You might have noticed that Microsoft recently released some important hotfixes for Windows Server 2012 Hyper-V Clusters. These are You cannot add VHD files to Hyper-V virtual machines in Windows Server 2012 and Update that improves cluster resiliency in Windows Server 2012 is available

So how do you deploy these easily and automatically to your Windows Server 2012 Clusters? Cluster Aware Updating! Here’s a screenshot of cluster Aware Updating in action deploying these hotfixes without a single interruption to the business services.

So what are you waiting for?Start using it Smile It will make your live easier, save time, and help you with continuous available infrastructure.

Here’s a link to the slide deck of a presentation I did on Cluster Aware Updating in a TechNet webcast http://www.slideshare.net/technetbelux/hands-on-with-hyperv-clustering-maintenance-mode-cluster-aware-updating

We’ve been enjoying the benefits of Windows Server 2012 since we got the RTM bits in August 2012. I can highly recommend it to everyone.

As an early adopter of Windows Server 2012 it’s not about being the fist it’s about using the great new features. When you leverage the Cluster Aware Updating (CAU) Plug-in to deploy hardware vendor updates like those from DELL which are called DUPs (Dell Update Packages) you have the option to to log the process via parameter /L

This looks like this in the config XML file for the CAU (I’ll address this XML file in more details later).

As you can see I use a file share as I don’t want to log locally because this would mean I’d have to collect the logs on all nodes of a cluster. Now if you log to file share you need to do two things that we’ll discuss below.

1. Set up a share where you can write the log or logs to

Please note that you cannot and should not use the CAU file share for this. First off all only a few accounts are allows to have write permissions to the CAU file share. This is documented in How CAU Plug-ins Work

Only certain security principals are permitted (but are not required) to have Write or Modify permission. The allowed principals are the local Administrators group, SYSTEM, CREATOR OWNER, and TrustedInstaller. Other accounts or groups are not permitted to have Write or Modify permission on the hotfix root folder.

This makes sense. SMB Signing and Encryption are used to protect tampering with the files in transit and to make sure you talk to the one an only real CAU file share. To protect the actual content of that share you need to make sure now one but some trusted accounts and a select group of trusted administrators can add installers to the share. If not you might be installing malicious content to your cluster nodes without you ever realizing. Perhaps some auditing on that folder structure might be a good idea?

This means that you need a separate file share so you can add modify or at least write permissions to the necessary accounts on the folder. Which brings us to the second thing you need to do.

2. Set up Write or Modify permissions on the log share

You’ll need to set up Write or Modify permissions on the log share for all cluster node computer accounts. To make this work more practically with larger clusters please you can add the computer accounts to an AD group, which makes for easier administration).

The two nodes here have permissions to write to the location

As you can see the first node to create the loge file is the owner:

Some extra tips

The log can grow quite large if used a lot. Keep an eye on it so avoid space issues or so it doesn’t get too big to handle and be useful. And for clarities sake you might get a different log per cluster or even folder type. You can customize to your needs.

Working Hard In IT

My view on IT from the trenches

Tag Archives: Hotfix Plug-in

Windows Server 2012 Cluster Aware Updating In Action