the market that can protect your phone or tablet, try some out and you will see what their scans show ( you will be surprised).

Funny story I read on a blog :

I had a guy complaining that his computer had been hacked (of course every time anything strange ever goes wrong, it’s been “hacked”) because whenever he booted the computer, opened a program, closed a program, whatever, the entire theme song to Reading Rainbow would play. The computer hadn’t been hacked, he had just left it unattended and someone came by and set every single Windows sound to play the whole song. I changed the theme and was done. Lesson learned: never leave a computer unattended because there are tricazksters out there!“

Ya all stay safe.

After the February 2021 Windows Updates on Windows 10 , some users complained about their Gemalto ID Prime not being recognized any more or showing the above message.

To note that , ID prime certificates are on the SIM card and will auto transfer to the proper place in order to work.

The first order of business is to look inside the IE options/Certificates if the proper Gemalto one is present.

Open IE properties via Win + R and type inetcpl.cpl

Mysteriously the certificates evaporated .

You cannot import them from the ID prime.

The missing certificates here are a hint, but not the main issue.

Windows logs do not say much as the device inserted is recognized and patched automatically with the standard driver that does not do much.

When plugging in the Gemalto token in a device you will see the following come and go and hear the associated bell :

This will lead you on a wild goose chase, as updating that driver is not solving anything

The below one is the Prime suspect :

If under smart cards you can see written Unknown, than the gemalto MiniDriver needs to be re-installed :

The proper .cab file containing the Minidriver can be found at :

https://www.catalog.update.microsoft.com/Search.aspx?q=Gemalto%20IDPrime%20MD

If you are using Intune you can deploy it to a group of users, or whatever floats you boat:

You can monitor the deployment in the Overview :

Deployment of apps and packages via SCCM and Intune are widely available.  So I assume for a Sysadmin this is a basic task ,I will not do a step by step.

In case of questions, drop me an email, I always reply.

The Problem Is not in Bios:

It needs AHCI Boot

Fast boot

‘optional secureboot’

In my case some pc’s in my infrastructure had a dimmed display boot:

Some would advocate for hardware failure (without any substantial proof). Let’s first rule out software before attacking the screws.

Plug in a VGA,HDMI,DVI ect cable on the sucker and let it boot.

If you see any sort of dimmed SECOND screen, almost impossible to see, but with some information about windows , you have a Software issue.

For some reason Windows 8 screws up the Aditional Screen Config in the registry, and incapacitates the Video Driver.

In my case it has replaced the values for the Nvidia car  inside the registry under :

HKEY_LOCAL_MACHINE\SOFTWARE\NVIDIA\global\nvUpdate

This is usually 1

I have added the correct value but the Driver was still busted.

Started having doubts about the HDD so I performed a :  chkdsk C: /f /r /x

Nothing conclusive….

Let’s take the bazooka to kill the fly, as too much effort in troubleshooting an isolated case. 

Let’s install Windows 10 on the device.

The device consumed about 30 minutes to install the W10 Image, and about 20 minutes after the OS has been installed and booted correctly it has identified also some windows updates but also the Graphics Drivers.

After installing all the WU’s the issue was gone.

This is where SCCM comes in to play, captured the full image and added it in a Task sequence.

Created a Direct Membership Collection with the Problematic devices (after checking they were backed up correctly (user perspective))

Deployed the TS to the devices in the evening, notified the impacted users via Ivanti.

Next day the users had windows 10 on the devices and where thrilled.

This incident convinced management that a W10 rollout would be strongly recommended even if extended support is still there.

Spitt the devices in pilots, and in a couple  of days all devices have been upgraded.

Lessons learned by the customer, there is some argumentation behind end of mainstream support.

In some instances the SCCM Console lags even though you have done the proper steps to optimize it.

What to do?

1.      Make sure SQL Server CE compatibility level is corrects, connect to your Database,select the correct DB and Run Query:

SELECT name, compatibility_level FROM sys.databases

2.      The Following should usually be 110,

      The query to set this is :

ALTER DATABASE <CM_DB(replace with your DB name)>

SET COMPATIBILITY_LEVEL = 110;

GO

3.      Unfortunately in many, many cases this does not solve the issue. Next step is re-install the console. The problem can be user related.

4.      Install the console via  folder (Program Files\Microsoft Configuration Manager\tools\ConsoleSetup) the folder mentioned on Technet varies …

5.      If the issue in still not solved you might need to check the DB one more time : 

Beware of large tables in your MEM Database. These may severely impact performance on insert and read operations, depending on the server’s resources:

These are typically your Tables that are > 10GB in size, or have > 10 million rows

Example: dbo.SoftwareInventory

Effect: slow collections or reports processing while querying that table

Example: DRSReceivedMessages

Effect: DRS links degrading, replication issues

If none of the above show results, there might be also some IIS issues, open a case with Microsoft or send me a comment with your issue, I’ll do my best to help you.